emdash 1.3.0 → 1.3.1

package/dist/marketplace-DNvEGLqU.mjs

@@ -0,0 +1,257 @@
+import { a as pluginManifestSchema, o as reconcileManifestAccess } from "./manifest-schema-B0BxPSjB.mjs";
+import { createGzipDecoder, unpackTar } from "modern-tar";
+
+//#region src/plugins/marketplace.ts
+/**
+* MarketplaceClient — HTTP client for the EmDash Plugin Marketplace
+*
+* Used by the install/update/proxy endpoints in EmDash core to communicate
+* with the marketplace Worker. The marketplace is a distribution channel,
+* not a runtime dependency — bundles are copied to site-local R2 at install time.
+*/
+const TRAILING_SLASHES = /\/+$/;
+const LEADING_DOT_SLASH = /^\.\//;
+var MarketplaceError = class extends Error {
+	constructor(message, status, code) {
+		super(message);
+		this.status = status;
+		this.code = code;
+		this.name = "MarketplaceError";
+	}
+};
+var MarketplaceUnavailableError = class extends MarketplaceError {
+	constructor(cause) {
+		super("Plugin marketplace is unavailable", void 0, "MARKETPLACE_UNAVAILABLE");
+		if (cause) this.cause = cause;
+	}
+};
+const MAX_REDIRECTS = 5;
+/**
+* Fetches a marketplace URL, following redirects only while they stay on
+* that URL's origin. Throws a `MarketplaceError` coded
+* `${codePrefix}_REDIRECT_UNTRUSTED` or `${codePrefix}_TOO_MANY_REDIRECTS`.
+*/
+async function fetchWithinOrigin(url, label, codePrefix) {
+	const origin = new URL(url).origin;
+	let currentUrl = url;
+	let response = await fetch(currentUrl, { redirect: "manual" });
+	for (let i = 0; i < MAX_REDIRECTS; i++) {
+		if (response.status < 300 || response.status >= 400) break;
+		const location = response.headers.get("location");
+		if (!location) break;
+		const target = new URL(location, currentUrl);
+		if (target.origin !== origin) throw new MarketplaceError(`${label} redirected to untrusted host: ${target.origin}`, response.status, `${codePrefix}_REDIRECT_UNTRUSTED`);
+		currentUrl = target.href;
+		response = await fetch(currentUrl, { redirect: "manual" });
+	}
+	if (response.status >= 300 && response.status < 400) throw new MarketplaceError(`${label} exceeded maximum redirects (${MAX_REDIRECTS})`, response.status, `${codePrefix}_TOO_MANY_REDIRECTS`);
+	return response;
+}
+var MarketplaceClientImpl = class {
+	baseUrl;
+	siteOrigin;
+	constructor(baseUrl, siteOrigin) {
+		this.baseUrl = baseUrl.replace(TRAILING_SLASHES, "");
+		this.siteOrigin = siteOrigin;
+	}
+	async search(query, opts) {
+		const params = new URLSearchParams();
+		if (query) params.set("q", query);
+		if (opts?.category) params.set("category", opts.category);
+		if (opts?.capability) params.set("capability", opts.capability);
+		if (opts?.sort) params.set("sort", opts.sort);
+		if (opts?.cursor) params.set("cursor", opts.cursor);
+		if (opts?.limit) params.set("limit", String(opts.limit));
+		const qs = params.toString();
+		const url = `${this.baseUrl}/api/v1/plugins${qs ? `?${qs}` : ""}`;
+		return await this.fetchJson(url);
+	}
+	async getPlugin(id) {
+		const url = `${this.baseUrl}/api/v1/plugins/${encodeURIComponent(id)}`;
+		return this.fetchJson(url);
+	}
+	async getVersions(id) {
+		const url = `${this.baseUrl}/api/v1/plugins/${encodeURIComponent(id)}/versions`;
+		return (await this.fetchJson(url)).items;
+	}
+	async downloadBundle(id, version) {
+		const bundleUrl = `${this.baseUrl}/api/v1/plugins/${encodeURIComponent(id)}/versions/${encodeURIComponent(version)}/bundle`;
+		let response;
+		try {
+			response = await fetchWithinOrigin(bundleUrl, "Bundle download", "BUNDLE");
+		} catch (err) {
+			if (err instanceof MarketplaceError) throw err;
+			throw new MarketplaceUnavailableError(err);
+		}
+		if (!response.ok) throw new MarketplaceError(`Failed to download bundle: ${response.status} ${response.statusText}`, response.status, "BUNDLE_DOWNLOAD_FAILED");
+		const tarballBytes = new Uint8Array(await response.arrayBuffer());
+		try {
+			return await extractBundle(tarballBytes);
+		} catch (err) {
+			if (err instanceof MarketplaceError) throw err;
+			throw new MarketplaceError("Failed to extract plugin bundle", void 0, "BUNDLE_EXTRACT_FAILED");
+		}
+	}
+	async reportInstall(id, version) {
+		const siteHash = await generateSiteHash(this.siteOrigin);
+		const url = `${this.baseUrl}/api/v1/plugins/${encodeURIComponent(id)}/installs`;
+		try {
+			await fetch(url, {
+				method: "POST",
+				headers: { "Content-Type": "application/json" },
+				body: JSON.stringify({
+					siteHash,
+					version
+				})
+			});
+		} catch {}
+	}
+	async searchThemes(query, opts) {
+		const params = new URLSearchParams();
+		if (query) params.set("q", query);
+		if (opts?.keyword) params.set("keyword", opts.keyword);
+		if (opts?.sort) params.set("sort", opts.sort);
+		if (opts?.cursor) params.set("cursor", opts.cursor);
+		if (opts?.limit) params.set("limit", String(opts.limit));
+		const qs = params.toString();
+		const url = `${this.baseUrl}/api/v1/themes${qs ? `?${qs}` : ""}`;
+		return this.fetchJson(url);
+	}
+	async getTheme(id) {
+		const url = `${this.baseUrl}/api/v1/themes/${encodeURIComponent(id)}`;
+		return this.fetchJson(url);
+	}
+	async fetchJson(url) {
+		let response;
+		try {
+			response = await fetch(url, { headers: { Accept: "application/json" } });
+		} catch (err) {
+			throw new MarketplaceUnavailableError(err);
+		}
+		if (!response.ok) {
+			let errorMessage = `Marketplace request failed: ${response.status}`;
+			try {
+				const body = await response.json();
+				if (body.error) errorMessage = body.error;
+			} catch {}
+			throw new MarketplaceError(errorMessage, response.status);
+		}
+		return await response.json();
+	}
+};
+/**
+* Extract manifest + code files from a tarball.
+*
+* The tarball is a gzipped tar archive containing:
+* - manifest.json
+* - backend.js
+* - admin.js (optional)
+*
+* We use a minimal tar parser since we only need to read a few small files.
+*/
+/**
+* Exported so the experimental registry install handler can reuse the
+* same parse / validate / hash primitive. Despite the file name, this
+* function predates the marketplace-vs-registry split and is generic
+* over plugin bundle tarballs regardless of distribution channel.
+*/
+const MAX_DECOMPRESSED_BUNDLE_BYTES = 256 * 1024;
+const MAX_BUNDLE_TAR_ENTRIES = 32;
+async function extractBundle(tarballBytes) {
+	const reader = new ReadableStream({ start(controller) {
+		controller.enqueue(tarballBytes);
+		controller.close();
+	} }).pipeThrough(createGzipDecoder()).getReader();
+	const chunks = [];
+	let total = 0;
+	while (true) {
+		const { done, value } = await reader.read();
+		if (done) break;
+		if (!value) continue;
+		total += value.byteLength;
+		if (total > MAX_DECOMPRESSED_BUNDLE_BYTES) {
+			try {
+				await reader.cancel();
+			} catch {}
+			throw new MarketplaceError(`Bundle decompressed size exceeds limit (${MAX_DECOMPRESSED_BUNDLE_BYTES} bytes)`, void 0, "INVALID_BUNDLE");
+		}
+		chunks.push(value);
+	}
+	const decompressedBytes = new Uint8Array(total);
+	{
+		let offset = 0;
+		for (const chunk of chunks) {
+			decompressedBytes.set(chunk, offset);
+			offset += chunk.byteLength;
+		}
+	}
+	const entries = await unpackTar(new ReadableStream({ start(controller) {
+		controller.enqueue(decompressedBytes);
+		controller.close();
+	} }));
+	if (entries.length > MAX_BUNDLE_TAR_ENTRIES) throw new MarketplaceError(`Bundle has too many tar entries (${entries.length} > ${MAX_BUNDLE_TAR_ENTRIES})`, void 0, "INVALID_BUNDLE");
+	const decoder = new TextDecoder();
+	const files = /* @__PURE__ */ new Map();
+	for (const entry of entries) if (entry.data && entry.header.type === "file") {
+		const name = entry.header.name.replace(LEADING_DOT_SLASH, "");
+		files.set(name, decoder.decode(entry.data));
+	}
+	const manifestJson = files.get("manifest.json");
+	const backendCode = files.get("backend.js");
+	if (!manifestJson) throw new MarketplaceError("Invalid bundle: missing manifest.json", void 0, "INVALID_BUNDLE");
+	if (!backendCode) throw new MarketplaceError("Invalid bundle: missing backend.js", void 0, "INVALID_BUNDLE");
+	let manifest;
+	try {
+		const parsed = JSON.parse(manifestJson);
+		const result = pluginManifestSchema.safeParse(parsed);
+		if (!result.success) throw new MarketplaceError("Invalid bundle: manifest.json failed validation", void 0, "INVALID_BUNDLE");
+		manifest = reconcileManifestAccess(result.data);
+	} catch (err) {
+		if (err instanceof MarketplaceError) throw err;
+		throw new MarketplaceError("Invalid bundle: malformed manifest.json", void 0, "INVALID_BUNDLE");
+	}
+	const hashBuffer = await crypto.subtle.digest("SHA-256", tarballBytes);
+	const hashArray = new Uint8Array(hashBuffer);
+	const checksum = Array.from(hashArray, (b) => b.toString(16).padStart(2, "0")).join("");
+	return {
+		manifest,
+		backendCode,
+		adminCode: files.get("admin.js"),
+		checksum
+	};
+}
+/**
+* Generate a stable non-identifying site hash from the site origin.
+* The same origin always produces the same hash, so the marketplace
+* installs table deduplicates correctly per (plugin_id, site_hash).
+*/
+async function generateSiteHash(siteOrigin) {
+	const seed = siteOrigin ? `emdash-site:${siteOrigin}` : `emdash-anonymous`;
+	try {
+		const hash = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(seed));
+		const arr = new Uint8Array(hash);
+		return Array.from(arr.slice(0, 8), (b) => b.toString(16).padStart(2, "0")).join("");
+	} catch {
+		let h = 2166136261;
+		for (let i = 0; i < seed.length; i++) {
+			h ^= seed.charCodeAt(i);
+			h = Math.imul(h, 16777619);
+		}
+		const h2 = h ^ h >>> 16;
+		return (h >>> 0).toString(16).padStart(8, "0") + (h2 >>> 0).toString(16).padStart(8, "0");
+	}
+}
+/**
+* Create a MarketplaceClient for the given marketplace URL.
+*
+* @param baseUrl - The marketplace API base URL (e.g. "https://marketplace.emdashcms.com")
+* @param siteOrigin - The origin of the EmDash site (e.g. "https://myblog.example.com").
+*   Used to generate a stable, non-identifying site hash for install deduplication.
+*/
+function createMarketplaceClient(baseUrl, siteOrigin) {
+	return new MarketplaceClientImpl(baseUrl, siteOrigin);
+}
+
+//#endregion
+export { fetchWithinOrigin as i, MarketplaceUnavailableError as n, createMarketplaceClient as r, MarketplaceError as t };
+//# sourceMappingURL=marketplace-DNvEGLqU.mjs.map

