@endora-commerce/mod-assets-library 0.0.0-stage → 0.100.0

package/dist/backend/services/hmac.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hmac.d.ts","sourceRoot":"","sources":["../../../src/backend/services/hmac.ts"],"names":[],"mappings":"AASA,MAAM,WAAW,gBAAgB;IAC/B,sCAAsC;IACtC,OAAO,EAAE,MAAM,CAAC;IAChB,2BAA2B;IAC3B,GAAG,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,MAAM,CAAC;IAChB,0CAA0C;IAC1C,KAAK,EAAE,MAAM,CAAC;IACd,iDAAiD;IACjD,GAAG,EAAE,MAAM,CAAC;IACZ,uDAAuD;IACvD,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,qBAAa,UAAU;IACT,OAAO,CAAC,QAAQ,CAAC,GAAG;gBAAH,GAAG,EAAE,MAAM;IAMxC,MAAM,CAAC,OAAO,CAAC,MAAM,qBAAyC,GAAG,UAAU;IAa3E,IAAI,CAAC,KAAK,EAAE,gBAAgB,GAAG,MAAM;IAMrC;;;;OAIG;IACH,MAAM,CAAC,GAAG,EAAE,mBAAmB,GAAG,OAAO;CAU1C"}

package/dist/backend/services/hmac.js

@@ -0,0 +1,50 @@
+// HMAC sign/verify for local-FS private asset URLs. Cloud backends use their
+// own native signed URLs and do not consult this module.
+//
+// The signing key is sourced from the env var ASSETS_LIBRARY_HMAC_KEY (32-byte
+// hex string). Rotating the key invalidates every outstanding private URL —
+// that is the desired behaviour, not a bug.
+import { createHmac, timingSafeEqual } from 'node:crypto';
+export class HmacSigner {
+    key;
+    constructor(key) {
+        this.key = key;
+        if (key.length === 0) {
+            throw new Error('HmacSigner: key cannot be empty');
+        }
+    }
+    static fromEnv(envKey = process.env['ASSETS_LIBRARY_HMAC_KEY']) {
+        if (!envKey || envKey.trim().length === 0) {
+            throw new Error('ASSETS_LIBRARY_HMAC_KEY is unset. Generate one with `openssl rand -hex 32` and add it to backend/.env.');
+        }
+        // Accept hex or raw — hex is what we document, but tolerate raw for tests.
+        const buf = /^[0-9a-fA-F]+$/.test(envKey) && envKey.length % 2 === 0
+            ? Buffer.from(envKey, 'hex')
+            : Buffer.from(envKey, 'utf8');
+        return new HmacSigner(buf);
+    }
+    sign(input) {
+        return createHmac('sha256', this.key)
+            .update(`${input.assetId}\n${input.exp}`)
+            .digest('hex');
+    }
+    /**
+     * Returns true when `ctx.token` is a valid signature for
+     * (`ctx.assetId`, `ctx.exp`) and `ctx.exp >= ctx.nowSec`. Returns false on
+     * any failure (mismatch, expiry, malformed). Uses `timingSafeEqual`.
+     */
+    verify(ctx) {
+        if (!Number.isFinite(ctx.exp) || ctx.exp < ctx.nowSec)
+            return false;
+        const expected = this.sign({ assetId: ctx.assetId, exp: ctx.exp });
+        if (expected.length !== ctx.token.length)
+            return false;
+        try {
+            return timingSafeEqual(Buffer.from(expected, 'hex'), Buffer.from(ctx.token, 'hex'));
+        }
+        catch {
+            return false;
+        }
+    }
+}
+//# sourceMappingURL=hmac.js.map

package/dist/backend/services/hmac.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hmac.js","sourceRoot":"","sources":["../../../src/backend/services/hmac.ts"],"names":[],"mappings":"AAAA,6EAA6E;AAC7E,yDAAyD;AACzD,EAAE;AACF,+EAA+E;AAC/E,4EAA4E;AAC5E,4CAA4C;AAE5C,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAmB1D,MAAM,OAAO,UAAU;IACQ;IAA7B,YAA6B,GAAW;QAAX,QAAG,GAAH,GAAG,CAAQ;QACtC,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;QACrD,CAAC;IACH,CAAC;IAED,MAAM,CAAC,OAAO,CAAC,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC;QAC5D,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1C,MAAM,IAAI,KAAK,CACb,wGAAwG,CACzG,CAAC;QACJ,CAAC;QACD,2EAA2E;QAC3E,MAAM,GAAG,GAAG,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC;YAClE,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC;YAC5B,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAChC,OAAO,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC;IAC7B,CAAC;IAED,IAAI,CAAC,KAAuB;QAC1B,OAAO,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,GAAG,CAAC;aAClC,MAAM,CAAC,GAAG,KAAK,CAAC,OAAO,KAAK,KAAK,CAAC,GAAG,EAAE,CAAC;aACxC,MAAM,CAAC,KAAK,CAAC,CAAC;IACnB,CAAC;IAED;;;;OAIG;IACH,MAAM,CAAC,GAAwB;QAC7B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,GAAG,GAAG,GAAG,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;QACpE,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC;QACnE,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,CAAC,KAAK,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;QACvD,IAAI,CAAC;YACH,OAAO,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;QACtF,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;CACF"}

package/dist/backend/services/reference-registry.d.ts

@@ -0,0 +1,36 @@
+import type { AssetReference, AssetReferenceDescriptor, AssetReferenceRegistryPort } from '@endora-commerce/contracts';
+/**
+ * Both shapes moved to `@endora-commerce/contracts` in feature 075's Phase P — four
+ * modules contribute a descriptor, so the descriptor is a boundary shape and
+ * not an internal. Re-exported here for the length of Phase P, which cuts no
+ * consumer.
+ */
+export type { AssetReference, AssetReferenceDescriptor };
+/**
+ * Enumeration policy: **honoured** while the contributing module is absent
+ * (feature 072, D-39).
+ *
+ * D-39's default is to skip, and honouring needs a written reason. This registry
+ * is referential integrity, not a surface. If `blog` is switched off its posts
+ * still exist and still embed assets; skipping `blog`'s scanner would let an
+ * operator delete an asset that comes back as a broken image the moment `blog`
+ * is switched on again — a data loss caused by an action Constitution XVII
+ * promises is non-destructive and reversible.
+ *
+ * `skip` is right for surface-like contributions — an interceptor, a palette
+ * action, a storefront element — where a switched-off module must contribute
+ * nothing a user can see. Nobody sees these; they exist to refuse a delete.
+ *
+ * The owner is recorded on every descriptor even though this registry does not
+ * filter on it, because the alternative is a registry that could not express the
+ * decision either way, and because it attributes a 409 to a module.
+ */
+export declare class AssetReferenceRegistry implements AssetReferenceRegistryPort {
+    private readonly descriptors;
+    register(d: AssetReferenceDescriptor): void;
+    /** The contributing module of every registered descriptor, in registration order. */
+    owners(): readonly string[];
+    findReferences(assetId: string): Promise<AssetReference[]>;
+    findReferencesMany(assetIds: string[]): Promise<Map<string, AssetReference[]>>;
+}
+//# sourceMappingURL=reference-registry.d.ts.map

