@fonderie/media 0.2.0 → 0.2.1

package/README.md

@@ -31,23 +31,33 @@ app.register(new MediaModule(store, {
 }));
 ```
 
-Run its migration alongside the others (it owns `fonderie_*` tables):
+Run **both** migrations — media's (`fonderie_media_assets` metadata) and
+`@fonderie/storage`'s (`fonderie_storage_blobs`, where `DbBlobProvider` writes).
+Forgetting storage's makes DbBlob uploads fail at runtime:
 
 ```ts
-import { getMigrationsPath } from '@fonderie/media/migrations';
-await new InternalMigrationRunner(store, getMigrationsPath()).run();
+import { getMigrationsPath as mediaMigrations }   from '@fonderie/media/migrations';
+import { getMigrationsPath as storageMigrations } from '@fonderie/storage/migrations';
+await new InternalMigrationRunner(store, storageMigrations()).run();
+await new InternalMigrationRunner(store, mediaMigrations()).run();
 ```
 
-## Storage providers
+## Storage & access
 
-`IStorageProvider` is the seam — `put` / `get` / `delete`, with `get` returning
-either bytes (app serves them) or a redirect URL (backend serves them, e.g. an
-S3 signed URL). Two zero-infra backends ship built in:
+Byte storage lives in **`@fonderie/storage`** (media re-exports the zero-infra
+providers for convenience):
 
-- **`DbBlobProvider`** — bytes in Postgres (`fonderie_media_blobs`). One process,
-  one database, atomic backups. The default.
-- **`LocalFsProvider`** — bytes on the server filesystem.
+- **`DbBlobProvider`** — bytes in Postgres. Zero infra; the default.
+- **`LocalFsProvider`** — bytes on disk.
+- **`S3Provider`** (S3 / MinIO / R2) — `import { S3Provider } from '@fonderie/storage/s3'`.
 
-Implement the interface to add object storage (`S3Provider`, etc.) without
-touching product code — the same pattern `@fonderie/billing` uses for payment
-providers.
+Swapping backends is one config line; the `/media/:id` URL contract is unchanged.
+
+**Access model:** `GET /media/:id` is **public** — an `<img src>` can't carry a
+Bearer token, and ids are unguessable UUIDs (capability URLs). Right for
+avatars/logos; it is **not** an access-controlled store for private or sensitive
+files — serve those through your own authenticated route.
+
+**Owner authorization:** uploads default to self-owned user assets only
+(`ownerType: 'user'`, `ownerId` = the caller). To allow workspace logos, customer
+photos, etc., pass `authorizeOwner(ctx, owner)` in the module config.

package/brain/outcomes.md

@@ -29,6 +29,6 @@ Raw SQL ships in `node_modules/@fonderie/media/dist/migrations/sql/` — read it
 
 | Method | Path | Middleware chain (auth / validation / handler) |
 |---|---|---|
-| POST | `/media` | `requireAuth → async (ctx) => { const userId = ctx.user!.id; const body = (ctx.meta['body'] ?? {}) as { dataBase64?: unknown; ownerType?: unknown; ownerId?: unknown; purpose?: unknown; }; if (typeof body.dataBase64 !== 'string' || body.dataBase64.length === 0) { return setApiResponse(HTTP.UNPROCESSABLE, 'INVALID_PARAMETER', 'dataBase64 (a base64 string) is required.'); } let bytes: Uint8Array; try { bytes = decodeBase64(body.dataBase64); } catch { return setApiResponse(HTTP.UNPROCESSABLE, 'INVALID_PARAMETER', 'dataBase64 is not valid base64.'); } if (bytes.byteLength === 0) { return setApiResponse(HTTP.UNPROCESSABLE, 'INVALID_PARAMETER', 'The image is empty.'); } if (bytes.byteLength > maxBytes) { return setApiResponse(HTTP.UNPROCESSABLE, 'ASSET_TOO_LARGE', `Image exceeds the ${maxBytes}-byte limit.`); } const contentType = sniffImageType(bytes); if (!contentType || !allowed.includes(contentType)) { return setApiResponse( HTTP.UNPROCESSABLE, 'ASSET_UNSUPPORTED', `Unsupported image type. Allowed: ${allowed.join(', ')}.`, ); } const ownerType = typeof body.ownerType === 'string' ? body.ownerType : 'user'; const ownerId = typeof body.ownerId === 'string' ? body.ownerId : userId; const purpose = typeof body.purpose === 'string' ? body.purpose : 'avatar'; const { ref } = await config.provider.put({ bytes, contentType }); const asset = await assets.create({ ownerType, ownerId, purpose, contentType, byteSize: bytes.byteLength, storageRef: ref, createdBy: userId, }); // Build the URL at whatever prefix this route is mounted under // (e.g. '/v1/media/:id'), derived from the request path. const basePath = new URL(ctx.request.url).pathname.replace(/\/media$/, ''); return setApiResponse(HTTP.OK, 'ASSET_CREATED', 'Asset uploaded.', { asset: toMediaAssetDTO(asset, basePath), }); }` |
+| POST | `/media` | `requireAuth → async (ctx) => { const userId = ctx.user!.id; const body = (ctx.meta['body'] ?? {}) as { dataBase64?: unknown; ownerType?: unknown; ownerId?: unknown; purpose?: unknown; }; if (typeof body.dataBase64 !== 'string' || body.dataBase64.length === 0) { return setApiResponse(HTTP.UNPROCESSABLE, 'INVALID_PARAMETER', 'dataBase64 (a base64 string) is required.'); } // Reject oversized uploads BEFORE decoding — base64 inflates ~4/3, so a // string longer than maxBytes*1.4 cannot fit the cap. Bounds the decode // allocation instead of materializing a huge buffer only to reject it. // (A request-body-size limit at the adapter is the complementary guard.) if (body.dataBase64.length > Math.ceil(maxBytes * 1.4)) { return setApiResponse(HTTP.UNPROCESSABLE, 'ASSET_TOO_LARGE', `Image exceeds the ${maxBytes}-byte limit.`); } let bytes: Uint8Array; try { bytes = decodeBase64(body.dataBase64); } catch { return setApiResponse(HTTP.UNPROCESSABLE, 'INVALID_PARAMETER', 'dataBase64 is not valid base64.'); } if (bytes.byteLength === 0) { return setApiResponse(HTTP.UNPROCESSABLE, 'INVALID_PARAMETER', 'The image is empty.'); } if (bytes.byteLength > maxBytes) { return setApiResponse(HTTP.UNPROCESSABLE, 'ASSET_TOO_LARGE', `Image exceeds the ${maxBytes}-byte limit.`); } const contentType = sniffImageType(bytes); if (!contentType || !allowed.includes(contentType)) { return setApiResponse( HTTP.UNPROCESSABLE, 'ASSET_UNSUPPORTED', `Unsupported image type. Allowed: ${allowed.join(', ')}.`, ); } const ownerType = typeof body.ownerType === 'string' ? body.ownerType : 'user'; const ownerId = typeof body.ownerId === 'string' ? body.ownerId : userId; const purpose = typeof body.purpose === 'string' ? body.purpose : 'avatar'; // Authorize the target owner. Default policy: self-owned user assets // only; a consumer opts into other owners (workspace logos, customer // photos) via config.authorizeOwner. const authorized = config.authorizeOwner ? await config.authorizeOwner(ctx, { ownerType, ownerId }) : ownerType === 'user' && ownerId === userId; if (!authorized) { return setApiResponse(HTTP.FORBIDDEN, 'FORBIDDEN', 'Not allowed to upload for that owner.'); } const { ref } = await config.provider.put({ bytes, contentType }); let asset: Awaited<ReturnType<typeof assets.create>>; try { asset = await assets.create({ ownerType, ownerId, purpose, contentType, byteSize: bytes.byteLength, storageRef: ref, createdBy: userId, }); } catch (err) { // Metadata insert failed — don't orphan the bytes we just stored. await config.provider.delete(ref).catch(() => {}); throw err; } // Build the URL at whatever prefix this route is mounted under // (e.g. '/v1/media/:id'), derived from the request path. const basePath = new URL(ctx.request.url).pathname.replace(/\/media$/, ''); return setApiResponse(HTTP.OK, 'ASSET_CREATED', 'Asset uploaded.', { asset: toMediaAssetDTO(asset, basePath), }); }` |
 | DELETE | `/media/:id` | `requireAuth → async (ctx) => { const id = ctx.meta.params?.['id']; if (!id || !UUID_RE.test(id)) { return setApiResponse(HTTP.NOT_FOUND, 'ASSET_NOT_FOUND', 'No such asset.'); } const asset = await assets.get(id); if (!asset) return setApiResponse(HTTP.NOT_FOUND, 'ASSET_NOT_FOUND', 'No such asset.'); if (asset.createdBy !== ctx.user!.id) { return setApiResponse(HTTP.FORBIDDEN, 'FORBIDDEN', 'You can only delete assets you uploaded.'); } await config.provider.delete(asset.storageRef); await assets.delete(id); return setApiResponse(HTTP.OK, 'ASSET_DELETED', 'Asset deleted.', { id }); }` |
 | GET | `/media/:id` | `async (ctx) => { const id = ctx.meta.params?.['id']; if (!id || !UUID_RE.test(id)) return new Response('Not found', { status: 404 }); const asset = await assets.get(id); if (!asset) return new Response('Not found', { status: 404 }); const etag = `"${asset.id}"`; if (ctx.request.headers.get('if-none-match') === etag) { return new Response(null, { status: 304, headers: { ETag: etag } }); } const fetched = await config.provider.get(asset.storageRef); if (!fetched) return new Response('Not found', { status: 404 }); if (fetched.kind === 'redirect') { return new Response(null, { status: 302, headers: { Location: fetched.url } }); } // Fresh Uint8Array (ArrayBuffer-backed) so it satisfies BodyInit; a // pg Buffer is typed Uint8Array<ArrayBufferLike>, which the lib rejects. return new Response(new Uint8Array(fetched.bytes), { status: 200, headers: { 'Content-Type': asset.contentType, 'Content-Length': String(asset.byteSize), 'Cache-Control': 'public, max-age=300', ETag: etag, }, }); }` |

package/brain/signatures.md

@@ -20,6 +20,10 @@ interface IMediaConfig {
     provider: IStorageProvider;
     maxBytes?: number;
     allowedTypes?: string[];
+    authorizeOwner?(ctx: IFonderieContext, owner: {
+        ownerType: string;
+        ownerId: string;
+    }): boolean | Promise<boolean>;
 }
 
 new DbBlobProvider(store: IStoreAdapter): DbBlobProvider

package/dist/index.cjs

@@ -144,6 +144,9 @@ function buildMediaRoutes(store, config) {
         if (typeof body.dataBase64 !== "string" || body.dataBase64.length === 0) {
           return (0, import_core.setApiResponse)(import_core.HTTP.UNPROCESSABLE, "INVALID_PARAMETER", "dataBase64 (a base64 string) is required.");
         }
+        if (body.dataBase64.length > Math.ceil(maxBytes * 1.4)) {
+          return (0, import_core.setApiResponse)(import_core.HTTP.UNPROCESSABLE, "ASSET_TOO_LARGE", `Image exceeds the ${maxBytes}-byte limit.`);
+        }
         let bytes;
         try {
           bytes = decodeBase64(body.dataBase64);
@@ -167,16 +170,27 @@ function buildMediaRoutes(store, config) {
         const ownerType = typeof body.ownerType === "string" ? body.ownerType : "user";
         const ownerId = typeof body.ownerId === "string" ? body.ownerId : userId;
         const purpose = typeof body.purpose === "string" ? body.purpose : "avatar";
+        const authorized = config.authorizeOwner ? await config.authorizeOwner(ctx, { ownerType, ownerId }) : ownerType === "user" && ownerId === userId;
+        if (!authorized) {
+          return (0, import_core.setApiResponse)(import_core.HTTP.FORBIDDEN, "FORBIDDEN", "Not allowed to upload for that owner.");
+        }
         const { ref } = await config.provider.put({ bytes, contentType });
-        const asset = await assets.create({
-          ownerType,
-          ownerId,
-          purpose,
-          contentType,
-          byteSize: bytes.byteLength,
-          storageRef: ref,
-          createdBy: userId
-        });
+        let asset;
+        try {
+          asset = await assets.create({
+            ownerType,
+            ownerId,
+            purpose,
+            contentType,
+            byteSize: bytes.byteLength,
+            storageRef: ref,
+            createdBy: userId
+          });
+        } catch (err) {
+          await config.provider.delete(ref).catch(() => {
+          });
+          throw err;
+        }
         const basePath = new URL(ctx.request.url).pathname.replace(/\/media$/, "");
         return (0, import_core.setApiResponse)(import_core.HTTP.OK, "ASSET_CREATED", "Asset uploaded.", {
           asset: toMediaAssetDTO(asset, basePath)

