@kensio/colophon 2.5.0 → 2.6.0

package/dist/render/rasterise.d.ts

@@ -0,0 +1,15 @@
+import type { Rasteriser } from "../types.js";
+/**
+ * The default rasteriser: resvg, scaled to `dimensions.width`.
+ *
+ * Text is drawn with the fonts named by `config`, which is what keeps the
+ * output the same on a laptop, in CI and in a container. Height follows the
+ * SVG's own aspect ratio; `buildSvg` sizes it to match.
+ *
+ * It lives here rather than in `png.ts` so that `resolveConfig` can name it as
+ * the default without importing the module that dispatches to it. Nothing here
+ * reads config beyond the fonts, which is the whole of what a rasteriser is
+ * given to work with.
+ */
+export declare const resvgRasteriser: Rasteriser;
+//# sourceMappingURL=rasterise.d.ts.map

package/dist/render/rasterise.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rasterise.d.ts","sourceRoot":"","sources":["../../src/render/rasterise.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,UAAU,EAAkB,MAAM,aAAa,CAAC;AAkB9D;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,eAAe,EAAE,UAO7B,CAAC"}

package/dist/render/rasterise.js

@@ -0,0 +1,34 @@
+import { renderAsync } from "@resvg/resvg-js";
+import { fallbackFamily, fontFilePaths } from "../fonts/index.js";
+/**
+ * Font options for resvg: the configured font files, and whether to fall back
+ * to the machine's own.
+ */
+async function fontOptions(config) {
+    const fallback = fallbackFamily(config.fonts);
+    return {
+        loadSystemFonts: config.systemFonts,
+        fontFiles: await fontFilePaths(config.fonts),
+        ...(fallback !== undefined && { defaultFontFamily: fallback }),
+    };
+}
+/**
+ * The default rasteriser: resvg, scaled to `dimensions.width`.
+ *
+ * Text is drawn with the fonts named by `config`, which is what keeps the
+ * output the same on a laptop, in CI and in a container. Height follows the
+ * SVG's own aspect ratio; `buildSvg` sizes it to match.
+ *
+ * It lives here rather than in `png.ts` so that `resolveConfig` can name it as
+ * the default without importing the module that dispatches to it. Nothing here
+ * reads config beyond the fonts, which is the whole of what a rasteriser is
+ * given to work with.
+ */
+export const resvgRasteriser = async (svg, dimensions, config) => {
+    const rendered = await renderAsync(svg, {
+        fitTo: { mode: "width", value: dimensions.width },
+        font: await fontOptions(config),
+    });
+    return rendered.asPng();
+};
+//# sourceMappingURL=rasterise.js.map

package/dist/render/rasterise.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rasterise.js","sourceRoot":"","sources":["../../src/render/rasterise.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAE9C,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAGlE;;;GAGG;AACH,KAAK,UAAU,WAAW,CACxB,MAAsB;IAEtB,MAAM,QAAQ,GAAG,cAAc,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAE9C,OAAO;QACL,eAAe,EAAE,MAAM,CAAC,WAAW;QACnC,SAAS,EAAE,MAAM,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC;QAC5C,GAAG,CAAC,QAAQ,KAAK,SAAS,IAAI,EAAE,iBAAiB,EAAE,QAAQ,EAAE,CAAC;KAC/D,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,eAAe,GAAe,KAAK,EAAE,GAAG,EAAE,UAAU,EAAE,MAAM,EAAE,EAAE;IAC3E,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,GAAG,EAAE;QACtC,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,CAAC,KAAK,EAAE;QACjD,IAAI,EAAE,MAAM,WAAW,CAAC,MAAM,CAAC;KAChC,CAAC,CAAC;IAEH,OAAO,QAAQ,CAAC,KAAK,EAAE,CAAC;AAC1B,CAAC,CAAC"}

package/dist/render/svg.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"svg.d.ts","sourceRoot":"","sources":["../../src/render/svg.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,UAAU,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAM9E;;;;;;;;GAQG;AACH,wBAAsB,QAAQ,CAC5B,KAAK,EAAE,cAAc,EACrB,MAAM,EAAE,cAAc,EACtB,UAAU,EAAE,UAAU,GACrB,OAAO,CAAC,MAAM,CAAC,CAkCjB"}
+{"version":3,"file":"svg.d.ts","sourceRoot":"","sources":["../../src/render/svg.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,UAAU,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAM9E;;;;;;;;GAQG;AACH,wBAAsB,QAAQ,CAC5B,KAAK,EAAE,cAAc,EACrB,MAAM,EAAE,cAAc,EACtB,UAAU,EAAE,UAAU,GACrB,OAAO,CAAC,MAAM,CAAC,CAmCjB"}

package/dist/render/svg.js

@@ -33,6 +33,7 @@ export async function buildSvg(props, config, dimensions) {
         measure,
         logo: images.logo,
         avatar: images.avatar,
+        picture: images.picture,
     });
     const { width, height } = dimensions;
     return (`<svg width="${String(width)}" height="${String(height)}"` +

