@emailens/engine 0.5.1 → 0.6.0

package/dist/compile/index.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/compile/errors.ts","../../src/compile/react-email.ts","../../src/compile/mjml.ts","../../src/compile/maizzle.ts","../../src/compile/index.ts"],"sourcesContent":["import type { InputFormat } from \"../types.js\";\r\n\r\n/**\r\n * Unified error class for all email compilation failures.\r\n *\r\n * Replaces the per-format error classes (ReactEmailCompileError,\r\n * MjmlCompileError, MaizzleCompileError) with a single class that\r\n * carries the source format and failure phase.\r\n */\r\nexport class CompileError extends Error {\r\n  override name = \"CompileError\";\r\n  readonly format: Exclude<InputFormat, \"html\">;\r\n  readonly phase: \"validation\" | \"transpile\" | \"execution\" | \"render\" | \"compile\";\r\n\r\n  constructor(\r\n    message: string,\r\n    format: CompileError[\"format\"],\r\n    phase: CompileError[\"phase\"],\r\n  ) {\r\n    super(message);\r\n    this.format = format;\r\n    this.phase = phase;\r\n  }\r\n}\r\n","import { CompileError } from \"./errors.js\";\r\n\r\n/** Maximum source code size: 256KB */\r\nconst MAX_SOURCE_SIZE = 256_000;\r\n\r\n/** Execution timeout: 5 seconds */\r\nconst EXECUTION_TIMEOUT_MS = 5_000;\r\n\r\n/**\r\n * Sandbox strategy for JSX execution.\r\n *\r\n * - `\"vm\"` — `node:vm` with hardened globals. Fast, zero-dependency,\r\n *   but NOT a true security boundary (prototype-chain escapes are possible).\r\n *   Suitable for CLI / local use where users run their own code.\r\n *\r\n * - `\"isolated-vm\"` (default) — Separate V8 isolate via the `isolated-vm`\r\n *   npm package. True heap isolation; escapes require a V8 engine bug.\r\n *   Requires `isolated-vm` to be installed (native addon).\r\n *\r\n * - `\"quickjs\"` — Validates code structure in a QuickJS WASM sandbox, then\r\n *   executes in `node:vm` for React rendering. Security is equivalent to\r\n *   `node:vm` — the QuickJS phase validates import restrictions only.\r\n *   No native addons needed, but only supports ES2020 and is slower.\r\n *   For true isolation on servers, use `isolated-vm`.\r\n */\r\nexport type SandboxStrategy = \"vm\" | \"isolated-vm\" | \"quickjs\";\r\n\r\nexport interface CompileReactEmailOptions {\r\n  /**\r\n   * Sandbox strategy to use for executing user JSX code.\r\n   * @default \"isolated-vm\"\r\n   */\r\n  sandbox?: SandboxStrategy;\r\n}\r\n\r\n/**\r\n * Compile a React Email JSX/TSX source string into an HTML email string.\r\n *\r\n * Pipeline:\r\n *  1. Validate input (size, basic checks)\r\n *  2. Transpile JSX/TSX → CommonJS JS using sucrase\r\n *  3. Execute inside a sandbox (configurable strategy)\r\n *  4. Render the exported component to a full HTML email string\r\n *\r\n * Requires peer dependencies: sucrase, react, @react-email/components,\r\n * @react-email/render. Additionally:\r\n *  - sandbox \"isolated-vm\" requires `isolated-vm`\r\n *  - sandbox \"quickjs\" requires `quickjs-emscripten`\r\n */\r\nexport async function compileReactEmail(\r\n  source: string,\r\n  options?: CompileReactEmailOptions,\r\n): Promise<string> {\r\n  const strategy = options?.sandbox ?? \"isolated-vm\";\r\n\r\n  // ── 1. Validate ──────────────────────────────────────────────────────\r\n  if (!source || !source.trim()) {\r\n    throw new CompileError(\"JSX source must not be empty.\", \"jsx\", \"validation\");\r\n  }\r\n\r\n  if (source.length > MAX_SOURCE_SIZE) {\r\n    throw new CompileError(\r\n      `JSX source exceeds ${MAX_SOURCE_SIZE / 1000}KB limit.`,\r\n      \"jsx\",\r\n      \"validation\",\r\n    );\r\n  }\r\n\r\n  // ── 2. Load peer dependencies ────────────────────────────────────────\r\n  let transform: typeof import(\"sucrase\").transform;\r\n  let React: typeof import(\"react\");\r\n  let ReactEmailComponents: typeof import(\"@react-email/components\");\r\n  let render: typeof import(\"@react-email/render\").render;\r\n\r\n  try {\r\n    ({ transform } = await import(\"sucrase\"));\r\n  } catch {\r\n    throw new CompileError(\r\n      'JSX compilation requires \"sucrase\". Install it:\\n  npm install sucrase',\r\n      \"jsx\",\r\n      \"transpile\",\r\n    );\r\n  }\r\n\r\n  try {\r\n    React = await import(\"react\");\r\n  } catch {\r\n    throw new CompileError(\r\n      'JSX compilation requires \"react\". Install it:\\n  npm install react',\r\n      \"jsx\",\r\n      \"transpile\",\r\n    );\r\n  }\r\n\r\n  try {\r\n    ReactEmailComponents = await import(\"@react-email/components\");\r\n  } catch {\r\n    throw new CompileError(\r\n      'JSX compilation requires \"@react-email/components\". Install it:\\n  npm install @react-email/components',\r\n      \"jsx\",\r\n      \"transpile\",\r\n    );\r\n  }\r\n\r\n  try {\r\n    ({ render } = await import(\"@react-email/render\"));\r\n  } catch {\r\n    throw new CompileError(\r\n      'JSX compilation requires \"@react-email/render\". Install it:\\n  npm install @react-email/render',\r\n      \"jsx\",\r\n      \"transpile\",\r\n    );\r\n  }\r\n\r\n  // ── 3. Transpile JSX/TSX → CommonJS ──────────────────────────────────\r\n  let transpiledCode: string;\r\n  try {\r\n    const result = transform(source, {\r\n      transforms: [\"typescript\", \"jsx\", \"imports\"],\r\n      jsxRuntime: \"classic\",\r\n      production: true,\r\n    });\r\n    transpiledCode = result.code;\r\n  } catch (err: unknown) {\r\n    const message = err instanceof Error ? err.message : \"Unknown transpilation error\";\r\n    throw new CompileError(`JSX syntax error: ${message}`, \"jsx\", \"transpile\");\r\n  }\r\n\r\n  // ── 4. Execute in sandbox ────────────────────────────────────────────\r\n  let moduleExports: Record<string, unknown>;\r\n\r\n  switch (strategy) {\r\n    case \"isolated-vm\":\r\n      moduleExports = await executeInIsolatedVm(transpiledCode, React, ReactEmailComponents);\r\n      break;\r\n    case \"quickjs\":\r\n      moduleExports = await executeInQuickJs(transpiledCode, React, ReactEmailComponents);\r\n      break;\r\n    case \"vm\":\r\n      moduleExports = executeInVm(transpiledCode, React, ReactEmailComponents);\r\n      break;\r\n    default:\r\n      throw new CompileError(\r\n        `Unknown sandbox strategy: \"${strategy}\". Use \"vm\", \"isolated-vm\", or \"quickjs\".`,\r\n        \"jsx\",\r\n        \"execution\",\r\n      );\r\n  }\r\n\r\n  // ── 5. Extract component and render ──────────────────────────────────\r\n  let Component: unknown = moduleExports.default ?? moduleExports;\r\n\r\n  if (typeof Component !== \"function\" && typeof Component === \"object\" && Component !== null) {\r\n    const values = Object.values(Component as Record<string, unknown>);\r\n    const fn = values.find((v) => typeof v === \"function\");\r\n    if (fn) Component = fn;\r\n  }\r\n\r\n  if (typeof Component !== \"function\") {\r\n    throw new CompileError(\r\n      'The JSX source must export a React component function. ' +\r\n        'Use \"export default function Email() { ... }\" or ' +\r\n        '\"export function Email() { ... }\".',\r\n      \"jsx\",\r\n      \"execution\",\r\n    );\r\n  }\r\n\r\n  try {\r\n    const element = React.createElement(Component as React.FC);\r\n    const html = await render(element);\r\n    return html;\r\n  } catch (err: unknown) {\r\n    const message = err instanceof Error ? err.message : \"Unknown rendering error\";\r\n    throw new CompileError(`React rendering error: ${message}`, \"jsx\", \"render\");\r\n  }\r\n}\r\n\r\n// ─── Sandbox: node:vm ──────────────────────────────────────────────────────\r\n\r\n/**\r\n * Execute transpiled code in a node:vm context with hardened globals.\r\n *\r\n * NOT a security boundary — see node:vm documentation. Suitable for CLI\r\n * use where the user runs their own code. For server use, prefer\r\n * \"isolated-vm\" or \"quickjs\".\r\n */\r\nfunction executeInVm(\r\n  code: string,\r\n  React: typeof import(\"react\"),\r\n  ReactEmailComponents: typeof import(\"@react-email/components\"),\r\n): Record<string, unknown> {\r\n  const { createContext, Script } = require(\"node:vm\") as typeof import(\"node:vm\");\r\n\r\n  const ALLOWED_MODULES: Record<string, unknown> = {\r\n    react: React,\r\n    \"@react-email/components\": ReactEmailComponents,\r\n  };\r\n\r\n  const moduleExports: Record<string, unknown> = {};\r\n  const moduleObj = { exports: moduleExports };\r\n\r\n  const mockRequire = (moduleName: string): unknown => {\r\n    if (moduleName in ALLOWED_MODULES) {\r\n      return ALLOWED_MODULES[moduleName];\r\n    }\r\n    throw new Error(\r\n      `Import of \"${moduleName}\" is not allowed. ` +\r\n        `Only \"react\" and \"@react-email/components\" can be imported.`,\r\n    );\r\n  };\r\n\r\n  const sandbox: Record<string, unknown> = {\r\n    module: moduleObj,\r\n    exports: moduleExports,\r\n    require: mockRequire,\r\n    React,\r\n    Object, Array, String, Number, Boolean,\r\n    Map, Set, WeakMap, WeakSet,\r\n    JSON, Math, Date, RegExp,\r\n    Error, TypeError, RangeError, ReferenceError, SyntaxError, URIError,\r\n    Promise, Symbol,\r\n    Proxy: undefined, Reflect: undefined,\r\n    parseInt, parseFloat, isNaN, isFinite,\r\n    encodeURIComponent, decodeURIComponent, encodeURI, decodeURI,\r\n    undefined, NaN, Infinity,\r\n    console: { log: () => {}, warn: () => {}, error: () => {}, info: () => {}, debug: () => {} },\r\n    setTimeout: undefined, setInterval: undefined, setImmediate: undefined, queueMicrotask: undefined,\r\n    process: undefined, globalThis: undefined, global: undefined, Buffer: undefined,\r\n    __dirname: undefined, __filename: undefined,\r\n  };\r\n\r\n  const context = createContext(sandbox, {\r\n    codeGeneration: { strings: false, wasm: false },\r\n  });\r\n\r\n  try {\r\n    const script = new Script(code, { filename: \"user-email-component.tsx\" });\r\n    script.runInContext(context, { timeout: EXECUTION_TIMEOUT_MS, displayErrors: true });\r\n  } catch (err: unknown) {\r\n    const message = err instanceof Error ? err.message : \"Unknown execution error\";\r\n    if (message.includes(\"Script execution timed out\")) {\r\n      throw new CompileError(\"JSX execution timed out (possible infinite loop).\", \"jsx\", \"execution\");\r\n    }\r\n    throw new CompileError(`JSX execution error: ${message}`, \"jsx\", \"execution\");\r\n  }\r\n\r\n  return moduleObj.exports as Record<string, unknown>;\r\n}\r\n\r\n// ─── Sandbox: isolated-vm ──────────────────────────────────────────────────\r\n\r\n/**\r\n * Validate code in a separate V8 isolate, then execute in `node:vm`.\r\n *\r\n * Two-phase approach:\r\n *  1. **Validate** — run the transpiled code in a true V8 isolate with stub\r\n *     React/component implementations. This catches disallowed imports and\r\n *     structural errors inside a genuine security boundary (separate heap,\r\n *     128 MB memory cap, timeout). Escape requires a V8 engine bug.\r\n *  2. **Execute** — run the validated code in `node:vm` with real React\r\n *     objects for actual rendering.