@monok/server 1.3.0 → 1.4.0

package/AGENTS.md

@@ -0,0 +1,318 @@
+# Implementing `@monok/server` in a host application
+
+This file is a self-contained implementation contract for AI coding assistants
+and developers integrating Monok with an Express application or CMS. Follow the
+requirements below rather than inventing alternate endpoint paths or response
+shapes.
+
+## Objective
+
+By default, expose a public HTTPS Monok integration at these routes:
+
+- `POST /api/monok/push`
+- `GET /api/monok/info`
+- `GET /api/monok/postfilter` when article discovery is supported
+
+Use `createMonokRouter` from `@monok/server`. Mount it at `/api/monok` for the
+default API base, or at an intentional custom base such as
+`/something/specialAPI/monok`. When connecting the integration, enter either the
+site origin to select the default or the complete custom base URL. Monok appends
+`/info`, `/push`, and `/postfilter` to that base.
+
+## Required implementation
+
+Install the package and Express:
+
+```bash
+npm install @monok/server express
+```
+
+Create one router with the same secret API key configured for the Monok
+workspace:
+
+```ts
+import express from "express";
+import {
+  createMonokRouter,
+  sendMonokLinkback,
+  type MonokArticle,
+  type PostFilterQuery,
+  type PostFilterResult,
+  type SiteInfoInput
+} from "@monok/server";
+
+const app = express();
+
+app.use(
+  "/api/monok",
+  createMonokRouter({
+    apiKey: process.env.MONOK_API_KEY!,
+    imageDir: "./uploads/monok",
+    getSiteInfo: async (): Promise<SiteInfoInput> => loadSiteInfo(),
+    searchArticles: async (
+      filters: PostFilterQuery
+    ): Promise<PostFilterResult[]> => searchPublishedArticles(filters),
+    onArticle: async (article, context) => {
+      await upsertMonokArticle(article, context);
+    }
+  })
+);
+```
+
+`onArticle` and the application's persistence work are always required.
+`getSiteInfo` is optional. The router always exposes authenticated `/info`; when
+the callback is omitted it returns minimal `Custom CMS` metadata so the standard
+Monok dashboard connection and sync flow can still detect the installation.
+`searchArticles` and `imageDir` are optional; omitting article search disables
+covered-article and backlink discovery.
+
+Do not add another JSON body parser solely for these routes. The router already
+parses JSON with a 20 MB limit. A reverse proxy in front of the application must
+also permit the request size.
+
+## Receiving and storing articles
+
+`onArticle` receives:
+
+```ts
+async function onArticle(
+  article: MonokArticle,
+  context: {
+    action?: "draft" | "publish";
+    saveThumbImage(fileNameBase?: string): Promise<string | undefined>;
+  }
+): Promise<void>
+```
+
+The host must:
+
+1. Validate any application-specific constraints.
+2. Upsert by `article.id`, or enqueue an idempotent job keyed by `article.id`, so
+   repeated delivery cannot create duplicate content.
+3. Preserve `article.id` with the CMS record or queued job for later linkbacks
+   and updates.
+4. Store `article.content` as the rendered HTML body when processing the job.
+5. Apply the supplied slug, author, categories, sections, tags, language, and
+   CMS post type when the host supports them.
+6. Treat the requested action as draft unless `context.action === "publish"`.
+7. Before returning, await either durable CMS persistence or durable queue
+   acceptance. Do not acknowledge an in-memory, fire-and-forget task.
+8. Throw when persistence or durable queueing fails.
+
+The draft/publish action normally arrives in the JSON body. The package also
+supports the legacy query parameter. Do not read `article.action` directly when
+deciding publication state; use the validated `context.action` value.
+
+`onArticle` returns `void` or `Promise<void>`. It must not construct an HTTP
+response. After the callback durably saves or queues the work, the package
+returns:
+
+```json
+{
+  "ok": true,
+  "status": "accepted",
+  "monokId": "the-article-id"
+}
+```
+
+This response acknowledges delivery only. It does not promise that a draft URL,
+CMS record ID, thumbnail URL, or public canonical URL already exists. Custom CMS
+implementations may render, moderate, deploy, or publish asynchronously.
+
+Thrown errors become JSON error responses. An error with a numeric `status`
+property uses that HTTP status; other errors return `500`.
+
+## Article payload
+
+The important `MonokArticle` fields are:
+
+```ts
+interface MonokArticle {
+  id: string | number;
+  title: string;
+  shortTitle?: string;
+  description?: string;
+  content?: string;
+  text?: string;
+  slug?: string;
+  action?: "draft" | "publish";
+  author?: { id: string | number; name: string };
+  categories?: Array<{ name: string; weight?: number }>;
+  sections?: string[];
+  tags?: string[] | null;
+  language?: string;
+  type?: string;
+  thumbnail?: string;
+  thumbImageData?: string;
+  thumbAlt?: string;
+  thumbImageDescription?: string;
+  keywords?: string[];
+}
+```
+
+Treat unknown additional fields as forward-compatible metadata. Do not reject a
+payload merely because it contains fields added by a newer Monok version.
+
+## JPEG thumbnail handling
+
+Monok sends `thumbImageData` as JPEG base64. It is normally raw base64, while a
+legacy path can wrap it in `data:image/jpeg;base64,...`.
+
+When `imageDir` is configured, call `await context.saveThumbImage()` to validate
+and save it. The return value is the local `.jpg` path, or `undefined` when no
+image directory or image data was provided. The default decoded-image limit is
+15 MiB and can be changed with `maxImageBytes`.
+
+Saving a file is not the same as making it public. If the CMS has a media API or
+object storage, the host may instead process `article.thumbImageData` itself.
+Preserve `thumbAlt` or fall back to `thumbImageDescription`, then the title, for
+accessible alt text.
+
+Do not label the saved image as PNG and do not log its base64 data.
+
+## Site information
+
+Implement `getSiteInfo` when Monok should offer real CMS authors, categories,
+tags, post types, or languages. Return this shape:
+
+```ts
+const info: SiteInfoInput = {
+  js_scripts: "Enabled",
+  name: "Site name",
+  logo: "https://example.com/logo.jpg",
+  categories: ["News", "Analysis"],
+  post_types: ["post", "page"],
+  tags: ["Technology", "Business"],
+  authors: [
+    {
+      id: "author-1",
+      name: "Jane Doe",
+      profile: "Editor",
+      avatar: "https://example.com/jane.jpg",
+      roles: ["editor"]
+    }
+  ],
+  languages: {
+    en: { name: "English", slug: "en", locale: "en_US" }
+  }
+};
+```
+
+Do not return `version` from `getSiteInfo`. The router always injects the
+installed `@monok/server` package version into the `/info` response.
+
+Return empty arrays when a supported collection has no entries. Values may be
+loaded dynamically on every request. The router sends private no-cache headers.
+If `getSiteInfo` is omitted, `/info` returns this authenticated fallback:
+
+```json
+{
+  "js_scripts": "Disabled",
+  "version": "1.4.0",
+  "name": "Custom CMS",
+  "logo": "",
+  "categories": [],
+  "post_types": ["post"],
+  "tags": [],
+  "authors": []
+}
+```
+
+## Article discovery with `/postfilter`
+
+Implement `searchArticles` to expose published host content to Monok. The
+callback receives normalized values:
+
+```ts
+interface PostFilterQuery {
+  postType: string; // defaults to "post"
+  section?: string;
+  tag?: string;
+  query?: string;
+  amount: number;   // defaults to 10
+  page: number;     // defaults to 1
+}
+```
+
+Apply all supplied filters, return only published/public articles, and paginate
+deterministically. Return an array using these exact snake-case keys:
+
+```ts
+const result: PostFilterResult = {
+  canonical_url: "https://example.com/articles/example",
+  post_id: "cms-record-id",
+  title: "Example article",
+  description: "A short plain-text description"
+};
+```
+
+Return `[]` when nothing matches. `title` and `description` may be `null`.
+Do not return drafts, private content, article bodies, credentials, or internal
+metadata. If `searchArticles` is omitted, `/postfilter` returns `404`.
+
+## Authentication and cache behavior
+
+The router performs authentication. The host should not duplicate it inside
+callbacks.
+
+- `/push` accepts Monok's `token` header, `X-API-Key`, or legacy `?apikey=`.
+- `/info` and `/postfilter` accept `X-API-Key` or legacy `?apikey=`.
+- Comparisons are timing-safe.
+- `/info` and `/postfilter` responses include private no-cache headers.
+
+Keep `MONOK_API_KEY` server-side. Never expose it to browser JavaScript, commit
+it, include it in a URL shown to users, or log it. Prefer `X-API-Key` over query
+authentication for custom calls because URLs are commonly logged by proxies.
+
+## Linkback after publication
+
+When an article is actually published, notify Monok only after the public
+canonical URL exists. This applies both to a draft published later and to an
+asynchronous `action: "publish"` job:
+
+```ts
+await sendMonokLinkback({
+  monokId: storedMonokId,
+  externalId: cmsArticleId,
+  url: canonicalUrl,
+  title,
+  thumbnailUrl: publicThumbnailUrl
+}, {
+  apiKey: process.env.MONOK_API_KEY
+});
+```
+
+Call this from the host's real publication lifecycle, not merely when `/push`
+returns or when a job enters a queue. The linkback is the authoritative signal
+that publication completed and a canonical URL exists. A retry should be safe.
+When useful, `externalId` is the stable article ID assigned by the host CMS; it
+is optional because the canonical URL also identifies the publication. When
+supplied, `thumbnailUrl` is the public thumbnail URL.
+
+## Verification checklist
+
+Before declaring the integration complete, verify all applicable items:
+
+- `GET /api/monok/info` returns `401` without a key.
+- The same route succeeds with `X-API-Key` and with legacy `?apikey=`.
+- Info responses contain `Cache-Control: no-store`.
+- `POST /api/monok/push` accepts a body containing `action: "draft"`.
+- A body containing `action: "publish"` is durably persisted or queued with the
+  requested publication intent.
+- Successful pushes return `ok: true`, `status: "accepted"`, and the same
+  `monokId`, without requiring a canonical URL.
+- Repeating the same `article.id` updates one record instead of duplicating it.
+- Invalid action values return `400`.
+- JPEG data saves as `.jpg`, and invalid or oversized image data is rejected.
+- `/postfilter` applies search, type, section, tag, amount, and page filters.
+- `/postfilter` returns exact `canonical_url`, `post_id`, `title`, and
+  `description` fields.
+- Synchronous or asynchronous publication sends a linkback only after the public
+  canonical URL exists.
+- The integration is reachable through its production HTTPS reverse proxy.
+
+Do not claim completion based only on TypeScript compilation. Exercise the HTTP
+routes and confirm one durable draft or draft job, one publication or publication
+job, one repeated delivery, and one discovery query against the host
+application's persistence layer. For asynchronous publishing, also complete one
+job and verify its eventual linkback.

package/README.md

@@ -5,6 +5,9 @@
 Monok server integration helpers for Node.js/Express.
 Easily connect your backend to Monok to receive articles, expose site info, and send linkbacks.
 
