emdash 0.12.0 → 0.13.0

package/dist/parse-BFTPon-J.mjs

@@ -0,0 +1,89 @@
+import { t as apiError } from "./error-tSQWIl5U.mjs";
+import { z } from "zod";
+
+//#region src/api/parse.ts
+/** Maximum allowed JSON request body size (10 MB). */
+const MAX_BODY_SIZE = 10 * 1024 * 1024;
+/**
+* Parse and validate a JSON request body against a Zod schema.
+*
+* Returns the validated data on success, or a 400 Response on failure.
+* Replaces all `(await request.json()) as T` casts.
+*/
+async function parseBody(request, schema) {
+	const contentLength = request.headers.get("Content-Length");
+	if (contentLength && parseInt(contentLength, 10) > MAX_BODY_SIZE) return apiError("PAYLOAD_TOO_LARGE", "Request body too large", 413);
+	let raw;
+	try {
+		raw = await request.json();
+	} catch {
+		return apiError("INVALID_JSON", "Request body must be valid JSON", 400);
+	}
+	return validate(schema, raw);
+}
+/**
+* Parse and validate an optional JSON request body.
+*
+* Returns `defaultValue` if the body is empty, or the validated data if present.
+* For endpoints where the body is optional (e.g., preview-url, confirm).
+*/
+async function parseOptionalBody(request, schema, defaultValue) {
+	const contentLength = request.headers.get("Content-Length");
+	if (contentLength && parseInt(contentLength, 10) > MAX_BODY_SIZE) return apiError("PAYLOAD_TOO_LARGE", "Request body too large", 413);
+	let text;
+	try {
+		text = await request.text();
+	} catch {
+		return defaultValue;
+	}
+	if (!text.trim()) return defaultValue;
+	let raw;
+	try {
+		raw = JSON.parse(text);
+	} catch {
+		return apiError("INVALID_JSON", "Request body must be valid JSON", 400);
+	}
+	return validate(schema, raw);
+}
+/**
+* Parse and validate URL search params against a Zod schema.
+*
+* Converts searchParams to a plain object before validation.
+* Zod coercion handles string -> number/boolean conversion.
+* Replaces manual `url.searchParams.get()` + `parseInt()` patterns.
+*/
+function parseQuery(url, schema) {
+	const raw = {};
+	for (const [key, value] of url.searchParams) raw[key] = value;
+	return validate(schema, raw);
+}
+/**
+* Validate raw data against a schema. Returns data or error Response.
+*/
+function validate(schema, data) {
+	const result = schema.safeParse(data);
+	if (result.success) return result.data;
+	const issues = result.error.issues.map((issue) => ({
+		path: issue.path.join("."),
+		message: issue.message
+	}));
+	return Response.json({ error: {
+		code: "VALIDATION_ERROR",
+		message: "Invalid request data",
+		details: { issues }
+	} }, {
+		status: 400,
+		headers: { "Cache-Control": "private, no-store" }
+	});
+}
+/**
+* Type guard to check if a ParseResult is an error Response.
+* Usage: `if (isParseError(result)) return result;`
+*/
+function isParseError(result) {
+	return result instanceof Response;
+}
+
+//#endregion
+export { parseQuery as i, parseBody as n, parseOptionalBody as r, isParseError as t };
+//# sourceMappingURL=parse-BFTPon-J.mjs.map

package/dist/parse-BFTPon-J.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"parse-BFTPon-J.mjs","names":[],"sources":["../src/api/parse.ts"],"sourcesContent":["/**\n * Request body and query parameter parsing with Zod validation.\n *\n * All API routes should use these utilities instead of `request.json() as T`\n * or raw `url.searchParams.get()` with manual coercion.\n */\n\nimport { z } from \"zod\";\n\nimport { apiError } from \"./error.js\";\n\n/** Maximum allowed JSON request body size (10 MB). */\nconst MAX_BODY_SIZE = 10 * 1024 * 1024;\n\n/**\n * Result of parsing: either the validated data or an error Response.\n * Routes should check `if (result instanceof Response) return result;`\n */\nexport type ParseResult<T> = T | Response;\n\n/**\n * Parse and validate a JSON request body against a Zod schema.\n *\n * Returns the validated data on success, or a 400 Response on failure.\n * Replaces all `(await request.json()) as T` casts.\n */\nexport async function parseBody<T extends z.ZodType>(\n\trequest: Request,\n\tschema: T,\n): Promise<ParseResult<z.infer<T>>> {\n\t// Best-effort size check via Content-Length (can be absent with chunked encoding)\n\tconst contentLength = request.headers.get(\"Content-Length\");\n\tif (contentLength && parseInt(contentLength, 10) > MAX_BODY_SIZE) {\n\t\treturn apiError(\"PAYLOAD_TOO_LARGE\", \"Request body too large\", 413);\n\t}\n\n\tlet raw: unknown;\n\ttry {\n\t\traw = await request.json();\n\t} catch {\n\t\treturn apiError(\"INVALID_JSON\", \"Request body must be valid JSON\", 400);\n\t}\n\n\treturn validate(schema, raw);\n}\n\n/**\n * Parse and validate an optional JSON request body.\n *\n * Returns `defaultValue` if the body is empty, or the validated data if present.\n * For endpoints where the body is optional (e.g., preview-url, confirm).\n */\nexport async function parseOptionalBody<T extends z.ZodType>(\n\trequest: Request,\n\tschema: T,\n\tdefaultValue: z.infer<T>,\n): Promise<ParseResult<z.infer<T>>> {\n\t// Best-effort size check via Content-Length (can be absent with chunked encoding)\n\tconst contentLength = request.headers.get(\"Content-Length\");\n\tif (contentLength && parseInt(contentLength, 10) > MAX_BODY_SIZE) {\n\t\treturn apiError(\"PAYLOAD_TOO_LARGE\", \"Request body too large\", 413);\n\t}\n\n\tlet text: string;\n\ttry {\n\t\ttext = await request.text();\n\t} catch {\n\t\treturn defaultValue;\n\t}\n\n\tif (!text.trim()) {\n\t\treturn defaultValue;\n\t}\n\n\tlet raw: unknown;\n\ttry {\n\t\traw = JSON.parse(text);\n\t} catch {\n\t\treturn apiError(\"INVALID_JSON\", \"Request body must be valid JSON\", 400);\n\t}\n\n\treturn validate(schema, raw);\n}\n\n/**\n * Parse and validate URL search params against a Zod schema.\n *\n * Converts searchParams to a plain object before validation.\n * Zod coercion handles string -> number/boolean conversion.\n * Replaces manual `url.searchParams.get()` + `parseInt()` patterns.\n */\nexport function parseQuery<T extends z.ZodType>(url: URL, schema: T): ParseResult<z.infer<T>> {\n\tconst raw: Record<string, string> = {};\n\tfor (const [key, value] of url.searchParams) {\n\t\traw[key] = value;\n\t}\n\treturn validate(schema, raw);\n}\n\n/**\n * Validate raw data against a schema. Returns data or error Response.\n */\nfunction validate<T extends z.ZodType>(schema: T, data: unknown): ParseResult<z.infer<T>> {\n\tconst result = schema.safeParse(data);\n\n\tif (result.success) {\n\t\treturn result.data as z.infer<T>;\n\t}\n\n\t// Format Zod errors into a readable structure\n\tconst issues = result.error.issues.map((issue: z.ZodIssue) => ({\n\t\tpath: issue.path.join(\".\"),\n\t\tmessage: issue.message,\n\t}));\n\n\treturn Response.json(\n\t\t{\n\t\t\terror: {\n\t\t\t\tcode: \"VALIDATION_ERROR\",\n\t\t\t\tmessage: \"Invalid request data\",\n\t\t\t\tdetails: { issues },\n\t\t\t},\n\t\t},\n\t\t{\n\t\t\tstatus: 400,\n\t\t\theaders: {\n\t\t\t\t\"Cache-Control\": \"private, no-store\",\n\t\t\t},\n\t\t},\n\t);\n}\n\n/**\n * Type guard to check if a ParseResult is an error Response.\n * Usage: `if (isParseError(result)) return result;`\n */\nexport function isParseError<T>(result: ParseResult<T>): result is Response {\n\treturn result instanceof Response;\n}\n"],"mappings":";;;;;AAYA,MAAM,gBAAgB,KAAK,OAAO;;;;;;;AAclC,eAAsB,UACrB,SACA,QACmC;CAEnC,MAAM,gBAAgB,QAAQ,QAAQ,IAAI,iBAAiB;AAC3D,KAAI,iBAAiB,SAAS,eAAe,GAAG,GAAG,cAClD,QAAO,SAAS,qBAAqB,0BAA0B,IAAI;CAGpE,IAAI;AACJ,KAAI;AACH,QAAM,MAAM,QAAQ,MAAM;SACnB;AACP,SAAO,SAAS,gBAAgB,mCAAmC,IAAI;;AAGxE,QAAO,SAAS,QAAQ,IAAI;;;;;;;;AAS7B,eAAsB,kBACrB,SACA,QACA,cACmC;CAEnC,MAAM,gBAAgB,QAAQ,QAAQ,IAAI,iBAAiB;AAC3D,KAAI,iBAAiB,SAAS,eAAe,GAAG,GAAG,cAClD,QAAO,SAAS,qBAAqB,0BAA0B,IAAI;CAGpE,IAAI;AACJ,KAAI;AACH,SAAO,MAAM,QAAQ,MAAM;SACpB;AACP,SAAO;;AAGR,KAAI,CAAC,KAAK,MAAM,CACf,QAAO;CAGR,IAAI;AACJ,KAAI;AACH,QAAM,KAAK,MAAM,KAAK;SACf;AACP,SAAO,SAAS,gBAAgB,mCAAmC,IAAI;;AAGxE,QAAO,SAAS,QAAQ,IAAI;;;;;;;;;AAU7B,SAAgB,WAAgC,KAAU,QAAoC;CAC7F,MAAM,MAA8B,EAAE;AACtC,MAAK,MAAM,CAAC,KAAK,UAAU,IAAI,aAC9B,KAAI,OAAO;AAEZ,QAAO,SAAS,QAAQ,IAAI;;;;;AAM7B,SAAS,SAA8B,QAAW,MAAwC;CACzF,MAAM,SAAS,OAAO,UAAU,KAAK;AAErC,KAAI,OAAO,QACV,QAAO,OAAO;CAIf,MAAM,SAAS,OAAO,MAAM,OAAO,KAAK,WAAuB;EAC9D,MAAM,MAAM,KAAK,KAAK,IAAI;EAC1B,SAAS,MAAM;EACf,EAAE;AAEH,QAAO,SAAS,KACf,EACC,OAAO;EACN,MAAM;EACN,SAAS;EACT,SAAS,EAAE,QAAQ;EACnB,EACD,EACD;EACC,QAAQ;EACR,SAAS,EACR,iBAAiB,qBACjB;EACD,CACD;;;;;;AAOF,SAAgB,aAAgB,QAA4C;AAC3E,QAAO,kBAAkB"}

