emdash 0.9.0 → 0.11.0

package/src/astro/routes/api/menus/[name].ts

@@ -1,9 +1,9 @@
 /**
  * Single menu endpoint
  *
- * GET    /_emdash/api/menus/:name - Get menu with items
- * PUT    /_emdash/api/menus/:name - Update menu metadata
- * DELETE /_emdash/api/menus/:name - Delete menu
+ * GET    /_emdash/api/menus/:name[?locale=xx]
+ * PUT    /_emdash/api/menus/:name[?locale=xx]
+ * DELETE /_emdash/api/menus/:name[?locale=xx]
  */
 
 import type { APIRoute } from "astro";
@@ -11,20 +11,23 @@ import type { APIRoute } from "astro";
 import { requirePerm } from "#api/authorize.js";
 import { handleError, unwrapResult } from "#api/error.js";
 import { handleMenuDelete, handleMenuGet, handleMenuUpdate } from "#api/handlers/menus.js";
-import { isParseError, parseBody } from "#api/parse.js";
-import { updateMenuBody } from "#api/schemas.js";
+import { isParseError, parseBody, parseQuery } from "#api/parse.js";
+import { localeFilterQuery, updateMenuBody } from "#api/schemas.js";
 
 export const prerender = false;
 
-export const GET: APIRoute = async ({ params, locals }) => {
+export const GET: APIRoute = async ({ params, request, locals }) => {
 	const { emdash, user } = locals;
 	const name = params.name!;
 
 	const denied = requirePerm(user, "menus:read");
 	if (denied) return denied;
 
+	const query = parseQuery(new URL(request.url), localeFilterQuery);
+	if (isParseError(query)) return query;
+
 	try {
-		const result = await handleMenuGet(emdash.db, name);
+		const result = await handleMenuGet(emdash.db, name, { locale: query.locale });
 		return unwrapResult(result);
 	} catch (error) {
 		return handleError(error, "Failed to fetch menu", "MENU_GET_ERROR");
@@ -38,26 +41,32 @@ export const PUT: APIRoute = async ({ params, request, locals }) => {
 	const denied = requirePerm(user, "menus:manage");
 	if (denied) return denied;
 
+	const query = parseQuery(new URL(request.url), localeFilterQuery);
+	if (isParseError(query)) return query;
+
 	try {
 		const body = await parseBody(request, updateMenuBody);
 		if (isParseError(body)) return body;
 
-		const result = await handleMenuUpdate(emdash.db, name, body);
+		const result = await handleMenuUpdate(emdash.db, name, { ...body, locale: query.locale });
 		return unwrapResult(result);
 	} catch (error) {
 		return handleError(error, "Failed to update menu", "MENU_UPDATE_ERROR");
 	}
 };
 
-export const DELETE: APIRoute = async ({ params, locals }) => {
+export const DELETE: APIRoute = async ({ params, request, locals }) => {
 	const { emdash, user } = locals;
 	const name = params.name!;
 
 	const denied = requirePerm(user, "menus:manage");
 	if (denied) return denied;
 
+	const query = parseQuery(new URL(request.url), localeFilterQuery);
+	if (isParseError(query)) return query;
+
 	try {
-		const result = await handleMenuDelete(emdash.db, name);
+		const result = await handleMenuDelete(emdash.db, name, { locale: query.locale });
 		return unwrapResult(result);
 	} catch (error) {
 		return handleError(error, "Failed to delete menu", "MENU_DELETE_ERROR");

package/src/astro/routes/api/menus/index.ts

@@ -1,8 +1,8 @@
 /**
  * Menus list and create endpoints
  *
- * GET  /_emdash/api/menus - List all menus
- * POST /_emdash/api/menus - Create menu
+ * GET  /_emdash/api/menus[?locale=xx] - List menus (optionally filtered by locale)
+ * POST /_emdash/api/menus              - Create menu (body may include locale & translationOf)
  */
 
 import type { APIRoute } from "astro";
@@ -10,19 +10,22 @@ import type { APIRoute } from "astro";
 import { requirePerm } from "#api/authorize.js";
 import { handleError, unwrapResult } from "#api/error.js";
 import { handleMenuCreate, handleMenuList } from "#api/handlers/menus.js";
-import { isParseError, parseBody } from "#api/parse.js";
-import { createMenuBody } from "#api/schemas.js";
+import { isParseError, parseBody, parseQuery } from "#api/parse.js";
+import { createMenuBody, localeFilterQuery } from "#api/schemas.js";
 
 export const prerender = false;
 