\r\n *\r\n * Why two phases: React's internal type system uses Symbols\r\n * (`Symbol(react.forward_ref)`, `Symbol(react.element)`, etc.) which cannot\r\n * be transferred across V8 isolate boundaries — the structured clone\r\n * algorithm does not support Symbols. Running React code directly inside\r\n * `isolated-vm` is not possible.\r\n */\r\nasync function executeInIsolatedVm(\r\n  code: string,\r\n  React: typeof import(\"react\"),\r\n  ReactEmailComponents: typeof import(\"@react-email/components\"),\r\n): Promise<Record<string, unknown>> {\r\n  let ivm: typeof import(\"isolated-vm\");\r\n  try {\r\n    ivm = await import(\"isolated-vm\");\r\n  } catch {\r\n    throw new CompileError(\r\n      'Sandbox strategy \"isolated-vm\" requires the \"isolated-vm\" package. Install it:\\n' +\r\n        \"  npm install isolated-vm\\n\" +\r\n        'Or use sandbox: \"vm\" for a lighter (but less secure) alternative.',\r\n      \"jsx\",\r\n      \"execution\",\r\n    );\r\n  }\r\n\r\n  // ── Phase 1: Validate in a true V8 isolate ─────────────────────────────\r\n  const isolate = new ivm.Isolate({ memoryLimit: 128 });\r\n  try {\r\n    const ivmContext = await isolate.createContext();\r\n\r\n    // Stub implementations let the code parse and execute structurally\r\n    // without needing real React objects (which contain non-cloneable Symbols).\r\n    const validationCode = `\r\n      (function() {\r\n        var module = { exports: {} };\r\n        var exports = module.exports;\r\n        var React = {\r\n          createElement: function() { return {}; },\r\n          forwardRef: function(fn) { return fn; },\r\n          Fragment: \"Fragment\",\r\n        };\r\n        function require(name) {\r\n          if (name === \"react\" || name === \"@react-email/components\") {\r\n            return React;\r\n          }\r\n          throw new Error('Import of \"' + name + '\" is not allowed. Only \"react\" and \"@react-email/components\" can be imported.');\r\n        }\r\n        try {\r\n          ${code}\r\n          return JSON.stringify({ ok: true });\r\n        } catch(e) {\r\n          return JSON.stringify({ ok: false, error: e.message || \"Unknown error\" });\r\n        }\r\n      })()\r\n    `;\r\n\r\n    try {\r\n      const result = await ivmContext.eval(validationCode, {\r\n        timeout: EXECUTION_TIMEOUT_MS,\r\n      });\r\n\r\n      if (typeof result === \"string\") {\r\n        const parsed = JSON.parse(result) as { ok: boolean; error?: string };\r\n        if (!parsed.ok) {\r\n          throw new CompileError(\r\n            `JSX execution error: ${parsed.error ?? \"Unknown error\"}`,\r\n            \"jsx\",\r\n            \"execution\",\r\n          );\r\n        }\r\n      }\r\n    } catch (err: unknown) {\r\n      if (err instanceof CompileError) throw err;\r\n      const message = err instanceof Error ? err.message : \"Unknown execution error\";\r\n      if (message.includes(\"timed out\") || message.includes(\"Timeout\")) {\r\n        throw new CompileError(\"JSX execution timed out (possible infinite loop).\", \"jsx\", \"execution\");\r\n      }\r\n      throw new CompileError(`JSX execution error: ${message}`, \"jsx\", \"execution\");\r\n    }\r\n  } finally {\r\n    isolate.dispose();\r\n  }\r\n\r\n  // ── Phase 2: Execute validated code in node:vm with real React ──────────\r\n  return executeInVm(code, React, ReactEmailComponents);\r\n}\r\n\r\n// ─── Sandbox: QuickJS (WASM) ──────────────────────────────────────────────\r\n\r\n/**\r\n * Validate code structure in QuickJS WASM, then execute in `node:vm`.\r\n *\r\n * Two-phase approach:\r\n *  1. Validate that the code doesn't access disallowed modules by running it\r\n *     in a QuickJS WASM sandbox with stub implementations.\r\n *  2. Execute in `node:vm` for actual React rendering (React objects can't\r\n *     cross the WASM boundary).\r\n *\r\n * **Security note:** The actual execution happens in `node:vm`, so runtime\r\n * security is equivalent to the `\"vm\"` strategy. The QuickJS phase only\r\n * validates import restrictions. For true isolation on servers, use\r\n * `\"isolated-vm\"`.\r\n */\r\nasync function executeInQuickJs(\r\n  code: string,\r\n  React: typeof import(\"react\"),\r\n  ReactEmailComponents: typeof import(\"@react-email/components\"),\r\n): Promise<Record<string, unknown>> {\r\n  let getQuickJS: typeof import(\"quickjs-emscripten\").getQuickJS;\r\n  try {\r\n    ({ getQuickJS } = await import(\"quickjs-emscripten\"));\r\n  } catch {\r\n    throw new CompileError(\r\n      'Sandbox strategy \"quickjs\" requires the \"quickjs-emscripten\" package. Install it:\\n' +\r\n        \"  npm install quickjs-emscripten\\n\" +\r\n        'Or use sandbox: \"vm\" for a lighter alternative.',\r\n      \"jsx\",\r\n      \"execution\",\r\n    );\r\n  }\r\n\r\n  const QuickJS = await getQuickJS();\r\n  const vm = QuickJS.newContext();\r\n\r\n  try {\r\n    // Phase 1: Validate code safety in the WASM sandbox.\r\n    // We provide stub implementations of React and the module system so\r\n    // the code can execute without errors, but we only care that it\r\n    // doesn't try to access anything dangerous.\r\n    const validationCode = `\r\n      (function() {\r\n        var module = { exports: {} };\r\n        var exports = module.exports;\r\n        var React = { createElement: function() { return {}; } };\r\n        function require(name) {\r\n          if (name === \"react\" || name === \"@react-email/components\") {\r\n            return React;\r\n          }\r\n          throw new Error('Import of \"' + name + '\" is not allowed.');\r\n        }\r\n        try {\r\n          ${code}\r\n          return JSON.stringify({ ok: true });\r\n        } catch(e) {\r\n          return JSON.stringify({ ok: false, error: e.message || \"Unknown error\" });\r\n        }\r\n      })()\r\n    `;\r\n\r\n    const result = vm.evalCode(validationCode);\r\n    if (result.error) {\r\n      const errorVal = vm.dump(result.error);\r\n      result.error.dispose();\r\n      throw new CompileError(\r\n        `JSX execution error: ${typeof errorVal === \"string\" ? errorVal : \"QuickJS execution failed\"}`,\r\n        \"jsx\",\r\n        \"execution\",\r\n      );\r\n    }\r\n\r\n    const resultStr = vm.dump(result.value);\r\n    result.value.dispose();\r\n\r\n    if (typeof resultStr === \"string\") {\r\n      const parsed = JSON.parse(resultStr) as { ok: boolean; error?: string };\r\n      if (!parsed.ok) {\r\n        throw new CompileError(\r\n          `JSX execution error: ${parsed.error ?? \"Unknown error\"}`,\r\n          \"jsx\",\r\n          \"execution\",\r\n        );\r\n      }\r\n    }\r\n\r\n    // Phase 2: Code validated as safe — execute in node:vm for actual\r\n    // React rendering (React objects can't cross the WASM boundary)\r\n    return executeInVm(code, React, ReactEmailComponents);\r\n  } finally {\r\n    vm.dispose();\r\n  }\r\n}\r\n","import { CompileError } from \"./errors.js\";\r\n\r\n/** Maximum MJML source size: 512KB */\r\nconst MAX_SOURCE_SIZE = 512_000;\r\n\r\n/**\r\n * Compile an MJML source string into an HTML email string.\r\n *\r\n * MJML is a declarative markup language with no code execution capability\r\n * (unlike JSX). The mjml library parses XML and generates HTML; there is\r\n * no sandboxing concern.\r\n *\r\n * Requires peer dependency: mjml\r\n */\r\nexport async function compileMjml(source: string): Promise<string> {\r\n  // ── 1. Validate ──────────────────────────────────────────────────────\r\n  if (!source || !source.trim()) {\r\n    throw new CompileError(\"MJML source must not be empty.\", \"mjml\", \"validation\");\r\n  }\r\n\r\n  if (source.length > MAX_SOURCE_SIZE) {\r\n    throw new CompileError(\r\n      `MJML source exceeds ${MAX_SOURCE_SIZE / 1000}KB limit.`,\r\n      \"mjml\",\r\n      \"validation\",\r\n    );\r\n  }\r\n\r\n  if (!/<mjml[\\s>]/i.test(source)) {\r\n    throw new CompileError(\r\n      \"MJML source must contain a root <mjml> element. \" +\r\n        \"Example: <mjml><mj-body><mj-section><mj-column><mj-text>Hello</mj-text></mj-column></mj-section></mj-body></mjml>\",\r\n      \"mjml\",\r\n      \"validation\",\r\n    );\r\n  }\r\n\r\n  // ── 2. Load peer dependency ──────────────────────────────────────────\r\n  type MjmlResult = {\r\n    html: string;\r\n    errors: Array<{ line: number; message: string; tagName: string; formattedMessage: string }>;\r\n  };\r\n  let mjml2html: (\r\n    input: string,\r\n    options?: Record<string, unknown>,\r\n  ) => MjmlResult | Promise<MjmlResult>;\r\n\r\n  try {\r\n    const mjmlModule = await import(\"mjml\");\r\n    mjml2html = mjmlModule.default ?? mjmlModule;\r\n  } catch {\r\n    throw new CompileError(\r\n      'MJML compilation requires \"mjml\". Install it:\\n  npm install mjml',\r\n      \"mjml\",\r\n      \"compile\",\r\n    );\r\n  }\r\n\r\n  // ── 3. Compile ───────────────────────────────────────────────────────\r\n  try {\r\n    // mjml v5+ returns a Promise; v4 returns synchronously.\r\n    // Await handles both cases.\r\n    const result = await mjml2html(source, {\r\n      validationLevel: \"soft\",\r\n      keepComments: false,\r\n    });\r\n\r\n    if (result.errors && result.errors.length > 0 && !result.html) {\r\n      const errorMessages = result.errors\r\n        .map((e) => `Line ${e.line}: ${e.message} (${e.tagName})`)\r\n        .join(\"; \");\r\n      throw new CompileError(\r\n        `MJML compilation errors: ${errorMessages}`,\r\n        \"mjml\",\r\n        \"compile\",\r\n      );\r\n    }\r\n\r\n    if (!result.html) {\r\n      throw new CompileError(\"MJML compilation produced empty output.\", \"mjml\", \"compile\");\r\n    }\r\n\r\n    return result.html;\r\n  } catch (err: unknown) {\r\n    if (err instanceof CompileError) throw err;\r\n    const message = err instanceof Error ? err.message : \"Unknown MJML compilation error\";\r\n    throw new CompileError(`MJML compilation failed: ${message}`, \"mjml\", \"compile\");\r\n  }\r\n}\r\n","import { CompileError } from \"./errors.js\";\r\n\r\n/** Maximum Maizzle source size: 512KB */\r\nconst MAX_SOURCE_SIZE = 512_000;\r\n\r\n/** Compilation timeout: 15 seconds */\r\nconst COMPILE_TIMEOUT_MS = 15_000;\r\n\r\n/**\r\n * PostHTML directives that perform file-system reads or network fetches.\r\n *\r\n * Maizzle's PostHTML pipeline resolves these at compile time: a template\r\n * like `<extends src=\"/etc/passwd\">` causes the server to read that path\r\n * and include the content in rendered output (server-side file read). We\r\n * reject any input containing these directives rather than stripping them,\r\n * because stripping is error-prone with nested or malformed markup.\r\n *\r\n * Affected plugins: posthtml-extend, posthtml-fetch, posthtml-components,\r\n * posthtml-include, posthtml-modules.\r\n */\r\nconst DANGEROUS_DIRECTIVE_RE =\r\n  /<\\s*(?:extends|component|fetch|include|module|slot|fill|raw|block|yield)\\b/i;\r\n\r\n/**\r\n * Compile a Maizzle template string into an HTML email string.