@lunora/bindings 1.0.0-alpha.45 → 1.0.0-alpha.47

package/dist/analytics/index.d.mts

@@ -120,7 +120,14 @@ interface AnalyticsSqlResult {
   rowCount: number;
   rows: Record<string, unknown>[];
 }
-/** Thrown when the SQL API responds with a non-2xx status; a `LunoraError` subclass carrying the HTTP `status` + body for the caller to surface. */
+/**
+ * Thrown when the SQL API responds with a non-2xx status; a `LunoraError`
+ * subclass carrying the HTTP `status` + a capped body preview, with the full
+ * body on `cause`.
+ *
+ * The preview is capped because AE's SQL error text quotes the query back, and
+ * `ANALYTICS_SQL_ERROR` is non-internal — the message reaches the browser.
+ */
 declare class AnalyticsSqlError extends LunoraError {
   constructor(status: number, body: string);
 }

package/dist/analytics/index.d.ts

@@ -120,7 +120,14 @@ interface AnalyticsSqlResult {
   rowCount: number;
   rows: Record<string, unknown>[];
 }
-/** Thrown when the SQL API responds with a non-2xx status; a `LunoraError` subclass carrying the HTTP `status` + body for the caller to surface. */
+/**
+ * Thrown when the SQL API responds with a non-2xx status; a `LunoraError`
+ * subclass carrying the HTTP `status` + a capped body preview, with the full
+ * body on `cause`.
+ *
+ * The preview is capped because AE's SQL error text quotes the query back, and
+ * `ANALYTICS_SQL_ERROR` is non-internal — the message reaches the browser.
+ */
 declare class AnalyticsSqlError extends LunoraError {
   constructor(status: number, body: string);
 }

package/dist/analytics/index.mjs

@@ -1 +1 @@
-import{createAnalytics as e}from"../packem_shared/createAnalytics-BXTNc57d.mjs";import{AnalyticsSqlError as a,createAnalyticsSqlClient as c}from"../packem_shared/AnalyticsSqlError-BEKML_Dg.mjs";export{a as AnalyticsSqlError,e as createAnalytics,c as createAnalyticsSqlClient};
+import{createAnalytics as e}from"../packem_shared/createAnalytics-BXTNc57d.mjs";import{AnalyticsSqlError as a,createAnalyticsSqlClient as c}from"../packem_shared/AnalyticsSqlError-CeQ3A5Eb.mjs";export{a as AnalyticsSqlError,e as createAnalytics,c as createAnalyticsSqlClient};

package/dist/images/index.mjs

@@ -1 +1 @@
-import{createImages as m}from"../packem_shared/createImages-CHgMZP4g.mjs";import{buildImageDeliveryUrl as g}from"../packem_shared/buildImageDeliveryUrl-Brqs-dcZ.mjs";import{buildSignedImageUrl as o,parseSignedTransform as l,verifySignedImageUrl as d}from"../packem_shared/buildSignedImageUrl-DbSDmjWK.mjs";export{g as buildImageDeliveryUrl,o as buildSignedImageUrl,m as createImages,l as parseSignedTransform,d as verifySignedImageUrl};
+import{createImages as m}from"../packem_shared/createImages-CHgMZP4g.mjs";import{buildImageDeliveryUrl as g}from"../packem_shared/buildImageDeliveryUrl-Brqs-dcZ.mjs";import{buildSignedImageUrl as o,parseSignedTransform as l,verifySignedImageUrl as d}from"../packem_shared/buildSignedImageUrl-C1b76MYf.mjs";export{g as buildImageDeliveryUrl,o as buildSignedImageUrl,m as createImages,l as parseSignedTransform,d as verifySignedImageUrl};