package/dist/passkey-config-Cg86_ISa.mjs

@@ -0,0 +1,46 @@
+//#region src/auth/passkey-config.ts
+/**
+* Get passkey configuration from request URL
+*
+* @param url The request URL (typically `new URL(Astro.request.url)` or `new URL(request.url)`)
+* @param siteName Optional site name for rpName (defaults to hostname from `url` or public origin)
+* @param siteUrl Optional browser-facing origin (see `EmDashConfig.siteUrl`).
+*        When set, the canonical **origin** and **rpId** are taken from this URL.
+* @param allowedOrigins Optional list of additional accepted origins for verification.
+*        Each must share `rpId` with the canonical origin (WebAuthn requirement).
+*        Typical use: apex + preview subdomain on the same registrable domain.
+* @throws If `siteUrl` is non-empty but not parseable by `new URL()`.
+*/
+function getPasskeyConfig(url, siteName, siteUrl, allowedOrigins) {
+	let rpName;
+	let rpId;
+	let canonicalOrigin;
+	if (siteUrl) {
+		let publicUrl;
+		try {
+			publicUrl = new URL(siteUrl);
+		} catch (e) {
+			throw new Error(`Invalid siteUrl: "${siteUrl}"`, { cause: e });
+		}
+		rpName = siteName || publicUrl.hostname;
+		rpId = publicUrl.hostname;
+		canonicalOrigin = publicUrl.origin;
+	} else {
+		rpName = siteName || url.hostname;
+		rpId = url.hostname;
+		canonicalOrigin = url.origin;
+	}
+	const origins = [canonicalOrigin];
+	if (allowedOrigins) {
+		for (const extra of allowedOrigins) if (extra && !origins.includes(extra)) origins.push(extra);
+	}
+	return {
+		rpName,
+		rpId,
+		origins
+	};
+}
+
+//#endregion
+export { getPasskeyConfig as t };
+//# sourceMappingURL=passkey-config-Cg86_ISa.mjs.map

package/dist/passkey-config-Cg86_ISa.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"passkey-config-Cg86_ISa.mjs","names":[],"sources":["../src/auth/passkey-config.ts"],"sourcesContent":["/**\n * Passkey configuration helper\n *\n * Extracts passkey configuration from the request URL.\n * This ensures the rpId and origin are correctly set for both\n * localhost development and production deployments.\n */\n\nexport interface PasskeyConfig {\n\trpName: string;\n\trpId: string;\n\t/**\n\t * Accepted client-data origins. First entry is the canonical/preferred origin;\n\t * additional entries support multi-origin deployments (e.g. apex + preview\n\t * subdomain sharing the same `rpId`). See `allowedOrigins` parameter.\n\t */\n\torigins: string[];\n}\n\n/**\n * Get passkey configuration from request URL\n *\n * @param url The request URL (typically `new URL(Astro.request.url)` or `new URL(request.url)`)\n * @param siteName Optional site name for rpName (defaults to hostname from `url` or public origin)\n * @param siteUrl Optional browser-facing origin (see `EmDashConfig.siteUrl`).\n *        When set, the canonical **origin** and **rpId** are taken from this URL.\n * @param allowedOrigins Optional list of additional accepted origins for verification.\n *        Each must share `rpId` with the canonical origin (WebAuthn requirement).\n *        Typical use: apex + preview subdomain on the same registrable domain.\n * @throws If `siteUrl` is non-empty but not parseable by `new URL()`.\n */\nexport function getPasskeyConfig(\n\turl: URL,\n\tsiteName?: string,\n\tsiteUrl?: string,\n\tallowedOrigins?: string[],\n): PasskeyConfig {\n\tlet rpName: string;\n\tlet rpId: string;\n\tlet canonicalOrigin: string;\n\n\tif (siteUrl) {\n\t\tlet publicUrl: URL;\n\t\ttry {\n\t\t\tpublicUrl = new URL(siteUrl);\n\t\t} catch (e) {\n\t\t\tthrow new Error(`Invalid siteUrl: \"${siteUrl}\"`, { cause: e });\n\t\t}\n\t\trpName = siteName || publicUrl.hostname;\n\t\trpId = publicUrl.hostname;\n\t\tcanonicalOrigin = publicUrl.origin;\n\t} else {\n\t\trpName = siteName || url.hostname;\n\t\trpId = url.hostname;\n\t\tcanonicalOrigin = url.origin;\n\t}\n\n\tconst origins = [canonicalOrigin];\n\tif (allowedOrigins) {\n\t\tfor (const extra of allowedOrigins) {\n\t\t\tif (extra && !origins.includes(extra)) origins.push(extra);\n\t\t}\n\t}\n\n\treturn { rpName, rpId, origins };\n}\n"],"mappings":";;;;;;;;;;;;;AA+BA,SAAgB,iBACf,KACA,UACA,SACA,gBACgB;CAChB,IAAI;CACJ,IAAI;CACJ,IAAI;AAEJ,KAAI,SAAS;EACZ,IAAI;AACJ,MAAI;AACH,eAAY,IAAI,IAAI,QAAQ;WACpB,GAAG;AACX,SAAM,IAAI,MAAM,qBAAqB,QAAQ,IAAI,EAAE,OAAO,GAAG,CAAC;;AAE/D,WAAS,YAAY,UAAU;AAC/B,SAAO,UAAU;AACjB,oBAAkB,UAAU;QACtB;AACN,WAAS,YAAY,IAAI;AACzB,SAAO,IAAI;AACX,oBAAkB,IAAI;;CAGvB,MAAM,UAAU,CAAC,gBAAgB;AACjC,KAAI,gBACH;OAAK,MAAM,SAAS,eACnB,KAAI,SAAS,CAAC,QAAQ,SAAS,MAAM,CAAE,SAAQ,KAAK,MAAM;;AAI5D,QAAO;EAAE;EAAQ;EAAM;EAAS"}

package/dist/{patterns-DsUZ4uxI.mjs → patterns-CqG5Ya3i.mjs}

@@ -21,6 +21,14 @@ const PARAM_PATTERN = /\[(\w+)\]/g;
 const SPLAT_PATTERN = /\[\.\.\.(\w+)\]/g;
 /** Combined pattern for validation: matches both [param] and [...splat] */
 const ANY_PLACEHOLDER = /\[(?:\.\.\.)?(\w+)\]/g;
+/** Nested brackets check: [foo[ */
+const NESTED_BRACKETS = /\[[^\]]*\[/;
+/** Empty brackets: [] */
+const EMPTY_BRACKETS = /\[\]/;
+/** Count open brackets */
+const OPEN_BRACKET = /\[/g;
+/** Count close brackets */
+const CLOSE_BRACKET = /\]/g;
 /** Split on capture groups in compiled regex string */
 const CAPTURE_GROUP_SPLIT = /(\([^)]+\))/;
 /** Escape regex-special characters in literal parts */
@@ -32,6 +40,50 @@ function isPattern(source) {
 	return source.match(ANY_PLACEHOLDER) !== null;
 }
 /**
+* Validate that a pattern string is well-formed.
+* Returns null if valid, or an error message if invalid.
+*/
+function validatePattern(source) {
+	if (!source.startsWith("/")) return "Pattern must start with /";
+	if (NESTED_BRACKETS.test(source)) return "Nested brackets are not allowed";
+	if (EMPTY_BRACKETS.test(source)) return "Empty brackets are not allowed";
+	if ((source.match(OPEN_BRACKET) ?? []).length !== (source.match(CLOSE_BRACKET) ?? []).length) return "Unmatched brackets";
+	const segments = source.split("/").filter(Boolean);
+	for (let i = 0; i < segments.length; i++) {
+		const segment = segments[i];
+		if (SPLAT_PATTERN.test(segment) && i !== segments.length - 1) {
+			SPLAT_PATTERN.lastIndex = 0;
+			return "Catch-all [...param] must be in the last segment";
+		}
+		SPLAT_PATTERN.lastIndex = 0;
+	}
+	for (const segment of segments) {
+		const placeholders = segment.match(ANY_PLACEHOLDER);
+		if (placeholders && placeholders.length > 1) return "Each segment can contain at most one placeholder";
+		if (placeholders && placeholders[0] !== segment) return "A placeholder must be the entire segment, not mixed with literal text";
+	}
+	const names = [];
+	for (const m of source.matchAll(ANY_PLACEHOLDER)) {
+		const name = m[1];
+		if (names.includes(name)) return `Duplicate parameter name: ${name}`;
+		names.push(name);
+	}
+	return null;
+}
+/**
+* Validate that all placeholders in a destination exist in the source.
+* Returns null if valid, or an error message if invalid.
+*/
+function validateDestinationParams(source, destination) {
+	const sourceNames = /* @__PURE__ */ new Set();
+	for (const m of source.matchAll(ANY_PLACEHOLDER)) sourceNames.add(m[1]);
+	for (const m of destination.matchAll(ANY_PLACEHOLDER)) {
+		const name = m[1];
+		if (!sourceNames.has(name)) return `Destination references [${name}] which is not captured in the source pattern`;
+	}
+	return null;
+}
+/**
 * Compile a URL pattern into a regex for matching.
 *
 * - `[param]` matches a single path segment (`[^/]+`)
@@ -89,5 +141,5 @@ function interpolateDestination(destination, params) {
 }
 
 //#endregion
-export { matchPattern as i, interpolateDestination as n, isPattern as r, compilePattern as t };
-//# sourceMappingURL=patterns-DsUZ4uxI.mjs.map
+export { validateDestinationParams as a, matchPattern as i, interpolateDestination as n, validatePattern as o, isPattern as r, compilePattern as t };
+//# sourceMappingURL=patterns-CqG5Ya3i.mjs.map

