@storyshelf/core 0.6.2 → 0.8.0

package/dist/utils/page-limiter.mjs

@@ -0,0 +1,55 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { mapLimit } from "./map-limit.mjs";
+import { detectResources, maxPageConcurrency, recommendedPageConcurrency } from "./resources.mjs";
+import { AdaptiveConcurrency } from "./adaptive-concurrency.mjs";
+import { mapAdaptive } from "./map-adaptive.mjs";
+// src/utils/page-limiter.ts
+/**
+* The session gate's size for a remote target; a fixed limit when `concurrency` is given; otherwise start at the CPU/memory/engine-sized
+* recommendation and let latency, event-loop lag and timeouts move it up to the adaptive ceiling.
+*/
+function createPageLimiter(options) {
+	const { gate } = options;
+	if (gate !== void 0) return {
+		each: async (items, fn) => {
+			await mapLimit(items, Math.min(gate.size, options.concurrency ?? gate.size), async (item) => {
+				await gate.run(async () => await fn(item));
+			});
+		},
+		dispose: noop
+	};
+	if (options.concurrency !== void 0) {
+		const limit = options.concurrency;
+		return {
+			each: async (items, fn) => {
+				await mapLimit(items, limit, async (item) => {
+					await fn(item);
+				});
+			},
+			dispose: noop
+		};
+	}
+	const resources = detectResources();
+	const controller = new AdaptiveConcurrency({
+		initial: recommendedPageConcurrency(resources, options.browser),
+		max: maxPageConcurrency(resources, options.browser),
+		logger: options.logger
+	});
+	return {
+		each: async (items, fn) => {
+			await mapAdaptive(items, controller, async (item) => ({
+				value: void 0,
+				timedOut: await fn(item)
+			}));
+		},
+		dispose: () => {
+			controller.dispose();
+		}
+	};
+}
+function noop() {}
+export { createPageLimiter };
+
+//# sourceMappingURL=page-limiter.mjs.map

package/dist/utils/page-limiter.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"page-limiter.mjs","names":[],"sources":["../../src/utils/page-limiter.ts"],"sourcesContent":["/** How many pages a capture run renders at once: fixed when configured, adaptive otherwise. */\nimport type { Logger } from \"../logger.ts\";\nimport { AdaptiveConcurrency } from \"./adaptive-concurrency.ts\";\nimport { mapAdaptive } from \"./map-adaptive.ts\";\nimport { mapLimit } from \"./map-limit.ts\";\nimport { detectResources, maxPageConcurrency, recommendedPageConcurrency } from \"./resources.ts\";\nimport type { SessionGate } from \"./session-gate.ts\";\n\n/** Options for {@link createPageLimiter}. */\nexport interface PageLimiterOptions {\n  /** Explicit page count (config or run input). Fixed: the adaptive controller stays off. */\n  concurrency?: number;\n  /**\n   * A remote target's session cap, shared by every render of that target in the process. It\n   * replaces CPU and memory sizing: the plan's parallel-session limit is the budget, not this host.\n   * An explicit `concurrency` can lower a run's share of it, never raise it.\n   */\n  gate?: SessionGate;\n  /** Engine being rendered; heavier engines get a smaller budget. */\n  browser?: string;\n  logger?: Logger;\n}\n\n/** Runs capture jobs under a page limit. One limiter spans a whole run so what it learns carries across batches. */\nexport interface PageLimiter {\n  /**\n   * Run `fn` over `items`. `fn` resolves to whether the capture timed out (it handles its own\n   * failures, so the limiter cannot see them otherwise).\n   */\n  each<T>(items: readonly T[], fn: (item: T) => Promise<boolean>): Promise<void>;\n  /** Release the event-loop monitor. */\n  dispose(): void;\n}\n\n/**\n * The session gate's size for a remote target; a fixed limit when `concurrency` is given; otherwise start at the CPU/memory/engine-sized\n * recommendation and let latency, event-loop lag and timeouts move it up to the adaptive ceiling.\n */\nexport function createPageLimiter(options: PageLimiterOptions): PageLimiter {\n  const { gate } = options;\n  if (gate !== undefined) {\n    return {\n      each: async (items, fn) => {\n        await mapLimit(\n          items,\n          Math.min(gate.size, options.concurrency ?? gate.size),\n          async (item) => {\n            await gate.run(async () => await fn(item));\n          },\n        );\n      },\n      dispose: noop,\n    };\n  }\n  if (options.concurrency !== undefined) {\n    const limit = options.concurrency;\n    return {\n      each: async (items, fn) => {\n        await mapLimit(items, limit, async (item) => {\n          await fn(item);\n        });\n      },\n      dispose: noop,\n    };\n  }\n  const resources = detectResources();\n  const controller = new AdaptiveConcurrency({\n    initial: recommendedPageConcurrency(resources, options.browser),\n    max: maxPageConcurrency(resources, options.browser),\n    logger: options.logger,\n  });\n  return {\n    each: async (items, fn) => {\n      await mapAdaptive(items, controller, async (item) => ({\n        value: undefined,\n        timedOut: await fn(item),\n      }));\n    },\n    dispose: () => {\n      controller.dispose();\n    },\n  };\n}\n\nfunction noop(): void {}\n"],"mappings":";;;;;;;;;;;;AAsCA,SAAgB,kBAAkB,SAA0C;CAC1E,MAAM,EAAE,SAAS;CACjB,IAAI,SAAS,KAAA,GACX,OAAO;EACL,MAAM,OAAO,OAAO,OAAO;GACzB,MAAM,SACJ,OACA,KAAK,IAAI,KAAK,MAAM,QAAQ,eAAe,KAAK,IAAI,GACpD,OAAO,SAAS;IACd,MAAM,KAAK,IAAI,YAAY,MAAM,GAAG,IAAI,CAAC;GAC3C,CACF;EACF;EACA,SAAS;CACX;CAEF,IAAI,QAAQ,gBAAgB,KAAA,GAAW;EACrC,MAAM,QAAQ,QAAQ;EACtB,OAAO;GACL,MAAM,OAAO,OAAO,OAAO;IACzB,MAAM,SAAS,OAAO,OAAO,OAAO,SAAS;KAC3C,MAAM,GAAG,IAAI;IACf,CAAC;GACH;GACA,SAAS;EACX;CACF;CACA,MAAM,YAAY,gBAAgB;CAClC,MAAM,aAAa,IAAI,oBAAoB;EACzC,SAAS,2BAA2B,WAAW,QAAQ,OAAO;EAC9D,KAAK,mBAAmB,WAAW,QAAQ,OAAO;EAClD,QAAQ,QAAQ;CAClB,CAAC;CACD,OAAO;EACL,MAAM,OAAO,OAAO,OAAO;GACzB,MAAM,YAAY,OAAO,YAAY,OAAO,UAAU;IACpD,OAAO,KAAA;IACP,UAAU,MAAM,GAAG,IAAI;GACzB,EAAE;EACJ;EACA,eAAe;GACb,WAAW,QAAQ;EACrB;CACF;AACF;AAEA,SAAS,OAAa,CAAC"}

package/dist/utils/path-security.d.mts

@@ -1,12 +1,10 @@
 import __tsdown_shims_path from 'node:path';
 import __tsdown_shims_url from 'node:url';
-//#region src/utils/path-security.d.ts
 /** Whether a path segment is safe (no traversal). */
 declare function isSafeSegment(segment: string): boolean;
 /** Whether joining root with candidate stays inside root (no traversal). */
 declare function isPathSafe(root: string, candidate: string): boolean;
 /** Check if a path built from root + entry would escape root (for zip extraction). */
 declare function isBlockedTarget(root: string, entryPath: string): boolean;
-//#endregion
 export { isBlockedTarget, isPathSafe, isSafeSegment };
 //# sourceMappingURL=path-security.d.mts.map

package/dist/utils/path-security.mjs

@@ -1,8 +1,7 @@
-import "node:path";
+import { join, normalize, sep } from "node:path";
 import "node:url";
 import.meta.url;
-import { join, normalize, sep } from "node:path";
-//#region src/utils/path-security.ts
+// src/utils/path-security.ts
 /** Whether a path segment is safe (no traversal). */
 function isSafeSegment(segment) {
 	return segment !== ".." && !segment.startsWith("/") && !segment.includes("\\") && !segment.includes("..");
@@ -18,7 +17,6 @@ function isBlockedTarget(root, entryPath) {
 	const target = normalize(join(root, entryPath));
 	return target !== root && !target.startsWith(normalize(root) + sep);
 }
-//#endregion
 export { isBlockedTarget, isPathSafe, isSafeSegment };
 