package/dist/marketplace-DNvEGLqU.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"marketplace-DNvEGLqU.mjs","names":[],"sources":["../src/plugins/marketplace.ts"],"sourcesContent":["/**\n * MarketplaceClient — HTTP client for the EmDash Plugin Marketplace\n *\n * Used by the install/update/proxy endpoints in EmDash core to communicate\n * with the marketplace Worker. The marketplace is a distribution channel,\n * not a runtime dependency — bundles are copied to site-local R2 at install time.\n */\n\nimport { createGzipDecoder, unpackTar } from \"modern-tar\";\n\nimport { pluginManifestSchema, reconcileManifestAccess } from \"./manifest-schema.js\";\nimport type { PluginManifest } from \"./types.js\";\n\n// ── Module-level regex patterns ───────────────────────────────────\n\nconst TRAILING_SLASHES = /\\/+$/;\nconst LEADING_DOT_SLASH = /^\\.\\//;\n\n// ── Types ──────────────────────────────────────────────────────────\n\nexport interface MarketplacePluginSummary {\n\tid: string;\n\tname: string;\n\tdescription: string | null;\n\tauthor: {\n\t\tname: string;\n\t\tverified: boolean;\n\t\tavatarUrl: string | null;\n\t};\n\tcapabilities: string[];\n\tkeywords: string[];\n\tinstallCount: number;\n\thasIcon: boolean;\n\ticonUrl: string;\n\tlatestVersion?: {\n\t\tversion: string;\n\t\taudit?: {\n\t\t\tverdict: string;\n\t\t\triskScore: number;\n\t\t};\n\t\timageAudit?: {\n\t\t\tverdict: string;\n\t\t};\n\t};\n\tcreatedAt: string;\n\tupdatedAt: string;\n}\n\nexport interface MarketplaceVersionSummary {\n\tversion: string;\n\tminEmDashVersion: string | null;\n\tbundleSize: number;\n\tchecksum: string;\n\tchangelog: string | null;\n\tcapabilities: string[];\n\tstatus: string;\n\tauditVerdict: string | null;\n\timageAuditVerdict: string | null;\n\tpublishedAt: string;\n}\n\nexport interface MarketplacePluginDetail extends MarketplacePluginSummary {\n\trepositoryUrl: string | null;\n\thomepageUrl: string | null;\n\tlicense: string | null;\n\tlatestVersion?: {\n\t\tversion: string;\n\t\tminEmDashVersion: string | null;\n\t\tbundleSize: number;\n\t\tchecksum: string;\n\t\tchangelog: string | null;\n\t\treadme: string | null;\n\t\thasIcon: boolean;\n\t\tscreenshotCount: number;\n\t\tscreenshotUrls: string[];\n\t\tcapabilities: string[];\n\t\tstatus: string;\n\t\taudit?: {\n\t\t\tverdict: string;\n\t\t\triskScore: number;\n\t\t};\n\t\timageAudit?: {\n\t\t\tverdict: string;\n\t\t};\n\t\tpublishedAt: string;\n\t};\n}\n\nexport interface MarketplaceSearchOpts {\n\tcategory?: string;\n\tcapability?: string;\n\tsort?: \"installs\" | \"updated\" | \"created\" | \"name\";\n\tcursor?: string;\n\tlimit?: number;\n}\n\nexport interface MarketplaceSearchResult {\n\titems: MarketplacePluginSummary[];\n\tnextCursor?: string;\n}\n\n// ── Theme types ───────────────────────────────────────────────────\n\nexport interface MarketplaceThemeSummary {\n\tid: string;\n\tname: string;\n\tdescription: string | null;\n\tauthor: {\n\t\tname: string;\n\t\tverified: boolean;\n\t\tavatarUrl: string | null;\n\t};\n\tkeywords: string[];\n\tpreviewUrl: string;\n\tdemoUrl: string | null;\n\thasThumbnail: boolean;\n\tthumbnailUrl: string | null;\n\tcreatedAt: string;\n\tupdatedAt: string;\n}\n\nexport interface MarketplaceThemeDetail extends MarketplaceThemeSummary {\n\tauthor: {\n\t\tid: string;\n\t\tname: string;\n\t\tverified: boolean;\n\t\tavatarUrl: string | null;\n\t};\n\trepositoryUrl: string | null;\n\thomepageUrl: string | null;\n\tlicense: string | null;\n\tscreenshotCount: number;\n\tscreenshotUrls: string[];\n}\n\nexport interface MarketplaceThemeSearchOpts {\n\tkeyword?: string;\n\tsort?: \"name\" | \"created\" | \"updated\";\n\tcursor?: string;\n\tlimit?: number;\n}\n\nexport interface MarketplaceThemeSearchResult {\n\titems: MarketplaceThemeSummary[];\n\tnextCursor?: string;\n}\n\nexport interface PluginBundle {\n\tmanifest: PluginManifest;\n\tbackendCode: string;\n\tadminCode?: string;\n\tchecksum: string;\n}\n\n// ── Interface ──────────────────────────────────────────────────────\n\nexport interface MarketplaceClient {\n\t/** Search the marketplace catalog */\n\tsearch(query?: string, opts?: MarketplaceSearchOpts): Promise<MarketplaceSearchResult>;\n\n\t/** Get full plugin detail */\n\tgetPlugin(id: string): Promise<MarketplacePluginDetail>;\n\n\t/** Get version history for a plugin */\n\tgetVersions(id: string): Promise<MarketplaceVersionSummary[]>;\n\n\t/** Download and extract a plugin bundle */\n\tdownloadBundle(id: string, version: string): Promise<PluginBundle>;\n\n\t/** Fire-and-forget install stat (never throws) */\n\treportInstall(id: string, version: string): Promise<void>;\n\n\t/** Search theme listings */\n\tsearchThemes(\n\t\tquery?: string,\n\t\topts?: MarketplaceThemeSearchOpts,\n\t): Promise<MarketplaceThemeSearchResult>;\n\n\t/** Get full theme detail */\n\tgetTheme(id: string): Promise<MarketplaceThemeDetail>;\n}\n\n// ── Errors ─────────────────────────────────────────────────────────\n\nexport class MarketplaceError extends Error {\n\tconstructor(\n\t\tmessage: string,\n\t\tpublic readonly status?: number,\n\t\tpublic readonly code?: string,\n\t) {\n\t\tsuper(message);\n\t\tthis.name = \"MarketplaceError\";\n\t}\n}\n\nexport class MarketplaceUnavailableError extends MarketplaceError {\n\tconstructor(cause?: unknown) {\n\t\tsuper(\"Plugin marketplace is unavailable\", undefined, \"MARKETPLACE_UNAVAILABLE\");\n\t\tif (cause) this.cause = cause;\n\t}\n}\n\nconst MAX_REDIRECTS = 5;\n\n/**\n * Fetches a marketplace URL, following redirects only while they stay on\n * that URL's origin. Throws a `MarketplaceError` coded\n * `${codePrefix}_REDIRECT_UNTRUSTED` or `${codePrefix}_TOO_MANY_REDIRECTS`.\n */\nexport async function fetchWithinOrigin(\n\turl: string,\n\tlabel: string,\n\tcodePrefix: string,\n): Promise<Response> {\n\tconst origin = new URL(url).origin;\n\tlet currentUrl = url;\n\tlet response = await fetch(currentUrl, { redirect: \"manual\" });\n\n\tfor (let i = 0; i < MAX_REDIRECTS; i++) {\n\t\tif (response.status < 300 || response.status >= 400) break;\n\n\t\tconst location = response.headers.get(\"location\");\n\t\tif (!location) break;\n\n\t\tconst target = new URL(location, currentUrl);\n\t\tif (target.origin !== origin) {\n\t\t\tthrow new MarketplaceError(\n\t\t\t\t`${label} redirected to untrusted host: ${target.origin}`,\n\t\t\t\tresponse.status,\n\t\t\t\t`${codePrefix}_REDIRECT_UNTRUSTED`,\n\t\t\t);\n\t\t}\n\t\tcurrentUrl = target.href;\n\t\tresponse = await fetch(currentUrl, { redirect: \"manual\" });\n\t}\n\n\tif (response.status >= 300 && response.status < 400) {\n\t\tthrow new MarketplaceError(\n\t\t\t`${label} exceeded maximum redirects (${MAX_REDIRECTS})`,\n\t\t\tresponse.status,\n\t\t\t`${codePrefix}_TOO_MANY_REDIRECTS`,\n\t\t);\n\t}\n\treturn response;\n}\n\n// ── Implementation ─────────────────────────────────────────────────\n\nclass MarketplaceClientImpl implements MarketplaceClient {\n\tprivate readonly baseUrl: string;\n\tprivate readonly siteOrigin: string | undefined;\n\n\tconstructor(baseUrl: string, siteOrigin?: string) {\n\t\t// Strip trailing slash\n\t\tthis.baseUrl = baseUrl.replace(TRAILING_SLASHES, \"\");\n\t\tthis.siteOrigin = siteOrigin;\n\t}\n\n\tasync search(query?: string, opts?: MarketplaceSearchOpts): Promise<MarketplaceSearchResult> {\n\t\tconst params = new URLSearchParams();\n\t\tif (query) params.set(\"q\", query);\n\t\tif (opts?.category) params.set(\"category\", opts.category);\n\t\tif (opts?.capability) params.set(\"capability\", opts.capability);\n\t\tif (opts?.sort) params.set(\"sort\", opts.sort);\n\t\tif (opts?.cursor) params.set(\"cursor\", opts.cursor);\n\t\tif (opts?.limit) params.set(\"limit\", String(opts.limit));\n\n\t\tconst qs = params.toString();\n\t\tconst url = `${this.baseUrl}/api/v1/plugins${qs ? `?${qs}` : \"\"}`;\n\t\tconst data = await this.fetchJson<MarketplaceSearchResult>(url);\n\t\treturn data;\n\t}\n\n\tasync getPlugin(id: string): Promise<MarketplacePluginDetail> {\n\t\tconst url = `${this.baseUrl}/api/v1/plugins/${encodeURIComponent(id)}`;\n\t\treturn this.fetchJson<MarketplacePluginDetail>(url);\n\t}\n\n\tasync getVersions(id: string): Promise<MarketplaceVersionSummary[]> {\n\t\tconst url = `${this.baseUrl}/api/v1/plugins/${encodeURIComponent(id)}/versions`;\n\t\tconst data = await this.fetchJson<{ items: MarketplaceVersionSummary[] }>(url);\n\t\treturn data.items;\n\t}\n\n\tasync downloadBundle(id: string, version: string): Promise<PluginBundle> {\n\t\tconst bundleUrl = `${this.baseUrl}/api/v1/plugins/${encodeURIComponent(id)}/versions/${encodeURIComponent(version)}/bundle`;\n\n\t\tlet response: Response;\n\t\ttry {\n\t\t\tresponse = await fetchWithinOrigin(bundleUrl, \"Bundle download\", \"BUNDLE\");\n\t\t} catch (err) {\n\t\t\tif (err instanceof MarketplaceError) throw err;\n\t\t\tthrow new MarketplaceUnavailableError(err);\n\t\t}\n\n\t\tif (!response.ok) {\n\t\t\tthrow new MarketplaceError(\n\t\t\t\t`Failed to download bundle: ${response.status} ${response.statusText}`,\n\t\t\t\tresponse.status,\n\t\t\t\t\"BUNDLE_DOWNLOAD_FAILED\",\n\t\t\t);\n\t\t}\n\n\t\tconst tarballBytes = new Uint8Array(await response.arrayBuffer());\n\t\ttry {\n\t\t\treturn await extractBundle(tarballBytes);\n\t\t} catch (err) {\n\t\t\tif (err instanceof MarketplaceError) throw err;\n\t\t\tthrow new MarketplaceError(\n\t\t\t\t\"Failed to extract plugin bundle\",\n\t\t\t\tundefined,\n\t\t\t\t\"BUNDLE_EXTRACT_FAILED\",\n\t\t\t);\n\t\t}\n\t}\n\n\tasync reportInstall(id: string, version: string): Promise<void> {\n\t\t// Generate a stable site hash from the site origin (best-effort, non-identifying)\n\t\tconst siteHash = await generateSiteHash(this.siteOrigin);\n\t\tconst url = `${this.baseUrl}/api/v1/plugins/${encodeURIComponent(id)}/installs`;\n\n\t\ttry {\n\t\t\tawait fetch(url, {\n\t\t\t\tmethod: \"POST\",\n\t\t\t\theaders: { \"Content-Type\": \"application/json\" },\n\t\t\t\tbody: JSON.stringify({ siteHash, version }),\n\t\t\t});\n\t\t} catch {\n\t\t\t// Fire-and-forget — never throw\n\t\t}\n\t}\n\n\tasync searchThemes(\n\t\tquery?: string,\n\t\topts?: MarketplaceThemeSearchOpts,\n\t): Promise<MarketplaceThemeSearchResult> {\n\t\tconst params = new URLSearchParams();\n\t\tif (query) params.set(\"q\", query);\n\t\tif (opts?.keyword) params.set(\"keyword\", opts.keyword);\n\t\tif (opts?.sort) params.set(\"sort\", opts.sort);\n\t\tif (opts?.cursor) params.set(\"cursor\", opts.cursor);\n\t\tif (opts?.limit) params.set(\"limit\", String(opts.limit));\n\n\t\tconst qs = params.toString();\n\t\tconst url = `${this.baseUrl}/api/v1/themes${qs ? `?${qs}` : \"\"}`;\n\t\treturn this.fetchJson<MarketplaceThemeSearchResult>(url);\n\t}\n\n\tasync getTheme(id: string): Promise<MarketplaceThemeDetail> {\n\t\tconst url = `${this.baseUrl}/api/v1/themes/${encodeURIComponent(id)}`;\n\t\treturn this.fetchJson<MarketplaceThemeDetail>(url);\n\t}\n\n\tprivate async fetchJson<T>(url: string): Promise<T> {\n\t\tlet response: Response;\n\t\ttry {\n\t\t\tresponse = await fetch(url, {\n\t\t\t\theaders: { Accept: \"application/json\" },\n\t\t\t});\n\t\t} catch (err) {\n\t\t\tthrow new MarketplaceUnavailableError(err);\n\t\t}\n\n\t\tif (!response.ok) {\n\t\t\tlet errorMessage = `Marketplace request failed: ${response.status}`;\n\t\t\ttry {\n\t\t\t\tconst body: { error?: string } = await response.json();\n\t\t\t\tif (body.error) errorMessage = body.error;\n\t\t\t} catch {\n\t\t\t\t// use default message\n\t\t\t}\n\t\t\tthrow new MarketplaceError(errorMessage, response.status);\n\t\t}\n\n\t\tconst data: T = await response.json();\n\t\treturn data;\n\t}\n}\n\n// ── Bundle extraction ──────────────────────────────────────────────\n\n/**\n * Extract manifest + code files from a tarball.\n *\n * The tarball is a gzipped tar archive containing:\n * - manifest.json\n * - backend.js\n * - admin.js (optional)\n *\n * We use a minimal tar parser since we only need to read a few small files.\n */\n/**\n * Exported so the experimental registry install handler can reuse the\n * same parse / validate / hash primitive. Despite the file name, this\n * function predates the marketplace-vs-registry split and is generic\n * over plugin bundle tarballs regardless of distribution channel.