@jant/core 0.6.15 → 0.7.0

package/src/lib/translit.ts

@@ -0,0 +1,288 @@
+/**
+ * Dictionary-free transliteration helpers for slug generation.
+ *
+ * These converters cover the scripts limax handles poorly:
+ *
+ * - Korean hangul → Revised Romanization (limax strips hangul entirely)
+ * - Japanese kana → Hepburn romaji (limax mangles long vowels and digraphs)
+ *
+ * Both are pure algorithms over Unicode code points — no dictionaries — so
+ * they stay small enough for the Workers bundle and the lazy client chunk.
+ * Japanese kanji is intentionally out of scope: readings are context-dependent
+ * and need a morphological dictionary, which is why `slugify` falls back to a
+ * random ID for kanji-heavy Japanese titles instead of guessing.
+ */
+
+/** Matches hiragana, katakana, and the chōonpu (ー) long-vowel mark. */
+export const KANA_RE = /[ぁ-ゖァ-ヺー]/u;
+
+/** Matches precomposed hangul syllables and compatibility jamo. */
+export const HANGUL_RE = /[가-힣ㄱ-ㆎ]/u;
+
+/** Matches Han (CJK ideograph) characters. */
+export const HAN_RE = /\p{Script=Han}/u;
+
+// --- Korean: Revised Romanization ---------------------------------------
+
+const HANGUL_SYLLABLE_BASE = 0xac00;
+const HANGUL_SYLLABLE_END = 0xd7a3;
+const VOWEL_COUNT = 21;
+const FINAL_COUNT = 28;
+
+// prettier-ignore
+const RR_INITIALS = [
+  "g", "kk", "n", "d", "tt", "r", "m", "b", "pp", "s",
+  "ss", "", "j", "jj", "ch", "k", "t", "p", "h",
+];
+
+// prettier-ignore
+const RR_VOWELS = [
+  "a", "ae", "ya", "yae", "eo", "e", "yeo", "ye", "o", "wa",
+  "wae", "oe", "yo", "u", "wo", "we", "wi", "yu", "eu", "ui", "i",
+];
+
+// Finals use their phonetic (syllable-final) value, e.g. ㅅ → "t".
+// prettier-ignore
+const RR_FINALS = [
+  "", "k", "k", "k", "n", "n", "n", "t", "l", "k", "m", "l", "l", "l",
+  "p", "l", "m", "p", "p", "t", "t", "ng", "t", "t", "k", "t", "p", "t",
+];
+
+// Liaison: when the next syllable starts with the silent initial ㅇ, the
+// final consonant is pronounced as that syllable's initial instead
+// (한국어 → han-gu-geo, not han-guk-eo). Each entry is
+// [what remains as the final, what carries over as the next initial].
+// ㅎ is dropped when carried (좋아 → joa); final ㅇ (ng) never carries.
+// prettier-ignore
+const RR_LIAISON: readonly (readonly [string, string])[] = [
+  ["", ""], ["", "g"], ["", "kk"], ["k", "s"], ["", "n"], ["n", "j"],
+  ["n", ""], ["", "d"], ["", "r"], ["l", "g"], ["l", "m"], ["l", "b"],
+  ["l", "s"], ["l", "t"], ["l", "p"], ["l", ""], ["", "m"], ["", "b"],
+  ["p", "s"], ["", "s"], ["", "ss"], ["ng", ""], ["", "j"], ["", "ch"],
+  ["", "k"], ["", "t"], ["", "p"], ["", ""],
+];
+
+// Standalone compatibility jamo (ㅋㅋㅋ, ㅠㅠ) — common in informal titles.
+const COMPAT_JAMO: Record<string, string> = {
+  ㄱ: "g",
+  ㄲ: "kk",
+  ㄴ: "n",
+  ㄷ: "d",
+  ㄸ: "tt",
+  ㄹ: "r",
+  ㅁ: "m",
+  ㅂ: "b",
+  ㅃ: "pp",
+  ㅅ: "s",
+  ㅆ: "ss",
+  ㅇ: "ng",
+  ㅈ: "j",
+  ㅉ: "jj",
+  ㅊ: "ch",
+  ㅋ: "k",
+  ㅌ: "t",
+  ㅍ: "p",
+  ㅎ: "h",
+  ㅏ: "a",
+  ㅐ: "ae",
+  ㅑ: "ya",
+  ㅒ: "yae",
+  ㅓ: "eo",
+  ㅔ: "e",