package/dist/index.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/index.ts","../src/routes.ts","../src/config.ts","../src/models/asset.model.ts","../src/dtos/media.ts","../src/services/image.ts","../src/module.ts"],"sourcesContent":["export { MediaModule } from './module';\nexport { DEFAULT_ALLOWED_TYPES, DEFAULT_MAX_BYTES } from './config';\nexport type { IMediaConfig } from './config';\n\n// Storage lives in @fonderie/storage now; re-exported here for convenience so\n// existing consumers can keep importing the zero-infra providers from media.\n// S3Provider (the object-storage backend) is at '@fonderie/storage/s3'.\nexport { DbBlobProvider, LocalFsProvider } from '@fonderie/storage';\nexport type { IStorageProvider, IFetched, IStoredRef } from '@fonderie/storage';\n\n// For server-side resolution (e.g. wiring a user's avatar URL) and custom flows.\nexport { MediaAssetModel } from './models/asset.model';\nexport { toMediaAssetDTO } from './dtos/media';\nexport type { IMediaAssetDTO } from './dtos/media';\nexport type { IMediaAsset, ICreateAssetInput } from './types';\nexport { decodeBase64, sniffImageType } from './services/image';\n","import type { Middleware } from '@fonderie/core';\nimport { HTTP, setApiResponse } from '@fonderie/core';\nimport { requireAuth } from '@fonderie/core/middlewares';\nimport type { IStoreAdapter } from '@fonderie/store';\n\nimport { DEFAULT_ALLOWED_TYPES, DEFAULT_MAX_BYTES, type IMediaConfig } from './config';\nimport { MediaAssetModel } from './models/asset.model';\nimport { toMediaAssetDTO } from './dtos/media';\nimport { decodeBase64, sniffImageType } from './services/image';\n\ntype Route = [string, string, ...Middleware[]];\n\nconst UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;\n\nexport function buildMediaRoutes(store: IStoreAdapter, config: IMediaConfig): Route[] {\n\tconst assets = new MediaAssetModel(store);\n\tconst maxBytes = config.maxBytes ?? DEFAULT_MAX_BYTES;\n\tconst allowed = config.allowedTypes ?? DEFAULT_ALLOWED_TYPES;\n\n\treturn [\n\t\t// POST /media { dataBase64, ownerType?, ownerId?, purpose? } -> { asset }\n\t\t// Accepts base64 (bare or a data URI), verifies it's a real image by its\n\t\t// magic bytes (never the client's claim), caps the decoded size, stores\n\t\t// the bytes via the provider, and records metadata. Returns a URL.\n\t\t[\n\t\t\t'POST',\n\t\t\t'/media',\n\t\t\trequireAuth,\n\t\t\tasync (ctx) => {\n\t\t\t\tconst userId = ctx.user!.id;\n\t\t\t\tconst body = (ctx.meta['body'] ?? {}) as {\n\t\t\t\t\tdataBase64?: unknown;\n\t\t\t\t\townerType?: unknown;\n\t\t\t\t\townerId?: unknown;\n\t\t\t\t\tpurpose?: unknown;\n\t\t\t\t};\n\n\t\t\t\tif (typeof body.dataBase64 !== 'string' || body.dataBase64.length === 0) {\n\t\t\t\t\treturn setApiResponse(HTTP.UNPROCESSABLE, 'INVALID_PARAMETER', 'dataBase64 (a base64 string) is required.');\n\t\t\t\t}\n\n\t\t\t\tlet bytes: Uint8Array;\n\t\t\t\ttry {\n\t\t\t\t\tbytes = decodeBase64(body.dataBase64);\n\t\t\t\t} catch {\n\t\t\t\t\treturn setApiResponse(HTTP.UNPROCESSABLE, 'INVALID_PARAMETER', 'dataBase64 is not valid base64.');\n\t\t\t\t}\n\t\t\t\tif (bytes.byteLength === 0) {\n\t\t\t\t\treturn setApiResponse(HTTP.UNPROCESSABLE, 'INVALID_PARAMETER', 'The image is empty.');\n\t\t\t\t}\n\t\t\t\tif (bytes.byteLength > maxBytes) {\n\t\t\t\t\treturn setApiResponse(HTTP.UNPROCESSABLE, 'ASSET_TOO_LARGE', `Image exceeds the ${maxBytes}-byte limit.`);\n\t\t\t\t}\n\n\t\t\t\tconst contentType = sniffImageType(bytes);\n\t\t\t\tif (!contentType || !allowed.includes(contentType)) {\n\t\t\t\t\treturn setApiResponse(\n\t\t\t\t\t\tHTTP.UNPROCESSABLE,\n\t\t\t\t\t\t'ASSET_UNSUPPORTED',\n\t\t\t\t\t\t`Unsupported image type. Allowed: ${allowed.join(', ')}.`,\n\t\t\t\t\t);\n\t\t\t\t}\n\n\t\t\t\tconst ownerType = typeof body.ownerType === 'string' ? body.ownerType : 'user';\n\t\t\t\tconst ownerId = typeof body.ownerId === 'string' ? body.ownerId : userId;\n\t\t\t\tconst purpose = typeof body.purpose === 'string' ? body.purpose : 'avatar';\n\n\t\t\t\tconst { ref } = await config.provider.put({ bytes, contentType });\n\t\t\t\tconst asset = await assets.create({\n\t\t\t\t\townerType,\n\t\t\t\t\townerId,\n\t\t\t\t\tpurpose,\n\t\t\t\t\tcontentType,\n\t\t\t\t\tbyteSize: bytes.byteLength,\n\t\t\t\t\tstorageRef: ref,\n\t\t\t\t\tcreatedBy: userId,\n\t\t\t\t});\n\n\t\t\t\t// Build the URL at whatever prefix this route is mounted under\n\t\t\t\t// (e.g. '/v1/media/:id'), derived from the request path.\n\t\t\t\tconst basePath = new URL(ctx.request.url).pathname.replace(/\\/media$/, '');\n\t\t\t\treturn setApiResponse(HTTP.OK, 'ASSET_CREATED', 'Asset uploaded.', {\n\t\t\t\t\tasset: toMediaAssetDTO(asset, basePath),\n\t\t\t\t});\n\t\t\t},\n\t\t],\n\n\t\t// GET /media/:id  (PUBLIC — an <img src> can't send an Authorization\n\t\t// header) -> the image bytes with cache headers, or a 302 to a\n\t\t// provider-served URL. Assets are immutable, so the id is a stable ETag.\n\t\t[\n\t\t\t'GET',\n\t\t\t'/media/:id',\n\t\t\tasync (ctx) => {\n\t\t\t\tconst id = ctx.meta.params?.['id'];\n\t\t\t\tif (!id || !UUID_RE.test(id)) return new Response('Not found', { status: 404 });\n\n\t\t\t\tconst asset = await assets.get(id);\n\t\t\t\tif (!asset) return new Response('Not found', { status: 404 });\n\n\t\t\t\tconst etag = `\"${asset.id}\"`;\n\t\t\t\tif (ctx.request.headers.get('if-none-match') === etag) {\n\t\t\t\t\treturn new Response(null, { status: 304, headers: { ETag: etag } });\n\t\t\t\t}\n\n\t\t\t\tconst fetched = await config.provider.get(asset.storageRef);\n\t\t\t\tif (!fetched) return new Response('Not found', { status: 404 });\n\t\t\t\tif (fetched.kind === 'redirect') {\n\t\t\t\t\treturn new Response(null, { status: 302, headers: { Location: fetched.url } });\n\t\t\t\t}\n\t\t\t\t// Fresh Uint8Array (ArrayBuffer-backed) so it satisfies BodyInit; a\n\t\t\t\t// pg Buffer is typed Uint8Array<ArrayBufferLike>, which the lib rejects.\n\t\t\t\treturn new Response(new Uint8Array(fetched.bytes), {\n\t\t\t\t\tstatus: 200,\n\t\t\t\t\theaders: {\n\t\t\t\t\t\t'Content-Type': asset.contentType,\n\t\t\t\t\t\t'Content-Length': String(asset.byteSize),\n\t\t\t\t\t\t'Cache-Control': 'public, max-age=300',\n\t\t\t\t\t\tETag: etag,\n\t\t\t\t\t},\n\t\t\t\t});\n\t\t\t},\n\t\t],\n\n\t\t// DELETE /media/:id  -> removes the asset; only the uploader may delete it.\n\t\t[\n\t\t\t'DELETE',\n\t\t\t'/media/:id',\n\t\t\trequireAuth,\n\t\t\tasync (ctx) => {\n\t\t\t\tconst id = ctx.meta.params?.['id'];\n\t\t\t\tif (!id || !UUID_RE.test(id)) {\n\t\t\t\t\treturn setApiResponse(HTTP.NOT_FOUND, 'ASSET_NOT_FOUND', 'No such asset.');\n\t\t\t\t}\n\t\t\t\tconst asset = await assets.get(id);\n\t\t\t\tif (!asset) return setApiResponse(HTTP.NOT_FOUND, 'ASSET_NOT_FOUND', 'No such asset.');\n\t\t\t\tif (asset.createdBy !== ctx.user!.id) {\n\t\t\t\t\treturn setApiResponse(HTTP.FORBIDDEN, 'FORBIDDEN', 'You can only delete assets you uploaded.');\n\t\t\t\t}\n\t\t\t\tawait config.provider.delete(asset.storageRef);\n\t\t\t\tawait assets.delete(id);\n\t\t\t\treturn setApiResponse(HTTP.OK, 'ASSET_DELETED', 'Asset deleted.', { id });\n\t\t\t},\n\t\t],\n\t];\n}\n","import type { IStorageProvider } from '@fonderie/storage';\n\nexport interface IMediaConfig {\n\t/** Where bytes are stored. `DbBlobProvider` (zero infra) by default; swap for S3 at scale. */\n\tprovider: IStorageProvider;\n\t/** Max decoded size per asset, in bytes. Default 1 MB. */\n\tmaxBytes?: number;\n\t/**\n\t * Content types accepted on upload (matched against magic bytes, not the\n\t * client's claim). Default: PNG / JPEG / WebP / GIF. SVG is never accepted —\n\t * it's a stored-XSS vector.\n\t */\n\tallowedTypes?: string[];\n}\n\nexport const DEFAULT_MAX_BYTES = 1_000_000;\nexport const DEFAULT_ALLOWED_TYPES = ['image/png', 'image/jpeg', 'image/webp', 'image/gif'];\n","import type { IStoreAdapter } from '@fonderie/store';\n\nimport type { ICreateAssetInput, IMediaAsset } from '../types';\n\ninterface AssetRow {\n\tid: string;\n\towner_type: string;\n\towner_id: string;\n\tpurpose: string;\n\tcontent_type: string;\n\tbyte_size: number;\n\tstorage_ref: string;\n\tcreated_by: string | null;\n\tcreated_at: Date;\n}\n\nconst toAsset = (r: AssetRow): IMediaAsset => ({\n\tid: r.id,\n\townerType: r.owner_type,\n\townerId: r.owner_id,\n\tpurpose: r.purpose,\n\tcontentType: r.content_type,\n\tbyteSize: r.byte_size,\n\tstorageRef: r.storage_ref,\n\tcreatedBy: r.created_by,\n\tcreatedAt: r.created_at,\n});\n\n/** Data access for `fonderie_media_assets` — the metadata around each stored blob. */\nexport class MediaAssetModel {\n\tconstructor(private readonly store: IStoreAdapter) {}\n\n\tasync create(input: ICreateAssetInput): Promise<IMediaAsset> {\n\t\tconst rows = await this.store.query<AssetRow>(\n\t\t\t`INSERT INTO fonderie_media_assets\n\t\t\t   (owner_type, owner_id, purpose, content_type, byte_size, storage_ref, created_by)\n\t\t\t VALUES ($1, $2, $3, $4, $5, $6, $7)\n\t\t\t RETURNING *`,\n\t\t\t[input.ownerType, input.ownerId, input.purpose, input.contentType, input.byteSize, input.storageRef, input.createdBy],\n\t\t);\n\t\treturn toAsset(rows[0]!);\n\t}\n\n\tasync get(id: string): Promise<IMediaAsset | null> {\n\t\tconst rows = await this.store.query<AssetRow>('SELECT * FROM fonderie_media_assets WHERE id = $1', [id]);\n\t\treturn rows[0] ? toAsset(rows[0]) : null;\n\t}\n\n\t/** The most recent asset for an owner + purpose (e.g. a user's current avatar). */\n\tasync latestFor(ownerType: string, ownerId: string, purpose: string): Promise<IMediaAsset | null> {\n\t\tconst rows = await this.store.query<AssetRow>(\n\t\t\t`SELECT * FROM fonderie_media_assets\n\t\t\t   WHERE owner_type = $1 AND owner_id = $2 AND purpose = $3\n\t\t\t   ORDER BY created_at DESC LIMIT 1`,\n\t\t\t[ownerType, ownerId, purpose],\n\t\t);\n\t\treturn rows[0] ? toAsset(rows[0]) : null;\n\t}\n\n\tasync delete(id: string): Promise<void> {\n\t\tawait this.store.query('DELETE FROM fonderie_media_assets WHERE id = $1', [id]);\n\t}\n}\n","import type { IMediaAsset } from '../types';\n\n/**\n * The wire shape for a stored asset. `url` is the monomorphic read contract:\n * always a `/media/:id` path, whatever the backend — clients render it in an\n * `<img>` and never care whether the bytes came from Postgres, disk, or S3.\n */\nexport interface IMediaAssetDTO {\n\tid: string;\n\turl: string;\n\tcontentType: string;\n\tbyteSize: number;\n\townerType: string;\n\townerId: string;\n\tpurpose: string;\n\tcreatedAt: string;\n}\n\n/** basePath is the router mount (e.g. '/v1'); '' yields a root-relative '/media/:id'. */\nexport function toMediaAssetDTO(asset: IMediaAsset, basePath = ''): IMediaAssetDTO {\n\treturn {\n\t\tid: asset.id,\n\t\turl: `${basePath}/media/${asset.id}`,\n\t\tcontentType: asset.contentType,\n\t\tbyteSize: asset.byteSize,\n\t\townerType: asset.ownerType,\n\t\townerId: asset.ownerId,\n\t\tpurpose: asset.purpose,\n\t\tcreatedAt: asset.createdAt instanceof Date ? asset.createdAt.toISOString() : String(asset.createdAt),\n\t};\n}\n","/**\n * Decode a base64 payload to bytes. Accepts both a bare base64 string and a\n * data URI (`data:image/png;base64,<...>`) — the frontend `FileReader` produces\n * the latter, so callers don't have to strip it.\n */\nexport function decodeBase64(input: string): Uint8Array {\n\tconst comma = input.startsWith('data:') ? input.indexOf(',') : -1;\n\tconst b64 = comma >= 0 ? input.slice(comma + 1) : input;\n\treturn new Uint8Array(Buffer.from(b64, 'base64'));\n}\n\n/**\n * Identify an image from its magic bytes — NOT from a client-claimed MIME type,\n * which is trivially spoofed. Returns the canonical content type or `null` for\n * anything unrecognised. SVG is deliberately not detected (it's XML, can carry\n * scripts, and is a stored-XSS vector), so it falls through to `null` and is\n * rejected upstream.\n */\nexport function sniffImageType(bytes: Uint8Array): string | null {\n\tconst b = bytes;\n\t// PNG: 89 50 4E 47 0D 0A 1A 0A\n\tif (b.length >= 8 && b[0] === 0x89 && b[1] === 0x50 && b[2] === 0x4e && b[3] === 0x47 && b[4] === 0x0d && b[5] === 0x0a && b[6] === 0x1a && b[7] === 0x0a) {\n\t\treturn 'image/png';\n\t}\n\t// JPEG: FF D8 FF\n\tif (b.length >= 3 && b[0] === 0xff && b[1] === 0xd8 && b[2] === 0xff) {\n\t\treturn 'image/jpeg';\n\t}\n\t// GIF: \"GIF87a\" / \"GIF89a\"\n\tif (b.length >= 6 && b[0] === 0x47 && b[1] === 0x49 && b[2] === 0x46 && b[3] === 0x38 && (b[4] === 0x37 || b[4] === 0x39) && b[5] === 0x61) {\n\t\treturn 'image/gif';\n\t}\n\t// WEBP: \"RIFF\" .... \"WEBP\" (bytes 0-3 and 8-11)\n\tif (b.length >= 12 && b[0] === 0x52 && b[1] === 0x49 && b[2] === 0x46 && b[3] === 0x46 && b[8] === 0x57 && b[9] === 0x45 && b[10] === 0x42 && b[11] === 0x50) {\n\t\treturn 'image/webp';\n\t}\n\treturn null;\n}\n","import type { IFonderieApp, IFonderieModule } from '@fonderie/core';\nimport type { IStoreAdapter } from '@fonderie/store';\n\nimport type { IMediaConfig } from './config';\nimport { buildMediaRoutes } from './routes';\n\n/**\n * Provider-abstracted asset storage. Register it like any other brick; it adds\n * `POST /media`, `GET /media/:id` (public), and `DELETE /media/:id`, and stores\n * bytes through the configured `IStorageProvider` (`DbBlobProvider` for zero\n * infra, swappable for object storage). Depends on `@fonderie/auth` for the\n * authenticated caller on upload/delete.