@endora-commerce/mod-assets-library 0.0.0-stage → 0.100.0

package/dist/backend/routes.admin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"routes.admin.js","sourceRoot":"","sources":["../../src/backend/routes.admin.ts"],"names":[],"mappings":"AAAA,iEAAiE;AACjE,uCAAuC;AACvC,EAAE;AACF,0CAA0C;AAC1C,+DAA+D;AAC/D,gFAAgF;AAChF,qEAAqE;AACrE,uEAAuE;AACvE,8EAA8E;AAC9E,EAAE;AACF,uEAAuE;AACvE,mCAAmC;AAInC,OAAO,EACL,WAAW,EACX,uBAAuB,EACvB,qBAAqB,EACrB,yBAAyB,EACzB,wBAAwB,EACxB,yBAAyB,EACzB,sBAAsB,EACtB,2BAA2B,GAC5B,MAAM,4BAA4B,CAAC;AAEpC,OAAO,EAAE,SAAS,EAAE,MAAM,gCAAgC,CAAC;AAC3D,OAAO,EAAE,KAAK,EAAE,MAAM,4BAA4B,CAAC;AAcnD,MAAM,CAAC,KAAK,UAAU,gCAAgC,CACpD,GAAoB,EACpB,IAAqB;IAErB,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,YAAY,EAAE,GAAG,IAAI,CAAC;IAErE,8EAA8E;IAC9E,GAAG,CAAC,IAAI,CACN,sBAAsB,EACtB,EAAE,UAAU,EAAE,YAAY,CAAC,cAAc,CAAC,EAAE,EAC5C,KAAK,EAAE,GAAmB,EAAE,KAAmB,EAAE,EAAE;QACjD,8CAA8C;QAC9C,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,EAAE,CAAC;YACvB,MAAM,IAAI,SAAS,CACjB,GAAG,EACH,WAAW,CAAC,oBAAoB,EAChC,yDAAyD,CAC1D,CAAC;QACJ,CAAC;QAED,kEAAkE;QAClE,IAAI,QAAQ,GAAkB,IAAI,CAAC;QACnC,IAAI,KAAK,GAAkB,IAAI,CAAC;QAChC,IAAI,UAAU,GAAyB,QAAQ,CAAC;QAChD,IAAI,KAAK,GAAsD,IAAI,CAAC;QAEpE,IAAI,KAAK,EAAE,MAAM,IAAI,IAAI,GAAG,CAAC,KAAK,EAAE,EAAE,CAAC;YACrC,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;gBACzB,IAAI,KAAK,EAAE,CAAC;oBACV,MAAM,IAAI,SAAS,CACjB,GAAG,EACH,WAAW,CAAC,oBAAoB,EAChC,uCAAuC,CACxC,CAAC;gBACJ,CAAC;gBACD,KAAK,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC;oBAC3B,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,SAAS;oBACpC,YAAY,EAAE,IAAI,CAAC,QAAQ,IAAI,0BAA0B;oBACzD,MAAM,EAAE,IAAI,CAAC,IAAI;oBACjB,yDAAyD;oBACzD,YAAY,EAAE,CAAC;oBACf,QAAQ;oBACR,KAAK;oBACL,UAAU;iBACX,CAAC,CAAC;YACL,CAAC;iBAAM,IAAI,IAAI,CAAC,SAAS,KAAK,UAAU,EAAE,CAAC;gBACzC,QAAQ,GAAI,IAAI,CAAC,KAAuB,IAAI,IAAI,CAAC;YACnD,CAAC;iBAAM,IAAI,IAAI,CAAC,SAAS,KAAK,OAAO,EAAE,CAAC;gBACtC,KAAK,GAAI,IAAI,CAAC,KAAuB,IAAI,IAAI,CAAC;YAChD,CAAC;iBAAM,IAAI,IAAI,CAAC,SAAS,KAAK,YAAY,EAAE,CAAC;gBAC3C,MAAM,CAAC,GAAG,IAAI,CAAC,KAAe,CAAC;gBAC/B,IAAI,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,SAAS,EAAE,CAAC;oBACtC,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,WAAW,CAAC,iBAAiB,EAAE,2CAA2C,CAAC,IAAI,CAAC,CAAC;gBAC5G,CAAC;gBACD,UAAU,GAAG,CAAC,CAAC;YACjB,CAAC;QACH,CAAC;QAED,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,SAAS,CACjB,GAAG,EACH,WAAW,CAAC,oBAAoB,EAChC,+CAA+C,CAChD,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAClB,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;IACzB,CAAC,CACF,CAAC;IAEF,6EAA6E;IAC7E,GAAG,CAAC,GAAG,CACL,sBAAsB,EACtB;QACE,UAAU,EAAE,YAAY,CAAC,aAAa,CAAC;KACxC,EACD,KAAK,EAAE,GAAmB,EAAE,EAAE;QAC5B,MAAM,MAAM,GAAG,qBAAqB,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACtD,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC;YACnC,QAAQ,EAAE,MAAM,CAAC,QAAQ,IAAI,IAAI;YACjC,GAAG,CAAC,MAAM,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAClD,GAAG,CAAC,MAAM,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3D,GAAG,CAAC,MAAM,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7E,cAAc,EAAE,MAAM,CAAC,cAAc;YACrC,GAAG,CAAC,MAAM,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACjE,KAAK,EAAE,MAAM,CAAC,KAAK;SACpB,CAAC,CAAC;QACH,OAAO,GAAG,CAAC;IACb,CAAC,CACF,CAAC;IAEF,6EAA6E;IAC7E,GAAG,CAAC,GAAG,CACL,0BAA0B,EAC1B,EAAE,UAAU,EAAE,YAAY,CAAC,aAAa,CAAC,EAAE,EAC3C,KAAK,EAAE,GAAG,EAAE,EAAE;QACZ,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACrD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAC1B,CAAC,CACF,CAAC;IAEF,6EAA6E;IAC7E,GAAG,CAAC,GAAG,CACL,8BAA8B,EAC9B,EAAE,UAAU,EAAE,YAAY,CAAC,aAAa,CAAC,EAAE,EAC3C,KAAK,EAAE,GAAG,EAAE,EAAE;QACZ,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACzD,OAAO;YACL,IAAI,EAAE;gBACJ,GAAG,EAAE,QAAQ,CAAC,GAAG;gBACjB,SAAS,EAAE,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI;aACxE;SACF,CAAC;IACJ,CAAC,CACF,CAAC;IAEF,4EAA4E;IAC5E,GAAG,CAAC,MAAM,CACR,0BAA0B,EAC1B,EAAE,UAAU,EAAE,YAAY,CAAC,cAAc,CAAC,EAAE,EAC5C,KAAK,EAAE,GAAG,EAAE,EAAE;QACZ,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACpD,OAAO;YACL,IAAI,EAAE;gBACJ,SAAS,EAAE,GAAG,CAAC,SAAS,CAAC,WAAW,EAAE;gBACtC,YAAY,EAAE,GAAG,CAAC,YAAY,CAAC,WAAW,EAAE;aAC7C;SACF,CAAC;IACJ,CAAC,CACF,CAAC;IAEF,4EAA4E;IAC5E,GAAG,CAAC,IAAI,CACN,kCAAkC,EAClC,EAAE,UAAU,EAAE,YAAY,CAAC,cAAc,CAAC,EAAE,EAC5C,KAAK,EAAE,GAAG,EAAE,EAAE;QACZ,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACpD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAC1B,CAAC,CACF,CAAC;IAEF,6EAA6E;IAC7E,GAAG,CAAC,IAAI,CACN,+BAA+B,EAC/B,EAAE,UAAU,EAAE,YAAY,CAAC,cAAc,CAAC,EAAE,EAC5C,KAAK,EAAE,GAAG,EAAE,EAAE;QACZ,MAAM,IAAI,GAAG,sBAAsB,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACpD,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,CAAC;QACxE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAC1B,CAAC,CACF,CAAC;IAEF,6EAA6E;IAC7E,GAAG,CAAC,IAAI,CACN,gCAAgC,EAChC,EAAE,UAAU,EAAE,YAAY,CAAC,cAAc,CAAC,EAAE,EAC5C,KAAK,EAAE,GAAmB,EAAE,EAAE;QAC5B,MAAM,IAAI,GAAG,2BAA2B,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACzD,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,CAAC;QACzE,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;IACvB,CAAC,CACF,CAAC;IAEF,6EAA6E;IAC7E,GAAG,CAAC,IAAI,CACN,yCAAyC,EACzC,EAAE,UAAU,EAAE,YAAY,CAAC,cAAc,CAAC,EAAE,EAC5C,KAAK,IAAI,EAAE;QACT,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,SAAS,EAAE,CAAC;QAC3C,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,SAAS,EAAE,CAAC;QACzC,OAAO;YACL,IAAI,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,IAAI,EAAE,GAAG,MAAM,EAAE;SAC3C,CAAC;IACJ,CAAC,CACF,CAAC;IAEF,GAAG,CAAC,GAAG,CACL,oCAAoC,EACpC,EAAE,UAAU,EAAE,YAAY,CAAC,aAAa,CAAC,EAAE,EAC3C,KAAK,IAAI,EAAE;QACT,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,SAAS,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YACvD,OAAO;gBACL,IAAI,EAAE,OAAgB;gBACtB,gEAAgE;gBAChE,KAAK,CAAC,SAAS;oBACb,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;gBACjF,CAAC;aACF,CAAC;QACJ,CAAC,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,SAAS,EAAE,CAAC;QACzC,MAAM,EAAE,GAAG,SAAS,EAAE,CAAC;QACvB,MAAM,mBAAmB,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC;QAC5E,MAAM,gBAAgB,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,SAAS,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;QAC7E,OAAO;YACL,IAAI,EAAE;gBACJ,aAAa,EAAE,OAAO,CAAC,IAAI;gBAC3B,SAAS,EAAE,MAAM;gBACjB,mBAAmB;gBACnB,gBAAgB;aACjB;SACF,CAAC;IACJ,CAAC,CACF,CAAC;IAEF,6EAA6E;IAC7E,GAAG,CAAC,GAAG,CACL,8BAA8B,EAC9B,EAAE,UAAU,EAAE,YAAY,CAAC,aAAa,CAAC,EAAE,EAC3C,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CACvD,CAAC;IAEF,GAAG,CAAC,IAAI,CACN,8BAA8B,EAC9B,EAAE,UAAU,EAAE,YAAY,CAAC,cAAc,CAAC,EAAE,EAC5C,KAAK,EAAE,GAAmB,EAAE,KAAmB,EAAE,EAAE;QACjD,MAAM,IAAI,GAAG,yBAAyB,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACvD,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;QAC3C,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAClB,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;IACrB,CAAC,CACF,CAAC;IAEF,GAAG,CAAC,KAAK,CACP,wCAAwC,EACxC,EAAE,UAAU,EAAE,YAAY,CAAC,cAAc,CAAC,EAAE,EAC5C,KAAK,EAAE,GAAG,EAAE,EAAE;QACZ,MAAM,IAAI,GAAG,wBAAwB,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACtD,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,EAAE;YACvD,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACvD,GAAG,CAAC,IAAI,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACnE,GAAG,CAAC,IAAI,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACpE,CAAC,CAAC;QACH,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;IACrB,CAAC,CACF,CAAC;IAEF,GAAG,CAAC,MAAM,CACR,wCAAwC,EACxC,EAAE,UAAU,EAAE,YAAY,CAAC,cAAc,CAAC,EAAE,EAC5C,KAAK,EAAE,GAAG,EAAE,EAAE;QACZ,MAAM,IAAI,GAAG,yBAAyB,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QAC7D,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;QAC7E,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;IACvB,CAAC,CACF,CAAC;IAEF,6EAA6E;IAC7E,GAAG,CAAC,KAAK,CACP,0BAA0B,EAC1B,EAAE,UAAU,EAAE,YAAY,CAAC,cAAc,CAAC,EAAE,EAC5C,KAAK,EAAE,GAAG,EAAE,EAAE;QACZ,MAAM,KAAK,GAAG,uBAAuB,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACtD,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE;YACrD,GAAG,CAAC,KAAK,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrE,GAAG,CAAC,KAAK,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5D,GAAG,CAAC,KAAK,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrE,GAAG,CAAC,KAAK,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3E,GAAG,CAAC,KAAK,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACtE,CAAC,CAAC;QACH,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAC1B,CAAC,CACF,CAAC;AACJ,CAAC"}