+  ㅕ: "yeo",
+  ㅖ: "ye",
+  ㅗ: "o",
+  ㅘ: "wa",
+  ㅙ: "wae",
+  ㅚ: "oe",
+  ㅛ: "yo",
+  ㅜ: "u",
+  ㅝ: "wo",
+  ㅞ: "we",
+  ㅟ: "wi",
+  ㅠ: "yu",
+  ㅡ: "eu",
+  ㅢ: "ui",
+  ㅣ: "i",
+};
+
+interface HangulSyllable {
+  initial: number;
+  vowel: number;
+  final: number;
+}
+
+function decomposeHangul(codePoint: number): HangulSyllable | null {
+  if (codePoint < HANGUL_SYLLABLE_BASE || codePoint > HANGUL_SYLLABLE_END) {
+    return null;
+  }
+  const index = codePoint - HANGUL_SYLLABLE_BASE;
+  return {
+    initial: Math.floor(index / (VOWEL_COUNT * FINAL_COUNT)),
+    vowel: Math.floor(index / FINAL_COUNT) % VOWEL_COUNT,
+    final: index % FINAL_COUNT,
+  };
+}
+
+/**
+ * Transliterates Korean hangul to Latin using Revised Romanization.
+ *
+ * Handles precomposed syllables with basic liaison (a final consonant before
+ * a silent-ㅇ syllable carries over as its initial) and standalone
+ * compatibility jamo. Assimilation sound rules (e.g. 종로 → "Jongno") are
+ * intentionally skipped — slugs need recognizable output, not phonetic
+ * perfection. Non-hangul characters pass through unchanged.
+ *
+ * @param text - Input text, possibly mixing hangul with other characters
+ * @returns Text with hangul replaced by its romanization
+ *
+ * @example
+ * ```ts
+ * hangulToLatin("안녕하세요"); // "annyeonghaseyo"
+ * hangulToLatin("한국어");     // "hangugeo" (liaison)
+ * hangulToLatin("개발 일지");  // "gaebal ilji"
+ * ```
+ */
+export function hangulToLatin(text: string): string {
+  const chars = [...text];
+  let out = "";
+  let carried: string | null = null;
+
+  for (const [i, char] of chars.entries()) {
+    const syllable = decomposeHangul(char.codePointAt(0) ?? 0);
+    if (!syllable) {
+      carried = null;
+      out += COMPAT_JAMO[char] ?? char;
+      continue;
+    }
+
+    const initial = carried ?? RR_INITIALS[syllable.initial] ?? "";
+    carried = null;
+    const next = decomposeHangul(chars[i + 1]?.codePointAt(0) ?? 0);
+    let final = RR_FINALS[syllable.final] ?? "";
+    if (syllable.final !== 0 && next && RR_INITIALS[next.initial] === "") {
+      const [remains, carry] = RR_LIAISON[syllable.final] ?? ["", ""];
+      final = remains;
+      carried = carry;
+    }
+    out += initial + (RR_VOWELS[syllable.vowel] ?? "") + final;
+  }
+  return out;
+}
+
+// --- Japanese: Hepburn romaji -------------------------------------------
+
+// prettier-ignore
+const KANA_BASE: Record<string, string> = {
+  あ: "a", い: "i", う: "u", え: "e", お: "o",
+  か: "ka", き: "ki", く: "ku", け: "ke", こ: "ko",
+  さ: "sa", し: "shi", す: "su", せ: "se", そ: "so",
+  た: "ta", ち: "chi", つ: "tsu", て: "te", と: "to",
+  な: "na", に: "ni", ぬ: "nu", ね: "ne", の: "no",
+  は: "ha", ひ: "hi", ふ: "fu", へ: "he", ほ: "ho",
+  ま: "ma", み: "mi", む: "mu", め: "me", も: "mo",
+  や: "ya", ゆ: "yu", よ: "yo",
+  ら: "ra", り: "ri", る: "ru", れ: "re", ろ: "ro",
+  わ: "wa", ゐ: "i", ゑ: "e", を: "o", ん: "n",
+  が: "ga", ぎ: "gi", ぐ: "gu", げ: "ge", ご: "go",
+  ざ: "za", じ: "ji", ず: "zu", ぜ: "ze", ぞ: "zo",
+  だ: "da", ぢ: "ji", づ: "zu", で: "de", ど: "do",
