@anvilkit/plugin-asset-manager 0.1.1

package/dist/ui/UploadButton.js

@@ -0,0 +1,155 @@
+import { Button } from "@anvilkit/ui/button";
+import { validateSelectedFile } from "../plugin.js";
+import { validateUploadResult } from "../validate-upload-result.js";
+import * as __rspack_external_react from "react";
+function UploadButton({ acceptedMimeTypes, allowMixedScriptHostnames, dataUrlAllowlistOptIn, maxFileSize, onError, onProgress, onUploaded, uploader }) {
+    const inputRef = __rspack_external_react.useRef(null);
+    const [errorMessage, setErrorMessage] = __rspack_external_react.useState(null);
+    const [batch, setBatch] = __rspack_external_react.useState(null);
+    const [isDragOver, setIsDragOver] = __rspack_external_react.useState(false);
+    const isUploading = null !== batch;
+    const acceptAttr = __rspack_external_react.useMemo(()=>acceptedMimeTypes?.join(","), [
+        acceptedMimeTypes
+    ]);
+    async function processFiles(files) {
+        if (0 === files.length) return;
+        const total = files.length;
+        setErrorMessage(null);
+        const initial = {
+            completed: 0,
+            total
+        };
+        setBatch(initial);
+        onProgress?.(initial);
+        let lastError = null;
+        for(let index = 0; index < files.length; index += 1){
+            const file = files[index];
+            if (file) try {
+                validateSelectedFile(file, {
+                    acceptedMimeTypes,
+                    maxFileSize
+                });
+                const uploaded = await uploader(file);
+                const validated = validateUploadResult({
+                    ...uploaded,
+                    meta: {
+                        size: file.size,
+                        ...file.type ? {
+                            mimeType: file.type
+                        } : {},
+                        ...uploaded.meta ?? {}
+                    }
+                }, {
+                    dataUrlAllowlistOptIn,
+                    allowMixedScriptHostnames
+                });
+                onUploaded?.(validated);
+            } catch (error) {
+                lastError = error instanceof Error ? error.message : String(error);
+                onError?.(error);
+            } finally{
+                const next = {
+                    completed: index + 1,
+                    total
+                };
+                setBatch(next);
+                onProgress?.(next);
+            }
+        }
+        if (null !== lastError) setErrorMessage(lastError);
+        setBatch(null);
+        onProgress?.(null);
+    }
+    async function handleChange(event) {
+        const list = event.currentTarget.files;
+        const picked = list ? Array.from(list) : [];
+        try {
+            await processFiles(picked);
+        } finally{
+            if (inputRef.current) inputRef.current.value = "";
+        }
+    }
+    function handleDragEnter(event) {
+        event.preventDefault();
+        event.stopPropagation();
+        if (event.dataTransfer?.types?.includes("Files")) setIsDragOver(true);
+    }
+    function handleDragOver(event) {
+        event.preventDefault();
+        event.stopPropagation();
+        if (event.dataTransfer) event.dataTransfer.dropEffect = "copy";
+    }
+    function handleDragLeave(event) {
+        event.preventDefault();
+        event.stopPropagation();
+        setIsDragOver(false);
+    }
+    async function handleDrop(event) {
+        event.preventDefault();
+        event.stopPropagation();
+        setIsDragOver(false);
+        const files = event.dataTransfer?.files ? Array.from(event.dataTransfer.files) : [];
+        await processFiles(files);
+    }
+    const statusMessage = errorMessage ?? (null !== batch ? `Uploading ${Math.min(batch.completed + 1, batch.total)} of ${batch.total}…` : "Accepted files upload through the configured adapter.");
+    return /*#__PURE__*/ __rspack_external_react.createElement("div", {
+        "data-asset-manager-drop-zone": true,
+        "data-drag-over": isDragOver ? "true" : void 0,
+        onDragEnter: handleDragEnter,
+        onDragLeave: handleDragLeave,
+        onDragOver: handleDragOver,
+        onDrop: (event)=>{
+            handleDrop(event);
+        },
+        tabIndex: -1
+    }, /*#__PURE__*/ __rspack_external_react.createElement("input", {
+        accept: acceptAttr,
+        multiple: true,
+        onChange: (event)=>{
+            handleChange(event);
+        },
+        ref: inputRef,
+        style: {
+            display: "none"
+        },
+        type: "file"
+    }), /*#__PURE__*/ __rspack_external_react.createElement(Button, {
+        "aria-label": "Upload asset file",
+        disabled: isUploading,
+        onClick: ()=>{
+            inputRef.current?.click();
+        },
+        type: "button",
+        variant: "outline"
+    }, isUploading ? /*#__PURE__*/ __rspack_external_react.createElement(UploadSpinner, null) : null, /*#__PURE__*/ __rspack_external_react.createElement("span", null, isUploading ? "Uploading…" : "Upload asset")), /*#__PURE__*/ __rspack_external_react.createElement("p", {
+        "aria-live": "polite",
+        role: "status"
+    }, statusMessage));
+}
+function UploadSpinner() {
+    return /*#__PURE__*/ __rspack_external_react.createElement("svg", {
+        "aria-hidden": true,
+        fill: "none",
+        height: 14,
+        style: {
+            display: "inline-block",
+            marginRight: 6,
+            animation: "spin 1s linear infinite"
+        },
+        viewBox: "0 0 24 24",
+        width: 14
+    }, /*#__PURE__*/ __rspack_external_react.createElement("circle", {
+        cx: "12",
+        cy: "12",
+        opacity: "0.25",
+        r: "10",
+        stroke: "currentColor",
+        strokeWidth: "4"
+    }), /*#__PURE__*/ __rspack_external_react.createElement("path", {
+        d: "M4 12a8 8 0 0 1 8-8",
+        stroke: "currentColor",
+        strokeLinecap: "round",
+        strokeWidth: "4"
+    }));
+}
+export { UploadButton };