package/dist/backend/routes.public.d.ts

@@ -0,0 +1,14 @@
+import type { FastifyInstance } from 'fastify';
+import type { EntityManager } from '@mikro-orm/postgresql';
+import type { AdapterRegistry } from './services/storage/adapter-registry.js';
+import type { AssetsLibraryService } from './services/assets-library.service.js';
+import type { HmacSigner } from './services/hmac.js';
+export interface PublicRoutesDeps {
+    service: AssetsLibraryService;
+    adapters: AdapterRegistry;
+    emFactory: () => EntityManager;
+    /** Provider so tests that never serve files don't pay env-var cost. */
+    signer: () => HmacSigner;
+}
+export declare function registerAssetsLibraryPublicRoutes(app: FastifyInstance, deps: PublicRoutesDeps): Promise<void>;
+//# sourceMappingURL=routes.public.d.ts.map

package/dist/backend/routes.public.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"routes.public.d.ts","sourceRoot":"","sources":["../../src/backend/routes.public.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,eAAe,EAAgB,MAAM,SAAS,CAAC;AAC7D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAM3D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wCAAwC,CAAC;AAC9E,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,sCAAsC,CAAC;AACjF,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAErD,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,oBAAoB,CAAC;IAC9B,QAAQ,EAAE,eAAe,CAAC;IAC1B,SAAS,EAAE,MAAM,aAAa,CAAC;IAC/B,uEAAuE;IACvE,MAAM,EAAE,MAAM,UAAU,CAAC;CAC1B;AAED,wBAAsB,iCAAiC,CACrD,GAAG,EAAE,eAAe,EACpB,IAAI,EAAE,gBAAgB,GACrB,OAAO,CAAC,IAAI,CAAC,CAqGf"}

package/dist/backend/routes.public.js

@@ -0,0 +1,99 @@
+// Public file-serving route for the Assets Library — feature 013 / US1.
+// Used by the storefront for assets stored on the local-FS adapter.
+// Cloud adapters (S3 / GCS) bypass this route entirely — their public URLs
+// point at the bucket directly and their private URLs are signed by the
+// vendor SDK; the storefront fetches them without touching this code path.
+//
+// Behaviour:
+//   public assets  → no auth, long Cache-Control
+//   private assets → require valid HMAC token (?token=&exp=)
+//   soft-deleted   → 410 ASSET_GONE (so still-live storefront caches degrade gracefully)
+//   missing file   → 404 ASSET_FILE_MISSING
+import { ERROR_CODES } from '@endora-commerce/contracts';
+import { HttpError } from '@endora-commerce/platform/http';
+import { Asset } from './entities/asset.entity.js';
+import { LocalFsStorageAdapter } from './services/storage/local-fs-adapter.js';
+export async function registerAssetsLibraryPublicRoutes(app, deps) {
+    app.get('/assets/file/:assetId', { config: { streamingResponse: true } }, async (req, reply) => {
+        const em = deps.emFactory();
+        const a = await em.findOne(Asset, { id: req.params.assetId });
+        if (!a) {
+            throw new HttpError(404, ERROR_CODES.ASSET_NOT_FOUND, 'Asset not found.');
+        }
+        if (a.deletedAt) {
+            throw new HttpError(410, ERROR_CODES.ASSET_GONE, 'Asset has been deleted.');
+        }
+        // This route only serves bytes from the local-FS adapter. Cloud
+        // assets are always reached via the bucket URL or signed URL — they
+        // never hit this endpoint.
+        if (a.storageBackend !== 'local') {
+            // Redirect to the resolved URL so a misconfigured client falls back
+            // to the canonical serving path.
+            const resolved = await deps.service.resolveUrl(a.id);
+            reply.redirect(resolved.url, 302);
+            return;
+        }
+        // Visibility / token check.
+        if (a.visibility === 'private') {
+            const signer = deps.signer();
+            const exp = Number(req.query.exp);
+            const token = String(req.query.token ?? '');
+            const ok = signer.verify({
+                assetId: a.id,
+                token,
+                exp,
+                nowSec: Math.floor(Date.now() / 1000),
+            });
+            if (!ok) {
+                throw new HttpError(403, ERROR_CODES.ASSET_ACCESS_DENIED, 'Access denied.');
+            }
+        }
+        const adapter = await deps.adapters.getForBackend('local');
+        if (!(adapter instanceof LocalFsStorageAdapter)) {
+            throw new HttpError(500, ERROR_CODES.INTERNAL, 'Local-FS adapter is not currently active.');
+        }
+        // ETag / 304 short-circuit.
+        const etag = `"${a.id}-${Math.floor(a.updatedAt.getTime() / 1000)}"`;
+        const ifNoneMatch = req.headers['if-none-match'];
+        if (typeof ifNoneMatch === 'string' && ifNoneMatch === etag) {
+            return reply.status(304).send();
+        }
+        // Stream open. open() throws on missing file → 404 ASSET_FILE_MISSING.
+        let stream;
+        try {
+            stream = await adapter.open({ locator: a.storageLocator || a.storageUrl });
+        }
+        catch {
+            throw new HttpError(404, ERROR_CODES.ASSET_FILE_MISSING, 'Underlying file is missing.');
+        }
+        // Standard headers.
+        reply.header('Content-Type', a.mimeType);
+        // sizeBytes is mapped as bigint at the DB layer; coerce to string for
+        // the Content-Length header (Node's HTTP layer rejects bigint values).
+        // Only set it when the recorded size is meaningful — a stale/legacy `0`
+        // (uploads that never captured a byte count) would otherwise tell the
+        // browser the body is empty and produce a broken/blank image. Omitting
+        // the header lets Fastify stream the file to EOF.
+        if (Number(a.sizeBytes) > 0) {
+            reply.header('Content-Length', String(a.sizeBytes));
+        }
+        reply.header('ETag', etag);
+        reply.header('Cache-Control', a.visibility === 'public'
+            ? 'public, max-age=31536000, immutable'
+            : 'private, no-store, max-age=0');
+        // Public assets are embedded by the storefront and admin, which run on a
+        // different origin than the backend. Helmet's default
+        // `Cross-Origin-Resource-Policy: same-origin` would block those
+        // cross-origin <img> loads, so relax it to `cross-origin` for public
+        // assets (private assets keep the stricter default).
+        if (a.visibility === 'public') {
+            reply.header('Cross-Origin-Resource-Policy', 'cross-origin');
+        }
+        const dispoMode = req.query.download === '1' ? 'attachment' : 'inline';
+        const safeName = a.filename.replace(/[\r\n";]/g, '_');
+        reply.header('Content-Disposition', `${dispoMode}; filename="${safeName}"`);
+        // Fastify will pipe a Readable through to the response.
+        return reply.send(stream);
+    });
+}
+//# sourceMappingURL=routes.public.js.map