\n */\n// Aligns with RFC 0001 §\"Bundle size limits\" (256 KiB decompressed,\n// 20 files). Matches `MAX_BUNDLE_SIZE` in @emdash-cms/plugin-cli. We\n// don't import that constant to keep this runtime module independent\n// of the authoring CLI; the two values must stay in sync.\n//\n// Tar adds per-file headers (~512 bytes each) plus directory entries,\n// so the entry count cap is set comfortably above RFC's 20-file limit.\n// Going over either is a strong signal the bundle isn't a legitimate\n// sandboxed plugin.\nconst MAX_DECOMPRESSED_BUNDLE_BYTES = 256 * 1024;\nconst MAX_BUNDLE_TAR_ENTRIES = 32;\n\nexport async function extractBundle(tarballBytes: Uint8Array): Promise<PluginBundle> {\n\t// Decompress fully into memory first, then parse the tar.\n\t// Passing a pipeThrough() stream directly to unpackTar causes a backpressure\n\t// deadlock in workerd: the tar decoder's body-stream pull() needs more\n\t// decompressed data, but the upstream pipe is stalled waiting for the\n\t// decoder's writable side to drain — a circular dependency.\n\tconst decompressedStream = new ReadableStream<Uint8Array>({\n\t\tstart(controller) {\n\t\t\tcontroller.enqueue(tarballBytes);\n\t\t\tcontroller.close();\n\t\t},\n\t}).pipeThrough(createGzipDecoder());\n\n\t// Collect decompressed bytes with a hard cap. A gzip-bomb -- a small\n\t// tarball that decompresses to gigabytes -- otherwise exhausts\n\t// worker / Node memory before we know to reject it. The cap matches\n\t// RFC 0001's publish-time bundle size limit (MAX_DECOMPRESSED_BUNDLE_BYTES);\n\t// anything past that isn't a legitimate sandboxed plugin.\n\tconst reader = decompressedStream.getReader();\n\tconst chunks: Uint8Array[] = [];\n\tlet total = 0;\n\twhile (true) {\n\t\tconst { done, value } = await reader.read();\n\t\tif (done) break;\n\t\tif (!value) continue;\n\t\ttotal += value.byteLength;\n\t\tif (total > MAX_DECOMPRESSED_BUNDLE_BYTES) {\n\t\t\ttry {\n\t\t\t\tawait reader.cancel();\n\t\t\t} catch {\n\t\t\t\t// nothing to do\n\t\t\t}\n\t\t\tthrow new MarketplaceError(\n\t\t\t\t`Bundle decompressed size exceeds limit (${MAX_DECOMPRESSED_BUNDLE_BYTES} bytes)`,\n\t\t\t\tundefined,\n\t\t\t\t\"INVALID_BUNDLE\",\n\t\t\t);\n\t\t}\n\t\tchunks.push(value);\n\t}\n\tconst decompressedBytes = new Uint8Array(total);\n\t{\n\t\tlet offset = 0;\n\t\tfor (const chunk of chunks) {\n\t\t\tdecompressedBytes.set(chunk, offset);\n\t\t\toffset += chunk.byteLength;\n\t\t}\n\t}\n\n\tconst decompressed = new ReadableStream<Uint8Array>({\n\t\tstart(controller) {\n\t\t\tcontroller.enqueue(decompressedBytes);\n\t\t\tcontroller.close();\n\t\t},\n\t});\n\n\tconst entries = await unpackTar(decompressed);\n\tif (entries.length > MAX_BUNDLE_TAR_ENTRIES) {\n\t\tthrow new MarketplaceError(\n\t\t\t`Bundle has too many tar entries (${entries.length} > ${MAX_BUNDLE_TAR_ENTRIES})`,\n\t\t\tundefined,\n\t\t\t\"INVALID_BUNDLE\",\n\t\t);\n\t}\n\n\tconst decoder = new TextDecoder();\n\tconst files = new Map<string, string>();\n\tfor (const entry of entries) {\n\t\tif (entry.data && entry.header.type === \"file\") {\n\t\t\t// Strip leading ./ prefix that tar tools commonly add\n\t\t\tconst name = entry.header.name.replace(LEADING_DOT_SLASH, \"\");\n\t\t\tfiles.set(name, decoder.decode(entry.data));\n\t\t}\n\t}\n\n\tconst manifestJson = files.get(\"manifest.json\");\n\tconst backendCode = files.get(\"backend.js\");\n\n\tif (!manifestJson) {\n\t\tthrow new MarketplaceError(\n\t\t\t\"Invalid bundle: missing manifest.json\",\n\t\t\tundefined,\n\t\t\t\"INVALID_BUNDLE\",\n\t\t);\n\t}\n\tif (!backendCode) {\n\t\tthrow new MarketplaceError(\"Invalid bundle: missing backend.js\", undefined, \"INVALID_BUNDLE\");\n\t}\n\n\tlet manifest: PluginManifest;\n\ttry {\n\t\tconst parsed: unknown = JSON.parse(manifestJson);\n\t\tconst result = pluginManifestSchema.safeParse(parsed);\n\t\tif (!result.success) {\n\t\t\tthrow new MarketplaceError(\n\t\t\t\t\"Invalid bundle: manifest.json failed validation\",\n\t\t\t\tundefined,\n\t\t\t\t\"INVALID_BUNDLE\",\n\t\t\t);\n\t\t}\n\t\tmanifest = reconcileManifestAccess(result.data);\n\t} catch (err) {\n\t\tif (err instanceof MarketplaceError) throw err;\n\t\tthrow new MarketplaceError(\n\t\t\t\"Invalid bundle: malformed manifest.json\",\n\t\t\tundefined,\n\t\t\t\"INVALID_BUNDLE\",\n\t\t);\n\t}\n\n\t// Compute SHA-256 checksum of the tarball for verification\n\t// eslint-disable-next-line typescript/no-unsafe-type-assertion -- Uint8Array is a valid BufferSource at runtime; TS lib mismatch\n\tconst hashBuffer = await crypto.subtle.digest(\"SHA-256\", tarballBytes as unknown as BufferSource);\n\tconst hashArray = new Uint8Array(hashBuffer);\n\tconst checksum = Array.from(hashArray, (b) => b.toString(16).padStart(2, \"0\")).join(\"\");\n\n\treturn {\n\t\tmanifest,\n\t\tbackendCode,\n\t\tadminCode: files.get(\"admin.js\"),\n\t\tchecksum,\n\t};\n}\n\n// ── Helpers ────────────────────────────────────────────────────────\n\n/**\n * Generate a stable non-identifying site hash from the site origin.\n * The same origin always produces the same hash, so the marketplace\n * installs table deduplicates correctly per (plugin_id, site_hash).\n */\nasync function generateSiteHash(siteOrigin?: string): Promise<string> {\n\tconst seed = siteOrigin ? `emdash-site:${siteOrigin}` : `emdash-anonymous`;\n\ttry {\n\t\tconst hash = await crypto.subtle.digest(\"SHA-256\", new TextEncoder().encode(seed));\n\t\tconst arr = new Uint8Array(hash);\n\t\treturn Array.from(arr.slice(0, 8), (b) => b.toString(16).padStart(2, \"0\")).join(\"\");\n\t} catch {\n\t\t// Fallback for environments without crypto.subtle: FNV-1a hash encoded as hex.\n\t\t// Deterministic, uniform distribution, no origin leakage.\n\t\tlet h = 0x811c9dc5;\n\t\tfor (let i = 0; i < seed.length; i++) {\n\t\t\th ^= seed.charCodeAt(i);\n\t\t\th = Math.imul(h, 0x01000193);\n\t\t}\n\t\tconst h2 = h ^ (h >>> 16);\n\t\treturn (h >>> 0).toString(16).padStart(8, \"0\") + (h2 >>> 0).toString(16).padStart(8, \"0\");\n\t}\n}\n\n// ── Factory ────────────────────────────────────────────────────────\n\n/**\n * Create a MarketplaceClient for the given marketplace URL.\n *\n * @param baseUrl - The marketplace API base URL (e.g. \"https://marketplace.emdashcms.com\")\n * @param siteOrigin - The origin of the EmDash site (e.g. \"https://myblog.example.com\").\n *   Used to generate a stable, non-identifying site hash for install deduplication.\n */\nexport function createMarketplaceClient(baseUrl: string, siteOrigin?: string): MarketplaceClient {\n\treturn new MarketplaceClientImpl(baseUrl, siteOrigin);\n}\n"],"mappings":";;;;;;;;;;;AAeA,MAAM,mBAAmB;AACzB,MAAM,oBAAoB;AAwK1B,IAAa,mBAAb,cAAsC,MAAM;CAC3C,YACC,SACA,AAAgB,QAChB,AAAgB,MACf;AACD,QAAM,QAAQ;EAHE;EACA;AAGhB,OAAK,OAAO;;;AAId,IAAa,8BAAb,cAAiD,iBAAiB;CACjE,YAAY,OAAiB;AAC5B,QAAM,qCAAqC,QAAW,0BAA0B;AAChF,MAAI,MAAO,MAAK,QAAQ;;;AAI1B,MAAM,gBAAgB;;;;;;AAOtB,eAAsB,kBACrB,KACA,OACA,YACoB;CACpB,MAAM,SAAS,IAAI,IAAI,IAAI,CAAC;CAC5B,IAAI,aAAa;CACjB,IAAI,WAAW,MAAM,MAAM,YAAY,EAAE,UAAU,UAAU,CAAC;AAE9D,MAAK,IAAI,IAAI,GAAG,IAAI,eAAe,KAAK;AACvC,MAAI,SAAS,SAAS,OAAO,SAAS,UAAU,IAAK;EAErD,MAAM,WAAW,SAAS,QAAQ,IAAI,WAAW;AACjD,MAAI,CAAC,SAAU;EAEf,MAAM,SAAS,IAAI,IAAI,UAAU,WAAW;AAC5C,MAAI,OAAO,WAAW,OACrB,OAAM,IAAI,iBACT,GAAG,MAAM,iCAAiC,OAAO,UACjD,SAAS,QACT,GAAG,WAAW,qBACd;AAEF,eAAa,OAAO;AACpB,aAAW,MAAM,MAAM,YAAY,EAAE,UAAU,UAAU,CAAC;;AAG3D,KAAI,SAAS,UAAU,OAAO,SAAS,SAAS,IAC/C,OAAM,IAAI,iBACT,GAAG,MAAM,+BAA+B,cAAc,IACtD,SAAS,QACT,GAAG,WAAW,qBACd;AAEF,QAAO;;AAKR,IAAM,wBAAN,MAAyD;CACxD,AAAiB;CACjB,AAAiB;CAEjB,YAAY,SAAiB,YAAqB;AAEjD,OAAK,UAAU,QAAQ,QAAQ,kBAAkB,GAAG;AACpD,OAAK,aAAa;;CAGnB,MAAM,OAAO,OAAgB,MAAgE;EAC5F,MAAM,SAAS,IAAI,iBAAiB;AACpC,MAAI,MAAO,QAAO,IAAI,KAAK,MAAM;AACjC,MAAI,MAAM,SAAU,QAAO,IAAI,YAAY,KAAK,SAAS;AACzD,MAAI,MAAM,WAAY,QAAO,IAAI,cAAc,KAAK,WAAW;AAC/D,MAAI,MAAM,KAAM,QAAO,IAAI,QAAQ,KAAK,KAAK;AAC7C,MAAI,MAAM,OAAQ,QAAO,IAAI,UAAU,KAAK,OAAO;AACnD,MAAI,MAAM,MAAO,QAAO,IAAI,SAAS,OAAO,KAAK,MAAM,CAAC;EAExD,MAAM,KAAK,OAAO,UAAU;EAC5B,MAAM,MAAM,GAAG,KAAK,QAAQ,iBAAiB,KAAK,IAAI,OAAO;AAE7D,SADa,MAAM,KAAK,UAAmC,IAAI;;CAIhE,MAAM,UAAU,IAA8C;EAC7D,MAAM,MAAM,GAAG,KAAK,QAAQ,kBAAkB,mBAAmB,GAAG;AACpE,SAAO,KAAK,UAAmC,IAAI;;CAGpD,MAAM,YAAY,IAAkD;EACnE,MAAM,MAAM,GAAG,KAAK,QAAQ,kBAAkB,mBAAmB,GAAG,CAAC;AAErE,UADa,MAAM,KAAK,UAAkD,IAAI,EAClE;;CAGb,MAAM,eAAe,IAAY,SAAwC;EACxE,MAAM,YAAY,GAAG,KAAK,QAAQ,kBAAkB,mBAAmB,GAAG,CAAC,YAAY,mBAAmB,QAAQ,CAAC;EAEnH,IAAI;AACJ,MAAI;AACH,cAAW,MAAM,kBAAkB,WAAW,mBAAmB,SAAS;WAClE,KAAK;AACb,OAAI,eAAe,iBAAkB,OAAM;AAC3C,SAAM,IAAI,4BAA4B,IAAI;;AAG3C,MAAI,CAAC,SAAS,GACb,OAAM,IAAI,iBACT,8BAA8B,SAAS,OAAO,GAAG,SAAS,cAC1D,SAAS,QACT,yBACA;EAGF,MAAM,eAAe,IAAI,WAAW,MAAM,SAAS,aAAa,CAAC;AACjE,MAAI;AACH,UAAO,MAAM,cAAc,aAAa;WAChC,KAAK;AACb,OAAI,eAAe,iBAAkB,OAAM;AAC3C,SAAM,IAAI,iBACT,mCACA,QACA,wBACA;;;CAIH,MAAM,cAAc,IAAY,SAAgC;EAE/D,MAAM,WAAW,MAAM,iBAAiB,KAAK,WAAW;EACxD,MAAM,MAAM,GAAG,KAAK,QAAQ,kBAAkB,mBAAmB,GAAG,CAAC;AAErE,MAAI;AACH,SAAM,MAAM,KAAK;IAChB,QAAQ;IACR,SAAS,EAAE,gBAAgB,oBAAoB;IAC/C,MAAM,KAAK,UAAU;KAAE;KAAU;KAAS,CAAC;IAC3C,CAAC;UACK;;CAKT,MAAM,aACL,OACA,MACwC;EACxC,MAAM,SAAS,IAAI,iBAAiB;AACpC,MAAI,MAAO,QAAO,IAAI,KAAK,MAAM;AACjC,MAAI,MAAM,QAAS,QAAO,IAAI,WAAW,KAAK,QAAQ;AACtD,MAAI,MAAM,KAAM,QAAO,IAAI,QAAQ,KAAK,KAAK;AAC7C,MAAI,MAAM,OAAQ,QAAO,IAAI,UAAU,KAAK,OAAO;AACnD,MAAI,MAAM,MAAO,QAAO,IAAI,SAAS,OAAO,KAAK,MAAM,CAAC;EAExD,MAAM,KAAK,OAAO,UAAU;EAC5B,MAAM,MAAM,GAAG,KAAK,QAAQ,gBAAgB,KAAK,IAAI,OAAO;AAC5D,SAAO,KAAK,UAAwC,IAAI;;CAGzD,MAAM,SAAS,IAA6C;EAC3D,MAAM,MAAM,GAAG,KAAK,QAAQ,iBAAiB,mBAAmB,GAAG;AACnE,SAAO,KAAK,UAAkC,IAAI;;CAGnD,MAAc,UAAa,KAAyB;EACnD,IAAI;AACJ,MAAI;AACH,cAAW,MAAM,MAAM,KAAK,EAC3B,SAAS,EAAE,QAAQ,oBAAoB,EACvC,CAAC;WACM,KAAK;AACb,SAAM,IAAI,4BAA4B,IAAI;;AAG3C,MAAI,CAAC,SAAS,IAAI;GACjB,IAAI,eAAe,+BAA+B,SAAS;AAC3D,OAAI;IACH,MAAM,OAA2B,MAAM,SAAS,MAAM;AACtD,QAAI,KAAK,MAAO,gBAAe,KAAK;WAC7B;AAGR,SAAM,IAAI,iBAAiB,cAAc,SAAS,OAAO;;AAI1D,SADgB,MAAM,SAAS,MAAM;;;;;;;;;;;;;;;;;;;AAgCvC,MAAM,gCAAgC,MAAM;AAC5C,MAAM,yBAAyB;AAE/B,eAAsB,cAAc,cAAiD;CAkBpF,MAAM,SAZqB,IAAI,eAA2B,EACzD,MAAM,YAAY;AACjB,aAAW,QAAQ,aAAa;AAChC,aAAW,OAAO;IAEnB,CAAC,CAAC,YAAY,mBAAmB,CAAC,CAOD,WAAW;CAC7C,MAAM,SAAuB,EAAE;CAC/B,IAAI,QAAQ;AACZ,QAAO,MAAM;EACZ,MAAM,EAAE,MAAM,UAAU,MAAM,OAAO,MAAM;AAC3C,MAAI,KAAM;AACV,MAAI,CAAC,MAAO;AACZ,WAAS,MAAM;AACf,MAAI,QAAQ,+BAA+B;AAC1C,OAAI;AACH,UAAM,OAAO,QAAQ;WACd;AAGR,SAAM,IAAI,iBACT,2CAA2C,8BAA8B,UACzE,QACA,iBACA;;AAEF,SAAO,KAAK,MAAM;;CAEnB,MAAM,oBAAoB,IAAI,WAAW,MAAM;CAC/C;EACC,IAAI,SAAS;AACb,OAAK,MAAM,SAAS,QAAQ;AAC3B,qBAAkB,IAAI,OAAO,OAAO;AACpC,aAAU,MAAM;;;CAWlB,MAAM,UAAU,MAAM,UAPD,IAAI,eAA2B,EACnD,MAAM,YAAY;AACjB,aAAW,QAAQ,kBAAkB;AACrC,aAAW,OAAO;IAEnB,CAAC,CAE2C;AAC7C,KAAI,QAAQ,SAAS,uBACpB,OAAM,IAAI,iBACT,oCAAoC,QAAQ,OAAO,KAAK,uBAAuB,IAC/E,QACA,iBACA;CAGF,MAAM,UAAU,IAAI,aAAa;CACjC,MAAM,wBAAQ,IAAI,KAAqB;AACvC,MAAK,MAAM,SAAS,QACnB,KAAI,MAAM,QAAQ,MAAM,OAAO,SAAS,QAAQ;EAE/C,MAAM,OAAO,MAAM,OAAO,KAAK,QAAQ,mBAAmB,GAAG;AAC7D,QAAM,IAAI,MAAM,QAAQ,OAAO,MAAM,KAAK,CAAC;;CAI7C,MAAM,eAAe,MAAM,IAAI,gBAAgB;CAC/C,MAAM,cAAc,MAAM,IAAI,aAAa;AAE3C,KAAI,CAAC,aACJ,OAAM,IAAI,iBACT,yCACA,QACA,iBACA;AAEF,KAAI,CAAC,YACJ,OAAM,IAAI,iBAAiB,sCAAsC,QAAW,iBAAiB;CAG9F,IAAI;AACJ,KAAI;EACH,MAAM,SAAkB,KAAK,MAAM,aAAa;EAChD,MAAM,SAAS,qBAAqB,UAAU,OAAO;AACrD,MAAI,CAAC,OAAO,QACX,OAAM,IAAI,iBACT,mDACA,QACA,iBACA;AAEF,aAAW,wBAAwB,OAAO,KAAK;UACvC,KAAK;AACb,MAAI,eAAe,iBAAkB,OAAM;AAC3C,QAAM,IAAI,iBACT,2CACA,QACA,iBACA;;CAKF,MAAM,aAAa,MAAM,OAAO,OAAO,OAAO,WAAW,aAAwC;CACjG,MAAM,YAAY,IAAI,WAAW,WAAW;CAC5C,MAAM,WAAW,MAAM,KAAK,YAAY,MAAM,EAAE,SAAS,GAAG,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC,KAAK,GAAG;AAEvF,QAAO;EACN;EACA;EACA,WAAW,MAAM,IAAI,WAAW;EAChC;EACA;;;;;;;AAUF,eAAe,iBAAiB,YAAsC;CACrE,MAAM,OAAO,aAAa,eAAe,eAAe;AACxD,KAAI;EACH,MAAM,OAAO,MAAM,OAAO,OAAO,OAAO,WAAW,IAAI,aAAa,CAAC,OAAO,KAAK,CAAC;EAClF,MAAM,MAAM,IAAI,WAAW,KAAK;AAChC,SAAO,MAAM,KAAK,IAAI,MAAM,GAAG,EAAE,GAAG,MAAM,EAAE,SAAS,GAAG,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC,KAAK,GAAG;SAC5E;EAGP,IAAI,IAAI;AACR,OAAK,IAAI,IAAI,GAAG,IAAI,KAAK,QAAQ,KAAK;AACrC,QAAK,KAAK,WAAW,EAAE;AACvB,OAAI,KAAK,KAAK,GAAG,SAAW;;EAE7B,MAAM,KAAK,IAAK,MAAM;AACtB,UAAQ,MAAM,GAAG,SAAS,GAAG,CAAC,SAAS,GAAG,IAAI,IAAI,OAAO,GAAG,SAAS,GAAG,CAAC,SAAS,GAAG,IAAI;;;;;;;;;;AAa3F,SAAgB,wBAAwB,SAAiB,YAAwC;AAChG,QAAO,IAAI,sBAAsB,SAAS,WAAW"}

