@emailens/engine 0.12.1 → 0.12.2

package/dist/{chunk-UFSYNSDP.js → chunk-KKWC2C3R.js}

@@ -205,7 +205,7 @@ async function executeInIsolatedVm(code, React, ReactEmailComponents) {
     ivm = (_a = ivmMod.default) != null ? _a : ivmMod;
   } catch (e) {
     throw new CompileError(
-      'Sandbox strategy "isolated-vm" requires the "isolated-vm" package. Install it:\n  npm install isolated-vm\nOr use sandbox: "vm" for a lighter (but less secure) alternative.',
+      'Sandbox strategy "isolated-vm" requires the "isolated-vm" package. Install it:\n  npm install isolated-vm\nOr pass sandbox: "vm", which needs no native addon and is NOT a security boundary: code you compile can reach the host process and its environment. Only choose it for templates you already trust.',
       "jsx",
       "execution"
     );
@@ -280,7 +280,7 @@ async function executeInQuickJs(code, React, ReactEmailComponents) {
     ({ getQuickJS } = await import("quickjs-emscripten"));
   } catch (e) {
     throw new CompileError(
-      'Sandbox strategy "quickjs" requires the "quickjs-emscripten" package. Install it:\n  npm install quickjs-emscripten\nOr use sandbox: "vm" for a lighter alternative.',
+      'Sandbox strategy "quickjs" requires the "quickjs-emscripten" package. Install it:\n  npm install quickjs-emscripten\nOr pass sandbox: "vm", which needs no native addon and is NOT a security boundary: code you compile can reach the host process and its environment. Only choose it for templates you already trust.',
       "jsx",
       "execution"
     );
@@ -356,4 +356,4 @@ async function executeInQuickJs(code, React, ReactEmailComponents) {
 export {
   compileReactEmail
 };
-//# sourceMappingURL=chunk-UFSYNSDP.js.map
+//# sourceMappingURL=chunk-KKWC2C3R.js.map

package/dist/chunk-KKWC2C3R.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/compile/react-email.ts"],"sourcesContent":["import { CompileError } from \"./errors.js\";\n\n/** Maximum source code size: 256KB */\nconst MAX_SOURCE_SIZE = 256_000;\n\n/** Execution timeout: 5 seconds */\nconst EXECUTION_TIMEOUT_MS = 5_000;\n\n/**\n * Sandbox strategy for JSX execution.\n *\n * - `\"vm\"`: `node:vm` with hardened globals. Fast, zero-dependency, and NOT a\n *   security boundary. The hardening removes `process`, `Buffer` and timers\n *   from the sandbox and sets `codeGeneration.strings: false`, but host\n *   intrinsics are passed in, and the `Function` constructor reached through\n *   one of them compiles in the *host* realm where that flag does not apply:\n *   `Object.constructor(\"return process\")()` returns the real process, and\n *   `process.env` with it. Demonstrated in the test suite. Use it only for\n *   templates you already trust, such as a developer compiling their own.\n *\n * - `\"isolated-vm\"` (default): Separate V8 isolate via the `isolated-vm`\n *   npm package. True heap isolation; escapes require a V8 engine bug.\n *   Requires `isolated-vm` to be installed (native addon).\n *\n * - `\"quickjs\"`: Validates code structure in a QuickJS WASM sandbox, then\n *   executes in `node:vm` for React rendering. Security is equivalent to\n *   `node:vm`: the QuickJS phase validates import restrictions only.\n *   No native addons needed, but only supports ES2020 and is slower.\n *   For true isolation on servers, use `isolated-vm`.\n */\nexport type SandboxStrategy = \"vm\" | \"isolated-vm\" | \"quickjs\";\n\nexport interface CompileReactEmailOptions {\n  /**\n   * Sandbox strategy to use for executing user JSX code.\n   * @default \"isolated-vm\"\n   */\n  sandbox?: SandboxStrategy;\n}\n\n/**\n * Compile a React Email JSX/TSX source string into an HTML email string.\n *\n * Pipeline:\n *  1. Validate input (size, basic checks)\n *  2. Transpile JSX/TSX → CommonJS JS using sucrase\n *  3. Execute inside a sandbox (configurable strategy)\n *  4. Render the exported component to a full HTML email string\n *\n * Requires peer dependencies: sucrase, react, @react-email/components,\n * @react-email/render. Additionally:\n *  - sandbox \"isolated-vm\" requires `isolated-vm`\n *  - sandbox \"quickjs\" requires `quickjs-emscripten`\n */\nexport async function compileReactEmail(\n  source: string,\n  options?: CompileReactEmailOptions,\n): Promise<string> {\n  const strategy = options?.sandbox ?? \"isolated-vm\";\n\n  // ── 1. Validate ──────────────────────────────────────────────────────\n  if (!source || !source.trim()) {\n    throw new CompileError(\"JSX source must not be empty.\", \"jsx\", \"validation\");\n  }\n\n  if (source.length > MAX_SOURCE_SIZE) {\n    throw new CompileError(\n      `JSX source exceeds ${MAX_SOURCE_SIZE / 1000}KB limit.`,\n      \"jsx\",\n      \"validation\",\n    );\n  }\n\n  // ── 2. Load peer dependencies ────────────────────────────────────────\n  let transform: typeof import(\"sucrase\").transform;\n  let React: typeof import(\"react\");\n  let ReactEmailComponents: typeof import(\"@react-email/components\");\n  let render: typeof import(\"@react-email/render\").render;\n\n  try {\n    ({ transform } = await import(\"sucrase\"));\n  } catch {\n    throw new CompileError(\n      'JSX compilation requires \"sucrase\". Install it:\\n  npm install sucrase',\n      \"jsx\",\n      \"transpile\",\n    );\n  }\n\n  try {\n    React = await import(\"react\");\n  } catch {\n    throw new CompileError(\n      'JSX compilation requires \"react\". Install it:\\n  npm install react',\n      \"jsx\",\n      \"transpile\",\n    );\n  }\n\n  try {\n    ReactEmailComponents = await import(\"@react-email/components\");\n  } catch {\n    throw new CompileError(\n      'JSX compilation requires \"@react-email/components\". Install it:\\n  npm install @react-email/components',\n      \"jsx\",\n      \"transpile\",\n    );\n  }\n\n  try {\n    ({ render } = await import(\"@react-email/render\"));\n  } catch {\n    throw new CompileError(\n      'JSX compilation requires \"@react-email/render\". Install it:\\n  npm install @react-email/render',\n      \"jsx\",\n      \"transpile\",\n    );\n  }\n\n  // ── 3. Transpile JSX/TSX → CommonJS ──────────────────────────────────\n  let transpiledCode: string;\n  try {\n    const result = transform(source, {\n      transforms: [\"typescript\", \"jsx\", \"imports\"],\n      jsxRuntime: \"classic\",\n      production: true,\n    });\n    transpiledCode = result.code;\n  } catch (err: unknown) {\n    const message = err instanceof Error ? err.message : \"Unknown transpilation error\";\n    throw new CompileError(`JSX syntax error: ${message}`, \"jsx\", \"transpile\");\n  }\n\n  // ── 4. Execute in sandbox ────────────────────────────────────────────\n  let moduleExports: Record<string, unknown>;\n\n  switch (strategy) {\n    case \"isolated-vm\":\n      moduleExports = await executeInIsolatedVm(transpiledCode, React, ReactEmailComponents);\n      break;\n    case \"quickjs\":\n      moduleExports = await executeInQuickJs(transpiledCode, React, ReactEmailComponents);\n      break;\n    case \"vm\":\n      moduleExports = await executeInVm(transpiledCode, React, ReactEmailComponents);\n      break;\n    default:\n      throw new CompileError(\n        `Unknown sandbox strategy: \"${strategy}\". Use \"vm\", \"isolated-vm\", or \"quickjs\".`,\n        \"jsx\",\n        \"execution\",\n      );\n  }\n\n  // ── 5. Extract component and render ──────────────────────────────────\n  let Component: unknown = moduleExports.default ?? moduleExports;\n\n  if (typeof Component !== \"function\" && typeof Component === \"object\" && Component !== null) {\n    const values = Object.values(Component as Record<string, unknown>);\n    const fn = values.find((v) => typeof v === \"function\");\n    if (fn) Component = fn;\n  }\n\n  if (typeof Component !== \"function\") {\n    throw new CompileError(\n      'The JSX source must export a React component function. ' +\n        'Use \"export default function Email() { ... }\" or ' +\n        '\"export function Email() { ... }\".',\n      \"jsx\",\n      \"execution\",\n    );\n  }\n\n  try {\n    const element = React.createElement(Component as React.FC);\n    const html = await render(element);\n    return html;\n  } catch (err: unknown) {\n    const message = err instanceof Error ? err.message : \"Unknown rendering error\";\n    throw new CompileError(`React rendering error: ${message}`, \"jsx\", \"render\");\n  }\n}\n\n// ─── Sandbox: node:vm ──────────────────────────────────────────────────────\n\n/**\n * Execute transpiled code in a node:vm context with hardened globals.\n *\n * NOT a security boundary, see node:vm documentation. Suitable for CLI\n * use where the user runs their own code. For server use, prefer\n * \"isolated-vm\" or \"quickjs\".\n */\nasync function executeInVm(\n  code: string,\n  React: typeof import(\"react\"),\n  ReactEmailComponents: typeof import(\"@react-email/components\"),\n): Promise<Record<string, unknown>> {\n  const { createContext, Script } = await import(\"node:vm\");\n\n  const ALLOWED_MODULES: Record<string, unknown> = {\n    react: React,\n    \"@react-email/components\": ReactEmailComponents,\n  };\n\n  const moduleExports: Record<string, unknown> = {};\n  const moduleObj = { exports: moduleExports };\n\n  const mockRequire = (moduleName: string): unknown => {\n    if (moduleName in ALLOWED_MODULES) {\n      return ALLOWED_MODULES[moduleName];\n    }\n    throw new Error(\n      `Import of \"${moduleName}\" is not allowed. ` +\n        `Only \"react\" and \"@react-email/components\" can be imported.`,\n    );\n  };\n\n  const sandbox: Record<string, unknown> = {\n    module: moduleObj,\n    exports: moduleExports,\n    require: mockRequire,\n    React,\n    Object, Array, String, Number, Boolean,\n    Map, Set, WeakMap, WeakSet,\n    JSON, Math, Date, RegExp,\n    Error, TypeError, RangeError, ReferenceError, SyntaxError, URIError,\n    Promise, Symbol,\n    Proxy: undefined, Reflect: undefined,\n    parseInt, parseFloat, isNaN, isFinite,\n    encodeURIComponent, decodeURIComponent, encodeURI, decodeURI,\n    undefined, NaN, Infinity,\n    console: { log: () => {}, warn: () => {}, error: () => {}, info: () => {}, debug: () => {} },\n    setTimeout: undefined, setInterval: undefined, setImmediate: undefined, queueMicrotask: undefined,\n    process: undefined, globalThis: undefined, global: undefined, Buffer: undefined,\n    __dirname: undefined, __filename: undefined,\n  };\n\n  const context = createContext(sandbox, {\n    codeGeneration: { strings: false, wasm: false },\n  });\n\n  try {\n    const script = new Script(code, { filename: \"user-email-component.tsx\" });\n    script.runInContext(context, { timeout: EXECUTION_TIMEOUT_MS, displayErrors: true });\n  } catch (err: unknown) {\n    const message = err instanceof Error ? err.message : \"Unknown execution error\";\n    if (message.includes(\"Script execution timed out\")) {\n      throw new CompileError(\"JSX execution timed out (possible infinite loop).\", \"jsx\", \"execution\");\n    }\n    throw new CompileError(`JSX execution error: ${message}`, \"jsx\", \"execution\");\n  }\n\n  return moduleObj.exports as Record<string, unknown>;\n}\n\n// ─── Sandbox: isolated-vm ──────────────────────────────────────────────────\n\n/**\n * Validate code in a separate V8 isolate, then execute in `node:vm`.\n *\n * Two-phase approach:\n *  1. **Validate**: run the transpiled code in a true V8 isolate with stub\n *     React/component implementations. This catches disallowed imports and\n *     structural errors inside a genuine security boundary (separate heap,\n *     128 MB memory cap, timeout). Escape requires a V8 engine bug.\n *  2. **Execute**: run the validated code in `node:vm` with real React\n *     objects for actual rendering.\n *\n * Why two phases: React's internal type system uses Symbols\n * (`Symbol(react.forward_ref)`, `Symbol(react.element)`, etc.) which cannot\n * be transferred across V8 isolate boundaries, the structured clone\n * algorithm does not support Symbols. Running React code directly inside\n * `isolated-vm` is not possible.\n */\nasync function executeInIsolatedVm(\n  code: string,\n  React: typeof import(\"react\"),\n  ReactEmailComponents: typeof import(\"@react-email/components\"),\n): Promise<Record<string, unknown>> {\n  let ivm: typeof import(\"isolated-vm\");\n  try {\n    const ivmMod = await import(\"isolated-vm\");\n    ivm = (ivmMod as any).default ?? ivmMod;\n  } catch {\n    throw new CompileError(\n      'Sandbox strategy \"isolated-vm\" requires the \"isolated-vm\" package. Install it:\\n' +\n        \"  npm install isolated-vm\\n\" +\n        'Or pass sandbox: \"vm\", which needs no native addon and is NOT a security' +\n        ' boundary: code you compile can reach the host process and its environment.' +\n        ' Only choose it for templates you already trust.',\n      \"jsx\",\n      \"execution\",\n    );\n  }\n\n  // ── Phase 1: Validate in a true V8 isolate ─────────────────────────────\n  const isolate = new ivm.Isolate({ memoryLimit: 128 });\n  try {\n    const ivmContext = await isolate.createContext();\n\n    // Stub implementations let the code parse and execute structurally\n    // without needing real React objects (which contain non-cloneable Symbols).\n    // Stub React: createElement returns a plain object, forwardRef passes\n    // through, and any unknown property returns a no-op function. The Proxy\n    // on the components module ensures that any named import (Html, Head,\n    // Button, etc.) resolves to a dummy component function so the transpiled\n    // code can execute structurally without real React objects.\n    const validationCode = `\n      (function() {\n        var module = { exports: {} };\n        var exports = module.exports;\n        var noop = function() { return {}; };\n        var React = new Proxy({\n          createElement: noop,\n          forwardRef: function(fn) { return fn; },\n          Fragment: \"Fragment\",\n          createContext: function() { return { Provider: noop, Consumer: noop }; },\n          useState: function(v) { return [v, noop]; },\n          useRef: function() { return { current: null }; },\n          useEffect: noop,\n          useMemo: function(fn) { return fn(); },\n          useCallback: function(fn) { return fn; },\n          Children: { map: noop, forEach: noop, toArray: function() { return []; } },\n        }, { get: function(t, p) { return p in t ? t[p] : noop; } });\n        var componentsProxy = new Proxy({}, {\n          get: function() { return noop; }\n        });\n        function require(name) {\n          if (name === \"react\") return React;\n          if (name === \"@react-email/components\") return componentsProxy;\n          throw new Error('Import of \"' + name + '\" is not allowed. Only \"react\" and \"@react-email/components\" can be imported.');\n        }\n        try {\n          ${code}\n          return JSON.stringify({ ok: true });\n        } catch(e) {\n          return JSON.stringify({ ok: false, error: e.message || \"Unknown error\" });\n        }\n      })()\n    `;\n\n    try {\n      const result = await ivmContext.eval(validationCode, {\n        timeout: EXECUTION_TIMEOUT_MS,\n      });\n\n      if (typeof result === \"string\") {\n        const parsed = JSON.parse(result) as { ok: boolean; error?: string };\n        if (!parsed.ok) {\n          throw new CompileError(\n            `JSX execution error: ${parsed.error ?? \"Unknown error\"}`,\n            \"jsx\",\n            \"execution\",\n          );\n        }\n      }\n    } catch (err: unknown) {\n      if (err instanceof CompileError) throw err;\n      const message = err instanceof Error ? err.message : \"Unknown execution error\";\n      if (message.includes(\"timed out\") || message.includes(\"Timeout\")) {\n        throw new CompileError(\"JSX execution timed out (possible infinite loop).\", \"jsx\", \"execution\");\n      }\n      throw new CompileError(`JSX execution error: ${message}`, \"jsx\", \"execution\");\n    }\n  } finally {\n    isolate.dispose();\n  }\n\n  // ── Phase 2: Execute validated code in node:vm with real React ──────────\n  return executeInVm(code, React, ReactEmailComponents);\n}\n\n// ─── Sandbox: QuickJS (WASM) ──────────────────────────────────────────────\n\n/**\n * Validate code structure in QuickJS WASM, then execute in `node:vm`.\n *\n * Two-phase approach:\n *  1. Validate that the code doesn't access disallowed modules by running it\n *     in a QuickJS WASM sandbox with stub implementations.\n *  2. Execute in `node:vm` for actual React rendering (React objects can't\n *     cross the WASM boundary).\n *\n * **Security note:** The actual execution happens in `node:vm`, so runtime\n * security is equivalent to the `\"vm\"` strategy. The QuickJS phase only\n * validates import restrictions. For true isolation on servers, use\n * `\"isolated-vm\"`.\n */\nasync function executeInQuickJs(\n  code: string,\n  React: typeof import(\"react\"),\n  ReactEmailComponents: typeof import(\"@react-email/components\"),\n): Promise<Record<string, unknown>> {\n  let getQuickJS: typeof import(\"quickjs-emscripten\").getQuickJS;\n  try {\n    ({ getQuickJS } = await import(\"quickjs-emscripten\"));\n  } catch {\n    throw new CompileError(\n      'Sandbox strategy \"quickjs\" requires the \"quickjs-emscripten\" package. Install it:\\n' +\n        \"  npm install quickjs-emscripten\\n\" +\n        'Or pass sandbox: \"vm\", which needs no native addon and is NOT a security' +\n        ' boundary: code you compile can reach the host process and its environment.' +\n        ' Only choose it for templates you already trust.',\n      \"jsx\",\n      \"execution\",\n    );\n  }\n\n  const QuickJS = await getQuickJS();\n  const vm = QuickJS.newContext();\n\n  try {\n    // Phase 1: Validate code safety in the WASM sandbox.\n    // We provide stub implementations of React and the module system so\n    // the code can execute without errors, but we only care that it\n    // doesn't try to access anything dangerous.\n    // QuickJS (ES2020) does not support Proxy, so we enumerate known\n    // React Email component names as stub functions instead.\n    const validationCode = `\n      (function() {\n        var module = { exports: {} };\n        var exports = module.exports;\n        var noop = function() { return {}; };\n        var React = {\n          createElement: noop,\n          forwardRef: function(fn) { return fn; },\n          Fragment: \"Fragment\",\n          createContext: function() { return { Provider: noop, Consumer: noop }; },\n          useState: function(v) { return [v, noop]; },\n          useRef: function() { return { current: null }; },\n          useEffect: noop,\n          useMemo: function(fn) { return fn(); },\n          useCallback: function(fn) { return fn; },\n          Children: { map: noop, forEach: noop, toArray: function() { return []; } },\n        };\n        var components = {};\n        var names = [\n          \"Html\",\"Head\",\"Body\",\"Container\",\"Section\",\"Row\",\"Column\",\"Text\",\n          \"Link\",\"Button\",\"Img\",\"Hr\",\"Preview\",\"Heading\",\"Font\",\"Style\",\n          \"CodeBlock\",\"CodeInline\",\"Markdown\",\"Tailwind\",\"Responsive\",\n        ];\n        for (var i = 0; i < names.length; i++) components[names[i]] = noop;\n        function require(name) {\n          if (name === \"react\") return React;\n          if (name === \"@react-email/components\") return components;\n          throw new Error('Import of \"' + name + '\" is not allowed.');\n        }\n        try {\n          ${code}\n          return JSON.stringify({ ok: true });\n        } catch(e) {\n          return JSON.stringify({ ok: false, error: e.message || \"Unknown error\" });\n        }\n      })()\n    `;\n\n    const result = vm.evalCode(validationCode);\n    if (result.error) {\n      const errorVal = vm.dump(result.error);\n      result.error.dispose();\n      throw new CompileError(\n        `JSX execution error: ${typeof errorVal === \"string\" ? errorVal : \"QuickJS execution failed\"}`,\n        \"jsx\",\n        \"execution\",\n      );\n    }\n\n    const resultStr = vm.dump(result.value);\n    result.value.dispose();\n\n    if (typeof resultStr === \"string\") {\n      const parsed = JSON.parse(resultStr) as { ok: boolean; error?: string };\n      if (!parsed.ok) {\n        throw new CompileError(\n          `JSX execution error: ${parsed.error ?? \"Unknown error\"}`,\n          \"jsx\",\n          \"execution\",\n        );\n      }\n    }\n\n    // Phase 2: Code validated as safe; execute in node:vm for actual\n    // React rendering (React objects can't cross the WASM boundary)\n    return executeInVm(code, React, ReactEmailComponents);\n  } finally {\n    vm.dispose();\n  }\n}\n"],"mappings":";;;;;AAGA,IAAM,kBAAkB;AAGxB,IAAM,uBAAuB;AAgD7B,eAAsB,kBACpB,QACA,SACiB;AAzDnB;AA0DE,QAAM,YAAW,wCAAS,YAAT,YAAoB;AAGrC,MAAI,CAAC,UAAU,CAAC,OAAO,KAAK,GAAG;AAC7B,UAAM,IAAI,aAAa,iCAAiC,OAAO,YAAY;AAAA,EAC7E;AAEA,MAAI,OAAO,SAAS,iBAAiB;AACnC,UAAM,IAAI;AAAA,MACR,sBAAsB,kBAAkB,GAAI;AAAA,MAC5C;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAGA,MAAI;AACJ,MAAI;AACJ,MAAI;AACJ,MAAI;AAEJ,MAAI;AACF,KAAC,EAAE,UAAU,IAAI,MAAM,OAAO,SAAS;AAAA,EACzC,SAAQ;AACN,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAEA,MAAI;AACF,YAAQ,MAAM,OAAO,OAAO;AAAA,EAC9B,SAAQ;AACN,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAEA,MAAI;AACF,2BAAuB,MAAM,OAAO,yBAAyB;AAAA,EAC/D,SAAQ;AACN,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAEA,MAAI;AACF,KAAC,EAAE,OAAO,IAAI,MAAM,OAAO,qBAAqB;AAAA,EAClD,SAAQ;AACN,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAGA,MAAI;AACJ,MAAI;AACF,UAAM,SAAS,UAAU,QAAQ;AAAA,MAC/B,YAAY,CAAC,cAAc,OAAO,SAAS;AAAA,MAC3C,YAAY;AAAA,MACZ,YAAY;AAAA,IACd,CAAC;AACD,qBAAiB,OAAO;AAAA,EAC1B,SAAS,KAAc;AACrB,UAAM,UAAU,eAAe,QAAQ,IAAI,UAAU;AACrD,UAAM,IAAI,aAAa,qBAAqB,OAAO,IAAI,OAAO,WAAW;AAAA,EAC3E;AAGA,MAAI;AAEJ,UAAQ,UAAU;AAAA,IAChB,KAAK;AACH,sBAAgB,MAAM,oBAAoB,gBAAgB,OAAO,oBAAoB;AACrF;AAAA,IACF,KAAK;AACH,sBAAgB,MAAM,iBAAiB,gBAAgB,OAAO,oBAAoB;AAClF;AAAA,IACF,KAAK;AACH,sBAAgB,MAAM,YAAY,gBAAgB,OAAO,oBAAoB;AAC7E;AAAA,IACF;AACE,YAAM,IAAI;AAAA,QACR,8BAA8B,QAAQ;AAAA,QACtC;AAAA,QACA;AAAA,MACF;AAAA,EACJ;AAGA,MAAI,aAAqB,mBAAc,YAAd,YAAyB;AAElD,MAAI,OAAO,cAAc,cAAc,OAAO,cAAc,YAAY,cAAc,MAAM;AAC1F,UAAM,SAAS,OAAO,OAAO,SAAoC;AACjE,UAAM,KAAK,OAAO,KAAK,CAAC,MAAM,OAAO,MAAM,UAAU;AACrD,QAAI,GAAI,aAAY;AAAA,EACtB;AAEA,MAAI,OAAO,cAAc,YAAY;AACnC,UAAM,IAAI;AAAA,MACR;AAAA,MAGA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAEA,MAAI;AACF,UAAM,UAAU,MAAM,cAAc,SAAqB;AACzD,UAAM,OAAO,MAAM,OAAO,OAAO;AACjC,WAAO;AAAA,EACT,SAAS,KAAc;AACrB,UAAM,UAAU,eAAe,QAAQ,IAAI,UAAU;AACrD,UAAM,IAAI,aAAa,0BAA0B,OAAO,IAAI,OAAO,QAAQ;AAAA,EAC7E;AACF;AAWA,eAAe,YACb,MACA,OACA,sBACkC;AAClC,QAAM,EAAE,eAAe,OAAO,IAAI,MAAM,OAAO,IAAS;AAExD,QAAM,kBAA2C;AAAA,IAC/C,OAAO;AAAA,IACP,2BAA2B;AAAA,EAC7B;AAEA,QAAM,gBAAyC,CAAC;AAChD,QAAM,YAAY,EAAE,SAAS,cAAc;AAE3C,QAAM,cAAc,CAAC,eAAgC;AACnD,QAAI,cAAc,iBAAiB;AACjC,aAAO,gBAAgB,UAAU;AAAA,IACnC;AACA,UAAM,IAAI;AAAA,MACR,cAAc,UAAU;AAAA,IAE1B;AAAA,EACF;AAEA,QAAM,UAAmC;AAAA,IACvC,QAAQ;AAAA,IACR,SAAS;AAAA,IACT,SAAS;AAAA,IACT;AAAA,IACA;AAAA,IAAQ;AAAA,IAAO;AAAA,IAAQ;AAAA,IAAQ;AAAA,IAC/B;AAAA,IAAK;AAAA,IAAK;AAAA,IAAS;AAAA,IACnB;AAAA,IAAM;AAAA,IAAM;AAAA,IAAM;AAAA,IAClB;AAAA,IAAO;AAAA,IAAW;AAAA,IAAY;AAAA,IAAgB;AAAA,IAAa;AAAA,IAC3D;AAAA,IAAS;AAAA,IACT,OAAO;AAAA,IAAW,SAAS;AAAA,IAC3B;AAAA,IAAU;AAAA,IAAY;AAAA,IAAO;AAAA,IAC7B;AAAA,IAAoB;AAAA,IAAoB;AAAA,IAAW;AAAA,IACnD;AAAA,IAAW;AAAA,IAAK;AAAA,IAChB,SAAS,EAAE,KAAK,MAAM;AAAA,IAAC,GAAG,MAAM,MAAM;AAAA,IAAC,GAAG,OAAO,MAAM;AAAA,IAAC,GAAG,MAAM,MAAM;AAAA,IAAC,GAAG,OAAO,MAAM;AAAA,IAAC,EAAE;AAAA,IAC3F,YAAY;AAAA,IAAW,aAAa;AAAA,IAAW,cAAc;AAAA,IAAW,gBAAgB;AAAA,IACxF,SAAS;AAAA,IAAW,YAAY;AAAA,IAAW,QAAQ;AAAA,IAAW,QAAQ;AAAA,IACtE,WAAW;AAAA,IAAW,YAAY;AAAA,EACpC;AAEA,QAAM,UAAU,cAAc,SAAS;AAAA,IACrC,gBAAgB,EAAE,SAAS,OAAO,MAAM,MAAM;AAAA,EAChD,CAAC;AAED,MAAI;AACF,UAAM,SAAS,IAAI,OAAO,MAAM,EAAE,UAAU,2BAA2B,CAAC;AACxE,WAAO,aAAa,SAAS,EAAE,SAAS,sBAAsB,eAAe,KAAK,CAAC;AAAA,EACrF,SAAS,KAAc;AACrB,UAAM,UAAU,eAAe,QAAQ,IAAI,UAAU;AACrD,QAAI,QAAQ,SAAS,4BAA4B,GAAG;AAClD,YAAM,IAAI,aAAa,qDAAqD,OAAO,WAAW;AAAA,IAChG;AACA,UAAM,IAAI,aAAa,wBAAwB,OAAO,IAAI,OAAO,WAAW;AAAA,EAC9E;AAEA,SAAO,UAAU;AACnB;AAqBA,eAAe,oBACb,MACA,OACA,sBACkC;AAtRpC;AAuRE,MAAI;AACJ,MAAI;AACF,UAAM,SAAS,MAAM,OAAO,aAAa;AACzC,WAAO,YAAe,YAAf,YAA0B;AAAA,EACnC,SAAQ;AACN,UAAM,IAAI;AAAA,MACR;AAAA,MAKA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAGA,QAAM,UAAU,IAAI,IAAI,QAAQ,EAAE,aAAa,IAAI,CAAC;AACpD,MAAI;AACF,UAAM,aAAa,MAAM,QAAQ,cAAc;AAS/C,UAAM,iBAAiB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,YA0Bf,IAAI;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAQZ,QAAI;AACF,YAAM,SAAS,MAAM,WAAW,KAAK,gBAAgB;AAAA,QACnD,SAAS;AAAA,MACX,CAAC;AAED,UAAI,OAAO,WAAW,UAAU;AAC9B,cAAM,SAAS,KAAK,MAAM,MAAM;AAChC,YAAI,CAAC,OAAO,IAAI;AACd,gBAAM,IAAI;AAAA,YACR,yBAAwB,YAAO,UAAP,YAAgB,eAAe;AAAA,YACvD;AAAA,YACA;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAAA,IACF,SAAS,KAAc;AACrB,UAAI,eAAe,aAAc,OAAM;AACvC,YAAM,UAAU,eAAe,QAAQ,IAAI,UAAU;AACrD,UAAI,QAAQ,SAAS,WAAW,KAAK,QAAQ,SAAS,SAAS,GAAG;AAChE,cAAM,IAAI,aAAa,qDAAqD,OAAO,WAAW;AAAA,MAChG;AACA,YAAM,IAAI,aAAa,wBAAwB,OAAO,IAAI,OAAO,WAAW;AAAA,IAC9E;AAAA,EACF,UAAE;AACA,YAAQ,QAAQ;AAAA,EAClB;AAGA,SAAO,YAAY,MAAM,OAAO,oBAAoB;AACtD;AAkBA,eAAe,iBACb,MACA,OACA,sBACkC;AAxYpC;AAyYE,MAAI;AACJ,MAAI;AACF,KAAC,EAAE,WAAW,IAAI,MAAM,OAAO,oBAAoB;AAAA,EACrD,SAAQ;AACN,UAAM,IAAI;AAAA,MACR;AAAA,MAKA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAEA,QAAM,UAAU,MAAM,WAAW;AACjC,QAAM,KAAK,QAAQ,WAAW;AAE9B,MAAI;AAOF,UAAM,iBAAiB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,YA8Bf,IAAI;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAQZ,UAAM,SAAS,GAAG,SAAS,cAAc;AACzC,QAAI,OAAO,OAAO;AAChB,YAAM,WAAW,GAAG,KAAK,OAAO,KAAK;AACrC,aAAO,MAAM,QAAQ;AACrB,YAAM,IAAI;AAAA,QACR,wBAAwB,OAAO,aAAa,WAAW,WAAW,0BAA0B;AAAA,QAC5F;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAEA,UAAM,YAAY,GAAG,KAAK,OAAO,KAAK;AACtC,WAAO,MAAM,QAAQ;AAErB,QAAI,OAAO,cAAc,UAAU;AACjC,YAAM,SAAS,KAAK,MAAM,SAAS;AACnC,UAAI,CAAC,OAAO,IAAI;AACd,cAAM,IAAI;AAAA,UACR,yBAAwB,YAAO,UAAP,YAAgB,eAAe;AAAA,UACvD;AAAA,UACA;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAIA,WAAO,YAAY,MAAM,OAAO,oBAAoB;AAAA,EACtD,UAAE;AACA,OAAG,QAAQ;AAAA,EACb;AACF;","names":[]}