package/dist/backend/routes.public.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"routes.public.js","sourceRoot":"","sources":["../../src/backend/routes.public.ts"],"names":[],"mappings":"AAAA,wEAAwE;AACxE,oEAAoE;AACpE,2EAA2E;AAC3E,wEAAwE;AACxE,2EAA2E;AAC3E,EAAE;AACF,aAAa;AACb,iDAAiD;AACjD,6DAA6D;AAC7D,yFAAyF;AACzF,4CAA4C;AAI5C,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AAEzD,OAAO,EAAE,SAAS,EAAE,MAAM,gCAAgC,CAAC;AAC3D,OAAO,EAAE,KAAK,EAAE,MAAM,4BAA4B,CAAC;AACnD,OAAO,EAAE,qBAAqB,EAAE,MAAM,wCAAwC,CAAC;AAa/E,MAAM,CAAC,KAAK,UAAU,iCAAiC,CACrD,GAAoB,EACpB,IAAsB;IAEtB,GAAG,CAAC,GAAG,CAIL,uBAAuB,EACvB,EAAE,MAAM,EAAE,EAAE,iBAAiB,EAAE,IAAI,EAAE,EAAE,EACvC,KAAK,EAAE,GAAG,EAAE,KAAmB,EAAE,EAAE;QACjC,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;QAC5B,MAAM,CAAC,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;QAC9D,IAAI,CAAC,CAAC,EAAE,CAAC;YACP,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,WAAW,CAAC,eAAe,EAAE,kBAAkB,CAAC,CAAC;QAC5E,CAAC;QACD,IAAI,CAAC,CAAC,SAAS,EAAE,CAAC;YAChB,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,WAAW,CAAC,UAAU,EAAE,yBAAyB,CAAC,CAAC;QAC9E,CAAC;QAED,gEAAgE;QAChE,oEAAoE;QACpE,2BAA2B;QAC3B,IAAI,CAAC,CAAC,cAAc,KAAK,OAAO,EAAE,CAAC;YACjC,oEAAoE;YACpE,iCAAiC;YACjC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YACrD,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YAClC,OAAO;QACT,CAAC;QAED,4BAA4B;QAC5B,IAAI,CAAC,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;YAC/B,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;YAC7B,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAClC,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;YAC5C,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC;gBACvB,OAAO,EAAE,CAAC,CAAC,EAAE;gBACb,KAAK;gBACL,GAAG;gBACH,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;aACtC,CAAC,CAAC;YACH,IAAI,CAAC,EAAE,EAAE,CAAC;gBACR,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,WAAW,CAAC,mBAAmB,EAAE,gBAAgB,CAAC,CAAC;YAC9E,CAAC;QACH,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;QAC3D,IAAI,CAAC,CAAC,OAAO,YAAY,qBAAqB,CAAC,EAAE,CAAC;YAChD,MAAM,IAAI,SAAS,CACjB,GAAG,EACH,WAAW,CAAC,QAAQ,EACpB,2CAA2C,CAC5C,CAAC;QACJ,CAAC;QAED,4BAA4B;QAC5B,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC;QACrE,MAAM,WAAW,GAAG,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;QACjD,IAAI,OAAO,WAAW,KAAK,QAAQ,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;YAC5D,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;QAClC,CAAC;QAED,uEAAuE;QACvE,IAAI,MAAM,CAAC;QACX,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,cAAc,IAAI,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC;QAC7E,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,WAAW,CAAC,kBAAkB,EAAE,6BAA6B,CAAC,CAAC;QAC1F,CAAC;QAED,oBAAoB;QACpB,KAAK,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC;QACzC,sEAAsE;QACtE,uEAAuE;QACvE,wEAAwE;QACxE,sEAAsE;QACtE,uEAAuE;QACvE,kDAAkD;QAClD,IAAI,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC;YAC5B,KAAK,CAAC,MAAM,CAAC,gBAAgB,EAAE,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;QACtD,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAC3B,KAAK,CAAC,MAAM,CACV,eAAe,EACf,CAAC,CAAC,UAAU,KAAK,QAAQ;YACvB,CAAC,CAAC,qCAAqC;YACvC,CAAC,CAAC,8BAA8B,CACnC,CAAC;QACF,yEAAyE;QACzE,sDAAsD;QACtD,gEAAgE;QAChE,qEAAqE;QACrE,qDAAqD;QACrD,IAAI,CAAC,CAAC,UAAU,KAAK,QAAQ,EAAE,CAAC;YAC9B,KAAK,CAAC,MAAM,CAAC,8BAA8B,EAAE,cAAc,CAAC,CAAC;QAC/D,CAAC;QACD,MAAM,SAAS,GAAG,GAAG,CAAC,KAAK,CAAC,QAAQ,KAAK,GAAG,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC;QACvE,MAAM,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;QACtD,KAAK,CAAC,MAAM,CAAC,qBAAqB,EAAE,GAAG,SAAS,eAAe,QAAQ,GAAG,CAAC,CAAC;QAC5E,wDAAwD;QACxD,OAAO,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC5B,CAAC,CACF,CAAC;AACJ,CAAC"}