 //# sourceMappingURL=path-security.mjs.map

package/dist/utils/path-security.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"path-security.mjs","names":[],"sources":["../../src/utils/path-security.ts"],"sourcesContent":["import { join, normalize, sep } from \"node:path\";\n\n/** Whether a path segment is safe (no traversal). */\nexport function isSafeSegment(segment: string): boolean {\n  return (\n    segment !== \"..\" &&\n    !segment.startsWith(\"/\") &&\n    !segment.includes(\"\\\\\") &&\n    !segment.includes(\"..\")\n  );\n}\n\n/** Whether joining root with candidate stays inside root (no traversal). */\nexport function isPathSafe(root: string, candidate: string): boolean {\n  const normalizedRoot = normalize(root);\n  const normalizedCandidate = normalize(candidate);\n  return (\n    normalizedCandidate === normalizedRoot ||\n    normalizedCandidate.startsWith(normalizedRoot + sep) ||\n    normalizedCandidate.startsWith(`${normalizedRoot}/`)\n  );\n}\n\n/** Check if a path built from root + entry would escape root (for zip extraction). */\nexport function isBlockedTarget(root: string, entryPath: string): boolean {\n  const target = normalize(join(root, entryPath));\n  return target !== root && !target.startsWith(normalize(root) + sep);\n}\n"],"mappings":";;;;;;AAGA,SAAgB,cAAc,SAA0B;CACtD,OACE,YAAY,QACZ,CAAC,QAAQ,WAAW,GAAG,KACvB,CAAC,QAAQ,SAAS,IAAI,KACtB,CAAC,QAAQ,SAAS,IAAI;AAE1B;;AAGA,SAAgB,WAAW,MAAc,WAA4B;CACnE,MAAM,iBAAiB,UAAU,IAAI;CACrC,MAAM,sBAAsB,UAAU,SAAS;CAC/C,OACE,wBAAwB,kBACxB,oBAAoB,WAAW,iBAAiB,GAAG,KACnD,oBAAoB,WAAW,GAAG,eAAe,EAAE;AAEvD;;AAGA,SAAgB,gBAAgB,MAAc,WAA4B;CACxE,MAAM,SAAS,UAAU,KAAK,MAAM,SAAS,CAAC;CAC9C,OAAO,WAAW,QAAQ,CAAC,OAAO,WAAW,UAAU,IAAI,IAAI,GAAG;AACpE"}
+{"version":3,"file":"path-security.mjs","names":[],"sources":["../../src/utils/path-security.ts"],"sourcesContent":["import { join, normalize, sep } from \"node:path\";\n\n/** Whether a path segment is safe (no traversal). */\nexport function isSafeSegment(segment: string): boolean {\n  return (\n    segment !== \"..\" &&\n    !segment.startsWith(\"/\") &&\n    !segment.includes(\"\\\\\") &&\n    !segment.includes(\"..\")\n  );\n}\n\n/** Whether joining root with candidate stays inside root (no traversal). */\nexport function isPathSafe(root: string, candidate: string): boolean {\n  const normalizedRoot = normalize(root);\n  const normalizedCandidate = normalize(candidate);\n  return (\n    normalizedCandidate === normalizedRoot ||\n    normalizedCandidate.startsWith(normalizedRoot + sep) ||\n    normalizedCandidate.startsWith(`${normalizedRoot}/`)\n  );\n}\n\n/** Check if a path built from root + entry would escape root (for zip extraction). */\nexport function isBlockedTarget(root: string, entryPath: string): boolean {\n  const target = normalize(join(root, entryPath));\n  return target !== root && !target.startsWith(normalize(root) + sep);\n}\n"],"mappings":";;;;;AAGA,SAAgB,cAAc,SAA0B;CACtD,OACE,YAAY,QACZ,CAAC,QAAQ,WAAW,GAAG,KACvB,CAAC,QAAQ,SAAS,IAAI,KACtB,CAAC,QAAQ,SAAS,IAAI;AAE1B;;AAGA,SAAgB,WAAW,MAAc,WAA4B;CACnE,MAAM,iBAAiB,UAAU,IAAI;CACrC,MAAM,sBAAsB,UAAU,SAAS;CAC/C,OACE,wBAAwB,kBACxB,oBAAoB,WAAW,iBAAiB,GAAG,KACnD,oBAAoB,WAAW,GAAG,eAAe,EAAE;AAEvD;;AAGA,SAAgB,gBAAgB,MAAc,WAA4B;CACxE,MAAM,SAAS,UAAU,KAAK,MAAM,SAAS,CAAC;CAC9C,OAAO,WAAW,QAAQ,CAAC,OAAO,WAAW,UAAU,IAAI,IAAI,GAAG;AACpE"}

package/dist/utils/public-origin.d.mts

@@ -0,0 +1,18 @@
+import __tsdown_shims_path from 'node:path';
+import __tsdown_shims_url from 'node:url';
+/** Finding the address a deployment is reached at without being told (ADR 0007, decision 6). */
+/** Environment variables, as `process.env` has them. */
+type Env = Readonly<Record<string, string | undefined>>;
+/**
+ * The origin (`scheme://host[:port]`) of `value`, or `undefined` when it is not an http(s) URL
+ * without credentials. A bare host (`app.example.com`), as platforms often publish, reads as https.
+ */
+declare function normalizeOrigin(value?: string): string | undefined;
+/**
+ * The address the hosting platform publishes in `env`, as an origin, or `undefined` when none is
+ * set. It is the platform's own domain, a working fallback but the wrong link behind a custom
+ * domain. Cloud Run, AWS App Runner, Lambda function URLs and Cloudflare Workers publish nothing.
+ */
+declare function detectPublicBaseUrl(env: Env): string | undefined;
+export { Env, detectPublicBaseUrl, normalizeOrigin };
+//# sourceMappingURL=public-origin.d.mts.map

