@exabugs/dynamodb-client 1.5.3 → 1.6.0

package/dist/server/media/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/server/media/types.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAEnD;;;;;GAKG;AACH,MAAM,MAAM,WAAW,GAAG,WAAW,GAAG,QAAQ,CAAC;AAEjD;;;;;GAKG;AACH,MAAM,WAAW,WAAW;IAC1B,mBAAmB;IACnB,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,WAAW,CAAC;IACpB,qCAAqC;IACrC,WAAW,EAAE,MAAM,CAAC;IACpB;;;OAGG;IACH,iBAAiB,EAAE,MAAM,CAAC;IAC1B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,yBAAyB;IACzB,UAAU,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAC/C,0BAA0B;IAC1B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,WAAW;IAC1B,uEAAuE;IACvE,kBAAkB,EAAE,MAAM,CAAC;IAC3B,6BAA6B;IAC7B,mBAAmB,EAAE,MAAM,EAAE,CAAC;IAC9B,oCAAoC;IACpC,aAAa,EAAE,MAAM,CAAC;CACvB;AAED;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC,QAAQ,EAAE,QAAQ,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,mBAAmB,EAAE,MAAM,EAAE,CAAC;IAC9B,aAAa,EAAE,MAAM,CAAC;IACtB,qDAAqD;IACrD,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,sCAAsC;IACtC,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAChC;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,MAAM,CAAC;IACf,gEAAgE;IAChE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,uCAAuC;IACvC,gBAAgB,EAAE,MAAM,CAAC;CAC1B;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,yCAAyC;IACzC,SAAS,EAAE,MAAM,CAAC;CACnB"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/server/media/types.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAEnD;;;;;GAKG;AACH,MAAM,MAAM,WAAW,GAAG,WAAW,GAAG,QAAQ,CAAC;AAEjD;;;;;GAKG;AACH,MAAM,WAAW,WAAW;IAC1B,mBAAmB;IACnB,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,WAAW,CAAC;IACpB,qCAAqC;IACrC,WAAW,EAAE,MAAM,CAAC;IACpB;;;OAGG;IACH,iBAAiB,EAAE,MAAM,CAAC;IAC1B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,yBAAyB;IACzB,UAAU,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAC/C,0BAA0B;IAC1B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,WAAW;IAC1B,uEAAuE;IACvE,kBAAkB,EAAE,MAAM,CAAC;IAC3B,6BAA6B;IAC7B,mBAAmB,EAAE,MAAM,EAAE,CAAC;IAC9B,oCAAoC;IACpC,aAAa,EAAE,MAAM,CAAC;CACvB;AAED;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC,QAAQ,EAAE,QAAQ,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,mBAAmB,EAAE,MAAM,EAAE,CAAC;IAC9B,aAAa,EAAE,MAAM,CAAC;IACtB,qDAAqD;IACrD,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,mDAAmD;IACnD,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAChC;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,MAAM,CAAC;IACf,gEAAgE;IAChE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,uCAAuC;IACvC,gBAAgB,EAAE,MAAM,CAAC;CAC1B;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,yCAAyC;IACzC,SAAS,EAAE,MAAM,CAAC;CACnB"}

package/dist/server/media/upload-handler.d.ts

@@ -0,0 +1,50 @@
+/**
+ * presign発行・署名付きURL発行を扱うLambda Function URL用ハンドラー（標準実装）
+ *
+ * 「誰にpresign/署名URLを発行してよいか」の判断はこのライブラリの関心事ではない
+ * （詳細: docs/media-design.md）。このハンドラーは`authorize`フックを通じて
+ * 呼び出し側アプリの認証・認可ロジックを注入できるようにする。
+ *
+ * より高度な認可（例: リソース単位の権限チェック）が必要な場合、呼び出し側は
+ * このハンドラーを使わず、`./presign.js`・`./sign.js`を自前のルーティング・
+ * 認可レイヤーから直接呼び出すこともできる。
+ */
+import type { APIGatewayProxyEventV2, APIGatewayProxyStructuredResultV2 } from 'aws-lambda';
+import { S3Client } from '@aws-sdk/client-s3';
+import { SSMClient } from '@aws-sdk/client-ssm';
+/**
+ * リクエストを認可し、presign発行時にpolicyへ固定するメタデータを返す。
+ * 認可できない場合はnullを返す（401を返す）。
+ */
+export type AuthorizeFn = (event: APIGatewayProxyEventV2) => Promise<Record<string, string> | null>;
+export interface UploadHandlerConfig {
+    bucket: string;
+    imagePolicyParam: string;
+    signingPrivateKeyParam: string;
+    keyPairId: string;
+    baseUrl: string;
+    authorize: AuthorizeFn;
+    signExpiresInSeconds?: number;
+    s3Client?: S3Client;
+    ssmClient?: SSMClient;
+}
+/**
+ * 設定を注入してLambda Function URLハンドラーを生成する。
+ *
+ * @example
+ * ```ts
+ * export const handler = createUploadHandler({
+ *   bucket: process.env.MEDIA_BUCKET!,
+ *   imagePolicyParam: process.env.IMAGE_POLICY_PARAM!,
+ *   signingPrivateKeyParam: process.env.SIGNING_PRIVATE_KEY_PARAM!,
+ *   keyPairId: process.env.CLOUDFRONT_KEY_PAIR_ID!,
+ *   baseUrl: process.env.MEDIA_BASE_URL!,
+ *   authorize: async (event) => {
+ *     const userId = await verifyMyAppJwt(event.headers.authorization);
+ *     return userId ? { ownerId: userId } : null;
+ *   },
+ * });
+ * ```
+ */
+export declare function createUploadHandler(config: UploadHandlerConfig): (event: APIGatewayProxyEventV2) => Promise<APIGatewayProxyStructuredResultV2>;
+//# sourceMappingURL=upload-handler.d.ts.map