+  ば: "ba", び: "bi", ぶ: "bu", べ: "be", ぼ: "bo",
+  ぱ: "pa", ぴ: "pi", ぷ: "pu", ぺ: "pe", ぽ: "po",
+  ゔ: "vu",
+  ぁ: "a", ぃ: "i", ぅ: "u", ぇ: "e", ぉ: "o",
+  ゃ: "ya", ゅ: "yu", ょ: "yo", ゎ: "wa",
+};
+
+// Digraphs and extended katakana combos (ファ, ティ, チェ, …). Keys are the
+// hiragana-normalized two-character sequences.
+// prettier-ignore
+const KANA_COMBO: Record<string, string> = {
+  きゃ: "kya", きゅ: "kyu", きょ: "kyo",
+  ぎゃ: "gya", ぎゅ: "gyu", ぎょ: "gyo",
+  しゃ: "sha", しゅ: "shu", しょ: "sho",
+  じゃ: "ja", じゅ: "ju", じょ: "jo",
+  ちゃ: "cha", ちゅ: "chu", ちょ: "cho",
+  ぢゃ: "ja", ぢゅ: "ju", ぢょ: "jo",
+  にゃ: "nya", にゅ: "nyu", にょ: "nyo",
+  ひゃ: "hya", ひゅ: "hyu", ひょ: "hyo",
+  びゃ: "bya", びゅ: "byu", びょ: "byo",
+  ぴゃ: "pya", ぴゅ: "pyu", ぴょ: "pyo",
+  みゃ: "mya", みゅ: "myu", みょ: "myo",
+  りゃ: "rya", りゅ: "ryu", りょ: "ryo",
+  ふぁ: "fa", ふぃ: "fi", ふぇ: "fe", ふぉ: "fo",
+  てぃ: "ti", でぃ: "di", とぅ: "tu", どぅ: "du",
+  うぃ: "wi", うぇ: "we", うぉ: "wo",
+  ゔぁ: "va", ゔぃ: "vi", ゔぇ: "ve", ゔぉ: "vo",
+  ちぇ: "che", しぇ: "she", じぇ: "je",
+  つぁ: "tsa", つぃ: "tsi", つぇ: "tse", つぉ: "tso",
+  いぇ: "ye",
+};
+
+const KATAKANA_START = 0x30a1;
+const KATAKANA_END = 0x30f6;
+const KATAKANA_TO_HIRAGANA_SHIFT = 0x60;
+const SOKUON = "っ";
+const CHOONPU = "ー";
+
+function normalizeToHiragana(char: string): string {
+  const codePoint = char.codePointAt(0) ?? 0;
+  if (codePoint >= KATAKANA_START && codePoint <= KATAKANA_END) {
+    return String.fromCodePoint(codePoint - KATAKANA_TO_HIRAGANA_SHIFT);
+  }
+  return char;
+}
+
+/**
+ * Transliterates Japanese kana to macron-less Hepburn romaji.
+ *
+ * Handles hiragana and katakana, digraphs (きゃ → "kya"), extended katakana
+ * loan combos (ファ → "fa"), sokuon gemination (まっちゃ → "matcha"), and
+ * drops the chōonpu long-vowel mark (ハンバーガー → "hanbaga"), matching how
+ * macrons are conventionally stripped in URLs. Kanji and other non-kana
+ * characters pass through unchanged.
+ *
+ * @param text - Input text, possibly mixing kana with other characters
+ * @returns Text with kana replaced by romaji
+ *
+ * @example
+ * ```ts
+ * kanaToRomaji("カタカナタイトル"); // "katakanataitoru"
+ * kanaToRomaji("ハンバーガー");     // "hanbaga"
+ * kanaToRomaji("まっちゃ");         // "matcha"
+ * ```
+ */
+export function kanaToRomaji(text: string): string {
+  const chars = [...text].map(normalizeToHiragana);
+  let out = "";
+  let geminate = false;
+
+  for (let i = 0; i < chars.length; i++) {
+    const char = chars[i] ?? "";
+    if (char === SOKUON) {
+      geminate = true;
+      continue;
+    }
+    if (char === CHOONPU) {
+      geminate = false;
+      continue;
+    }
+
+    const combo = KANA_COMBO[char + (chars[i + 1] ?? "")];
+    const romaji = combo ?? KANA_BASE[char];
+    if (combo) i++;
+    if (romaji === undefined) {
+      geminate = false;
+      out += char;
+      continue;
+    }
+    if (geminate) {
+      geminate = false;
+      if (/^[^aeiou]/.test(romaji)) {
+        out += romaji.startsWith("ch") ? "t" : (romaji[0] ?? "");
+      }
+    }
+    out += romaji;
+  }
+  return out;
+}

