@bobbykim/manguito-cms-api 0.1.0

package/dist/runtime/index.d.mts

@@ -0,0 +1,29 @@
+import { Hono } from 'hono';
+import { ServerAdapter } from '@bobbykim/manguito-cms-core';
+import { handle } from 'hono/aws-lambda';
+import { handle as handle$1 } from 'hono/vercel';
+
+declare function createServer(app: Hono, options?: {
+    port?: number;
+}): ServerAdapter;
+
+declare function createLambdaHandler(app: Hono): ServerAdapter & {
+    handler: ReturnType<typeof handle>;
+};
+
+declare function createVercelHandler(app: Hono): ServerAdapter & {
+    handler: ReturnType<typeof handle$1>;
+};
+
+/**
+ * Resolve a request sub-path against a base directory, returning the absolute
+ * path only when it stays inside baseDir. Returns null for any path that
+ * escapes (traversal, sibling-prefix). Pure — performs no filesystem access.
+ */
+declare function resolveStaticFile(baseDir: string, urlSubPath: string): string | null;
+/** Extensions safe to serve inline for untrusted user uploads (Finding #2). */
+declare const SAFE_INLINE_MIME: Record<string, string>;
+/** MIME map for trusted, build-produced admin SPA assets. */
+declare const ADMIN_MIME: Record<string, string>;
+
+export { ADMIN_MIME, SAFE_INLINE_MIME, createLambdaHandler, createServer, createVercelHandler, resolveStaticFile };

package/dist/runtime/index.d.ts

@@ -0,0 +1,29 @@
+import { Hono } from 'hono';
+import { ServerAdapter } from '@bobbykim/manguito-cms-core';
+import { handle } from 'hono/aws-lambda';
+import { handle as handle$1 } from 'hono/vercel';
+
+declare function createServer(app: Hono, options?: {
+    port?: number;
+}): ServerAdapter;
+
+declare function createLambdaHandler(app: Hono): ServerAdapter & {
+    handler: ReturnType<typeof handle>;
+};
+
+declare function createVercelHandler(app: Hono): ServerAdapter & {
+    handler: ReturnType<typeof handle$1>;
+};
+
+/**
+ * Resolve a request sub-path against a base directory, returning the absolute
+ * path only when it stays inside baseDir. Returns null for any path that
+ * escapes (traversal, sibling-prefix). Pure — performs no filesystem access.
+ */
+declare function resolveStaticFile(baseDir: string, urlSubPath: string): string | null;
+/** Extensions safe to serve inline for untrusted user uploads (Finding #2). */
+declare const SAFE_INLINE_MIME: Record<string, string>;
+/** MIME map for trusted, build-produced admin SPA assets. */
+declare const ADMIN_MIME: Record<string, string>;
+
+export { ADMIN_MIME, SAFE_INLINE_MIME, createLambdaHandler, createServer, createVercelHandler, resolveStaticFile };