-export const GET: APIRoute = async ({ locals }) => {
+export const GET: APIRoute = async ({ request, locals }) => {
 	const { emdash, user } = locals;
 
 	const denied = requirePerm(user, "menus:read");
 	if (denied) return denied;
 
+	const query = parseQuery(new URL(request.url), localeFilterQuery);
+	if (isParseError(query)) return query;
+
 	try {
-		const result = await handleMenuList(emdash.db);
+		const result = await handleMenuList(emdash.db, { locale: query.locale });
 		return unwrapResult(result);
 	} catch (error) {
 		return handleError(error, "Failed to fetch menus", "MENU_LIST_ERROR");

package/src/astro/routes/api/taxonomies/[name]/terms/[slug]/translations.ts

@@ -0,0 +1,89 @@
+/**
+ * Term translation endpoints
+ *
+ * GET  /_emdash/api/taxonomies/:name/terms/:slug/translations[?locale=xx]
+ * POST /_emdash/api/taxonomies/:name/terms/:slug/translations
+ *    body: { locale, label?, slug? }
+ */
+
+import type { APIRoute } from "astro";
+import { z } from "zod";
+
+import { requirePerm } from "#api/authorize.js";
+import { apiError, handleError, requireDb, unwrapResult } from "#api/error.js";
+import {
+	handleTermCreate,
+	handleTermGet,
+	handleTermTranslations,
+} from "#api/handlers/taxonomies.js";
+import { isParseError, parseBody, parseQuery } from "#api/parse.js";
+import { localeFilterQuery } from "#api/schemas.js";
+
+export const prerender = false;
+
+const createTermTranslationBody = z
+	.object({
+		locale: z.string().min(1),
+		label: z.string().min(1).optional(),
+		slug: z.string().min(1).optional(),
+	})
+	.meta({ id: "CreateTermTranslationBody" });
+
+export const GET: APIRoute = async ({ params, request, locals }) => {
+	const { emdash, user } = locals;
+	const { name, slug } = params;
+	if (!name || !slug) return apiError("VALIDATION_ERROR", "Taxonomy name and slug required", 400);
+
+	const dbErr = requireDb(emdash?.db);
+	if (dbErr) return dbErr;
+
+	const denied = requirePerm(user, "taxonomies:read");
+	if (denied) return denied;
+
+	const query = parseQuery(new URL(request.url), localeFilterQuery);
+	if (isParseError(query)) return query;
+
+	try {
+		const anchor = await handleTermGet(emdash.db, name, slug, { locale: query.locale });
+		if (!anchor.success) return unwrapResult(anchor);
+		const result = await handleTermTranslations(emdash.db, anchor.data.term.id);
+		return unwrapResult(result);
+	} catch (error) {
+		return handleError(error, "Failed to list term translations", "TERM_TRANSLATIONS_ERROR");
+	}
+};
+
+export const POST: APIRoute = async ({ params, request, locals }) => {
+	const { emdash, user } = locals;
+	const { name, slug } = params;
+	if (!name || !slug) return apiError("VALIDATION_ERROR", "Taxonomy name and slug required", 400);
+
+	const dbErr = requireDb(emdash?.db);
+	if (dbErr) return dbErr;
+
+	const denied = requirePerm(user, "taxonomies:manage");
+	if (denied) return denied;
+
+	const query = parseQuery(new URL(request.url), localeFilterQuery);
+	if (isParseError(query)) return query;
+
+	try {
+		const body = await parseBody(request, createTermTranslationBody);
+		if (isParseError(body)) return body;
+
+		const source = await handleTermGet(emdash.db, name, slug, { locale: query.locale });
+		if (!source.success) return unwrapResult(source);
+
+		const result = await handleTermCreate(emdash.db, name, {
+			slug: body.slug ?? source.data.term.slug,
+			label: body.label ?? source.data.term.label,
+			parentId: source.data.term.parentId,
+			description: source.data.term.description,
+			locale: body.locale,
+			translationOf: source.data.term.id,
+		});
+		return unwrapResult(result, 201);
+	} catch (error) {
+		return handleError(error, "Failed to create term translation", "TERM_TRANSLATION_CREATE_ERROR");
+	}
+};

