@exabugs/dynamodb-client 1.5.2 → 1.5.3

package/dist/server/media/magicBytes.d.ts

@@ -0,0 +1,25 @@
+/**
+ * マジックナンバー照合
+ *
+ * アップロード時に申告されたcontentTypeが、実際のバイト列と一致するかを検証する
+ * （contentType偽装による無加工配信XSS対策。詳細: docs/media-design.md セキュリティ表#4）。
+ *
+ * 既知の画像形式のみ照合する。既知形式以外（任意の非画像ファイル）は
+ * 「配信時にContent-Disposition: attachmentを付与し、ブラウザに解釈させない」という
+ * 別の対策で守るため、ここでは照合不要（常に一致扱い）とする。
+ */
+/**
+ * 申告されたcontentTypeと実バイト列が一致するか検証する。
+ *
+ * 既知の画像形式についてのみ厳密に照合し、未知のcontentTypeは
+ * （画像として処理されないため）常に一致扱いとする。
+ */
+export declare function verifyMagicBytes(contentType: string, buffer: Buffer): boolean;
+/**
+ * sharpで処理してよい「画像」として扱うかどうか。
+ *
+ * image/svg+xmlは画像だが埋め込みスクリプトのリスクがあるため除外し、
+ * 非画像ファイルと同じ経路（無加工コピー + Content-Disposition: attachment）で扱う。
+ */
+export declare function isProcessableImage(contentType: string): boolean;
+//# sourceMappingURL=magicBytes.d.ts.map

package/dist/server/media/magicBytes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"magicBytes.d.ts","sourceRoot":"","sources":["../../../src/server/media/magicBytes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAiBH;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAW7E;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAE/D"}

package/dist/server/media/magicBytes.js

@@ -0,0 +1,50 @@
+/**
+ * マジックナンバー照合
+ *
+ * アップロード時に申告されたcontentTypeが、実際のバイト列と一致するかを検証する
+ * （contentType偽装による無加工配信XSS対策。詳細: docs/media-design.md セキュリティ表#4）。
+ *
+ * 既知の画像形式のみ照合する。既知形式以外（任意の非画像ファイル）は
+ * 「配信時にContent-Disposition: attachmentを付与し、ブラウザに解釈させない」という
+ * 別の対策で守るため、ここでは照合不要（常に一致扱い）とする。
+ */
+const SIGNATURES = {
+    'image/jpeg': [{ bytes: [0xff, 0xd8, 0xff] }],
+    'image/png': [{ bytes: [0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a] }],
+    'image/gif': [
+        { bytes: [0x47, 0x49, 0x46, 0x38, 0x37, 0x61] },
+        { bytes: [0x47, 0x49, 0x46, 0x38, 0x39, 0x61] },
+    ],
+    'image/webp': [
+        { bytes: [0x52, 0x49, 0x46, 0x46] }, // "RIFF"
+        { bytes: [0x57, 0x45, 0x42, 0x50], offset: 8 }, // "WEBP"
+    ],
+};
+/**
+ * 申告されたcontentTypeと実バイト列が一致するか検証する。
+ *
+ * 既知の画像形式についてのみ厳密に照合し、未知のcontentTypeは
+ * （画像として処理されないため）常に一致扱いとする。
+ */
+export function verifyMagicBytes(contentType, buffer) {
+    const signatures = SIGNATURES[contentType];
+    if (!signatures) {
+        return true;
+    }
+    return signatures.every((sig) => {
+        const offset = sig.offset ?? 0;
+        if (buffer.length < offset + sig.bytes.length)
+            return false;
+        return sig.bytes.every((byte, i) => buffer[offset + i] === byte);
+    });
+}
+/**
+ * sharpで処理してよい「画像」として扱うかどうか。
+ *
+ * image/svg+xmlは画像だが埋め込みスクリプトのリスクがあるため除外し、
+ * 非画像ファイルと同じ経路（無加工コピー + Content-Disposition: attachment）で扱う。
+ */
+export function isProcessableImage(contentType) {
+    return contentType.startsWith('image/') && contentType !== 'image/svg+xml';
+}
+//# sourceMappingURL=magicBytes.js.map

package/dist/server/media/magicBytes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"magicBytes.js","sourceRoot":"","sources":["../../../src/server/media/magicBytes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAIH,MAAM,UAAU,GAAqC;IACnD,YAAY,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC;IAC7C,WAAW,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC;IAC1E,WAAW,EAAE;QACX,EAAE,KAAK,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE;QAC/C,EAAE,KAAK,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE;KAChD;IACD,YAAY,EAAE;QACZ,EAAE,KAAK,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,SAAS;QAC9C,EAAE,KAAK,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,EAAE,SAAS;KAC1D;CACF,CAAC;AAEF;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,WAAmB,EAAE,MAAc;IAClE,MAAM,UAAU,GAAG,UAAU,CAAC,WAAW,CAAC,CAAC;IAC3C,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,UAAU,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;QAC9B,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,IAAI,CAAC,CAAC;QAC/B,IAAI,MAAM,CAAC,MAAM,GAAG,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;QAC5D,OAAO,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;IACnE,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,WAAmB;IACpD,OAAO,WAAW,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,WAAW,KAAK,eAAe,CAAC;AAC7E,CAAC"}

package/dist/server/media/media-handler.d.ts

@@ -0,0 +1,13 @@
+/**
+ * CloudFrontの `/resize/*` ビヘイビア専用オリジン（Lambda Function URL）
+ *
+ * Function URLは `authorization_type: AWS_IAM` で保護し、CloudFrontからのみ
+ * 呼び出せるようにする（詳細: docs/media-design.md、CloudFrontを経由しない
+ * 直接呼び出しによる署名検証の迂回を防ぐため）。
+ *
+ * widthの健全性チェックは「異常値を弾く粗いガード」でよい設計
+ * （署名付きURL必須のため、本来の認可はCloudFront側の署名検証で担保される）。
+ */
+import type { APIGatewayProxyEventV2, APIGatewayProxyStructuredResultV2 } from 'aws-lambda';
+export declare function handler(event: APIGatewayProxyEventV2): Promise<APIGatewayProxyStructuredResultV2>;
+//# sourceMappingURL=media-handler.d.ts.map