package/dist/ui/index.cjs

@@ -0,0 +1,60 @@
+"use strict";
+var __webpack_require__ = {};
+(()=>{
+    __webpack_require__.d = (exports1, definition)=>{
+        for(var key in definition)if (__webpack_require__.o(definition, key) && !__webpack_require__.o(exports1, key)) Object.defineProperty(exports1, key, {
+            enumerable: true,
+            get: definition[key]
+        });
+    };
+})();
+(()=>{
+    __webpack_require__.o = (obj, prop)=>Object.prototype.hasOwnProperty.call(obj, prop);
+})();
+(()=>{
+    __webpack_require__.r = (exports1)=>{
+        if ("u" > typeof Symbol && Symbol.toStringTag) Object.defineProperty(exports1, Symbol.toStringTag, {
+            value: 'Module'
+        });
+        Object.defineProperty(exports1, '__esModule', {
+            value: true
+        });
+    };
+})();
+var __webpack_exports__ = {};
+__webpack_require__.r(__webpack_exports__);
+__webpack_require__.d(__webpack_exports__, {
+    MetadataPanel: ()=>external_MetadataPanel_cjs_namespaceObject.MetadataPanel,
+    DeleteAssetDialog: ()=>external_DeleteAssetDialog_cjs_namespaceObject.DeleteAssetDialog,
+    AssetCommandPalette: ()=>external_AssetCommandPalette_cjs_namespaceObject.AssetCommandPalette,
+    UploadButton: ()=>external_UploadButton_cjs_namespaceObject.UploadButton,
+    AssetBrowser: ()=>external_AssetBrowser_cjs_namespaceObject.AssetBrowser,
+    AssetManagerUI: ()=>external_AssetManagerUI_cjs_namespaceObject.AssetManagerUI,
+    ReplaceAssetDialog: ()=>external_ReplaceAssetDialog_cjs_namespaceObject.ReplaceAssetDialog
+});
+const external_AssetBrowser_cjs_namespaceObject = require("./AssetBrowser.cjs");
+const external_AssetCommandPalette_cjs_namespaceObject = require("./AssetCommandPalette.cjs");
+const external_AssetManagerUI_cjs_namespaceObject = require("./AssetManagerUI.cjs");
+const external_DeleteAssetDialog_cjs_namespaceObject = require("./DeleteAssetDialog.cjs");
+const external_MetadataPanel_cjs_namespaceObject = require("./MetadataPanel.cjs");
+const external_ReplaceAssetDialog_cjs_namespaceObject = require("./ReplaceAssetDialog.cjs");
+const external_UploadButton_cjs_namespaceObject = require("./UploadButton.cjs");
+exports.AssetBrowser = __webpack_exports__.AssetBrowser;
+exports.AssetCommandPalette = __webpack_exports__.AssetCommandPalette;
+exports.AssetManagerUI = __webpack_exports__.AssetManagerUI;
+exports.DeleteAssetDialog = __webpack_exports__.DeleteAssetDialog;
+exports.MetadataPanel = __webpack_exports__.MetadataPanel;
+exports.ReplaceAssetDialog = __webpack_exports__.ReplaceAssetDialog;
+exports.UploadButton = __webpack_exports__.UploadButton;
+for(var __rspack_i in __webpack_exports__)if (-1 === [
+    "AssetBrowser",
+    "AssetCommandPalette",
+    "AssetManagerUI",
+    "DeleteAssetDialog",
+    "MetadataPanel",
+    "ReplaceAssetDialog",
+    "UploadButton"
+].indexOf(__rspack_i)) exports[__rspack_i] = __webpack_exports__[__rspack_i];
+Object.defineProperty(exports, '__esModule', {
+    value: true
+});

