@zvndev/darkmown 2.10.0 → 2.10.1

package/src/api-runner.js

@@ -78,13 +78,17 @@ function dynamicCount(segments) {
 /**
  * Match a request pathname against discovered routes. The pathname is expected
  * to start with `/api`; anything else returns `null` (caller serves static).
+ * A dynamic segment whose percent-encoding is malformed (`%E0%A4%A`) makes
+ * `decodeURIComponent` throw — that is reported as `{ malformed: true }` so the
+ * caller answers a clean 400 instead of crashing the request handler.
  * @param {ApiRoute[]} routes
  * @param {string} pathname Request pathname (no query string).
- * @returns {{ file: string, params: Record<string, string> } | null}
+ * @returns {{ file: string, params: Record<string, string> } | { malformed: true } | null}
  */
 export function matchApiRoute(routes, pathname) {
   if (pathname !== "/api" && !pathname.startsWith("/api/")) return null;
   const parts = pathname.split("/").filter(Boolean).slice(1); // drop leading "api"
+  let sawMalformed = false;
   for (const route of routes) {
     if (route.segments.length !== parts.length) continue;
     /** @type {Record<string, string>} */
@@ -93,7 +97,15 @@ export function matchApiRoute(routes, pathname) {
     for (let i = 0; i < parts.length; i++) {
       const seg = route.segments[i];
       if (seg.startsWith("[") && seg.endsWith("]")) {
-        params[seg.slice(1, -1)] = decodeURIComponent(parts[i]);
+        try {
+          params[seg.slice(1, -1)] = decodeURIComponent(parts[i]);
+        } catch {
+          // Malformed here does not preclude a static match on a later route,
+          // so keep scanning and report only if nothing else claimed the path.
+          sawMalformed = true;
+          ok = false;
+          break;
+        }
       } else if (seg !== parts[i]) {
         ok = false;
         break;
@@ -101,13 +113,15 @@ export function matchApiRoute(routes, pathname) {
     }
     if (ok) return { file: route.file, params };
   }
-  return null;
+  return sawMalformed ? { malformed: true } : null;
 }
 
 /**
  * Build a Web-standard `Request` from a Node `IncomingMessage`. The body (for
- * methods that carry one) is buffered fully — dev endpoints are small and this
- * avoids the `duplex: "half"` streaming dance.
+ * methods that carry one) is buffered up to {@link MAX_BODY_BYTES} — dev and
+ * preview endpoints are small and this avoids the `duplex: "half"` streaming
+ * dance. A larger body rejects with {@link BodyTooLargeError}, which
+ * `handleApiRequest` answers as a 413.
  * @param {import("node:http").IncomingMessage} req
  * @returns {Promise<Request>}
  */
@@ -125,6 +139,15 @@ export async function nodeRequestToWeb(req) {
   return new Request(url, init);
 }
 