package/dist/render/svg.js.map

@@ -1 +1 @@
-{"version":3,"file":"svg.js","sourceRoot":"","sources":["../../src/render/svg.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAC/C,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAEjD,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAE/C,MAAM,YAAY,GAAG,aAAa,CAAC;AACnC,MAAM,SAAS,GAAG,kBAAkB,CAAC;AAErC;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAC5B,KAAqB,EACrB,MAAsB,EACtB,UAAsB;IAEtB,MAAM,QAAQ,GAAG,cAAc,CAAC,MAAM,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;IACxD,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QAC1C,cAAc,CAAC,MAAM,CAAC;QACtB,UAAU,CAAC,MAAM,EAAE,KAAK,CAAC;KAC1B,CAAC,CAAC;IAEH,MAAM,UAAU,GAAG,aAAa,CAC9B,MAAM,CAAC,UAAU,EACjB,UAAU,EACV,YAAY,EACZ,MAAM,CAAC,UAAU,CAClB,CAAC;IACF,4EAA4E;IAC5E,uEAAuE;IACvE,MAAM,OAAO,GACX,MAAM,CAAC,OAAO,KAAK,SAAS;QAC1B,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,OAAO,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC;IACxD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC;QACjC,KAAK;QACL,MAAM;QACN,UAAU;QACV,OAAO;QACP,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,MAAM,EAAE,MAAM,CAAC,MAAM;KACtB,CAAC,CAAC;IACH,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,UAAU,CAAC;IAErC,OAAO,CACL,eAAe,MAAM,CAAC,KAAK,CAAC,aAAa,MAAM,CAAC,MAAM,CAAC,GAAG;QAC1D,iBAAiB,MAAM,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG;QACnD,uCAAuC,UAAU,GAAG,OAAO,GAAG,IAAI,QAAQ,CAC3E,CAAC;AACJ,CAAC"}
+{"version":3,"file":"svg.js","sourceRoot":"","sources":["../../src/render/svg.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAC/C,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAEjD,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAE/C,MAAM,YAAY,GAAG,aAAa,CAAC;AACnC,MAAM,SAAS,GAAG,kBAAkB,CAAC;AAErC;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAC5B,KAAqB,EACrB,MAAsB,EACtB,UAAsB;IAEtB,MAAM,QAAQ,GAAG,cAAc,CAAC,MAAM,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;IACxD,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QAC1C,cAAc,CAAC,MAAM,CAAC;QACtB,UAAU,CAAC,MAAM,EAAE,KAAK,CAAC;KAC1B,CAAC,CAAC;IAEH,MAAM,UAAU,GAAG,aAAa,CAC9B,MAAM,CAAC,UAAU,EACjB,UAAU,EACV,YAAY,EACZ,MAAM,CAAC,UAAU,CAClB,CAAC;IACF,4EAA4E;IAC5E,uEAAuE;IACvE,MAAM,OAAO,GACX,MAAM,CAAC,OAAO,KAAK,SAAS;QAC1B,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,OAAO,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC;IACxD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC;QACjC,KAAK;QACL,MAAM;QACN,UAAU;QACV,OAAO;QACP,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,OAAO,EAAE,MAAM,CAAC,OAAO;KACxB,CAAC,CAAC;IACH,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,UAAU,CAAC;IAErC,OAAO,CACL,eAAe,MAAM,CAAC,KAAK,CAAC,aAAa,MAAM,CAAC,MAAM,CAAC,GAAG;QAC1D,iBAAiB,MAAM,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG;QACnD,uCAAuC,UAAU,GAAG,OAAO,GAAG,IAAI,QAAQ,CAC3E,CAAC;AACJ,CAAC"}

package/dist/sign/base64url.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Base64url, which is what a signature has to be to travel in a URL.
+ *
+ * It is ordinary base64 with two characters swapped and the padding dropped,
+ * so the encoding itself comes from `platform/base64.ts` and this is only the
+ * alphabet. `+`, `/` and `=` all mean something in a query string, and a
+ * signature carrying them would depend on every proxy between the two ends
+ * escaping them the same way.
+ */
+export declare function toBase64Url(bytes: Uint8Array): string;
+/**
+ * The reverse. The padding `toBase64Url` dropped is not needed to decode, since
+ * the length of the input says where the bytes end.
+ */
+export declare function fromBase64Url(text: string): Uint8Array<ArrayBuffer>;
+//# sourceMappingURL=base64url.d.ts.map

package/dist/sign/base64url.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"base64url.d.ts","sourceRoot":"","sources":["../../src/sign/base64url.ts"],"names":[],"mappings":"AAEA;;;;;;;;GAQG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAKrD;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,UAAU,CAAC,WAAW,CAAC,CAEnE"}

package/dist/sign/base64url.js

@@ -0,0 +1,24 @@
+import { fromBase64, toBase64 } from "../platform/base64.js";
+/**
+ * Base64url, which is what a signature has to be to travel in a URL.
+ *
+ * It is ordinary base64 with two characters swapped and the padding dropped,
+ * so the encoding itself comes from `platform/base64.ts` and this is only the
+ * alphabet. `+`, `/` and `=` all mean something in a query string, and a
+ * signature carrying them would depend on every proxy between the two ends
+ * escaping them the same way.
+ */
+export function toBase64Url(bytes) {
+    return toBase64(bytes)
+        .replaceAll("+", "-")
+        .replaceAll("/", "_")
+        .replaceAll("=", "");
+}
+/**
+ * The reverse. The padding `toBase64Url` dropped is not needed to decode, since
+ * the length of the input says where the bytes end.
+ */
+export function fromBase64Url(text) {
+    return fromBase64(text.replaceAll("-", "+").replaceAll("_", "/"));
+}
+//# sourceMappingURL=base64url.js.map