+Using an AI coding assistant? Give it [`AGENTS.md`](./AGENTS.md). The guide contains
+the complete host-implementation contract, response shapes, and verification checklist.
+
 ---
 
 ## ⚡ Quick Start
@@ -16,7 +19,7 @@ import { createMonokRouter, type MonokArticle } from "@monok/server";
 const app = express();
 
 app.use(
-  "/monok",
+  "/api/monok",
   createMonokRouter({
     apiKey: process.env.MONOK_API_KEY!,
     onArticle: async (article: MonokArticle, { saveThumbImage, action }) => {
@@ -59,19 +62,21 @@ import {
 const app = express();
 
 app.use(
-  "/monok",
+  "/api/monok",
   createMonokRouter({
     apiKey: process.env.MONOK_API_KEY!,
     imageDir: "./uploads", // optional
     // Optional: provide site info if you want Monok to query it
     getSiteInfo: {
       js_scripts: "Enabled",
-      version: "1.0.0",
       name: "My Site",
       logo: "https://example.com/logo.png",
       categories: ["Content", "News Articles", "Uncategorized"],
       post_types: ["post", "page"],
       tags: ["Tech", "Health", "News"],
+      languages: {
+        en: { name: "English", slug: "en", locale: "en_US" }
+      },
       authors: [
         {
           name: "Jane Doe",
@@ -82,6 +87,15 @@ app.use(
         }
       ]
     },
+    searchArticles: async ({ postType, section, tag, query, amount, page }) => {
+      // Search published content in your CMS and return the requested page.
+      return [{
+        canonical_url: "https://example.com/blog/an-article",
+        post_id: "cms-123",
+        title: "An article",
+        description: "Article summary"
+      }];
+    },
     onArticle: async (article: MonokArticle, { saveThumbImage, action }) => {
       const imagePath = await saveThumbImage();
       console.log("Received article:", article.title);
@@ -95,9 +109,9 @@ app.use(
       // when you publish later, notify Monok:
       // await sendMonokLinkback({
       //   monokId: article.id,
-      //   publicUrl: "https://example.com/blog/" + (article.slug ?? article.id),
+      //   externalId: savedArticle.id,
+      //   url: "https://example.com/blog/" + (article.slug ?? article.id),
       //   title: article.title,
-      //   articleTextSample: article.text?.slice(0, 500),
       //   thumbnailUrl: imagePath
       //     ? "https://example.com/uploads/" + require("path").basename(imagePath)
       //     : undefined
@@ -118,7 +132,7 @@ const { createMonokRouter } = require("@monok/server");
 const app = express();
 
 app.use(
-  "/monok",
+  "/api/monok",
   createMonokRouter({
     apiKey: process.env.MONOK_API_KEY,
     onArticle: async (article, { saveThumbImage, action }) => {
@@ -141,29 +155,56 @@ app.listen(3000);
 
 ## 🔑 Endpoints
 
-* **`POST /monok/push[?action=draft|publish]`**
+Mounting the router at `/api/monok` uses Monok's default API base. A custom or
+versioned base is also supported, for example:
+
+```ts
+app.use("/something/specialAPI/monok", createMonokRouter({ /* ... */ }));
+```
+
+Enter that complete base URL when connecting the integration in Monok. Monok
+appends `/info`, `/push`, and `/postfilter` to the configured base.
+
+* **`POST /api/monok/push`**
   Monok pushes new article data here.
   Header: `token: <your-api-key>`
   Body: JSON payload of the article.
 
-  * `action` query param may be `draft` or `publish` depending on GUI dropdown selection.
+  * `action` is read from the JSON body and may be `draft` or `publish`.
+  * A legacy `?action=draft|publish` query parameter is also accepted.
+  * After `onArticle` durably saves or queues the work, the route acknowledges
+    it with `{ "ok": true, "status": "accepted", "monokId": "..." }`. This
+    does not claim that asynchronous publication has completed.
+
+* **`GET /api/monok/info`**
+  Monok fetches this to authenticate and learn your site branding, categories, tags, and authors.
+  If `getSiteInfo` is not provided, the route remains available and returns a
+  minimal `Custom CMS` response with empty metadata collections.
 
-* **`GET /monok/info?apikey=<your-api-key>`**
-  If `getSiteInfo` is configured, Monok fetches this to learn your site branding, categories, tags, and authors.
-  If `getSiteInfo` is not provided, this route responds with `404`.
+* **`GET /api/monok/postfilter`**
+  If `searchArticles` is configured, Monok uses this route to search published
+  content. Supported parameters are `post_type`, `section`, `tag`, `q`, `amount`,
+  and `page`. If it is not configured, the route responds with `404`.
+
+`GET /info` and `GET /postfilter` accept the API key in the `X-API-Key` header
+(preferred) or the legacy `?apikey=` query parameter. Their responses include
+private no-cache headers. `POST /push` also accepts Monok's `token` header.
 
 ---
 
 ## 🔗 Linkback after publishing
 
+The push acknowledgement confirms delivery only. If publication is asynchronous,
+send the linkback later, after the public canonical URL actually exists.
+
 ```ts
 import { sendMonokLinkback } from "@monok/server";
 
 await sendMonokLinkback({
   monokId: article.id,
-  publicUrl: "https://example.com/blog/" + (article.slug ?? article.id),
+  externalId: cmsArticle.id,
+  url: "https://example.com/blog/" + (article.slug ?? article.id),
   title: article.title,
-  articleTextSample: article.text?.slice(0, 500),
   thumbnailUrl: "https://example.com/uploads/" + imageFile
 });
 ```
@@ -176,8 +217,10 @@ await sendMonokLinkback({
 | ------------- | ----------------------------------------- | -------- | --------------------------------------------------------------------------------- |
 | `apiKey`      | `string`                                  | ✅        | Token Monok sends in headers / query.                                             |
 | `onArticle`   | `(article, ctx) => void \| Promise<void>` | ✅        | Handle new article pushes. `ctx` includes `saveThumbImage` and optional `action`. |
-| `getSiteInfo` | `SiteInfo \| () => SiteInfo`              | ❌        | Return site info in the Monok format. If omitted, `GET /info` responds 404.       |
-| `imageDir`    | `string`                                  | ❌        | Directory to save `thumbImageData`.                                               |
+| `getSiteInfo` | `SiteInfoInput \| () => SiteInfoInput`    | ❌        | Return host metadata; the router injects its package version. A minimal fallback is used when omitted. |
+| `searchArticles` | `(query) => PostFilterResult[]`       | ❌        | Enables authenticated article discovery through `GET /postfilter`.                |
+| `imageDir`    | `string`                                  | ❌        | Directory in which validated JPEG thumbnails are saved.                           |
+| `maxImageBytes` | `number`                               | ❌        | Maximum decoded JPEG size; defaults to 15 MiB.                                    |
 | `basePath`    | `string`                                  | ❌        | Custom prefix for routes (default "").                                            |
 
 ---

package/dist/client.d.ts

@@ -2,9 +2,8 @@ import type { LinkbackPayload } from "./types.js";
 /**
  * Send a linkback to Monok after you publish the article.
  */
-export declare function sendMonokLinkback({ monokId, publicUrl, title, articleTextSample, thumbnailUrl }: LinkbackPayload, opts?: {
+export declare function sendMonokLinkback({ monokId, externalId, url, title, thumbnailUrl }: LinkbackPayload, opts?: {
     monokBaseUrl?: string;
-    userId?: string;
     apiKey?: string;
 }): Promise<void>;
 //# sourceMappingURL=client.d.ts.map

package/dist/client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAElD;;GAEG;AACH,wBAAsB,iBAAiB,CACrC,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,iBAAsB,EAAE,YAAY,EAAE,EAAE,eAAe,EACpF,IAAI,CAAC,EAAE;IAAE,YAAY,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GACjE,OAAO,CAAC,IAAI,CAAC,CAwBf"}
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAElD;;GAEG;AACH,wBAAsB,iBAAiB,CACrC,EAAE,OAAO,EAAE,UAAU,EAAE,GAAG,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE,eAAe,EAClE,IAAI,CAAC,EAAE;IAAE,YAAY,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GAChD,OAAO,CAAC,IAAI,CAAC,CA0Bf"}

package/dist/client.js

@@ -2,14 +2,16 @@ import fetch from "node-fetch";
 /**
  * Send a linkback to Monok after you publish the article.
  */
-export async function sendMonokLinkback({ monokId, publicUrl, title, articleTextSample = "", thumbnailUrl }, opts) {
+export async function sendMonokLinkback({ monokId, externalId, url, title, thumbnailUrl }, opts) {
     const endpoint = (opts?.monokBaseUrl ?? "https://www.monok.com") + "/api/v1/linkback";
     const payload = {
-        puff: { title, article: articleTextSample },
+        puff: { title },
         id: monokId,
-        url: publicUrl,
-        source: new URL(publicUrl).hostname,
-        userId: opts?.userId ?? new URL(publicUrl).hostname + "-CUSTOM",
+        ...(externalId !== undefined && externalId !== null
+            ? { externalId: String(externalId) }
+            : {}),
+        url,
+        source: new URL(url).hostname,
         ...(thumbnailUrl ? { thumbnail: thumbnailUrl } : {})
     };
     const resp = await fetch(endpoint, {

package/dist/client.js.map

@@ -1 +1 @@
-{"version":3,"file":"client.js","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,YAAY,CAAC;AAG/B;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,iBAAiB,GAAG,EAAE,EAAE,YAAY,EAAmB,EACpF,IAAkE;IAElE,MAAM,QAAQ,GAAG,CAAC,IAAI,EAAE,YAAY,IAAI,uBAAuB,CAAC,GAAG,kBAAkB,CAAC;IACtF,MAAM,OAAO,GAAG;QACd,IAAI,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,iBAAiB,EAAE;QAC3C,EAAE,EAAE,OAAO;QACX,GAAG,EAAE,SAAS;QACd,MAAM,EAAE,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC,QAAQ;QACnC,MAAM,EAAE,IAAI,EAAE,MAAM,IAAI,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC,QAAQ,GAAG,SAAS;QAC/D,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACrD,CAAC;IAEF,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,QAAQ,EAAE;QACjC,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,cAAc,EAAE,kBAAkB;YAClC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACtD;QACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;KAC9B,CAAC,CAAC;IAEH,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;QACb,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;QAC/C,MAAM,IAAI,KAAK,CAAC,0BAA0B,IAAI,CAAC,MAAM,IAAI,IAAI,EAAE,CAAC,CAAC;IACnE,CAAC;AACH,CAAC"}
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,YAAY,CAAC;AAG/B;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,EAAE,OAAO,EAAE,UAAU,EAAE,GAAG,EAAE,KAAK,EAAE,YAAY,EAAmB,EAClE,IAAiD;IAEjD,MAAM,QAAQ,GAAG,CAAC,IAAI,EAAE,YAAY,IAAI,uBAAuB,CAAC,GAAG,kBAAkB,CAAC;IACtF,MAAM,OAAO,GAAG;QACd,IAAI,EAAE,EAAE,KAAK,EAAE;QACf,EAAE,EAAE,OAAO;QACX,GAAG,CAAC,UAAU,KAAK,SAAS,IAAI,UAAU,KAAK,IAAI;YACjD,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,CAAC,EAAE;YACpC,CAAC,CAAC,EAAE,CAAC;QACP,GAAG;QACH,MAAM,EAAE,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ;QAC7B,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACrD,CAAC;IAEF,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,QAAQ,EAAE;QACjC,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,cAAc,EAAE,kBAAkB;YAClC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACtD;QACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;KAC9B,CAAC,CAAC;IAEH,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;QACb,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;QAC/C,MAAM,IAAI,KAAK,CAAC,0BAA0B,IAAI,CAAC,MAAM,IAAI,IAAI,EAAE,CAAC,CAAC;IACnE,CAAC;AACH,CAAC"}