package/dist/compile/index.cjs

@@ -251,7 +251,7 @@ async function executeInIsolatedVm(code, React, ReactEmailComponents) {
     ivm = (_a = ivmMod.default) != null ? _a : ivmMod;
   } catch (e) {
     throw new CompileError(
-      'Sandbox strategy "isolated-vm" requires the "isolated-vm" package. Install it:\n  npm install isolated-vm\nOr use sandbox: "vm" for a lighter (but less secure) alternative.',
+      'Sandbox strategy "isolated-vm" requires the "isolated-vm" package. Install it:\n  npm install isolated-vm\nOr pass sandbox: "vm", which needs no native addon and is NOT a security boundary: code you compile can reach the host process and its environment. Only choose it for templates you already trust.',
       "jsx",
       "execution"
     );
@@ -326,7 +326,7 @@ async function executeInQuickJs(code, React, ReactEmailComponents) {
     ({ getQuickJS } = await import("quickjs-emscripten"));
   } catch (e) {
     throw new CompileError(
-      'Sandbox strategy "quickjs" requires the "quickjs-emscripten" package. Install it:\n  npm install quickjs-emscripten\nOr use sandbox: "vm" for a lighter alternative.',
+      'Sandbox strategy "quickjs" requires the "quickjs-emscripten" package. Install it:\n  npm install quickjs-emscripten\nOr pass sandbox: "vm", which needs no native addon and is NOT a security boundary: code you compile can reach the host process and its environment. Only choose it for templates you already trust.',
       "jsx",
       "execution"
     );