package/dist/packem_shared/AnalyticsSqlError-CeQ3A5Eb.mjs

@@ -0,0 +1 @@
+import{LunoraError as y}from"@lunora/errors";import{c as h}from"./cap-error-body-YBKO32BF.mjs";const w="https://api.cloudflare.com/client/v4/accounts",S=6e4;class a extends y{constructor(r,o){super("ANALYTICS_SQL_ERROR",`Analytics Engine SQL API returned ${String(r)}: ${h(o)}`,{cause:o,name:"AnalyticsSqlError",status:r})}}const b=e=>{const r=e.fetch??globalThis.fetch,o=`${w}/${encodeURIComponent(e.accountId)}/analytics_engine/sql`,c=e.timeoutMs??S;return{query:async u=>{const n=new AbortController,d=setTimeout(()=>{n.abort()},c);try{const t=await r(o,{body:u,headers:{Authorization:`Bearer ${e.apiToken}`,"Content-Type":"text/plain"},method:"POST",signal:n.signal});if(!t.ok)throw new a(t.status,await t.text().catch(()=>"<error body unavailable: the request deadline fired before it was read>"));let i;try{i=await t.json()}catch(m){throw n.signal.aborted?m:new a(t.status,"Analytics Engine SQL API returned a non-JSON body.")}const s=i,l=s.data??[];return{columns:s.meta??[],rowCount:s.rows??l.length,rows:l}}catch(t){throw n.signal.aborted&&!(t instanceof a)?new a(504,`query timed out after ${String(c)}ms (AnalyticsSqlConfig.timeoutMs)`):t}finally{clearTimeout(d)}}}};export{a as AnalyticsSqlError,b as createAnalyticsSqlClient};

package/dist/packem_shared/R2SqlError-utivPDyt.mjs

@@ -0,0 +1 @@
+import{LunoraError as f}from"@lunora/errors";import{c as b}from"./cap-error-body-YBKO32BF.mjs";import R from"./SelectBuilder-Dnqem9T0.mjs";import{ident as m,toText as h}from"./Sql-BfnxRway.mjs";const T="https://api.sql.cloudflarestorage.com/api/v1/accounts",E=6e4,$=e=>e[0]===void 0?[]:Object.keys(e[0]).map(s=>({name:s}));class c extends f{constructor(s,i){super("R2_SQL_ERROR",`R2 SQL query failed (${String(s)}): ${b(i)}`,{cause:i,name:"R2SqlError",status:s})}}const C=e=>{const s=e.fetch??globalThis.fetch,S=`${e.endpoint??T}/${encodeURIComponent(e.accountId)}/r2-sql/query/${encodeURIComponent(e.bucket)}`,p=`${e.accountId}_${e.bucket}`,l=e.timeoutMs??E,n=async t=>{const a=new AbortController,w=setTimeout(()=>{a.abort()},l);try{const r=await s(S,{body:JSON.stringify({query:t,warehouse:p}),headers:{Authorization:`Bearer ${e.apiToken}`,"Content-Type":"application/json"},method:"POST",signal:a.signal});if(!r.ok)throw new c(r.status,await r.text().catch(()=>"<error body unavailable: the request deadline fired before it was read>"));let d;try{d=await r.json()}catch(y){throw a.signal.aborted?y:new c(r.status,"R2 SQL returned a non-JSON body.")}const o=d;if(o.success===!1||o.errors!==void 0&&o.errors.length>0)throw new c(r.status,JSON.stringify(o.errors??o));const u=o.result?.rows??[];return{columns:o.result?.schema??$(u),rowCount:u.length,rows:u}}catch(r){throw a.signal.aborted&&!(r instanceof c)?new c(504,`query timed out after ${String(l)}ms (R2SqlConfig.timeoutMs)`):r}finally{clearTimeout(w)}};return{describe:async t=>n(`DESCRIBE ${m(t)}`),explain:async(t,a)=>n(`EXPLAIN ${a?.format==="json"?"FORMAT JSON ":""}${h(t)}`),from:t=>new R(n,t),query:async t=>n(h(t)),showDatabases:async()=>n("SHOW DATABASES"),showTables:async t=>n(`SHOW TABLES IN ${m(t)}`)}};export{c as R2SqlError,C as createR2Sql};

