@_linked/server 2.7.5 → 2.9.0

package/CHANGELOG.md

@@ -1,5 +1,80 @@
 # @\_linked/server
 
+## 2.9.0
+
+### Minor Changes
+
+- [#65](https://github.com/linked-fw/server/pull/65) [`85d61d1`](https://github.com/linked-fw/server/commit/85d61d107af292d2b6e02d73bb41251248239d2c) Thanks [@flyon](https://github.com/flyon)! - Upgrade `sharp` to ^0.35.4 and drop the unused `adm-zip` dependency.
+
+  `sharp` was pinned to `^0.34.4`, which resolves to a build carrying the libvips
+  advisories CVE-2026-33327, -33328, -35590 and -35591. This is not a
+  tooling-only exposure: `LinkedServer` imports `sharp` at module top level and
+  registers `GET /resized/*` **before** the `apiOnly` guard, so the handler is
+  live in an API-only deployment too. It fetches a URL and pipes the bytes
+  straight into `sharp()`, which makes those the only advisories in this package
+  reachable from a request.
+
+  `^0.35.4` is a semver-major for sharp, but the surface used here —
+  `sharp(buffer|path)`, `.metadata()`, `.resize(w, h)`, `.toFormat(fmt, opts)`,
+  `.toBuffer()` and `.toFile()` — is unchanged between the two. Verified by
+  exercising exactly those calls against jpeg, png and webp, through both the
+  buffer branch and the `toFile` branch. sharp 0.35 requires Node >= 20.9.
+
+  Flagged `minor` rather than `patch` because sharp 0.35 drops some older
+  platform prebuilds; consumers on an unusual target should check that a binary
+  exists for theirs.
+
+  Five declared dependencies are removed, each referenced nowhere in the package:
+  `adm-zip`, `archiver`, `zip-a-folder`, `node-hook` and `is-object`. Only
+  `adm-zip` carried advisories -- three of them, so that is three fewer for every
+  consumer. The other four are weight rather than risk: 38 fewer packages in a
+  consumer's tree.
+
+  Note for whoever picks it up next: `resizeImage` still fetches an arbitrary
+  `req.query.src` server-side. The `// TODO: restrict resizing to images that are
+stored by LinkedFileStorage` above it is an unfixed SSRF and is arguably a
+  bigger problem than the libvips CVEs this change closes. Deliberately left
+  alone here rather than mixed into a dependency bump.
+
+## 2.8.0
+
+### Minor Changes
+
+- [#63](https://github.com/linked-fw/server/pull/63) [`10a61bb`](https://github.com/linked-fw/server/commit/10a61bb7bcd2d85c24abc108ce86ac7bdfa51472) Thanks [@flyon](https://github.com/flyon)! - `LocalFileStore` suffixes only on a real collision, and `listFiles` returns keys you can use.
+
+  **`preventDuplicates` now means what its name says.** The random `_ab12cd` suffix
+  was applied to _every_ save, without ever checking whether the name was taken —
+  so a caller never got back the key it asked for. A content-hashed bundle handed
+  over as `main-hwqwrAvA.css` landed as `main-hwqwrAvA_x9k2ml.css`, and the name
+  baked into the HTML no longer resolved. `@_linked/cli` publishes app assets with
+  a bare two-argument `saveFile`, so it hit exactly this.
+
+  The store now checks first and suffixes only when the name is occupied,
+  re-checking the suffixed name in turn. **The never-clobber guarantee is
+  unchanged** — a taken name still gets a fresh key, and an explicit
+  `preventDuplicates: false` still overwrites in place. What changes is that a free
+  name is left alone, which is what `S3FileStore` has always done: the two
+  implementations of `IFileStore` now read the flag the same way.
+
+  Minor rather than patch because stored keys change shape: a first save that used
+  to produce `report_312acb.pdf` now produces `report.pdf`. Anything that recorded
+  a returned `storedPath` keeps working; anything that _assumed_ every key carries
+  a suffix should re-read `storedPath`, which has always been the supported way to
+  learn the key.