package/dist/server/media/upload-handler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"upload-handler.d.ts","sourceRoot":"","sources":["../../../src/server/media/upload-handler.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,KAAK,EAAE,sBAAsB,EAAE,iCAAiC,EAAE,MAAM,YAAY,CAAC;AAE5F,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAWhD;;;GAGG;AACH,MAAM,MAAM,WAAW,GAAG,CAAC,KAAK,EAAE,sBAAsB,KAAK,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC;AAEpG,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,gBAAgB,EAAE,MAAM,CAAC;IACzB,sBAAsB,EAAE,MAAM,CAAC;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,WAAW,CAAC;IACvB,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB,SAAS,CAAC,EAAE,SAAS,CAAC;CACvB;AA0FD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,mBAAmB,GAC1B,CAAC,KAAK,EAAE,sBAAsB,KAAK,OAAO,CAAC,iCAAiC,CAAC,CAiC/E"}

package/dist/server/media/upload-handler.js

@@ -0,0 +1,115 @@
+import { S3Client } from '@aws-sdk/client-s3';
+import { SSMClient } from '@aws-sdk/client-ssm';
+import { createLogger } from '../../shared/index.js';
+import { generatePresignedUpload } from './presign.js';
+import { signMediaUrl } from './sign.js';
+import { getImagePolicy, getSigningPrivateKey } from './ssmParams.js';
+const logger = createLogger({ service: 'media-upload-handler' });
+const DEFAULT_SIGN_EXPIRES_IN_SECONDS = 3600;
+function jsonResponse(statusCode, body) {
+    return {
+        statusCode,
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify(body),
+    };
+}
+function parseBody(event) {
+    if (!event.body)
+        return {};
+    const raw = event.isBase64Encoded
+        ? Buffer.from(event.body, 'base64').toString('utf-8')
+        : event.body;
+    return JSON.parse(raw);
+}
+async function handlePresign(event, config, s3Client, ssmClient, metadata, requestId) {
+    const body = parseBody(event);
+    if (!body.contentType || !body.fileSize) {
+        return jsonResponse(400, { error: 'contentType and fileSize are required' });
+    }
+    const imagePolicy = await getImagePolicy(ssmClient, config.imagePolicyParam);
+    const result = await generatePresignedUpload({
+        s3Client,
+        bucket: config.bucket,
+        contentType: body.contentType,
+        originalFilename: body.originalFilename,
+        fileSize: body.fileSize,
+        allowedContentTypes: imagePolicy.allowedContentTypes,
+        maxUploadSize: imagePolicy.maxUploadSize,
+        metadata,
+    });
+    logger.info('Presign issued', { requestId, fileId: result.fileId });
+    return jsonResponse(200, result);
+}
+async function handleSign(event, config, ssmClient, requestId) {
+    const body = parseBody(event);
+    if (!Array.isArray(body.items) || body.items.length === 0) {
+        return jsonResponse(400, { error: 'items is required and must be non-empty' });
+    }
+    const privateKey = await getSigningPrivateKey(ssmClient, config.signingPrivateKeyParam);
+    const expiresInSeconds = config.signExpiresInSeconds ?? DEFAULT_SIGN_EXPIRES_IN_SECONDS;
+    const items = body.items.map((item) => {
+        if (!item.fileId) {
+            throw new Error('Each item must have fileId');
+        }
+        return signMediaUrl({
+            fileId: item.fileId,
+            width: item.width,
+            keyPairId: config.keyPairId,
+            privateKey,
+            baseUrl: config.baseUrl,
+            expiresInSeconds,
+        });
+    });
+    logger.info('Media URLs signed', { requestId, count: items.length });
+    return jsonResponse(200, { items });
+}
+/**
+ * 設定を注入してLambda Function URLハンドラーを生成する。
+ *
+ * @example
+ * ```ts
+ * export const handler = createUploadHandler({
+ *   bucket: process.env.MEDIA_BUCKET!,
+ *   imagePolicyParam: process.env.IMAGE_POLICY_PARAM!,
+ *   signingPrivateKeyParam: process.env.SIGNING_PRIVATE_KEY_PARAM!,
+ *   keyPairId: process.env.CLOUDFRONT_KEY_PAIR_ID!,
+ *   baseUrl: process.env.MEDIA_BASE_URL!,
+ *   authorize: async (event) => {
+ *     const userId = await verifyMyAppJwt(event.headers.authorization);
+ *     return userId ? { ownerId: userId } : null;
+ *   },
+ * });
+ * ```
+ */
+export function createUploadHandler(config) {
+    const s3Client = config.s3Client ?? new S3Client({ region: process.env.AWS_REGION });
+    const ssmClient = config.ssmClient ?? new SSMClient({ region: process.env.AWS_REGION });
+    return async (event) => {
+        const requestId = event.requestContext.requestId;
+        const method = event.requestContext.http.method;
+        const path = event.rawPath;
+        try {
+            const metadata = await config.authorize(event);
+            if (!metadata) {
+                return jsonResponse(401, { error: 'Unauthorized' });
+            }
+            if (method === 'POST' && path.endsWith('/presign')) {
+                return await handlePresign(event, config, s3Client, ssmClient, metadata, requestId);
+            }
+            if (method === 'POST' && path.endsWith('/sign')) {
+                return await handleSign(event, config, ssmClient, requestId);
+            }
+            return jsonResponse(404, { error: 'Not found' });
+        }
+        catch (error) {
+            logger.error('Upload handler error', {
+                requestId,
+                error: error instanceof Error ? error.message : String(error),
+            });
+            return jsonResponse(400, {
+                error: error instanceof Error ? error.message : 'Bad request',
+            });
+        }
+    };
+}
+//# sourceMappingURL=upload-handler.js.map