\r\n *\r\n * Pipeline:\r\n *  1. Validate input (size, basic structure check)\r\n *  2. Reject inputs containing PostHTML file-access directives\r\n *  3. Compile using @maizzle/framework\r\n *\r\n * Security:\r\n *  - PostHTML file-system directives are rejected at validation time\r\n *    to prevent server-side file reads and SSRF.\r\n *  - Template expressions ({{ expr }}) are evaluated by posthtml-expressions\r\n *    with empty `locals`, so unknown identifiers like `process` or `require`\r\n *    return the literal string '{local}' rather than accessing Node.js globals.\r\n *  - A hard timeout prevents pathological PostCSS/Tailwind inputs from\r\n *    hanging indefinitely.\r\n *\r\n * Requires peer dependency: @maizzle/framework\r\n */\r\nexport async function compileMaizzle(source: string): Promise<string> {\r\n  // ── 1. Validate ──────────────────────────────────────────────────────\r\n  if (!source || !source.trim()) {\r\n    throw new CompileError(\"Maizzle source must not be empty.\", \"maizzle\", \"validation\");\r\n  }\r\n\r\n  if (source.length > MAX_SOURCE_SIZE) {\r\n    throw new CompileError(\r\n      `Maizzle source exceeds ${MAX_SOURCE_SIZE / 1000}KB limit.`,\r\n      \"maizzle\",\r\n      \"validation\",\r\n    );\r\n  }\r\n\r\n  // ── 2. Block file-system and network PostHTML directives ─────────────\r\n  if (DANGEROUS_DIRECTIVE_RE.test(source)) {\r\n    throw new CompileError(\r\n      \"Maizzle templates may not use <extends>, <component>, <fetch>, <include>, \" +\r\n        \"<module>, <slot>, <fill>, <raw>, <block>, or <yield> directives. These directives \" +\r\n        \"access the server file system at compile time. Use inline HTML and Tailwind utility classes instead.\",\r\n      \"maizzle\",\r\n      \"validation\",\r\n    );\r\n  }\r\n\r\n  // ── 3. Load peer dependency ──────────────────────────────────────────\r\n  let maizzleRender: (\r\n    input: string,\r\n    options: Record<string, unknown>,\r\n  ) => Promise<{ html: string }>;\r\n\r\n  try {\r\n    const maizzle = await import(\"@maizzle/framework\");\r\n    maizzleRender = maizzle.render;\r\n  } catch {\r\n    throw new CompileError(\r\n      'Maizzle compilation requires \"@maizzle/framework\". Install it:\\n  npm install @maizzle/framework',\r\n      \"maizzle\",\r\n      \"compile\",\r\n    );\r\n  }\r\n\r\n  // ── 4. Compile with timeout ──────────────────────────────────────────\r\n  const compilePromise = maizzleRender(source, {\r\n    css: {\r\n      inline: {\r\n        removeInlinedSelectors: true,\r\n        applyWidthAttributes: true,\r\n        applyHeightAttributes: true,\r\n      },\r\n      shorthand: true,\r\n      sixHex: true,\r\n    },\r\n    locals: {},\r\n  });\r\n\r\n  const timeoutPromise = new Promise<never>((_, reject) => {\r\n    const t = setTimeout(() => {\r\n      reject(\r\n        new CompileError(\r\n          `Maizzle compilation timed out after ${COMPILE_TIMEOUT_MS / 1000}s.`,\r\n          \"maizzle\",\r\n          \"compile\",\r\n        ),\r\n      );\r\n    }, COMPILE_TIMEOUT_MS);\r\n    if (typeof t.unref === \"function\") t.unref();\r\n  });\r\n\r\n  try {\r\n    const { html } = await Promise.race([compilePromise, timeoutPromise]);\r\n\r\n    if (!html) {\r\n      throw new CompileError(\"Maizzle compilation produced empty output.\", \"maizzle\", \"compile\");\r\n    }\r\n\r\n    return html;\r\n  } catch (err: unknown) {\r\n    if (err instanceof CompileError) throw err;\r\n    const message = err instanceof Error ? err.message : \"Unknown Maizzle compilation error\";\r\n    throw new CompileError(`Maizzle compilation failed: ${message}`, \"maizzle\", \"compile\");\r\n  }\r\n}\r\n","import { extname } from \"node:path\";\r\nimport type { InputFormat } from \"../types.js\";\r\n\r\nexport { CompileError } from \"./errors.js\";\r\nexport { compileReactEmail } from \"./react-email.js\";\r\nexport type { SandboxStrategy, CompileReactEmailOptions } from \"./react-email.js\";\r\nexport { compileMjml } from \"./mjml.js\";\r\nexport { compileMaizzle } from \"./maizzle.js\";\r\n\r\n/**\r\n * Compile source to HTML based on format.\r\n * Returns the HTML unchanged if format is \"html\".\r\n * Lazily imports per-format compilers to avoid loading unnecessary deps.\r\n */\r\nexport async function compile(\r\n  source: string,\r\n  format: InputFormat,\r\n  filePath?: string,\r\n): Promise<string> {\r\n  switch (format) {\r\n    case \"html\":\r\n      return source;\r\n\r\n    case \"jsx\": {\r\n      const { compileReactEmail } = await import(\"./react-email.js\");\r\n      return compileReactEmail(source);\r\n    }\r\n\r\n    case \"mjml\": {\r\n      const { compileMjml } = await import(\"./mjml.js\");\r\n      return compileMjml(source);\r\n    }\r\n\r\n    case \"maizzle\": {\r\n      const { compileMaizzle } = await import(\"./maizzle.js\");\r\n      return compileMaizzle(source);\r\n    }\r\n\r\n    default:\r\n      throw new Error(`Unknown format: \"${format}\". Use html, jsx, mjml, or maizzle.`);\r\n  }\r\n}\r\n\r\n/**\r\n * Auto-detect input format from file extension.\r\n */\r\nexport function detectFormat(filePath: string): InputFormat {\r\n  const ext = extname(filePath).toLowerCase();\r\n\r\n  switch (ext) {\r\n    case \".tsx\":\r\n    case \".jsx\":\r\n      return \"jsx\";\r\n    case \".mjml\":\r\n      return \"mjml\";\r\n    case \".html\":\r\n    case \".htm\":\r\n      return \"html\";\r\n    default:\r\n      return \"html\";\r\n  }\r\n}\r\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,IASa;AATb;AAAA;AAAA;AASO,IAAM,eAAN,cAA2B,MAAM;AAAA,MAKtC,YACE,SACA,QACA,OACA;AACA,cAAM,OAAO;AATf,aAAS,OAAO;AAUd,aAAK,SAAS;AACd,aAAK,QAAQ;AAAA,MACf;AAAA,IACF;AAAA;AAAA;;;ACvBA;AAAA;AAAA;AAAA;AAiDA,eAAsB,kBACpB,QACA,SACiB;AApDnB;AAqDE,QAAM,YAAW,wCAAS,YAAT,YAAoB;AAGrC,MAAI,CAAC,UAAU,CAAC,OAAO,KAAK,GAAG;AAC7B,UAAM,IAAI,aAAa,iCAAiC,OAAO,YAAY;AAAA,EAC7E;AAEA,MAAI,OAAO,SAAS,iBAAiB;AACnC,UAAM,IAAI;AAAA,MACR,sBAAsB,kBAAkB,GAAI;AAAA,MAC5C;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAGA,MAAI;AACJ,MAAI;AACJ,MAAI;AACJ,MAAI;AAEJ,MAAI;AACF,KAAC,EAAE,UAAU,IAAI,MAAM,OAAO,SAAS;AAAA,EACzC,SAAQ;AACN,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAEA,MAAI;AACF,YAAQ,MAAM,OAAO,OAAO;AAAA,EAC9B,SAAQ;AACN,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAEA,MAAI;AACF,2BAAuB,MAAM,OAAO,yBAAyB;AAAA,EAC/D,SAAQ;AACN,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAEA,MAAI;AACF,KAAC,EAAE,OAAO,IAAI,MAAM,OAAO,qBAAqB;AAAA,EAClD,SAAQ;AACN,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAGA,MAAI;AACJ,MAAI;AACF,UAAM,SAAS,UAAU,QAAQ;AAAA,MAC/B,YAAY,CAAC,cAAc,OAAO,SAAS;AAAA,MAC3C,YAAY;AAAA,MACZ,YAAY;AAAA,IACd,CAAC;AACD,qBAAiB,OAAO;AAAA,EAC1B,SAAS,KAAc;AACrB,UAAM,UAAU,eAAe,QAAQ,IAAI,UAAU;AACrD,UAAM,IAAI,aAAa,qBAAqB,OAAO,IAAI,OAAO,WAAW;AAAA,EAC3E;AAGA,MAAI;AAEJ,UAAQ,UAAU;AAAA,IAChB,KAAK;AACH,sBAAgB,MAAM,oBAAoB,gBAAgB,OAAO,oBAAoB;AACrF;AAAA,IACF,KAAK;AACH,sBAAgB,MAAM,iBAAiB,gBAAgB,OAAO,oBAAoB;AAClF;AAAA,IACF,KAAK;AACH,sBAAgB,YAAY,gBAAgB,OAAO,oBAAoB;AACvE;AAAA,IACF;AACE,YAAM,IAAI;AAAA,QACR,8BAA8B,QAAQ;AAAA,QACtC;AAAA,QACA;AAAA,MACF;AAAA,EACJ;AAGA,MAAI,aAAqB,mBAAc,YAAd,YAAyB;AAElD,MAAI,OAAO,cAAc,cAAc,OAAO,cAAc,YAAY,cAAc,MAAM;AAC1F,UAAM,SAAS,OAAO,OAAO,SAAoC;AACjE,UAAM,KAAK,OAAO,KAAK,CAAC,MAAM,OAAO,MAAM,UAAU;AACrD,QAAI,GAAI,aAAY;AAAA,EACtB;AAEA,MAAI,OAAO,cAAc,YAAY;AACnC,UAAM,IAAI;AAAA,MACR;AAAA,MAGA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAEA,MAAI;AACF,UAAM,UAAU,MAAM,cAAc,SAAqB;AACzD,UAAM,OAAO,MAAM,OAAO,OAAO;AACjC,WAAO;AAAA,EACT,SAAS,KAAc;AACrB,UAAM,UAAU,eAAe,QAAQ,IAAI,UAAU;AACrD,UAAM,IAAI,aAAa,0BAA0B,OAAO,IAAI,OAAO,QAAQ;AAAA,EAC7E;AACF;AAWA,SAAS,YACP,MACA,OACA,sBACyB;AACzB,QAAM,EAAE,eAAe,OAAO,IAAI,QAAQ,IAAS;AAEnD,QAAM,kBAA2C;AAAA,IAC/C,OAAO;AAAA,IACP,2BAA2B;AAAA,EAC7B;AAEA,QAAM,gBAAyC,CAAC;AAChD,QAAM,YAAY,EAAE,SAAS,cAAc;AAE3C,QAAM,cAAc,CAAC,eAAgC;AACnD,QAAI,cAAc,iBAAiB;AACjC,aAAO,gBAAgB,UAAU;AAAA,IACnC;AACA,UAAM,IAAI;AAAA,MACR,cAAc,UAAU;AAAA,IAE1B;AAAA,EACF;AAEA,QAAM,UAAmC;AAAA,IACvC,QAAQ;AAAA,IACR,SAAS;AAAA,IACT,SAAS;AAAA,IACT;AAAA,IACA;AAAA,IAAQ;AAAA,IAAO;AAAA,IAAQ;AAAA,IAAQ;AAAA,IAC/B;AAAA,IAAK;AAAA,IAAK;AAAA,IAAS;AAAA,IACnB;AAAA,IAAM;AAAA,IAAM;AAAA,IAAM;AAAA,IAClB;AAAA,IAAO;AAAA,IAAW;AAAA,IAAY;AAAA,IAAgB;AAAA,IAAa;AAAA,IAC3D;AAAA,IAAS;AAAA,IACT,OAAO;AAAA,IAAW,SAAS;AAAA,IAC3B;AAAA,IAAU;AAAA,IAAY;AAAA,IAAO;AAAA,IAC7B;AAAA,IAAoB;AAAA,IAAoB;AAAA,IAAW;AAAA,IACnD;AAAA,IAAW;AAAA,IAAK;AAAA,IAChB,SAAS,EAAE,KAAK,MAAM;AAAA,IAAC,GAAG,MAAM,MAAM;AAAA,IAAC,GAAG,OAAO,MAAM;AAAA,IAAC,GAAG,MAAM,MAAM;AAAA,IAAC,GAAG,OAAO,MAAM;AAAA,IAAC,EAAE;AAAA,IAC3F,YAAY;AAAA,IAAW,aAAa;AAAA,IAAW,cAAc;AAAA,IAAW,gBAAgB;AAAA,IACxF,SAAS;AAAA,IAAW,YAAY;AAAA,IAAW,QAAQ;AAAA,IAAW,QAAQ;AAAA,IACtE,WAAW;AAAA,IAAW,YAAY;AAAA,EACpC;AAEA,QAAM,UAAU,cAAc,SAAS;AAAA,IACrC,gBAAgB,EAAE,SAAS,OAAO,MAAM,MAAM;AAAA,EAChD,CAAC;AAED,MAAI;AACF,UAAM,SAAS,IAAI,OAAO,MAAM,EAAE,UAAU,2BAA2B,CAAC;AACxE,WAAO,aAAa,SAAS,EAAE,SAAS,sBAAsB,eAAe,KAAK,CAAC;AAAA,EACrF,SAAS,KAAc;AACrB,UAAM,UAAU,eAAe,QAAQ,IAAI,UAAU;AACrD,QAAI,QAAQ,SAAS,4BAA4B,GAAG;AAClD,YAAM,IAAI,aAAa,qDAAqD,OAAO,WAAW;AAAA,IAChG;AACA,UAAM,IAAI,aAAa,wBAAwB,OAAO,IAAI,OAAO,WAAW;AAAA,EAC9E;AAEA,SAAO,UAAU;AACnB;AAqBA,eAAe,oBACb,MACA,OACA,sBACkC;AAjRpC;AAkRE,MAAI;AACJ,MAAI;AACF,UAAM,MAAM,OAAO,aAAa;AAAA,EAClC,SAAQ;AACN,UAAM,IAAI;AAAA,MACR;AAAA,MAGA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAGA,QAAM,UAAU,IAAI,IAAI,QAAQ,EAAE,aAAa,IAAI,CAAC;AACpD,MAAI;AACF,UAAM,aAAa,MAAM,QAAQ,cAAc;AAI/C,UAAM,iBAAiB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,YAgBf,IAAI;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAQZ,QAAI;AACF,YAAM,SAAS,MAAM,WAAW,KAAK,gBAAgB;AAAA,QACnD,SAAS;AAAA,MACX,CAAC;AAED,UAAI,OAAO,WAAW,UAAU;AAC9B,cAAM,SAAS,KAAK,MAAM,MAAM;AAChC,YAAI,CAAC,OAAO,IAAI;AACd,gBAAM,IAAI;AAAA,YACR,yBAAwB,YAAO,UAAP,YAAgB,eAAe;AAAA,YACvD;AAAA,YACA;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAAA,IACF,SAAS,KAAc;AACrB,UAAI,eAAe,aAAc,OAAM;AACvC,YAAM,UAAU,eAAe,QAAQ,IAAI,UAAU;AACrD,UAAI,QAAQ,SAAS,WAAW,KAAK,QAAQ,SAAS,SAAS,GAAG;AAChE,cAAM,IAAI,aAAa,qDAAqD,OAAO,WAAW;AAAA,MAChG;AACA,YAAM,IAAI,aAAa,wBAAwB,OAAO,IAAI,OAAO,WAAW;AAAA,IAC9E;AAAA,EACF,UAAE;AACA,YAAQ,QAAQ;AAAA,EAClB;AAGA,SAAO,YAAY,MAAM,OAAO,oBAAoB;AACtD;AAkBA,eAAe,iBACb,MACA,OACA,sBACkC;AAjXpC;AAkXE,MAAI;AACJ,MAAI;AACF,KAAC,EAAE,WAAW,IAAI,MAAM,OAAO,oBAAoB;AAAA,EACrD,SAAQ;AACN,UAAM,IAAI;AAAA,MACR;AAAA,MAGA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAEA,QAAM,UAAU,MAAM,WAAW;AACjC,QAAM,KAAK,QAAQ,WAAW;AAE9B,MAAI;AAKF,UAAM,iBAAiB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,YAYf,IAAI;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAQZ,UAAM,SAAS,GAAG,SAAS,cAAc;AACzC,QAAI,OAAO,OAAO;AAChB,YAAM,WAAW,GAAG,KAAK,OAAO,KAAK;AACrC,aAAO,MAAM,QAAQ;AACrB,YAAM,IAAI;AAAA,QACR,wBAAwB,OAAO,aAAa,WAAW,WAAW,0BAA0B;AAAA,QAC5F;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAEA,UAAM,YAAY,GAAG,KAAK,OAAO,KAAK;AACtC,WAAO,MAAM,QAAQ;AAErB,QAAI,OAAO,cAAc,UAAU;AACjC,YAAM,SAAS,KAAK,MAAM,SAAS;AACnC,UAAI,CAAC,OAAO,IAAI;AACd,cAAM,IAAI;AAAA,UACR,yBAAwB,YAAO,UAAP,YAAgB,eAAe;AAAA,UACvD;AAAA,UACA;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAIA,WAAO,YAAY,MAAM,OAAO,oBAAoB;AAAA,EACtD,UAAE;AACA,OAAG,QAAQ;AAAA,EACb;AACF;AA1bA,IAGM,iBAGA;AANN;AAAA;AAAA;AAAA;AAGA,IAAM,kBAAkB;AAGxB,IAAM,uBAAuB;AAAA;AAAA;;;ACN7B;AAAA;AAAA;AAAA;AAcA,eAAsB,YAAY,QAAiC;AAdnE;AAgBE,MAAI,CAAC,UAAU,CAAC,OAAO,KAAK,GAAG;AAC7B,UAAM,IAAI,aAAa,kCAAkC,QAAQ,YAAY;AAAA,EAC/E;AAEA,MAAI,OAAO,SAASA,kBAAiB;AACnC,UAAM,IAAI;AAAA,MACR,uBAAuBA,mBAAkB,GAAI;AAAA,MAC7C;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAEA,MAAI,CAAC,cAAc,KAAK,MAAM,GAAG;AAC/B,UAAM,IAAI;AAAA,MACR;AAAA,MAEA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAOA,MAAI;AAKJ,MAAI;AACF,UAAM,aAAa,MAAM,OAAO,MAAM;AACtC,iBAAY,gBAAW,YAAX,YAAsB;AAAA,EACpC,SAAQ;AACN,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAGA,MAAI;AAGF,UAAM,SAAS,MAAM,UAAU,QAAQ;AAAA,MACrC,iBAAiB;AAAA,MACjB,cAAc;AAAA,IAChB,CAAC;AAED,QAAI,OAAO,UAAU,OAAO,OAAO,SAAS,KAAK,CAAC,OAAO,MAAM;AAC7D,YAAM,gBAAgB,OAAO,OAC1B,IAAI,CAAC,MAAM,QAAQ,EAAE,IAAI,KAAK,EAAE,OAAO,KAAK,EAAE,OAAO,GAAG,EACxD,KAAK,IAAI;AACZ,YAAM,IAAI;AAAA,QACR,4BAA4B,aAAa;AAAA,QACzC;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAEA,QAAI,CAAC,OAAO,MAAM;AAChB,YAAM,IAAI,aAAa,2CAA2C,QAAQ,SAAS;AAAA,IACrF;AAEA,WAAO,OAAO;AAAA,EAChB,SAAS,KAAc;AACrB,QAAI,eAAe,aAAc,OAAM;AACvC,UAAM,UAAU,eAAe,QAAQ,IAAI,UAAU;AACrD,UAAM,IAAI,aAAa,4BAA4B,OAAO,IAAI,QAAQ,SAAS;AAAA,EACjF;AACF;AAxFA,IAGMA;AAHN;AAAA;AAAA;AAAA;AAGA,IAAMA,mBAAkB;AAAA;AAAA;;;ACHxB;AAAA;AAAA;AAAA;AA0CA,eAAsB,eAAe,QAAiC;AAEpE,MAAI,CAAC,UAAU,CAAC,OAAO,KAAK,GAAG;AAC7B,UAAM,IAAI,aAAa,qCAAqC,WAAW,YAAY;AAAA,EACrF;AAEA,MAAI,OAAO,SAASC,kBAAiB;AACnC,UAAM,IAAI;AAAA,MACR,0BAA0BA,mBAAkB,GAAI;AAAA,MAChD;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAGA,MAAI,uBAAuB,KAAK,MAAM,GAAG;AACvC,UAAM,IAAI;AAAA,MACR;AAAA,MAGA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAGA,MAAI;AAKJ,MAAI;AACF,UAAM,UAAU,MAAM,OAAO,oBAAoB;AACjD,oBAAgB,QAAQ;AAAA,EAC1B,SAAQ;AACN,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAGA,QAAM,iBAAiB,cAAc,QAAQ;AAAA,IAC3C,KAAK;AAAA,MACH,QAAQ;AAAA,QACN,wBAAwB;AAAA,QACxB,sBAAsB;AAAA,QACtB,uBAAuB;AAAA,MACzB;AAAA,MACA,WAAW;AAAA,MACX,QAAQ;AAAA,IACV;AAAA,IACA,QAAQ,CAAC;AAAA,EACX,CAAC;AAED,QAAM,iBAAiB,IAAI,QAAe,CAAC,GAAG,WAAW;AACvD,UAAM,IAAI,WAAW,MAAM;AACzB;AAAA,QACE,IAAI;AAAA,UACF,uCAAuC,qBAAqB,GAAI;AAAA,UAChE;AAAA,UACA;AAAA,QACF;AAAA,MACF;AAAA,IACF,GAAG,kBAAkB;AACrB,QAAI,OAAO,EAAE,UAAU,WAAY,GAAE,MAAM;AAAA,EAC7C,CAAC;AAED,MAAI;AACF,UAAM,EAAE,KAAK,IAAI,MAAM,QAAQ,KAAK,CAAC,gBAAgB,cAAc,CAAC;AAEpE,QAAI,CAAC,MAAM;AACT,YAAM,IAAI,aAAa,8CAA8C,WAAW,SAAS;AAAA,IAC3F;AAEA,WAAO;AAAA,EACT,SAAS,KAAc;AACrB,QAAI,eAAe,aAAc,OAAM;AACvC,UAAM,UAAU,eAAe,QAAQ,IAAI,UAAU;AACrD,UAAM,IAAI,aAAa,+BAA+B,OAAO,IAAI,WAAW,SAAS;AAAA,EACvF;AACF;AA5HA,IAGMA,kBAGA,oBAcA;AApBN;AAAA;AAAA;AAAA;AAGA,IAAMA,mBAAkB;AAGxB,IAAM,qBAAqB;AAc3B,IAAM,yBACJ;AAAA;AAAA;;;ACrBF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,uBAAwB;AAGxB;AACA;AAEA;AACA;AAOA,eAAsB,QACpB,QACA,QACA,UACiB;AACjB,UAAQ,QAAQ;AAAA,IACd,KAAK;AACH,aAAO;AAAA,IAET,KAAK,OAAO;AACV,YAAM,EAAE,mBAAAC,mBAAkB,IAAI,MAAM;AACpC,aAAOA,mBAAkB,MAAM;AAAA,IACjC;AAAA,IAEA,KAAK,QAAQ;AACX,YAAM,EAAE,aAAAC,aAAY,IAAI,MAAM;AAC9B,aAAOA,aAAY,MAAM;AAAA,IAC3B;AAAA,IAEA,KAAK,WAAW;AACd,YAAM,EAAE,gBAAAC,gBAAe,IAAI,MAAM;AACjC,aAAOA,gBAAe,MAAM;AAAA,IAC9B;AAAA,IAEA;AACE,YAAM,IAAI,MAAM,oBAAoB,MAAM,qCAAqC;AAAA,EACnF;AACF;AAKO,SAAS,aAAa,UAA+B;AAC1D,QAAM,UAAM,0BAAQ,QAAQ,EAAE,YAAY;AAE1C,UAAQ,KAAK;AAAA,IACX,KAAK;AAAA,IACL,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AAAA,IACL,KAAK;AACH,aAAO;AAAA,IACT;AACE,aAAO;AAAA,EACX;AACF;","names":["MAX_SOURCE_SIZE","MAX_SOURCE_SIZE","compileReactEmail","compileMjml","compileMaizzle"]}
+{"version":3,"sources":["../../src/compile/errors.ts","../../src/compile/react-email.ts","../../src/compile/mjml.ts","../../src/compile/maizzle.ts","../../src/compile/index.ts"],"sourcesContent":["import type { InputFormat } from \"../types.js\";\r\n\r\n/**\r\n * Unified error class for all email compilation failures.\r\n *\r\n * Replaces the per-format error classes (ReactEmailCompileError,\r\n * MjmlCompileError, MaizzleCompileError) with a single class that\r\n * carries the source format and failure phase.\r\n */\r\nexport class CompileError extends Error {\r\n  override name = \"CompileError\";\r\n  readonly format: Exclude<InputFormat, \"html\">;\r\n  readonly phase: \"validation\" | \"transpile\" | \"execution\" | \"render\" | \"compile\";\r\n\r\n  constructor(\r\n    message: string,\r\n    format: CompileError[\"format\"],\r\n    phase: CompileError[\"phase\"],\r\n  ) {\r\n    super(message);\r\n    this.format = format;\r\n    this.phase = phase;\r\n  }\r\n}\r\n","import { CompileError } from \"./errors.js\";\r\n\r\n/** Maximum source code size: 256KB */\r\nconst MAX_SOURCE_SIZE = 256_000;\r\n\r\n/** Execution timeout: 5 seconds */\r\nconst EXECUTION_TIMEOUT_MS = 5_000;\r\n\r\n/**\r\n * Sandbox strategy for JSX execution.\r\n *\r\n * - `\"vm\"` — `node:vm` with hardened globals. Fast, zero-dependency,\r\n *   but NOT a true security boundary (prototype-chain escapes are possible).\r\n *   Suitable for CLI / local use where users run their own code.\r\n *\r\n * - `\"isolated-vm\"` (default) — Separate V8 isolate via the `isolated-vm`\r\n *   npm package. True heap isolation; escapes require a V8 engine bug.\r\n *   Requires `isolated-vm` to be installed (native addon).\r\n *\r\n * - `\"quickjs\"` — Validates code structure in a QuickJS WASM sandbox, then\r\n *   executes in `node:vm` for React rendering. Security is equivalent to\r\n *   `node:vm` — the QuickJS phase validates import restrictions only.\r\n *   No native addons needed, but only supports ES2020 and is slower.\r\n *   For true isolation on servers, use `isolated-vm`.\r\n */\r\nexport type SandboxStrategy = \"vm\" | \"isolated-vm\" | \"quickjs\";\r\n\r\nexport interface CompileReactEmailOptions {\r\n  /**\r\n   * Sandbox strategy to use for executing user JSX code.\r\n   * @default \"isolated-vm\"\r\n   */\r\n  sandbox?: SandboxStrategy;\r\n}\r\n\r\n/**\r\n * Compile a React Email JSX/TSX source string into an HTML email string.\r\n *\r\n * Pipeline:\r\n *  1. Validate input (size, basic checks)\r\n *  2. Transpile JSX/TSX → CommonJS JS using sucrase\r\n *  3. Execute inside a sandbox (configurable strategy)\r\n *  4. Render the exported component to a full HTML email string\r\n *\r\n * Requires peer dependencies: sucrase, react, @react-email/components,\r\n * @react-email/render. Additionally:\r\n *  - sandbox \"isolated-vm\" requires `isolated-vm`\r\n *  - sandbox \"quickjs\" requires `quickjs-emscripten`\r\n */\r\nexport async function compileReactEmail(\r\n  source: string,\r\n  options?: CompileReactEmailOptions,\r\n): Promise<string> {\r\n  const strategy = options?.sandbox ?? \"isolated-vm\";\r\n\r\n  // ── 1. Validate ──────────────────────────────────────────────────────\r\n  if (!source || !source.trim()) {\r\n    throw new CompileError(\"JSX source must not be empty.\", \"jsx\", \"validation\");\r\n  }\r\n\r\n  if (source.length > MAX_SOURCE_SIZE) {\r\n    throw new CompileError(\r\n      `JSX source exceeds ${MAX_SOURCE_SIZE / 1000}KB limit.`,\r\n      \"jsx\",\r\n      \"validation\",\r\n    );\r\n  }\r\n\r\n  // ── 2. Load peer dependencies ────────────────────────────────────────\r\n  let transform: typeof import(\"sucrase\").transform;\r\n  let React: typeof import(\"react\");\r\n  let ReactEmailComponents: typeof import(\"@react-email/components\");\r\n  let render: typeof import(\"@react-email/render\").render;\r\n\r\n  try {\r\n    ({ transform } = await import(\"sucrase\"));\r\n  } catch {\r\n    throw new CompileError(\r\n      'JSX compilation requires \"sucrase\". Install it:\\n  npm install sucrase',\r\n      \"jsx\",\r\n      \"transpile\",\r\n    );\r\n  }\r\n\r\n  try {\r\n    React = await import(\"react\");\r\n  } catch {\r\n    throw new CompileError(\r\n      'JSX compilation requires \"react\". Install it:\\n  npm install react',\r\n      \"jsx\",\r\n      \"transpile\",\r\n    );\r\n  }\r\n\r\n  try {\r\n    ReactEmailComponents = await import(\"@react-email/components\");\r\n  } catch {\r\n    throw new CompileError(\r\n      'JSX compilation requires \"@react-email/components\". Install it:\\n  npm install @react-email/components',\r\n      \"jsx\",\r\n      \"transpile\",\r\n    );\r\n  }\r\n\r\n  try {\r\n    ({ render } = await import(\"@react-email/render\"));\r\n  } catch {\r\n    throw new CompileError(\r\n      'JSX compilation requires \"@react-email/render\". Install it:\\n  npm install @react-email/render',\r\n      \"jsx\",\r\n      \"transpile\",\r\n    );\r\n  }\r\n\r\n  // ── 3. Transpile JSX/TSX → CommonJS ──────────────────────────────────\r\n  let transpiledCode: string;\r\n  try {\r\n    const result = transform(source, {\r\n      transforms: [\"typescript\", \"jsx\", \"imports\"],\r\n      jsxRuntime: \"classic\",\r\n      production: true,\r\n    });\r\n    transpiledCode = result.code;\r\n  } catch (err: unknown) {\r\n    const message = err instanceof Error ? err.message : \"Unknown transpilation error\";\r\n    throw new CompileError(`JSX syntax error: ${message}`, \"jsx\", \"transpile\");\r\n  }\r\n\r\n  // ── 4. Execute in sandbox ────────────────────────────────────────────\r\n  let moduleExports: Record<string, unknown>;\r\n\r\n  switch (strategy) {\r\n    case \"isolated-vm\":\r\n      moduleExports = await executeInIsolatedVm(transpiledCode, React, ReactEmailComponents);\r\n      break;\r\n    case \"quickjs\":\r\n      moduleExports = await executeInQuickJs(transpiledCode, React, ReactEmailComponents);\r\n      break;\r\n    case \"vm\":\r\n      moduleExports = await executeInVm(transpiledCode, React, ReactEmailComponents);\r\n      break;\r\n    default:\r\n      throw new CompileError(\r\n        `Unknown sandbox strategy: \"${strategy}\". Use \"vm\", \"isolated-vm\", or \"quickjs\".`,\r\n        \"jsx\",\r\n        \"execution\",\r\n      );\r\n  }\r\n\r\n  // ── 5. Extract component and render ──────────────────────────────────\r\n  let Component: unknown = moduleExports.default ?? moduleExports;\r\n\r\n  if (typeof Component !== \"function\" && typeof Component === \"object\" && Component !== null) {\r\n    const values = Object.values(Component as Record<string, unknown>);\r\n    const fn = values.find((v) => typeof v === \"function\");\r\n    if (fn) Component = fn;\r\n  }\r\n\r\n  if (typeof Component !== \"function\") {\r\n    throw new CompileError(\r\n      'The JSX source must export a React component function. ' +\r\n        'Use \"export default function Email() { ... }\" or ' +\r\n        '\"export function Email() { ... }\".',\r\n      \"jsx\",\r\n      \"execution\",\r\n    );\r\n  }\r\n\r\n  try {\r\n    const element = React.createElement(Component as React.FC);\r\n    const html = await render(element);\r\n    return html;\r\n  } catch (err: unknown) {\r\n    const message = err instanceof Error ? err.message : \"Unknown rendering error\";\r\n    throw new CompileError(`React rendering error: ${message}`, \"jsx\", \"render\");\r\n  }\r\n}\r\n\r\n// ─── Sandbox: node:vm ──────────────────────────────────────────────────────\r\n\r\n/**\r\n * Execute transpiled code in a node:vm context with hardened globals.