package/dist/runtime/index.js

@@ -0,0 +1,118 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/runtime/index.ts
+var runtime_exports = {};
+__export(runtime_exports, {
+  ADMIN_MIME: () => ADMIN_MIME,
+  SAFE_INLINE_MIME: () => SAFE_INLINE_MIME,
+  createLambdaHandler: () => createLambdaHandler,
+  createServer: () => createServer,
+  createVercelHandler: () => createVercelHandler,
+  resolveStaticFile: () => resolveStaticFile
+});
+module.exports = __toCommonJS(runtime_exports);
+
+// src/runtime/server.ts
+var import_node_server = require("@hono/node-server");
+var DEFAULT_CORS = { origin: "*" };
+function createServer(app, options) {
+  const port = options?.port ?? Number(process.env["PORT"] ?? 3e3);
+  (0, import_node_server.serve)({ fetch: app.fetch, port }, (info) => {
+    console.log(`Server listening on http://localhost:${info.port}`);
+  });
+  return {
+    type: "node",
+    cors: DEFAULT_CORS,
+    getEntryPoint: () => "node"
+  };
+}
+
+// src/runtime/lambda.ts
+var import_aws_lambda = require("hono/aws-lambda");
+var DEFAULT_CORS2 = { origin: "*" };
+function createLambdaHandler(app) {
+  return {
+    type: "lambda",
+    cors: DEFAULT_CORS2,
+    getEntryPoint: () => "lambda",
+    handler: (0, import_aws_lambda.handle)(app)
+  };
+}
+
+// src/runtime/vercel.ts
+var import_vercel = require("hono/vercel");
+var DEFAULT_CORS3 = { origin: "*" };
+function createVercelHandler(app) {
+  return {
+    type: "vercel",
+    cors: DEFAULT_CORS3,
+    getEntryPoint: () => "vercel",
+    handler: (0, import_vercel.handle)(app)
+  };
+}
+
+// src/runtime/static.ts
+var import_node_path = require("path");
+function resolveStaticFile(baseDir, urlSubPath) {
+  const base = (0, import_node_path.resolve)(baseDir);
+  const rel = urlSubPath.startsWith("/") ? "." + urlSubPath : "./" + urlSubPath;
+  const candidate = (0, import_node_path.resolve)(base, rel);
+  if (candidate === base || candidate.startsWith(base + import_node_path.sep)) {
+    return candidate;
+  }
+  return null;
+}
+var SAFE_INLINE_MIME = {
+  png: "image/png",
+  jpg: "image/jpeg",
+  jpeg: "image/jpeg",
+  gif: "image/gif",
+  webp: "image/webp",
+  mp4: "video/mp4",
+  webm: "video/webm",
+  mov: "video/quicktime",
+  pdf: "application/pdf"
+};
+var ADMIN_MIME = {
+  html: "text/html; charset=utf-8",
+  js: "application/javascript",
+  mjs: "application/javascript",
+  css: "text/css",
+  json: "application/json",
+  png: "image/png",
+  jpg: "image/jpeg",
+  jpeg: "image/jpeg",
+  gif: "image/gif",
+  svg: "image/svg+xml",
+  ico: "image/x-icon",
+  woff: "font/woff",
+  woff2: "font/woff2",
+  webp: "image/webp"
+};
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  ADMIN_MIME,
+  SAFE_INLINE_MIME,
+  createLambdaHandler,
+  createServer,
+  createVercelHandler,
+  resolveStaticFile
+});
+//# sourceMappingURL=index.js.map

