@pro-laico/payload-images 0.0.0

package/dist/transform/sharp.js

@@ -0,0 +1,85 @@
+/**
+ * Server-only Sharp transform. `sharp` is a lazy import so the package carries no
+ * hard runtime dependency (it's an optional peer) and so client bundles never pull
+ * it in. The focal-crop geometry is split out as a pure function for unit testing.
+ */ import { coverCropGeometry, fitWithinSource } from "./geometry.js";
+import { withTransformLimit } from "./limit.js";
+import { mimeForFormat } from "./params.js";
+import { loadSharp } from "./sharpInstance.js";
+export { coverCropGeometry, coverObjectPosition, fitWithinSource } from "./geometry.js";
+/** Default decompression-bomb / memory guard (~100MP); overridable per call via {@link TransformInput.maxInputPixels}. */ const MAX_INPUT_PIXELS = 100_000_000;
+const encode = (pipeline, format, quality)=>{
+    switch(format){
+        case 'avif':
+            return pipeline.avif({
+                quality
+            });
+        case 'webp':
+            return pipeline.webp({
+                quality
+            });
+        case 'png':
+            return pipeline.png();
+        default:
+            // JPEG has no alpha channel — composite transparent sources (logos, contain letterboxing)
+            // onto white instead of Sharp's default black.
+            return pipeline.flatten({
+                background: '#ffffff'
+            }).jpeg({
+                quality,
+                mozjpeg: true
+            });
+    }
+};
+/**
+ * Transform a source image buffer: focal cover-crop (or plain resize for other fits) +
+ * encode. The CPU-bound work runs behind {@link withTransformLimit} so a burst of
+ * concurrent srcset requests can't saturate the host.
+ */ export const transformImage = (src, input)=>withTransformLimit(async ()=>{
+        const sharp = await loadSharp();
+        let pipeline = sharp(src, {
+            failOn: 'none',
+            limitInputPixels: input.maxInputPixels ?? MAX_INPUT_PIXELS
+        }).rotate();
+        const meta = await pipeline.metadata();
+        const swapped = (meta.orientation ?? 1) >= 5;
+        const sw = (swapped ? meta.height : meta.width) ?? 0;
+        const sh = (swapped ? meta.width : meta.height) ?? 0;
+        if (input.fit === 'cover' && input.w != null && input.h != null && sw > 0 && sh > 0) {
+            const { w: tw, h: th } = fitWithinSource(input.w, input.h, sw, sh);
+            const g = coverCropGeometry(sw, sh, tw, th, input.focalX ?? 50, input.focalY ?? 50);
+            pipeline = pipeline.resize(g.resizeWidth, g.resizeHeight).extract({
+                left: g.left,
+                top: g.top,
+                width: g.width,
+                height: g.height
+            });
+        } else {
+            // Transparent padding: 'contain' letterboxes when the box aspect differs from the source,
+            // and Sharp's default pad color is opaque black.
+            pipeline = pipeline.resize({
+                width: input.w,
+                height: input.h,
+                fit: input.fit,
+                withoutEnlargement: true,
+                background: {
+                    r: 0,
+                    g: 0,
+                    b: 0,
+                    alpha: 0
+                }
+            });
+        }
+        const { data, info } = await encode(pipeline, input.format, input.quality).toBuffer({
+            resolveWithObject: true
+        });
+        return {
+            data,
+            format: input.format,
+            width: info.width,
+            height: info.height,
+            mimeType: mimeForFormat(input.format)
+        };
+    });
+
+//# sourceMappingURL=sharp.js.map

package/dist/transform/sharp.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/transform/sharp.ts"],"sourcesContent":["/**\n * Server-only Sharp transform. `sharp` is a lazy import so the package carries no\n * hard runtime dependency (it's an optional peer) and so client bundles never pull\n * it in. The focal-crop geometry is split out as a pure function for unit testing.\n */\nimport type { Sharp } from 'sharp'\n\nimport { coverCropGeometry, fitWithinSource } from './geometry'\nimport { withTransformLimit } from './limit'\nimport { type Fit, mimeForFormat, type OutputFormat } from './params'\nimport { loadSharp } from './sharpInstance'\n\nexport { coverCropGeometry, coverObjectPosition, fitWithinSource } from './geometry'\nexport type { CropGeometry } from './geometry'\n\nexport interface TransformInput {\n  w?: number\n  h?: number\n  fit: Fit\n  quality: number\n  format: OutputFormat\n  focalX?: number | null\n  focalY?: number | null\n  /** Max source pixels Sharp will decode (decompression-bomb + memory guard). Defaults to {@link MAX_INPUT_PIXELS}. */\n  maxInputPixels?: number\n}\n\nexport interface TransformOutput {\n  data: Buffer\n  format: OutputFormat\n  width: number\n  height: number\n  mimeType: string\n}\n\n/** Default decompression-bomb / memory guard (~100MP); overridable per call via {@link TransformInput.maxInputPixels}. */\nconst MAX_INPUT_PIXELS = 100_000_000\n\nconst encode = (pipeline: Sharp, format: OutputFormat, quality: number): Sharp => {\n  switch (format) {\n    case 'avif':\n      return pipeline.avif({ quality })\n    case 'webp':\n      return pipeline.webp({ quality })\n    case 'png':\n      return pipeline.png()\n    default:\n      // JPEG has no alpha channel — composite transparent sources (logos, contain letterboxing)\n      // onto white instead of Sharp's default black.\n      return pipeline.flatten({ background: '#ffffff' }).jpeg({ quality, mozjpeg: true })\n  }\n}\n\n/**\n * Transform a source image buffer: focal cover-crop (or plain resize for other fits) +\n * encode. The CPU-bound work runs behind {@link withTransformLimit} so a burst of\n * concurrent srcset requests can't saturate the host.\n */\nexport const transformImage = (src: Buffer, input: TransformInput): Promise<TransformOutput> =>\n  withTransformLimit(async () => {\n    const sharp = await loadSharp()\n    let pipeline = sharp(src, { failOn: 'none', limitInputPixels: input.maxInputPixels ?? MAX_INPUT_PIXELS }).rotate()\n    const meta = await pipeline.metadata()\n    const swapped = (meta.orientation ?? 1) >= 5\n    const sw = (swapped ? meta.height : meta.width) ?? 0\n    const sh = (swapped ? meta.width : meta.height) ?? 0\n\n    if (input.fit === 'cover' && input.w != null && input.h != null && sw > 0 && sh > 0) {\n      const { w: tw, h: th } = fitWithinSource(input.w, input.h, sw, sh)\n      const g = coverCropGeometry(sw, sh, tw, th, input.focalX ?? 50, input.focalY ?? 50)\n      pipeline = pipeline.resize(g.resizeWidth, g.resizeHeight).extract({ left: g.left, top: g.top, width: g.width, height: g.height })\n    } else {\n      // Transparent padding: 'contain' letterboxes when the box aspect differs from the source,\n      // and Sharp's default pad color is opaque black.\n      pipeline = pipeline.resize({\n        width: input.w,\n        height: input.h,\n        fit: input.fit,\n        withoutEnlargement: true,\n        background: { r: 0, g: 0, b: 0, alpha: 0 },\n      })\n    }\n\n    const { data, info } = await encode(pipeline, input.format, input.quality).toBuffer({ resolveWithObject: true })\n    return { data, format: input.format, width: info.width, height: info.height, mimeType: mimeForFormat(input.format) }\n  })\n"],"names":["coverCropGeometry","fitWithinSource","withTransformLimit","mimeForFormat","loadSharp","coverObjectPosition","MAX_INPUT_PIXELS","encode","pipeline","format","quality","avif","webp","png","flatten","background","jpeg","mozjpeg","transformImage","src","input","sharp","failOn","limitInputPixels","maxInputPixels","rotate","meta","metadata","swapped","orientation","sw","height","width","sh","fit","w","h","tw","th","g","focalX","focalY","resize","resizeWidth","resizeHeight","extract","left","top","withoutEnlargement","r","b","alpha","data","info","toBuffer","resolveWithObject","mimeType"],"mappings":"AAAA;;;;CAIC,GAGD,SAASA,iBAAiB,EAAEC,eAAe,QAAQ,gBAAY;AAC/D,SAASC,kBAAkB,QAAQ,aAAS;AAC5C,SAAmBC,aAAa,QAA2B,cAAU;AACrE,SAASC,SAAS,QAAQ,qBAAiB;AAE3C,SAASJ,iBAAiB,EAAEK,mBAAmB,EAAEJ,eAAe,QAAQ,gBAAY;AAuBpF,wHAAwH,GACxH,MAAMK,mBAAmB;AAEzB,MAAMC,SAAS,CAACC,UAAiBC,QAAsBC;IACrD,OAAQD;QACN,KAAK;YACH,OAAOD,SAASG,IAAI,CAAC;gBAAED;YAAQ;QACjC,KAAK;YACH,OAAOF,SAASI,IAAI,CAAC;gBAAEF;YAAQ;QACjC,KAAK;YACH,OAAOF,SAASK,GAAG;QACrB;YACE,0FAA0F;YAC1F,+CAA+C;YAC/C,OAAOL,SAASM,OAAO,CAAC;gBAAEC,YAAY;YAAU,GAAGC,IAAI,CAAC;gBAAEN;gBAASO,SAAS;YAAK;IACrF;AACF;AAEA;;;;CAIC,GACD,OAAO,MAAMC,iBAAiB,CAACC,KAAaC,QAC1ClB,mBAAmB;QACjB,MAAMmB,QAAQ,MAAMjB;QACpB,IAAII,WAAWa,MAAMF,KAAK;YAAEG,QAAQ;YAAQC,kBAAkBH,MAAMI,cAAc,IAAIlB;QAAiB,GAAGmB,MAAM;QAChH,MAAMC,OAAO,MAAMlB,SAASmB,QAAQ;QACpC,MAAMC,UAAU,AAACF,CAAAA,KAAKG,WAAW,IAAI,CAAA,KAAM;QAC3C,MAAMC,KAAK,AAACF,CAAAA,UAAUF,KAAKK,MAAM,GAAGL,KAAKM,KAAK,AAAD,KAAM;QACnD,MAAMC,KAAK,AAACL,CAAAA,UAAUF,KAAKM,KAAK,GAAGN,KAAKK,MAAM,AAAD,KAAM;QAEnD,IAAIX,MAAMc,GAAG,KAAK,WAAWd,MAAMe,CAAC,IAAI,QAAQf,MAAMgB,CAAC,IAAI,QAAQN,KAAK,KAAKG,KAAK,GAAG;YACnF,MAAM,EAAEE,GAAGE,EAAE,EAAED,GAAGE,EAAE,EAAE,GAAGrC,gBAAgBmB,MAAMe,CAAC,EAAEf,MAAMgB,CAAC,EAAEN,IAAIG;YAC/D,MAAMM,IAAIvC,kBAAkB8B,IAAIG,IAAII,IAAIC,IAAIlB,MAAMoB,MAAM,IAAI,IAAIpB,MAAMqB,MAAM,IAAI;YAChFjC,WAAWA,SAASkC,MAAM,CAACH,EAAEI,WAAW,EAAEJ,EAAEK,YAAY,EAAEC,OAAO,CAAC;gBAAEC,MAAMP,EAAEO,IAAI;gBAAEC,KAAKR,EAAEQ,GAAG;gBAAEf,OAAOO,EAAEP,KAAK;gBAAED,QAAQQ,EAAER,MAAM;YAAC;QACjI,OAAO;YACL,0FAA0F;YAC1F,iDAAiD;YACjDvB,WAAWA,SAASkC,MAAM,CAAC;gBACzBV,OAAOZ,MAAMe,CAAC;gBACdJ,QAAQX,MAAMgB,CAAC;gBACfF,KAAKd,MAAMc,GAAG;gBACdc,oBAAoB;gBACpBjC,YAAY;oBAAEkC,GAAG;oBAAGV,GAAG;oBAAGW,GAAG;oBAAGC,OAAO;gBAAE;YAC3C;QACF;QAEA,MAAM,EAAEC,IAAI,EAAEC,IAAI,EAAE,GAAG,MAAM9C,OAAOC,UAAUY,MAAMX,MAAM,EAAEW,MAAMV,OAAO,EAAE4C,QAAQ,CAAC;YAAEC,mBAAmB;QAAK;QAC9G,OAAO;YAAEH;YAAM3C,QAAQW,MAAMX,MAAM;YAAEuB,OAAOqB,KAAKrB,KAAK;YAAED,QAAQsB,KAAKtB,MAAM;YAAEyB,UAAUrD,cAAciB,MAAMX,MAAM;QAAE;IACrH,GAAE"}