package/src/astro/routes/api/taxonomies/[name]/terms/[slug].ts

@@ -1,9 +1,9 @@
 /**
  * Single term endpoint
  *
- * GET /_emdash/api/taxonomies/:name/terms/:slug - Get a single term
- * PUT /_emdash/api/taxonomies/:name/terms/:slug - Update a term
- * DELETE /_emdash/api/taxonomies/:name/terms/:slug - Delete a term
+ * GET    /_emdash/api/taxonomies/:name/terms/:slug[?locale=xx]
+ * PUT    /_emdash/api/taxonomies/:name/terms/:slug[?locale=xx]
+ * DELETE /_emdash/api/taxonomies/:name/terms/:slug[?locale=xx]
  */
 
 import type { APIRoute } from "astro";
@@ -11,21 +11,18 @@ import type { APIRoute } from "astro";
 import { requirePerm } from "#api/authorize.js";
 import { apiError, handleError, requireDb, unwrapResult } from "#api/error.js";
 import { handleTermDelete, handleTermGet, handleTermUpdate } from "#api/handlers/taxonomies.js";
-import { isParseError, parseBody } from "#api/parse.js";
-import { updateTermBody } from "#api/schemas.js";
+import { isParseError, parseBody, parseQuery } from "#api/parse.js";
+import { localeFilterQuery, updateTermBody } from "#api/schemas.js";
 
 export const prerender = false;
 
 /**
  * Get a single term
  */
-export const GET: APIRoute = async ({ params, locals }) => {
+export const GET: APIRoute = async ({ params, request, locals }) => {
 	const { emdash, user } = locals;
 	const { name, slug } = params;
-
-	if (!name || !slug) {
-		return apiError("VALIDATION_ERROR", "Taxonomy name and slug required", 400);
-	}
+	if (!name || !slug) return apiError("VALIDATION_ERROR", "Taxonomy name and slug required", 400);
 
 	const dbErr = requireDb(emdash?.db);
 	if (dbErr) return dbErr;
@@ -33,8 +30,11 @@ export const GET: APIRoute = async ({ params, locals }) => {
 	const denied = requirePerm(user, "taxonomies:read");
 	if (denied) return denied;
 
+	const query = parseQuery(new URL(request.url), localeFilterQuery);
+	if (isParseError(query)) return query;
+
 	try {
-		const result = await handleTermGet(emdash.db, name, slug);
+		const result = await handleTermGet(emdash.db, name, slug, { locale: query.locale });
 		return unwrapResult(result);
 	} catch (error) {
 		return handleError(error, "Failed to get term", "TERM_GET_ERROR");
@@ -47,10 +47,7 @@ export const GET: APIRoute = async ({ params, locals }) => {
 export const PUT: APIRoute = async ({ params, request, locals }) => {
 	const { emdash, user } = locals;
 	const { name, slug } = params;
-
-	if (!name || !slug) {
-		return apiError("VALIDATION_ERROR", "Taxonomy name and slug required", 400);
-	}
+	if (!name || !slug) return apiError("VALIDATION_ERROR", "Taxonomy name and slug required", 400);
 
 	const dbErr = requireDb(emdash?.db);
 	if (dbErr) return dbErr;
@@ -58,11 +55,14 @@ export const PUT: APIRoute = async ({ params, request, locals }) => {
 	const denied = requirePerm(user, "taxonomies:manage");
 	if (denied) return denied;
 