package/dist/utils/public-origin.mjs

@@ -0,0 +1,74 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+// src/utils/public-origin.ts
+/**
+* The origin (`scheme://host[:port]`) of `value`, or `undefined` when it is not an http(s) URL
+* without credentials. A bare host (`app.example.com`), as platforms often publish, reads as https.
+*/
+function normalizeOrigin(value) {
+	const text = value?.trim();
+	if (!text) return;
+	if (/^[a-z][a-z\d+.-]*:(?!\/\/|\d+(?:\/|$))/iu.test(text)) return;
+	try {
+		const url = new URL(/^[a-z][a-z\d+.-]*:\/\//iu.test(text) ? text : `https://${text}`);
+		return (url.protocol === "https:" || url.protocol === "http:") && url.username === "" && url.password === "" && url.hostname !== "" ? url.origin : void 0;
+	} catch {
+		return;
+	}
+}
+const PLATFORMS = [
+	{ address: ["HEROKU_APP_DEFAULT_DOMAIN_NAME"] },
+	{ address: ["RAILWAY_PUBLIC_DOMAIN"] },
+	{
+		marker: ["VERCEL", "1"],
+		address: ["VERCEL_PROJECT_PRODUCTION_URL", "VERCEL_URL"]
+	},
+	{
+		marker: ["NETLIFY", "true"],
+		address: ["URL", "DEPLOY_PRIME_URL"]
+	},
+	{ address: ["RENDER_EXTERNAL_URL", "RENDER_EXTERNAL_HOSTNAME"] },
+	{ address: ["WEBSITE_HOSTNAME"] },
+	{
+		marker: ["DIGITALOCEAN_APP_ID"],
+		address: ["APP_URL"]
+	}
+];
+/**
+* The address the hosting platform publishes in `env`, as an origin, or `undefined` when none is
+* set. It is the platform's own domain, a working fallback but the wrong link behind a custom
+* domain. Cloud Run, AWS App Runner, Lambda function URLs and Cloudflare Workers publish nothing.
+*/
+function detectPublicBaseUrl(env) {
+	for (const platform of PLATFORMS) {
+		const found = fromPlatform(platform, env);
+		if (found !== void 0) return found;
+	}
+	return fromFly(env) ?? fromContainerApps(env);
+}
+function fromPlatform(platform, env) {
+	if (platform.marker !== void 0) {
+		const [name, expected] = platform.marker;
+		const actual = env[name];
+		if (actual === void 0 || actual === "" || expected !== void 0 && actual !== expected) return;
+	}
+	for (const name of platform.address) {
+		const origin = normalizeOrigin(env[name]);
+		if (origin !== void 0) return origin;
+	}
+}
+/** Fly.io: `<app>.fly.dev`. */
+function fromFly(env) {
+	const app = env["FLY_APP_NAME"];
+	return app ? normalizeOrigin(`${app}.fly.dev`) : void 0;
+}
+/** Azure Container Apps: `<app>.<environment DNS suffix>`. */
+function fromContainerApps(env) {
+	const app = env["CONTAINER_APP_NAME"];
+	const suffix = env["CONTAINER_APP_ENV_DNS_SUFFIX"];
+	return app && suffix ? normalizeOrigin(`${app}.${suffix}`) : void 0;
+}
+export { detectPublicBaseUrl, normalizeOrigin };
+
+//# sourceMappingURL=public-origin.mjs.map

package/dist/utils/public-origin.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"public-origin.mjs","names":[],"sources":["../../src/utils/public-origin.ts"],"sourcesContent":["/** Finding the address a deployment is reached at without being told (ADR 0007, decision 6). */\n\n/** Environment variables, as `process.env` has them. */\nexport type Env = Readonly<Record<string, string | undefined>>;\n\n/**\n * The origin (`scheme://host[:port]`) of `value`, or `undefined` when it is not an http(s) URL\n * without credentials. A bare host (`app.example.com`), as platforms often publish, reads as https.\n */\nexport function normalizeOrigin(value?: string): string | undefined {\n  const text = value?.trim();\n  if (!text) {\n    return undefined;\n  }\n  // `javascript:alert(1)`, `mailto:x`: a scheme with no `//` is no address (`host:8443` is).\n  if (/^[a-z][a-z\\d+.-]*:(?!\\/\\/|\\d+(?:\\/|$))/iu.test(text)) {\n    return undefined;\n  }\n  try {\n    const url = new URL(/^[a-z][a-z\\d+.-]*:\\/\\//iu.test(text) ? text : `https://${text}`);\n    const web = url.protocol === \"https:\" || url.protocol === \"http:\";\n    return web && url.username === \"\" && url.password === \"\" && url.hostname !== \"\"\n      ? url.origin\n      : undefined;\n  } catch {\n    return undefined;\n  }\n}\n\n/** One platform: the variables that say its address, tried in order. */\ninterface Platform {\n  /** Variable whose presence says the app runs there; absent when the address variable alone says so. */\n  marker?: readonly [string, string?];\n  /** Variables holding a host or URL, first set one wins. */\n  address: readonly string[];\n}\n\nconst PLATFORMS: readonly Platform[] = [\n  // Heroku: needs the `runtime-dyno-metadata` Labs feature.\n  { address: [\"HEROKU_APP_DEFAULT_DOMAIN_NAME\"] },\n  // Railway: only when the service has a public domain.\n  { address: [\"RAILWAY_PUBLIC_DOMAIN\"] },\n  // Vercel: the production alias beats the per-deployment URL.\n  { marker: [\"VERCEL\", \"1\"], address: [\"VERCEL_PROJECT_PRODUCTION_URL\", \"VERCEL_URL\"] },\n  // Netlify: `URL` is the site's main URL (a generic name, so it needs the platform marker).\n  { marker: [\"NETLIFY\", \"true\"], address: [\"URL\", \"DEPLOY_PRIME_URL\"] },\n  // Render.\n  { address: [\"RENDER_EXTERNAL_URL\", \"RENDER_EXTERNAL_HOSTNAME\"] },\n  // Azure App Service.\n  { address: [\"WEBSITE_HOSTNAME\"] },\n  // DigitalOcean App Platform: `APP_URL` is a bindable variable the app spec must set.\n  { marker: [\"DIGITALOCEAN_APP_ID\"], address: [\"APP_URL\"] },\n];\n\n/**\n * The address the hosting platform publishes in `env`, as an origin, or `undefined` when none is\n * set. It is the platform's own domain, a working fallback but the wrong link behind a custom\n * domain. Cloud Run, AWS App Runner, Lambda function URLs and Cloudflare Workers publish nothing.\n */\nexport function detectPublicBaseUrl(env: Env): string | undefined {\n  for (const platform of PLATFORMS) {\n    const found = fromPlatform(platform, env);\n    if (found !== undefined) {\n      return found;\n    }\n  }\n  return fromFly(env) ?? fromContainerApps(env);\n}\n\nfunction fromPlatform(platform: Platform, env: Env): string | undefined {\n  if (platform.marker !== undefined) {\n    const [name, expected] = platform.marker;\n    const actual = env[name];\n    if (actual === undefined || actual === \"\" || (expected !== undefined && actual !== expected)) {\n      return undefined;\n    }\n  }\n  for (const name of platform.address) {\n    const origin = normalizeOrigin(env[name]);\n    if (origin !== undefined) {\n      return origin;\n    }\n  }\n  return undefined;\n}\n\n/** Fly.io: `<app>.fly.dev`. */\nfunction fromFly(env: Env): string | undefined {\n  const app = env[\"FLY_APP_NAME\"];\n  return app ? normalizeOrigin(`${app}.fly.dev`) : undefined;\n}\n\n/** Azure Container Apps: `<app>.<environment DNS suffix>`. */\nfunction fromContainerApps(env: Env): string | undefined {\n  const app = env[\"CONTAINER_APP_NAME\"];\n  const suffix = env[\"CONTAINER_APP_ENV_DNS_SUFFIX\"];\n  return app && suffix ? normalizeOrigin(`${app}.${suffix}`) : undefined;\n}\n"],"mappings":";;;;;;;;AASA,SAAgB,gBAAgB,OAAoC;CAClE,MAAM,OAAO,OAAO,KAAK;CACzB,IAAI,CAAC,MACH;CAGF,IAAI,2CAA2C,KAAK,IAAI,GACtD;CAEF,IAAI;EACF,MAAM,MAAM,IAAI,IAAI,2BAA2B,KAAK,IAAI,IAAI,OAAO,WAAW,MAAM;EAEpF,QADY,IAAI,aAAa,YAAY,IAAI,aAAa,YAC5C,IAAI,aAAa,MAAM,IAAI,aAAa,MAAM,IAAI,aAAa,KACzE,IAAI,SACJ,KAAA;CACN,QAAQ;EACN;CACF;AACF;AAUA,MAAM,YAAiC;CAErC,EAAE,SAAS,CAAC,gCAAgC,EAAE;CAE9C,EAAE,SAAS,CAAC,uBAAuB,EAAE;CAErC;EAAE,QAAQ,CAAC,UAAU,GAAG;EAAG,SAAS,CAAC,iCAAiC,YAAY;CAAE;CAEpF;EAAE,QAAQ,CAAC,WAAW,MAAM;EAAG,SAAS,CAAC,OAAO,kBAAkB;CAAE;CAEpE,EAAE,SAAS,CAAC,uBAAuB,0BAA0B,EAAE;CAE/D,EAAE,SAAS,CAAC,kBAAkB,EAAE;CAEhC;EAAE,QAAQ,CAAC,qBAAqB;EAAG,SAAS,CAAC,SAAS;CAAE;AAC1D;;;;;;AAOA,SAAgB,oBAAoB,KAA8B;CAChE,KAAK,MAAM,YAAY,WAAW;EAChC,MAAM,QAAQ,aAAa,UAAU,GAAG;EACxC,IAAI,UAAU,KAAA,GACZ,OAAO;CAEX;CACA,OAAO,QAAQ,GAAG,KAAK,kBAAkB,GAAG;AAC9C;AAEA,SAAS,aAAa,UAAoB,KAA8B;CACtE,IAAI,SAAS,WAAW,KAAA,GAAW;EACjC,MAAM,CAAC,MAAM,YAAY,SAAS;EAClC,MAAM,SAAS,IAAI;EACnB,IAAI,WAAW,KAAA,KAAa,WAAW,MAAO,aAAa,KAAA,KAAa,WAAW,UACjF;CAEJ;CACA,KAAK,MAAM,QAAQ,SAAS,SAAS;EACnC,MAAM,SAAS,gBAAgB,IAAI,KAAK;EACxC,IAAI,WAAW,KAAA,GACb,OAAO;CAEX;AAEF;;AAGA,SAAS,QAAQ,KAA8B;CAC7C,MAAM,MAAM,IAAI;CAChB,OAAO,MAAM,gBAAgB,GAAG,IAAI,SAAS,IAAI,KAAA;AACnD;;AAGA,SAAS,kBAAkB,KAA8B;CACvD,MAAM,MAAM,IAAI;CAChB,MAAM,SAAS,IAAI;CACnB,OAAO,OAAO,SAAS,gBAAgB,GAAG,IAAI,GAAG,QAAQ,IAAI,KAAA;AAC/D"}

