@anvilkit/plugin-asset-manager 0.1.8 → 0.1.10

package/dist/utils/sniff-file-type.js

@@ -0,0 +1,164 @@
+const ascii = (text)=>Array.from(text, (ch)=>ch.charCodeAt(0));
+const SIGNATURES = [
+    {
+        mime: "image/png",
+        parts: [
+            {
+                offset: 0,
+                bytes: [
+                    0x89,
+                    0x50,
+                    0x4e,
+                    0x47,
+                    0x0d,
+                    0x0a,
+                    0x1a,
+                    0x0a
+                ]
+            }
+        ]
+    },
+    {
+        mime: "image/jpeg",
+        parts: [
+            {
+                offset: 0,
+                bytes: [
+                    0xff,
+                    0xd8,
+                    0xff
+                ]
+            }
+        ]
+    },
+    {
+        mime: "image/gif",
+        parts: [
+            {
+                offset: 0,
+                bytes: ascii("GIF8")
+            }
+        ]
+    },
+    {
+        mime: "image/bmp",
+        parts: [
+            {
+                offset: 0,
+                bytes: ascii("BM")
+            }
+        ]
+    },
+    {
+        mime: "image/webp",
+        parts: [
+            {
+                offset: 0,
+                bytes: ascii("RIFF")
+            },
+            {
+                offset: 8,
+                bytes: ascii("WEBP")
+            }
+        ]
+    },
+    {
+        mime: "audio/wav",
+        parts: [
+            {
+                offset: 0,
+                bytes: ascii("RIFF")
+            },
+            {
+                offset: 8,
+                bytes: ascii("WAVE")
+            }
+        ]
+    },
+    {
+        mime: "video/webm",
+        parts: [
+            {
+                offset: 0,
+                bytes: [
+                    0x1a,
+                    0x45,
+                    0xdf,
+                    0xa3
+                ]
+            }
+        ]
+    },
+    {
+        mime: "audio/ogg",
+        parts: [
+            {
+                offset: 0,
+                bytes: ascii("OggS")
+            }
+        ]
+    },
+    {
+        mime: "audio/mpeg",
+        parts: [
+            {
+                offset: 0,
+                bytes: ascii("ID3")
+            }
+        ]
+    },
+    {
+        mime: "application/pdf",
+        parts: [
+            {
+                offset: 0,
+                bytes: ascii("%PDF")
+            }
+        ]
+    }
+];
+const FTYP_BRAND_MIME = {
+    avif: "image/avif",
+    avis: "image/avif",
+    heic: "image/heic",
+    heix: "image/heic",
+    heim: "image/heic",
+    heis: "image/heic",
+    mif1: "image/heic",
+    isom: "video/mp4",
+    iso2: "video/mp4",
+    mp41: "video/mp4",
+    mp42: "video/mp4",
+    avc1: "video/mp4",
+    dash: "video/mp4",
+    "qt  ": "video/quicktime"
+};
+const FTYP = ascii("ftyp");
+const SNIFF_BYTE_COUNT = 16;
+function detectMimeFromBytes(bytes) {
+    if (matchesAt(bytes, {
+        offset: 4,
+        bytes: FTYP
+    })) {
+        const brand = readAscii(bytes, 8, 4);
+        return void 0 !== brand ? FTYP_BRAND_MIME[brand] : void 0;
+    }
+    for (const signature of SIGNATURES)if (signature.parts.every((part)=>matchesAt(bytes, part))) return signature.mime;
+}
+function readAscii(bytes, offset, length) {
+    if (offset + length > bytes.length) return;
+    let out = "";
+    for(let i = 0; i < length; i += 1)out += String.fromCharCode(bytes[offset + i]);
+    return out;
+}
+function matchesAt(bytes, part) {
+    if (part.offset + part.bytes.length > bytes.length) return false;
+    for(let i = 0; i < part.bytes.length; i += 1)if (bytes[part.offset + i] !== part.bytes[i]) return false;
+    return true;
+}
+async function sniffFileMime(file) {
+    if ("function" != typeof file.slice) return;
+    const buffer = await file.slice(0, SNIFF_BYTE_COUNT).arrayBuffer();
+    return detectMimeFromBytes(new Uint8Array(buffer));
+}
+export { SNIFF_BYTE_COUNT, detectMimeFromBytes, sniffFileMime };