+
+  **`listFiles` is usable for the first time.** It returned keys joined onto
+  `basePath` (`data/uploads/x.txt`) while every other method on the store resolves
+  its argument _against_ `basePath` — so feeding a result straight back into
+  `getFile` looked for `data/uploads/data/uploads/x.txt` and found nothing. Keys
+  are now relative to the base folder, matching `S3FileStore`, which strips its
+  bucket prefix before returning.
+
+  Two more bugs went with it: the recursive branch called `listFiles(prefix)`,
+  which re-read `basePath` and found the same directory again — unbounded
+  recursion as soon as the store held a single folder — and the `prefix` argument
+  was accepted and then ignored entirely. Subdirectories are now walked properly
+  and `prefix` filters the returned keys.
+
 ## 2.7.5
 
 ### Patch Changes

package/lib/esm/shapes/filestores/LocalFileStore.d.ts

@@ -56,11 +56,19 @@ export declare class LocalFileStore implements IFileStore {
      */
     getFile(filePath: string): Promise<Buffer | null>;
     /**
-     * List all files in the local filesystem, relative to the base upload folder
-     * @param recursive Whether or not to search all subdirectories recursively
-     * @returns A promise that resolves to a list of file paths, relative to the base upload folder
-     * @todo Think about taking an options parameter instead of positional args
-     * @todo Take a path parameter to list files in a subdirectory
+     * List every file in the store, recursively.
+     *
+     * @param prefix Only return keys starting with this string. Matched against
+     *   the returned (relative) key, so `listFiles('images/')` selects the
+     *   `images` folder and `listFiles('main-')` selects by file name.
+     * @returns Keys relative to the base folder, exactly as `getFile`,
+     *   `fileExists`, `deleteFile` and `statFile` expect them.
+     *
+     * The keys are relative on purpose: every other method on this store resolves
+     * its argument *against* `basePath`, so returning `data/uploads/x.txt` here
+     * meant a caller who fed the result straight back into `getFile` looked for
+     * `data/uploads/data/uploads/x.txt`. It also matches `S3FileStore`, which
+     * strips the bucket prefix before returning.
      */
     listFiles(prefix?: string): Promise<string[]>;
     /**
@@ -104,10 +112,11 @@ export declare class LocalFileStore implements IFileStore {
      * take. That is what `storedPath` is: hand it straight back to any of them.
      *
      * The key equals the `filePath` given verbatim — case included — as long as
-     * the name needs no sanitising, already has an extension, and
-     * `preventDuplicates` is `false`. With `preventDuplicates` left unspecified
-     * (this store's default, kept for upload callers) a random suffix is added,
-     * and `storedPath` is the only place that name is reported.
+     * the name needs no sanitising and already has an extension. With
+     * `preventDuplicates` left unspecified (this store's default, kept for upload
+     * callers) that still holds for a name nothing else occupies; only a name
+     * already taken gains a random suffix, and `storedPath` is the only place
+     * that name is reported.
      */
     saveFileWithPath(filePath: string, fileContent: Buffer, options?: SaveFileOptions | string, preventDuplicates?: boolean): Promise<SavedFileLocation>;
     /**

package/lib/esm/shapes/filestores/LocalFileStore.js

@@ -59,33 +59,44 @@ export class LocalFileStore {
         return fs.readFile(fileToGet).catch(() => null);
     }
     /**
-     * List all files in the local filesystem, relative to the base upload folder
-     * @param recursive Whether or not to search all subdirectories recursively
-     * @returns A promise that resolves to a list of file paths, relative to the base upload folder
-     * @todo Think about taking an options parameter instead of positional args
-     * @todo Take a path parameter to list files in a subdirectory
+     * List every file in the store, recursively.
+     *
+     * @param prefix Only return keys starting with this string. Matched against
+     *   the returned (relative) key, so `listFiles('images/')` selects the
+     *   `images` folder and `listFiles('main-')` selects by file name.
+     * @returns Keys relative to the base folder, exactly as `getFile`,
+     *   `fileExists`, `deleteFile` and `statFile` expect them.
+     *
+     * The keys are relative on purpose: every other method on this store resolves
+     * its argument *against* `basePath`, so returning `data/uploads/x.txt` here
+     * meant a caller who fed the result straight back into `getFile` looked for
+     * `data/uploads/data/uploads/x.txt`. It also matches `S3FileStore`, which
+     * strips the bucket prefix before returning.