package/dist/utils/redact.d.mts

@@ -1,6 +1,5 @@
 import __tsdown_shims_path from 'node:path';
 import __tsdown_shims_url from 'node:url';
-//#region src/utils/redact.d.ts
 /**
  * Secret redaction for adapter errors, health details, and logs.
  *
@@ -12,6 +11,5 @@ import __tsdown_shims_url from 'node:url';
 declare function redactSecrets(text: string): string;
 /** Redact secrets, then truncate to `maxLength`. */
 declare function sanitizeErrorText(text: string, maxLength: number): string;
-//#endregion
 export { redactSecrets, sanitizeErrorText };
 //# sourceMappingURL=redact.d.mts.map

package/dist/utils/redact.mjs

@@ -1,7 +1,8 @@
 import "node:path";
 import "node:url";
 import.meta.url;
-//#region src/utils/redact.ts
+import { STORYBOOK_TOKEN_PREFIX, STORYBOOK_TOKEN_SOURCE } from "./storybook-token.mjs";
+// src/utils/redact.ts
 /**
 * Secret redaction for adapter errors, health details, and logs.
 *
@@ -13,10 +14,12 @@ const SECRET_PATTERNS = [
 	/(:\/\/)[^/\s:]+:[^/\s@]+(?=@)/u,
 	/([?&#](?:token|secret|password|api[_-]?key|auth[_-]?token|access[_-]?key)=)[^&#\s]*/giu,
 	/((?:password|passwd|secret|token|api[_-]?key|auth[_-]?token|client[_-]?secret|access[_-]?key|private[_-]?key)\s*[:=]\s*['"]?)[^\s'";,[\]&]+/giu,
+	new RegExp(`(${STORYBOOK_TOKEN_PREFIX})${STORYBOOK_TOKEN_SOURCE}`, "gu"),
 	/AKIA[0-9A-Z]{16}/gu,
 	/gh[pous]_[A-Za-z0-9_]+/gu,
 	/github_pat_[A-Za-z0-9_]+/gu,
 	/xox[bpasr]-[A-Za-z0-9-]+/gu,
+	/eyJ[\w-]{8,}\.eyJ[\w-]{8,}\.[\w-]+/gu,
 	/-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/gu
 ];
 /** Replace embedded secrets with `[redacted]`. Never throws on weird input. */
@@ -36,7 +39,6 @@ function sanitizeErrorText(text, maxLength) {
 	const redacted = redactSecrets(text);
 	return redacted.length > maxLength ? redacted.slice(0, maxLength) : redacted;
 }
-//#endregion
 export { redactSecrets, sanitizeErrorText };
 