package/dist/media/image-endpoint.d.mts

@@ -117,8 +117,9 @@ declare function resolveTransformQuality(format: ImageTransformFormat, requested
  * Parse and validate `?w=&h=&f=&q=` query params. Width is required (it sizes
  * the rendition); dimensions are bounded so a request can't ask for an
  * unbounded or nonsensical transform. Format falls back to
- * {@link DEFAULT_TRANSFORM_FORMAT} when not requested. `q` is validated when
- * present but otherwise left `undefined` so the caller can apply a per-format
+ * {@link DEFAULT_TRANSFORM_FORMAT} when not requested. `q` accepts Astro presets
+ * or finite numbers rounded and clamped to 1-100. It is otherwise left
+ * `undefined` so the caller can apply a per-format
  * default (lossy formats get one, lossless PNG does not — see
  * {@link DEFAULT_TRANSFORM_QUALITY}).
  */

package/dist/media/image-endpoint.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"image-endpoint.d.mts","names":[],"sources":["../../src/media/image-endpoint.ts"],"mappings":";;AAiBA;;;;;AAGA;;;;;AAWA;;;cAda,yBAAA;;cAGA,wBAAA,EAA0B,oBAAA;;;;;AA4BvC;;;;;cAjBa,yBAAA;;cAGA,uBAAA;;KAcD,oBAAA,WAA+B,yBAAA;;UAG1B,qBAAA;EAChB,KAAA;EACA,MAAA;EACA,MAAA,EAAQ,oBAAA;EAMD;AAIR;;;;EAJC,OAAA;AAAA;;cAIY,qBAAA;;cAGA,2BAAA;AAKb;;;AAAA,iBAAgB,cAAA,CAAe,IAAA,EAAM,IAAA;;AASrC;;;;iBAAgB,YAAA,CAAa,IAAA,UAAc,YAAA,GAAe,IAAA,EAAM,MAAA;;;;;iBAWhD,uBAAA,CAAwB,MAAA,EAAQ,eAAA;AAAhD;;;;AAAA,iBAkBgB,aAAA,CACf,OAAA,EAAS,OAAA,EACT,IAAA,UACA,YAAA,GAAe,IAAA,EACf,MAAA;AAJD;;;AAAA,iBA6BgB,gBAAA,CACf,IAAA,UACA,YAAA,GAAe,IAAA,EACf,MAAA,YACE,MAAA;;;;;;;;iBA+Ba,oBAAA,CACf,WAAA,UACA,IAAA,WACA,YAAA,GAAe,IAAA,GACb,MAAA;AAvCH;AAAA,iBA0DgB,kBAAA,CAAmB,GAAA;;;;;;;;;;AAvBnC;;;;iBAwCgB,qBAAA,CAAsB,IAAA;;iBAetB,iBAAA,CAAkB,KAAA,WAAgB,KAAA,IAAS,oBAAA;;KAK/C,qBAAA;EACP,EAAA;EAAU,OAAA,EAAS,qBAAA;AAAA;EACnB,EAAA;EAAW,OAAA;AAAA;;AAtBhB;;;;;AAeA;;iBAiBgB,uBAAA,CACf,MAAA,EAAQ,oBAAA,EACR,SAAA;;;;;;;AAdD;;;iBA6BgB,oBAAA,CAAqB,MAAA,EAAQ,eAAA,GAAkB,qBAAA"}
+{"version":3,"file":"image-endpoint.d.mts","names":[],"sources":["../../src/media/image-endpoint.ts"],"mappings":";;AAiBA;;;;;AAGA;;;;;AAWA;;;cAda,yBAAA;;cAGA,wBAAA,EAA0B,oBAAA;;;;;AA4BvC;;;;;cAjBa,yBAAA;;cAGA,uBAAA;;KAcD,oBAAA,WAA+B,yBAAA;;UAG1B,qBAAA;EAChB,KAAA;EACA,MAAA;EACA,MAAA,EAAQ,oBAAA;EAMD;AAIR;;;;EAJC,OAAA;AAAA;;cAIY,qBAAA;;cAGA,2BAAA;AAKb;;;AAAA,iBAAgB,cAAA,CAAe,IAAA,EAAM,IAAA;;AASrC;;;;iBAAgB,YAAA,CAAa,IAAA,UAAc,YAAA,GAAe,IAAA,EAAM,MAAA;;;;;iBAWhD,uBAAA,CAAwB,MAAA,EAAQ,eAAA;AAAhD;;;;AAAA,iBAkBgB,aAAA,CACf,OAAA,EAAS,OAAA,EACT,IAAA,UACA,YAAA,GAAe,IAAA,EACf,MAAA;AAJD;;;AAAA,iBA6BgB,gBAAA,CACf,IAAA,UACA,YAAA,GAAe,IAAA,EACf,MAAA,YACE,MAAA;;;;;;;;iBA+Ba,oBAAA,CACf,WAAA,UACA,IAAA,WACA,YAAA,GAAe,IAAA,GACb,MAAA;AAvCH;AAAA,iBA4DgB,kBAAA,CAAmB,GAAA;;;;;;;;;;AAzBnC;;;;iBA0CgB,qBAAA,CAAsB,IAAA;;iBAetB,iBAAA,CAAkB,KAAA,WAAgB,KAAA,IAAS,oBAAA;;KAK/C,qBAAA;EACP,EAAA;EAAU,OAAA,EAAS,qBAAA;AAAA;EACnB,EAAA;EAAW,OAAA;AAAA;;AAtBhB;;;;;AAeA;;iBAiBgB,uBAAA,CACf,MAAA,EAAQ,oBAAA,EACR,SAAA;;;;;;;AAdD;;;;iBA8BgB,oBAAA,CAAqB,MAAA,EAAQ,eAAA,GAAkB,qBAAA"}

package/dist/media/image-endpoint.mjs

@@ -1,4 +1,4 @@
-import { t as INTERNAL_MEDIA_PREFIX } from "../normalize-BuWa0lvd.mjs";
+import { t as INTERNAL_MEDIA_PREFIX } from "../normalize-Ip_hFAm8.mjs";
 
 //#region src/media/image-endpoint.ts
 /**
@@ -142,6 +142,13 @@ function originalMediaHeaders(contentType, size, lastModified) {
 const SAFE_STORAGE_KEY = /^[A-Za-z0-9._-]+$/;
 /** Plain decimal digits only -- rejects "1e3", "0x10", "+5", whitespace. */
 const DECIMAL_DIGITS = /^\d+$/;
+const NUMERIC_QUALITY = /^-?\d+(?:\.\d+)?(?:e[+-]?\d+)?$/i;
+const QUALITY_PRESETS = {
+	low: 25,
+	mid: 50,
+	high: 80,
+	max: 100
+};
 /** Whether a storage key is safe to resolve against the storage backend. */
 function isSafeTransformKey(key) {
 	return SAFE_STORAGE_KEY.test(key);
@@ -192,8 +199,9 @@ function resolveTransformQuality(format, requested) {
 * Parse and validate `?w=&h=&f=&q=` query params. Width is required (it sizes
 * the rendition); dimensions are bounded so a request can't ask for an
 * unbounded or nonsensical transform. Format falls back to
-* {@link DEFAULT_TRANSFORM_FORMAT} when not requested. `q` is validated when
-* present but otherwise left `undefined` so the caller can apply a per-format
+* {@link DEFAULT_TRANSFORM_FORMAT} when not requested. `q` accepts Astro presets
+* or finite numbers rounded and clamped to 1-100. It is otherwise left
+* `undefined` so the caller can apply a per-format
 * default (lossy formats get one, lossless PNG does not — see
 * {@link DEFAULT_TRANSFORM_QUALITY}).
 */
@@ -223,13 +231,14 @@ function parseTransformParams(params) {
 	}
 	let quality;
 	const qualityRaw = params.get("q");
-	if (qualityRaw !== null) {
-		const q = Number(qualityRaw);
-		if (!Number.isInteger(q) || q < 1 || q > 100) return {
+	if (qualityRaw !== null) if (Object.hasOwn(QUALITY_PRESETS, qualityRaw)) quality = QUALITY_PRESETS[qualityRaw];
+	else {
+		const q = NUMERIC_QUALITY.test(qualityRaw) ? Number(qualityRaw) : NaN;
+		if (!Number.isFinite(q)) return {
 			ok: false,
-			message: "Invalid 'q' (quality), expected 1-100"
+			message: "Invalid 'q' (quality), expected a number or Astro preset"
 		};
-		quality = q;
+		quality = Math.round(Math.min(100, Math.max(1, q)));
 	}
 	return {
 		ok: true,