package/dist/runtime/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/runtime/index.ts","../../src/runtime/server.ts","../../src/runtime/lambda.ts","../../src/runtime/vercel.ts","../../src/runtime/static.ts"],"sourcesContent":["export { createServer } from './server.js'\nexport { createLambdaHandler } from './lambda.js'\nexport { createVercelHandler } from './vercel.js'\nexport { resolveStaticFile, SAFE_INLINE_MIME, ADMIN_MIME } from './static.js'\n","import { serve } from '@hono/node-server'\nimport type { Hono } from 'hono'\nimport type { ServerAdapter, CorsConfig } from '@bobbykim/manguito-cms-core'\n\nconst DEFAULT_CORS: CorsConfig = { origin: '*' }\n\nexport function createServer(app: Hono, options?: { port?: number }): ServerAdapter {\n  const port = options?.port ?? Number(process.env['PORT'] ?? 3000)\n\n  serve({ fetch: app.fetch, port }, (info: { port: number }) => {\n    console.log(`Server listening on http://localhost:${info.port}`)\n  })\n\n  return {\n    type: 'node',\n    cors: DEFAULT_CORS,\n    getEntryPoint: () => 'node',\n  }\n}\n","import { handle } from 'hono/aws-lambda'\nimport type { Hono } from 'hono'\nimport type { ServerAdapter, CorsConfig } from '@bobbykim/manguito-cms-core'\n\nconst DEFAULT_CORS: CorsConfig = { origin: '*' }\n\nexport function createLambdaHandler(app: Hono): ServerAdapter & { handler: ReturnType<typeof handle> } {\n  return {\n    type: 'lambda',\n    cors: DEFAULT_CORS,\n    getEntryPoint: () => 'lambda',\n    handler: handle(app),\n  }\n}\n","import { handle } from 'hono/vercel'\nimport type { Hono } from 'hono'\nimport type { ServerAdapter, CorsConfig } from '@bobbykim/manguito-cms-core'\n\nconst DEFAULT_CORS: CorsConfig = { origin: '*' }\n\nexport function createVercelHandler(app: Hono): ServerAdapter & { handler: ReturnType<typeof handle> } {\n  return {\n    type: 'vercel',\n    cors: DEFAULT_CORS,\n    getEntryPoint: () => 'vercel',\n    handler: handle(app),\n  }\n}\n","import { resolve, sep } from 'node:path'\n\n/**\n * Resolve a request sub-path against a base directory, returning the absolute\n * path only when it stays inside baseDir. Returns null for any path that\n * escapes (traversal, sibling-prefix). Pure — performs no filesystem access.\n */\nexport function resolveStaticFile(baseDir: string, urlSubPath: string): string | null {\n  const base = resolve(baseDir)\n  const rel = urlSubPath.startsWith('/') ? '.' + urlSubPath : './' + urlSubPath\n  const candidate = resolve(base, rel)\n  if (candidate === base || candidate.startsWith(base + sep)) {\n    return candidate\n  }\n  return null\n}\n\n/** Extensions safe to serve inline for untrusted user uploads (Finding #2). */\nexport const SAFE_INLINE_MIME: Record<string, string> = {\n  png: 'image/png',\n  jpg: 'image/jpeg',\n  jpeg: 'image/jpeg',\n  gif: 'image/gif',\n  webp: 'image/webp',\n  mp4: 'video/mp4',\n  webm: 'video/webm',\n  mov: 'video/quicktime',\n  pdf: 'application/pdf',\n}\n\n/** MIME map for trusted, build-produced admin SPA assets. */\nexport const ADMIN_MIME: Record<string, string> = {\n  html: 'text/html; charset=utf-8',\n  js: 'application/javascript',\n  mjs: 'application/javascript',\n  css: 'text/css',\n  json: 'application/json',\n  png: 'image/png',\n  jpg: 'image/jpeg',\n  jpeg: 'image/jpeg',\n  gif: 'image/gif',\n  svg: 'image/svg+xml',\n  ico: 'image/x-icon',\n  woff: 'font/woff',\n  woff2: 'font/woff2',\n  webp: 'image/webp',\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACAA,yBAAsB;AAItB,IAAM,eAA2B,EAAE,QAAQ,IAAI;AAExC,SAAS,aAAa,KAAW,SAA4C;AAClF,QAAM,OAAO,SAAS,QAAQ,OAAO,QAAQ,IAAI,MAAM,KAAK,GAAI;AAEhE,gCAAM,EAAE,OAAO,IAAI,OAAO,KAAK,GAAG,CAAC,SAA2B;AAC5D,YAAQ,IAAI,wCAAwC,KAAK,IAAI,EAAE;AAAA,EACjE,CAAC;AAED,SAAO;AAAA,IACL,MAAM;AAAA,IACN,MAAM;AAAA,IACN,eAAe,MAAM;AAAA,EACvB;AACF;;;AClBA,wBAAuB;AAIvB,IAAMA,gBAA2B,EAAE,QAAQ,IAAI;AAExC,SAAS,oBAAoB,KAAmE;AACrG,SAAO;AAAA,IACL,MAAM;AAAA,IACN,MAAMA;AAAA,IACN,eAAe,MAAM;AAAA,IACrB,aAAS,0BAAO,GAAG;AAAA,EACrB;AACF;;;ACbA,oBAAuB;AAIvB,IAAMC,gBAA2B,EAAE,QAAQ,IAAI;AAExC,SAAS,oBAAoB,KAAmE;AACrG,SAAO;AAAA,IACL,MAAM;AAAA,IACN,MAAMA;AAAA,IACN,eAAe,MAAM;AAAA,IACrB,aAAS,sBAAO,GAAG;AAAA,EACrB;AACF;;;ACbA,uBAA6B;AAOtB,SAAS,kBAAkB,SAAiB,YAAmC;AACpF,QAAM,WAAO,0BAAQ,OAAO;AAC5B,QAAM,MAAM,WAAW,WAAW,GAAG,IAAI,MAAM,aAAa,OAAO;AACnE,QAAM,gBAAY,0BAAQ,MAAM,GAAG;AACnC,MAAI,cAAc,QAAQ,UAAU,WAAW,OAAO,oBAAG,GAAG;AAC1D,WAAO;AAAA,EACT;AACA,SAAO;AACT;AAGO,IAAM,mBAA2C;AAAA,EACtD,KAAK;AAAA,EACL,KAAK;AAAA,EACL,MAAM;AAAA,EACN,KAAK;AAAA,EACL,MAAM;AAAA,EACN,KAAK;AAAA,EACL,MAAM;AAAA,EACN,KAAK;AAAA,EACL,KAAK;AACP;AAGO,IAAM,aAAqC;AAAA,EAChD,MAAM;AAAA,EACN,IAAI;AAAA,EACJ,KAAK;AAAA,EACL,KAAK;AAAA,EACL,MAAM;AAAA,EACN,KAAK;AAAA,EACL,KAAK;AAAA,EACL,MAAM;AAAA,EACN,KAAK;AAAA,EACL,KAAK;AAAA,EACL,KAAK;AAAA,EACL,MAAM;AAAA,EACN,OAAO;AAAA,EACP,MAAM;AACR;","names":["DEFAULT_CORS","DEFAULT_CORS"]}