package/dist/server/media/upload-handler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"upload-handler.js","sourceRoot":"","sources":["../../../src/server/media/upload-handler.ts"],"names":[],"mappings":"AAaA,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAEhD,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,EAAE,uBAAuB,EAAE,MAAM,cAAc,CAAC;AACvD,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,EAAE,cAAc,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AAEtE,MAAM,MAAM,GAAG,YAAY,CAAC,EAAE,OAAO,EAAE,sBAAsB,EAAE,CAAC,CAAC;AAEjE,MAAM,+BAA+B,GAAG,IAAI,CAAC;AA8B7C,SAAS,YAAY,CAAC,UAAkB,EAAE,IAAa;IACrD,OAAO;QACL,UAAU;QACV,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;KAC3B,CAAC;AACJ,CAAC;AAED,SAAS,SAAS,CAAI,KAA6B;IACjD,IAAI,CAAC,KAAK,CAAC,IAAI;QAAE,OAAO,EAAO,CAAC;IAChC,MAAM,GAAG,GAAG,KAAK,CAAC,eAAe;QAC/B,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC;QACrD,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC;IACf,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAM,CAAC;AAC9B,CAAC;AAED,KAAK,UAAU,aAAa,CAC1B,KAA6B,EAC7B,MAA2B,EAC3B,QAAkB,EAClB,SAAoB,EACpB,QAAgC,EAChC,SAAiB;IAEjB,MAAM,IAAI,GAAG,SAAS,CAAqB,KAAK,CAAC,CAAC;IAClD,IAAI,CAAC,IAAI,CAAC,WAAW,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;QACxC,OAAO,YAAY,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,uCAAuC,EAAE,CAAC,CAAC;IAC/E,CAAC;IAED,MAAM,WAAW,GAAG,MAAM,cAAc,CAAC,SAAS,EAAE,MAAM,CAAC,gBAAgB,CAAC,CAAC;IAE7E,MAAM,MAAM,GAAG,MAAM,uBAAuB,CAAC;QAC3C,QAAQ;QACR,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;QACvC,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,mBAAmB,EAAE,WAAW,CAAC,mBAAmB;QACpD,aAAa,EAAE,WAAW,CAAC,aAAa;QACxC,QAAQ;KACT,CAAC,CAAC;IAEH,MAAM,CAAC,IAAI,CAAC,gBAAgB,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;IACpE,OAAO,YAAY,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;AACnC,CAAC;AAED,KAAK,UAAU,UAAU,CACvB,KAA6B,EAC7B,MAA2B,EAC3B,SAAoB,EACpB,SAAiB;IAEjB,MAAM,IAAI,GAAG,SAAS,CAAkB,KAAK,CAAC,CAAC;IAC/C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1D,OAAO,YAAY,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,yCAAyC,EAAE,CAAC,CAAC;IACjF,CAAC;IAED,MAAM,UAAU,GAAG,MAAM,oBAAoB,CAAC,SAAS,EAAE,MAAM,CAAC,sBAAsB,CAAC,CAAC;IACxF,MAAM,gBAAgB,GAAG,MAAM,CAAC,oBAAoB,IAAI,+BAA+B,CAAC;IAExF,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QACpC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;QAChD,CAAC;QACD,OAAO,YAAY,CAAC;YAClB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,UAAU;YACV,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,gBAAgB;SACjB,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,IAAI,CAAC,mBAAmB,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;IACrE,OAAO,YAAY,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;AACtC,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,mBAAmB,CACjC,MAA2B;IAE3B,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,IAAI,IAAI,QAAQ,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC;IACrF,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,IAAI,IAAI,SAAS,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC;IAExF,OAAO,KAAK,EAAE,KAA6B,EAA8C,EAAE;QACzF,MAAM,SAAS,GAAG,KAAK,CAAC,cAAc,CAAC,SAAS,CAAC;QACjD,MAAM,MAAM,GAAG,KAAK,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC;QAChD,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC;QAE3B,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;YAC/C,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,OAAO,YAAY,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;YACtD,CAAC;YAED,IAAI,MAAM,KAAK,MAAM,IAAI,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;gBACnD,OAAO,MAAM,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC;YACtF,CAAC;YACD,IAAI,MAAM,KAAK,MAAM,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;gBAChD,OAAO,MAAM,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;YAC/D,CAAC;YAED,OAAO,YAAY,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;QACnD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CAAC,sBAAsB,EAAE;gBACnC,SAAS;gBACT,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;aAC9D,CAAC,CAAC;YACH,OAAO,YAAY,CAAC,GAAG,EAAE;gBACvB,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,aAAa;aAC9D,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}