package/dist/media/image-endpoint.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"image-endpoint.mjs","names":[],"sources":["../../src/media/image-endpoint.ts"],"sourcesContent":["/**\n * Portable helpers shared by the platform image-endpoint modules.\n *\n * EmDash wraps Astro's image endpoint (`image.endpoint`) so that source bytes\n * for EmDash media are read straight from the storage adapter instead of being\n * fetched over HTTP. The platform endpoint modules (Node: sharp via\n * `astro:assets`; Cloudflare: the `IMAGES` binding) do the actual transform;\n * this module holds the platform-agnostic bits they share: recognizing an\n * EmDash media URL and validating transform query params.\n *\n * Kept free of `astro:*` / `virtual:emdash/*` imports so it stays in the\n * precompiled package and can be unit-tested directly.\n */\n\nimport { INTERNAL_MEDIA_PREFIX } from \"./normalize.js\";\n\n/** Output formats the wrapped endpoint can produce on Cloudflare. */\nexport const ALLOWED_TRANSFORM_FORMATS = [\"webp\", \"avif\", \"jpeg\", \"png\"] as const;\n\n/** Default output format -- broad support, strong compression. */\nexport const DEFAULT_TRANSFORM_FORMAT: ImageTransformFormat = \"webp\";\n\n/**\n * Default output quality for lossy formats (WebP/AVIF/JPEG) when the request\n * doesn't specify one. Matches the default Cloudflare applies to URL-based\n * image transformations. The Images *binding* applies no default of its own\n * and encodes near-losslessly when quality is omitted (a 2048px WebP comes\n * out ~900 KB instead of ~100 KB), so the endpoint sends an explicit quality\n * for lossy output. PNG is exempt: an explicit PNG quality switches the\n * binding to lossy PNG8, which is not a safe default for a lossless format.\n */\nexport const DEFAULT_TRANSFORM_QUALITY = 85;\n\n/** Upper bound for a requested dimension; caps the work a single request asks for. */\nexport const MAX_TRANSFORM_DIMENSION = 4000;\n\n/** Weak prefix on an ETag, stripped for weak comparison per RFC 7232. */\nconst WEAK_ETAG_PREFIX = /^W\\//;\n\n/**\n * Strip surrounding whitespace and the weak prefix from an ETag value for\n * weak comparison. Defined at module scope so it is not recreated per request.\n */\nfunction stripWeakEtagPrefix(value: string): string {\n\treturn value.trim().replace(WEAK_ETAG_PREFIX, \"\");\n}\n\n/** A format string accepted by {@link ImageTransformOptions.format}. */\nexport type ImageTransformFormat = (typeof ALLOWED_TRANSFORM_FORMATS)[number];\n\n/** Validated options for a single transform. */\nexport interface ImageTransformOptions {\n\twidth?: number;\n\theight?: number;\n\tformat: ImageTransformFormat;\n\t/**\n\t * Explicitly-requested quality (1-100), or `undefined` when the request\n\t * carried no `q`. Callers apply their own default per format (see\n\t * {@link DEFAULT_TRANSFORM_QUALITY}); lossless PNG deliberately gets none.\n\t */\n\tquality?: number;\n}\n\n/** Long-lived cache for content-addressed image URLs. */\nexport const IMMUTABLE_IMAGE_CACHE = \"public, max-age=31536000, immutable\";\n\n/** Cache policy for media keys that Replace original may overwrite. */\nexport const MUTABLE_MEDIA_CACHE_CONTROL = \"public, max-age=0, must-revalidate\";\n\n/**\n * Format a Date as an HTTP-date (RFC 7231).\n */\nexport function formatHttpDate(date: Date): string {\n\treturn date.toUTCString();\n}\n\n/**\n * Build a weak validator from representation metadata. Weak because it is based\n * on size and modification time rather than a content hash. Keeps the same\n * shape for stored files and derived transforms so replacements change the tag.\n */\nexport function makeWeakEtag(size: number, lastModified?: Date, suffix?: string): string {\n\tlet value = String(size);\n\tif (lastModified) value += `-${lastModified.getTime()}`;\n\tif (suffix) value += `-${suffix}`;\n\treturn `W/\"${value}\"`;\n}\n\n/**\n * Build a canonical fingerprint of the transform query params that affect the\n * derived /_image bytes. Used as the suffix of a transform's weak ETag.\n */\nexport function getTransformFingerprint(params: URLSearchParams): string {\n\tconst parts: string[] = [];\n\tconst append = (name: string) => {\n\t\tconst value = params.get(name);\n\t\tif (value !== null) parts.push(`${name}=${value}`);\n\t};\n\tappend(\"w\");\n\tappend(\"h\");\n\tappend(\"f\");\n\tappend(\"q\");\n\tappend(\"fit\");\n\treturn parts.join(\"&\");\n}\n\n/**\n * Check whether a request's preconditions are satisfied for the given\n * representation. Returns true when the client already has the current version.\n */\nexport function isNotModified(\n\trequest: Request,\n\tsize: number,\n\tlastModified?: Date,\n\tsuffix?: string,\n): boolean {\n\tconst etag = makeWeakEtag(size, lastModified, suffix);\n\tconst ifNoneMatch = request.headers.get(\"If-None-Match\");\n\tif (ifNoneMatch !== null) {\n\t\tif (ifNoneMatch.trim() === \"*\") return true;\n\t\t// If-None-Match uses weak comparison: \"W/\" prefixes are ignored.\n\t\tconst requestedTags = ifNoneMatch.split(\",\").map(stripWeakEtagPrefix);\n\t\treturn requestedTags.includes(stripWeakEtagPrefix(etag));\n\t}\n\tconst ifModifiedSince = request.headers.get(\"If-Modified-Since\");\n\tif (ifModifiedSince !== null && lastModified) {\n\t\tconst since = Date.parse(ifModifiedSince);\n\t\tif (!Number.isNaN(since)) {\n\t\t\t// HTTP-date has one-second precision; round the stored time down so\n\t\t\t// a Last-Modified header replayed as If-Modified-Since always matches.\n\t\t\treturn Math.floor(lastModified.getTime() / 1000) * 1000 <= since;\n\t\t}\n\t}\n\treturn false;\n}\n\n/**\n * Headers that make a mutable representation conditionally cacheable.\n */\nexport function validatorHeaders(\n\tsize: number,\n\tlastModified?: Date,\n\tsuffix?: string,\n): Record<string, string> {\n\tconst headers: Record<string, string> = {\n\t\tETag: makeWeakEtag(size, lastModified, suffix),\n\t};\n\tif (lastModified) {\n\t\theaders[\"Last-Modified\"] = formatHttpDate(lastModified);\n\t}\n\treturn headers;\n}\n\n/**\n * Raster types safe to render inline. Anything else (SVG, PDF, ...) is served\n * as an attachment so it can't execute as an active document. Mirrors the\n * `/_emdash/api/media/file/{key}` route's allowlist.\n */\nconst SAFE_INLINE_IMAGE_TYPES = new Set([\n\t\"image/jpeg\",\n\t\"image/png\",\n\t\"image/gif\",\n\t\"image/webp\",\n\t\"image/avif\",\n\t\"image/x-icon\",\n]);\n\n/**\n * Headers for streaming **original** stored bytes (the no-transform fallback).\n * Carries the same stored-XSS protections as the media file route: a sandbox\n * CSP, `nosniff`, and `Content-Disposition: attachment` for anything not on the\n * inline raster allowlist (so a stored SVG can't run scripts in the site\n * origin). Transformed output is always generated raster and doesn't need this.\n */\nexport function originalMediaHeaders(\n\tcontentType: string,\n\tsize?: number,\n\tlastModified?: Date,\n): Record<string, string> {\n\treturn {\n\t\t\"Content-Type\": contentType,\n\t\t\"Cache-Control\": MUTABLE_MEDIA_CACHE_CONTROL,\n\t\t\"X-Content-Type-Options\": \"nosniff\",\n\t\t\"Content-Security-Policy\":\n\t\t\t\"sandbox; default-src 'none'; img-src 'self'; style-src 'unsafe-inline'\",\n\t\t\"Content-Disposition\": SAFE_INLINE_IMAGE_TYPES.has(contentType) ? \"inline\" : \"attachment\",\n\t\t...(size !== undefined ? validatorHeaders(size, lastModified) : {}),\n\t};\n}\n\n/** Storage keys safe to serve: the flat `{ulid}{ext}` shape, no slashes/traversal. */\nconst SAFE_STORAGE_KEY = /^[A-Za-z0-9._-]+$/;\n\n/** Plain decimal digits only -- rejects \"1e3\", \"0x10\", \"+5\", whitespace. */\nconst DECIMAL_DIGITS = /^\\d+$/;\n\n/** Whether a storage key is safe to resolve against the storage backend. */\nexport function isSafeTransformKey(key: string): boolean {\n\treturn SAFE_STORAGE_KEY.test(key);\n}\n\n/**\n * If `href` points at the internal EmDash media route\n * (`/_emdash/api/media/file/{key}`) with a safe key, return the key; otherwise\n * `null` (the endpoint then delegates to the stock image endpoint for bundled\n * assets, allowed remote, and `publicUrl` media).\n *\n * The component absolutizes same-origin media (Astro only optimizes absolute,\n * remote-allowed URLs), so `href` is typically `https://site/_emdash/...` but\n * may be relative. We match on the **pathname** only and never fetch `href` —\n * the key is read from our own storage — so the host is irrelevant and can't be\n * an SSRF vector. A dummy base resolves both absolute and relative forms and\n * strips any query/fragment.\n */\nexport function matchInternalMediaKey(href: string | null | undefined): string | null {\n\tif (!href) return null;\n\tlet pathname: string;\n\ttry {\n\t\tpathname = new URL(href, \"http://localhost\").pathname;\n\t} catch {\n\t\treturn null;\n\t}\n\tif (!pathname.startsWith(INTERNAL_MEDIA_PREFIX)) return null;\n\tconst key = pathname.slice(INTERNAL_MEDIA_PREFIX.length);\n\tif (!key || !isSafeTransformKey(key)) return null;\n\treturn key;\n}\n\n/** Type guard for {@link ImageTransformFormat}. */\nexport function isTransformFormat(value: string): value is ImageTransformFormat {\n\treturn (ALLOWED_TRANSFORM_FORMATS as readonly string[]).includes(value);\n}\n\n/** Outcome of parsing transform query params: validated options or an error. */\nexport type ParsedTransformParams =\n\t| { ok: true; options: ImageTransformOptions }\n\t| { ok: false; message: string };\n\n/**\n * Resolve the quality to send to the image binding for a transform. An\n * explicitly-requested quality always wins. Otherwise lossy formats\n * (WebP/AVIF/JPEG) get {@link DEFAULT_TRANSFORM_QUALITY} because the Images\n * binding encodes near-losslessly when quality is omitted; lossless PNG gets\n * `undefined` because an explicit PNG quality switches the binding to lossy\n * PNG8, which is not a safe default for a lossless format.\n */\nexport function resolveTransformQuality(\n\tformat: ImageTransformFormat,\n\trequested: number | undefined,\n): number | undefined {\n\tif (requested !== undefined) return requested;\n\treturn format === \"png\" ? undefined : DEFAULT_TRANSFORM_QUALITY;\n}\n\n/**\n * Parse and validate `?w=&h=&f=&q=` query params. Width is required (it sizes\n * the rendition); dimensions are bounded so a request can't ask for an\n * unbounded or nonsensical transform. Format falls back to\n * {@link DEFAULT_TRANSFORM_FORMAT} when not requested. `q` is validated when\n * present but otherwise left `undefined` so the caller can apply a per-format\n * default (lossy formats get one, lossless PNG does not — see\n * {@link DEFAULT_TRANSFORM_QUALITY}).\n */\nexport function parseTransformParams(params: URLSearchParams): ParsedTransformParams {\n\tconst width = parseDimension(params.get(\"w\"));\n\tif (width === null) return { ok: false, message: \"Invalid 'w' (width)\" };\n\tif (width === undefined) return { ok: false, message: \"Missing 'w' (width)\" };\n\n\tconst height = parseDimension(params.get(\"h\"));\n\tif (height === null) return { ok: false, message: \"Invalid 'h' (height)\" };\n\n\tconst formatRaw = params.get(\"f\");\n\tlet format: ImageTransformFormat = DEFAULT_TRANSFORM_FORMAT;\n\tif (formatRaw !== null) {\n\t\tif (!isTransformFormat(formatRaw)) {\n\t\t\treturn { ok: false, message: `Unsupported 'f' (format): ${formatRaw}` };\n\t\t}\n\t\tformat = formatRaw;\n\t}\n\n\tlet quality: number | undefined;\n\tconst qualityRaw = params.get(\"q\");\n\tif (qualityRaw !== null) {\n\t\tconst q = Number(qualityRaw);\n\t\tif (!Number.isInteger(q) || q < 1 || q > 100) {\n\t\t\treturn { ok: false, message: \"Invalid 'q' (quality), expected 1-100\" };\n\t\t}\n\t\tquality = q;\n\t}\n\n\treturn { ok: true, options: { width, height, format, quality } };\n}\n\n/**\n * Parse a dimension query value.\n * - `undefined`: param absent\n * - `null`: present but invalid (non-integer, out of range)\n * - `number`: valid, within [1, MAX_TRANSFORM_DIMENSION]\n */\nfunction parseDimension(raw: string | null): number | undefined | null {\n\tif (raw === null) return undefined;\n\tif (!DECIMAL_DIGITS.test(raw)) return null;\n\tconst n = Number(raw);\n\tif (n < 1 || n > MAX_TRANSFORM_DIMENSION) return null;\n\treturn n;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;AAiBA,MAAa,4BAA4B;CAAC;CAAQ;CAAQ;CAAQ;CAAM;;AAGxE,MAAa,2BAAiD;;;;;;;;;;AAW9D,MAAa,4BAA4B;;AAGzC,MAAa,0BAA0B;;AAGvC,MAAM,mBAAmB;;;;;AAMzB,SAAS,oBAAoB,OAAuB;AACnD,QAAO,MAAM,MAAM,CAAC,QAAQ,kBAAkB,GAAG;;;AAoBlD,MAAa,wBAAwB;;AAGrC,MAAa,8BAA8B;;;;AAK3C,SAAgB,eAAe,MAAoB;AAClD,QAAO,KAAK,aAAa;;;;;;;AAQ1B,SAAgB,aAAa,MAAc,cAAqB,QAAyB;CACxF,IAAI,QAAQ,OAAO,KAAK;AACxB,KAAI,aAAc,UAAS,IAAI,aAAa,SAAS;AACrD,KAAI,OAAQ,UAAS,IAAI;AACzB,QAAO,MAAM,MAAM;;;;;;AAOpB,SAAgB,wBAAwB,QAAiC;CACxE,MAAM,QAAkB,EAAE;CAC1B,MAAM,UAAU,SAAiB;EAChC,MAAM,QAAQ,OAAO,IAAI,KAAK;AAC9B,MAAI,UAAU,KAAM,OAAM,KAAK,GAAG,KAAK,GAAG,QAAQ;;AAEnD,QAAO,IAAI;AACX,QAAO,IAAI;AACX,QAAO,IAAI;AACX,QAAO,IAAI;AACX,QAAO,MAAM;AACb,QAAO,MAAM,KAAK,IAAI;;;;;;AAOvB,SAAgB,cACf,SACA,MACA,cACA,QACU;CACV,MAAM,OAAO,aAAa,MAAM,cAAc,OAAO;CACrD,MAAM,cAAc,QAAQ,QAAQ,IAAI,gBAAgB;AACxD,KAAI,gBAAgB,MAAM;AACzB,MAAI,YAAY,MAAM,KAAK,IAAK,QAAO;AAGvC,SADsB,YAAY,MAAM,IAAI,CAAC,IAAI,oBAAoB,CAChD,SAAS,oBAAoB,KAAK,CAAC;;CAEzD,MAAM,kBAAkB,QAAQ,QAAQ,IAAI,oBAAoB;AAChE,KAAI,oBAAoB,QAAQ,cAAc;EAC7C,MAAM,QAAQ,KAAK,MAAM,gBAAgB;AACzC,MAAI,CAAC,OAAO,MAAM,MAAM,CAGvB,QAAO,KAAK,MAAM,aAAa,SAAS,GAAG,IAAK,GAAG,OAAQ;;AAG7D,QAAO;;;;;AAMR,SAAgB,iBACf,MACA,cACA,QACyB;CACzB,MAAM,UAAkC,EACvC,MAAM,aAAa,MAAM,cAAc,OAAO,EAC9C;AACD,KAAI,aACH,SAAQ,mBAAmB,eAAe,aAAa;AAExD,QAAO;;;;;;;AAQR,MAAM,0BAA0B,IAAI,IAAI;CACvC;CACA;CACA;CACA;CACA;CACA;CACA,CAAC;;;;;;;;AASF,SAAgB,qBACf,aACA,MACA,cACyB;AACzB,QAAO;EACN,gBAAgB;EAChB,iBAAiB;EACjB,0BAA0B;EAC1B,2BACC;EACD,uBAAuB,wBAAwB,IAAI,YAAY,GAAG,WAAW;EAC7E,GAAI,SAAS,SAAY,iBAAiB,MAAM,aAAa,GAAG,EAAE;EAClE;;;AAIF,MAAM,mBAAmB;;AAGzB,MAAM,iBAAiB;;AAGvB,SAAgB,mBAAmB,KAAsB;AACxD,QAAO,iBAAiB,KAAK,IAAI;;;;;;;;;;;;;;;AAgBlC,SAAgB,sBAAsB,MAAgD;AACrF,KAAI,CAAC,KAAM,QAAO;CAClB,IAAI;AACJ,KAAI;AACH,aAAW,IAAI,IAAI,MAAM,mBAAmB,CAAC;SACtC;AACP,SAAO;;AAER,KAAI,CAAC,SAAS,WAAW,sBAAsB,CAAE,QAAO;CACxD,MAAM,MAAM,SAAS,MAAM,sBAAsB,OAAO;AACxD,KAAI,CAAC,OAAO,CAAC,mBAAmB,IAAI,CAAE,QAAO;AAC7C,QAAO;;;AAIR,SAAgB,kBAAkB,OAA8C;AAC/E,QAAQ,0BAAgD,SAAS,MAAM;;;;;;;;;;AAgBxE,SAAgB,wBACf,QACA,WACqB;AACrB,KAAI,cAAc,OAAW,QAAO;AACpC,QAAO,WAAW,QAAQ,SAAY;;;;;;;;;;;AAYvC,SAAgB,qBAAqB,QAAgD;CACpF,MAAM,QAAQ,eAAe,OAAO,IAAI,IAAI,CAAC;AAC7C,KAAI,UAAU,KAAM,QAAO;EAAE,IAAI;EAAO,SAAS;EAAuB;AACxE,KAAI,UAAU,OAAW,QAAO;EAAE,IAAI;EAAO,SAAS;EAAuB;CAE7E,MAAM,SAAS,eAAe,OAAO,IAAI,IAAI,CAAC;AAC9C,KAAI,WAAW,KAAM,QAAO;EAAE,IAAI;EAAO,SAAS;EAAwB;CAE1E,MAAM,YAAY,OAAO,IAAI,IAAI;CACjC,IAAI,SAA+B;AACnC,KAAI,cAAc,MAAM;AACvB,MAAI,CAAC,kBAAkB,UAAU,CAChC,QAAO;GAAE,IAAI;GAAO,SAAS,6BAA6B;GAAa;AAExE,WAAS;;CAGV,IAAI;CACJ,MAAM,aAAa,OAAO,IAAI,IAAI;AAClC,KAAI,eAAe,MAAM;EACxB,MAAM,IAAI,OAAO,WAAW;AAC5B,MAAI,CAAC,OAAO,UAAU,EAAE,IAAI,IAAI,KAAK,IAAI,IACxC,QAAO;GAAE,IAAI;GAAO,SAAS;GAAyC;AAEvE,YAAU;;AAGX,QAAO;EAAE,IAAI;EAAM,SAAS;GAAE;GAAO;GAAQ;GAAQ;GAAS;EAAE;;;;;;;;AASjE,SAAS,eAAe,KAA+C;AACtE,KAAI,QAAQ,KAAM,QAAO;AACzB,KAAI,CAAC,eAAe,KAAK,IAAI,CAAE,QAAO;CACtC,MAAM,IAAI,OAAO,IAAI;AACrB,KAAI,IAAI,KAAK,IAAI,wBAAyB,QAAO;AACjD,QAAO"}