package/dist/backend/services/asset-read-port.d.ts

@@ -0,0 +1,103 @@
+import type { EntityManager } from '@mikro-orm/postgresql';
+import type { AssetBytes, AssetByteStream, AssetReadPort, AssetRecord, ObjectStorageBackendCode, StorageBackendCode } from '@endora-commerce/contracts';
+import { Asset } from '../entities/asset.entity.js';
+import type { StorageResolveUrlInput, StorageResolveUrlOutput } from './storage/storage-adapter.js';
+/**
+ * The narrow slice of the adapter registry {@link AssetReadService} needs — the
+ * URL builder of whichever backend owns an object's bytes, and, for a backend
+ * that is a real object store, the reader that opens them.
+ *
+ * Declared here rather than taking `AdapterRegistry` so that the read model can
+ * be unit-tested over a stub, and so that the two capabilities it has over the
+ * `assets` table are visible in its constructor.
+ *
+ * **Two overloads, narrowest first**, because `AdapterRegistry` has exactly
+ * this shape and for the reason it has it: `legacy` is not a store — it
+ * resolves the URL of a pre-013 row this platform did not issue and can open
+ * nothing — so `open` exists only on the arm a `legacy` code cannot reach
+ * (`ObjectStoragePort`'s doc block, point 3). Widest-first would hand every
+ * call the arm without `open` and put the probe back at the call site, which is
+ * the thing the port removes.
+ */
+export interface AssetStorageRegistry {
+    getForBackend(backend: ObjectStorageBackendCode): Promise<{
+        resolveUrl(input: StorageResolveUrlInput): StorageResolveUrlOutput | Promise<StorageResolveUrlOutput>;
+        open(input: {
+            locator: string;
+        }): Promise<AssetByteStream>;
+    }>;
+    getForBackend(backend: StorageBackendCode): Promise<{
+        resolveUrl(input: StorageResolveUrlInput): StorageResolveUrlOutput | Promise<StorageResolveUrlOutput>;
+    }>;
+}
+/**
+ * The row-level read model `assets_library` publishes (feature 075, Phase P).
+ *
+ * Five inbound sites read the `Asset` entity, and all five ask the same thing
+ * before attaching an id an admin supplied: does this asset exist, and is it
+ * the right kind? `catalog`'s gallery, attachments and product links do it
+ * three times over, `orders` once for invoice branding.
+ *
+ * `sizeBytes` stays a string: the column is `bigint`, and a `number` cannot
+ * hold one past 2^53.
+ */
+export declare class AssetReadService implements AssetReadPort {
+    private readonly emFactory;
+    /**
+     * Required, and a provider rather than the registry itself: the registry is
+     * built from settings and rebuilt when they change, so a captured one goes
+     * stale after an operator switches the active backend. Not optional — an
+     * argument whose omission is silent is how this module once shipped a
+     * permission gate that defaulted to permissive.
+     */
+    private readonly adapters;
+    constructor(emFactory: () => EntityManager, 
+    /**
+     * Required, and a provider rather than the registry itself: the registry is
+     * built from settings and rebuilt when they change, so a captured one goes
+     * stale after an operator switches the active backend. Not optional — an
+     * argument whose omission is silent is how this module once shipped a
+     * permission gate that defaulted to permissive.
+     */
+    adapters: () => AssetStorageRegistry);
+    findById(id: string, options?: {
+        liveOnly?: boolean;
+    }): Promise<AssetRecord | null>;
+    findByIds(ids: readonly string[], options?: {
+        liveOnly?: boolean;
+    }): Promise<AssetRecord[]>;
+    /**
+     * FR-043's rule, answered where the information is.
+     *
+     * Only a live, `public` asset can have a stable URL, and only this module can
+     * say so: a consumer holding an asset id cannot tell a signed link from a
+     * permanent one. So the filter is here and the absence is the answer — see
+     * the port's contract.
+     *
+     * One query for the rows and a URL build per row. The adapters are cached by
+     * the registry and a *public* resolution is a string join in all four of
+     * them, so this issues no I/O beyond the read.
+     */
+    resolvePublicUrls(assetIds: readonly string[]): Promise<Map<string, string>>;
+    /**
+     * The bytes of one live asset — the port's rule, answered where the storage
+     * layout is (`specs/110-instance-repository/` T118c).
+     *
+     * Three facts left a composition root to arrive here, and each of them is one
+     * line below. `legacy` is not a store, so a row on it has no bytes to open
+     * and answers `null` rather than being probed for an `open` method at the
+     * call site. The locator falls back to `storageUrl` for rows written before
+     * the column existed. And an adapter answers a stream, which the caller
+     * wanted whole.
+     *
+     * **The `catch` is the degrade, and it belongs here** (composition checklist
+     * item 7): a configured backend that will not stream is a document rendered
+     * without its decoration, and the caller — holding an asset id and nothing
+     * else — cannot tell that state from an asset that is not there. It is
+     * narrow on purpose: it covers the open and the drain, never the row read,
+     * which is this module's own `EntityManager` and whose failure is a real one.
+     */
+    openAssetBytes(assetId: string): Promise<AssetBytes | null>;
+}
+export declare function toAssetRecord(asset: Asset): AssetRecord;
+//# sourceMappingURL=asset-read-port.d.ts.map

package/dist/backend/services/asset-read-port.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"asset-read-port.d.ts","sourceRoot":"","sources":["../../../src/backend/services/asset-read-port.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,KAAK,EACV,UAAU,EACV,eAAe,EACf,aAAa,EACb,WAAW,EACX,wBAAwB,EACxB,kBAAkB,EACnB,MAAM,4BAA4B,CAAC;AAEpC,OAAO,EAAE,KAAK,EAAE,MAAM,6BAA6B,CAAC;AACpD,OAAO,KAAK,EAAE,sBAAsB,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AAEpG;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,WAAW,oBAAoB;IACnC,aAAa,CAAC,OAAO,EAAE,wBAAwB,GAAG,OAAO,CAAC;QACxD,UAAU,CAAC,KAAK,EAAE,sBAAsB,GAAG,uBAAuB,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAAC;QACtG,IAAI,CAAC,KAAK,EAAE;YAAE,OAAO,EAAE,MAAM,CAAA;SAAE,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;KAC5D,CAAC,CAAC;IACH,aAAa,CACX,OAAO,EAAE,kBAAkB,GAC1B,OAAO,CAAC;QAAE,UAAU,CAAC,KAAK,EAAE,sBAAsB,GAAG,uBAAuB,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAAA;KAAE,CAAC,CAAC;CACvH;AAED;;;;;;;;;;GAUG;AACH,qBAAa,gBAAiB,YAAW,aAAa;IAElD,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B;;;;;;OAMG;IACH,OAAO,CAAC,QAAQ,CAAC,QAAQ;gBARR,SAAS,EAAE,MAAM,aAAa;IAC/C;;;;;;OAMG;IACc,QAAQ,EAAE,MAAM,oBAAoB;IAGjD,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,QAAQ,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;IAQnF,SAAS,CACb,GAAG,EAAE,SAAS,MAAM,EAAE,EACtB,OAAO,CAAC,EAAE;QAAE,QAAQ,CAAC,EAAE,OAAO,CAAA;KAAE,GAC/B,OAAO,CAAC,WAAW,EAAE,CAAC;IASzB;;;;;;;;;;;OAWG;IACG,iBAAiB,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IA+BlF;;;;;;;;;;;;;;;;;OAiBG;IACG,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC;CAqClE;AAED,wBAAgB,aAAa,CAAC,KAAK,EAAE,KAAK,GAAG,WAAW,CAqBvD"}