package/dist/backend/services/reference-registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"reference-registry.d.ts","sourceRoot":"","sources":["../../../src/backend/services/reference-registry.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EACV,cAAc,EACd,wBAAwB,EACxB,0BAA0B,EAC3B,MAAM,4BAA4B,CAAC;AAEpC;;;;;GAKG;AACH,YAAY,EAAE,cAAc,EAAE,wBAAwB,EAAE,CAAC;AAEzD;;;;;;;;;;;;;;;;;;GAkBG;AACH,qBAAa,sBAAuB,YAAW,0BAA0B;IACvE,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAkC;IAE9D,QAAQ,CAAC,CAAC,EAAE,wBAAwB,GAAG,IAAI;IAM3C,qFAAqF;IACrF,MAAM,IAAI,SAAS,MAAM,EAAE;IAIrB,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC;IAO1D,kBAAkB,CACtB,QAAQ,EAAE,MAAM,EAAE,GACjB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,cAAc,EAAE,CAAC,CAAC;CAoB1C"}

package/dist/backend/services/reference-registry.js

@@ -0,0 +1,63 @@
+// AssetReferenceRegistry — feature 013 / research.md R10 / contracts/
+// assets-library-reference-registry.contract.md.
+//
+// In-process registry of "who points at this asset" descriptors. Catalog
+// (4 FK descriptors) and CMS (1 jsonb-body-scan descriptor) register at
+// composition time. The Library consults the registry before every
+// soft-delete attempt (FR-030).
+/**
+ * Enumeration policy: **honoured** while the contributing module is absent
+ * (feature 072, D-39).
+ *
+ * D-39's default is to skip, and honouring needs a written reason. This registry
+ * is referential integrity, not a surface. If `blog` is switched off its posts
+ * still exist and still embed assets; skipping `blog`'s scanner would let an
+ * operator delete an asset that comes back as a broken image the moment `blog`
+ * is switched on again — a data loss caused by an action Constitution XVII
+ * promises is non-destructive and reversible.
+ *
+ * `skip` is right for surface-like contributions — an interceptor, a palette
+ * action, a storefront element — where a switched-off module must contribute
+ * nothing a user can see. Nobody sees these; they exist to refuse a delete.
+ *
+ * The owner is recorded on every descriptor even though this registry does not
+ * filter on it, because the alternative is a registry that could not express the
+ * decision either way, and because it attributes a 409 to a module.
+ */
+export class AssetReferenceRegistry {
+    descriptors = [];
+    register(d) {
+        if (!this.descriptors.includes(d)) {
+            this.descriptors.push(d);
+        }
+    }
+    /** The contributing module of every registered descriptor, in registration order. */
+    owners() {
+        return this.descriptors.map((d) => d.ownerModuleId);
+    }
+    async findReferences(assetId) {
+        const all = await Promise.all(this.descriptors.map((d) => d.findReferences([assetId])));
+        return all.flat();
+    }
+    async findReferencesMany(assetIds) {
+        const out = new Map();
+        for (const id of assetIds)
+            out.set(id, []);
+        if (assetIds.length === 0)
+            return out;
+        const perDescriptor = await Promise.all(this.descriptors.map((d) => d.findReferences(assetIds)));
+        for (const refs of perDescriptor) {
+            for (const ref of refs) {
+                // Each descriptor is responsible for tagging every reference with the
+                // *original* asset id it found; the registry does not try to cross-
+                // correlate. Descriptors that batch via WHERE asset_id = ANY($1) get
+                // the asset_id back from the row trivially.
+                const list = out.get(ref.__assetId ?? '');
+                if (list)
+                    list.push(ref);
+            }
+        }
+        return out;
+    }
+}
+//# sourceMappingURL=reference-registry.js.map

package/dist/backend/services/reference-registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"reference-registry.js","sourceRoot":"","sources":["../../../src/backend/services/reference-registry.ts"],"names":[],"mappings":"AAAA,sEAAsE;AACtE,iDAAiD;AACjD,EAAE;AACF,yEAAyE;AACzE,wEAAwE;AACxE,mEAAmE;AACnE,gCAAgC;AAgBhC;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,OAAO,sBAAsB;IAChB,WAAW,GAA+B,EAAE,CAAC;IAE9D,QAAQ,CAAC,CAA2B;QAClC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;YAClC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC3B,CAAC;IACH,CAAC;IAED,qFAAqF;IACrF,MAAM;QACJ,OAAO,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC;IACtD,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,OAAe;QAClC,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,CAC3B,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CACzD,CAAC;QACF,OAAO,GAAG,CAAC,IAAI,EAAE,CAAC;IACpB,CAAC;IAED,KAAK,CAAC,kBAAkB,CACtB,QAAkB;QAElB,MAAM,GAAG,GAAG,IAAI,GAAG,EAA4B,CAAC;QAChD,KAAK,MAAM,EAAE,IAAI,QAAQ;YAAE,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QAC3C,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,GAAG,CAAC;QAEtC,MAAM,aAAa,GAAG,MAAM,OAAO,CAAC,GAAG,CACrC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC,CACxD,CAAC;QACF,KAAK,MAAM,IAAI,IAAI,aAAa,EAAE,CAAC;YACjC,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;gBACvB,sEAAsE;gBACtE,oEAAoE;gBACpE,qEAAqE;gBACrE,4CAA4C;gBAC5C,MAAM,IAAI,GAAG,GAAG,CAAC,GAAG,CAAE,GAA+C,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;gBACvF,IAAI,IAAI;oBAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAC3B,CAAC;QACH,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;CACF"}