+/** Bodies larger than this are rejected with a 413 rather than buffered without bound. */
+const MAX_BODY_BYTES = 10 * 1024 * 1024;
+
+/**
+ * Rejection marker for an over-cap request body, so `handleApiRequest` answers
+ * 413 (a client error) instead of a generic 500.
+ */
+class BodyTooLargeError extends Error {}
+
 /**
  * @param {import("node:http").IncomingMessage} req
  * @returns {Promise<Buffer>}
@@ -133,7 +156,22 @@ function readBody(req) {
   return new Promise((resolve, reject) => {
     /** @type {Buffer[]} */
     const chunks = [];
-    req.on("data", (chunk) => chunks.push(Buffer.from(chunk)));
+    let received = 0;
+    let over = false;
+    req.on("data", (chunk) => {
+      received += chunk.length;
+      if (received > MAX_BODY_BYTES) {
+        // Stop accumulating, but keep draining the socket: destroying the
+        // request here would kill the connection before the 413 answer can
+        // reach the client (verified: `req.destroy()` mid-upload → EPIPE).
+        if (!over) {
+          over = true;
+          reject(new BodyTooLargeError(`Request body too large (over ${MAX_BODY_BYTES} bytes)`));
+        }
+        return;
+      }
+      chunks.push(Buffer.from(chunk));
+    });
     req.on("end", () => resolve(Buffer.concat(chunks)));
     req.on("error", reject);
   });
@@ -189,18 +227,41 @@ export async function writeWebResponse(response, res, acceptEncoding) {
  * the handler succeeded or threw), `false` when nothing matched so the caller
  * should fall through to static serving.
  *
+ * Error disclosure: a handler throw is answered as JSON either way, but the
+ * `error` field carries the real message only when `discloseErrors` is set
+ * (the dev server's default — a documented dev convenience). The preview
+ * server passes `false` and the client gets the generic "Internal error",
+ * matching the shape the generated Cloudflare worker ships.
+ *
  * @param {object} io
  * @param {string} io.apiDir Absolute path to the project's `api/` directory.
  * @param {import("node:http").IncomingMessage} io.req
  * @param {import("node:http").ServerResponse} io.res
  * @param {string | string[] | undefined} [io.acceptEncoding] The request's
  *   Accept-Encoding header, when the caller negotiates compression (preview).
+ * @param {boolean} [io.discloseErrors] Echo the thrown message to the client
+ *   (default true, the dev behavior). Pass false on any production-shaped path.
  * @returns {Promise<boolean>}
  */
-export async function handleApiRequest({ apiDir, req, res, acceptEncoding }) {
+export async function handleApiRequest({
+  apiDir,
+  req,
+  res,
+  acceptEncoding,
+  discloseErrors = true
+}) {
   const pathname = new URL(req.url || "/", "http://localhost").pathname;
   const match = matchApiRoute(discoverApiRoutes(apiDir), pathname);
   if (!match) return false;
+  if ("malformed" in match) {
+    // A malformed percent-encoded dynamic segment: the URL itself is at fault,
+    // so this is a 400, not a 500 — and it must never reach the caller's catch.
+    await writeWebResponse(
+      Response.json({ ok: false, error: "Malformed URL encoding" }, { status: 400 }),
+      res
+    );
+    return true;
+  }
 
   try {
     const handler = await importHandler(match.file);
@@ -215,7 +276,18 @@ export async function handleApiRequest({ apiDir, req, res, acceptEncoding }) {
     }
     await writeWebResponse(response, res, acceptEncoding);
   } catch (err) {
-    const message = err instanceof Error ? err.message : String(err);
+    if (err instanceof BodyTooLargeError) {
+      await writeWebResponse(
+        Response.json({ ok: false, error: "Request body too large" }, { status: 413 }),
+        res
+      );
+      return true;
+    }
+    const message = discloseErrors
+      ? err instanceof Error
+        ? err.message
+        : String(err)
+      : "Internal error";
     await writeWebResponse(Response.json({ ok: false, error: message }, { status: 500 }), res);
   }
   return true;

package/src/builder.js

@@ -1464,15 +1464,17 @@ function emitAssets(assets, paths, pageHtml, warned) {
     fs.mkdirSync(path.dirname(out), { recursive: true });
     if (source.endsWith(".skin")) {
       const src = fs.readFileSync(source, "utf8");
+      // `file` threads the source path into compileSkin so a skin authoring
+      // error reports `file:line` like every other compile error.
       if (assets.scopedSkins.has(source)) {
         const rel = path.relative(paths.cwd, source).replaceAll(path.sep, "/");
         const scope = scopeIdFor(rel);
         /** @type {Set<string>} */
         const subjects = new Set();
-        fs.writeFileSync(out, compileSkin(src, { scope, subjects }));
+        fs.writeFileSync(out, compileSkin(src, { scope, subjects, file: source }));
         warnUnusedScoped(subjects, scope, pageHtml, path.basename(source), warned);
       } else {
-        fs.writeFileSync(out, compileSkin(src));
+        fs.writeFileSync(out, compileSkin(src, { file: source }));
       }
     } else {
       fs.copyFileSync(source, out);

