emdash 1.3.1 → 1.4.0

package/dist/cache-5DHbpEWu.mjs

@@ -0,0 +1,151 @@
+import { f as __exportAll } from "./runner-Bkkfk4O8.mjs";
+import { t as after } from "./after-32yNRvd2.mjs";
+import { n as invalidateSingleFlightCache, r as singleFlightCached, t as createSingleFlightCache } from "./single-flight-cache-D0EaGbN1.mjs";
+import { i as matchPattern, n as interpolateDestination, o as validatePattern, t as compilePattern } from "./patterns-CryGz_EV.mjs";
+
+//#region src/redirects/cache.ts
+/**
+* Redirect rule cache.
+*
+* Worker-isolate cache for enabled redirect rules. The middleware populates
+* this on first request; route handlers invalidate it on writes. Cached rules
+* are revalidated after they expire so writes handled by another isolate
+* become visible here too.
+*
+* A cold isolate loads the rules from its source and waits for them. Once
+* warm, requests never wait: an expired cache keeps serving while one
+* background revalidation asks the source whether the loaded version is still
+* current and reloads only when it is not. A caller that must not act on stale
+* rules asks for them to be verified, and waits for that check.
+*
+* This module deliberately has NO Astro imports so it can be safely imported
+* from handlers, seed, CLI, and tests without dragging in `astro:middleware`.
+*/
+var cache_exports = /* @__PURE__ */ __exportAll({
+	invalidateRedirectCache: () => invalidateRedirectCache,
+	loadCachedRedirects: () => loadCachedRedirects,
+	matchCachedPatterns: () => matchCachedPatterns
+});
+const REDIRECT_CACHE_TTL_MS = 3e4;
+const REDIRECT_CACHE_MAX_REFRESH_ATTEMPTS = 3;
+const REDIRECT_CACHE_KEY = Symbol.for("emdash:redirect-cache");
+const g = globalThis;
+const cacheState = g[REDIRECT_CACHE_KEY] ?? (() => {
+	const state = {
+		redirects: null,
+		expiresAt: 0,
+		generation: 0,
+		refresh: createSingleFlightCache(),
+		revalidatingUntil: 0
+	};
+	g[REDIRECT_CACHE_KEY] = state;
+	return state;
+})();
+/**
+* Invalidate the cached redirects (both exact and pattern).
+* Call when redirects are created, updated, or deleted.
+*/
+function invalidateRedirectCache() {
+	cacheState.generation++;
+	cacheState.redirects = null;
+	cacheState.expiresAt = 0;
+	cacheState.revalidatingUntil = 0;
+	invalidateSingleFlightCache(cacheState.refresh);
+}
+/** Compile a rule set into the in-memory lookup structures. */
+function compileRedirects(rules) {
+	const exact = /* @__PURE__ */ new Map();
+	for (const rule of rules.exact) exact.set(rule.source, rule);
+	const patterns = [];
+	for (const rule of rules.patterns) {
+		const patternError = validatePattern(rule.source);
+		if (patternError) {
+			console.warn(`[emdash:redirects] Skipping redirect ${rule.id}: ${patternError}`);
+			continue;
+		}
+		patterns.push({
+			redirect: rule,
+			compiled: compilePattern(rule.source)
+		});
+	}
+	return {
+		version: rules.version,
+		exact,
+		patterns
+	};
+}
+function installCachedRedirects(redirects) {
+	cacheState.redirects = redirects;
+	cacheState.expiresAt = Date.now() + REDIRECT_CACHE_TTL_MS;
+	return cacheState.redirects;
+}
+function revalidateInBackground(source, cached) {
+	const now = Date.now();
+	if (cacheState.revalidatingUntil > now) return;
+	cacheState.revalidatingUntil = now + REDIRECT_CACHE_TTL_MS;
+	const generation = cacheState.generation;
+	after(async () => {
+		try {
+			if (cached.version !== null && await source.isCurrent(cached.version)) {
+				if (generation === cacheState.generation) cacheState.expiresAt = Date.now() + REDIRECT_CACHE_TTL_MS;
+				return;
+			}
+			const loaded = compileRedirects(await source.load());
+			if (generation === cacheState.generation) installCachedRedirects(loaded);
+		} catch (error) {
+			console.error("[emdash:redirects] revalidating redirects failed:", error);
+		}
+	});
+}
+async function loadCachedRedirects(source, options = {}) {
+	let verify = options.verify === true;
+	for (let attempt = 0; attempt < REDIRECT_CACHE_MAX_REFRESH_ATTEMPTS; attempt++) {
+		const cached = cacheState.redirects;
+		if (cached && verify) {
+			verify = false;
+			let current;
+			try {
+				current = cached.version !== null && await source.isCurrent(cached.version);
+			} catch (error) {
+				console.error("[emdash:redirects] checking redirects are current failed:", error);
+				return cached;
+			}
+			if (current) {
+				if (cacheState.redirects === cached) cacheState.expiresAt = Date.now() + REDIRECT_CACHE_TTL_MS;
+				return cached;
+			}
+			if (cacheState.redirects === cached) invalidateRedirectCache();
+			continue;
+		}
+		if (cached) {
+			if (Date.now() >= cacheState.expiresAt) revalidateInBackground(source, cached);
+			return cached;
+		}
+		const generation = cacheState.generation;
+		const loaded = await singleFlightCached(cacheState.refresh, async () => compileRedirects(await source.load()), {
+			anchor: (promise) => after(() => promise),
+			ownerTimeoutMs: 3e4
+		});
+		if (generation === cacheState.generation) return installCachedRedirects(loaded);
+		if (attempt === REDIRECT_CACHE_MAX_REFRESH_ATTEMPTS - 1) return loaded;
+	}
+	throw new Error("Redirect cache refresh exhausted without loading rules");
+}
+/**
+* Match a path against the cached pattern rules.