package/dist/runtime/index.mjs

@@ -0,0 +1,86 @@
+// src/runtime/server.ts
+import { serve } from "@hono/node-server";
+var DEFAULT_CORS = { origin: "*" };
+function createServer(app, options) {
+  const port = options?.port ?? Number(process.env["PORT"] ?? 3e3);
+  serve({ fetch: app.fetch, port }, (info) => {
+    console.log(`Server listening on http://localhost:${info.port}`);
+  });
+  return {
+    type: "node",
+    cors: DEFAULT_CORS,
+    getEntryPoint: () => "node"
+  };
+}
+
+// src/runtime/lambda.ts
+import { handle } from "hono/aws-lambda";
+var DEFAULT_CORS2 = { origin: "*" };
+function createLambdaHandler(app) {
+  return {
+    type: "lambda",
+    cors: DEFAULT_CORS2,
+    getEntryPoint: () => "lambda",
+    handler: handle(app)
+  };
+}
+
+// src/runtime/vercel.ts
+import { handle as handle2 } from "hono/vercel";
+var DEFAULT_CORS3 = { origin: "*" };
+function createVercelHandler(app) {
+  return {
+    type: "vercel",
+    cors: DEFAULT_CORS3,
+    getEntryPoint: () => "vercel",
+    handler: handle2(app)
+  };
+}
+
+// src/runtime/static.ts
+import { resolve, sep } from "path";
+function resolveStaticFile(baseDir, urlSubPath) {
+  const base = resolve(baseDir);
+  const rel = urlSubPath.startsWith("/") ? "." + urlSubPath : "./" + urlSubPath;
+  const candidate = resolve(base, rel);
+  if (candidate === base || candidate.startsWith(base + sep)) {
+    return candidate;
+  }
+  return null;
+}
+var SAFE_INLINE_MIME = {
+  png: "image/png",
+  jpg: "image/jpeg",
+  jpeg: "image/jpeg",
+  gif: "image/gif",
+  webp: "image/webp",
+  mp4: "video/mp4",
+  webm: "video/webm",
+  mov: "video/quicktime",
+  pdf: "application/pdf"
+};
+var ADMIN_MIME = {
+  html: "text/html; charset=utf-8",
+  js: "application/javascript",
+  mjs: "application/javascript",
+  css: "text/css",
+  json: "application/json",
+  png: "image/png",
+  jpg: "image/jpeg",
+  jpeg: "image/jpeg",
+  gif: "image/gif",
+  svg: "image/svg+xml",
+  ico: "image/x-icon",
+  woff: "font/woff",
+  woff2: "font/woff2",
+  webp: "image/webp"
+};
+export {
+  ADMIN_MIME,
+  SAFE_INLINE_MIME,
+  createLambdaHandler,
+  createServer,
+  createVercelHandler,
+  resolveStaticFile
+};
+//# sourceMappingURL=index.mjs.map