package/dist/server/media/media-handler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"media-handler.d.ts","sourceRoot":"","sources":["../../../src/server/media/media-handler.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,KAAK,EAAE,sBAAsB,EAAE,iCAAiC,EAAE,MAAM,YAAY,CAAC;AAoF5F,wBAAsB,OAAO,CAC3B,KAAK,EAAE,sBAAsB,GAC5B,OAAO,CAAC,iCAAiC,CAAC,CAkF5C"}

package/dist/server/media/media-handler.js

@@ -0,0 +1,143 @@
+import sharp from 'sharp';
+import { GetObjectCommand, NoSuchKey, PutObjectCommand, S3Client } from '@aws-sdk/client-s3';
+import { SSMClient } from '@aws-sdk/client-ssm';
+import { createLogger } from '../../shared/index.js';
+import { getImagePolicy } from './ssmParams.js';
+const logger = createLogger({ service: 'media-handler' });
+const s3Client = new S3Client({ region: process.env.AWS_REGION });
+const ssmClient = new SSMClient({ region: process.env.AWS_REGION });
+const MAX_INPUT_PIXELS = 100_000_000;
+const CACHE_CONTROL_IMMUTABLE = 'public, max-age=31536000, immutable';
+const CACHE_CONTROL_NO_STORE = 'no-store';
+function notFoundResponse(message) {
+    return {
+        statusCode: 404,
+        headers: { 'Cache-Control': CACHE_CONTROL_NO_STORE, 'Content-Type': 'text/plain' },
+        body: message,
+    };
+}
+function badRequestResponse(message) {
+    return {
+        statusCode: 400,
+        headers: { 'Cache-Control': CACHE_CONTROL_NO_STORE, 'Content-Type': 'text/plain' },
+        body: message,
+    };
+}
+function imageResponse(body, contentType) {
+    return {
+        statusCode: 200,
+        headers: {
+            'Content-Type': contentType ?? 'application/octet-stream',
+            'Cache-Control': CACHE_CONTROL_IMMUTABLE,
+        },
+        body: body.toString('base64'),
+        isBase64Encoded: true,
+    };
+}
+/** パス（例: /resize/{fileId}）からfileIdを取り出す */
+function extractFileId(rawPath) {
+    return rawPath.replace(/^\/resize\//, '').replace(/^\//, '');
+}
+/**
+ * s3:ListBucketが無いロールでGetObjectが存在しないキーを指すと、S3はNoSuchKey
+ * ではなく403 AccessDeniedを返す（存在確認防止のためのAWS仕様）。IAM側で
+ * ListBucketを許可済みだが、念のためAccessDeniedも「存在しない」として扱う
+ * （IAM設定の将来的な regression に対する防御）。
+ */
+function isNotFoundError(error) {
+    if (error instanceof NoSuchKey)
+        return true;
+    if (error instanceof Error) {
+        const name = error.name;
+        const statusCode = error.$metadata
+            ?.httpStatusCode;
+        return name === 'AccessDenied' || statusCode === 403;
+    }
+    return false;
+}
+async function tryGetFromS3(bucket, key) {
+    try {
+        const result = await s3Client.send(new GetObjectCommand({ Bucket: bucket, Key: key }));
+        const bytes = await result.Body.transformToByteArray();
+        return Buffer.from(bytes);
+    }
+    catch (error) {
+        if (isNotFoundError(error))
+            return undefined;
+        throw error;
+    }
+}
+export async function handler(event) {
+    const requestId = event.requestContext.requestId;
+    const bucket = process.env.MEDIA_BUCKET;
+    const imagePolicyParam = process.env.IMAGE_POLICY_PARAM;
+    if (!bucket || !imagePolicyParam) {
+        logger.error('MEDIA_BUCKET or IMAGE_POLICY_PARAM not configured', { requestId });
+        return { statusCode: 500, body: 'Server misconfiguration' };
+    }
+    const fileId = extractFileId(event.rawPath);
+    if (!fileId) {
+        return badRequestResponse('fileId is required');
+    }
+    const widthParam = event.queryStringParameters?.width;
+    const width = widthParam ? Number(widthParam) : NaN;
+    if (!Number.isInteger(width) || width < 1) {
+        return badRequestResponse(`Invalid width: ${widthParam}`);
+    }
+    let imagePolicy;
+    try {
+        imagePolicy = await getImagePolicy(ssmClient, imagePolicyParam);
+    }
+    catch (error) {
+        logger.error('Failed to load image policy (fail-closed)', {
+            requestId,
+            error: error instanceof Error ? error.message : String(error),
+        });
+        return {
+            statusCode: 500,
+            headers: { 'Cache-Control': CACHE_CONTROL_NO_STORE },
+            body: 'Image policy unavailable',
+        };
+    }
+    if (width > imagePolicy.masterMaxDimension) {
+        return badRequestResponse(`width exceeds masterMaxDimension: ${width}`);
+    }
+    const cacheKey = `cache/${fileId}/${width}`;
+    const cached = await tryGetFromS3(bucket, cacheKey);
+    if (cached) {
+        logger.debug('Cache hit', { requestId, fileId, width });
+        return imageResponse(cached, 'image/jpeg');
+    }
+    const master = await tryGetFromS3(bucket, `master/${fileId}`);
+    if (!master) {
+        return notFoundResponse('Not found');
+    }
+    // リサイズは process-handler がラスター画像として正規化した master（常に
+    // image/jpeg）にのみ適用できる。非画像ファイル・SVGのmasterはオリジナル
+    // バイト列のまま保存されており、sharpで処理すると例外（PDF等）や意図しない
+    // ラスタライズ（SVG）を起こすため、ここで明示的に拒否する。
+    let resized;
+    try {
+        resized = await sharp(master, { limitInputPixels: MAX_INPUT_PIXELS })
+            .resize(width, width, { fit: 'inside', withoutEnlargement: true })
+            .jpeg()
+            .toBuffer();
+    }
+    catch (error) {
+        logger.warn('Resize not applicable (master is not a processable raster image)', {
+            requestId,
+            fileId,
+            error: error instanceof Error ? error.message : String(error),
+        });
+        return badRequestResponse('Resize is not applicable to this file');
+    }
+    await s3Client.send(new PutObjectCommand({
+        Bucket: bucket,
+        Key: cacheKey,
+        Body: resized,
+        ContentType: 'image/jpeg',
+    }));
+    logger.debug('Cache miss, generated resize', { requestId, fileId, width });
+    return imageResponse(resized, 'image/jpeg');
+}
+//# sourceMappingURL=media-handler.js.map