package/dist/{patterns-DsUZ4uxI.mjs.map → patterns-CqG5Ya3i.mjs.map}

@@ -1 +1 @@
-{"version":3,"file":"patterns-DsUZ4uxI.mjs","names":[],"sources":["../src/redirects/patterns.ts"],"sourcesContent":["/**\n * URL pattern matching for redirects.\n *\n * Uses Astro's route syntax: [param] for named segments, [...rest] for catch-all.\n * Compiles patterns to safe regexes -- no user-supplied regex, no ReDoS risk.\n *\n * @example\n * ```ts\n * const compiled = compilePattern(\"/old-blog/[...path]\");\n * const match = matchPattern(compiled, \"/old-blog/2024/01/post\");\n * // match = { path: \"2024/01/post\" }\n *\n * interpolateDestination(\"/blog/[...path]\", match);\n * // \"/blog/2024/01/post\"\n * ```\n */\n\n/** Matches [paramName] placeholders */\nconst PARAM_PATTERN = /\\[(\\w+)\\]/g;\n\n/** Matches [...splatName] placeholders */\nconst SPLAT_PATTERN = /\\[\\.\\.\\.(\\w+)\\]/g;\n\n/** Combined pattern for validation: matches both [param] and [...splat] */\nconst ANY_PLACEHOLDER = /\\[(?:\\.\\.\\.)?(\\w+)\\]/g;\n\n/** Nested brackets check: [foo[ */\nconst NESTED_BRACKETS = /\\[[^\\]]*\\[/;\n\n/** Empty brackets: [] */\nconst EMPTY_BRACKETS = /\\[\\]/;\n\n/** Count open brackets */\nconst OPEN_BRACKET = /\\[/g;\n\n/** Count close brackets */\nconst CLOSE_BRACKET = /\\]/g;\n\n/** Split on capture groups in compiled regex string */\nconst CAPTURE_GROUP_SPLIT = /(\\([^)]+\\))/;\n\n/** Escape regex-special characters in literal parts */\nconst REGEX_SPECIAL_CHARS = /[.*+?^${}|\\\\]/g;\n\nexport interface CompiledPattern {\n\tregex: RegExp;\n\tparamNames: string[];\n\tsource: string;\n}\n\n/**\n * Returns true if a source string contains [param] or [...splat] placeholders.\n */\nexport function isPattern(source: string): boolean {\n\t// Use match() instead of test() to avoid lastIndex issues with the global regex\n\treturn source.match(ANY_PLACEHOLDER) !== null;\n}\n\n/**\n * Validate that a pattern string is well-formed.\n * Returns null if valid, or an error message if invalid.\n */\nexport function validatePattern(source: string): string | null {\n\tif (!source.startsWith(\"/\")) {\n\t\treturn \"Pattern must start with /\";\n\t}\n\n\t// Check for nested brackets\n\tif (NESTED_BRACKETS.test(source)) {\n\t\treturn \"Nested brackets are not allowed\";\n\t}\n\n\t// Check for empty brackets\n\tif (EMPTY_BRACKETS.test(source)) {\n\t\treturn \"Empty brackets are not allowed\";\n\t}\n\n\t// Check for unmatched brackets\n\tconst openCount = (source.match(OPEN_BRACKET) ?? []).length;\n\tconst closeCount = (source.match(CLOSE_BRACKET) ?? []).length;\n\tif (openCount !== closeCount) {\n\t\treturn \"Unmatched brackets\";\n\t}\n\n\t// Check that [...splat] is only in the last segment\n\tconst segments = source.split(\"/\").filter(Boolean);\n\tfor (let i = 0; i < segments.length; i++) {\n\t\tconst segment = segments[i];\n\t\tif (SPLAT_PATTERN.test(segment) && i !== segments.length - 1) {\n\t\t\tSPLAT_PATTERN.lastIndex = 0;\n\t\t\treturn \"Catch-all [...param] must be in the last segment\";\n\t\t}\n\t\tSPLAT_PATTERN.lastIndex = 0;\n\t}\n\n\t// Check that a segment is either all literal or a single placeholder\n\tfor (const segment of segments) {\n\t\tconst placeholders = segment.match(ANY_PLACEHOLDER);\n\t\tif (placeholders && placeholders.length > 1) {\n\t\t\treturn \"Each segment can contain at most one placeholder\";\n\t\t}\n\t\tif (placeholders && placeholders[0] !== segment) {\n\t\t\treturn \"A placeholder must be the entire segment, not mixed with literal text\";\n\t\t}\n\t}\n\n\t// Check for duplicate param names\n\tconst names: string[] = [];\n\tfor (const m of source.matchAll(ANY_PLACEHOLDER)) {\n\t\tconst name = m[1];\n\t\tif (names.includes(name)) {\n\t\t\treturn `Duplicate parameter name: ${name}`;\n\t\t}\n\t\tnames.push(name);\n\t}\n\n\treturn null;\n}\n\n/**\n * Validate that all placeholders in a destination exist in the source.\n * Returns null if valid, or an error message if invalid.\n */\nexport function validateDestinationParams(source: string, destination: string): string | null {\n\tconst sourceNames = new Set<string>();\n\tfor (const m of source.matchAll(ANY_PLACEHOLDER)) {\n\t\tsourceNames.add(m[1]);\n\t}\n\n\tfor (const m of destination.matchAll(ANY_PLACEHOLDER)) {\n\t\tconst name = m[1];\n\t\tif (!sourceNames.has(name)) {\n\t\t\treturn `Destination references [${name}] which is not captured in the source pattern`;\n\t\t}\n\t}\n\n\treturn null;\n}\n\n/**\n * Compile a URL pattern into a regex for matching.\n *\n * - `[param]` matches a single path segment (`[^/]+`)\n * - `[...rest]` matches one or more remaining segments (`.+`)\n */\nexport function compilePattern(source: string): CompiledPattern {\n\tconst paramNames: string[] = [];\n\n\t// Replace [...splat] first (before [param]) since [...x] contains [x]\n\tlet regexStr = source.replace(SPLAT_PATTERN, (_match, name: string) => {\n\t\tparamNames.push(name);\n\t\treturn \"(.+)\";\n\t});\n\n\t// Then replace [param]\n\tregexStr = regexStr.replace(PARAM_PATTERN, (_match, name: string) => {\n\t\tparamNames.push(name);\n\t\treturn \"([^/]+)\";\n\t});\n\n\t// Escape any regex-special characters in the literal parts\n\t// We need to be careful: the replacement groups are already valid regex\n\t// Split on capture groups, escape literals, rejoin\n\tconst parts = regexStr.split(CAPTURE_GROUP_SPLIT);\n\tconst escaped = parts\n\t\t.map((part, i) => {\n\t\t\t// Odd indices are the capture groups -- leave them alone\n\t\t\tif (i % 2 === 1) return part;\n\t\t\t// Even indices are literal text -- escape special regex chars\n\t\t\treturn part.replace(REGEX_SPECIAL_CHARS, \"\\\\$&\");\n\t\t})\n\t\t.join(\"\");\n\n\treturn {\n\t\tregex: new RegExp(`^${escaped}$`),\n\t\tparamNames,\n\t\tsource,\n\t};\n}\n\n/**\n * Match a path against a compiled pattern.\n * Returns captured params or null if no match.\n */\nexport function matchPattern(\n\tcompiled: CompiledPattern,\n\tpath: string,\n): Record<string, string> | null {\n\tconst match = path.match(compiled.regex);\n\tif (!match) return null;\n\n\tconst params: Record<string, string> = {};\n\tfor (let i = 0; i < compiled.paramNames.length; i++) {\n\t\tconst value = match[i + 1];\n\t\tif (value !== undefined) {\n\t\t\tparams[compiled.paramNames[i]] = value;\n\t\t}\n\t}\n\treturn params;\n}\n\n/**\n * Interpolate captured params into a destination pattern.\n *\n * @example\n * interpolateDestination(\"/blog/[...path]\", { path: \"2024/01/post\" })\n * // \"/blog/2024/01/post\"\n */\nexport function interpolateDestination(\n\tdestination: string,\n\tparams: Record<string, string>,\n): string {\n\t// Replace [...splat] first\n\tlet result = destination.replace(SPLAT_PATTERN, (_match, name: string) => {\n\t\treturn params[name] ?? \"\";\n\t});\n\n\t// Then [param]\n\tresult = result.replace(PARAM_PATTERN, (_match, name: string) => {\n\t\treturn params[name] ?? \"\";\n\t});\n\n\treturn result;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AAkBA,MAAM,gBAAgB;;AAGtB,MAAM,gBAAgB;;AAGtB,MAAM,kBAAkB;;AAexB,MAAM,sBAAsB;;AAG5B,MAAM,sBAAsB;;;;AAW5B,SAAgB,UAAU,QAAyB;AAElD,QAAO,OAAO,MAAM,gBAAgB,KAAK;;;;;;;;AA0F1C,SAAgB,eAAe,QAAiC;CAC/D,MAAM,aAAuB,EAAE;CAG/B,IAAI,WAAW,OAAO,QAAQ,gBAAgB,QAAQ,SAAiB;AACtE,aAAW,KAAK,KAAK;AACrB,SAAO;GACN;AAGF,YAAW,SAAS,QAAQ,gBAAgB,QAAQ,SAAiB;AACpE,aAAW,KAAK,KAAK;AACrB,SAAO;GACN;CAMF,MAAM,UADQ,SAAS,MAAM,oBAAoB,CAE/C,KAAK,MAAM,MAAM;AAEjB,MAAI,IAAI,MAAM,EAAG,QAAO;AAExB,SAAO,KAAK,QAAQ,qBAAqB,OAAO;GAC/C,CACD,KAAK,GAAG;AAEV,QAAO;EACN,OAAO,IAAI,OAAO,IAAI,QAAQ,GAAG;EACjC;EACA;EACA;;;;;;AAOF,SAAgB,aACf,UACA,MACgC;CAChC,MAAM,QAAQ,KAAK,MAAM,SAAS,MAAM;AACxC,KAAI,CAAC,MAAO,QAAO;CAEnB,MAAM,SAAiC,EAAE;AACzC,MAAK,IAAI,IAAI,GAAG,IAAI,SAAS,WAAW,QAAQ,KAAK;EACpD,MAAM,QAAQ,MAAM,IAAI;AACxB,MAAI,UAAU,OACb,QAAO,SAAS,WAAW,MAAM;;AAGnC,QAAO;;;;;;;;;AAUR,SAAgB,uBACf,aACA,QACS;CAET,IAAI,SAAS,YAAY,QAAQ,gBAAgB,QAAQ,SAAiB;AACzE,SAAO,OAAO,SAAS;GACtB;AAGF,UAAS,OAAO,QAAQ,gBAAgB,QAAQ,SAAiB;AAChE,SAAO,OAAO,SAAS;GACtB;AAEF,QAAO"}
+{"version":3,"file":"patterns-CqG5Ya3i.mjs","names":[],"sources":["../src/redirects/patterns.ts"],"sourcesContent":["/**\n * URL pattern matching for redirects.\n *\n * Uses Astro's route syntax: [param] for named segments, [...rest] for catch-all.\n * Compiles patterns to safe regexes -- no user-supplied regex, no ReDoS risk.\n *\n * @example\n * ```ts\n * const compiled = compilePattern(\"/old-blog/[...path]\");\n * const match = matchPattern(compiled, \"/old-blog/2024/01/post\");\n * // match = { path: \"2024/01/post\" }\n *\n * interpolateDestination(\"/blog/[...path]\", match);\n * // \"/blog/2024/01/post\"\n * ```\n */\n\n/** Matches [paramName] placeholders */\nconst PARAM_PATTERN = /\\[(\\w+)\\]/g;\n\n/** Matches [...splatName] placeholders */\nconst SPLAT_PATTERN = /\\[\\.\\.\\.(\\w+)\\]/g;\n\n/** Combined pattern for validation: matches both [param] and [...splat] */\nconst ANY_PLACEHOLDER = /\\[(?:\\.\\.\\.)?(\\w+)\\]/g;\n\n/** Nested brackets check: [foo[ */\nconst NESTED_BRACKETS = /\\[[^\\]]*\\[/;\n\n/** Empty brackets: [] */\nconst EMPTY_BRACKETS = /\\[\\]/;\n\n/** Count open brackets */\nconst OPEN_BRACKET = /\\[/g;\n\n/** Count close brackets */\nconst CLOSE_BRACKET = /\\]/g;\n\n/** Split on capture groups in compiled regex string */\nconst CAPTURE_GROUP_SPLIT = /(\\([^)]+\\))/;\n\n/** Escape regex-special characters in literal parts */\nconst REGEX_SPECIAL_CHARS = /[.*+?^${}|\\\\]/g;\n\nexport interface CompiledPattern {\n\tregex: RegExp;\n\tparamNames: string[];\n\tsource: string;\n}\n\n/**\n * Returns true if a source string contains [param] or [...splat] placeholders.\n */\nexport function isPattern(source: string): boolean {\n\t// Use match() instead of test() to avoid lastIndex issues with the global regex\n\treturn source.match(ANY_PLACEHOLDER) !== null;\n}\n\n/**\n * Validate that a pattern string is well-formed.\n * Returns null if valid, or an error message if invalid.\n */\nexport function validatePattern(source: string): string | null {\n\tif (!source.startsWith(\"/\")) {\n\t\treturn \"Pattern must start with /\";\n\t}\n\n\t// Check for nested brackets\n\tif (NESTED_BRACKETS.test(source)) {\n\t\treturn \"Nested brackets are not allowed\";\n\t}\n\n\t// Check for empty brackets\n\tif (EMPTY_BRACKETS.test(source)) {\n\t\treturn \"Empty brackets are not allowed\";\n\t}\n\n\t// Check for unmatched brackets\n\tconst openCount = (source.match(OPEN_BRACKET) ?? []).length;\n\tconst closeCount = (source.match(CLOSE_BRACKET) ?? []).length;\n\tif (openCount !== closeCount) {\n\t\treturn \"Unmatched brackets\";\n\t}\n\n\t// Check that [...splat] is only in the last segment\n\tconst segments = source.split(\"/\").filter(Boolean);\n\tfor (let i = 0; i < segments.length; i++) {\n\t\tconst segment = segments[i];\n\t\tif (SPLAT_PATTERN.test(segment) && i !== segments.length - 1) {\n\t\t\tSPLAT_PATTERN.lastIndex = 0;\n\t\t\treturn \"Catch-all [...param] must be in the last segment\";\n\t\t}\n\t\tSPLAT_PATTERN.lastIndex = 0;\n\t}\n\n\t// Check that a segment is either all literal or a single placeholder\n\tfor (const segment of segments) {\n\t\tconst placeholders = segment.match(ANY_PLACEHOLDER);\n\t\tif (placeholders && placeholders.length > 1) {\n\t\t\treturn \"Each segment can contain at most one placeholder\";\n\t\t}\n\t\tif (placeholders && placeholders[0] !== segment) {\n\t\t\treturn \"A placeholder must be the entire segment, not mixed with literal text\";\n\t\t}\n\t}\n\n\t// Check for duplicate param names\n\tconst names: string[] = [];\n\tfor (const m of source.matchAll(ANY_PLACEHOLDER)) {\n\t\tconst name = m[1];\n\t\tif (names.includes(name)) {\n\t\t\treturn `Duplicate parameter name: ${name}`;\n\t\t}\n\t\tnames.push(name);\n\t}\n\n\treturn null;\n}\n\n/**\n * Validate that all placeholders in a destination exist in the source.\n * Returns null if valid, or an error message if invalid.\n */\nexport function validateDestinationParams(source: string, destination: string): string | null {\n\tconst sourceNames = new Set<string>();\n\tfor (const m of source.matchAll(ANY_PLACEHOLDER)) {\n\t\tsourceNames.add(m[1]);\n\t}\n\n\tfor (const m of destination.matchAll(ANY_PLACEHOLDER)) {\n\t\tconst name = m[1];\n\t\tif (!sourceNames.has(name)) {\n\t\t\treturn `Destination references [${name}] which is not captured in the source pattern`;\n\t\t}\n\t}\n\n\treturn null;\n}\n\n/**\n * Compile a URL pattern into a regex for matching.\n *\n * - `[param]` matches a single path segment (`[^/]+`)\n * - `[...rest]` matches one or more remaining segments (`.+`)\n */\nexport function compilePattern(source: string): CompiledPattern {\n\tconst paramNames: string[] = [];\n\n\t// Replace [...splat] first (before [param]) since [...x] contains [x]\n\tlet regexStr = source.replace(SPLAT_PATTERN, (_match, name: string) => {\n\t\tparamNames.push(name);\n\t\treturn \"(.+)\";\n\t});\n\n\t// Then replace [param]\n\tregexStr = regexStr.replace(PARAM_PATTERN, (_match, name: string) => {\n\t\tparamNames.push(name);\n\t\treturn \"([^/]+)\";\n\t});\n\n\t// Escape any regex-special characters in the literal parts\n\t// We need to be careful: the replacement groups are already valid regex\n\t// Split on capture groups, escape literals, rejoin\n\tconst parts = regexStr.split(CAPTURE_GROUP_SPLIT);\n\tconst escaped = parts\n\t\t.map((part, i) => {\n\t\t\t// Odd indices are the capture groups -- leave them alone\n\t\t\tif (i % 2 === 1) return part;\n\t\t\t// Even indices are literal text -- escape special regex chars\n\t\t\treturn part.replace(REGEX_SPECIAL_CHARS, \"\\\\$&\");\n\t\t})\n\t\t.join(\"\");\n\n\treturn {\n\t\tregex: new RegExp(`^${escaped}$`),\n\t\tparamNames,\n\t\tsource,\n\t};\n}\n\n/**\n * Match a path against a compiled pattern.\n * Returns captured params or null if no match.\n */\nexport function matchPattern(\n\tcompiled: CompiledPattern,\n\tpath: string,\n): Record<string, string> | null {\n\tconst match = path.match(compiled.regex);\n\tif (!match) return null;\n\n\tconst params: Record<string, string> = {};\n\tfor (let i = 0; i < compiled.paramNames.length; i++) {\n\t\tconst value = match[i + 1];\n\t\tif (value !== undefined) {\n\t\t\tparams[compiled.paramNames[i]] = value;\n\t\t}\n\t}\n\treturn params;\n}\n\n/**\n * Interpolate captured params into a destination pattern.\n *\n * @example\n * interpolateDestination(\"/blog/[...path]\", { path: \"2024/01/post\" })\n * // \"/blog/2024/01/post\"\n */\nexport function interpolateDestination(\n\tdestination: string,\n\tparams: Record<string, string>,\n): string {\n\t// Replace [...splat] first\n\tlet result = destination.replace(SPLAT_PATTERN, (_match, name: string) => {\n\t\treturn params[name] ?? \"\";\n\t});\n\n\t// Then [param]\n\tresult = result.replace(PARAM_PATTERN, (_match, name: string) => {\n\t\treturn params[name] ?? \"\";\n\t});\n\n\treturn result;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AAkBA,MAAM,gBAAgB;;AAGtB,MAAM,gBAAgB;;AAGtB,MAAM,kBAAkB;;AAGxB,MAAM,kBAAkB;;AAGxB,MAAM,iBAAiB;;AAGvB,MAAM,eAAe;;AAGrB,MAAM,gBAAgB;;AAGtB,MAAM,sBAAsB;;AAG5B,MAAM,sBAAsB;;;;AAW5B,SAAgB,UAAU,QAAyB;AAElD,QAAO,OAAO,MAAM,gBAAgB,KAAK;;;;;;AAO1C,SAAgB,gBAAgB,QAA+B;AAC9D,KAAI,CAAC,OAAO,WAAW,IAAI,CAC1B,QAAO;AAIR,KAAI,gBAAgB,KAAK,OAAO,CAC/B,QAAO;AAIR,KAAI,eAAe,KAAK,OAAO,CAC9B,QAAO;AAMR,MAFmB,OAAO,MAAM,aAAa,IAAI,EAAE,EAAE,YACjC,OAAO,MAAM,cAAc,IAAI,EAAE,EAAE,OAEtD,QAAO;CAIR,MAAM,WAAW,OAAO,MAAM,IAAI,CAAC,OAAO,QAAQ;AAClD,MAAK,IAAI,IAAI,GAAG,IAAI,SAAS,QAAQ,KAAK;EACzC,MAAM,UAAU,SAAS;AACzB,MAAI,cAAc,KAAK,QAAQ,IAAI,MAAM,SAAS,SAAS,GAAG;AAC7D,iBAAc,YAAY;AAC1B,UAAO;;AAER,gBAAc,YAAY;;AAI3B,MAAK,MAAM,WAAW,UAAU;EAC/B,MAAM,eAAe,QAAQ,MAAM,gBAAgB;AACnD,MAAI,gBAAgB,aAAa,SAAS,EACzC,QAAO;AAER,MAAI,gBAAgB,aAAa,OAAO,QACvC,QAAO;;CAKT,MAAM,QAAkB,EAAE;AAC1B,MAAK,MAAM,KAAK,OAAO,SAAS,gBAAgB,EAAE;EACjD,MAAM,OAAO,EAAE;AACf,MAAI,MAAM,SAAS,KAAK,CACvB,QAAO,6BAA6B;AAErC,QAAM,KAAK,KAAK;;AAGjB,QAAO;;;;;;AAOR,SAAgB,0BAA0B,QAAgB,aAAoC;CAC7F,MAAM,8BAAc,IAAI,KAAa;AACrC,MAAK,MAAM,KAAK,OAAO,SAAS,gBAAgB,CAC/C,aAAY,IAAI,EAAE,GAAG;AAGtB,MAAK,MAAM,KAAK,YAAY,SAAS,gBAAgB,EAAE;EACtD,MAAM,OAAO,EAAE;AACf,MAAI,CAAC,YAAY,IAAI,KAAK,CACzB,QAAO,2BAA2B,KAAK;;AAIzC,QAAO;;;;;;;;AASR,SAAgB,eAAe,QAAiC;CAC/D,MAAM,aAAuB,EAAE;CAG/B,IAAI,WAAW,OAAO,QAAQ,gBAAgB,QAAQ,SAAiB;AACtE,aAAW,KAAK,KAAK;AACrB,SAAO;GACN;AAGF,YAAW,SAAS,QAAQ,gBAAgB,QAAQ,SAAiB;AACpE,aAAW,KAAK,KAAK;AACrB,SAAO;GACN;CAMF,MAAM,UADQ,SAAS,MAAM,oBAAoB,CAE/C,KAAK,MAAM,MAAM;AAEjB,MAAI,IAAI,MAAM,EAAG,QAAO;AAExB,SAAO,KAAK,QAAQ,qBAAqB,OAAO;GAC/C,CACD,KAAK,GAAG;AAEV,QAAO;EACN,OAAO,IAAI,OAAO,IAAI,QAAQ,GAAG;EACjC;EACA;EACA;;;;;;AAOF,SAAgB,aACf,UACA,MACgC;CAChC,MAAM,QAAQ,KAAK,MAAM,SAAS,MAAM;AACxC,KAAI,CAAC,MAAO,QAAO;CAEnB,MAAM,SAAiC,EAAE;AACzC,MAAK,IAAI,IAAI,GAAG,IAAI,SAAS,WAAW,QAAQ,KAAK;EACpD,MAAM,QAAQ,MAAM,IAAI;AACxB,MAAI,UAAU,OACb,QAAO,SAAS,WAAW,MAAM;;AAGnC,QAAO;;;;;;;;;AAUR,SAAgB,uBACf,aACA,QACS;CAET,IAAI,SAAS,YAAY,QAAQ,gBAAgB,QAAQ,SAAiB;AACzE,SAAO,OAAO,SAAS;GACtB;AAGF,UAAS,OAAO,QAAQ,gBAAgB,QAAQ,SAAiB;AAChE,SAAO,OAAO,SAAS;GACtB;AAEF,QAAO"}