package/dist/express.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"express.d.ts","sourceRoot":"","sources":["../src/express.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAwD,MAAM,SAAS,CAAC;AACvF,OAAO,KAAK,EAAE,mBAAmB,EAA0B,MAAM,YAAY,CAAC;AAG9E,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,mBAAmB,GAAG,MAAM,CAgDnE"}
+{"version":3,"file":"express.d.ts","sourceRoot":"","sources":["../src/express.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAwD,MAAM,SAAS,CAAC;AAEvF,OAAO,KAAK,EACV,mBAAmB,EAKpB,MAAM,YAAY,CAAC;AAKpB,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,mBAAmB,GAAG,MAAM,CAmFnE"}

package/dist/express.js

@@ -1,5 +1,7 @@
 import { Router, json } from "express";
+import { readFileSync } from "node:fs";
 import { assertApiKey, makeThumbSaver } from "./utils.js";
+const PACKAGE_VERSION = readPackageVersion();
 export function createMonokRouter(opts) {
     const r = Router();
     const base = opts.basePath ?? "";
@@ -7,34 +9,132 @@ export function createMonokRouter(opts) {
     r.use(json({ limit: "20mb" }));
     // POST /push
     r.post(base + "/push", wrap(async (req, res) => {
-        assertApiKey(req.header("token"), opts.apiKey);
+        assertRequestApiKey(req, opts.apiKey, true);
         const body = req.body;
-        if (!body?.id || !body?.title) {
+        if (body?.id === undefined
+            || body.id === null
+            || (typeof body.id === "string" && body.id.trim() === "")
+            || typeof body.title !== "string"
+            || body.title.trim() === "") {
             return res.status(400).json({ error: "Invalid payload" });
         }
-        // read optional ?action=draft|publish
-        const action = req.query.action;
-        const saver = makeThumbSaver(opts.imageDir);
+        // Monok's API integration sends action in the body. Retain query support
+        // for older callers and give an explicit query value precedence.
+        const action = parseAction(firstQueryValue(req.query.action) ?? body.action);
+        const saver = makeThumbSaver(opts.imageDir, opts.maxImageBytes);
         await Promise.resolve(opts.onArticle(body, {
-            saveThumbImage: async (fileNameBase) => saver(fileNameBase ?? body.slug ?? body.id, body.thumbImageData),
+            saveThumbImage: async (fileNameBase) => saver(fileNameBase ?? body.slug ?? String(body.id), body.thumbImageData),
             action
         }));
-        res.json({ ok: true, monokId: body.id });
+        res.json({ ok: true, status: "accepted", monokId: body.id });
     }));
     // GET /info
     r.get(base + "/info", wrap(async (req, res) => {
-        if (!opts.getSiteInfo) {
-            return res.status(404).json({ error: "Site info not configured" });
-        }
-        const apikey = req.query.apikey;
-        assertApiKey(apikey, opts.apiKey);
-        const info = typeof opts.getSiteInfo === "function"
-            ? await Promise.resolve(opts.getSiteInfo())
-            : opts.getSiteInfo;
+        setPrivateNoCacheHeaders(res);
+        assertRequestApiKey(req, opts.apiKey);
+        const configuredInfo = !opts.getSiteInfo
+            ? undefined
+            : typeof opts.getSiteInfo === "function"
+                ? await Promise.resolve(opts.getSiteInfo())
+                : opts.getSiteInfo;
+        const info = configuredInfo
+            ? { ...configuredInfo, version: PACKAGE_VERSION }
+            : defaultSiteInfo();
         res.json(info);
     }));
+    // GET /postfilter
+    r.get(base + "/postfilter", wrap(async (req, res) => {
+        setPrivateNoCacheHeaders(res);
+        if (!opts.searchArticles) {
+            return res.status(404).json({ error: "Article search not configured" });
+        }
+        assertRequestApiKey(req, opts.apiKey);
+        const amount = parsePositiveInteger(firstQueryValue(req.query.amount), 10, "amount");
+        const page = parsePositiveInteger(firstQueryValue(req.query.page), 1, "page");
+        const query = {
+            postType: firstQueryValue(req.query.post_type)?.trim() || "post",
+            amount,
+            page,
+            ...optionalTrimmed("section", firstQueryValue(req.query.section)),
+            ...optionalTrimmed("tag", firstQueryValue(req.query.tag)),
+            ...optionalTrimmed("query", firstQueryValue(req.query.q))
+        };
+        const articles = await Promise.resolve(opts.searchArticles(query));
+        if (!Array.isArray(articles)) {
+            throw httpError(500, "searchArticles must return an array");
+        }
+        res.json(articles);
+    }));
     return r;
 }
+function assertRequestApiKey(req, expected, allowToken = false) {
+    const provided = ((allowToken ? req.header("token") : undefined)
+        ?? req.header("x-api-key")
+        ?? firstQueryValue(req.query.apikey));
+    assertApiKey(provided, expected);
+}
+function parseAction(value) {
+    if (value === undefined || value === null || value === "")
+        return undefined;
+    if (value === "draft" || value === "publish")
+        return value;
+    throw httpError(400, "action must be either draft or publish");
+}
+function parsePositiveInteger(value, fallback, name) {
+    if (value === undefined || value === "")
+        return fallback;
+    if (!/^\d+$/.test(value))
+        throw httpError(400, `${name} must be a positive integer`);
+    const parsed = Number(value);
+    if (!Number.isSafeInteger(parsed) || parsed < 1) {
+        throw httpError(400, `${name} must be a positive integer`);
+    }
+    return parsed;
+}
+function firstQueryValue(value) {
+    if (typeof value === "string")
+        return value;
+    if (Array.isArray(value) && typeof value[0] === "string")
+        return value[0];
+    return undefined;
+}
+function optionalTrimmed(key, value) {
+    const trimmed = value?.trim();
+    return trimmed ? { [key]: trimmed } : {};
+}
+function setPrivateNoCacheHeaders(res) {
+    res.set({
+        "Cache-Control": "no-store, no-cache, must-revalidate, max-age=0, private",
+        "Pragma": "no-cache",
+        "Expires": "0",
+        "Surrogate-Control": "no-store",
+        "Vary": "Accept-Encoding"
+    });
+}
+function defaultSiteInfo() {
+    return {
+        js_scripts: "Disabled",
+        version: PACKAGE_VERSION,
+        name: "Custom CMS",
+        logo: "",
+        categories: [],
+        post_types: ["post"],
+        tags: [],
+        authors: []
+    };
+}
+function readPackageVersion() {
+    const packageJson = JSON.parse(readFileSync(new URL("../package.json", import.meta.url), "utf8"));
+    if (typeof packageJson.version !== "string" || packageJson.version.length === 0) {
+        throw new Error("@monok/server package version is missing");
+    }
+    return packageJson.version;
+}
+function httpError(status, message) {
+    const error = new Error(message);
+    error.status = status;
+    return error;
+}
 function wrap(fn) {
     return (req, res, next) => fn(req, res, next).catch((err) => {
         const status = typeof err?.status === "number" ? err.status : 500;

