@pyreon/zero 0.16.0 → 0.19.0

package/lib/{api-routes-Ci0kVmM4.js → api-routes-CQiOi3q5.js}

@@ -16,17 +16,19 @@ function matchApiRoute(pattern, path) {
 	const patternParts = pattern.split("/").filter(Boolean);
 	const pathParts = path.split("/").filter(Boolean);
 	const params = {};
+	const isUnsafeParam = (name) => name === "__proto__" || name === "constructor" || name === "prototype";
 	for (let i = 0; i < patternParts.length; i++) {
 		const pp = patternParts[i];
 		if (!pp) continue;
 		if (pp.endsWith("*")) {
 			const paramName = pp.slice(1, -1);
-			params[paramName] = pathParts.slice(i).join("/");
+			if (!isUnsafeParam(paramName)) params[paramName] = pathParts.slice(i).join("/");
 			return params;
 		}
 		if (i >= pathParts.length) return null;
 		if (pp.startsWith(":")) {
-			params[pp.slice(1)] = pathParts[i];
+			const paramName = pp.slice(1);
+			if (!isUnsafeParam(paramName)) params[paramName] = pathParts[i];
 			continue;
 		}
 		if (pp !== pathParts[i]) return null;
@@ -143,4 +145,4 @@ function generateApiRouteModule(files, routesDir) {
 
 //#endregion
 export { matchApiRoute as i, createApiMiddleware as n, generateApiRouteModule as r, api_routes_exports as t };
-//# sourceMappingURL=api-routes-Ci0kVmM4.js.map
+//# sourceMappingURL=api-routes-CQiOi3q5.js.map

package/lib/api-routes.js

@@ -7,17 +7,19 @@ function matchApiRoute(pattern, path) {
 	const patternParts = pattern.split("/").filter(Boolean);
 	const pathParts = path.split("/").filter(Boolean);
 	const params = {};
+	const isUnsafeParam = (name) => name === "__proto__" || name === "constructor" || name === "prototype";
 	for (let i = 0; i < patternParts.length; i++) {
 		const pp = patternParts[i];
 		if (!pp) continue;
 		if (pp.endsWith("*")) {
 			const paramName = pp.slice(1, -1);
-			params[paramName] = pathParts.slice(i).join("/");
+			if (!isUnsafeParam(paramName)) params[paramName] = pathParts.slice(i).join("/");
 			return params;
 		}
 		if (i >= pathParts.length) return null;
 		if (pp.startsWith(":")) {
-			params[pp.slice(1)] = pathParts[i];
+			const paramName = pp.slice(1);
+			if (!isUnsafeParam(paramName)) params[paramName] = pathParts[i];
 			continue;
 		}
 		if (pp !== pathParts[i]) return null;

package/lib/{fs-router-MewHc5SB.js → fs-router-BVY4lTH_.js}

@@ -750,7 +750,8 @@ function generateRouteModuleFromRoutes(routes, routesDir, options) {
 		const opts = [];
 		if (loadingName) opts.push(`loading: ${loadingName}`);
 		if (errorName) opts.push(`error: ${errorName}`);
-		const optsStr = opts.length > 0 ? `, { ${opts.join(", ")} }` : "";
+		opts.push(`hmrId: ${JSON.stringify(fullPath)}`);
+		const optsStr = `, { ${opts.join(", ")} }`;
 		imports.push(`const ${name} = lazy(() => import("${fullPath}")${optsStr})`);
 		return name;
 	}
@@ -968,7 +969,7 @@ async function scanRouteFiles(routesDir) {
 */
 async function scanRouteFilesWithExports(routesDir, defaultMode = "ssr") {
 	const { readFile } = await import("node:fs/promises");
-	const { isApiRoute } = await import("./api-routes-Ci0kVmM4.js").then((n) => n.t);
+	const { isApiRoute } = await import("./api-routes-CQiOi3q5.js").then((n) => n.t);
 	const files = (await scanRouteFiles(routesDir)).filter((f) => !isApiRoute(f));
 	const exportsMap = /* @__PURE__ */ new Map();
 	await Promise.all(files.map(async (filePath) => {
@@ -984,4 +985,4 @@ async function scanRouteFilesWithExports(routesDir, defaultMode = "ssr") {
 