package/dist/ui/index.d.cts

@@ -0,0 +1,15 @@
+export type { AssetBrowserProps } from "./AssetBrowser.js";
+export { AssetBrowser } from "./AssetBrowser.js";
+export type { AssetCommandPaletteProps } from "./AssetCommandPalette.js";
+export { AssetCommandPalette } from "./AssetCommandPalette.js";
+export type { AssetManagerUIProps } from "./AssetManagerUI.js";
+export { AssetManagerUI } from "./AssetManagerUI.js";
+export type { DeleteAssetDialogProps } from "./DeleteAssetDialog.js";
+export { DeleteAssetDialog } from "./DeleteAssetDialog.js";
+export type { MetadataPanelProps } from "./MetadataPanel.js";
+export { MetadataPanel } from "./MetadataPanel.js";
+export type { ReplaceAssetDialogProps } from "./ReplaceAssetDialog.js";
+export { ReplaceAssetDialog } from "./ReplaceAssetDialog.js";
+export type { UploadButtonProps, UploadProgressSnapshot, } from "./UploadButton.js";
+export { UploadButton } from "./UploadButton.js";
+//# sourceMappingURL=index.d.cts.map

package/dist/ui/index.d.cts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.cts","sourceRoot":"","sources":["../../src/ui/index.ts"],"names":[],"mappings":"AAAA,YAAY,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAC3D,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjD,YAAY,EAAE,wBAAwB,EAAE,MAAM,0BAA0B,CAAC;AACzE,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAC/D,YAAY,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC/D,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,YAAY,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAC;AACrE,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,YAAY,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAC7D,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,YAAY,EAAE,uBAAuB,EAAE,MAAM,yBAAyB,CAAC;AACvE,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAC7D,YAAY,EACX,iBAAiB,EACjB,sBAAsB,GACtB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC"}