+	const query = parseQuery(new URL(request.url), localeFilterQuery);
+	if (isParseError(query)) return query;
+
 	try {
 		const body = await parseBody(request, updateTermBody);
 		if (isParseError(body)) return body;
 
-		const result = await handleTermUpdate(emdash.db, name, slug, body);
+		const result = await handleTermUpdate(emdash.db, name, slug, body, { locale: query.locale });
 		return unwrapResult(result);
 	} catch (error) {
 		return handleError(error, "Failed to update term", "TERM_UPDATE_ERROR");
@@ -72,13 +72,10 @@ export const PUT: APIRoute = async ({ params, request, locals }) => {
 /**
  * Delete a term
  */
-export const DELETE: APIRoute = async ({ params, locals }) => {
+export const DELETE: APIRoute = async ({ params, request, locals }) => {
 	const { emdash, user } = locals;
 	const { name, slug } = params;
-
-	if (!name || !slug) {
-		return apiError("VALIDATION_ERROR", "Taxonomy name and slug required", 400);
-	}
+	if (!name || !slug) return apiError("VALIDATION_ERROR", "Taxonomy name and slug required", 400);
 
 	const dbErr = requireDb(emdash?.db);
 	if (dbErr) return dbErr;
@@ -86,8 +83,11 @@ export const DELETE: APIRoute = async ({ params, locals }) => {
 	const denied = requirePerm(user, "taxonomies:manage");
 	if (denied) return denied;
 
+	const query = parseQuery(new URL(request.url), localeFilterQuery);
+	if (isParseError(query)) return query;
+
 	try {
-		const result = await handleTermDelete(emdash.db, name, slug);
+		const result = await handleTermDelete(emdash.db, name, slug, { locale: query.locale });
 		return unwrapResult(result);
 	} catch (error) {
 		return handleError(error, "Failed to delete term", "TERM_DELETE_ERROR");

package/src/astro/routes/api/taxonomies/[name]/terms/index.ts

@@ -1,8 +1,8 @@
 /**
  * Taxonomy terms list and create endpoint
  *
- * GET /_emdash/api/taxonomies/:name/terms - List all terms (tree for hierarchical)
- * POST /_emdash/api/taxonomies/:name/terms - Create a new term
+ * GET  /_emdash/api/taxonomies/:name/terms[?locale=xx] - List terms (tree for hierarchical)
+ * POST /_emdash/api/taxonomies/:name/terms              - Create a new term (body may include locale & translationOf)
  */
 
 import type { APIRoute } from "astro";
@@ -10,21 +10,18 @@ import type { APIRoute } from "astro";
 import { requirePerm } from "#api/authorize.js";
 import { apiError, handleError, requireDb, unwrapResult } from "#api/error.js";
 import { handleTermCreate, handleTermList } from "#api/handlers/taxonomies.js";
-import { isParseError, parseBody } from "#api/parse.js";
-import { createTermBody } from "#api/schemas.js";
+import { isParseError, parseBody, parseQuery } from "#api/parse.js";
+import { createTermBody, localeFilterQuery } from "#api/schemas.js";
 
 export const prerender = false;
 
 /**
  * List all terms for a taxonomy
  */
-export const GET: APIRoute = async ({ params, locals }) => {
+export const GET: APIRoute = async ({ params, request, locals }) => {
 	const { emdash, user } = locals;
 	const { name } = params;
-
-	if (!name) {
-		return apiError("VALIDATION_ERROR", "Taxonomy name required", 400);
-	}
+	if (!name) return apiError("VALIDATION_ERROR", "Taxonomy name required", 400);
 
 	const dbErr = requireDb(emdash?.db);
 	if (dbErr) return dbErr;
@@ -32,8 +29,11 @@ export const GET: APIRoute = async ({ params, locals }) => {
 	const denied = requirePerm(user, "taxonomies:read");
 	if (denied) return denied;
 