package/dist/server/media/media-handler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"media-handler.js","sourceRoot":"","sources":["../../../src/server/media/media-handler.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,MAAM,OAAO,CAAC;AAE1B,OAAO,EAAE,gBAAgB,EAAE,SAAS,EAAE,gBAAgB,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC7F,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAEhD,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAEhD,MAAM,MAAM,GAAG,YAAY,CAAC,EAAE,OAAO,EAAE,eAAe,EAAE,CAAC,CAAC;AAE1D,MAAM,QAAQ,GAAG,IAAI,QAAQ,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC;AAClE,MAAM,SAAS,GAAG,IAAI,SAAS,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC;AAEpE,MAAM,gBAAgB,GAAG,WAAW,CAAC;AACrC,MAAM,uBAAuB,GAAG,qCAAqC,CAAC;AACtE,MAAM,sBAAsB,GAAG,UAAU,CAAC;AAE1C,SAAS,gBAAgB,CAAC,OAAe;IACvC,OAAO;QACL,UAAU,EAAE,GAAG;QACf,OAAO,EAAE,EAAE,eAAe,EAAE,sBAAsB,EAAE,cAAc,EAAE,YAAY,EAAE;QAClF,IAAI,EAAE,OAAO;KACd,CAAC;AACJ,CAAC;AAED,SAAS,kBAAkB,CAAC,OAAe;IACzC,OAAO;QACL,UAAU,EAAE,GAAG;QACf,OAAO,EAAE,EAAE,eAAe,EAAE,sBAAsB,EAAE,cAAc,EAAE,YAAY,EAAE;QAClF,IAAI,EAAE,OAAO;KACd,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CACpB,IAAY,EACZ,WAA+B;IAE/B,OAAO;QACL,UAAU,EAAE,GAAG;QACf,OAAO,EAAE;YACP,cAAc,EAAE,WAAW,IAAI,0BAA0B;YACzD,eAAe,EAAE,uBAAuB;SACzC;QACD,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAC7B,eAAe,EAAE,IAAI;KACtB,CAAC;AACJ,CAAC;AAED,2CAA2C;AAC3C,SAAS,aAAa,CAAC,OAAe;IACpC,OAAO,OAAO,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AAC/D,CAAC;AAED;;;;;GAKG;AACH,SAAS,eAAe,CAAC,KAAc;IACrC,IAAI,KAAK,YAAY,SAAS;QAAE,OAAO,IAAI,CAAC;IAC5C,IAAI,KAAK,YAAY,KAAK,EAAE,CAAC;QAC3B,MAAM,IAAI,GAAI,KAA2B,CAAC,IAAI,CAAC;QAC/C,MAAM,UAAU,GAAI,KAAqD,CAAC,SAAS;YACjF,EAAE,cAAc,CAAC;QACnB,OAAO,IAAI,KAAK,cAAc,IAAI,UAAU,KAAK,GAAG,CAAC;IACvD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,MAAc,EAAE,GAAW;IACrD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,gBAAgB,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;QACvF,MAAM,KAAK,GAAG,MACZ,MAAM,CAAC,IACR,CAAC,oBAAoB,EAAE,CAAC;QACzB,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC5B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,eAAe,CAAC,KAAK,CAAC;YAAE,OAAO,SAAS,CAAC;QAC7C,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,OAAO,CAC3B,KAA6B;IAE7B,MAAM,SAAS,GAAG,KAAK,CAAC,cAAc,CAAC,SAAS,CAAC;IACjD,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC;IACxC,MAAM,gBAAgB,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC;IAExD,IAAI,CAAC,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACjC,MAAM,CAAC,KAAK,CAAC,mDAAmD,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC;QACjF,OAAO,EAAE,UAAU,EAAE,GAAG,EAAE,IAAI,EAAE,yBAAyB,EAAE,CAAC;IAC9D,CAAC;IAED,MAAM,MAAM,GAAG,aAAa,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC5C,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,kBAAkB,CAAC,oBAAoB,CAAC,CAAC;IAClD,CAAC;IAED,MAAM,UAAU,GAAG,KAAK,CAAC,qBAAqB,EAAE,KAAK,CAAC;IACtD,MAAM,KAAK,GAAG,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IACpD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;QAC1C,OAAO,kBAAkB,CAAC,kBAAkB,UAAU,EAAE,CAAC,CAAC;IAC5D,CAAC;IAED,IAAI,WAAW,CAAC;IAChB,IAAI,CAAC;QACH,WAAW,GAAG,MAAM,cAAc,CAAC,SAAS,EAAE,gBAAgB,CAAC,CAAC;IAClE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,KAAK,CAAC,2CAA2C,EAAE;YACxD,SAAS;YACT,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;SAC9D,CAAC,CAAC;QACH,OAAO;YACL,UAAU,EAAE,GAAG;YACf,OAAO,EAAE,EAAE,eAAe,EAAE,sBAAsB,EAAE;YACpD,IAAI,EAAE,0BAA0B;SACjC,CAAC;IACJ,CAAC;IAED,IAAI,KAAK,GAAG,WAAW,CAAC,kBAAkB,EAAE,CAAC;QAC3C,OAAO,kBAAkB,CAAC,qCAAqC,KAAK,EAAE,CAAC,CAAC;IAC1E,CAAC;IAED,MAAM,QAAQ,GAAG,SAAS,MAAM,IAAI,KAAK,EAAE,CAAC;IAC5C,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IACpD,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QACxD,OAAO,aAAa,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IAC7C,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,MAAM,EAAE,UAAU,MAAM,EAAE,CAAC,CAAC;IAC9D,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,gBAAgB,CAAC,WAAW,CAAC,CAAC;IACvC,CAAC;IAED,kDAAkD;IAClD,+CAA+C;IAC/C,2CAA2C;IAC3C,iCAAiC;IACjC,IAAI,OAAe,CAAC;IACpB,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,KAAK,CAAC,MAAM,EAAE,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,CAAC;aAClE,MAAM,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,GAAG,EAAE,QAAQ,EAAE,kBAAkB,EAAE,IAAI,EAAE,CAAC;aACjE,IAAI,EAAE;aACN,QAAQ,EAAE,CAAC;IAChB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,IAAI,CAAC,kEAAkE,EAAE;YAC9E,SAAS;YACT,MAAM;YACN,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;SAC9D,CAAC,CAAC;QACH,OAAO,kBAAkB,CAAC,uCAAuC,CAAC,CAAC;IACrE,CAAC;IAED,MAAM,QAAQ,CAAC,IAAI,CACjB,IAAI,gBAAgB,CAAC;QACnB,MAAM,EAAE,MAAM;QACd,GAAG,EAAE,QAAQ;QACb,IAAI,EAAE,OAAO;QACb,WAAW,EAAE,YAAY;KAC1B,CAAC,CACH,CAAC;IAEF,MAAM,CAAC,KAAK,CAAC,8BAA8B,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IAC3E,OAAO,aAAa,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;AAC9C,CAAC"}