\n */\nexport class MediaModule implements IFonderieModule {\n\treadonly name = '@fonderie/media';\n\treadonly deps = ['@fonderie/auth'];\n\n\tconstructor(\n\t\tprivate readonly store: IStoreAdapter,\n\t\tprivate readonly config: IMediaConfig,\n\t) {}\n\n\tinstall(app: IFonderieApp): void {\n\t\tfor (const [method, path, ...handlers] of buildMediaRoutes(this.store, this.config)) {\n\t\t\tapp.addRoute(method, path, ...handlers);\n\t\t}\n\t}\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACCA,kBAAqC;AACrC,yBAA4B;;;ACarB,IAAM,oBAAoB;AAC1B,IAAM,wBAAwB,CAAC,aAAa,cAAc,cAAc,WAAW;;;ACA1F,IAAM,UAAU,CAAC,OAA8B;AAAA,EAC9C,IAAI,EAAE;AAAA,EACN,WAAW,EAAE;AAAA,EACb,SAAS,EAAE;AAAA,EACX,SAAS,EAAE;AAAA,EACX,aAAa,EAAE;AAAA,EACf,UAAU,EAAE;AAAA,EACZ,YAAY,EAAE;AAAA,EACd,WAAW,EAAE;AAAA,EACb,WAAW,EAAE;AACd;AAGO,IAAM,kBAAN,MAAsB;AAAA,EAC5B,YAA6B,OAAsB;AAAtB;AAAA,EAAuB;AAAA,EAAvB;AAAA,EAE7B,MAAM,OAAO,OAAgD;AAC5D,UAAM,OAAO,MAAM,KAAK,MAAM;AAAA,MAC7B;AAAA;AAAA;AAAA;AAAA,MAIA,CAAC,MAAM,WAAW,MAAM,SAAS,MAAM,SAAS,MAAM,aAAa,MAAM,UAAU,MAAM,YAAY,MAAM,SAAS;AAAA,IACrH;AACA,WAAO,QAAQ,KAAK,CAAC,CAAE;AAAA,EACxB;AAAA,EAEA,MAAM,IAAI,IAAyC;AAClD,UAAM,OAAO,MAAM,KAAK,MAAM,MAAgB,qDAAqD,CAAC,EAAE,CAAC;AACvG,WAAO,KAAK,CAAC,IAAI,QAAQ,KAAK,CAAC,CAAC,IAAI;AAAA,EACrC;AAAA;AAAA,EAGA,MAAM,UAAU,WAAmB,SAAiB,SAA8C;AACjG,UAAM,OAAO,MAAM,KAAK,MAAM;AAAA,MAC7B;AAAA;AAAA;AAAA,MAGA,CAAC,WAAW,SAAS,OAAO;AAAA,IAC7B;AACA,WAAO,KAAK,CAAC,IAAI,QAAQ,KAAK,CAAC,CAAC,IAAI;AAAA,EACrC;AAAA,EAEA,MAAM,OAAO,IAA2B;AACvC,UAAM,KAAK,MAAM,MAAM,mDAAmD,CAAC,EAAE,CAAC;AAAA,EAC/E;AACD;;;AC3CO,SAAS,gBAAgB,OAAoB,WAAW,IAAoB;AAClF,SAAO;AAAA,IACN,IAAI,MAAM;AAAA,IACV,KAAK,GAAG,QAAQ,UAAU,MAAM,EAAE;AAAA,IAClC,aAAa,MAAM;AAAA,IACnB,UAAU,MAAM;AAAA,IAChB,WAAW,MAAM;AAAA,IACjB,SAAS,MAAM;AAAA,IACf,SAAS,MAAM;AAAA,IACf,WAAW,MAAM,qBAAqB,OAAO,MAAM,UAAU,YAAY,IAAI,OAAO,MAAM,SAAS;AAAA,EACpG;AACD;;;ACzBO,SAAS,aAAa,OAA2B;AACvD,QAAM,QAAQ,MAAM,WAAW,OAAO,IAAI,MAAM,QAAQ,GAAG,IAAI;AAC/D,QAAM,MAAM,SAAS,IAAI,MAAM,MAAM,QAAQ,CAAC,IAAI;AAClD,SAAO,IAAI,WAAW,OAAO,KAAK,KAAK,QAAQ,CAAC;AACjD;AASO,SAAS,eAAe,OAAkC;AAChE,QAAM,IAAI;AAEV,MAAI,EAAE,UAAU,KAAK,EAAE,CAAC,MAAM,OAAQ,EAAE,CAAC,MAAM,MAAQ,EAAE,CAAC,MAAM,MAAQ,EAAE,CAAC,MAAM,MAAQ,EAAE,CAAC,MAAM,MAAQ,EAAE,CAAC,MAAM,MAAQ,EAAE,CAAC,MAAM,MAAQ,EAAE,CAAC,MAAM,IAAM;AAC1J,WAAO;AAAA,EACR;AAEA,MAAI,EAAE,UAAU,KAAK,EAAE,CAAC,MAAM,OAAQ,EAAE,CAAC,MAAM,OAAQ,EAAE,CAAC,MAAM,KAAM;AACrE,WAAO;AAAA,EACR;AAEA,MAAI,EAAE,UAAU,KAAK,EAAE,CAAC,MAAM,MAAQ,EAAE,CAAC,MAAM,MAAQ,EAAE,CAAC,MAAM,MAAQ,EAAE,CAAC,MAAM,OAAS,EAAE,CAAC,MAAM,MAAQ,EAAE,CAAC,MAAM,OAAS,EAAE,CAAC,MAAM,IAAM;AAC3I,WAAO;AAAA,EACR;AAEA,MAAI,EAAE,UAAU,MAAM,EAAE,CAAC,MAAM,MAAQ,EAAE,CAAC,MAAM,MAAQ,EAAE,CAAC,MAAM,MAAQ,EAAE,CAAC,MAAM,MAAQ,EAAE,CAAC,MAAM,MAAQ,EAAE,CAAC,MAAM,MAAQ,EAAE,EAAE,MAAM,MAAQ,EAAE,EAAE,MAAM,IAAM;AAC7J,WAAO;AAAA,EACR;AACA,SAAO;AACR;;;AJzBA,IAAM,UAAU;AAET,SAAS,iBAAiB,OAAsB,QAA+B;AACrF,QAAM,SAAS,IAAI,gBAAgB,KAAK;AACxC,QAAM,WAAW,OAAO,YAAY;AACpC,QAAM,UAAU,OAAO,gBAAgB;AAEvC,SAAO;AAAA;AAAA;AAAA;AAAA;AAAA,IAKN;AAAA,MACC;AAAA,MACA;AAAA,MACA;AAAA,MACA,OAAO,QAAQ;AACd,cAAM,SAAS,IAAI,KAAM;AACzB,cAAM,OAAQ,IAAI,KAAK,MAAM,KAAK,CAAC;AAOnC,YAAI,OAAO,KAAK,eAAe,YAAY,KAAK,WAAW,WAAW,GAAG;AACxE,qBAAO,4BAAe,iBAAK,eAAe,qBAAqB,2CAA2C;AAAA,QAC3G;AAEA,YAAI;AACJ,YAAI;AACH,kBAAQ,aAAa,KAAK,UAAU;AAAA,QACrC,QAAQ;AACP,qBAAO,4BAAe,iBAAK,eAAe,qBAAqB,iCAAiC;AAAA,QACjG;AACA,YAAI,MAAM,eAAe,GAAG;AAC3B,qBAAO,4BAAe,iBAAK,eAAe,qBAAqB,qBAAqB;AAAA,QACrF;AACA,YAAI,MAAM,aAAa,UAAU;AAChC,qBAAO,4BAAe,iBAAK,eAAe,mBAAmB,qBAAqB,QAAQ,cAAc;AAAA,QACzG;AAEA,cAAM,cAAc,eAAe,KAAK;AACxC,YAAI,CAAC,eAAe,CAAC,QAAQ,SAAS,WAAW,GAAG;AACnD,qBAAO;AAAA,YACN,iBAAK;AAAA,YACL;AAAA,YACA,oCAAoC,QAAQ,KAAK,IAAI,CAAC;AAAA,UACvD;AAAA,QACD;AAEA,cAAM,YAAY,OAAO,KAAK,cAAc,WAAW,KAAK,YAAY;AACxE,cAAM,UAAU,OAAO,KAAK,YAAY,WAAW,KAAK,UAAU;AAClE,cAAM,UAAU,OAAO,KAAK,YAAY,WAAW,KAAK,UAAU;AAElE,cAAM,EAAE,IAAI,IAAI,MAAM,OAAO,SAAS,IAAI,EAAE,OAAO,YAAY,CAAC;AAChE,cAAM,QAAQ,MAAM,OAAO,OAAO;AAAA,UACjC;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,UACA,UAAU,MAAM;AAAA,UAChB,YAAY;AAAA,UACZ,WAAW;AAAA,QACZ,CAAC;AAID,cAAM,WAAW,IAAI,IAAI,IAAI,QAAQ,GAAG,EAAE,SAAS,QAAQ,YAAY,EAAE;AACzE,mBAAO,4BAAe,iBAAK,IAAI,iBAAiB,mBAAmB;AAAA,UAClE,OAAO,gBAAgB,OAAO,QAAQ;AAAA,QACvC,CAAC;AAAA,MACF;AAAA,IACD;AAAA;AAAA;AAAA;AAAA,IAKA;AAAA,MACC;AAAA,MACA;AAAA,MACA,OAAO,QAAQ;AACd,cAAM,KAAK,IAAI,KAAK,SAAS,IAAI;AACjC,YAAI,CAAC,MAAM,CAAC,QAAQ,KAAK,EAAE,EAAG,QAAO,IAAI,SAAS,aAAa,EAAE,QAAQ,IAAI,CAAC;AAE9E,cAAM,QAAQ,MAAM,OAAO,IAAI,EAAE;AACjC,YAAI,CAAC,MAAO,QAAO,IAAI,SAAS,aAAa,EAAE,QAAQ,IAAI,CAAC;AAE5D,cAAM,OAAO,IAAI,MAAM,EAAE;AACzB,YAAI,IAAI,QAAQ,QAAQ,IAAI,eAAe,MAAM,MAAM;AACtD,iBAAO,IAAI,SAAS,MAAM,EAAE,QAAQ,KAAK,SAAS,EAAE,MAAM,KAAK,EAAE,CAAC;AAAA,QACnE;AAEA,cAAM,UAAU,MAAM,OAAO,SAAS,IAAI,MAAM,UAAU;AAC1D,YAAI,CAAC,QAAS,QAAO,IAAI,SAAS,aAAa,EAAE,QAAQ,IAAI,CAAC;AAC9D,YAAI,QAAQ,SAAS,YAAY;AAChC,iBAAO,IAAI,SAAS,MAAM,EAAE,QAAQ,KAAK,SAAS,EAAE,UAAU,QAAQ,IAAI,EAAE,CAAC;AAAA,QAC9E;AAGA,eAAO,IAAI,SAAS,IAAI,WAAW,QAAQ,KAAK,GAAG;AAAA,UAClD,QAAQ;AAAA,UACR,SAAS;AAAA,YACR,gBAAgB,MAAM;AAAA,YACtB,kBAAkB,OAAO,MAAM,QAAQ;AAAA,YACvC,iBAAiB;AAAA,YACjB,MAAM;AAAA,UACP;AAAA,QACD,CAAC;AAAA,MACF;AAAA,IACD;AAAA;AAAA,IAGA;AAAA,MACC;AAAA,MACA;AAAA,MACA;AAAA,MACA,OAAO,QAAQ;AACd,cAAM,KAAK,IAAI,KAAK,SAAS,IAAI;AACjC,YAAI,CAAC,MAAM,CAAC,QAAQ,KAAK,EAAE,GAAG;AAC7B,qBAAO,4BAAe,iBAAK,WAAW,mBAAmB,gBAAgB;AAAA,QAC1E;AACA,cAAM,QAAQ,MAAM,OAAO,IAAI,EAAE;AACjC,YAAI,CAAC,MAAO,YAAO,4BAAe,iBAAK,WAAW,mBAAmB,gBAAgB;AACrF,YAAI,MAAM,cAAc,IAAI,KAAM,IAAI;AACrC,qBAAO,4BAAe,iBAAK,WAAW,aAAa,0CAA0C;AAAA,QAC9F;AACA,cAAM,OAAO,SAAS,OAAO,MAAM,UAAU;AAC7C,cAAM,OAAO,OAAO,EAAE;AACtB,mBAAO,4BAAe,iBAAK,IAAI,iBAAiB,kBAAkB,EAAE,GAAG,CAAC;AAAA,MACzE;AAAA,IACD;AAAA,EACD;AACD;;;AKpIO,IAAM,cAAN,MAA6C;AAAA,EAInD,YACkB,OACA,QAChB;AAFgB;AACA;AAAA,EACf;AAAA,EAFe;AAAA,EACA;AAAA,EALT,OAAO;AAAA,EACP,OAAO,CAAC,gBAAgB;AAAA,EAOjC,QAAQ,KAAyB;AAChC,eAAW,CAAC,QAAQ,MAAM,GAAG,QAAQ,KAAK,iBAAiB,KAAK,OAAO,KAAK,MAAM,GAAG;AACpF,UAAI,SAAS,QAAQ,MAAM,GAAG,QAAQ;AAAA,IACvC;AAAA,EACD;AACD;;;ANpBA,qBAAgD;","names":[]}
+{"version":3,"sources":["../src/index.ts","../src/routes.ts","../src/config.ts","../src/models/asset.model.ts","../src/dtos/media.ts","../src/services/image.ts","../src/module.ts"],"sourcesContent":["export { MediaModule } from './module';\nexport { DEFAULT_ALLOWED_TYPES, DEFAULT_MAX_BYTES } from './config';\nexport type { IMediaConfig } from './config';\n\n// Storage lives in @fonderie/storage now; re-exported here for convenience so\n// existing consumers can keep importing the zero-infra providers from media.\n// S3Provider (the object-storage backend) is at '@fonderie/storage/s3'.\nexport { DbBlobProvider, LocalFsProvider } from '@fonderie/storage';\nexport type { IStorageProvider, IFetched, IStoredRef } from '@fonderie/storage';\n\n// For server-side resolution (e.g. wiring a user's avatar URL) and custom flows.\nexport { MediaAssetModel } from './models/asset.model';\nexport { toMediaAssetDTO } from './dtos/media';\nexport type { IMediaAssetDTO } from './dtos/media';\nexport type { IMediaAsset, ICreateAssetInput } from './types';\nexport { decodeBase64, sniffImageType } from './services/image';\n","import type { Middleware } from '@fonderie/core';\nimport { HTTP, setApiResponse } from '@fonderie/core';\nimport { requireAuth } from '@fonderie/core/middlewares';\nimport type { IStoreAdapter } from '@fonderie/store';\n\nimport { DEFAULT_ALLOWED_TYPES, DEFAULT_MAX_BYTES, type IMediaConfig } from './config';\nimport { MediaAssetModel } from './models/asset.model';\nimport { toMediaAssetDTO } from './dtos/media';\nimport { decodeBase64, sniffImageType } from './services/image';\n\ntype Route = [string, string, ...Middleware[]];\n\nconst UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;\n\nexport function buildMediaRoutes(store: IStoreAdapter, config: IMediaConfig): Route[] {\n\tconst assets = new MediaAssetModel(store);\n\tconst maxBytes = config.maxBytes ?? DEFAULT_MAX_BYTES;\n\tconst allowed = config.allowedTypes ?? DEFAULT_ALLOWED_TYPES;\n\n\treturn [\n\t\t// POST /media { dataBase64, ownerType?, ownerId?, purpose? } -> { asset }\n\t\t// Accepts base64 (bare or a data URI), verifies it's a real image by its\n\t\t// magic bytes (never the client's claim), caps the decoded size, stores\n\t\t// the bytes via the provider, and records metadata. Returns a URL.\n\t\t[\n\t\t\t'POST',\n\t\t\t'/media',\n\t\t\trequireAuth,\n\t\t\tasync (ctx) => {\n\t\t\t\tconst userId = ctx.user!.id;\n\t\t\t\tconst body = (ctx.meta['body'] ?? {}) as {\n\t\t\t\t\tdataBase64?: unknown;\n\t\t\t\t\townerType?: unknown;\n\t\t\t\t\townerId?: unknown;\n\t\t\t\t\tpurpose?: unknown;\n\t\t\t\t};\n\n\t\t\t\tif (typeof body.dataBase64 !== 'string' || body.dataBase64.length === 0) {\n\t\t\t\t\treturn setApiResponse(HTTP.UNPROCESSABLE, 'INVALID_PARAMETER', 'dataBase64 (a base64 string) is required.');\n\t\t\t\t}\n\t\t\t\t// Reject oversized uploads BEFORE decoding — base64 inflates ~4/3, so a\n\t\t\t\t// string longer than maxBytes*1.4 cannot fit the cap. Bounds the decode\n\t\t\t\t// allocation instead of materializing a huge buffer only to reject it.\n\t\t\t\t// (A request-body-size limit at the adapter is the complementary guard.)\n\t\t\t\tif (body.dataBase64.length > Math.ceil(maxBytes * 1.4)) {\n\t\t\t\t\treturn setApiResponse(HTTP.UNPROCESSABLE, 'ASSET_TOO_LARGE', `Image exceeds the ${maxBytes}-byte limit.`);\n\t\t\t\t}\n\n\t\t\t\tlet bytes: Uint8Array;\n\t\t\t\ttry {\n\t\t\t\t\tbytes = decodeBase64(body.dataBase64);\n\t\t\t\t} catch {\n\t\t\t\t\treturn setApiResponse(HTTP.UNPROCESSABLE, 'INVALID_PARAMETER', 'dataBase64 is not valid base64.');\n\t\t\t\t}\n\t\t\t\tif (bytes.byteLength === 0) {\n\t\t\t\t\treturn setApiResponse(HTTP.UNPROCESSABLE, 'INVALID_PARAMETER', 'The image is empty.');\n\t\t\t\t}\n\t\t\t\tif (bytes.byteLength > maxBytes) {\n\t\t\t\t\treturn setApiResponse(HTTP.UNPROCESSABLE, 'ASSET_TOO_LARGE', `Image exceeds the ${maxBytes}-byte limit.`);\n\t\t\t\t}\n\n\t\t\t\tconst contentType = sniffImageType(bytes);\n\t\t\t\tif (!contentType || !allowed.includes(contentType)) {\n\t\t\t\t\treturn setApiResponse(\n\t\t\t\t\t\tHTTP.UNPROCESSABLE,\n\t\t\t\t\t\t'ASSET_UNSUPPORTED',\n\t\t\t\t\t\t`Unsupported image type. Allowed: ${allowed.join(', ')}.`,\n\t\t\t\t\t);\n\t\t\t\t}\n\n\t\t\t\tconst ownerType = typeof body.ownerType === 'string' ? body.ownerType : 'user';\n\t\t\t\tconst ownerId = typeof body.ownerId === 'string' ? body.ownerId : userId;\n\t\t\t\tconst purpose = typeof body.purpose === 'string' ? body.purpose : 'avatar';\n\n\t\t\t\t// Authorize the target owner. Default policy: self-owned user assets\n\t\t\t\t// only; a consumer opts into other owners (workspace logos, customer\n\t\t\t\t// photos) via config.authorizeOwner.\n\t\t\t\tconst authorized = config.authorizeOwner\n\t\t\t\t\t? await config.authorizeOwner(ctx, { ownerType, ownerId })\n\t\t\t\t\t: ownerType === 'user' && ownerId === userId;\n\t\t\t\tif (!authorized) {\n\t\t\t\t\treturn setApiResponse(HTTP.FORBIDDEN, 'FORBIDDEN', 'Not allowed to upload for that owner.');\n\t\t\t\t}\n\n\t\t\t\tconst { ref } = await config.provider.put({ bytes, contentType });\n\t\t\t\tlet asset: Awaited<ReturnType<typeof assets.create>>;\n\t\t\t\ttry {\n\t\t\t\t\tasset = await assets.create({\n\t\t\t\t\t\townerType,\n\t\t\t\t\t\townerId,\n\t\t\t\t\t\tpurpose,\n\t\t\t\t\t\tcontentType,\n\t\t\t\t\t\tbyteSize: bytes.byteLength,\n\t\t\t\t\t\tstorageRef: ref,\n\t\t\t\t\t\tcreatedBy: userId,\n\t\t\t\t\t});\n\t\t\t\t} catch (err) {\n\t\t\t\t\t// Metadata insert failed — don't orphan the bytes we just stored.\n\t\t\t\t\tawait config.provider.delete(ref).catch(() => {});\n\t\t\t\t\tthrow err;\n\t\t\t\t}\n\n\t\t\t\t// Build the URL at whatever prefix this route is mounted under\n\t\t\t\t// (e.g. '/v1/media/:id'), derived from the request path.\n\t\t\t\tconst basePath = new URL(ctx.request.url).pathname.replace(/\\/media$/, '');\n\t\t\t\treturn setApiResponse(HTTP.OK, 'ASSET_CREATED', 'Asset uploaded.', {\n\t\t\t\t\tasset: toMediaAssetDTO(asset, basePath),\n\t\t\t\t});\n\t\t\t},\n\t\t],\n\n\t\t// GET /media/:id  (PUBLIC — an <img src> can't send an Authorization\n\t\t// header) -> the image bytes with cache headers, or a 302 to a\n\t\t// provider-served URL. Assets are immutable, so the id is a stable ETag.\n\t\t[\n\t\t\t'GET',\n\t\t\t'/media/:id',\n\t\t\tasync (ctx) => {\n\t\t\t\tconst id = ctx.meta.params?.['id'];\n\t\t\t\tif (!id || !UUID_RE.test(id)) return new Response('Not found', { status: 404 });\n\n\t\t\t\tconst asset = await assets.get(id);\n\t\t\t\tif (!asset) return new Response('Not found', { status: 404 });\n\n\t\t\t\tconst etag = `\"${asset.id}\"`;\n\t\t\t\tif (ctx.request.headers.get('if-none-match') === etag) {\n\t\t\t\t\treturn new Response(null, { status: 304, headers: { ETag: etag } });\n\t\t\t\t}\n\n\t\t\t\tconst fetched = await config.provider.get(asset.storageRef);\n\t\t\t\tif (!fetched) return new Response('Not found', { status: 404 });\n\t\t\t\tif (fetched.kind === 'redirect') {\n\t\t\t\t\treturn new Response(null, { status: 302, headers: { Location: fetched.url } });\n\t\t\t\t}\n\t\t\t\t// Fresh Uint8Array (ArrayBuffer-backed) so it satisfies BodyInit; a\n\t\t\t\t// pg Buffer is typed Uint8Array<ArrayBufferLike>, which the lib rejects.\n\t\t\t\treturn new Response(new Uint8Array(fetched.bytes), {\n\t\t\t\t\tstatus: 200,\n\t\t\t\t\theaders: {\n\t\t\t\t\t\t'Content-Type': asset.contentType,\n\t\t\t\t\t\t'Content-Length': String(asset.byteSize),\n\t\t\t\t\t\t'Cache-Control': 'public, max-age=300',\n\t\t\t\t\t\tETag: etag,\n\t\t\t\t\t},\n\t\t\t\t});\n\t\t\t},\n\t\t],\n\n\t\t// DELETE /media/:id  -> removes the asset; only the uploader may delete it.\n\t\t[\n\t\t\t'DELETE',\n\t\t\t'/media/:id',\n\t\t\trequireAuth,\n\t\t\tasync (ctx) => {\n\t\t\t\tconst id = ctx.meta.params?.['id'];\n\t\t\t\tif (!id || !UUID_RE.test(id)) {\n\t\t\t\t\treturn setApiResponse(HTTP.NOT_FOUND, 'ASSET_NOT_FOUND', 'No such asset.');\n\t\t\t\t}\n\t\t\t\tconst asset = await assets.get(id);\n\t\t\t\tif (!asset) return setApiResponse(HTTP.NOT_FOUND, 'ASSET_NOT_FOUND', 'No such asset.');\n\t\t\t\tif (asset.createdBy !== ctx.user!.id) {\n\t\t\t\t\treturn setApiResponse(HTTP.FORBIDDEN, 'FORBIDDEN', 'You can only delete assets you uploaded.');\n\t\t\t\t}\n\t\t\t\tawait config.provider.delete(asset.storageRef);\n\t\t\t\tawait assets.delete(id);\n\t\t\t\treturn setApiResponse(HTTP.OK, 'ASSET_DELETED', 'Asset deleted.', { id });\n\t\t\t},\n\t\t],\n\t];\n}\n","import type { IFonderieContext } from '@fonderie/core';\nimport type { IStorageProvider } from '@fonderie/storage';\n\nexport interface IMediaConfig {\n\t/** Where bytes are stored. `DbBlobProvider` (zero infra) by default; swap for S3 at scale. */\n\tprovider: IStorageProvider;\n\t/** Max decoded size per asset, in bytes. Default 1 MB. */\n\tmaxBytes?: number;\n\t/**\n\t * Content types accepted on upload (matched against magic bytes, not the\n\t * client's claim). Default: PNG / JPEG / WebP / GIF. SVG is never accepted —\n\t * it's a stored-XSS vector.