+* Returns the resolved destination and matching redirect, or null.
+*/
+function matchCachedPatterns(rules, pathname) {
+	for (const { redirect, compiled } of rules) {
+		const params = matchPattern(compiled, pathname);
+		if (params) return {
+			redirect,
+			destination: interpolateDestination(redirect.destination, params)
+		};
+	}
+	return null;
+}
+
+//#endregion
+export { matchCachedPatterns as i, invalidateRedirectCache as n, loadCachedRedirects as r, cache_exports as t };
+//# sourceMappingURL=cache-5DHbpEWu.mjs.map

package/dist/cache-5DHbpEWu.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"cache-5DHbpEWu.mjs","names":[],"sources":["../src/redirects/cache.ts"],"sourcesContent":["/**\n * Redirect rule cache.\n *\n * Worker-isolate cache for enabled redirect rules. The middleware populates\n * this on first request; route handlers invalidate it on writes. Cached rules\n * are revalidated after they expire so writes handled by another isolate\n * become visible here too.\n *\n * A cold isolate loads the rules from its source and waits for them. Once\n * warm, requests never wait: an expired cache keeps serving while one\n * background revalidation asks the source whether the loaded version is still\n * current and reloads only when it is not. A caller that must not act on stale\n * rules asks for them to be verified, and waits for that check.\n *\n * This module deliberately has NO Astro imports so it can be safely imported\n * from handlers, seed, CLI, and tests without dragging in `astro:middleware`.\n */\n\nimport { after } from \"../after.js\";\nimport {\n\tcreateSingleFlightCache,\n\ttype SingleFlightCache,\n\tinvalidateSingleFlightCache,\n\tsingleFlightCached,\n} from \"../utils/single-flight-cache.js\";\nimport type { CompiledPattern } from \"./patterns.js\";\nimport {\n\tcompilePattern,\n\tinterpolateDestination,\n\tmatchPattern,\n\tvalidatePattern,\n} from \"./patterns.js\";\n\nexport interface RedirectRule {\n\tid: string;\n\tsource: string;\n\tdestination: string;\n\ttype: number;\n}\n\nexport interface RedirectRuleSet {\n\t/** Identifies the loaded rules for revalidation, or null when they can only be reloaded. */\n\tversion: string | null;\n\t/** Exact rules; a later rule for the same source replaces an earlier one. */\n\texact: RedirectRule[];\n\t/** Pattern rules in precedence order. */\n\tpatterns: RedirectRule[];\n}\n\nexport interface RedirectSource {\n\tload(): Promise<RedirectRuleSet>;\n\t/** Whether `version` is still the source's current rule set. */\n\tisCurrent(version: string): Promise<boolean>;\n}\n\nexport interface CachedRedirectRule {\n\tredirect: RedirectRule;\n\tcompiled: CompiledPattern;\n}\n\nexport interface CachedRedirects {\n\tversion: string | null;\n\t/** Exact-match rules indexed by source path. */\n\texact: Map<string, RedirectRule>;\n\t/** Pattern rules with their compiled regexes, in precedence order. */\n\tpatterns: CachedRedirectRule[];\n}\n\ninterface RedirectCacheState {\n\tredirects: CachedRedirects | null;\n\texpiresAt: number;\n\tgeneration: number;\n\trefresh: SingleFlightCache<CachedRedirects>;\n\trevalidatingUntil: number;\n}\n\nconst REDIRECT_CACHE_TTL_MS = 30_000;\nconst REDIRECT_CACHE_MAX_REFRESH_ATTEMPTS = 3;\nconst REDIRECT_CACHE_KEY = Symbol.for(\"emdash:redirect-cache\");\nconst g = globalThis as Record<symbol, unknown>;\nconst cacheState: RedirectCacheState =\n\t// eslint-disable-next-line typescript/no-unsafe-type-assertion -- globalThis singleton pattern (see request-context.ts)\n\t(g[REDIRECT_CACHE_KEY] as RedirectCacheState | undefined) ??\n\t(() => {\n\t\tconst state: RedirectCacheState = {\n\t\t\tredirects: null,\n\t\t\texpiresAt: 0,\n\t\t\tgeneration: 0,\n\t\t\trefresh: createSingleFlightCache<CachedRedirects>(),\n\t\t\trevalidatingUntil: 0,\n\t\t};\n\t\tg[REDIRECT_CACHE_KEY] = state;\n\t\treturn state;\n\t})();\n\n/**\n * Invalidate the cached redirects (both exact and pattern).\n * Call when redirects are created, updated, or deleted.