@fonderie/media 0.1.0

package/dist/index.d.cts

@@ -0,0 +1,190 @@
+import { IFonderieModule, IFonderieApp } from '@fonderie/core';
+import { IStoreAdapter } from '@fonderie/store';
+
+/**
+ * The storage seam every backend implements — the same pattern @fonderie/billing
+ * uses for payment providers. Product code depends on this interface, never on a
+ * concrete backend, so `DbBlobProvider` (zero infra) → `S3Provider` (object
+ * storage) is a one-line swap in `MediaModule`'s config.
+ *
+ * Kept to a least-common-denominator on purpose: `put` / `get` / `delete` and
+ * nothing backend-specific. The one real divergence between backends — "can you
+ * hand the client a URL, or must the app stream the bytes?" — is modelled by the
+ * discriminated result of `get`, so an S3 provider can 302 to a signed URL while
+ * a DB/filesystem provider serves inline, and the controller never branches on
+ * which backend is wired.
+ */
+/** A backend-opaque handle to a stored object; the module persists it verbatim. */
+interface IStoredRef {
+    ref: string;
+}
+/**
+ * The outcome of resolving a ref. `bytes` → the app serves them (content type
+ * comes from the asset record, not here). `redirect` → the app 302s to a URL the
+ * backend can serve directly (e.g. an S3 signed URL). `null` → not found.
+ */
+type IFetched = {
+    kind: 'bytes';
+    bytes: Uint8Array;
+} | {
+    kind: 'redirect';
+    url: string;
+};
+interface IStorageProvider {
+    /** Stable id for logs/readiness (e.g. 'db-blob', 'local-fs', 's3'). */
+    readonly name: string;
+    /** Persist bytes; `contentType` is passed for backends that store it natively (S3). */
+    put(input: {
+        bytes: Uint8Array;
+        contentType: string;
+    }): Promise<IStoredRef>;
+    /** Resolve a ref to servable bytes or a redirect URL, or null if it's gone. */
+    get(ref: string): Promise<IFetched | null>;
+    /** Remove the stored object. Idempotent — deleting a missing ref must not throw. */
+    delete(ref: string): Promise<void>;
+}
+
+interface IMediaConfig {
+    /** Where bytes are stored. `DbBlobProvider` (zero infra) by default; swap for S3 at scale. */
+    provider: IStorageProvider;
+    /** Max decoded size per asset, in bytes. Default 1 MB. */
+    maxBytes?: number;
+    /**
+     * Content types accepted on upload (matched against magic bytes, not the
+     * client's claim). Default: PNG / JPEG / WebP / GIF. SVG is never accepted —
+     * it's a stored-XSS vector.
+     */
+    allowedTypes?: string[];
+}
+declare const DEFAULT_MAX_BYTES = 1000000;
+declare const DEFAULT_ALLOWED_TYPES: string[];
+
+/**
+ * Provider-abstracted asset storage. Register it like any other brick; it adds
+ * `POST /media`, `GET /media/:id` (public), and `DELETE /media/:id`, and stores
+ * bytes through the configured `IStorageProvider` (`DbBlobProvider` for zero
+ * infra, swappable for object storage). Depends on `@fonderie/auth` for the
+ * authenticated caller on upload/delete.
+ */
+declare class MediaModule implements IFonderieModule {
+    private readonly store;
+    private readonly config;
+    readonly name = "@fonderie/media";
+    readonly deps: string[];
+    constructor(store: IStoreAdapter, config: IMediaConfig);
+    install(app: IFonderieApp): void;
+}
+
+/**
+ * Zero-infra provider: bytes live in Postgres (`fonderie_media_blobs`, created by
+ * this package's migration). Great for getting started and self-hosting — the
+ * whole app is one Node process + one database, and a `pg_dump` captures the
+ * images atomically with their metadata. Swap to `S3Provider` when bandwidth or
+ * table size make object storage worth the extra moving part; no app code
+ * changes, only the `MediaModule` config line.