package/src/lib/upload.ts

@@ -4,7 +4,7 @@
  * Shared file validation and storage key generation for upload routes.
  */
 
-import type { MediaKind } from "../types/constants.js";
+import type { ContentDisposition, MediaKind } from "../types/constants.js";
 import { createEntityId } from "./ids.js";
 
 const MEDIA_ROOT_PREFIX = "media";
@@ -161,16 +161,6 @@ const MIME_CATEGORY_MAP = new Map<string, MediaCategory>([
   ...CODE_MIME_TYPES.map((t) => [t, "code" as const] as const),
 ]);
 
-/**
- * Accept string for file inputs. Accepts all file types.
- *
- * @example
- * ```ts
- * <input type="file" accept={UPLOAD_ACCEPT} />
- * ```
- */
-export const UPLOAD_ACCEPT = "*/*";
-
 export type MediaCategory =
   | "image"
   | "video"
@@ -183,7 +173,7 @@ export type MediaCategory =
   | "3d"
   | "code";
 
-export type UploadContentDisposition = "inline" | "attachment";
+export type UploadContentDisposition = ContentDisposition;
 
 export interface StoredUploadPolicy {
   contentDisposition: UploadContentDisposition;
@@ -326,10 +316,22 @@ export function imageExtensionForMimeType(contentType: string): string | null {
   return IMAGE_MIME_EXTENSIONS[contentType] ?? null;
 }
 
+/** ISO BMFF `ftyp` major brands that mean a HEIC/HEIF still image. */
+const HEIC_FTYP_BRANDS = new Set([
+  "heic",
+  "heix",
+  "hevc",
+  "hevx",
+  "mif1",
+  "msf1",
+]);
+
 /**
  * Identify an image format from its leading bytes (magic numbers), so a remote
  * sideload can trust the actual content rather than the server's content-type
- * header. Recognizes every {@link isAllowedSideloadImageType} format.
+ * header. Recognizes every {@link isAllowedSideloadImageType} format, plus
+ * HEIC/HEIF — which no browser decodes natively and no sideload accepts, but
+ * which the composer converts before upload once it knows what it holds.
  *
  * @param bytes - The leading bytes of the file (≥ ~256 bytes recommended)
  * @returns The detected image MIME type, or null if unrecognized
@@ -367,6 +369,7 @@ export function sniffImageMimeType(bytes: Uint8Array): string | null {
   if (bytes.length >= 12 && readAscii(bytes, 4, 4) === "ftyp") {
     const brand = readAscii(bytes, 8, 4);
     if (brand === "avif" || brand === "avis") return "image/avif";
+    if (HEIC_FTYP_BRANDS.has(brand)) return "image/heic";
   }
   if (bytes.length >= 2 && bytes[0] === 0x42 && bytes[1] === 0x4d) {
     return "image/bmp";