+	const query = parseQuery(new URL(request.url), localeFilterQuery);
+	if (isParseError(query)) return query;
+
 	try {
-		const result = await handleTermList(emdash.db, name);
+		const result = await handleTermList(emdash.db, name, { locale: query.locale });
 		return unwrapResult(result);
 	} catch (error) {
 		return handleError(error, "Failed to list terms", "TERM_LIST_ERROR");
@@ -46,10 +46,7 @@ export const GET: APIRoute = async ({ params, locals }) => {
 export const POST: APIRoute = async ({ params, request, locals }) => {
 	const { emdash, user } = locals;
 	const { name } = params;
-
-	if (!name) {
-		return apiError("VALIDATION_ERROR", "Taxonomy name required", 400);
-	}
+	if (!name) return apiError("VALIDATION_ERROR", "Taxonomy name required", 400);
 
 	const dbErr = requireDb(emdash?.db);
 	if (dbErr) return dbErr;

package/src/astro/routes/api/taxonomies/index.ts

@@ -1,8 +1,8 @@
 /**
  * Taxonomy definitions endpoint
  *
- * GET  /_emdash/api/taxonomies - List all taxonomy definitions
- * POST /_emdash/api/taxonomies - Create a custom taxonomy definition
+ * GET  /_emdash/api/taxonomies[?locale=xx] - List taxonomy definitions
+ * POST /_emdash/api/taxonomies              - Create a custom taxonomy definition
  */
 
 import type { APIRoute } from "astro";
@@ -10,15 +10,15 @@ import type { APIRoute } from "astro";
 import { requirePerm } from "#api/authorize.js";
 import { handleError, requireDb, unwrapResult } from "#api/error.js";
 import { handleTaxonomyCreate, handleTaxonomyList } from "#api/handlers/taxonomies.js";
-import { isParseError, parseBody } from "#api/parse.js";
-import { createTaxonomyDefBody } from "#api/schemas.js";
+import { isParseError, parseBody, parseQuery } from "#api/parse.js";
+import { createTaxonomyDefBody, localeFilterQuery } from "#api/schemas.js";
 
 export const prerender = false;
 
 /**
  * List taxonomy definitions
  */
-export const GET: APIRoute = async ({ locals }) => {
+export const GET: APIRoute = async ({ request, locals }) => {
 	const { emdash, user } = locals;
 
 	const dbErr = requireDb(emdash?.db);
@@ -27,8 +27,11 @@ export const GET: APIRoute = async ({ locals }) => {
 	const denied = requirePerm(user, "taxonomies:read");
 	if (denied) return denied;
 
+	const query = parseQuery(new URL(request.url), localeFilterQuery);
+	if (isParseError(query)) return query;
+
 	try {
-		const result = await handleTaxonomyList(emdash.db);
+		const result = await handleTaxonomyList(emdash.db, { locale: query.locale });
 		return unwrapResult(result);
 	} catch (error) {
 		return handleError(error, "Failed to list taxonomies", "TAXONOMY_LIST_ERROR");

package/src/astro/types.ts

@@ -43,6 +43,10 @@ export interface ManifestCollection {
 			 *     (e.g. a checkbox grid receiving its column definitions)
 			 */
 			options?: Array<{ value: string; label: string }> | Record<string, unknown>;
+			/** The `_emdash_fields` row ID. Used by the admin to forward to upload/media-list API calls. */
+			id?: string;
+			/** Validation config for the field (e.g. `allowedMimeTypes` for file/image fields, subFields for repeater). */
+			validation?: Record<string, unknown>;
 		}
 	>;
 }
@@ -292,7 +296,7 @@ export interface EmDashHandlers {
 	handleMediaList: (params: {
 		cursor?: string;
 		limit?: number;
-		mimeType?: string;
+		mimeType?: string | readonly string[];
 	}) => Promise<HandlerResponse>;
 
 	handleMediaGet: (id: string) => Promise<HandlerResponse>;