package/dist/sign/base64url.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"base64url.js","sourceRoot":"","sources":["../../src/sign/base64url.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AAE7D;;;;;;;;GAQG;AACH,MAAM,UAAU,WAAW,CAAC,KAAiB;IAC3C,OAAO,QAAQ,CAAC,KAAK,CAAC;SACnB,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC;SACpB,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC;SACpB,UAAU,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;AACzB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,OAAO,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;AACpE,CAAC"}

package/dist/sign/index.d.ts

@@ -0,0 +1,49 @@
+/**
+ * Signing the parameters of an image request.
+ *
+ * Rendering on demand means an endpoint that turns a query string into a
+ * picture, and an endpoint like that is an open image generator for anyone who
+ * finds it: they choose the text, your domain serves it, and your bill pays for
+ * it. Signing is what makes the URLs your own, since only the site holding the
+ * secret can produce one the endpoint will answer.
+ *
+ * It uses Web Crypto, which is the one HMAC available everywhere this is meant
+ * to run: browsers, workers, and Node since 18.
+ */
+/**
+ * The parameters of one request, which are what the signature covers.
+ */
+export type SignedParams = Readonly<Record<string, string>>;
+/** The parameter a signature travels in, chosen to be short and unremarkable. */
+export declare const signatureParam = "s";
+/**
+ * The signature for a set of parameters.
+ *
+ * Everything that must not be tampered with has to be in `params`: the
+ * signature covers those and nothing else, so a template name or a size left
+ * outside them is a template name or a size anyone can change.
+ */
+export declare function signParams(params: SignedParams, secret: string): Promise<string>;
+/**
+ * Whether a signature is the one these parameters should carry.
+ *
+ * The comparison is `crypto.subtle.verify` rather than one of two strings,
+ * because a comparison that stops at the first wrong byte tells an attacker how
+ * much of a guess was right.
+ */
+export declare function verifyParams(params: SignedParams, signature: string, secret: string): Promise<boolean>;
+/** The query string for a set of parameters, with its signature appended. */
+export declare function signedQuery(params: SignedParams, secret: string): Promise<string>;
+/**
+ * Check a request's own query string, which is the shape the check takes in a
+ * route handler: everything but the signature is what was signed.
+ *
+ * A repeated parameter is refused rather than resolved. A query string may
+ * carry the same key twice, and the two ends then disagree about which one it
+ * means: `URLSearchParams.get` takes the first, and building an object from the
+ * pairs takes the last. An attacker appending their own copy of a key to a URL
+ * that was signed for the other value is the whole attack this exists to stop,
+ * and no honest signed URL repeats a key.
+ */
+export declare function verifySignedQuery(search: URLSearchParams, secret: string): Promise<boolean>;
+//# sourceMappingURL=index.d.ts.map

package/dist/sign/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/sign/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAIH;;GAEG;AACH,MAAM,MAAM,YAAY,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;AAE5D,iFAAiF;AACjF,eAAO,MAAM,cAAc,MAAM,CAAC;AAuElC;;;;;;GAMG;AACH,wBAAsB,UAAU,CAC9B,MAAM,EAAE,YAAY,EACpB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,MAAM,CAAC,CAUjB;AAED;;;;;;GAMG;AACH,wBAAsB,YAAY,CAChC,MAAM,EAAE,YAAY,EACpB,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,OAAO,CAAC,CAYlB;AAED,6EAA6E;AAC7E,wBAAsB,WAAW,CAC/B,MAAM,EAAE,YAAY,EACpB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,MAAM,CAAC,CAOjB;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,iBAAiB,CACrC,MAAM,EAAE,eAAe,EACvB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,OAAO,CAAC,CAwBlB"}