package/dist/{placeholder-CDPtkelt.d.mts → placeholder-D3cFCU9y.d.mts}

@@ -250,6 +250,7 @@ declare function mediaItemToValue(providerId: string, item: MediaProviderItem):
  * - `null`/`undefined` → `null`
  * - Bare URL string → `{ provider: "external", id: "", src: url }`
  * - Bare internal media URL → resolved via local provider's `get()`
+ * - Bare local media ID → resolved via local provider's `get()`
  * - Object with `provider` + `id` → enriched with missing fields from provider
  */
 declare function normalizeMediaValue(value: unknown, getProvider: (id: string) => MediaProvider | undefined): Promise<MediaValue | null>;
@@ -281,4 +282,4 @@ declare function generatePlaceholder(buffer: Uint8Array, mimeType: string, dimen
 }): Promise<PlaceholderData | null>;
 //#endregion
 export { MediaValue as _, ComponentEmbed as a, mediaItemToValue as b, EmbedResult as c, MediaListResult as d, MediaProvider as f, MediaUploadInput as g, MediaProviderItem as h, AudioEmbed as i, ImageEmbed as l, MediaProviderDescriptor as m, generatePlaceholder as n, CreateMediaProviderFn as o, MediaProviderCapabilities as p, normalizeMediaValue as r, EmbedOptions as s, PlaceholderData as t, MediaListOptions as u, ThumbnailOptions as v, VideoEmbed as y };
-//# sourceMappingURL=placeholder-CDPtkelt.d.mts.map
+//# sourceMappingURL=placeholder-D3cFCU9y.d.mts.map