package/dist/packem_shared/buildSignedImageUrl-C1b76MYf.mjs

@@ -0,0 +1,4 @@
+const S=e=>{const t=atob(e),r=new Uint8Array(t.length);for(let n=0;n<t.length;n+=1)r[n]=t.codePointAt(n)??0;return r},a="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_",E=e=>{let t="",r=0;const n=e.length-2;for(;r<n;r+=3){const s=e[r]<<16|e[r+1]<<8|e[r+2];t+=a.charAt(s>>18&63)+a.charAt(s>>12&63)+a.charAt(s>>6&63)+a.charAt(s&63)}const o=e.length-r;if(o===1){const s=e[r]<<16;t+=a.charAt(s>>18&63)+a.charAt(s>>12&63)}else if(o===2){const s=e[r]<<16|e[r+1]<<8;t+=a.charAt(s>>18&63)+a.charAt(s>>12&63)+a.charAt(s>>6&63)}return t},v=e=>{const t=e.replaceAll("-","+").replaceAll("_","/"),r=t+"=".repeat((4-t.length%4)%4);return S(r)},R=(e,t)=>{if(e.size<t)return;const r=e.keys().next().value;r!==void 0&&e.delete(r)},_=(e,t,r,n)=>{const o=e.get(t);if(o!==void 0)return o;R(e,n);const s=r().catch(i=>{throw e.get(t)===s&&e.delete(t),i});return e.set(t,s),s},f=new TextEncoder,T=10080*60,$=/^[a-z][a-z0-9+\-.]*:\/\//i,x=Array.from({length:32},(e,t)=>t),C=new RegExp(`[${x.map(e=>String.fromCodePoint(e)).join("")}]`,"u"),U=64,N=new Map,h=async e=>_(N,e,async()=>crypto.subtle.importKey("raw",f.encode(e),{hash:"SHA-256",name:"HMAC"},!1,["sign","verify"]),U),p=e=>{try{return new URL(e).host}catch{return e.replace($,"").split("/")[0]??""}},y=e=>{if(C.test(e))throw new TypeError("hmac-url: value must not contain control characters (including CR/LF)")},L=/^\/+$/u,O=e=>L.test(e),H=(e,t)=>{if(!Number.isFinite(e)||e<=0)return"expiresInSeconds must be a positive finite number";if(e>t){const r=` (${String(t/86400)} days)`;return`expiresInSeconds must not exceed ${String(t)} seconds${r}`}},I=async(e,t)=>{const r=await h(e),n=await crypto.subtle.sign("HMAC",r,f.encode(t));return E(new Uint8Array(n))},K=async(e,t,r)=>{const n=await h(e);return crypto.subtle.verify("HMAC",n,r,f.encode(t))},b=/^\//,P=e=>{let t=e.length;for(;t>0&&e[t-1]==="/";)t-=1;return e.slice(0,t)},D=e=>e.replaceAll("&","%26").replaceAll("=","%3D"),M=e=>e.replaceAll("%3D","=").replaceAll("%26","&"),j=e=>e===void 0?"":Object.entries(e).filter(([,t])=>t!==void 0).toSorted(([t],[r])=>(t>r?1:0)-(t<r?1:0)).map(([t,r])=>`${t}=${D(typeof r=="object"?JSON.stringify(r):String(r))}`).join("&"),k={background:"string",blur:"number",brightness:"number",contrast:"number",draw:"json",fit:"string",flip:"string",gamma:"number",gravity:"string-or-json",height:"number",rotate:"number",saturation:"number",segment:"string",sharpen:"number",upscale:"string",width:"number"},z=new Map(Object.entries(k)),B=(e,t,r)=>{if(t==="string"||t==="string-or-json"&&!r.startsWith("{"))return r;if(t==="number"){const n=Number(r);if(r===""||!Number.isFinite(n))throw new TypeError(`@lunora/bindings/images: transform key "${e}" expects a number, got "${r}"`);return n}try{return JSON.parse(r)}catch{throw new TypeError(`@lunora/bindings/images: transform key "${e}" carries malformed JSON`)}},w=(e,t,r,n)=>`${e.toLowerCase()}
+${t}
+${String(r)}
+${n}`,F=e=>e.split("/").map(t=>encodeURIComponent(t)).join("/"),Y=e=>{if(e==="")return{};const t={};for(const r of e.split("&")){const n=r.indexOf("=");if(n===-1)throw new TypeError(`@lunora/bindings/images: malformed transform segment "${r}" — expected key=value`);const o=r.slice(0,n),s=z.get(o);if(s===void 0)throw new TypeError(`@lunora/bindings/images: unknown transform key "${o}" — the serialized transform does not match this version's TransformOptions`);t[o]=B(o,s,M(r.slice(n+1)))}return t},J=async e=>{const t=e.expiresInSeconds??3600,r=H(t,T);if(r!==void 0)throw new TypeError(`@lunora/bindings/images: ${r}`);let n="";try{n=new URL(e.baseUrl).pathname}catch{}if(n!==""&&!O(n))throw new TypeError(`@lunora/bindings/images: baseUrl must not carry a path ("${n}") — the key is verified from the full URL pathname, so a subpath base would make every signed URL fail verification`);const o=Math.floor(Date.now()/1e3)+t,s=p(e.baseUrl),i=j(e.transform),c=e.key.replace(b,"");y(c);const l=await I(e.secret,w(s,c,o,i)),m=P(e.baseUrl),d=F(c),g=i===""?"":`&t=${encodeURIComponent(i)}`;return`${m}/${d}?exp=${String(o)}&sig=${l}${g}`},V=async(e,t,r)=>{let n;try{n=e instanceof URL?e:new URL(e)}catch{return{reason:"malformed",valid:!1}}const o=n.searchParams.get("exp"),s=o===null?Number.NaN:Number(o),i=n.searchParams.get("sig"),c=n.searchParams.get("t")??"";if(!i||!Number.isInteger(s))return{reason:"malformed",valid:!1};if(s<Math.floor(Date.now()/1e3))return{reason:"expired",valid:!1};let l,m;try{l=n.pathname.replace(b,"").split("/").map(A=>decodeURIComponent(A)).join("/"),y(l),m=v(i)}catch{return{reason:"malformed",valid:!1}}const d=r?.expectedHost===void 0?n.host:p(r.expectedHost);if(!await K(t,w(d,l,s,c),m))return{reason:"bad_signature",valid:!1};if(c==="")return{key:l,valid:!0};let u;try{u=Y(c)}catch{u=void 0}return{key:l,transform:c,transformOptions:u,valid:!0}};export{J as buildSignedImageUrl,Y as parseSignedTransform,V as verifySignedImageUrl};