package/dist/utils/studio-asset-source.cjs

@@ -34,10 +34,11 @@ __webpack_require__.d(__webpack_exports__, {
     toStudioAsset: ()=>toStudioAsset
 });
 const external_asset_reference_cjs_namespaceObject = require("./asset-reference.cjs");
+const external_errors_cjs_namespaceObject = require("./errors.cjs");
 const external_infer_kind_cjs_namespaceObject = require("./infer-kind.cjs");
 const MAX_CONCURRENT_UPLOADS = 3;
 function createStudioAssetSource(options) {
-    const { registry, upload, getThumbnail } = options;
+    const { registry, upload, getThumbnail, onDelete } = options;
     const maxConcurrent = Math.max(1, options.maxConcurrentUploads ?? MAX_CONCURRENT_UPLOADS);
     const project = (entry)=>toStudioAsset(entry, getThumbnail);
     const uploadListeners = new Set();
@@ -141,16 +142,17 @@ function createStudioAssetSource(options) {
                 signal?.removeEventListener("abort", abortFromSignal);
             }
         },
-        delete (assetId) {
-            registry.delete(assetId);
-            return Promise.resolve();
+        async delete (assetId) {
+            const removed = registry.get(assetId);
+            if (!registry.delete(assetId)) throw makeUnknownAssetMutationError("delete", assetId);
+            if (void 0 !== removed) await onDelete?.(removed);
         },
         rename (assetId, nextName) {
-            registry.rename(assetId, nextName);
+            if (void 0 === registry.rename(assetId, nextName)) return Promise.reject(makeUnknownAssetMutationError("rename", assetId));
             return Promise.resolve();
         },
         setTags (assetId, tags) {
-            registry.setTags(assetId, tags);
+            if (void 0 === registry.setTags(assetId, tags)) return Promise.reject(makeUnknownAssetMutationError("set tags on", assetId));
             return Promise.resolve();
         },
         async replace (assetId, file) {
@@ -207,6 +209,9 @@ function deriveThumbnailUrl(entry, kind, getThumbnail) {
     if (void 0 !== getThumbnail) return getThumbnail(entry);
     return "image" === kind ? entry.url : void 0;
 }
+function makeUnknownAssetMutationError(operation, assetId) {
+    return new external_errors_cjs_namespaceObject.AssetSourceError("ASSET_MUTATION_REJECTED", `Cannot ${operation} unknown asset "${assetId}".`);
+}
 function deriveFallbackName(entry) {
     const tail = entry.url.split(/[/?#]/).filter(Boolean).pop();
     if (void 0 !== tail && "" !== tail && !tail.startsWith("data:")) return tail;

package/dist/utils/studio-asset-source.d.cts

@@ -12,13 +12,14 @@
  * registry so the IR resolver and the sidebar see the same data.
  */
 import type { StudioAsset, StudioAssetKind, StudioAssetSource } from "@anvilkit/core/types";
-import type { AssetRegistry, UploadAdapterOptions, UploadResult } from "../types/types.js";
+import type { AssetDeletedHook, AssetRegistry, UploadAdapterOptions, UploadResult } from "../types/types.js";
 /**
  * Default concurrency cap for batched uploads. Editors typically drag
  * 1–10 files at a time; three concurrent uploads strikes a balance
  * between throughput and politeness to host endpoints.
  */
 export declare const MAX_CONCURRENT_UPLOADS = 3;
+/** Inputs needed to bridge the registry into core's studio asset source API. */
 export interface CreateStudioAssetSourceOptions {
     readonly registry: AssetRegistry;
     /**
@@ -41,7 +42,10 @@ export interface CreateStudioAssetSourceOptions {
      * sequential behavior.
      */
     readonly maxConcurrentUploads?: number;
+    /** Fired with the removed record after a successful delete. */
+    readonly onDelete?: AssetDeletedHook;
 }
+/** Adapt the upload registry into core's `StudioAssetSource` contract. */
 export declare function createStudioAssetSource(options: CreateStudioAssetSourceOptions): StudioAssetSource;
 /**
  * Project a registry `UploadResult` into the sidebar's `StudioAsset` shape.