package/src/cli.js

@@ -413,7 +413,10 @@ function startDevServer({ cwd, log, warn, error }) {
     }
     // Serverless parity: run a project `api/*.js` function if the path matches,
     // exactly as Vercel/Cloudflare would in production; otherwise serve static. A
-    // throw on either path (e.g. a stat/read error) becomes a clean 500.
+    // throw on either path (e.g. a stat/read error) becomes a clean 500. Dev
+    // DELIBERATELY echoes the stack and the api runner keeps real error messages
+    // (the `discloseErrors` default) — this is the author's own machine; `serve`
+    // is the production-shaped path and discloses nothing.
     handleApiRequest({ apiDir, req, res })
       .then((handled) => {
         if (!handled) serveDev(distRoot, url, res, draftRoutes(cwd), () => lastBuildError);
@@ -473,15 +476,20 @@ function startPreviewServer({ cwd, log, error }) {
   const server = http.createServer((req, res) => {
     const acceptEncoding = req.headers["accept-encoding"];
     // Serverless parity, exactly as in dev: run a project api/*.js function when
-    // the path matches; otherwise serve static (compressed when negotiated). A
-    // throw on either path (e.g. a malformed dynamic segment) becomes a clean 500.
-    handleApiRequest({ apiDir, req, res, acceptEncoding })
+    // the path matches; otherwise serve static (compressed when negotiated).
+    // Unlike dev, serve mirrors PRODUCTION disclosure rules: the api runner gets
+    // `discloseErrors: false` (the client sees "Internal error", same shape as
+    // the generated Cloudflare worker), a malformed dynamic segment is a clean
+    // 400 inside the runner, and an unexpected throw here is logged server-side
+    // but never echoed — a stack trace leaks paths and internals to the client.
+    handleApiRequest({ apiDir, req, res, acceptEncoding, discloseErrors: false })
       .then((handled) => {
         if (!handled) serve(distRoot, req.url || "/", res, { acceptEncoding });
       })
       .catch((err) => {
+        error(err instanceof Error && err.stack ? err.stack : String(err));
         res.writeHead(500, { "content-type": "text/plain" });
-        res.end((err instanceof Error && err.stack) || String(err));
+        res.end("Internal Server Error");
       });
   });
   return new Promise((resolve) => {

package/src/compiler/state.js

@@ -174,6 +174,79 @@ function rejectStateSeed(value, raw, directive, ctx, index) {
   );
 }
 