\n\t */\n\tallowedTypes?: string[];\n\t/**\n\t * Authorize an upload's target owner. Return false to reject with 403. When\n\t * omitted, the default policy allows only **self-owned user assets**\n\t * (`ownerType: 'user'`, `ownerId` = the authenticated caller). Provide this\n\t * to permit other owners — e.g. a workspace logo the caller may administer, a\n\t * customer photo in the caller's workspace.\n\t */\n\tauthorizeOwner?(\n\t\tctx: IFonderieContext,\n\t\towner: { ownerType: string; ownerId: string },\n\t): boolean | Promise<boolean>;\n}\n\nexport const DEFAULT_MAX_BYTES = 1_000_000;\nexport const DEFAULT_ALLOWED_TYPES = ['image/png', 'image/jpeg', 'image/webp', 'image/gif'];\n","import type { IStoreAdapter } from '@fonderie/store';\n\nimport type { ICreateAssetInput, IMediaAsset } from '../types';\n\ninterface AssetRow {\n\tid: string;\n\towner_type: string;\n\towner_id: string;\n\tpurpose: string;\n\tcontent_type: string;\n\tbyte_size: number;\n\tstorage_ref: string;\n\tcreated_by: string | null;\n\tcreated_at: Date;\n}\n\nconst toAsset = (r: AssetRow): IMediaAsset => ({\n\tid: r.id,\n\townerType: r.owner_type,\n\townerId: r.owner_id,\n\tpurpose: r.purpose,\n\tcontentType: r.content_type,\n\tbyteSize: r.byte_size,\n\tstorageRef: r.storage_ref,\n\tcreatedBy: r.created_by,\n\tcreatedAt: r.created_at,\n});\n\n/** Data access for `fonderie_media_assets` — the metadata around each stored blob. */\nexport class MediaAssetModel {\n\tconstructor(private readonly store: IStoreAdapter) {}\n\n\tasync create(input: ICreateAssetInput): Promise<IMediaAsset> {\n\t\tconst rows = await this.store.query<AssetRow>(\n\t\t\t`INSERT INTO fonderie_media_assets\n\t\t\t   (owner_type, owner_id, purpose, content_type, byte_size, storage_ref, created_by)\n\t\t\t VALUES ($1, $2, $3, $4, $5, $6, $7)\n\t\t\t RETURNING *`,\n\t\t\t[input.ownerType, input.ownerId, input.purpose, input.contentType, input.byteSize, input.storageRef, input.createdBy],\n\t\t);\n\t\treturn toAsset(rows[0]!);\n\t}\n\n\tasync get(id: string): Promise<IMediaAsset | null> {\n\t\tconst rows = await this.store.query<AssetRow>('SELECT * FROM fonderie_media_assets WHERE id = $1', [id]);\n\t\treturn rows[0] ? toAsset(rows[0]) : null;\n\t}\n\n\t/** The most recent asset for an owner + purpose (e.g. a user's current avatar). */\n\tasync latestFor(ownerType: string, ownerId: string, purpose: string): Promise<IMediaAsset | null> {\n\t\tconst rows = await this.store.query<AssetRow>(\n\t\t\t`SELECT * FROM fonderie_media_assets\n\t\t\t   WHERE owner_type = $1 AND owner_id = $2 AND purpose = $3\n\t\t\t   ORDER BY created_at DESC LIMIT 1`,\n\t\t\t[ownerType, ownerId, purpose],\n\t\t);\n\t\treturn rows[0] ? toAsset(rows[0]) : null;\n\t}\n\n\tasync delete(id: string): Promise<void> {\n\t\tawait this.store.query('DELETE FROM fonderie_media_assets WHERE id = $1', [id]);\n\t}\n}\n","import type { IMediaAsset } from '../types';\n\n/**\n * The wire shape for a stored asset. `url` is the monomorphic read contract:\n * always a `/media/:id` path, whatever the backend — clients render it in an\n * `<img>` and never care whether the bytes came from Postgres, disk, or S3.\n */\nexport interface IMediaAssetDTO {\n\tid: string;\n\turl: string;\n\tcontentType: string;\n\tbyteSize: number;\n\townerType: string;\n\townerId: string;\n\tpurpose: string;\n\tcreatedAt: string;\n}\n\n/** basePath is the router mount (e.g. '/v1'); '' yields a root-relative '/media/:id'. */\nexport function toMediaAssetDTO(asset: IMediaAsset, basePath = ''): IMediaAssetDTO {\n\treturn {\n\t\tid: asset.id,\n\t\turl: `${basePath}/media/${asset.id}`,\n\t\tcontentType: asset.contentType,\n\t\tbyteSize: asset.byteSize,\n\t\townerType: asset.ownerType,\n\t\townerId: asset.ownerId,\n\t\tpurpose: asset.purpose,\n\t\tcreatedAt: asset.createdAt instanceof Date ? asset.createdAt.toISOString() : String(asset.createdAt),\n\t};\n}\n","/**\n * Decode a base64 payload to bytes. Accepts both a bare base64 string and a\n * data URI (`data:image/png;base64,<...>`) — the frontend `FileReader` produces\n * the latter, so callers don't have to strip it.\n */\nexport function decodeBase64(input: string): Uint8Array {\n\tconst comma = input.startsWith('data:') ? input.indexOf(',') : -1;\n\tconst b64 = comma >= 0 ? input.slice(comma + 1) : input;\n\treturn new Uint8Array(Buffer.from(b64, 'base64'));\n}\n\n/**\n * Identify an image from its magic bytes — NOT from a client-claimed MIME type,\n * which is trivially spoofed. Returns the canonical content type or `null` for\n * anything unrecognised. SVG is deliberately not detected (it's XML, can carry\n * scripts, and is a stored-XSS vector), so it falls through to `null` and is\n * rejected upstream.\n */\nexport function sniffImageType(bytes: Uint8Array): string | null {\n\tconst b = bytes;\n\t// PNG: 89 50 4E 47 0D 0A 1A 0A\n\tif (b.length >= 8 && b[0] === 0x89 && b[1] === 0x50 && b[2] === 0x4e && b[3] === 0x47 && b[4] === 0x0d && b[5] === 0x0a && b[6] === 0x1a && b[7] === 0x0a) {\n\t\treturn 'image/png';\n\t}\n\t// JPEG: FF D8 FF\n\tif (b.length >= 3 && b[0] === 0xff && b[1] === 0xd8 && b[2] === 0xff) {\n\t\treturn 'image/jpeg';\n\t}\n\t// GIF: \"GIF87a\" / \"GIF89a\"\n\tif (b.length >= 6 && b[0] === 0x47 && b[1] === 0x49 && b[2] === 0x46 && b[3] === 0x38 && (b[4] === 0x37 || b[4] === 0x39) && b[5] === 0x61) {\n\t\treturn 'image/gif';\n\t}\n\t// WEBP: \"RIFF\" .... \"WEBP\" (bytes 0-3 and 8-11)\n\tif (b.length >= 12 && b[0] === 0x52 && b[1] === 0x49 && b[2] === 0x46 && b[3] === 0x46 && b[8] === 0x57 && b[9] === 0x45 && b[10] === 0x42 && b[11] === 0x50) {\n\t\treturn 'image/webp';\n\t}\n\treturn null;\n}\n","import type { IFonderieApp, IFonderieModule } from '@fonderie/core';\nimport type { IStoreAdapter } from '@fonderie/store';\n\nimport type { IMediaConfig } from './config';\nimport { buildMediaRoutes } from './routes';\n\n/**\n * Provider-abstracted asset storage. Register it like any other brick; it adds\n * `POST /media`, `GET /media/:id` (public), and `DELETE /media/:id`, and stores\n * bytes through the configured `IStorageProvider` (`DbBlobProvider` for zero\n * infra, swappable for object storage). Depends on `@fonderie/auth` for the\n * authenticated caller on upload/delete.\n */\nexport class MediaModule implements IFonderieModule {\n\treadonly name = '@fonderie/media';\n\treadonly deps = ['@fonderie/auth'];\n\n\tconstructor(\n\t\tprivate readonly store: IStoreAdapter,\n\t\tprivate readonly config: IMediaConfig,\n\t) {}\n\n\tinstall(app: IFonderieApp): void {\n\t\tfor (const [method, path, ...handlers] of buildMediaRoutes(this.store, this.config)) {\n\t\t\tapp.addRoute(method, path, ...handlers);\n\t\t}\n\t}\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACCA,kBAAqC;AACrC,yBAA4B;;;ACyBrB,IAAM,oBAAoB;AAC1B,IAAM,wBAAwB,CAAC,aAAa,cAAc,cAAc,WAAW;;;ACZ1F,IAAM,UAAU,CAAC,OAA8B;AAAA,EAC9C,IAAI,EAAE;AAAA,EACN,WAAW,EAAE;AAAA,EACb,SAAS,EAAE;AAAA,EACX,SAAS,EAAE;AAAA,EACX,aAAa,EAAE;AAAA,EACf,UAAU,EAAE;AAAA,EACZ,YAAY,EAAE;AAAA,EACd,WAAW,EAAE;AAAA,EACb,WAAW,EAAE;AACd;AAGO,IAAM,kBAAN,MAAsB;AAAA,EAC5B,YAA6B,OAAsB;AAAtB;AAAA,EAAuB;AAAA,EAAvB;AAAA,EAE7B,MAAM,OAAO,OAAgD;AAC5D,UAAM,OAAO,MAAM,KAAK,MAAM;AAAA,MAC7B;AAAA;AAAA;AAAA;AAAA,MAIA,CAAC,MAAM,WAAW,MAAM,SAAS,MAAM,SAAS,MAAM,aAAa,MAAM,UAAU,MAAM,YAAY,MAAM,SAAS;AAAA,IACrH;AACA,WAAO,QAAQ,KAAK,CAAC,CAAE;AAAA,EACxB;AAAA,EAEA,MAAM,IAAI,IAAyC;AAClD,UAAM,OAAO,MAAM,KAAK,MAAM,MAAgB,qDAAqD,CAAC,EAAE,CAAC;AACvG,WAAO,KAAK,CAAC,IAAI,QAAQ,KAAK,CAAC,CAAC,IAAI;AAAA,EACrC;AAAA;AAAA,EAGA,MAAM,UAAU,WAAmB,SAAiB,SAA8C;AACjG,UAAM,OAAO,MAAM,KAAK,MAAM;AAAA,MAC7B;AAAA;AAAA;AAAA,MAGA,CAAC,WAAW,SAAS,OAAO;AAAA,IAC7B;AACA,WAAO,KAAK,CAAC,IAAI,QAAQ,KAAK,CAAC,CAAC,IAAI;AAAA,EACrC;AAAA,EAEA,MAAM,OAAO,IAA2B;AACvC,UAAM,KAAK,MAAM,MAAM,mDAAmD,CAAC,EAAE,CAAC;AAAA,EAC/E;AACD;;;AC3CO,SAAS,gBAAgB,OAAoB,WAAW,IAAoB;AAClF,SAAO;AAAA,IACN,IAAI,MAAM;AAAA,IACV,KAAK,GAAG,QAAQ,UAAU,MAAM,EAAE;AAAA,IAClC,aAAa,MAAM;AAAA,IACnB,UAAU,MAAM;AAAA,IAChB,WAAW,MAAM;AAAA,IACjB,SAAS,MAAM;AAAA,IACf,SAAS,MAAM;AAAA,IACf,WAAW,MAAM,qBAAqB,OAAO,MAAM,UAAU,YAAY,IAAI,OAAO,MAAM,SAAS;AAAA,EACpG;AACD;;;ACzBO,SAAS,aAAa,OAA2B;AACvD,QAAM,QAAQ,MAAM,WAAW,OAAO,IAAI,MAAM,QAAQ,GAAG,IAAI;AAC/D,QAAM,MAAM,SAAS,IAAI,MAAM,MAAM,QAAQ,CAAC,IAAI;AAClD,SAAO,IAAI,WAAW,OAAO,KAAK,KAAK,QAAQ,CAAC;AACjD;AASO,SAAS,eAAe,OAAkC;AAChE,QAAM,IAAI;AAEV,MAAI,EAAE,UAAU,KAAK,EAAE,CAAC,MAAM,OAAQ,EAAE,CAAC,MAAM,MAAQ,EAAE,CAAC,MAAM,MAAQ,EAAE,CAAC,MAAM,MAAQ,EAAE,CAAC,MAAM,MAAQ,EAAE,CAAC,MAAM,MAAQ,EAAE,CAAC,MAAM,MAAQ,EAAE,CAAC,MAAM,IAAM;AAC1J,WAAO;AAAA,EACR;AAEA,MAAI,EAAE,UAAU,KAAK,EAAE,CAAC,MAAM,OAAQ,EAAE,CAAC,MAAM,OAAQ,EAAE,CAAC,MAAM,KAAM;AACrE,WAAO;AAAA,EACR;AAEA,MAAI,EAAE,UAAU,KAAK,EAAE,CAAC,MAAM,MAAQ,EAAE,CAAC,MAAM,MAAQ,EAAE,CAAC,MAAM,MAAQ,EAAE,CAAC,MAAM,OAAS,EAAE,CAAC,MAAM,MAAQ,EAAE,CAAC,MAAM,OAAS,EAAE,CAAC,MAAM,IAAM;AAC3I,WAAO;AAAA,EACR;AAEA,MAAI,EAAE,UAAU,MAAM,EAAE,CAAC,MAAM,MAAQ,EAAE,CAAC,MAAM,MAAQ,EAAE,CAAC,MAAM,MAAQ,EAAE,CAAC,MAAM,MAAQ,EAAE,CAAC,MAAM,MAAQ,EAAE,CAAC,MAAM,MAAQ,EAAE,EAAE,MAAM,MAAQ,EAAE,EAAE,MAAM,IAAM;AAC7J,WAAO;AAAA,EACR;AACA,SAAO;AACR;;;AJzBA,IAAM,UAAU;AAET,SAAS,iBAAiB,OAAsB,QAA+B;AACrF,QAAM,SAAS,IAAI,gBAAgB,KAAK;AACxC,QAAM,WAAW,OAAO,YAAY;AACpC,QAAM,UAAU,OAAO,gBAAgB;AAEvC,SAAO;AAAA;AAAA;AAAA;AAAA;AAAA,IAKN;AAAA,MACC;AAAA,MACA;AAAA,MACA;AAAA,MACA,OAAO,QAAQ;AACd,cAAM,SAAS,IAAI,KAAM;AACzB,cAAM,OAAQ,IAAI,KAAK,MAAM,KAAK,CAAC;AAOnC,YAAI,OAAO,KAAK,eAAe,YAAY,KAAK,WAAW,WAAW,GAAG;AACxE,qBAAO,4BAAe,iBAAK,eAAe,qBAAqB,2CAA2C;AAAA,QAC3G;AAKA,YAAI,KAAK,WAAW,SAAS,KAAK,KAAK,WAAW,GAAG,GAAG;AACvD,qBAAO,4BAAe,iBAAK,eAAe,mBAAmB,qBAAqB,QAAQ,cAAc;AAAA,QACzG;AAEA,YAAI;AACJ,YAAI;AACH,kBAAQ,aAAa,KAAK,UAAU;AAAA,QACrC,QAAQ;AACP,qBAAO,4BAAe,iBAAK,eAAe,qBAAqB,iCAAiC;AAAA,QACjG;AACA,YAAI,MAAM,eAAe,GAAG;AAC3B,qBAAO,4BAAe,iBAAK,eAAe,qBAAqB,qBAAqB;AAAA,QACrF;AACA,YAAI,MAAM,aAAa,UAAU;AAChC,qBAAO,4BAAe,iBAAK,eAAe,mBAAmB,qBAAqB,QAAQ,cAAc;AAAA,QACzG;AAEA,cAAM,cAAc,eAAe,KAAK;AACxC,YAAI,CAAC,eAAe,CAAC,QAAQ,SAAS,WAAW,GAAG;AACnD,qBAAO;AAAA,YACN,iBAAK;AAAA,YACL;AAAA,YACA,oCAAoC,QAAQ,KAAK,IAAI,CAAC;AAAA,UACvD;AAAA,QACD;AAEA,cAAM,YAAY,OAAO,KAAK,cAAc,WAAW,KAAK,YAAY;AACxE,cAAM,UAAU,OAAO,KAAK,YAAY,WAAW,KAAK,UAAU;AAClE,cAAM,UAAU,OAAO,KAAK,YAAY,WAAW,KAAK,UAAU;AAKlE,cAAM,aAAa,OAAO,iBACvB,MAAM,OAAO,eAAe,KAAK,EAAE,WAAW,QAAQ,CAAC,IACvD,cAAc,UAAU,YAAY;AACvC,YAAI,CAAC,YAAY;AAChB,qBAAO,4BAAe,iBAAK,WAAW,aAAa,uCAAuC;AAAA,QAC3F;AAEA,cAAM,EAAE,IAAI,IAAI,MAAM,OAAO,SAAS,IAAI,EAAE,OAAO,YAAY,CAAC;AAChE,YAAI;AACJ,YAAI;AACH,kBAAQ,MAAM,OAAO,OAAO;AAAA,YAC3B;AAAA,YACA;AAAA,YACA;AAAA,YACA;AAAA,YACA,UAAU,MAAM;AAAA,YAChB,YAAY;AAAA,YACZ,WAAW;AAAA,UACZ,CAAC;AAAA,QACF,SAAS,KAAK;AAEb,gBAAM,OAAO,SAAS,OAAO,GAAG,EAAE,MAAM,MAAM;AAAA,UAAC,CAAC;AAChD,gBAAM;AAAA,QACP;AAIA,cAAM,WAAW,IAAI,IAAI,IAAI,QAAQ,GAAG,EAAE,SAAS,QAAQ,YAAY,EAAE;AACzE,mBAAO,4BAAe,iBAAK,IAAI,iBAAiB,mBAAmB;AAAA,UAClE,OAAO,gBAAgB,OAAO,QAAQ;AAAA,QACvC,CAAC;AAAA,MACF;AAAA,IACD;AAAA;AAAA;AAAA;AAAA,IAKA;AAAA,MACC;AAAA,MACA;AAAA,MACA,OAAO,QAAQ;AACd,cAAM,KAAK,IAAI,KAAK,SAAS,IAAI;AACjC,YAAI,CAAC,MAAM,CAAC,QAAQ,KAAK,EAAE,EAAG,QAAO,IAAI,SAAS,aAAa,EAAE,QAAQ,IAAI,CAAC;AAE9E,cAAM,QAAQ,MAAM,OAAO,IAAI,EAAE;AACjC,YAAI,CAAC,MAAO,QAAO,IAAI,SAAS,aAAa,EAAE,QAAQ,IAAI,CAAC;AAE5D,cAAM,OAAO,IAAI,MAAM,EAAE;AACzB,YAAI,IAAI,QAAQ,QAAQ,IAAI,eAAe,MAAM,MAAM;AACtD,iBAAO,IAAI,SAAS,MAAM,EAAE,QAAQ,KAAK,SAAS,EAAE,MAAM,KAAK,EAAE,CAAC;AAAA,QACnE;AAEA,cAAM,UAAU,MAAM,OAAO,SAAS,IAAI,MAAM,UAAU;AAC1D,YAAI,CAAC,QAAS,QAAO,IAAI,SAAS,aAAa,EAAE,QAAQ,IAAI,CAAC;AAC9D,YAAI,QAAQ,SAAS,YAAY;AAChC,iBAAO,IAAI,SAAS,MAAM,EAAE,QAAQ,KAAK,SAAS,EAAE,UAAU,QAAQ,IAAI,EAAE,CAAC;AAAA,QAC9E;AAGA,eAAO,IAAI,SAAS,IAAI,WAAW,QAAQ,KAAK,GAAG;AAAA,UAClD,QAAQ;AAAA,UACR,SAAS;AAAA,YACR,gBAAgB,MAAM;AAAA,YACtB,kBAAkB,OAAO,MAAM,QAAQ;AAAA,YACvC,iBAAiB;AAAA,YACjB,MAAM;AAAA,UACP;AAAA,QACD,CAAC;AAAA,MACF;AAAA,IACD;AAAA;AAAA,IAGA;AAAA,MACC;AAAA,MACA;AAAA,MACA;AAAA,MACA,OAAO,QAAQ;AACd,cAAM,KAAK,IAAI,KAAK,SAAS,IAAI;AACjC,YAAI,CAAC,MAAM,CAAC,QAAQ,KAAK,EAAE,GAAG;AAC7B,qBAAO,4BAAe,iBAAK,WAAW,mBAAmB,gBAAgB;AAAA,QAC1E;AACA,cAAM,QAAQ,MAAM,OAAO,IAAI,EAAE;AACjC,YAAI,CAAC,MAAO,YAAO,4BAAe,iBAAK,WAAW,mBAAmB,gBAAgB;AACrF,YAAI,MAAM,cAAc,IAAI,KAAM,IAAI;AACrC,qBAAO,4BAAe,iBAAK,WAAW,aAAa,0CAA0C;AAAA,QAC9F;AACA,cAAM,OAAO,SAAS,OAAO,MAAM,UAAU;AAC7C,cAAM,OAAO,OAAO,EAAE;AACtB,mBAAO,4BAAe,iBAAK,IAAI,iBAAiB,kBAAkB,EAAE,GAAG,CAAC;AAAA,MACzE;AAAA,IACD;AAAA,EACD;AACD;;;AK5JO,IAAM,cAAN,MAA6C;AAAA,EAInD,YACkB,OACA,QAChB;AAFgB;AACA;AAAA,EACf;AAAA,EAFe;AAAA,EACA;AAAA,EALT,OAAO;AAAA,EACP,OAAO,CAAC,gBAAgB;AAAA,EAOjC,QAAQ,KAAyB;AAChC,eAAW,CAAC,QAAQ,MAAM,GAAG,QAAQ,KAAK,iBAAiB,KAAK,OAAO,KAAK,MAAM,GAAG;AACpF,UAAI,SAAS,QAAQ,MAAM,GAAG,QAAQ;AAAA,IACvC;AAAA,EACD;AACD;;;ANpBA,qBAAgD;","names":[]}

package/dist/index.d.cts

@@ -1,4 +1,4 @@
-import { IFonderieModule, IFonderieApp } from '@fonderie/core';
+import { IFonderieContext, IFonderieModule, IFonderieApp } from '@fonderie/core';
 import { IStoreAdapter } from '@fonderie/store';
 import { IStorageProvider } from '@fonderie/storage';
 export { DbBlobProvider, IFetched, IStorageProvider, IStoredRef, LocalFsProvider } from '@fonderie/storage';
@@ -14,6 +14,17 @@ interface IMediaConfig {
      * it's a stored-XSS vector.