+{"version":3,"file":"image-endpoint.mjs","names":[],"sources":["../../src/media/image-endpoint.ts"],"sourcesContent":["/**\n * Portable helpers shared by the platform image-endpoint modules.\n *\n * EmDash wraps Astro's image endpoint (`image.endpoint`) so that source bytes\n * for EmDash media are read straight from the storage adapter instead of being\n * fetched over HTTP. The platform endpoint modules (Node: sharp via\n * `astro:assets`; Cloudflare: the `IMAGES` binding) do the actual transform;\n * this module holds the platform-agnostic bits they share: recognizing an\n * EmDash media URL and validating transform query params.\n *\n * Kept free of `astro:*` / `virtual:emdash/*` imports so it stays in the\n * precompiled package and can be unit-tested directly.\n */\n\nimport { INTERNAL_MEDIA_PREFIX } from \"./normalize.js\";\n\n/** Output formats the wrapped endpoint can produce on Cloudflare. */\nexport const ALLOWED_TRANSFORM_FORMATS = [\"webp\", \"avif\", \"jpeg\", \"png\"] as const;\n\n/** Default output format -- broad support, strong compression. */\nexport const DEFAULT_TRANSFORM_FORMAT: ImageTransformFormat = \"webp\";\n\n/**\n * Default output quality for lossy formats (WebP/AVIF/JPEG) when the request\n * doesn't specify one. Matches the default Cloudflare applies to URL-based\n * image transformations. The Images *binding* applies no default of its own\n * and encodes near-losslessly when quality is omitted (a 2048px WebP comes\n * out ~900 KB instead of ~100 KB), so the endpoint sends an explicit quality\n * for lossy output. PNG is exempt: an explicit PNG quality switches the\n * binding to lossy PNG8, which is not a safe default for a lossless format.\n */\nexport const DEFAULT_TRANSFORM_QUALITY = 85;\n\n/** Upper bound for a requested dimension; caps the work a single request asks for. */\nexport const MAX_TRANSFORM_DIMENSION = 4000;\n\n/** Weak prefix on an ETag, stripped for weak comparison per RFC 7232. */\nconst WEAK_ETAG_PREFIX = /^W\\//;\n\n/**\n * Strip surrounding whitespace and the weak prefix from an ETag value for\n * weak comparison. Defined at module scope so it is not recreated per request.\n */\nfunction stripWeakEtagPrefix(value: string): string {\n\treturn value.trim().replace(WEAK_ETAG_PREFIX, \"\");\n}\n\n/** A format string accepted by {@link ImageTransformOptions.format}. */\nexport type ImageTransformFormat = (typeof ALLOWED_TRANSFORM_FORMATS)[number];\n\n/** Validated options for a single transform. */\nexport interface ImageTransformOptions {\n\twidth?: number;\n\theight?: number;\n\tformat: ImageTransformFormat;\n\t/**\n\t * Explicitly-requested quality (1-100), or `undefined` when the request\n\t * carried no `q`. Callers apply their own default per format (see\n\t * {@link DEFAULT_TRANSFORM_QUALITY}); lossless PNG deliberately gets none.\n\t */\n\tquality?: number;\n}\n\n/** Long-lived cache for content-addressed image URLs. */\nexport const IMMUTABLE_IMAGE_CACHE = \"public, max-age=31536000, immutable\";\n\n/** Cache policy for media keys that Replace original may overwrite. */\nexport const MUTABLE_MEDIA_CACHE_CONTROL = \"public, max-age=0, must-revalidate\";\n\n/**\n * Format a Date as an HTTP-date (RFC 7231).\n */\nexport function formatHttpDate(date: Date): string {\n\treturn date.toUTCString();\n}\n\n/**\n * Build a weak validator from representation metadata. Weak because it is based\n * on size and modification time rather than a content hash. Keeps the same\n * shape for stored files and derived transforms so replacements change the tag.\n */\nexport function makeWeakEtag(size: number, lastModified?: Date, suffix?: string): string {\n\tlet value = String(size);\n\tif (lastModified) value += `-${lastModified.getTime()}`;\n\tif (suffix) value += `-${suffix}`;\n\treturn `W/\"${value}\"`;\n}\n\n/**\n * Build a canonical fingerprint of the transform query params that affect the\n * derived /_image bytes. Used as the suffix of a transform's weak ETag.\n */\nexport function getTransformFingerprint(params: URLSearchParams): string {\n\tconst parts: string[] = [];\n\tconst append = (name: string) => {\n\t\tconst value = params.get(name);\n\t\tif (value !== null) parts.push(`${name}=${value}`);\n\t};\n\tappend(\"w\");\n\tappend(\"h\");\n\tappend(\"f\");\n\tappend(\"q\");\n\tappend(\"fit\");\n\treturn parts.join(\"&\");\n}\n\n/**\n * Check whether a request's preconditions are satisfied for the given\n * representation. Returns true when the client already has the current version.\n */\nexport function isNotModified(\n\trequest: Request,\n\tsize: number,\n\tlastModified?: Date,\n\tsuffix?: string,\n): boolean {\n\tconst etag = makeWeakEtag(size, lastModified, suffix);\n\tconst ifNoneMatch = request.headers.get(\"If-None-Match\");\n\tif (ifNoneMatch !== null) {\n\t\tif (ifNoneMatch.trim() === \"*\") return true;\n\t\t// If-None-Match uses weak comparison: \"W/\" prefixes are ignored.\n\t\tconst requestedTags = ifNoneMatch.split(\",\").map(stripWeakEtagPrefix);\n\t\treturn requestedTags.includes(stripWeakEtagPrefix(etag));\n\t}\n\tconst ifModifiedSince = request.headers.get(\"If-Modified-Since\");\n\tif (ifModifiedSince !== null && lastModified) {\n\t\tconst since = Date.parse(ifModifiedSince);\n\t\tif (!Number.isNaN(since)) {\n\t\t\t// HTTP-date has one-second precision; round the stored time down so\n\t\t\t// a Last-Modified header replayed as If-Modified-Since always matches.\n\t\t\treturn Math.floor(lastModified.getTime() / 1000) * 1000 <= since;\n\t\t}\n\t}\n\treturn false;\n}\n\n/**\n * Headers that make a mutable representation conditionally cacheable.\n */\nexport function validatorHeaders(\n\tsize: number,\n\tlastModified?: Date,\n\tsuffix?: string,\n): Record<string, string> {\n\tconst headers: Record<string, string> = {\n\t\tETag: makeWeakEtag(size, lastModified, suffix),\n\t};\n\tif (lastModified) {\n\t\theaders[\"Last-Modified\"] = formatHttpDate(lastModified);\n\t}\n\treturn headers;\n}\n\n/**\n * Raster types safe to render inline. Anything else (SVG, PDF, ...) is served\n * as an attachment so it can't execute as an active document. Mirrors the\n * `/_emdash/api/media/file/{key}` route's allowlist.\n */\nconst SAFE_INLINE_IMAGE_TYPES = new Set([\n\t\"image/jpeg\",\n\t\"image/png\",\n\t\"image/gif\",\n\t\"image/webp\",\n\t\"image/avif\",\n\t\"image/x-icon\",\n]);\n\n/**\n * Headers for streaming **original** stored bytes (the no-transform fallback).\n * Carries the same stored-XSS protections as the media file route: a sandbox\n * CSP, `nosniff`, and `Content-Disposition: attachment` for anything not on the\n * inline raster allowlist (so a stored SVG can't run scripts in the site\n * origin). Transformed output is always generated raster and doesn't need this.\n */\nexport function originalMediaHeaders(\n\tcontentType: string,\n\tsize?: number,\n\tlastModified?: Date,\n): Record<string, string> {\n\treturn {\n\t\t\"Content-Type\": contentType,\n\t\t\"Cache-Control\": MUTABLE_MEDIA_CACHE_CONTROL,\n\t\t\"X-Content-Type-Options\": \"nosniff\",\n\t\t\"Content-Security-Policy\":\n\t\t\t\"sandbox; default-src 'none'; img-src 'self'; style-src 'unsafe-inline'\",\n\t\t\"Content-Disposition\": SAFE_INLINE_IMAGE_TYPES.has(contentType) ? \"inline\" : \"attachment\",\n\t\t...(size !== undefined ? validatorHeaders(size, lastModified) : {}),\n\t};\n}\n\n/** Storage keys safe to serve: the flat `{ulid}{ext}` shape, no slashes/traversal. */\nconst SAFE_STORAGE_KEY = /^[A-Za-z0-9._-]+$/;\n\n/** Plain decimal digits only -- rejects \"1e3\", \"0x10\", \"+5\", whitespace. */\nconst DECIMAL_DIGITS = /^\\d+$/;\nconst NUMERIC_QUALITY = /^-?\\d+(?:\\.\\d+)?(?:e[+-]?\\d+)?$/i;\nconst QUALITY_PRESETS: Record<string, number> = { low: 25, mid: 50, high: 80, max: 100 };\n\n/** Whether a storage key is safe to resolve against the storage backend. */\nexport function isSafeTransformKey(key: string): boolean {\n\treturn SAFE_STORAGE_KEY.test(key);\n}\n\n/**\n * If `href` points at the internal EmDash media route\n * (`/_emdash/api/media/file/{key}`) with a safe key, return the key; otherwise\n * `null` (the endpoint then delegates to the stock image endpoint for bundled\n * assets, allowed remote, and `publicUrl` media).\n *\n * The component absolutizes same-origin media (Astro only optimizes absolute,\n * remote-allowed URLs), so `href` is typically `https://site/_emdash/...` but\n * may be relative. We match on the **pathname** only and never fetch `href` —\n * the key is read from our own storage — so the host is irrelevant and can't be\n * an SSRF vector. A dummy base resolves both absolute and relative forms and\n * strips any query/fragment.\n */\nexport function matchInternalMediaKey(href: string | null | undefined): string | null {\n\tif (!href) return null;\n\tlet pathname: string;\n\ttry {\n\t\tpathname = new URL(href, \"http://localhost\").pathname;\n\t} catch {\n\t\treturn null;\n\t}\n\tif (!pathname.startsWith(INTERNAL_MEDIA_PREFIX)) return null;\n\tconst key = pathname.slice(INTERNAL_MEDIA_PREFIX.length);\n\tif (!key || !isSafeTransformKey(key)) return null;\n\treturn key;\n}\n\n/** Type guard for {@link ImageTransformFormat}. */\nexport function isTransformFormat(value: string): value is ImageTransformFormat {\n\treturn (ALLOWED_TRANSFORM_FORMATS as readonly string[]).includes(value);\n}\n\n/** Outcome of parsing transform query params: validated options or an error. */\nexport type ParsedTransformParams =\n\t| { ok: true; options: ImageTransformOptions }\n\t| { ok: false; message: string };\n\n/**\n * Resolve the quality to send to the image binding for a transform. An\n * explicitly-requested quality always wins. Otherwise lossy formats\n * (WebP/AVIF/JPEG) get {@link DEFAULT_TRANSFORM_QUALITY} because the Images\n * binding encodes near-losslessly when quality is omitted; lossless PNG gets\n * `undefined` because an explicit PNG quality switches the binding to lossy\n * PNG8, which is not a safe default for a lossless format.\n */\nexport function resolveTransformQuality(\n\tformat: ImageTransformFormat,\n\trequested: number | undefined,\n): number | undefined {\n\tif (requested !== undefined) return requested;\n\treturn format === \"png\" ? undefined : DEFAULT_TRANSFORM_QUALITY;\n}\n\n/**\n * Parse and validate `?w=&h=&f=&q=` query params. Width is required (it sizes\n * the rendition); dimensions are bounded so a request can't ask for an\n * unbounded or nonsensical transform. Format falls back to\n * {@link DEFAULT_TRANSFORM_FORMAT} when not requested. `q` accepts Astro presets\n * or finite numbers rounded and clamped to 1-100. It is otherwise left\n * `undefined` so the caller can apply a per-format\n * default (lossy formats get one, lossless PNG does not — see\n * {@link DEFAULT_TRANSFORM_QUALITY}).\n */\nexport function parseTransformParams(params: URLSearchParams): ParsedTransformParams {\n\tconst width = parseDimension(params.get(\"w\"));\n\tif (width === null) return { ok: false, message: \"Invalid 'w' (width)\" };\n\tif (width === undefined) return { ok: false, message: \"Missing 'w' (width)\" };\n\n\tconst height = parseDimension(params.get(\"h\"));\n\tif (height === null) return { ok: false, message: \"Invalid 'h' (height)\" };\n\n\tconst formatRaw = params.get(\"f\");\n\tlet format: ImageTransformFormat = DEFAULT_TRANSFORM_FORMAT;\n\tif (formatRaw !== null) {\n\t\tif (!isTransformFormat(formatRaw)) {\n\t\t\treturn { ok: false, message: `Unsupported 'f' (format): ${formatRaw}` };\n\t\t}\n\t\tformat = formatRaw;\n\t}\n\n\tlet quality: number | undefined;\n\tconst qualityRaw = params.get(\"q\");\n\tif (qualityRaw !== null) {\n\t\tif (Object.hasOwn(QUALITY_PRESETS, qualityRaw)) {\n\t\t\tquality = QUALITY_PRESETS[qualityRaw];\n\t\t} else {\n\t\t\tconst q = NUMERIC_QUALITY.test(qualityRaw) ? Number(qualityRaw) : Number.NaN;\n\t\t\tif (!Number.isFinite(q)) {\n\t\t\t\treturn { ok: false, message: \"Invalid 'q' (quality), expected a number or Astro preset\" };\n\t\t\t}\n\t\t\tquality = Math.round(Math.min(100, Math.max(1, q)));\n\t\t}\n\t}\n\n\treturn { ok: true, options: { width, height, format, quality } };\n}\n\n/**\n * Parse a dimension query value.\n * - `undefined`: param absent\n * - `null`: present but invalid (non-integer, out of range)\n * - `number`: valid, within [1, MAX_TRANSFORM_DIMENSION]\n */\nfunction parseDimension(raw: string | null): number | undefined | null {\n\tif (raw === null) return undefined;\n\tif (!DECIMAL_DIGITS.test(raw)) return null;\n\tconst n = Number(raw);\n\tif (n < 1 || n > MAX_TRANSFORM_DIMENSION) return null;\n\treturn n;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;AAiBA,MAAa,4BAA4B;CAAC;CAAQ;CAAQ;CAAQ;CAAM;;AAGxE,MAAa,2BAAiD;;;;;;;;;;AAW9D,MAAa,4BAA4B;;AAGzC,MAAa,0BAA0B;;AAGvC,MAAM,mBAAmB;;;;;AAMzB,SAAS,oBAAoB,OAAuB;AACnD,QAAO,MAAM,MAAM,CAAC,QAAQ,kBAAkB,GAAG;;;AAoBlD,MAAa,wBAAwB;;AAGrC,MAAa,8BAA8B;;;;AAK3C,SAAgB,eAAe,MAAoB;AAClD,QAAO,KAAK,aAAa;;;;;;;AAQ1B,SAAgB,aAAa,MAAc,cAAqB,QAAyB;CACxF,IAAI,QAAQ,OAAO,KAAK;AACxB,KAAI,aAAc,UAAS,IAAI,aAAa,SAAS;AACrD,KAAI,OAAQ,UAAS,IAAI;AACzB,QAAO,MAAM,MAAM;;;;;;AAOpB,SAAgB,wBAAwB,QAAiC;CACxE,MAAM,QAAkB,EAAE;CAC1B,MAAM,UAAU,SAAiB;EAChC,MAAM,QAAQ,OAAO,IAAI,KAAK;AAC9B,MAAI,UAAU,KAAM,OAAM,KAAK,GAAG,KAAK,GAAG,QAAQ;;AAEnD,QAAO,IAAI;AACX,QAAO,IAAI;AACX,QAAO,IAAI;AACX,QAAO,IAAI;AACX,QAAO,MAAM;AACb,QAAO,MAAM,KAAK,IAAI;;;;;;AAOvB,SAAgB,cACf,SACA,MACA,cACA,QACU;CACV,MAAM,OAAO,aAAa,MAAM,cAAc,OAAO;CACrD,MAAM,cAAc,QAAQ,QAAQ,IAAI,gBAAgB;AACxD,KAAI,gBAAgB,MAAM;AACzB,MAAI,YAAY,MAAM,KAAK,IAAK,QAAO;AAGvC,SADsB,YAAY,MAAM,IAAI,CAAC,IAAI,oBAAoB,CAChD,SAAS,oBAAoB,KAAK,CAAC;;CAEzD,MAAM,kBAAkB,QAAQ,QAAQ,IAAI,oBAAoB;AAChE,KAAI,oBAAoB,QAAQ,cAAc;EAC7C,MAAM,QAAQ,KAAK,MAAM,gBAAgB;AACzC,MAAI,CAAC,OAAO,MAAM,MAAM,CAGvB,QAAO,KAAK,MAAM,aAAa,SAAS,GAAG,IAAK,GAAG,OAAQ;;AAG7D,QAAO;;;;;AAMR,SAAgB,iBACf,MACA,cACA,QACyB;CACzB,MAAM,UAAkC,EACvC,MAAM,aAAa,MAAM,cAAc,OAAO,EAC9C;AACD,KAAI,aACH,SAAQ,mBAAmB,eAAe,aAAa;AAExD,QAAO;;;;;;;AAQR,MAAM,0BAA0B,IAAI,IAAI;CACvC;CACA;CACA;CACA;CACA;CACA;CACA,CAAC;;;;;;;;AASF,SAAgB,qBACf,aACA,MACA,cACyB;AACzB,QAAO;EACN,gBAAgB;EAChB,iBAAiB;EACjB,0BAA0B;EAC1B,2BACC;EACD,uBAAuB,wBAAwB,IAAI,YAAY,GAAG,WAAW;EAC7E,GAAI,SAAS,SAAY,iBAAiB,MAAM,aAAa,GAAG,EAAE;EAClE;;;AAIF,MAAM,mBAAmB;;AAGzB,MAAM,iBAAiB;AACvB,MAAM,kBAAkB;AACxB,MAAM,kBAA0C;CAAE,KAAK;CAAI,KAAK;CAAI,MAAM;CAAI,KAAK;CAAK;;AAGxF,SAAgB,mBAAmB,KAAsB;AACxD,QAAO,iBAAiB,KAAK,IAAI;;;;;;;;;;;;;;;AAgBlC,SAAgB,sBAAsB,MAAgD;AACrF,KAAI,CAAC,KAAM,QAAO;CAClB,IAAI;AACJ,KAAI;AACH,aAAW,IAAI,IAAI,MAAM,mBAAmB,CAAC;SACtC;AACP,SAAO;;AAER,KAAI,CAAC,SAAS,WAAW,sBAAsB,CAAE,QAAO;CACxD,MAAM,MAAM,SAAS,MAAM,sBAAsB,OAAO;AACxD,KAAI,CAAC,OAAO,CAAC,mBAAmB,IAAI,CAAE,QAAO;AAC7C,QAAO;;;AAIR,SAAgB,kBAAkB,OAA8C;AAC/E,QAAQ,0BAAgD,SAAS,MAAM;;;;;;;;;;AAgBxE,SAAgB,wBACf,QACA,WACqB;AACrB,KAAI,cAAc,OAAW,QAAO;AACpC,QAAO,WAAW,QAAQ,SAAY;;;;;;;;;;;;AAavC,SAAgB,qBAAqB,QAAgD;CACpF,MAAM,QAAQ,eAAe,OAAO,IAAI,IAAI,CAAC;AAC7C,KAAI,UAAU,KAAM,QAAO;EAAE,IAAI;EAAO,SAAS;EAAuB;AACxE,KAAI,UAAU,OAAW,QAAO;EAAE,IAAI;EAAO,SAAS;EAAuB;CAE7E,MAAM,SAAS,eAAe,OAAO,IAAI,IAAI,CAAC;AAC9C,KAAI,WAAW,KAAM,QAAO;EAAE,IAAI;EAAO,SAAS;EAAwB;CAE1E,MAAM,YAAY,OAAO,IAAI,IAAI;CACjC,IAAI,SAA+B;AACnC,KAAI,cAAc,MAAM;AACvB,MAAI,CAAC,kBAAkB,UAAU,CAChC,QAAO;GAAE,IAAI;GAAO,SAAS,6BAA6B;GAAa;AAExE,WAAS;;CAGV,IAAI;CACJ,MAAM,aAAa,OAAO,IAAI,IAAI;AAClC,KAAI,eAAe,KAClB,KAAI,OAAO,OAAO,iBAAiB,WAAW,CAC7C,WAAU,gBAAgB;MACpB;EACN,MAAM,IAAI,gBAAgB,KAAK,WAAW,GAAG,OAAO,WAAW,GAAG;AAClE,MAAI,CAAC,OAAO,SAAS,EAAE,CACtB,QAAO;GAAE,IAAI;GAAO,SAAS;GAA4D;AAE1F,YAAU,KAAK,MAAM,KAAK,IAAI,KAAK,KAAK,IAAI,GAAG,EAAE,CAAC,CAAC;;AAIrD,QAAO;EAAE,IAAI;EAAM,SAAS;GAAE;GAAO;GAAQ;GAAQ;GAAS;EAAE;;;;;;;;AASjE,SAAS,eAAe,KAA+C;AACtE,KAAI,QAAQ,KAAM,QAAO;AACzB,KAAI,CAAC,eAAe,KAAK,IAAI,CAAE,QAAO;CACtC,MAAM,IAAI,OAAO,IAAI;AACrB,KAAI,IAAI,KAAK,IAAI,wBAAyB,QAAO;AACjD,QAAO"}