 //#endregion
 export { generateRouteModuleFromRoutes as a, scanRouteFilesWithExports as c, generateRouteModule as i, fs_router_exports as n, parseFileRoutes as o, generateMiddlewareModule as r, scanRouteFiles as s, filePathToUrlPath as t };
-//# sourceMappingURL=fs-router-MewHc5SB.js.map
+//# sourceMappingURL=fs-router-BVY4lTH_.js.map

package/lib/image-plugin.js

@@ -20,6 +20,13 @@ const cdnProviders = {
 	/** Bunny CDN: `https://{pullZone}.b-cdn.net/...?width=...&quality=...` */
 	bunny: (pullZone) => (src, { width, quality }) => `https://${pullZone}.b-cdn.net/${src}?width=${width}&quality=${quality}`
 };
+/**
+* Normalize the public {@link PlaceholderStrategy} to an internal kind.
+* @internal Exported for testing.
+*/
+function normalizePlaceholder(s) {
+	return s === "dominant-color" ? "color" : s;
+}
 const IMAGE_EXT_RE = /\.(jpe?g|png|webp|avif)$/i;
 /**
 * Zero image processing Vite plugin.
@@ -52,9 +59,9 @@ function imagePlugin(config = {}) {
 		1920
 	];
 	const defaultFormats = config.formats ?? ["webp"];
-	const quality = config.quality ?? 80;
+	const qualityFor = resolveQuality(config.quality);
 	const placeholderSize = config.placeholderSize ?? 16;
-	const placeholderStrategy = config.placeholder ?? "blur";
+	const placeholderStrategy = normalizePlaceholder(config.placeholder ?? "blur");
 	const outSubDir = config.outDir ?? "assets/img";
 	const include = config.include ?? IMAGE_EXT_RE;
 	const cdn = config.cdn;
@@ -110,7 +117,7 @@ export default function SvgComponent(props) {
 				const sources = defaultWidths.map((w) => ({
 					src: cdn(rawPath, {
 						width: w,
-						quality,
+						quality: qualityFor(defaultFormats[0]),
 						format: defaultFormats[0]
 					}) ?? rawPath,
 					width: w,
@@ -122,12 +129,12 @@ export default function SvgComponent(props) {
 					srcset,
 					width: metadata.width,
 					height: metadata.height,
-					placeholder: placeholderStrategy === "none" ? "" : await generateBlurPlaceholder(absPath, placeholderSize),
+					placeholder: await generatePlaceholder(absPath, placeholderStrategy, placeholderSize),
 					formats: defaultFormats.map((fmt) => ({
 						type: `image/${fmt}`,
 						srcset: defaultWidths.map((w) => `${cdn(rawPath, {
 							width: w,
-							quality,
+							quality: qualityFor(fmt),
 							format: fmt
 						}) ?? rawPath} ${w}w`).join(", ")
 					})),
@@ -136,13 +143,14 @@ export default function SvgComponent(props) {
 				return `export default ${JSON.stringify(result)}`;
 			}
 			if (!isBuild) {
-				const result = await loadDevImage(absPath, rawPath, placeholderSize);
+				const result = await loadDevImage(absPath, rawPath, placeholderStrategy, placeholderSize);
 				return `export default ${JSON.stringify(result)}`;
 			}
 			const processed = await processImage(absPath, {
 				widths: defaultWidths,
 				formats: defaultFormats,
-				quality,
+				qualityFor,
+				placeholderStrategy,
 				placeholderSize,
 				outSubDir,
 				outDir: join(root, outDir)
@@ -153,7 +161,7 @@ export default function SvgComponent(props) {
 		}
 	};
 }
-async function loadDevImage(absPath, rawPath, placeholderSize) {
+async function loadDevImage(absPath, rawPath, strategy, placeholderSize) {
 	const metadata = await getImageMetadata(absPath);
 	const publicPath = rawPath.startsWith("/") ? rawPath : `/@fs/${absPath}`;
 	return {
@@ -161,7 +169,7 @@ async function loadDevImage(absPath, rawPath, placeholderSize) {
 		srcset: "",
 		width: metadata.width,
 		height: metadata.height,
-		placeholder: await generateBlurPlaceholder(absPath, placeholderSize),
+		placeholder: await generatePlaceholder(absPath, strategy, placeholderSize),
 		formats: [],
 		sources: [{
 			src: publicPath,
@@ -208,7 +216,7 @@ async function processImage(absPath, opts) {
 	for (const format of opts.formats) for (const targetWidth of opts.widths) {