      */
     allowedTypes?: string[];
+    /**
+     * Authorize an upload's target owner. Return false to reject with 403. When
+     * omitted, the default policy allows only **self-owned user assets**
+     * (`ownerType: 'user'`, `ownerId` = the authenticated caller). Provide this
+     * to permit other owners — e.g. a workspace logo the caller may administer, a
+     * customer photo in the caller's workspace.
+     */
+    authorizeOwner?(ctx: IFonderieContext, owner: {
+        ownerType: string;
+        ownerId: string;
+    }): boolean | Promise<boolean>;
 }
 declare const DEFAULT_MAX_BYTES = 1000000;
 declare const DEFAULT_ALLOWED_TYPES: string[];

package/dist/index.d.ts

@@ -1,4 +1,4 @@
-import { IFonderieModule, IFonderieApp } from '@fonderie/core';
+import { IFonderieContext, IFonderieModule, IFonderieApp } from '@fonderie/core';
 import { IStoreAdapter } from '@fonderie/store';
 import { IStorageProvider } from '@fonderie/storage';
 export { DbBlobProvider, IFetched, IStorageProvider, IStoredRef, LocalFsProvider } from '@fonderie/storage';
@@ -14,6 +14,17 @@ interface IMediaConfig {
      * it's a stored-XSS vector.
      */
     allowedTypes?: string[];
+    /**
+     * Authorize an upload's target owner. Return false to reject with 403. When
+     * omitted, the default policy allows only **self-owned user assets**
+     * (`ownerType: 'user'`, `ownerId` = the authenticated caller). Provide this
+     * to permit other owners — e.g. a workspace logo the caller may administer, a
+     * customer photo in the caller's workspace.
+     */
+    authorizeOwner?(ctx: IFonderieContext, owner: {
+        ownerType: string;
+        ownerId: string;
+    }): boolean | Promise<boolean>;
 }
 declare const DEFAULT_MAX_BYTES = 1000000;
 declare const DEFAULT_ALLOWED_TYPES: string[];

package/dist/index.js

@@ -110,6 +110,9 @@ function buildMediaRoutes(store, config) {
         if (typeof body.dataBase64 !== "string" || body.dataBase64.length === 0) {
           return setApiResponse(HTTP.UNPROCESSABLE, "INVALID_PARAMETER", "dataBase64 (a base64 string) is required.");
         }
+        if (body.dataBase64.length > Math.ceil(maxBytes * 1.4)) {
+          return setApiResponse(HTTP.UNPROCESSABLE, "ASSET_TOO_LARGE", `Image exceeds the ${maxBytes}-byte limit.`);
+        }
         let bytes;
         try {
           bytes = decodeBase64(body.dataBase64);
@@ -133,16 +136,27 @@ function buildMediaRoutes(store, config) {
         const ownerType = typeof body.ownerType === "string" ? body.ownerType : "user";
         const ownerId = typeof body.ownerId === "string" ? body.ownerId : userId;
         const purpose = typeof body.purpose === "string" ? body.purpose : "avatar";
+        const authorized = config.authorizeOwner ? await config.authorizeOwner(ctx, { ownerType, ownerId }) : ownerType === "user" && ownerId === userId;
+        if (!authorized) {
+          return setApiResponse(HTTP.FORBIDDEN, "FORBIDDEN", "Not allowed to upload for that owner.");
+        }
         const { ref } = await config.provider.put({ bytes, contentType });
-        const asset = await assets.create({
-          ownerType,
-          ownerId,
-          purpose,
-          contentType,
-          byteSize: bytes.byteLength,
-          storageRef: ref,
-          createdBy: userId
-        });
+        let asset;
+        try {
+          asset = await assets.create({
+            ownerType,
+            ownerId,
+            purpose,
+            contentType,
+            byteSize: bytes.byteLength,
+            storageRef: ref,
+            createdBy: userId
+          });
+        } catch (err) {
+          await config.provider.delete(ref).catch(() => {
+          });
+          throw err;
+        }
         const basePath = new URL(ctx.request.url).pathname.replace(/\/media$/, "");
         return setApiResponse(HTTP.OK, "ASSET_CREATED", "Asset uploaded.", {
           asset: toMediaAssetDTO(asset, basePath)

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/routes.ts","../src/config.ts","../src/models/asset.model.ts","../src/dtos/media.ts","../src/services/image.ts","../src/module.ts","../src/index.ts"],"sourcesContent":["import type { Middleware } from '@fonderie/core';\nimport { HTTP, setApiResponse } from '@fonderie/core';\nimport { requireAuth } from '@fonderie/core/middlewares';\nimport type { IStoreAdapter } from '@fonderie/store';\n\nimport { DEFAULT_ALLOWED_TYPES, DEFAULT_MAX_BYTES, type IMediaConfig } from './config';\nimport { MediaAssetModel } from './models/asset.model';\nimport { toMediaAssetDTO } from './dtos/media';\nimport { decodeBase64, sniffImageType } from './services/image';\n\ntype Route = [string, string, ...Middleware[]];\n\nconst UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;\n\nexport function buildMediaRoutes(store: IStoreAdapter, config: IMediaConfig): Route[] {\n\tconst assets = new MediaAssetModel(store);\n\tconst maxBytes = config.maxBytes ?? DEFAULT_MAX_BYTES;\n\tconst allowed = config.allowedTypes ?? DEFAULT_ALLOWED_TYPES;\n\n\treturn [\n\t\t// POST /media { dataBase64, ownerType?, ownerId?, purpose? } -> { asset }\n\t\t// Accepts base64 (bare or a data URI), verifies it's a real image by its\n\t\t// magic bytes (never the client's claim), caps the decoded size, stores\n\t\t// the bytes via the provider, and records metadata. Returns a URL.\n\t\t[\n\t\t\t'POST',\n\t\t\t'/media',\n\t\t\trequireAuth,\n\t\t\tasync (ctx) => {\n\t\t\t\tconst userId = ctx.user!.id;\n\t\t\t\tconst body = (ctx.meta['body'] ?? {}) as {\n\t\t\t\t\tdataBase64?: unknown;\n\t\t\t\t\townerType?: unknown;\n\t\t\t\t\townerId?: unknown;\n\t\t\t\t\tpurpose?: unknown;\n\t\t\t\t};\n\n\t\t\t\tif (typeof body.dataBase64 !== 'string' || body.dataBase64.length === 0) {\n\t\t\t\t\treturn setApiResponse(HTTP.UNPROCESSABLE, 'INVALID_PARAMETER', 'dataBase64 (a base64 string) is required.');\n\t\t\t\t}\n\n\t\t\t\tlet bytes: Uint8Array;\n\t\t\t\ttry {\n\t\t\t\t\tbytes = decodeBase64(body.dataBase64);\n\t\t\t\t} catch {\n\t\t\t\t\treturn setApiResponse(HTTP.UNPROCESSABLE, 'INVALID_PARAMETER', 'dataBase64 is not valid base64.');\n\t\t\t\t}\n\t\t\t\tif (bytes.byteLength === 0) {\n\t\t\t\t\treturn setApiResponse(HTTP.UNPROCESSABLE, 'INVALID_PARAMETER', 'The image is empty.');\n\t\t\t\t}\n\t\t\t\tif (bytes.byteLength > maxBytes) {\n\t\t\t\t\treturn setApiResponse(HTTP.UNPROCESSABLE, 'ASSET_TOO_LARGE', `Image exceeds the ${maxBytes}-byte limit.`);\n\t\t\t\t}\n\n\t\t\t\tconst contentType = sniffImageType(bytes);\n\t\t\t\tif (!contentType || !allowed.includes(contentType)) {\n\t\t\t\t\treturn setApiResponse(\n\t\t\t\t\t\tHTTP.UNPROCESSABLE,\n\t\t\t\t\t\t'ASSET_UNSUPPORTED',\n\t\t\t\t\t\t`Unsupported image type. Allowed: ${allowed.join(', ')}.`,\n\t\t\t\t\t);\n\t\t\t\t}\n\n\t\t\t\tconst ownerType = typeof body.ownerType === 'string' ? body.ownerType : 'user';\n\t\t\t\tconst ownerId = typeof body.ownerId === 'string' ? body.ownerId : userId;\n\t\t\t\tconst purpose = typeof body.purpose === 'string' ? body.purpose : 'avatar';\n\n\t\t\t\tconst { ref } = await config.provider.put({ bytes, contentType });\n\t\t\t\tconst asset = await assets.create({\n\t\t\t\t\townerType,\n\t\t\t\t\townerId,\n\t\t\t\t\tpurpose,\n\t\t\t\t\tcontentType,\n\t\t\t\t\tbyteSize: bytes.byteLength,\n\t\t\t\t\tstorageRef: ref,\n\t\t\t\t\tcreatedBy: userId,\n\t\t\t\t});\n\n\t\t\t\t// Build the URL at whatever prefix this route is mounted under\n\t\t\t\t// (e.g. '/v1/media/:id'), derived from the request path.\n\t\t\t\tconst basePath = new URL(ctx.request.url).pathname.replace(/\\/media$/, '');\n\t\t\t\treturn setApiResponse(HTTP.OK, 'ASSET_CREATED', 'Asset uploaded.', {\n\t\t\t\t\tasset: toMediaAssetDTO(asset, basePath),\n\t\t\t\t});\n\t\t\t},\n\t\t],\n\n\t\t// GET /media/:id  (PUBLIC — an <img src> can't send an Authorization\n\t\t// header) -> the image bytes with cache headers, or a 302 to a\n\t\t// provider-served URL. Assets are immutable, so the id is a stable ETag.\n\t\t[\n\t\t\t'GET',\n\t\t\t'/media/:id',\n\t\t\tasync (ctx) => {\n\t\t\t\tconst id = ctx.meta.params?.['id'];\n\t\t\t\tif (!id || !UUID_RE.test(id)) return new Response('Not found', { status: 404 });\n\n\t\t\t\tconst asset = await assets.get(id);\n\t\t\t\tif (!asset) return new Response('Not found', { status: 404 });\n\n\t\t\t\tconst etag = `\"${asset.id}\"`;\n\t\t\t\tif (ctx.request.headers.get('if-none-match') === etag) {\n\t\t\t\t\treturn new Response(null, { status: 304, headers: { ETag: etag } });\n\t\t\t\t}\n\n\t\t\t\tconst fetched = await config.provider.get(asset.storageRef);\n\t\t\t\tif (!fetched) return new Response('Not found', { status: 404 });\n\t\t\t\tif (fetched.kind === 'redirect') {\n\t\t\t\t\treturn new Response(null, { status: 302, headers: { Location: fetched.url } });\n\t\t\t\t}\n\t\t\t\t// Fresh Uint8Array (ArrayBuffer-backed) so it satisfies BodyInit; a\n\t\t\t\t// pg Buffer is typed Uint8Array<ArrayBufferLike>, which the lib rejects.\n\t\t\t\treturn new Response(new Uint8Array(fetched.bytes), {\n\t\t\t\t\tstatus: 200,\n\t\t\t\t\theaders: {\n\t\t\t\t\t\t'Content-Type': asset.contentType,\n\t\t\t\t\t\t'Content-Length': String(asset.byteSize),\n\t\t\t\t\t\t'Cache-Control': 'public, max-age=300',\n\t\t\t\t\t\tETag: etag,\n\t\t\t\t\t},\n\t\t\t\t});\n\t\t\t},\n\t\t],\n\n\t\t// DELETE /media/:id  -> removes the asset; only the uploader may delete it.\n\t\t[\n\t\t\t'DELETE',\n\t\t\t'/media/:id',\n\t\t\trequireAuth,\n\t\t\tasync (ctx) => {\n\t\t\t\tconst id = ctx.meta.params?.['id'];\n\t\t\t\tif (!id || !UUID_RE.test(id)) {\n\t\t\t\t\treturn setApiResponse(HTTP.NOT_FOUND, 'ASSET_NOT_FOUND', 'No such asset.');\n\t\t\t\t}\n\t\t\t\tconst asset = await assets.get(id);\n\t\t\t\tif (!asset) return setApiResponse(HTTP.NOT_FOUND, 'ASSET_NOT_FOUND', 'No such asset.');\n\t\t\t\tif (asset.createdBy !== ctx.user!.id) {\n\t\t\t\t\treturn setApiResponse(HTTP.FORBIDDEN, 'FORBIDDEN', 'You can only delete assets you uploaded.');\n\t\t\t\t}\n\t\t\t\tawait config.provider.delete(asset.storageRef);\n\t\t\t\tawait assets.delete(id);\n\t\t\t\treturn setApiResponse(HTTP.OK, 'ASSET_DELETED', 'Asset deleted.', { id });\n\t\t\t},\n\t\t],\n\t];\n}\n","import type { IStorageProvider } from '@fonderie/storage';\n\nexport interface IMediaConfig {\n\t/** Where bytes are stored. `DbBlobProvider` (zero infra) by default; swap for S3 at scale. */\n\tprovider: IStorageProvider;\n\t/** Max decoded size per asset, in bytes. Default 1 MB. */\n\tmaxBytes?: number;\n\t/**\n\t * Content types accepted on upload (matched against magic bytes, not the\n\t * client's claim). Default: PNG / JPEG / WebP / GIF. SVG is never accepted —\n\t * it's a stored-XSS vector.