package/dist/server/media-handler.cjs

@@ -1,5 +1,5 @@
-// @exabugs/dynamodb-client v1.5.3
-// Built: 2026-10-04T14:32:33.468Z
+// @exabugs/dynamodb-client v1.6.0
+// Built: 2026-10-04T23:59:48.659Z
 "use strict";
 var __create = Object.create;
 var __defProp = Object.defineProperty;
@@ -57323,6 +57323,16 @@ var ssmClient = new import_client_ssm2.SSMClient({ region: process.env.AWS_REGIO
 var MAX_INPUT_PIXELS = 1e8;
 var CACHE_CONTROL_IMMUTABLE = "public, max-age=31536000, immutable";
 var CACHE_CONTROL_NO_STORE = "no-store";
+var MAX_RESPONSE_BYTES = 4 * 1024 * 1024;
+var QUALITY_FALLBACK_STEPS = [80, 60, 40];
+function payloadTooLargeResponse(message) {
+  return {
+    statusCode: 413,
+    headers: { "Cache-Control": CACHE_CONTROL_NO_STORE, "Content-Type": "text/plain" },
+    body: message
+  };
+}
+__name(payloadTooLargeResponse, "payloadTooLargeResponse");
 function notFoundResponse(message) {
   return {
     statusCode: 404,
@@ -57422,7 +57432,13 @@ async function handler(event) {
   }
   let resized;
   try {
-    resized = await (0, import_sharp.default)(master, { limitInputPixels: MAX_INPUT_PIXELS }).resize(width, width, { fit: "inside", withoutEnlargement: true }).jpeg().toBuffer();
+    for (const quality of QUALITY_FALLBACK_STEPS) {
+      const buffer = await (0, import_sharp.default)(master, { limitInputPixels: MAX_INPUT_PIXELS }).resize(width, width, { fit: "inside", withoutEnlargement: true }).jpeg({ quality }).toBuffer();
+      if (buffer.length <= MAX_RESPONSE_BYTES) {
+        resized = buffer;
+        break;
+      }
+    }
   } catch (error2) {
     logger2.warn("Resize not applicable (master is not a processable raster image)", {
       requestId,
@@ -57431,6 +57447,14 @@ async function handler(event) {
     });
     return badRequestResponse("Resize is not applicable to this file");
   }
+  if (!resized) {
+    logger2.warn("Resized output exceeds response size limit even at minimum quality", {
+      requestId,
+      fileId,
+      width
+    });
+    return payloadTooLargeResponse("Resized output is too large to return");
+  }
   await s3Client.send(
     new import_client_s3.PutObjectCommand({
       Bucket: bucket,