package/dist/ui/index.d.ts

@@ -0,0 +1,15 @@
+export type { AssetBrowserProps } from "./AssetBrowser.js";
+export { AssetBrowser } from "./AssetBrowser.js";
+export type { AssetCommandPaletteProps } from "./AssetCommandPalette.js";
+export { AssetCommandPalette } from "./AssetCommandPalette.js";
+export type { AssetManagerUIProps } from "./AssetManagerUI.js";
+export { AssetManagerUI } from "./AssetManagerUI.js";
+export type { DeleteAssetDialogProps } from "./DeleteAssetDialog.js";
+export { DeleteAssetDialog } from "./DeleteAssetDialog.js";
+export type { MetadataPanelProps } from "./MetadataPanel.js";
+export { MetadataPanel } from "./MetadataPanel.js";
+export type { ReplaceAssetDialogProps } from "./ReplaceAssetDialog.js";
+export { ReplaceAssetDialog } from "./ReplaceAssetDialog.js";
+export type { UploadButtonProps, UploadProgressSnapshot, } from "./UploadButton.js";
+export { UploadButton } from "./UploadButton.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/ui/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/ui/index.ts"],"names":[],"mappings":"AAAA,YAAY,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAC3D,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjD,YAAY,EAAE,wBAAwB,EAAE,MAAM,0BAA0B,CAAC;AACzE,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAC/D,YAAY,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC/D,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,YAAY,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAC;AACrE,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,YAAY,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAC7D,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,YAAY,EAAE,uBAAuB,EAAE,MAAM,yBAAyB,CAAC;AACvE,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAC7D,YAAY,EACX,iBAAiB,EACjB,sBAAsB,GACtB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC"}

package/dist/ui/index.js

@@ -0,0 +1,7 @@
+export { AssetBrowser } from "./AssetBrowser.js";
+export { AssetCommandPalette } from "./AssetCommandPalette.js";
+export { AssetManagerUI } from "./AssetManagerUI.js";
+export { DeleteAssetDialog } from "./DeleteAssetDialog.js";
+export { MetadataPanel } from "./MetadataPanel.js";
+export { ReplaceAssetDialog } from "./ReplaceAssetDialog.js";
+export { UploadButton } from "./UploadButton.js";