+// ---------------------------------------------------------------------------
+// A SECRET-SHAPED SEED IS A HINT, NEVER AN ERROR.
+//
+// Every `:state`/`:store` seed is stored verbatim and inlined into the public
+// HTML as a JSON script tag — that is the design, and it means a seed that is
+// really an API key or token is published to every reader of the page. The
+// documented pattern is to seed empty and fill from an api/ endpoint at
+// runtime, but nothing stopped an author from pasting the key itself. This
+// check is a heuristic over string seeds (and string values nested in
+// array/object seeds), pushed onto the same `comp.warnings` channel as the
+// other build hints: it can never fail a build, because a false positive must
+// never break one, and it fires at most once per declaration.
+//
+// The shapes are deliberately tight — false positives are the enemy:
+//
+// - Known key prefixes (`sk-`, `ghp_`, `xoxb-`, `AKIA`, …) followed by a real
+//   token body, and the `-----BEGIN` private-key header.
+// - A JWT: three base64url segments joined by dots, opening with `eyJ` (the
+//   base64 of `{"` — requiring it keeps dotted prose quiet).
+// - A long unbroken token: 32+ chars from the base64/base64url alphabet with
+//   no spaces, requiring BOTH cases and a digit. Requiring the case mix keeps
+//   kebab-case slugs, hex hashes, and UUIDs (all lowercase) silent, and the
+//   charset excludes `:`, `.`, and space, so URLs, file paths, and prose
+//   never match.
+// ---------------------------------------------------------------------------
+const SECRET_PREFIX = /^(?:sk-|sk_live_|sk_test_|ghp_|gho_|xoxb-|xoxp-|AKIA)/;
+const SECRET_TOKEN_BODY = /^[A-Za-z0-9_-]{8,}$/;
+const JWT_SHAPE = /^eyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}$/;
+const LONG_TOKEN_SHAPE = /^[A-Za-z0-9/_+=-]{32,}$/;
+
+/**
+ * Test one string for the secret shapes above.
+ * @param {string} text
+ * @returns {boolean}
+ */
+function looksLikeSecret(text) {
+  if (text.startsWith("-----BEGIN")) return true;
+  const prefixed = text.match(SECRET_PREFIX);
+  if (prefixed && SECRET_TOKEN_BODY.test(text.slice(prefixed[0].length))) return true;
+  if (JWT_SHAPE.test(text)) return true;
+  return LONG_TOKEN_SHAPE.test(text) && /[a-z]/.test(text) && /[A-Z]/.test(text) && /\d/.test(text);
+}
+
+/**
+ * Walk a parsed seed for a secret-shaped string: the seed itself, or any
+ * string value nested in its arrays/objects.
+ * @param {unknown} value
+ * @returns {boolean}
+ */
+function seedContainsSecret(value) {
+  if (typeof value === "string") return looksLikeSecret(value);
+  if (Array.isArray(value)) return value.some(seedContainsSecret);
+  if (value && typeof value === "object") return Object.values(value).some(seedContainsSecret);
+  return false;
+}
+
+/**
+ * Push the secret-seed hint when a `:state`/`:store` seed carries one.
+ * @param {unknown} value The parsed seed.
+ * @param {string} name The declared name, for the message.
+ * @param {string} directive `:state` or `:store`, for the message.
+ * @param {Ctx} ctx
+ * @param {number} index 0-based line index for `file:line`.
+ * @returns {void}
+ */
+function warnSecretSeed(value, name, directive, ctx, index) {
+  if (!seedContainsSecret(value)) return;
+  ctx.comp.warnings.push(
+    `${at(ctx, index)}: ${directive} "${name}" seed looks like a secret — it will be inlined into public HTML. ` +
+      `Seed empty and fill it from an api/ endpoint at runtime.`
+  );
+}
+
 /**
  * @param {string} line
  * @param {Ctx} ctx
@@ -195,6 +268,7 @@ export function handleState(line, ctx, index) {
   const flags = parseModifiers(match[3], ":state", ctx, index);
   const value = parseStateValue(match[2], at(ctx, index));
   rejectStateSeed(value, match[2], ":state", ctx, index);
+  warnSecretSeed(value, match[1], ":state", ctx, index);
   const key = declareState(match[1], value, ctx);
   recordSymbol(ctx, index, { kind: "state", name: key, detail: `${key} = ${match[2].trim()}` });
   const persistAttr = flags.persist ? ` data-wd-persist="${escapeHtml(key)}"` : "";
@@ -263,6 +337,7 @@ export function handleStore(line, ctx, index) {
   const flags = parseModifiers(match[3], ":store", ctx, index);
   const value = parseStateValue(match[2], at(ctx, index));
   rejectStateSeed(value, match[2], ":store", ctx, index);
+  warnSecretSeed(value, match[1], ":store", ctx, index);
   const name = declareStore(match[1], value, ctx);
   recordSymbol(ctx, index, { kind: "store", name, detail: `${name} = ${match[2].trim()}` });
   const ephemeral = flags.ephemeral ? " data-wd-store-ephemeral" : "";

package/src/errors.js

@@ -76,6 +76,7 @@ import {
   IF_EXAMPLE,
   INCLUDE_EXAMPLE
 } from "./compiler/structure.js";
+import { FONT_FACE_EXAMPLE, KEYFRAMES_EXAMPLE } from "./skin.js";
 