package/dist/backend/services/storage/adapter-registry.d.ts

@@ -0,0 +1,77 @@
+import type { ObjectStorageBackendCode } from '@endora-commerce/contracts';
+import type { StorageAdapter, StorageBackendCode } from './storage-adapter.js';
+import { type LegacyAssetResolver } from './legacy-resolver.js';
+import type { HmacSigner } from '../hmac.js';
+/**
+ * The minimum settings surface AdapterRegistry needs. The composition root
+ * supplies an implementation backed by SettingsService (real) or by a static
+ * map (tests).
+ */
+export interface AdapterSettingsView {
+    /** Active adapter code: 'local' | 's3' | 'gcs'. */
+    activeAdapter(): Promise<'local' | 's3' | 'gcs'>;
+    /** Local-FS base directory (`assets.local.base_dir`). */
+    localBaseDir(): Promise<string>;
+    /** Public URL prefix for local-FS public assets. May be empty in dev. */
+    localPublicUrlBase(): Promise<string>;
+    /** Default TTL for private signed URLs (seconds). */
+    privateUrlTtlSec(): Promise<number>;
+    /** S3-adapter configuration. */
+    s3Config(): Promise<{
+        bucket: string;
+        region: string;
+        accessKeyId: string;
+        secretAccessKey: string;
+        endpoint?: string;
+        prefix?: string;
+        publicBaseUrl?: string;
+    }>;
+    /** GCS-adapter configuration. */
+    gcsConfig(): Promise<{
+        bucket: string;
+        serviceAccountJson?: string;
+        prefix?: string;
+        publicBaseUrl?: string;
+    }>;
+}
+export interface AdapterRegistryOptions {
+    settings: AdapterSettingsView;
+    /** Provider; invoked on first need so tests that never sign a URL can skip env setup. */
+    signer: () => HmacSigner;
+    /**
+     * This deployment's resolved public API origin (D-223).
+     *
+     * Handed to every adapter it builds, and to the legacy resolver, so that the
+     * fallback base is decided at **construction** — never at the setting's
+     * declaration, which cannot read the environment, and never by a consumer,
+     * which cannot know which backend produced the URL or whether it is signed.
+     */
+    publicApiBaseUrl: string;
+}
+export declare class AdapterRegistry {
+    private readonly opts;
+    private cached;
+    constructor(opts: AdapterRegistryOptions);
+    /** Drop the cached active adapter. Called when settings change. */
+    invalidate(): void;
+    /** Return the adapter currently selected by settings. */
+    getActive(): Promise<StorageAdapter>;
+    /**
+     * Return the adapter that owns the given asset's bytes. Use this for read /
+     * delete / setVisibility — never `getActive()`, which would silently route
+     * a previously-uploaded asset to the wrong backend after a switch (FR-017).
+     *
+     * **Overloaded on the code, because the union has exactly one cause.** The
+     * legacy arm is returned for `'legacy'` and for nothing else, so a caller
+     * naming a real backend gets a `StorageAdapter` and needs no probe. Both
+     * consumers of the byte surface used to write
+     * `if (!('open' in adapter) || typeof adapter.open !== 'function')` — the
+     * shape D-97.3 refuses on a *published* port — for a branch the type could
+     * have ruled out. `ObjectStoragePort` is what publishes that narrowing
+     * (`specs/110-instance-repository/` T118c).
+     */
+    getForBackend(backend: ObjectStorageBackendCode): Promise<StorageAdapter>;
+    getForBackend(backend: StorageBackendCode): Promise<StorageAdapter | LegacyAssetResolver>;
+    private build;
+}
+//# sourceMappingURL=adapter-registry.d.ts.map

package/dist/backend/services/storage/adapter-registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"adapter-registry.d.ts","sourceRoot":"","sources":["../../../../src/backend/services/storage/adapter-registry.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,4BAA4B,CAAC;AAC3E,OAAO,KAAK,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAI/E,OAAO,EAA6B,KAAK,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAE3F,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAE7C;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IAClC,mDAAmD;IACnD,aAAa,IAAI,OAAO,CAAC,OAAO,GAAG,IAAI,GAAG,KAAK,CAAC,CAAC;IACjD,yDAAyD;IACzD,YAAY,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;IAChC,yEAAyE;IACzE,kBAAkB,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;IACtC,qDAAqD;IACrD,gBAAgB,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;IACpC,gCAAgC;IAChC,QAAQ,IAAI,OAAO,CAAC;QAClB,MAAM,EAAE,MAAM,CAAC;QACf,MAAM,EAAE,MAAM,CAAC;QACf,WAAW,EAAE,MAAM,CAAC;QACpB,eAAe,EAAE,MAAM,CAAC;QACxB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,aAAa,CAAC,EAAE,MAAM,CAAC;KACxB,CAAC,CAAC;IACH,iCAAiC;IACjC,SAAS,IAAI,OAAO,CAAC;QACnB,MAAM,EAAE,MAAM,CAAC;QACf,kBAAkB,CAAC,EAAE,MAAM,CAAC;QAC5B,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,aAAa,CAAC,EAAE,MAAM,CAAC;KACxB,CAAC,CAAC;CACJ;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,EAAE,mBAAmB,CAAC;IAC9B,yFAAyF;IACzF,MAAM,EAAE,MAAM,UAAU,CAAC;IACzB;;;;;;;OAOG;IACH,gBAAgB,EAAE,MAAM,CAAC;CAC1B;AAED,qBAAa,eAAe;IAGd,OAAO,CAAC,QAAQ,CAAC,IAAI;IAFjC,OAAO,CAAC,MAAM,CAAsE;gBAEvD,IAAI,EAAE,sBAAsB;IAEzD,mEAAmE;IACnE,UAAU,IAAI,IAAI;IAIlB,yDAAyD;IACnD,SAAS,IAAI,OAAO,CAAC,cAAc,CAAC;IAQ1C;;;;;;;;;;;;;OAaG;IACG,aAAa,CAAC,OAAO,EAAE,wBAAwB,GAAG,OAAO,CAAC,cAAc,CAAC;IACzE,aAAa,CACjB,OAAO,EAAE,kBAAkB,GAC1B,OAAO,CAAC,cAAc,GAAG,mBAAmB,CAAC;YASlC,KAAK;CAqDpB"}