+ */
+declare class DbBlobProvider implements IStorageProvider {
+    private readonly store;
+    readonly name = "db-blob";
+    constructor(store: IStoreAdapter);
+    put({ bytes }: {
+        bytes: Uint8Array;
+        contentType: string;
+    }): Promise<IStoredRef>;
+    get(ref: string): Promise<IFetched | null>;
+    delete(ref: string): Promise<void>;
+}
+
+/**
+ * Zero-infra provider: bytes live on the server's filesystem under `dir`. Useful
+ * for a single-box deployment that wants images off the database without
+ * standing up object storage. The `ref` is an opaque filename; the asset's
+ * content type is tracked in `fonderie_media_assets`, so nothing about the
+ * bytes-on-disk needs to encode it.
+ *
+ * (Serves inline through the app like `DbBlobProvider`. It has no CDN in front,
+ * so at real scale prefer `S3Provider` — same interface, one config line.)
+ */
+declare class LocalFsProvider implements IStorageProvider {
+    readonly name = "local-fs";
+    private readonly dir;
+    private ready;
+    constructor(dir: string);
+    private ensureDir;
+    private pathFor;
+    put({ bytes }: {
+        bytes: Uint8Array;
+        contentType: string;
+    }): Promise<IStoredRef>;
+    get(ref: string): Promise<IFetched | null>;
+    delete(ref: string): Promise<void>;
+}
+
+/** A stored asset's metadata row (bytes live behind the storage provider). */
+interface IMediaAsset {
+    id: string;
+    ownerType: string;
+    ownerId: string;
+    purpose: string;
+    contentType: string;
+    byteSize: number;
+    storageRef: string;
+    createdBy: string | null;
+    createdAt: Date;
+}
+/** What an upload records. `ownerId` defaults to the caller when omitted. */
+interface ICreateAssetInput {
+    ownerType: string;
+    ownerId: string;
+    purpose: string;
+    contentType: string;
+    byteSize: number;
+    storageRef: string;
+    createdBy: string | null;
+}
+
+/** Data access for `fonderie_media_assets` — the metadata around each stored blob. */
+declare class MediaAssetModel {
+    private readonly store;
+    constructor(store: IStoreAdapter);
+    create(input: ICreateAssetInput): Promise<IMediaAsset>;
+    get(id: string): Promise<IMediaAsset | null>;
+    /** The most recent asset for an owner + purpose (e.g. a user's current avatar). */
+    latestFor(ownerType: string, ownerId: string, purpose: string): Promise<IMediaAsset | null>;
+    delete(id: string): Promise<void>;
+}
+
+/**
+ * The wire shape for a stored asset. `url` is the monomorphic read contract:
+ * always a `/media/:id` path, whatever the backend — clients render it in an
+ * `<img>` and never care whether the bytes came from Postgres, disk, or S3.
+ */
+interface IMediaAssetDTO {
+    id: string;
+    url: string;
+    contentType: string;
+    byteSize: number;
+    ownerType: string;
+    ownerId: string;
+    purpose: string;
+    createdAt: string;
+}
+/** basePath is the router mount (e.g. '/v1'); '' yields a root-relative '/media/:id'. */
+declare function toMediaAssetDTO(asset: IMediaAsset, basePath?: string): IMediaAssetDTO;
+
+/**
+ * Decode a base64 payload to bytes. Accepts both a bare base64 string and a
+ * data URI (`data:image/png;base64,<...>`) — the frontend `FileReader` produces
+ * the latter, so callers don't have to strip it.
+ */
+declare function decodeBase64(input: string): Uint8Array;
+/**
+ * Identify an image from its magic bytes — NOT from a client-claimed MIME type,
+ * which is trivially spoofed. Returns the canonical content type or `null` for
+ * anything unrecognised. SVG is deliberately not detected (it's XML, can carry
+ * scripts, and is a stored-XSS vector), so it falls through to `null` and is
+ * rejected upstream.