package/dist/transform/sharpInstance.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Lazy Sharp loader with one-time global tuning. `sharp` is an optional peer and kept
+ * out of client bundles, so it's imported on first use. On first load we cap the
+ * per-image libvips thread pool: the transform endpoint's {@link withTransformLimit}
+ * gate already provides cross-image parallelism, so each transform defaults to a single
+ * libvips thread to bound memory on serverless (libaom still manages its own threads
+ * for AVIF regardless of this). Override via the endpoint's `sharpConcurrency` option or
+ * `IMAGES_SHARP_CONCURRENCY`; `0` resets Sharp to its default (CPU-core count).
+ *
+ * The libvips operation cache stays at Sharp's defaults (50MB / 100 ops) — EXCEPT its
+ * file-descriptor cache on Windows: libvips keeps up to 20 recently-read files OPEN, and
+ * Windows can't unlink an open file, so a transformed original would block its own
+ * deletion (a reseed, a replaced upload) for as long as the process lives. POSIX unlinks
+ * open files fine, so the fd cache is kept there.
+ */
+type SharpFactory = typeof import('sharp')['default'];
+/** Set the per-image libvips thread cap applied on the next Sharp load (negative ignored). */
+export declare const setSharpConcurrency: (n?: number) => void;
+export declare const loadSharp: () => Promise<SharpFactory>;
+export {};
+//# sourceMappingURL=sharpInstance.d.ts.map

package/dist/transform/sharpInstance.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sharpInstance.d.ts","sourceRoot":"","sources":["../../src/transform/sharpInstance.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,KAAK,YAAY,GAAG,cAAc,OAAO,CAAC,CAAC,SAAS,CAAC,CAAA;AAKrD,8FAA8F;AAC9F,eAAO,MAAM,mBAAmB,GAAI,IAAI,MAAM,KAAG,IAEhD,CAAA;AAED,eAAO,MAAM,SAAS,QAAa,OAAO,CAAC,YAAY,CAYtD,CAAA"}

package/dist/transform/sharpInstance.js

@@ -0,0 +1,38 @@
+/**
+ * Lazy Sharp loader with one-time global tuning. `sharp` is an optional peer and kept
+ * out of client bundles, so it's imported on first use. On first load we cap the
+ * per-image libvips thread pool: the transform endpoint's {@link withTransformLimit}
+ * gate already provides cross-image parallelism, so each transform defaults to a single
+ * libvips thread to bound memory on serverless (libaom still manages its own threads
+ * for AVIF regardless of this). Override via the endpoint's `sharpConcurrency` option or
+ * `IMAGES_SHARP_CONCURRENCY`; `0` resets Sharp to its default (CPU-core count).
+ *
+ * The libvips operation cache stays at Sharp's defaults (50MB / 100 ops) — EXCEPT its
+ * file-descriptor cache on Windows: libvips keeps up to 20 recently-read files OPEN, and
+ * Windows can't unlink an open file, so a transformed original would block its own
+ * deletion (a reseed, a replaced upload) for as long as the process lives. POSIX unlinks
+ * open files fine, so the fd cache is kept there.
+ */ let override;
+let configured = false;
+/** Set the per-image libvips thread cap applied on the next Sharp load (negative ignored). */ export const setSharpConcurrency = (n)=>{
+    if (n != null && Number.isFinite(n) && n >= 0) override = Math.floor(n);
+};
+export const loadSharp = async ()=>{
+    const sharp = (await import("sharp")).default;
+    if (!configured) {
+        configured = true;
+        const env = Number(process.env.IMAGES_SHARP_CONCURRENCY);
+        const n = override ?? (Number.isFinite(env) && env >= 0 ? Math.floor(env) : 1);
+        try {
+            sharp.concurrency(n);
+            if (process.platform === 'win32') sharp.cache({
+                memory: 50,
+                files: 0,
+                items: 100
+            });
+        } catch  {}
+    }
+    return sharp;
+};
+
+//# sourceMappingURL=sharpInstance.js.map

package/dist/transform/sharpInstance.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/transform/sharpInstance.ts"],"sourcesContent":["/**\n * Lazy Sharp loader with one-time global tuning. `sharp` is an optional peer and kept\n * out of client bundles, so it's imported on first use. On first load we cap the\n * per-image libvips thread pool: the transform endpoint's {@link withTransformLimit}\n * gate already provides cross-image parallelism, so each transform defaults to a single\n * libvips thread to bound memory on serverless (libaom still manages its own threads\n * for AVIF regardless of this). Override via the endpoint's `sharpConcurrency` option or\n * `IMAGES_SHARP_CONCURRENCY`; `0` resets Sharp to its default (CPU-core count).\n *\n * The libvips operation cache stays at Sharp's defaults (50MB / 100 ops) — EXCEPT its\n * file-descriptor cache on Windows: libvips keeps up to 20 recently-read files OPEN, and\n * Windows can't unlink an open file, so a transformed original would block its own\n * deletion (a reseed, a replaced upload) for as long as the process lives. POSIX unlinks\n * open files fine, so the fd cache is kept there.\n */\ntype SharpFactory = typeof import('sharp')['default']\n\nlet override: number | undefined\nlet configured = false\n\n/** Set the per-image libvips thread cap applied on the next Sharp load (negative ignored). */\nexport const setSharpConcurrency = (n?: number): void => {\n  if (n != null && Number.isFinite(n) && n >= 0) override = Math.floor(n)\n}\n\nexport const loadSharp = async (): Promise<SharpFactory> => {\n  const sharp = (await import('sharp')).default\n  if (!configured) {\n    configured = true\n    const env = Number(process.env.IMAGES_SHARP_CONCURRENCY)\n    const n = override ?? (Number.isFinite(env) && env >= 0 ? Math.floor(env) : 1)\n    try {\n      sharp.concurrency(n)\n      if (process.platform === 'win32') sharp.cache({ memory: 50, files: 0, items: 100 })\n    } catch {}\n  }\n  return sharp\n}\n"],"names":["override","configured","setSharpConcurrency","n","Number","isFinite","Math","floor","loadSharp","sharp","default","env","process","IMAGES_SHARP_CONCURRENCY","concurrency","platform","cache","memory","files","items"],"mappings":"AAAA;;;;;;;;;;;;;;CAcC,GAGD,IAAIA;AACJ,IAAIC,aAAa;AAEjB,4FAA4F,GAC5F,OAAO,MAAMC,sBAAsB,CAACC;IAClC,IAAIA,KAAK,QAAQC,OAAOC,QAAQ,CAACF,MAAMA,KAAK,GAAGH,WAAWM,KAAKC,KAAK,CAACJ;AACvE,EAAC;AAED,OAAO,MAAMK,YAAY;IACvB,MAAMC,QAAQ,AAAC,CAAA,MAAM,MAAM,CAAC,QAAO,EAAGC,OAAO;IAC7C,IAAI,CAACT,YAAY;QACfA,aAAa;QACb,MAAMU,MAAMP,OAAOQ,QAAQD,GAAG,CAACE,wBAAwB;QACvD,MAAMV,IAAIH,YAAaI,CAAAA,OAAOC,QAAQ,CAACM,QAAQA,OAAO,IAAIL,KAAKC,KAAK,CAACI,OAAO,CAAA;QAC5E,IAAI;YACFF,MAAMK,WAAW,CAACX;YAClB,IAAIS,QAAQG,QAAQ,KAAK,SAASN,MAAMO,KAAK,CAAC;gBAAEC,QAAQ;gBAAIC,OAAO;gBAAGC,OAAO;YAAI;QACnF,EAAE,OAAM,CAAC;IACX;IACA,OAAOV;AACT,EAAC"}