package/dist/runtime/index.mjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/runtime/server.ts","../../src/runtime/lambda.ts","../../src/runtime/vercel.ts","../../src/runtime/static.ts"],"sourcesContent":["import { serve } from '@hono/node-server'\nimport type { Hono } from 'hono'\nimport type { ServerAdapter, CorsConfig } from '@bobbykim/manguito-cms-core'\n\nconst DEFAULT_CORS: CorsConfig = { origin: '*' }\n\nexport function createServer(app: Hono, options?: { port?: number }): ServerAdapter {\n  const port = options?.port ?? Number(process.env['PORT'] ?? 3000)\n\n  serve({ fetch: app.fetch, port }, (info: { port: number }) => {\n    console.log(`Server listening on http://localhost:${info.port}`)\n  })\n\n  return {\n    type: 'node',\n    cors: DEFAULT_CORS,\n    getEntryPoint: () => 'node',\n  }\n}\n","import { handle } from 'hono/aws-lambda'\nimport type { Hono } from 'hono'\nimport type { ServerAdapter, CorsConfig } from '@bobbykim/manguito-cms-core'\n\nconst DEFAULT_CORS: CorsConfig = { origin: '*' }\n\nexport function createLambdaHandler(app: Hono): ServerAdapter & { handler: ReturnType<typeof handle> } {\n  return {\n    type: 'lambda',\n    cors: DEFAULT_CORS,\n    getEntryPoint: () => 'lambda',\n    handler: handle(app),\n  }\n}\n","import { handle } from 'hono/vercel'\nimport type { Hono } from 'hono'\nimport type { ServerAdapter, CorsConfig } from '@bobbykim/manguito-cms-core'\n\nconst DEFAULT_CORS: CorsConfig = { origin: '*' }\n\nexport function createVercelHandler(app: Hono): ServerAdapter & { handler: ReturnType<typeof handle> } {\n  return {\n    type: 'vercel',\n    cors: DEFAULT_CORS,\n    getEntryPoint: () => 'vercel',\n    handler: handle(app),\n  }\n}\n","import { resolve, sep } from 'node:path'\n\n/**\n * Resolve a request sub-path against a base directory, returning the absolute\n * path only when it stays inside baseDir. Returns null for any path that\n * escapes (traversal, sibling-prefix). Pure — performs no filesystem access.\n */\nexport function resolveStaticFile(baseDir: string, urlSubPath: string): string | null {\n  const base = resolve(baseDir)\n  const rel = urlSubPath.startsWith('/') ? '.' + urlSubPath : './' + urlSubPath\n  const candidate = resolve(base, rel)\n  if (candidate === base || candidate.startsWith(base + sep)) {\n    return candidate\n  }\n  return null\n}\n\n/** Extensions safe to serve inline for untrusted user uploads (Finding #2). */\nexport const SAFE_INLINE_MIME: Record<string, string> = {\n  png: 'image/png',\n  jpg: 'image/jpeg',\n  jpeg: 'image/jpeg',\n  gif: 'image/gif',\n  webp: 'image/webp',\n  mp4: 'video/mp4',\n  webm: 'video/webm',\n  mov: 'video/quicktime',\n  pdf: 'application/pdf',\n}\n\n/** MIME map for trusted, build-produced admin SPA assets. */\nexport const ADMIN_MIME: Record<string, string> = {\n  html: 'text/html; charset=utf-8',\n  js: 'application/javascript',\n  mjs: 'application/javascript',\n  css: 'text/css',\n  json: 'application/json',\n  png: 'image/png',\n  jpg: 'image/jpeg',\n  jpeg: 'image/jpeg',\n  gif: 'image/gif',\n  svg: 'image/svg+xml',\n  ico: 'image/x-icon',\n  woff: 'font/woff',\n  woff2: 'font/woff2',\n  webp: 'image/webp',\n}\n"],"mappings":";AAAA,SAAS,aAAa;AAItB,IAAM,eAA2B,EAAE,QAAQ,IAAI;AAExC,SAAS,aAAa,KAAW,SAA4C;AAClF,QAAM,OAAO,SAAS,QAAQ,OAAO,QAAQ,IAAI,MAAM,KAAK,GAAI;AAEhE,QAAM,EAAE,OAAO,IAAI,OAAO,KAAK,GAAG,CAAC,SAA2B;AAC5D,YAAQ,IAAI,wCAAwC,KAAK,IAAI,EAAE;AAAA,EACjE,CAAC;AAED,SAAO;AAAA,IACL,MAAM;AAAA,IACN,MAAM;AAAA,IACN,eAAe,MAAM;AAAA,EACvB;AACF;;;AClBA,SAAS,cAAc;AAIvB,IAAMA,gBAA2B,EAAE,QAAQ,IAAI;AAExC,SAAS,oBAAoB,KAAmE;AACrG,SAAO;AAAA,IACL,MAAM;AAAA,IACN,MAAMA;AAAA,IACN,eAAe,MAAM;AAAA,IACrB,SAAS,OAAO,GAAG;AAAA,EACrB;AACF;;;ACbA,SAAS,UAAAC,eAAc;AAIvB,IAAMC,gBAA2B,EAAE,QAAQ,IAAI;AAExC,SAAS,oBAAoB,KAAmE;AACrG,SAAO;AAAA,IACL,MAAM;AAAA,IACN,MAAMA;AAAA,IACN,eAAe,MAAM;AAAA,IACrB,SAASD,QAAO,GAAG;AAAA,EACrB;AACF;;;ACbA,SAAS,SAAS,WAAW;AAOtB,SAAS,kBAAkB,SAAiB,YAAmC;AACpF,QAAM,OAAO,QAAQ,OAAO;AAC5B,QAAM,MAAM,WAAW,WAAW,GAAG,IAAI,MAAM,aAAa,OAAO;AACnE,QAAM,YAAY,QAAQ,MAAM,GAAG;AACnC,MAAI,cAAc,QAAQ,UAAU,WAAW,OAAO,GAAG,GAAG;AAC1D,WAAO;AAAA,EACT;AACA,SAAO;AACT;AAGO,IAAM,mBAA2C;AAAA,EACtD,KAAK;AAAA,EACL,KAAK;AAAA,EACL,MAAM;AAAA,EACN,KAAK;AAAA,EACL,MAAM;AAAA,EACN,KAAK;AAAA,EACL,MAAM;AAAA,EACN,KAAK;AAAA,EACL,KAAK;AACP;AAGO,IAAM,aAAqC;AAAA,EAChD,MAAM;AAAA,EACN,IAAI;AAAA,EACJ,KAAK;AAAA,EACL,KAAK;AAAA,EACL,MAAM;AAAA,EACN,KAAK;AAAA,EACL,KAAK;AAAA,EACL,MAAM;AAAA,EACN,KAAK;AAAA,EACL,KAAK;AAAA,EACL,KAAK;AAAA,EACL,MAAM;AAAA,EACN,OAAO;AAAA,EACP,MAAM;AACR;","names":["DEFAULT_CORS","handle","DEFAULT_CORS"]}

