@zvndev/darkmown 2.10.0 → 2.11.0

package/src/templates/store/site/_/card.wd

@@ -0,0 +1,19 @@
+---
+defaults: [note="Ships in 2 days"]
+---
+
+::: card .product
+::: tile
+{ p.initial }
+:::
+::: pname
+{ p.name }
+:::
+::: price
+{ p.price | money }
+:::
+::: note
+{ note }
+:::
+{ children }
+:::

package/src/templates/store/site/_/products.json

@@ -1,8 +1,8 @@
 [
-  { "name": "Ceramic Mug", "emoji": "☕️", "price": 18 },
-  { "name": "Linen Tote", "emoji": "👜", "price": 32 },
-  { "name": "Pocket Notebook", "emoji": "📓", "price": 12 },
-  { "name": "Desk Lamp", "emoji": "💡", "price": 64 },
-  { "name": "Plant Pot", "emoji": "🪴", "price": 24 },
-  { "name": "Wall Clock", "emoji": "🕰️", "price": 48 }
+  { "name": "Ceramic Mug", "initial": "C", "price": 18 },
+  { "name": "Linen Tote", "initial": "L", "price": 32 },
+  { "name": "Pocket Notebook", "initial": "P", "price": 12 },
+  { "name": "Desk Lamp", "initial": "D", "price": 64 },
+  { "name": "Plant Pot", "initial": "P", "price": 24 },
+  { "name": "Wall Clock", "initial": "W", "price": 48 }
 ]

package/src/templates/store/site/pages/index.skin

@@ -93,13 +93,28 @@ input:focus-visible, select:focus-visible, textarea:focus-visible
   border-color $accent
   box-shadow 0 12px 26px -16px rgba(26,31,43,.4)
 
-.emoji
-  font-size 2.25rem
+.tile
+  width 3rem
+  height 3rem
+  margin 0 auto
+  display grid
+  place-items center
+  font-size 1.3rem
+  font-weight 700
+  color $accent-deep
+  bg $paper
+  border 1px solid $line
+  radius 10px
 
 .pname
   font-weight 600
   margin .35rem 0 .15rem
 
+.note
+  color $muted
+  font-size .82rem
+  margin-bottom .6rem
+
 .price
   color $accent
   font-weight 600

package/src/templates/store/site/pages/index.wd

@@ -23,18 +23,9 @@ transitions: true
 
 ::: catalog
 @loop /products.json into p where p.name contains q
-::: card .product
-::: emoji
-{ p.emoji }
-:::
-::: pname
-{ p.name }
-:::
-::: price
-{ p.price | money }
-:::
+@include /card.wd
 :button "Add to cart" -> cart += p
-:::
+@endinclude
 @empty
 ::: card .empty
 Nothing matches "**{ q }**".
@@ -46,7 +37,7 @@ Nothing matches "**{ q }**".
 
 @loop cart into item
 ::: card .line
-{ item.emoji } **{ item.name }** — { item.price | money }
+**{ item.name }** — { item.price | money }
 :button "Remove" -> cart remove item
 :::
 @empty