\r\n *\r\n * NOT a security boundary — see node:vm documentation. Suitable for CLI\r\n * use where the user runs their own code. For server use, prefer\r\n * \"isolated-vm\" or \"quickjs\".\r\n */\r\nasync function executeInVm(\r\n  code: string,\r\n  React: typeof import(\"react\"),\r\n  ReactEmailComponents: typeof import(\"@react-email/components\"),\r\n): Promise<Record<string, unknown>> {\r\n  const { createContext, Script } = await import(\"node:vm\");\r\n\r\n  const ALLOWED_MODULES: Record<string, unknown> = {\r\n    react: React,\r\n    \"@react-email/components\": ReactEmailComponents,\r\n  };\r\n\r\n  const moduleExports: Record<string, unknown> = {};\r\n  const moduleObj = { exports: moduleExports };\r\n\r\n  const mockRequire = (moduleName: string): unknown => {\r\n    if (moduleName in ALLOWED_MODULES) {\r\n      return ALLOWED_MODULES[moduleName];\r\n    }\r\n    throw new Error(\r\n      `Import of \"${moduleName}\" is not allowed. ` +\r\n        `Only \"react\" and \"@react-email/components\" can be imported.`,\r\n    );\r\n  };\r\n\r\n  const sandbox: Record<string, unknown> = {\r\n    module: moduleObj,\r\n    exports: moduleExports,\r\n    require: mockRequire,\r\n    React,\r\n    Object, Array, String, Number, Boolean,\r\n    Map, Set, WeakMap, WeakSet,\r\n    JSON, Math, Date, RegExp,\r\n    Error, TypeError, RangeError, ReferenceError, SyntaxError, URIError,\r\n    Promise, Symbol,\r\n    Proxy: undefined, Reflect: undefined,\r\n    parseInt, parseFloat, isNaN, isFinite,\r\n    encodeURIComponent, decodeURIComponent, encodeURI, decodeURI,\r\n    undefined, NaN, Infinity,\r\n    console: { log: () => {}, warn: () => {}, error: () => {}, info: () => {}, debug: () => {} },\r\n    setTimeout: undefined, setInterval: undefined, setImmediate: undefined, queueMicrotask: undefined,\r\n    process: undefined, globalThis: undefined, global: undefined, Buffer: undefined,\r\n    __dirname: undefined, __filename: undefined,\r\n  };\r\n\r\n  const context = createContext(sandbox, {\r\n    codeGeneration: { strings: false, wasm: false },\r\n  });\r\n\r\n  try {\r\n    const script = new Script(code, { filename: \"user-email-component.tsx\" });\r\n    script.runInContext(context, { timeout: EXECUTION_TIMEOUT_MS, displayErrors: true });\r\n  } catch (err: unknown) {\r\n    const message = err instanceof Error ? err.message : \"Unknown execution error\";\r\n    if (message.includes(\"Script execution timed out\")) {\r\n      throw new CompileError(\"JSX execution timed out (possible infinite loop).\", \"jsx\", \"execution\");\r\n    }\r\n    throw new CompileError(`JSX execution error: ${message}`, \"jsx\", \"execution\");\r\n  }\r\n\r\n  return moduleObj.exports as Record<string, unknown>;\r\n}\r\n\r\n// ─── Sandbox: isolated-vm ──────────────────────────────────────────────────\r\n\r\n/**\r\n * Validate code in a separate V8 isolate, then execute in `node:vm`.\r\n *\r\n * Two-phase approach:\r\n *  1. **Validate** — run the transpiled code in a true V8 isolate with stub\r\n *     React/component implementations. This catches disallowed imports and\r\n *     structural errors inside a genuine security boundary (separate heap,\r\n *     128 MB memory cap, timeout). Escape requires a V8 engine bug.\r\n *  2. **Execute** — run the validated code in `node:vm` with real React\r\n *     objects for actual rendering.\r\n *\r\n * Why two phases: React's internal type system uses Symbols\r\n * (`Symbol(react.forward_ref)`, `Symbol(react.element)`, etc.) which cannot\r\n * be transferred across V8 isolate boundaries — the structured clone\r\n * algorithm does not support Symbols. Running React code directly inside\r\n * `isolated-vm` is not possible.\r\n */\r\nasync function executeInIsolatedVm(\r\n  code: string,\r\n  React: typeof import(\"react\"),\r\n  ReactEmailComponents: typeof import(\"@react-email/components\"),\r\n): Promise<Record<string, unknown>> {\r\n  let ivm: typeof import(\"isolated-vm\");\r\n  try {\r\n    const ivmMod = await import(\"isolated-vm\");\r\n    ivm = (ivmMod as any).default ?? ivmMod;\r\n  } catch {\r\n    throw new CompileError(\r\n      'Sandbox strategy \"isolated-vm\" requires the \"isolated-vm\" package. Install it:\\n' +\r\n        \"  npm install isolated-vm\\n\" +\r\n        'Or use sandbox: \"vm\" for a lighter (but less secure) alternative.',\r\n      \"jsx\",\r\n      \"execution\",\r\n    );\r\n  }\r\n\r\n  // ── Phase 1: Validate in a true V8 isolate ─────────────────────────────\r\n  const isolate = new ivm.Isolate({ memoryLimit: 128 });\r\n  try {\r\n    const ivmContext = await isolate.createContext();\r\n\r\n    // Stub implementations let the code parse and execute structurally\r\n    // without needing real React objects (which contain non-cloneable Symbols).\r\n    // Stub React: createElement returns a plain object, forwardRef passes\r\n    // through, and any unknown property returns a no-op function. The Proxy\r\n    // on the components module ensures that any named import (Html, Head,\r\n    // Button, etc.) resolves to a dummy component function so the transpiled\r\n    // code can execute structurally without real React objects.\r\n    const validationCode = `\r\n      (function() {\r\n        var module = { exports: {} };\r\n        var exports = module.exports;\r\n        var noop = function() { return {}; };\r\n        var React = new Proxy({\r\n          createElement: noop,\r\n          forwardRef: function(fn) { return fn; },\r\n          Fragment: \"Fragment\",\r\n          createContext: function() { return { Provider: noop, Consumer: noop }; },\r\n          useState: function(v) { return [v, noop]; },\r\n          useRef: function() { return { current: null }; },\r\n          useEffect: noop,\r\n          useMemo: function(fn) { return fn(); },\r\n          useCallback: function(fn) { return fn; },\r\n          Children: { map: noop, forEach: noop, toArray: function() { return []; } },\r\n        }, { get: function(t, p) { return p in t ? t[p] : noop; } });\r\n        var componentsProxy = new Proxy({}, {\r\n          get: function() { return noop; }\r\n        });\r\n        function require(name) {\r\n          if (name === \"react\") return React;\r\n          if (name === \"@react-email/components\") return componentsProxy;\r\n          throw new Error('Import of \"' + name + '\" is not allowed. Only \"react\" and \"@react-email/components\" can be imported.');\r\n        }\r\n        try {\r\n          ${code}\r\n          return JSON.stringify({ ok: true });\r\n        } catch(e) {\r\n          return JSON.stringify({ ok: false, error: e.message || \"Unknown error\" });\r\n        }\r\n      })()\r\n    `;\r\n\r\n    try {\r\n      const result = await ivmContext.eval(validationCode, {\r\n        timeout: EXECUTION_TIMEOUT_MS,\r\n      });\r\n\r\n      if (typeof result === \"string\") {\r\n        const parsed = JSON.parse(result) as { ok: boolean; error?: string };\r\n        if (!parsed.ok) {\r\n          throw new CompileError(\r\n            `JSX execution error: ${parsed.error ?? \"Unknown error\"}`,\r\n            \"jsx\",\r\n            \"execution\",\r\n          );\r\n        }\r\n      }\r\n    } catch (err: unknown) {\r\n      if (err instanceof CompileError) throw err;\r\n      const message = err instanceof Error ? err.message : \"Unknown execution error\";\r\n      if (message.includes(\"timed out\") || message.includes(\"Timeout\")) {\r\n        throw new CompileError(\"JSX execution timed out (possible infinite loop).\", \"jsx\", \"execution\");\r\n      }\r\n      throw new CompileError(`JSX execution error: ${message}`, \"jsx\", \"execution\");\r\n    }\r\n  } finally {\r\n    isolate.dispose();\r\n  }\r\n\r\n  // ── Phase 2: Execute validated code in node:vm with real React ──────────\r\n  return executeInVm(code, React, ReactEmailComponents);\r\n}\r\n\r\n// ─── Sandbox: QuickJS (WASM) ──────────────────────────────────────────────\r\n\r\n/**\r\n * Validate code structure in QuickJS WASM, then execute in `node:vm`.\r\n *\r\n * Two-phase approach:\r\n *  1. Validate that the code doesn't access disallowed modules by running it\r\n *     in a QuickJS WASM sandbox with stub implementations.\r\n *  2. Execute in `node:vm` for actual React rendering (React objects can't\r\n *     cross the WASM boundary).\r\n *\r\n * **Security note:** The actual execution happens in `node:vm`, so runtime\r\n * security is equivalent to the `\"vm\"` strategy. The QuickJS phase only\r\n * validates import restrictions. For true isolation on servers, use\r\n * `\"isolated-vm\"`.\r\n */\r\nasync function executeInQuickJs(\r\n  code: string,\r\n  React: typeof import(\"react\"),\r\n  ReactEmailComponents: typeof import(\"@react-email/components\"),\r\n): Promise<Record<string, unknown>> {\r\n  let getQuickJS: typeof import(\"quickjs-emscripten\").getQuickJS;\r\n  try {\r\n    ({ getQuickJS } = await import(\"quickjs-emscripten\"));\r\n  } catch {\r\n    throw new CompileError(\r\n      'Sandbox strategy \"quickjs\" requires the \"quickjs-emscripten\" package. Install it:\\n' +\r\n        \"  npm install quickjs-emscripten\\n\" +\r\n        'Or use sandbox: \"vm\" for a lighter alternative.',\r\n      \"jsx\",\r\n      \"execution\",\r\n    );\r\n  }\r\n\r\n  const QuickJS = await getQuickJS();\r\n  const vm = QuickJS.newContext();\r\n\r\n  try {\r\n    // Phase 1: Validate code safety in the WASM sandbox.\r\n    // We provide stub implementations of React and the module system so\r\n    // the code can execute without errors, but we only care that it\r\n    // doesn't try to access anything dangerous.\r\n    // QuickJS (ES2020) does not support Proxy, so we enumerate known\r\n    // React Email component names as stub functions instead.