package/dist/packem_shared/cap-error-body-YBKO32BF.mjs

@@ -0,0 +1 @@
+const _=R=>R.length>256?`${R.slice(0,256)}… (truncated)`:R;export{_ as c};

package/dist/r2sql/index.d.mts

@@ -273,8 +273,11 @@ declare class SelectBuilder<Row = Record<string, unknown>> implements Queryable<
 }
 /**
  * Thrown when R2 SQL responds with a non-2xx status, an `success: false`
- * envelope, or an unparseable body; carries the HTTP `status` and the raw body
- * for the caller to surface.
+ * envelope, or an unparseable body; carries the HTTP `status` and a capped body
+ * preview for the caller to surface, with the full body on `cause`.
+ *
+ * The preview is capped because the engine's SQL error text quotes the query
+ * back, and `R2_SQL_ERROR` is non-internal — the message reaches the browser.
  */
 declare class R2SqlError extends LunoraError {
   constructor(status: number, body: string);

package/dist/r2sql/index.d.ts

@@ -273,8 +273,11 @@ declare class SelectBuilder<Row = Record<string, unknown>> implements Queryable<
 }
 /**
  * Thrown when R2 SQL responds with a non-2xx status, an `success: false`
- * envelope, or an unparseable body; carries the HTTP `status` and the raw body
- * for the caller to surface.
+ * envelope, or an unparseable body; carries the HTTP `status` and a capped body
+ * preview for the caller to surface, with the full body on `cause`.
+ *
+ * The preview is capped because the engine's SQL error text quotes the query
+ * back, and `R2_SQL_ERROR` is non-internal — the message reaches the browser.
  */
 declare class R2SqlError extends LunoraError {
   constructor(status: number, body: string);