package/dist/storage/index.d.mts

@@ -0,0 +1,25 @@
+import { StorageAdapter } from '@bobbykim/manguito-cms-core';
+
+type LocalAdapterOptions = {
+    upload_dir?: string;
+};
+declare function createLocalAdapter(options?: LocalAdapterOptions): StorageAdapter;
+
+type S3AdapterOptions = {
+    bucket: string;
+    region: string;
+    prefix?: string;
+    access_key_id?: string;
+    secret_access_key?: string;
+};
+declare function createS3Adapter(options: S3AdapterOptions): StorageAdapter;
+
+type CloudinaryAdapterOptions = {
+    cloud_name?: string;
+    folder?: string;
+    access_key_id?: string;
+    secret_access_key?: string;
+};
+declare function createCloudinaryAdapter(options?: CloudinaryAdapterOptions): StorageAdapter;
+
+export { type CloudinaryAdapterOptions, type LocalAdapterOptions, type S3AdapterOptions, createCloudinaryAdapter, createLocalAdapter, createS3Adapter };

package/dist/storage/index.d.ts

@@ -0,0 +1,25 @@
+import { StorageAdapter } from '@bobbykim/manguito-cms-core';
+
+type LocalAdapterOptions = {
+    upload_dir?: string;
+};
+declare function createLocalAdapter(options?: LocalAdapterOptions): StorageAdapter;
+
+type S3AdapterOptions = {
+    bucket: string;
+    region: string;
+    prefix?: string;
+    access_key_id?: string;
+    secret_access_key?: string;
+};
+declare function createS3Adapter(options: S3AdapterOptions): StorageAdapter;
+
+type CloudinaryAdapterOptions = {
+    cloud_name?: string;
+    folder?: string;
+    access_key_id?: string;
+    secret_access_key?: string;
+};
+declare function createCloudinaryAdapter(options?: CloudinaryAdapterOptions): StorageAdapter;
+
+export { type CloudinaryAdapterOptions, type LocalAdapterOptions, type S3AdapterOptions, createCloudinaryAdapter, createLocalAdapter, createS3Adapter };