      */
     async listFiles(prefix) {
-        let files = await fs.readdir(this.basePath);
-        // if (recursive) {
-        const allFiles = await Promise.all(files.map((file) => {
-            const filePath = path.join(this.basePath, file);
-            return fs
-                .stat(filePath)
-                .then((stat) => {
-                if (stat.isDirectory()) {
-                    return this.listFiles(prefix).then((files) => files.map((file) => path.join(filePath, file)));
-                }
-                else {
-                    return [filePath];
-                }
-            })
-                .catch((err) => {
+        const walk = async (relativeDir) => {
+            const absoluteDir = path.join(this.basePath, relativeDir);
+            let entries;
+            try {
+                entries = await fs.readdir(absoluteDir, { withFileTypes: true });
+            }
+            catch (err) {
                 console.warn('Error during listFiles', err);
                 return [];
-            });
-        }));
-        return allFiles.flat();
+            }
+            const nested = await Promise.all(entries.map((entry) => {
+                // path.join('', 'x') === 'x', so the top level stays unprefixed
+                const key = path.join(relativeDir, entry.name);
+                // recurse into the subdirectory itself. This used to call
+                // listFiles(prefix), which re-read basePath and so found the same
+                // directory again -- unbounded recursion as soon as the store held
+                // one folder.
+                return entry.isDirectory() ? walk(key) : Promise.resolve([key]);
+            }));
+            return nested.flat();
+        };
+        const keys = await walk('');
+        return prefix ? keys.filter((key) => key.startsWith(prefix)) : keys;
     }
     /**
      * Work out the key a save will use, and the URL that key is served under.
@@ -105,7 +116,7 @@ export class LocalFileStore {
      * Characters that are not safe in a file name are still replaced, exactly as
      * `getUploadTarget` does it — only the case is left alone.
      */
-    resolveTarget(filePath, mimeType, suffixDuplicates) {
+    async resolveTarget(filePath, mimeType, suffixDuplicates) {
         // alphanumerics, dot, underscore, dash and the path separator survive; a
         // run of anything else becomes one dash. Case is deliberately preserved.
         //
@@ -124,12 +135,33 @@ export class LocalFileStore {
         }
         const ext = sanitisedName.split('.').pop();
         const withoutExt = sanitisedName.substring(0, sanitisedName.length - (ext.length + 1));
-        // 6 character random string to avoid clobbering an existing file,
-        // e.g. report.pdf -> report_312acb.pdf
-        const randomStringSuffix = suffixDuplicates
-            ? '_' + Math.random().toString(36).substring(2, 8)
-            : '';
-        const storedPath = withoutExt + randomStringSuffix + '.' + ext;
+        // A 6 character random string avoids clobbering an existing file,
+        // e.g. report.pdf -> report_312acb.pdf.
+        //
+        // It is only applied when the name is actually taken. This used to be
+        // unconditional, which did prevent duplicates but also meant a caller never
+        // got back the key it asked for: a content-hashed bundle handed over as
+        // `main-hwqwrAvA.css` landed as `main-hwqwrAvA_x9k2ml.css`, so the name
+        // baked into the HTML no longer resolved. Checking first keeps the
+        // never-clobber guarantee -- a taken name still gets a suffix, and the
+        // suffixed name is itself re-checked -- while leaving free names alone.
+        // `S3FileStore` has always worked this way, so the two implementations of
+        // IFileStore now read the flag the same.
+        let storedPath = withoutExt + '.' + ext;
+        if (suffixDuplicates) {
+            // 36^6 is ~2 billion, so a second collision is already vanishingly
+            // unlikely; the cap turns a pathological case into a clear error rather
+            // than a spin.
+            const maxAttempts = 10;
+            let attempt = 0;
+            while (await this.fileExists(storedPath)) {
+                if (attempt++ >= maxAttempts) {
+                    throw new Error(`Could not find a free name for '${filePath}' after ${maxAttempts} attempts`);
+                }
+                storedPath =
+                    withoutExt + '_' + Math.random().toString(36).substring(2, 8) + '.' + ext;
+            }
+        }
         return {
             storedPath,
             publicURL: this.accessURL + publicUploadPath + '/' + storedPath,
@@ -160,19 +192,20 @@ export class LocalFileStore {
      * take. That is what `storedPath` is: hand it straight back to any of them.