package/dist/compile/index.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/compile/errors.ts","../../src/compile/react-email.ts","../../src/compile/mjml.ts","../../src/compile/maizzle.ts","../../src/compile/index.ts"],"sourcesContent":["import type { InputFormat } from \"../types.js\";\r\n\r\n/**\r\n * Unified error class for all email compilation failures.\r\n *\r\n * Replaces the per-format error classes (ReactEmailCompileError,\r\n * MjmlCompileError, MaizzleCompileError) with a single class that\r\n * carries the source format and failure phase.\r\n */\r\nexport class CompileError extends Error {\r\n  override name = \"CompileError\";\r\n  readonly format: Exclude<InputFormat, \"html\">;\r\n  readonly phase: \"validation\" | \"transpile\" | \"execution\" | \"render\" | \"compile\";\r\n\r\n  constructor(\r\n    message: string,\r\n    format: CompileError[\"format\"],\r\n    phase: CompileError[\"phase\"],\r\n  ) {\r\n    super(message);\r\n    this.format = format;\r\n    this.phase = phase;\r\n  }\r\n}\r\n","import { CompileError } from \"./errors.js\";\r\n\r\n/** Maximum source code size: 256KB */\r\nconst MAX_SOURCE_SIZE = 256_000;\r\n\r\n/** Execution timeout: 5 seconds */\r\nconst EXECUTION_TIMEOUT_MS = 5_000;\r\n\r\n/**\r\n * Sandbox strategy for JSX execution.\r\n *\r\n * - `\"vm\"`: `node:vm` with hardened globals. Fast, zero-dependency,\r\n *   but NOT a true security boundary (prototype-chain escapes are possible).\r\n *   Suitable for CLI / local use where users run their own code.\r\n *\r\n * - `\"isolated-vm\"` (default): Separate V8 isolate via the `isolated-vm`\r\n *   npm package. True heap isolation; escapes require a V8 engine bug.\r\n *   Requires `isolated-vm` to be installed (native addon).\r\n *\r\n * - `\"quickjs\"`: Validates code structure in a QuickJS WASM sandbox, then\r\n *   executes in `node:vm` for React rendering. Security is equivalent to\r\n *   `node:vm`: the QuickJS phase validates import restrictions only.\r\n *   No native addons needed, but only supports ES2020 and is slower.\r\n *   For true isolation on servers, use `isolated-vm`.\r\n */\r\nexport type SandboxStrategy = \"vm\" | \"isolated-vm\" | \"quickjs\";\r\n\r\nexport interface CompileReactEmailOptions {\r\n  /**\r\n   * Sandbox strategy to use for executing user JSX code.\r\n   * @default \"isolated-vm\"\r\n   */\r\n  sandbox?: SandboxStrategy;\r\n}\r\n\r\n/**\r\n * Compile a React Email JSX/TSX source string into an HTML email string.\r\n *\r\n * Pipeline:\r\n *  1. Validate input (size, basic checks)\r\n *  2. Transpile JSX/TSX → CommonJS JS using sucrase\r\n *  3. Execute inside a sandbox (configurable strategy)\r\n *  4. Render the exported component to a full HTML email string\r\n *\r\n * Requires peer dependencies: sucrase, react, @react-email/components,\r\n * @react-email/render. Additionally:\r\n *  - sandbox \"isolated-vm\" requires `isolated-vm`\r\n *  - sandbox \"quickjs\" requires `quickjs-emscripten`\r\n */\r\nexport async function compileReactEmail(\r\n  source: string,\r\n  options?: CompileReactEmailOptions,\r\n): Promise<string> {\r\n  const strategy = options?.sandbox ?? \"isolated-vm\";\r\n\r\n  // ── 1. Validate ──────────────────────────────────────────────────────\r\n  if (!source || !source.trim()) {\r\n    throw new CompileError(\"JSX source must not be empty.\", \"jsx\", \"validation\");\r\n  }\r\n\r\n  if (source.length > MAX_SOURCE_SIZE) {\r\n    throw new CompileError(\r\n      `JSX source exceeds ${MAX_SOURCE_SIZE / 1000}KB limit.`,\r\n      \"jsx\",\r\n      \"validation\",\r\n    );\r\n  }\r\n\r\n  // ── 2. Load peer dependencies ────────────────────────────────────────\r\n  let transform: typeof import(\"sucrase\").transform;\r\n  let React: typeof import(\"react\");\r\n  let ReactEmailComponents: typeof import(\"@react-email/components\");\r\n  let render: typeof import(\"@react-email/render\").render;\r\n\r\n  try {\r\n    ({ transform } = await import(\"sucrase\"));\r\n  } catch {\r\n    throw new CompileError(\r\n      'JSX compilation requires \"sucrase\". Install it:\\n  npm install sucrase',\r\n      \"jsx\",\r\n      \"transpile\",\r\n    );\r\n  }\r\n\r\n  try {\r\n    React = await import(\"react\");\r\n  } catch {\r\n    throw new CompileError(\r\n      'JSX compilation requires \"react\". Install it:\\n  npm install react',\r\n      \"jsx\",\r\n      \"transpile\",\r\n    );\r\n  }\r\n\r\n  try {\r\n    ReactEmailComponents = await import(\"@react-email/components\");\r\n  } catch {\r\n    throw new CompileError(\r\n      'JSX compilation requires \"@react-email/components\". Install it:\\n  npm install @react-email/components',\r\n      \"jsx\",\r\n      \"transpile\",\r\n    );\r\n  }\r\n\r\n  try {\r\n    ({ render } = await import(\"@react-email/render\"));\r\n  } catch {\r\n    throw new CompileError(\r\n      'JSX compilation requires \"@react-email/render\". Install it:\\n  npm install @react-email/render',\r\n      \"jsx\",\r\n      \"transpile\",\r\n    );\r\n  }\r\n\r\n  // ── 3. Transpile JSX/TSX → CommonJS ──────────────────────────────────\r\n  let transpiledCode: string;\r\n  try {\r\n    const result = transform(source, {\r\n      transforms: [\"typescript\", \"jsx\", \"imports\"],\r\n      jsxRuntime: \"classic\",\r\n      production: true,\r\n    });\r\n    transpiledCode = result.code;\r\n  } catch (err: unknown) {\r\n    const message = err instanceof Error ? err.message : \"Unknown transpilation error\";\r\n    throw new CompileError(`JSX syntax error: ${message}`, \"jsx\", \"transpile\");\r\n  }\r\n\r\n  // ── 4. Execute in sandbox ────────────────────────────────────────────\r\n  let moduleExports: Record<string, unknown>;\r\n\r\n  switch (strategy) {\r\n    case \"isolated-vm\":\r\n      moduleExports = await executeInIsolatedVm(transpiledCode, React, ReactEmailComponents);\r\n      break;\r\n    case \"quickjs\":\r\n      moduleExports = await executeInQuickJs(transpiledCode, React, ReactEmailComponents);\r\n      break;\r\n    case \"vm\":\r\n      moduleExports = await executeInVm(transpiledCode, React, ReactEmailComponents);\r\n      break;\r\n    default:\r\n      throw new CompileError(\r\n        `Unknown sandbox strategy: \"${strategy}\". Use \"vm\", \"isolated-vm\", or \"quickjs\".`,\r\n        \"jsx\",\r\n        \"execution\",\r\n      );\r\n  }\r\n\r\n  // ── 5. Extract component and render ──────────────────────────────────\r\n  let Component: unknown = moduleExports.default ?? moduleExports;\r\n\r\n  if (typeof Component !== \"function\" && typeof Component === \"object\" && Component !== null) {\r\n    const values = Object.values(Component as Record<string, unknown>);\r\n    const fn = values.find((v) => typeof v === \"function\");\r\n    if (fn) Component = fn;\r\n  }\r\n\r\n  if (typeof Component !== \"function\") {\r\n    throw new CompileError(\r\n      'The JSX source must export a React component function. ' +\r\n        'Use \"export default function Email() { ... }\" or ' +\r\n        '\"export function Email() { ... }\".',\r\n      \"jsx\",\r\n      \"execution\",\r\n    );\r\n  }\r\n\r\n  try {\r\n    const element = React.createElement(Component as React.FC);\r\n    const html = await render(element);\r\n    return html;\r\n  } catch (err: unknown) {\r\n    const message = err instanceof Error ? err.message : \"Unknown rendering error\";\r\n    throw new CompileError(`React rendering error: ${message}`, \"jsx\", \"render\");\r\n  }\r\n}\r\n\r\n// ─── Sandbox: node:vm ──────────────────────────────────────────────────────\r\n\r\n/**\r\n * Execute transpiled code in a node:vm context with hardened globals.\r\n *\r\n * NOT a security boundary, see node:vm documentation. Suitable for CLI\r\n * use where the user runs their own code. For server use, prefer\r\n * \"isolated-vm\" or \"quickjs\".\r\n */\r\nasync function executeInVm(\r\n  code: string,\r\n  React: typeof import(\"react\"),\r\n  ReactEmailComponents: typeof import(\"@react-email/components\"),\r\n): Promise<Record<string, unknown>> {\r\n  const { createContext, Script } = await import(\"node:vm\");\r\n\r\n  const ALLOWED_MODULES: Record<string, unknown> = {\r\n    react: React,\r\n    \"@react-email/components\": ReactEmailComponents,\r\n  };\r\n\r\n  const moduleExports: Record<string, unknown> = {};\r\n  const moduleObj = { exports: moduleExports };\r\n\r\n  const mockRequire = (moduleName: string): unknown => {\r\n    if (moduleName in ALLOWED_MODULES) {\r\n      return ALLOWED_MODULES[moduleName];\r\n    }\r\n    throw new Error(\r\n      `Import of \"${moduleName}\" is not allowed. ` +\r\n        `Only \"react\" and \"@react-email/components\" can be imported.`,\r\n    );\r\n  };\r\n\r\n  const sandbox: Record<string, unknown> = {\r\n    module: moduleObj,\r\n    exports: moduleExports,\r\n    require: mockRequire,\r\n    React,\r\n    Object, Array, String, Number, Boolean,\r\n    Map, Set, WeakMap, WeakSet,\r\n    JSON, Math, Date, RegExp,\r\n    Error, TypeError, RangeError, ReferenceError, SyntaxError, URIError,\r\n    Promise, Symbol,\r\n    Proxy: undefined, Reflect: undefined,\r\n    parseInt, parseFloat, isNaN, isFinite,\r\n    encodeURIComponent, decodeURIComponent, encodeURI, decodeURI,\r\n    undefined, NaN, Infinity,\r\n    console: { log: () => {}, warn: () => {}, error: () => {}, info: () => {}, debug: () => {} },\r\n    setTimeout: undefined, setInterval: undefined, setImmediate: undefined, queueMicrotask: undefined,\r\n    process: undefined, globalThis: undefined, global: undefined, Buffer: undefined,\r\n    __dirname: undefined, __filename: undefined,\r\n  };\r\n\r\n  const context = createContext(sandbox, {\r\n    codeGeneration: { strings: false, wasm: false },\r\n  });\r\n\r\n  try {\r\n    const script = new Script(code, { filename: \"user-email-component.tsx\" });\r\n    script.runInContext(context, { timeout: EXECUTION_TIMEOUT_MS, displayErrors: true });\r\n  } catch (err: unknown) {\r\n    const message = err instanceof Error ? err.message : \"Unknown execution error\";\r\n    if (message.includes(\"Script execution timed out\")) {\r\n      throw new CompileError(\"JSX execution timed out (possible infinite loop).\", \"jsx\", \"execution\");\r\n    }\r\n    throw new CompileError(`JSX execution error: ${message}`, \"jsx\", \"execution\");\r\n  }\r\n\r\n  return moduleObj.exports as Record<string, unknown>;\r\n}\r\n\r\n// ─── Sandbox: isolated-vm ──────────────────────────────────────────────────\r\n\r\n/**\r\n * Validate code in a separate V8 isolate, then execute in `node:vm`.\r\n *\r\n * Two-phase approach:\r\n *  1. **Validate**: run the transpiled code in a true V8 isolate with stub\r\n *     React/component implementations. This catches disallowed imports and\r\n *     structural errors inside a genuine security boundary (separate heap,\r\n *     128 MB memory cap, timeout). Escape requires a V8 engine bug.\r\n *  2. **Execute**: run the validated code in `node:vm` with real React\r\n *     objects for actual rendering.\r\n *\r\n * Why two phases: React's internal type system uses Symbols\r\n * (`Symbol(react.forward_ref)`, `Symbol(react.element)`, etc.) which cannot\r\n * be transferred across V8 isolate boundaries, the structured clone\r\n * algorithm does not support Symbols. Running React code directly inside\r\n * `isolated-vm` is not possible.\r\n */\r\nasync function executeInIsolatedVm(\r\n  code: string,\r\n  React: typeof import(\"react\"),\r\n  ReactEmailComponents: typeof import(\"@react-email/components\"),\r\n): Promise<Record<string, unknown>> {\r\n  let ivm: typeof import(\"isolated-vm\");\r\n  try {\r\n    const ivmMod = await import(\"isolated-vm\");\r\n    ivm = (ivmMod as any).default ?? ivmMod;\r\n  } catch {\r\n    throw new CompileError(\r\n      'Sandbox strategy \"isolated-vm\" requires the \"isolated-vm\" package. Install it:\\n' +\r\n        \"  npm install isolated-vm\\n\" +\r\n        'Or use sandbox: \"vm\" for a lighter (but less secure) alternative.',\r\n      \"jsx\",\r\n      \"execution\",\r\n    );\r\n  }\r\n\r\n  // ── Phase 1: Validate in a true V8 isolate ─────────────────────────────\r\n  const isolate = new ivm.Isolate({ memoryLimit: 128 });\r\n  try {\r\n    const ivmContext = await isolate.createContext();\r\n\r\n    // Stub implementations let the code parse and execute structurally\r\n    // without needing real React objects (which contain non-cloneable Symbols).\r\n    // Stub React: createElement returns a plain object, forwardRef passes\r\n    // through, and any unknown property returns a no-op function. The Proxy\r\n    // on the components module ensures that any named import (Html, Head,\r\n    // Button, etc.) resolves to a dummy component function so the transpiled\r\n    // code can execute structurally without real React objects.\r\n    const validationCode = `\r\n      (function() {\r\n        var module = { exports: {} };\r\n        var exports = module.exports;\r\n        var noop = function() { return {}; };\r\n        var React = new Proxy({\r\n          createElement: noop,\r\n          forwardRef: function(fn) { return fn; },\r\n          Fragment: \"Fragment\",\r\n          createContext: function() { return { Provider: noop, Consumer: noop }; },\r\n          useState: function(v) { return [v, noop]; },\r\n          useRef: function() { return { current: null }; },\r\n          useEffect: noop,\r\n          useMemo: function(fn) { return fn(); },\r\n          useCallback: function(fn) { return fn; },\r\n          Children: { map: noop, forEach: noop, toArray: function() { return []; } },\r\n        }, { get: function(t, p) { return p in t ? t[p] : noop; } });\r\n        var componentsProxy = new Proxy({}, {\r\n          get: function() { return noop; }\r\n        });\r\n        function require(name) {\r\n          if (name === \"react\") return React;\r\n          if (name === \"@react-email/components\") return componentsProxy;\r\n          throw new Error('Import of \"' + name + '\" is not allowed. Only \"react\" and \"@react-email/components\" can be imported.');\r\n        }\r\n        try {\r\n          ${code}\r\n          return JSON.stringify({ ok: true });\r\n        } catch(e) {\r\n          return JSON.stringify({ ok: false, error: e.message || \"Unknown error\" });\r\n        }\r\n      })()\r\n    `;\r\n\r\n    try {\r\n      const result = await ivmContext.eval(validationCode, {\r\n        timeout: EXECUTION_TIMEOUT_MS,\r\n      });\r\n\r\n      if (typeof result === \"string\") {\r\n        const parsed = JSON.parse(result) as { ok: boolean; error?: string };\r\n        if (!parsed.ok) {\r\n          throw new CompileError(\r\n            `JSX execution error: ${parsed.error ?? \"Unknown error\"}`,\r\n            \"jsx\",\r\n            \"execution\",\r\n          );\r\n        }\r\n      }\r\n    } catch (err: unknown) {\r\n      if (err instanceof CompileError) throw err;\r\n      const message = err instanceof Error ? err.message : \"Unknown execution error\";\r\n      if (message.includes(\"timed out\") || message.includes(\"Timeout\")) {\r\n        throw new CompileError(\"JSX execution timed out (possible infinite loop).\", \"jsx\", \"execution\");\r\n      }\r\n      throw new CompileError(`JSX execution error: ${message}`, \"jsx\", \"execution\");\r\n    }\r\n  } finally {\r\n    isolate.dispose();\r\n  }\r\n\r\n  // ── Phase 2: Execute validated code in node:vm with real React ──────────\r\n  return executeInVm(code, React, ReactEmailComponents);\r\n}\r\n\r\n// ─── Sandbox: QuickJS (WASM) ──────────────────────────────────────────────\r\n\r\n/**\r\n * Validate code structure in QuickJS WASM, then execute in `node:vm`.\r\n *\r\n * Two-phase approach:\r\n *  1. Validate that the code doesn't access disallowed modules by running it\r\n *     in a QuickJS WASM sandbox with stub implementations.\r\n *  2. Execute in `node:vm` for actual React rendering (React objects can't\r\n *     cross the WASM boundary).