package/dist/backend/services/storage/adapter-registry.js

@@ -0,0 +1,95 @@
+// AdapterRegistry — chooses the active StorageAdapter from settings and
+// caches it for the process lifetime. Per-asset reads dispatch to the
+// adapter that owns that asset's bytes (recorded in `Asset.storageBackend`),
+// not to the active adapter. The active adapter is consulted only at upload
+// time and for self-check.
+//
+// Cloud adapters (S3, GCS) are stub-imported here; their concrete classes
+// land in Phase 5 (US3) — until then, attempting to switch the active
+// adapter to s3/gcs raises a clear error.
+import { LocalFsStorageAdapter } from './local-fs-adapter.js';
+import { S3StorageAdapter } from './s3-adapter.js';
+import { GcsStorageAdapter } from './gcs-adapter.js';
+import { createLegacyAssetResolver } from './legacy-resolver.js';
+import { ConfigurationError } from './errors.js';
+export class AdapterRegistry {
+    opts;
+    cached = null;
+    constructor(opts) {
+        this.opts = opts;
+    }
+    /** Drop the cached active adapter. Called when settings change. */
+    invalidate() {
+        this.cached = null;
+    }
+    /** Return the adapter currently selected by settings. */
+    async getActive() {
+        if (this.cached)
+            return this.cached.adapter;
+        const code = await this.opts.settings.activeAdapter();
+        const adapter = await this.build(code);
+        this.cached = { code, adapter };
+        return adapter;
+    }
+    async getForBackend(backend) {
+        if (backend === 'legacy')
+            return createLegacyAssetResolver(this.opts.publicApiBaseUrl);
+        if (this.cached && this.cached.code === backend)
+            return this.cached.adapter;
+        return this.build(backend);
+    }
+    async build(code) {
+        if (code === 'local') {
+            const baseDir = await this.opts.settings.localBaseDir();
+            // Blank stays blank here on purpose: the adapter decides what a blank
+            // base means (D-223 — this deployment's public API origin), so there is
+            // one place that answers it rather than one per construction site.
+            const publicUrlBase = (await this.opts.settings.localPublicUrlBase()).trim();
+            const privateUrlTtlSec = await this.opts.settings.privateUrlTtlSec();
+            return new LocalFsStorageAdapter({
+                baseDir,
+                publicUrlBase,
+                publicApiBaseUrl: this.opts.publicApiBaseUrl,
+                privateUrlTtlSec,
+                signer: this.opts.signer(),
+            });
+        }
+        if (code === 's3') {
+            const cfg = await this.opts.settings.s3Config();
+            const ttl = await this.opts.settings.privateUrlTtlSec();
+            return new S3StorageAdapter({
+                bucket: cfg.bucket,
+                region: cfg.region,
+                accessKeyId: cfg.accessKeyId,
+                secretAccessKey: cfg.secretAccessKey,
+                ...(cfg.endpoint !== undefined && cfg.endpoint.length > 0
+                    ? { endpoint: cfg.endpoint }
+                    : {}),
+                ...(cfg.prefix !== undefined && cfg.prefix.length > 0 ? { prefix: cfg.prefix } : {}),
+                ...(cfg.publicBaseUrl !== undefined && cfg.publicBaseUrl.length > 0
+                    ? { publicBaseUrl: cfg.publicBaseUrl }
+                    : {}),
+                publicApiBaseUrl: this.opts.publicApiBaseUrl,
+                privateUrlTtlSec: ttl,
+            });
+        }
+        if (code === 'gcs') {
+            const cfg = await this.opts.settings.gcsConfig();
+            const ttl = await this.opts.settings.privateUrlTtlSec();
+            return new GcsStorageAdapter({
+                bucket: cfg.bucket,
+                ...(cfg.serviceAccountJson !== undefined && cfg.serviceAccountJson.length > 0
+                    ? { serviceAccountJson: cfg.serviceAccountJson }
+                    : {}),
+                ...(cfg.prefix !== undefined && cfg.prefix.length > 0 ? { prefix: cfg.prefix } : {}),
+                ...(cfg.publicBaseUrl !== undefined && cfg.publicBaseUrl.length > 0
+                    ? { publicBaseUrl: cfg.publicBaseUrl }
+                    : {}),
+                publicApiBaseUrl: this.opts.publicApiBaseUrl,
+                privateUrlTtlSec: ttl,
+            });
+        }
+        throw new ConfigurationError(`Unknown storage backend: "${code}"`);
+    }
+}
+//# sourceMappingURL=adapter-registry.js.map