package/dist/utils/studio-asset-source.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"studio-asset-source.d.cts","sourceRoot":"","sources":["../../src/utils/studio-asset-source.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EACX,WAAW,EACX,eAAe,EAGf,iBAAiB,EAGjB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,KAAK,EACX,aAAa,EACb,oBAAoB,EACpB,YAAY,EACZ,MAAM,mBAAmB,CAAC;AAI3B;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,IAAI,CAAC;AAExC,MAAM,WAAW,8BAA8B;IAC9C,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC;IACjC;;;OAGG;IACH,QAAQ,CAAC,MAAM,EAAE,CAChB,IAAI,EAAE,IAAI,EACV,OAAO,CAAC,EAAE,oBAAoB,KAC1B,OAAO,CAAC,YAAY,CAAC,CAAC;IAC3B;;;;;;;OAOG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC,KAAK,EAAE,YAAY,KAAK,MAAM,GAAG,SAAS,CAAC;IACpE;;;;OAIG;IACH,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,CAAC;CACvC;AAED,wBAAgB,uBAAuB,CACtC,OAAO,EAAE,8BAA8B,GACrC,iBAAiB,CAqLnB;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAC5B,KAAK,EAAE,YAAY,EACnB,YAAY,CAAC,EAAE,CAAC,KAAK,EAAE,YAAY,KAAK,MAAM,GAAG,SAAS,GACxD,WAAW,CAqBb;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,YAAY,GAAG,eAAe,CAEzE"}
+{"version":3,"file":"studio-asset-source.d.cts","sourceRoot":"","sources":["../../src/utils/studio-asset-source.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EACX,WAAW,EACX,eAAe,EAGf,iBAAiB,EAGjB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,KAAK,EACX,gBAAgB,EAChB,aAAa,EACb,oBAAoB,EACpB,YAAY,EACZ,MAAM,mBAAmB,CAAC;AAK3B;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,IAAI,CAAC;AAExC,gFAAgF;AAChF,MAAM,WAAW,8BAA8B;IAC9C,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC;IACjC;;;OAGG;IACH,QAAQ,CAAC,MAAM,EAAE,CAChB,IAAI,EAAE,IAAI,EACV,OAAO,CAAC,EAAE,oBAAoB,KAC1B,OAAO,CAAC,YAAY,CAAC,CAAC;IAC3B;;;;;;;OAOG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC,KAAK,EAAE,YAAY,KAAK,MAAM,GAAG,SAAS,CAAC;IACpE;;;;OAIG;IACH,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,CAAC;IACvC,+DAA+D;IAC/D,QAAQ,CAAC,QAAQ,CAAC,EAAE,gBAAgB,CAAC;CACrC;AAED,0EAA0E;AAC1E,wBAAgB,uBAAuB,CACtC,OAAO,EAAE,8BAA8B,GACrC,iBAAiB,CA8LnB;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAC5B,KAAK,EAAE,YAAY,EACnB,YAAY,CAAC,EAAE,CAAC,KAAK,EAAE,YAAY,KAAK,MAAM,GAAG,SAAS,GACxD,WAAW,CAqBb;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,YAAY,GAAG,eAAe,CAEzE"}

package/dist/utils/studio-asset-source.d.ts

@@ -12,13 +12,14 @@
  * registry so the IR resolver and the sidebar see the same data.
  */
 import type { StudioAsset, StudioAssetKind, StudioAssetSource } from "@anvilkit/core/types";
-import type { AssetRegistry, UploadAdapterOptions, UploadResult } from "../types/types.js";
+import type { AssetDeletedHook, AssetRegistry, UploadAdapterOptions, UploadResult } from "../types/types.js";
 /**
  * Default concurrency cap for batched uploads. Editors typically drag
  * 1–10 files at a time; three concurrent uploads strikes a balance
  * between throughput and politeness to host endpoints.
  */
 export declare const MAX_CONCURRENT_UPLOADS = 3;
+/** Inputs needed to bridge the registry into core's studio asset source API. */
 export interface CreateStudioAssetSourceOptions {
     readonly registry: AssetRegistry;
     /**
@@ -41,7 +42,10 @@ export interface CreateStudioAssetSourceOptions {
      * sequential behavior.
      */
     readonly maxConcurrentUploads?: number;
+    /** Fired with the removed record after a successful delete. */
+    readonly onDelete?: AssetDeletedHook;
 }
+/** Adapt the upload registry into core's `StudioAssetSource` contract. */
 export declare function createStudioAssetSource(options: CreateStudioAssetSourceOptions): StudioAssetSource;
 /**
  * Project a registry `UploadResult` into the sidebar's `StudioAsset` shape.