+ */
+declare function sniffImageType(bytes: Uint8Array): string | null;
+
+export { DEFAULT_ALLOWED_TYPES, DEFAULT_MAX_BYTES, DbBlobProvider, type ICreateAssetInput, type IFetched, type IMediaAsset, type IMediaAssetDTO, type IMediaConfig, type IStorageProvider, type IStoredRef, LocalFsProvider, MediaAssetModel, MediaModule, decodeBase64, sniffImageType, toMediaAssetDTO };

package/dist/index.d.ts

@@ -0,0 +1,190 @@
+import { IFonderieModule, IFonderieApp } from '@fonderie/core';
+import { IStoreAdapter } from '@fonderie/store';
+
+/**
+ * The storage seam every backend implements — the same pattern @fonderie/billing
+ * uses for payment providers. Product code depends on this interface, never on a
+ * concrete backend, so `DbBlobProvider` (zero infra) → `S3Provider` (object
+ * storage) is a one-line swap in `MediaModule`'s config.
+ *
+ * Kept to a least-common-denominator on purpose: `put` / `get` / `delete` and
+ * nothing backend-specific. The one real divergence between backends — "can you
+ * hand the client a URL, or must the app stream the bytes?" — is modelled by the
+ * discriminated result of `get`, so an S3 provider can 302 to a signed URL while
+ * a DB/filesystem provider serves inline, and the controller never branches on
+ * which backend is wired.
+ */
+/** A backend-opaque handle to a stored object; the module persists it verbatim. */
+interface IStoredRef {
+    ref: string;
+}
+/**
+ * The outcome of resolving a ref. `bytes` → the app serves them (content type
+ * comes from the asset record, not here). `redirect` → the app 302s to a URL the
+ * backend can serve directly (e.g. an S3 signed URL). `null` → not found.
+ */
+type IFetched = {
+    kind: 'bytes';
+    bytes: Uint8Array;
+} | {
+    kind: 'redirect';
+    url: string;
+};
+interface IStorageProvider {
+    /** Stable id for logs/readiness (e.g. 'db-blob', 'local-fs', 's3'). */
+    readonly name: string;
+    /** Persist bytes; `contentType` is passed for backends that store it natively (S3). */
+    put(input: {
+        bytes: Uint8Array;
+        contentType: string;
+    }): Promise<IStoredRef>;
+    /** Resolve a ref to servable bytes or a redirect URL, or null if it's gone. */
+    get(ref: string): Promise<IFetched | null>;
+    /** Remove the stored object. Idempotent — deleting a missing ref must not throw. */
+    delete(ref: string): Promise<void>;
+}
+
+interface IMediaConfig {
+    /** Where bytes are stored. `DbBlobProvider` (zero infra) by default; swap for S3 at scale. */
+    provider: IStorageProvider;
+    /** Max decoded size per asset, in bytes. Default 1 MB. */
+    maxBytes?: number;
+    /**
+     * Content types accepted on upload (matched against magic bytes, not the
+     * client's claim). Default: PNG / JPEG / WebP / GIF. SVG is never accepted —
+     * it's a stored-XSS vector.
+     */
+    allowedTypes?: string[];
+}
+declare const DEFAULT_MAX_BYTES = 1000000;
+declare const DEFAULT_ALLOWED_TYPES: string[];
+
+/**
+ * Provider-abstracted asset storage. Register it like any other brick; it adds
+ * `POST /media`, `GET /media/:id` (public), and `DELETE /media/:id`, and stores
+ * bytes through the configured `IStorageProvider` (`DbBlobProvider` for zero
+ * infra, swappable for object storage). Depends on `@fonderie/auth` for the
+ * authenticated caller on upload/delete.
+ */
+declare class MediaModule implements IFonderieModule {
+    private readonly store;
+    private readonly config;
+    readonly name = "@fonderie/media";
+    readonly deps: string[];
+    constructor(store: IStoreAdapter, config: IMediaConfig);
+    install(app: IFonderieApp): void;
+}
+
+/**
+ * Zero-infra provider: bytes live in Postgres (`fonderie_media_blobs`, created by
+ * this package's migration). Great for getting started and self-hosting — the
+ * whole app is one Node process + one database, and a `pg_dump` captures the
+ * images atomically with their metadata. Swap to `S3Provider` when bandwidth or
+ * table size make object storage worth the extra moving part; no app code
+ * changes, only the `MediaModule` config line.