\n\t */\n\tallowedTypes?: string[];\n}\n\nexport const DEFAULT_MAX_BYTES = 1_000_000;\nexport const DEFAULT_ALLOWED_TYPES = ['image/png', 'image/jpeg', 'image/webp', 'image/gif'];\n","import type { IStoreAdapter } from '@fonderie/store';\n\nimport type { ICreateAssetInput, IMediaAsset } from '../types';\n\ninterface AssetRow {\n\tid: string;\n\towner_type: string;\n\towner_id: string;\n\tpurpose: string;\n\tcontent_type: string;\n\tbyte_size: number;\n\tstorage_ref: string;\n\tcreated_by: string | null;\n\tcreated_at: Date;\n}\n\nconst toAsset = (r: AssetRow): IMediaAsset => ({\n\tid: r.id,\n\townerType: r.owner_type,\n\townerId: r.owner_id,\n\tpurpose: r.purpose,\n\tcontentType: r.content_type,\n\tbyteSize: r.byte_size,\n\tstorageRef: r.storage_ref,\n\tcreatedBy: r.created_by,\n\tcreatedAt: r.created_at,\n});\n\n/** Data access for `fonderie_media_assets` — the metadata around each stored blob. */\nexport class MediaAssetModel {\n\tconstructor(private readonly store: IStoreAdapter) {}\n\n\tasync create(input: ICreateAssetInput): Promise<IMediaAsset> {\n\t\tconst rows = await this.store.query<AssetRow>(\n\t\t\t`INSERT INTO fonderie_media_assets\n\t\t\t   (owner_type, owner_id, purpose, content_type, byte_size, storage_ref, created_by)\n\t\t\t VALUES ($1, $2, $3, $4, $5, $6, $7)\n\t\t\t RETURNING *`,\n\t\t\t[input.ownerType, input.ownerId, input.purpose, input.contentType, input.byteSize, input.storageRef, input.createdBy],\n\t\t);\n\t\treturn toAsset(rows[0]!);\n\t}\n\n\tasync get(id: string): Promise<IMediaAsset | null> {\n\t\tconst rows = await this.store.query<AssetRow>('SELECT * FROM fonderie_media_assets WHERE id = $1', [id]);\n\t\treturn rows[0] ? toAsset(rows[0]) : null;\n\t}\n\n\t/** The most recent asset for an owner + purpose (e.g. a user's current avatar). */\n\tasync latestFor(ownerType: string, ownerId: string, purpose: string): Promise<IMediaAsset | null> {\n\t\tconst rows = await this.store.query<AssetRow>(\n\t\t\t`SELECT * FROM fonderie_media_assets\n\t\t\t   WHERE owner_type = $1 AND owner_id = $2 AND purpose = $3\n\t\t\t   ORDER BY created_at DESC LIMIT 1`,\n\t\t\t[ownerType, ownerId, purpose],\n\t\t);\n\t\treturn rows[0] ? toAsset(rows[0]) : null;\n\t}\n\n\tasync delete(id: string): Promise<void> {\n\t\tawait this.store.query('DELETE FROM fonderie_media_assets WHERE id = $1', [id]);\n\t}\n}\n","import type { IMediaAsset } from '../types';\n\n/**\n * The wire shape for a stored asset. `url` is the monomorphic read contract:\n * always a `/media/:id` path, whatever the backend — clients render it in an\n * `<img>` and never care whether the bytes came from Postgres, disk, or S3.\n */\nexport interface IMediaAssetDTO {\n\tid: string;\n\turl: string;\n\tcontentType: string;\n\tbyteSize: number;\n\townerType: string;\n\townerId: string;\n\tpurpose: string;\n\tcreatedAt: string;\n}\n\n/** basePath is the router mount (e.g. '/v1'); '' yields a root-relative '/media/:id'. */\nexport function toMediaAssetDTO(asset: IMediaAsset, basePath = ''): IMediaAssetDTO {\n\treturn {\n\t\tid: asset.id,\n\t\turl: `${basePath}/media/${asset.id}`,\n\t\tcontentType: asset.contentType,\n\t\tbyteSize: asset.byteSize,\n\t\townerType: asset.ownerType,\n\t\townerId: asset.ownerId,\n\t\tpurpose: asset.purpose,\n\t\tcreatedAt: asset.createdAt instanceof Date ? asset.createdAt.toISOString() : String(asset.createdAt),\n\t};\n}\n","/**\n * Decode a base64 payload to bytes. Accepts both a bare base64 string and a\n * data URI (`data:image/png;base64,<...>`) — the frontend `FileReader` produces\n * the latter, so callers don't have to strip it.\n */\nexport function decodeBase64(input: string): Uint8Array {\n\tconst comma = input.startsWith('data:') ? input.indexOf(',') : -1;\n\tconst b64 = comma >= 0 ? input.slice(comma + 1) : input;\n\treturn new Uint8Array(Buffer.from(b64, 'base64'));\n}\n\n/**\n * Identify an image from its magic bytes — NOT from a client-claimed MIME type,\n * which is trivially spoofed. Returns the canonical content type or `null` for\n * anything unrecognised. SVG is deliberately not detected (it's XML, can carry\n * scripts, and is a stored-XSS vector), so it falls through to `null` and is\n * rejected upstream.\n */\nexport function sniffImageType(bytes: Uint8Array): string | null {\n\tconst b = bytes;\n\t// PNG: 89 50 4E 47 0D 0A 1A 0A\n\tif (b.length >= 8 && b[0] === 0x89 && b[1] === 0x50 && b[2] === 0x4e && b[3] === 0x47 && b[4] === 0x0d && b[5] === 0x0a && b[6] === 0x1a && b[7] === 0x0a) {\n\t\treturn 'image/png';\n\t}\n\t// JPEG: FF D8 FF\n\tif (b.length >= 3 && b[0] === 0xff && b[1] === 0xd8 && b[2] === 0xff) {\n\t\treturn 'image/jpeg';\n\t}\n\t// GIF: \"GIF87a\" / \"GIF89a\"\n\tif (b.length >= 6 && b[0] === 0x47 && b[1] === 0x49 && b[2] === 0x46 && b[3] === 0x38 && (b[4] === 0x37 || b[4] === 0x39) && b[5] === 0x61) {\n\t\treturn 'image/gif';\n\t}\n\t// WEBP: \"RIFF\" .... \"WEBP\" (bytes 0-3 and 8-11)\n\tif (b.length >= 12 && b[0] === 0x52 && b[1] === 0x49 && b[2] === 0x46 && b[3] === 0x46 && b[8] === 0x57 && b[9] === 0x45 && b[10] === 0x42 && b[11] === 0x50) {\n\t\treturn 'image/webp';\n\t}\n\treturn null;\n}\n","import type { IFonderieApp, IFonderieModule } from '@fonderie/core';\nimport type { IStoreAdapter } from '@fonderie/store';\n\nimport type { IMediaConfig } from './config';\nimport { buildMediaRoutes } from './routes';\n\n/**\n * Provider-abstracted asset storage. Register it like any other brick; it adds\n * `POST /media`, `GET /media/:id` (public), and `DELETE /media/:id`, and stores\n * bytes through the configured `IStorageProvider` (`DbBlobProvider` for zero\n * infra, swappable for object storage). Depends on `@fonderie/auth` for the\n * authenticated caller on upload/delete.\n */\nexport class MediaModule implements IFonderieModule {\n\treadonly name = '@fonderie/media';\n\treadonly deps = ['@fonderie/auth'];\n\n\tconstructor(\n\t\tprivate readonly store: IStoreAdapter,\n\t\tprivate readonly config: IMediaConfig,\n\t) {}\n\n\tinstall(app: IFonderieApp): void {\n\t\tfor (const [method, path, ...handlers] of buildMediaRoutes(this.store, this.config)) {\n\t\t\tapp.addRoute(method, path, ...handlers);\n\t\t}\n\t}\n}\n","export { MediaModule } from './module';\nexport { DEFAULT_ALLOWED_TYPES, DEFAULT_MAX_BYTES } from './config';\nexport type { IMediaConfig } from './config';\n\n// Storage lives in @fonderie/storage now; re-exported here for convenience so\n// existing consumers can keep importing the zero-infra providers from media.\n// S3Provider (the object-storage backend) is at '@fonderie/storage/s3'.\nexport { DbBlobProvider, LocalFsProvider } from '@fonderie/storage';\nexport type { IStorageProvider, IFetched, IStoredRef } from '@fonderie/storage';\n\n// For server-side resolution (e.g. wiring a user's avatar URL) and custom flows.\nexport { MediaAssetModel } from './models/asset.model';\nexport { toMediaAssetDTO } from './dtos/media';\nexport type { IMediaAssetDTO } from './dtos/media';\nexport type { IMediaAsset, ICreateAssetInput } from './types';\nexport { decodeBase64, sniffImageType } from './services/image';\n"],"mappings":";AACA,SAAS,MAAM,sBAAsB;AACrC,SAAS,mBAAmB;;;ACarB,IAAM,oBAAoB;AAC1B,IAAM,wBAAwB,CAAC,aAAa,cAAc,cAAc,WAAW;;;ACA1F,IAAM,UAAU,CAAC,OAA8B;AAAA,EAC9C,IAAI,EAAE;AAAA,EACN,WAAW,EAAE;AAAA,EACb,SAAS,EAAE;AAAA,EACX,SAAS,EAAE;AAAA,EACX,aAAa,EAAE;AAAA,EACf,UAAU,EAAE;AAAA,EACZ,YAAY,EAAE;AAAA,EACd,WAAW,EAAE;AAAA,EACb,WAAW,EAAE;AACd;AAGO,IAAM,kBAAN,MAAsB;AAAA,EAC5B,YAA6B,OAAsB;AAAtB;AAAA,EAAuB;AAAA,EAAvB;AAAA,EAE7B,MAAM,OAAO,OAAgD;AAC5D,UAAM,OAAO,MAAM,KAAK,MAAM;AAAA,MAC7B;AAAA;AAAA;AAAA;AAAA,MAIA,CAAC,MAAM,WAAW,MAAM,SAAS,MAAM,SAAS,MAAM,aAAa,MAAM,UAAU,MAAM,YAAY,MAAM,SAAS;AAAA,IACrH;AACA,WAAO,QAAQ,KAAK,CAAC,CAAE;AAAA,EACxB;AAAA,EAEA,MAAM,IAAI,IAAyC;AAClD,UAAM,OAAO,MAAM,KAAK,MAAM,MAAgB,qDAAqD,CAAC,EAAE,CAAC;AACvG,WAAO,KAAK,CAAC,IAAI,QAAQ,KAAK,CAAC,CAAC,IAAI;AAAA,EACrC;AAAA;AAAA,EAGA,MAAM,UAAU,WAAmB,SAAiB,SAA8C;AACjG,UAAM,OAAO,MAAM,KAAK,MAAM;AAAA,MAC7B;AAAA;AAAA;AAAA,MAGA,CAAC,WAAW,SAAS,OAAO;AAAA,IAC7B;AACA,WAAO,KAAK,CAAC,IAAI,QAAQ,KAAK,CAAC,CAAC,IAAI;AAAA,EACrC;AAAA,EAEA,MAAM,OAAO,IAA2B;AACvC,UAAM,KAAK,MAAM,MAAM,mDAAmD,CAAC,EAAE,CAAC;AAAA,EAC/E;AACD;;;AC3CO,SAAS,gBAAgB,OAAoB,WAAW,IAAoB;AAClF,SAAO;AAAA,IACN,IAAI,MAAM;AAAA,IACV,KAAK,GAAG,QAAQ,UAAU,MAAM,EAAE;AAAA,IAClC,aAAa,MAAM;AAAA,IACnB,UAAU,MAAM;AAAA,IAChB,WAAW,MAAM;AAAA,IACjB,SAAS,MAAM;AAAA,IACf,SAAS,MAAM;AAAA,IACf,WAAW,MAAM,qBAAqB,OAAO,MAAM,UAAU,YAAY,IAAI,OAAO,MAAM,SAAS;AAAA,EACpG;AACD;;;ACzBO,SAAS,aAAa,OAA2B;AACvD,QAAM,QAAQ,MAAM,WAAW,OAAO,IAAI,MAAM,QAAQ,GAAG,IAAI;AAC/D,QAAM,MAAM,SAAS,IAAI,MAAM,MAAM,QAAQ,CAAC,IAAI;AAClD,SAAO,IAAI,WAAW,OAAO,KAAK,KAAK,QAAQ,CAAC;AACjD;AASO,SAAS,eAAe,OAAkC;AAChE,QAAM,IAAI;AAEV,MAAI,EAAE,UAAU,KAAK,EAAE,CAAC,MAAM,OAAQ,EAAE,CAAC,MAAM,MAAQ,EAAE,CAAC,MAAM,MAAQ,EAAE,CAAC,MAAM,MAAQ,EAAE,CAAC,MAAM,MAAQ,EAAE,CAAC,MAAM,MAAQ,EAAE,CAAC,MAAM,MAAQ,EAAE,CAAC,MAAM,IAAM;AAC1J,WAAO;AAAA,EACR;AAEA,MAAI,EAAE,UAAU,KAAK,EAAE,CAAC,MAAM,OAAQ,EAAE,CAAC,MAAM,OAAQ,EAAE,CAAC,MAAM,KAAM;AACrE,WAAO;AAAA,EACR;AAEA,MAAI,EAAE,UAAU,KAAK,EAAE,CAAC,MAAM,MAAQ,EAAE,CAAC,MAAM,MAAQ,EAAE,CAAC,MAAM,MAAQ,EAAE,CAAC,MAAM,OAAS,EAAE,CAAC,MAAM,MAAQ,EAAE,CAAC,MAAM,OAAS,EAAE,CAAC,MAAM,IAAM;AAC3I,WAAO;AAAA,EACR;AAEA,MAAI,EAAE,UAAU,MAAM,EAAE,CAAC,MAAM,MAAQ,EAAE,CAAC,MAAM,MAAQ,EAAE,CAAC,MAAM,MAAQ,EAAE,CAAC,MAAM,MAAQ,EAAE,CAAC,MAAM,MAAQ,EAAE,CAAC,MAAM,MAAQ,EAAE,EAAE,MAAM,MAAQ,EAAE,EAAE,MAAM,IAAM;AAC7J,WAAO;AAAA,EACR;AACA,SAAO;AACR;;;AJzBA,IAAM,UAAU;AAET,SAAS,iBAAiB,OAAsB,QAA+B;AACrF,QAAM,SAAS,IAAI,gBAAgB,KAAK;AACxC,QAAM,WAAW,OAAO,YAAY;AACpC,QAAM,UAAU,OAAO,gBAAgB;AAEvC,SAAO;AAAA;AAAA;AAAA;AAAA;AAAA,IAKN;AAAA,MACC;AAAA,MACA;AAAA,MACA;AAAA,MACA,OAAO,QAAQ;AACd,cAAM,SAAS,IAAI,KAAM;AACzB,cAAM,OAAQ,IAAI,KAAK,MAAM,KAAK,CAAC;AAOnC,YAAI,OAAO,KAAK,eAAe,YAAY,KAAK,WAAW,WAAW,GAAG;AACxE,iBAAO,eAAe,KAAK,eAAe,qBAAqB,2CAA2C;AAAA,QAC3G;AAEA,YAAI;AACJ,YAAI;AACH,kBAAQ,aAAa,KAAK,UAAU;AAAA,QACrC,QAAQ;AACP,iBAAO,eAAe,KAAK,eAAe,qBAAqB,iCAAiC;AAAA,QACjG;AACA,YAAI,MAAM,eAAe,GAAG;AAC3B,iBAAO,eAAe,KAAK,eAAe,qBAAqB,qBAAqB;AAAA,QACrF;AACA,YAAI,MAAM,aAAa,UAAU;AAChC,iBAAO,eAAe,KAAK,eAAe,mBAAmB,qBAAqB,QAAQ,cAAc;AAAA,QACzG;AAEA,cAAM,cAAc,eAAe,KAAK;AACxC,YAAI,CAAC,eAAe,CAAC,QAAQ,SAAS,WAAW,GAAG;AACnD,iBAAO;AAAA,YACN,KAAK;AAAA,YACL;AAAA,YACA,oCAAoC,QAAQ,KAAK,IAAI,CAAC;AAAA,UACvD;AAAA,QACD;AAEA,cAAM,YAAY,OAAO,KAAK,cAAc,WAAW,KAAK,YAAY;AACxE,cAAM,UAAU,OAAO,KAAK,YAAY,WAAW,KAAK,UAAU;AAClE,cAAM,UAAU,OAAO,KAAK,YAAY,WAAW,KAAK,UAAU;AAElE,cAAM,EAAE,IAAI,IAAI,MAAM,OAAO,SAAS,IAAI,EAAE,OAAO,YAAY,CAAC;AAChE,cAAM,QAAQ,MAAM,OAAO,OAAO;AAAA,UACjC;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,UACA,UAAU,MAAM;AAAA,UAChB,YAAY;AAAA,UACZ,WAAW;AAAA,QACZ,CAAC;AAID,cAAM,WAAW,IAAI,IAAI,IAAI,QAAQ,GAAG,EAAE,SAAS,QAAQ,YAAY,EAAE;AACzE,eAAO,eAAe,KAAK,IAAI,iBAAiB,mBAAmB;AAAA,UAClE,OAAO,gBAAgB,OAAO,QAAQ;AAAA,QACvC,CAAC;AAAA,MACF;AAAA,IACD;AAAA;AAAA;AAAA;AAAA,IAKA;AAAA,MACC;AAAA,MACA;AAAA,MACA,OAAO,QAAQ;AACd,cAAM,KAAK,IAAI,KAAK,SAAS,IAAI;AACjC,YAAI,CAAC,MAAM,CAAC,QAAQ,KAAK,EAAE,EAAG,QAAO,IAAI,SAAS,aAAa,EAAE,QAAQ,IAAI,CAAC;AAE9E,cAAM,QAAQ,MAAM,OAAO,IAAI,EAAE;AACjC,YAAI,CAAC,MAAO,QAAO,IAAI,SAAS,aAAa,EAAE,QAAQ,IAAI,CAAC;AAE5D,cAAM,OAAO,IAAI,MAAM,EAAE;AACzB,YAAI,IAAI,QAAQ,QAAQ,IAAI,eAAe,MAAM,MAAM;AACtD,iBAAO,IAAI,SAAS,MAAM,EAAE,QAAQ,KAAK,SAAS,EAAE,MAAM,KAAK,EAAE,CAAC;AAAA,QACnE;AAEA,cAAM,UAAU,MAAM,OAAO,SAAS,IAAI,MAAM,UAAU;AAC1D,YAAI,CAAC,QAAS,QAAO,IAAI,SAAS,aAAa,EAAE,QAAQ,IAAI,CAAC;AAC9D,YAAI,QAAQ,SAAS,YAAY;AAChC,iBAAO,IAAI,SAAS,MAAM,EAAE,QAAQ,KAAK,SAAS,EAAE,UAAU,QAAQ,IAAI,EAAE,CAAC;AAAA,QAC9E;AAGA,eAAO,IAAI,SAAS,IAAI,WAAW,QAAQ,KAAK,GAAG;AAAA,UAClD,QAAQ;AAAA,UACR,SAAS;AAAA,YACR,gBAAgB,MAAM;AAAA,YACtB,kBAAkB,OAAO,MAAM,QAAQ;AAAA,YACvC,iBAAiB;AAAA,YACjB,MAAM;AAAA,UACP;AAAA,QACD,CAAC;AAAA,MACF;AAAA,IACD;AAAA;AAAA,IAGA;AAAA,MACC;AAAA,MACA;AAAA,MACA;AAAA,MACA,OAAO,QAAQ;AACd,cAAM,KAAK,IAAI,KAAK,SAAS,IAAI;AACjC,YAAI,CAAC,MAAM,CAAC,QAAQ,KAAK,EAAE,GAAG;AAC7B,iBAAO,eAAe,KAAK,WAAW,mBAAmB,gBAAgB;AAAA,QAC1E;AACA,cAAM,QAAQ,MAAM,OAAO,IAAI,EAAE;AACjC,YAAI,CAAC,MAAO,QAAO,eAAe,KAAK,WAAW,mBAAmB,gBAAgB;AACrF,YAAI,MAAM,cAAc,IAAI,KAAM,IAAI;AACrC,iBAAO,eAAe,KAAK,WAAW,aAAa,0CAA0C;AAAA,QAC9F;AACA,cAAM,OAAO,SAAS,OAAO,MAAM,UAAU;AAC7C,cAAM,OAAO,OAAO,EAAE;AACtB,eAAO,eAAe,KAAK,IAAI,iBAAiB,kBAAkB,EAAE,GAAG,CAAC;AAAA,MACzE;AAAA,IACD;AAAA,EACD;AACD;;;AKpIO,IAAM,cAAN,MAA6C;AAAA,EAInD,YACkB,OACA,QAChB;AAFgB;AACA;AAAA,EACf;AAAA,EAFe;AAAA,EACA;AAAA,EALT,OAAO;AAAA,EACP,OAAO,CAAC,gBAAgB;AAAA,EAOjC,QAAQ,KAAyB;AAChC,eAAW,CAAC,QAAQ,MAAM,GAAG,QAAQ,KAAK,iBAAiB,KAAK,OAAO,KAAK,MAAM,GAAG;AACpF,UAAI,SAAS,QAAQ,MAAM,GAAG,QAAQ;AAAA,IACvC;AAAA,EACD;AACD;;;ACpBA,SAAS,gBAAgB,uBAAuB;","names":[]}