package/dist/utils/studio-asset-source.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"studio-asset-source.d.ts","sourceRoot":"","sources":["../../src/utils/studio-asset-source.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EACX,WAAW,EACX,eAAe,EAGf,iBAAiB,EAGjB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,KAAK,EACX,aAAa,EACb,oBAAoB,EACpB,YAAY,EACZ,MAAM,mBAAmB,CAAC;AAI3B;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,IAAI,CAAC;AAExC,MAAM,WAAW,8BAA8B;IAC9C,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC;IACjC;;;OAGG;IACH,QAAQ,CAAC,MAAM,EAAE,CAChB,IAAI,EAAE,IAAI,EACV,OAAO,CAAC,EAAE,oBAAoB,KAC1B,OAAO,CAAC,YAAY,CAAC,CAAC;IAC3B;;;;;;;OAOG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC,KAAK,EAAE,YAAY,KAAK,MAAM,GAAG,SAAS,CAAC;IACpE;;;;OAIG;IACH,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,CAAC;CACvC;AAED,wBAAgB,uBAAuB,CACtC,OAAO,EAAE,8BAA8B,GACrC,iBAAiB,CAqLnB;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAC5B,KAAK,EAAE,YAAY,EACnB,YAAY,CAAC,EAAE,CAAC,KAAK,EAAE,YAAY,KAAK,MAAM,GAAG,SAAS,GACxD,WAAW,CAqBb;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,YAAY,GAAG,eAAe,CAEzE"}
+{"version":3,"file":"studio-asset-source.d.ts","sourceRoot":"","sources":["../../src/utils/studio-asset-source.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EACX,WAAW,EACX,eAAe,EAGf,iBAAiB,EAGjB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,KAAK,EACX,gBAAgB,EAChB,aAAa,EACb,oBAAoB,EACpB,YAAY,EACZ,MAAM,mBAAmB,CAAC;AAK3B;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,IAAI,CAAC;AAExC,gFAAgF;AAChF,MAAM,WAAW,8BAA8B;IAC9C,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC;IACjC;;;OAGG;IACH,QAAQ,CAAC,MAAM,EAAE,CAChB,IAAI,EAAE,IAAI,EACV,OAAO,CAAC,EAAE,oBAAoB,KAC1B,OAAO,CAAC,YAAY,CAAC,CAAC;IAC3B;;;;;;;OAOG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC,KAAK,EAAE,YAAY,KAAK,MAAM,GAAG,SAAS,CAAC;IACpE;;;;OAIG;IACH,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,CAAC;IACvC,+DAA+D;IAC/D,QAAQ,CAAC,QAAQ,CAAC,EAAE,gBAAgB,CAAC;CACrC;AAED,0EAA0E;AAC1E,wBAAgB,uBAAuB,CACtC,OAAO,EAAE,8BAA8B,GACrC,iBAAiB,CA8LnB;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAC5B,KAAK,EAAE,YAAY,EACnB,YAAY,CAAC,EAAE,CAAC,KAAK,EAAE,YAAY,KAAK,MAAM,GAAG,SAAS,GACxD,WAAW,CAqBb;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,YAAY,GAAG,eAAe,CAEzE"}