+ */
+declare class DbBlobProvider implements IStorageProvider {
+    private readonly store;
+    readonly name = "db-blob";
+    constructor(store: IStoreAdapter);
+    put({ bytes }: {
+        bytes: Uint8Array;
+        contentType: string;
+    }): Promise<IStoredRef>;
+    get(ref: string): Promise<IFetched | null>;
+    delete(ref: string): Promise<void>;
+}
+
+/**
+ * Zero-infra provider: bytes live on the server's filesystem under `dir`. Useful
+ * for a single-box deployment that wants images off the database without
+ * standing up object storage. The `ref` is an opaque filename; the asset's
+ * content type is tracked in `fonderie_media_assets`, so nothing about the
+ * bytes-on-disk needs to encode it.
+ *
+ * (Serves inline through the app like `DbBlobProvider`. It has no CDN in front,
+ * so at real scale prefer `S3Provider` — same interface, one config line.)
+ */
+declare class LocalFsProvider implements IStorageProvider {
+    readonly name = "local-fs";
+    private readonly dir;
+    private ready;
+    constructor(dir: string);
+    private ensureDir;
+    private pathFor;
+    put({ bytes }: {
+        bytes: Uint8Array;
+        contentType: string;
+    }): Promise<IStoredRef>;
+    get(ref: string): Promise<IFetched | null>;
+    delete(ref: string): Promise<void>;
+}
+
+/** A stored asset's metadata row (bytes live behind the storage provider). */
+interface IMediaAsset {
+    id: string;
+    ownerType: string;
+    ownerId: string;
+    purpose: string;
+    contentType: string;
+    byteSize: number;
+    storageRef: string;
+    createdBy: string | null;
+    createdAt: Date;
+}
+/** What an upload records. `ownerId` defaults to the caller when omitted. */
+interface ICreateAssetInput {
+    ownerType: string;
+    ownerId: string;
+    purpose: string;
+    contentType: string;
+    byteSize: number;
+    storageRef: string;
+    createdBy: string | null;
+}
+
+/** Data access for `fonderie_media_assets` — the metadata around each stored blob. */
+declare class MediaAssetModel {
+    private readonly store;
+    constructor(store: IStoreAdapter);
+    create(input: ICreateAssetInput): Promise<IMediaAsset>;
+    get(id: string): Promise<IMediaAsset | null>;
+    /** The most recent asset for an owner + purpose (e.g. a user's current avatar). */
+    latestFor(ownerType: string, ownerId: string, purpose: string): Promise<IMediaAsset | null>;
+    delete(id: string): Promise<void>;
+}
+
+/**
+ * The wire shape for a stored asset. `url` is the monomorphic read contract:
+ * always a `/media/:id` path, whatever the backend — clients render it in an
+ * `<img>` and never care whether the bytes came from Postgres, disk, or S3.
+ */
+interface IMediaAssetDTO {
+    id: string;
+    url: string;
+    contentType: string;
+    byteSize: number;
+    ownerType: string;
+    ownerId: string;
+    purpose: string;
+    createdAt: string;
+}
+/** basePath is the router mount (e.g. '/v1'); '' yields a root-relative '/media/:id'. */
+declare function toMediaAssetDTO(asset: IMediaAsset, basePath?: string): IMediaAssetDTO;
+
+/**
+ * Decode a base64 payload to bytes. Accepts both a bare base64 string and a
+ * data URI (`data:image/png;base64,<...>`) — the frontend `FileReader` produces
+ * the latter, so callers don't have to strip it.
+ */
+declare function decodeBase64(input: string): Uint8Array;
+/**
+ * Identify an image from its magic bytes — NOT from a client-claimed MIME type,
+ * which is trivially spoofed. Returns the canonical content type or `null` for
+ * anything unrecognised. SVG is deliberately not detected (it's XML, can carry
+ * scripts, and is a stored-XSS vector), so it falls through to `null` and is
+ * rejected upstream.