package/dist/{placeholder-CDPtkelt.d.mts.map → placeholder-D3cFCU9y.d.mts.map}

@@ -1 +1 @@
-{"version":3,"file":"placeholder-CDPtkelt.d.mts","names":[],"sources":["../src/media/types.ts","../src/media/normalize.ts","../src/media/placeholder.ts"],"mappings":";;AAYA;;;;;;;;;;UAAiB,uBAAA,WAAkC,MAAA;EAKlD;EAHA,EAAA;EASA;EANA,IAAA;EAYA;EATA,IAAA;EAYA;EATA,UAAA;EASe;EANf,WAAA;EAYgB;EAThB,YAAA,EAAc,yBAAA;;EAGd,MAAA,EAAQ,OAAA;AAAA;;;;UAMQ,yBAAA;EAQV;EANN,MAAA;EAYgC;EAVhC,MAAA;EAUgC;EARhC,MAAA;EAYA;EAVA,MAAA;AAAA;;;AAoBD;UAdiB,gBAAA;;EAEhB,MAAA;EAaA;EAXA,KAAA;EAYA;EAVA,KAAA;EAUU;EARV,QAAA;AAAA;;;;UAMgB,eAAA;EAChB,KAAA,EAAO,iBAAA;EACP,UAAA;AAAA;;;;;UAOgB,iBAAA;EAiBH;EAfb,EAAA;EAqBgB;EAnBhB,QAAA;;EAEA,QAAA;EAkBA;EAhBA,IAAA;EAiBA;EAfA,KAAA;EACA,MAAA;EAeG;EAbH,GAAA;EAmB4B;EAjB5B,UAAA;EAiB4B;EAf5B,IAAA,GAAO,MAAA;AAAA;;;;UAMS,gBAAA;EAChB,IAAA,EAAM,IAAA;EACN,QAAA;EACA,GAAA;AAAA;;;;UAMgB,YAAA;EAYS;EAVzB,KAAA;EAUmD;EARnD,MAAA;EAQ8E;EAN9E,MAAA;AAAA;;;;KAMW,WAAA,GAAc,UAAA,GAAa,UAAA,GAAa,UAAA,GAAa,cAAA;AAAA,UAEhD,UAAA;EAChB,IAAA;EACA,GAAA;EACA,MAAA;EACA,KAAA;EACA,KAAA;EACA,MAAA;EACA,GAAA;EAIkB;EAFlB,UAAA;EAEmD;EAAnD,MAAA,IAAU,IAAA;IAAQ,KAAA;IAAgB,MAAA;IAAiB,MAAA;EAAA;AAAA;AAAA,UAGnC,UAAA;EAChB,IAAA;EAEA;EAAA,GAAA;EAEU;EAAV,OAAA,GAAU,KAAA;IAAQ,GAAA;IAAa,IAAA;EAAA;EAI/B;EAFA,MAAA;EACA,KAAA;EACA,MAAA;EAKA;EAHA,QAAA;EACA,QAAA;EACA,KAAA;EACA,IAAA;EACA,WAAA;EACA,OAAA;EACA,WAAA;AAAA;AAAA,UAGgB,UAAA;EAChB,IAAA;EACA,GAAA;EACA,OAAA,GAAU,KAAA;IAAQ,GAAA;IAAa,IAAA;EAAA;EAC/B,QAAA;EACA,QAAA;EACA,KAAA;EACA,IAAA;EACA,OAAA;AAAA;AAAA,UAGgB,cAAA;EAChB,IAAA;EAD8B;EAG9B,OAAA;EAIa;EAFb,MAAA;EAFA;EAIA,KAAA,EAAO,MAAA;AAAA;;;;UAMS,gBAAA;EAAgB;EAEhC,KAAA;EAAA;EAEA,MAAA;AAAA;;;;;UAOgB,aAAA;EASU;;;EAL1B,IAAA,CAAK,OAAA,EAAS,gBAAA,GAAmB,OAAA,CAAQ,eAAA;EAUP;;;EALlC,GAAA,EAAK,EAAA,WAAa,OAAA,CAAQ,iBAAA;EAgBmC;;;EAX7D,MAAA,EAAQ,KAAA,EAAO,gBAAA,GAAmB,OAAA,CAAQ,iBAAA;EAkBgC;;;EAb1E,MAAA,EAAQ,EAAA,WAAa,OAAA;EAfhB;;;;EAqBL,QAAA,CAAS,KAAA,EAAO,UAAA,EAAY,OAAA,GAAU,YAAA,GAAe,OAAA,CAAQ,WAAA,IAAe,WAAA;EAhB1D;;;;;EAuBlB,eAAA,EAAiB,EAAA,UAAY,QAAA,WAAmB,OAAA,GAAU,gBAAA;AAAA;;;;KAM/C,qBAAA,WAAgC,MAAA,sBAC3C,MAAA,EAAQ,OAAA,KACJ,aAAA;;;;;;;;;UAUY,UAAA;EAlBa;EAoB7B,QAAA;EApBgD;EAuBhD,EAAA;EAvB0E;EA0B1E,GAAA;EApBgC;EAuBhC,UAAA;EAvB2C;EA0B3C,QAAA;EACA,QAAA;EACA,KAAA;EACA,MAAA;EACA,GAAA;EA9B2C;EAiC3C,IAAA,GAAO,MAAA;AAAA;;;;iBAMQ,gBAAA,CAAiB,UAAA,UAAoB,IAAA,EAAM,iBAAA,GAAoB,UAAA;;;;;;;;;;;iBCnPzD,mBAAA,CACrB,KAAA,WACA,WAAA,GAAc,EAAA,aAAe,aAAA,eAC3B,OAAA,CAAQ,UAAA;;;;ADfX;;;;;;UEDiB,eAAA;EAChB,QAAA;EACA,aAAA;AAAA;;;;;;;;;;iBAgGqB,mBAAA,CACrB,MAAA,EAAQ,UAAA,EACR,QAAA,UACA,UAAA;EAAe,KAAA;EAAe,MAAA;AAAA,IAC5B,OAAA,CAAQ,eAAA"}
+{"version":3,"file":"placeholder-D3cFCU9y.d.mts","names":[],"sources":["../src/media/types.ts","../src/media/normalize.ts","../src/media/placeholder.ts"],"mappings":";;AAYA;;;;;;;;;;UAAiB,uBAAA,WAAkC,MAAA;EAKlD;EAHA,EAAA;EASA;EANA,IAAA;EAYA;EATA,IAAA;EAYA;EATA,UAAA;EASe;EANf,WAAA;EAYgB;EAThB,YAAA,EAAc,yBAAA;;EAGd,MAAA,EAAQ,OAAA;AAAA;;;;UAMQ,yBAAA;EAQV;EANN,MAAA;EAYgC;EAVhC,MAAA;EAUgC;EARhC,MAAA;EAYA;EAVA,MAAA;AAAA;;;AAoBD;UAdiB,gBAAA;;EAEhB,MAAA;EAaA;EAXA,KAAA;EAYA;EAVA,KAAA;EAUU;EARV,QAAA;AAAA;;;;UAMgB,eAAA;EAChB,KAAA,EAAO,iBAAA;EACP,UAAA;AAAA;;;;;UAOgB,iBAAA;EAiBH;EAfb,EAAA;EAqBgB;EAnBhB,QAAA;;EAEA,QAAA;EAkBA;EAhBA,IAAA;EAiBA;EAfA,KAAA;EACA,MAAA;EAeG;EAbH,GAAA;EAmB4B;EAjB5B,UAAA;EAiB4B;EAf5B,IAAA,GAAO,MAAA;AAAA;;;;UAMS,gBAAA;EAChB,IAAA,EAAM,IAAA;EACN,QAAA;EACA,GAAA;AAAA;;;;UAMgB,YAAA;EAYS;EAVzB,KAAA;EAUmD;EARnD,MAAA;EAQ8E;EAN9E,MAAA;AAAA;;;;KAMW,WAAA,GAAc,UAAA,GAAa,UAAA,GAAa,UAAA,GAAa,cAAA;AAAA,UAEhD,UAAA;EAChB,IAAA;EACA,GAAA;EACA,MAAA;EACA,KAAA;EACA,KAAA;EACA,MAAA;EACA,GAAA;EAIkB;EAFlB,UAAA;EAEmD;EAAnD,MAAA,IAAU,IAAA;IAAQ,KAAA;IAAgB,MAAA;IAAiB,MAAA;EAAA;AAAA;AAAA,UAGnC,UAAA;EAChB,IAAA;EAEA;EAAA,GAAA;EAEU;EAAV,OAAA,GAAU,KAAA;IAAQ,GAAA;IAAa,IAAA;EAAA;EAI/B;EAFA,MAAA;EACA,KAAA;EACA,MAAA;EAKA;EAHA,QAAA;EACA,QAAA;EACA,KAAA;EACA,IAAA;EACA,WAAA;EACA,OAAA;EACA,WAAA;AAAA;AAAA,UAGgB,UAAA;EAChB,IAAA;EACA,GAAA;EACA,OAAA,GAAU,KAAA;IAAQ,GAAA;IAAa,IAAA;EAAA;EAC/B,QAAA;EACA,QAAA;EACA,KAAA;EACA,IAAA;EACA,OAAA;AAAA;AAAA,UAGgB,cAAA;EAChB,IAAA;EAD8B;EAG9B,OAAA;EAIa;EAFb,MAAA;EAFA;EAIA,KAAA,EAAO,MAAA;AAAA;;;;UAMS,gBAAA;EAAgB;EAEhC,KAAA;EAAA;EAEA,MAAA;AAAA;;;;;UAOgB,aAAA;EASU;;;EAL1B,IAAA,CAAK,OAAA,EAAS,gBAAA,GAAmB,OAAA,CAAQ,eAAA;EAUP;;;EALlC,GAAA,EAAK,EAAA,WAAa,OAAA,CAAQ,iBAAA;EAgBmC;;;EAX7D,MAAA,EAAQ,KAAA,EAAO,gBAAA,GAAmB,OAAA,CAAQ,iBAAA;EAkBgC;;;EAb1E,MAAA,EAAQ,EAAA,WAAa,OAAA;EAfhB;;;;EAqBL,QAAA,CAAS,KAAA,EAAO,UAAA,EAAY,OAAA,GAAU,YAAA,GAAe,OAAA,CAAQ,WAAA,IAAe,WAAA;EAhB1D;;;;;EAuBlB,eAAA,EAAiB,EAAA,UAAY,QAAA,WAAmB,OAAA,GAAU,gBAAA;AAAA;;;;KAM/C,qBAAA,WAAgC,MAAA,sBAC3C,MAAA,EAAQ,OAAA,KACJ,aAAA;;;;;;;;;UAUY,UAAA;EAlBa;EAoB7B,QAAA;EApBgD;EAuBhD,EAAA;EAvB0E;EA0B1E,GAAA;EApBgC;EAuBhC,UAAA;EAvB2C;EA0B3C,QAAA;EACA,QAAA;EACA,KAAA;EACA,MAAA;EACA,GAAA;EA9B2C;EAiC3C,IAAA,GAAO,MAAA;AAAA;;;;iBAMQ,gBAAA,CAAiB,UAAA,UAAoB,IAAA,EAAM,iBAAA,GAAoB,UAAA;;;;;;;;;;;;iBClPzD,mBAAA,CACrB,KAAA,WACA,WAAA,GAAc,EAAA,aAAe,aAAA,eAC3B,OAAA,CAAQ,UAAA;;;;ADhBX;;;;;;UEDiB,eAAA;EAChB,QAAA;EACA,aAAA;AAAA;;;;;;;;;;iBAgGqB,mBAAA,CACrB,MAAA,EAAQ,UAAA,EACR,QAAA,UACA,UAAA;EAAe,KAAA;EAAe,MAAA;AAAA,IAC5B,OAAA,CAAQ,eAAA"}