package/dist/sign/index.js

@@ -0,0 +1,133 @@
+/**
+ * Signing the parameters of an image request.
+ *
+ * Rendering on demand means an endpoint that turns a query string into a
+ * picture, and an endpoint like that is an open image generator for anyone who
+ * finds it: they choose the text, your domain serves it, and your bill pays for
+ * it. Signing is what makes the URLs your own, since only the site holding the
+ * secret can produce one the endpoint will answer.
+ *
+ * It uses Web Crypto, which is the one HMAC available everywhere this is meant
+ * to run: browsers, workers, and Node since 18.
+ */
+import { fromBase64Url, toBase64Url } from "./base64url.js";
+/** The parameter a signature travels in, chosen to be short and unremarkable. */
+export const signatureParam = "s";
+/**
+ * Order two keys the same way everywhere.
+ *
+ * By code unit rather than `localeCompare`, which is what the rest of this
+ * package sorts with. That is for people reading a list; this is a protocol,
+ * and the two ends of it are usually two different machines. `localeCompare`
+ * puts "ä" before "z" under `en` and after it under `sv`, so a URL signed by a
+ * build could be refused by the edge that serves it.
+ */
+function byCodeUnit(a, b) {
+    if (a === b) {
+        return 0;
+    }
+    return a < b ? -1 : 1;
+}
+/**
+ * The exact bytes signed, so that signing and verifying agree.
+ *
+ * Sorted, because a query string means the same thing whatever order it arrives
+ * in, and a signature that did not would fail on a URL a proxy had tidied.
+ * `URLSearchParams` does the escaping, so a value containing an `&` cannot be
+ * read as two parameters, which is the way a scheme like this is usually
+ * broken.
+ */
+// `Uint8Array<ArrayBuffer>` rather than the default `ArrayBufferLike`, which
+// Web Crypto will not take: it cannot work on a shared buffer.
+function canonical(params) {
+    const search = new URLSearchParams();
+    for (const key of Object.keys(params).toSorted(byCodeUnit)) {
+        search.append(key, params[key] ?? "");
+    }
+    return new TextEncoder().encode(search.toString());
+}
+/**
+ * Refuse a parameter set that carries the signature parameter itself.
+ *
+ * Dropping it quietly would sign something other than what the caller passed,
+ * and `signedQuery` would then put two of them in one URL. Neither is a thing
+ * to guess about, and a caller in that position has made a mistake worth being
+ * told about.
+ */
+function assertSignable(params) {
+    if (Object.hasOwn(params, signatureParam)) {
+        throw new Error(`"${signatureParam}" is the parameter the signature itself travels in,` +
+            ` so it cannot be one of the parameters being signed. Rename it.`);
+    }
+}
+/** The secret as a key Web Crypto will sign or verify with, and nothing else. */
+async function hmacKey(secret, use) {
+    return crypto.subtle.importKey("raw", new TextEncoder().encode(secret), { name: "HMAC", hash: "SHA-256" }, false, [use]);
+}
+/**
+ * The signature for a set of parameters.
+ *
+ * Everything that must not be tampered with has to be in `params`: the
+ * signature covers those and nothing else, so a template name or a size left
+ * outside them is a template name or a size anyone can change.
+ */
+export async function signParams(params, secret) {
+    assertSignable(params);
+    const signature = await crypto.subtle.sign("HMAC", await hmacKey(secret, "sign"), canonical(params));
+    return toBase64Url(new Uint8Array(signature));
+}
+/**
+ * Whether a signature is the one these parameters should carry.
+ *
+ * The comparison is `crypto.subtle.verify` rather than one of two strings,
+ * because a comparison that stops at the first wrong byte tells an attacker how
+ * much of a guess was right.
+ */
+export async function verifyParams(params, signature, secret) {
+    try {
+        return await crypto.subtle.verify("HMAC", await hmacKey(secret, "verify"), fromBase64Url(signature), canonical(params));
+    }
+    catch {
+        // A signature that is not base64url at all is simply a wrong one.
+        return false;
+    }
+}
+/** The query string for a set of parameters, with its signature appended. */
+export async function signedQuery(params, secret) {
+    assertSignable(params);
+    const search = new URLSearchParams(params);
+    search.append(signatureParam, await signParams(params, secret));
+    return search.toString();
+}
+/**
+ * Check a request's own query string, which is the shape the check takes in a
+ * route handler: everything but the signature is what was signed.
+ *
+ * A repeated parameter is refused rather than resolved. A query string may
+ * carry the same key twice, and the two ends then disagree about which one it
+ * means: `URLSearchParams.get` takes the first, and building an object from the
+ * pairs takes the last. An attacker appending their own copy of a key to a URL
+ * that was signed for the other value is the whole attack this exists to stop,
+ * and no honest signed URL repeats a key.
+ */
+export async function verifySignedQuery(search, secret) {
+    const params = {};
+    let signature;
+    for (const [key, value] of search) {
+        if (key === signatureParam) {
+            if (signature !== undefined) {
+                return false;
+            }
+            signature = value;
+            continue;
+        }
+        if (Object.hasOwn(params, key)) {
+            return false;
+        }
+        params[key] = value;
+    }
+    return signature === undefined
+        ? false
+        : verifyParams(params, signature, secret);
+}
+//# sourceMappingURL=index.js.map