package/src/auth/rate-limit.ts

@@ -63,9 +63,9 @@ export async function checkRateLimit(
 
 	// Atomic upsert: insert or increment, return current count
 	const result = await sql<{ count: number }>`
-		INSERT INTO _emdash_rate_limits (key, window, count)
+		INSERT INTO _emdash_rate_limits (key, "window", count)
 		VALUES (${key}, ${windowStart}, 1)
-		ON CONFLICT (key, window)
+		ON CONFLICT (key, "window")
 		DO UPDATE SET count = _emdash_rate_limits.count + 1
 		RETURNING count
 	`.execute(db);
@@ -179,7 +179,7 @@ export async function cleanupExpiredRateLimits(
 	const cutoff = new Date(Date.now() - maxAgeSeconds * 1000).toISOString();
 
 	const result = await sql`
-		DELETE FROM _emdash_rate_limits WHERE window < ${cutoff}
+		DELETE FROM _emdash_rate_limits WHERE "window" < ${cutoff}
 	`.execute(db);
 
 	return Number(result.numAffectedRows ?? 0);

package/src/cli/commands/bundle-utils.ts

@@ -22,7 +22,12 @@ import type {
 
 // ── Constants ────────────────────────────────────────────────────────────────
 
-export const MAX_BUNDLE_SIZE = 5 * 1024 * 1024;
+// Bundle size caps per RFC 0001 §"Bundle size limits". These are decompressed
+// sizes; the gzipped tarball is typically a fraction of MAX_BUNDLE_SIZE.
+export const MAX_BUNDLE_SIZE = 256 * 1024;
+export const MAX_FILE_SIZE = 128 * 1024;
+export const MAX_FILE_COUNT = 20;
+
 export const MAX_SCREENSHOTS = 5;
 export const MAX_SCREENSHOT_WIDTH = 1920;
 export const MAX_SCREENSHOT_HEIGHT = 1080;
@@ -251,23 +256,93 @@ export function findSourceExports(
 // ── Directory helpers ────────────────────────────────────────────────────────
 
 /**
- * Recursively calculate the total size of all files in a directory.
+ * One file in a bundle: a tarball-relative path and its byte length.
+ * Produced by `collectBundleEntries` (from a staging dir) or by the publish
+ * flow (from tarball entries); consumed by `validateBundleSize`.
  */
-export async function calculateDirectorySize(dir: string): Promise<number> {
-	let total = 0;
+export interface BundleFileEntry {
+	name: string;
+	bytes: number;
+}
+
+/**
+ * Recursively walk a staging directory and return a flat list of all files
+ * with sizes. Names are relative to `dir` so they match what would appear
+ * as the tarball entry name.
+ */
+export async function collectBundleEntries(dir: string): Promise<BundleFileEntry[]> {
+	const entries: BundleFileEntry[] = [];
+	await walkBundle(dir, "", entries);
+	return entries;
+}
+
+async function walkBundle(dir: string, prefix: string, into: BundleFileEntry[]): Promise<void> {
 	const items = await readdir(dir, { withFileTypes: true });
 	for (const item of items) {
 		const fullPath = join(dir, item.name);
+		const relPath = prefix ? `${prefix}/${item.name}` : item.name;
 		if (item.isFile()) {
 			const s = await stat(fullPath);
-			total += s.size;
+			into.push({ name: relPath, bytes: s.size });
 		} else if (item.isDirectory()) {
-			total += await calculateDirectorySize(fullPath);
+			await walkBundle(fullPath, relPath, into);
 		}
 	}
+}
+
+/**
+ * Sum the byte sizes of all entries.
+ */
+export function totalBundleBytes(entries: readonly BundleFileEntry[]): number {
+	let total = 0;
+	for (const e of entries) total += e.bytes;
 	return total;
 }
 