package/dist/placeholder-LqmHqvBw.mjs

@@ -0,0 +1,143 @@
+import { encode } from "blurhash";
+import { imageSize } from "image-size";
+
+//#region src/media/placeholder.ts
+/**
+* Image Placeholder Generation
+*
+* Generates blurhash and dominant color from image buffers for LQIP support.
+* Decodes images via jpeg-js (pure JS) and upng-js (pure JS, uses pako for
+* deflate). No Node-specific dependencies — works in Workers and Node SSR.
+*/
+const SUPPORTED_TYPES = {
+	"image/jpeg": "jpeg",
+	"image/jpg": "jpeg",
+	"image/png": "png"
+};
+/** Max width for blurhash input. Encode is O(w*h*components), so downsample first. */
+const MAX_ENCODE_WIDTH = 32;
+/** Max decoded RGBA size (32 MB). Images exceeding this skip placeholder generation. */
+const MAX_DECODED_BYTES = 32 * 1024 * 1024;
+/**
+* Decode a JPEG buffer into raw RGBA pixel data.
+*/
+async function decodeJpeg(buffer) {
+	const { decode } = await import("jpeg-js");
+	const result = decode(buffer, { useTArray: true });
+	return {
+		width: result.width,
+		height: result.height,
+		data: result.data
+	};
+}
+/**
+* Decode a PNG buffer into raw RGBA pixel data.
+* Uses upng-js (pure JS with pako deflate) — no Node zlib dependency.
+*/
+async function decodePng(buffer) {
+	const UPNG = (await import("upng-js")).default;
+	const img = UPNG.decode(buffer.buffer);
+	const frames = UPNG.toRGBA8(img);
+	const rgba = new Uint8Array(frames[0]);
+	return {
+		width: img.width,
+		height: img.height,
+		data: rgba
+	};
+}
+/**
+* Extract the dominant color from RGBA pixel data.
+* Simple average of all non-transparent pixels.
+*/
+function extractDominantColor(data, width, height) {
+	let r = 0;
+	let g = 0;
+	let b = 0;
+	let count = 0;
+	const len = width * height * 4;
+	for (let i = 0; i < len; i += 4) {
+		if (data[i + 3] < 128) continue;
+		r += data[i];
+		g += data[i + 1];
+		b += data[i + 2];
+		count++;
+	}
+	if (count === 0) return "rgb(0,0,0)";
+	return `rgb(${Math.round(r / count)},${Math.round(g / count)},${Math.round(b / count)})`;
+}
+/**
+* Read image dimensions from headers without decoding pixel data.
+*/
+function getImageDimensions(buffer) {
+	try {
+		const result = imageSize(buffer);
+		if (result.width != null && result.height != null) return {
+			width: result.width,
+			height: result.height
+		};
+		return null;
+	} catch {
+		return null;
+	}
+}
+/**
+* Generate blurhash and dominant color from an image buffer.
+* Returns null for non-image MIME types or on failure.
+*
+* @param dimensions - Optional pre-known dimensions. Used as a fallback when
+*   image-size cannot parse the buffer (e.g. truncated headers). When the
+*   decoded size (width * height * 4) exceeds MAX_DECODED_BYTES, placeholder
+*   generation is skipped to avoid OOM on memory-constrained runtimes.
+*/
+async function generatePlaceholder(buffer, mimeType, dimensions) {
+	const format = SUPPORTED_TYPES[mimeType];
+	if (!format) return null;
+	try {
+		const dims = getImageDimensions(buffer) ?? dimensions;
+		if (dims && dims.width * dims.height * 4 > MAX_DECODED_BYTES) return null;
+		const { width, height, data } = format === "jpeg" ? await decodeJpeg(buffer) : await decodePng(buffer);
+		if (width === 0 || height === 0) return null;
+		let encodePixels;
+		let encodeWidth;
+		let encodeHeight;
+		if (width > MAX_ENCODE_WIDTH) {
+			const scale = MAX_ENCODE_WIDTH / width;
+			encodeWidth = MAX_ENCODE_WIDTH;
+			encodeHeight = Math.max(1, Math.round(height * scale));
+			encodePixels = downsample(data, width, height, encodeWidth, encodeHeight);
+		} else {
+			encodeWidth = width;
+			encodeHeight = height;
+			encodePixels = new Uint8ClampedArray(data.buffer, data.byteOffset, data.byteLength);
+		}
+		return {
+			blurhash: encode(encodePixels, encodeWidth, encodeHeight, 4, 3),
+			dominantColor: extractDominantColor(data, width, height)
+		};
+	} catch {
+		return null;
+	}
+}
+/**
+* Nearest-neighbor downsample of RGBA pixel data.
+*/
+function downsample(src, srcW, srcH, dstW, dstH) {
+	const dst = new Uint8ClampedArray(dstW * dstH * 4);
+	for (let y = 0; y < dstH; y++) {
+		const srcY = Math.floor(y * srcH / dstH);
+		for (let x = 0; x < dstW; x++) {
+			const srcX = Math.floor(x * srcW / dstW);
+			const srcIdx = (srcY * srcW + srcX) * 4;
+			const dstIdx = (y * dstW + x) * 4;
+			dst[dstIdx] = src[srcIdx];
+			dst[dstIdx + 1] = src[srcIdx + 1];
+			dst[dstIdx + 2] = src[srcIdx + 2];
+			dst[dstIdx + 3] = src[srcIdx + 3];
+		}
+	}
+	return dst;
+}
+
+//#endregion
+export { generatePlaceholder as t };
+//# sourceMappingURL=placeholder-LqmHqvBw.mjs.map