package/dist/express.js.map

@@ -1 +1 @@
-{"version":3,"file":"express.js","sourceRoot":"","sources":["../src/express.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,IAAI,EAAkD,MAAM,SAAS,CAAC;AAEvF,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAE1D,MAAM,UAAU,iBAAiB,CAAC,IAAyB;IACzD,MAAM,CAAC,GAAG,MAAM,EAAE,CAAC;IACnB,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC;IAEjC,kEAAkE;IAClE,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;IAE/B,aAAa;IACb,CAAC,CAAC,IAAI,CAAC,IAAI,GAAG,OAAO,EAAE,IAAI,CAAC,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;QAChE,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QAE/C,MAAM,IAAI,GAAG,GAAG,CAAC,IAAoB,CAAC;QACtC,IAAI,CAAC,IAAI,EAAE,EAAE,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC;YAC9B,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAC;QAC5D,CAAC;QAED,sCAAsC;QACtC,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,MAAyC,CAAC;QAEnE,MAAM,KAAK,GAAG,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC5C,MAAM,OAAO,CAAC,OAAO,CACnB,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE;YACnB,cAAc,EAAE,KAAK,EAAE,YAAqB,EAAE,EAAE,CAC9C,KAAK,CAAC,YAAY,IAAI,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,cAAc,CAAC;YAClE,MAAM;SACP,CAAC,CACH,CAAC;QAEF,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC,CAAC;IAEJ,YAAY;IACZ,CAAC,CAAC,GAAG,CAAC,IAAI,GAAG,OAAO,EAAE,IAAI,CAAC,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;QAC/D,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YACtB,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,0BAA0B,EAAE,CAAC,CAAC;QACrE,CAAC;QAED,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,MAA4B,CAAC;QACtD,YAAY,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QAElC,MAAM,IAAI,GAAa,OAAO,IAAI,CAAC,WAAW,KAAK,UAAU;YAC3D,CAAC,CAAC,MAAM,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YAC3C,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC;QAErB,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACjB,CAAC,CAAC,CAAC,CAAC;IAEJ,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,IAAI,CACX,EAAyE;IAEzE,OAAO,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE,CACzD,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,GAAQ,EAAE,EAAE;QACpC,MAAM,MAAM,GAAG,OAAO,GAAG,EAAE,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC;QAClE,IAAI,MAAM,IAAI,GAAG;YAAE,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACtC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,IAAI,cAAc,EAAE,CAAC,CAAC;IACrE,CAAC,CAAC,CAAC;AACP,CAAC"}
+{"version":3,"file":"express.js","sourceRoot":"","sources":["../src/express.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,IAAI,EAAkD,MAAM,SAAS,CAAC;AACvF,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAQvC,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAE1D,MAAM,eAAe,GAAG,kBAAkB,EAAE,CAAC;AAE7C,MAAM,UAAU,iBAAiB,CAAC,IAAyB;IACzD,MAAM,CAAC,GAAG,MAAM,EAAE,CAAC;IACnB,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC;IAEjC,kEAAkE;IAClE,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;IAE/B,aAAa;IACb,CAAC,CAAC,IAAI,CAAC,IAAI,GAAG,OAAO,EAAE,IAAI,CAAC,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;QAChE,mBAAmB,CAAC,GAAG,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAE5C,MAAM,IAAI,GAAG,GAAG,CAAC,IAAoB,CAAC;QACtC,IACE,IAAI,EAAE,EAAE,KAAK,SAAS;eACnB,IAAI,CAAC,EAAE,KAAK,IAAI;eAChB,CAAC,OAAO,IAAI,CAAC,EAAE,KAAK,QAAQ,IAAI,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC;eACtD,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ;eAC9B,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,EAC3B,CAAC;YACD,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAC;QAC5D,CAAC;QAED,yEAAyE;QACzE,iEAAiE;QACjE,MAAM,MAAM,GAAG,WAAW,CAAC,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC;QAE7E,MAAM,KAAK,GAAG,cAAc,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC;QAChE,MAAM,OAAO,CAAC,OAAO,CACnB,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE;YACnB,cAAc,EAAE,KAAK,EAAE,YAAqB,EAAE,EAAE,CAC9C,KAAK,CAAC,YAAY,IAAI,IAAI,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,IAAI,CAAC,cAAc,CAAC;YAC1E,MAAM;SACP,CAAC,CACH,CAAC;QAEF,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;IAC/D,CAAC,CAAC,CAAC,CAAC;IAEJ,YAAY;IACZ,CAAC,CAAC,GAAG,CAAC,IAAI,GAAG,OAAO,EAAE,IAAI,CAAC,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;QAC/D,wBAAwB,CAAC,GAAG,CAAC,CAAC;QAC9B,mBAAmB,CAAC,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QAEtC,MAAM,cAAc,GAAG,CAAC,IAAI,CAAC,WAAW;YACtC,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,OAAO,IAAI,CAAC,WAAW,KAAK,UAAU;gBACtC,CAAC,CAAC,MAAM,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;gBAC3C,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC;QACvB,MAAM,IAAI,GAAa,cAAc;YACnC,CAAC,CAAC,EAAE,GAAG,cAAc,EAAE,OAAO,EAAE,eAAe,EAAE;YACjD,CAAC,CAAC,eAAe,EAAE,CAAC;QAEtB,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACjB,CAAC,CAAC,CAAC,CAAC;IAEJ,kBAAkB;IAClB,CAAC,CAAC,GAAG,CAAC,IAAI,GAAG,aAAa,EAAE,IAAI,CAAC,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;QACrE,wBAAwB,CAAC,GAAG,CAAC,CAAC;QAC9B,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;YACzB,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,+BAA+B,EAAE,CAAC,CAAC;QAC1E,CAAC;QAED,mBAAmB,CAAC,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QAEtC,MAAM,MAAM,GAAG,oBAAoB,CAAC,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,QAAQ,CAAC,CAAC;QACrF,MAAM,IAAI,GAAG,oBAAoB,CAAC,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC;QAC9E,MAAM,KAAK,GAAoB;YAC7B,QAAQ,EAAE,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,IAAI,MAAM;YAChE,MAAM;YACN,IAAI;YACJ,GAAG,eAAe,CAAC,SAAS,EAAE,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACjE,GAAG,eAAe,CAAC,KAAK,EAAE,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACzD,GAAG,eAAe,CAAC,OAAO,EAAE,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;SAC1D,CAAC;QAEF,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC;QACnE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC7B,MAAM,SAAS,CAAC,GAAG,EAAE,qCAAqC,CAAC,CAAC;QAC9D,CAAC;QACD,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACrB,CAAC,CAAC,CAAC,CAAC;IAEJ,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,mBAAmB,CAAC,GAAY,EAAE,QAAgB,EAAE,UAAU,GAAG,KAAK;IAC7E,MAAM,QAAQ,GAAG,CACf,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;WAC3C,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC;WACvB,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CACrC,CAAC;IACF,YAAY,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;AACnC,CAAC;AAED,SAAS,WAAW,CAAC,KAAc;IACjC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,EAAE;QAAE,OAAO,SAAS,CAAC;IAC5E,IAAI,KAAK,KAAK,OAAO,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAC3D,MAAM,SAAS,CAAC,GAAG,EAAE,wCAAwC,CAAC,CAAC;AACjE,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAyB,EAAE,QAAgB,EAAE,IAAY;IACrF,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE;QAAE,OAAO,QAAQ,CAAC;IACzD,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,MAAM,SAAS,CAAC,GAAG,EAAE,GAAG,IAAI,6BAA6B,CAAC,CAAC;IACrF,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC7B,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC,EAAE,CAAC;QAChD,MAAM,SAAS,CAAC,GAAG,EAAE,GAAG,IAAI,6BAA6B,CAAC,CAAC;IAC7D,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,eAAe,CAAC,KAAc;IACrC,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5C,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC;IAC1E,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,eAAe,CAAqB,GAAQ,EAAE,KAAc;IACnE,MAAM,OAAO,GAAG,KAAK,EAAE,IAAI,EAAE,CAAC;IAC9B,OAAO,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,OAAO,EAAyB,CAAC,CAAC,CAAC,EAAE,CAAC;AAClE,CAAC;AAED,SAAS,wBAAwB,CAAC,GAAa;IAC7C,GAAG,CAAC,GAAG,CAAC;QACN,eAAe,EAAE,yDAAyD;QAC1E,QAAQ,EAAE,UAAU;QACpB,SAAS,EAAE,GAAG;QACd,mBAAmB,EAAE,UAAU;QAC/B,MAAM,EAAE,iBAAiB;KAC1B,CAAC,CAAC;AACL,CAAC;AAED,SAAS,eAAe;IACtB,OAAO;QACL,UAAU,EAAE,UAAU;QACtB,OAAO,EAAE,eAAe;QACxB,IAAI,EAAE,YAAY;QAClB,IAAI,EAAE,EAAE;QACR,UAAU,EAAE,EAAE;QACd,UAAU,EAAE,CAAC,MAAM,CAAC;QACpB,IAAI,EAAE,EAAE;QACR,OAAO,EAAE,EAAE;KACZ,CAAC;AACJ,CAAC;AAED,SAAS,kBAAkB;IACzB,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAC5B,YAAY,CAAC,IAAI,GAAG,CAAC,iBAAiB,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,CACzC,CAAC;IAE3B,IAAI,OAAO,WAAW,CAAC,OAAO,KAAK,QAAQ,IAAI,WAAW,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChF,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IAC9D,CAAC;IACD,OAAO,WAAW,CAAC,OAAO,CAAC;AAC7B,CAAC;AAED,SAAS,SAAS,CAAC,MAAc,EAAE,OAAe;IAChD,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,OAAO,CAA+B,CAAC;IAC/D,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC;IACtB,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,IAAI,CACX,EAAyE;IAEzE,OAAO,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE,CACzD,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,GAAQ,EAAE,EAAE;QACpC,MAAM,MAAM,GAAG,OAAO,GAAG,EAAE,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC;QAClE,IAAI,MAAM,IAAI,GAAG;YAAE,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACtC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,IAAI,cAAc,EAAE,CAAC,CAAC;IACrE,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/types.d.ts

@@ -1,4 +1,15 @@
 export type VFImage = Record<string, unknown>;
+export type MonokArticleId = string | number;
+export type MonokArticleAction = "draft" | "publish";
+export interface MonokArticleAuthor {
+    id: string | number;
+    name: string;
+}
+export interface MonokArticleCategory {
+    name: string;
+    weight?: number;
+    [key: string]: unknown;
+}
 export interface MonokArticle {
     title: string;
     shortTitle?: string;
@@ -6,15 +17,21 @@ export interface MonokArticle {
     content?: string;
     text?: string;
     slug?: string;
-    id: string;
+    id: MonokArticleId;
+    action?: MonokArticleAction;
+    author?: MonokArticleAuthor;
+    categories?: MonokArticleCategory[];
+    thumbnail?: string;
     thumbImageData?: string;
+    thumbAlt?: string;
     thumbImageDescription?: string;
     language?: string;
-    type?: "blog" | "news";
+    type?: string;
     keywords?: string[];
-    tags?: string[];
+    tags?: string[] | null;
     vfImage?: VFImage;
-    sections?: string;
+    sections?: string[];
+    [key: string]: unknown;
 }
 export interface SiteAuthor {
     name: string;
@@ -23,24 +40,53 @@ export interface SiteAuthor {
     avatar: string;
     roles: string[];
 }
-/**
- * Exact shape Monok expects from GET /info
- */
-export interface SiteInfo {
+export interface SiteLanguage {
+    id?: string | number;
+    name?: string;
+    slug?: string;
+    locale?: string;
+    [key: string]: unknown;
+}
+export type SiteLanguages = SiteLanguage[] | Record<string, SiteLanguage>;
+interface SiteInfoFields {
     js_scripts: "Enabled" | "Disabled";
-    version: string;
     name: string;
     logo: string;
     categories: string[];
     post_types: string[];
     tags: string[];
     authors: SiteAuthor[];
+    languages?: SiteLanguages;
+    [key: string]: unknown;
+}
+/** Site metadata supplied by the host. The router owns the package version. */
+export interface SiteInfoInput extends SiteInfoFields {
+    version?: never;
+}
+/** Exact response shape Monok receives from GET /info. */
+export interface SiteInfo extends SiteInfoFields {
+    version: string;
+}
+export interface PostFilterQuery {
+    postType: string;
+    section?: string;
+    tag?: string;
+    query?: string;
+    amount: number;
+    page: number;
+}
+/** Exact result shape consumed by Monok's covered-article and link search. */
+export interface PostFilterResult {
+    canonical_url: string;
+    post_id: string | number;
+    title: string | null;
+    description: string | null;
 }
 export interface LinkbackPayload {
-    monokId: string;
-    publicUrl: string;
+    monokId: MonokArticleId;
+    externalId?: string | number;
+    url: string;
     title: string;
-    articleTextSample?: string;
     thumbnailUrl?: string;
 }
 export interface CreateRouterOptions {
@@ -53,19 +99,28 @@ export interface CreateRouterOptions {
      */
     onArticle: (article: MonokArticle, ctx: {
         saveThumbImage: (fileNameBase?: string) => Promise<string | undefined>;
-        action?: "draft" | "publish" | undefined;
+        action?: MonokArticleAction | undefined;
     }) => Promise<void> | void;
     /**
-     * Optional. If not provided, GET /info will respond with 404.
+     * Optional. If omitted, GET /info returns a minimal Custom CMS fallback.
      */
-    getSiteInfo?: SiteInfo | (() => Promise<SiteInfo> | SiteInfo);
+    getSiteInfo?: SiteInfoInput | (() => Promise<SiteInfoInput> | SiteInfoInput);
+    /**
+     * Optional. Enables GET /postfilter for article discovery and search.
+     */
+    searchArticles?: (query: PostFilterQuery) => Promise<PostFilterResult[]> | PostFilterResult[];
     /**
      * Directory where a decoded `thumbImageData` will be saved if present.
      */
     imageDir?: string;
+    /**
+     * Maximum decoded JPEG size. Defaults to 15 MiB.
+     */
+    maxImageBytes?: number;
     /**
      * Customize route base path (defaults to "").
      */
     basePath?: string;
 }
+export {};
 //# sourceMappingURL=types.d.ts.map