package/dist/backend/services/storage/adapter-registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"adapter-registry.js","sourceRoot":"","sources":["../../../../src/backend/services/storage/adapter-registry.ts"],"names":[],"mappings":"AAAA,wEAAwE;AACxE,sEAAsE;AACtE,6EAA6E;AAC7E,4EAA4E;AAC5E,2BAA2B;AAC3B,EAAE;AACF,0EAA0E;AAC1E,sEAAsE;AACtE,0CAA0C;AAI1C,OAAO,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAC9D,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,yBAAyB,EAA4B,MAAM,sBAAsB,CAAC;AAC3F,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAmDjD,MAAM,OAAO,eAAe;IAGG;IAFrB,MAAM,GAAiE,IAAI,CAAC;IAEpF,YAA6B,IAA4B;QAA5B,SAAI,GAAJ,IAAI,CAAwB;IAAG,CAAC;IAE7D,mEAAmE;IACnE,UAAU;QACR,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;IACrB,CAAC;IAED,yDAAyD;IACzD,KAAK,CAAC,SAAS;QACb,IAAI,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC;QAC5C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,aAAa,EAAE,CAAC;QACtD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACvC,IAAI,CAAC,MAAM,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;QAChC,OAAO,OAAO,CAAC;IACjB,CAAC;IAoBD,KAAK,CAAC,aAAa,CACjB,OAA2B;QAE3B,IAAI,OAAO,KAAK,QAAQ;YAAE,OAAO,yBAAyB,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;QACvF,IAAI,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,OAAO;YAAE,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC;QAC5E,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC7B,CAAC;IAEO,KAAK,CAAC,KAAK,CAAC,IAAwB;QAC1C,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;YACrB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,YAAY,EAAE,CAAC;YACxD,sEAAsE;YACtE,wEAAwE;YACxE,mEAAmE;YACnE,MAAM,aAAa,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,kBAAkB,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;YAC7E,MAAM,gBAAgB,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,gBAAgB,EAAE,CAAC;YACrE,OAAO,IAAI,qBAAqB,CAAC;gBAC/B,OAAO;gBACP,aAAa;gBACb,gBAAgB,EAAE,IAAI,CAAC,IAAI,CAAC,gBAAgB;gBAC5C,gBAAgB;gBAChB,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE;aAC3B,CAAC,CAAC;QACL,CAAC;QACD,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YAClB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC;YAChD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,gBAAgB,EAAE,CAAC;YACxD,OAAO,IAAI,gBAAgB,CAAC;gBAC1B,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,WAAW,EAAE,GAAG,CAAC,WAAW;gBAC5B,eAAe,EAAE,GAAG,CAAC,eAAe;gBACpC,GAAG,CAAC,GAAG,CAAC,QAAQ,KAAK,SAAS,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC;oBACvD,CAAC,CAAC,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE;oBAC5B,CAAC,CAAC,EAAE,CAAC;gBACP,GAAG,CAAC,GAAG,CAAC,MAAM,KAAK,SAAS,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACpF,GAAG,CAAC,GAAG,CAAC,aAAa,KAAK,SAAS,IAAI,GAAG,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC;oBACjE,CAAC,CAAC,EAAE,aAAa,EAAE,GAAG,CAAC,aAAa,EAAE;oBACtC,CAAC,CAAC,EAAE,CAAC;gBACP,gBAAgB,EAAE,IAAI,CAAC,IAAI,CAAC,gBAAgB;gBAC5C,gBAAgB,EAAE,GAAG;aACtB,CAAC,CAAC;QACL,CAAC;QACD,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC;YACnB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,CAAC;YACjD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,gBAAgB,EAAE,CAAC;YACxD,OAAO,IAAI,iBAAiB,CAAC;gBAC3B,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,GAAG,CAAC,GAAG,CAAC,kBAAkB,KAAK,SAAS,IAAI,GAAG,CAAC,kBAAkB,CAAC,MAAM,GAAG,CAAC;oBAC3E,CAAC,CAAC,EAAE,kBAAkB,EAAE,GAAG,CAAC,kBAAkB,EAAE;oBAChD,CAAC,CAAC,EAAE,CAAC;gBACP,GAAG,CAAC,GAAG,CAAC,MAAM,KAAK,SAAS,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACpF,GAAG,CAAC,GAAG,CAAC,aAAa,KAAK,SAAS,IAAI,GAAG,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC;oBACjE,CAAC,CAAC,EAAE,aAAa,EAAE,GAAG,CAAC,aAAa,EAAE;oBACtC,CAAC,CAAC,EAAE,CAAC;gBACP,gBAAgB,EAAE,IAAI,CAAC,IAAI,CAAC,gBAAgB;gBAC5C,gBAAgB,EAAE,GAAG;aACtB,CAAC,CAAC;QACL,CAAC;QACD,MAAM,IAAI,kBAAkB,CAAC,6BAA6B,IAAI,GAAG,CAAC,CAAC;IACrE,CAAC;CACF"}

package/dist/backend/services/storage/errors.d.ts

@@ -0,0 +1,18 @@
+export declare class ConfigurationError extends Error {
+    readonly name = "ConfigurationError";
+    constructor(message: string);
+}
+export declare class BackendUnavailableError extends Error {
+    readonly cause?: unknown | undefined;
+    readonly name = "BackendUnavailableError";
+    constructor(message: string, cause?: unknown | undefined);
+}
+export declare class LocatorMissingError extends Error {
+    readonly name = "LocatorMissingError";
+    constructor(message: string);
+}
+export declare class LegacyAssetCannotHardenError extends Error {
+    readonly name = "LegacyAssetCannotHardenError";
+    constructor();
+}
+//# sourceMappingURL=errors.d.ts.map

package/dist/backend/services/storage/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../../../src/backend/services/storage/errors.ts"],"names":[],"mappings":"AAIA,qBAAa,kBAAmB,SAAQ,KAAK;IAC3C,SAAkB,IAAI,wBAAwB;gBAClC,OAAO,EAAE,MAAM;CAG5B;AAED,qBAAa,uBAAwB,SAAQ,KAAK;aAI9B,KAAK,CAAC,EAAE,OAAO;IAHjC,SAAkB,IAAI,6BAA6B;gBAEjD,OAAO,EAAE,MAAM,EACC,KAAK,CAAC,EAAE,OAAO,YAAA;CAIlC;AAED,qBAAa,mBAAoB,SAAQ,KAAK;IAC5C,SAAkB,IAAI,yBAAyB;gBACnC,OAAO,EAAE,MAAM;CAG5B;AAED,qBAAa,4BAA6B,SAAQ,KAAK;IACrD,SAAkB,IAAI,kCAAkC;;CAMzD"}

package/dist/backend/services/storage/errors.js

@@ -0,0 +1,30 @@
+// Adapter-side error classes — the upload pipeline / resolveUrl path map these
+// onto the platform's standard HTTP error envelope codes (see contracts/
+// assets-library-admin-http.contract.md).
+export class ConfigurationError extends Error {
+    name = 'ConfigurationError';
+    constructor(message) {
+        super(message);
+    }
+}
+export class BackendUnavailableError extends Error {
+    cause;
+    name = 'BackendUnavailableError';
+    constructor(message, cause) {
+        super(message);
+        this.cause = cause;
+    }
+}
+export class LocatorMissingError extends Error {
+    name = 'LocatorMissingError';
+    constructor(message) {
+        super(message);
+    }
+}
+export class LegacyAssetCannotHardenError extends Error {
+    name = 'LegacyAssetCannotHardenError';
+    constructor() {
+        super('Cannot mark a `legacy` (pre-013 absolute-URL) asset as private — re-upload it through the active adapter first.');
+    }
+}
+//# sourceMappingURL=errors.js.map