package/dist/validate-upload-result.cjs

@@ -0,0 +1,149 @@
+"use strict";
+var __webpack_require__ = {};
+(()=>{
+    __webpack_require__.d = (exports1, definition)=>{
+        for(var key in definition)if (__webpack_require__.o(definition, key) && !__webpack_require__.o(exports1, key)) Object.defineProperty(exports1, key, {
+            enumerable: true,
+            get: definition[key]
+        });
+    };
+})();
+(()=>{
+    __webpack_require__.o = (obj, prop)=>Object.prototype.hasOwnProperty.call(obj, prop);
+})();
+(()=>{
+    __webpack_require__.r = (exports1)=>{
+        if ("u" > typeof Symbol && Symbol.toStringTag) Object.defineProperty(exports1, Symbol.toStringTag, {
+            value: 'Module'
+        });
+        Object.defineProperty(exports1, '__esModule', {
+            value: true
+        });
+    };
+})();
+var __webpack_exports__ = {};
+__webpack_require__.r(__webpack_exports__);
+__webpack_require__.d(__webpack_exports__, {
+    validateUploadResult: ()=>validateUploadResult
+});
+const external_errors_cjs_namespaceObject = require("./errors.cjs");
+const ALWAYS_ALLOWED_SCHEMES = new Set([
+    "http",
+    "https",
+    "blob"
+]);
+const HARD_BLOCKED_SCHEMES = new Set([
+    "javascript",
+    "vbscript"
+]);
+function validateUploadResult(result, options = {}) {
+    if ("string" != typeof result.id || "" === result.id.trim()) throw new external_errors_cjs_namespaceObject.AssetValidationError("INVALID_UPLOAD_ID", "Upload adapter returned an empty asset id.");
+    const normalizedUrl = normalizeAllowedUrl(result.url, options);
+    const trimmedName = "string" == typeof result.name ? result.name.trim() : "";
+    const nextResult = {
+        id: result.id.trim(),
+        url: normalizedUrl,
+        ..."" !== trimmedName ? {
+            name: trimmedName
+        } : {},
+        ...result.meta ? {
+            meta: stripUndefinedMeta(result.meta)
+        } : {},
+        ...result.tags && result.tags.length > 0 ? {
+            tags: Object.freeze([
+                ...result.tags
+            ])
+        } : {}
+    };
+    return Object.freeze(nextResult);
+}
+function normalizeAllowedUrl(input, options) {
+    const candidate = normalizeCandidate(input);
+    if (!candidate) throw new external_errors_cjs_namespaceObject.AssetValidationError("EMPTY_UPLOAD_URL", "Upload adapter returned an empty URL.");
+    if (candidate.startsWith("//")) throw new external_errors_cjs_namespaceObject.AssetValidationError("UNSCHEMED_UPLOAD_URL", "Upload adapter returned a scheme-less URL. Use an absolute URL with an allowed scheme.");
+    const sanitized = stripUnsafeAscii(candidate);
+    const schemeMatch = sanitized.match(/^([a-z][a-z0-9+.-]*):/i);
+    if (!schemeMatch) throw new external_errors_cjs_namespaceObject.AssetValidationError("UNSCHEMED_UPLOAD_URL", "Upload adapter returned a URL without a scheme.");
+    const scheme = schemeMatch[1]?.toLowerCase();
+    if (!scheme) throw new external_errors_cjs_namespaceObject.AssetValidationError("UNSCHEMED_UPLOAD_URL", "Upload adapter returned a URL without a scheme.");
+    if (HARD_BLOCKED_SCHEMES.has(scheme)) throw new external_errors_cjs_namespaceObject.AssetValidationError("DISALLOWED_UPLOAD_URL_SCHEME", `Upload adapter returned a disallowed URL scheme "${scheme}".`);
+    if (!isSchemeAllowed(scheme, options)) throw new external_errors_cjs_namespaceObject.AssetValidationError("DISALLOWED_UPLOAD_URL_SCHEME", `Upload adapter returned URL scheme "${scheme}" which is not in the allowlist.`);
+    if ("http" === scheme || "https" === scheme || "blob" === scheme) assertNoPathTraversal(sanitized);
+    if ("http" === scheme || "https" === scheme) assertNoMixedScriptHostname(sanitized, options);
+    return candidate;
+}
+function isSchemeAllowed(scheme, options) {
+    if (ALWAYS_ALLOWED_SCHEMES.has(scheme)) return true;
+    if ("data" === scheme) return true === options.dataUrlAllowlistOptIn;
+    return false;
+}
+function assertNoPathTraversal(url) {
+    const lowered = url.toLowerCase();
+    if (lowered.includes("../") || lowered.includes("..%2f")) throw new external_errors_cjs_namespaceObject.AssetValidationError("PATH_TRAVERSAL_URL", "Upload adapter returned a URL containing path-traversal segments.");
+    if (lowered.includes("%2e%2e/") || lowered.includes("%2e%2e%2f")) throw new external_errors_cjs_namespaceObject.AssetValidationError("PATH_TRAVERSAL_URL", "Upload adapter returned a URL containing percent-encoded path-traversal segments.");
+}
+function assertNoMixedScriptHostname(url, options) {
+    if (true === options.allowMixedScriptHostnames) return;
+    const match = url.match(/^[a-z][a-z0-9+.-]*:\/\/(?:[^@/]+@)?([^:/?#]+)/i);
+    if (!match) return;
+    const hostname = match[1] ?? "";
+    if ("" === hostname) return;
+    const scripts = detectHostnameScripts(hostname);
+    const hasLatin = scripts.has("Latin");
+    const confusable = [
+        "Cyrillic",
+        "Greek"
+    ].filter((s)=>scripts.has(s));
+    if (hasLatin && confusable.length > 0) throw new external_errors_cjs_namespaceObject.AssetValidationError("MIXED_SCRIPT_HOSTNAME", `Upload adapter returned a URL whose hostname mixes Latin with a visually confusable script (${confusable.join(", ")}). Set allowMixedScriptHostnames: true to permit this.`);
+}
+function detectHostnameScripts(host) {
+    const scripts = new Set();
+    for (const ch of host)if (!/[\p{Script=Common}\p{Script=Inherited}]/u.test(ch)) if (/\p{Script=Latin}/u.test(ch)) scripts.add("Latin");
+    else if (/\p{Script=Cyrillic}/u.test(ch)) scripts.add("Cyrillic");
+    else if (/\p{Script=Greek}/u.test(ch)) scripts.add("Greek");
+    else if (/\p{Script=Han}/u.test(ch)) scripts.add("Han");
+    else if (/\p{Script=Hiragana}/u.test(ch)) scripts.add("Hiragana");
+    else if (/\p{Script=Katakana}/u.test(ch)) scripts.add("Katakana");
+    else if (/\p{Script=Hangul}/u.test(ch)) scripts.add("Hangul");
+    else if (/\p{Script=Arabic}/u.test(ch)) scripts.add("Arabic");
+    else if (/\p{Script=Hebrew}/u.test(ch)) scripts.add("Hebrew");
+    else scripts.add("Other");
+    return scripts;
+}
+function normalizeCandidate(input) {
+    const candidate = input.trim();
+    return "" === candidate ? void 0 : candidate;
+}
+function stripUnsafeAscii(input) {
+    let output = "";
+    for (const character of input){
+        const codePoint = character.charCodeAt(0);
+        if (!(codePoint <= 0x20) && 0x7f !== codePoint) output += character;
+    }
+    return output;
+}
+function stripUndefinedMeta(meta) {
+    if (!meta) return;
+    const nextMeta = {
+        ...void 0 !== meta.size ? {
+            size: meta.size
+        } : {},
+        ...void 0 !== meta.mimeType ? {
+            mimeType: meta.mimeType
+        } : {},
+        ...void 0 !== meta.width ? {
+            width: meta.width
+        } : {},
+        ...void 0 !== meta.height ? {
+            height: meta.height
+        } : {}
+    };
+    return Object.freeze(nextMeta);
+}
+exports.validateUploadResult = __webpack_exports__.validateUploadResult;
+for(var __rspack_i in __webpack_exports__)if (-1 === [
+    "validateUploadResult"
+].indexOf(__rspack_i)) exports[__rspack_i] = __webpack_exports__[__rspack_i];
+Object.defineProperty(exports, '__esModule', {
+    value: true
+});