 /**
  * One subsystem block of the numbering scheme.
@@ -94,8 +95,9 @@ import {
  * @property {string} title Short name for the mistake.
  * @property {string} cause What the author wrote that triggers it.
  * @property {string} fix The corrective action, in one line.
- * @property {string} [example] A concrete, compilable line, sourced from the
- *   compiler's own `*_EXAMPLE` constants.
+ * @property {string} [example] A concrete, compilable line (or, for block
+ *   constructs like the `.skin` at-rules, a minimal compilable block), sourced
+ *   from the compiler's own `*_EXAMPLE` constants.
  */
 
 /** The subsystem blocks, in code order. */
@@ -1167,6 +1169,36 @@ const ENTRIES = [
     cause: "A top-level `page`/`body`/`html`/`*`/`::selection` selector escapes the scope.",
     fix: "Move page-level styles to a global (non-scoped) skin."
   },
+  {
+    code: "WD804",
+    title: "Malformed `@font-face` block",
+    cause:
+      "`@font-face` was given a name, holds a nested block, or has no descriptors — it takes plain `prop value` declaration lines only.",
+    fix: "Write a bare `@font-face` line and indent each descriptor beneath it.",
+    example: FONT_FACE_EXAMPLE
+  },
+  {
+    code: "WD805",
+    title: "Invalid `@keyframes` name",
+    cause: "The name after `@keyframes` is missing or is not a plain CSS identifier.",
+    fix: "Name the animation with a plain identifier, e.g. `@keyframes fade-in`.",
+    example: KEYFRAMES_EXAMPLE
+  },
+  {
+    code: "WD806",
+    title: "Invalid keyframe selector",
+    cause: "A child of `@keyframes` is not `from`, `to`, or a percentage.",
+    fix: "Use `from`, `to`, a percentage (`50%`), or a comma list of them (`50%, 75%`).",
+    example: KEYFRAMES_EXAMPLE
+  },
+  {
+    code: "WD807",
+    title: "Malformed `@keyframes` body",
+    cause:
+      "A keyframe's declarations nest deeper, a keyframe selector has no declarations, or the block has no keyframe selectors at all.",
+    fix: "Give each keyframe selector a flat list of declarations indented one level beneath it.",
+    example: KEYFRAMES_EXAMPLE
+  },
 
   // --- WD9xx: project, routing, CLI ----------------------------------------
   {
@@ -1211,6 +1243,13 @@ const ENTRIES = [
     cause: "The home page's `ai_crawlers:` is neither `allow` nor `deny`.",
     fix: "Write `ai_crawlers: allow` or `ai_crawlers: deny` (absent means allow)."
   },
+  {
+    code: "WD908",
+    title: "Unsafe route name",
+    cause:
+      "A page filename produced a route containing whitespace or control characters, which would corrupt generated config files (dist/_headers, llms.txt).",
+    fix: "Rename the file using only letters, digits, dashes, and underscores."
+  },
   {
     code: "WD950",
     title: "Invalid `rss_limit`",
@@ -1296,7 +1335,15 @@ export function errorsMarkdown() {
     out.push("| Code | Error | Cause | Fix | Example |");
     out.push("| --- | --- | --- | --- | --- |");
     for (const row of rows) {
-      const example = row.example ? `\`${escapeCell(row.example)}\`` : "";
+      // A multi-line example (the `.skin` at-rule blocks are block constructs)
+      // becomes one code span per line joined by <br>, keeping the table row
+      // on a single markdown line.
+      const example = row.example
+        ? row.example
+            .split("\n")
+            .map((line) => `\`${escapeCell(line)}\``)
+            .join("<br>")
+        : "";
       out.push(
         `| \`${row.code}\` | ${escapeCell(row.title)} | ${escapeCell(row.cause)} | ${escapeCell(row.fix)} | ${example} |`
       );

package/src/font-subset.js

@@ -36,6 +36,8 @@ import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
+import { fsReader } from "./compiler/fs-reader.js";
+import { isAllowedInclude } from "./compiler/includes.js";
 