package/dist/sign/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/sign/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAO5D,iFAAiF;AACjF,MAAM,CAAC,MAAM,cAAc,GAAG,GAAG,CAAC;AAElC;;;;;;;;GAQG;AACH,SAAS,UAAU,CAAC,CAAS,EAAE,CAAS;IACtC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACZ,OAAO,CAAC,CAAC;IACX,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACxB,CAAC;AAED;;;;;;;;GAQG;AACH,6EAA6E;AAC7E,+DAA+D;AAC/D,SAAS,SAAS,CAAC,MAAoB;IACrC,MAAM,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;IAErC,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;QAC3D,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;IACxC,CAAC;IAED,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;AACrD,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,cAAc,CAAC,MAAoB;IAC1C,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CACb,IAAI,cAAc,qDAAqD;YACrE,iEAAiE,CACpE,CAAC;IACJ,CAAC;AACH,CAAC;AAED,iFAAiF;AACjF,KAAK,UAAU,OAAO,CACpB,MAAc,EACd,GAAsB;IAEtB,OAAO,MAAM,CAAC,MAAM,CAAC,SAAS,CAC5B,KAAK,EACL,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,EAChC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,EACjC,KAAK,EACL,CAAC,GAAG,CAAC,CACN,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,MAAoB,EACpB,MAAc;IAEd,cAAc,CAAC,MAAM,CAAC,CAAC;IAEvB,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CACxC,MAAM,EACN,MAAM,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,EAC7B,SAAS,CAAC,MAAM,CAAC,CAClB,CAAC;IAEF,OAAO,WAAW,CAAC,IAAI,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC;AAChD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,MAAoB,EACpB,SAAiB,EACjB,MAAc;IAEd,IAAI,CAAC;QACH,OAAO,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAC/B,MAAM,EACN,MAAM,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,EAC/B,aAAa,CAAC,SAAS,CAAC,EACxB,SAAS,CAAC,MAAM,CAAC,CAClB,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,kEAAkE;QAClE,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,6EAA6E;AAC7E,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,MAAoB,EACpB,MAAc;IAEd,cAAc,CAAC,MAAM,CAAC,CAAC;IAEvB,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,MAAM,CAAC,CAAC;IAC3C,MAAM,CAAC,MAAM,CAAC,cAAc,EAAE,MAAM,UAAU,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAEhE,OAAO,MAAM,CAAC,QAAQ,EAAE,CAAC;AAC3B,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,MAAuB,EACvB,MAAc;IAEd,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,IAAI,SAA6B,CAAC;IAElC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,EAAE,CAAC;QAClC,IAAI,GAAG,KAAK,cAAc,EAAE,CAAC;YAC3B,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;gBAC5B,OAAO,KAAK,CAAC;YACf,CAAC;YAED,SAAS,GAAG,KAAK,CAAC;YAClB,SAAS;QACX,CAAC;QAED,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,CAAC;YAC/B,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IACtB,CAAC;IAED,OAAO,SAAS,KAAK,SAAS;QAC5B,CAAC,CAAC,KAAK;QACP,CAAC,CAAC,YAAY,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;AAC9C,CAAC"}

package/dist/stamp/carrier/index.d.ts

@@ -0,0 +1,7 @@
+import type { StampCarrier } from "./types.js";
+export type { StampCarrier } from "./types.js";
+/** The carrier for these bytes, read from their signature. */
+export declare function carrierFor(head: Buffer): StampCarrier | undefined;
+/** What the containers are called, for the message when none of them fits. */
+export declare function carrierFormats(): string;
+//# sourceMappingURL=index.d.ts.map

package/dist/stamp/carrier/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/stamp/carrier/index.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAE/C,YAAY,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAiB/C,8DAA8D;AAC9D,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,YAAY,GAAG,SAAS,CAEjE;AAED,8EAA8E;AAC9E,wBAAgB,cAAc,IAAI,MAAM,CAEvC"}

package/dist/stamp/carrier/index.js

@@ -0,0 +1,27 @@
+import { isobmffCarrier } from "./isobmff.js";
+import { jpegCarrier } from "./jpeg.js";
+import { pngCarrier } from "./png.js";
+import { riffCarrier } from "./riff.js";
+/**
+ * Every container a stamp can go into, tried in the order they are written.
+ *
+ * Each one owns its own signature as well as its reading and writing, so the
+ * package has no second opinion about what a file is: `image/media.ts` sniffs
+ * the formats a build can _draw_ with, which is a different list arrived at for
+ * a different reason, and neither should be made to answer for the other.
+ */
+const carriers = [
+    pngCarrier,
+    jpegCarrier,
+    riffCarrier,
+    isobmffCarrier,
+];
+/** The carrier for these bytes, read from their signature. */
+export function carrierFor(head) {
+    return carriers.find((carrier) => carrier.matches(head));
+}
+/** What the containers are called, for the message when none of them fits. */
+export function carrierFormats() {
+    return carriers.map(({ format }) => format).join(", ");
+}
+//# sourceMappingURL=index.js.map

package/dist/stamp/carrier/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/stamp/carrier/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AACxC,OAAO,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AACtC,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAKxC;;;;;;;GAOG;AACH,MAAM,QAAQ,GAA4B;IACxC,UAAU;IACV,WAAW;IACX,WAAW;IACX,cAAc;CACf,CAAC;AAEF,8DAA8D;AAC9D,MAAM,UAAU,UAAU,CAAC,IAAY;IACrC,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;AAC3D,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,cAAc;IAC5B,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACzD,CAAC"}

package/dist/stamp/carrier/isobmff.d.ts

@@ -0,0 +1,7 @@
+import type { StampCarrier } from "./types.js";
+/**
+ * ISO base media, which is AVIF and HEIC, where the stamp is a `uuid` box on
+ * the end of the file.
+ */
+export declare const isobmffCarrier: StampCarrier;
+//# sourceMappingURL=isobmff.d.ts.map

package/dist/stamp/carrier/isobmff.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"isobmff.d.ts","sourceRoot":"","sources":["../../../src/stamp/carrier/isobmff.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAuD/C;;;GAGG;AACH,eAAO,MAAM,cAAc,EAAE,YAM5B,CAAC"}