 //# sourceMappingURL=redact.mjs.map

package/dist/utils/redact.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"redact.mjs","names":[],"sources":["../../src/utils/redact.ts"],"sourcesContent":["/**\n * Secret redaction for adapter errors, health details, and logs.\n *\n * Adapter-thrown messages routinely embed connection strings and tokens.\n * Every surface that exposes adapter text (503 gate, health report, error\n * logs) must pass through here before truncation or transport.\n */\n\nconst SECRET_PATTERNS: RegExp[] = [\n  /(:\\/\\/)[^/\\s:]+:[^/\\s@]+(?=@)/u,\n  /([?&#](?:token|secret|password|api[_-]?key|auth[_-]?token|access[_-]?key)=)[^&#\\s]*/giu,\n  /((?:password|passwd|secret|token|api[_-]?key|auth[_-]?token|client[_-]?secret|access[_-]?key|private[_-]?key)\\s*[:=]\\s*['\"]?)[^\\s'\";,[\\]&]+/giu,\n  /AKIA[0-9A-Z]{16}/gu,\n  /gh[pous]_[A-Za-z0-9_]+/gu,\n  /github_pat_[A-Za-z0-9_]+/gu,\n  /xox[bpasr]-[A-Za-z0-9-]+/gu,\n  /-----BEGIN [A-Z ]*PRIVATE KEY-----[\\s\\S]*?-----END [A-Z ]*PRIVATE KEY-----/gu,\n];\n\n/** Replace embedded secrets with `[redacted]`. Never throws on weird input. */\nexport function redactSecrets(text: string): string {\n  let redacted = text;\n  for (const pattern of SECRET_PATTERNS) {\n    pattern.lastIndex = 0;\n    redacted = redacted.replace(pattern, (...args: unknown[]) => {\n      const group = args[1];\n      return typeof group === \"string\" ? `${group}[redacted]` : \"[redacted]\";\n    });\n  }\n  return redacted;\n}\n\n/** Redact secrets, then truncate to `maxLength`. */\nexport function sanitizeErrorText(text: string, maxLength: number): string {\n  const redacted = redactSecrets(text);\n  return redacted.length > maxLength ? redacted.slice(0, maxLength) : redacted;\n}\n"],"mappings":";;;;;;;;;;;AAQA,MAAM,kBAA4B;CAChC;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF;;AAGA,SAAgB,cAAc,MAAsB;CAClD,IAAI,WAAW;CACf,KAAK,MAAM,WAAW,iBAAiB;EACrC,QAAQ,YAAY;EACpB,WAAW,SAAS,QAAQ,UAAU,GAAG,SAAoB;GAC3D,MAAM,QAAQ,KAAK;GACnB,OAAO,OAAO,UAAU,WAAW,GAAG,MAAM,cAAc;EAC5D,CAAC;CACH;CACA,OAAO;AACT;;AAGA,SAAgB,kBAAkB,MAAc,WAA2B;CACzE,MAAM,WAAW,cAAc,IAAI;CACnC,OAAO,SAAS,SAAS,YAAY,SAAS,MAAM,GAAG,SAAS,IAAI;AACtE"}
+{"version":3,"file":"redact.mjs","names":[],"sources":["../../src/utils/redact.ts"],"sourcesContent":["/**\n * Secret redaction for adapter errors, health details, and logs.\n *\n * Adapter-thrown messages routinely embed connection strings and tokens.\n * Every surface that exposes adapter text (503 gate, health report, error\n * logs) must pass through here before truncation or transport.\n */\n\nimport { STORYBOOK_TOKEN_PREFIX, STORYBOOK_TOKEN_SOURCE } from \"./storybook-token.ts\";\n\nconst SECRET_PATTERNS: RegExp[] = [\n  /(:\\/\\/)[^/\\s:]+:[^/\\s@]+(?=@)/u,\n  /([?&#](?:token|secret|password|api[_-]?key|auth[_-]?token|access[_-]?key)=)[^&#\\s]*/giu,\n  /((?:password|passwd|secret|token|api[_-]?key|auth[_-]?token|client[_-]?secret|access[_-]?key|private[_-]?key)\\s*[:=]\\s*['\"]?)[^\\s'\";,[\\]&]+/giu,\n  new RegExp(`(${STORYBOOK_TOKEN_PREFIX})${STORYBOOK_TOKEN_SOURCE}`, \"gu\"),\n  /AKIA[0-9A-Z]{16}/gu,\n  /gh[pous]_[A-Za-z0-9_]+/gu,\n  /github_pat_[A-Za-z0-9_]+/gu,\n  /xox[bpasr]-[A-Za-z0-9-]+/gu,\n  /eyJ[\\w-]{8,}\\.eyJ[\\w-]{8,}\\.[\\w-]+/gu,\n  /-----BEGIN [A-Z ]*PRIVATE KEY-----[\\s\\S]*?-----END [A-Z ]*PRIVATE KEY-----/gu,\n];\n\n/** Replace embedded secrets with `[redacted]`. Never throws on weird input. */\nexport function redactSecrets(text: string): string {\n  let redacted = text;\n  for (const pattern of SECRET_PATTERNS) {\n    pattern.lastIndex = 0;\n    redacted = redacted.replace(pattern, (...args: unknown[]) => {\n      const group = args[1];\n      return typeof group === \"string\" ? `${group}[redacted]` : \"[redacted]\";\n    });\n  }\n  return redacted;\n}\n\n/** Redact secrets, then truncate to `maxLength`. */\nexport function sanitizeErrorText(text: string, maxLength: number): string {\n  const redacted = redactSecrets(text);\n  return redacted.length > maxLength ? redacted.slice(0, maxLength) : redacted;\n}\n"],"mappings":";;;;;;;;;;;;AAUA,MAAM,kBAA4B;CAChC;CACA;CACA;CACA,IAAI,OAAO,IAAI,uBAAuB,GAAG,0BAA0B,IAAI;CACvE;CACA;CACA;CACA;CACA;CACA;AACF;;AAGA,SAAgB,cAAc,MAAsB;CAClD,IAAI,WAAW;CACf,KAAK,MAAM,WAAW,iBAAiB;EACrC,QAAQ,YAAY;EACpB,WAAW,SAAS,QAAQ,UAAU,GAAG,SAAoB;GAC3D,MAAM,QAAQ,KAAK;GACnB,OAAO,OAAO,UAAU,WAAW,GAAG,MAAM,cAAc;EAC5D,CAAC;CACH;CACA,OAAO;AACT;;AAGA,SAAgB,kBAAkB,MAAc,WAA2B;CACzE,MAAM,WAAW,cAAc,IAAI;CACnC,OAAO,SAAS,SAAS,YAAY,SAAS,MAAM,GAAG,SAAS,IAAI;AACtE"}

package/dist/utils/remote-environment.d.mts

@@ -0,0 +1,76 @@
+import __tsdown_shims_path from 'node:path';
+import __tsdown_shims_url from 'node:url';
+import { CaptureEnvironment } from "../adapter/capture-runner.mjs";
+/** What the probe page reports. */
+interface BrowserProbe {
+  /** OS as the page sees it (`navigator.userAgentData.platform`, else `navigator.platform`). */
+  platform?: string;
+  deviceScaleFactor?: number;
+  /** Which of {@link FONT_PROBE_FAMILIES} are installed. */
+  fonts?: string[];
+}
+/**
+ * Families probed for the fonts digest: system fonts that differ between operating systems and
+ * image builds, so a provider-side change moves the hash. A fixed list; changing it re-baselines
+ * every remote target's fingerprint.
+ */
+declare const FONT_PROBE_FAMILIES: readonly string[];
+/**
+ * Read the OS, the device pixel ratio and the installed probe fonts. Runs inside the page, so it
+ * must stay one self-contained function (no imports, no closures): the runners pass it to
+ * `page.evaluate`, which sends its source. A font counts as installed when text in it measures
+ * differently from the generic family it would fall back to; `document.fonts.check` answers `true`
+ * for a family that does not exist, so it cannot tell.
+ */
+declare function inPageProbe(families: string[]): BrowserProbe;
+/** How a {@link boundedProbe} ended. */
+type ProbeOutcome<T> = {
+  status: "done";
+  value: T;
+} |
+/** Still running after `timeoutMs`: the environment is unknown, the run goes on. */
+{
+  status: "timeout";
+} |
+/** The run was cancelled: the run stops, it is never read as "unknown environment". */
+{
+  status: "cancelled";
+} |
+/** The probe threw (a service outage, a page that would not open): unknown, with a warning. */
+{
+  status: "failed";
+  error: unknown;
+};
+/** What a probe's work can ask about its own fate. */
+interface ProbeControl {
+  /**
+   * True once the probe timed out or was cancelled. Work that opens a page must check it after
+   * every await and release what it opened, because nothing waits for it any more.
+   */
+  stopped: () => boolean;
+}
+/**
+ * Run probe work under a time limit and a cancel signal (ADR 0007, decision 2). A probe that hangs
+ * on an unresponsive service must not hold a render, and a cancel must interrupt it instead of
+ * waiting for the service. The work is never awaited past the limit and never leaves an unhandled
+ * rejection; releasing the page it opened is the caller's job (`ProbeControl.stopped`, or closing
+ * what it holds once this returns). A failure after the signal fired reads as cancelled, since
+ * closing the browser is how a cancel interrupts it.
+ */
+declare function boundedProbe<T>(options: {
+  run: (control: ProbeControl) => Promise<T>;
+  timeoutMs: number;
+  signal?: AbortSignal | undefined;
+}): Promise<ProbeOutcome<T>>;
+/**
+ * The environment of a remote render: the driver's browser version and what the page reported. A
+ * field the page could not give is left out, except the OS, which falls back to what the service
+ * was configured to render on; an unknown fingerprint component is never a change (ADR 0005).
+ */
+declare function remoteEnvironment(options: {
+  browserVersion?: string | undefined;
+  probe?: BrowserProbe | undefined;
+  declaredPlatform?: string | undefined;
+}): CaptureEnvironment;
+export { BrowserProbe, FONT_PROBE_FAMILIES, ProbeControl, ProbeOutcome, boundedProbe, inPageProbe, remoteEnvironment };
+//# sourceMappingURL=remote-environment.d.mts.map