\r\n    const validationCode = `\r\n      (function() {\r\n        var module = { exports: {} };\r\n        var exports = module.exports;\r\n        var noop = function() { return {}; };\r\n        var React = {\r\n          createElement: noop,\r\n          forwardRef: function(fn) { return fn; },\r\n          Fragment: \"Fragment\",\r\n          createContext: function() { return { Provider: noop, Consumer: noop }; },\r\n          useState: function(v) { return [v, noop]; },\r\n          useRef: function() { return { current: null }; },\r\n          useEffect: noop,\r\n          useMemo: function(fn) { return fn(); },\r\n          useCallback: function(fn) { return fn; },\r\n          Children: { map: noop, forEach: noop, toArray: function() { return []; } },\r\n        };\r\n        var components = {};\r\n        var names = [\r\n          \"Html\",\"Head\",\"Body\",\"Container\",\"Section\",\"Row\",\"Column\",\"Text\",\r\n          \"Link\",\"Button\",\"Img\",\"Hr\",\"Preview\",\"Heading\",\"Font\",\"Style\",\r\n          \"CodeBlock\",\"CodeInline\",\"Markdown\",\"Tailwind\",\"Responsive\",\r\n        ];\r\n        for (var i = 0; i < names.length; i++) components[names[i]] = noop;\r\n        function require(name) {\r\n          if (name === \"react\") return React;\r\n          if (name === \"@react-email/components\") return components;\r\n          throw new Error('Import of \"' + name + '\" is not allowed.');\r\n        }\r\n        try {\r\n          ${code}\r\n          return JSON.stringify({ ok: true });\r\n        } catch(e) {\r\n          return JSON.stringify({ ok: false, error: e.message || \"Unknown error\" });\r\n        }\r\n      })()\r\n    `;\r\n\r\n    const result = vm.evalCode(validationCode);\r\n    if (result.error) {\r\n      const errorVal = vm.dump(result.error);\r\n      result.error.dispose();\r\n      throw new CompileError(\r\n        `JSX execution error: ${typeof errorVal === \"string\" ? errorVal : \"QuickJS execution failed\"}`,\r\n        \"jsx\",\r\n        \"execution\",\r\n      );\r\n    }\r\n\r\n    const resultStr = vm.dump(result.value);\r\n    result.value.dispose();\r\n\r\n    if (typeof resultStr === \"string\") {\r\n      const parsed = JSON.parse(resultStr) as { ok: boolean; error?: string };\r\n      if (!parsed.ok) {\r\n        throw new CompileError(\r\n          `JSX execution error: ${parsed.error ?? \"Unknown error\"}`,\r\n          \"jsx\",\r\n          \"execution\",\r\n        );\r\n      }\r\n    }\r\n\r\n    // Phase 2: Code validated as safe — execute in node:vm for actual\r\n    // React rendering (React objects can't cross the WASM boundary)\r\n    return executeInVm(code, React, ReactEmailComponents);\r\n  } finally {\r\n    vm.dispose();\r\n  }\r\n}\r\n","import { CompileError } from \"./errors.js\";\r\n\r\n/** Maximum MJML source size: 512KB */\r\nconst MAX_SOURCE_SIZE = 512_000;\r\n\r\n/**\r\n * Compile an MJML source string into an HTML email string.\r\n *\r\n * MJML is a declarative markup language with no code execution capability\r\n * (unlike JSX). The mjml library parses XML and generates HTML; there is\r\n * no sandboxing concern.\r\n *\r\n * Requires peer dependency: mjml\r\n */\r\nexport async function compileMjml(source: string): Promise<string> {\r\n  // ── 1. Validate ──────────────────────────────────────────────────────\r\n  if (!source || !source.trim()) {\r\n    throw new CompileError(\"MJML source must not be empty.\", \"mjml\", \"validation\");\r\n  }\r\n\r\n  if (source.length > MAX_SOURCE_SIZE) {\r\n    throw new CompileError(\r\n      `MJML source exceeds ${MAX_SOURCE_SIZE / 1000}KB limit.`,\r\n      \"mjml\",\r\n      \"validation\",\r\n    );\r\n  }\r\n\r\n  if (!/<mjml[\\s>]/i.test(source)) {\r\n    throw new CompileError(\r\n      \"MJML source must contain a root <mjml> element. \" +\r\n        \"Example: <mjml><mj-body><mj-section><mj-column><mj-text>Hello</mj-text></mj-column></mj-section></mj-body></mjml>\",\r\n      \"mjml\",\r\n      \"validation\",\r\n    );\r\n  }\r\n\r\n  // ── 2. Load peer dependency ──────────────────────────────────────────\r\n  type MjmlResult = {\r\n    html: string;\r\n    errors: Array<{ line: number; message: string; tagName: string; formattedMessage: string }>;\r\n  };\r\n  let mjml2html: (\r\n    input: string,\r\n    options?: Record<string, unknown>,\r\n  ) => MjmlResult | Promise<MjmlResult>;\r\n\r\n  try {\r\n    const mjmlModule = await import(\"mjml\");\r\n    mjml2html = mjmlModule.default ?? mjmlModule;\r\n  } catch {\r\n    throw new CompileError(\r\n      'MJML compilation requires \"mjml\". Install it:\\n  npm install mjml',\r\n      \"mjml\",\r\n      \"compile\",\r\n    );\r\n  }\r\n\r\n  // ── 3. Compile ───────────────────────────────────────────────────────\r\n  try {\r\n    // mjml v5+ returns a Promise; v4 returns synchronously.\r\n    // Await handles both cases.\r\n    const result = await mjml2html(source, {\r\n      validationLevel: \"soft\",\r\n      keepComments: false,\r\n    });\r\n\r\n    if (result.errors && result.errors.length > 0 && !result.html) {\r\n      const errorMessages = result.errors\r\n        .map((e) => `Line ${e.line}: ${e.message} (${e.tagName})`)\r\n        .join(\"; \");\r\n      throw new CompileError(\r\n        `MJML compilation errors: ${errorMessages}`,\r\n        \"mjml\",\r\n        \"compile\",\r\n      );\r\n    }\r\n\r\n    if (!result.html) {\r\n      throw new CompileError(\"MJML compilation produced empty output.\", \"mjml\", \"compile\");\r\n    }\r\n\r\n    return result.html;\r\n  } catch (err: unknown) {\r\n    if (err instanceof CompileError) throw err;\r\n    const message = err instanceof Error ? err.message : \"Unknown MJML compilation error\";\r\n    throw new CompileError(`MJML compilation failed: ${message}`, \"mjml\", \"compile\");\r\n  }\r\n}\r\n","import { CompileError } from \"./errors.js\";\r\n\r\n/** Maximum Maizzle source size: 512KB */\r\nconst MAX_SOURCE_SIZE = 512_000;\r\n\r\n/** Compilation timeout: 15 seconds */\r\nconst COMPILE_TIMEOUT_MS = 15_000;\r\n\r\n/**\r\n * PostHTML directives that perform file-system reads or network fetches.\r\n *\r\n * Maizzle's PostHTML pipeline resolves these at compile time: a template\r\n * like `<extends src=\"/etc/passwd\">` causes the server to read that path\r\n * and include the content in rendered output (server-side file read). We\r\n * reject any input containing these directives rather than stripping them,\r\n * because stripping is error-prone with nested or malformed markup.\r\n *\r\n * Affected plugins: posthtml-extend, posthtml-fetch, posthtml-components,\r\n * posthtml-include, posthtml-modules.\r\n */\r\nconst DANGEROUS_DIRECTIVE_RE =\r\n  /<\\s*(?:extends|component|fetch|include|module|slot|fill|raw|block|yield)\\b/i;\r\n\r\n/**\r\n * Compile a Maizzle template string into an HTML email string.\r\n *\r\n * Pipeline:\r\n *  1. Validate input (size, basic structure check)\r\n *  2. Reject inputs containing PostHTML file-access directives\r\n *  3. Compile using @maizzle/framework\r\n *\r\n * Security:\r\n *  - PostHTML file-system directives are rejected at validation time\r\n *    to prevent server-side file reads and SSRF.\r\n *  - Template expressions ({{ expr }}) are evaluated by posthtml-expressions\r\n *    with empty `locals`, so unknown identifiers like `process` or `require`\r\n *    return the literal string '{local}' rather than accessing Node.js globals.\r\n *  - A hard timeout prevents pathological PostCSS/Tailwind inputs from\r\n *    hanging indefinitely.\r\n *\r\n * Requires peer dependency: @maizzle/framework\r\n */\r\nexport async function compileMaizzle(source: string): Promise<string> {\r\n  // ── 1. Validate ──────────────────────────────────────────────────────\r\n  if (!source || !source.trim()) {\r\n    throw new CompileError(\"Maizzle source must not be empty.\", \"maizzle\", \"validation\");\r\n  }\r\n\r\n  if (source.length > MAX_SOURCE_SIZE) {\r\n    throw new CompileError(\r\n      `Maizzle source exceeds ${MAX_SOURCE_SIZE / 1000}KB limit.`,\r\n      \"maizzle\",\r\n      \"validation\",\r\n    );\r\n  }\r\n\r\n  // ── 2. Block file-system and network PostHTML directives ─────────────\r\n  if (DANGEROUS_DIRECTIVE_RE.test(source)) {\r\n    throw new CompileError(\r\n      \"Maizzle templates may not use <extends>, <component>, <fetch>, <include>, \" +\r\n        \"<module>, <slot>, <fill>, <raw>, <block>, or <yield> directives. These directives \" +\r\n        \"access the server file system at compile time. Use inline HTML and Tailwind utility classes instead.\",\r\n      \"maizzle\",\r\n      \"validation\",\r\n    );\r\n  }\r\n\r\n  // ── 3. Load peer dependency ──────────────────────────────────────────\r\n  let maizzleRender: (\r\n    input: string,\r\n    options: Record<string, unknown>,\r\n  ) => Promise<{ html: string }>;\r\n\r\n  try {\r\n    const maizzle = await import(\"@maizzle/framework\");\r\n    maizzleRender = maizzle.render;\r\n  } catch {\r\n    throw new CompileError(\r\n      'Maizzle compilation requires \"@maizzle/framework\". Install it:\\n  npm install @maizzle/framework',\r\n      \"maizzle\",\r\n      \"compile\",\r\n    );\r\n  }\r\n\r\n  // ── 4. Compile with timeout ──────────────────────────────────────────\r\n  const compilePromise = maizzleRender(source, {\r\n    css: {\r\n      inline: {\r\n        removeInlinedSelectors: true,\r\n        applyWidthAttributes: true,\r\n        applyHeightAttributes: true,\r\n      },\r\n      shorthand: true,\r\n      sixHex: true,\r\n    },\r\n    locals: {},\r\n  });\r\n\r\n  const timeoutPromise = new Promise<never>((_, reject) => {\r\n    const t = setTimeout(() => {\r\n      reject(\r\n        new CompileError(\r\n          `Maizzle compilation timed out after ${COMPILE_TIMEOUT_MS / 1000}s.`,\r\n          \"maizzle\",\r\n          \"compile\",\r\n        ),\r\n      );\r\n    }, COMPILE_TIMEOUT_MS);\r\n    if (typeof t.unref === \"function\") t.unref();\r\n  });\r\n\r\n  try {\r\n    const { html } = await Promise.race([compilePromise, timeoutPromise]);\r\n\r\n    if (!html) {\r\n      throw new CompileError(\"Maizzle compilation produced empty output.\", \"maizzle\", \"compile\");\r\n    }\r\n\r\n    return html;\r\n  } catch (err: unknown) {\r\n    if (err instanceof CompileError) throw err;\r\n    const message = err instanceof Error ? err.message : \"Unknown Maizzle compilation error\";\r\n    throw new CompileError(`Maizzle compilation failed: ${message}`, \"maizzle\", \"compile\");\r\n  }\r\n}\r\n","import { extname } from \"node:path\";\r\nimport type { InputFormat } from \"../types.js\";\r\n\r\nexport { CompileError } from \"./errors.js\";\r\nexport { compileReactEmail } from \"./react-email.js\";\r\nexport type { SandboxStrategy, CompileReactEmailOptions } from \"./react-email.js\";\r\nexport { compileMjml } from \"./mjml.js\";\r\nexport { compileMaizzle } from \"./maizzle.js\";\r\n\r\n/**\r\n * Compile source to HTML based on format.\r\n * Returns the HTML unchanged if format is \"html\".\r\n * Lazily imports per-format compilers to avoid loading unnecessary deps.\r\n */\r\nexport async function compile(\r\n  source: string,\r\n  format: InputFormat,\r\n  filePath?: string,\r\n): Promise<string> {\r\n  switch (format) {\r\n    case \"html\":\r\n      return source;\r\n\r\n    case \"jsx\": {\r\n      const { compileReactEmail } = await import(\"./react-email.js\");\r\n      return compileReactEmail(source);\r\n    }\r\n\r\n    case \"mjml\": {\r\n      const { compileMjml } = await import(\"./mjml.js\");\r\n      return compileMjml(source);\r\n    }\r\n\r\n    case \"maizzle\": {\r\n      const { compileMaizzle } = await import(\"./maizzle.js\");\r\n      return compileMaizzle(source);\r\n    }\r\n\r\n    default:\r\n      throw new Error(`Unknown format: \"${format}\". Use html, jsx, mjml, or maizzle.`);\r\n  }\r\n}\r\n\r\n/**\r\n * Auto-detect input format from file extension.