\n */\nexport function invalidateRedirectCache(): void {\n\tcacheState.generation++;\n\tcacheState.redirects = null;\n\tcacheState.expiresAt = 0;\n\tcacheState.revalidatingUntil = 0;\n\tinvalidateSingleFlightCache(cacheState.refresh);\n}\n\n/** Compile a rule set into the in-memory lookup structures. */\nfunction compileRedirects(rules: RedirectRuleSet): CachedRedirects {\n\tconst exact = new Map<string, RedirectRule>();\n\tfor (const rule of rules.exact) exact.set(rule.source, rule);\n\tconst patterns: CachedRedirectRule[] = [];\n\tfor (const rule of rules.patterns) {\n\t\tconst patternError = validatePattern(rule.source);\n\t\tif (patternError) {\n\t\t\tconsole.warn(`[emdash:redirects] Skipping redirect ${rule.id}: ${patternError}`);\n\t\t\tcontinue;\n\t\t}\n\t\tpatterns.push({ redirect: rule, compiled: compilePattern(rule.source) });\n\t}\n\treturn { version: rules.version, exact, patterns };\n}\n\nfunction installCachedRedirects(redirects: CachedRedirects): CachedRedirects {\n\tcacheState.redirects = redirects;\n\tcacheState.expiresAt = Date.now() + REDIRECT_CACHE_TTL_MS;\n\treturn cacheState.redirects;\n}\n\nfunction revalidateInBackground(source: RedirectSource, cached: CachedRedirects): void {\n\tconst now = Date.now();\n\tif (cacheState.revalidatingUntil > now) return;\n\tcacheState.revalidatingUntil = now + REDIRECT_CACHE_TTL_MS;\n\tconst generation = cacheState.generation;\n\tafter(async () => {\n\t\ttry {\n\t\t\tif (cached.version !== null && (await source.isCurrent(cached.version))) {\n\t\t\t\tif (generation === cacheState.generation) {\n\t\t\t\t\tcacheState.expiresAt = Date.now() + REDIRECT_CACHE_TTL_MS;\n\t\t\t\t}\n\t\t\t\treturn;\n\t\t\t}\n\t\t\tconst loaded = compileRedirects(await source.load());\n\t\t\tif (generation === cacheState.generation) installCachedRedirects(loaded);\n\t\t} catch (error) {\n\t\t\tconsole.error(\"[emdash:redirects] revalidating redirects failed:\", error);\n\t\t}\n\t});\n}\n\nexport interface LoadCachedRedirectsOptions {\n\t/**\n\t * Confirm the cached rules are current before returning them, reloading\n\t * them when they are not, instead of revalidating in the background. If the\n\t * check fails, the cached rules are returned.\n\t */\n\tverify?: boolean;\n}\n\nexport async function loadCachedRedirects(\n\tsource: RedirectSource,\n\toptions: LoadCachedRedirectsOptions = {},\n): Promise<CachedRedirects> {\n\tlet verify = options.verify === true;\n\tfor (let attempt = 0; attempt < REDIRECT_CACHE_MAX_REFRESH_ATTEMPTS; attempt++) {\n\t\tconst cached = cacheState.redirects;\n\t\tif (cached && verify) {\n\t\t\tverify = false;\n\t\t\tlet current: boolean;\n\t\t\ttry {\n\t\t\t\tcurrent = cached.version !== null && (await source.isCurrent(cached.version));\n\t\t\t} catch (error) {\n\t\t\t\tconsole.error(\"[emdash:redirects] checking redirects are current failed:\", error);\n\t\t\t\treturn cached;\n\t\t\t}\n\t\t\tif (current) {\n\t\t\t\tif (cacheState.redirects === cached) {\n\t\t\t\t\tcacheState.expiresAt = Date.now() + REDIRECT_CACHE_TTL_MS;\n\t\t\t\t}\n\t\t\t\treturn cached;\n\t\t\t}\n\t\t\tif (cacheState.redirects === cached) invalidateRedirectCache();\n\t\t\tcontinue;\n\t\t}\n\t\tif (cached) {\n\t\t\tif (Date.now() >= cacheState.expiresAt) revalidateInBackground(source, cached);\n\t\t\treturn cached;\n\t\t}\n\n\t\tconst generation = cacheState.generation;\n\t\tconst loaded = await singleFlightCached(\n\t\t\tcacheState.refresh,\n\t\t\tasync () => compileRedirects(await source.load()),\n\t\t\t{ anchor: (promise) => after(() => promise), ownerTimeoutMs: 30_000 },\n\t\t);\n\n\t\tif (generation === cacheState.generation) {\n\t\t\treturn installCachedRedirects(loaded);\n\t\t}\n\n\t\tif (attempt === REDIRECT_CACHE_MAX_REFRESH_ATTEMPTS - 1) {\n\t\t\treturn loaded;\n\t\t}\n\t}\n\n\tthrow new Error(\"Redirect cache refresh exhausted without loading rules\");\n}\n\n/**\n * Match a path against the cached pattern rules.\n * Returns the resolved destination and matching redirect, or null.