package/dist/stamp/carrier/isobmff.js

@@ -0,0 +1,55 @@
+import { findPayload, stampFromPayload } from "../payload.js";
+/**
+ * The UUID the stamp box is tagged with. ISO base media keeps the `uuid` box
+ * for data its own format does not define, identified by a UUID whoever writes
+ * it picks once. This is Colophon's, and it means nothing beyond being
+ * unlikely to be anybody else's.
+ */
+const stampUuid = Buffer.from("5d5f8f3a9b7c4e2ab1c6f0a83d47e912", "hex");
+/** A four-byte size, four characters of type, then the UUID. */
+const header = 8 + stampUuid.length;
+function isIsobmff(head) {
+    return head.length >= 8 && head.toString("latin1", 4, 8) === "ftyp";
+}
+/**
+ * The file with the stamp box on the end of it.
+ *
+ * Appended rather than put after `ftyp`, where it would read better, because
+ * an AVIF locates the picture inside `mdat` by its offset from the start of the
+ * file. Anything inserted in front of `mdat` moves it, and the file then names
+ * the wrong bytes as its own image.
+ */
+function write(image, payload) {
+    const box = Buffer.alloc(header + payload.length);
+    box.writeUInt32BE(box.length, 0);
+    box.write("uuid", 4, "latin1");
+    stampUuid.copy(box, 8);
+    payload.copy(box, header);
+    return Buffer.concat([image, box]);
+}
+function read(tail) {
+    const at = findPayload(tail);
+    const start = at - header;
+    if (start < 0 ||
+        tail.toString("latin1", start + 4, start + 8) !== "uuid" ||
+        !tail.subarray(start + 8, at).equals(stampUuid)) {
+        return undefined;
+    }
+    // Unlike a RIFF chunk, a box states the size of the whole of itself.
+    const end = start + tail.readUInt32BE(start);
+    return end > tail.length
+        ? undefined
+        : stampFromPayload(tail.subarray(at, end));
+}
+/**
+ * ISO base media, which is AVIF and HEIC, where the stamp is a `uuid` box on
+ * the end of the file.
+ */
+export const isobmffCarrier = {
+    format: "AVIF",
+    end: "tail",
+    matches: isIsobmff,
+    write,
+    read,
+};
+//# sourceMappingURL=isobmff.js.map

package/dist/stamp/carrier/isobmff.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"isobmff.js","sourceRoot":"","sources":["../../../src/stamp/carrier/isobmff.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAG9D;;;;;GAKG;AACH,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,kCAAkC,EAAE,KAAK,CAAC,CAAC;AAEzE,gEAAgE;AAChE,MAAM,MAAM,GAAG,CAAC,GAAG,SAAS,CAAC,MAAM,CAAC;AAEpC,SAAS,SAAS,CAAC,IAAY;IAC7B,OAAO,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAC,KAAK,MAAM,CAAC;AACtE,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,KAAK,CAAC,KAAa,EAAE,OAAe;IAC3C,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAElD,GAAG,CAAC,aAAa,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IACjC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,QAAQ,CAAC,CAAC;IAC/B,SAAS,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IACvB,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAE1B,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;AACrC,CAAC;AAED,SAAS,IAAI,CAAC,IAAY;IACxB,MAAM,EAAE,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;IAC7B,MAAM,KAAK,GAAG,EAAE,GAAG,MAAM,CAAC;IAE1B,IACE,KAAK,GAAG,CAAC;QACT,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC,KAAK,MAAM;QACxD,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,EAC/C,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,qEAAqE;IACrE,MAAM,GAAG,GAAG,KAAK,GAAG,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;IAC7C,OAAO,GAAG,GAAG,IAAI,CAAC,MAAM;QACtB,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,gBAAgB,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC;AAC/C,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,cAAc,GAAiB;IAC1C,MAAM,EAAE,MAAM;IACd,GAAG,EAAE,MAAM;IACX,OAAO,EAAE,SAAS;IAClB,KAAK;IACL,IAAI;CACL,CAAC"}

package/dist/stamp/carrier/jpeg.d.ts

@@ -0,0 +1,4 @@
+import type { StampCarrier } from "./types.js";
+/** JPEG, where the stamp is a `COM` segment among the ones before the scan. */
+export declare const jpegCarrier: StampCarrier;
+//# sourceMappingURL=jpeg.d.ts.map

package/dist/stamp/carrier/jpeg.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"jpeg.d.ts","sourceRoot":"","sources":["../../../src/stamp/carrier/jpeg.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAsF/C,+EAA+E;AAC/E,eAAO,MAAM,WAAW,EAAE,YAMzB,CAAC"}