package/dist/r2sql/index.mjs

@@ -1 +1 @@
-import{default as o}from"../packem_shared/SelectBuilder-Dnqem9T0.mjs";import{R2SqlError as l,createR2Sql as f}from"../packem_shared/R2SqlError-CJ_zgztT.mjs";import{asc as d,desc as i,renderOrderTerm as n}from"../packem_shared/asc-DP_WFiAE.mjs";import{default as s}from"../packem_shared/SetOperation-kiI5Wnlm.mjs";import{Sql as m,isSql as S,joinSql as q,lit as c,raw as u,sql as w,toText as E}from"../packem_shared/Sql-BfnxRway.mjs";import{WindowFunction as R,fn as T}from"../packem_shared/WindowFunction-CL4jYy2l.mjs";import{default as j}from"../packem_shared/WindowExpression-VX7EEV3h.mjs";export{l as R2SqlError,o as SelectBuilder,s as SetOperation,m as Sql,j as WindowExpression,R as WindowFunction,d as asc,f as createR2Sql,i as desc,T as fn,S as isSql,q as joinSql,c as lit,u as raw,n as renderOrderTerm,w as sql,E as toText};
+import{default as o}from"../packem_shared/SelectBuilder-Dnqem9T0.mjs";import{R2SqlError as l,createR2Sql as f}from"../packem_shared/R2SqlError-utivPDyt.mjs";import{asc as d,desc as i,renderOrderTerm as n}from"../packem_shared/asc-DP_WFiAE.mjs";import{default as s}from"../packem_shared/SetOperation-kiI5Wnlm.mjs";import{Sql as m,isSql as S,joinSql as q,lit as c,raw as u,sql as w,toText as E}from"../packem_shared/Sql-BfnxRway.mjs";import{WindowFunction as R,fn as T}from"../packem_shared/WindowFunction-CL4jYy2l.mjs";import{default as j}from"../packem_shared/WindowExpression-VX7EEV3h.mjs";export{l as R2SqlError,o as SelectBuilder,s as SetOperation,m as Sql,j as WindowExpression,R as WindowFunction,d as asc,f as createR2Sql,i as desc,T as fn,S as isSql,q as joinSql,c as lit,u as raw,n as renderOrderTerm,w as sql,E as toText};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lunora/bindings",
-  "version": "1.0.0-alpha.45",
+  "version": "1.0.0-alpha.47",
   "description": "Lightweight Cloudflare binding helpers for Lunora — ctx.kv, ctx.images, ctx.analytics, ctx.pipelines, ctx.vectors, ctx.r2sql — one install, per-binding subpaths",
   "keywords": [
     "analytics",
@@ -64,8 +64,8 @@
     "access": "public"
   },
   "dependencies": {
-    "@lunora/errors": "1.0.0-alpha.28",
-    "@lunora/platform": "1.0.0-alpha.23"
+    "@lunora/errors": "1.0.0-alpha.30",
+    "@lunora/platform": "1.0.0-alpha.25"
   },
   "engines": {
     "node": "^22.15.0 || >=24.11.0"

package/dist/packem_shared/AnalyticsSqlError-BEKML_Dg.mjs

@@ -1 +0,0 @@
-import{LunoraError as h}from"@lunora/errors";const m="https://api.cloudflare.com/client/v4/accounts",w=6e4;class r extends h{constructor(o,a){super("ANALYTICS_SQL_ERROR",`Analytics Engine SQL API returned ${String(o)}: ${a}`,{name:"AnalyticsSqlError",status:o})}}const p=e=>{const o=e.fetch??globalThis.fetch,a=`${m}/${encodeURIComponent(e.accountId)}/analytics_engine/sql`,i=e.timeoutMs??w;return{query:async u=>{const n=new AbortController,d=setTimeout(()=>{n.abort()},i);try{const t=await o(a,{body:u,headers:{Authorization:`Bearer ${e.apiToken}`,"Content-Type":"text/plain"},method:"POST",signal:n.signal});if(!t.ok)throw new r(t.status,await t.text().catch(()=>"<error body unavailable: the request deadline fired before it was read>"));let c;try{c=await t.json()}catch(y){throw n.signal.aborted?y:new r(t.status,"Analytics Engine SQL API returned a non-JSON body.")}const s=c,l=s.data??[];return{columns:s.meta??[],rowCount:s.rows??l.length,rows:l}}catch(t){throw n.signal.aborted&&!(t instanceof r)?new r(504,`query timed out after ${String(i)}ms (AnalyticsSqlConfig.timeoutMs)`):t}finally{clearTimeout(d)}}}};export{r as AnalyticsSqlError,p as createAnalyticsSqlClient};