\n */\nexport function matchCachedPatterns(\n\trules: CachedRedirectRule[],\n\tpathname: string,\n): { redirect: RedirectRule; destination: string } | null {\n\tfor (const { redirect, compiled } of rules) {\n\t\tconst params = matchPattern(compiled, pathname);\n\t\tif (params) {\n\t\t\tconst dest = interpolateDestination(redirect.destination, params);\n\t\t\treturn { redirect, destination: dest };\n\t\t}\n\t}\n\treturn null;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;AA4EA,MAAM,wBAAwB;AAC9B,MAAM,sCAAsC;AAC5C,MAAM,qBAAqB,OAAO,IAAI,wBAAwB;AAC9D,MAAM,IAAI;AACV,MAAM,aAEJ,EAAE,8BACI;CACN,MAAM,QAA4B;EACjC,WAAW;EACX,WAAW;EACX,YAAY;EACZ,SAAS,yBAA0C;EACnD,mBAAmB;EACnB;AACD,GAAE,sBAAsB;AACxB,QAAO;IACJ;;;;;AAML,SAAgB,0BAAgC;AAC/C,YAAW;AACX,YAAW,YAAY;AACvB,YAAW,YAAY;AACvB,YAAW,oBAAoB;AAC/B,6BAA4B,WAAW,QAAQ;;;AAIhD,SAAS,iBAAiB,OAAyC;CAClE,MAAM,wBAAQ,IAAI,KAA2B;AAC7C,MAAK,MAAM,QAAQ,MAAM,MAAO,OAAM,IAAI,KAAK,QAAQ,KAAK;CAC5D,MAAM,WAAiC,EAAE;AACzC,MAAK,MAAM,QAAQ,MAAM,UAAU;EAClC,MAAM,eAAe,gBAAgB,KAAK,OAAO;AACjD,MAAI,cAAc;AACjB,WAAQ,KAAK,wCAAwC,KAAK,GAAG,IAAI,eAAe;AAChF;;AAED,WAAS,KAAK;GAAE,UAAU;GAAM,UAAU,eAAe,KAAK,OAAO;GAAE,CAAC;;AAEzE,QAAO;EAAE,SAAS,MAAM;EAAS;EAAO;EAAU;;AAGnD,SAAS,uBAAuB,WAA6C;AAC5E,YAAW,YAAY;AACvB,YAAW,YAAY,KAAK,KAAK,GAAG;AACpC,QAAO,WAAW;;AAGnB,SAAS,uBAAuB,QAAwB,QAA+B;CACtF,MAAM,MAAM,KAAK,KAAK;AACtB,KAAI,WAAW,oBAAoB,IAAK;AACxC,YAAW,oBAAoB,MAAM;CACrC,MAAM,aAAa,WAAW;AAC9B,OAAM,YAAY;AACjB,MAAI;AACH,OAAI,OAAO,YAAY,QAAS,MAAM,OAAO,UAAU,OAAO,QAAQ,EAAG;AACxE,QAAI,eAAe,WAAW,WAC7B,YAAW,YAAY,KAAK,KAAK,GAAG;AAErC;;GAED,MAAM,SAAS,iBAAiB,MAAM,OAAO,MAAM,CAAC;AACpD,OAAI,eAAe,WAAW,WAAY,wBAAuB,OAAO;WAChE,OAAO;AACf,WAAQ,MAAM,qDAAqD,MAAM;;GAEzE;;AAYH,eAAsB,oBACrB,QACA,UAAsC,EAAE,EACb;CAC3B,IAAI,SAAS,QAAQ,WAAW;AAChC,MAAK,IAAI,UAAU,GAAG,UAAU,qCAAqC,WAAW;EAC/E,MAAM,SAAS,WAAW;AAC1B,MAAI,UAAU,QAAQ;AACrB,YAAS;GACT,IAAI;AACJ,OAAI;AACH,cAAU,OAAO,YAAY,QAAS,MAAM,OAAO,UAAU,OAAO,QAAQ;YACpE,OAAO;AACf,YAAQ,MAAM,6DAA6D,MAAM;AACjF,WAAO;;AAER,OAAI,SAAS;AACZ,QAAI,WAAW,cAAc,OAC5B,YAAW,YAAY,KAAK,KAAK,GAAG;AAErC,WAAO;;AAER,OAAI,WAAW,cAAc,OAAQ,0BAAyB;AAC9D;;AAED,MAAI,QAAQ;AACX,OAAI,KAAK,KAAK,IAAI,WAAW,UAAW,wBAAuB,QAAQ,OAAO;AAC9E,UAAO;;EAGR,MAAM,aAAa,WAAW;EAC9B,MAAM,SAAS,MAAM,mBACpB,WAAW,SACX,YAAY,iBAAiB,MAAM,OAAO,MAAM,CAAC,EACjD;GAAE,SAAS,YAAY,YAAY,QAAQ;GAAE,gBAAgB;GAAQ,CACrE;AAED,MAAI,eAAe,WAAW,WAC7B,QAAO,uBAAuB,OAAO;AAGtC,MAAI,YAAY,sCAAsC,EACrD,QAAO;;AAIT,OAAM,IAAI,MAAM,yDAAyD;;;;;;AAO1E,SAAgB,oBACf,OACA,UACyD;AACzD,MAAK,MAAM,EAAE,UAAU,cAAc,OAAO;EAC3C,MAAM,SAAS,aAAa,UAAU,SAAS;AAC/C,MAAI,OAEH,QAAO;GAAE;GAAU,aADN,uBAAuB,SAAS,aAAa,OAAO;GAC3B;;AAGxC,QAAO"}

package/dist/canonical-BudtH-Fx.mjs

@@ -0,0 +1,174 @@
+//#region src/transfer/format/limits.ts
+/**
+* Hard limits for site packages and transfer operations.
+*
+* Package limits are part of the format contract: an exporter must never
+* produce a package that exceeds them and a reader must reject one that does
+* before doing expensive work. Operation limits bound one `advance` step so it
+* fits a Workers request on D1.
+*/
+const MiB = 1024 * 1024;
+const TRANSFER_LIMITS = Object.freeze({
+	manifestBytes: 8 * MiB,
+	recordLineBytes: 19e5,
+	chunkBytes: 4 * MiB,
+	chunkRecords: 1e3,
+	totalRecords: 5e6,
+	jsonDepth: 64,
+	totalFiles: 1e6,
+	indexChunks: 1e3,
+	defaultMaxBlobBytes: 50 * MiB,
+	idLength: 1024,
+	shortString: 4096,
+	stepQueryCeiling: 900,
+	stepQueries: 150,
+	stepClosingQueries: 2,
+	stepBytes: 32 * MiB,
+	d1BindParameters: 100,
+	leaseSeconds: 300,
+	pendingImportTtlSeconds: 1440 * 60,
+	exportTtlSeconds: 10080 * 60,
+	approvalTtlSeconds: 900,
+	exportFenceAttempts: 3,
+	verificationMismatches: 50,
+	planIssues: 500
+});
+/**
+* Rows per multi-row INSERT so a statement stays within D1's bound-parameter
+* limit. Returns 0 when a single row needs more parameters than the limit;
+* callers then insert core columns first and set the rest with batched
+* UPDATEs.
+*/
+function rowsPerInsert(columnCount) {
+	if (!Number.isInteger(columnCount) || columnCount < 1) throw new RangeError(`Invalid column count ${columnCount}`);
+	return Math.floor(TRANSFER_LIMITS.d1BindParameters / columnCount);
+}
+
+//#endregion
+//#region src/transfer/format/canonical.ts
+/**
+* Canonical JSON serialization for site packages.