package/dist/validate-upload-result.d.cts

@@ -0,0 +1,9 @@
+import type { AssetManagerOptions, UploadResult } from "./types.js";
+/**
+ * Subset of {@link AssetManagerOptions} consulted by the trust boundary.
+ * `urlAllowlist` is intentionally absent — Phase 4 replaced the raw
+ * allowlist with the two typed flags below.
+ */
+export type ValidateUploadResultOptions = Pick<AssetManagerOptions, "dataUrlAllowlistOptIn" | "allowMixedScriptHostnames">;
+export declare function validateUploadResult(result: UploadResult, options?: ValidateUploadResultOptions): UploadResult;
+//# sourceMappingURL=validate-upload-result.d.cts.map

package/dist/validate-upload-result.d.cts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate-upload-result.d.cts","sourceRoot":"","sources":["../src/validate-upload-result.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,mBAAmB,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAKpE;;;;GAIG;AACH,MAAM,MAAM,2BAA2B,GAAG,IAAI,CAC7C,mBAAmB,EACnB,uBAAuB,GAAG,2BAA2B,CACrD,CAAC;AAEF,wBAAgB,oBAAoB,CACnC,MAAM,EAAE,YAAY,EACpB,OAAO,GAAE,2BAAgC,GACvC,YAAY,CAqBd"}