+{"version":3,"sources":["../src/routes.ts","../src/config.ts","../src/models/asset.model.ts","../src/dtos/media.ts","../src/services/image.ts","../src/module.ts","../src/index.ts"],"sourcesContent":["import type { Middleware } from '@fonderie/core';\nimport { HTTP, setApiResponse } from '@fonderie/core';\nimport { requireAuth } from '@fonderie/core/middlewares';\nimport type { IStoreAdapter } from '@fonderie/store';\n\nimport { DEFAULT_ALLOWED_TYPES, DEFAULT_MAX_BYTES, type IMediaConfig } from './config';\nimport { MediaAssetModel } from './models/asset.model';\nimport { toMediaAssetDTO } from './dtos/media';\nimport { decodeBase64, sniffImageType } from './services/image';\n\ntype Route = [string, string, ...Middleware[]];\n\nconst UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;\n\nexport function buildMediaRoutes(store: IStoreAdapter, config: IMediaConfig): Route[] {\n\tconst assets = new MediaAssetModel(store);\n\tconst maxBytes = config.maxBytes ?? DEFAULT_MAX_BYTES;\n\tconst allowed = config.allowedTypes ?? DEFAULT_ALLOWED_TYPES;\n\n\treturn [\n\t\t// POST /media { dataBase64, ownerType?, ownerId?, purpose? } -> { asset }\n\t\t// Accepts base64 (bare or a data URI), verifies it's a real image by its\n\t\t// magic bytes (never the client's claim), caps the decoded size, stores\n\t\t// the bytes via the provider, and records metadata. Returns a URL.\n\t\t[\n\t\t\t'POST',\n\t\t\t'/media',\n\t\t\trequireAuth,\n\t\t\tasync (ctx) => {\n\t\t\t\tconst userId = ctx.user!.id;\n\t\t\t\tconst body = (ctx.meta['body'] ?? {}) as {\n\t\t\t\t\tdataBase64?: unknown;\n\t\t\t\t\townerType?: unknown;\n\t\t\t\t\townerId?: unknown;\n\t\t\t\t\tpurpose?: unknown;\n\t\t\t\t};\n\n\t\t\t\tif (typeof body.dataBase64 !== 'string' || body.dataBase64.length === 0) {\n\t\t\t\t\treturn setApiResponse(HTTP.UNPROCESSABLE, 'INVALID_PARAMETER', 'dataBase64 (a base64 string) is required.');\n\t\t\t\t}\n\t\t\t\t// Reject oversized uploads BEFORE decoding — base64 inflates ~4/3, so a\n\t\t\t\t// string longer than maxBytes*1.4 cannot fit the cap. Bounds the decode\n\t\t\t\t// allocation instead of materializing a huge buffer only to reject it.\n\t\t\t\t// (A request-body-size limit at the adapter is the complementary guard.)\n\t\t\t\tif (body.dataBase64.length > Math.ceil(maxBytes * 1.4)) {\n\t\t\t\t\treturn setApiResponse(HTTP.UNPROCESSABLE, 'ASSET_TOO_LARGE', `Image exceeds the ${maxBytes}-byte limit.`);\n\t\t\t\t}\n\n\t\t\t\tlet bytes: Uint8Array;\n\t\t\t\ttry {\n\t\t\t\t\tbytes = decodeBase64(body.dataBase64);\n\t\t\t\t} catch {\n\t\t\t\t\treturn setApiResponse(HTTP.UNPROCESSABLE, 'INVALID_PARAMETER', 'dataBase64 is not valid base64.');\n\t\t\t\t}\n\t\t\t\tif (bytes.byteLength === 0) {\n\t\t\t\t\treturn setApiResponse(HTTP.UNPROCESSABLE, 'INVALID_PARAMETER', 'The image is empty.');\n\t\t\t\t}\n\t\t\t\tif (bytes.byteLength > maxBytes) {\n\t\t\t\t\treturn setApiResponse(HTTP.UNPROCESSABLE, 'ASSET_TOO_LARGE', `Image exceeds the ${maxBytes}-byte limit.`);\n\t\t\t\t}\n\n\t\t\t\tconst contentType = sniffImageType(bytes);\n\t\t\t\tif (!contentType || !allowed.includes(contentType)) {\n\t\t\t\t\treturn setApiResponse(\n\t\t\t\t\t\tHTTP.UNPROCESSABLE,\n\t\t\t\t\t\t'ASSET_UNSUPPORTED',\n\t\t\t\t\t\t`Unsupported image type. Allowed: ${allowed.join(', ')}.`,\n\t\t\t\t\t);\n\t\t\t\t}\n\n\t\t\t\tconst ownerType = typeof body.ownerType === 'string' ? body.ownerType : 'user';\n\t\t\t\tconst ownerId = typeof body.ownerId === 'string' ? body.ownerId : userId;\n\t\t\t\tconst purpose = typeof body.purpose === 'string' ? body.purpose : 'avatar';\n\n\t\t\t\t// Authorize the target owner. Default policy: self-owned user assets\n\t\t\t\t// only; a consumer opts into other owners (workspace logos, customer\n\t\t\t\t// photos) via config.authorizeOwner.\n\t\t\t\tconst authorized = config.authorizeOwner\n\t\t\t\t\t? await config.authorizeOwner(ctx, { ownerType, ownerId })\n\t\t\t\t\t: ownerType === 'user' && ownerId === userId;\n\t\t\t\tif (!authorized) {\n\t\t\t\t\treturn setApiResponse(HTTP.FORBIDDEN, 'FORBIDDEN', 'Not allowed to upload for that owner.');\n\t\t\t\t}\n\n\t\t\t\tconst { ref } = await config.provider.put({ bytes, contentType });\n\t\t\t\tlet asset: Awaited<ReturnType<typeof assets.create>>;\n\t\t\t\ttry {\n\t\t\t\t\tasset = await assets.create({\n\t\t\t\t\t\townerType,\n\t\t\t\t\t\townerId,\n\t\t\t\t\t\tpurpose,\n\t\t\t\t\t\tcontentType,\n\t\t\t\t\t\tbyteSize: bytes.byteLength,\n\t\t\t\t\t\tstorageRef: ref,\n\t\t\t\t\t\tcreatedBy: userId,\n\t\t\t\t\t});\n\t\t\t\t} catch (err) {\n\t\t\t\t\t// Metadata insert failed — don't orphan the bytes we just stored.\n\t\t\t\t\tawait config.provider.delete(ref).catch(() => {});\n\t\t\t\t\tthrow err;\n\t\t\t\t}\n\n\t\t\t\t// Build the URL at whatever prefix this route is mounted under\n\t\t\t\t// (e.g. '/v1/media/:id'), derived from the request path.\n\t\t\t\tconst basePath = new URL(ctx.request.url).pathname.replace(/\\/media$/, '');\n\t\t\t\treturn setApiResponse(HTTP.OK, 'ASSET_CREATED', 'Asset uploaded.', {\n\t\t\t\t\tasset: toMediaAssetDTO(asset, basePath),\n\t\t\t\t});\n\t\t\t},\n\t\t],\n\n\t\t// GET /media/:id  (PUBLIC — an <img src> can't send an Authorization\n\t\t// header) -> the image bytes with cache headers, or a 302 to a\n\t\t// provider-served URL. Assets are immutable, so the id is a stable ETag.\n\t\t[\n\t\t\t'GET',\n\t\t\t'/media/:id',\n\t\t\tasync (ctx) => {\n\t\t\t\tconst id = ctx.meta.params?.['id'];\n\t\t\t\tif (!id || !UUID_RE.test(id)) return new Response('Not found', { status: 404 });\n\n\t\t\t\tconst asset = await assets.get(id);\n\t\t\t\tif (!asset) return new Response('Not found', { status: 404 });\n\n\t\t\t\tconst etag = `\"${asset.id}\"`;\n\t\t\t\tif (ctx.request.headers.get('if-none-match') === etag) {\n\t\t\t\t\treturn new Response(null, { status: 304, headers: { ETag: etag } });\n\t\t\t\t}\n\n\t\t\t\tconst fetched = await config.provider.get(asset.storageRef);\n\t\t\t\tif (!fetched) return new Response('Not found', { status: 404 });\n\t\t\t\tif (fetched.kind === 'redirect') {\n\t\t\t\t\treturn new Response(null, { status: 302, headers: { Location: fetched.url } });\n\t\t\t\t}\n\t\t\t\t// Fresh Uint8Array (ArrayBuffer-backed) so it satisfies BodyInit; a\n\t\t\t\t// pg Buffer is typed Uint8Array<ArrayBufferLike>, which the lib rejects.\n\t\t\t\treturn new Response(new Uint8Array(fetched.bytes), {\n\t\t\t\t\tstatus: 200,\n\t\t\t\t\theaders: {\n\t\t\t\t\t\t'Content-Type': asset.contentType,\n\t\t\t\t\t\t'Content-Length': String(asset.byteSize),\n\t\t\t\t\t\t'Cache-Control': 'public, max-age=300',\n\t\t\t\t\t\tETag: etag,\n\t\t\t\t\t},\n\t\t\t\t});\n\t\t\t},\n\t\t],\n\n\t\t// DELETE /media/:id  -> removes the asset; only the uploader may delete it.\n\t\t[\n\t\t\t'DELETE',\n\t\t\t'/media/:id',\n\t\t\trequireAuth,\n\t\t\tasync (ctx) => {\n\t\t\t\tconst id = ctx.meta.params?.['id'];\n\t\t\t\tif (!id || !UUID_RE.test(id)) {\n\t\t\t\t\treturn setApiResponse(HTTP.NOT_FOUND, 'ASSET_NOT_FOUND', 'No such asset.');\n\t\t\t\t}\n\t\t\t\tconst asset = await assets.get(id);\n\t\t\t\tif (!asset) return setApiResponse(HTTP.NOT_FOUND, 'ASSET_NOT_FOUND', 'No such asset.');\n\t\t\t\tif (asset.createdBy !== ctx.user!.id) {\n\t\t\t\t\treturn setApiResponse(HTTP.FORBIDDEN, 'FORBIDDEN', 'You can only delete assets you uploaded.');\n\t\t\t\t}\n\t\t\t\tawait config.provider.delete(asset.storageRef);\n\t\t\t\tawait assets.delete(id);\n\t\t\t\treturn setApiResponse(HTTP.OK, 'ASSET_DELETED', 'Asset deleted.', { id });\n\t\t\t},\n\t\t],\n\t];\n}\n","import type { IFonderieContext } from '@fonderie/core';\nimport type { IStorageProvider } from '@fonderie/storage';\n\nexport interface IMediaConfig {\n\t/** Where bytes are stored. `DbBlobProvider` (zero infra) by default; swap for S3 at scale. */\n\tprovider: IStorageProvider;\n\t/** Max decoded size per asset, in bytes. Default 1 MB. */\n\tmaxBytes?: number;\n\t/**\n\t * Content types accepted on upload (matched against magic bytes, not the\n\t * client's claim). Default: PNG / JPEG / WebP / GIF. SVG is never accepted —\n\t * it's a stored-XSS vector.\n\t */\n\tallowedTypes?: string[];\n\t/**\n\t * Authorize an upload's target owner. Return false to reject with 403. When\n\t * omitted, the default policy allows only **self-owned user assets**\n\t * (`ownerType: 'user'`, `ownerId` = the authenticated caller). Provide this\n\t * to permit other owners — e.g. a workspace logo the caller may administer, a\n\t * customer photo in the caller's workspace.\n\t */\n\tauthorizeOwner?(\n\t\tctx: IFonderieContext,\n\t\towner: { ownerType: string; ownerId: string },\n\t): boolean | Promise<boolean>;\n}\n\nexport const DEFAULT_MAX_BYTES = 1_000_000;\nexport const DEFAULT_ALLOWED_TYPES = ['image/png', 'image/jpeg', 'image/webp', 'image/gif'];\n","import type { IStoreAdapter } from '@fonderie/store';\n\nimport type { ICreateAssetInput, IMediaAsset } from '../types';\n\ninterface AssetRow {\n\tid: string;\n\towner_type: string;\n\towner_id: string;\n\tpurpose: string;\n\tcontent_type: string;\n\tbyte_size: number;\n\tstorage_ref: string;\n\tcreated_by: string | null;\n\tcreated_at: Date;\n}\n\nconst toAsset = (r: AssetRow): IMediaAsset => ({\n\tid: r.id,\n\townerType: r.owner_type,\n\townerId: r.owner_id,\n\tpurpose: r.purpose,\n\tcontentType: r.content_type,\n\tbyteSize: r.byte_size,\n\tstorageRef: r.storage_ref,\n\tcreatedBy: r.created_by,\n\tcreatedAt: r.created_at,\n});\n\n/** Data access for `fonderie_media_assets` — the metadata around each stored blob. */\nexport class MediaAssetModel {\n\tconstructor(private readonly store: IStoreAdapter) {}\n\n\tasync create(input: ICreateAssetInput): Promise<IMediaAsset> {\n\t\tconst rows = await this.store.query<AssetRow>(\n\t\t\t`INSERT INTO fonderie_media_assets\n\t\t\t   (owner_type, owner_id, purpose, content_type, byte_size, storage_ref, created_by)\n\t\t\t VALUES ($1, $2, $3, $4, $5, $6, $7)\n\t\t\t RETURNING *`,\n\t\t\t[input.ownerType, input.ownerId, input.purpose, input.contentType, input.byteSize, input.storageRef, input.createdBy],\n\t\t);\n\t\treturn toAsset(rows[0]!);\n\t}\n\n\tasync get(id: string): Promise<IMediaAsset | null> {\n\t\tconst rows = await this.store.query<AssetRow>('SELECT * FROM fonderie_media_assets WHERE id = $1', [id]);\n\t\treturn rows[0] ? toAsset(rows[0]) : null;\n\t}\n\n\t/** The most recent asset for an owner + purpose (e.g. a user's current avatar). */\n\tasync latestFor(ownerType: string, ownerId: string, purpose: string): Promise<IMediaAsset | null> {\n\t\tconst rows = await this.store.query<AssetRow>(\n\t\t\t`SELECT * FROM fonderie_media_assets\n\t\t\t   WHERE owner_type = $1 AND owner_id = $2 AND purpose = $3\n\t\t\t   ORDER BY created_at DESC LIMIT 1`,\n\t\t\t[ownerType, ownerId, purpose],\n\t\t);\n\t\treturn rows[0] ? toAsset(rows[0]) : null;\n\t}\n\n\tasync delete(id: string): Promise<void> {\n\t\tawait this.store.query('DELETE FROM fonderie_media_assets WHERE id = $1', [id]);\n\t}\n}\n","import type { IMediaAsset } from '../types';\n\n/**\n * The wire shape for a stored asset. `url` is the monomorphic read contract:\n * always a `/media/:id` path, whatever the backend — clients render it in an\n * `<img>` and never care whether the bytes came from Postgres, disk, or S3.