      *
      * The key equals the `filePath` given verbatim — case included — as long as
-     * the name needs no sanitising, already has an extension, and
-     * `preventDuplicates` is `false`. With `preventDuplicates` left unspecified
-     * (this store's default, kept for upload callers) a random suffix is added,
-     * and `storedPath` is the only place that name is reported.
+     * the name needs no sanitising and already has an extension. With
+     * `preventDuplicates` left unspecified (this store's default, kept for upload
+     * callers) that still holds for a name nothing else occupies; only a name
+     * already taken gains a random suffix, and `storedPath` is the only place
+     * that name is reported.
      */
     async saveFileWithPath(filePath, fileContent, options, preventDuplicates) {
         var _a;
         const normalized = normalizeSaveFileOptions(options, preventDuplicates);
         // Core reports an unspecified preventDuplicates as undefined, leaving the
-        // default to each store. This one has always appended a random suffix, so
-        // only an explicit `false` turns that off.
+        // default to each store. This one protects an existing file, so only an
+        // explicit `false` allows an overwrite.
         const suffixDuplicates = (_a = normalized.preventDuplicates) !== null && _a !== void 0 ? _a : true;
-        const target = this.resolveTarget(filePath, normalized.mimeType, suffixDuplicates);
+        const target = await this.resolveTarget(filePath, normalized.mimeType, suffixDuplicates);
         // resolved against basePath, exactly like every read method does, so what
         // is written here can be read back by the same key
         const targetFilePath = path.join(this.basePath, target.storedPath);

package/lib/esm/shapes/filestores/LocalFileStore.js.map

@@ -1 +1 @@
-{"version":3,"file":"LocalFileStore.js","sourceRoot":"","sources":["../../../../src/shapes/filestores/LocalFileStore.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,4BAA4B,EAAE,MAAM,oCAAoC,CAAC;AAClF,OAAO,EAAE,gBAAgB,EAAE,MAAM,yCAAyC,CAAC;AAC3E,OAAO,EAIL,wBAAwB,GACzB,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,KAAK,MAAM,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,IAAI,MAAM,WAAW,CAAC;AAiB7B;;;;;;;;;;;;GAYG;AACH,MAAM,OAAO,cAAc;IAKzB;;;;OAIG;IACH,YACE,CAA0B,EAC1B,WAAmB,4BAA4B;QAE/C,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC;QACvC,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAC3B,CAAC;IAED;;;;OAIG;IACH,UAAU,CAAC,QAAgB;QACzB,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QAExD,OAAO,EAAE,CAAC,EAAE,CAAC,YAAY,CAAC,CAAC;IAC7B,CAAC;IAED;;;;OAIG;IACH,UAAU,CAAC,QAAgB;QACzB,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QAEvD,OAAO,EAAE;aACN,MAAM,CAAC,WAAW,CAAC;aACnB,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC;aAChB,KAAK,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC;IACxB,CAAC;IAED;;;;OAIG;IACH,OAAO,CAAC,QAAgB;QACtB,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QAErD,OAAO,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IAClD,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,SAAS,CAAC,MAAe;QAC7B,IAAI,KAAK,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAE5C,mBAAmB;QACnB,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,CAChC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;YACjB,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;YAEhD,OAAO,EAAE;iBACN,IAAI,CAAC,QAAQ,CAAC;iBACd,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE;gBACb,IAAI,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;oBACvB,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAC3C,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAC/C,CAAC;gBACJ,CAAC;qBAAM,CAAC;oBACN,OAAO,CAAC,QAAQ,CAAC,CAAC;gBACpB,CAAC;YACH,CAAC,CAAC;iBACD,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;gBACb,OAAO,CAAC,IAAI,CAAC,wBAAwB,EAAE,GAAG,CAAC,CAAC;gBAC5C,OAAO,EAAE,CAAC;YACZ,CAAC,CAAC,CAAC;QACP,CAAC,CAAC,CACH,CAAC;QAEF,OAAO,QAAQ,CAAC,IAAI,EAAE,CAAC;IACzB,CAAC;IAED;;;;;;;;;;;;;;;;;OAiBG;IACK,aAAa,CACnB,QAAgB,EAChB,QAA4B,EAC5B,gBAAyB;QAEzB,yEAAyE;QACzE,yEAAyE;QACzE,EAAE;QACF,0EAA0E;QAC1E,yEAAyE;QACzE,kDAAkD;QAClD,2EAA2E;QAC3E,oDAAoD;QACpD,IAAI,aAAa,GAAG,QAAQ,CAAC,OAAO,CAAC,sBAAsB,EAAE,GAAG,CAAC,CAAC;QAElE,IAAI,aAAa,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YACtC,iEAAiE;YACjE,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,MAAM,IAAI,KAAK,CACb,mEAAmE,CACpE,CAAC;YACJ,CAAC;YACD,aAAa,GAAG,aAAa,GAAG,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAC/D,CAAC;QAED,MAAM,GAAG,GAAG,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;QAC3C,MAAM,UAAU,GAAG,aAAa,CAAC,SAAS,CACxC,CAAC,EACD,aAAa,CAAC,MAAM,GAAG,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CACxC,CAAC;QAEF,kEAAkE;QAClE,uCAAuC;QACvC,MAAM,kBAAkB,GAAG,gBAAgB;YACzC,CAAC,CAAC,GAAG,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC;YAClD,CAAC,CAAC,EAAE,CAAC;QAEP,MAAM,UAAU,GAAG,UAAU,GAAG,kBAAkB,GAAG,GAAG,GAAG,GAAG,CAAC;QAE/D,OAAO;YACL,UAAU;YACV,SAAS,EAAE,IAAI,CAAC,SAAS,GAAG,gBAAgB,GAAG,GAAG,GAAG,UAAU;SAChE,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,QAAQ,CACZ,QAAgB,EAChB,WAAmB,EACnB,OAAkC,EAClC,iBAA2B;QAE3B,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAC/C,QAAQ,EACR,WAAW,EACX,OAAO,EACP,iBAAiB,CAClB,CAAC;QAEF,OAAO,SAAS,CAAC;IACnB,CAAC;IAED;;;;;;;;;;;;;OAaG;IACH,KAAK,CAAC,gBAAgB,CACpB,QAAgB,EAChB,WAAmB,EACnB,OAAkC,EAClC,iBAA2B;;QAE3B,MAAM,UAAU,GAAG,wBAAwB,CAAC,OAAO,EAAE,iBAAiB,CAAC,CAAC;QACxE,0EAA0E;QAC1E,0EAA0E;QAC1E,2CAA2C;QAC3C,MAAM,gBAAgB,GAAG,MAAA,UAAU,CAAC,iBAAiB,mCAAI,IAAI,CAAC;QAE9D,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAC/B,QAAQ,EACR,UAAU,CAAC,QAAQ,EACnB,gBAAgB,CACjB,CAAC;QAEF,0EAA0E;QAC1E,mDAAmD;QACnD,MAAM,cAAc,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC;QAEnE,oCAAoC;QACpC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,EAAE,CAAC;YACrD,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACtE,CAAC;QACD,MAAM,EAAE,CAAC,SAAS,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;QAEhD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;;;;;;;;;;OAYG;IACH,KAAK,CAAC,QAAQ,CAAC,QAAgB;QAC7B,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QAEtD,IAAI,IAAkB,CAAC;QACvB,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACnC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;YACnB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;QAC/C,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAEnE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;IACrC,CAAC;CACF"}