package/dist/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAE9C,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,EAAE,EAAE,MAAM,CAAC;IACX,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACvB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB;AAED;;GAEG;AACH,MAAM,WAAW,QAAQ;IACvB,UAAU,EAAE,SAAS,GAAG,UAAU,CAAC;IACnC,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,OAAO,EAAE,UAAU,EAAE,CAAC;CACvB;AAED,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,mBAAmB;IAClC;;OAEG;IACH,MAAM,EAAE,MAAM,CAAC;IAEf;;OAEG;IACH,SAAS,EAAE,CACT,OAAO,EAAE,YAAY,EACrB,GAAG,EAAE;QACH,cAAc,EAAE,CAAC,YAAY,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;QACvE,MAAM,CAAC,EAAE,OAAO,GAAG,SAAS,GAAG,SAAS,CAAC;KAC1C,KACE,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IAE1B;;OAEG;IACH,WAAW,CAAC,EAAE,QAAQ,GAAG,CAAC,MAAM,OAAO,CAAC,QAAQ,CAAC,GAAG,QAAQ,CAAC,CAAC;IAE9D;;OAEG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB;;OAEG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAE9C,MAAM,MAAM,cAAc,GAAG,MAAM,GAAG,MAAM,CAAC;AAC7C,MAAM,MAAM,kBAAkB,GAAG,OAAO,GAAG,SAAS,CAAC;AAErD,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,MAAM,GAAG,MAAM,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,EAAE,EAAE,cAAc,CAAC;IACnB,MAAM,CAAC,EAAE,kBAAkB,CAAC;IAC5B,MAAM,CAAC,EAAE,kBAAkB,CAAC;IAC5B,UAAU,CAAC,EAAE,oBAAoB,EAAE,CAAC;IACpC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,IAAI,CAAC,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IACvB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB;AAED,MAAM,WAAW,YAAY;IAC3B,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACrB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,MAAM,MAAM,aAAa,GAAG,YAAY,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;AAE1E,UAAU,cAAc;IACtB,UAAU,EAAE,SAAS,GAAG,UAAU,CAAC;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,OAAO,EAAE,UAAU,EAAE,CAAC;IACtB,SAAS,CAAC,EAAE,aAAa,CAAC;IAC1B,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,+EAA+E;AAC/E,MAAM,WAAW,aAAc,SAAQ,cAAc;IACnD,OAAO,CAAC,EAAE,KAAK,CAAC;CACjB;AAED,0DAA0D;AAC1D,MAAM,WAAW,QAAS,SAAQ,cAAc;IAC9C,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;CACd;AAED,8EAA8E;AAC9E,MAAM,WAAW,gBAAgB;IAC/B,aAAa,EAAE,MAAM,CAAC;IACtB,OAAO,EAAE,MAAM,GAAG,MAAM,CAAC;IACzB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B;AAED,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,cAAc,CAAC;IACxB,UAAU,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IAC7B,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,mBAAmB;IAClC;;OAEG;IACH,MAAM,EAAE,MAAM,CAAC;IAEf;;OAEG;IACH,SAAS,EAAE,CACT,OAAO,EAAE,YAAY,EACrB,GAAG,EAAE;QACH,cAAc,EAAE,CAAC,YAAY,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;QACvE,MAAM,CAAC,EAAE,kBAAkB,GAAG,SAAS,CAAC;KACzC,KACE,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IAE1B;;OAEG;IACH,WAAW,CAAC,EAAE,aAAa,GAAG,CAAC,MAAM,OAAO,CAAC,aAAa,CAAC,GAAG,aAAa,CAAC,CAAC;IAE7E;;OAEG;IACH,cAAc,CAAC,EAAE,CACf,KAAK,EAAE,eAAe,KACnB,OAAO,CAAC,gBAAgB,EAAE,CAAC,GAAG,gBAAgB,EAAE,CAAC;IAEtD;;OAEG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB;;OAEG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IAEvB;;OAEG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB"}

package/dist/utils.d.ts

@@ -1,4 +1,4 @@
 export declare function timingSafeEqual(a: string, b: string): boolean;
 export declare function assertApiKey(headerValue: string | undefined, expected: string): void;
-export declare function makeThumbSaver(imageDir?: string): (base?: string, data?: string) => Promise<string | undefined>;
+export declare function makeThumbSaver(imageDir?: string, maxImageBytes?: number): (base?: string, data?: string) => Promise<string | undefined>;
 //# sourceMappingURL=utils.d.ts.map

package/dist/utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"utils.d.ts","sourceRoot":"","sources":["../src/utils.ts"],"names":[],"mappings":"AAIA,wBAAgB,eAAe,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,OAAO,CAK7D;AAED,wBAAgB,YAAY,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,EAAE,QAAQ,EAAE,MAAM,GAAG,IAAI,CAOpF;AAED,wBAAgB,cAAc,CAAC,QAAQ,CAAC,EAAE,MAAM,IAChC,OAAO,MAAM,EAAE,OAAO,MAAM,KAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAUzE"}
+{"version":3,"file":"utils.d.ts","sourceRoot":"","sources":["../src/utils.ts"],"names":[],"mappings":"AAMA,wBAAgB,eAAe,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,OAAO,CAK7D;AAED,wBAAgB,YAAY,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,EAAE,QAAQ,EAAE,MAAM,GAAG,IAAI,CASpF;AAED,wBAAgB,cAAc,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,aAAa,SAA0B,IACzE,OAAO,MAAM,EAAE,OAAO,MAAM,KAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CA4BzE"}

package/dist/utils.js

@@ -1,6 +1,7 @@
 import crypto from "crypto";
 import path from "path";
 import fs from "fs/promises";
+const DEFAULT_MAX_IMAGE_BYTES = 15 * 1024 * 1024;
 export function timingSafeEqual(a, b) {
     const abuf = Buffer.from(a);
     const bbuf = Buffer.from(b);
@@ -9,24 +10,59 @@ export function timingSafeEqual(a, b) {
     return crypto.timingSafeEqual(abuf, bbuf);
 }
 export function assertApiKey(headerValue, expected) {
-    if (!headerValue || !timingSafeEqual(headerValue, expected)) {
+    const candidate = headerValue?.trim();
+    const configured = expected.trim();
+    if (!candidate || !configured || !timingSafeEqual(candidate, configured)) {
         const err = new Error("Unauthorized");
         // @ts-expect-error custom status
         err.status = 401;
         throw err;
     }
 }
-export function makeThumbSaver(imageDir) {
+export function makeThumbSaver(imageDir, maxImageBytes = DEFAULT_MAX_IMAGE_BYTES) {
     return async (base, data) => {
         if (!imageDir || !data)
             return undefined;
-        const bytes = Buffer.from(data, "base64");
+        if (!Number.isSafeInteger(maxImageBytes) || maxImageBytes <= 0) {
+            throw httpError(500, "maxImageBytes must be a positive safe integer");
+        }
+        const encoded = normalizeJpegBase64(data);
+        const estimatedBytes = Math.floor((encoded.length * 3) / 4);
+        if (estimatedBytes > maxImageBytes) {
+            throw httpError(413, `Thumbnail exceeds the ${maxImageBytes}-byte limit`);
+        }
+        const bytes = Buffer.from(encoded, "base64");
+        if (bytes.length === 0 || bytes.length > maxImageBytes) {
+            throw httpError(413, `Thumbnail exceeds the ${maxImageBytes}-byte limit`);
+        }
+        if (bytes.length < 3 || bytes[0] !== 0xff || bytes[1] !== 0xd8 || bytes[2] !== 0xff) {
+            throw httpError(400, "thumbImageData is not a valid JPEG image");
+        }
         const safeName = (base || crypto.randomUUID()).replace(/[^a-zA-Z0-9-_]/g, "_");
-        const fileName = `${safeName}.png`;
+        const fileName = `${safeName}.jpg`;
         await fs.mkdir(imageDir, { recursive: true });
         const full = path.join(imageDir, fileName);
         await fs.writeFile(full, bytes);
         return full;
     };
 }
+function normalizeJpegBase64(data) {
+    const trimmed = data.trim();
+    const dataUrl = /^data:image\/(?:jpeg|jpg);base64,/i;
+    if (/^data:/i.test(trimmed) && !dataUrl.test(trimmed)) {
+        throw httpError(400, "thumbImageData must be a JPEG data URL");
+    }
+    const encoded = trimmed.replace(dataUrl, "").replace(/\s+/g, "");
+    if (encoded.length === 0
+        || encoded.length % 4 === 1
+        || !/^[A-Za-z0-9+/]*={0,2}$/.test(encoded)) {
+        throw httpError(400, "thumbImageData is not valid base64");
+    }
+    return encoded;
+}
+function httpError(status, message) {
+    const error = new Error(message);
+    error.status = status;
+    return error;
+}
 //# sourceMappingURL=utils.js.map