package/types/api-runner.d.ts

@@ -38,18 +38,25 @@ export function discoverApiRoutes(apiDir: string): ApiRoute[];
 /**
  * Match a request pathname against discovered routes. The pathname is expected
  * to start with `/api`; anything else returns `null` (caller serves static).
+ * A dynamic segment whose percent-encoding is malformed (`%E0%A4%A`) makes
+ * `decodeURIComponent` throw — that is reported as `{ malformed: true }` so the
+ * caller answers a clean 400 instead of crashing the request handler.
  * @param {ApiRoute[]} routes
  * @param {string} pathname Request pathname (no query string).
- * @returns {{ file: string, params: Record<string, string> } | null}
+ * @returns {{ file: string, params: Record<string, string> } | { malformed: true } | null}
  */
 export function matchApiRoute(routes: ApiRoute[], pathname: string): {
     file: string;
     params: Record<string, string>;
+} | {
+    malformed: true;
 } | null;
 /**
  * Build a Web-standard `Request` from a Node `IncomingMessage`. The body (for
- * methods that carry one) is buffered fully — dev endpoints are small and this
- * avoids the `duplex: "half"` streaming dance.
+ * methods that carry one) is buffered up to {@link MAX_BODY_BYTES} — dev and
+ * preview endpoints are small and this avoids the `duplex: "half"` streaming
+ * dance. A larger body rejects with {@link BodyTooLargeError}, which
+ * `handleApiRequest` answers as a 413.
  * @param {import("node:http").IncomingMessage} req
  * @returns {Promise<Request>}
  */
@@ -75,19 +82,28 @@ export function writeWebResponse(response: Response, res: import("node:http").Se
  * the handler succeeded or threw), `false` when nothing matched so the caller
  * should fall through to static serving.
  *
+ * Error disclosure: a handler throw is answered as JSON either way, but the
+ * `error` field carries the real message only when `discloseErrors` is set
+ * (the dev server's default — a documented dev convenience). The preview
+ * server passes `false` and the client gets the generic "Internal error",
+ * matching the shape the generated Cloudflare worker ships.
+ *
  * @param {object} io
  * @param {string} io.apiDir Absolute path to the project's `api/` directory.
  * @param {import("node:http").IncomingMessage} io.req
  * @param {import("node:http").ServerResponse} io.res
  * @param {string | string[] | undefined} [io.acceptEncoding] The request's
  *   Accept-Encoding header, when the caller negotiates compression (preview).
+ * @param {boolean} [io.discloseErrors] Echo the thrown message to the client
+ *   (default true, the dev behavior). Pass false on any production-shaped path.
  * @returns {Promise<boolean>}
  */
-export function handleApiRequest({ apiDir, req, res, acceptEncoding }: {
+export function handleApiRequest({ apiDir, req, res, acceptEncoding, discloseErrors }: {
     apiDir: string;
     req: import("node:http").IncomingMessage;
     res: import("node:http").ServerResponse;
     acceptEncoding?: string | string[] | undefined;
+    discloseErrors?: boolean | undefined;
 }): Promise<boolean>;
 /**
  * A discovered API route.

package/types/builder.d.ts

@@ -169,6 +169,11 @@ export type SiteIdentity = {
      * Most-recent-first RSS item cap, from `rss_limit:`.
      */
     rssLimit: number;
+    /**
+     * Publish every page's markdown source at
+     * `<route>.md`, from the home page's `md_source: true` (2.11).
+     */
+    mdSource: boolean;
 };
 export type Paths = import("./config.js").Paths;
 export type Assets = import("./compiler.js").Assets;

package/types/compiler/page.d.ts

@@ -2,10 +2,13 @@
  * Compile a page source file into a full HTML document plus its assets.
  * @param {string} file Absolute path to the source `.md`/`.wd` file.
  * @param {Paths} context Resolved project paths.
- * @param {{ feed?: { href: string, title: string }, site?: SiteContext, collections?: Map<string, import("./collections.js").CollectionRow[]>, vars?: Record<string, unknown>, reader?: import("./reader.js").Reader, imageVariants?: Map<string, number[]> | null }} [options]
+ * @param {{ feed?: { href: string, title: string }, mdSource?: { href: string }, site?: SiteContext, collections?: Map<string, import("./collections.js").CollectionRow[]>, vars?: Record<string, unknown>, reader?: import("./reader.js").Reader, imageVariants?: Map<string, number[]> | null }} [options]
  *   When a site-wide RSS feed is emitted (the home page set `site_url` and the
  *   site has dated posts), `feed` carries its absolute href + title so every page
- *   links it. `site` carries the origin + this page's own route (and its resolved
+ *   links it. When the site publishes markdown sources (the home page set
+ *   `md_source: true` and this page did not opt out), `mdSource` carries the
+ *   page's own `<route>.md` href for the alternate link. `site` carries the
+ *   origin + this page's own route (and its resolved
  *   breadcrumb trail) so the shell can state a canonical URL. `collections` is the
  *   build-time collection index a bare-name `@loop` resolves against; `vars` seeds
  *   the document scope (the pager `page` object on a paginated route). `reader` is
@@ -19,6 +22,9 @@ export function compilePage(file: string, context: Paths, options?: {
         href: string;
         title: string;
     };
+    mdSource?: {
+        href: string;
+    };
     site?: SiteContext;
     collections?: Map<string, import("./collections.js").CollectionRow[]>;
     vars?: Record<string, unknown>;
@@ -103,7 +109,7 @@ export function foldBuildBindings(text: string, now?: Date): string;
  * @param {Record<string, string> | Map<string, string>} files Project-relative
  *   path → source content.
  * @param {string} entryPath Project-relative path of the page to compile.
- * @param {{ feed?: { href: string, title: string }, site?: SiteContext, collections?: Map<string, import("./collections.js").CollectionRow[]>, vars?: Record<string, unknown>, cwd?: string }} [options]
+ * @param {{ feed?: { href: string, title: string }, mdSource?: { href: string }, site?: SiteContext, collections?: Map<string, import("./collections.js").CollectionRow[]>, vars?: Record<string, unknown>, cwd?: string }} [options]
  *   Same shell options as {@link compilePage}; `cwd` overrides the virtual
  *   project root the relative keys resolve against (defaults to `/`).
  * @returns {CompiledPage}
@@ -113,6 +119,9 @@ export function compileFromMemory(files: Record<string, string> | Map<string, st
         href: string;
         title: string;
     };
+    mdSource?: {
+        href: string;
+    };
     site?: SiteContext;
     collections?: Map<string, import("./collections.js").CollectionRow[]>;
     vars?: Record<string, unknown>;