package/dist/utils/remote-environment.mjs

@@ -0,0 +1,163 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { sha256 } from "./hash.mjs";
+// src/utils/remote-environment.ts
+/**
+* Families probed for the fonts digest: system fonts that differ between operating systems and
+* image builds, so a provider-side change moves the hash. A fixed list; changing it re-baselines
+* every remote target's fingerprint.
+*/
+const FONT_PROBE_FAMILIES = [
+	"Arial",
+	"Helvetica",
+	"Helvetica Neue",
+	"Times New Roman",
+	"Georgia",
+	"Verdana",
+	"Tahoma",
+	"Trebuchet MS",
+	"Courier New",
+	"Consolas",
+	"Menlo",
+	"Monaco",
+	"Segoe UI",
+	"Calibri",
+	"Cambria",
+	"San Francisco",
+	"SF Pro Text",
+	"Lucida Grande",
+	"Roboto",
+	"Open Sans",
+	"Noto Sans",
+	"Noto Serif",
+	"Noto Sans Mono",
+	"Noto Color Emoji",
+	"Apple Color Emoji",
+	"Segoe UI Emoji",
+	"DejaVu Sans",
+	"DejaVu Serif",
+	"DejaVu Sans Mono",
+	"Liberation Sans",
+	"Liberation Serif",
+	"Liberation Mono",
+	"Ubuntu",
+	"Cantarell",
+	"Droid Sans",
+	"Source Sans Pro",
+	"Fira Sans",
+	"Inter",
+	"Arial Unicode MS",
+	"MS Gothic",
+	"Hiragino Sans",
+	"PingFang SC",
+	"Microsoft YaHei",
+	"Malgun Gothic"
+];
+/**
+* Read the OS, the device pixel ratio and the installed probe fonts. Runs inside the page, so it
+* must stay one self-contained function (no imports, no closures): the runners pass it to
+* `page.evaluate`, which sends its source. A font counts as installed when text in it measures
+* differently from the generic family it would fall back to; `document.fonts.check` answers `true`
+* for a family that does not exist, so it cannot tell.
+*/
+function inPageProbe(families) {
+	const win = globalThis;
+	const probe = {};
+	const reported = win.navigator.userAgentData?.platform;
+	const platform = reported === void 0 || reported === "" ? win.navigator.platform : reported;
+	if (platform) probe.platform = platform;
+	if (typeof win.devicePixelRatio === "number") probe.deviceScaleFactor = win.devicePixelRatio;
+	const context = win.document.createElement("canvas").getContext("2d");
+	if (!context) return probe;
+	const text = "mmmmmmmmmmlli1WwQqÅgy 漢字";
+	const generics = [
+		"monospace",
+		"sans-serif",
+		"serif"
+	];
+	const widthOf = (font) => {
+		context.font = `72px ${font}`;
+		return context.measureText(text).width;
+	};
+	const baseline = generics.map((generic) => widthOf(generic));
+	probe.fonts = families.filter((family) => generics.some((generic, index) => widthOf(`"${family}", ${generic}`) !== baseline[index]));
+	return probe;
+}
+/**
+* Run probe work under a time limit and a cancel signal (ADR 0007, decision 2). A probe that hangs
+* on an unresponsive service must not hold a render, and a cancel must interrupt it instead of
+* waiting for the service. The work is never awaited past the limit and never leaves an unhandled
+* rejection; releasing the page it opened is the caller's job (`ProbeControl.stopped`, or closing
+* what it holds once this returns). A failure after the signal fired reads as cancelled, since
+* closing the browser is how a cancel interrupts it.
+*/
+async function boundedProbe(options) {
+	const { signal, timeoutMs } = options;
+	if (signal?.aborted) return { status: "cancelled" };
+	const halt = { halted: false };
+	return await settle(options.run({ stopped: () => halt.halted }).then((value) => ({
+		status: "done",
+		value
+	}), (error) => ({
+		status: "failed",
+		error
+	})), limitOf(timeoutMs, signal), signal, halt);
+}
+/** Wait for the work or the limit, mark the work stopped if it lost, and drop the timer and listener. */
+async function settle(work, limit, signal, halt) {
+	try {
+		const outcome = await Promise.race([work, limit.reached]);
+		halt.halted = outcome.status === "timeout" || outcome.status === "cancelled";
+		return outcome.status === "failed" && signal?.aborted ? { status: "cancelled" } : outcome;
+	} finally {
+		limit.clear();
+	}
+}
+/** A promise that settles on the timeout or the abort, and a way to drop both. */
+function limitOf(timeoutMs, signal) {
+	let timer;
+	let onAbort;
+	return {
+		reached: new Promise((resolve) => {
+			timer = setTimeout(() => {
+				resolve({ status: "timeout" });
+			}, timeoutMs);
+			onAbort = () => {
+				resolve({ status: "cancelled" });
+			};
+			signal?.addEventListener("abort", onAbort, { once: true });
+		}),
+		clear: () => {
+			clearTimeout(timer);
+			if (onAbort) signal?.removeEventListener("abort", onAbort);
+		}
+	};
+}
+/**
+* The environment of a remote render: the driver's browser version and what the page reported. A
+* field the page could not give is left out, except the OS, which falls back to what the service
+* was configured to render on; an unknown fingerprint component is never a change (ADR 0005).
+*/
+function remoteEnvironment(options) {
+	const { probe, browserVersion } = options;
+	const platform = normalizePlatform(probe?.platform) ?? options.declaredPlatform;
+	const fonts = probe?.fonts;
+	return {
+		...browserVersion ? { browserVersion } : {},
+		...platform ? { platform } : {},
+		...probe?.deviceScaleFactor ? { deviceScaleFactor: probe.deviceScaleFactor } : {},
+		...fonts && fonts.length > 0 ? { fontsHash: sha256(fonts.toSorted().join("\n")).slice(0, 16) } : {}
+	};
+}
+/** `Win32`, `Windows` and `Linux x86_64` read as the OS, in one spelling per OS. */
+function normalizePlatform(value) {
+	const text = value?.trim().toLowerCase();
+	if (!text) return;
+	if (text.startsWith("win")) return "windows";
+	if (text.startsWith("mac") || text === "iphone" || text === "ipad") return "macos";
+	return text.startsWith("linux") ? "linux" : text;
+}
+export { FONT_PROBE_FAMILIES, boundedProbe, inPageProbe, remoteEnvironment };
+
+//# sourceMappingURL=remote-environment.mjs.map