\r\n *\r\n * **Security note:** The actual execution happens in `node:vm`, so runtime\r\n * security is equivalent to the `\"vm\"` strategy. The QuickJS phase only\r\n * validates import restrictions. For true isolation on servers, use\r\n * `\"isolated-vm\"`.\r\n */\r\nasync function executeInQuickJs(\r\n  code: string,\r\n  React: typeof import(\"react\"),\r\n  ReactEmailComponents: typeof import(\"@react-email/components\"),\r\n): Promise<Record<string, unknown>> {\r\n  let getQuickJS: typeof import(\"quickjs-emscripten\").getQuickJS;\r\n  try {\r\n    ({ getQuickJS } = await import(\"quickjs-emscripten\"));\r\n  } catch {\r\n    throw new CompileError(\r\n      'Sandbox strategy \"quickjs\" requires the \"quickjs-emscripten\" package. Install it:\\n' +\r\n        \"  npm install quickjs-emscripten\\n\" +\r\n        'Or use sandbox: \"vm\" for a lighter alternative.',\r\n      \"jsx\",\r\n      \"execution\",\r\n    );\r\n  }\r\n\r\n  const QuickJS = await getQuickJS();\r\n  const vm = QuickJS.newContext();\r\n\r\n  try {\r\n    // Phase 1: Validate code safety in the WASM sandbox.\r\n    // We provide stub implementations of React and the module system so\r\n    // the code can execute without errors, but we only care that it\r\n    // doesn't try to access anything dangerous.\r\n    // QuickJS (ES2020) does not support Proxy, so we enumerate known\r\n    // React Email component names as stub functions instead.\r\n    const validationCode = `\r\n      (function() {\r\n        var module = { exports: {} };\r\n        var exports = module.exports;\r\n        var noop = function() { return {}; };\r\n        var React = {\r\n          createElement: noop,\r\n          forwardRef: function(fn) { return fn; },\r\n          Fragment: \"Fragment\",\r\n          createContext: function() { return { Provider: noop, Consumer: noop }; },\r\n          useState: function(v) { return [v, noop]; },\r\n          useRef: function() { return { current: null }; },\r\n          useEffect: noop,\r\n          useMemo: function(fn) { return fn(); },\r\n          useCallback: function(fn) { return fn; },\r\n          Children: { map: noop, forEach: noop, toArray: function() { return []; } },\r\n        };\r\n        var components = {};\r\n        var names = [\r\n          \"Html\",\"Head\",\"Body\",\"Container\",\"Section\",\"Row\",\"Column\",\"Text\",\r\n          \"Link\",\"Button\",\"Img\",\"Hr\",\"Preview\",\"Heading\",\"Font\",\"Style\",\r\n          \"CodeBlock\",\"CodeInline\",\"Markdown\",\"Tailwind\",\"Responsive\",\r\n        ];\r\n        for (var i = 0; i < names.length; i++) components[names[i]] = noop;\r\n        function require(name) {\r\n          if (name === \"react\") return React;\r\n          if (name === \"@react-email/components\") return components;\r\n          throw new Error('Import of \"' + name + '\" is not allowed.');\r\n        }\r\n        try {\r\n          ${code}\r\n          return JSON.stringify({ ok: true });\r\n        } catch(e) {\r\n          return JSON.stringify({ ok: false, error: e.message || \"Unknown error\" });\r\n        }\r\n      })()\r\n    `;\r\n\r\n    const result = vm.evalCode(validationCode);\r\n    if (result.error) {\r\n      const errorVal = vm.dump(result.error);\r\n      result.error.dispose();\r\n      throw new CompileError(\r\n        `JSX execution error: ${typeof errorVal === \"string\" ? errorVal : \"QuickJS execution failed\"}`,\r\n        \"jsx\",\r\n        \"execution\",\r\n      );\r\n    }\r\n\r\n    const resultStr = vm.dump(result.value);\r\n    result.value.dispose();\r\n\r\n    if (typeof resultStr === \"string\") {\r\n      const parsed = JSON.parse(resultStr) as { ok: boolean; error?: string };\r\n      if (!parsed.ok) {\r\n        throw new CompileError(\r\n          `JSX execution error: ${parsed.error ?? \"Unknown error\"}`,\r\n          \"jsx\",\r\n          \"execution\",\r\n        );\r\n      }\r\n    }\r\n\r\n    // Phase 2: Code validated as safe; execute in node:vm for actual\r\n    // React rendering (React objects can't cross the WASM boundary)\r\n    return executeInVm(code, React, ReactEmailComponents);\r\n  } finally {\r\n    vm.dispose();\r\n  }\r\n}\r\n","import { CompileError } from \"./errors.js\";\r\n\r\n/** Maximum MJML source size: 512KB */\r\nconst MAX_SOURCE_SIZE = 512_000;\r\n\r\n/**\r\n * Compile an MJML source string into an HTML email string.\r\n *\r\n * MJML is a declarative markup language with no code execution capability\r\n * (unlike JSX). The mjml library parses XML and generates HTML; there is\r\n * no sandboxing concern.\r\n *\r\n * Requires peer dependency: mjml\r\n */\r\nexport async function compileMjml(source: string): Promise<string> {\r\n  // ── 1. Validate ──────────────────────────────────────────────────────\r\n  if (!source || !source.trim()) {\r\n    throw new CompileError(\"MJML source must not be empty.\", \"mjml\", \"validation\");\r\n  }\r\n\r\n  if (source.length > MAX_SOURCE_SIZE) {\r\n    throw new CompileError(\r\n      `MJML source exceeds ${MAX_SOURCE_SIZE / 1000}KB limit.`,\r\n      \"mjml\",\r\n      \"validation\",\r\n    );\r\n  }\r\n\r\n  if (!/<mjml[\\s>]/i.test(source)) {\r\n    throw new CompileError(\r\n      \"MJML source must contain a root <mjml> element. \" +\r\n        \"Example: <mjml><mj-body><mj-section><mj-column><mj-text>Hello</mj-text></mj-column></mj-section></mj-body></mjml>\",\r\n      \"mjml\",\r\n      \"validation\",\r\n    );\r\n  }\r\n\r\n  // ── 2. Load peer dependency ──────────────────────────────────────────\r\n  type MjmlResult = {\r\n    html: string;\r\n    errors: Array<{ line: number; message: string; tagName: string; formattedMessage: string }>;\r\n  };\r\n  let mjml2html: (\r\n    input: string,\r\n    options?: Record<string, unknown>,\r\n  ) => MjmlResult | Promise<MjmlResult>;\r\n\r\n  try {\r\n    const mjmlModule = await import(\"mjml\");\r\n    mjml2html = mjmlModule.default ?? mjmlModule;\r\n  } catch {\r\n    throw new CompileError(\r\n      'MJML compilation requires \"mjml\". Install it:\\n  npm install mjml',\r\n      \"mjml\",\r\n      \"compile\",\r\n    );\r\n  }\r\n\r\n  // ── 3. Compile ───────────────────────────────────────────────────────\r\n  try {\r\n    // mjml v5+ returns a Promise; v4 returns synchronously.\r\n    // Await handles both cases.\r\n    const result = await mjml2html(source, {\r\n      validationLevel: \"soft\",\r\n      keepComments: false,\r\n    });\r\n\r\n    if (result.errors && result.errors.length > 0 && !result.html) {\r\n      const errorMessages = result.errors\r\n        .map((e) => `Line ${e.line}: ${e.message} (${e.tagName})`)\r\n        .join(\"; \");\r\n      throw new CompileError(\r\n        `MJML compilation errors: ${errorMessages}`,\r\n        \"mjml\",\r\n        \"compile\",\r\n      );\r\n    }\r\n\r\n    if (!result.html) {\r\n      throw new CompileError(\"MJML compilation produced empty output.\", \"mjml\", \"compile\");\r\n    }\r\n\r\n    return result.html;\r\n  } catch (err: unknown) {\r\n    if (err instanceof CompileError) throw err;\r\n    const message = err instanceof Error ? err.message : \"Unknown MJML compilation error\";\r\n    throw new CompileError(`MJML compilation failed: ${message}`, \"mjml\", \"compile\");\r\n  }\r\n}\r\n","import { CompileError } from \"./errors.js\";\r\n\r\n/** Maximum Maizzle source size: 512KB */\r\nconst MAX_SOURCE_SIZE = 512_000;\r\n\r\n/** Compilation timeout: 15 seconds */\r\nconst COMPILE_TIMEOUT_MS = 15_000;\r\n\r\n/**\r\n * PostHTML directives that perform file-system reads or network fetches.\r\n *\r\n * Maizzle's PostHTML pipeline resolves these at compile time: a template\r\n * like `<extends src=\"/etc/passwd\">` causes the server to read that path\r\n * and include the content in rendered output (server-side file read). We\r\n * reject any input containing these directives rather than stripping them,\r\n * because stripping is error-prone with nested or malformed markup.\r\n *\r\n * Affected plugins: posthtml-extend, posthtml-fetch, posthtml-components,\r\n * posthtml-include, posthtml-modules.\r\n */\r\nconst DANGEROUS_DIRECTIVE_RE =\r\n  /<\\s*(?:extends|component|fetch|include|module|slot|fill|raw|block|yield)\\b/i;\r\n\r\n/**\r\n * Compile a Maizzle template string into an HTML email string.\r\n *\r\n * Pipeline:\r\n *  1. Validate input (size, basic structure check)\r\n *  2. Reject inputs containing PostHTML file-access directives\r\n *  3. Compile using @maizzle/framework\r\n *\r\n * Security:\r\n *  - PostHTML file-system directives are rejected at validation time\r\n *    to prevent server-side file reads and SSRF.\r\n *  - Template expressions ({{ expr }}) are evaluated by posthtml-expressions\r\n *    with empty `locals`, so unknown identifiers like `process` or `require`\r\n *    return the literal string '{local}' rather than accessing Node.js globals.\r\n *  - A hard timeout prevents pathological PostCSS/Tailwind inputs from\r\n *    hanging indefinitely.\r\n *\r\n * Requires peer dependency: @maizzle/framework\r\n */\r\n/**\r\n * Is this the Maizzle 6 module?\r\n *\r\n * Maizzle 6 replaced the HTML template with a Vue single-file component, and\r\n * its `render` resolves a string argument as a path rather than as source.\r\n * Handed a template it reports `Failed to load url <!DOCTYPE html>…`, which\r\n * describes nothing an author can act on, so the caller checks first and says\r\n * what actually happened.\r\n *\r\n * `createRenderer` is the discriminator: exported by every v6 release and by\r\n * no v5 one. The module carries no version to read, so a capability probe is\r\n * what there is.\r\n */\r\nexport function isMaizzle6(mod: object): boolean {\r\n  return \"createRenderer\" in mod;\r\n}\r\n\r\nexport async function compileMaizzle(source: string): Promise<string> {\r\n  // ── 1. Validate ──────────────────────────────────────────────────────\r\n  if (!source || !source.trim()) {\r\n    throw new CompileError(\"Maizzle source must not be empty.\", \"maizzle\", \"validation\");\r\n  }\r\n\r\n  if (source.length > MAX_SOURCE_SIZE) {\r\n    throw new CompileError(\r\n      `Maizzle source exceeds ${MAX_SOURCE_SIZE / 1000}KB limit.`,\r\n      \"maizzle\",\r\n      \"validation\",\r\n    );\r\n  }\r\n\r\n  // ── 2. Block file-system and network PostHTML directives ─────────────\r\n  if (DANGEROUS_DIRECTIVE_RE.test(source)) {\r\n    throw new CompileError(\r\n      \"Maizzle templates may not use <extends>, <component>, <fetch>, <include>, \" +\r\n        \"<module>, <slot>, <fill>, <raw>, <block>, or <yield> directives. These directives \" +\r\n        \"access the server file system at compile time. Use inline HTML and Tailwind utility classes instead.\",\r\n      \"maizzle\",\r\n      \"validation\",\r\n    );\r\n  }\r\n\r\n  // ── 3. Load peer dependency ──────────────────────────────────────────\r\n  let maizzleRender: (\r\n    input: string,\r\n    options: Record<string, unknown>,\r\n  ) => Promise<{ html: string }>;\r\n\r\n  let maizzle: Record<string, unknown>;\r\n  try {\r\n    maizzle = (await import(\"@maizzle/framework\")) as unknown as Record<string, unknown>;\r\n  } catch {\r\n    throw new CompileError(\r\n      'Maizzle compilation requires \"@maizzle/framework\". Install it:\\n' +\r\n        \"  npm install @maizzle/framework@5\",\r\n      \"maizzle\",\r\n      \"compile\",\r\n    );\r\n  }\r\n\r\n  if (isMaizzle6(maizzle)) {\r\n    throw new CompileError(\r\n      \"Maizzle 6 is installed, and this engine compiles Maizzle 5 templates.\\n\" +\r\n        \"Maizzle 6 renders Vue single-file components rather than HTML, so an\\n\" +\r\n        \"HTML template is not something it can read. Install the supported major:\\n\" +\r\n        \"  npm install @maizzle/framework@5\",\r\n      \"maizzle\",\r\n      \"compile\",\r\n    );\r\n  }\r\n  maizzleRender = maizzle.render as typeof maizzleRender;\r\n\r\n  // ── 4. Compile with timeout ──────────────────────────────────────────\r\n  const compilePromise = maizzleRender(source, {\r\n    css: {\r\n      inline: {\r\n        removeInlinedSelectors: true,\r\n        applyWidthAttributes: true,\r\n        applyHeightAttributes: true,\r\n      },\r\n      shorthand: true,\r\n      sixHex: true,\r\n    },\r\n    locals: {},\r\n  });\r\n\r\n  const timeoutPromise = new Promise<never>((_, reject) => {\r\n    const t = setTimeout(() => {\r\n      reject(\r\n        new CompileError(\r\n          `Maizzle compilation timed out after ${COMPILE_TIMEOUT_MS / 1000}s.`,\r\n          \"maizzle\",\r\n          \"compile\",\r\n        ),\r\n      );\r\n    }, COMPILE_TIMEOUT_MS);\r\n    if (typeof t.unref === \"function\") t.unref();\r\n  });\r\n\r\n  try {\r\n    const { html } = await Promise.race([compilePromise, timeoutPromise]);\r\n\r\n    if (!html) {\r\n      throw new CompileError(\"Maizzle compilation produced empty output.\", \"maizzle\", \"compile\");\r\n    }\r\n\r\n    return html;\r\n  } catch (err: unknown) {\r\n    if (err instanceof CompileError) throw err;\r\n    const message = err instanceof Error ? err.message : \"Unknown Maizzle compilation error\";\r\n    throw new CompileError(`Maizzle compilation failed: ${message}`, \"maizzle\", \"compile\");\r\n  }\r\n}\r\n","import { extname } from \"node:path\";\r\nimport type { InputFormat } from \"../types.js\";\r\n\r\nexport { CompileError } from \"./errors.js\";\r\nexport { compileReactEmail } from \"./react-email.js\";\r\nexport type { SandboxStrategy, CompileReactEmailOptions } from \"./react-email.js\";\r\nexport { compileMjml } from \"./mjml.js\";\r\nexport { compileMaizzle } from \"./maizzle.js\";\r\n\r\n/**\r\n * Compile source to HTML based on format.\r\n * Returns the HTML unchanged if format is \"html\".\r\n * Lazily imports per-format compilers to avoid loading unnecessary deps.\r\n */\r\nexport async function compile(\r\n  source: string,\r\n  format: InputFormat,\r\n): Promise<string> {\r\n  switch (format) {\r\n    case \"html\":\r\n      return source;\r\n\r\n    case \"jsx\": {\r\n      const { compileReactEmail } = await import(\"./react-email.js\");\r\n      return compileReactEmail(source);\r\n    }\r\n\r\n    case \"mjml\": {\r\n      const { compileMjml } = await import(\"./mjml.js\");\r\n      return compileMjml(source);\r\n    }\r\n\r\n    case \"maizzle\": {\r\n      const { compileMaizzle } = await import(\"./maizzle.js\");\r\n      return compileMaizzle(source);\r\n    }\r\n\r\n    default:\r\n      throw new Error(`Unknown format: \"${format}\". Use html, jsx, mjml, or maizzle.`);\r\n  }\r\n}\r\n\r\n/**\r\n * Auto-detect input format from file extension.