package/dist/transform/source.d.ts

@@ -0,0 +1,32 @@
+import { type Payload } from 'payload';
+export interface UploadDocLike {
+    filename?: string | null;
+    url?: string | null;
+    /** Cloud-storage adapters store their key prefix on the doc. */
+    prefix?: string | null;
+}
+/**
+ * SSRF guard for the remote-source fetch: always allow the configured server origin
+ * itself (so self-fetching Payload's own static route works, even on localhost in
+ * dev), but otherwise refuse private/loopback/link-local hosts — blocking cloud
+ * metadata endpoints and internal services reachable from a malicious `url`.
+ */
+export declare const isAllowedFetchTarget: (target: URL, trusted: URL | null) => boolean;
+/** Resolve a collection's on-disk upload directory (absolute). */
+export declare const resolveStaticDir: (payload: Payload, slug: string) => string;
+/**
+ * Read an upload's bytes. In order:
+ *  1. the local file under `staticDir` (verifying the resolved path stays inside it),
+ *  2. the collection's storage-adapter `upload.handlers`, invoked directly (cloud storage — no
+ *     HTTP, no access control; pass `via` to enable),
+ *  3. the absolute URL the doc reports (cloud storage), or
+ *  4. its relative URL resolved against `baseUrl` — i.e. self-fetch Payload's own
+ *     static file route, which serves the file whatever the adapter/storage is.
+ *
+ * Returns null when nothing yields bytes.
+ */
+export declare const readBytes: (doc: UploadDocLike, staticDir: string, baseUrl?: string, via?: {
+    payload: Payload;
+    slug: string;
+}) => Promise<Buffer | null>;
+//# sourceMappingURL=source.d.ts.map

package/dist/transform/source.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"source.d.ts","sourceRoot":"","sources":["../../src/transform/source.ts"],"names":[],"mappings":"AAQA,OAAO,EAAkB,KAAK,OAAO,EAAuB,MAAM,SAAS,CAAA;AAE3E,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACnB,gEAAgE;IAChE,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CACvB;AA4BD;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,GAAI,QAAQ,GAAG,EAAE,SAAS,GAAG,GAAG,IAAI,KAAG,OAGvE,CAAA;AAED,kEAAkE;AAClE,eAAO,MAAM,gBAAgB,GAAI,SAAS,OAAO,EAAE,MAAM,MAAM,KAAG,MAKjE,CAAA;AAyBD;;;;;;;;;;GAUG;AACH,eAAO,MAAM,SAAS,GACpB,KAAK,aAAa,EAClB,WAAW,MAAM,EACjB,UAAU,MAAM,EAChB,MAAM;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,KACvC,OAAO,CAAC,MAAM,GAAG,IAAI,CAuCvB,CAAA"}

package/dist/transform/source.js

@@ -0,0 +1,121 @@
+/**
+ * Read the raw bytes of an upload doc from either local disk (the collection's
+ * `staticDir`) or cloud storage (Vercel Blob, S3, …) by fetching the absolute URL
+ * Payload reports. Includes a path-traversal guard on the local read, a bounded fetch
+ * timeout, and an SSRF guard on the remote-fetch path.
+ */ import fs from "node:fs";
+import path from "node:path";
+import { createLocalReq } from "payload";
+const MAX_FETCH_BYTES = 64 * 1024 * 1024;
+/** True for hostnames in loopback / private / link-local space (the SSRF sinks). */ const isPrivateHost = (hostname)=>{
+    const h = hostname.toLowerCase().replace(/^\[|\]$/g, '');
+    if (h === 'localhost' || h.endsWith('.localhost') || h === '0.0.0.0' || h === '::1') return true;
+    const m = h.match(/^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/);
+    if (m) {
+        const a = Number(m[1]);
+        const b = Number(m[2]);
+        if (a === 0 || a === 10 || a === 127) return true;
+        if (a === 169 && b === 254) return true;
+        if (a === 192 && b === 168) return true;
+        if (a === 172 && b >= 16 && b <= 31) return true;
+        if (a === 100 && b >= 64 && b <= 127) return true;
+        return false;
+    }
+    return /^fe80:/i.test(h) || /^f[cd][0-9a-f]{2}:/i.test(h);
+};
+/**
+ * SSRF guard for the remote-source fetch: always allow the configured server origin
+ * itself (so self-fetching Payload's own static route works, even on localhost in
+ * dev), but otherwise refuse private/loopback/link-local hosts — blocking cloud
+ * metadata endpoints and internal services reachable from a malicious `url`.
+ */ export const isAllowedFetchTarget = (target, trusted)=>{
+    if (trusted && target.host === trusted.host) return true;
+    return !isPrivateHost(target.hostname);
+};
+/** Resolve a collection's on-disk upload directory (absolute). */ export const resolveStaticDir = (payload, slug)=>{
+    const collections = payload.collections;
+    const dir = collections?.[slug]?.config?.upload?.staticDir;
+    const base = dir?.length ? dir : slug;
+    return path.isAbsolute(base) ? base : path.resolve(process.cwd(), base);
+};
+/**
+ * Read the bytes through the collection's storage-adapter `upload.handlers` (Vercel Blob, S3, …).
+ * This is the same server-side path Payload's own file route takes after its access check —
+ * invoked directly, not over HTTP, so it needs no origin, cookie, or open read access. (The
+ * self-fetch fallback below can't serve an access-controlled collection like `generated-images`:
+ * its unauthenticated request 403s and every variant read becomes a cache miss.)
+ */ const readViaStorageHandlers = async (payload, slug, doc)=>{
+    const collections = payload.collections;
+    const handlers = collections?.[slug]?.config?.upload?.handlers;
+    if (!handlers?.length || !doc.filename) return null;
+    try {
+        const req = await createLocalReq({}, payload);
+        for (const handler of handlers){
+            const res = await handler(req, {
+                doc,
+                params: {
+                    collection: slug,
+                    filename: doc.filename,
+                    prefix: doc.prefix ?? undefined
+                }
+            });
+            if (res instanceof Response) return res.ok ? Buffer.from(await res.arrayBuffer()) : null;
+        }
+    } catch  {
+    // fall through to the URL fetch
+    }
+    return null;
+};
+/**
+ * Read an upload's bytes. In order:
+ *  1. the local file under `staticDir` (verifying the resolved path stays inside it),
+ *  2. the collection's storage-adapter `upload.handlers`, invoked directly (cloud storage — no
+ *     HTTP, no access control; pass `via` to enable),
+ *  3. the absolute URL the doc reports (cloud storage), or
+ *  4. its relative URL resolved against `baseUrl` — i.e. self-fetch Payload's own
+ *     static file route, which serves the file whatever the adapter/storage is.
+ *
+ * Returns null when nothing yields bytes.
+ */ export const readBytes = async (doc, staticDir, baseUrl, via)=>{
+    if (doc.filename) {
+        const base = path.resolve(staticDir);
+        const filePath = path.resolve(base, doc.filename);
+        if ((filePath === base || filePath.startsWith(base + path.sep)) && fs.existsSync(filePath)) return fs.readFileSync(filePath);
+    }
+    if (via) {
+        const bytes = await readViaStorageHandlers(via.payload, via.slug, doc);
+        if (bytes) return bytes;
+    }
+    if (typeof doc.url === 'string' && doc.url) {
+        const isAbsolute = /^https?:\/\//i.test(doc.url);
+        const base = (baseUrl ?? '').replace(/\/$/, '');
+        const targetStr = isAbsolute ? doc.url : base ? `${base}${doc.url.startsWith('/') ? '' : '/'}${doc.url}` : '';
+        if (/^https?:\/\//i.test(targetStr)) {
+            let target;
+            let trusted = null;
+            try {
+                target = new URL(targetStr);
+            } catch  {
+                return null;
+            }
+            try {
+                trusted = base ? new URL(base) : null;
+            } catch  {}
+            if (!isAllowedFetchTarget(target, trusted)) return null;
+            try {
+                const res = await fetch(targetStr, {
+                    signal: AbortSignal.timeout(15_000),
+                    redirect: 'manual'
+                });
+                if (!res.ok) return null;
+                const declared = Number(res.headers?.get?.('content-length') ?? '');
+                if (Number.isFinite(declared) && declared > MAX_FETCH_BYTES) return null;
+                const buf = Buffer.from(await res.arrayBuffer());
+                return buf.byteLength > MAX_FETCH_BYTES ? null : buf;
+            } catch  {}
+        }
+    }
+    return null;
+};
+
+//# sourceMappingURL=source.js.map