package/dist/utils/studio-asset-source.js

@@ -1,8 +1,9 @@
 import { createAssetReference } from "./asset-reference.js";
+import { AssetSourceError } from "./errors.js";
 import { inferAssetKind } from "./infer-kind.js";
 const MAX_CONCURRENT_UPLOADS = 3;
 function createStudioAssetSource(options) {
-    const { registry, upload, getThumbnail } = options;
+    const { registry, upload, getThumbnail, onDelete } = options;
     const maxConcurrent = Math.max(1, options.maxConcurrentUploads ?? MAX_CONCURRENT_UPLOADS);
     const project = (entry)=>toStudioAsset(entry, getThumbnail);
     const uploadListeners = new Set();
@@ -106,16 +107,17 @@ function createStudioAssetSource(options) {
                 signal?.removeEventListener("abort", abortFromSignal);
             }
         },
-        delete (assetId) {
-            registry.delete(assetId);
-            return Promise.resolve();
+        async delete (assetId) {
+            const removed = registry.get(assetId);
+            if (!registry.delete(assetId)) throw makeUnknownAssetMutationError("delete", assetId);
+            if (void 0 !== removed) await onDelete?.(removed);
         },
         rename (assetId, nextName) {
-            registry.rename(assetId, nextName);
+            if (void 0 === registry.rename(assetId, nextName)) return Promise.reject(makeUnknownAssetMutationError("rename", assetId));
             return Promise.resolve();
         },
         setTags (assetId, tags) {
-            registry.setTags(assetId, tags);
+            if (void 0 === registry.setTags(assetId, tags)) return Promise.reject(makeUnknownAssetMutationError("set tags on", assetId));
             return Promise.resolve();
         },
         async replace (assetId, file) {
@@ -172,6 +174,9 @@ function deriveThumbnailUrl(entry, kind, getThumbnail) {
     if (void 0 !== getThumbnail) return getThumbnail(entry);
     return "image" === kind ? entry.url : void 0;
 }
+function makeUnknownAssetMutationError(operation, assetId) {
+    return new AssetSourceError("ASSET_MUTATION_REJECTED", `Cannot ${operation} unknown asset "${assetId}".`);
+}
 function deriveFallbackName(entry) {
     const tail = entry.url.split(/[/?#]/).filter(Boolean).pop();
     if (void 0 !== tail && "" !== tail && !tail.startsWith("data:")) return tail;

package/dist/utils/upload-session-store.cjs

@@ -0,0 +1,125 @@
+"use strict";
+var __webpack_require__ = {};
+(()=>{
+    __webpack_require__.d = (exports1, getters, values)=>{
+        var define = (defs, kind)=>{
+            for(var key in defs)if (__webpack_require__.o(defs, key) && !__webpack_require__.o(exports1, key)) Object.defineProperty(exports1, key, {
+                enumerable: true,
+                [kind]: defs[key]
+            });
+        };
+        define(getters, "get");
+        define(values, "value");
+    };
+})();
+(()=>{
+    __webpack_require__.o = (obj, prop)=>Object.prototype.hasOwnProperty.call(obj, prop);
+})();
+(()=>{
+    __webpack_require__.r = (exports1)=>{
+        if ("u" > typeof Symbol && Symbol.toStringTag) Object.defineProperty(exports1, Symbol.toStringTag, {
+            value: 'Module'
+        });
+        Object.defineProperty(exports1, '__esModule', {
+            value: true
+        });
+    };
+})();
+var __webpack_exports__ = {};
+__webpack_require__.r(__webpack_exports__);
+const DEFAULT_KEY_PREFIX = "anvilkit:asset-upload";
+function fingerprintFile(file) {
+    return `${encodeURIComponent(file.name)}:${file.size}:${file.lastModified}`;
+}
+function createUploadSessionStore(options = {}) {
+    const storage = options.storage ?? resolveDefaultStorage();
+    const prefix = options.keyPrefix ?? DEFAULT_KEY_PREFIX;
+    const keyOf = (file)=>`${prefix}:${fingerprintFile(file)}`;
+    return {
+        load (file) {
+            const key = keyOf(file);
+            let raw;
+            try {
+                raw = storage.getItem(key);
+            } catch  {
+                return;
+            }
+            if (null === raw) return;
+            let parsed;
+            try {
+                parsed = JSON.parse(raw);
+            } catch  {
+                dropQuietly(storage, key);
+                return;
+            }
+            if (!isPersistedUploadSession(parsed)) return void dropQuietly(storage, key);
+            return parsed;
+        },
+        save (file, session) {
+            const serialized = JSON.stringify(session);
+            try {
+                storage.setItem(keyOf(file), serialized);
+            } catch  {}
+        },
+        clear (file) {
+            dropQuietly(storage, keyOf(file));
+        }
+    };
+}
+function dropQuietly(storage, key) {
+    try {
+        storage.removeItem(key);
+    } catch  {}
+}
+function resolveDefaultStorage() {
+    try {
+        const ls = globalThis.localStorage;
+        if (ls) {
+            const probe = `${DEFAULT_KEY_PREFIX}:__probe__`;
+            ls.setItem(probe, "1");
+            ls.removeItem(probe);
+            return ls;
+        }
+    } catch  {}
+    return createMemoryStorage();
+}
+function createMemoryStorage() {
+    const map = new Map();
+    return {
+        getItem: (key)=>map.get(key) ?? null,
+        setItem: (key, value)=>{
+            map.set(key, value);
+        },
+        removeItem: (key)=>{
+            map.delete(key);
+        }
+    };
+}
+function isPersistedUploadSession(value) {
+    if (!isJsonObject(value)) return false;
+    const v = value;
+    if ("string" != typeof v.uploadId || "" === v.uploadId) return false;
+    if (!isPositiveSafeInteger(v.partSize)) return false;
+    if (void 0 !== v.meta && !isJsonObject(v.meta)) return false;
+    if (!Array.isArray(v.parts)) return false;
+    return v.parts.every((part)=>isJsonObject(part) && isPositiveSafeInteger(part.partNumber) && "string" == typeof part.etag);
+}
+function isJsonObject(value) {
+    return null !== value && "object" == typeof value && !Array.isArray(value);
+}
+function isPositiveSafeInteger(value) {
+    return "number" == typeof value && Number.isSafeInteger(value) && value > 0;
+}
+__webpack_require__.d(__webpack_exports__, {
+    createUploadSessionStore: ()=>createUploadSessionStore,
+    fingerprintFile: ()=>fingerprintFile
+});
+exports.createUploadSessionStore = __webpack_exports__.createUploadSessionStore;
+exports.fingerprintFile = __webpack_exports__.fingerprintFile;
+for(var __rspack_i in __webpack_exports__)if (-1 === [
+    "createUploadSessionStore",
+    "fingerprintFile"
+].indexOf(__rspack_i)) exports[__rspack_i] = __webpack_exports__[__rspack_i];
+Object.defineProperty(exports, '__esModule', {
+    value: true
+});