package/types/compiler.d.ts

@@ -4,7 +4,7 @@
  * a different source (see `compileFromMemory`).
  * @param {string} file Absolute path to the source `.md`/`.wd` file.
  * @param {import("./config.js").Paths} context Resolved project paths.
- * @param {{ feed?: { href: string, title: string }, site?: import("./compiler/page.js").SiteContext, collections?: Map<string, import("./compiler/collections.js").CollectionRow[]>, vars?: Record<string, unknown>, reader?: import("./compiler/reader.js").Reader, imageVariants?: Map<string, number[]> | null }} [options]
+ * @param {{ feed?: { href: string, title: string }, mdSource?: { href: string }, site?: import("./compiler/page.js").SiteContext, collections?: Map<string, import("./compiler/collections.js").CollectionRow[]>, vars?: Record<string, unknown>, reader?: import("./compiler/reader.js").Reader, imageVariants?: Map<string, number[]> | null }} [options]
  * @returns {CompiledPage}
  */
 export function compilePage(file: string, context: import("./config.js").Paths, options?: {
@@ -12,6 +12,9 @@ export function compilePage(file: string, context: import("./config.js").Paths,
         href: string;
         title: string;
     };
+    mdSource?: {
+        href: string;
+    };
     site?: import("./compiler/page.js").SiteContext;
     collections?: Map<string, import("./compiler/collections.js").CollectionRow[]>;
     vars?: Record<string, unknown>;

package/types/errors.d.ts

@@ -33,8 +33,9 @@ export function errorsMarkdown(): string;
  * @property {string} title Short name for the mistake.
  * @property {string} cause What the author wrote that triggers it.
  * @property {string} fix The corrective action, in one line.
- * @property {string} [example] A concrete, compilable line, sourced from the
- *   compiler's own `*_EXAMPLE` constants.
+ * @property {string} [example] A concrete, compilable line (or, for block
+ *   constructs like the `.skin` at-rules, a minimal compilable block), sourced
+ *   from the compiler's own `*_EXAMPLE` constants.
  */
 /** The subsystem blocks, in code order. */
 /** @type {ErrorArea[]} */
@@ -93,8 +94,9 @@ export type ErrorEntry = {
      */
     fix: string;
     /**
-     * A concrete, compilable line, sourced from the
-     * compiler's own `*_EXAMPLE` constants.
+     * A concrete, compilable line (or, for block
+     * constructs like the `.skin` at-rules, a minimal compilable block), sourced
+     * from the compiler's own `*_EXAMPLE` constants.
      */
     example?: string | undefined;
 };

package/types/font-subset.d.ts

@@ -29,17 +29,21 @@ export function subsetFonts(paths: Paths, options?: {
  * build is synchronous; the wasm API is not), communicating through temp JSON
  * files rather than stdio so a large payload never hits a pipe buffer. The
  * worker always writes a results file — a missing or unparsable one means the
- * child itself died, which is reported as `unavailable` (the build then behaves
- * as if the toolchain were absent: a hint, no subsets, no failure).
+ * child itself died (crashed, or killed by the spawn timeout), which is
+ * reported as `unavailable` (the build then behaves as if the toolchain were
+ * absent: a hint, no subsets, no failure).
  * @param {{ charset: number[], jobs: SubsetJob[] }} payload
  * @param {(cmd: string, args: string[], opts: object) => unknown} [spawn]
  *   Injectable for tests; the real one is `spawnSync`.
+ * @param {number} [timeoutMs] The worker is killed after this long (default
+ *   two minutes), so a hung toolchain call cannot stall a build forever. The
+ *   kill lands in the same `unavailable` path as any other dead child.
  * @returns {SubsetResult}
  */
 export function runSubsetJobs(payload: {
     charset: number[];
     jobs: SubsetJob[];
-}, spawn?: (cmd: string, args: string[], opts: object) => unknown): SubsetResult;
+}, spawn?: (cmd: string, args: string[], opts: object) => unknown, timeoutMs?: number): SubsetResult;
 /**
  * The subset charset for a build: the base set plus every code point appearing
  * in the given texts (the emitted pages' HTML). Numeric character references