package/dist/transform/source.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/transform/source.ts"],"sourcesContent":["/**\n * Read the raw bytes of an upload doc from either local disk (the collection's\n * `staticDir`) or cloud storage (Vercel Blob, S3, …) by fetching the absolute URL\n * Payload reports. Includes a path-traversal guard on the local read, a bounded fetch\n * timeout, and an SSRF guard on the remote-fetch path.\n */\nimport fs from 'node:fs'\nimport path from 'node:path'\nimport { createLocalReq, type Payload, type PayloadRequest } from 'payload'\n\nexport interface UploadDocLike {\n  filename?: string | null\n  url?: string | null\n  /** Cloud-storage adapters store their key prefix on the doc. */\n  prefix?: string | null\n}\n\ntype UploadHandler = (\n  req: PayloadRequest,\n  args: { doc: unknown; headers?: Headers; params: { collection: string; filename: string; prefix?: string } },\n  // biome-ignore lint/suspicious/noConfusingVoidType: mirrors Payload's upload handler signature, which returns void\n) => Promise<Response | void> | Response | void\n\nconst MAX_FETCH_BYTES = 64 * 1024 * 1024\n\n/** True for hostnames in loopback / private / link-local space (the SSRF sinks). */\nconst isPrivateHost = (hostname: string): boolean => {\n  const h = hostname.toLowerCase().replace(/^\\[|\\]$/g, '')\n  if (h === 'localhost' || h.endsWith('.localhost') || h === '0.0.0.0' || h === '::1') return true\n  const m = h.match(/^(\\d{1,3})\\.(\\d{1,3})\\.(\\d{1,3})\\.(\\d{1,3})$/)\n  if (m) {\n    const a = Number(m[1])\n    const b = Number(m[2])\n    if (a === 0 || a === 10 || a === 127) return true\n    if (a === 169 && b === 254) return true\n    if (a === 192 && b === 168) return true\n    if (a === 172 && b >= 16 && b <= 31) return true\n    if (a === 100 && b >= 64 && b <= 127) return true\n    return false\n  }\n  return /^fe80:/i.test(h) || /^f[cd][0-9a-f]{2}:/i.test(h)\n}\n\n/**\n * SSRF guard for the remote-source fetch: always allow the configured server origin\n * itself (so self-fetching Payload's own static route works, even on localhost in\n * dev), but otherwise refuse private/loopback/link-local hosts — blocking cloud\n * metadata endpoints and internal services reachable from a malicious `url`.\n */\nexport const isAllowedFetchTarget = (target: URL, trusted: URL | null): boolean => {\n  if (trusted && target.host === trusted.host) return true\n  return !isPrivateHost(target.hostname)\n}\n\n/** Resolve a collection's on-disk upload directory (absolute). */\nexport const resolveStaticDir = (payload: Payload, slug: string): string => {\n  const collections = payload.collections as Record<string, { config?: { upload?: { staticDir?: string } } }>\n  const dir = collections?.[slug]?.config?.upload?.staticDir\n  const base = dir?.length ? dir : slug\n  return path.isAbsolute(base) ? base : path.resolve(process.cwd(), base)\n}\n\n/**\n * Read the bytes through the collection's storage-adapter `upload.handlers` (Vercel Blob, S3, …).\n * This is the same server-side path Payload's own file route takes after its access check —\n * invoked directly, not over HTTP, so it needs no origin, cookie, or open read access. (The\n * self-fetch fallback below can't serve an access-controlled collection like `generated-images`:\n * its unauthenticated request 403s and every variant read becomes a cache miss.)\n */\nconst readViaStorageHandlers = async (payload: Payload, slug: string, doc: UploadDocLike): Promise<Buffer | null> => {\n  const collections = payload.collections as Record<string, { config?: { upload?: { handlers?: UploadHandler[] } } }>\n  const handlers = collections?.[slug]?.config?.upload?.handlers\n  if (!handlers?.length || !doc.filename) return null\n  try {\n    const req = await createLocalReq({}, payload)\n    for (const handler of handlers) {\n      const res = await handler(req, { doc, params: { collection: slug, filename: doc.filename, prefix: doc.prefix ?? undefined } })\n      if (res instanceof Response) return res.ok ? Buffer.from(await res.arrayBuffer()) : null\n    }\n  } catch {\n    // fall through to the URL fetch\n  }\n  return null\n}\n\n/**\n * Read an upload's bytes. In order:\n *  1. the local file under `staticDir` (verifying the resolved path stays inside it),\n *  2. the collection's storage-adapter `upload.handlers`, invoked directly (cloud storage — no\n *     HTTP, no access control; pass `via` to enable),\n *  3. the absolute URL the doc reports (cloud storage), or\n *  4. its relative URL resolved against `baseUrl` — i.e. self-fetch Payload's own\n *     static file route, which serves the file whatever the adapter/storage is.\n *\n * Returns null when nothing yields bytes.\n */\nexport const readBytes = async (\n  doc: UploadDocLike,\n  staticDir: string,\n  baseUrl?: string,\n  via?: { payload: Payload; slug: string },\n): Promise<Buffer | null> => {\n  if (doc.filename) {\n    const base = path.resolve(staticDir)\n    const filePath = path.resolve(base, doc.filename)\n    if ((filePath === base || filePath.startsWith(base + path.sep)) && fs.existsSync(filePath)) return fs.readFileSync(filePath)\n  }\n\n  if (via) {\n    const bytes = await readViaStorageHandlers(via.payload, via.slug, doc)\n    if (bytes) return bytes\n  }\n\n  if (typeof doc.url === 'string' && doc.url) {\n    const isAbsolute = /^https?:\\/\\//i.test(doc.url)\n    const base = (baseUrl ?? '').replace(/\\/$/, '')\n    const targetStr = isAbsolute ? doc.url : base ? `${base}${doc.url.startsWith('/') ? '' : '/'}${doc.url}` : ''\n    if (/^https?:\\/\\//i.test(targetStr)) {\n      let target: URL\n      let trusted: URL | null = null\n      try {\n        target = new URL(targetStr)\n      } catch {\n        return null\n      }\n      try {\n        trusted = base ? new URL(base) : null\n      } catch {}\n      if (!isAllowedFetchTarget(target, trusted)) return null\n      try {\n        const res = await fetch(targetStr, { signal: AbortSignal.timeout(15_000), redirect: 'manual' })\n        if (!res.ok) return null\n        const declared = Number(res.headers?.get?.('content-length') ?? '')\n        if (Number.isFinite(declared) && declared > MAX_FETCH_BYTES) return null\n        const buf = Buffer.from(await res.arrayBuffer())\n        return buf.byteLength > MAX_FETCH_BYTES ? null : buf\n      } catch {}\n    }\n  }\n  return null\n}\n"],"names":["fs","path","createLocalReq","MAX_FETCH_BYTES","isPrivateHost","hostname","h","toLowerCase","replace","endsWith","m","match","a","Number","b","test","isAllowedFetchTarget","target","trusted","host","resolveStaticDir","payload","slug","collections","dir","config","upload","staticDir","base","length","isAbsolute","resolve","process","cwd","readViaStorageHandlers","doc","handlers","filename","req","handler","res","params","collection","prefix","undefined","Response","ok","Buffer","from","arrayBuffer","readBytes","baseUrl","via","filePath","startsWith","sep","existsSync","readFileSync","bytes","url","targetStr","URL","fetch","signal","AbortSignal","timeout","redirect","declared","headers","get","isFinite","buf","byteLength"],"mappings":"AAAA;;;;;CAKC,GACD,OAAOA,QAAQ,UAAS;AACxB,OAAOC,UAAU,YAAW;AAC5B,SAASC,cAAc,QAA2C,UAAS;AAe3E,MAAMC,kBAAkB,KAAK,OAAO;AAEpC,kFAAkF,GAClF,MAAMC,gBAAgB,CAACC;IACrB,MAAMC,IAAID,SAASE,WAAW,GAAGC,OAAO,CAAC,YAAY;IACrD,IAAIF,MAAM,eAAeA,EAAEG,QAAQ,CAAC,iBAAiBH,MAAM,aAAaA,MAAM,OAAO,OAAO;IAC5F,MAAMI,IAAIJ,EAAEK,KAAK,CAAC;IAClB,IAAID,GAAG;QACL,MAAME,IAAIC,OAAOH,CAAC,CAAC,EAAE;QACrB,MAAMI,IAAID,OAAOH,CAAC,CAAC,EAAE;QACrB,IAAIE,MAAM,KAAKA,MAAM,MAAMA,MAAM,KAAK,OAAO;QAC7C,IAAIA,MAAM,OAAOE,MAAM,KAAK,OAAO;QACnC,IAAIF,MAAM,OAAOE,MAAM,KAAK,OAAO;QACnC,IAAIF,MAAM,OAAOE,KAAK,MAAMA,KAAK,IAAI,OAAO;QAC5C,IAAIF,MAAM,OAAOE,KAAK,MAAMA,KAAK,KAAK,OAAO;QAC7C,OAAO;IACT;IACA,OAAO,UAAUC,IAAI,CAACT,MAAM,sBAAsBS,IAAI,CAACT;AACzD;AAEA;;;;;CAKC,GACD,OAAO,MAAMU,uBAAuB,CAACC,QAAaC;IAChD,IAAIA,WAAWD,OAAOE,IAAI,KAAKD,QAAQC,IAAI,EAAE,OAAO;IACpD,OAAO,CAACf,cAAca,OAAOZ,QAAQ;AACvC,EAAC;AAED,gEAAgE,GAChE,OAAO,MAAMe,mBAAmB,CAACC,SAAkBC;IACjD,MAAMC,cAAcF,QAAQE,WAAW;IACvC,MAAMC,MAAMD,aAAa,CAACD,KAAK,EAAEG,QAAQC,QAAQC;IACjD,MAAMC,OAAOJ,KAAKK,SAASL,MAAMF;IACjC,OAAOrB,KAAK6B,UAAU,CAACF,QAAQA,OAAO3B,KAAK8B,OAAO,CAACC,QAAQC,GAAG,IAAIL;AACpE,EAAC;AAED;;;;;;CAMC,GACD,MAAMM,yBAAyB,OAAOb,SAAkBC,MAAca;IACpE,MAAMZ,cAAcF,QAAQE,WAAW;IACvC,MAAMa,WAAWb,aAAa,CAACD,KAAK,EAAEG,QAAQC,QAAQU;IACtD,IAAI,CAACA,UAAUP,UAAU,CAACM,IAAIE,QAAQ,EAAE,OAAO;IAC/C,IAAI;QACF,MAAMC,MAAM,MAAMpC,eAAe,CAAC,GAAGmB;QACrC,KAAK,MAAMkB,WAAWH,SAAU;YAC9B,MAAMI,MAAM,MAAMD,QAAQD,KAAK;gBAAEH;gBAAKM,QAAQ;oBAAEC,YAAYpB;oBAAMe,UAAUF,IAAIE,QAAQ;oBAAEM,QAAQR,IAAIQ,MAAM,IAAIC;gBAAU;YAAE;YAC5H,IAAIJ,eAAeK,UAAU,OAAOL,IAAIM,EAAE,GAAGC,OAAOC,IAAI,CAAC,MAAMR,IAAIS,WAAW,MAAM;QACtF;IACF,EAAE,OAAM;IACN,gCAAgC;IAClC;IACA,OAAO;AACT;AAEA;;;;;;;;;;CAUC,GACD,OAAO,MAAMC,YAAY,OACvBf,KACAR,WACAwB,SACAC;IAEA,IAAIjB,IAAIE,QAAQ,EAAE;QAChB,MAAMT,OAAO3B,KAAK8B,OAAO,CAACJ;QAC1B,MAAM0B,WAAWpD,KAAK8B,OAAO,CAACH,MAAMO,IAAIE,QAAQ;QAChD,IAAI,AAACgB,CAAAA,aAAazB,QAAQyB,SAASC,UAAU,CAAC1B,OAAO3B,KAAKsD,GAAG,CAAA,KAAMvD,GAAGwD,UAAU,CAACH,WAAW,OAAOrD,GAAGyD,YAAY,CAACJ;IACrH;IAEA,IAAID,KAAK;QACP,MAAMM,QAAQ,MAAMxB,uBAAuBkB,IAAI/B,OAAO,EAAE+B,IAAI9B,IAAI,EAAEa;QAClE,IAAIuB,OAAO,OAAOA;IACpB;IAEA,IAAI,OAAOvB,IAAIwB,GAAG,KAAK,YAAYxB,IAAIwB,GAAG,EAAE;QAC1C,MAAM7B,aAAa,gBAAgBf,IAAI,CAACoB,IAAIwB,GAAG;QAC/C,MAAM/B,OAAO,AAACuB,CAAAA,WAAW,EAAC,EAAG3C,OAAO,CAAC,OAAO;QAC5C,MAAMoD,YAAY9B,aAAaK,IAAIwB,GAAG,GAAG/B,OAAO,GAAGA,OAAOO,IAAIwB,GAAG,CAACL,UAAU,CAAC,OAAO,KAAK,MAAMnB,IAAIwB,GAAG,EAAE,GAAG;QAC3G,IAAI,gBAAgB5C,IAAI,CAAC6C,YAAY;YACnC,IAAI3C;YACJ,IAAIC,UAAsB;YAC1B,IAAI;gBACFD,SAAS,IAAI4C,IAAID;YACnB,EAAE,OAAM;gBACN,OAAO;YACT;YACA,IAAI;gBACF1C,UAAUU,OAAO,IAAIiC,IAAIjC,QAAQ;YACnC,EAAE,OAAM,CAAC;YACT,IAAI,CAACZ,qBAAqBC,QAAQC,UAAU,OAAO;YACnD,IAAI;gBACF,MAAMsB,MAAM,MAAMsB,MAAMF,WAAW;oBAAEG,QAAQC,YAAYC,OAAO,CAAC;oBAASC,UAAU;gBAAS;gBAC7F,IAAI,CAAC1B,IAAIM,EAAE,EAAE,OAAO;gBACpB,MAAMqB,WAAWtD,OAAO2B,IAAI4B,OAAO,EAAEC,MAAM,qBAAqB;gBAChE,IAAIxD,OAAOyD,QAAQ,CAACH,aAAaA,WAAWhE,iBAAiB,OAAO;gBACpE,MAAMoE,MAAMxB,OAAOC,IAAI,CAAC,MAAMR,IAAIS,WAAW;gBAC7C,OAAOsB,IAAIC,UAAU,GAAGrE,kBAAkB,OAAOoE;YACnD,EAAE,OAAM,CAAC;QACX;IACF;IACA,OAAO;AACT,EAAC"}