\r\n */\r\nexport function detectFormat(filePath: string): InputFormat {\r\n  const ext = extname(filePath).toLowerCase();\r\n\r\n  switch (ext) {\r\n    case \".tsx\":\r\n    case \".jsx\":\r\n      return \"jsx\";\r\n    case \".mjml\":\r\n      return \"mjml\";\r\n    case \".html\":\r\n    case \".htm\":\r\n      return \"html\";\r\n    default:\r\n      return \"html\";\r\n  }\r\n}\r\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,IASa;AATb;AAAA;AAAA;AASO,IAAM,eAAN,cAA2B,MAAM;AAAA,MAKtC,YACE,SACA,QACA,OACA;AACA,cAAM,OAAO;AATf,aAAS,OAAO;AAUd,aAAK,SAAS;AACd,aAAK,QAAQ;AAAA,MACf;AAAA,IACF;AAAA;AAAA;;;ACvBA;AAAA;AAAA;AAAA;AAiDA,eAAsB,kBACpB,QACA,SACiB;AApDnB;AAqDE,QAAM,YAAW,wCAAS,YAAT,YAAoB;AAGrC,MAAI,CAAC,UAAU,CAAC,OAAO,KAAK,GAAG;AAC7B,UAAM,IAAI,aAAa,iCAAiC,OAAO,YAAY;AAAA,EAC7E;AAEA,MAAI,OAAO,SAAS,iBAAiB;AACnC,UAAM,IAAI;AAAA,MACR,sBAAsB,kBAAkB,GAAI;AAAA,MAC5C;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAGA,MAAI;AACJ,MAAI;AACJ,MAAI;AACJ,MAAI;AAEJ,MAAI;AACF,KAAC,EAAE,UAAU,IAAI,MAAM,OAAO,SAAS;AAAA,EACzC,SAAQ;AACN,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAEA,MAAI;AACF,YAAQ,MAAM,OAAO,OAAO;AAAA,EAC9B,SAAQ;AACN,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAEA,MAAI;AACF,2BAAuB,MAAM,OAAO,yBAAyB;AAAA,EAC/D,SAAQ;AACN,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAEA,MAAI;AACF,KAAC,EAAE,OAAO,IAAI,MAAM,OAAO,qBAAqB;AAAA,EAClD,SAAQ;AACN,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAGA,MAAI;AACJ,MAAI;AACF,UAAM,SAAS,UAAU,QAAQ;AAAA,MAC/B,YAAY,CAAC,cAAc,OAAO,SAAS;AAAA,MAC3C,YAAY;AAAA,MACZ,YAAY;AAAA,IACd,CAAC;AACD,qBAAiB,OAAO;AAAA,EAC1B,SAAS,KAAc;AACrB,UAAM,UAAU,eAAe,QAAQ,IAAI,UAAU;AACrD,UAAM,IAAI,aAAa,qBAAqB,OAAO,IAAI,OAAO,WAAW;AAAA,EAC3E;AAGA,MAAI;AAEJ,UAAQ,UAAU;AAAA,IAChB,KAAK;AACH,sBAAgB,MAAM,oBAAoB,gBAAgB,OAAO,oBAAoB;AACrF;AAAA,IACF,KAAK;AACH,sBAAgB,MAAM,iBAAiB,gBAAgB,OAAO,oBAAoB;AAClF;AAAA,IACF,KAAK;AACH,sBAAgB,MAAM,YAAY,gBAAgB,OAAO,oBAAoB;AAC7E;AAAA,IACF;AACE,YAAM,IAAI;AAAA,QACR,8BAA8B,QAAQ;AAAA,QACtC;AAAA,QACA;AAAA,MACF;AAAA,EACJ;AAGA,MAAI,aAAqB,mBAAc,YAAd,YAAyB;AAElD,MAAI,OAAO,cAAc,cAAc,OAAO,cAAc,YAAY,cAAc,MAAM;AAC1F,UAAM,SAAS,OAAO,OAAO,SAAoC;AACjE,UAAM,KAAK,OAAO,KAAK,CAAC,MAAM,OAAO,MAAM,UAAU;AACrD,QAAI,GAAI,aAAY;AAAA,EACtB;AAEA,MAAI,OAAO,cAAc,YAAY;AACnC,UAAM,IAAI;AAAA,MACR;AAAA,MAGA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAEA,MAAI;AACF,UAAM,UAAU,MAAM,cAAc,SAAqB;AACzD,UAAM,OAAO,MAAM,OAAO,OAAO;AACjC,WAAO;AAAA,EACT,SAAS,KAAc;AACrB,UAAM,UAAU,eAAe,QAAQ,IAAI,UAAU;AACrD,UAAM,IAAI,aAAa,0BAA0B,OAAO,IAAI,OAAO,QAAQ;AAAA,EAC7E;AACF;AAWA,eAAe,YACb,MACA,OACA,sBACkC;AAClC,QAAM,EAAE,eAAe,OAAO,IAAI,MAAM,OAAO,IAAS;AAExD,QAAM,kBAA2C;AAAA,IAC/C,OAAO;AAAA,IACP,2BAA2B;AAAA,EAC7B;AAEA,QAAM,gBAAyC,CAAC;AAChD,QAAM,YAAY,EAAE,SAAS,cAAc;AAE3C,QAAM,cAAc,CAAC,eAAgC;AACnD,QAAI,cAAc,iBAAiB;AACjC,aAAO,gBAAgB,UAAU;AAAA,IACnC;AACA,UAAM,IAAI;AAAA,MACR,cAAc,UAAU;AAAA,IAE1B;AAAA,EACF;AAEA,QAAM,UAAmC;AAAA,IACvC,QAAQ;AAAA,IACR,SAAS;AAAA,IACT,SAAS;AAAA,IACT;AAAA,IACA;AAAA,IAAQ;AAAA,IAAO;AAAA,IAAQ;AAAA,IAAQ;AAAA,IAC/B;AAAA,IAAK;AAAA,IAAK;AAAA,IAAS;AAAA,IACnB;AAAA,IAAM;AAAA,IAAM;AAAA,IAAM;AAAA,IAClB;AAAA,IAAO;AAAA,IAAW;AAAA,IAAY;AAAA,IAAgB;AAAA,IAAa;AAAA,IAC3D;AAAA,IAAS;AAAA,IACT,OAAO;AAAA,IAAW,SAAS;AAAA,IAC3B;AAAA,IAAU;AAAA,IAAY;AAAA,IAAO;AAAA,IAC7B;AAAA,IAAoB;AAAA,IAAoB;AAAA,IAAW;AAAA,IACnD;AAAA,IAAW;AAAA,IAAK;AAAA,IAChB,SAAS,EAAE,KAAK,MAAM;AAAA,IAAC,GAAG,MAAM,MAAM;AAAA,IAAC,GAAG,OAAO,MAAM;AAAA,IAAC,GAAG,MAAM,MAAM;AAAA,IAAC,GAAG,OAAO,MAAM;AAAA,IAAC,EAAE;AAAA,IAC3F,YAAY;AAAA,IAAW,aAAa;AAAA,IAAW,cAAc;AAAA,IAAW,gBAAgB;AAAA,IACxF,SAAS;AAAA,IAAW,YAAY;AAAA,IAAW,QAAQ;AAAA,IAAW,QAAQ;AAAA,IACtE,WAAW;AAAA,IAAW,YAAY;AAAA,EACpC;AAEA,QAAM,UAAU,cAAc,SAAS;AAAA,IACrC,gBAAgB,EAAE,SAAS,OAAO,MAAM,MAAM;AAAA,EAChD,CAAC;AAED,MAAI;AACF,UAAM,SAAS,IAAI,OAAO,MAAM,EAAE,UAAU,2BAA2B,CAAC;AACxE,WAAO,aAAa,SAAS,EAAE,SAAS,sBAAsB,eAAe,KAAK,CAAC;AAAA,EACrF,SAAS,KAAc;AACrB,UAAM,UAAU,eAAe,QAAQ,IAAI,UAAU;AACrD,QAAI,QAAQ,SAAS,4BAA4B,GAAG;AAClD,YAAM,IAAI,aAAa,qDAAqD,OAAO,WAAW;AAAA,IAChG;AACA,UAAM,IAAI,aAAa,wBAAwB,OAAO,IAAI,OAAO,WAAW;AAAA,EAC9E;AAEA,SAAO,UAAU;AACnB;AAqBA,eAAe,oBACb,MACA,OACA,sBACkC;AAjRpC;AAkRE,MAAI;AACJ,MAAI;AACF,UAAM,SAAS,MAAM,OAAO,aAAa;AACzC,WAAO,YAAe,YAAf,YAA0B;AAAA,EACnC,SAAQ;AACN,UAAM,IAAI;AAAA,MACR;AAAA,MAGA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAGA,QAAM,UAAU,IAAI,IAAI,QAAQ,EAAE,aAAa,IAAI,CAAC;AACpD,MAAI;AACF,UAAM,aAAa,MAAM,QAAQ,cAAc;AAS/C,UAAM,iBAAiB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,YA0Bf,IAAI;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAQZ,QAAI;AACF,YAAM,SAAS,MAAM,WAAW,KAAK,gBAAgB;AAAA,QACnD,SAAS;AAAA,MACX,CAAC;AAED,UAAI,OAAO,WAAW,UAAU;AAC9B,cAAM,SAAS,KAAK,MAAM,MAAM;AAChC,YAAI,CAAC,OAAO,IAAI;AACd,gBAAM,IAAI;AAAA,YACR,yBAAwB,YAAO,UAAP,YAAgB,eAAe;AAAA,YACvD;AAAA,YACA;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAAA,IACF,SAAS,KAAc;AACrB,UAAI,eAAe,aAAc,OAAM;AACvC,YAAM,UAAU,eAAe,QAAQ,IAAI,UAAU;AACrD,UAAI,QAAQ,SAAS,WAAW,KAAK,QAAQ,SAAS,SAAS,GAAG;AAChE,cAAM,IAAI,aAAa,qDAAqD,OAAO,WAAW;AAAA,MAChG;AACA,YAAM,IAAI,aAAa,wBAAwB,OAAO,IAAI,OAAO,WAAW;AAAA,IAC9E;AAAA,EACF,UAAE;AACA,YAAQ,QAAQ;AAAA,EAClB;AAGA,SAAO,YAAY,MAAM,OAAO,oBAAoB;AACtD;AAkBA,eAAe,iBACb,MACA,OACA,sBACkC;AAjYpC;AAkYE,MAAI;AACJ,MAAI;AACF,KAAC,EAAE,WAAW,IAAI,MAAM,OAAO,oBAAoB;AAAA,EACrD,SAAQ;AACN,UAAM,IAAI;AAAA,MACR;AAAA,MAGA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAEA,QAAM,UAAU,MAAM,WAAW;AACjC,QAAM,KAAK,QAAQ,WAAW;AAE9B,MAAI;AAOF,UAAM,iBAAiB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,YA8Bf,IAAI;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAQZ,UAAM,SAAS,GAAG,SAAS,cAAc;AACzC,QAAI,OAAO,OAAO;AAChB,YAAM,WAAW,GAAG,KAAK,OAAO,KAAK;AACrC,aAAO,MAAM,QAAQ;AACrB,YAAM,IAAI;AAAA,QACR,wBAAwB,OAAO,aAAa,WAAW,WAAW,0BAA0B;AAAA,QAC5F;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAEA,UAAM,YAAY,GAAG,KAAK,OAAO,KAAK;AACtC,WAAO,MAAM,QAAQ;AAErB,QAAI,OAAO,cAAc,UAAU;AACjC,YAAM,SAAS,KAAK,MAAM,SAAS;AACnC,UAAI,CAAC,OAAO,IAAI;AACd,cAAM,IAAI;AAAA,UACR,yBAAwB,YAAO,UAAP,YAAgB,eAAe;AAAA,UACvD;AAAA,UACA;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAIA,WAAO,YAAY,MAAM,OAAO,oBAAoB;AAAA,EACtD,UAAE;AACA,OAAG,QAAQ;AAAA,EACb;AACF;AA9dA,IAGM,iBAGA;AANN;AAAA;AAAA;AAAA;AAGA,IAAM,kBAAkB;AAGxB,IAAM,uBAAuB;AAAA;AAAA;;;ACN7B;AAAA;AAAA;AAAA;AAcA,eAAsB,YAAY,QAAiC;AAdnE;AAgBE,MAAI,CAAC,UAAU,CAAC,OAAO,KAAK,GAAG;AAC7B,UAAM,IAAI,aAAa,kCAAkC,QAAQ,YAAY;AAAA,EAC/E;AAEA,MAAI,OAAO,SAASA,kBAAiB;AACnC,UAAM,IAAI;AAAA,MACR,uBAAuBA,mBAAkB,GAAI;AAAA,MAC7C;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAEA,MAAI,CAAC,cAAc,KAAK,MAAM,GAAG;AAC/B,UAAM,IAAI;AAAA,MACR;AAAA,MAEA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAOA,MAAI;AAKJ,MAAI;AACF,UAAM,aAAa,MAAM,OAAO,MAAM;AACtC,iBAAY,gBAAW,YAAX,YAAsB;AAAA,EACpC,SAAQ;AACN,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAGA,MAAI;AAGF,UAAM,SAAS,MAAM,UAAU,QAAQ;AAAA,MACrC,iBAAiB;AAAA,MACjB,cAAc;AAAA,IAChB,CAAC;AAED,QAAI,OAAO,UAAU,OAAO,OAAO,SAAS,KAAK,CAAC,OAAO,MAAM;AAC7D,YAAM,gBAAgB,OAAO,OAC1B,IAAI,CAAC,MAAM,QAAQ,EAAE,IAAI,KAAK,EAAE,OAAO,KAAK,EAAE,OAAO,GAAG,EACxD,KAAK,IAAI;AACZ,YAAM,IAAI;AAAA,QACR,4BAA4B,aAAa;AAAA,QACzC;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAEA,QAAI,CAAC,OAAO,MAAM;AAChB,YAAM,IAAI,aAAa,2CAA2C,QAAQ,SAAS;AAAA,IACrF;AAEA,WAAO,OAAO;AAAA,EAChB,SAAS,KAAc;AACrB,QAAI,eAAe,aAAc,OAAM;AACvC,UAAM,UAAU,eAAe,QAAQ,IAAI,UAAU;AACrD,UAAM,IAAI,aAAa,4BAA4B,OAAO,IAAI,QAAQ,SAAS;AAAA,EACjF;AACF;AAxFA,IAGMA;AAHN;AAAA;AAAA;AAAA;AAGA,IAAMA,mBAAkB;AAAA;AAAA;;;ACHxB;AAAA;AAAA;AAAA;AAAA;AAuDO,SAAS,WAAW,KAAsB;AAC/C,SAAO,oBAAoB;AAC7B;AAEA,eAAsB,eAAe,QAAiC;AAEpE,MAAI,CAAC,UAAU,CAAC,OAAO,KAAK,GAAG;AAC7B,UAAM,IAAI,aAAa,qCAAqC,WAAW,YAAY;AAAA,EACrF;AAEA,MAAI,OAAO,SAASC,kBAAiB;AACnC,UAAM,IAAI;AAAA,MACR,0BAA0BA,mBAAkB,GAAI;AAAA,MAChD;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAGA,MAAI,uBAAuB,KAAK,MAAM,GAAG;AACvC,UAAM,IAAI;AAAA,MACR;AAAA,MAGA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAGA,MAAI;AAKJ,MAAI;AACJ,MAAI;AACF,cAAW,MAAM,OAAO,oBAAoB;AAAA,EAC9C,SAAQ;AACN,UAAM,IAAI;AAAA,MACR;AAAA,MAEA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAEA,MAAI,WAAW,OAAO,GAAG;AACvB,UAAM,IAAI;AAAA,MACR;AAAA,MAIA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,kBAAgB,QAAQ;AAGxB,QAAM,iBAAiB,cAAc,QAAQ;AAAA,IAC3C,KAAK;AAAA,MACH,QAAQ;AAAA,QACN,wBAAwB;AAAA,QACxB,sBAAsB;AAAA,QACtB,uBAAuB;AAAA,MACzB;AAAA,MACA,WAAW;AAAA,MACX,QAAQ;AAAA,IACV;AAAA,IACA,QAAQ,CAAC;AAAA,EACX,CAAC;AAED,QAAM,iBAAiB,IAAI,QAAe,CAAC,GAAG,WAAW;AACvD,UAAM,IAAI,WAAW,MAAM;AACzB;AAAA,QACE,IAAI;AAAA,UACF,uCAAuC,qBAAqB,GAAI;AAAA,UAChE;AAAA,UACA;AAAA,QACF;AAAA,MACF;AAAA,IACF,GAAG,kBAAkB;AACrB,QAAI,OAAO,EAAE,UAAU,WAAY,GAAE,MAAM;AAAA,EAC7C,CAAC;AAED,MAAI;AACF,UAAM,EAAE,KAAK,IAAI,MAAM,QAAQ,KAAK,CAAC,gBAAgB,cAAc,CAAC;AAEpE,QAAI,CAAC,MAAM;AACT,YAAM,IAAI,aAAa,8CAA8C,WAAW,SAAS;AAAA,IAC3F;AAEA,WAAO;AAAA,EACT,SAAS,KAAc;AACrB,QAAI,eAAe,aAAc,OAAM;AACvC,UAAM,UAAU,eAAe,QAAQ,IAAI,UAAU;AACrD,UAAM,IAAI,aAAa,+BAA+B,OAAO,IAAI,WAAW,SAAS;AAAA,EACvF;AACF;AA1JA,IAGMA,kBAGA,oBAcA;AApBN;AAAA;AAAA;AAAA;AAGA,IAAMA,mBAAkB;AAGxB,IAAM,qBAAqB;AAc3B,IAAM,yBACJ;AAAA;AAAA;;;ACrBF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,uBAAwB;AAGxB;AACA;AAEA;AACA;AAOA,eAAsB,QACpB,QACA,QACiB;AACjB,UAAQ,QAAQ;AAAA,IACd,KAAK;AACH,aAAO;AAAA,IAET,KAAK,OAAO;AACV,YAAM,EAAE,mBAAAC,mBAAkB,IAAI,MAAM;AACpC,aAAOA,mBAAkB,MAAM;AAAA,IACjC;AAAA,IAEA,KAAK,QAAQ;AACX,YAAM,EAAE,aAAAC,aAAY,IAAI,MAAM;AAC9B,aAAOA,aAAY,MAAM;AAAA,IAC3B;AAAA,IAEA,KAAK,WAAW;AACd,YAAM,EAAE,gBAAAC,gBAAe,IAAI,MAAM;AACjC,aAAOA,gBAAe,MAAM;AAAA,IAC9B;AAAA,IAEA;AACE,YAAM,IAAI,MAAM,oBAAoB,MAAM,qCAAqC;AAAA,EACnF;AACF;AAKO,SAAS,aAAa,UAA+B;AAC1D,QAAM,UAAM,0BAAQ,QAAQ,EAAE,YAAY;AAE1C,UAAQ,KAAK;AAAA,IACX,KAAK;AAAA,IACL,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AAAA,IACL,KAAK;AACH,aAAO;AAAA,IACT;AACE,aAAO;AAAA,EACX;AACF;","names":["MAX_SOURCE_SIZE","MAX_SOURCE_SIZE","compileReactEmail","compileMjml","compileMaizzle"]}
+{"version":3,"sources":["../../src/compile/errors.ts","../../src/compile/react-email.ts","../../src/compile/mjml.ts","../../src/compile/maizzle.ts","../../src/compile/index.ts"],"sourcesContent":["import type { InputFormat } from \"../types.js\";\r\n\r\n/**\r\n * Unified error class for all email compilation failures.\r\n *\r\n * Replaces the per-format error classes (ReactEmailCompileError,\r\n * MjmlCompileError, MaizzleCompileError) with a single class that\r\n * carries the source format and failure phase.\r\n */\r\nexport class CompileError extends Error {\r\n  override name = \"CompileError\";\r\n  readonly format: Exclude<InputFormat, \"html\">;\r\n  readonly phase: \"validation\" | \"transpile\" | \"execution\" | \"render\" | \"compile\";\r\n\r\n  constructor(\r\n    message: string,\r\n    format: CompileError[\"format\"],\r\n    phase: CompileError[\"phase\"],\r\n  ) {\r\n    super(message);\r\n    this.format = format;\r\n    this.phase = phase;\r\n  }\r\n}\r\n","import { CompileError } from \"./errors.js\";\n\n/** Maximum source code size: 256KB */\nconst MAX_SOURCE_SIZE = 256_000;\n\n/** Execution timeout: 5 seconds */\nconst EXECUTION_TIMEOUT_MS = 5_000;\n\n/**\n * Sandbox strategy for JSX execution.\n *\n * - `\"vm\"`: `node:vm` with hardened globals. Fast, zero-dependency, and NOT a\n *   security boundary. The hardening removes `process`, `Buffer` and timers\n *   from the sandbox and sets `codeGeneration.strings: false`, but host\n *   intrinsics are passed in, and the `Function` constructor reached through\n *   one of them compiles in the *host* realm where that flag does not apply:\n *   `Object.constructor(\"return process\")()` returns the real process, and\n *   `process.env` with it. Demonstrated in the test suite. Use it only for\n *   templates you already trust, such as a developer compiling their own.\n *\n * - `\"isolated-vm\"` (default): Separate V8 isolate via the `isolated-vm`\n *   npm package. True heap isolation; escapes require a V8 engine bug.\n *   Requires `isolated-vm` to be installed (native addon).\n *\n * - `\"quickjs\"`: Validates code structure in a QuickJS WASM sandbox, then\n *   executes in `node:vm` for React rendering. Security is equivalent to\n *   `node:vm`: the QuickJS phase validates import restrictions only.\n *   No native addons needed, but only supports ES2020 and is slower.\n *   For true isolation on servers, use `isolated-vm`.\n */\nexport type SandboxStrategy = \"vm\" | \"isolated-vm\" | \"quickjs\";\n\nexport interface CompileReactEmailOptions {\n  /**\n   * Sandbox strategy to use for executing user JSX code.\n   * @default \"isolated-vm\"\n   */\n  sandbox?: SandboxStrategy;\n}\n\n/**\n * Compile a React Email JSX/TSX source string into an HTML email string.\n *\n * Pipeline:\n *  1. Validate input (size, basic checks)\n *  2. Transpile JSX/TSX → CommonJS JS using sucrase\n *  3. Execute inside a sandbox (configurable strategy)\n *  4. Render the exported component to a full HTML email string\n *\n * Requires peer dependencies: sucrase, react, @react-email/components,\n * @react-email/render. Additionally:\n *  - sandbox \"isolated-vm\" requires `isolated-vm`\n *  - sandbox \"quickjs\" requires `quickjs-emscripten`\n */\nexport async function compileReactEmail(\n  source: string,\n  options?: CompileReactEmailOptions,\n): Promise<string> {\n  const strategy = options?.sandbox ?? \"isolated-vm\";\n\n  // ── 1. Validate ──────────────────────────────────────────────────────\n  if (!source || !source.trim()) {\n    throw new CompileError(\"JSX source must not be empty.\", \"jsx\", \"validation\");\n  }\n\n  if (source.length > MAX_SOURCE_SIZE) {\n    throw new CompileError(\n      `JSX source exceeds ${MAX_SOURCE_SIZE / 1000}KB limit.`,\n      \"jsx\",\n      \"validation\",\n    );\n  }\n\n  // ── 2. Load peer dependencies ────────────────────────────────────────\n  let transform: typeof import(\"sucrase\").transform;\n  let React: typeof import(\"react\");\n  let ReactEmailComponents: typeof import(\"@react-email/components\");\n  let render: typeof import(\"@react-email/render\").render;\n\n  try {\n    ({ transform } = await import(\"sucrase\"));\n  } catch {\n    throw new CompileError(\n      'JSX compilation requires \"sucrase\". Install it:\\n  npm install sucrase',\n      \"jsx\",\n      \"transpile\",\n    );\n  }\n\n  try {\n    React = await import(\"react\");\n  } catch {\n    throw new CompileError(\n      'JSX compilation requires \"react\". Install it:\\n  npm install react',\n      \"jsx\",\n      \"transpile\",\n    );\n  }\n\n  try {\n    ReactEmailComponents = await import(\"@react-email/components\");\n  } catch {\n    throw new CompileError(\n      'JSX compilation requires \"@react-email/components\". Install it:\\n  npm install @react-email/components',\n      \"jsx\",\n      \"transpile\",\n    );\n  }\n\n  try {\n    ({ render } = await import(\"@react-email/render\"));\n  } catch {\n    throw new CompileError(\n      'JSX compilation requires \"@react-email/render\". Install it:\\n  npm install @react-email/render',\n      \"jsx\",\n      \"transpile\",\n    );\n  }\n\n  // ── 3. Transpile JSX/TSX → CommonJS ──────────────────────────────────\n  let transpiledCode: string;\n  try {\n    const result = transform(source, {\n      transforms: [\"typescript\", \"jsx\", \"imports\"],\n      jsxRuntime: \"classic\",\n      production: true,\n    });\n    transpiledCode = result.code;\n  } catch (err: unknown) {\n    const message = err instanceof Error ? err.message : \"Unknown transpilation error\";\n    throw new CompileError(`JSX syntax error: ${message}`, \"jsx\", \"transpile\");\n  }\n\n  // ── 4. Execute in sandbox ────────────────────────────────────────────\n  let moduleExports: Record<string, unknown>;\n\n  switch (strategy) {\n    case \"isolated-vm\":\n      moduleExports = await executeInIsolatedVm(transpiledCode, React, ReactEmailComponents);\n      break;\n    case \"quickjs\":\n      moduleExports = await executeInQuickJs(transpiledCode, React, ReactEmailComponents);\n      break;\n    case \"vm\":\n      moduleExports = await executeInVm(transpiledCode, React, ReactEmailComponents);\n      break;\n    default:\n      throw new CompileError(\n        `Unknown sandbox strategy: \"${strategy}\". Use \"vm\", \"isolated-vm\", or \"quickjs\".`,\n        \"jsx\",\n        \"execution\",\n      );\n  }\n\n  // ── 5. Extract component and render ──────────────────────────────────\n  let Component: unknown = moduleExports.default ?? moduleExports;\n\n  if (typeof Component !== \"function\" && typeof Component === \"object\" && Component !== null) {\n    const values = Object.values(Component as Record<string, unknown>);\n    const fn = values.find((v) => typeof v === \"function\");\n    if (fn) Component = fn;\n  }\n\n  if (typeof Component !== \"function\") {\n    throw new CompileError(\n      'The JSX source must export a React component function. ' +\n        'Use \"export default function Email() { ... }\" or ' +\n        '\"export function Email() { ... }\".',\n      \"jsx\",\n      \"execution\",\n    );\n  }\n\n  try {\n    const element = React.createElement(Component as React.FC);\n    const html = await render(element);\n    return html;\n  } catch (err: unknown) {\n    const message = err instanceof Error ? err.message : \"Unknown rendering error\";\n    throw new CompileError(`React rendering error: ${message}`, \"jsx\", \"render\");\n  }\n}\n\n// ─── Sandbox: node:vm ──────────────────────────────────────────────────────\n\n/**\n * Execute transpiled code in a node:vm context with hardened globals.\n *\n * NOT a security boundary, see node:vm documentation. Suitable for CLI\n * use where the user runs their own code. For server use, prefer\n * \"isolated-vm\" or \"quickjs\".