package/dist/backend/services/asset-read-port.js

@@ -0,0 +1,167 @@
+import { rethrowIfModuleDisabled } from '@endora-commerce/platform/kernel';
+import { Asset } from '../entities/asset.entity.js';
+/**
+ * The row-level read model `assets_library` publishes (feature 075, Phase P).
+ *
+ * Five inbound sites read the `Asset` entity, and all five ask the same thing
+ * before attaching an id an admin supplied: does this asset exist, and is it
+ * the right kind? `catalog`'s gallery, attachments and product links do it
+ * three times over, `orders` once for invoice branding.
+ *
+ * `sizeBytes` stays a string: the column is `bigint`, and a `number` cannot
+ * hold one past 2^53.
+ */
+export class AssetReadService {
+    emFactory;
+    adapters;
+    constructor(emFactory, 
+    /**
+     * Required, and a provider rather than the registry itself: the registry is
+     * built from settings and rebuilt when they change, so a captured one goes
+     * stale after an operator switches the active backend. Not optional — an
+     * argument whose omission is silent is how this module once shipped a
+     * permission gate that defaulted to permissive.
+     */
+    adapters) {
+        this.emFactory = emFactory;
+        this.adapters = adapters;
+    }
+    async findById(id, options) {
+        const asset = await this.emFactory().findOne(Asset, {
+            id,
+            ...(options?.liveOnly ? { deletedAt: null } : {}),
+        });
+        return asset ? toAssetRecord(asset) : null;
+    }
+    async findByIds(ids, options) {
+        if (ids.length === 0)
+            return [];
+        const assets = await this.emFactory().find(Asset, {
+            id: { $in: [...ids] },
+            ...(options?.liveOnly ? { deletedAt: null } : {}),
+        });
+        return assets.map(toAssetRecord);
+    }
+    /**
+     * FR-043's rule, answered where the information is.
+     *
+     * Only a live, `public` asset can have a stable URL, and only this module can
+     * say so: a consumer holding an asset id cannot tell a signed link from a
+     * permanent one. So the filter is here and the absence is the answer — see
+     * the port's contract.
+     *
+     * One query for the rows and a URL build per row. The adapters are cached by
+     * the registry and a *public* resolution is a string join in all four of
+     * them, so this issues no I/O beyond the read.
+     */
+    async resolvePublicUrls(assetIds) {
+        const out = new Map();
+        if (assetIds.length === 0)
+            return out;
+        const registry = this.adapters();
+        const assets = await this.emFactory().find(Asset, {
+            id: { $in: [...assetIds] },
+            deletedAt: null,
+            visibility: 'public',
+        });
+        for (const asset of assets) {
+            const adapter = await registry.getForBackend(asset.storageBackend);
+            const resolved = await adapter.resolveUrl({
+                locator: asset.storageLocator || asset.storageUrl,
+                visibility: asset.visibility,
+            });
+            // The rule the port states, kept where the answer is rather than inferred
+            // from the filter above. **Measured**: with that filter in place this
+            // branch is unreachable — all four resolvers answer a `public` visibility
+            // with `expiresAt: null` as their first statement — and with it removed
+            // this branch is what still refuses a private asset. Two spellings of one
+            // rule is deliberate here and only here: a fifth backend, or a fifth
+            // visibility, changes which of the two is doing the work, and a feed that
+            // published an expiring link would not fail anywhere near this line.
+            if (resolved.expiresAt !== null)
+                continue;
+            out.set(asset.id, resolved.url);
+        }
+        return out;
+    }
+    /**
+     * The bytes of one live asset — the port's rule, answered where the storage
+     * layout is (`specs/110-instance-repository/` T118c).
+     *
+     * Three facts left a composition root to arrive here, and each of them is one
+     * line below. `legacy` is not a store, so a row on it has no bytes to open
+     * and answers `null` rather than being probed for an `open` method at the
+     * call site. The locator falls back to `storageUrl` for rows written before
+     * the column existed. And an adapter answers a stream, which the caller
+     * wanted whole.
+     *
+     * **The `catch` is the degrade, and it belongs here** (composition checklist
+     * item 7): a configured backend that will not stream is a document rendered
+     * without its decoration, and the caller — holding an asset id and nothing
+     * else — cannot tell that state from an asset that is not there. It is
+     * narrow on purpose: it covers the open and the drain, never the row read,
+     * which is this module's own `EntityManager` and whose failure is a real one.
+     */
+    async openAssetBytes(assetId) {
+        const asset = await this.emFactory().findOne(Asset, { id: assetId, deletedAt: null });
+        if (!asset)
+            return null;
+        // Narrowed here rather than probed at the caller: the overload's `open` arm
+        // is unreachable for `legacy` by construction.
+        if (asset.storageBackend === 'legacy')
+            return null;
+        try {
+            const store = await this.adapters().getForBackend(asset.storageBackend);
+            const stream = await store.open({ locator: asset.storageLocator || asset.storageUrl });
+            const chunks = [];
+            let length = 0;
+            for await (const chunk of stream) {
+                const bytes = typeof chunk === 'string' ? new TextEncoder().encode(chunk) : chunk;
+                chunks.push(bytes);
+                length += bytes.byteLength;
+            }
+            const bytes = new Uint8Array(length);
+            let offset = 0;
+            for (const chunk of chunks) {
+                bytes.set(chunk, offset);
+                offset += chunk.byteLength;
+            }
+            return { bytes, mimeType: asset.mimeType };
+        }
+        catch (error) {
+            // Narrow tolerance, and `rethrowIfModuleDisabled` is its first line by
+            // decision rather than by habit. The registry this reaches is this
+            // module's own and crosses no gate today, so the re-throw is unreachable;
+            // what it buys is that it stays unreachable *by construction* — a future
+            // adapter that resolved a port would otherwise have its "this capability
+            // is off" answer absorbed into "this asset has no bytes", which is the
+            // fail-open composition checklist item 7 refuses. A status-code test
+            // would not do: `ModuleDisabledError` is an `HttpError`.
+            rethrowIfModuleDisabled(error);
+            return null;
+        }
+    }
+}
+export function toAssetRecord(asset) {
+    return {
+        id: asset.id,
+        kind: asset.kind,
+        filename: asset.filename,
+        mimeType: asset.mimeType,
+        sizeBytes: asset.sizeBytes,
+        storageUrl: asset.storageUrl,
+        altText: asset.altText ?? null,
+        folderId: asset.folderId ?? null,
+        visibility: asset.visibility,
+        label: asset.label ?? null,
+        storageBackend: asset.storageBackend,
+        storageLocator: asset.storageLocator,
+        pendingCleanup: asset.pendingCleanup,
+        purgeAfterAt: asset.purgeAfterAt ?? null,
+        mimeTypeOverridden: asset.mimeTypeOverridden,
+        createdAt: asset.createdAt,
+        updatedAt: asset.updatedAt,
+        deletedAt: asset.deletedAt ?? null,
+    };
+}
+//# sourceMappingURL=asset-read-port.js.map