package/dist/stamp/carrier/jpeg.js

@@ -0,0 +1,76 @@
+import { jpegSegments } from "../../jpeg/segments.js";
+import { stampFromPayload } from "../payload.js";
+import { stampWindow } from "../window.js";
+/** The comment marker, which is where the stamp goes. */
+const comment = 0xfe;
+/** The most a segment can carry: its two-byte length counts itself. */
+const maxPayload = 0xff_ff - 2;
+/** An application segment, `APP0` through `APP15`. */
+function isApplication(marker) {
+    return marker >= 0xe0 && marker <= 0xef;
+}
+function isJpeg(head) {
+    return (head.length >= 3 && head.readUInt8(0) === 0xff && head.readUInt8(1) === 0xd8);
+}
+/**
+ * Where a comment of `length` bytes goes: after the start-of-image marker, and
+ * past whatever application segments come first.
+ *
+ * Both JFIF and Exif want their own `APPn` to be the first thing after `SOI`.
+ * A comment written ahead of one leaves a file that still decodes but whose
+ * metadata a strict reader no longer finds, which is a needless thing for a
+ * rebuild stamp to cost.
+ *
+ * It has to end inside the window the stamp is read back through, though, and
+ * that wins where the two disagree: an embedded colour profile can run to tens
+ * of kilobytes, and a stamp written past it would be a stamp no later build
+ * ever finds, leaving the image to render again every time and nothing to say
+ * why. So the last segment boundary with room for the comment is where it goes,
+ * and failing every one of them, straight after `SOI`.
+ */
+function insertionPoint(jpeg, length) {
+    let offset = 2;
+    for (const segment of jpegSegments(jpeg)) {
+        if (!isApplication(segment.marker) || segment.end + length > stampWindow) {
+            break;
+        }
+        offset = segment.end;
+    }
+    return offset;
+}
+function write(jpeg, payload) {
+    if (payload.length > maxPayload) {
+        throw new Error(`Cannot stamp: the stamp needs ${String(payload.length)} bytes and a` +
+            ` JPEG comment holds ${String(maxPayload)}.`);
+    }
+    const segment = Buffer.alloc(4 + payload.length);
+    segment.writeUInt8(0xff, 0);
+    segment.writeUInt8(comment, 1);
+    segment.writeUInt16BE(payload.length + 2, 2);
+    payload.copy(segment, 4);
+    const at = insertionPoint(jpeg, segment.length);
+    return Buffer.concat([jpeg.subarray(0, at), segment, jpeg.subarray(at)]);
+}
+function read(head) {
+    for (const { marker, start, end, truncated } of jpegSegments(head)) {
+        // Half a comment is half a stamp, which would never match anything but is
+        // not the sort of thing to hand back and hope.
+        if (marker !== comment || truncated) {
+            continue;
+        }
+        const stamp = stampFromPayload(head.subarray(start, end));
+        if (stamp !== undefined) {
+            return stamp;
+        }
+    }
+    return undefined;
+}
+/** JPEG, where the stamp is a `COM` segment among the ones before the scan. */
+export const jpegCarrier = {
+    format: "JPEG",
+    end: "head",
+    matches: isJpeg,
+    write,
+    read,
+};
+//# sourceMappingURL=jpeg.js.map

package/dist/stamp/carrier/jpeg.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jpeg.js","sourceRoot":"","sources":["../../../src/stamp/carrier/jpeg.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AACtD,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACjD,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAG3C,yDAAyD;AACzD,MAAM,OAAO,GAAG,IAAI,CAAC;AAErB,uEAAuE;AACvE,MAAM,UAAU,GAAG,OAAO,GAAG,CAAC,CAAC;AAE/B,sDAAsD;AACtD,SAAS,aAAa,CAAC,MAAc;IACnC,OAAO,MAAM,IAAI,IAAI,IAAI,MAAM,IAAI,IAAI,CAAC;AAC1C,CAAC;AAED,SAAS,MAAM,CAAC,IAAY;IAC1B,OAAO,CACL,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,IAAI,CAC7E,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,SAAS,cAAc,CAAC,IAAY,EAAE,MAAc;IAClD,IAAI,MAAM,GAAG,CAAC,CAAC;IAEf,KAAK,MAAM,OAAO,IAAI,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC;QACzC,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,OAAO,CAAC,GAAG,GAAG,MAAM,GAAG,WAAW,EAAE,CAAC;YACzE,MAAM;QACR,CAAC;QAED,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC;IACvB,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,KAAK,CAAC,IAAY,EAAE,OAAe;IAC1C,IAAI,OAAO,CAAC,MAAM,GAAG,UAAU,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CACb,iCAAiC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,cAAc;YACnE,uBAAuB,MAAM,CAAC,UAAU,CAAC,GAAG,CAC/C,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAEjD,OAAO,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAC5B,OAAO,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;IAC/B,OAAO,CAAC,aAAa,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;IAC7C,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;IAEzB,MAAM,EAAE,GAAG,cAAc,CAAC,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IAChD,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;AAC3E,CAAC;AAED,SAAS,IAAI,CAAC,IAAY;IACxB,KAAK,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC;QACnE,0EAA0E;QAC1E,+CAA+C;QAC/C,IAAI,MAAM,KAAK,OAAO,IAAI,SAAS,EAAE,CAAC;YACpC,SAAS;QACX,CAAC;QAED,MAAM,KAAK,GAAG,gBAAgB,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;QAE1D,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,+EAA+E;AAC/E,MAAM,CAAC,MAAM,WAAW,GAAiB;IACvC,MAAM,EAAE,MAAM;IACd,GAAG,EAAE,MAAM;IACX,OAAO,EAAE,MAAM;IACf,KAAK;IACL,IAAI;CACL,CAAC"}