+/**
+ * Check a bundle against the three size caps from RFC 0001:
+ *   - total decompressed ≤ MAX_BUNDLE_SIZE
+ *   - per-file decompressed ≤ MAX_FILE_SIZE
+ *   - file count ≤ MAX_FILE_COUNT
+ *
+ * Returns a list of violation messages (empty if the bundle is within all
+ * caps). Messages are deterministic per input — the total/count violations
+ * come first, then oversized files in alphabetical order — so the same
+ * bundle always produces the same error text.
+ */
+export function validateBundleSize(entries: readonly BundleFileEntry[]): string[] {
+	const violations: string[] = [];
+	const total = totalBundleBytes(entries);
+	if (total > MAX_BUNDLE_SIZE) {
+		violations.push(
+			`Bundle size ${formatBytes(total)} exceeds maximum of ${formatBytes(MAX_BUNDLE_SIZE)}.`,
+		);
+	}
+	if (entries.length > MAX_FILE_COUNT) {
+		violations.push(
+			`Bundle contains ${entries.length} files, exceeds maximum of ${MAX_FILE_COUNT}.`,
+		);
+	}
+	const oversized = entries
+		.filter((e) => e.bytes > MAX_FILE_SIZE)
+		.toSorted((a, b) => a.name.localeCompare(b.name));
+	for (const e of oversized) {
+		violations.push(
+			`File ${e.name} is ${formatBytes(e.bytes)}, exceeds per-file maximum of ${formatBytes(MAX_FILE_SIZE)}.`,
+		);
+	}
+	return violations;
+}
+
+/**
+ * Render a byte count as a human-friendly string (e.g. "256.0 KB").
+ */
+export function formatBytes(n: number): string {
+	if (n < 1024) return `${n} B`;
+	if (n < 1024 * 1024) return `${(n / 1024).toFixed(1)} KB`;
+	return `${(n / 1024 / 1024).toFixed(2)} MB`;
+}
+
 // ── Tarball creation ─────────────────────────────────────────────────────────
 
 /**

package/src/cli/commands/bundle.ts

@@ -23,20 +23,22 @@ import consola from "consola";
 import { CAPABILITY_RENAMES, isDeprecatedCapability } from "../../plugins/types.js";
 import type { ResolvedPlugin } from "../../plugins/types.js";
 import {
-	fileExists,
-	readImageDimensions,
+	collectBundleEntries,
+	createTarball,
 	extractManifest,
-	findNodeBuiltinImports,
+	fileExists,
 	findBuildOutput,
+	findNodeBuiltinImports,
 	findSourceExports,
-	resolveSourceEntry,
-	calculateDirectorySize,
-	createTarball,
-	MAX_BUNDLE_SIZE,
+	formatBytes,
+	ICON_SIZE,
 	MAX_SCREENSHOTS,
 	MAX_SCREENSHOT_WIDTH,
 	MAX_SCREENSHOT_HEIGHT,
-	ICON_SIZE,
+	readImageDimensions,
+	resolveSourceEntry,
+	totalBundleBytes,
+	validateBundleSize,
 } from "./bundle-utils.js";
 
 const TS_EXT_RE = /\.(tsx?|[mc]?js)$/;
@@ -596,15 +598,16 @@ export const bundleCommand = defineCommand({
 				}
 			}
 
-			// Calculate total bundle size
-			const totalSize = await calculateDirectorySize(bundleDir);
-			if (totalSize > MAX_BUNDLE_SIZE) {
-				const sizeMB = (totalSize / 1024 / 1024).toFixed(2);
-				consola.error(`Bundle size ${sizeMB}MB exceeds maximum of 5MB`);
+			// Bundle size caps (RFC 0001 §"Bundle size limits").
+			const bundleEntries = await collectBundleEntries(bundleDir);
+			const sizeViolations = validateBundleSize(bundleEntries);
+			if (sizeViolations.length > 0) {
+				for (const v of sizeViolations) consola.error(v);
 				hasErrors = true;
 			} else {
-				const sizeKB = (totalSize / 1024).toFixed(1);
-				consola.info(`Bundle size: ${sizeKB}KB`);
+				consola.info(
+					`Bundle size: ${formatBytes(totalBundleBytes(bundleEntries))} across ${bundleEntries.length} file${bundleEntries.length === 1 ? "" : "s"}`,
+				);
 			}
 
 			if (hasErrors) {