package/dist/utils.js.map

@@ -1 +1 @@
-{"version":3,"file":"utils.js","sourceRoot":"","sources":["../src/utils.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,QAAQ,CAAC;AAC5B,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,EAAE,MAAM,aAAa,CAAC;AAE7B,MAAM,UAAU,eAAe,CAAC,CAAS,EAAE,CAAS;IAClD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC5B,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC5B,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC9C,OAAO,MAAM,CAAC,eAAe,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;AAC5C,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,WAA+B,EAAE,QAAgB;IAC5E,IAAI,CAAC,WAAW,IAAI,CAAC,eAAe,CAAC,WAAW,EAAE,QAAQ,CAAC,EAAE,CAAC;QAC5D,MAAM,GAAG,GAAG,IAAI,KAAK,CAAC,cAAc,CAAC,CAAC;QACtC,iCAAiC;QACjC,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;QACjB,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,QAAiB;IAC9C,OAAO,KAAK,EAAE,IAAa,EAAE,IAAa,EAA+B,EAAE;QACzE,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI;YAAE,OAAO,SAAS,CAAC;QACzC,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QAC1C,MAAM,QAAQ,GAAG,CAAC,IAAI,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,OAAO,CAAC,iBAAiB,EAAE,GAAG,CAAC,CAAC;QAC/E,MAAM,QAAQ,GAAG,GAAG,QAAQ,MAAM,CAAC;QACnC,MAAM,EAAE,CAAC,KAAK,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9C,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QAC3C,MAAM,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAChC,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"utils.js","sourceRoot":"","sources":["../src/utils.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,QAAQ,CAAC;AAC5B,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,EAAE,MAAM,aAAa,CAAC;AAE7B,MAAM,uBAAuB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAEjD,MAAM,UAAU,eAAe,CAAC,CAAS,EAAE,CAAS;IAClD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC5B,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC5B,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC9C,OAAO,MAAM,CAAC,eAAe,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;AAC5C,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,WAA+B,EAAE,QAAgB;IAC5E,MAAM,SAAS,GAAG,WAAW,EAAE,IAAI,EAAE,CAAC;IACtC,MAAM,UAAU,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC;IACnC,IAAI,CAAC,SAAS,IAAI,CAAC,UAAU,IAAI,CAAC,eAAe,CAAC,SAAS,EAAE,UAAU,CAAC,EAAE,CAAC;QACzE,MAAM,GAAG,GAAG,IAAI,KAAK,CAAC,cAAc,CAAC,CAAC;QACtC,iCAAiC;QACjC,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;QACjB,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,QAAiB,EAAE,aAAa,GAAG,uBAAuB;IACvF,OAAO,KAAK,EAAE,IAAa,EAAE,IAAa,EAA+B,EAAE;QACzE,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI;YAAE,OAAO,SAAS,CAAC;QAEzC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,aAAa,CAAC,IAAI,aAAa,IAAI,CAAC,EAAE,CAAC;YAC/D,MAAM,SAAS,CAAC,GAAG,EAAE,+CAA+C,CAAC,CAAC;QACxE,CAAC;QAED,MAAM,OAAO,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;QAC1C,MAAM,cAAc,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QAC5D,IAAI,cAAc,GAAG,aAAa,EAAE,CAAC;YACnC,MAAM,SAAS,CAAC,GAAG,EAAE,yBAAyB,aAAa,aAAa,CAAC,CAAC;QAC5E,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QAC7C,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,aAAa,EAAE,CAAC;YACvD,MAAM,SAAS,CAAC,GAAG,EAAE,yBAAyB,aAAa,aAAa,CAAC,CAAC;QAC5E,CAAC;QACD,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YACpF,MAAM,SAAS,CAAC,GAAG,EAAE,0CAA0C,CAAC,CAAC;QACnE,CAAC;QAED,MAAM,QAAQ,GAAG,CAAC,IAAI,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,OAAO,CAAC,iBAAiB,EAAE,GAAG,CAAC,CAAC;QAC/E,MAAM,QAAQ,GAAG,GAAG,QAAQ,MAAM,CAAC;QACnC,MAAM,EAAE,CAAC,KAAK,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9C,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QAC3C,MAAM,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAChC,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,mBAAmB,CAAC,IAAY;IACvC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAC5B,MAAM,OAAO,GAAG,oCAAoC,CAAC;IACrD,IAAI,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACtD,MAAM,SAAS,CAAC,GAAG,EAAE,wCAAwC,CAAC,CAAC;IACjE,CAAC;IAED,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACjE,IACE,OAAO,CAAC,MAAM,KAAK,CAAC;WACjB,OAAO,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC;WACxB,CAAC,wBAAwB,CAAC,IAAI,CAAC,OAAO,CAAC,EAC1C,CAAC;QACD,MAAM,SAAS,CAAC,GAAG,EAAE,oCAAoC,CAAC,CAAC;IAC7D,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,SAAS,CAAC,MAAc,EAAE,OAAe;IAChD,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,OAAO,CAA+B,CAAC;IAC/D,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC;IACtB,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist-cjs/client.js

@@ -2,14 +2,16 @@ import fetch from "node-fetch";
 /**
  * Send a linkback to Monok after you publish the article.
  */
-export async function sendMonokLinkback({ monokId, publicUrl, title, articleTextSample = "", thumbnailUrl }, opts) {
+export async function sendMonokLinkback({ monokId, externalId, url, title, thumbnailUrl }, opts) {
     const endpoint = (opts?.monokBaseUrl ?? "https://www.monok.com") + "/api/v1/linkback";
     const payload = {
-        puff: { title, article: articleTextSample },
+        puff: { title },
         id: monokId,
-        url: publicUrl,
-        source: new URL(publicUrl).hostname,
-        userId: opts?.userId ?? new URL(publicUrl).hostname + "-CUSTOM",
+        ...(externalId !== undefined && externalId !== null
+            ? { externalId: String(externalId) }
+            : {}),
+        url,
+        source: new URL(url).hostname,
         ...(thumbnailUrl ? { thumbnail: thumbnailUrl } : {})
     };
     const resp = await fetch(endpoint, {

package/dist-cjs/client.js.map

@@ -1 +1 @@
-{"version":3,"file":"client.js","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,YAAY,CAAC;AAG/B;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,iBAAiB,GAAG,EAAE,EAAE,YAAY,EAAmB,EACpF,IAAkE;IAElE,MAAM,QAAQ,GAAG,CAAC,IAAI,EAAE,YAAY,IAAI,uBAAuB,CAAC,GAAG,kBAAkB,CAAC;IACtF,MAAM,OAAO,GAAG;QACd,IAAI,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,iBAAiB,EAAE;QAC3C,EAAE,EAAE,OAAO;QACX,GAAG,EAAE,SAAS;QACd,MAAM,EAAE,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC,QAAQ;QACnC,MAAM,EAAE,IAAI,EAAE,MAAM,IAAI,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC,QAAQ,GAAG,SAAS;QAC/D,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACrD,CAAC;IAEF,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,QAAQ,EAAE;QACjC,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,cAAc,EAAE,kBAAkB;YAClC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACtD;QACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;KAC9B,CAAC,CAAC;IAEH,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;QACb,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;QAC/C,MAAM,IAAI,KAAK,CAAC,0BAA0B,IAAI,CAAC,MAAM,IAAI,IAAI,EAAE,CAAC,CAAC;IACnE,CAAC;AACH,CAAC"}
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,YAAY,CAAC;AAG/B;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,EAAE,OAAO,EAAE,UAAU,EAAE,GAAG,EAAE,KAAK,EAAE,YAAY,EAAmB,EAClE,IAAiD;IAEjD,MAAM,QAAQ,GAAG,CAAC,IAAI,EAAE,YAAY,IAAI,uBAAuB,CAAC,GAAG,kBAAkB,CAAC;IACtF,MAAM,OAAO,GAAG;QACd,IAAI,EAAE,EAAE,KAAK,EAAE;QACf,EAAE,EAAE,OAAO;QACX,GAAG,CAAC,UAAU,KAAK,SAAS,IAAI,UAAU,KAAK,IAAI;YACjD,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,CAAC,EAAE;YACpC,CAAC,CAAC,EAAE,CAAC;QACP,GAAG;QACH,MAAM,EAAE,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ;QAC7B,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACrD,CAAC;IAEF,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,QAAQ,EAAE;QACjC,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,cAAc,EAAE,kBAAkB;YAClC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACtD;QACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;KAC9B,CAAC,CAAC;IAEH,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;QACb,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;QAC/C,MAAM,IAAI,KAAK,CAAC,0BAA0B,IAAI,CAAC,MAAM,IAAI,IAAI,EAAE,CAAC,CAAC;IACnE,CAAC;AACH,CAAC"}

package/dist-cjs/express.js

@@ -1,5 +1,7 @@
 import { Router, json } from "express";
+import { readFileSync } from "node:fs";
 import { assertApiKey, makeThumbSaver } from "./utils.js";
+const PACKAGE_VERSION = readPackageVersion();
 export function createMonokRouter(opts) {
     const r = Router();
     const base = opts.basePath ?? "";
@@ -7,34 +9,132 @@ export function createMonokRouter(opts) {
     r.use(json({ limit: "20mb" }));
     // POST /push
     r.post(base + "/push", wrap(async (req, res) => {
-        assertApiKey(req.header("token"), opts.apiKey);
+        assertRequestApiKey(req, opts.apiKey, true);
         const body = req.body;
-        if (!body?.id || !body?.title) {
+        if (body?.id === undefined
+            || body.id === null
+            || (typeof body.id === "string" && body.id.trim() === "")
+            || typeof body.title !== "string"
+            || body.title.trim() === "") {
             return res.status(400).json({ error: "Invalid payload" });
         }
-        // read optional ?action=draft|publish
-        const action = req.query.action;
-        const saver = makeThumbSaver(opts.imageDir);
+        // Monok's API integration sends action in the body. Retain query support
+        // for older callers and give an explicit query value precedence.
+        const action = parseAction(firstQueryValue(req.query.action) ?? body.action);
+        const saver = makeThumbSaver(opts.imageDir, opts.maxImageBytes);
         await Promise.resolve(opts.onArticle(body, {
-            saveThumbImage: async (fileNameBase) => saver(fileNameBase ?? body.slug ?? body.id, body.thumbImageData),
+            saveThumbImage: async (fileNameBase) => saver(fileNameBase ?? body.slug ?? String(body.id), body.thumbImageData),
             action
         }));
-        res.json({ ok: true, monokId: body.id });
+        res.json({ ok: true, status: "accepted", monokId: body.id });
     }));
     // GET /info
     r.get(base + "/info", wrap(async (req, res) => {
-        if (!opts.getSiteInfo) {
-            return res.status(404).json({ error: "Site info not configured" });
-        }
-        const apikey = req.query.apikey;
-        assertApiKey(apikey, opts.apiKey);
-        const info = typeof opts.getSiteInfo === "function"
-            ? await Promise.resolve(opts.getSiteInfo())
-            : opts.getSiteInfo;
+        setPrivateNoCacheHeaders(res);
+        assertRequestApiKey(req, opts.apiKey);
+        const configuredInfo = !opts.getSiteInfo
+            ? undefined
+            : typeof opts.getSiteInfo === "function"
+                ? await Promise.resolve(opts.getSiteInfo())
+                : opts.getSiteInfo;
+        const info = configuredInfo
+            ? { ...configuredInfo, version: PACKAGE_VERSION }
+            : defaultSiteInfo();
         res.json(info);
     }));
+    // GET /postfilter
+    r.get(base + "/postfilter", wrap(async (req, res) => {
+        setPrivateNoCacheHeaders(res);
+        if (!opts.searchArticles) {
+            return res.status(404).json({ error: "Article search not configured" });
+        }
+        assertRequestApiKey(req, opts.apiKey);
+        const amount = parsePositiveInteger(firstQueryValue(req.query.amount), 10, "amount");
+        const page = parsePositiveInteger(firstQueryValue(req.query.page), 1, "page");
+        const query = {
+            postType: firstQueryValue(req.query.post_type)?.trim() || "post",
+            amount,
+            page,
+            ...optionalTrimmed("section", firstQueryValue(req.query.section)),
+            ...optionalTrimmed("tag", firstQueryValue(req.query.tag)),
+            ...optionalTrimmed("query", firstQueryValue(req.query.q))
+        };
+        const articles = await Promise.resolve(opts.searchArticles(query));
+        if (!Array.isArray(articles)) {
+            throw httpError(500, "searchArticles must return an array");
+        }
+        res.json(articles);
+    }));
     return r;
 }
+function assertRequestApiKey(req, expected, allowToken = false) {
+    const provided = ((allowToken ? req.header("token") : undefined)
+        ?? req.header("x-api-key")
+        ?? firstQueryValue(req.query.apikey));
+    assertApiKey(provided, expected);
+}
+function parseAction(value) {
+    if (value === undefined || value === null || value === "")
+        return undefined;
+    if (value === "draft" || value === "publish")
+        return value;
+    throw httpError(400, "action must be either draft or publish");
+}
+function parsePositiveInteger(value, fallback, name) {
+    if (value === undefined || value === "")
+        return fallback;
+    if (!/^\d+$/.test(value))
+        throw httpError(400, `${name} must be a positive integer`);
+    const parsed = Number(value);
+    if (!Number.isSafeInteger(parsed) || parsed < 1) {
+        throw httpError(400, `${name} must be a positive integer`);
+    }
+    return parsed;
+}
+function firstQueryValue(value) {
+    if (typeof value === "string")
+        return value;
+    if (Array.isArray(value) && typeof value[0] === "string")
+        return value[0];
+    return undefined;
+}
+function optionalTrimmed(key, value) {
+    const trimmed = value?.trim();
+    return trimmed ? { [key]: trimmed } : {};
+}
+function setPrivateNoCacheHeaders(res) {
+    res.set({
+        "Cache-Control": "no-store, no-cache, must-revalidate, max-age=0, private",
+        "Pragma": "no-cache",
+        "Expires": "0",
+        "Surrogate-Control": "no-store",
+        "Vary": "Accept-Encoding"
+    });
+}
+function defaultSiteInfo() {
+    return {
+        js_scripts: "Disabled",
+        version: PACKAGE_VERSION,
+        name: "Custom CMS",
+        logo: "",
+        categories: [],
+        post_types: ["post"],
+        tags: [],
+        authors: []
+    };
+}
+function readPackageVersion() {
+    const packageJson = JSON.parse(readFileSync(new URL("../package.json", import.meta.url), "utf8"));
+    if (typeof packageJson.version !== "string" || packageJson.version.length === 0) {
+        throw new Error("@monok/server package version is missing");
+    }
+    return packageJson.version;
+}
+function httpError(status, message) {
+    const error = new Error(message);
+    error.status = status;
+    return error;
+}
 function wrap(fn) {
     return (req, res, next) => fn(req, res, next).catch((err) => {
         const status = typeof err?.status === "number" ? err.status : 500;