package/dist/stamp/carrier/png.d.ts

@@ -0,0 +1,7 @@
+import type { StampCarrier } from "./types.js";
+/**
+ * PNG, where the stamp is a `tEXt` chunk straight after the header, so it can
+ * be read back without decoding the image.
+ */
+export declare const pngCarrier: StampCarrier;
+//# sourceMappingURL=png.d.ts.map

package/dist/stamp/carrier/png.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"png.d.ts","sourceRoot":"","sources":["../../../src/stamp/carrier/png.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AA6C/C;;;GAGG;AACH,eAAO,MAAM,UAAU,EAAE,YAWxB,CAAC"}

package/dist/stamp/carrier/png.js

@@ -0,0 +1,50 @@
+import { chunkBytes, pngSignature } from "../../png/chunk.js";
+import { stampFromPayload } from "../payload.js";
+/** Signature + the whole `IHDR` chunk: length, type, 13 bytes of data, CRC. */
+const afterHeader = pngSignature.length + 4 + 4 + 13 + 4;
+function isPng(head) {
+    return (head.length >= afterHeader &&
+        head.subarray(0, pngSignature.length).equals(pngSignature) &&
+        head.toString("latin1", 12, 16) === "IHDR");
+}
+/**
+ * The stamp in the first `tEXt` chunk that carries one, reading the chunks in
+ * the order the file declares them.
+ */
+function read(head) {
+    let offset = pngSignature.length;
+    while (offset + 8 <= head.length) {
+        const length = head.readUInt32BE(offset);
+        const type = head.toString("latin1", offset + 4, offset + 8);
+        const start = offset + 8;
+        const end = start + length;
+        // Image data starts here; anything past it is not worth reading for a hash.
+        if (type === "IDAT" || type === "IEND" || end > head.length) {
+            return undefined;
+        }
+        if (type === "tEXt") {
+            const stamp = stampFromPayload(head.subarray(start, end));
+            if (stamp !== undefined) {
+                return stamp;
+            }
+        }
+        offset = end + 4;
+    }
+    return undefined;
+}
+/**
+ * PNG, where the stamp is a `tEXt` chunk straight after the header, so it can
+ * be read back without decoding the image.
+ */
+export const pngCarrier = {
+    format: "PNG",
+    end: "head",
+    matches: isPng,
+    write: (png, payload) => Buffer.concat([
+        png.subarray(0, afterHeader),
+        chunkBytes("tEXt", payload),
+        png.subarray(afterHeader),
+    ]),
+    read,
+};
+//# sourceMappingURL=png.js.map

package/dist/stamp/carrier/png.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"png.js","sourceRoot":"","sources":["../../../src/stamp/carrier/png.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAC9D,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAGjD,+EAA+E;AAC/E,MAAM,WAAW,GAAG,YAAY,CAAC,MAAM,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;AAEzD,SAAS,KAAK,CAAC,IAAY;IACzB,OAAO,CACL,IAAI,CAAC,MAAM,IAAI,WAAW;QAC1B,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,YAAY,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC;QAC1D,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,EAAE,EAAE,EAAE,CAAC,KAAK,MAAM,CAC3C,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,SAAS,IAAI,CAAC,IAAY;IACxB,IAAI,MAAM,GAAG,YAAY,CAAC,MAAM,CAAC;IAEjC,OAAO,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QACjC,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;QACzC,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,CAAC,EAAE,MAAM,GAAG,CAAC,CAAC,CAAC;QAC7D,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,CAAC;QACzB,MAAM,GAAG,GAAG,KAAK,GAAG,MAAM,CAAC;QAE3B,4EAA4E;QAC5E,IAAI,IAAI,KAAK,MAAM,IAAI,IAAI,KAAK,MAAM,IAAI,GAAG,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;YAC5D,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;YACpB,MAAM,KAAK,GAAG,gBAAgB,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;YAE1D,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;gBACxB,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;QAED,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC;IACnB,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,UAAU,GAAiB;IACtC,MAAM,EAAE,KAAK;IACb,GAAG,EAAE,MAAM;IACX,OAAO,EAAE,KAAK;IACd,KAAK,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,EAAE,CACtB,MAAM,CAAC,MAAM,CAAC;QACZ,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,WAAW,CAAC;QAC5B,UAAU,CAAC,MAAM,EAAE,OAAO,CAAC;QAC3B,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC;KAC1B,CAAC;IACJ,IAAI;CACL,CAAC"}

package/dist/stamp/carrier/riff.d.ts

@@ -0,0 +1,4 @@
+import type { StampCarrier } from "./types.js";
+/** WebP, where the stamp is a chunk of its own on the end of the RIFF file. */
+export declare const riffCarrier: StampCarrier;
+//# sourceMappingURL=riff.d.ts.map

package/dist/stamp/carrier/riff.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"riff.d.ts","sourceRoot":"","sources":["../../../src/stamp/carrier/riff.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAyD/C,+EAA+E;AAC/E,eAAO,MAAM,WAAW,EAAE,YAMzB,CAAC"}