package/dist/placeholder-LqmHqvBw.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"placeholder-LqmHqvBw.mjs","names":[],"sources":["../src/media/placeholder.ts"],"sourcesContent":["/**\n * Image Placeholder Generation\n *\n * Generates blurhash and dominant color from image buffers for LQIP support.\n * Decodes images via jpeg-js (pure JS) and upng-js (pure JS, uses pako for\n * deflate). No Node-specific dependencies — works in Workers and Node SSR.\n */\n\nimport { encode } from \"blurhash\";\nimport { imageSize } from \"image-size\";\n\nexport interface PlaceholderData {\n\tblurhash: string;\n\tdominantColor: string;\n}\n\nconst SUPPORTED_TYPES: Record<string, \"jpeg\" | \"png\"> = {\n\t\"image/jpeg\": \"jpeg\",\n\t\"image/jpg\": \"jpeg\",\n\t\"image/png\": \"png\",\n};\n\n/** Max width for blurhash input. Encode is O(w*h*components), so downsample first. */\nconst MAX_ENCODE_WIDTH = 32;\n\n/** Max decoded RGBA size (32 MB). Images exceeding this skip placeholder generation. */\nconst MAX_DECODED_BYTES = 32 * 1024 * 1024;\n\ninterface DecodedImage {\n\twidth: number;\n\theight: number;\n\tdata: Uint8Array;\n}\n\n/**\n * Decode a JPEG buffer into raw RGBA pixel data.\n */\nasync function decodeJpeg(buffer: Uint8Array): Promise<DecodedImage> {\n\tconst { decode } = await import(\"jpeg-js\");\n\tconst result = decode(buffer, { useTArray: true });\n\treturn { width: result.width, height: result.height, data: result.data };\n}\n\n/**\n * Decode a PNG buffer into raw RGBA pixel data.\n * Uses upng-js (pure JS with pako deflate) — no Node zlib dependency.\n */\nasync function decodePng(buffer: Uint8Array): Promise<DecodedImage> {\n\t// @ts-expect-error -- upng-js has no type declarations\n\tconst UPNG = (await import(\"upng-js\")).default;\n\tconst img = UPNG.decode(buffer.buffer);\n\t// toRGBA8 returns an array of frames; take the first frame\n\tconst frames: ArrayBuffer[] = UPNG.toRGBA8(img);\n\tconst rgba = new Uint8Array(frames[0]);\n\treturn { width: img.width, height: img.height, data: rgba };\n}\n\n/**\n * Extract the dominant color from RGBA pixel data.\n * Simple average of all non-transparent pixels.\n */\nfunction extractDominantColor(data: Uint8Array, width: number, height: number): string {\n\tlet r = 0;\n\tlet g = 0;\n\tlet b = 0;\n\tlet count = 0;\n\n\tconst len = width * height * 4;\n\tfor (let i = 0; i < len; i += 4) {\n\t\tconst a = data[i + 3];\n\t\tif (a < 128) continue; // skip mostly-transparent pixels\n\t\tr += data[i];\n\t\tg += data[i + 1];\n\t\tb += data[i + 2];\n\t\tcount++;\n\t}\n\n\tif (count === 0) return \"rgb(0,0,0)\";\n\n\tconst avgR = Math.round(r / count);\n\tconst avgG = Math.round(g / count);\n\tconst avgB = Math.round(b / count);\n\treturn `rgb(${avgR},${avgG},${avgB})`;\n}\n\n/**\n * Read image dimensions from headers without decoding pixel data.\n */\nfunction getImageDimensions(buffer: Uint8Array): { width: number; height: number } | null {\n\ttry {\n\t\tconst result = imageSize(buffer);\n\t\tif (result.width != null && result.height != null) {\n\t\t\treturn { width: result.width, height: result.height };\n\t\t}\n\t\treturn null;\n\t} catch {\n\t\treturn null;\n\t}\n}\n\n/**\n * Generate blurhash and dominant color from an image buffer.\n * Returns null for non-image MIME types or on failure.\n *\n * @param dimensions - Optional pre-known dimensions. Used as a fallback when\n *   image-size cannot parse the buffer (e.g. truncated headers). When the\n *   decoded size (width * height * 4) exceeds MAX_DECODED_BYTES, placeholder\n *   generation is skipped to avoid OOM on memory-constrained runtimes.\n */\nexport async function generatePlaceholder(\n\tbuffer: Uint8Array,\n\tmimeType: string,\n\tdimensions?: { width: number; height: number },\n): Promise<PlaceholderData | null> {\n\tconst format = SUPPORTED_TYPES[mimeType];\n\tif (!format) return null;\n\n\ttry {\n\t\t// Safety net: skip decode if the image would exceed the memory budget\n\t\tconst dims = getImageDimensions(buffer) ?? dimensions;\n\t\tif (dims && dims.width * dims.height * 4 > MAX_DECODED_BYTES) {\n\t\t\treturn null;\n\t\t}\n\n\t\tconst imageData = format === \"jpeg\" ? await decodeJpeg(buffer) : await decodePng(buffer);\n\t\tconst { width, height, data } = imageData;\n\n\t\tif (width === 0 || height === 0) return null;\n\n\t\t// Downsample for blurhash encoding if needed\n\t\tlet encodePixels: Uint8ClampedArray;\n\t\tlet encodeWidth: number;\n\t\tlet encodeHeight: number;\n\n\t\tif (width > MAX_ENCODE_WIDTH) {\n\t\t\tconst scale = MAX_ENCODE_WIDTH / width;\n\t\t\tencodeWidth = MAX_ENCODE_WIDTH;\n\t\t\tencodeHeight = Math.max(1, Math.round(height * scale));\n\t\t\tencodePixels = downsample(data, width, height, encodeWidth, encodeHeight);\n\t\t} else {\n\t\t\tencodeWidth = width;\n\t\t\tencodeHeight = height;\n\t\t\tencodePixels = new Uint8ClampedArray(data.buffer, data.byteOffset, data.byteLength);\n\t\t}\n\n\t\tconst blurhash = encode(encodePixels, encodeWidth, encodeHeight, 4, 3);\n\t\tconst dominantColor = extractDominantColor(data, width, height);\n\n\t\treturn { blurhash, dominantColor };\n\t} catch {\n\t\treturn null;\n\t}\n}\n\n/**\n * Nearest-neighbor downsample of RGBA pixel data.\n */\nfunction downsample(\n\tsrc: Uint8Array,\n\tsrcW: number,\n\tsrcH: number,\n\tdstW: number,\n\tdstH: number,\n): Uint8ClampedArray {\n\tconst dst = new Uint8ClampedArray(dstW * dstH * 4);\n\n\tfor (let y = 0; y < dstH; y++) {\n\t\tconst srcY = Math.floor((y * srcH) / dstH);\n\t\tfor (let x = 0; x < dstW; x++) {\n\t\t\tconst srcX = Math.floor((x * srcW) / dstW);\n\t\t\tconst srcIdx = (srcY * srcW + srcX) * 4;\n\t\t\tconst dstIdx = (y * dstW + x) * 4;\n\t\t\tdst[dstIdx] = src[srcIdx]!;\n\t\t\tdst[dstIdx + 1] = src[srcIdx + 1]!;\n\t\t\tdst[dstIdx + 2] = src[srcIdx + 2]!;\n\t\t\tdst[dstIdx + 3] = src[srcIdx + 3]!;\n\t\t}\n\t}\n\n\treturn dst;\n}\n"],"mappings":";;;;;;;;;;;AAgBA,MAAM,kBAAkD;CACvD,cAAc;CACd,aAAa;CACb,aAAa;CACb;;AAGD,MAAM,mBAAmB;;AAGzB,MAAM,oBAAoB,KAAK,OAAO;;;;AAWtC,eAAe,WAAW,QAA2C;CACpE,MAAM,EAAE,WAAW,MAAM,OAAO;CAChC,MAAM,SAAS,OAAO,QAAQ,EAAE,WAAW,MAAM,CAAC;AAClD,QAAO;EAAE,OAAO,OAAO;EAAO,QAAQ,OAAO;EAAQ,MAAM,OAAO;EAAM;;;;;;AAOzE,eAAe,UAAU,QAA2C;CAEnE,MAAM,QAAQ,MAAM,OAAO,YAAY;CACvC,MAAM,MAAM,KAAK,OAAO,OAAO,OAAO;CAEtC,MAAM,SAAwB,KAAK,QAAQ,IAAI;CAC/C,MAAM,OAAO,IAAI,WAAW,OAAO,GAAG;AACtC,QAAO;EAAE,OAAO,IAAI;EAAO,QAAQ,IAAI;EAAQ,MAAM;EAAM;;;;;;AAO5D,SAAS,qBAAqB,MAAkB,OAAe,QAAwB;CACtF,IAAI,IAAI;CACR,IAAI,IAAI;CACR,IAAI,IAAI;CACR,IAAI,QAAQ;CAEZ,MAAM,MAAM,QAAQ,SAAS;AAC7B,MAAK,IAAI,IAAI,GAAG,IAAI,KAAK,KAAK,GAAG;AAEhC,MADU,KAAK,IAAI,KACX,IAAK;AACb,OAAK,KAAK;AACV,OAAK,KAAK,IAAI;AACd,OAAK,KAAK,IAAI;AACd;;AAGD,KAAI,UAAU,EAAG,QAAO;AAKxB,QAAO,OAHM,KAAK,MAAM,IAAI,MAAM,CAGf,GAFN,KAAK,MAAM,IAAI,MAAM,CAEP,GADd,KAAK,MAAM,IAAI,MAAM,CACC;;;;;AAMpC,SAAS,mBAAmB,QAA8D;AACzF,KAAI;EACH,MAAM,SAAS,UAAU,OAAO;AAChC,MAAI,OAAO,SAAS,QAAQ,OAAO,UAAU,KAC5C,QAAO;GAAE,OAAO,OAAO;GAAO,QAAQ,OAAO;GAAQ;AAEtD,SAAO;SACA;AACP,SAAO;;;;;;;;;;;;AAaT,eAAsB,oBACrB,QACA,UACA,YACkC;CAClC,MAAM,SAAS,gBAAgB;AAC/B,KAAI,CAAC,OAAQ,QAAO;AAEpB,KAAI;EAEH,MAAM,OAAO,mBAAmB,OAAO,IAAI;AAC3C,MAAI,QAAQ,KAAK,QAAQ,KAAK,SAAS,IAAI,kBAC1C,QAAO;EAIR,MAAM,EAAE,OAAO,QAAQ,SADL,WAAW,SAAS,MAAM,WAAW,OAAO,GAAG,MAAM,UAAU,OAAO;AAGxF,MAAI,UAAU,KAAK,WAAW,EAAG,QAAO;EAGxC,IAAI;EACJ,IAAI;EACJ,IAAI;AAEJ,MAAI,QAAQ,kBAAkB;GAC7B,MAAM,QAAQ,mBAAmB;AACjC,iBAAc;AACd,kBAAe,KAAK,IAAI,GAAG,KAAK,MAAM,SAAS,MAAM,CAAC;AACtD,kBAAe,WAAW,MAAM,OAAO,QAAQ,aAAa,aAAa;SACnE;AACN,iBAAc;AACd,kBAAe;AACf,kBAAe,IAAI,kBAAkB,KAAK,QAAQ,KAAK,YAAY,KAAK,WAAW;;AAMpF,SAAO;GAAE,UAHQ,OAAO,cAAc,aAAa,cAAc,GAAG,EAAE;GAGnD,eAFG,qBAAqB,MAAM,OAAO,OAAO;GAE7B;SAC3B;AACP,SAAO;;;;;;AAOT,SAAS,WACR,KACA,MACA,MACA,MACA,MACoB;CACpB,MAAM,MAAM,IAAI,kBAAkB,OAAO,OAAO,EAAE;AAElD,MAAK,IAAI,IAAI,GAAG,IAAI,MAAM,KAAK;EAC9B,MAAM,OAAO,KAAK,MAAO,IAAI,OAAQ,KAAK;AAC1C,OAAK,IAAI,IAAI,GAAG,IAAI,MAAM,KAAK;GAC9B,MAAM,OAAO,KAAK,MAAO,IAAI,OAAQ,KAAK;GAC1C,MAAM,UAAU,OAAO,OAAO,QAAQ;GACtC,MAAM,UAAU,IAAI,OAAO,KAAK;AAChC,OAAI,UAAU,IAAI;AAClB,OAAI,SAAS,KAAK,IAAI,SAAS;AAC/B,OAAI,SAAS,KAAK,IAAI,SAAS;AAC/B,OAAI,SAAS,KAAK,IAAI,SAAS;;;AAIjC,QAAO"}