\n */\nasync function executeInVm(\n  code: string,\n  React: typeof import(\"react\"),\n  ReactEmailComponents: typeof import(\"@react-email/components\"),\n): Promise<Record<string, unknown>> {\n  const { createContext, Script } = await import(\"node:vm\");\n\n  const ALLOWED_MODULES: Record<string, unknown> = {\n    react: React,\n    \"@react-email/components\": ReactEmailComponents,\n  };\n\n  const moduleExports: Record<string, unknown> = {};\n  const moduleObj = { exports: moduleExports };\n\n  const mockRequire = (moduleName: string): unknown => {\n    if (moduleName in ALLOWED_MODULES) {\n      return ALLOWED_MODULES[moduleName];\n    }\n    throw new Error(\n      `Import of \"${moduleName}\" is not allowed. ` +\n        `Only \"react\" and \"@react-email/components\" can be imported.`,\n    );\n  };\n\n  const sandbox: Record<string, unknown> = {\n    module: moduleObj,\n    exports: moduleExports,\n    require: mockRequire,\n    React,\n    Object, Array, String, Number, Boolean,\n    Map, Set, WeakMap, WeakSet,\n    JSON, Math, Date, RegExp,\n    Error, TypeError, RangeError, ReferenceError, SyntaxError, URIError,\n    Promise, Symbol,\n    Proxy: undefined, Reflect: undefined,\n    parseInt, parseFloat, isNaN, isFinite,\n    encodeURIComponent, decodeURIComponent, encodeURI, decodeURI,\n    undefined, NaN, Infinity,\n    console: { log: () => {}, warn: () => {}, error: () => {}, info: () => {}, debug: () => {} },\n    setTimeout: undefined, setInterval: undefined, setImmediate: undefined, queueMicrotask: undefined,\n    process: undefined, globalThis: undefined, global: undefined, Buffer: undefined,\n    __dirname: undefined, __filename: undefined,\n  };\n\n  const context = createContext(sandbox, {\n    codeGeneration: { strings: false, wasm: false },\n  });\n\n  try {\n    const script = new Script(code, { filename: \"user-email-component.tsx\" });\n    script.runInContext(context, { timeout: EXECUTION_TIMEOUT_MS, displayErrors: true });\n  } catch (err: unknown) {\n    const message = err instanceof Error ? err.message : \"Unknown execution error\";\n    if (message.includes(\"Script execution timed out\")) {\n      throw new CompileError(\"JSX execution timed out (possible infinite loop).\", \"jsx\", \"execution\");\n    }\n    throw new CompileError(`JSX execution error: ${message}`, \"jsx\", \"execution\");\n  }\n\n  return moduleObj.exports as Record<string, unknown>;\n}\n\n// ─── Sandbox: isolated-vm ──────────────────────────────────────────────────\n\n/**\n * Validate code in a separate V8 isolate, then execute in `node:vm`.\n *\n * Two-phase approach:\n *  1. **Validate**: run the transpiled code in a true V8 isolate with stub\n *     React/component implementations. This catches disallowed imports and\n *     structural errors inside a genuine security boundary (separate heap,\n *     128 MB memory cap, timeout). Escape requires a V8 engine bug.\n *  2. **Execute**: run the validated code in `node:vm` with real React\n *     objects for actual rendering.\n *\n * Why two phases: React's internal type system uses Symbols\n * (`Symbol(react.forward_ref)`, `Symbol(react.element)`, etc.) which cannot\n * be transferred across V8 isolate boundaries, the structured clone\n * algorithm does not support Symbols. Running React code directly inside\n * `isolated-vm` is not possible.\n */\nasync function executeInIsolatedVm(\n  code: string,\n  React: typeof import(\"react\"),\n  ReactEmailComponents: typeof import(\"@react-email/components\"),\n): Promise<Record<string, unknown>> {\n  let ivm: typeof import(\"isolated-vm\");\n  try {\n    const ivmMod = await import(\"isolated-vm\");\n    ivm = (ivmMod as any).default ?? ivmMod;\n  } catch {\n    throw new CompileError(\n      'Sandbox strategy \"isolated-vm\" requires the \"isolated-vm\" package. Install it:\\n' +\n        \"  npm install isolated-vm\\n\" +\n        'Or pass sandbox: \"vm\", which needs no native addon and is NOT a security' +\n        ' boundary: code you compile can reach the host process and its environment.' +\n        ' Only choose it for templates you already trust.',\n      \"jsx\",\n      \"execution\",\n    );\n  }\n\n  // ── Phase 1: Validate in a true V8 isolate ─────────────────────────────\n  const isolate = new ivm.Isolate({ memoryLimit: 128 });\n  try {\n    const ivmContext = await isolate.createContext();\n\n    // Stub implementations let the code parse and execute structurally\n    // without needing real React objects (which contain non-cloneable Symbols).\n    // Stub React: createElement returns a plain object, forwardRef passes\n    // through, and any unknown property returns a no-op function. The Proxy\n    // on the components module ensures that any named import (Html, Head,\n    // Button, etc.) resolves to a dummy component function so the transpiled\n    // code can execute structurally without real React objects.\n    const validationCode = `\n      (function() {\n        var module = { exports: {} };\n        var exports = module.exports;\n        var noop = function() { return {}; };\n        var React = new Proxy({\n          createElement: noop,\n          forwardRef: function(fn) { return fn; },\n          Fragment: \"Fragment\",\n          createContext: function() { return { Provider: noop, Consumer: noop }; },\n          useState: function(v) { return [v, noop]; },\n          useRef: function() { return { current: null }; },\n          useEffect: noop,\n          useMemo: function(fn) { return fn(); },\n          useCallback: function(fn) { return fn; },\n          Children: { map: noop, forEach: noop, toArray: function() { return []; } },\n        }, { get: function(t, p) { return p in t ? t[p] : noop; } });\n        var componentsProxy = new Proxy({}, {\n          get: function() { return noop; }\n        });\n        function require(name) {\n          if (name === \"react\") return React;\n          if (name === \"@react-email/components\") return componentsProxy;\n          throw new Error('Import of \"' + name + '\" is not allowed. Only \"react\" and \"@react-email/components\" can be imported.');\n        }\n        try {\n          ${code}\n          return JSON.stringify({ ok: true });\n        } catch(e) {\n          return JSON.stringify({ ok: false, error: e.message || \"Unknown error\" });\n        }\n      })()\n    `;\n\n    try {\n      const result = await ivmContext.eval(validationCode, {\n        timeout: EXECUTION_TIMEOUT_MS,\n      });\n\n      if (typeof result === \"string\") {\n        const parsed = JSON.parse(result) as { ok: boolean; error?: string };\n        if (!parsed.ok) {\n          throw new CompileError(\n            `JSX execution error: ${parsed.error ?? \"Unknown error\"}`,\n            \"jsx\",\n            \"execution\",\n          );\n        }\n      }\n    } catch (err: unknown) {\n      if (err instanceof CompileError) throw err;\n      const message = err instanceof Error ? err.message : \"Unknown execution error\";\n      if (message.includes(\"timed out\") || message.includes(\"Timeout\")) {\n        throw new CompileError(\"JSX execution timed out (possible infinite loop).\", \"jsx\", \"execution\");\n      }\n      throw new CompileError(`JSX execution error: ${message}`, \"jsx\", \"execution\");\n    }\n  } finally {\n    isolate.dispose();\n  }\n\n  // ── Phase 2: Execute validated code in node:vm with real React ──────────\n  return executeInVm(code, React, ReactEmailComponents);\n}\n\n// ─── Sandbox: QuickJS (WASM) ──────────────────────────────────────────────\n\n/**\n * Validate code structure in QuickJS WASM, then execute in `node:vm`.\n *\n * Two-phase approach:\n *  1. Validate that the code doesn't access disallowed modules by running it\n *     in a QuickJS WASM sandbox with stub implementations.\n *  2. Execute in `node:vm` for actual React rendering (React objects can't\n *     cross the WASM boundary).\n *\n * **Security note:** The actual execution happens in `node:vm`, so runtime\n * security is equivalent to the `\"vm\"` strategy. The QuickJS phase only\n * validates import restrictions. For true isolation on servers, use\n * `\"isolated-vm\"`.\n */\nasync function executeInQuickJs(\n  code: string,\n  React: typeof import(\"react\"),\n  ReactEmailComponents: typeof import(\"@react-email/components\"),\n): Promise<Record<string, unknown>> {\n  let getQuickJS: typeof import(\"quickjs-emscripten\").getQuickJS;\n  try {\n    ({ getQuickJS } = await import(\"quickjs-emscripten\"));\n  } catch {\n    throw new CompileError(\n      'Sandbox strategy \"quickjs\" requires the \"quickjs-emscripten\" package. Install it:\\n' +\n        \"  npm install quickjs-emscripten\\n\" +\n        'Or pass sandbox: \"vm\", which needs no native addon and is NOT a security' +\n        ' boundary: code you compile can reach the host process and its environment.' +\n        ' Only choose it for templates you already trust.',\n      \"jsx\",\n      \"execution\",\n    );\n  }\n\n  const QuickJS = await getQuickJS();\n  const vm = QuickJS.newContext();\n\n  try {\n    // Phase 1: Validate code safety in the WASM sandbox.\n    // We provide stub implementations of React and the module system so\n    // the code can execute without errors, but we only care that it\n    // doesn't try to access anything dangerous.\n    // QuickJS (ES2020) does not support Proxy, so we enumerate known\n    // React Email component names as stub functions instead.\n    const validationCode = `\n      (function() {\n        var module = { exports: {} };\n        var exports = module.exports;\n        var noop = function() { return {}; };\n        var React = {\n          createElement: noop,\n          forwardRef: function(fn) { return fn; },\n          Fragment: \"Fragment\",\n          createContext: function() { return { Provider: noop, Consumer: noop }; },\n          useState: function(v) { return [v, noop]; },\n          useRef: function() { return { current: null }; },\n          useEffect: noop,\n          useMemo: function(fn) { return fn(); },\n          useCallback: function(fn) { return fn; },\n          Children: { map: noop, forEach: noop, toArray: function() { return []; } },\n        };\n        var components = {};\n        var names = [\n          \"Html\",\"Head\",\"Body\",\"Container\",\"Section\",\"Row\",\"Column\",\"Text\",\n          \"Link\",\"Button\",\"Img\",\"Hr\",\"Preview\",\"Heading\",\"Font\",\"Style\",\n          \"CodeBlock\",\"CodeInline\",\"Markdown\",\"Tailwind\",\"Responsive\",\n        ];\n        for (var i = 0; i < names.length; i++) components[names[i]] = noop;\n        function require(name) {\n          if (name === \"react\") return React;\n          if (name === \"@react-email/components\") return components;\n          throw new Error('Import of \"' + name + '\" is not allowed.');\n        }\n        try {\n          ${code}\n          return JSON.stringify({ ok: true });\n        } catch(e) {\n          return JSON.stringify({ ok: false, error: e.message || \"Unknown error\" });\n        }\n      })()\n    `;\n\n    const result = vm.evalCode(validationCode);\n    if (result.error) {\n      const errorVal = vm.dump(result.error);\n      result.error.dispose();\n      throw new CompileError(\n        `JSX execution error: ${typeof errorVal === \"string\" ? errorVal : \"QuickJS execution failed\"}`,\n        \"jsx\",\n        \"execution\",\n      );\n    }\n\n    const resultStr = vm.dump(result.value);\n    result.value.dispose();\n\n    if (typeof resultStr === \"string\") {\n      const parsed = JSON.parse(resultStr) as { ok: boolean; error?: string };\n      if (!parsed.ok) {\n        throw new CompileError(\n          `JSX execution error: ${parsed.error ?? \"Unknown error\"}`,\n          \"jsx\",\n          \"execution\",\n        );\n      }\n    }\n\n    // Phase 2: Code validated as safe; execute in node:vm for actual\n    // React rendering (React objects can't cross the WASM boundary)\n    return executeInVm(code, React, ReactEmailComponents);\n  } finally {\n    vm.dispose();\n  }\n}\n","import { CompileError } from \"./errors.js\";\r\n\r\n/** Maximum MJML source size: 512KB */\r\nconst MAX_SOURCE_SIZE = 512_000;\r\n\r\n/**\r\n * Compile an MJML source string into an HTML email string.\r\n *\r\n * MJML is a declarative markup language with no code execution capability\r\n * (unlike JSX). The mjml library parses XML and generates HTML; there is\r\n * no sandboxing concern.\r\n *\r\n * Requires peer dependency: mjml\r\n */\r\nexport async function compileMjml(source: string): Promise<string> {\r\n  // ── 1. Validate ──────────────────────────────────────────────────────\r\n  if (!source || !source.trim()) {\r\n    throw new CompileError(\"MJML source must not be empty.\", \"mjml\", \"validation\");\r\n  }\r\n\r\n  if (source.length > MAX_SOURCE_SIZE) {\r\n    throw new CompileError(\r\n      `MJML source exceeds ${MAX_SOURCE_SIZE / 1000}KB limit.`,\r\n      \"mjml\",\r\n      \"validation\",\r\n    );\r\n  }\r\n\r\n  if (!/<mjml[\\s>]/i.test(source)) {\r\n    throw new CompileError(\r\n      \"MJML source must contain a root <mjml> element. \" +\r\n        \"Example: <mjml><mj-body><mj-section><mj-column><mj-text>Hello</mj-text></mj-column></mj-section></mj-body></mjml>\",\r\n      \"mjml\",\r\n      \"validation\",\r\n    );\r\n  }\r\n\r\n  // ── 2. Load peer dependency ──────────────────────────────────────────\r\n  type MjmlResult = {\r\n    html: string;\r\n    errors: Array<{ line: number; message: string; tagName: string; formattedMessage: string }>;\r\n  };\r\n  let mjml2html: (\r\n    input: string,\r\n    options?: Record<string, unknown>,\r\n  ) => MjmlResult | Promise<MjmlResult>;\r\n\r\n  try {\r\n    const mjmlModule = await import(\"mjml\");\r\n    mjml2html = mjmlModule.default ?? mjmlModule;\r\n  } catch {\r\n    throw new CompileError(\r\n      'MJML compilation requires \"mjml\". Install it:\\n  npm install mjml',\r\n      \"mjml\",\r\n      \"compile\",\r\n    );\r\n  }\r\n\r\n  // ── 3. Compile ───────────────────────────────────────────────────────\r\n  try {\r\n    // mjml v5+ returns a Promise; v4 returns synchronously.\r\n    // Await handles both cases.\r\n    const result = await mjml2html(source, {\r\n      validationLevel: \"soft\",\r\n      keepComments: false,\r\n    });\r\n\r\n    if (result.errors && result.errors.length > 0 && !result.html) {\r\n      const errorMessages = result.errors\r\n        .map((e) => `Line ${e.line}: ${e.message} (${e.tagName})`)\r\n        .join(\"; \");\r\n      throw new CompileError(\r\n        `MJML compilation errors: ${errorMessages}`,\r\n        \"mjml\",\r\n        \"compile\",\r\n      );\r\n    }\r\n\r\n    if (!result.html) {\r\n      throw new CompileError(\"MJML compilation produced empty output.\", \"mjml\", \"compile\");\r\n    }\r\n\r\n    return result.html;\r\n  } catch (err: unknown) {\r\n    if (err instanceof CompileError) throw err;\r\n    const message = err instanceof Error ? err.message : \"Unknown MJML compilation error\";\r\n    throw new CompileError(`MJML compilation failed: ${message}`, \"mjml\", \"compile\");\r\n  }\r\n}\r\n","import { CompileError } from \"./errors.js\";\r\n\r\n/** Maximum Maizzle source size: 512KB */\r\nconst MAX_SOURCE_SIZE = 512_000;\r\n\r\n/** Compilation timeout: 15 seconds */\r\nconst COMPILE_TIMEOUT_MS = 15_000;\r\n\r\n/**\r\n * PostHTML directives that perform file-system reads or network fetches.\r\n *\r\n * Maizzle's PostHTML pipeline resolves these at compile time: a template\r\n * like `<extends src=\"/etc/passwd\">` causes the server to read that path\r\n * and include the content in rendered output (server-side file read). We\r\n * reject any input containing these directives rather than stripping them,\r\n * because stripping is error-prone with nested or malformed markup.\r\n *\r\n * Affected plugins: posthtml-extend, posthtml-fetch, posthtml-components,\r\n * posthtml-include, posthtml-modules.\r\n */\r\nconst DANGEROUS_DIRECTIVE_RE =\r\n  /<\\s*(?:extends|component|fetch|include|module|slot|fill|raw|block|yield)\\b/i;\r\n\r\n/**\r\n * Compile a Maizzle template string into an HTML email string.