+*
+* Rules (normative for formatVersion "1"):
+* - object keys are sorted by UTF-16 code unit order ({@link compareUtf16});
+* - no insignificant whitespace;
+* - strings and numbers are encoded exactly as `JSON.stringify` encodes them;
+* - object properties whose value is `undefined` are omitted;
+* - `undefined` inside an array, non-finite numbers, and any value that is not
+*   a plain object, array, string, finite number, boolean, or `null` are
+*   rejected;
+* - nesting depth is at most {@link TRANSFER_LIMITS.jsonDepth} containers
+*   (the root object or array is depth 1).
+*
+* The manifest, every NDJSON line, the plan, the receipt, and logical digests
+* all use this one implementation.
+*/
+var CanonicalJsonError = class extends Error {
+	path;
+	constructor(message, path) {
+		super(`${message} at ${path}`);
+		this.name = "CanonicalJsonError";
+		this.path = path;
+	}
+};
+function compareUtf16(a, b) {
+	if (a === b) return 0;
+	return a < b ? -1 : 1;
+}
+function canonicalJson(value, options = {}) {
+	const maxDepth = options.maxDepth ?? TRANSFER_LIMITS.jsonDepth;
+	const parts = [];
+	write(value, parts, 0, maxDepth, "$");
+	return parts.join("");
+}
+function write(value, out, depth, maxDepth, path) {
+	if (value === null) {
+		out.push("null");
+		return;
+	}
+	switch (typeof value) {
+		case "string":
+			out.push(JSON.stringify(value));
+			return;
+		case "number":
+			if (!Number.isFinite(value)) throw new CanonicalJsonError("Non-finite number", path);
+			out.push(JSON.stringify(value));
+			return;
+		case "boolean":
+			out.push(value ? "true" : "false");
+			return;
+		case "object": break;
+		default: throw new CanonicalJsonError(`Unsupported ${typeof value} value`, path);
+	}
+	if (depth + 1 > maxDepth) throw new CanonicalJsonError(`Nesting deeper than ${maxDepth}`, path);
+	if (Array.isArray(value)) {
+		out.push("[");
+		for (let index = 0; index < value.length; index++) {
+			if (index > 0) out.push(",");
+			const item = value[index];
+			if (item === void 0) throw new CanonicalJsonError("Undefined array item", `${path}[${index}]`);
+			write(item, out, depth + 1, maxDepth, `${path}[${index}]`);
+		}
+		out.push("]");
+		return;
+	}
+	const prototype = Object.getPrototypeOf(value);
+	if (prototype !== Object.prototype && prototype !== null) throw new CanonicalJsonError("Non-plain object", path);
+	const present = Object.entries(value).filter(([, item]) => item !== void 0).toSorted(([a], [b]) => compareUtf16(a, b));
+	out.push("{");
+	present.forEach(([key, item], index) => {
+		if (index > 0) out.push(",");
+		out.push(JSON.stringify(key), ":");
+		write(item, out, depth + 1, maxDepth, `${path}.${key}`);
+	});
+	out.push("}");
+}
+/**
+* Container nesting depth of a JSON text, measured without parsing it so an
+* adversarial document cannot exhaust the parser's stack first. Returns
+* `Infinity` as soon as `limit` is exceeded.
+*/
+function measureJsonDepth(text, limit = TRANSFER_LIMITS.jsonDepth) {
+	let depth = 0;
+	let max = 0;
+	let inString = false;
+	for (let index = 0; index < text.length; index++) {
+		const code = text.charCodeAt(index);
+		if (inString) {
+			if (code === 92) index++;
+			else if (code === 34) inString = false;
+			continue;
+		}
+		if (code === 34) inString = true;
+		else if (code === 123 || code === 91) {
+			depth++;
+			if (depth > max) {
+				max = depth;
+				if (max > limit) return Number.POSITIVE_INFINITY;
+			}
+		} else if (code === 125 || code === 93) depth--;
+	}
+	return max;
+}
+/**
+* Parse a JSON text that must already be in canonical form. Throws
+* {@link CanonicalJsonError} when the depth limit is exceeded, the text is not
+* valid JSON, or re-serializing the parsed value does not reproduce the text
+* byte for byte.