package/dist/utils/upload-session-store.d.cts

@@ -0,0 +1,55 @@
+/**
+ * @file Built-in {@link UploadSessionStore} implementation (PRD 0004 §5.1 — M2).
+ *
+ * Persists in-progress resumable-upload sessions so an interrupted upload can
+ * resume after a reload. Keyed by a stable file fingerprint (name + size +
+ * lastModified): the same picked file resumes, a different file does not.
+ *
+ * Backed by `localStorage` by default with a silent in-memory fallback when the
+ * Web Storage API is unavailable or throws (SSR, Node tests, privacy mode).
+ * Every storage call is wrapped — persistence is an *optimization*, never a
+ * correctness dependency, so quota/availability errors degrade to "no resume"
+ * rather than failing the upload.
+ *
+ * The interface ({@link UploadSessionStore}) lives in `types/resumable.ts`
+ * alongside the rest of the contract; this module is the implementation only,
+ * so `types → utils` never forms an import cycle.
+ *
+ * @experimental Public surface may change before v1.0.
+ */
+import type { UploadSessionStore } from "../types/resumable.js";
+/**
+ * Minimal subset of the Web Storage API the session store relies on. Declared
+ * locally (rather than referencing the DOM `Storage` lib type) so a host can
+ * supply `sessionStorage`, a namespaced wrapper, or a test double without
+ * pulling in DOM typings.
+ */
+export interface UploadSessionStorage {
+    getItem(key: string): string | null;
+    setItem(key: string, value: string): void;
+    removeItem(key: string): void;
+}
+/** Options for {@link createUploadSessionStore}. */
+export interface CreateUploadSessionStoreOptions {
+    /**
+     * Backing storage. Defaults to `globalThis.localStorage` when usable,
+     * otherwise a process-lifetime in-memory map.
+     */
+    readonly storage?: UploadSessionStorage;
+    /** Key namespace. Defaults to `"anvilkit:asset-upload"`. */
+    readonly keyPrefix?: string;
+}
+/**
+ * Stable identity for an upload across reloads: the same file (by name, byte
+ * length, and last-modified time) maps to the same key, while any edit changes
+ * it. `name` is percent-encoded so the `:` delimiter can't be spoofed by a
+ * filename.
+ */
+export declare function fingerprintFile(file: File): string;
+/**
+ * Create the built-in {@link UploadSessionStore}. Synchronous (localStorage is
+ * synchronous); the contract's optionally-async return types let custom hosts
+ * back it with IndexedDB or a remote service.
+ */
+export declare function createUploadSessionStore(options?: CreateUploadSessionStoreOptions): UploadSessionStore;
+//# sourceMappingURL=upload-session-store.d.cts.map