\r\n *\r\n * Pipeline:\r\n *  1. Validate input (size, basic structure check)\r\n *  2. Reject inputs containing PostHTML file-access directives\r\n *  3. Compile using @maizzle/framework\r\n *\r\n * Security:\r\n *  - PostHTML file-system directives are rejected at validation time\r\n *    to prevent server-side file reads and SSRF.\r\n *  - Template expressions ({{ expr }}) are evaluated by posthtml-expressions\r\n *    with empty `locals`, so unknown identifiers like `process` or `require`\r\n *    return the literal string '{local}' rather than accessing Node.js globals.\r\n *  - A hard timeout prevents pathological PostCSS/Tailwind inputs from\r\n *    hanging indefinitely.\r\n *\r\n * Requires peer dependency: @maizzle/framework\r\n */\r\n/**\r\n * Is this the Maizzle 6 module?\r\n *\r\n * Maizzle 6 replaced the HTML template with a Vue single-file component, and\r\n * its `render` resolves a string argument as a path rather than as source.\r\n * Handed a template it reports `Failed to load url <!DOCTYPE html>…`, which\r\n * describes nothing an author can act on, so the caller checks first and says\r\n * what actually happened.\r\n *\r\n * `createRenderer` is the discriminator: exported by every v6 release and by\r\n * no v5 one. The module carries no version to read, so a capability probe is\r\n * what there is.\r\n */\r\nexport function isMaizzle6(mod: object): boolean {\r\n  return \"createRenderer\" in mod;\r\n}\r\n\r\nexport async function compileMaizzle(source: string): Promise<string> {\r\n  // ── 1. Validate ──────────────────────────────────────────────────────\r\n  if (!source || !source.trim()) {\r\n    throw new CompileError(\"Maizzle source must not be empty.\", \"maizzle\", \"validation\");\r\n  }\r\n\r\n  if (source.length > MAX_SOURCE_SIZE) {\r\n    throw new CompileError(\r\n      `Maizzle source exceeds ${MAX_SOURCE_SIZE / 1000}KB limit.`,\r\n      \"maizzle\",\r\n      \"validation\",\r\n    );\r\n  }\r\n\r\n  // ── 2. Block file-system and network PostHTML directives ─────────────\r\n  if (DANGEROUS_DIRECTIVE_RE.test(source)) {\r\n    throw new CompileError(\r\n      \"Maizzle templates may not use <extends>, <component>, <fetch>, <include>, \" +\r\n        \"<module>, <slot>, <fill>, <raw>, <block>, or <yield> directives. These directives \" +\r\n        \"access the server file system at compile time. Use inline HTML and Tailwind utility classes instead.\",\r\n      \"maizzle\",\r\n      \"validation\",\r\n    );\r\n  }\r\n\r\n  // ── 3. Load peer dependency ──────────────────────────────────────────\r\n  let maizzleRender: (\r\n    input: string,\r\n    options: Record<string, unknown>,\r\n  ) => Promise<{ html: string }>;\r\n\r\n  let maizzle: Record<string, unknown>;\r\n  try {\r\n    maizzle = (await import(\"@maizzle/framework\")) as unknown as Record<string, unknown>;\r\n  } catch {\r\n    throw new CompileError(\r\n      'Maizzle compilation requires \"@maizzle/framework\". Install it:\\n' +\r\n        \"  npm install @maizzle/framework@5\",\r\n      \"maizzle\",\r\n      \"compile\",\r\n    );\r\n  }\r\n\r\n  if (isMaizzle6(maizzle)) {\r\n    throw new CompileError(\r\n      \"Maizzle 6 is installed, and this engine compiles Maizzle 5 templates.\\n\" +\r\n        \"Maizzle 6 renders Vue single-file components rather than HTML, so an\\n\" +\r\n        \"HTML template is not something it can read. Install the supported major:\\n\" +\r\n        \"  npm install @maizzle/framework@5\",\r\n      \"maizzle\",\r\n      \"compile\",\r\n    );\r\n  }\r\n  maizzleRender = maizzle.render as typeof maizzleRender;\r\n\r\n  // ── 4. Compile with timeout ──────────────────────────────────────────\r\n  const compilePromise = maizzleRender(source, {\r\n    css: {\r\n      inline: {\r\n        removeInlinedSelectors: true,\r\n        applyWidthAttributes: true,\r\n        applyHeightAttributes: true,\r\n      },\r\n      shorthand: true,\r\n      sixHex: true,\r\n    },\r\n    locals: {},\r\n  });\r\n\r\n  const timeoutPromise = new Promise<never>((_, reject) => {\r\n    const t = setTimeout(() => {\r\n      reject(\r\n        new CompileError(\r\n          `Maizzle compilation timed out after ${COMPILE_TIMEOUT_MS / 1000}s.`,\r\n          \"maizzle\",\r\n          \"compile\",\r\n        ),\r\n      );\r\n    }, COMPILE_TIMEOUT_MS);\r\n    if (typeof t.unref === \"function\") t.unref();\r\n  });\r\n\r\n  try {\r\n    const { html } = await Promise.race([compilePromise, timeoutPromise]);\r\n\r\n    if (!html) {\r\n      throw new CompileError(\"Maizzle compilation produced empty output.\", \"maizzle\", \"compile\");\r\n    }\r\n\r\n    return html;\r\n  } catch (err: unknown) {\r\n    if (err instanceof CompileError) throw err;\r\n    const message = err instanceof Error ? err.message : \"Unknown Maizzle compilation error\";\r\n    throw new CompileError(`Maizzle compilation failed: ${message}`, \"maizzle\", \"compile\");\r\n  }\r\n}\r\n","import { extname } from \"node:path\";\r\nimport type { InputFormat } from \"../types.js\";\r\n\r\nexport { CompileError } from \"./errors.js\";\r\nexport { compileReactEmail } from \"./react-email.js\";\r\nexport type { SandboxStrategy, CompileReactEmailOptions } from \"./react-email.js\";\r\nexport { compileMjml } from \"./mjml.js\";\r\nexport { compileMaizzle } from \"./maizzle.js\";\r\n\r\n/**\r\n * Compile source to HTML based on format.\r\n * Returns the HTML unchanged if format is \"html\".\r\n * Lazily imports per-format compilers to avoid loading unnecessary deps.\r\n */\r\nexport async function compile(\r\n  source: string,\r\n  format: InputFormat,\r\n): Promise<string> {\r\n  switch (format) {\r\n    case \"html\":\r\n      return source;\r\n\r\n    case \"jsx\": {\r\n      const { compileReactEmail } = await import(\"./react-email.js\");\r\n      return compileReactEmail(source);\r\n    }\r\n\r\n    case \"mjml\": {\r\n      const { compileMjml } = await import(\"./mjml.js\");\r\n      return compileMjml(source);\r\n    }\r\n\r\n    case \"maizzle\": {\r\n      const { compileMaizzle } = await import(\"./maizzle.js\");\r\n      return compileMaizzle(source);\r\n    }\r\n\r\n    default:\r\n      throw new Error(`Unknown format: \"${format}\". Use html, jsx, mjml, or maizzle.`);\r\n  }\r\n}\r\n\r\n/**\r\n * Auto-detect input format from file extension.\r\n */\r\nexport function detectFormat(filePath: string): InputFormat {\r\n  const ext = extname(filePath).toLowerCase();\r\n\r\n  switch (ext) {\r\n    case \".tsx\":\r\n    case \".jsx\":\r\n      return \"jsx\";\r\n    case \".mjml\":\r\n      return \"mjml\";\r\n    case \".html\":\r\n    case \".htm\":\r\n      return \"html\";\r\n    default:\r\n      return \"html\";\r\n  }\r\n}\r\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,IASa;AATb;AAAA;AAAA;AASO,IAAM,eAAN,cAA2B,MAAM;AAAA,MAKtC,YACE,SACA,QACA,OACA;AACA,cAAM,OAAO;AATf,aAAS,OAAO;AAUd,aAAK,SAAS;AACd,aAAK,QAAQ;AAAA,MACf;AAAA,IACF;AAAA;AAAA;;;ACvBA;AAAA;AAAA;AAAA;AAsDA,eAAsB,kBACpB,QACA,SACiB;AAzDnB;AA0DE,QAAM,YAAW,wCAAS,YAAT,YAAoB;AAGrC,MAAI,CAAC,UAAU,CAAC,OAAO,KAAK,GAAG;AAC7B,UAAM,IAAI,aAAa,iCAAiC,OAAO,YAAY;AAAA,EAC7E;AAEA,MAAI,OAAO,SAAS,iBAAiB;AACnC,UAAM,IAAI;AAAA,MACR,sBAAsB,kBAAkB,GAAI;AAAA,MAC5C;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAGA,MAAI;AACJ,MAAI;AACJ,MAAI;AACJ,MAAI;AAEJ,MAAI;AACF,KAAC,EAAE,UAAU,IAAI,MAAM,OAAO,SAAS;AAAA,EACzC,SAAQ;AACN,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAEA,MAAI;AACF,YAAQ,MAAM,OAAO,OAAO;AAAA,EAC9B,SAAQ;AACN,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAEA,MAAI;AACF,2BAAuB,MAAM,OAAO,yBAAyB;AAAA,EAC/D,SAAQ;AACN,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAEA,MAAI;AACF,KAAC,EAAE,OAAO,IAAI,MAAM,OAAO,qBAAqB;AAAA,EAClD,SAAQ;AACN,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAGA,MAAI;AACJ,MAAI;AACF,UAAM,SAAS,UAAU,QAAQ;AAAA,MAC/B,YAAY,CAAC,cAAc,OAAO,SAAS;AAAA,MAC3C,YAAY;AAAA,MACZ,YAAY;AAAA,IACd,CAAC;AACD,qBAAiB,OAAO;AAAA,EAC1B,SAAS,KAAc;AACrB,UAAM,UAAU,eAAe,QAAQ,IAAI,UAAU;AACrD,UAAM,IAAI,aAAa,qBAAqB,OAAO,IAAI,OAAO,WAAW;AAAA,EAC3E;AAGA,MAAI;AAEJ,UAAQ,UAAU;AAAA,IAChB,KAAK;AACH,sBAAgB,MAAM,oBAAoB,gBAAgB,OAAO,oBAAoB;AACrF;AAAA,IACF,KAAK;AACH,sBAAgB,MAAM,iBAAiB,gBAAgB,OAAO,oBAAoB;AAClF;AAAA,IACF,KAAK;AACH,sBAAgB,MAAM,YAAY,gBAAgB,OAAO,oBAAoB;AAC7E;AAAA,IACF;AACE,YAAM,IAAI;AAAA,QACR,8BAA8B,QAAQ;AAAA,QACtC;AAAA,QACA;AAAA,MACF;AAAA,EACJ;AAGA,MAAI,aAAqB,mBAAc,YAAd,YAAyB;AAElD,MAAI,OAAO,cAAc,cAAc,OAAO,cAAc,YAAY,cAAc,MAAM;AAC1F,UAAM,SAAS,OAAO,OAAO,SAAoC;AACjE,UAAM,KAAK,OAAO,KAAK,CAAC,MAAM,OAAO,MAAM,UAAU;AACrD,QAAI,GAAI,aAAY;AAAA,EACtB;AAEA,MAAI,OAAO,cAAc,YAAY;AACnC,UAAM,IAAI;AAAA,MACR;AAAA,MAGA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAEA,MAAI;AACF,UAAM,UAAU,MAAM,cAAc,SAAqB;AACzD,UAAM,OAAO,MAAM,OAAO,OAAO;AACjC,WAAO;AAAA,EACT,SAAS,KAAc;AACrB,UAAM,UAAU,eAAe,QAAQ,IAAI,UAAU;AACrD,UAAM,IAAI,aAAa,0BAA0B,OAAO,IAAI,OAAO,QAAQ;AAAA,EAC7E;AACF;AAWA,eAAe,YACb,MACA,OACA,sBACkC;AAClC,QAAM,EAAE,eAAe,OAAO,IAAI,MAAM,OAAO,IAAS;AAExD,QAAM,kBAA2C;AAAA,IAC/C,OAAO;AAAA,IACP,2BAA2B;AAAA,EAC7B;AAEA,QAAM,gBAAyC,CAAC;AAChD,QAAM,YAAY,EAAE,SAAS,cAAc;AAE3C,QAAM,cAAc,CAAC,eAAgC;AACnD,QAAI,cAAc,iBAAiB;AACjC,aAAO,gBAAgB,UAAU;AAAA,IACnC;AACA,UAAM,IAAI;AAAA,MACR,cAAc,UAAU;AAAA,IAE1B;AAAA,EACF;AAEA,QAAM,UAAmC;AAAA,IACvC,QAAQ;AAAA,IACR,SAAS;AAAA,IACT,SAAS;AAAA,IACT;AAAA,IACA;AAAA,IAAQ;AAAA,IAAO;AAAA,IAAQ;AAAA,IAAQ;AAAA,IAC/B;AAAA,IAAK;AAAA,IAAK;AAAA,IAAS;AAAA,IACnB;AAAA,IAAM;AAAA,IAAM;AAAA,IAAM;AAAA,IAClB;AAAA,IAAO;AAAA,IAAW;AAAA,IAAY;AAAA,IAAgB;AAAA,IAAa;AAAA,IAC3D;AAAA,IAAS;AAAA,IACT,OAAO;AAAA,IAAW,SAAS;AAAA,IAC3B;AAAA,IAAU;AAAA,IAAY;AAAA,IAAO;AAAA,IAC7B;AAAA,IAAoB;AAAA,IAAoB;AAAA,IAAW;AAAA,IACnD;AAAA,IAAW;AAAA,IAAK;AAAA,IAChB,SAAS,EAAE,KAAK,MAAM;AAAA,IAAC,GAAG,MAAM,MAAM;AAAA,IAAC,GAAG,OAAO,MAAM;AAAA,IAAC,GAAG,MAAM,MAAM;AAAA,IAAC,GAAG,OAAO,MAAM;AAAA,IAAC,EAAE;AAAA,IAC3F,YAAY;AAAA,IAAW,aAAa;AAAA,IAAW,cAAc;AAAA,IAAW,gBAAgB;AAAA,IACxF,SAAS;AAAA,IAAW,YAAY;AAAA,IAAW,QAAQ;AAAA,IAAW,QAAQ;AAAA,IACtE,WAAW;AAAA,IAAW,YAAY;AAAA,EACpC;AAEA,QAAM,UAAU,cAAc,SAAS;AAAA,IACrC,gBAAgB,EAAE,SAAS,OAAO,MAAM,MAAM;AAAA,EAChD,CAAC;AAED,MAAI;AACF,UAAM,SAAS,IAAI,OAAO,MAAM,EAAE,UAAU,2BAA2B,CAAC;AACxE,WAAO,aAAa,SAAS,EAAE,SAAS,sBAAsB,eAAe,KAAK,CAAC;AAAA,EACrF,SAAS,KAAc;AACrB,UAAM,UAAU,eAAe,QAAQ,IAAI,UAAU;AACrD,QAAI,QAAQ,SAAS,4BAA4B,GAAG;AAClD,YAAM,IAAI,aAAa,qDAAqD,OAAO,WAAW;AAAA,IAChG;AACA,UAAM,IAAI,aAAa,wBAAwB,OAAO,IAAI,OAAO,WAAW;AAAA,EAC9E;AAEA,SAAO,UAAU;AACnB;AAqBA,eAAe,oBACb,MACA,OACA,sBACkC;AAtRpC;AAuRE,MAAI;AACJ,MAAI;AACF,UAAM,SAAS,MAAM,OAAO,aAAa;AACzC,WAAO,YAAe,YAAf,YAA0B;AAAA,EACnC,SAAQ;AACN,UAAM,IAAI;AAAA,MACR;AAAA,MAKA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAGA,QAAM,UAAU,IAAI,IAAI,QAAQ,EAAE,aAAa,IAAI,CAAC;AACpD,MAAI;AACF,UAAM,aAAa,MAAM,QAAQ,cAAc;AAS/C,UAAM,iBAAiB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,YA0Bf,IAAI;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAQZ,QAAI;AACF,YAAM,SAAS,MAAM,WAAW,KAAK,gBAAgB;AAAA,QACnD,SAAS;AAAA,MACX,CAAC;AAED,UAAI,OAAO,WAAW,UAAU;AAC9B,cAAM,SAAS,KAAK,MAAM,MAAM;AAChC,YAAI,CAAC,OAAO,IAAI;AACd,gBAAM,IAAI;AAAA,YACR,yBAAwB,YAAO,UAAP,YAAgB,eAAe;AAAA,YACvD;AAAA,YACA;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAAA,IACF,SAAS,KAAc;AACrB,UAAI,eAAe,aAAc,OAAM;AACvC,YAAM,UAAU,eAAe,QAAQ,IAAI,UAAU;AACrD,UAAI,QAAQ,SAAS,WAAW,KAAK,QAAQ,SAAS,SAAS,GAAG;AAChE,cAAM,IAAI,aAAa,qDAAqD,OAAO,WAAW;AAAA,MAChG;AACA,YAAM,IAAI,aAAa,wBAAwB,OAAO,IAAI,OAAO,WAAW;AAAA,IAC9E;AAAA,EACF,UAAE;AACA,YAAQ,QAAQ;AAAA,EAClB;AAGA,SAAO,YAAY,MAAM,OAAO,oBAAoB;AACtD;AAkBA,eAAe,iBACb,MACA,OACA,sBACkC;AAxYpC;AAyYE,MAAI;AACJ,MAAI;AACF,KAAC,EAAE,WAAW,IAAI,MAAM,OAAO,oBAAoB;AAAA,EACrD,SAAQ;AACN,UAAM,IAAI;AAAA,MACR;AAAA,MAKA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAEA,QAAM,UAAU,MAAM,WAAW;AACjC,QAAM,KAAK,QAAQ,WAAW;AAE9B,MAAI;AAOF,UAAM,iBAAiB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,YA8Bf,IAAI;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAQZ,UAAM,SAAS,GAAG,SAAS,cAAc;AACzC,QAAI,OAAO,OAAO;AAChB,YAAM,WAAW,GAAG,KAAK,OAAO,KAAK;AACrC,aAAO,MAAM,QAAQ;AACrB,YAAM,IAAI;AAAA,QACR,wBAAwB,OAAO,aAAa,WAAW,WAAW,0BAA0B;AAAA,QAC5F;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAEA,UAAM,YAAY,GAAG,KAAK,OAAO,KAAK;AACtC,WAAO,MAAM,QAAQ;AAErB,QAAI,OAAO,cAAc,UAAU;AACjC,YAAM,SAAS,KAAK,MAAM,SAAS;AACnC,UAAI,CAAC,OAAO,IAAI;AACd,cAAM,IAAI;AAAA,UACR,yBAAwB,YAAO,UAAP,YAAgB,eAAe;AAAA,UACvD;AAAA,UACA;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAIA,WAAO,YAAY,MAAM,OAAO,oBAAoB;AAAA,EACtD,UAAE;AACA,OAAG,QAAQ;AAAA,EACb;AACF;AAveA,IAGM,iBAGA;AANN;AAAA;AAAA;AAAA;AAGA,IAAM,kBAAkB;AAGxB,IAAM,uBAAuB;AAAA;AAAA;;;ACN7B;AAAA;AAAA;AAAA;AAcA,eAAsB,YAAY,QAAiC;AAdnE;AAgBE,MAAI,CAAC,UAAU,CAAC,OAAO,KAAK,GAAG;AAC7B,UAAM,IAAI,aAAa,kCAAkC,QAAQ,YAAY;AAAA,EAC/E;AAEA,MAAI,OAAO,SAASA,kBAAiB;AACnC,UAAM,IAAI;AAAA,MACR,uBAAuBA,mBAAkB,GAAI;AAAA,MAC7C;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAEA,MAAI,CAAC,cAAc,KAAK,MAAM,GAAG;AAC/B,UAAM,IAAI;AAAA,MACR;AAAA,MAEA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAOA,MAAI;AAKJ,MAAI;AACF,UAAM,aAAa,MAAM,OAAO,MAAM;AACtC,iBAAY,gBAAW,YAAX,YAAsB;AAAA,EACpC,SAAQ;AACN,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAGA,MAAI;AAGF,UAAM,SAAS,MAAM,UAAU,QAAQ;AAAA,MACrC,iBAAiB;AAAA,MACjB,cAAc;AAAA,IAChB,CAAC;AAED,QAAI,OAAO,UAAU,OAAO,OAAO,SAAS,KAAK,CAAC,OAAO,MAAM;AAC7D,YAAM,gBAAgB,OAAO,OAC1B,IAAI,CAAC,MAAM,QAAQ,EAAE,IAAI,KAAK,EAAE,OAAO,KAAK,EAAE,OAAO,GAAG,EACxD,KAAK,IAAI;AACZ,YAAM,IAAI;AAAA,QACR,4BAA4B,aAAa;AAAA,QACzC;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAEA,QAAI,CAAC,OAAO,MAAM;AAChB,YAAM,IAAI,aAAa,2CAA2C,QAAQ,SAAS;AAAA,IACrF;AAEA,WAAO,OAAO;AAAA,EAChB,SAAS,KAAc;AACrB,QAAI,eAAe,aAAc,OAAM;AACvC,UAAM,UAAU,eAAe,QAAQ,IAAI,UAAU;AACrD,UAAM,IAAI,aAAa,4BAA4B,OAAO,IAAI,QAAQ,SAAS;AAAA,EACjF;AACF;AAxFA,IAGMA;AAHN;AAAA;AAAA;AAAA;AAGA,IAAMA,mBAAkB;AAAA;AAAA;;;ACHxB;AAAA;AAAA;AAAA;AAAA;AAuDO,SAAS,WAAW,KAAsB;AAC/C,SAAO,oBAAoB;AAC7B;AAEA,eAAsB,eAAe,QAAiC;AAEpE,MAAI,CAAC,UAAU,CAAC,OAAO,KAAK,GAAG;AAC7B,UAAM,IAAI,aAAa,qCAAqC,WAAW,YAAY;AAAA,EACrF;AAEA,MAAI,OAAO,SAASC,kBAAiB;AACnC,UAAM,IAAI;AAAA,MACR,0BAA0BA,mBAAkB,GAAI;AAAA,MAChD;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAGA,MAAI,uBAAuB,KAAK,MAAM,GAAG;AACvC,UAAM,IAAI;AAAA,MACR;AAAA,MAGA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAGA,MAAI;AAKJ,MAAI;AACJ,MAAI;AACF,cAAW,MAAM,OAAO,oBAAoB;AAAA,EAC9C,SAAQ;AACN,UAAM,IAAI;AAAA,MACR;AAAA,MAEA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAEA,MAAI,WAAW,OAAO,GAAG;AACvB,UAAM,IAAI;AAAA,MACR;AAAA,MAIA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,kBAAgB,QAAQ;AAGxB,QAAM,iBAAiB,cAAc,QAAQ;AAAA,IAC3C,KAAK;AAAA,MACH,QAAQ;AAAA,QACN,wBAAwB;AAAA,QACxB,sBAAsB;AAAA,QACtB,uBAAuB;AAAA,MACzB;AAAA,MACA,WAAW;AAAA,MACX,QAAQ;AAAA,IACV;AAAA,IACA,QAAQ,CAAC;AAAA,EACX,CAAC;AAED,QAAM,iBAAiB,IAAI,QAAe,CAAC,GAAG,WAAW;AACvD,UAAM,IAAI,WAAW,MAAM;AACzB;AAAA,QACE,IAAI;AAAA,UACF,uCAAuC,qBAAqB,GAAI;AAAA,UAChE;AAAA,UACA;AAAA,QACF;AAAA,MACF;AAAA,IACF,GAAG,kBAAkB;AACrB,QAAI,OAAO,EAAE,UAAU,WAAY,GAAE,MAAM;AAAA,EAC7C,CAAC;AAED,MAAI;AACF,UAAM,EAAE,KAAK,IAAI,MAAM,QAAQ,KAAK,CAAC,gBAAgB,cAAc,CAAC;AAEpE,QAAI,CAAC,MAAM;AACT,YAAM,IAAI,aAAa,8CAA8C,WAAW,SAAS;AAAA,IAC3F;AAEA,WAAO;AAAA,EACT,SAAS,KAAc;AACrB,QAAI,eAAe,aAAc,OAAM;AACvC,UAAM,UAAU,eAAe,QAAQ,IAAI,UAAU;AACrD,UAAM,IAAI,aAAa,+BAA+B,OAAO,IAAI,WAAW,SAAS;AAAA,EACvF;AACF;AA1JA,IAGMA,kBAGA,oBAcA;AApBN;AAAA;AAAA;AAAA;AAGA,IAAMA,mBAAkB;AAGxB,IAAM,qBAAqB;AAc3B,IAAM,yBACJ;AAAA;AAAA;;;ACrBF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,uBAAwB;AAGxB;AACA;AAEA;AACA;AAOA,eAAsB,QACpB,QACA,QACiB;AACjB,UAAQ,QAAQ;AAAA,IACd,KAAK;AACH,aAAO;AAAA,IAET,KAAK,OAAO;AACV,YAAM,EAAE,mBAAAC,mBAAkB,IAAI,MAAM;AACpC,aAAOA,mBAAkB,MAAM;AAAA,IACjC;AAAA,IAEA,KAAK,QAAQ;AACX,YAAM,EAAE,aAAAC,aAAY,IAAI,MAAM;AAC9B,aAAOA,aAAY,MAAM;AAAA,IAC3B;AAAA,IAEA,KAAK,WAAW;AACd,YAAM,EAAE,gBAAAC,gBAAe,IAAI,MAAM;AACjC,aAAOA,gBAAe,MAAM;AAAA,IAC9B;AAAA,IAEA;AACE,YAAM,IAAI,MAAM,oBAAoB,MAAM,qCAAqC;AAAA,EACnF;AACF;AAKO,SAAS,aAAa,UAA+B;AAC1D,QAAM,UAAM,0BAAQ,QAAQ,EAAE,YAAY;AAE1C,UAAQ,KAAK;AAAA,IACX,KAAK;AAAA,IACL,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AAAA,IACL,KAAK;AACH,aAAO;AAAA,IACT;AACE,aAAO;AAAA,EACX;AACF;","names":["MAX_SOURCE_SIZE","MAX_SOURCE_SIZE","compileReactEmail","compileMjml","compileMaizzle"]}