\r\n */\r\nexport function detectFormat(filePath: string): InputFormat {\r\n  const ext = extname(filePath).toLowerCase();\r\n\r\n  switch (ext) {\r\n    case \".tsx\":\r\n    case \".jsx\":\r\n      return \"jsx\";\r\n    case \".mjml\":\r\n      return \"mjml\";\r\n    case \".html\":\r\n    case \".htm\":\r\n      return \"html\";\r\n    default:\r\n      return \"html\";\r\n  }\r\n}\r\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,IASa;AATb;AAAA;AAAA;AASO,IAAM,eAAN,cAA2B,MAAM;AAAA,MAKtC,YACE,SACA,QACA,OACA;AACA,cAAM,OAAO;AATf,aAAS,OAAO;AAUd,aAAK,SAAS;AACd,aAAK,QAAQ;AAAA,MACf;AAAA,IACF;AAAA;AAAA;;;ACvBA;AAAA;AAAA;AAAA;AAiDA,eAAsB,kBACpB,QACA,SACiB;AApDnB;AAqDE,QAAM,YAAW,wCAAS,YAAT,YAAoB;AAGrC,MAAI,CAAC,UAAU,CAAC,OAAO,KAAK,GAAG;AAC7B,UAAM,IAAI,aAAa,iCAAiC,OAAO,YAAY;AAAA,EAC7E;AAEA,MAAI,OAAO,SAAS,iBAAiB;AACnC,UAAM,IAAI;AAAA,MACR,sBAAsB,kBAAkB,GAAI;AAAA,MAC5C;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAGA,MAAI;AACJ,MAAI;AACJ,MAAI;AACJ,MAAI;AAEJ,MAAI;AACF,KAAC,EAAE,UAAU,IAAI,MAAM,OAAO,SAAS;AAAA,EACzC,SAAQ;AACN,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAEA,MAAI;AACF,YAAQ,MAAM,OAAO,OAAO;AAAA,EAC9B,SAAQ;AACN,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAEA,MAAI;AACF,2BAAuB,MAAM,OAAO,yBAAyB;AAAA,EAC/D,SAAQ;AACN,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAEA,MAAI;AACF,KAAC,EAAE,OAAO,IAAI,MAAM,OAAO,qBAAqB;AAAA,EAClD,SAAQ;AACN,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAGA,MAAI;AACJ,MAAI;AACF,UAAM,SAAS,UAAU,QAAQ;AAAA,MAC/B,YAAY,CAAC,cAAc,OAAO,SAAS;AAAA,MAC3C,YAAY;AAAA,MACZ,YAAY;AAAA,IACd,CAAC;AACD,qBAAiB,OAAO;AAAA,EAC1B,SAAS,KAAc;AACrB,UAAM,UAAU,eAAe,QAAQ,IAAI,UAAU;AACrD,UAAM,IAAI,aAAa,qBAAqB,OAAO,IAAI,OAAO,WAAW;AAAA,EAC3E;AAGA,MAAI;AAEJ,UAAQ,UAAU;AAAA,IAChB,KAAK;AACH,sBAAgB,MAAM,oBAAoB,gBAAgB,OAAO,oBAAoB;AACrF;AAAA,IACF,KAAK;AACH,sBAAgB,MAAM,iBAAiB,gBAAgB,OAAO,oBAAoB;AAClF;AAAA,IACF,KAAK;AACH,sBAAgB,MAAM,YAAY,gBAAgB,OAAO,oBAAoB;AAC7E;AAAA,IACF;AACE,YAAM,IAAI;AAAA,QACR,8BAA8B,QAAQ;AAAA,QACtC;AAAA,QACA;AAAA,MACF;AAAA,EACJ;AAGA,MAAI,aAAqB,mBAAc,YAAd,YAAyB;AAElD,MAAI,OAAO,cAAc,cAAc,OAAO,cAAc,YAAY,cAAc,MAAM;AAC1F,UAAM,SAAS,OAAO,OAAO,SAAoC;AACjE,UAAM,KAAK,OAAO,KAAK,CAAC,MAAM,OAAO,MAAM,UAAU;AACrD,QAAI,GAAI,aAAY;AAAA,EACtB;AAEA,MAAI,OAAO,cAAc,YAAY;AACnC,UAAM,IAAI;AAAA,MACR;AAAA,MAGA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAEA,MAAI;AACF,UAAM,UAAU,MAAM,cAAc,SAAqB;AACzD,UAAM,OAAO,MAAM,OAAO,OAAO;AACjC,WAAO;AAAA,EACT,SAAS,KAAc;AACrB,UAAM,UAAU,eAAe,QAAQ,IAAI,UAAU;AACrD,UAAM,IAAI,aAAa,0BAA0B,OAAO,IAAI,OAAO,QAAQ;AAAA,EAC7E;AACF;AAWA,eAAe,YACb,MACA,OACA,sBACkC;AAClC,QAAM,EAAE,eAAe,OAAO,IAAI,MAAM,OAAO,IAAS;AAExD,QAAM,kBAA2C;AAAA,IAC/C,OAAO;AAAA,IACP,2BAA2B;AAAA,EAC7B;AAEA,QAAM,gBAAyC,CAAC;AAChD,QAAM,YAAY,EAAE,SAAS,cAAc;AAE3C,QAAM,cAAc,CAAC,eAAgC;AACnD,QAAI,cAAc,iBAAiB;AACjC,aAAO,gBAAgB,UAAU;AAAA,IACnC;AACA,UAAM,IAAI;AAAA,MACR,cAAc,UAAU;AAAA,IAE1B;AAAA,EACF;AAEA,QAAM,UAAmC;AAAA,IACvC,QAAQ;AAAA,IACR,SAAS;AAAA,IACT,SAAS;AAAA,IACT;AAAA,IACA;AAAA,IAAQ;AAAA,IAAO;AAAA,IAAQ;AAAA,IAAQ;AAAA,IAC/B;AAAA,IAAK;AAAA,IAAK;AAAA,IAAS;AAAA,IACnB;AAAA,IAAM;AAAA,IAAM;AAAA,IAAM;AAAA,IAClB;AAAA,IAAO;AAAA,IAAW;AAAA,IAAY;AAAA,IAAgB;AAAA,IAAa;AAAA,IAC3D;AAAA,IAAS;AAAA,IACT,OAAO;AAAA,IAAW,SAAS;AAAA,IAC3B;AAAA,IAAU;AAAA,IAAY;AAAA,IAAO;AAAA,IAC7B;AAAA,IAAoB;AAAA,IAAoB;AAAA,IAAW;AAAA,IACnD;AAAA,IAAW;AAAA,IAAK;AAAA,IAChB,SAAS,EAAE,KAAK,MAAM;AAAA,IAAC,GAAG,MAAM,MAAM;AAAA,IAAC,GAAG,OAAO,MAAM;AAAA,IAAC,GAAG,MAAM,MAAM;AAAA,IAAC,GAAG,OAAO,MAAM;AAAA,IAAC,EAAE;AAAA,IAC3F,YAAY;AAAA,IAAW,aAAa;AAAA,IAAW,cAAc;AAAA,IAAW,gBAAgB;AAAA,IACxF,SAAS;AAAA,IAAW,YAAY;AAAA,IAAW,QAAQ;AAAA,IAAW,QAAQ;AAAA,IACtE,WAAW;AAAA,IAAW,YAAY;AAAA,EACpC;AAEA,QAAM,UAAU,cAAc,SAAS;AAAA,IACrC,gBAAgB,EAAE,SAAS,OAAO,MAAM,MAAM;AAAA,EAChD,CAAC;AAED,MAAI;AACF,UAAM,SAAS,IAAI,OAAO,MAAM,EAAE,UAAU,2BAA2B,CAAC;AACxE,WAAO,aAAa,SAAS,EAAE,SAAS,sBAAsB,eAAe,KAAK,CAAC;AAAA,EACrF,SAAS,KAAc;AACrB,UAAM,UAAU,eAAe,QAAQ,IAAI,UAAU;AACrD,QAAI,QAAQ,SAAS,4BAA4B,GAAG;AAClD,YAAM,IAAI,aAAa,qDAAqD,OAAO,WAAW;AAAA,IAChG;AACA,UAAM,IAAI,aAAa,wBAAwB,OAAO,IAAI,OAAO,WAAW;AAAA,EAC9E;AAEA,SAAO,UAAU;AACnB;AAqBA,eAAe,oBACb,MACA,OACA,sBACkC;AAjRpC;AAkRE,MAAI;AACJ,MAAI;AACF,UAAM,SAAS,MAAM,OAAO,aAAa;AACzC,WAAO,YAAe,YAAf,YAA0B;AAAA,EACnC,SAAQ;AACN,UAAM,IAAI;AAAA,MACR;AAAA,MAGA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAGA,QAAM,UAAU,IAAI,IAAI,QAAQ,EAAE,aAAa,IAAI,CAAC;AACpD,MAAI;AACF,UAAM,aAAa,MAAM,QAAQ,cAAc;AAS/C,UAAM,iBAAiB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,YA0Bf,IAAI;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAQZ,QAAI;AACF,YAAM,SAAS,MAAM,WAAW,KAAK,gBAAgB;AAAA,QACnD,SAAS;AAAA,MACX,CAAC;AAED,UAAI,OAAO,WAAW,UAAU;AAC9B,cAAM,SAAS,KAAK,MAAM,MAAM;AAChC,YAAI,CAAC,OAAO,IAAI;AACd,gBAAM,IAAI;AAAA,YACR,yBAAwB,YAAO,UAAP,YAAgB,eAAe;AAAA,YACvD;AAAA,YACA;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAAA,IACF,SAAS,KAAc;AACrB,UAAI,eAAe,aAAc,OAAM;AACvC,YAAM,UAAU,eAAe,QAAQ,IAAI,UAAU;AACrD,UAAI,QAAQ,SAAS,WAAW,KAAK,QAAQ,SAAS,SAAS,GAAG;AAChE,cAAM,IAAI,aAAa,qDAAqD,OAAO,WAAW;AAAA,MAChG;AACA,YAAM,IAAI,aAAa,wBAAwB,OAAO,IAAI,OAAO,WAAW;AAAA,IAC9E;AAAA,EACF,UAAE;AACA,YAAQ,QAAQ;AAAA,EAClB;AAGA,SAAO,YAAY,MAAM,OAAO,oBAAoB;AACtD;AAkBA,eAAe,iBACb,MACA,OACA,sBACkC;AAjYpC;AAkYE,MAAI;AACJ,MAAI;AACF,KAAC,EAAE,WAAW,IAAI,MAAM,OAAO,oBAAoB;AAAA,EACrD,SAAQ;AACN,UAAM,IAAI;AAAA,MACR;AAAA,MAGA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAEA,QAAM,UAAU,MAAM,WAAW;AACjC,QAAM,KAAK,QAAQ,WAAW;AAE9B,MAAI;AAOF,UAAM,iBAAiB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,YA8Bf,IAAI;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAQZ,UAAM,SAAS,GAAG,SAAS,cAAc;AACzC,QAAI,OAAO,OAAO;AAChB,YAAM,WAAW,GAAG,KAAK,OAAO,KAAK;AACrC,aAAO,MAAM,QAAQ;AACrB,YAAM,IAAI;AAAA,QACR,wBAAwB,OAAO,aAAa,WAAW,WAAW,0BAA0B;AAAA,QAC5F;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAEA,UAAM,YAAY,GAAG,KAAK,OAAO,KAAK;AACtC,WAAO,MAAM,QAAQ;AAErB,QAAI,OAAO,cAAc,UAAU;AACjC,YAAM,SAAS,KAAK,MAAM,SAAS;AACnC,UAAI,CAAC,OAAO,IAAI;AACd,cAAM,IAAI;AAAA,UACR,yBAAwB,YAAO,UAAP,YAAgB,eAAe;AAAA,UACvD;AAAA,UACA;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAIA,WAAO,YAAY,MAAM,OAAO,oBAAoB;AAAA,EACtD,UAAE;AACA,OAAG,QAAQ;AAAA,EACb;AACF;AA9dA,IAGM,iBAGA;AANN;AAAA;AAAA;AAAA;AAGA,IAAM,kBAAkB;AAGxB,IAAM,uBAAuB;AAAA;AAAA;;;ACN7B;AAAA;AAAA;AAAA;AAcA,eAAsB,YAAY,QAAiC;AAdnE;AAgBE,MAAI,CAAC,UAAU,CAAC,OAAO,KAAK,GAAG;AAC7B,UAAM,IAAI,aAAa,kCAAkC,QAAQ,YAAY;AAAA,EAC/E;AAEA,MAAI,OAAO,SAASA,kBAAiB;AACnC,UAAM,IAAI;AAAA,MACR,uBAAuBA,mBAAkB,GAAI;AAAA,MAC7C;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAEA,MAAI,CAAC,cAAc,KAAK,MAAM,GAAG;AAC/B,UAAM,IAAI;AAAA,MACR;AAAA,MAEA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAOA,MAAI;AAKJ,MAAI;AACF,UAAM,aAAa,MAAM,OAAO,MAAM;AACtC,iBAAY,gBAAW,YAAX,YAAsB;AAAA,EACpC,SAAQ;AACN,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAGA,MAAI;AAGF,UAAM,SAAS,MAAM,UAAU,QAAQ;AAAA,MACrC,iBAAiB;AAAA,MACjB,cAAc;AAAA,IAChB,CAAC;AAED,QAAI,OAAO,UAAU,OAAO,OAAO,SAAS,KAAK,CAAC,OAAO,MAAM;AAC7D,YAAM,gBAAgB,OAAO,OAC1B,IAAI,CAAC,MAAM,QAAQ,EAAE,IAAI,KAAK,EAAE,OAAO,KAAK,EAAE,OAAO,GAAG,EACxD,KAAK,IAAI;AACZ,YAAM,IAAI;AAAA,QACR,4BAA4B,aAAa;AAAA,QACzC;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAEA,QAAI,CAAC,OAAO,MAAM;AAChB,YAAM,IAAI,aAAa,2CAA2C,QAAQ,SAAS;AAAA,IACrF;AAEA,WAAO,OAAO;AAAA,EAChB,SAAS,KAAc;AACrB,QAAI,eAAe,aAAc,OAAM;AACvC,UAAM,UAAU,eAAe,QAAQ,IAAI,UAAU;AACrD,UAAM,IAAI,aAAa,4BAA4B,OAAO,IAAI,QAAQ,SAAS;AAAA,EACjF;AACF;AAxFA,IAGMA;AAHN;AAAA;AAAA;AAAA;AAGA,IAAMA,mBAAkB;AAAA;AAAA;;;ACHxB;AAAA;AAAA;AAAA;AA0CA,eAAsB,eAAe,QAAiC;AAEpE,MAAI,CAAC,UAAU,CAAC,OAAO,KAAK,GAAG;AAC7B,UAAM,IAAI,aAAa,qCAAqC,WAAW,YAAY;AAAA,EACrF;AAEA,MAAI,OAAO,SAASC,kBAAiB;AACnC,UAAM,IAAI;AAAA,MACR,0BAA0BA,mBAAkB,GAAI;AAAA,MAChD;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAGA,MAAI,uBAAuB,KAAK,MAAM,GAAG;AACvC,UAAM,IAAI;AAAA,MACR;AAAA,MAGA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAGA,MAAI;AAKJ,MAAI;AACF,UAAM,UAAU,MAAM,OAAO,oBAAoB;AACjD,oBAAgB,QAAQ;AAAA,EAC1B,SAAQ;AACN,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAGA,QAAM,iBAAiB,cAAc,QAAQ;AAAA,IAC3C,KAAK;AAAA,MACH,QAAQ;AAAA,QACN,wBAAwB;AAAA,QACxB,sBAAsB;AAAA,QACtB,uBAAuB;AAAA,MACzB;AAAA,MACA,WAAW;AAAA,MACX,QAAQ;AAAA,IACV;AAAA,IACA,QAAQ,CAAC;AAAA,EACX,CAAC;AAED,QAAM,iBAAiB,IAAI,QAAe,CAAC,GAAG,WAAW;AACvD,UAAM,IAAI,WAAW,MAAM;AACzB;AAAA,QACE,IAAI;AAAA,UACF,uCAAuC,qBAAqB,GAAI;AAAA,UAChE;AAAA,UACA;AAAA,QACF;AAAA,MACF;AAAA,IACF,GAAG,kBAAkB;AACrB,QAAI,OAAO,EAAE,UAAU,WAAY,GAAE,MAAM;AAAA,EAC7C,CAAC;AAED,MAAI;AACF,UAAM,EAAE,KAAK,IAAI,MAAM,QAAQ,KAAK,CAAC,gBAAgB,cAAc,CAAC;AAEpE,QAAI,CAAC,MAAM;AACT,YAAM,IAAI,aAAa,8CAA8C,WAAW,SAAS;AAAA,IAC3F;AAEA,WAAO;AAAA,EACT,SAAS,KAAc;AACrB,QAAI,eAAe,aAAc,OAAM;AACvC,UAAM,UAAU,eAAe,QAAQ,IAAI,UAAU;AACrD,UAAM,IAAI,aAAa,+BAA+B,OAAO,IAAI,WAAW,SAAS;AAAA,EACvF;AACF;AA5HA,IAGMA,kBAGA,oBAcA;AApBN;AAAA;AAAA;AAAA;AAGA,IAAMA,mBAAkB;AAGxB,IAAM,qBAAqB;AAc3B,IAAM,yBACJ;AAAA;AAAA;;;ACrBF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,uBAAwB;AAGxB;AACA;AAEA;AACA;AAOA,eAAsB,QACpB,QACA,QACA,UACiB;AACjB,UAAQ,QAAQ;AAAA,IACd,KAAK;AACH,aAAO;AAAA,IAET,KAAK,OAAO;AACV,YAAM,EAAE,mBAAAC,mBAAkB,IAAI,MAAM;AACpC,aAAOA,mBAAkB,MAAM;AAAA,IACjC;AAAA,IAEA,KAAK,QAAQ;AACX,YAAM,EAAE,aAAAC,aAAY,IAAI,MAAM;AAC9B,aAAOA,aAAY,MAAM;AAAA,IAC3B;AAAA,IAEA,KAAK,WAAW;AACd,YAAM,EAAE,gBAAAC,gBAAe,IAAI,MAAM;AACjC,aAAOA,gBAAe,MAAM;AAAA,IAC9B;AAAA,IAEA;AACE,YAAM,IAAI,MAAM,oBAAoB,MAAM,qCAAqC;AAAA,EACnF;AACF;AAKO,SAAS,aAAa,UAA+B;AAC1D,QAAM,UAAM,0BAAQ,QAAQ,EAAE,YAAY;AAE1C,UAAQ,KAAK;AAAA,IACX,KAAK;AAAA,IACL,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AAAA,IACL,KAAK;AACH,aAAO;AAAA,IACT;AACE,aAAO;AAAA,EACX;AACF;","names":["MAX_SOURCE_SIZE","MAX_SOURCE_SIZE","compileReactEmail","compileMjml","compileMaizzle"]}

package/dist/compile/index.js

@@ -1,15 +1,15 @@
 import {
   compileReactEmail
-} from "../chunk-PX25W7YG.js";
+} from "../chunk-URZ4XPST.js";
 import {
   compileMjml
-} from "../chunk-W4SPWESS.js";
+} from "../chunk-3NDQOTPM.js";
 import {
   compileMaizzle
-} from "../chunk-SZ5O5PDZ.js";
+} from "../chunk-OY3DGZVU.js";
 import {
   CompileError
-} from "../chunk-PFONR3YC.js";
+} from "../chunk-ZQF2XUIJ.js";
 
 // src/compile/index.ts
 import { extname } from "path";
@@ -18,15 +18,15 @@ async function compile(source, format, filePath) {
     case "html":
       return source;
     case "jsx": {
-      const { compileReactEmail: compileReactEmail2 } = await import("../react-email-QRL5KZ4Y.js");
+      const { compileReactEmail: compileReactEmail2 } = await import("../react-email-4TW6IDAA.js");
       return compileReactEmail2(source);
     }
     case "mjml": {
-      const { compileMjml: compileMjml2 } = await import("../mjml-IYGC6AOM.js");
+      const { compileMjml: compileMjml2 } = await import("../mjml-D7IOYXXK.js");
       return compileMjml2(source);
     }
     case "maizzle": {
-      const { compileMaizzle: compileMaizzle2 } = await import("../maizzle-YDSYDVSM.js");
+      const { compileMaizzle: compileMaizzle2 } = await import("../maizzle-Y2CLJ7GB.js");
       return compileMaizzle2(source);
     }
     default:

package/dist/index.cjs

@@ -72,6 +72,7 @@ __export(index_exports, {
   auditEmail: () => auditEmail,
   checkAccessibility: () => checkAccessibility,
   contrastRatio: () => contrastRatio,
+  createSession: () => createSession,
   diffResults: () => diffResults,
   errorWarnings: () => errorWarnings,
   estimateAiFixTokens: () => estimateAiFixTokens,
@@ -2836,6 +2837,14 @@ var GENERIC_LINK_TEXT = /* @__PURE__ */ new Set([
   "tap here",
   "this"
 ]);
+var EMPTY_SPAM = { score: 100, level: "low", issues: [] };