package/dist/backend/services/asset-read-port.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"asset-read-port.js","sourceRoot":"","sources":["../../../src/backend/services/asset-read-port.ts"],"names":[],"mappings":"AASA,OAAO,EAAE,uBAAuB,EAAE,MAAM,kCAAkC,CAAC;AAC3E,OAAO,EAAE,KAAK,EAAE,MAAM,6BAA6B,CAAC;AA8BpD;;;;;;;;;;GAUG;AACH,MAAM,OAAO,gBAAgB;IAER;IAQA;IATnB,YACmB,SAA8B;IAC/C;;;;;;OAMG;IACc,QAAoC;QARpC,cAAS,GAAT,SAAS,CAAqB;QAQ9B,aAAQ,GAAR,QAAQ,CAA4B;IACpD,CAAC;IAEJ,KAAK,CAAC,QAAQ,CAAC,EAAU,EAAE,OAAgC;QACzD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE;YAClD,EAAE;YACF,GAAG,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAClD,CAAC,CAAC;QACH,OAAO,KAAK,CAAC,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC7C,CAAC;IAED,KAAK,CAAC,SAAS,CACb,GAAsB,EACtB,OAAgC;QAEhC,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,CAAC;QAChC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE;YAChD,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,GAAG,GAAG,CAAC,EAAE;YACrB,GAAG,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAClD,CAAC,CAAC;QACH,OAAO,MAAM,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;IACnC,CAAC;IAED;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,iBAAiB,CAAC,QAA2B;QACjD,MAAM,GAAG,GAAG,IAAI,GAAG,EAAkB,CAAC;QACtC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,GAAG,CAAC;QACtC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;QAEjC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE;YAChD,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,GAAG,QAAQ,CAAC,EAAE;YAC1B,SAAS,EAAE,IAAI;YACf,UAAU,EAAE,QAAQ;SACrB,CAAC,CAAC;QAEH,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,aAAa,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;YACnE,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC;gBACxC,OAAO,EAAE,KAAK,CAAC,cAAc,IAAI,KAAK,CAAC,UAAU;gBACjD,UAAU,EAAE,KAAK,CAAC,UAAU;aAC7B,CAAC,CAAC;YACH,0EAA0E;YAC1E,sEAAsE;YACtE,0EAA0E;YAC1E,wEAAwE;YACxE,0EAA0E;YAC1E,qEAAqE;YACrE,0EAA0E;YAC1E,qEAAqE;YACrE,IAAI,QAAQ,CAAC,SAAS,KAAK,IAAI;gBAAE,SAAS;YAC1C,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC;QAClC,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAED;;;;;;;;;;;;;;;;;OAiBG;IACH,KAAK,CAAC,cAAc,CAAC,OAAe;QAClC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACtF,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QACxB,4EAA4E;QAC5E,+CAA+C;QAC/C,IAAI,KAAK,CAAC,cAAc,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QAEnD,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC,aAAa,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;YACxE,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,cAAc,IAAI,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC;YACvF,MAAM,MAAM,GAAiB,EAAE,CAAC;YAChC,IAAI,MAAM,GAAG,CAAC,CAAC;YACf,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;gBACjC,MAAM,KAAK,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;gBAClF,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBACnB,MAAM,IAAI,KAAK,CAAC,UAAU,CAAC;YAC7B,CAAC;YACD,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC;YACrC,IAAI,MAAM,GAAG,CAAC,CAAC;YACf,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;gBAC3B,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;gBACzB,MAAM,IAAI,KAAK,CAAC,UAAU,CAAC;YAC7B,CAAC;YACD,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC;QAC7C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,uEAAuE;YACvE,mEAAmE;YACnE,0EAA0E;YAC1E,yEAAyE;YACzE,yEAAyE;YACzE,uEAAuE;YACvE,qEAAqE;YACrE,yDAAyD;YACzD,uBAAuB,CAAC,KAAK,CAAC,CAAC;YAC/B,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;CACF;AAED,MAAM,UAAU,aAAa,CAAC,KAAY;IACxC,OAAO;QACL,EAAE,EAAE,KAAK,CAAC,EAAE;QACZ,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,IAAI;QAC9B,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,IAAI;QAChC,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,IAAI;QAC1B,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,YAAY,EAAE,KAAK,CAAC,YAAY,IAAI,IAAI;QACxC,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,IAAI;KACnC,CAAC;AACJ,CAAC"}