package/dist/packem_shared/R2SqlError-CJ_zgztT.mjs

@@ -1 +0,0 @@
-import{LunoraError as b}from"@lunora/errors";import f from"./SelectBuilder-Dnqem9T0.mjs";import{ident as m,toText as h}from"./Sql-BfnxRway.mjs";const R="https://api.sql.cloudflarestorage.com/api/v1/accounts",T=6e4,$=e=>e[0]===void 0?[]:Object.keys(e[0]).map(s=>({name:s}));class c extends b{constructor(s,l){super("R2_SQL_ERROR",`R2 SQL query failed (${String(s)}): ${l}`,{name:"R2SqlError",status:s})}}const O=e=>{const s=e.fetch??globalThis.fetch,S=`${e.endpoint??R}/${encodeURIComponent(e.accountId)}/r2-sql/query/${encodeURIComponent(e.bucket)}`,w=`${e.accountId}_${e.bucket}`,u=e.timeoutMs??T,n=async t=>{const a=new AbortController,y=setTimeout(()=>{a.abort()},u);try{const r=await s(S,{body:JSON.stringify({query:t,warehouse:w}),headers:{Authorization:`Bearer ${e.apiToken}`,"Content-Type":"application/json"},method:"POST",signal:a.signal});if(!r.ok)throw new c(r.status,await r.text().catch(()=>"<error body unavailable: the request deadline fired before it was read>"));let d;try{d=await r.json()}catch(p){throw a.signal.aborted?p:new c(r.status,"R2 SQL returned a non-JSON body.")}const o=d;if(o.success===!1||o.errors!==void 0&&o.errors.length>0)throw new c(r.status,JSON.stringify(o.errors??o));const i=o.result?.rows??[];return{columns:o.result?.schema??$(i),rowCount:i.length,rows:i}}catch(r){throw a.signal.aborted&&!(r instanceof c)?new c(504,`query timed out after ${String(u)}ms (R2SqlConfig.timeoutMs)`):r}finally{clearTimeout(y)}};return{describe:async t=>n(`DESCRIBE ${m(t)}`),explain:async(t,a)=>n(`EXPLAIN ${a?.format==="json"?"FORMAT JSON ":""}${h(t)}`),from:t=>new f(n,t),query:async t=>n(h(t)),showDatabases:async()=>n("SHOW DATABASES"),showTables:async t=>n(`SHOW TABLES IN ${m(t)}`)}};export{c as R2SqlError,O as createR2Sql};