package/dist/plugin-types.d.mts

@@ -0,0 +1,122 @@
+import { $ as PageMetadataHandler, A as EmailDeliverEvent, C as CronHandler, Ct as UninstallEvent, D as EmailAfterSendHandler, E as EmailAfterSendEvent, H as MediaAfterUploadEvent, K as MediaUploadEvent, O as EmailBeforeSendEvent, Q as PageMetadataEvent, R as LifecycleEvent, S as CronEvent, U as MediaAfterUploadHandler, W as MediaBeforeUploadHandler, X as PageFragmentHandler, Y as PageFragmentEvent, _ as ContentBeforeDeleteHandler, a as CommentAfterCreateHandler, b as ContentHookEvent, c as CommentBeforeCreateEvent, d as CommentModerateHandler, g as ContentAfterUnpublishHandler, h as ContentAfterSaveHandler, i as CommentAfterCreateEvent, j as EmailDeliverHandler, k as EmailBeforeSendHandler, l as CommentBeforeCreateHandler, m as ContentAfterPublishHandler, o as CommentAfterModerateEvent, ot as PluginContext, p as ContentAfterDeleteHandler, s as CommentAfterModerateHandler, u as CommentModerateEvent, v as ContentBeforeSaveHandler, wt as UninstallHandler, x as ContentPublishStateChangeEvent, y as ContentDeleteEvent, z as LifecycleHandler } from "./types-B05e2naf.mjs";
+
+//#region src/plugin-types.d.ts
+/**
+ * Map from hook name to its handler signature. Adding or changing a
+ * hook signature in the runtime means updating this map; the rest of
+ * the type story flows from it. Authors writing
+ * `"content:beforeSave": async (event, ctx) => { ... }` get `event`
+ * typed as `ContentHookEvent` and `ctx` as `PluginContext` for free.
+ */
+interface HookHandlers {
+  "plugin:install": LifecycleHandler;
+  "plugin:activate": LifecycleHandler;
+  "plugin:deactivate": LifecycleHandler;
+  "plugin:uninstall": UninstallHandler;
+  "content:beforeSave": ContentBeforeSaveHandler;
+  "content:afterSave": ContentAfterSaveHandler;
+  "content:beforeDelete": ContentBeforeDeleteHandler;
+  "content:afterDelete": ContentAfterDeleteHandler;
+  "content:afterPublish": ContentAfterPublishHandler;
+  "content:afterUnpublish": ContentAfterUnpublishHandler;
+  "media:beforeUpload": MediaBeforeUploadHandler;
+  "media:afterUpload": MediaAfterUploadHandler;
+  cron: CronHandler;
+  "email:beforeSend": EmailBeforeSendHandler;
+  "email:deliver": EmailDeliverHandler;
+  "email:afterSend": EmailAfterSendHandler;
+  "comment:beforeCreate": CommentBeforeCreateHandler;
+  "comment:moderate": CommentModerateHandler;
+  "comment:afterCreate": CommentAfterCreateHandler;
+  "comment:afterModerate": CommentAfterModerateHandler;
+  "page:metadata": PageMetadataHandler;
+  "page:fragments": PageFragmentHandler;
+}
+/**
+ * Hook-handler config form. The bare-function form is also accepted
+ * (see `HookEntry`) — this is the long form that lets authors override
+ * priority, timeout, exclusivity. `errorPolicy` and `dependencies` are
+ * read by the host but rarely set by authors.
+ */
+interface HookConfig<K extends keyof HookHandlers> {
+  handler: HookHandlers[K];
+  priority?: number;
+  timeout?: number;
+  dependencies?: string[];
+  errorPolicy?: "continue" | "abort";
+  exclusive?: boolean;
+}
+/**
+ * Either a bare handler or the config form. The build probe accepts
+ * both shapes and the runtime normalises to the config form before
+ * dispatch.
+ */
+type HookEntry<K extends keyof HookHandlers> = HookHandlers[K] | HookConfig<K>;
+/**
+ * Request fields a route handler can rely on across both trusted and
+ * sandboxed execution. Trusted handlers receive a real `Request`
+ * (which is structurally compatible — has `url`, `method`, `headers`);
+ * sandboxed handlers receive a serialised `{ url, method, headers }`
+ * record because Worker Loader can't pass `Request` objects across
+ * the boundary. The shared shape is what's actually portable.
+ *
+ * `headers` is intentionally `Record<string, string>` rather than
+ * `Headers` so the sandboxed serialised form (which is a plain
+ * record) typechecks. Trusted handlers receiving a real `Headers`
+ * object can still call `.get(...)`, but reading via this type's
+ * indexing requires the lookup to be lowercased and exact. Authors
+ * iterating headers in a portable way should use `Object.entries`.
+ */
+interface SandboxedRequest {
+  url: string;
+  method: string;
+  headers: Record<string, string>;
+}
+/**
+ * Context passed to a route handler. Routes get an extra `routeCtx`
+ * argument with the call-site input + the originating request, in
+ * addition to the standard `PluginContext`.
+ *
+ * `input` is `unknown` because plugins validate it themselves — no
+ * central schema for route payloads.
+ */
+interface SandboxedRouteContext {
+  input: unknown;
+  request: SandboxedRequest;
+  requestMeta?: unknown;
+}
+/**
+ * Route handler. The two-arg shape (`routeCtx`, `pluginCtx`) matches
+ * how the standard-format runtime invokes routes — distinct from
+ * native plugins, where routes take a single context with the input
+ * merged in.
+ *
+ * Return type is `unknown` because routes serialise their return value
+ * to JSON for the caller; authors define their own response shape.
+ */
+type RouteHandler = (routeCtx: SandboxedRouteContext, ctx: PluginContext) => Promise<unknown>;
+/**
+ * Route entry — either a bare handler or the config form with
+ * `public`, `input` schema, and so on. The build probe accepts both.
+ */
+type RouteEntry = RouteHandler | {
+  handler: RouteHandler;
+  public?: boolean;
+  input?: unknown;
+};
+/**
+ * The shape of a sandboxed plugin's default export.
+ *
+ * Both `hooks` and `routes` are optional — a plugin that only declares
+ * one is valid. Hook keys are constrained to the runtime's hook
+ * vocabulary so a typo (`"content:beforSave"`) is a compile error.
+ * Route keys are open because route names are author-chosen URL path
+ * segments.
+ */
+interface SandboxedPlugin {
+  hooks?: { [K in keyof HookHandlers]?: HookEntry<K> };
+  routes?: Record<string, RouteEntry>;
+}
+//#endregion
+export { type CommentAfterCreateEvent, type CommentAfterModerateEvent, type CommentBeforeCreateEvent, type CommentModerateEvent, type ContentDeleteEvent, type ContentHookEvent, type ContentPublishStateChangeEvent, type CronEvent, type EmailAfterSendEvent, type EmailBeforeSendEvent, type EmailDeliverEvent, HookConfig, HookEntry, HookHandlers, type LifecycleEvent, type MediaAfterUploadEvent, type MediaUploadEvent, type PageFragmentEvent, type PageMetadataEvent, type PluginContext, RouteEntry, RouteHandler, SandboxedPlugin, SandboxedRequest, SandboxedRouteContext, type UninstallEvent };
+//# sourceMappingURL=plugin-types.d.mts.map

package/dist/plugin-types.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin-types.d.mts","names":[],"sources":["../src/plugin-types.ts"],"mappings":";;;;;;;;;;UAwFiB,YAAA;EAChB,gBAAA,EAAkB,gBAAA;EAClB,iBAAA,EAAmB,gBAAA;EACnB,mBAAA,EAAqB,gBAAA;EACrB,kBAAA,EAAoB,gBAAA;EACpB,oBAAA,EAAsB,wBAAA;EACtB,mBAAA,EAAqB,uBAAA;EACrB,sBAAA,EAAwB,0BAAA;EACxB,qBAAA,EAAuB,yBAAA;EACvB,sBAAA,EAAwB,0BAAA;EACxB,wBAAA,EAA0B,4BAAA;EAC1B,oBAAA,EAAsB,wBAAA;EACtB,mBAAA,EAAqB,uBAAA;EACrB,IAAA,EAAM,WAAA;EACN,kBAAA,EAAoB,sBAAA;EACpB,eAAA,EAAiB,mBAAA;EACjB,iBAAA,EAAmB,qBAAA;EACnB,sBAAA,EAAwB,0BAAA;EACxB,kBAAA,EAAoB,sBAAA;EACpB,qBAAA,EAAuB,yBAAA;EACvB,uBAAA,EAAyB,2BAAA;EACzB,eAAA,EAAiB,mBAAA;EACjB,gBAAA,EAAkB,mBAAA;AAAA;;;;;;AASnB;UAAiB,UAAA,iBAA2B,YAAA;EAC3C,OAAA,EAAS,YAAA,CAAa,CAAA;EACtB,QAAA;EACA,OAAA;EACA,YAAA;EACA,WAAA;EACA,SAAA;AAAA;;;;;;KAQW,SAAA,iBAA0B,YAAA,IAAgB,YAAA,CAAa,CAAA,IAAK,UAAA,CAAW,CAAA;;;;;;AAAnF;;;;;;;;;;UAiBiB,gBAAA;EAChB,GAAA;EACA,MAAA;EACA,OAAA,EAAS,MAAA;AAAA;;;;AAHV;;;;;UAciB,qBAAA;EAChB,KAAA;EACA,OAAA,EAAS,gBAAA;EACT,WAAA;AAAA;AAHD;;;;;;;;;AAAA,KAeY,YAAA,IACX,QAAA,EAAU,qBAAA,EACV,GAAA,EAAK,aAAA,KACD,OAAA;AAHL;;;;AAAA,KASY,UAAA,GACT,YAAA;EAEA,OAAA,EAAS,YAAA;EACT,MAAA;EACA,KAAA;AAAA;;;;;;;AALH;;;UAiBiB,eAAA;EAChB,KAAA,iBACa,YAAA,IAAgB,SAAA,CAAU,CAAA;EAEvC,MAAA,GAAS,MAAA,SAAe,UAAA;AAAA"}

package/dist/plugin-types.mjs

@@ -0,0 +1 @@
+export {  };

package/dist/plugins/adapt-sandbox-entry.d.mts

@@ -1,22 +1,30 @@
-import "../types-BQx6ZXpR.mjs";
-import { mn as PluginDescriptor } from "../index-Dlkzhb4C.mjs";
-import "../runner-Iu3IZSDM.mjs";
-import { $ as ResolvedPlugin, it as StandardPluginDefinition } from "../types-DgSc9Rpc.mjs";
-import "../validate-BcC3m2O7.mjs";
+import "../options-Cq64Wx0O.mjs";
+import "../types-C1KKK4VP.mjs";
+import { _t as ResolvedPlugin } from "../types-B05e2naf.mjs";
+import "../bylines-C6eYUWlZ.mjs";
+import { Ft as PluginDescriptor } from "../index-UmOMt9T-.mjs";
+import "../runner-DcfZewkO.mjs";
+import "../index-D2gvztOP.mjs";
+import { SandboxedPlugin } from "../plugin-types.mjs";
+import "../types-Cb2UCDJg.mjs";
+import "../validate-BpQGsmd7.mjs";
 
 //#region src/plugins/adapt-sandbox-entry.d.ts
 /**
- * Adapt a standard-format plugin definition into a ResolvedPlugin.
+ * Adapt a sandboxed plugin's default export into a ResolvedPlugin.
  *
- * This is the core of the unified plugin format. It takes the `{ hooks, routes }`
- * export from a standard plugin and produces a ResolvedPlugin that can enter the
- * HookPipeline alongside native plugins.
+ * This is the in-process side of sandboxed-format plugins: it takes
+ * the `{ hooks, routes }` default export of a sandboxed plugin and
+ * produces a `ResolvedPlugin` that enters the HookPipeline alongside
+ * native plugins. The descriptor supplies identity (id, version) and
+ * the trust contract (capabilities, allowedHosts, storage); the
+ * definition supplies behaviour.
  *
- * @param definition - The standard plugin definition (from definePlugin() or raw export)
+ * @param definition - The plugin's default export (matching `SandboxedPlugin` from `emdash/plugin`).
  * @param descriptor - The plugin descriptor with id, version, capabilities, etc.
- * @returns A ResolvedPlugin compatible with HookPipeline
+ * @returns A ResolvedPlugin compatible with HookPipeline.
  */
-declare function adaptSandboxEntry(definition: StandardPluginDefinition, descriptor: PluginDescriptor): ResolvedPlugin;
+declare function adaptSandboxEntry(definition: SandboxedPlugin, descriptor: PluginDescriptor): ResolvedPlugin;
 //#endregion
 export { adaptSandboxEntry };
 //# sourceMappingURL=adapt-sandbox-entry.d.mts.map

package/dist/plugins/adapt-sandbox-entry.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"adapt-sandbox-entry.d.mts","names":[],"sources":["../../src/plugins/adapt-sandbox-entry.ts"],"mappings":";;;;;;;;;;;;;;;;;;iBAgGgB,iBAAA,CACf,UAAA,EAAY,wBAAA,EACZ,UAAA,EAAY,gBAAA,GACV,cAAA"}
+{"version":3,"file":"adapt-sandbox-entry.d.mts","names":[],"sources":["../../src/plugins/adapt-sandbox-entry.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;iBAoHgB,iBAAA,CACf,UAAA,EAAY,eAAA,EACZ,UAAA,EAAY,gBAAA,GACV,cAAA"}