package/dist/utils/upload-session-store.d.cts.map

@@ -0,0 +1 @@
+{"version":3,"file":"upload-session-store.d.cts","sourceRoot":"","sources":["../../src/utils/upload-session-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,KAAK,EAEX,kBAAkB,EAClB,MAAM,uBAAuB,CAAC;AAE/B;;;;;GAKG;AACH,MAAM,WAAW,oBAAoB;IACpC,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;IACpC,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1C,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9B;AAED,oDAAoD;AACpD,MAAM,WAAW,+BAA+B;IAC/C;;;OAGG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,oBAAoB,CAAC;IACxC,4DAA4D;IAC5D,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC5B;AAID;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,IAAI,GAAG,MAAM,CAElD;AAED;;;;GAIG;AACH,wBAAgB,wBAAwB,CACvC,OAAO,GAAE,+BAAoC,GAC3C,kBAAkB,CA+CpB"}

package/dist/utils/upload-session-store.d.ts

@@ -0,0 +1,55 @@
+/**
+ * @file Built-in {@link UploadSessionStore} implementation (PRD 0004 §5.1 — M2).
+ *
+ * Persists in-progress resumable-upload sessions so an interrupted upload can
+ * resume after a reload. Keyed by a stable file fingerprint (name + size +
+ * lastModified): the same picked file resumes, a different file does not.
+ *
+ * Backed by `localStorage` by default with a silent in-memory fallback when the
+ * Web Storage API is unavailable or throws (SSR, Node tests, privacy mode).
+ * Every storage call is wrapped — persistence is an *optimization*, never a
+ * correctness dependency, so quota/availability errors degrade to "no resume"
+ * rather than failing the upload.
+ *
+ * The interface ({@link UploadSessionStore}) lives in `types/resumable.ts`
+ * alongside the rest of the contract; this module is the implementation only,
+ * so `types → utils` never forms an import cycle.
+ *
+ * @experimental Public surface may change before v1.0.
+ */
+import type { UploadSessionStore } from "../types/resumable.js";
+/**
+ * Minimal subset of the Web Storage API the session store relies on. Declared
+ * locally (rather than referencing the DOM `Storage` lib type) so a host can
+ * supply `sessionStorage`, a namespaced wrapper, or a test double without
+ * pulling in DOM typings.
+ */
+export interface UploadSessionStorage {
+    getItem(key: string): string | null;
+    setItem(key: string, value: string): void;
+    removeItem(key: string): void;
+}
+/** Options for {@link createUploadSessionStore}. */
+export interface CreateUploadSessionStoreOptions {
+    /**
+     * Backing storage. Defaults to `globalThis.localStorage` when usable,
+     * otherwise a process-lifetime in-memory map.
+     */
+    readonly storage?: UploadSessionStorage;
+    /** Key namespace. Defaults to `"anvilkit:asset-upload"`. */
+    readonly keyPrefix?: string;
+}
+/**
+ * Stable identity for an upload across reloads: the same file (by name, byte
+ * length, and last-modified time) maps to the same key, while any edit changes
+ * it. `name` is percent-encoded so the `:` delimiter can't be spoofed by a
+ * filename.
+ */
+export declare function fingerprintFile(file: File): string;
+/**
+ * Create the built-in {@link UploadSessionStore}. Synchronous (localStorage is
+ * synchronous); the contract's optionally-async return types let custom hosts
+ * back it with IndexedDB or a remote service.
+ */
+export declare function createUploadSessionStore(options?: CreateUploadSessionStoreOptions): UploadSessionStore;
+//# sourceMappingURL=upload-session-store.d.ts.map

package/dist/utils/upload-session-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"upload-session-store.d.ts","sourceRoot":"","sources":["../../src/utils/upload-session-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,KAAK,EAEX,kBAAkB,EAClB,MAAM,uBAAuB,CAAC;AAE/B;;;;;GAKG;AACH,MAAM,WAAW,oBAAoB;IACpC,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;IACpC,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1C,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9B;AAED,oDAAoD;AACpD,MAAM,WAAW,+BAA+B;IAC/C;;;OAGG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,oBAAoB,CAAC;IACxC,4DAA4D;IAC5D,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC5B;AAID;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,IAAI,GAAG,MAAM,CAElD;AAED;;;;GAIG;AACH,wBAAgB,wBAAwB,CACvC,OAAO,GAAE,+BAAoC,GAC3C,kBAAkB,CA+CpB"}