package/dist/server/media/presign.d.ts

@@ -0,0 +1,9 @@
+import type { PresignedUploadParams, PresignedUploadResult } from './types.js';
+/**
+ * presign付きアップロードURLを発行する
+ *
+ * @throws contentTypeがallowedContentTypesに含まれない場合
+ * @throws fileSizeがmaxUploadSizeを超える場合
+ */
+export declare function generatePresignedUpload(params: PresignedUploadParams): Promise<PresignedUploadResult>;
+//# sourceMappingURL=presign.d.ts.map

package/dist/server/media/presign.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"presign.d.ts","sourceRoot":"","sources":["../../../src/server/media/presign.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AA4B/E;;;;;GAKG;AACH,wBAAsB,uBAAuB,CAC3C,MAAM,EAAE,qBAAqB,GAC5B,OAAO,CAAC,qBAAqB,CAAC,CAwDhC"}

package/dist/server/media/presign.js

@@ -0,0 +1,73 @@
+/**
+ * presign発行（S3 Presigned POST）
+ *
+ * DynamoDBには一切触れない（詳細: docs/media-design.md 設計方針2）。
+ * アップロードされたオブジェクトのメタデータは、クライアントが自由に指定できる値では
+ * なく、ここでpolicyのeq条件として固定した値のみを許可する（サーバー側が値を強制する）。
+ */
+import { ulid } from 'ulid';
+import { createPresignedPost } from '@aws-sdk/s3-presigned-post';
+const DEFAULT_EXPIRES_IN_SECONDS = 300;
+/**
+ * S3はユーザー定義メタデータのキーを常に小文字で保存する（AWS仕様）。
+ * ここで大文字混じりのキーを許可すると、アップロード時に指定したキー名と
+ * process-handlerがHeadObjectで読み戻すキー名が一致しなくなり、呼び出し側の
+ * 権限スコープ判定（例: ownerIdでのフィルタ）がサイレントに失敗する。
+ * 呼び出し側の実装ミスを早期に検出するため、小文字以外のキーは拒否する。
+ */
+const METADATA_KEY_PATTERN = /^[a-z0-9-]+$/;
+function validateMetadataKeys(metadata) {
+    for (const key of Object.keys(metadata)) {
+        if (!METADATA_KEY_PATTERN.test(key)) {
+            throw new Error(`Invalid metadata key "${key}": S3 lowercases metadata keys, so keys must already be ` +
+                `lowercase (and use only [a-z0-9-]) to avoid a silent mismatch after upload`);
+        }
+    }
+}
+/**
+ * presign付きアップロードURLを発行する
+ *
+ * @throws contentTypeがallowedContentTypesに含まれない場合
+ * @throws fileSizeがmaxUploadSizeを超える場合
+ */
+export async function generatePresignedUpload(params) {
+    const { s3Client, bucket, contentType, originalFilename, fileSize, allowedContentTypes, maxUploadSize, metadata, expiresInSeconds, } = params;
+    if (!allowedContentTypes.includes(contentType)) {
+        throw new Error(`Content type not allowed: ${contentType}`);
+    }
+    if (fileSize <= 0 || fileSize > maxUploadSize) {
+        throw new Error(`File size out of range: ${fileSize} (max: ${maxUploadSize})`);
+    }
+    validateMetadataKeys(metadata);
+    const fileId = ulid();
+    const key = `raw/${fileId}`;
+    const conditions = [
+        ['content-length-range', 1, maxUploadSize],
+        { 'Content-Type': contentType },
+    ];
+    const fields = {
+        'Content-Type': contentType,
+    };
+    for (const [metaKey, metaValue] of Object.entries(metadata)) {
+        const fieldName = `x-amz-meta-${metaKey}`;
+        fields[fieldName] = metaValue;
+        conditions.push({ [fieldName]: metaValue });
+    }
+    if (originalFilename) {
+        fields['x-amz-meta-original-filename'] = originalFilename;
+        conditions.push({ 'x-amz-meta-original-filename': originalFilename });
+    }
+    const { url, fields: presignedFields } = await createPresignedPost(s3Client, {
+        Bucket: bucket,
+        Key: key,
+        Conditions: conditions,
+        Fields: fields,
+        Expires: expiresInSeconds ?? DEFAULT_EXPIRES_IN_SECONDS,
+    });
+    return {
+        fileId,
+        uploadUrl: url,
+        fields: presignedFields,
+    };
+}
+//# sourceMappingURL=presign.js.map