package/dist/backend/services/assets-library.service.d.ts

@@ -0,0 +1,76 @@
+import type { EntityManager } from '@mikro-orm/postgresql';
+import { type AssetSummary, type AssetDetail } from '@endora-commerce/contracts';
+import type { AdapterRegistry } from './storage/adapter-registry.js';
+import type { AssetReferenceRegistry } from './reference-registry.js';
+import { type UploadInput, type UploadPolicy } from './upload-pipeline.js';
+import type { AuditPort } from '@endora-commerce/platform/kernel';
+export declare class NotImplementedYet extends Error {
+    readonly name = "NotImplementedYet";
+    constructor(method: string);
+}
+export interface AssetsLibraryServiceDeps {
+    emFactory: () => EntityManager;
+    adapters: AdapterRegistry;
+    referenceRegistry: AssetReferenceRegistry;
+    /** Upload-policy provider — reads `assets.allowed_file_types` + max-size. */
+    loadUploadPolicy: () => Promise<UploadPolicy>;
+    /** Feature 054 — audits asset writes co-transactionally when provided. */
+    auditLog?: AuditPort;
+}
+export interface ListAssetsQuery {
+    folderId?: string | null | undefined;
+    q?: string | undefined;
+    mime?: string | undefined;
+    visibility?: 'public' | 'private' | undefined;
+    includeDeleted?: boolean | undefined;
+    cursor?: string | undefined;
+    limit?: number | undefined;
+}
+export declare class AssetsLibraryService {
+    #private;
+    private readonly deps;
+    private readonly pipeline;
+    constructor(deps: AssetsLibraryServiceDeps);
+    /** Upload entry point — runs the atomic put + insert + compensating-delete pipeline. */
+    upload(input: UploadInput): Promise<AssetDetail>;
+    /** Resolve the serving URL for an asset by id (public or private). */
+    resolveUrl(assetId: string, opts?: {
+        ttlSec?: number;
+    }): Promise<{
+        url: string;
+        expiresAt: Date | null;
+    }>;
+    getAsset(assetId: string): Promise<AssetDetail>;
+    listAssets(query: ListAssetsQuery): Promise<{
+        data: AssetSummary[];
+        nextCursor: string | null;
+    }>;
+    patchAsset(assetId: string, patch: {
+        filename?: string;
+        label?: string | null;
+        mimeType?: string;
+        visibility?: 'public' | 'private';
+        folderId?: string | null;
+        /**
+         * Per-language alternate text. `AssetDetail` has always reported it and
+         * nothing could write it; feature 068 needs it, because an imported image
+         * must keep the alternate text the source supplied, per language
+         * (FR-047). Not on `patchAssetRequestSchema`, so the HTTP surface is
+         * unchanged — this is a service-level field for module callers.
+         */
+        altText?: Record<string, string> | null;
+    }): Promise<AssetDetail>;
+    setVisibility(assetId: string, visibility: 'public' | 'private'): Promise<AssetDetail>;
+    softDelete(assetId: string): Promise<{
+        deletedAt: Date;
+        purgeAfterAt: Date;
+    }>;
+    restore(assetId: string): Promise<AssetDetail>;
+    move(assetId: string, folderId: string | null): Promise<AssetDetail>;
+    moveMany(assetIds: string[], folderId: string | null): Promise<{
+        movedCount: number;
+    }>;
+    private summary;
+    private detail;
+}
+//# sourceMappingURL=assets-library.service.d.ts.map

package/dist/backend/services/assets-library.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"assets-library.service.d.ts","sourceRoot":"","sources":["../../../src/backend/services/assets-library.service.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,EAAe,KAAK,YAAY,EAAE,KAAK,WAAW,EAAE,MAAM,4BAA4B,CAAC;AAG9F,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AACrE,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AACtE,OAAO,EAAkB,KAAK,WAAW,EAAE,KAAK,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAG3F,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,kCAAkC,CAAC;AAElE,qBAAa,iBAAkB,SAAQ,KAAK;IAC1C,SAAkB,IAAI,uBAAuB;gBACjC,MAAM,EAAE,MAAM;CAK3B;AAED,MAAM,WAAW,wBAAwB;IACvC,SAAS,EAAE,MAAM,aAAa,CAAC;IAC/B,QAAQ,EAAE,eAAe,CAAC;IAC1B,iBAAiB,EAAE,sBAAsB,CAAC;IAC1C,6EAA6E;IAC7E,gBAAgB,EAAE,MAAM,OAAO,CAAC,YAAY,CAAC,CAAC;IAC9C,0EAA0E;IAC1E,QAAQ,CAAC,EAAE,SAAS,CAAC;CACtB;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;IACrC,CAAC,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACvB,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B,UAAU,CAAC,EAAE,QAAQ,GAAG,SAAS,GAAG,SAAS,CAAC;IAC9C,cAAc,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IACrC,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5B,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC5B;AAED,qBAAa,oBAAoB;;IAGnB,OAAO,CAAC,QAAQ,CAAC,IAAI;IAFjC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAiB;gBAEb,IAAI,EAAE,wBAAwB;IA2B3D,wFAAwF;IAClF,MAAM,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IAKtD,sEAAsE;IAChE,UAAU,CACd,OAAO,EAAE,MAAM,EACf,IAAI,GAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAA;KAAO,GAC7B,OAAO,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,IAAI,GAAG,IAAI,CAAA;KAAE,CAAC;IAc7C,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC;IAO/C,UAAU,CAAC,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,YAAY,EAAE,CAAC;QAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;IA0ChG,UAAU,CACd,OAAO,EAAE,MAAM,EACf,KAAK,EAAE;QACL,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QACtB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,UAAU,CAAC,EAAE,QAAQ,GAAG,SAAS,CAAC;QAClC,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QACzB;;;;;;WAMG;QACH,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,CAAC;KACzC,GACA,OAAO,CAAC,WAAW,CAAC;IA+CjB,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,GAAG,SAAS,GAAG,OAAO,CAAC,WAAW,CAAC;IAMtF,UAAU,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,SAAS,EAAE,IAAI,CAAC;QAAC,YAAY,EAAE,IAAI,CAAA;KAAE,CAAC;IA8B7E,OAAO,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC;IAY9C,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,WAAW,CAAC;IAUpE,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,QAAQ,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC;QAAE,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC;YAgB9E,OAAO;YAmBP,MAAM;CASrB"}