package/dist/backend/services/storage/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../../../src/backend/services/storage/errors.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,yEAAyE;AACzE,0CAA0C;AAE1C,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IACzB,IAAI,GAAG,oBAAoB,CAAC;IAC9C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;IACjB,CAAC;CACF;AAED,MAAM,OAAO,uBAAwB,SAAQ,KAAK;IAI9B;IAHA,IAAI,GAAG,yBAAyB,CAAC;IACnD,YACE,OAAe,EACC,KAAe;QAE/B,KAAK,CAAC,OAAO,CAAC,CAAC;QAFC,UAAK,GAAL,KAAK,CAAU;IAGjC,CAAC;CACF;AAED,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IAC1B,IAAI,GAAG,qBAAqB,CAAC;IAC/C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;IACjB,CAAC;CACF;AAED,MAAM,OAAO,4BAA6B,SAAQ,KAAK;IACnC,IAAI,GAAG,8BAA8B,CAAC;IACxD;QACE,KAAK,CACH,iHAAiH,CAClH,CAAC;IACJ,CAAC;CACF"}

package/dist/backend/services/storage/gcs-adapter.d.ts

@@ -0,0 +1,42 @@
+import type { StorageAdapter, StorageAdapterSelfCheck, StorageNewLocatorInput, StoragePutInput, StorageResolveUrlInput, StorageResolveUrlOutput } from './storage-adapter.js';
+export interface GcsAdapterConfig {
+    bucket: string;
+    serviceAccountJson?: string;
+    prefix?: string;
+    /**
+     * `assets.gcs.public_base_url` — a CDN or custom domain in front of the
+     * bucket. Blank means the bucket's own origin, which is already absolute.
+     */
+    publicBaseUrl?: string;
+    /**
+     * This deployment's resolved public API origin — D-223's fallback base, with
+     * the same bound as the S3 adapter's: it rescues a `publicBaseUrl` written as
+     * a path, and a blank one keeps resolving to the bucket, which serves the
+     * bytes this API does not.
+     */
+    publicApiBaseUrl: string;
+    privateUrlTtlSec: number;
+}
+export declare class GcsStorageAdapter implements StorageAdapter {
+    private readonly cfg;
+    readonly code: "gcs";
+    private readonly bucket;
+    /** The absolute base public object URLs are built on — decided once (D-223). */
+    private readonly publicBase;
+    constructor(cfg: GcsAdapterConfig);
+    selfCheck(): Promise<StorageAdapterSelfCheck>;
+    newLocator(input: StorageNewLocatorInput): string;
+    put(input: StoragePutInput): Promise<void>;
+    resolveUrl(input: StorageResolveUrlInput): Promise<StorageResolveUrlOutput>;
+    open(input: {
+        locator: string;
+    }): Promise<NodeJS.ReadableStream>;
+    delete(input: {
+        locator: string;
+    }): Promise<void>;
+    setVisibility(input: {
+        locator: string;
+        visibility: 'public' | 'private';
+    }): Promise<void>;
+}
+//# sourceMappingURL=gcs-adapter.d.ts.map

package/dist/backend/services/storage/gcs-adapter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gcs-adapter.d.ts","sourceRoot":"","sources":["../../../../src/backend/services/storage/gcs-adapter.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EACV,cAAc,EACd,uBAAuB,EACvB,sBAAsB,EACtB,eAAe,EACf,sBAAsB,EACtB,uBAAuB,EACxB,MAAM,sBAAsB,CAAC;AAS9B,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;OAKG;IACH,gBAAgB,EAAE,MAAM,CAAC;IACzB,gBAAgB,EAAE,MAAM,CAAC;CAC1B;AAED,qBAAa,iBAAkB,YAAW,cAAc;IAM1C,OAAO,CAAC,QAAQ,CAAC,GAAG;IALhC,QAAQ,CAAC,IAAI,EAAG,KAAK,CAAU;IAC/B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,gFAAgF;IAChF,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;gBAEP,GAAG,EAAE,gBAAgB;IAyB5C,SAAS,IAAI,OAAO,CAAC,uBAAuB,CAAC;IASnD,UAAU,CAAC,KAAK,EAAE,sBAAsB,GAAG,MAAM;IAM3C,GAAG,CAAC,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC;IAqB1C,UAAU,CAAC,KAAK,EAAE,sBAAsB,GAAG,OAAO,CAAC,uBAAuB,CAAC;IAiB3E,IAAI,CAAC,KAAK,EAAE;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC,cAAc,CAAC;IAIhE,MAAM,CAAC,KAAK,EAAE;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAWjD,aAAa,CAAC,KAAK,EAAE;QACzB,OAAO,EAAE,MAAM,CAAC;QAChB,UAAU,EAAE,QAAQ,GAAG,SAAS,CAAC;KAClC,GAAG,OAAO,CAAC,IAAI,CAAC;CAelB"}