package/dist/utils/upload-session-store.js

@@ -0,0 +1,84 @@
+const DEFAULT_KEY_PREFIX = "anvilkit:asset-upload";
+function fingerprintFile(file) {
+    return `${encodeURIComponent(file.name)}:${file.size}:${file.lastModified}`;
+}
+function createUploadSessionStore(options = {}) {
+    const storage = options.storage ?? resolveDefaultStorage();
+    const prefix = options.keyPrefix ?? DEFAULT_KEY_PREFIX;
+    const keyOf = (file)=>`${prefix}:${fingerprintFile(file)}`;
+    return {
+        load (file) {
+            const key = keyOf(file);
+            let raw;
+            try {
+                raw = storage.getItem(key);
+            } catch  {
+                return;
+            }
+            if (null === raw) return;
+            let parsed;
+            try {
+                parsed = JSON.parse(raw);
+            } catch  {
+                dropQuietly(storage, key);
+                return;
+            }
+            if (!isPersistedUploadSession(parsed)) return void dropQuietly(storage, key);
+            return parsed;
+        },
+        save (file, session) {
+            const serialized = JSON.stringify(session);
+            try {
+                storage.setItem(keyOf(file), serialized);
+            } catch  {}
+        },
+        clear (file) {
+            dropQuietly(storage, keyOf(file));
+        }
+    };
+}
+function dropQuietly(storage, key) {
+    try {
+        storage.removeItem(key);
+    } catch  {}
+}
+function resolveDefaultStorage() {
+    try {
+        const ls = globalThis.localStorage;
+        if (ls) {
+            const probe = `${DEFAULT_KEY_PREFIX}:__probe__`;
+            ls.setItem(probe, "1");
+            ls.removeItem(probe);
+            return ls;
+        }
+    } catch  {}
+    return createMemoryStorage();
+}
+function createMemoryStorage() {
+    const map = new Map();
+    return {
+        getItem: (key)=>map.get(key) ?? null,
+        setItem: (key, value)=>{
+            map.set(key, value);
+        },
+        removeItem: (key)=>{
+            map.delete(key);
+        }
+    };
+}
+function isPersistedUploadSession(value) {
+    if (!isJsonObject(value)) return false;
+    const v = value;
+    if ("string" != typeof v.uploadId || "" === v.uploadId) return false;
+    if (!isPositiveSafeInteger(v.partSize)) return false;
+    if (void 0 !== v.meta && !isJsonObject(v.meta)) return false;
+    if (!Array.isArray(v.parts)) return false;
+    return v.parts.every((part)=>isJsonObject(part) && isPositiveSafeInteger(part.partNumber) && "string" == typeof part.etag);
+}
+function isJsonObject(value) {
+    return null !== value && "object" == typeof value && !Array.isArray(value);
+}
+function isPositiveSafeInteger(value) {
+    return "number" == typeof value && Number.isSafeInteger(value) && value > 0;
+}
+export { createUploadSessionStore, fingerprintFile };

package/dist/utils/validate-upload-result.cjs

@@ -74,7 +74,7 @@ function normalizeAllowedUrl(input, options) {
     if (!isSchemeAllowed(scheme, options)) throw new external_errors_cjs_namespaceObject.AssetValidationError("DISALLOWED_UPLOAD_URL_SCHEME", `Upload adapter returned URL scheme "${scheme}" which is not in the allowlist.`);
     if ("http" === scheme || "https" === scheme || "blob" === scheme) assertNoPathTraversal(sanitized);
     if ("http" === scheme || "https" === scheme) assertNoMixedScriptHostname(sanitized, options);
-    return candidate;
+    return sanitized;
 }
 function isSchemeAllowed(scheme, options) {
     if (ALWAYS_ALLOWED_SCHEMES.has(scheme)) return true;
@@ -179,6 +179,14 @@ function stripUndefinedMeta(meta) {
         } : {},
         ...void 0 !== meta.height ? {
             height: meta.height
+        } : {},
+        ...void 0 !== meta.hash ? {
+            hash: meta.hash
+        } : {},
+        ...void 0 !== meta.attribution ? {
+            attribution: Object.freeze({
+                ...meta.attribution
+            })
         } : {}
     };
     return Object.freeze(nextMeta);