package/types/image-variants.d.ts

@@ -29,14 +29,18 @@ export function generateImageVariants(paths: Paths, options?: {
  * build is synchronous; sharp is not), communicating through temp JSON files
  * rather than stdio so a large job list never hits a pipe buffer. The worker
  * always writes a results file — a missing or unparsable one means the child
- * itself died, which is reported as `unavailable` (the build then behaves as
- * if sharp were absent: a hint, no variants, no failure).
+ * itself died (crashed, or killed by the spawn timeout), which is reported as
+ * `unavailable` (the build then behaves as if sharp were absent: a hint, no
+ * variants, no failure).
  * @param {ResizeJob[]} jobs
  * @param {(cmd: string, args: string[], opts: object) => unknown} [spawn]
  *   Injectable for tests; the real one is `spawnSync`.
+ * @param {number} [timeoutMs] The worker is killed after this long (default
+ *   two minutes), so a hung sharp call cannot stall a build forever. The kill
+ *   lands in the same `unavailable` path as any other dead child.
  * @returns {ResizeResult}
  */
-export function runResizeJobs(jobs: ResizeJob[], spawn?: (cmd: string, args: string[], opts: object) => unknown): ResizeResult;
+export function runResizeJobs(jobs: ResizeJob[], spawn?: (cmd: string, args: string[], opts: object) => unknown, timeoutMs?: number): ResizeResult;
 /**
  * @typedef {import("./config.js").Paths} Paths
  */

package/types/router.d.ts

@@ -38,6 +38,11 @@ export function discoverRoutes(routesRoot: string, options?: {
 export function isDraft(meta: Meta): boolean;
 /**
  * Derive a public route path from a source file path.
+ *
+ * Fail-closed on control/whitespace characters: the route string flows RAW
+ * into generated config (`dist/_headers` blocks, llms.txt lines), where a
+ * newline in a filename would inject whole config lines. Rejecting here, at
+ * the one route-derivation chokepoint, protects every downstream sink at once.
  * @param {string} routesRoot Absolute path to `site/pages`.
  * @param {string} file Absolute path to the source file.
  * @returns {string}

package/types/skin.d.ts

@@ -33,16 +33,21 @@ export function scopeIdFor(relPath: string): string;
  * selectors), they are ALWAYS global (never scope-stamped, same contract as
  * `tokens`), and their declaration values use the same alias/`$token` pipeline.
  * @param {string} source
- * @param {{ scope?: string, subjects?: Set<string> }} [opts] `scope`: the scope
- *   id enabling scoped mode. `subjects`: an optional set the compiler fills with
- *   every scoped subject token (`.card`, `h2`, `#id`) for the unused-selector
- *   warning, so the caller need not re-parse the source.
+ * @param {{ scope?: string, subjects?: Set<string>, file?: string }} [opts]
+ *   `scope`: the scope id enabling scoped mode. `subjects`: an optional set the
+ *   compiler fills with every scoped subject token (`.card`, `h2`, `#id`) for
+ *   the unused-selector warning, so the caller need not re-parse the source.
+ *   `file`: the skin's path, threaded into author-facing errors so they report
+ *   `file:line` (the builder always passes it; a bare call reports `on line N`).
  * @returns {string}
  */
 export function compileSkin(source: string, opts?: {
     scope?: string;
     subjects?: Set<string>;
+    file?: string;
 }): string;
+export const FONT_FACE_EXAMPLE: "@font-face\n  font-family \"Newsreader\"";
+export const KEYFRAMES_EXAMPLE: "@keyframes fade-in\n  to\n    opacity 1";
 /**
  * A nesting frame in the indentation stack.
  */