 		const width = Math.min(targetWidth, metadata.width);
 		const outPath = join(processedDir, `${name}-${width}.${format}`);
-		await resizeImage(absPath, outPath, width, format, opts.quality);
+		await resizeImage(absPath, outPath, width, format, opts.qualityFor(format));
 		sources.push({
 			src: outPath,
 			width,
@@ -233,7 +241,7 @@ async function processImage(absPath, opts) {
 	}));
 	const fallbackFormat = formats[formats.length - 1];
 	const fallbackSources = formatGroups.get([...formatGroups.keys()].pop());
-	const placeholder = await generateBlurPlaceholder(absPath, opts.placeholderSize);
+	const placeholder = await generatePlaceholder(absPath, opts.placeholderStrategy, opts.placeholderSize);
 	return {
 		src: fallbackSources[fallbackSources.length - 1]?.src ?? absPath,
 		srcset: fallbackFormat?.srcset ?? "",
@@ -351,10 +359,66 @@ async function generateBlurPlaceholder(input, size) {
 	try {
 		return `data:image/webp;base64,${(await (await import("sharp").then((m) => m.default ?? m))(input).resize(size, size, { fit: "inside" }).blur(2).webp({ quality: 20 }).toBuffer()).toString("base64")}`;
 	} catch {
-		return "data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' width='1' height='1'%3E%3C/svg%3E";
+		return TRANSPARENT_PLACEHOLDER;
+	}
+}
+/** 1×1 transparent SVG — the no-sharp fallback for every strategy. */
+const TRANSPARENT_PLACEHOLDER = "data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' width='1' height='1'%3E%3C/svg%3E";
+const DEFAULT_QUALITY = 80;
+/**
+* Resolve the public {@link ImageQuality} config into a per-format lookup.
+*
+* - `undefined` → every format gets {@link DEFAULT_QUALITY}.
+* - `number` → that number for every format (backward-compatible).
+* - `Partial<Record<ImageFormat, number>>` → per-format; formats omitted
+*   from the map fall back to {@link DEFAULT_QUALITY}.
+*
+* @internal Exported for testing.
+*/
+function resolveQuality(q) {
+	if (q === void 0) return () => DEFAULT_QUALITY;
+	if (typeof q === "number") return () => q;
+	return (format) => q[format] ?? DEFAULT_QUALITY;
+}
+/**
+* Dispatch placeholder generation by strategy. Single source of truth used
+* by every code path (CDN / dev / build) — pre-fix each path open-coded
+* `generateBlurPlaceholder`, so `'none'` was honoured only in the CDN path
+* and `'dominant-color'` (typed since the plugin's inception) was never
+* implemented anywhere — the exact typed-but-unimplemented bug class the
+* `audit-types` gate exists to catch.
+*
+* @internal Exported for testing.
+*/
+async function generatePlaceholder(input, strategy, size) {
+	if (strategy === "none") return "";
+	if (strategy === "color") return generateColorPlaceholder(input);
+	return generateBlurPlaceholder(input, size);
+}
+/**
+* Generate a dominant-colour placeholder: a ~200-byte flat-fill SVG data URI.
+*
+* Uses sharp's `.stats()` `dominant` swatch — a histogram-binned colour,
+* not a naive average (averaging a photo trends muddy grey). Note the
+* swatch is approximate by design: a pure-red source resolves to ~#f80808,
+* not #ff0000. The SVG is a constant ~200 bytes regardless of source
+* complexity and needs zero image decode, at the cost of showing a solid
+* colour instead of a blurry preview of the content.
+*/
+async function generateColorPlaceholder(input) {
+	try {
+		const { dominant } = await (await import("sharp").then((m) => m.default ?? m))(input).stats();
+		const svg = `<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 1 1' preserveAspectRatio='none'><rect width='1' height='1' fill='${"#" + [
+			dominant.r,
+			dominant.g,
+			dominant.b
+		].map((c) => Math.max(0, Math.min(255, c)).toString(16).padStart(2, "0")).join("")}'/></svg>`;
+		return `data:image/svg+xml,${encodeURIComponent(svg)}`;
+	} catch {
+		return TRANSPARENT_PLACEHOLDER;
 	}
 }
 