package/dist/utils/urls.d.ts

@@ -0,0 +1,108 @@
+/**
+ * Isomorphic URL builders for the on-demand transform endpoint. NO Node / Sharp / server imports —
+ * safe to bundle into client components. `buildVariantUrl` / `buildSrcset` produce same-origin
+ * relative URLs by default (pass `baseUrl` for absolute); `getImageUrl` — the one-off/shareable
+ * helper — instead defaults `baseUrl` to `process.env.NEXT_PUBLIC_SERVER_URL` (a Next build-time
+ * constant, inlined in client bundles) so OG/email URLs come out absolute with no extra wiring.
+ */
+import { DEFAULT_PIXEL_STEP, type Fit, type Format } from '../transform/params';
+export { DEFAULT_PIXEL_STEP };
+/**
+ * Default base for transform URLs: `/api` + the endpoint's fixed `/img` path. Override
+ * `path` only if your Payload API route or Next.js basePath differs from the default.
+ */
+export declare const DEFAULT_TRANSFORM_API_PATH = "/api/img";
+export interface BuildUrlOptions {
+    fit?: Fit;
+    quality?: number;
+    format?: Format;
+    /** Render aspect ratio (`16/9` | `"16:9"`); derives `h` from each width. */
+    aspectRatio?: number | string;
+    /** Prefix for absolute URLs (e.g. `https://site.com`). Default '' (same-origin). */
+    baseUrl?: string;
+    /** Endpoint base. Default `/api/img` ({@link DEFAULT_TRANSFORM_API_PATH}); override only for a custom API route / basePath. */
+    path?: string;
+    /**
+     * Cache-busting version token appended as `v=`. Derive it from the source doc with
+     * {@link deriveVersion} so replacing the file or moving the focal point yields a new
+     * URL — busting immutable browser/CDN caches (the server ignores `v`, reading focal
+     * from the doc; it exists only to make the immutable URL honest).
+     */
+    version?: string;
+}
+/** Source-identity fields that determine the rendered pixels (independent of size/quality). */
+export interface VersionSource {
+    filename?: string | null;
+    focalX?: number | null;
+    focalY?: number | null;
+}
+/**
+ * A short, stable version token from the source-identity fields that change the
+ * rendered pixels (filename + focal point) — the same inputs the server folds into
+ * the variant cache key. Returns undefined when no identity is available (a bare id),
+ * in which case URLs carry no `v` — so pass a populated doc to get cache-correct
+ * busting on file replace / focal edits.
+ */
+export declare const deriveVersion: (src?: VersionSource | null) => string | undefined;
+/** A bare id, or a populated image doc (so the version token + a default width can be read off it). */
+export type ImageResource = string | number | ({
+    id: string | number;
+    width?: number | null;
+} & VersionSource) | null | undefined;
+export interface GetImageUrlOptions extends BuildUrlOptions {
+    /** Output width. Falls back to a populated doc's intrinsic width, else 1280. */
+    width?: number;
+    /** Prefix for absolute URLs. Defaults to `NEXT_PUBLIC_SERVER_URL`; pass `''` for a relative URL. */
+    baseUrl?: string;
+}
+/**
+ * One transform URL for an image, taking the id OR a populated doc directly: it resolves the
+ * id, picks a sensible default width, and (for a doc) folds in the cache-busting version
+ * automatically — so you don't re-implement the resolve-and-`deriveVersion` dance every time
+ * you need a raw URL (OG tags, CSS backgrounds, emails). Returns null when there's no id.
+ * For a responsive `<img>`, prefer `<ResponsiveImage>` / {@link buildSrcset}.
+ *
+ * Because these URLs are usually for external/shareable contexts (OG, email), `baseUrl` defaults
+ * to `process.env.NEXT_PUBLIC_SERVER_URL` so the result is absolute with no extra wiring. Pass an
+ * explicit `baseUrl` to override, or `baseUrl: ''` to force a relative same-origin URL.
+ */
+export declare const getImageUrl: (resource: ImageResource, o?: GetImageUrlOptions) => string | null;
+export declare const buildVariantUrl: (id: string, width: number, o?: BuildUrlOptions) => string;
+/**
+ * The widths for a srcset. Two modes via `pixelStep`:
+ *
+ *  - a **number** (the step): every multiple of it up to the source's intrinsic width,
+ *    then the exact source width as the final candidate (so the srcset always tops out
+ *    at the true native resolution, not the largest step multiple below it). With no
+ *    source width, steps up to `maxWidth`.
+ *  - an **array** (an explicit, possibly non-linear ladder à la a curated width list):
+ *    the ladder values that fall below the source width, then the exact source width on
+ *    top. With no source width, the ladder is used as-is (its author-chosen cap is kept).
+ *
+ * Either way no width exceeds the source (no upscaling) or `maxWidth`. The entry count is
+ * bounded by the size ceiling: a bigger step / a shorter ladder / a smaller source yields
+ * fewer widths (and so fewer cached variants).
+ */
+export declare const stepWidths: (sourceWidth?: number, pixelStep?: number | number[], maxWidth?: number) => number[];
+export interface BuildSrcsetOptions extends BuildUrlOptions {
+    /**
+     * The srcset widths. A number is the step increment (default 50; bigger = fewer widths).
+     * An array is an explicit, curated ladder of widths (e.g. `[200, 450, 750, 1200, 2000]`)
+     * — non-linear, denser where it matters, fewer entries than a fine linear step.
+     */
+    pixelStep?: number | number[];
+    /** The source image's intrinsic width — caps the srcset (no upscaling). */
+    sourceWidth?: number;
+    /** Hard ceiling. Default 4096. */
+    maxWidth?: number;
+    /** Width used for the plain `src` fallback. Defaults to min(top, 1280). */
+    defaultWidth?: number;
+}
+export interface BuildSrcsetResult {
+    srcset: string;
+    src: string;
+}
+/** Build a responsive `srcset` (pixelStep multiples up to the source width) + a default `src`. */
+export declare const buildSrcset: (id: string, o?: BuildSrcsetOptions) => BuildSrcsetResult;
+export type { Fit, Format };
+//# sourceMappingURL=urls.d.ts.map