package/src/lib/url.ts

@@ -2,8 +2,6 @@
  * URL Utilities
  */
 
-import limax from "limax";
-
 function normalizeSitePathname(pathname: string): string {
   if (pathname === "/" || pathname === "") return "";
   const trimmed = pathname.replace(/\/+$/, "");
@@ -134,25 +132,159 @@ export function toSameSitePath(url: string, siteOrigin: string): string | null {
 }
 
 /**
- * Converts text to a URL-friendly slug.
- *
- * Transforms text into a lowercase, hyphen-separated slug using limax for
- * i18n-aware transliteration (CJK → Pinyin, Japanese → Romaji, accented → ASCII).
+ * Any `scheme:` at the start. `mailto:` and `tel:` address something real but
+ * never a page here, and an unrecognized scheme must not be read as a path.
+ */
+const ANY_SCHEME_RE = /^[a-z][a-z0-9+.-]*:/i;
+
+export interface InternalPathOptions {
+  /**
+   * Origins this site answers on. Pass the configured one *and* the origin of
+   * the current request: a hosted site is often reached on a custom domain the
+   * canonical URL knows nothing about.
+   */
+  siteOrigins?: readonly string[];
+  /** Public site path prefix, such as `/blog`. */
+  sitePathPrefix?: string;
+  /**
+   * Language URL prefixes the site serves, without slashes (`["en", "ja"]`).
+   * A leading one is removed, because `/en/about` and `/about` are the same
+   * page seen from two views.
+   */
+  languagePrefixes?: readonly string[];
+  /** Keep `?query` and `#hash`. Off by default: they name a spot, not a page. */
+  keepQuery?: boolean;
+}
+
+/**
+ * Whether a string is meant as an address rather than as search words.
  *
- * @param text - The text to convert to a slug
- * @returns The slugified string
+ * Deliberately narrow — a leading slash or a full `http(s)` URL. Anything
+ * looser would swallow real queries: a search for "about" is not a search for
+ * `/about`.
  *
+ * @param input - What the author typed or pasted
+ * @returns True when the input should be resolved instead of searched
  * @example
- * ```ts
- * slugify("Hello World! This is a Test.");
- * // Returns: "hello-world-this-is-a-test"
+ * looksLikeAddress("/about"); // true
+ * looksLikeAddress("https://example.com/about"); // true
+ * looksLikeAddress("about"); // false
+ */
+export function looksLikeAddress(input: string): boolean {
+  const trimmed = input.trim();
+  return trimmed.startsWith("/") || isFullUrl(trimmed);
+}
+
+/**
+ * Convert an address the author pasted into an internal app path.
  *
- * slugify("书评");
- * // Returns: "shu-ping"
- * ```
+ * Accepts what a browser address bar would produce — a full URL on one of the
+ * site's own origins, or a path — and returns the path the router resolves
+ * against: no site path prefix, no language prefix, rooted at `/`. Returns
+ * `null` for anything that is not a page on this site, so callers can tell an
+ * external link apart from a bad one.
+ *
+ * Case is left alone; storage-level normalization belongs to the path
+ * registry, which lowercases on its own terms.
+ *
+ * A full URL has to sit inside the deployment to count. A typed path does not:
+ * `/about` on a site served from `/blog` is the About page, because that is