package/dist/media/index.d.mts

@@ -1,4 +1,4 @@
-import { _ as MediaValue, a as ComponentEmbed, b as mediaItemToValue, c as EmbedResult, d as MediaListResult, f as MediaProvider, g as MediaUploadInput, h as MediaProviderItem, i as AudioEmbed, l as ImageEmbed, m as MediaProviderDescriptor, n as generatePlaceholder, o as CreateMediaProviderFn, p as MediaProviderCapabilities, r as normalizeMediaValue, s as EmbedOptions, t as PlaceholderData, u as MediaListOptions, v as ThumbnailOptions, y as VideoEmbed } from "../placeholder-D41vk11_.mjs";
+import { _ as MediaValue, a as ComponentEmbed, b as mediaItemToValue, c as EmbedResult, d as MediaListResult, f as MediaProvider, g as MediaUploadInput, h as MediaProviderItem, i as AudioEmbed, l as ImageEmbed, m as MediaProviderDescriptor, n as generatePlaceholder, o as CreateMediaProviderFn, p as MediaProviderCapabilities, r as normalizeMediaValue, s as EmbedOptions, t as PlaceholderData, u as MediaListOptions, v as ThumbnailOptions, y as VideoEmbed } from "../placeholder-BlfXkucE.mjs";
 
 //#region src/media/enrich.d.ts
 /**

package/dist/media/index.mjs

@@ -1,7 +1,7 @@
-import { n as normalizeFocalPoint } from "../focal-point-JX8kcOTQ.mjs";
-import { n as normalizeMediaValue } from "../normalize-BuWa0lvd.mjs";
-import "../dist-Cfu8mMBs.mjs";
-import { n as generatePlaceholder, t as enrichImageMetadata } from "../enrich-Duu4sV3a.mjs";
+import { n as normalizeFocalPoint } from "../focal-point-CgCcr1Ca.mjs";
+import { i as syncMediaCaption, n as normalizeMediaValue } from "../normalize-Ip_hFAm8.mjs";
+import "../dist-DY0aOmAP.mjs";
+import { n as generatePlaceholder, t as enrichImageMetadata } from "../enrich-C3XIJi0O.mjs";
 
 //#region src/media/types.ts
 /**
@@ -16,7 +16,7 @@ import { n as generatePlaceholder, t as enrichImageMetadata } from "../enrich-Du
 */
 function mediaItemToValue(providerId, item) {
 	const focalPoint = normalizeFocalPoint(item.focalX, item.focalY);
-	return {
+	return syncMediaCaption({
 		provider: providerId,
 		id: item.id,
 		filename: item.filename,
@@ -27,8 +27,9 @@ function mediaItemToValue(providerId, item) {
 		blurhash: item.blurhash,
 		dominantColor: item.dominantColor,
 		alt: item.alt,
+		caption: item.caption,
 		meta: item.meta
-	};
+	});
 }
 