package/dist/server/media/presign.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"presign.js","sourceRoot":"","sources":["../../../src/server/media/presign.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAE5B,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AAIjE,MAAM,0BAA0B,GAAG,GAAG,CAAC;AAMvC;;;;;;GAMG;AACH,MAAM,oBAAoB,GAAG,cAAc,CAAC;AAE5C,SAAS,oBAAoB,CAAC,QAAgC;IAC5D,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QACxC,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACpC,MAAM,IAAI,KAAK,CACb,yBAAyB,GAAG,0DAA0D;gBACpF,4EAA4E,CAC/E,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,MAA6B;IAE7B,MAAM,EACJ,QAAQ,EACR,MAAM,EACN,WAAW,EACX,gBAAgB,EAChB,QAAQ,EACR,mBAAmB,EACnB,aAAa,EACb,QAAQ,EACR,gBAAgB,GACjB,GAAG,MAAM,CAAC;IAEX,IAAI,CAAC,mBAAmB,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;QAC/C,MAAM,IAAI,KAAK,CAAC,6BAA6B,WAAW,EAAE,CAAC,CAAC;IAC9D,CAAC;IACD,IAAI,QAAQ,IAAI,CAAC,IAAI,QAAQ,GAAG,aAAa,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CAAC,2BAA2B,QAAQ,UAAU,aAAa,GAAG,CAAC,CAAC;IACjF,CAAC;IACD,oBAAoB,CAAC,QAAQ,CAAC,CAAC;IAE/B,MAAM,MAAM,GAAG,IAAI,EAAE,CAAC;IACtB,MAAM,GAAG,GAAG,OAAO,MAAM,EAAE,CAAC;IAE5B,MAAM,UAAU,GAAuB;QACrC,CAAC,sBAAsB,EAAE,CAAC,EAAE,aAAa,CAAC;QAC1C,EAAE,cAAc,EAAE,WAAW,EAAE;KAChC,CAAC;IACF,MAAM,MAAM,GAA2B;QACrC,cAAc,EAAE,WAAW;KAC5B,CAAC;IAEF,KAAK,MAAM,CAAC,OAAO,EAAE,SAAS,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC5D,MAAM,SAAS,GAAG,cAAc,OAAO,EAAE,CAAC;QAC1C,MAAM,CAAC,SAAS,CAAC,GAAG,SAAS,CAAC;QAC9B,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC;IAC9C,CAAC;IAED,IAAI,gBAAgB,EAAE,CAAC;QACrB,MAAM,CAAC,8BAA8B,CAAC,GAAG,gBAAgB,CAAC;QAC1D,UAAU,CAAC,IAAI,CAAC,EAAE,8BAA8B,EAAE,gBAAgB,EAAE,CAAC,CAAC;IACxE,CAAC;IAED,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,eAAe,EAAE,GAAG,MAAM,mBAAmB,CAAC,QAAQ,EAAE;QAC3E,MAAM,EAAE,MAAM;QACd,GAAG,EAAE,GAAG;QACR,UAAU,EAAE,UAAU;QACtB,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,gBAAgB,IAAI,0BAA0B;KACxD,CAAC,CAAC;IAEH,OAAO;QACL,MAAM;QACN,SAAS,EAAE,GAAG;QACd,MAAM,EAAE,eAAe;KACxB,CAAC;AACJ,CAAC"}

package/dist/server/media/process-handler-dlq.d.ts

@@ -0,0 +1,16 @@
+/**
+ * process-handler の失敗（Lambda非同期呼び出しのリトライが尽きた場合）を
+ * 受け取るDLQ（SQS）ハンドラー
+ *
+ * process-handler本体が例外を投げ続けてLambdaのリトライが尽きると、
+ * on-failure宛先として設定したこのSQSキューにメッセージが送られる。
+ * ここでは呼び出し側に「処理が永久に終わらない」状態（クライアントが
+ * 無限ポーリングし続ける）を解消するため、status:'failed'レコードを書き込む。
+ *
+ * 上書き防止: S3イベントの重複配信により、process-handler本体が先に
+ * completedを書き込んだ後にDLQ経由の古いリトライがfailedで上書きする
+ * 可能性があるため、書き込み前に既存レコードを確認する。
+ */
+import type { SQSHandler } from 'aws-lambda';
+export declare const handler: SQSHandler;
+//# sourceMappingURL=process-handler-dlq.d.ts.map

package/dist/server/media/process-handler-dlq.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"process-handler-dlq.d.ts","sourceRoot":"","sources":["../../../src/server/media/process-handler-dlq.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,KAAK,EAAY,UAAU,EAAE,MAAM,YAAY,CAAC;AAwEvD,eAAO,MAAM,OAAO,EAAE,UAIrB,CAAC"}

package/dist/server/media/process-handler-dlq.js

@@ -0,0 +1,52 @@
+import { createLogger } from '../../shared/index.js';
+import { handleFindMany } from '../operations/findMany.js';
+import { handleUpdateOne } from '../operations/updateOne.js';
+const logger = createLogger({ service: 'media-process-handler-dlq' });
+function extractFileId(envelope) {
+    const key = envelope.requestPayload?.Records?.[0]?.s3?.object?.key;
+    if (!key)
+        return undefined;
+    return decodeURIComponent(key.replace(/\+/g, ' ')).replace(/^raw\//, '');
+}
+async function processMessage(body) {
+    let envelope;
+    try {
+        envelope = JSON.parse(body);
+    }
+    catch {
+        logger.error('DLQ message is not valid JSON', { body });
+        return;
+    }
+    const fileId = extractFileId(envelope);
+    if (!fileId) {
+        logger.error('Could not extract fileId from DLQ message', { envelope });
+        return;
+    }
+    const requestId = `dlq-${fileId}`;
+    const existing = await handleFindMany('media', { ids: [fileId] }, requestId);
+    const existingRecord = existing[0];
+    if (existingRecord?.status === 'completed') {
+        logger.info('Media already completed, skipping DLQ failure write', { requestId, fileId });
+        return;
+    }
+    const now = new Date().toISOString();
+    await handleUpdateOne('media', {
+        id: fileId,
+        data: {
+            $set: {
+                status: 'failed',
+                error: 'Processing failed after exhausting retries',
+                updatedAt: now,
+            },
+            $setOnInsert: { createdAt: now },
+        },
+        options: { upsert: true },
+    }, requestId);
+    logger.warn('Media marked as failed via DLQ', { requestId, fileId });
+}
+export const handler = async (event) => {
+    for (const record of event.Records) {
+        await processMessage(record.body);
+    }
+};
+//# sourceMappingURL=process-handler-dlq.js.map