+ * what someone typing it means.
+ *
+ * @param input - A full URL, or a path
+ * @param options - The site's origins, prefixes, and what to keep
+ * @returns Internal path rooted at `/`, or `null` when the address is not ours
+ * @example
+ * toInternalPath("https://example.com/blog/en/about", {
+ *   siteOrigins: ["https://example.com"],
+ *   sitePathPrefix: "/blog",
+ *   languagePrefixes: ["en"],
+ * }); // "/about"
+ * toInternalPath("https://other.com/about", { siteOrigins: ["https://example.com"] }); // null
  */
-export function slugify(text: string): string {
-  return limax(text, { tone: false }).replace(/_/g, "-");
+export function toInternalPath(
+  input: string,
+  options: InternalPathOptions = {},
+): string | null {
+  const value = input.trim();
+  if (!value) return null;
+
+  const {
+    siteOrigins = [],
+    sitePathPrefix = "",
+    languagePrefixes = [],
+    keepQuery = false,
+  } = options;
+
+  const isFull = isFullUrl(value);
+  let candidate: string | null = null;
+  if (isFull) {
+    for (const origin of siteOrigins) {
+      const path = toSameSitePath(value, origin);
+      if (path !== null) {
+        candidate = path;
+        break;
+      }
+    }
+    // A full URL on a host we do not serve is somebody else's page.
+    if (candidate === null) return null;
+  } else if (
+    value.startsWith("//") ||
+    ANY_SCHEME_RE.test(value) ||
+    value.startsWith("#")
+  ) {
+    return null;
+  } else {
+    candidate = value;
+  }
+
+  let url: URL;
+  try {
+    // A fixed base resolves `..`, percent-encoding, and stray backslashes the
+    // same way the browser that produced the address did.
+    url = new URL(candidate, "https://jant.invalid");
+  } catch {
+    return null;
+  }
+
+  const withoutSite = stripSitePathPrefix(
+    url.pathname,
+    normalizeSitePathPrefix(sitePathPrefix),
+  );
+  if (withoutSite === null && isFull) {
+    // A URL on our host but outside the deployment: another app, not a page.
+    return null;
+  }
+
+  // A typed path that does not carry the prefix is already an internal one —
+  // an author writing `/about` on a site served from `/blog` means the About
+  // page, not a different site.
+  const internal = stripLanguagePrefix(
+    withoutSite ?? url.pathname,
+    languagePrefixes,
+  );
+  const trimmed =
+    internal.length > 1 ? internal.replace(/\/+$/, "") || "/" : internal;
+
+  return keepQuery ? `${trimmed}${url.search}${url.hash}` : trimmed;
+}
+
+/** Drop a leading `/en`-style segment when the site serves that language. */
+function stripLanguagePrefix(
+  pathname: string,
+  languagePrefixes: readonly string[],
+): string {
+  if (languagePrefixes.length === 0) return pathname;
+
+  const rest = pathname.startsWith("/") ? pathname.slice(1) : pathname;
+  const slash = rest.indexOf("/");
+  const first = (slash === -1 ? rest : rest.slice(0, slash)).toLowerCase();
+  if (!first) return pathname;
+  if (!languagePrefixes.some((prefix) => prefix.toLowerCase() === first)) {
+    return pathname;
+  }
+
+  return slash === -1 ? "/" : rest.slice(slash);
 }
 