+ */
+declare function sniffImageType(bytes: Uint8Array): string | null;
+
+export { DEFAULT_ALLOWED_TYPES, DEFAULT_MAX_BYTES, DbBlobProvider, type ICreateAssetInput, type IFetched, type IMediaAsset, type IMediaAssetDTO, type IMediaConfig, type IStorageProvider, type IStoredRef, LocalFsProvider, MediaAssetModel, MediaModule, decodeBase64, sniffImageType, toMediaAssetDTO };

package/dist/index.js

@@ -0,0 +1,300 @@
+// src/routes.ts
+import { HTTP, setApiResponse } from "@fonderie/core";
+import { requireAuth } from "@fonderie/core/middlewares";
+
+// src/config.ts
+var DEFAULT_MAX_BYTES = 1e6;
+var DEFAULT_ALLOWED_TYPES = ["image/png", "image/jpeg", "image/webp", "image/gif"];
+
+// src/models/asset.model.ts
+var toAsset = (r) => ({
+  id: r.id,
+  ownerType: r.owner_type,
+  ownerId: r.owner_id,
+  purpose: r.purpose,
+  contentType: r.content_type,
+  byteSize: r.byte_size,
+  storageRef: r.storage_ref,
+  createdBy: r.created_by,
+  createdAt: r.created_at
+});
+var MediaAssetModel = class {
+  constructor(store) {
+    this.store = store;
+  }
+  store;
+  async create(input) {
+    const rows = await this.store.query(
+      `INSERT INTO fonderie_media_assets
+			   (owner_type, owner_id, purpose, content_type, byte_size, storage_ref, created_by)
+			 VALUES ($1, $2, $3, $4, $5, $6, $7)
+			 RETURNING *`,
+      [input.ownerType, input.ownerId, input.purpose, input.contentType, input.byteSize, input.storageRef, input.createdBy]
+    );
+    return toAsset(rows[0]);
+  }
+  async get(id) {
+    const rows = await this.store.query("SELECT * FROM fonderie_media_assets WHERE id = $1", [id]);
+    return rows[0] ? toAsset(rows[0]) : null;
+  }
+  /** The most recent asset for an owner + purpose (e.g. a user's current avatar). */
+  async latestFor(ownerType, ownerId, purpose) {
+    const rows = await this.store.query(
+      `SELECT * FROM fonderie_media_assets
+			   WHERE owner_type = $1 AND owner_id = $2 AND purpose = $3
+			   ORDER BY created_at DESC LIMIT 1`,
+      [ownerType, ownerId, purpose]
+    );
+    return rows[0] ? toAsset(rows[0]) : null;
+  }
+  async delete(id) {
+    await this.store.query("DELETE FROM fonderie_media_assets WHERE id = $1", [id]);
+  }
+};
+
+// src/dtos/media.ts
+function toMediaAssetDTO(asset, basePath = "") {
+  return {
+    id: asset.id,
+    url: `${basePath}/media/${asset.id}`,
+    contentType: asset.contentType,
+    byteSize: asset.byteSize,
+    ownerType: asset.ownerType,
+    ownerId: asset.ownerId,
+    purpose: asset.purpose,
+    createdAt: asset.createdAt instanceof Date ? asset.createdAt.toISOString() : String(asset.createdAt)
+  };
+}
+
+// src/services/image.ts
+function decodeBase64(input) {
+  const comma = input.startsWith("data:") ? input.indexOf(",") : -1;
+  const b64 = comma >= 0 ? input.slice(comma + 1) : input;
+  return new Uint8Array(Buffer.from(b64, "base64"));
+}
+function sniffImageType(bytes) {
+  const b = bytes;
+  if (b.length >= 8 && b[0] === 137 && b[1] === 80 && b[2] === 78 && b[3] === 71 && b[4] === 13 && b[5] === 10 && b[6] === 26 && b[7] === 10) {
+    return "image/png";
+  }
+  if (b.length >= 3 && b[0] === 255 && b[1] === 216 && b[2] === 255) {
+    return "image/jpeg";
+  }
+  if (b.length >= 6 && b[0] === 71 && b[1] === 73 && b[2] === 70 && b[3] === 56 && (b[4] === 55 || b[4] === 57) && b[5] === 97) {
+    return "image/gif";
+  }
+  if (b.length >= 12 && b[0] === 82 && b[1] === 73 && b[2] === 70 && b[3] === 70 && b[8] === 87 && b[9] === 69 && b[10] === 66 && b[11] === 80) {
+    return "image/webp";
+  }
+  return null;
+}
+
+// src/routes.ts
+var UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+function buildMediaRoutes(store, config) {
+  const assets = new MediaAssetModel(store);
+  const maxBytes = config.maxBytes ?? DEFAULT_MAX_BYTES;
+  const allowed = config.allowedTypes ?? DEFAULT_ALLOWED_TYPES;
+  return [
+    // POST /media { dataBase64, ownerType?, ownerId?, purpose? } -> { asset }
+    // Accepts base64 (bare or a data URI), verifies it's a real image by its
+    // magic bytes (never the client's claim), caps the decoded size, stores
+    // the bytes via the provider, and records metadata. Returns a URL.