package/dist/server/media/process-handler-dlq.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"process-handler-dlq.js","sourceRoot":"","sources":["../../../src/server/media/process-handler-dlq.ts"],"names":[],"mappings":"AAeA,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAC3D,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAG7D,MAAM,MAAM,GAAG,YAAY,CAAC,EAAE,OAAO,EAAE,2BAA2B,EAAE,CAAC,CAAC;AActE,SAAS,aAAa,CAAC,QAAwC;IAC7D,MAAM,GAAG,GAAG,QAAQ,CAAC,cAAc,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC;IACnE,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC;IAC3B,OAAO,kBAAkB,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;AAC3E,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,IAAY;IACxC,IAAI,QAAwC,CAAC;IAC7C,IAAI,CAAC;QACH,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,CAAC,KAAK,CAAC,+BAA+B,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QACxD,OAAO;IACT,CAAC;IAED,MAAM,MAAM,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;IACvC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,CAAC,KAAK,CAAC,2CAA2C,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;QACxE,OAAO;IACT,CAAC;IAED,MAAM,SAAS,GAAG,OAAO,MAAM,EAAE,CAAC;IAElC,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,OAAO,EAAE,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;IAC7E,MAAM,cAAc,GAAG,QAAQ,CAAC,CAAC,CAA4B,CAAC;IAC9D,IAAI,cAAc,EAAE,MAAM,KAAK,WAAW,EAAE,CAAC;QAC3C,MAAM,CAAC,IAAI,CAAC,qDAAqD,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;QAC1F,OAAO;IACT,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACrC,MAAM,eAAe,CACnB,OAAO,EACP;QACE,EAAE,EAAE,MAAM;QACV,IAAI,EAAE;YACJ,IAAI,EAAE;gBACJ,MAAM,EAAE,QAAQ;gBAChB,KAAK,EAAE,4CAA4C;gBACnD,SAAS,EAAE,GAAG;aACf;YACD,YAAY,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE;SACjC;QACD,OAAO,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE;KAC1B,EACD,SAAS,CACV,CAAC;IAEF,MAAM,CAAC,IAAI,CAAC,gCAAgC,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;AACvE,CAAC;AAED,MAAM,CAAC,MAAM,OAAO,GAAe,KAAK,EAAE,KAAe,EAAiB,EAAE;IAC1E,KAAK,MAAM,MAAM,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QACnC,MAAM,cAAc,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACpC,CAAC;AACH,CAAC,CAAC"}

package/dist/server/media/process-handler.d.ts

@@ -0,0 +1,12 @@
+/**
+ * S3 ObjectCreated（raw/*）イベントハンドラー
+ *
+ * アップロードされたファイルを検証・処理し、masterとしてS3に配置した上で
+ * 呼び出し側の既存テーブルにMediaRecordを作成/更新する（詳細: docs/media-design.md）。
+ *
+ * presign発行時点ではDynamoDBに一切触れない設計のため、DynamoDBレコードが
+ * 作られるのはこのハンドラーが成功した時点が初めて。
+ */
+import type { S3Handler } from 'aws-lambda';
+export declare const handler: S3Handler;
+//# sourceMappingURL=process-handler.d.ts.map

package/dist/server/media/process-handler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"process-handler.d.ts","sourceRoot":"","sources":["../../../src/server/media/process-handler.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,KAAK,EAAW,SAAS,EAAE,MAAM,YAAY,CAAC;AA8KrD,eAAO,MAAM,OAAO,EAAE,SAgBrB,CAAC"}