 //#endregion
-export { cdnProviders, imagePlugin, parseJpegDimensions, parseWebPDimensions };
+export { cdnProviders, generatePlaceholder, imagePlugin, normalizePlaceholder, parseJpegDimensions, parseWebPDimensions, resolveQuality };
 //# sourceMappingURL=image-plugin.js.map

package/lib/index.js

@@ -1,9 +1,102 @@
-import { createContext, createRef, onMount, onUnmount } from "@pyreon/core";
-import { effect, signal } from "@pyreon/reactivity";
+import { createContext, createRef, onMount, onUnmount, splitProps } from "@pyreon/core";
 import { jsx, jsxs } from "@pyreon/core/jsx-runtime";
+import { effect, signal } from "@pyreon/reactivity";
 import { useRouter } from "@pyreon/router";
 import { useHead } from "@pyreon/head";
 
+//#region src/icon.tsx
+const FILL_STYLE = "display:block;width:100%;height:100%";
+/**
+* Render a loaded SVG — container-filling, theme-aware, props-transparent.
+*
+* @example
+* import Check from './check.svg?component'
+* <span style="width:2rem"><Icon as={Check} /></span>
+*
+* @example
+* import check from './check.svg?raw'
+* <span style="width:2rem"><Icon svg={check} /></span>
+*/
+function Icon(props) {
+	const [own, rest] = splitProps(props, ["as", "svg"]);
+	if (own.as) {
+		const As = own.as;
+		return /* @__PURE__ */ jsx(As, {
+			fill: "currentColor",
+			style: FILL_STYLE,
+			...rest
+		});
+	}
+	if (own.svg) return /* @__PURE__ */ jsx("span", {
+		style: FILL_STYLE,
+		...rest,
+		dangerouslySetInnerHTML: { __html: own.svg }
+	});
+	return null;
+}
+/**
+* Build a reusable icon component from a loaded svg — a markup string OR an
+* imported SVG component. The result is still just `<Icon>`, so it's
+* container-sizable + theme-aware with every prop passed through.
+*
+* @example
+* import check from './check.svg?raw'
+* export const Check = createIcon(check)
+*
+* import StarSvg from './star.svg?component'
+* export const Star = createIcon(StarSvg)
+*
+* // …sized + themed entirely by the consumer:
+* <span style="width:48px"><Check class="text-green-600" /></span>
+*/
+function createIcon(source) {
+	return (props) => typeof source === "string" ? /* @__PURE__ */ jsx(Icon, {
+		svg: source,
+		...props
+	}) : /* @__PURE__ */ jsx(Icon, {
+		as: source,
+		...props
+	});
+}
+/**
+* Build a strictly-typed `<Icon name="…" />` from a name→source registry.
+*
+* - `mode: 'inline'` (default) — `source` is raw `<svg>` markup; rendered via
+*   {@link Icon} so it's `currentColor`-themeable (system icons you recolor).
+* - `mode: 'image'` — `source` is an asset URL; rendered as `<img>` with NO
+*   svg mutation, original colors preserved (colorful / brand icons).
+*
+* Either way it stays container-filling + props-transparent. Not called by
+* hand normally — `iconsPlugin` emits the generated file that calls it.
+*
+* @example
+* // icons.gen.tsx (auto-generated):
+* export const Icon = createNamedIcon({ 'check-circle': '<svg…' })
+* // app:
+* <span style="width:2rem"><Icon name="check-circle" /></span>
+*/
+function createNamedIcon(registry, options = {}) {
+	const mode = options.mode ?? "inline";
+	return (props) => {
+		const [own, rest] = splitProps(props, ["name", "alt"]);
+		const source = registry[own.name];
+		if (mode === "image") {
+			const hostRest = rest;
+			return /* @__PURE__ */ jsx("img", {
+				src: source,
+				alt: own.alt ?? "",
+				style: FILL_STYLE,
+				...hostRest
+			});
+		}
+		return /* @__PURE__ */ jsx(Icon, {
+			svg: source,
+			...rest
+		});
+	};
+}
+
+//#endregion
 //#region src/utils/use-intersection-observer.ts
 /**
 * Observes an element and calls `onIntersect` once it enters the viewport.
@@ -1118,5 +1211,5 @@ function aiPlugin(..._) {
 }
 