package/dist-cjs/express.js.map

@@ -1 +1 @@
-{"version":3,"file":"express.js","sourceRoot":"","sources":["../src/express.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,IAAI,EAAkD,MAAM,SAAS,CAAC;AAEvF,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAE1D,MAAM,UAAU,iBAAiB,CAAC,IAAyB;IACzD,MAAM,CAAC,GAAG,MAAM,EAAE,CAAC;IACnB,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC;IAEjC,kEAAkE;IAClE,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;IAE/B,aAAa;IACb,CAAC,CAAC,IAAI,CAAC,IAAI,GAAG,OAAO,EAAE,IAAI,CAAC,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;QAChE,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QAE/C,MAAM,IAAI,GAAG,GAAG,CAAC,IAAoB,CAAC;QACtC,IAAI,CAAC,IAAI,EAAE,EAAE,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC;YAC9B,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAC;QAC5D,CAAC;QAED,sCAAsC;QACtC,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,MAAyC,CAAC;QAEnE,MAAM,KAAK,GAAG,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC5C,MAAM,OAAO,CAAC,OAAO,CACnB,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE;YACnB,cAAc,EAAE,KAAK,EAAE,YAAqB,EAAE,EAAE,CAC9C,KAAK,CAAC,YAAY,IAAI,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,cAAc,CAAC;YAClE,MAAM;SACP,CAAC,CACH,CAAC;QAEF,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC,CAAC;IAEJ,YAAY;IACZ,CAAC,CAAC,GAAG,CAAC,IAAI,GAAG,OAAO,EAAE,IAAI,CAAC,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;QAC/D,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YACtB,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,0BAA0B,EAAE,CAAC,CAAC;QACrE,CAAC;QAED,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,MAA4B,CAAC;QACtD,YAAY,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QAElC,MAAM,IAAI,GAAa,OAAO,IAAI,CAAC,WAAW,KAAK,UAAU;YAC3D,CAAC,CAAC,MAAM,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YAC3C,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC;QAErB,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACjB,CAAC,CAAC,CAAC,CAAC;IAEJ,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,IAAI,CACX,EAAyE;IAEzE,OAAO,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE,CACzD,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,GAAQ,EAAE,EAAE;QACpC,MAAM,MAAM,GAAG,OAAO,GAAG,EAAE,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC;QAClE,IAAI,MAAM,IAAI,GAAG;YAAE,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACtC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,IAAI,cAAc,EAAE,CAAC,CAAC;IACrE,CAAC,CAAC,CAAC;AACP,CAAC"}
+{"version":3,"file":"express.js","sourceRoot":"","sources":["../src/express.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,IAAI,EAAkD,MAAM,SAAS,CAAC;AACvF,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAQvC,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAE1D,MAAM,eAAe,GAAG,kBAAkB,EAAE,CAAC;AAE7C,MAAM,UAAU,iBAAiB,CAAC,IAAyB;IACzD,MAAM,CAAC,GAAG,MAAM,EAAE,CAAC;IACnB,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC;IAEjC,kEAAkE;IAClE,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;IAE/B,aAAa;IACb,CAAC,CAAC,IAAI,CAAC,IAAI,GAAG,OAAO,EAAE,IAAI,CAAC,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;QAChE,mBAAmB,CAAC,GAAG,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAE5C,MAAM,IAAI,GAAG,GAAG,CAAC,IAAoB,CAAC;QACtC,IACE,IAAI,EAAE,EAAE,KAAK,SAAS;eACnB,IAAI,CAAC,EAAE,KAAK,IAAI;eAChB,CAAC,OAAO,IAAI,CAAC,EAAE,KAAK,QAAQ,IAAI,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC;eACtD,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ;eAC9B,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,EAC3B,CAAC;YACD,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAC;QAC5D,CAAC;QAED,yEAAyE;QACzE,iEAAiE;QACjE,MAAM,MAAM,GAAG,WAAW,CAAC,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC;QAE7E,MAAM,KAAK,GAAG,cAAc,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC;QAChE,MAAM,OAAO,CAAC,OAAO,CACnB,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE;YACnB,cAAc,EAAE,KAAK,EAAE,YAAqB,EAAE,EAAE,CAC9C,KAAK,CAAC,YAAY,IAAI,IAAI,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,IAAI,CAAC,cAAc,CAAC;YAC1E,MAAM;SACP,CAAC,CACH,CAAC;QAEF,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;IAC/D,CAAC,CAAC,CAAC,CAAC;IAEJ,YAAY;IACZ,CAAC,CAAC,GAAG,CAAC,IAAI,GAAG,OAAO,EAAE,IAAI,CAAC,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;QAC/D,wBAAwB,CAAC,GAAG,CAAC,CAAC;QAC9B,mBAAmB,CAAC,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QAEtC,MAAM,cAAc,GAAG,CAAC,IAAI,CAAC,WAAW;YACtC,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,OAAO,IAAI,CAAC,WAAW,KAAK,UAAU;gBACtC,CAAC,CAAC,MAAM,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;gBAC3C,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC;QACvB,MAAM,IAAI,GAAa,cAAc;YACnC,CAAC,CAAC,EAAE,GAAG,cAAc,EAAE,OAAO,EAAE,eAAe,EAAE;YACjD,CAAC,CAAC,eAAe,EAAE,CAAC;QAEtB,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACjB,CAAC,CAAC,CAAC,CAAC;IAEJ,kBAAkB;IAClB,CAAC,CAAC,GAAG,CAAC,IAAI,GAAG,aAAa,EAAE,IAAI,CAAC,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;QACrE,wBAAwB,CAAC,GAAG,CAAC,CAAC;QAC9B,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;YACzB,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,+BAA+B,EAAE,CAAC,CAAC;QAC1E,CAAC;QAED,mBAAmB,CAAC,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QAEtC,MAAM,MAAM,GAAG,oBAAoB,CAAC,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,QAAQ,CAAC,CAAC;QACrF,MAAM,IAAI,GAAG,oBAAoB,CAAC,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC;QAC9E,MAAM,KAAK,GAAoB;YAC7B,QAAQ,EAAE,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,IAAI,MAAM;YAChE,MAAM;YACN,IAAI;YACJ,GAAG,eAAe,CAAC,SAAS,EAAE,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACjE,GAAG,eAAe,CAAC,KAAK,EAAE,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACzD,GAAG,eAAe,CAAC,OAAO,EAAE,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;SAC1D,CAAC;QAEF,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC;QACnE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC7B,MAAM,SAAS,CAAC,GAAG,EAAE,qCAAqC,CAAC,CAAC;QAC9D,CAAC;QACD,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACrB,CAAC,CAAC,CAAC,CAAC;IAEJ,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,mBAAmB,CAAC,GAAY,EAAE,QAAgB,EAAE,UAAU,GAAG,KAAK;IAC7E,MAAM,QAAQ,GAAG,CACf,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;WAC3C,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC;WACvB,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CACrC,CAAC;IACF,YAAY,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;AACnC,CAAC;AAED,SAAS,WAAW,CAAC,KAAc;IACjC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,EAAE;QAAE,OAAO,SAAS,CAAC;IAC5E,IAAI,KAAK,KAAK,OAAO,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAC3D,MAAM,SAAS,CAAC,GAAG,EAAE,wCAAwC,CAAC,CAAC;AACjE,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAyB,EAAE,QAAgB,EAAE,IAAY;IACrF,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE;QAAE,OAAO,QAAQ,CAAC;IACzD,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,MAAM,SAAS,CAAC,GAAG,EAAE,GAAG,IAAI,6BAA6B,CAAC,CAAC;IACrF,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC7B,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC,EAAE,CAAC;QAChD,MAAM,SAAS,CAAC,GAAG,EAAE,GAAG,IAAI,6BAA6B,CAAC,CAAC;IAC7D,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,eAAe,CAAC,KAAc;IACrC,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5C,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC;IAC1E,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,eAAe,CAAqB,GAAQ,EAAE,KAAc;IACnE,MAAM,OAAO,GAAG,KAAK,EAAE,IAAI,EAAE,CAAC;IAC9B,OAAO,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,OAAO,EAAyB,CAAC,CAAC,CAAC,EAAE,CAAC;AAClE,CAAC;AAED,SAAS,wBAAwB,CAAC,GAAa;IAC7C,GAAG,CAAC,GAAG,CAAC;QACN,eAAe,EAAE,yDAAyD;QAC1E,QAAQ,EAAE,UAAU;QACpB,SAAS,EAAE,GAAG;QACd,mBAAmB,EAAE,UAAU;QAC/B,MAAM,EAAE,iBAAiB;KAC1B,CAAC,CAAC;AACL,CAAC;AAED,SAAS,eAAe;IACtB,OAAO;QACL,UAAU,EAAE,UAAU;QACtB,OAAO,EAAE,eAAe;QACxB,IAAI,EAAE,YAAY;QAClB,IAAI,EAAE,EAAE;QACR,UAAU,EAAE,EAAE;QACd,UAAU,EAAE,CAAC,MAAM,CAAC;QACpB,IAAI,EAAE,EAAE;QACR,OAAO,EAAE,EAAE;KACZ,CAAC;AACJ,CAAC;AAED,SAAS,kBAAkB;IACzB,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAC5B,YAAY,CAAC,IAAI,GAAG,CAAC,iBAAiB,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,CACzC,CAAC;IAE3B,IAAI,OAAO,WAAW,CAAC,OAAO,KAAK,QAAQ,IAAI,WAAW,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChF,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IAC9D,CAAC;IACD,OAAO,WAAW,CAAC,OAAO,CAAC;AAC7B,CAAC;AAED,SAAS,SAAS,CAAC,MAAc,EAAE,OAAe;IAChD,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,OAAO,CAA+B,CAAC;IAC/D,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC;IACtB,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,IAAI,CACX,EAAyE;IAEzE,OAAO,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE,CACzD,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,GAAQ,EAAE,EAAE;QACpC,MAAM,MAAM,GAAG,OAAO,GAAG,EAAE,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC;QAClE,IAAI,MAAM,IAAI,GAAG;YAAE,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACtC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,IAAI,cAAc,EAAE,CAAC,CAAC;IACrE,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist-cjs/utils.js