package/dist/utils/urls.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"urls.d.ts","sourceRoot":"","sources":["../../src/utils/urls.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,kBAAkB,EAAE,KAAK,GAAG,EAAE,KAAK,MAAM,EAAoB,MAAM,qBAAqB,CAAA;AAEjG,OAAO,EAAE,kBAAkB,EAAE,CAAA;AAE7B;;;GAGG;AACH,eAAO,MAAM,0BAA0B,aAAa,CAAA;AAEpD,MAAM,WAAW,eAAe;IAC9B,GAAG,CAAC,EAAE,GAAG,CAAA;IACT,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,4EAA4E;IAC5E,WAAW,CAAC,EAAE,MAAM,GAAG,MAAM,CAAA;IAC7B,oFAAoF;IACpF,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,+HAA+H;IAC/H,IAAI,CAAC,EAAE,MAAM,CAAA;IACb;;;;;OAKG;IACH,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB;AAED,+FAA+F;AAC/F,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACtB,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CACvB;AAWD;;;;;;GAMG;AACH,eAAO,MAAM,aAAa,GAAI,MAAM,aAAa,GAAG,IAAI,KAAG,MAAM,GAAG,SAKnE,CAAA;AAED,uGAAuG;AACvG,MAAM,MAAM,aAAa,GAAG,MAAM,GAAG,MAAM,GAAG,CAAC;IAAE,EAAE,EAAE,MAAM,GAAG,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GAAG,aAAa,CAAC,GAAG,IAAI,GAAG,SAAS,CAAA;AAEjI,MAAM,WAAW,kBAAmB,SAAQ,eAAe;IACzD,gFAAgF;IAChF,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,oGAAoG;IACpG,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB;AAED;;;;;;;;;;GAUG;AACH,eAAO,MAAM,WAAW,GAAI,UAAU,aAAa,EAAE,IAAG,kBAAuB,KAAG,MAAM,GAAG,IAW1F,CAAA;AAED,eAAO,MAAM,eAAe,GAAI,IAAI,MAAM,EAAE,OAAO,MAAM,EAAE,IAAG,eAAoB,KAAG,MAYpF,CAAA;AAED;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,UAAU,GAAI,cAAc,MAAM,EAAE,YAAW,MAAM,GAAG,MAAM,EAAuB,EAAE,iBAAe,KAAG,MAAM,EAwB3H,CAAA;AAED,MAAM,WAAW,kBAAmB,SAAQ,eAAe;IACzD;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IAC7B,2EAA2E;IAC3E,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,kCAAkC;IAClC,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,2EAA2E;IAC3E,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB;AAED,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,MAAM,CAAA;IACd,GAAG,EAAE,MAAM,CAAA;CACZ;AAED,kGAAkG;AAClG,eAAO,MAAM,WAAW,GAAI,IAAI,MAAM,EAAE,IAAG,kBAAuB,KAAG,iBAMpE,CAAA;AAED,YAAY,EAAE,GAAG,EAAE,MAAM,EAAE,CAAA"}

package/dist/utils/urls.js

@@ -0,0 +1,113 @@
+/**
+ * Isomorphic URL builders for the on-demand transform endpoint. NO Node / Sharp / server imports —
+ * safe to bundle into client components. `buildVariantUrl` / `buildSrcset` produce same-origin
+ * relative URLs by default (pass `baseUrl` for absolute); `getImageUrl` — the one-off/shareable
+ * helper — instead defaults `baseUrl` to `process.env.NEXT_PUBLIC_SERVER_URL` (a Next build-time
+ * constant, inlined in client bundles) so OG/email URLs come out absolute with no extra wiring.
+ */ import { DEFAULT_PIXEL_STEP, parseAspectRatio } from "../transform/params.js";
+export { DEFAULT_PIXEL_STEP };
+/**
+ * Default base for transform URLs: `/api` + the endpoint's fixed `/img` path. Override
+ * `path` only if your Payload API route or Next.js basePath differs from the default.
+ */ export const DEFAULT_TRANSFORM_API_PATH = '/api/img';
+const fnv1a = (s)=>{
+    let h = 0x811c9dc5;
+    for(let i = 0; i < s.length; i++){
+        h ^= s.charCodeAt(i);
+        h = Math.imul(h, 0x01000193);
+    }
+    return (h >>> 0).toString(36);
+};
+/**
+ * A short, stable version token from the source-identity fields that change the
+ * rendered pixels (filename + focal point) — the same inputs the server folds into
+ * the variant cache key. Returns undefined when no identity is available (a bare id),
+ * in which case URLs carry no `v` — so pass a populated doc to get cache-correct
+ * busting on file replace / focal edits.
+ */ export const deriveVersion = (src)=>{
+    if (!src) return undefined;
+    const { filename, focalX, focalY } = src;
+    if (filename == null && focalX == null && focalY == null) return undefined;
+    return fnv1a(`${filename ?? ''}|${focalX ?? ''}|${focalY ?? ''}`);
+};
+/**
+ * One transform URL for an image, taking the id OR a populated doc directly: it resolves the
+ * id, picks a sensible default width, and (for a doc) folds in the cache-busting version
+ * automatically — so you don't re-implement the resolve-and-`deriveVersion` dance every time
+ * you need a raw URL (OG tags, CSS backgrounds, emails). Returns null when there's no id.
+ * For a responsive `<img>`, prefer `<ResponsiveImage>` / {@link buildSrcset}.
+ *
+ * Because these URLs are usually for external/shareable contexts (OG, email), `baseUrl` defaults
+ * to `process.env.NEXT_PUBLIC_SERVER_URL` so the result is absolute with no extra wiring. Pass an
+ * explicit `baseUrl` to override, or `baseUrl: ''` to force a relative same-origin URL.
+ */ export const getImageUrl = (resource, o = {})=>{
+    if (resource == null) return null;
+    const doc = typeof resource === 'object' ? resource : undefined;
+    const id = doc ? doc.id == null ? '' : String(doc.id) : String(resource);
+    if (!id) return null;
+    const width = o.width ?? doc?.width ?? 1280;
+    return buildVariantUrl(id, width, {
+        ...o,
+        baseUrl: o.baseUrl ?? (process.env.NEXT_PUBLIC_SERVER_URL || undefined),
+        version: o.version ?? deriveVersion(doc)
+    });
+};
+export const buildVariantUrl = (id, width, o = {})=>{
+    const base = o.baseUrl ?? '';
+    const apiPath = o.path ?? DEFAULT_TRANSFORM_API_PATH;
+    const ar = parseAspectRatio(o.aspectRatio);
+    const params = new URLSearchParams();
+    params.set('w', String(Math.round(width)));
+    if (ar) params.set('h', String(Math.round(width / ar)));
+    params.set('fit', o.fit ?? 'cover');
+    params.set('q', String(o.quality ?? 75));
+    params.set('fmt', o.format ?? 'auto');
+    if (o.version) params.set('v', o.version);
+    return `${base}${apiPath}/${encodeURIComponent(id)}?${params.toString()}`;
+};
+/**
+ * The widths for a srcset. Two modes via `pixelStep`:
+ *
+ *  - a **number** (the step): every multiple of it up to the source's intrinsic width,
+ *    then the exact source width as the final candidate (so the srcset always tops out
+ *    at the true native resolution, not the largest step multiple below it). With no
+ *    source width, steps up to `maxWidth`.
+ *  - an **array** (an explicit, possibly non-linear ladder à la a curated width list):
+ *    the ladder values that fall below the source width, then the exact source width on
+ *    top. With no source width, the ladder is used as-is (its author-chosen cap is kept).
+ *
+ * Either way no width exceeds the source (no upscaling) or `maxWidth`. The entry count is
+ * bounded by the size ceiling: a bigger step / a shorter ladder / a smaller source yields
+ * fewer widths (and so fewer cached variants).
+ */ export const stepWidths = (sourceWidth, pixelStep = DEFAULT_PIXEL_STEP, maxWidth = 4096)=>{
+    const known = sourceWidth && sourceWidth > 0 ? Math.min(maxWidth, Math.round(sourceWidth)) : undefined;
+    if (Array.isArray(pixelStep)) {
+        const ladder = [
+            ...new Set(pixelStep.filter((w)=>Number.isFinite(w) && w > 0).map((w)=>Math.round(w)).filter((w)=>w <= maxWidth))
+        ].sort((a, b)=>a - b);
+        if (known == null) return ladder.length ? ladder : [
+            maxWidth
+        ];
+        const widths = ladder.filter((w)=>w < known);
+        widths.push(known); // exact source width as the top candidate
+        return widths;
+    }
+    const step = pixelStep > 0 ? pixelStep : DEFAULT_PIXEL_STEP;
+    const top = known ?? maxWidth;
+    const widths = [];
+    for(let w = step; w < top; w += step)widths.push(w);
+    widths.push(top);
+    return widths;
+};
+/** Build a responsive `srcset` (pixelStep multiples up to the source width) + a default `src`. */ export const buildSrcset = (id, o = {})=>{
+    const widths = stepWidths(o.sourceWidth, o.pixelStep, o.maxWidth);
+    const srcset = widths.map((w)=>`${buildVariantUrl(id, w, o)} ${w}w`).join(', ');
+    const top = widths[widths.length - 1] ?? o.maxWidth ?? 4096;
+    const src = buildVariantUrl(id, o.defaultWidth ?? Math.min(top, 1280), o);
+    return {
+        srcset,
+        src
+    };
+};
+
+//# sourceMappingURL=urls.js.map