 //#endregion
-export { Image, Link, Meta, Script, ThemeToggle, aiPlugin, buildLocalePath, buildMetaTags, createImage, createLink, createScript, createServer, defineConfig, extractLocaleFromPath, faviconPlugin, initTheme, ogImagePlugin, prefetchRoute, resolvedTheme, seoPlugin, setLocale, setSSRThemeDefault, setTheme, theme, themeScript, toggleTheme, useImage, useLink, useLocale, useScript, validateEnv };
+export { Icon, Image, Link, Meta, Script, ThemeToggle, aiPlugin, buildLocalePath, buildMetaTags, createIcon, createImage, createLink, createNamedIcon, createScript, createServer, defineConfig, extractLocaleFromPath, faviconPlugin, initTheme, ogImagePlugin, prefetchRoute, resolvedTheme, seoPlugin, setLocale, setSSRThemeDefault, setTheme, theme, themeScript, toggleTheme, useImage, useLink, useLocale, useScript, validateEnv };
 //# sourceMappingURL=index.js.map

package/lib/rate-limit.js

@@ -26,6 +26,11 @@ function rateLimitMiddleware(config = {}) {
 		if (store.size < MAX_STORE_SIZE / 2 && now - lastCleanup < windowMs) return;
 		lastCleanup = now;
 		for (const [key, entry] of store) if (entry.resetAt <= now) store.delete(key);
+		while (store.size > MAX_STORE_SIZE) {
+			const oldest = store.keys().next().value;
+			if (oldest === void 0) break;
+			store.delete(oldest);
+		}
 	}
 	return (ctx) => {
 		if (include && !include.some((p) => matchSimpleGlob(p, ctx.path))) return;

package/lib/seo.js

@@ -14,7 +14,7 @@ import { join, resolve } from "node:path";
 */
 function generateSitemap(routeFiles, config, i18n) {
 	const { origin, exclude = [], changefreq = "weekly", priority = .7 } = config;
-	const clusters = clusterPathsByLocale([...routeFiles.filter((f) => {
+	const paths = routeFiles.filter((f) => {
 		const name = f.split("/").pop()?.replace(/\.\w+$/, "");
 		return name !== "_layout" && name !== "_error" && name !== "_loading";
 	}).map((f) => {
@@ -23,11 +23,16 @@ function generateSitemap(routeFiles, config, i18n) {
 		path = path.replace(/\([\w-]+\)\//g, "");
 		if (!path.startsWith("/")) path = `/${path}`;
 		return path;
-	}).filter((p) => p !== null).filter((p) => !exclude.some((e) => p.startsWith(e))).map((p) => ({
-		path: p,
-		changefreq,
-		priority
-	})), ...config.additionalPaths ?? []], i18n);
+	}).filter((p) => p !== null).filter((p) => !exclude.some((e) => p.startsWith(e)));
+	const clusters = clusterPathsByLocale((() => {
+		const byPath = /* @__PURE__ */ new Map();
+		for (const e of [...paths.map((p) => ({
+			path: p,
+			changefreq,
+			priority
+		})), ...config.additionalPaths ?? []]) if (!byPath.has(e.path)) byPath.set(e.path, e);
+		return [...byPath.values()];
+	})(), i18n);
 	return `<?xml version="1.0" encoding="UTF-8"?>
 <urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9"${i18n != null && i18n.locales.length > 0 ? " xmlns:xhtml=\"http://www.w3.org/1999/xhtml\"" : ""}>
 ${clusters.map((cluster) => renderClusterEntry(cluster, origin, changefreq, priority, i18n)).join("\n")}