package/dist/validate-upload-result.d.ts

@@ -0,0 +1,9 @@
+import type { AssetManagerOptions, UploadResult } from "./types.js";
+/**
+ * Subset of {@link AssetManagerOptions} consulted by the trust boundary.
+ * `urlAllowlist` is intentionally absent — Phase 4 replaced the raw
+ * allowlist with the two typed flags below.
+ */
+export type ValidateUploadResultOptions = Pick<AssetManagerOptions, "dataUrlAllowlistOptIn" | "allowMixedScriptHostnames">;
+export declare function validateUploadResult(result: UploadResult, options?: ValidateUploadResultOptions): UploadResult;
+//# sourceMappingURL=validate-upload-result.d.ts.map

package/dist/validate-upload-result.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate-upload-result.d.ts","sourceRoot":"","sources":["../src/validate-upload-result.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,mBAAmB,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAKpE;;;;GAIG;AACH,MAAM,MAAM,2BAA2B,GAAG,IAAI,CAC7C,mBAAmB,EACnB,uBAAuB,GAAG,2BAA2B,CACrD,CAAC;AAEF,wBAAgB,oBAAoB,CACnC,MAAM,EAAE,YAAY,EACpB,OAAO,GAAE,2BAAgC,GACvC,YAAY,CAqBd"}