+*/
+function parseCanonicalJson(text, options = {}) {
+	const maxDepth = options.maxDepth ?? TRANSFER_LIMITS.jsonDepth;
+	if (measureJsonDepth(text, maxDepth) > maxDepth) throw new CanonicalJsonError(`Nesting deeper than ${maxDepth}`, "$");
+	let parsed;
+	try {
+		parsed = JSON.parse(text);
+	} catch {
+		throw new CanonicalJsonError("Invalid JSON", "$");
+	}
+	if (canonicalJson(parsed, { maxDepth }) !== text) throw new CanonicalJsonError("JSON is not in canonical form", "$");
+	return parsed;
+}
+
+//#endregion
+export { parseCanonicalJson as a, measureJsonDepth as i, canonicalJson as n, TRANSFER_LIMITS as o, compareUtf16 as r, rowsPerInsert as s, CanonicalJsonError as t };
+//# sourceMappingURL=canonical-BudtH-Fx.mjs.map

package/dist/canonical-BudtH-Fx.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"canonical-BudtH-Fx.mjs","names":[],"sources":["../src/transfer/format/limits.ts","../src/transfer/format/canonical.ts"],"sourcesContent":["/**\n * Hard limits for site packages and transfer operations.\n *\n * Package limits are part of the format contract: an exporter must never\n * produce a package that exceeds them and a reader must reject one that does\n * before doing expensive work. Operation limits bound one `advance` step so it\n * fits a Workers request on D1.\n */\n\nconst MiB = 1024 * 1024;\n\nexport const TRANSFER_LIMITS = Object.freeze({\n\t/** Maximum `manifest.json` size in bytes. */\n\tmanifestBytes: 8 * MiB,\n\t/**\n\t * Maximum bytes in one NDJSON line, excluding the newline. Kept under D1's\n\t * 2 MB row/statement ceiling so every record can be written in one row.\n\t */\n\trecordLineBytes: 1_900_000,\n\t/** Maximum bytes in one record or index chunk file. */\n\tchunkBytes: 4 * MiB,\n\t/** Maximum records (or index entries) in one chunk file. */\n\tchunkRecords: 1000,\n\t/** Maximum records across every kind. */\n\ttotalRecords: 5_000_000,\n\t/** Maximum container nesting of any JSON value (root = 1). */\n\tjsonDepth: 64,\n\t/** Maximum files (record chunks + media blobs) listed by the index. */\n\ttotalFiles: 1_000_000,\n\t/** Maximum index chunk files listed by the manifest. */\n\tindexChunks: 1000,\n\t/** Default per-blob ceiling; the target's `maxUploadSize` overrides it. */\n\tdefaultMaxBlobBytes: 50 * MiB,\n\n\t/** Maximum length of a portable id (including synthetic composite ids). */\n\tidLength: 1024,\n\t/** Maximum length of short strings: slugs, names, labels, locales, mime types. */\n\tshortString: 4096,\n\n\t/** Operation step: stop starting work once this many queries ran in the request. */\n\tstepQueryCeiling: 900,\n\t/** Operation step: queries a unit of work may use; checked before starting it. */\n\tstepQueries: 150,\n\t/**\n\t * Operation step: queries kept back from the ceiling for the writes that\n\t * end a step once no more units start (a checkpoint and the lease\n\t * release, or the read and write that record a failed step).\n\t */\n\tstepClosingQueries: 2,\n\t/** Operation step: media bytes copied per step (a larger single blob gets its own step). */\n\tstepBytes: 32 * MiB,\n\t/** D1 bound parameters per statement. */\n\td1BindParameters: 100,\n\n\t/** Operation lease duration. */\n\tleaseSeconds: 5 * 60,\n\t/** Uploading / analyzing / planned imports expire after this long. */\n\tpendingImportTtlSeconds: 24 * 60 * 60,\n\t/** Completed exports expire (and their staging is collected) after this long. */\n\texportTtlSeconds: 7 * 24 * 60 * 60,\n\t/**\n\t * MCP approval grant lifetime: a pending grant expires this long after it\n\t * is requested, and an approved one this long after it is approved.\n\t */\n\tapprovalTtlSeconds: 15 * 60,\n\t/** Export attempts before failing with TRANSFER_EXPORT_CONCURRENT_WRITES. */\n\texportFenceAttempts: 3,\n\t/** Maximum mismatches kept in a verification failure detail. */\n\tverificationMismatches: 50,\n\t/** Maximum warnings or blockers kept in a plan (the rest are summarized by count). */\n\tplanIssues: 500,\n});\n\nexport type TransferLimits = typeof TRANSFER_LIMITS;\n\n/**\n * Rows per multi-row INSERT so a statement stays within D1's bound-parameter\n * limit. Returns 0 when a single row needs more parameters than the limit;\n * callers then insert core columns first and set the rest with batched\n * UPDATEs.