+var EMPTY_LINKS = {
+  totalLinks: 0,
+  issues: [],
+  breakdown: { https: 0, http: 0, mailto: 0, tel: 0, anchor: 0, javascript: 0, protocolRelative: 0, other: 0 }
+};
+var EMPTY_ACCESSIBILITY = { score: 100, issues: [] };
+var EMPTY_IMAGES = { total: 0, totalDataUriBytes: 0, issues: [], images: [] };
 
 // src/transform.ts
 function inlineStyles($) {
@@ -3344,15 +3353,8 @@ function transformForAllClients(html, framework) {
 // src/analyze.ts
 var cheerio2 = __toESM(require("cheerio"), 1);
 var csstree2 = __toESM(require("css-tree"), 1);
-function analyzeEmail(html, framework) {
+function analyzeEmailFromDom($, framework) {
   var _a, _b, _c, _d, _e, _f, _g;
-  if (!html || !html.trim()) {
-    return [];
-  }
-  if (html.length > MAX_HTML_SIZE) {
-    throw new Error(`HTML input exceeds ${MAX_HTML_SIZE / 1024}KB limit.`);
-  }
-  const $ = cheerio2.load(html);
   const warnings = [];
   const seenWarnings = /* @__PURE__ */ new Set();
   function addWarning(w) {
@@ -3597,6 +3599,16 @@ function analyzeEmail(html, framework) {
   warnings.sort((a, b) => severityOrder[a.severity] - severityOrder[b.severity]);
   return warnings;
 }
+function analyzeEmail(html, framework) {
+  if (!html || !html.trim()) {
+    return [];
+  }
+  if (html.length > MAX_HTML_SIZE) {
+    throw new Error(`HTML input exceeds ${MAX_HTML_SIZE / 1024}KB limit.`);
+  }
+  const $ = cheerio2.load(html);
+  return analyzeEmailFromDom($, framework);
+}
 function getFixType(prop) {
   return STRUCTURAL_FIX_PROPERTIES.has(prop) ? "structural" : "css";
 }
@@ -4723,14 +4735,7 @@ function checkAllCapsTitle($) {
   }
   return null;
 }
-function analyzeSpam(html, options) {
-  if (!html || !html.trim()) {
-    return { score: 100, level: "low", issues: [] };
-  }
-  if (html.length > MAX_HTML_SIZE) {
-    throw new Error(`HTML input exceeds ${MAX_HTML_SIZE / 1024}KB limit.`);
-  }
-  const $ = cheerio4.load(html);
+function analyzeSpamFromDom($, options) {
   const text = extractVisibleText($);
   const issues = [];
   const capsIssue = checkCapsRatio(text);
@@ -4768,6 +4773,16 @@ function analyzeSpam(html, options) {
   const level = score >= 70 ? "low" : score >= 40 ? "medium" : "high";
   return { score, level, issues };
 }
+function analyzeSpam(html, options) {
+  if (!html || !html.trim()) {
+    return { score: 100, level: "low", issues: [] };
+  }
+  if (html.length > MAX_HTML_SIZE) {
+    throw new Error(`HTML input exceeds ${MAX_HTML_SIZE / 1024}KB limit.`);
+  }
+  const $ = cheerio4.load(html);
+  return analyzeSpamFromDom($, options);
+}
 
 // src/link-validator.ts
 var cheerio5 = __toESM(require("cheerio"), 1);
@@ -4787,18 +4802,7 @@ function isPlaceholderHref(href) {
   const h = href.trim().toLowerCase();
   return h === "#" || h === "" || h === "javascript:void(0)" || h === "javascript:;";
 }
-function validateLinks(html) {
-  if (!html || !html.trim()) {
-    return {
-      totalLinks: 0,
-      issues: [],
-      breakdown: { https: 0, http: 0, mailto: 0, tel: 0, anchor: 0, javascript: 0, protocolRelative: 0, other: 0 }
-    };
-  }
-  if (html.length > MAX_HTML_SIZE) {
-    throw new Error(`HTML input exceeds ${MAX_HTML_SIZE / 1024}KB limit.`);
-  }
-  const $ = cheerio5.load(html);
+function validateLinksFromDom($) {
   const issues = [];
   const breakdown = { https: 0, http: 0, mailto: 0, tel: 0, anchor: 0, javascript: 0, protocolRelative: 0, other: 0 };
   const links = $("a");
@@ -4949,6 +4953,20 @@ function validateLinks(html) {
   }
   return { totalLinks, issues, breakdown };
 }
+function validateLinks(html) {
+  if (!html || !html.trim()) {
+    return {
+      totalLinks: 0,
+      issues: [],
+      breakdown: { https: 0, http: 0, mailto: 0, tel: 0, anchor: 0, javascript: 0, protocolRelative: 0, other: 0 }
+    };
+  }
+  if (html.length > MAX_HTML_SIZE) {
+    throw new Error(`HTML input exceeds ${MAX_HTML_SIZE / 1024}KB limit.`);
+  }
+  const $ = cheerio5.load(html);
+  return validateLinksFromDom($);
+}
 
 // src/accessibility-checker.ts
 var cheerio6 = __toESM(require("cheerio"), 1);
@@ -5197,14 +5215,7 @@ function checkSemanticStructure($) {
   }
   return issues;
 }
-function checkAccessibility(html) {
-  if (!html || !html.trim()) {
-    return { score: 100, issues: [] };
-  }
-  if (html.length > MAX_HTML_SIZE) {
-    throw new Error(`HTML input exceeds ${MAX_HTML_SIZE / 1024}KB limit.`);
-  }
-  const $ = cheerio6.load(html);
+function checkAccessibilityFromDom($) {
   const issues = [];
   const langIssue = checkLangAttribute($);
   if (langIssue) issues.push(langIssue);
@@ -5237,6 +5248,16 @@ function checkAccessibility(html) {
   const score = Math.max(0, 100 - penalty);
   return { score, issues };
 }
+function checkAccessibility(html) {
+  if (!html || !html.trim()) {
+    return { score: 100, issues: [] };
+  }
+  if (html.length > MAX_HTML_SIZE) {
+    throw new Error(`HTML input exceeds ${MAX_HTML_SIZE / 1024}KB limit.`);
+  }
+  const $ = cheerio6.load(html);
+  return checkAccessibilityFromDom($);
+}
 
 // src/image-analyzer.ts
 var cheerio7 = __toESM(require("cheerio"), 1);
@@ -5270,14 +5291,7 @@ function truncateSrc(src, max = 60) {
   }
   return src.length > max ? src.slice(0, max - 3) + "..." : src;
 }
-function analyzeImages(html) {
-  if (!html || !html.trim()) {
-    return { total: 0, totalDataUriBytes: 0, issues: [], images: [] };
-  }
-  if (html.length > MAX_HTML_SIZE) {
-    throw new Error(`HTML input exceeds ${MAX_HTML_SIZE / 1024}KB limit.`);
-  }
-  const $ = cheerio7.load(html);
+function analyzeImagesFromDom($) {
   const issues = [];
   const images = [];
   let totalDataUriBytes = 0;
@@ -5403,16 +5417,19 @@ function analyzeImages(html) {
   }
   return { total: images.length, totalDataUriBytes, issues, images };
 }
+function analyzeImages(html) {
+  if (!html || !html.trim()) {
+    return { total: 0, totalDataUriBytes: 0, issues: [], images: [] };
+  }
+  if (html.length > MAX_HTML_SIZE) {
+    throw new Error(`HTML input exceeds ${MAX_HTML_SIZE / 1024}KB limit.`);
+  }
+  const $ = cheerio7.load(html);
+  return analyzeImagesFromDom($);
+}
 
 // src/audit.ts
-var EMPTY_SPAM = { score: 100, level: "low", issues: [] };
-var EMPTY_LINKS = {
-  totalLinks: 0,
-  issues: [],
-  breakdown: { https: 0, http: 0, mailto: 0, tel: 0, anchor: 0, javascript: 0, protocolRelative: 0, other: 0 }
-};
-var EMPTY_ACCESSIBILITY = { score: 100, issues: [] };
-var EMPTY_IMAGES = { total: 0, totalDataUriBytes: 0, issues: [], images: [] };
+var cheerio8 = __toESM(require("cheerio"), 1);
 function auditEmail(html, options) {
   var _a;
   if (!html || !html.trim()) {
@@ -5429,15 +5446,92 @@ function auditEmail(html, options) {
   }
   const framework = options == null ? void 0 : options.framework;
   const skip = new Set((_a = options == null ? void 0 : options.skip) != null ? _a : []);
-  const warnings = skip.has("compatibility") ? [] : analyzeEmail(html, framework);
+  const $ = cheerio8.load(html);
+  const warnings = skip.has("compatibility") ? [] : analyzeEmailFromDom($, framework);
   const scores = skip.has("compatibility") ? {} : generateCompatibilityScore(warnings);
-  const spam = skip.has("spam") ? EMPTY_SPAM : analyzeSpam(html, options == null ? void 0 : options.spam);
-  const links = skip.has("links") ? EMPTY_LINKS : validateLinks(html);
-  const accessibility = skip.has("accessibility") ? EMPTY_ACCESSIBILITY : checkAccessibility(html);
-  const images = skip.has("images") ? EMPTY_IMAGES : analyzeImages(html);
+  const spam = skip.has("spam") ? EMPTY_SPAM : analyzeSpamFromDom($, options == null ? void 0 : options.spam);
+  const links = skip.has("links") ? EMPTY_LINKS : validateLinksFromDom($);
+  const accessibility = skip.has("accessibility") ? EMPTY_ACCESSIBILITY : checkAccessibilityFromDom($);
+  const images = skip.has("images") ? EMPTY_IMAGES : analyzeImagesFromDom($);
   return { compatibility: { warnings, scores }, spam, links, accessibility, images };
 }
 
+// src/session.ts
+var cheerio9 = __toESM(require("cheerio"), 1);
+function createSession(html, options) {
+  if (!html || !html.trim()) {
+    const fw = options == null ? void 0 : options.framework;
+    return {
+      html: html || "",
+      framework: fw,
+      audit: () => ({
+        compatibility: { warnings: [], scores: {} },
+        spam: EMPTY_SPAM,
+        links: EMPTY_LINKS,
+        accessibility: EMPTY_ACCESSIBILITY,
+        images: EMPTY_IMAGES
+      }),
+      analyze: () => [],
+      score: () => ({}),
+      analyzeSpam: () => EMPTY_SPAM,
+      validateLinks: () => EMPTY_LINKS,
+      checkAccessibility: () => EMPTY_ACCESSIBILITY,
+      analyzeImages: () => EMPTY_IMAGES,
+      transformForClient: (clientId) => ({ clientId, html: html || "", warnings: [] }),
+      transformForAllClients: () => [],
+      simulateDarkMode: (clientId) => ({ html: html || "", warnings: [] })
+    };
+  }
+  if (html.length > MAX_HTML_SIZE) {
+    throw new Error(`HTML input exceeds ${MAX_HTML_SIZE / 1024}KB limit.`);
+  }
+  const $ = cheerio9.load(html);
+  const framework = options == null ? void 0 : options.framework;
+  return {
+    html,
+    framework,
+    audit(opts) {
+      var _a;
+      const skip = new Set((_a = opts == null ? void 0 : opts.skip) != null ? _a : []);
+      const warnings = skip.has("compatibility") ? [] : analyzeEmailFromDom($, framework);
+      const scores = skip.has("compatibility") ? {} : generateCompatibilityScore(warnings);
+      const spam = skip.has("spam") ? EMPTY_SPAM : analyzeSpamFromDom($, opts == null ? void 0 : opts.spam);
+      const links = skip.has("links") ? EMPTY_LINKS : validateLinksFromDom($);
+      const accessibility = skip.has("accessibility") ? EMPTY_ACCESSIBILITY : checkAccessibilityFromDom($);
+      const images = skip.has("images") ? EMPTY_IMAGES : analyzeImagesFromDom($);
+      return { compatibility: { warnings, scores }, spam, links, accessibility, images };
+    },
+    analyze() {
+      return analyzeEmailFromDom($, framework);
+    },
+    score(warnings) {
+      return generateCompatibilityScore(warnings);
+    },
+    analyzeSpam(opts) {
+      return analyzeSpamFromDom($, opts);
+    },
+    validateLinks() {
+      return validateLinksFromDom($);
+    },
+    checkAccessibility() {
+      return checkAccessibilityFromDom($);
+    },
+    analyzeImages() {
+      return analyzeImagesFromDom($);
+    },
+    // Transforms create isolated copies since they mutate the DOM
+    transformForClient(clientId) {
+      return transformForClient(html, clientId, framework);
+    },
+    transformForAllClients() {
+      return transformForAllClients(html, framework);
+    },
+    simulateDarkMode(clientId) {
+      return simulateDarkMode(html, clientId);
+    }
+  };
+}
+
 // src/compile/errors.ts
 var CompileError = class extends Error {
   constructor(message, format, phase) {
@@ -5462,6 +5556,7 @@ var CompileError = class extends Error {
   auditEmail,
   checkAccessibility,
   contrastRatio,
+  createSession,
   diffResults,
   errorWarnings,
   estimateAiFixTokens,