package/dist/compile/index.d.cts

@@ -1,5 +1,5 @@
-import { _ as InputFormat } from '../types-hQYXbiqj.cjs';
-export { C as CompileError, a as CompileReactEmailOptions, S as SandboxStrategy, c as compileReactEmail } from '../react-email-eJhDK8a5.cjs';
+import { y as InputFormat } from '../types-DdFHwMtT.cjs';
+export { C as CompileError, a as CompileReactEmailOptions, S as SandboxStrategy, c as compileReactEmail } from '../react-email-Dmn1QpXz.cjs';
 
 /**
  * Compile an MJML source string into an HTML email string.

package/dist/compile/index.d.ts

@@ -1,5 +1,5 @@
-import { _ as InputFormat } from '../types-hQYXbiqj.js';
-export { C as CompileError, a as CompileReactEmailOptions, S as SandboxStrategy, c as compileReactEmail } from '../react-email-CDNfg8Ta.js';
+import { y as InputFormat } from '../types-DdFHwMtT.js';
+export { C as CompileError, a as CompileReactEmailOptions, S as SandboxStrategy, c as compileReactEmail } from '../react-email-BTIw8QV8.js';
 
 /**
  * Compile an MJML source string into an HTML email string.

package/dist/compile/index.js

@@ -1,6 +1,6 @@
 import {
   compileReactEmail
-} from "../chunk-UFSYNSDP.js";
+} from "../chunk-KKWC2C3R.js";
 import {
   compileMjml
 } from "../chunk-E4QE4WXE.js";
@@ -19,7 +19,7 @@ async function compile(source, format) {
     case "html":
       return source;
     case "jsx": {
-      const { compileReactEmail: compileReactEmail2 } = await import("../react-email-CVZZNVZ2.js");
+      const { compileReactEmail: compileReactEmail2 } = await import("../react-email-2DGTHWTN.js");
       return compileReactEmail2(source);
     }
     case "mjml": {

package/dist/index.cjs

@@ -138,7 +138,7 @@ __export(index_exports, {
 module.exports = __toCommonJS(index_exports);
 
 // src/clients.ts
-var EMAIL_CLIENTS = [
+var CLIENTS = [
   {
     id: "gmail-web",
     name: "Gmail",
@@ -313,6 +313,7 @@ var EMAIL_CLIENTS = [
     icon: "monitor"
   }
 ];
+var EMAIL_CLIENTS = [...CLIENTS];
 function getClient(id) {
   return EMAIL_CLIENTS.find((c) => c.id === id);
 }
@@ -8752,7 +8753,9 @@ var GRACEFUL_FEATURES = /* @__PURE__ */ new Set([
   "[aria-labelledby]",
   "[aria-live]",
   "[lang]",
-  "[dir]"
+  "[dir]",
+  "[width]",
+  "[height]"
 ]);
 var OUTLOOK_WORD_UNSUPPORTED = /* @__PURE__ */ new Set([
   "border-radius",
@@ -14831,15 +14834,17 @@ var YAHOO_AOL = [
   "aol"
 ];
 var MAX_LOCS = 20;
+var MAX_COLOR_FUNCTION_LENGTH = 256;
 function hasSpaceSeparatedColor(css) {
   const fn = /\b(?:rgba?|hsla?)\(/gi;
   let m;
   while (m = fn.exec(css)) {
     const start = m.index + m[0].length;
+    const limit = Math.min(css.length, start + MAX_COLOR_FUNCTION_LENGTH);
     let depth = 1;
     let comma = false;
     let i = start;
-    for (; i < css.length && depth > 0; i++) {
+    for (; i < limit && depth > 0; i++) {
       const c = css[i];
       if (c === "(") depth++;
       else if (c === ")") depth--;