\n */\nexport function rowsPerInsert(columnCount: number): number {\n\tif (!Number.isInteger(columnCount) || columnCount < 1) {\n\t\tthrow new RangeError(`Invalid column count ${columnCount}`);\n\t}\n\treturn Math.floor(TRANSFER_LIMITS.d1BindParameters / columnCount);\n}\n","/**\n * Canonical JSON serialization for site packages.\n *\n * Rules (normative for formatVersion \"1\"):\n * - object keys are sorted by UTF-16 code unit order ({@link compareUtf16});\n * - no insignificant whitespace;\n * - strings and numbers are encoded exactly as `JSON.stringify` encodes them;\n * - object properties whose value is `undefined` are omitted;\n * - `undefined` inside an array, non-finite numbers, and any value that is not\n *   a plain object, array, string, finite number, boolean, or `null` are\n *   rejected;\n * - nesting depth is at most {@link TRANSFER_LIMITS.jsonDepth} containers\n *   (the root object or array is depth 1).\n *\n * The manifest, every NDJSON line, the plan, the receipt, and logical digests\n * all use this one implementation.\n */\n\nimport { TRANSFER_LIMITS } from \"./limits.js\";\n\nexport class CanonicalJsonError extends Error {\n\treadonly path: string;\n\n\tconstructor(message: string, path: string) {\n\t\tsuper(`${message} at ${path}`);\n\t\tthis.name = \"CanonicalJsonError\";\n\t\tthis.path = path;\n\t}\n}\n\nexport type JsonPrimitive = string | number | boolean | null;\nexport type JsonValue = JsonPrimitive | JsonValue[] | { [key: string]: JsonValue };\n\nexport function compareUtf16(a: string, b: string): number {\n\tif (a === b) return 0;\n\treturn a < b ? -1 : 1;\n}\n\nexport function canonicalJson(value: unknown, options: { maxDepth?: number } = {}): string {\n\tconst maxDepth = options.maxDepth ?? TRANSFER_LIMITS.jsonDepth;\n\tconst parts: string[] = [];\n\twrite(value, parts, 0, maxDepth, \"$\");\n\treturn parts.join(\"\");\n}\n\nfunction write(value: unknown, out: string[], depth: number, maxDepth: number, path: string): void {\n\tif (value === null) {\n\t\tout.push(\"null\");\n\t\treturn;\n\t}\n\tswitch (typeof value) {\n\t\tcase \"string\":\n\t\t\tout.push(JSON.stringify(value));\n\t\t\treturn;\n\t\tcase \"number\":\n\t\t\tif (!Number.isFinite(value)) throw new CanonicalJsonError(\"Non-finite number\", path);\n\t\t\tout.push(JSON.stringify(value));\n\t\t\treturn;\n\t\tcase \"boolean\":\n\t\t\tout.push(value ? \"true\" : \"false\");\n\t\t\treturn;\n\t\tcase \"object\":\n\t\t\tbreak;\n\t\tdefault:\n\t\t\tthrow new CanonicalJsonError(`Unsupported ${typeof value} value`, path);\n\t}\n\n\tif (depth + 1 > maxDepth) {\n\t\tthrow new CanonicalJsonError(`Nesting deeper than ${maxDepth}`, path);\n\t}\n\n\tif (Array.isArray(value)) {\n\t\tout.push(\"[\");\n\t\tfor (let index = 0; index < value.length; index++) {\n\t\t\tif (index > 0) out.push(\",\");\n\t\t\tconst item: unknown = value[index];\n\t\t\tif (item === undefined)\n\t\t\t\tthrow new CanonicalJsonError(\"Undefined array item\", `${path}[${index}]`);\n\t\t\twrite(item, out, depth + 1, maxDepth, `${path}[${index}]`);\n\t\t}\n\t\tout.push(\"]\");\n\t\treturn;\n\t}\n\n\tconst prototype: unknown = Object.getPrototypeOf(value);\n\tif (prototype !== Object.prototype && prototype !== null) {\n\t\tthrow new CanonicalJsonError(\"Non-plain object\", path);\n\t}\n\tconst entries: Array<[string, unknown]> = Object.entries(value);\n\tconst present = entries\n\t\t.filter(([, item]) => item !== undefined)\n\t\t.toSorted(([a], [b]) => compareUtf16(a, b));\n\tout.push(\"{\");\n\tpresent.forEach(([key, item], index) => {\n\t\tif (index > 0) out.push(\",\");\n\t\tout.push(JSON.stringify(key), \":\");\n\t\twrite(item, out, depth + 1, maxDepth, `${path}.${key}`);\n\t});\n\tout.push(\"}\");\n}\n\n/**\n * Container nesting depth of a JSON text, measured without parsing it so an\n * adversarial document cannot exhaust the parser's stack first. Returns\n * `Infinity` as soon as `limit` is exceeded.