 //#endregion

package/dist/media/index.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"index.mjs","names":[],"sources":["../../src/media/types.ts","../../src/media/local.ts"],"sourcesContent":["/**\n * Media Provider Types\n *\n * Media providers are pluggable sources for browsing, uploading, and embedding media.\n * They enable integration with external services (Unsplash, Cloudinary, Mux, etc.)\n * alongside the built-in local media library.\n */\n\nimport { normalizeFocalPoint } from \"./focal-point.js\";\n\n/**\n * Serializable media provider configuration descriptor\n * Returned by provider config functions (e.g., unsplash(), mux())\n */\nexport interface MediaProviderDescriptor<TConfig = Record<string, unknown>> {\n\t/** Unique identifier, used in MediaValue.provider */\n\tid: string;\n\n\t/** Display name for admin UI */\n\tname: string;\n\n\t/** Icon for tab UI (emoji or URL) */\n\ticon?: string;\n\n\t/** Module path exporting createMediaProvider function */\n\tentrypoint: string;\n\n\t/** Optional React component module for custom admin UI */\n\tadminModule?: string;\n\n\t/** Capability flags determine UI behavior */\n\tcapabilities: MediaProviderCapabilities;\n\n\t/** Serializable config passed to createMediaProvider at runtime */\n\tconfig: TConfig;\n}\n\n/**\n * Provider capabilities determine what UI elements to show\n */\nexport interface MediaProviderCapabilities {\n\t/** Can list/browse media */\n\tbrowse: boolean;\n\t/** Supports text search */\n\tsearch: boolean;\n\t/** Can upload new media */\n\tupload: boolean;\n\t/** Can delete media */\n\tdelete: boolean;\n}\n\n/**\n * Options for listing media\n */\nexport interface MediaListOptions {\n\t/** Pagination cursor */\n\tcursor?: string;\n\t/** Max items to return (default 20) */\n\tlimit?: number;\n\t/** Search query (if capabilities.search is true) */\n\tquery?: string;\n\t/** Filter by MIME type prefix, e.g., \"image/\", \"video/\" */\n\tmimeType?: string;\n}\n\n/**\n * Result from listing media\n */\nexport interface MediaListResult {\n\titems: MediaProviderItem[];\n\tnextCursor?: string;\n}\n\n/**\n * A media item as returned by a provider\n * This is the provider's view of the item, before it's selected\n */\nexport interface MediaProviderItem {\n\t/** Provider-specific ID */\n\tid: string;\n\t/** Original filename */\n\tfilename: string;\n\t/** MIME type */\n\tmimeType: string;\n\t/** File size in bytes (if known) */\n\tsize?: number;\n\t/** Dimensions (for images/video) */\n\twidth?: number;\n\theight?: number;\n\t/** Default focal point for cover-cropped displays */\n\tfocalX?: number;\n\tfocalY?: number;\n\t/** LQIP blurhash placeholder (images only) */\n\tblurhash?: string;\n\t/** LQIP dominant-color placeholder, as a CSS color (images only) */\n\tdominantColor?: string;\n\t/** Accessibility text */\n\talt?: string;\n\t/** Preview URL for admin UI thumbnail */\n\tpreviewUrl?: string;\n\t/** Provider-specific metadata */\n\tmeta?: Record<string, unknown>;\n}\n\n/**\n * Input for uploading media\n */\nexport interface MediaUploadInput {\n\tfile: File;\n\tfilename: string;\n\talt?: string;\n}\n\n/**\n * Options for generating embed\n */\nexport interface EmbedOptions {\n\t/** Desired width (provider may use for optimization) */\n\twidth?: number;\n\t/** Desired height */\n\theight?: number;\n\t/** Image format preference */\n\tformat?: \"webp\" | \"avif\" | \"jpeg\" | \"png\" | \"auto\";\n}\n\n/**\n * Embed result types\n */\nexport type EmbedResult = ImageEmbed | VideoEmbed | AudioEmbed | ComponentEmbed;\n\nexport interface ImageEmbed {\n\ttype: \"image\";\n\tsrc: string;\n\tsrcset?: string;\n\tsizes?: string;\n\twidth?: number;\n\theight?: number;\n\t/** LQIP blurhash placeholder for rendering before the image loads */\n\tblurhash?: string;\n\t/** LQIP dominant-color placeholder, as a CSS color */\n\tdominantColor?: string;\n\talt?: string;\n\t/** Base URL without transforms, for responsive image generation */\n\tcdnBaseUrl?: string;\n\t/** For providers with URL-based transforms (Cloudinary, imgix) */\n\tgetSrc?: (opts: { width?: number; height?: number; format?: string }) => string;\n}\n\nexport interface VideoEmbed {\n\ttype: \"video\";\n\t/** Single source URL */\n\tsrc?: string;\n\t/** Multiple sources for format fallback */\n\tsources?: Array<{ src: string; type: string }>;\n\t/** Poster/thumbnail image */\n\tposter?: string;\n\twidth?: number;\n\theight?: number;\n\t/** Player controls */\n\tcontrols?: boolean;\n\tautoplay?: boolean;\n\tmuted?: boolean;\n\tloop?: boolean;\n\tplaysinline?: boolean;\n\tpreload?: \"none\" | \"metadata\" | \"auto\";\n\tcrossorigin?: \"anonymous\" | \"use-credentials\";\n}\n\nexport interface AudioEmbed {\n\ttype: \"audio\";\n\tsrc?: string;\n\tsources?: Array<{ src: string; type: string }>;\n\tcontrols?: boolean;\n\tautoplay?: boolean;\n\tmuted?: boolean;\n\tloop?: boolean;\n\tpreload?: \"none\" | \"metadata\" | \"auto\";\n}\n\nexport interface ComponentEmbed {\n\ttype: \"component\";\n\t/** Package to import from, e.g., \"@mux/player-react\" */\n\tpackage: string;\n\t/** Named export (default export if not specified) */\n\texport?: string;\n\t/** Props to pass to the component */\n\tprops: Record<string, unknown>;\n}\n\n/**\n * Options for thumbnail generation\n */\nexport interface ThumbnailOptions {\n\t/** Desired width */\n\twidth?: number;\n\t/** Desired height */\n\theight?: number;\n}\n\n/**\n * Runtime media provider interface\n * Implemented by provider entrypoints\n */\nexport interface MediaProvider {\n\t/**\n\t * List/search media items\n\t */\n\tlist(options: MediaListOptions): Promise<MediaListResult>;\n\n\t/**\n\t * Get a single item by ID (optional, for refresh/validation)\n\t */\n\tget?(id: string): Promise<MediaProviderItem | null>;\n\n\t/**\n\t * Upload new media (if capabilities.upload is true)\n\t */\n\tupload?(input: MediaUploadInput): Promise<MediaProviderItem>;\n\n\t/**\n\t * Delete media (if capabilities.delete is true)\n\t */\n\tdelete?(id: string): Promise<void>;\n\n\t/**\n\t * Get embed information for rendering this media item\n\t * Called at runtime when rendering content\n\t */\n\tgetEmbed(value: MediaValue, options?: EmbedOptions): Promise<EmbedResult> | EmbedResult;\n\n\t/**\n\t * Get a thumbnail URL for admin display\n\t * For images: returns a resized image URL\n\t * For videos: returns a poster/thumbnail URL\n\t */\n\tgetThumbnailUrl?(id: string, mimeType?: string, options?: ThumbnailOptions): string;\n}\n\n/**\n * Function signature for provider entrypoint modules\n */\nexport type CreateMediaProviderFn<TConfig = Record<string, unknown>> = (\n\tconfig: TConfig,\n) => MediaProvider;\n\n/**\n * Media value stored in content fields\n * This is what gets persisted when media is selected\n *\n * For backwards compatibility:\n * - `provider` defaults to \"local\" if not specified\n * - `src` is supported for legacy data or external URLs\n */\nexport interface MediaValue {\n\t/** Provider ID, e.g., \"local\", \"unsplash\", \"mux\" (defaults to \"local\") */\n\tprovider?: string;\n\n\t/** Provider-specific item ID */\n\tid: string;\n\n\t/** Direct URL (for local media or legacy data) */\n\tsrc?: string;\n\n\t/** Preview URL for admin display (external providers) */\n\tpreviewUrl?: string;\n\n\t/** Cached metadata for display without runtime lookup */\n\tfilename?: string;\n\tmimeType?: string;\n\twidth?: number;\n\theight?: number;\n\t/** Default focal point copied when the media item is selected */\n\tfocalX?: number;\n\tfocalY?: number;\n\t/** Cached LQIP blurhash placeholder (images only) */\n\tblurhash?: string;\n\t/** Cached LQIP dominant-color placeholder, as a CSS color (images only) */\n\tdominantColor?: string;\n\talt?: string;\n\n\t/** Provider-specific data needed for embedding */\n\tmeta?: Record<string, unknown>;\n}\n\n/**\n * Convert a MediaProviderItem to a MediaValue for storage\n */\nexport function mediaItemToValue(providerId: string, item: MediaProviderItem): MediaValue {\n\tconst focalPoint = normalizeFocalPoint(item.focalX, item.focalY);\n\treturn {\n\t\tprovider: providerId,\n\t\tid: item.id,\n\t\tfilename: item.filename,\n\t\tmimeType: item.mimeType,\n\t\twidth: item.width,\n\t\theight: item.height,\n\t\t...focalPoint,\n\t\tblurhash: item.blurhash,\n\t\tdominantColor: item.dominantColor,\n\t\talt: item.alt,\n\t\tmeta: item.meta,\n\t};\n}\n","/**\n * Local Media Provider\n *\n * The built-in media provider that wraps the current storage adapter and media database.\n * This is the default provider and is available unless explicitly disabled.\n */\n\nimport type { MediaProviderDescriptor } from \"./types.js\";\n\nexport interface LocalMediaConfig {\n\t/** Whether the local provider is enabled (default true) */\n\tenabled?: boolean;\n}\n\n/**\n * Local media provider configuration\n *\n * @example\n * ```ts\n * import { localMedia } from \"emdash/media\";\n *\n * emdash({\n *   mediaProviders: [\n *     localMedia(), // Uses defaults\n *     // or: localMedia({ enabled: false }) to disable\n *   ],\n * })\n * ```\n */\nexport function localMedia(config: LocalMediaConfig = {}): MediaProviderDescriptor {\n\treturn {\n\t\tid: \"local\",\n\t\tname: \"Library\",\n\t\ticon: \"📁\",\n\t\tentrypoint: \"emdash/internal/media/local-runtime\",\n\t\tcapabilities: {\n\t\t\tbrowse: true,\n\t\t\tsearch: false, // TODO: Add search support\n\t\t\tupload: true,\n\t\t\tdelete: true,\n\t\t},\n\t\tconfig: {\n\t\t\tenabled: config.enabled ?? true,\n\t\t},\n\t};\n}\n"],"mappings":";;;;;;;;;;;;;;;;AA+RA,SAAgB,iBAAiB,YAAoB,MAAqC;CACzF,MAAM,aAAa,oBAAoB,KAAK,QAAQ,KAAK,OAAO;AAChE,QAAO;EACN,UAAU;EACV,IAAI,KAAK;EACT,UAAU,KAAK;EACf,UAAU,KAAK;EACf,OAAO,KAAK;EACZ,QAAQ,KAAK;EACb,GAAG;EACH,UAAU,KAAK;EACf,eAAe,KAAK;EACpB,KAAK,KAAK;EACV,MAAM,KAAK;EACX;;;;;;;;;;;;;;;;;;;;AChRF,SAAgB,WAAW,SAA2B,EAAE,EAA2B;AAClF,QAAO;EACN,IAAI;EACJ,MAAM;EACN,MAAM;EACN,YAAY;EACZ,cAAc;GACb,QAAQ;GACR,QAAQ;GACR,QAAQ;GACR,QAAQ;GACR;EACD,QAAQ,EACP,SAAS,OAAO,WAAW,MAC3B;EACD"}
+{"version":3,"file":"index.mjs","names":[],"sources":["../../src/media/types.ts","../../src/media/local.ts"],"sourcesContent":["/**\n * Media Provider Types\n *\n * Media providers are pluggable sources for browsing, uploading, and embedding media.\n * They enable integration with external services (Unsplash, Cloudinary, Mux, etc.)\n * alongside the built-in local media library.\n */\n\nimport { syncMediaCaption } from \"./caption.js\";\nimport { normalizeFocalPoint } from \"./focal-point.js\";\n\n/**\n * Serializable media provider configuration descriptor\n * Returned by provider config functions (e.g., unsplash(), mux())\n */\nexport interface MediaProviderDescriptor<TConfig = Record<string, unknown>> {\n\t/** Unique identifier, used in MediaValue.provider */\n\tid: string;\n\n\t/** Display name for admin UI */\n\tname: string;\n\n\t/** Icon for tab UI (emoji or URL) */\n\ticon?: string;\n\n\t/** Module path exporting createMediaProvider function */\n\tentrypoint: string;\n\n\t/** Optional React component module for custom admin UI */\n\tadminModule?: string;\n\n\t/** Capability flags determine UI behavior */\n\tcapabilities: MediaProviderCapabilities;\n\n\t/** Serializable config passed to createMediaProvider at runtime */\n\tconfig: TConfig;\n}\n\n/**\n * Provider capabilities determine what UI elements to show\n */\nexport interface MediaProviderCapabilities {\n\t/** Can list/browse media */\n\tbrowse: boolean;\n\t/** Supports text search */\n\tsearch: boolean;\n\t/** Can upload new media */\n\tupload: boolean;\n\t/** Can delete media */\n\tdelete: boolean;\n}\n\n/**\n * Options for listing media\n */\nexport interface MediaListOptions {\n\t/** Pagination cursor */\n\tcursor?: string;\n\t/** Max items to return (default 20) */\n\tlimit?: number;\n\t/** Search query (if capabilities.search is true) */\n\tquery?: string;\n\t/** Filter by MIME type prefix, e.g., \"image/\", \"video/\" */\n\tmimeType?: string;\n}\n\n/**\n * Result from listing media\n */\nexport interface MediaListResult {\n\titems: MediaProviderItem[];\n\tnextCursor?: string;\n}\n\n/**\n * A media item as returned by a provider\n * This is the provider's view of the item, before it's selected\n */\nexport interface MediaProviderItem {\n\t/** Provider-specific ID */\n\tid: string;\n\t/** Original filename */\n\tfilename: string;\n\t/** MIME type */\n\tmimeType: string;\n\t/** File size in bytes (if known) */\n\tsize?: number;\n\t/** Dimensions (for images/video) */\n\twidth?: number;\n\theight?: number;\n\t/** Default focal point for cover-cropped displays */\n\tfocalX?: number;\n\tfocalY?: number;\n\t/** LQIP blurhash placeholder (images only) */\n\tblurhash?: string;\n\t/** LQIP dominant-color placeholder, as a CSS color (images only) */\n\tdominantColor?: string;\n\t/** Accessibility text */\n\talt?: string;\n\t/** Default caption for display or attribution */\n\tcaption?: string;\n\t/** Preview URL for admin UI thumbnail */\n\tpreviewUrl?: string;\n\t/** Provider-specific metadata */\n\tmeta?: Record<string, unknown>;\n}\n\n/**\n * Input for uploading media\n */\nexport interface MediaUploadInput {\n\tfile: File;\n\tfilename: string;\n\talt?: string;\n}\n\n/**\n * Options for generating embed\n */\nexport interface EmbedOptions {\n\t/** Desired width (provider may use for optimization) */\n\twidth?: number;\n\t/** Desired height */\n\theight?: number;\n\t/** Image format preference */\n\tformat?: \"webp\" | \"avif\" | \"jpeg\" | \"png\" | \"auto\";\n\t/** Output quality (numeric or a provider-supported preset). */\n\tquality?: number | string;\n}\n\n/**\n * Embed result types\n */\nexport type EmbedResult = ImageEmbed | VideoEmbed | AudioEmbed | ComponentEmbed;\n\nexport interface ImageEmbed {\n\ttype: \"image\";\n\tsrc: string;\n\tsrcset?: string;\n\tsizes?: string;\n\twidth?: number;\n\theight?: number;\n\t/** LQIP blurhash placeholder for rendering before the image loads */\n\tblurhash?: string;\n\t/** LQIP dominant-color placeholder, as a CSS color */\n\tdominantColor?: string;\n\talt?: string;\n\t/** Base URL without transforms, for responsive image generation */\n\tcdnBaseUrl?: string;\n\t/** For providers with URL-based transforms (Cloudinary, imgix) */\n\tgetSrc?: (opts: {\n\t\twidth?: number;\n\t\theight?: number;\n\t\tformat?: string;\n\t\tquality?: EmbedOptions[\"quality\"];\n\t}) => string;\n}\n\nexport interface VideoEmbed {\n\ttype: \"video\";\n\t/** Single source URL */\n\tsrc?: string;\n\t/** Multiple sources for format fallback */\n\tsources?: Array<{ src: string; type: string }>;\n\t/** Poster/thumbnail image */\n\tposter?: string;\n\twidth?: number;\n\theight?: number;\n\t/** Player controls */\n\tcontrols?: boolean;\n\tautoplay?: boolean;\n\tmuted?: boolean;\n\tloop?: boolean;\n\tplaysinline?: boolean;\n\tpreload?: \"none\" | \"metadata\" | \"auto\";\n\tcrossorigin?: \"anonymous\" | \"use-credentials\";\n}\n\nexport interface AudioEmbed {\n\ttype: \"audio\";\n\tsrc?: string;\n\tsources?: Array<{ src: string; type: string }>;\n\tcontrols?: boolean;\n\tautoplay?: boolean;\n\tmuted?: boolean;\n\tloop?: boolean;\n\tpreload?: \"none\" | \"metadata\" | \"auto\";\n}\n\nexport interface ComponentEmbed {\n\ttype: \"component\";\n\t/** Package to import from, e.g., \"@mux/player-react\" */\n\tpackage: string;\n\t/** Named export (default export if not specified) */\n\texport?: string;\n\t/** Props to pass to the component */\n\tprops: Record<string, unknown>;\n}\n\n/**\n * Options for thumbnail generation\n */\nexport interface ThumbnailOptions {\n\t/** Desired width */\n\twidth?: number;\n\t/** Desired height */\n\theight?: number;\n}\n\n/**\n * Runtime media provider interface\n * Implemented by provider entrypoints\n */\nexport interface MediaProvider {\n\t/**\n\t * List/search media items\n\t */\n\tlist(options: MediaListOptions): Promise<MediaListResult>;\n\n\t/**\n\t * Get a single item by ID (optional, for refresh/validation)\n\t */\n\tget?(id: string): Promise<MediaProviderItem | null>;\n\n\t/**\n\t * Upload new media (if capabilities.upload is true)\n\t */\n\tupload?(input: MediaUploadInput): Promise<MediaProviderItem>;\n\n\t/**\n\t * Delete media (if capabilities.delete is true)\n\t */\n\tdelete?(id: string): Promise<void>;\n\n\t/**\n\t * Get embed information for rendering this media item\n\t * Called at runtime when rendering content\n\t */\n\tgetEmbed(value: MediaValue, options?: EmbedOptions): Promise<EmbedResult> | EmbedResult;\n\n\t/**\n\t * Get a thumbnail URL for admin display\n\t * For images: returns a resized image URL\n\t * For videos: returns a poster/thumbnail URL\n\t */\n\tgetThumbnailUrl?(id: string, mimeType?: string, options?: ThumbnailOptions): string;\n}\n\n/**\n * Function signature for provider entrypoint modules\n */\nexport type CreateMediaProviderFn<TConfig = Record<string, unknown>> = (\n\tconfig: TConfig,\n) => MediaProvider;\n\n/**\n * Media value stored in content fields\n * This is what gets persisted when media is selected\n *\n * For backwards compatibility:\n * - `provider` defaults to \"local\" if not specified\n * - `src` is supported for legacy data or external URLs\n */\nexport interface MediaValue {\n\t/** Provider ID, e.g., \"local\", \"unsplash\", \"mux\" (defaults to \"local\") */\n\tprovider?: string;\n\n\t/** Provider-specific item ID */\n\tid: string;\n\n\t/** Direct URL (for local media or legacy data) */\n\tsrc?: string;\n\n\t/** Preview URL for admin display (external providers) */\n\tpreviewUrl?: string;\n\n\t/** Cached metadata for display without runtime lookup */\n\tfilename?: string;\n\tmimeType?: string;\n\twidth?: number;\n\theight?: number;\n\t/** Default focal point copied when the media item is selected */\n\tfocalX?: number;\n\tfocalY?: number;\n\t/** Cached LQIP blurhash placeholder (images only) */\n\tblurhash?: string;\n\t/** Cached LQIP dominant-color placeholder, as a CSS color (images only) */\n\tdominantColor?: string;\n\talt?: string;\n\t/** Caption for display or attribution */\n\tcaption?: string;\n\n\t/** Provider-specific data needed for embedding */\n\tmeta?: Record<string, unknown>;\n}\n\n/**\n * Convert a MediaProviderItem to a MediaValue for storage\n */\nexport function mediaItemToValue(providerId: string, item: MediaProviderItem): MediaValue {\n\tconst focalPoint = normalizeFocalPoint(item.focalX, item.focalY);\n\treturn syncMediaCaption({\n\t\tprovider: providerId,\n\t\tid: item.id,\n\t\tfilename: item.filename,\n\t\tmimeType: item.mimeType,\n\t\twidth: item.width,\n\t\theight: item.height,\n\t\t...focalPoint,\n\t\tblurhash: item.blurhash,\n\t\tdominantColor: item.dominantColor,\n\t\talt: item.alt,\n\t\tcaption: item.caption,\n\t\tmeta: item.meta,\n\t});\n}\n","/**\n * Local Media Provider\n *\n * The built-in media provider that wraps the current storage adapter and media database.\n * This is the default provider and is available unless explicitly disabled.\n */\n\nimport type { MediaProviderDescriptor } from \"./types.js\";\n\nexport interface LocalMediaConfig {\n\t/** Whether the local provider is enabled (default true) */\n\tenabled?: boolean;\n}\n\n/**\n * Local media provider configuration\n *\n * @example\n * ```ts\n * import { localMedia } from \"emdash/media\";\n *\n * emdash({\n *   mediaProviders: [\n *     localMedia(), // Uses defaults\n *     // or: localMedia({ enabled: false }) to disable\n *   ],\n * })\n * ```\n */\nexport function localMedia(config: LocalMediaConfig = {}): MediaProviderDescriptor {\n\treturn {\n\t\tid: \"local\",\n\t\tname: \"Library\",\n\t\ticon: \"📁\",\n\t\tentrypoint: \"emdash/internal/media/local-runtime\",\n\t\tcapabilities: {\n\t\t\tbrowse: true,\n\t\t\tsearch: false, // TODO: Add search support\n\t\t\tupload: true,\n\t\t\tdelete: true,\n\t\t},\n\t\tconfig: {\n\t\t\tenabled: config.enabled ?? true,\n\t\t},\n\t};\n}\n"],"mappings":";;;;;;;;;;;;;;;;AA2SA,SAAgB,iBAAiB,YAAoB,MAAqC;CACzF,MAAM,aAAa,oBAAoB,KAAK,QAAQ,KAAK,OAAO;AAChE,QAAO,iBAAiB;EACvB,UAAU;EACV,IAAI,KAAK;EACT,UAAU,KAAK;EACf,UAAU,KAAK;EACf,OAAO,KAAK;EACZ,QAAQ,KAAK;EACb,GAAG;EACH,UAAU,KAAK;EACf,eAAe,KAAK;EACpB,KAAK,KAAK;EACV,SAAS,KAAK;EACd,MAAM,KAAK;EACX,CAAC;;;;;;;;;;;;;;;;;;;;AC7RH,SAAgB,WAAW,SAA2B,EAAE,EAA2B;AAClF,QAAO;EACN,IAAI;EACJ,MAAM;EACN,MAAM;EACN,YAAY;EACZ,cAAc;GACb,QAAQ;GACR,QAAQ;GACR,QAAQ;GACR,QAAQ;GACR;EACD,QAAQ,EACP,SAAS,OAAO,WAAW,MAC3B;EACD"}

package/dist/media/local-runtime.d.mts

@@ -1,17 +1,17 @@
-import "../parse-CWHOFc6z.mjs";
-import { t as Database } from "../types-DCFavOii.mjs";
-import "../types-QoPHm-2w.mjs";
-import "../options-DJWaq3Ie.mjs";
-import "../entry-lock-C7VX0NGK.mjs";
-import { h as MediaProviderItem, o as CreateMediaProviderFn } from "../placeholder-D41vk11_.mjs";
-import "../config-Bsm_u_oE.mjs";
-import "../runner-BObHz5FC.mjs";
-import "../storage-query-DRyu3bSU.mjs";
-import "../index-BB9sVisO.mjs";
-import { p as Storage } from "../types-Bwpzb5o6.mjs";
-import "../types-DHO7Pd25.mjs";
-import "../hreflang-CY_F5OjF.mjs";
-import "../validate-emKxGC5F.mjs";
+import "../parse-6pN8Xqg5.mjs";
+import { t as Database } from "../types-CCEHAhOv.mjs";
+import "../types-mQGTpP-4.mjs";
+import "../options-CmUpkyKW.mjs";
+import "../entry-lock-CY7XpdSw.mjs";
+import { h as MediaProviderItem, o as CreateMediaProviderFn } from "../placeholder-BlfXkucE.mjs";
+import "../config-9IzA83_U.mjs";
+import "../runner-g1A9P-wD.mjs";
+import "../storage-query-Cy0SZ8iG.mjs";
+import "../index-C37Ty40w.mjs";
+import { p as Storage } from "../types-CLVwYRBr.mjs";
+import "../types-CadaL_k8.mjs";
+import "../hreflang-D07R-RbI.mjs";
+import "../validate-mnoVfASU.mjs";
 import "../index.mjs";
 import { Kysely } from "kysely";
 

package/dist/media/local-runtime.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"local-runtime.d.mts","names":[],"sources":["../../src/media/local-runtime.ts"],"mappings":";;;;;;;;;;;;;;;;;;UA4BiB,uBAAA;EAChB,OAAA;EAEA,EAAA,GAAK,MAAA,CAAO,QAAA;;AAHb;;;;;;EAWC,KAAA,SAAc,MAAA,CAAO,QAAA;EACrB,OAAA,GAAU,OAAA;AAAA;;;;cAME,mBAAA,EAAqB,qBAAA,CAAsB,uBAAA;;;;iBAqKxC,sBAAA,CAAuB,IAAA;EACtC,EAAA;EACA,QAAA;EACA,QAAA;EACA,IAAA;EACA,KAAA;EACA,MAAA;EACA,MAAA;EACA,MAAA;EACA,GAAA;EACA,OAAA;EACA,UAAA;EACA,QAAA;EACA,aAAA;AAAA,IACG,iBAAA"}
+{"version":3,"file":"local-runtime.d.mts","names":[],"sources":["../../src/media/local-runtime.ts"],"mappings":";;;;;;;;;;;;;;;;;;UA4BiB,uBAAA;EAChB,OAAA;EAEA,EAAA,GAAK,MAAA,CAAO,QAAA;;AAHb;;;;;;EAWC,KAAA,SAAc,MAAA,CAAO,QAAA;EACrB,OAAA,GAAU,OAAA;AAAA;;;;cAME,mBAAA,EAAqB,qBAAA,CAAsB,uBAAA;;;;iBAuKxC,sBAAA,CAAuB,IAAA;EACtC,EAAA;EACA,QAAA;EACA,QAAA;EACA,IAAA;EACA,KAAA;EACA,MAAA;EACA,MAAA;EACA,MAAA;EACA,GAAA;EACA,OAAA;EACA,UAAA;EACA,QAAA;EACA,aAAA;AAAA,IACG,iBAAA"}