package/dist/utils/remote-environment.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"remote-environment.mjs","names":[],"sources":["../../src/utils/remote-environment.ts"],"sourcesContent":["/**\n * The environment of a remote browser, measured inside it (ADR 0007, decision 2). `fc-list` and\n * `process.platform` describe the machine running the runner, not the one that rendered.\n */\nimport type { CaptureEnvironment } from \"../adapters/capture-runner.ts\";\nimport { sha256 } from \"./hash.ts\";\n\n/** What the probe page reports. */\nexport interface BrowserProbe {\n  /** OS as the page sees it (`navigator.userAgentData.platform`, else `navigator.platform`). */\n  platform?: string;\n  deviceScaleFactor?: number;\n  /** Which of {@link FONT_PROBE_FAMILIES} are installed. */\n  fonts?: string[];\n}\n\n/**\n * Families probed for the fonts digest: system fonts that differ between operating systems and\n * image builds, so a provider-side change moves the hash. A fixed list; changing it re-baselines\n * every remote target's fingerprint.\n */\nexport const FONT_PROBE_FAMILIES: readonly string[] = [\n  \"Arial\",\n  \"Helvetica\",\n  \"Helvetica Neue\",\n  \"Times New Roman\",\n  \"Georgia\",\n  \"Verdana\",\n  \"Tahoma\",\n  \"Trebuchet MS\",\n  \"Courier New\",\n  \"Consolas\",\n  \"Menlo\",\n  \"Monaco\",\n  \"Segoe UI\",\n  \"Calibri\",\n  \"Cambria\",\n  \"San Francisco\",\n  \"SF Pro Text\",\n  \"Lucida Grande\",\n  \"Roboto\",\n  \"Open Sans\",\n  \"Noto Sans\",\n  \"Noto Serif\",\n  \"Noto Sans Mono\",\n  \"Noto Color Emoji\",\n  \"Apple Color Emoji\",\n  \"Segoe UI Emoji\",\n  \"DejaVu Sans\",\n  \"DejaVu Serif\",\n  \"DejaVu Sans Mono\",\n  \"Liberation Sans\",\n  \"Liberation Serif\",\n  \"Liberation Mono\",\n  \"Ubuntu\",\n  \"Cantarell\",\n  \"Droid Sans\",\n  \"Source Sans Pro\",\n  \"Fira Sans\",\n  \"Inter\",\n  \"Arial Unicode MS\",\n  \"MS Gothic\",\n  \"Hiragino Sans\",\n  \"PingFang SC\",\n  \"Microsoft YaHei\",\n  \"Malgun Gothic\",\n];\n\n/**\n * Read the OS, the device pixel ratio and the installed probe fonts. Runs inside the page, so it\n * must stay one self-contained function (no imports, no closures): the runners pass it to\n * `page.evaluate`, which sends its source. A font counts as installed when text in it measures\n * differently from the generic family it would fall back to; `document.fonts.check` answers `true`\n * for a family that does not exist, so it cannot tell.\n */\n// oxlint-disable-next-line eslint/max-statements, eslint/max-lines-per-function -- must stay one self-contained function (see above)\nexport function inPageProbe(families: string[]): BrowserProbe {\n  const win = globalThis as unknown as {\n    devicePixelRatio?: number;\n    navigator: { userAgentData?: { platform?: string }; platform?: string };\n    document: {\n      createElement: (tag: string) => {\n        getContext: (kind: string) => {\n          font: string;\n          measureText: (text: string) => { width: number };\n        } | null;\n      };\n    };\n  };\n  const probe: BrowserProbe = {};\n  const reported = win.navigator.userAgentData?.platform;\n  const platform = reported === undefined || reported === \"\" ? win.navigator.platform : reported;\n  if (platform) probe.platform = platform;\n  if (typeof win.devicePixelRatio === \"number\") probe.deviceScaleFactor = win.devicePixelRatio;\n  const context = win.document.createElement(\"canvas\").getContext(\"2d\");\n  if (!context) return probe;\n  const text = \"mmmmmmmmmmlli1WwQqÅgy 漢字\";\n  const generics = [\"monospace\", \"sans-serif\", \"serif\"];\n  const widthOf = (font: string): number => {\n    context.font = `72px ${font}`;\n    return context.measureText(text).width;\n  };\n  const baseline = generics.map((generic) => widthOf(generic));\n  probe.fonts = families.filter((family) =>\n    generics.some((generic, index) => widthOf(`\"${family}\", ${generic}`) !== baseline[index]),\n  );\n  return probe;\n}\n\n/** How a {@link boundedProbe} ended. */\nexport type ProbeOutcome<T> =\n  | { status: \"done\"; value: T }\n  /** Still running after `timeoutMs`: the environment is unknown, the run goes on. */\n  | { status: \"timeout\" }\n  /** The run was cancelled: the run stops, it is never read as \"unknown environment\". */\n  | { status: \"cancelled\" }\n  /** The probe threw (a service outage, a page that would not open): unknown, with a warning. */\n  | { status: \"failed\"; error: unknown };\n\n/** What a probe's work can ask about its own fate. */\nexport interface ProbeControl {\n  /**\n   * True once the probe timed out or was cancelled. Work that opens a page must check it after\n   * every await and release what it opened, because nothing waits for it any more.\n   */\n  stopped: () => boolean;\n}\n\n/**\n * Run probe work under a time limit and a cancel signal (ADR 0007, decision 2). A probe that hangs\n * on an unresponsive service must not hold a render, and a cancel must interrupt it instead of\n * waiting for the service. The work is never awaited past the limit and never leaves an unhandled\n * rejection; releasing the page it opened is the caller's job (`ProbeControl.stopped`, or closing\n * what it holds once this returns). A failure after the signal fired reads as cancelled, since\n * closing the browser is how a cancel interrupts it.\n */\nexport async function boundedProbe<T>(options: {\n  run: (control: ProbeControl) => Promise<T>;\n  timeoutMs: number;\n  signal?: AbortSignal | undefined;\n}): Promise<ProbeOutcome<T>> {\n  const { signal, timeoutMs } = options;\n  if (signal?.aborted) {\n    return { status: \"cancelled\" };\n  }\n  const halt = { halted: false };\n  const work = options.run({ stopped: () => halt.halted }).then(\n    (value): ProbeOutcome<T> => ({ status: \"done\", value }),\n    (error: unknown): ProbeOutcome<T> => ({ status: \"failed\", error }),\n  );\n  return await settle(work, limitOf<T>(timeoutMs, signal), signal, halt);\n}\n\n/** Wait for the work or the limit, mark the work stopped if it lost, and drop the timer and listener. */\nasync function settle<T>(\n  work: Promise<ProbeOutcome<T>>,\n  limit: { reached: Promise<ProbeOutcome<T>>; clear: () => void },\n  signal: AbortSignal | undefined,\n  halt: { halted: boolean },\n): Promise<ProbeOutcome<T>> {\n  try {\n    const outcome = await Promise.race([work, limit.reached]);\n    halt.halted = outcome.status === \"timeout\" || outcome.status === \"cancelled\";\n    return outcome.status === \"failed\" && signal?.aborted ? { status: \"cancelled\" } : outcome;\n  } finally {\n    limit.clear();\n  }\n}\n\n/** A promise that settles on the timeout or the abort, and a way to drop both. */\nfunction limitOf<T>(\n  timeoutMs: number,\n  signal: AbortSignal | undefined,\n): { reached: Promise<ProbeOutcome<T>>; clear: () => void } {\n  let timer: ReturnType<typeof setTimeout> | undefined;\n  let onAbort: (() => void) | undefined;\n  const reached = new Promise<ProbeOutcome<T>>((resolve) => {\n    timer = setTimeout(() => {\n      resolve({ status: \"timeout\" });\n    }, timeoutMs);\n    onAbort = (): void => {\n      resolve({ status: \"cancelled\" });\n    };\n    signal?.addEventListener(\"abort\", onAbort, { once: true });\n  });\n  return {\n    reached,\n    clear: (): void => {\n      clearTimeout(timer);\n      if (onAbort) signal?.removeEventListener(\"abort\", onAbort);\n    },\n  };\n}\n\n/**\n * The environment of a remote render: the driver's browser version and what the page reported. A\n * field the page could not give is left out, except the OS, which falls back to what the service\n * was configured to render on; an unknown fingerprint component is never a change (ADR 0005).\n */\nexport function remoteEnvironment(options: {\n  browserVersion?: string | undefined;\n  probe?: BrowserProbe | undefined;\n  declaredPlatform?: string | undefined;\n}): CaptureEnvironment {\n  const { probe, browserVersion } = options;\n  const platform = normalizePlatform(probe?.platform) ?? options.declaredPlatform;\n  const fonts = probe?.fonts;\n  return {\n    ...(browserVersion ? { browserVersion } : {}),\n    ...(platform ? { platform } : {}),\n    ...(probe?.deviceScaleFactor ? { deviceScaleFactor: probe.deviceScaleFactor } : {}),\n    ...(fonts && fonts.length > 0\n      ? { fontsHash: sha256(fonts.toSorted().join(\"\\n\")).slice(0, 16) }\n      : {}),\n  };\n}\n\n/** `Win32`, `Windows` and `Linux x86_64` read as the OS, in one spelling per OS. */\nfunction normalizePlatform(value: string | undefined): string | undefined {\n  const text = value?.trim().toLowerCase();\n  if (!text) {\n    return undefined;\n  }\n  if (text.startsWith(\"win\")) return \"windows\";\n  if (text.startsWith(\"mac\") || text === \"iphone\" || text === \"ipad\") return \"macos\";\n  return text.startsWith(\"linux\") ? \"linux\" : text;\n}\n"],"mappings":";;;;;;;;;;AAqBA,MAAa,sBAAyC;CACpD;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF;;;;;;;;AAUA,SAAgB,YAAY,UAAkC;CAC5D,MAAM,MAAM;CAYZ,MAAM,QAAsB,CAAC;CAC7B,MAAM,WAAW,IAAI,UAAU,eAAe;CAC9C,MAAM,WAAW,aAAa,KAAA,KAAa,aAAa,KAAK,IAAI,UAAU,WAAW;CACtF,IAAI,UAAU,MAAM,WAAW;CAC/B,IAAI,OAAO,IAAI,qBAAqB,UAAU,MAAM,oBAAoB,IAAI;CAC5E,MAAM,UAAU,IAAI,SAAS,cAAc,QAAQ,CAAC,CAAC,WAAW,IAAI;CACpE,IAAI,CAAC,SAAS,OAAO;CACrB,MAAM,OAAO;CACb,MAAM,WAAW;EAAC;EAAa;EAAc;CAAO;CACpD,MAAM,WAAW,SAAyB;EACxC,QAAQ,OAAO,QAAQ;EACvB,OAAO,QAAQ,YAAY,IAAI,CAAC,CAAC;CACnC;CACA,MAAM,WAAW,SAAS,KAAK,YAAY,QAAQ,OAAO,CAAC;CAC3D,MAAM,QAAQ,SAAS,QAAQ,WAC7B,SAAS,MAAM,SAAS,UAAU,QAAQ,IAAI,OAAO,KAAK,SAAS,MAAM,SAAS,MAAM,CAC1F;CACA,OAAO;AACT;;;;;;;;;AA6BA,eAAsB,aAAgB,SAIT;CAC3B,MAAM,EAAE,QAAQ,cAAc;CAC9B,IAAI,QAAQ,SACV,OAAO,EAAE,QAAQ,YAAY;CAE/B,MAAM,OAAO,EAAE,QAAQ,MAAM;CAK7B,OAAO,MAAM,OAJA,QAAQ,IAAI,EAAE,eAAe,KAAK,OAAO,CAAC,CAAC,CAAC,MACtD,WAA4B;EAAE,QAAQ;EAAQ;CAAM,KACpD,WAAqC;EAAE,QAAQ;EAAU;CAAM,EAE3C,GAAG,QAAW,WAAW,MAAM,GAAG,QAAQ,IAAI;AACvE;;AAGA,eAAe,OACb,MACA,OACA,QACA,MAC0B;CAC1B,IAAI;EACF,MAAM,UAAU,MAAM,QAAQ,KAAK,CAAC,MAAM,MAAM,OAAO,CAAC;EACxD,KAAK,SAAS,QAAQ,WAAW,aAAa,QAAQ,WAAW;EACjE,OAAO,QAAQ,WAAW,YAAY,QAAQ,UAAU,EAAE,QAAQ,YAAY,IAAI;CACpF,UAAU;EACR,MAAM,MAAM;CACd;AACF;;AAGA,SAAS,QACP,WACA,QAC0D;CAC1D,IAAI;CACJ,IAAI;CAUJ,OAAO;EACL,SAAA,IAVkB,SAA0B,YAAY;GACxD,QAAQ,iBAAiB;IACvB,QAAQ,EAAE,QAAQ,UAAU,CAAC;GAC/B,GAAG,SAAS;GACZ,gBAAsB;IACpB,QAAQ,EAAE,QAAQ,YAAY,CAAC;GACjC;GACA,QAAQ,iBAAiB,SAAS,SAAS,EAAE,MAAM,KAAK,CAAC;EAC3D,CAEQ;EACN,aAAmB;GACjB,aAAa,KAAK;GAClB,IAAI,SAAS,QAAQ,oBAAoB,SAAS,OAAO;EAC3D;CACF;AACF;;;;;;AAOA,SAAgB,kBAAkB,SAIX;CACrB,MAAM,EAAE,OAAO,mBAAmB;CAClC,MAAM,WAAW,kBAAkB,OAAO,QAAQ,KAAK,QAAQ;CAC/D,MAAM,QAAQ,OAAO;CACrB,OAAO;EACL,GAAI,iBAAiB,EAAE,eAAe,IAAI,CAAC;EAC3C,GAAI,WAAW,EAAE,SAAS,IAAI,CAAC;EAC/B,GAAI,OAAO,oBAAoB,EAAE,mBAAmB,MAAM,kBAAkB,IAAI,CAAC;EACjF,GAAI,SAAS,MAAM,SAAS,IACxB,EAAE,WAAW,OAAO,MAAM,SAAS,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,GAAG,EAAE,EAAE,IAC9D,CAAC;CACP;AACF;;AAGA,SAAS,kBAAkB,OAA+C;CACxE,MAAM,OAAO,OAAO,KAAK,CAAC,CAAC,YAAY;CACvC,IAAI,CAAC,MACH;CAEF,IAAI,KAAK,WAAW,KAAK,GAAG,OAAO;CACnC,IAAI,KAAK,WAAW,KAAK,KAAK,SAAS,YAAY,SAAS,QAAQ,OAAO;CAC3E,OAAO,KAAK,WAAW,OAAO,IAAI,UAAU;AAC9C"}