\n */\nexport function measureJsonDepth(text: string, limit: number = TRANSFER_LIMITS.jsonDepth): number {\n\tlet depth = 0;\n\tlet max = 0;\n\tlet inString = false;\n\tfor (let index = 0; index < text.length; index++) {\n\t\tconst code = text.charCodeAt(index);\n\t\tif (inString) {\n\t\t\tif (code === 0x5c) index++;\n\t\t\telse if (code === 0x22) inString = false;\n\t\t\tcontinue;\n\t\t}\n\t\tif (code === 0x22) inString = true;\n\t\telse if (code === 0x7b || code === 0x5b) {\n\t\t\tdepth++;\n\t\t\tif (depth > max) {\n\t\t\t\tmax = depth;\n\t\t\t\tif (max > limit) return Number.POSITIVE_INFINITY;\n\t\t\t}\n\t\t} else if (code === 0x7d || code === 0x5d) depth--;\n\t}\n\treturn max;\n}\n\n/**\n * Parse a JSON text that must already be in canonical form. Throws\n * {@link CanonicalJsonError} when the depth limit is exceeded, the text is not\n * valid JSON, or re-serializing the parsed value does not reproduce the text\n * byte for byte.\n */\nexport function parseCanonicalJson(text: string, options: { maxDepth?: number } = {}): unknown {\n\tconst maxDepth = options.maxDepth ?? TRANSFER_LIMITS.jsonDepth;\n\tif (measureJsonDepth(text, maxDepth) > maxDepth) {\n\t\tthrow new CanonicalJsonError(`Nesting deeper than ${maxDepth}`, \"$\");\n\t}\n\tlet parsed: unknown;\n\ttry {\n\t\tparsed = JSON.parse(text);\n\t} catch {\n\t\tthrow new CanonicalJsonError(\"Invalid JSON\", \"$\");\n\t}\n\tif (canonicalJson(parsed, { maxDepth }) !== text) {\n\t\tthrow new CanonicalJsonError(\"JSON is not in canonical form\", \"$\");\n\t}\n\treturn parsed;\n}\n"],"mappings":";;;;;;;;;AASA,MAAM,MAAM,OAAO;AAEnB,MAAa,kBAAkB,OAAO,OAAO;CAE5C,eAAe,IAAI;CAKnB,iBAAiB;CAEjB,YAAY,IAAI;CAEhB,cAAc;CAEd,cAAc;CAEd,WAAW;CAEX,YAAY;CAEZ,aAAa;CAEb,qBAAqB,KAAK;CAG1B,UAAU;CAEV,aAAa;CAGb,kBAAkB;CAElB,aAAa;CAMb,oBAAoB;CAEpB,WAAW,KAAK;CAEhB,kBAAkB;CAGlB,cAAc;CAEd,yBAAyB,OAAU;CAEnC,kBAAkB,QAAc;CAKhC,oBAAoB;CAEpB,qBAAqB;CAErB,wBAAwB;CAExB,YAAY;CACZ,CAAC;;;;;;;AAUF,SAAgB,cAAc,aAA6B;AAC1D,KAAI,CAAC,OAAO,UAAU,YAAY,IAAI,cAAc,EACnD,OAAM,IAAI,WAAW,wBAAwB,cAAc;AAE5D,QAAO,KAAK,MAAM,gBAAgB,mBAAmB,YAAY;;;;;;;;;;;;;;;;;;;;;;ACjElE,IAAa,qBAAb,cAAwC,MAAM;CAC7C,AAAS;CAET,YAAY,SAAiB,MAAc;AAC1C,QAAM,GAAG,QAAQ,MAAM,OAAO;AAC9B,OAAK,OAAO;AACZ,OAAK,OAAO;;;AAOd,SAAgB,aAAa,GAAW,GAAmB;AAC1D,KAAI,MAAM,EAAG,QAAO;AACpB,QAAO,IAAI,IAAI,KAAK;;AAGrB,SAAgB,cAAc,OAAgB,UAAiC,EAAE,EAAU;CAC1F,MAAM,WAAW,QAAQ,YAAY,gBAAgB;CACrD,MAAM,QAAkB,EAAE;AAC1B,OAAM,OAAO,OAAO,GAAG,UAAU,IAAI;AACrC,QAAO,MAAM,KAAK,GAAG;;AAGtB,SAAS,MAAM,OAAgB,KAAe,OAAe,UAAkB,MAAoB;AAClG,KAAI,UAAU,MAAM;AACnB,MAAI,KAAK,OAAO;AAChB;;AAED,SAAQ,OAAO,OAAf;EACC,KAAK;AACJ,OAAI,KAAK,KAAK,UAAU,MAAM,CAAC;AAC/B;EACD,KAAK;AACJ,OAAI,CAAC,OAAO,SAAS,MAAM,CAAE,OAAM,IAAI,mBAAmB,qBAAqB,KAAK;AACpF,OAAI,KAAK,KAAK,UAAU,MAAM,CAAC;AAC/B;EACD,KAAK;AACJ,OAAI,KAAK,QAAQ,SAAS,QAAQ;AAClC;EACD,KAAK,SACJ;EACD,QACC,OAAM,IAAI,mBAAmB,eAAe,OAAO,MAAM,SAAS,KAAK;;AAGzE,KAAI,QAAQ,IAAI,SACf,OAAM,IAAI,mBAAmB,uBAAuB,YAAY,KAAK;AAGtE,KAAI,MAAM,QAAQ,MAAM,EAAE;AACzB,MAAI,KAAK,IAAI;AACb,OAAK,IAAI,QAAQ,GAAG,QAAQ,MAAM,QAAQ,SAAS;AAClD,OAAI,QAAQ,EAAG,KAAI,KAAK,IAAI;GAC5B,MAAM,OAAgB,MAAM;AAC5B,OAAI,SAAS,OACZ,OAAM,IAAI,mBAAmB,wBAAwB,GAAG,KAAK,GAAG,MAAM,GAAG;AAC1E,SAAM,MAAM,KAAK,QAAQ,GAAG,UAAU,GAAG,KAAK,GAAG,MAAM,GAAG;;AAE3D,MAAI,KAAK,IAAI;AACb;;CAGD,MAAM,YAAqB,OAAO,eAAe,MAAM;AACvD,KAAI,cAAc,OAAO,aAAa,cAAc,KACnD,OAAM,IAAI,mBAAmB,oBAAoB,KAAK;CAGvD,MAAM,UADoC,OAAO,QAAQ,MAAM,CAE7D,QAAQ,GAAG,UAAU,SAAS,OAAU,CACxC,UAAU,CAAC,IAAI,CAAC,OAAO,aAAa,GAAG,EAAE,CAAC;AAC5C,KAAI,KAAK,IAAI;AACb,SAAQ,SAAS,CAAC,KAAK,OAAO,UAAU;AACvC,MAAI,QAAQ,EAAG,KAAI,KAAK,IAAI;AAC5B,MAAI,KAAK,KAAK,UAAU,IAAI,EAAE,IAAI;AAClC,QAAM,MAAM,KAAK,QAAQ,GAAG,UAAU,GAAG,KAAK,GAAG,MAAM;GACtD;AACF,KAAI,KAAK,IAAI;;;;;;;AAQd,SAAgB,iBAAiB,MAAc,QAAgB,gBAAgB,WAAmB;CACjG,IAAI,QAAQ;CACZ,IAAI,MAAM;CACV,IAAI,WAAW;AACf,MAAK,IAAI,QAAQ,GAAG,QAAQ,KAAK,QAAQ,SAAS;EACjD,MAAM,OAAO,KAAK,WAAW,MAAM;AACnC,MAAI,UAAU;AACb,OAAI,SAAS,GAAM;YACV,SAAS,GAAM,YAAW;AACnC;;AAED,MAAI,SAAS,GAAM,YAAW;WACrB,SAAS,OAAQ,SAAS,IAAM;AACxC;AACA,OAAI,QAAQ,KAAK;AAChB,UAAM;AACN,QAAI,MAAM,MAAO,QAAO,OAAO;;aAEtB,SAAS,OAAQ,SAAS,GAAM;;AAE5C,QAAO;;;;;;;;AASR,SAAgB,mBAAmB,MAAc,UAAiC,EAAE,EAAW;CAC9F,MAAM,WAAW,QAAQ,YAAY,gBAAgB;AACrD,KAAI,iBAAiB,MAAM,SAAS,GAAG,SACtC,OAAM,IAAI,mBAAmB,uBAAuB,YAAY,IAAI;CAErE,IAAI;AACJ,KAAI;AACH,WAAS,KAAK,MAAM,KAAK;SAClB;AACP,QAAM,IAAI,mBAAmB,gBAAgB,IAAI;;AAElD,KAAI,cAAc,QAAQ,EAAE,UAAU,CAAC,KAAK,KAC3C,OAAM,IAAI,mBAAmB,iCAAiC,IAAI;AAEnE,QAAO"}