package/dist/validate-upload-result.js

@@ -0,0 +1,115 @@
+import { AssetValidationError } from "./errors.js";
+const ALWAYS_ALLOWED_SCHEMES = new Set([
+    "http",
+    "https",
+    "blob"
+]);
+const HARD_BLOCKED_SCHEMES = new Set([
+    "javascript",
+    "vbscript"
+]);
+function validateUploadResult(result, options = {}) {
+    if ("string" != typeof result.id || "" === result.id.trim()) throw new AssetValidationError("INVALID_UPLOAD_ID", "Upload adapter returned an empty asset id.");
+    const normalizedUrl = normalizeAllowedUrl(result.url, options);
+    const trimmedName = "string" == typeof result.name ? result.name.trim() : "";
+    const nextResult = {
+        id: result.id.trim(),
+        url: normalizedUrl,
+        ..."" !== trimmedName ? {
+            name: trimmedName
+        } : {},
+        ...result.meta ? {
+            meta: stripUndefinedMeta(result.meta)
+        } : {},
+        ...result.tags && result.tags.length > 0 ? {
+            tags: Object.freeze([
+                ...result.tags
+            ])
+        } : {}
+    };
+    return Object.freeze(nextResult);
+}
+function normalizeAllowedUrl(input, options) {
+    const candidate = normalizeCandidate(input);
+    if (!candidate) throw new AssetValidationError("EMPTY_UPLOAD_URL", "Upload adapter returned an empty URL.");
+    if (candidate.startsWith("//")) throw new AssetValidationError("UNSCHEMED_UPLOAD_URL", "Upload adapter returned a scheme-less URL. Use an absolute URL with an allowed scheme.");
+    const sanitized = stripUnsafeAscii(candidate);
+    const schemeMatch = sanitized.match(/^([a-z][a-z0-9+.-]*):/i);
+    if (!schemeMatch) throw new AssetValidationError("UNSCHEMED_UPLOAD_URL", "Upload adapter returned a URL without a scheme.");
+    const scheme = schemeMatch[1]?.toLowerCase();
+    if (!scheme) throw new AssetValidationError("UNSCHEMED_UPLOAD_URL", "Upload adapter returned a URL without a scheme.");
+    if (HARD_BLOCKED_SCHEMES.has(scheme)) throw new AssetValidationError("DISALLOWED_UPLOAD_URL_SCHEME", `Upload adapter returned a disallowed URL scheme "${scheme}".`);
+    if (!isSchemeAllowed(scheme, options)) throw new AssetValidationError("DISALLOWED_UPLOAD_URL_SCHEME", `Upload adapter returned URL scheme "${scheme}" which is not in the allowlist.`);
+    if ("http" === scheme || "https" === scheme || "blob" === scheme) assertNoPathTraversal(sanitized);
+    if ("http" === scheme || "https" === scheme) assertNoMixedScriptHostname(sanitized, options);
+    return candidate;
+}
+function isSchemeAllowed(scheme, options) {
+    if (ALWAYS_ALLOWED_SCHEMES.has(scheme)) return true;
+    if ("data" === scheme) return true === options.dataUrlAllowlistOptIn;
+    return false;
+}
+function assertNoPathTraversal(url) {
+    const lowered = url.toLowerCase();
+    if (lowered.includes("../") || lowered.includes("..%2f")) throw new AssetValidationError("PATH_TRAVERSAL_URL", "Upload adapter returned a URL containing path-traversal segments.");
+    if (lowered.includes("%2e%2e/") || lowered.includes("%2e%2e%2f")) throw new AssetValidationError("PATH_TRAVERSAL_URL", "Upload adapter returned a URL containing percent-encoded path-traversal segments.");
+}
+function assertNoMixedScriptHostname(url, options) {
+    if (true === options.allowMixedScriptHostnames) return;
+    const match = url.match(/^[a-z][a-z0-9+.-]*:\/\/(?:[^@/]+@)?([^:/?#]+)/i);
+    if (!match) return;
+    const hostname = match[1] ?? "";
+    if ("" === hostname) return;
+    const scripts = detectHostnameScripts(hostname);
+    const hasLatin = scripts.has("Latin");
+    const confusable = [
+        "Cyrillic",
+        "Greek"
+    ].filter((s)=>scripts.has(s));
+    if (hasLatin && confusable.length > 0) throw new AssetValidationError("MIXED_SCRIPT_HOSTNAME", `Upload adapter returned a URL whose hostname mixes Latin with a visually confusable script (${confusable.join(", ")}). Set allowMixedScriptHostnames: true to permit this.`);
+}
+function detectHostnameScripts(host) {
+    const scripts = new Set();
+    for (const ch of host)if (!/[\p{Script=Common}\p{Script=Inherited}]/u.test(ch)) if (/\p{Script=Latin}/u.test(ch)) scripts.add("Latin");
+    else if (/\p{Script=Cyrillic}/u.test(ch)) scripts.add("Cyrillic");
+    else if (/\p{Script=Greek}/u.test(ch)) scripts.add("Greek");
+    else if (/\p{Script=Han}/u.test(ch)) scripts.add("Han");
+    else if (/\p{Script=Hiragana}/u.test(ch)) scripts.add("Hiragana");
+    else if (/\p{Script=Katakana}/u.test(ch)) scripts.add("Katakana");
+    else if (/\p{Script=Hangul}/u.test(ch)) scripts.add("Hangul");
+    else if (/\p{Script=Arabic}/u.test(ch)) scripts.add("Arabic");
+    else if (/\p{Script=Hebrew}/u.test(ch)) scripts.add("Hebrew");
+    else scripts.add("Other");
+    return scripts;
+}
+function normalizeCandidate(input) {
+    const candidate = input.trim();
+    return "" === candidate ? void 0 : candidate;
+}
+function stripUnsafeAscii(input) {
+    let output = "";
+    for (const character of input){
+        const codePoint = character.charCodeAt(0);
+        if (!(codePoint <= 0x20) && 0x7f !== codePoint) output += character;
+    }
+    return output;
+}
+function stripUndefinedMeta(meta) {
+    if (!meta) return;
+    const nextMeta = {
+        ...void 0 !== meta.size ? {
+            size: meta.size
+        } : {},
+        ...void 0 !== meta.mimeType ? {
+            mimeType: meta.mimeType
+        } : {},
+        ...void 0 !== meta.width ? {
+            width: meta.width
+        } : {},
+        ...void 0 !== meta.height ? {
+            height: meta.height
+        } : {}
+    };
+    return Object.freeze(nextMeta);
+}
+export { validateUploadResult };