package/dist/backend/services/storage/gcs-adapter.js

@@ -0,0 +1,106 @@
+// GCS storage adapter — feature 013 / US3 / T076.
+// Wraps @google-cloud/storage. Storage layout matches the local-FS / S3
+// sharded scheme; private URLs use V4 signed URLs.
+import { Storage } from '@google-cloud/storage';
+import { computeLocator } from './locator.js';
+import { resolvePublicUrlBase } from './public-url-base.js';
+import { BackendUnavailableError, ConfigurationError, LocatorMissingError, } from './errors.js';
+export class GcsStorageAdapter {
+    cfg;
+    code = 'gcs';
+    bucket;
+    /** The absolute base public object URLs are built on — decided once (D-223). */
+    publicBase;
+    constructor(cfg) {
+        this.cfg = cfg;
+        if (!cfg.bucket)
+            throw new ConfigurationError('GcsStorageAdapter: bucket is required');
+        const configuredBase = (cfg.publicBaseUrl ?? '').trim();
+        this.publicBase = resolvePublicUrlBase(configuredBase.length > 0
+            ? configuredBase
+            : `https://storage.googleapis.com/${cfg.bucket}`, cfg.publicApiBaseUrl);
+        let credentials;
+        if (cfg.serviceAccountJson && cfg.serviceAccountJson.trim().length > 0) {
+            try {
+                credentials = JSON.parse(cfg.serviceAccountJson);
+            }
+            catch (e) {
+                throw new ConfigurationError(`GcsStorageAdapter: serviceAccountJson is not valid JSON (${e.message})`);
+            }
+        }
+        const storage = new Storage({
+            ...(credentials ? { credentials } : {}),
+        });
+        this.bucket = storage.bucket(cfg.bucket);
+    }
+    async selfCheck() {
+        try {
+            const [exists] = await this.bucket.exists();
+            return exists ? { ok: true } : { ok: false, reason: `bucket "${this.cfg.bucket}" not found` };
+        }
+        catch (e) {
+            return { ok: false, reason: e instanceof Error ? e.message : String(e) };
+        }
+    }
+    newLocator(input) {
+        const tail = computeLocator(input);
+        const prefix = (this.cfg.prefix ?? '').replace(/^\/+|\/+$/g, '');
+        return prefix.length > 0 ? `${prefix}/${tail}` : tail;
+    }
+    async put(input) {
+        if (!input.locator)
+            throw new LocatorMissingError('GcsStorageAdapter.put: empty locator');
+        return new Promise((resolve, reject) => {
+            const writeStream = this.bucket.file(input.locator).createWriteStream({
+                metadata: { contentType: input.mimeType },
+                ...(input.visibility === 'public' ? { predefinedAcl: 'publicRead' } : { predefinedAcl: 'private' }),
+                resumable: false,
+            });
+            input.stream.pipe(writeStream);
+            writeStream.on('finish', () => resolve());
+            writeStream.on('error', (err) => reject(new BackendUnavailableError(`GcsStorageAdapter.put: failed to persist ${input.locator}`, err)));
+        });
+    }
+    async resolveUrl(input) {
+        if (input.visibility === 'public') {
+            return { url: `${this.publicBase}/${input.locator}`, expiresAt: null };
+        }
+        const ttl = input.ttlSec ?? this.cfg.privateUrlTtlSec;
+        if (!Number.isInteger(ttl) || ttl <= 0) {
+            throw new ConfigurationError(`GcsStorageAdapter.resolveUrl: invalid TTL ${ttl}`);
+        }
+        const expiresAt = new Date(Date.now() + ttl * 1000);
+        const [url] = await this.bucket.file(input.locator).getSignedUrl({
+            version: 'v4',
+            action: 'read',
+            expires: expiresAt.getTime(),
+        });
+        return { url, expiresAt };
+    }
+    async open(input) {
+        return this.bucket.file(input.locator).createReadStream();
+    }
+    async delete(input) {
+        try {
+            await this.bucket.file(input.locator).delete({ ignoreNotFound: false });
+        }
+        catch (e) {
+            throw new BackendUnavailableError(`GcsStorageAdapter.delete: failed to remove ${input.locator}`, e);
+        }
+    }
+    async setVisibility(input) {
+        const acl = this.bucket.file(input.locator).acl;
+        try {
+            if (input.visibility === 'public') {
+                await acl.add({ entity: 'allUsers', role: 'READER' });
+            }
+            else {
+                await acl.delete({ entity: 'allUsers' });
+            }
+        }
+        catch (e) {
+            throw new BackendUnavailableError(`GcsStorageAdapter.setVisibility: failed on ${input.locator}`, e);
+        }
+    }
+}
+//# sourceMappingURL=gcs-adapter.js.map

package/dist/backend/services/storage/gcs-adapter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gcs-adapter.js","sourceRoot":"","sources":["../../../../src/backend/services/storage/gcs-adapter.ts"],"names":[],"mappings":"AAAA,kDAAkD;AAClD,wEAAwE;AACxE,mDAAmD;AAEnD,OAAO,EAAE,OAAO,EAAe,MAAM,uBAAuB,CAAC;AAS7D,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,EACL,uBAAuB,EACvB,kBAAkB,EAClB,mBAAmB,GACpB,MAAM,aAAa,CAAC;AAqBrB,MAAM,OAAO,iBAAiB;IAMC;IALpB,IAAI,GAAG,KAAc,CAAC;IACd,MAAM,CAAS;IAChC,gFAAgF;IAC/D,UAAU,CAAS;IAEpC,YAA6B,GAAqB;QAArB,QAAG,GAAH,GAAG,CAAkB;QAChD,IAAI,CAAC,GAAG,CAAC,MAAM;YAAE,MAAM,IAAI,kBAAkB,CAAC,uCAAuC,CAAC,CAAC;QACvF,MAAM,cAAc,GAAG,CAAC,GAAG,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACxD,IAAI,CAAC,UAAU,GAAG,oBAAoB,CACpC,cAAc,CAAC,MAAM,GAAG,CAAC;YACvB,CAAC,CAAC,cAAc;YAChB,CAAC,CAAC,kCAAkC,GAAG,CAAC,MAAM,EAAE,EAClD,GAAG,CAAC,gBAAgB,CACrB,CAAC;QACF,IAAI,WAAgD,CAAC;QACrD,IAAI,GAAG,CAAC,kBAAkB,IAAI,GAAG,CAAC,kBAAkB,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvE,IAAI,CAAC;gBACH,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,kBAAkB,CAA4B,CAAC;YAC9E,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,MAAM,IAAI,kBAAkB,CAC1B,4DAA6D,CAAW,CAAC,OAAO,GAAG,CACpF,CAAC;YACJ,CAAC;QACH,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC;YAC1B,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACxC,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC3C,CAAC;IAED,KAAK,CAAC,SAAS;QACb,IAAI,CAAC;YACH,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;YAC5C,OAAO,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,IAAI,CAAC,GAAG,CAAC,MAAM,aAAa,EAAE,CAAC;QAChG,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3E,CAAC;IACH,CAAC;IAED,UAAU,CAAC,KAA6B;QACtC,MAAM,IAAI,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;QACnC,MAAM,MAAM,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;QACjE,OAAO,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACxD,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,KAAsB;QAC9B,IAAI,CAAC,KAAK,CAAC,OAAO;YAAE,MAAM,IAAI,mBAAmB,CAAC,sCAAsC,CAAC,CAAC;QAC1F,OAAO,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC3C,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,iBAAiB,CAAC;gBACpE,QAAQ,EAAE,EAAE,WAAW,EAAE,KAAK,CAAC,QAAQ,EAAE;gBACzC,GAAG,CAAC,KAAK,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,SAAS,EAAE,CAAC;gBACnG,SAAS,EAAE,KAAK;aACjB,CAAC,CAAC;YACH,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YAC/B,WAAW,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;YAC1C,WAAW,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,CAC9B,MAAM,CACJ,IAAI,uBAAuB,CACzB,4CAA4C,KAAK,CAAC,OAAO,EAAE,EAC3D,GAAG,CACJ,CACF,CACF,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,KAA6B;QAC5C,IAAI,KAAK,CAAC,UAAU,KAAK,QAAQ,EAAE,CAAC;YAClC,OAAO,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,UAAU,IAAI,KAAK,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;QACzE,CAAC;QACD,MAAM,GAAG,GAAG,KAAK,CAAC,MAAM,IAAI,IAAI,CAAC,GAAG,CAAC,gBAAgB,CAAC;QACtD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC;YACvC,MAAM,IAAI,kBAAkB,CAAC,6CAA6C,GAAG,EAAE,CAAC,CAAC;QACnF,CAAC;QACD,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,GAAG,GAAG,IAAI,CAAC,CAAC;QACpD,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,YAAY,CAAC;YAC/D,OAAO,EAAE,IAAI;YACb,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,SAAS,CAAC,OAAO,EAAE;SAC7B,CAAC,CAAC;QACH,OAAO,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC;IAC5B,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,KAA0B;QACnC,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,gBAAgB,EAAE,CAAC;IAC5D,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,KAA0B;QACrC,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,CAAC;QAC1E,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,IAAI,uBAAuB,CAC/B,8CAA8C,KAAK,CAAC,OAAO,EAAE,EAC7D,CAAC,CACF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,KAGnB;QACC,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC;QAChD,IAAI,CAAC;YACH,IAAI,KAAK,CAAC,UAAU,KAAK,QAAQ,EAAE,CAAC;gBAClC,MAAM,GAAG,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;YACxD,CAAC;iBAAM,CAAC;gBACN,MAAM,GAAG,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;YAC3C,CAAC;QACH,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,IAAI,uBAAuB,CAC/B,8CAA8C,KAAK,CAAC,OAAO,EAAE,EAC7D,CAAC,CACF,CAAC;QACJ,CAAC;IACH,CAAC;CACF"}