package/dist/utils/resources.d.mts

@@ -0,0 +1,62 @@
+import __tsdown_shims_path from 'node:path';
+import __tsdown_shims_url from 'node:url';
+/** CPU and memory actually available to this process (container limits included). */
+interface HostResources {
+  /** Fractional vCPUs: a cgroup quota of 0.5 CPU reports `0.5`. */
+  cpus: number;
+  memoryBytes: number;
+}
+/**
+ * Detect the CPU and memory budget. Container limits win over the host's: a
+ * 0.5 vCPU / 1 GB container on a large machine must be sized as 0.5 / 1 GB.
+ */
+declare function detectResources(): HostResources;
+/**
+ * Cost of one page in Chromium-page slots. Firefox and WebKit pages cost about twice a Chromium
+ * page in CPU time (ray.run cross-browser benchmarks: Firefox +71%, WebKit +60%; some Playwright
+ * reports show WebKit worse), so they get half the page budget. Takes a capture target too.
+ */
+declare function engineWeight(browser?: string): number;
+/**
+ * Pages to render at once: no more than the CPUs (extra pages only slow each
+ * other down and trip timeouts) and no more than memory allows. A heavier engine
+ * (see {@link engineWeight}) spends the same budget on fewer pages.
+ */
+declare function recommendedPageConcurrency(resources?: HostResources, browser?: string): number;
+/**
+ * Most pages the adaptive controller may reach: memory is a hard limit, but CPU is only a
+ * starting point (latency tells us when it is saturated), so allow up to twice the CPUs.
+ */
+declare function maxPageConcurrency(resources?: HostResources, browser?: string): number;
+/** Builds to capture at once: each launches its own browser, so only on roomy hosts. */
+declare function recommendedBuildConcurrency(resources?: HostResources): number;
+/** Playwright's 30 s default assumes a full CPU; starved containers parse the Storybook bundle slower. */
+declare function recommendedNavigationTimeoutMs(resources?: HostResources): number;
+/** Captures between browser restarts: Chromium grows slowly over a long run, so recycle it. */
+declare const DEFAULT_RECYCLE_BROWSER_EVERY = 150;
+/** Loggable summary of the host budget and the capture settings derived from it. */
+declare function describeSizing(settings: {
+  browser?: string;
+  concurrency?: number;
+  navigationTimeoutMs?: number;
+  recycleBrowserEvery?: number;
+}): Record<string, number>;
+/** What capture will use on this host: detected resources and the effective concurrency. */
+interface CaptureHostSummary {
+  cpus: number;
+  memoryMb: number;
+  /** Builds captured at once, and whether that was sized from the hardware or configured. */
+  builds: {
+    value: number;
+    auto: boolean;
+  };
+  /** Pages per build when the runner is not pinned: where it starts and the most it may reach (Chromium). */
+  pages: {
+    start: number;
+    max: number;
+  };
+}
+/** Summarise the host budget and effective capture concurrency, for the System page. */
+declare function describeCaptureHost(configuredBuilds?: number, resources?: HostResources): CaptureHostSummary;
+export { CaptureHostSummary, DEFAULT_RECYCLE_BROWSER_EVERY, HostResources, describeCaptureHost, describeSizing, detectResources, engineWeight, maxPageConcurrency, recommendedBuildConcurrency, recommendedNavigationTimeoutMs, recommendedPageConcurrency };
+//# sourceMappingURL=resources.d.mts.map