package/dist/server/media/process-handler.js

@@ -0,0 +1,138 @@
+import sharp from 'sharp';
+import { CopyObjectCommand, GetObjectCommand, HeadObjectCommand, PutObjectCommand, S3Client, } from '@aws-sdk/client-s3';
+import { SSMClient } from '@aws-sdk/client-ssm';
+import { createLogger } from '../../shared/index.js';
+import { handleUpdateOne } from '../operations/updateOne.js';
+import { isProcessableImage, verifyMagicBytes } from './magicBytes.js';
+import { getImagePolicy } from './ssmParams.js';
+const logger = createLogger({ service: 'media-process-handler' });
+const s3Client = new S3Client({ region: process.env.AWS_REGION });
+const ssmClient = new SSMClient({ region: process.env.AWS_REGION });
+/** sharp のDoS対策（極端に大きい画素数の画像を拒否） */
+const MAX_INPUT_PIXELS = 100_000_000;
+/** メディアレコードに持ち込まないS3メタデータキー（original-filenameは専用フィールドとして扱う） */
+const RESERVED_METADATA_KEYS = new Set(['original-filename']);
+/**
+ * S3オブジェクトメタデータ（x-amz-meta-プレフィックスを除いた小文字キー）から、
+ * アプリ固有の追加フィールドのみを抽出する。
+ */
+function extractAppMetadata(metadata) {
+    const result = {};
+    for (const [key, value] of Object.entries(metadata)) {
+        if (!RESERVED_METADATA_KEYS.has(key)) {
+            result[key] = value;
+        }
+    }
+    return result;
+}
+/** Content-Dispositionのfilenameパラメータに安全に埋め込めるよう制御文字・ダブルクォートを除去する */
+function sanitizeFilenameForHeader(filename) {
+    return filename.replace(/["\r\n]/g, '');
+}
+async function streamToBuffer(body) {
+    const bytes = await body.transformToByteArray();
+    return Buffer.from(bytes);
+}
+async function writeMediaRecord(fileId, fields, requestId) {
+    const now = new Date().toISOString();
+    await handleUpdateOne('media', {
+        id: fileId,
+        data: {
+            $set: { ...fields, updatedAt: now },
+            $setOnInsert: { createdAt: now },
+        },
+        options: { upsert: true },
+    }, requestId);
+}
+async function processRecord(bucket, rawKey) {
+    const key = decodeURIComponent(rawKey.replace(/\+/g, ' '));
+    const fileId = key.replace(/^raw\//, '');
+    const requestId = `s3-event-${fileId}`;
+    const head = await s3Client.send(new HeadObjectCommand({ Bucket: bucket, Key: key }));
+    const contentType = head.ContentType || 'application/octet-stream';
+    const metadata = head.Metadata || {};
+    const originalFilename = metadata['original-filename'];
+    const getResult = await s3Client.send(new GetObjectCommand({ Bucket: bucket, Key: key }));
+    const buffer = await streamToBuffer(getResult.Body);
+    if (!verifyMagicBytes(contentType, buffer)) {
+        logger.warn('Content type does not match file signature', { requestId, fileId, contentType });
+        await writeMediaRecord(fileId, {
+            status: 'failed',
+            contentType,
+            error: 'Content type does not match file signature',
+        }, requestId);
+        return;
+    }
+    const masterKey = `master/${fileId}`;
+    const appMetadata = extractAppMetadata(metadata);
+    if (isProcessableImage(contentType)) {
+        const imagePolicyParam = process.env.IMAGE_POLICY_PARAM;
+        if (!imagePolicyParam) {
+            throw new Error('IMAGE_POLICY_PARAM environment variable is not set');
+        }
+        const imagePolicy = await getImagePolicy(ssmClient, imagePolicyParam);
+        const image = sharp(buffer, { limitInputPixels: MAX_INPUT_PIXELS }).rotate();
+        const inputMeta = await image.metadata();
+        const maxDim = imagePolicy.masterMaxDimension;
+        if ((inputMeta.width ?? 0) > maxDim || (inputMeta.height ?? 0) > maxDim) {
+            image.resize(maxDim, maxDim, { fit: 'inside', withoutEnlargement: true });
+        }
+        const outputBuffer = await image.jpeg().toBuffer();
+        const outputMeta = await sharp(outputBuffer).metadata();
+        await s3Client.send(new PutObjectCommand({
+            Bucket: bucket,
+            Key: masterKey,
+            Body: outputBuffer,
+            ContentType: 'image/jpeg',
+        }));
+        await writeMediaRecord(fileId, {
+            status: 'completed',
+            contentType,
+            outputContentType: 'image/jpeg',
+            dimensions: { width: outputMeta.width ?? 0, height: outputMeta.height ?? 0 },
+            size: outputBuffer.length,
+            ...(originalFilename ? { originalFilename } : {}),
+            ...appMetadata,
+        }, requestId);
+    }
+    else {
+        await s3Client.send(new CopyObjectCommand({
+            Bucket: bucket,
+            Key: masterKey,
+            CopySource: `${bucket}/${key}`,
+            MetadataDirective: 'REPLACE',
+            ContentType: contentType,
+            ContentDisposition: originalFilename
+                ? `attachment; filename="${sanitizeFilenameForHeader(originalFilename)}"`
+                : 'attachment',
+        }));
+        await writeMediaRecord(fileId, {
+            status: 'completed',
+            contentType,
+            outputContentType: contentType,
+            size: head.ContentLength ?? buffer.length,
+            ...(originalFilename ? { originalFilename } : {}),
+            ...appMetadata,
+        }, requestId);
+    }
+    logger.info('Media processed', { requestId, fileId, contentType });
+}
+export const handler = async (event) => {
+    for (const record of event.Records) {
+        const bucket = record.s3.bucket.name;
+        const key = record.s3.object.key;
+        try {
+            await processRecord(bucket, key);
+        }
+        catch (error) {
+            logger.error('Failed to process media', {
+                bucket,
+                key,
+                error: error instanceof Error ? error.message : String(error),
+            });
+            // 再スロー: Lambda非同期呼び出しのリトライに乗せ、尽きたらon-failure宛先（DLQ）へ送る
+            throw error;
+        }
+    }
+};
+//# sourceMappingURL=process-handler.js.map