 /**
@@ -183,6 +315,25 @@ export function extractDisplayDomain(url: string): string | null {
 }
 
 const SAFE_URL_PROTOCOLS = new Set(["http:", "https:", "mailto:"]);
+const SAFE_RICH_TEXT_HREF_PROTOCOLS = new Set([
+  ...SAFE_URL_PROTOCOLS,
+  "tel:",
+  "sms:",
+]);
+
+function sanitizeUrlWithProtocols(
+  url: string,
+  protocols: ReadonlySet<string>,
+): string {
+  try {
+    const parsed = new URL(url, "https://placeholder.invalid");
+    // Relative URLs resolve against the placeholder and get https: — allow them
+    if (protocols.has(parsed.protocol)) return url;
+    return "";
+  } catch {
+    return "";
+  }
+}
 
 /**
  * Checks whether a string is a safe absolute URL.
@@ -231,14 +382,27 @@ export function isSafeAbsoluteUrl(url: string): boolean {
  * ```
  */
 export function sanitizeUrl(url: string): string {
-  try {
-    const parsed = new URL(url, "https://placeholder.invalid");
-    // Relative URLs resolve against the placeholder and get https: — allow them
-    if (SAFE_URL_PROTOCOLS.has(parsed.protocol)) return url;
-    return "";
-  } catch {
-    return "";
-  }
+  return sanitizeUrlWithProtocols(url, SAFE_URL_PROTOCOLS);
+}
+
+/**
+ * Sanitizes a rich-text link destination.
+ *
+ * In addition to safe web and email URLs, rich-text links may launch the
+ * device's phone or messaging app through `tel:` and `sms:`. Relative links
+ * remain valid, while executable and resource-only protocols are rejected.
+ *
+ * @param url - The link destination to sanitize
+ * @returns The original URL if safe for an anchor, or an empty string otherwise
+ *
+ * @example
+ * ```ts
+ * sanitizeRichTextHref("sms:+15551234567"); // "sms:+15551234567"
+ * sanitizeRichTextHref("javascript:alert(1)"); // ""
+ * ```
+ */
+export function sanitizeRichTextHref(url: string): string {
+  return sanitizeUrlWithProtocols(url, SAFE_RICH_TEXT_HREF_PROTOCOLS);
 }
 
 /**

package/src/lib/version.ts

@@ -1,33 +1,35 @@
 /**
- * Version and environment detection
- *
- * In Vite dev, `__JANT_DEV__` is replaced with `true` via Vite's `define` config.
- * In production (wrangler/esbuild), the typeof check evaluates to false safely.
+ * Version and build asset paths
  *
  * `__JANT_VERSION__` is replaced by Vite's `define` during both dev and lib build.
  *
  * `__CLIENT_JS_FILE__` and `__CLIENT_AUTH_JS_FILE__` are content-addressed
  * internal paths (e.g. `/_assets/client-HASH.js`) embedded by the Worker build
  * from the Vite client manifest. Used only in production (IS_VITE_DEV=false).
+ * `__CLIENT_COMPOSE_PRELOAD__` lists every file the composer entry needs —
+ * the entry and the chunks it imports — for the layout's modulepreload links.
+ *
+ * The dev flag itself lives in `build-env.ts`, which client bundles can import
+ * without these Worker-only globals.
  */
 
-declare const __JANT_DEV__: boolean | undefined;
 declare const __JANT_VERSION__: string;
 declare const __CLIENT_JS_FILE__: string;
 declare const __CLIENT_AUTH_JS_FILE__: string;
+declare const __CLIENT_COMPOSE_PRELOAD__: readonly string[];
 declare const __CLIENT_CSS_FILE__: string;
+declare const __CLIENT_AUTHOR_CSS_FILE__: string;
 declare const __CLIENT_CJK_CSS_FILE__: string;
 declare const __CLIENT_CJK_TC_CSS_FILE__: string;
 declare const __CLIENT_CJK_JP_CSS_FILE__: string;
 declare const __CLIENT_CJK_KR_CSS_FILE__: string;
 
-export const IS_VITE_DEV =
-  typeof __JANT_DEV__ !== "undefined" && __JANT_DEV__ === true;
-
 export const CORE_VERSION = __JANT_VERSION__;
 export const CLIENT_JS_FILE = __CLIENT_JS_FILE__;
 export const CLIENT_AUTH_JS_FILE = __CLIENT_AUTH_JS_FILE__;
+export const CLIENT_COMPOSE_PRELOAD = __CLIENT_COMPOSE_PRELOAD__;
 export const CLIENT_CSS_FILE = __CLIENT_CSS_FILE__;
+export const CLIENT_AUTHOR_CSS_FILE = __CLIENT_AUTHOR_CSS_FILE__;
 export const CLIENT_CJK_CSS_FILE = __CLIENT_CJK_CSS_FILE__;
 export const CLIENT_CJK_TC_CSS_FILE = __CLIENT_CJK_TC_CSS_FILE__;
 export const CLIENT_CJK_JP_CSS_FILE = __CLIENT_CJK_JP_CSS_FILE__;