@@ -1,6 +1,7 @@
 import crypto from "crypto";
 import path from "path";
 import fs from "fs/promises";
+const DEFAULT_MAX_IMAGE_BYTES = 15 * 1024 * 1024;
 export function timingSafeEqual(a, b) {
     const abuf = Buffer.from(a);
     const bbuf = Buffer.from(b);
@@ -9,24 +10,59 @@ export function timingSafeEqual(a, b) {
     return crypto.timingSafeEqual(abuf, bbuf);
 }
 export function assertApiKey(headerValue, expected) {
-    if (!headerValue || !timingSafeEqual(headerValue, expected)) {
+    const candidate = headerValue?.trim();
+    const configured = expected.trim();
+    if (!candidate || !configured || !timingSafeEqual(candidate, configured)) {
         const err = new Error("Unauthorized");
         // @ts-expect-error custom status
         err.status = 401;
         throw err;
     }
 }
-export function makeThumbSaver(imageDir) {
+export function makeThumbSaver(imageDir, maxImageBytes = DEFAULT_MAX_IMAGE_BYTES) {
     return async (base, data) => {
         if (!imageDir || !data)
             return undefined;
-        const bytes = Buffer.from(data, "base64");
+        if (!Number.isSafeInteger(maxImageBytes) || maxImageBytes <= 0) {
+            throw httpError(500, "maxImageBytes must be a positive safe integer");
+        }
+        const encoded = normalizeJpegBase64(data);
+        const estimatedBytes = Math.floor((encoded.length * 3) / 4);
+        if (estimatedBytes > maxImageBytes) {
+            throw httpError(413, `Thumbnail exceeds the ${maxImageBytes}-byte limit`);
+        }
+        const bytes = Buffer.from(encoded, "base64");
+        if (bytes.length === 0 || bytes.length > maxImageBytes) {
+            throw httpError(413, `Thumbnail exceeds the ${maxImageBytes}-byte limit`);
+        }
+        if (bytes.length < 3 || bytes[0] !== 0xff || bytes[1] !== 0xd8 || bytes[2] !== 0xff) {
+            throw httpError(400, "thumbImageData is not a valid JPEG image");
+        }
         const safeName = (base || crypto.randomUUID()).replace(/[^a-zA-Z0-9-_]/g, "_");
-        const fileName = `${safeName}.png`;
+        const fileName = `${safeName}.jpg`;
         await fs.mkdir(imageDir, { recursive: true });
         const full = path.join(imageDir, fileName);
         await fs.writeFile(full, bytes);
         return full;
     };
 }
+function normalizeJpegBase64(data) {
+    const trimmed = data.trim();
+    const dataUrl = /^data:image\/(?:jpeg|jpg);base64,/i;
+    if (/^data:/i.test(trimmed) && !dataUrl.test(trimmed)) {
+        throw httpError(400, "thumbImageData must be a JPEG data URL");
+    }
+    const encoded = trimmed.replace(dataUrl, "").replace(/\s+/g, "");
+    if (encoded.length === 0
+        || encoded.length % 4 === 1
+        || !/^[A-Za-z0-9+/]*={0,2}$/.test(encoded)) {
+        throw httpError(400, "thumbImageData is not valid base64");
+    }
+    return encoded;
+}
+function httpError(status, message) {
+    const error = new Error(message);
+    error.status = status;
+    return error;
+}
 //# sourceMappingURL=utils.js.map

package/dist-cjs/utils.js.map

@@ -1 +1 @@
-{"version":3,"file":"utils.js","sourceRoot":"","sources":["../src/utils.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,QAAQ,CAAC;AAC5B,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,EAAE,MAAM,aAAa,CAAC;AAE7B,MAAM,UAAU,eAAe,CAAC,CAAS,EAAE,CAAS;IAClD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC5B,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC5B,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC9C,OAAO,MAAM,CAAC,eAAe,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;AAC5C,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,WAA+B,EAAE,QAAgB;IAC5E,IAAI,CAAC,WAAW,IAAI,CAAC,eAAe,CAAC,WAAW,EAAE,QAAQ,CAAC,EAAE,CAAC;QAC5D,MAAM,GAAG,GAAG,IAAI,KAAK,CAAC,cAAc,CAAC,CAAC;QACtC,iCAAiC;QACjC,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;QACjB,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,QAAiB;IAC9C,OAAO,KAAK,EAAE,IAAa,EAAE,IAAa,EAA+B,EAAE;QACzE,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI;YAAE,OAAO,SAAS,CAAC;QACzC,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QAC1C,MAAM,QAAQ,GAAG,CAAC,IAAI,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,OAAO,CAAC,iBAAiB,EAAE,GAAG,CAAC,CAAC;QAC/E,MAAM,QAAQ,GAAG,GAAG,QAAQ,MAAM,CAAC;QACnC,MAAM,EAAE,CAAC,KAAK,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9C,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QAC3C,MAAM,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAChC,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"utils.js","sourceRoot":"","sources":["../src/utils.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,QAAQ,CAAC;AAC5B,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,EAAE,MAAM,aAAa,CAAC;AAE7B,MAAM,uBAAuB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAEjD,MAAM,UAAU,eAAe,CAAC,CAAS,EAAE,CAAS;IAClD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC5B,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC5B,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC9C,OAAO,MAAM,CAAC,eAAe,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;AAC5C,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,WAA+B,EAAE,QAAgB;IAC5E,MAAM,SAAS,GAAG,WAAW,EAAE,IAAI,EAAE,CAAC;IACtC,MAAM,UAAU,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC;IACnC,IAAI,CAAC,SAAS,IAAI,CAAC,UAAU,IAAI,CAAC,eAAe,CAAC,SAAS,EAAE,UAAU,CAAC,EAAE,CAAC;QACzE,MAAM,GAAG,GAAG,IAAI,KAAK,CAAC,cAAc,CAAC,CAAC;QACtC,iCAAiC;QACjC,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;QACjB,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,QAAiB,EAAE,aAAa,GAAG,uBAAuB;IACvF,OAAO,KAAK,EAAE,IAAa,EAAE,IAAa,EAA+B,EAAE;QACzE,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI;YAAE,OAAO,SAAS,CAAC;QAEzC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,aAAa,CAAC,IAAI,aAAa,IAAI,CAAC,EAAE,CAAC;YAC/D,MAAM,SAAS,CAAC,GAAG,EAAE,+CAA+C,CAAC,CAAC;QACxE,CAAC;QAED,MAAM,OAAO,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;QAC1C,MAAM,cAAc,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QAC5D,IAAI,cAAc,GAAG,aAAa,EAAE,CAAC;YACnC,MAAM,SAAS,CAAC,GAAG,EAAE,yBAAyB,aAAa,aAAa,CAAC,CAAC;QAC5E,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QAC7C,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,aAAa,EAAE,CAAC;YACvD,MAAM,SAAS,CAAC,GAAG,EAAE,yBAAyB,aAAa,aAAa,CAAC,CAAC;QAC5E,CAAC;QACD,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YACpF,MAAM,SAAS,CAAC,GAAG,EAAE,0CAA0C,CAAC,CAAC;QACnE,CAAC;QAED,MAAM,QAAQ,GAAG,CAAC,IAAI,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,OAAO,CAAC,iBAAiB,EAAE,GAAG,CAAC,CAAC;QAC/E,MAAM,QAAQ,GAAG,GAAG,QAAQ,MAAM,CAAC;QACnC,MAAM,EAAE,CAAC,KAAK,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9C,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QAC3C,MAAM,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAChC,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,mBAAmB,CAAC,IAAY;IACvC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAC5B,MAAM,OAAO,GAAG,oCAAoC,CAAC;IACrD,IAAI,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACtD,MAAM,SAAS,CAAC,GAAG,EAAE,wCAAwC,CAAC,CAAC;IACjE,CAAC;IAED,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACjE,IACE,OAAO,CAAC,MAAM,KAAK,CAAC;WACjB,OAAO,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC;WACxB,CAAC,wBAAwB,CAAC,IAAI,CAAC,OAAO,CAAC,EAC1C,CAAC;QACD,MAAM,SAAS,CAAC,GAAG,EAAE,oCAAoC,CAAC,CAAC;IAC7D,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,SAAS,CAAC,MAAc,EAAE,OAAe;IAChD,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,OAAO,CAA+B,CAAC;IAC/D,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC;IACtB,OAAO,KAAK,CAAC;AACf,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@monok/server",
-  "version": "1.3.0",
+  "version": "1.4.0",
   "description": "Monok server integration helpers (Express router + linkback client)",
   "license": "MIT",
   "type": "module",
@@ -17,6 +17,7 @@
   "files": [
     "dist",
     "dist-cjs",
+    "AGENTS.md",
     "README.md",
     "LICENSE"
   ],
@@ -26,6 +27,7 @@
   "sideEffects": false,
   "scripts": {
     "build": "tsc -p tsconfig.json && tsc -p tsconfig.cjs.json",
+    "test": "npm run build && node --test tests/*.test.mjs",
     "dev": "tsc -w -p tsconfig.json",
     "clean": "rimraf dist dist-cjs",
     "prepublishOnly": "npm run build"