package/dist/storage/index.js

@@ -0,0 +1,287 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/storage/index.ts
+var storage_exports = {};
+__export(storage_exports, {
+  createCloudinaryAdapter: () => createCloudinaryAdapter,
+  createLocalAdapter: () => createLocalAdapter,
+  createS3Adapter: () => createS3Adapter
+});
+module.exports = __toCommonJS(storage_exports);
+
+// src/storage/adapters/local.ts
+var import_node_fs = require("fs");
+var import_node_path = __toESM(require("path"));
+var import_node_crypto = __toESM(require("crypto"));
+function createLocalAdapter(options = {}) {
+  if (process.env["NODE_ENV"] === "production") {
+    console.warn(
+      "\u26A0 Warning: Local storage adapter is not recommended for production.\n  Files will not persist across container restarts or serverless invocations.\n  Consider createS3Adapter() or createCloudinaryAdapter() for production."
+    );
+  }
+  const upload_dir = options.upload_dir ?? "./uploads";
+  const pending = /* @__PURE__ */ new Map();
+  return {
+    type: "local",
+    async getPresignedUploadUrl(opts) {
+      const raw_ext = import_node_path.default.extname(opts.filename);
+      const ext = raw_ext.startsWith(".") ? raw_ext.slice(1) : raw_ext;
+      const uuid = import_node_crypto.default.randomUUID();
+      const key = ext ? `${opts.folder}/${uuid}.${ext}` : `${opts.folder}/${uuid}`;
+      const token = import_node_crypto.default.randomUUID();
+      const expires_in = opts.expires_in ?? 3600;
+      const expires_at = Math.floor(Date.now() / 1e3) + expires_in;
+      pending.set(token, { key, expires_at, folder: opts.folder });
+      return {
+        upload_url: `http://localhost:3000/_local_upload/${key}?token=${token}`,
+        key,
+        expires_at
+      };
+    },
+    getUrl(key) {
+      return `http://localhost:3000/uploads/${key}`;
+    },
+    async upload(key, data) {
+      const filepath = import_node_path.default.join(upload_dir, key);
+      await import_node_fs.promises.mkdir(import_node_path.default.dirname(filepath), { recursive: true });
+      await import_node_fs.promises.writeFile(filepath, data);
+    },
+    async delete(key) {
+      const normalizedKey = key.startsWith("uploads/") ? key.slice("uploads/".length) : key;
+      const filepath = import_node_path.default.join(upload_dir, normalizedKey);
+      try {
+        await import_node_fs.promises.unlink(filepath);
+      } catch (err) {
+        if (err.code !== "ENOENT") {
+          throw err;
+        }
+      }
+    },
+    async stat(key) {
+      const filepath = import_node_path.default.join(upload_dir, key.startsWith("uploads/") ? key.slice("uploads/".length) : key);
+      try {
+        const s = await import_node_fs.promises.stat(filepath);
+        return { size: s.size };
+      } catch {
+        return null;
+      }
+    }
+  };
+}
+
+// src/storage/adapters/s3.ts
+var import_node_path2 = __toESM(require("path"));
+var import_node_crypto2 = __toESM(require("crypto"));
+var import_client_s3 = require("@aws-sdk/client-s3");
+var import_s3_request_presigner = require("@aws-sdk/s3-request-presigner");
+function createS3Adapter(options) {
+  const { bucket, region, prefix, access_key_id, secret_access_key } = options;
+  const client = new import_client_s3.S3Client({
+    region,
+    // AWS SDK v3 (>= ~3.729) adds a CRC32 checksum to PutObject by default. For
+    // presigned URLs that bakes the *empty-body* checksum into the signed URL,
+    // so the browser's real upload fails the check with 403. Only checksum when
+    // an operation actually requires it, which excludes presigned PUTs.
+    requestChecksumCalculation: "WHEN_REQUIRED",
+    // Only override credentials when explicitly configured. Otherwise fall back
+    // to the SDK's default provider chain, which resolves the Lambda/Fargate
+    // execution role *including the AWS_SESSION_TOKEN that temporary credentials
+    // require*. Hand-reading only AWS_ACCESS_KEY_ID/SECRET dropped the session
+    // token, so presigned URLs 403'd on Lambda (works on Fargate, whose role
+    // credentials don't arrive via those env vars).
+    ...access_key_id && secret_access_key ? { credentials: { accessKeyId: access_key_id, secretAccessKey: secret_access_key } } : {}
+  });
+  return {
+    type: "s3",
+    async getPresignedUploadUrl(opts) {
+      const raw_ext = import_node_path2.default.extname(opts.filename);
+      const ext = raw_ext.startsWith(".") ? raw_ext.slice(1) : raw_ext;
+      const uuid = import_node_crypto2.default.randomUUID();
+      const segment = ext ? `${uuid}.${ext}` : uuid;
+      const parts = [prefix, opts.folder, segment].filter(Boolean);
+      const key = parts.join("/");
+      const expires_in = opts.expires_in ?? 3600;
+      const expires_at = Math.floor(Date.now() / 1e3) + expires_in;
+      const command = new import_client_s3.PutObjectCommand({
+        Bucket: bucket,
+        Key: key,
+        ContentType: opts.mime_type
+      });
+      const upload_url = await (0, import_s3_request_presigner.getSignedUrl)(client, command, { expiresIn: expires_in });
+      return { upload_url, key, expires_at };
+    },
+    getUrl(key) {
+      return `https://${bucket}.s3.${region}.amazonaws.com/${key}`;
+    },