package/dist/packem_shared/buildSignedImageUrl-DbSDmjWK.mjs

@@ -1,4 +0,0 @@
-const v=e=>{const t=atob(e),n=new Uint8Array(t.length);for(let r=0;r<t.length;r+=1)n[r]=t.codePointAt(r)??0;return n},a="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_",E=e=>{let t="",n=0;const r=e.length-2;for(;n<r;n+=3){const s=e[n]<<16|e[n+1]<<8|e[n+2];t+=a.charAt(s>>18&63)+a.charAt(s>>12&63)+a.charAt(s>>6&63)+a.charAt(s&63)}const o=e.length-n;if(o===1){const s=e[n]<<16;t+=a.charAt(s>>18&63)+a.charAt(s>>12&63)}else if(o===2){const s=e[n]<<16|e[n+1]<<8;t+=a.charAt(s>>18&63)+a.charAt(s>>12&63)+a.charAt(s>>6&63)}return t},R=e=>{const t=e.replaceAll("-","+").replaceAll("_","/"),n=t+"=".repeat((4-t.length%4)%4);return v(n)},$=(e,t)=>{if(e.size<t)return;const n=e.keys().next().value;n!==void 0&&e.delete(n)},_=(e,t,n,r)=>{const o=e.get(t);if(o!==void 0)return o;$(e,r);const s=n().catch(i=>{throw e.get(t)===s&&e.delete(t),i});return e.set(t,s),s},u=new TextEncoder,x=10080*60,C=/^[a-z][a-z0-9+\-.]*:\/\//i,T=Array.from({length:32},(e,t)=>t),U=new RegExp(`[${T.map(e=>String.fromCodePoint(e)).join("")}]`,"u"),N=64,O=new Map,h=async e=>_(O,e,async()=>crypto.subtle.importKey("raw",u.encode(e),{hash:"SHA-256",name:"HMAC"},!1,["sign","verify"]),N),p=e=>{try{return new URL(e).host}catch{return e.replace(C,"").split("/")[0]??""}},y=e=>{if(U.test(e))throw new TypeError("hmac-url: value must not contain control characters (including CR/LF)")},L=/^\/+$/u,H=e=>L.test(e),I=(e,t)=>{if(!Number.isFinite(e)||e<=0)return"expiresInSeconds must be a positive finite number";if(e>t){const n=` (${String(t/86400)} days)`;return`expiresInSeconds must not exceed ${String(t)} seconds${n}`}},K=async(e,t)=>{const n=await h(e),r=await crypto.subtle.sign("HMAC",n,u.encode(t));return E(new Uint8Array(r))},P=async(e,t,n)=>{const r=await h(e);return crypto.subtle.verify("HMAC",r,n,u.encode(t))},b=/^\//,M=e=>{let t=e.length;for(;t>0&&e[t-1]==="/";)t-=1;return e.slice(0,t)},j=e=>e===void 0?"":Object.entries(e).filter(([,t])=>t!==void 0).toSorted(([t],[n])=>(t>n?1:0)-(t<n?1:0)).map(([t,n])=>`${t}=${typeof n=="object"?JSON.stringify(n):String(n)}`).join("&"),D={background:"string",blur:"number",brightness:"number",contrast:"number",draw:"json",fit:"string",flip:"string",gamma:"number",gravity:"string-or-json",height:"number",rotate:"number",saturation:"number",segment:"string",sharpen:"number",upscale:"string",width:"number"},w=new Map(Object.entries(D)),k=e=>{const t=[];for(const n of e.split("&")){const r=n.indexOf("="),o=r!==-1&&w.has(n.slice(0,r)),s=t.at(-1);o||s===void 0?t.push(n):t[t.length-1]=`${s}&${n}`}return t},z=(e,t,n)=>{if(t==="string"||t==="string-or-json"&&!n.startsWith("{"))return n;if(t==="number"){const r=Number(n);if(n===""||!Number.isFinite(r))throw new TypeError(`@lunora/bindings/images: transform key "${e}" expects a number, got "${n}"`);return r}try{return JSON.parse(n)}catch{throw new TypeError(`@lunora/bindings/images: transform key "${e}" carries malformed JSON`)}},S=(e,t,n,r)=>`${e.toLowerCase()}
-${t}
-${String(n)}
-${r}`,B=e=>e.split("/").map(t=>encodeURIComponent(t)).join("/"),F=e=>{if(e==="")return{};const t={};for(const n of k(e)){const r=n.indexOf("=");if(r===-1)throw new TypeError(`@lunora/bindings/images: malformed transform segment "${n}" — expected key=value`);const o=n.slice(0,r),s=w.get(o);if(s===void 0)throw new TypeError(`@lunora/bindings/images: unknown transform key "${o}" — the serialized transform does not match this version's TransformOptions`);t[o]=z(o,s,n.slice(r+1))}return t},Y=async e=>{const t=e.expiresInSeconds??3600,n=I(t,x);if(n!==void 0)throw new TypeError(`@lunora/bindings/images: ${n}`);let r="";try{r=new URL(e.baseUrl).pathname}catch{}if(r!==""&&!H(r))throw new TypeError(`@lunora/bindings/images: baseUrl must not carry a path ("${r}") — the key is verified from the full URL pathname, so a subpath base would make every signed URL fail verification`);const o=Math.floor(Date.now()/1e3)+t,s=p(e.baseUrl),i=j(e.transform),c=e.key.replace(b,"");y(c);const l=await K(e.secret,S(s,c,o,i)),m=M(e.baseUrl),d=B(c),g=i===""?"":`&t=${encodeURIComponent(i)}`;return`${m}/${d}?exp=${String(o)}&sig=${l}${g}`},J=async(e,t,n)=>{let r;try{r=e instanceof URL?e:new URL(e)}catch{return{reason:"malformed",valid:!1}}const o=r.searchParams.get("exp"),s=o===null?Number.NaN:Number(o),i=r.searchParams.get("sig"),c=r.searchParams.get("t")??"";if(!i||!Number.isInteger(s))return{reason:"malformed",valid:!1};if(s<Math.floor(Date.now()/1e3))return{reason:"expired",valid:!1};let l,m;try{l=r.pathname.replace(b,"").split("/").map(A=>decodeURIComponent(A)).join("/"),y(l),m=R(i)}catch{return{reason:"malformed",valid:!1}}const d=n?.expectedHost===void 0?r.host:p(n.expectedHost);if(!await P(t,S(d,l,s,c),m))return{reason:"bad_signature",valid:!1};if(c==="")return{key:l,valid:!0};let f;try{f=F(c)}catch{f=void 0}return{key:l,transform:c,transformOptions:f,valid:!0}};export{Y as buildSignedImageUrl,F as parseSignedTransform,J as verifySignedImageUrl};