 /**
  * @typedef {import("./config.js").Paths} Paths
@@ -287,21 +289,26 @@ export function subsetFonts(paths, options = {}) {
  * build is synchronous; the wasm API is not), communicating through temp JSON
  * files rather than stdio so a large payload never hits a pipe buffer. The
  * worker always writes a results file — a missing or unparsable one means the
- * child itself died, which is reported as `unavailable` (the build then behaves
- * as if the toolchain were absent: a hint, no subsets, no failure).
+ * child itself died (crashed, or killed by the spawn timeout), which is
+ * reported as `unavailable` (the build then behaves as if the toolchain were
+ * absent: a hint, no subsets, no failure).
  * @param {{ charset: number[], jobs: SubsetJob[] }} payload
  * @param {(cmd: string, args: string[], opts: object) => unknown} [spawn]
  *   Injectable for tests; the real one is `spawnSync`.
+ * @param {number} [timeoutMs] The worker is killed after this long (default
+ *   two minutes), so a hung toolchain call cannot stall a build forever. The
+ *   kill lands in the same `unavailable` path as any other dead child.
  * @returns {SubsetResult}
  */
-export function runSubsetJobs(payload, spawn = /** @type {any} */ (spawnSync)) {
+export function runSubsetJobs(payload, spawn = /** @type {any} */ (spawnSync), timeoutMs = 120000) {
   const dir = fs.mkdtempSync(path.join(os.tmpdir(), "wd-font-subset-"));
   try {
     const jobsFile = path.join(dir, "jobs.json");
     const resultsFile = path.join(dir, "results.json");
     fs.writeFileSync(jobsFile, JSON.stringify(payload));
     spawn(process.execPath, [WORKER_PATH, jobsFile, resultsFile], {
-      stdio: ["ignore", "ignore", "inherit"]
+      stdio: ["ignore", "ignore", "inherit"],
+      timeout: timeoutMs
     });
     if (!fs.existsSync(resultsFile)) return { unavailable: true, failed: [] };
     try {
@@ -391,9 +398,10 @@ function fontUrlsInCss(css) {
  * Resolve a url() target from an emitted `@font-face` to the project font file
  * it names, or null when it is not a subset candidate: anything not
  * leading-slash (remote, protocol-relative, `data:`, relative), a non-subsettable
- * extension (already-woff2 included), an un-decodable or escaping path, or a
- * file that does not exist. `/__wd/media/<rel>` maps to the shelf; every other
- * absolute path maps to `site/pages`.
+ * extension (already-woff2 included), an un-decodable or escaping path, a
+ * symlink (whose target could live anywhere on disk, whatever the link's own
+ * path says), or a file that does not exist. `/__wd/media/<rel>` maps to the
+ * shelf; every other absolute path maps to `site/pages`.
  * @param {Paths} paths
  * @param {string} url The raw url() target.
  * @returns {FontRef | null}
@@ -416,6 +424,16 @@ function resolveFontUrl(paths, url) {
   const source = path.normalize(path.join(base, rel));
   if (!source.startsWith(base + path.sep)) return null;
   if (!fs.existsSync(source)) return null;
+  // Symlinks are never subsetted, matching the asset-copy convention
+  // (`emitPageAssets` skips them entirely, and so does the image pre-pass):
+  // the lexical containment check above reads the path as WRITTEN, so a link
+  // sitting inside the project could point anywhere on disk and the target's
+  // bytes would be read and published as a subset. An ancestor directory can
+  // be a symlink with the file itself plain, so the canonical (realpath)
+  // containment check `@include` uses runs too — a font whose real path
+  // escapes site/pages and site/_ is simply "not project-local" here.
+  if (fs.lstatSync(source).isSymbolicLink()) return null;
+  if (!isAllowedInclude(source, paths, fsReader())) return null;
   const subsetUrl = `${clean.slice(0, clean.length - ext.length)}-subset.woff2`;
   return { url, source, subsetUrl, subsetDist: path.join(paths.distRoot, subsetUrl.slice(1)) };
 }