package/dist/backend/services/storage/legacy-resolver.d.ts

@@ -0,0 +1,15 @@
+import type { StorageResolveUrlInput, StorageResolveUrlOutput } from './storage-adapter.js';
+export interface LegacyAssetResolver {
+    resolveUrl(input: StorageResolveUrlInput): StorageResolveUrlOutput;
+}
+/**
+ * Build the resolver for `storage_backend='legacy'` rows on this deployment's
+ * public API origin.
+ *
+ * A factory rather than the module-level constant it used to be, for the same
+ * reason every adapter in this directory takes the origin at construction: the
+ * origin is a deployment fact, and a URL builder that cannot see it is a URL
+ * builder whose answer is relative.
+ */
+export declare function createLegacyAssetResolver(publicApiBaseUrl: string): LegacyAssetResolver;
+//# sourceMappingURL=legacy-resolver.d.ts.map

package/dist/backend/services/storage/legacy-resolver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"legacy-resolver.d.ts","sourceRoot":"","sources":["../../../../src/backend/services/storage/legacy-resolver.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EACV,sBAAsB,EACtB,uBAAuB,EACxB,MAAM,sBAAsB,CAAC;AAI9B,MAAM,WAAW,mBAAmB;IAClC,UAAU,CAAC,KAAK,EAAE,sBAAsB,GAAG,uBAAuB,CAAC;CACpE;AAED;;;;;;;;GAQG;AACH,wBAAgB,yBAAyB,CAAC,gBAAgB,EAAE,MAAM,GAAG,mBAAmB,CASvF"}

package/dist/backend/services/storage/legacy-resolver.js

@@ -0,0 +1,32 @@
+// Legacy locator resolver — handles Asset rows whose `storage_backend='legacy'`
+// because their pre-013 `storage_url` was a URL we don't own. The runtime serves
+// their URLs verbatim for `public`; refuses to flip them to `private` (we cannot
+// sign a URL we didn't issue). See research.md R11.
+//
+// **Verbatim, but absolute** (D-223). A legacy row that carries a full URL is
+// passed through untouched; one that carries a host-relative path — the shape
+// the composition root's `absolutizePublicUrl` used to rescue for two of its
+// four consumers and not for the other two — is rebased here, so the answer no
+// longer depends on which root composed the platform.
+import { LegacyAssetCannotHardenError } from './errors.js';
+import { absolutizeAssetUrl } from './public-url-base.js';
+/**
+ * Build the resolver for `storage_backend='legacy'` rows on this deployment's
+ * public API origin.
+ *
+ * A factory rather than the module-level constant it used to be, for the same
+ * reason every adapter in this directory takes the origin at construction: the
+ * origin is a deployment fact, and a URL builder that cannot see it is a URL
+ * builder whose answer is relative.
+ */
+export function createLegacyAssetResolver(publicApiBaseUrl) {
+    return {
+        resolveUrl(input) {
+            if (input.visibility === 'private') {
+                throw new LegacyAssetCannotHardenError();
+            }
+            return { url: absolutizeAssetUrl(input.locator, publicApiBaseUrl), expiresAt: null };
+        },
+    };
+}
+//# sourceMappingURL=legacy-resolver.js.map

package/dist/backend/services/storage/legacy-resolver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"legacy-resolver.js","sourceRoot":"","sources":["../../../../src/backend/services/storage/legacy-resolver.ts"],"names":[],"mappings":"AAAA,gFAAgF;AAChF,iFAAiF;AACjF,iFAAiF;AACjF,oDAAoD;AACpD,EAAE;AACF,8EAA8E;AAC9E,8EAA8E;AAC9E,6EAA6E;AAC7E,+EAA+E;AAC/E,sDAAsD;AAMtD,OAAO,EAAE,4BAA4B,EAAE,MAAM,aAAa,CAAC;AAC3D,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAM1D;;;;;;;;GAQG;AACH,MAAM,UAAU,yBAAyB,CAAC,gBAAwB;IAChE,OAAO;QACL,UAAU,CAAC,KAA6B;YACtC,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;gBACnC,MAAM,IAAI,4BAA4B,EAAE,CAAC;YAC3C,CAAC;YACD,OAAO,EAAE,GAAG,EAAE,kBAAkB,CAAC,KAAK,CAAC,OAAO,EAAE,gBAAgB,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;QACvF,CAAC;KACF,CAAC;AACJ,CAAC"}