+    async upload(key, data, mimeType) {
+      const command = new import_client_s3.PutObjectCommand({
+        Bucket: bucket,
+        Key: key,
+        Body: data,
+        ContentType: mimeType
+      });
+      await client.send(command);
+    },
+    async delete(key) {
+      const command = new import_client_s3.DeleteObjectCommand({ Bucket: bucket, Key: key });
+      await client.send(command);
+    },
+    async stat(key) {
+      try {
+        const head = await client.send(new import_client_s3.HeadObjectCommand({ Bucket: bucket, Key: key }));
+        return {
+          size: head.ContentLength ?? 0,
+          ...head.ContentType !== void 0 && { content_type: head.ContentType }
+        };
+      } catch {
+        return null;
+      }
+    },
+    getUploadOrigins() {
+      return [`https://${bucket}.s3.${region}.amazonaws.com`];
+    }
+  };
+}
+
+// src/storage/adapters/cloudinary.ts
+var import_node_crypto3 = __toESM(require("crypto"));
+function toCloudinaryResourceType(folder) {
+  if (folder === "video") return "video";
+  if (folder === "file") return "raw";
+  return "image";
+}
+function resourceTypeFromKey(key) {
+  for (const part of key.split("/")) {
+    if (part === "video") return "video";
+    if (part === "file") return "raw";
+  }
+  return "image";
+}
+function signParams(params, secret) {
+  const to_sign = Object.keys(params).sort().map((k) => `${k}=${params[k]}`).join("&");
+  return import_node_crypto3.default.createHash("sha1").update(to_sign + secret).digest("hex");
+}
+function createCloudinaryAdapter(options = {}) {
+  const cloud_name = options.cloud_name ?? process.env["CLOUDINARY_CLOUD_NAME"] ?? "";
+  const folder_prefix = options.folder;
+  const access_key_id = options.access_key_id ?? process.env["CLOUDINARY_API_KEY"] ?? "";
+  const secret_access_key = options.secret_access_key ?? process.env["CLOUDINARY_API_SECRET"] ?? "";
+  return {
+    type: "cloudinary",
+    async getPresignedUploadUrl(opts) {
+      const uuid = import_node_crypto3.default.randomUUID();
+      const public_id_parts = [folder_prefix, opts.folder, uuid].filter(Boolean);
+      const public_id = public_id_parts.join("/");
+      const key = public_id;
+      const expires_in = opts.expires_in ?? 3600;
+      const timestamp = Math.floor(Date.now() / 1e3);
+      const expires_at = timestamp + expires_in;
+      const params_to_sign = {
+        public_id,
+        timestamp
+      };
+      const signature = signParams(params_to_sign, secret_access_key);
+      const resource_type = toCloudinaryResourceType(opts.folder);
+      const upload_url = `https://api.cloudinary.com/v1_1/${cloud_name}/${resource_type}/upload`;
+      return {
+        upload_url,
+        key,
+        expires_at,
+        method: "POST",
+        fields: {
+          public_id,
+          timestamp: String(timestamp),
+          signature,
+          api_key: access_key_id
+        }
+      };
+    },
+    getUrl(key) {
+      const resource_type = resourceTypeFromKey(key);
+      return `https://res.cloudinary.com/${cloud_name}/${resource_type}/upload/${key}`;
+    },
+    async upload(key, data, mimeType) {
+      const timestamp = Math.floor(Date.now() / 1e3);
+      const params_to_sign = { public_id: key, timestamp };
+      const signature = signParams(params_to_sign, secret_access_key);
+      const resource_type = resourceTypeFromKey(key);
+      const form = new FormData();
+      form.append("file", new Blob([new Uint8Array(data)], { type: mimeType }), "upload");
+      form.append("public_id", key);
+      form.append("timestamp", String(timestamp));
+      form.append("api_key", access_key_id);
+      form.append("signature", signature);
+      const res = await fetch(
+        `https://api.cloudinary.com/v1_1/${cloud_name}/${resource_type}/upload`,
+        { method: "POST", body: form }
+      );
+      if (!res.ok) {
+        const text = await res.text();
+        throw new Error(`Cloudinary upload failed: ${res.status} ${res.statusText} \u2014 ${text}`);
+      }
+    },
+    async delete(key) {
+      const timestamp = Math.floor(Date.now() / 1e3);
+      const params_to_sign = {
+        public_id: key,
+        timestamp
+      };
+      const signature = signParams(params_to_sign, secret_access_key);
+      const resource_type = resourceTypeFromKey(key);
+      const endpoint = `https://api.cloudinary.com/v1_1/${cloud_name}/${resource_type}/destroy`;
+      const body = new URLSearchParams({
+        public_id: key,
+        signature,
+        timestamp: String(timestamp),
+        api_key: access_key_id
+      });
+      const res = await fetch(endpoint, {
+        method: "POST",
+        body,
+        headers: { "Content-Type": "application/x-www-form-urlencoded" }
+      });
+      const json = await res.json();
+      if (json.result === "ok" || json.result === "not found") return;
+      throw new Error(
+        `Cloudinary delete failed: ${json.error?.message ?? json.result ?? res.statusText}`
+      );
+    },
+    getUploadOrigins() {
+      return ["https://api.cloudinary.com"];
+    }
+  };
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  createCloudinaryAdapter,
+  createLocalAdapter,
+  createS3Adapter
+});
+//# sourceMappingURL=index.js.map