package/dist/utils/urls.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/utils/urls.ts"],"sourcesContent":["/**\n * Isomorphic URL builders for the on-demand transform endpoint. NO Node / Sharp / server imports —\n * safe to bundle into client components. `buildVariantUrl` / `buildSrcset` produce same-origin\n * relative URLs by default (pass `baseUrl` for absolute); `getImageUrl` — the one-off/shareable\n * helper — instead defaults `baseUrl` to `process.env.NEXT_PUBLIC_SERVER_URL` (a Next build-time\n * constant, inlined in client bundles) so OG/email URLs come out absolute with no extra wiring.\n */\nimport { DEFAULT_PIXEL_STEP, type Fit, type Format, parseAspectRatio } from '../transform/params'\n\nexport { DEFAULT_PIXEL_STEP }\n\n/**\n * Default base for transform URLs: `/api` + the endpoint's fixed `/img` path. Override\n * `path` only if your Payload API route or Next.js basePath differs from the default.\n */\nexport const DEFAULT_TRANSFORM_API_PATH = '/api/img'\n\nexport interface BuildUrlOptions {\n  fit?: Fit\n  quality?: number\n  format?: Format\n  /** Render aspect ratio (`16/9` | `\"16:9\"`); derives `h` from each width. */\n  aspectRatio?: number | string\n  /** Prefix for absolute URLs (e.g. `https://site.com`). Default '' (same-origin). */\n  baseUrl?: string\n  /** Endpoint base. Default `/api/img` ({@link DEFAULT_TRANSFORM_API_PATH}); override only for a custom API route / basePath. */\n  path?: string\n  /**\n   * Cache-busting version token appended as `v=`. Derive it from the source doc with\n   * {@link deriveVersion} so replacing the file or moving the focal point yields a new\n   * URL — busting immutable browser/CDN caches (the server ignores `v`, reading focal\n   * from the doc; it exists only to make the immutable URL honest).\n   */\n  version?: string\n}\n\n/** Source-identity fields that determine the rendered pixels (independent of size/quality). */\nexport interface VersionSource {\n  filename?: string | null\n  focalX?: number | null\n  focalY?: number | null\n}\n\nconst fnv1a = (s: string): string => {\n  let h = 0x811c9dc5\n  for (let i = 0; i < s.length; i++) {\n    h ^= s.charCodeAt(i)\n    h = Math.imul(h, 0x01000193)\n  }\n  return (h >>> 0).toString(36)\n}\n\n/**\n * A short, stable version token from the source-identity fields that change the\n * rendered pixels (filename + focal point) — the same inputs the server folds into\n * the variant cache key. Returns undefined when no identity is available (a bare id),\n * in which case URLs carry no `v` — so pass a populated doc to get cache-correct\n * busting on file replace / focal edits.\n */\nexport const deriveVersion = (src?: VersionSource | null): string | undefined => {\n  if (!src) return undefined\n  const { filename, focalX, focalY } = src\n  if (filename == null && focalX == null && focalY == null) return undefined\n  return fnv1a(`${filename ?? ''}|${focalX ?? ''}|${focalY ?? ''}`)\n}\n\n/** A bare id, or a populated image doc (so the version token + a default width can be read off it). */\nexport type ImageResource = string | number | ({ id: string | number; width?: number | null } & VersionSource) | null | undefined\n\nexport interface GetImageUrlOptions extends BuildUrlOptions {\n  /** Output width. Falls back to a populated doc's intrinsic width, else 1280. */\n  width?: number\n  /** Prefix for absolute URLs. Defaults to `NEXT_PUBLIC_SERVER_URL`; pass `''` for a relative URL. */\n  baseUrl?: string\n}\n\n/**\n * One transform URL for an image, taking the id OR a populated doc directly: it resolves the\n * id, picks a sensible default width, and (for a doc) folds in the cache-busting version\n * automatically — so you don't re-implement the resolve-and-`deriveVersion` dance every time\n * you need a raw URL (OG tags, CSS backgrounds, emails). Returns null when there's no id.\n * For a responsive `<img>`, prefer `<ResponsiveImage>` / {@link buildSrcset}.\n *\n * Because these URLs are usually for external/shareable contexts (OG, email), `baseUrl` defaults\n * to `process.env.NEXT_PUBLIC_SERVER_URL` so the result is absolute with no extra wiring. Pass an\n * explicit `baseUrl` to override, or `baseUrl: ''` to force a relative same-origin URL.\n */\nexport const getImageUrl = (resource: ImageResource, o: GetImageUrlOptions = {}): string | null => {\n  if (resource == null) return null\n  const doc = typeof resource === 'object' ? resource : undefined\n  const id = doc ? (doc.id == null ? '' : String(doc.id)) : String(resource)\n  if (!id) return null\n  const width = o.width ?? doc?.width ?? 1280\n  return buildVariantUrl(id, width, {\n    ...o,\n    baseUrl: o.baseUrl ?? (process.env.NEXT_PUBLIC_SERVER_URL || undefined),\n    version: o.version ?? deriveVersion(doc),\n  })\n}\n\nexport const buildVariantUrl = (id: string, width: number, o: BuildUrlOptions = {}): string => {\n  const base = o.baseUrl ?? ''\n  const apiPath = o.path ?? DEFAULT_TRANSFORM_API_PATH\n  const ar = parseAspectRatio(o.aspectRatio)\n  const params = new URLSearchParams()\n  params.set('w', String(Math.round(width)))\n  if (ar) params.set('h', String(Math.round(width / ar)))\n  params.set('fit', o.fit ?? 'cover')\n  params.set('q', String(o.quality ?? 75))\n  params.set('fmt', o.format ?? 'auto')\n  if (o.version) params.set('v', o.version)\n  return `${base}${apiPath}/${encodeURIComponent(id)}?${params.toString()}`\n}\n\n/**\n * The widths for a srcset. Two modes via `pixelStep`:\n *\n *  - a **number** (the step): every multiple of it up to the source's intrinsic width,\n *    then the exact source width as the final candidate (so the srcset always tops out\n *    at the true native resolution, not the largest step multiple below it). With no\n *    source width, steps up to `maxWidth`.\n *  - an **array** (an explicit, possibly non-linear ladder à la a curated width list):\n *    the ladder values that fall below the source width, then the exact source width on\n *    top. With no source width, the ladder is used as-is (its author-chosen cap is kept).\n *\n * Either way no width exceeds the source (no upscaling) or `maxWidth`. The entry count is\n * bounded by the size ceiling: a bigger step / a shorter ladder / a smaller source yields\n * fewer widths (and so fewer cached variants).