package/dist/server/media/process-handler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"process-handler.js","sourceRoot":"","sources":["../../../src/server/media/process-handler.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,MAAM,OAAO,CAAC;AAE1B,OAAO,EACL,iBAAiB,EACjB,gBAAgB,EAChB,iBAAiB,EACjB,gBAAgB,EAChB,QAAQ,GACT,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAEhD,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACvE,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAEhD,MAAM,MAAM,GAAG,YAAY,CAAC,EAAE,OAAO,EAAE,uBAAuB,EAAE,CAAC,CAAC;AAElE,MAAM,QAAQ,GAAG,IAAI,QAAQ,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC;AAClE,MAAM,SAAS,GAAG,IAAI,SAAS,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC;AAEpE,oCAAoC;AACpC,MAAM,gBAAgB,GAAG,WAAW,CAAC;AAErC,+DAA+D;AAC/D,MAAM,sBAAsB,GAAG,IAAI,GAAG,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC;AAE9D;;;GAGG;AACH,SAAS,kBAAkB,CAAC,QAAgC;IAC1D,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QACpD,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACrC,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QACtB,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,oEAAoE;AACpE,SAAS,yBAAyB,CAAC,QAAgB;IACjD,OAAO,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;AAC1C,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,IAAa;IACzC,MAAM,KAAK,GAAG,MACZ,IACD,CAAC,oBAAoB,EAAE,CAAC;IACzB,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC5B,CAAC;AAED,KAAK,UAAU,gBAAgB,CAC7B,MAAc,EACd,MAA+B,EAC/B,SAAiB;IAEjB,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACrC,MAAM,eAAe,CACnB,OAAO,EACP;QACE,EAAE,EAAE,MAAM;QACV,IAAI,EAAE;YACJ,IAAI,EAAE,EAAE,GAAG,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE;YACnC,YAAY,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE;SACjC;QACD,OAAO,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE;KAC1B,EACD,SAAS,CACV,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,MAAc,EAAE,MAAc;IACzD,MAAM,GAAG,GAAG,kBAAkB,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;IAC3D,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;IACzC,MAAM,SAAS,GAAG,YAAY,MAAM,EAAE,CAAC;IAEvC,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,iBAAiB,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;IACtF,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,0BAA0B,CAAC;IACnE,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC;IACrC,MAAM,gBAAgB,GAAG,QAAQ,CAAC,mBAAmB,CAAC,CAAC;IAEvD,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,gBAAgB,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;IAC1F,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IAEpD,IAAI,CAAC,gBAAgB,CAAC,WAAW,EAAE,MAAM,CAAC,EAAE,CAAC;QAC3C,MAAM,CAAC,IAAI,CAAC,4CAA4C,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;QAC9F,MAAM,gBAAgB,CACpB,MAAM,EACN;YACE,MAAM,EAAE,QAAQ;YAChB,WAAW;YACX,KAAK,EAAE,4CAA4C;SACpD,EACD,SAAS,CACV,CAAC;QACF,OAAO;IACT,CAAC;IAED,MAAM,SAAS,GAAG,UAAU,MAAM,EAAE,CAAC;IACrC,MAAM,WAAW,GAAG,kBAAkB,CAAC,QAAQ,CAAC,CAAC;IAEjD,IAAI,kBAAkB,CAAC,WAAW,CAAC,EAAE,CAAC;QACpC,MAAM,gBAAgB,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC;QACxD,IAAI,CAAC,gBAAgB,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;QACxE,CAAC;QACD,MAAM,WAAW,GAAG,MAAM,cAAc,CAAC,SAAS,EAAE,gBAAgB,CAAC,CAAC;QAEtE,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;QAC7E,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC,QAAQ,EAAE,CAAC;QACzC,MAAM,MAAM,GAAG,WAAW,CAAC,kBAAkB,CAAC;QAC9C,IAAI,CAAC,SAAS,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,MAAM,IAAI,CAAC,CAAC,GAAG,MAAM,EAAE,CAAC;YACxE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,QAAQ,EAAE,kBAAkB,EAAE,IAAI,EAAE,CAAC,CAAC;QAC5E,CAAC;QAED,MAAM,YAAY,GAAG,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC;QACnD,MAAM,UAAU,GAAG,MAAM,KAAK,CAAC,YAAY,CAAC,CAAC,QAAQ,EAAE,CAAC;QAExD,MAAM,QAAQ,CAAC,IAAI,CACjB,IAAI,gBAAgB,CAAC;YACnB,MAAM,EAAE,MAAM;YACd,GAAG,EAAE,SAAS;YACd,IAAI,EAAE,YAAY;YAClB,WAAW,EAAE,YAAY;SAC1B,CAAC,CACH,CAAC;QAEF,MAAM,gBAAgB,CACpB,MAAM,EACN;YACE,MAAM,EAAE,WAAW;YACnB,WAAW;YACX,iBAAiB,EAAE,YAAY;YAC/B,UAAU,EAAE,EAAE,KAAK,EAAE,UAAU,CAAC,KAAK,IAAI,CAAC,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,IAAI,CAAC,EAAE;YAC5E,IAAI,EAAE,YAAY,CAAC,MAAM;YACzB,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACjD,GAAG,WAAW;SACf,EACD,SAAS,CACV,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,MAAM,QAAQ,CAAC,IAAI,CACjB,IAAI,iBAAiB,CAAC;YACpB,MAAM,EAAE,MAAM;YACd,GAAG,EAAE,SAAS;YACd,UAAU,EAAE,GAAG,MAAM,IAAI,GAAG,EAAE;YAC9B,iBAAiB,EAAE,SAAS;YAC5B,WAAW,EAAE,WAAW;YACxB,kBAAkB,EAAE,gBAAgB;gBAClC,CAAC,CAAC,yBAAyB,yBAAyB,CAAC,gBAAgB,CAAC,GAAG;gBACzE,CAAC,CAAC,YAAY;SACjB,CAAC,CACH,CAAC;QAEF,MAAM,gBAAgB,CACpB,MAAM,EACN;YACE,MAAM,EAAE,WAAW;YACnB,WAAW;YACX,iBAAiB,EAAE,WAAW;YAC9B,IAAI,EAAE,IAAI,CAAC,aAAa,IAAI,MAAM,CAAC,MAAM;YACzC,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACjD,GAAG,WAAW;SACf,EACD,SAAS,CACV,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,IAAI,CAAC,iBAAiB,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;AACrE,CAAC;AAED,MAAM,CAAC,MAAM,OAAO,GAAc,KAAK,EAAE,KAAc,EAAiB,EAAE;IACxE,KAAK,MAAM,MAAM,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QACnC,MAAM,MAAM,GAAG,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC;QACrC,MAAM,GAAG,GAAG,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC;QACjC,IAAI,CAAC;YACH,MAAM,aAAa,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QACnC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CAAC,yBAAyB,EAAE;gBACtC,MAAM;gBACN,GAAG;gBACH,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;aAC9D,CAAC,CAAC;YACH,uDAAuD;YACvD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;AACH,CAAC,CAAC"}

package/dist/server/media/sign.d.ts

@@ -0,0 +1,11 @@
+import type { SignMediaUrlParams, SignMediaUrlResult } from './types.js';
+/**
+ * メディア配信用の署名付きURLを生成する。
+ *
+ * width指定時は /resize/{fileId}?width=N、省略時は /master/{fileId} に署名する
+ * （呼び出し元が具体的な幅を決めてから呼ぶこと。ワイルドカード署名はしない）。
+ *
+ * 秘密鍵の取得はこの関数の責務外（引数で受け取るだけ）。
+ */
+export declare function signMediaUrl(params: SignMediaUrlParams): SignMediaUrlResult;
+//# sourceMappingURL=sign.d.ts.map

package/dist/server/media/sign.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sign.d.ts","sourceRoot":"","sources":["../../../src/server/media/sign.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAmBzE;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,kBAAkB,GAAG,kBAAkB,CAqB3E"}