+    [
+      "POST",
+      "/media",
+      requireAuth,
+      async (ctx) => {
+        const userId = ctx.user.id;
+        const body = ctx.meta["body"] ?? {};
+        if (typeof body.dataBase64 !== "string" || body.dataBase64.length === 0) {
+          return setApiResponse(HTTP.UNPROCESSABLE, "INVALID_PARAMETER", "dataBase64 (a base64 string) is required.");
+        }
+        let bytes;
+        try {
+          bytes = decodeBase64(body.dataBase64);
+        } catch {
+          return setApiResponse(HTTP.UNPROCESSABLE, "INVALID_PARAMETER", "dataBase64 is not valid base64.");
+        }
+        if (bytes.byteLength === 0) {
+          return setApiResponse(HTTP.UNPROCESSABLE, "INVALID_PARAMETER", "The image is empty.");
+        }
+        if (bytes.byteLength > maxBytes) {
+          return setApiResponse(HTTP.UNPROCESSABLE, "ASSET_TOO_LARGE", `Image exceeds the ${maxBytes}-byte limit.`);
+        }
+        const contentType = sniffImageType(bytes);
+        if (!contentType || !allowed.includes(contentType)) {
+          return setApiResponse(
+            HTTP.UNPROCESSABLE,
+            "ASSET_UNSUPPORTED",
+            `Unsupported image type. Allowed: ${allowed.join(", ")}.`
+          );
+        }
+        const ownerType = typeof body.ownerType === "string" ? body.ownerType : "user";
+        const ownerId = typeof body.ownerId === "string" ? body.ownerId : userId;
+        const purpose = typeof body.purpose === "string" ? body.purpose : "avatar";
+        const { ref } = await config.provider.put({ bytes, contentType });
+        const asset = await assets.create({
+          ownerType,
+          ownerId,
+          purpose,
+          contentType,
+          byteSize: bytes.byteLength,
+          storageRef: ref,
+          createdBy: userId
+        });
+        const basePath = new URL(ctx.request.url).pathname.replace(/\/media$/, "");
+        return setApiResponse(HTTP.OK, "ASSET_CREATED", "Asset uploaded.", {
+          asset: toMediaAssetDTO(asset, basePath)
+        });
+      }
+    ],
+    // GET /media/:id  (PUBLIC — an <img src> can't send an Authorization
+    // header) -> the image bytes with cache headers, or a 302 to a
+    // provider-served URL. Assets are immutable, so the id is a stable ETag.
+    [
+      "GET",
+      "/media/:id",
+      async (ctx) => {
+        const id = ctx.meta.params?.["id"];
+        if (!id || !UUID_RE.test(id)) return new Response("Not found", { status: 404 });
+        const asset = await assets.get(id);
+        if (!asset) return new Response("Not found", { status: 404 });
+        const etag = `"${asset.id}"`;
+        if (ctx.request.headers.get("if-none-match") === etag) {
+          return new Response(null, { status: 304, headers: { ETag: etag } });
+        }
+        const fetched = await config.provider.get(asset.storageRef);
+        if (!fetched) return new Response("Not found", { status: 404 });
+        if (fetched.kind === "redirect") {
+          return new Response(null, { status: 302, headers: { Location: fetched.url } });
+        }
+        return new Response(new Uint8Array(fetched.bytes), {
+          status: 200,
+          headers: {
+            "Content-Type": asset.contentType,
+            "Content-Length": String(asset.byteSize),
+            "Cache-Control": "public, max-age=300",
+            ETag: etag
+          }
+        });
+      }
+    ],
+    // DELETE /media/:id  -> removes the asset; only the uploader may delete it.