package/src/image-variant-resize.js

@@ -46,7 +46,10 @@ export async function runJobsFile(jobsFile, resultsFile) {
       // loses the EXIF tag with its pixels physically rotated, so it displays
       // exactly like the tag-carrying original. `withoutEnlargement` is belt and
       // braces — the pre-pass only ever queues widths below the intrinsic size.
-      let pipeline = sharp(job.source)
+      // `limitInputPixels` caps the decompression-bomb surface: 100 MP is above
+      // any real photo, and an oversized input fails as a per-job error (a hint
+      // naming the file), never a build failure.
+      let pipeline = sharp(job.source, { limitInputPixels: 1e8 })
         .rotate()
         .resize({ width: job.width, withoutEnlargement: true });
       if (job.format === "webp") pipeline = pipeline.webp({ quality: 82 });

package/src/image-variants.js

@@ -228,21 +228,26 @@ export function generateImageVariants(paths, options = {}) {
  * build is synchronous; sharp is not), communicating through temp JSON files
  * rather than stdio so a large job list never hits a pipe buffer. The worker
  * always writes a results file — a missing or unparsable one means the child
- * itself died, which is reported as `unavailable` (the build then behaves as
- * if sharp were absent: a hint, no variants, no failure).
+ * itself died (crashed, or killed by the spawn timeout), which is reported as
+ * `unavailable` (the build then behaves as if sharp were absent: a hint, no
+ * variants, no failure).
  * @param {ResizeJob[]} jobs
  * @param {(cmd: string, args: string[], opts: object) => unknown} [spawn]
  *   Injectable for tests; the real one is `spawnSync`.
+ * @param {number} [timeoutMs] The worker is killed after this long (default
+ *   two minutes), so a hung sharp call cannot stall a build forever. The kill
+ *   lands in the same `unavailable` path as any other dead child.
  * @returns {ResizeResult}
  */
-export function runResizeJobs(jobs, spawn = /** @type {any} */ (spawnSync)) {
+export function runResizeJobs(jobs, spawn = /** @type {any} */ (spawnSync), timeoutMs = 120000) {
   const dir = fs.mkdtempSync(path.join(os.tmpdir(), "wd-img-variants-"));
   try {
     const jobsFile = path.join(dir, "jobs.json");
     const resultsFile = path.join(dir, "results.json");
     fs.writeFileSync(jobsFile, JSON.stringify(jobs));
     spawn(process.execPath, [WORKER_PATH, jobsFile, resultsFile], {
-      stdio: ["ignore", "ignore", "inherit"]
+      stdio: ["ignore", "ignore", "inherit"],
+      timeout: timeoutMs
     });
     if (!fs.existsSync(resultsFile)) return { unavailable: true, failed: [] };
     try {

package/src/router.js

@@ -88,6 +88,11 @@ export function isDraft(meta) {
 
 /**
  * Derive a public route path from a source file path.
+ *
+ * Fail-closed on control/whitespace characters: the route string flows RAW
+ * into generated config (`dist/_headers` blocks, llms.txt lines), where a
+ * newline in a filename would inject whole config lines. Rejecting here, at
+ * the one route-derivation chokepoint, protects every downstream sink at once.
  * @param {string} routesRoot Absolute path to `site/pages`.
  * @param {string} file Absolute path to the source file.
  * @returns {string}
@@ -98,9 +103,20 @@ export function routeFromFile(routesRoot, file) {
   const parts = rel.split(path.sep);
   if (parts.at(-1) === "index") parts.pop();
   const route = `/${parts.join("/")}`;
+  if (ROUTE_UNSAFE_CHARS.test(route)) {
+    throw wdError(
+      `Refusing to route ${file} — a page filename must not contain whitespace or ` +
+        "control characters: the route is written verbatim into generated config " +
+        "(dist/_headers, llms.txt), where such a character would corrupt the file.",
+      { code: "WD908", file }
+    );
+  }
   return route === "/" ? "/" : `${route}/`;
 }
 
+/** Whitespace (`\s`) and control characters (`\p{Cc}`: C0, DEL, C1) a route string must never carry. */
+const ROUTE_UNSAFE_CHARS = /[\s\p{Cc}]/u;
+
 /**
  * Map a public route to the `index.html` output path under `distRoot`.
  *