\n */\nexport const stepWidths = (sourceWidth?: number, pixelStep: number | number[] = DEFAULT_PIXEL_STEP, maxWidth = 4096): number[] => {\n  const known = sourceWidth && sourceWidth > 0 ? Math.min(maxWidth, Math.round(sourceWidth)) : undefined\n\n  if (Array.isArray(pixelStep)) {\n    const ladder = [\n      ...new Set(\n        pixelStep\n          .filter((w) => Number.isFinite(w) && w > 0)\n          .map((w) => Math.round(w))\n          .filter((w) => w <= maxWidth),\n      ),\n    ].sort((a, b) => a - b)\n    if (known == null) return ladder.length ? ladder : [maxWidth]\n    const widths = ladder.filter((w) => w < known)\n    widths.push(known) // exact source width as the top candidate\n    return widths\n  }\n\n  const step = pixelStep > 0 ? pixelStep : DEFAULT_PIXEL_STEP\n  const top = known ?? maxWidth\n  const widths: number[] = []\n  for (let w = step; w < top; w += step) widths.push(w)\n  widths.push(top)\n  return widths\n}\n\nexport interface BuildSrcsetOptions extends BuildUrlOptions {\n  /**\n   * The srcset widths. A number is the step increment (default 50; bigger = fewer widths).\n   * An array is an explicit, curated ladder of widths (e.g. `[200, 450, 750, 1200, 2000]`)\n   * — non-linear, denser where it matters, fewer entries than a fine linear step.\n   */\n  pixelStep?: number | number[]\n  /** The source image's intrinsic width — caps the srcset (no upscaling). */\n  sourceWidth?: number\n  /** Hard ceiling. Default 4096. */\n  maxWidth?: number\n  /** Width used for the plain `src` fallback. Defaults to min(top, 1280). */\n  defaultWidth?: number\n}\n\nexport interface BuildSrcsetResult {\n  srcset: string\n  src: string\n}\n\n/** Build a responsive `srcset` (pixelStep multiples up to the source width) + a default `src`. */\nexport const buildSrcset = (id: string, o: BuildSrcsetOptions = {}): BuildSrcsetResult => {\n  const widths = stepWidths(o.sourceWidth, o.pixelStep, o.maxWidth)\n  const srcset = widths.map((w) => `${buildVariantUrl(id, w, o)} ${w}w`).join(', ')\n  const top = widths[widths.length - 1] ?? o.maxWidth ?? 4096\n  const src = buildVariantUrl(id, o.defaultWidth ?? Math.min(top, 1280), o)\n  return { srcset, src }\n}\n\nexport type { Fit, Format }\n"],"names":["DEFAULT_PIXEL_STEP","parseAspectRatio","DEFAULT_TRANSFORM_API_PATH","fnv1a","s","h","i","length","charCodeAt","Math","imul","toString","deriveVersion","src","undefined","filename","focalX","focalY","getImageUrl","resource","o","doc","id","String","width","buildVariantUrl","baseUrl","process","env","NEXT_PUBLIC_SERVER_URL","version","base","apiPath","path","ar","aspectRatio","params","URLSearchParams","set","round","fit","quality","format","encodeURIComponent","stepWidths","sourceWidth","pixelStep","maxWidth","known","min","Array","isArray","ladder","Set","filter","w","Number","isFinite","map","sort","a","b","widths","push","step","top","buildSrcset","srcset","join","defaultWidth"],"mappings":"AAAA;;;;;;CAMC,GACD,SAASA,kBAAkB,EAAyBC,gBAAgB,QAAQ,yBAAqB;AAEjG,SAASD,kBAAkB,GAAE;AAE7B;;;CAGC,GACD,OAAO,MAAME,6BAA6B,WAAU;AA4BpD,MAAMC,QAAQ,CAACC;IACb,IAAIC,IAAI;IACR,IAAK,IAAIC,IAAI,GAAGA,IAAIF,EAAEG,MAAM,EAAED,IAAK;QACjCD,KAAKD,EAAEI,UAAU,CAACF;QAClBD,IAAII,KAAKC,IAAI,CAACL,GAAG;IACnB;IACA,OAAO,AAACA,CAAAA,MAAM,CAAA,EAAGM,QAAQ,CAAC;AAC5B;AAEA;;;;;;CAMC,GACD,OAAO,MAAMC,gBAAgB,CAACC;IAC5B,IAAI,CAACA,KAAK,OAAOC;IACjB,MAAM,EAAEC,QAAQ,EAAEC,MAAM,EAAEC,MAAM,EAAE,GAAGJ;IACrC,IAAIE,YAAY,QAAQC,UAAU,QAAQC,UAAU,MAAM,OAAOH;IACjE,OAAOX,MAAM,GAAGY,YAAY,GAAG,CAAC,EAAEC,UAAU,GAAG,CAAC,EAAEC,UAAU,IAAI;AAClE,EAAC;AAYD;;;;;;;;;;CAUC,GACD,OAAO,MAAMC,cAAc,CAACC,UAAyBC,IAAwB,CAAC,CAAC;IAC7E,IAAID,YAAY,MAAM,OAAO;IAC7B,MAAME,MAAM,OAAOF,aAAa,WAAWA,WAAWL;IACtD,MAAMQ,KAAKD,MAAOA,IAAIC,EAAE,IAAI,OAAO,KAAKC,OAAOF,IAAIC,EAAE,IAAKC,OAAOJ;IACjE,IAAI,CAACG,IAAI,OAAO;IAChB,MAAME,QAAQJ,EAAEI,KAAK,IAAIH,KAAKG,SAAS;IACvC,OAAOC,gBAAgBH,IAAIE,OAAO;QAChC,GAAGJ,CAAC;QACJM,SAASN,EAAEM,OAAO,IAAKC,CAAAA,QAAQC,GAAG,CAACC,sBAAsB,IAAIf,SAAQ;QACrEgB,SAASV,EAAEU,OAAO,IAAIlB,cAAcS;IACtC;AACF,EAAC;AAED,OAAO,MAAMI,kBAAkB,CAACH,IAAYE,OAAeJ,IAAqB,CAAC,CAAC;IAChF,MAAMW,OAAOX,EAAEM,OAAO,IAAI;IAC1B,MAAMM,UAAUZ,EAAEa,IAAI,IAAI/B;IAC1B,MAAMgC,KAAKjC,iBAAiBmB,EAAEe,WAAW;IACzC,MAAMC,SAAS,IAAIC;IACnBD,OAAOE,GAAG,CAAC,KAAKf,OAAOd,KAAK8B,KAAK,CAACf;IAClC,IAAIU,IAAIE,OAAOE,GAAG,CAAC,KAAKf,OAAOd,KAAK8B,KAAK,CAACf,QAAQU;IAClDE,OAAOE,GAAG,CAAC,OAAOlB,EAAEoB,GAAG,IAAI;IAC3BJ,OAAOE,GAAG,CAAC,KAAKf,OAAOH,EAAEqB,OAAO,IAAI;IACpCL,OAAOE,GAAG,CAAC,OAAOlB,EAAEsB,MAAM,IAAI;IAC9B,IAAItB,EAAEU,OAAO,EAAEM,OAAOE,GAAG,CAAC,KAAKlB,EAAEU,OAAO;IACxC,OAAO,GAAGC,OAAOC,QAAQ,CAAC,EAAEW,mBAAmBrB,IAAI,CAAC,EAAEc,OAAOzB,QAAQ,IAAI;AAC3E,EAAC;AAED;;;;;;;;;;;;;;CAcC,GACD,OAAO,MAAMiC,aAAa,CAACC,aAAsBC,YAA+B9C,kBAAkB,EAAE+C,WAAW,IAAI;IACjH,MAAMC,QAAQH,eAAeA,cAAc,IAAIpC,KAAKwC,GAAG,CAACF,UAAUtC,KAAK8B,KAAK,CAACM,gBAAgB/B;IAE7F,IAAIoC,MAAMC,OAAO,CAACL,YAAY;QAC5B,MAAMM,SAAS;eACV,IAAIC,IACLP,UACGQ,MAAM,CAAC,CAACC,IAAMC,OAAOC,QAAQ,CAACF,MAAMA,IAAI,GACxCG,GAAG,CAAC,CAACH,IAAM9C,KAAK8B,KAAK,CAACgB,IACtBD,MAAM,CAAC,CAACC,IAAMA,KAAKR;SAEzB,CAACY,IAAI,CAAC,CAACC,GAAGC,IAAMD,IAAIC;QACrB,IAAIb,SAAS,MAAM,OAAOI,OAAO7C,MAAM,GAAG6C,SAAS;YAACL;SAAS;QAC7D,MAAMe,SAASV,OAAOE,MAAM,CAAC,CAACC,IAAMA,IAAIP;QACxCc,OAAOC,IAAI,CAACf,QAAO,0CAA0C;QAC7D,OAAOc;IACT;IAEA,MAAME,OAAOlB,YAAY,IAAIA,YAAY9C;IACzC,MAAMiE,MAAMjB,SAASD;IACrB,MAAMe,SAAmB,EAAE;IAC3B,IAAK,IAAIP,IAAIS,MAAMT,IAAIU,KAAKV,KAAKS,KAAMF,OAAOC,IAAI,CAACR;IACnDO,OAAOC,IAAI,CAACE;IACZ,OAAOH;AACT,EAAC;AAsBD,gGAAgG,GAChG,OAAO,MAAMI,cAAc,CAAC5C,IAAYF,IAAwB,CAAC,CAAC;IAChE,MAAM0C,SAASlB,WAAWxB,EAAEyB,WAAW,EAAEzB,EAAE0B,SAAS,EAAE1B,EAAE2B,QAAQ;IAChE,MAAMoB,SAASL,OAAOJ,GAAG,CAAC,CAACH,IAAM,GAAG9B,gBAAgBH,IAAIiC,GAAGnC,GAAG,CAAC,EAAEmC,EAAE,CAAC,CAAC,EAAEa,IAAI,CAAC;IAC5E,MAAMH,MAAMH,MAAM,CAACA,OAAOvD,MAAM,GAAG,EAAE,IAAIa,EAAE2B,QAAQ,IAAI;IACvD,MAAMlC,MAAMY,gBAAgBH,IAAIF,EAAEiD,YAAY,IAAI5D,KAAKwC,GAAG,CAACgB,KAAK,OAAO7C;IACvE,OAAO;QAAE+C;QAAQtD;IAAI;AACvB,EAAC"}

package/dist/variants/key.d.ts

@@ -0,0 +1,9 @@
+import type { ParsedParams } from '../transform/params';
+export interface CacheKeyDoc {
+    id: string | number;
+    filename?: string | null;
+    focalX?: number | null;
+    focalY?: number | null;
+}
+export declare const variantCacheKey: (doc: CacheKeyDoc, p: ParsedParams, resolvedFormat: string) => string;
+//# sourceMappingURL=key.d.ts.map

package/dist/variants/key.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"key.d.ts","sourceRoot":"","sources":["../../src/variants/key.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAA;AAEvD,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,GAAG,MAAM,CAAA;IACnB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACtB,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CACvB;AAED,eAAO,MAAM,eAAe,GAAI,KAAK,WAAW,EAAE,GAAG,YAAY,EAAE,gBAAgB,MAAM,KAAG,MAI3F,CAAA"}