+    [
+      "DELETE",
+      "/media/:id",
+      requireAuth,
+      async (ctx) => {
+        const id = ctx.meta.params?.["id"];
+        if (!id || !UUID_RE.test(id)) {
+          return setApiResponse(HTTP.NOT_FOUND, "ASSET_NOT_FOUND", "No such asset.");
+        }
+        const asset = await assets.get(id);
+        if (!asset) return setApiResponse(HTTP.NOT_FOUND, "ASSET_NOT_FOUND", "No such asset.");
+        if (asset.createdBy !== ctx.user.id) {
+          return setApiResponse(HTTP.FORBIDDEN, "FORBIDDEN", "You can only delete assets you uploaded.");
+        }
+        await config.provider.delete(asset.storageRef);
+        await assets.delete(id);
+        return setApiResponse(HTTP.OK, "ASSET_DELETED", "Asset deleted.", { id });
+      }
+    ]
+  ];
+}
+
+// src/module.ts
+var MediaModule = class {
+  constructor(store, config) {
+    this.store = store;
+    this.config = config;
+  }
+  store;
+  config;
+  name = "@fonderie/media";
+  deps = ["@fonderie/auth"];
+  install(app) {
+    for (const [method, path, ...handlers] of buildMediaRoutes(this.store, this.config)) {
+      app.addRoute(method, path, ...handlers);
+    }
+  }
+};
+
+// src/providers/db-blob.ts
+var DbBlobProvider = class {
+  constructor(store) {
+    this.store = store;
+  }
+  store;
+  name = "db-blob";
+  async put({ bytes }) {
+    const rows = await this.store.query(
+      "INSERT INTO fonderie_media_blobs (bytes) VALUES ($1) RETURNING id",
+      [Buffer.from(bytes)]
+    );
+    return { ref: rows[0].id };
+  }
+  async get(ref) {
+    const rows = await this.store.query(
+      "SELECT bytes FROM fonderie_media_blobs WHERE id = $1",
+      [ref]
+    );
+    const row = rows[0];
+    return row ? { kind: "bytes", bytes: row.bytes } : null;
+  }
+  async delete(ref) {
+    await this.store.query("DELETE FROM fonderie_media_blobs WHERE id = $1", [ref]);
+  }
+};
+
+// src/providers/local-fs.ts
+import { mkdir, readFile, rm, writeFile } from "fs/promises";
+import { randomUUID } from "crypto";
+import { join, resolve } from "path";
+var LocalFsProvider = class {
+  name = "local-fs";
+  dir;
+  ready = null;
+  constructor(dir) {
+    this.dir = resolve(dir);
+  }
+  ensureDir() {
+    if (!this.ready) this.ready = mkdir(this.dir, { recursive: true }).then(() => void 0);
+    return this.ready;
+  }
+  // Reject any ref that isn't a bare id, so a ref can never escape `dir`
+  // (path traversal). Ids we mint are UUIDs.
+  pathFor(ref) {
+    if (!/^[A-Za-z0-9_-]+$/.test(ref)) throw new Error("invalid media ref");
+    return join(this.dir, ref);
+  }
+  async put({ bytes }) {
+    await this.ensureDir();
+    const ref = randomUUID();
+    await writeFile(this.pathFor(ref), bytes);
+    return { ref };
+  }
+  async get(ref) {
+    try {
+      const bytes = await readFile(this.pathFor(ref));
+      return { kind: "bytes", bytes };
+    } catch {
+      return null;
+    }
+  }
+  async delete(ref) {
+    await rm(this.pathFor(ref), { force: true });
+  }
+};
+export {
+  DEFAULT_ALLOWED_TYPES,
+  DEFAULT_MAX_BYTES,
+  DbBlobProvider,
+  LocalFsProvider,
+  MediaAssetModel,
+  MediaModule,
+  decodeBase64,
+  sniffImageType,
+  toMediaAssetDTO
+};
+//# sourceMappingURL=index.js.map