+{"version":3,"file":"LocalFileStore.js","sourceRoot":"","sources":["../../../../src/shapes/filestores/LocalFileStore.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,4BAA4B,EAAE,MAAM,oCAAoC,CAAC;AAClF,OAAO,EAAE,gBAAgB,EAAE,MAAM,yCAAyC,CAAC;AAC3E,OAAO,EAIL,wBAAwB,GACzB,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,KAAK,MAAM,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,IAAI,MAAM,WAAW,CAAC;AAiB7B;;;;;;;;;;;;GAYG;AACH,MAAM,OAAO,cAAc;IAKzB;;;;OAIG;IACH,YACE,CAA0B,EAC1B,WAAmB,4BAA4B;QAE/C,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC;QACvC,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAC3B,CAAC;IAED;;;;OAIG;IACH,UAAU,CAAC,QAAgB;QACzB,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QAExD,OAAO,EAAE,CAAC,EAAE,CAAC,YAAY,CAAC,CAAC;IAC7B,CAAC;IAED;;;;OAIG;IACH,UAAU,CAAC,QAAgB;QACzB,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QAEvD,OAAO,EAAE;aACN,MAAM,CAAC,WAAW,CAAC;aACnB,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC;aAChB,KAAK,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC;IACxB,CAAC;IAED;;;;OAIG;IACH,OAAO,CAAC,QAAgB;QACtB,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QAErD,OAAO,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IAClD,CAAC;IAED;;;;;;;;;;;;;;OAcG;IACH,KAAK,CAAC,SAAS,CAAC,MAAe;QAC7B,MAAM,IAAI,GAAG,KAAK,EAAE,WAAmB,EAAqB,EAAE;YAC5D,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;YAE1D,IAAI,OAAwB,CAAC;YAC7B,IAAI,CAAC;gBACH,OAAO,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;YACnE,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,CAAC,IAAI,CAAC,wBAAwB,EAAE,GAAG,CAAC,CAAC;gBAC5C,OAAO,EAAE,CAAC;YACZ,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,GAAG,CAC9B,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;gBACpB,gEAAgE;gBAChE,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;gBAC/C,0DAA0D;gBAC1D,kEAAkE;gBAClE,mEAAmE;gBACnE,cAAc;gBACd,OAAO,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YAClE,CAAC,CAAC,CACH,CAAC;YAEF,OAAO,MAAM,CAAC,IAAI,EAAE,CAAC;QACvB,CAAC,CAAC;QAEF,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,CAAC;QAE5B,OAAO,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACtE,CAAC;IAED;;;;;;;;;;;;;;;;;OAiBG;IACK,KAAK,CAAC,aAAa,CACzB,QAAgB,EAChB,QAA4B,EAC5B,gBAAyB;QAEzB,yEAAyE;QACzE,yEAAyE;QACzE,EAAE;QACF,0EAA0E;QAC1E,yEAAyE;QACzE,kDAAkD;QAClD,2EAA2E;QAC3E,oDAAoD;QACpD,IAAI,aAAa,GAAG,QAAQ,CAAC,OAAO,CAAC,sBAAsB,EAAE,GAAG,CAAC,CAAC;QAElE,IAAI,aAAa,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YACtC,iEAAiE;YACjE,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,MAAM,IAAI,KAAK,CACb,mEAAmE,CACpE,CAAC;YACJ,CAAC;YACD,aAAa,GAAG,aAAa,GAAG,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAC/D,CAAC;QAED,MAAM,GAAG,GAAG,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;QAC3C,MAAM,UAAU,GAAG,aAAa,CAAC,SAAS,CACxC,CAAC,EACD,aAAa,CAAC,MAAM,GAAG,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CACxC,CAAC;QAEF,kEAAkE;QAClE,wCAAwC;QACxC,EAAE;QACF,sEAAsE;QACtE,4EAA4E;QAC5E,wEAAwE;QACxE,wEAAwE;QACxE,mEAAmE;QACnE,uEAAuE;QACvE,wEAAwE;QACxE,0EAA0E;QAC1E,yCAAyC;QACzC,IAAI,UAAU,GAAG,UAAU,GAAG,GAAG,GAAG,GAAG,CAAC;QAExC,IAAI,gBAAgB,EAAE,CAAC;YACrB,mEAAmE;YACnE,wEAAwE;YACxE,eAAe;YACf,MAAM,WAAW,GAAG,EAAE,CAAC;YACvB,IAAI,OAAO,GAAG,CAAC,CAAC;YAEhB,OAAO,MAAM,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;gBACzC,IAAI,OAAO,EAAE,IAAI,WAAW,EAAE,CAAC;oBAC7B,MAAM,IAAI,KAAK,CACb,mCAAmC,QAAQ,WAAW,WAAW,WAAW,CAC7E,CAAC;gBACJ,CAAC;gBAED,UAAU;oBACR,UAAU,GAAG,GAAG,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,GAAG,GAAG,GAAG,CAAC;YAC9E,CAAC;QACH,CAAC;QAED,OAAO;YACL,UAAU;YACV,SAAS,EAAE,IAAI,CAAC,SAAS,GAAG,gBAAgB,GAAG,GAAG,GAAG,UAAU;SAChE,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,QAAQ,CACZ,QAAgB,EAChB,WAAmB,EACnB,OAAkC,EAClC,iBAA2B;QAE3B,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAC/C,QAAQ,EACR,WAAW,EACX,OAAO,EACP,iBAAiB,CAClB,CAAC;QAEF,OAAO,SAAS,CAAC;IACnB,CAAC;IAED;;;;;;;;;;;;;;OAcG;IACH,KAAK,CAAC,gBAAgB,CACpB,QAAgB,EAChB,WAAmB,EACnB,OAAkC,EAClC,iBAA2B;;QAE3B,MAAM,UAAU,GAAG,wBAAwB,CAAC,OAAO,EAAE,iBAAiB,CAAC,CAAC;QACxE,0EAA0E;QAC1E,wEAAwE;QACxE,wCAAwC;QACxC,MAAM,gBAAgB,GAAG,MAAA,UAAU,CAAC,iBAAiB,mCAAI,IAAI,CAAC;QAE9D,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CACrC,QAAQ,EACR,UAAU,CAAC,QAAQ,EACnB,gBAAgB,CACjB,CAAC;QAEF,0EAA0E;QAC1E,mDAAmD;QACnD,MAAM,cAAc,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC;QAEnE,oCAAoC;QACpC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,EAAE,CAAC;YACrD,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACtE,CAAC;QACD,MAAM,EAAE,CAAC,SAAS,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;QAEhD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;;;;;;;;;;OAYG;IACH,KAAK,CAAC,QAAQ,CAAC,QAAgB;QAC7B,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QAEtD,IAAI,IAAkB,CAAC;QACvB,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACnC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;YACnB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;QAC/C,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAEnE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;IACrC,CAAC;CACF"}

package/package.json

@@ -10,7 +10,7 @@
     "type": "git",
     "url": "git+https://github.com/linked-fw/server.git"
   },
-  "version": "2.7.5",
+  "version": "2.9.0",
   "packageManager": "npm@11.19.1",
   "linkedPackage": true,
   "type": "module",
@@ -38,8 +38,6 @@
     "@_linked/cli": "^1.2",
     "@_linked/core": "^2.20.0",
     "@_linked/server-utils": "^1.3.0",
-    "adm-zip": "^0.5.16",
-    "archiver": "^7.0.1",
     "autoprefixer": "^10.4.18",
     "body-parser": "^1.20.2",
     "chalk": "4.1.2",
@@ -48,10 +46,8 @@
     "cron": "^4.3.4",
     "express": "^4.18.3",
     "fetch-cookie": "^3.1.0",
-    "is-object": "^1.0.2",
     "n3": "^1.17.2",
     "node-addon-api": "^8.2.2",
-    "node-hook": "^1.0.0",
     "open": "^8.4.0",
     "proper-lockfile": "^4.1.2",
     "react": "^18.2",
@@ -59,14 +55,13 @@
     "react-error-boundary": "^4.0.13",
     "react-router-dom": "^6.22.3",
     "rimraf": "^5.0.5",
-    "sharp": "^0.34.4",
+    "sharp": "^0.35.4",
     "tough-cookie": "^6.0.0",
     "tsconfig-to-dual-package": "^1.2.0",
     "typescript": "^5.7.3",
     "webpack": "^5.90.3",
     "webpack-dev-middleware": "^7.0.0",
-    "webpack-hot-middleware": "^2.26.1",
-    "zip-a-folder": "^3.1.8"
+    "webpack-hot-middleware": "^2.26.1"
   },
   "devDependencies": {
     "@changesets/changelog-github": "^0.5.2",