\n */\nexport interface IMediaAssetDTO {\n\tid: string;\n\turl: string;\n\tcontentType: string;\n\tbyteSize: number;\n\townerType: string;\n\townerId: string;\n\tpurpose: string;\n\tcreatedAt: string;\n}\n\n/** basePath is the router mount (e.g. '/v1'); '' yields a root-relative '/media/:id'. */\nexport function toMediaAssetDTO(asset: IMediaAsset, basePath = ''): IMediaAssetDTO {\n\treturn {\n\t\tid: asset.id,\n\t\turl: `${basePath}/media/${asset.id}`,\n\t\tcontentType: asset.contentType,\n\t\tbyteSize: asset.byteSize,\n\t\townerType: asset.ownerType,\n\t\townerId: asset.ownerId,\n\t\tpurpose: asset.purpose,\n\t\tcreatedAt: asset.createdAt instanceof Date ? asset.createdAt.toISOString() : String(asset.createdAt),\n\t};\n}\n","/**\n * Decode a base64 payload to bytes. Accepts both a bare base64 string and a\n * data URI (`data:image/png;base64,<...>`) — the frontend `FileReader` produces\n * the latter, so callers don't have to strip it.\n */\nexport function decodeBase64(input: string): Uint8Array {\n\tconst comma = input.startsWith('data:') ? input.indexOf(',') : -1;\n\tconst b64 = comma >= 0 ? input.slice(comma + 1) : input;\n\treturn new Uint8Array(Buffer.from(b64, 'base64'));\n}\n\n/**\n * Identify an image from its magic bytes — NOT from a client-claimed MIME type,\n * which is trivially spoofed. Returns the canonical content type or `null` for\n * anything unrecognised. SVG is deliberately not detected (it's XML, can carry\n * scripts, and is a stored-XSS vector), so it falls through to `null` and is\n * rejected upstream.\n */\nexport function sniffImageType(bytes: Uint8Array): string | null {\n\tconst b = bytes;\n\t// PNG: 89 50 4E 47 0D 0A 1A 0A\n\tif (b.length >= 8 && b[0] === 0x89 && b[1] === 0x50 && b[2] === 0x4e && b[3] === 0x47 && b[4] === 0x0d && b[5] === 0x0a && b[6] === 0x1a && b[7] === 0x0a) {\n\t\treturn 'image/png';\n\t}\n\t// JPEG: FF D8 FF\n\tif (b.length >= 3 && b[0] === 0xff && b[1] === 0xd8 && b[2] === 0xff) {\n\t\treturn 'image/jpeg';\n\t}\n\t// GIF: \"GIF87a\" / \"GIF89a\"\n\tif (b.length >= 6 && b[0] === 0x47 && b[1] === 0x49 && b[2] === 0x46 && b[3] === 0x38 && (b[4] === 0x37 || b[4] === 0x39) && b[5] === 0x61) {\n\t\treturn 'image/gif';\n\t}\n\t// WEBP: \"RIFF\" .... \"WEBP\" (bytes 0-3 and 8-11)\n\tif (b.length >= 12 && b[0] === 0x52 && b[1] === 0x49 && b[2] === 0x46 && b[3] === 0x46 && b[8] === 0x57 && b[9] === 0x45 && b[10] === 0x42 && b[11] === 0x50) {\n\t\treturn 'image/webp';\n\t}\n\treturn null;\n}\n","import type { IFonderieApp, IFonderieModule } from '@fonderie/core';\nimport type { IStoreAdapter } from '@fonderie/store';\n\nimport type { IMediaConfig } from './config';\nimport { buildMediaRoutes } from './routes';\n\n/**\n * Provider-abstracted asset storage. Register it like any other brick; it adds\n * `POST /media`, `GET /media/:id` (public), and `DELETE /media/:id`, and stores\n * bytes through the configured `IStorageProvider` (`DbBlobProvider` for zero\n * infra, swappable for object storage). Depends on `@fonderie/auth` for the\n * authenticated caller on upload/delete.\n */\nexport class MediaModule implements IFonderieModule {\n\treadonly name = '@fonderie/media';\n\treadonly deps = ['@fonderie/auth'];\n\n\tconstructor(\n\t\tprivate readonly store: IStoreAdapter,\n\t\tprivate readonly config: IMediaConfig,\n\t) {}\n\n\tinstall(app: IFonderieApp): void {\n\t\tfor (const [method, path, ...handlers] of buildMediaRoutes(this.store, this.config)) {\n\t\t\tapp.addRoute(method, path, ...handlers);\n\t\t}\n\t}\n}\n","export { MediaModule } from './module';\nexport { DEFAULT_ALLOWED_TYPES, DEFAULT_MAX_BYTES } from './config';\nexport type { IMediaConfig } from './config';\n\n// Storage lives in @fonderie/storage now; re-exported here for convenience so\n// existing consumers can keep importing the zero-infra providers from media.\n// S3Provider (the object-storage backend) is at '@fonderie/storage/s3'.\nexport { DbBlobProvider, LocalFsProvider } from '@fonderie/storage';\nexport type { IStorageProvider, IFetched, IStoredRef } from '@fonderie/storage';\n\n// For server-side resolution (e.g. wiring a user's avatar URL) and custom flows.\nexport { MediaAssetModel } from './models/asset.model';\nexport { toMediaAssetDTO } from './dtos/media';\nexport type { IMediaAssetDTO } from './dtos/media';\nexport type { IMediaAsset, ICreateAssetInput } from './types';\nexport { decodeBase64, sniffImageType } from './services/image';\n"],"mappings":";AACA,SAAS,MAAM,sBAAsB;AACrC,SAAS,mBAAmB;;;ACyBrB,IAAM,oBAAoB;AAC1B,IAAM,wBAAwB,CAAC,aAAa,cAAc,cAAc,WAAW;;;ACZ1F,IAAM,UAAU,CAAC,OAA8B;AAAA,EAC9C,IAAI,EAAE;AAAA,EACN,WAAW,EAAE;AAAA,EACb,SAAS,EAAE;AAAA,EACX,SAAS,EAAE;AAAA,EACX,aAAa,EAAE;AAAA,EACf,UAAU,EAAE;AAAA,EACZ,YAAY,EAAE;AAAA,EACd,WAAW,EAAE;AAAA,EACb,WAAW,EAAE;AACd;AAGO,IAAM,kBAAN,MAAsB;AAAA,EAC5B,YAA6B,OAAsB;AAAtB;AAAA,EAAuB;AAAA,EAAvB;AAAA,EAE7B,MAAM,OAAO,OAAgD;AAC5D,UAAM,OAAO,MAAM,KAAK,MAAM;AAAA,MAC7B;AAAA;AAAA;AAAA;AAAA,MAIA,CAAC,MAAM,WAAW,MAAM,SAAS,MAAM,SAAS,MAAM,aAAa,MAAM,UAAU,MAAM,YAAY,MAAM,SAAS;AAAA,IACrH;AACA,WAAO,QAAQ,KAAK,CAAC,CAAE;AAAA,EACxB;AAAA,EAEA,MAAM,IAAI,IAAyC;AAClD,UAAM,OAAO,MAAM,KAAK,MAAM,MAAgB,qDAAqD,CAAC,EAAE,CAAC;AACvG,WAAO,KAAK,CAAC,IAAI,QAAQ,KAAK,CAAC,CAAC,IAAI;AAAA,EACrC;AAAA;AAAA,EAGA,MAAM,UAAU,WAAmB,SAAiB,SAA8C;AACjG,UAAM,OAAO,MAAM,KAAK,MAAM;AAAA,MAC7B;AAAA;AAAA;AAAA,MAGA,CAAC,WAAW,SAAS,OAAO;AAAA,IAC7B;AACA,WAAO,KAAK,CAAC,IAAI,QAAQ,KAAK,CAAC,CAAC,IAAI;AAAA,EACrC;AAAA,EAEA,MAAM,OAAO,IAA2B;AACvC,UAAM,KAAK,MAAM,MAAM,mDAAmD,CAAC,EAAE,CAAC;AAAA,EAC/E;AACD;;;AC3CO,SAAS,gBAAgB,OAAoB,WAAW,IAAoB;AAClF,SAAO;AAAA,IACN,IAAI,MAAM;AAAA,IACV,KAAK,GAAG,QAAQ,UAAU,MAAM,EAAE;AAAA,IAClC,aAAa,MAAM;AAAA,IACnB,UAAU,MAAM;AAAA,IAChB,WAAW,MAAM;AAAA,IACjB,SAAS,MAAM;AAAA,IACf,SAAS,MAAM;AAAA,IACf,WAAW,MAAM,qBAAqB,OAAO,MAAM,UAAU,YAAY,IAAI,OAAO,MAAM,SAAS;AAAA,EACpG;AACD;;;ACzBO,SAAS,aAAa,OAA2B;AACvD,QAAM,QAAQ,MAAM,WAAW,OAAO,IAAI,MAAM,QAAQ,GAAG,IAAI;AAC/D,QAAM,MAAM,SAAS,IAAI,MAAM,MAAM,QAAQ,CAAC,IAAI;AAClD,SAAO,IAAI,WAAW,OAAO,KAAK,KAAK,QAAQ,CAAC;AACjD;AASO,SAAS,eAAe,OAAkC;AAChE,QAAM,IAAI;AAEV,MAAI,EAAE,UAAU,KAAK,EAAE,CAAC,MAAM,OAAQ,EAAE,CAAC,MAAM,MAAQ,EAAE,CAAC,MAAM,MAAQ,EAAE,CAAC,MAAM,MAAQ,EAAE,CAAC,MAAM,MAAQ,EAAE,CAAC,MAAM,MAAQ,EAAE,CAAC,MAAM,MAAQ,EAAE,CAAC,MAAM,IAAM;AAC1J,WAAO;AAAA,EACR;AAEA,MAAI,EAAE,UAAU,KAAK,EAAE,CAAC,MAAM,OAAQ,EAAE,CAAC,MAAM,OAAQ,EAAE,CAAC,MAAM,KAAM;AACrE,WAAO;AAAA,EACR;AAEA,MAAI,EAAE,UAAU,KAAK,EAAE,CAAC,MAAM,MAAQ,EAAE,CAAC,MAAM,MAAQ,EAAE,CAAC,MAAM,MAAQ,EAAE,CAAC,MAAM,OAAS,EAAE,CAAC,MAAM,MAAQ,EAAE,CAAC,MAAM,OAAS,EAAE,CAAC,MAAM,IAAM;AAC3I,WAAO;AAAA,EACR;AAEA,MAAI,EAAE,UAAU,MAAM,EAAE,CAAC,MAAM,MAAQ,EAAE,CAAC,MAAM,MAAQ,EAAE,CAAC,MAAM,MAAQ,EAAE,CAAC,MAAM,MAAQ,EAAE,CAAC,MAAM,MAAQ,EAAE,CAAC,MAAM,MAAQ,EAAE,EAAE,MAAM,MAAQ,EAAE,EAAE,MAAM,IAAM;AAC7J,WAAO;AAAA,EACR;AACA,SAAO;AACR;;;AJzBA,IAAM,UAAU;AAET,SAAS,iBAAiB,OAAsB,QAA+B;AACrF,QAAM,SAAS,IAAI,gBAAgB,KAAK;AACxC,QAAM,WAAW,OAAO,YAAY;AACpC,QAAM,UAAU,OAAO,gBAAgB;AAEvC,SAAO;AAAA;AAAA;AAAA;AAAA;AAAA,IAKN;AAAA,MACC;AAAA,MACA;AAAA,MACA;AAAA,MACA,OAAO,QAAQ;AACd,cAAM,SAAS,IAAI,KAAM;AACzB,cAAM,OAAQ,IAAI,KAAK,MAAM,KAAK,CAAC;AAOnC,YAAI,OAAO,KAAK,eAAe,YAAY,KAAK,WAAW,WAAW,GAAG;AACxE,iBAAO,eAAe,KAAK,eAAe,qBAAqB,2CAA2C;AAAA,QAC3G;AAKA,YAAI,KAAK,WAAW,SAAS,KAAK,KAAK,WAAW,GAAG,GAAG;AACvD,iBAAO,eAAe,KAAK,eAAe,mBAAmB,qBAAqB,QAAQ,cAAc;AAAA,QACzG;AAEA,YAAI;AACJ,YAAI;AACH,kBAAQ,aAAa,KAAK,UAAU;AAAA,QACrC,QAAQ;AACP,iBAAO,eAAe,KAAK,eAAe,qBAAqB,iCAAiC;AAAA,QACjG;AACA,YAAI,MAAM,eAAe,GAAG;AAC3B,iBAAO,eAAe,KAAK,eAAe,qBAAqB,qBAAqB;AAAA,QACrF;AACA,YAAI,MAAM,aAAa,UAAU;AAChC,iBAAO,eAAe,KAAK,eAAe,mBAAmB,qBAAqB,QAAQ,cAAc;AAAA,QACzG;AAEA,cAAM,cAAc,eAAe,KAAK;AACxC,YAAI,CAAC,eAAe,CAAC,QAAQ,SAAS,WAAW,GAAG;AACnD,iBAAO;AAAA,YACN,KAAK;AAAA,YACL;AAAA,YACA,oCAAoC,QAAQ,KAAK,IAAI,CAAC;AAAA,UACvD;AAAA,QACD;AAEA,cAAM,YAAY,OAAO,KAAK,cAAc,WAAW,KAAK,YAAY;AACxE,cAAM,UAAU,OAAO,KAAK,YAAY,WAAW,KAAK,UAAU;AAClE,cAAM,UAAU,OAAO,KAAK,YAAY,WAAW,KAAK,UAAU;AAKlE,cAAM,aAAa,OAAO,iBACvB,MAAM,OAAO,eAAe,KAAK,EAAE,WAAW,QAAQ,CAAC,IACvD,cAAc,UAAU,YAAY;AACvC,YAAI,CAAC,YAAY;AAChB,iBAAO,eAAe,KAAK,WAAW,aAAa,uCAAuC;AAAA,QAC3F;AAEA,cAAM,EAAE,IAAI,IAAI,MAAM,OAAO,SAAS,IAAI,EAAE,OAAO,YAAY,CAAC;AAChE,YAAI;AACJ,YAAI;AACH,kBAAQ,MAAM,OAAO,OAAO;AAAA,YAC3B;AAAA,YACA;AAAA,YACA;AAAA,YACA;AAAA,YACA,UAAU,MAAM;AAAA,YAChB,YAAY;AAAA,YACZ,WAAW;AAAA,UACZ,CAAC;AAAA,QACF,SAAS,KAAK;AAEb,gBAAM,OAAO,SAAS,OAAO,GAAG,EAAE,MAAM,MAAM;AAAA,UAAC,CAAC;AAChD,gBAAM;AAAA,QACP;AAIA,cAAM,WAAW,IAAI,IAAI,IAAI,QAAQ,GAAG,EAAE,SAAS,QAAQ,YAAY,EAAE;AACzE,eAAO,eAAe,KAAK,IAAI,iBAAiB,mBAAmB;AAAA,UAClE,OAAO,gBAAgB,OAAO,QAAQ;AAAA,QACvC,CAAC;AAAA,MACF;AAAA,IACD;AAAA;AAAA;AAAA;AAAA,IAKA;AAAA,MACC;AAAA,MACA;AAAA,MACA,OAAO,QAAQ;AACd,cAAM,KAAK,IAAI,KAAK,SAAS,IAAI;AACjC,YAAI,CAAC,MAAM,CAAC,QAAQ,KAAK,EAAE,EAAG,QAAO,IAAI,SAAS,aAAa,EAAE,QAAQ,IAAI,CAAC;AAE9E,cAAM,QAAQ,MAAM,OAAO,IAAI,EAAE;AACjC,YAAI,CAAC,MAAO,QAAO,IAAI,SAAS,aAAa,EAAE,QAAQ,IAAI,CAAC;AAE5D,cAAM,OAAO,IAAI,MAAM,EAAE;AACzB,YAAI,IAAI,QAAQ,QAAQ,IAAI,eAAe,MAAM,MAAM;AACtD,iBAAO,IAAI,SAAS,MAAM,EAAE,QAAQ,KAAK,SAAS,EAAE,MAAM,KAAK,EAAE,CAAC;AAAA,QACnE;AAEA,cAAM,UAAU,MAAM,OAAO,SAAS,IAAI,MAAM,UAAU;AAC1D,YAAI,CAAC,QAAS,QAAO,IAAI,SAAS,aAAa,EAAE,QAAQ,IAAI,CAAC;AAC9D,YAAI,QAAQ,SAAS,YAAY;AAChC,iBAAO,IAAI,SAAS,MAAM,EAAE,QAAQ,KAAK,SAAS,EAAE,UAAU,QAAQ,IAAI,EAAE,CAAC;AAAA,QAC9E;AAGA,eAAO,IAAI,SAAS,IAAI,WAAW,QAAQ,KAAK,GAAG;AAAA,UAClD,QAAQ;AAAA,UACR,SAAS;AAAA,YACR,gBAAgB,MAAM;AAAA,YACtB,kBAAkB,OAAO,MAAM,QAAQ;AAAA,YACvC,iBAAiB;AAAA,YACjB,MAAM;AAAA,UACP;AAAA,QACD,CAAC;AAAA,MACF;AAAA,IACD;AAAA;AAAA,IAGA;AAAA,MACC;AAAA,MACA;AAAA,MACA;AAAA,MACA,OAAO,QAAQ;AACd,cAAM,KAAK,IAAI,KAAK,SAAS,IAAI;AACjC,YAAI,CAAC,MAAM,CAAC,QAAQ,KAAK,EAAE,GAAG;AAC7B,iBAAO,eAAe,KAAK,WAAW,mBAAmB,gBAAgB;AAAA,QAC1E;AACA,cAAM,QAAQ,MAAM,OAAO,IAAI,EAAE;AACjC,YAAI,CAAC,MAAO,QAAO,eAAe,KAAK,WAAW,mBAAmB,gBAAgB;AACrF,YAAI,MAAM,cAAc,IAAI,KAAM,IAAI;AACrC,iBAAO,eAAe,KAAK,WAAW,aAAa,0CAA0C;AAAA,QAC9F;AACA,cAAM,OAAO,SAAS,OAAO,MAAM,UAAU;AAC7C,cAAM,OAAO,OAAO,EAAE;AACtB,eAAO,eAAe,KAAK,IAAI,iBAAiB,kBAAkB,EAAE,GAAG,CAAC;AAAA,MACzE;AAAA,IACD;AAAA,EACD;AACD;;;AK5JO,IAAM,cAAN,MAA6C;AAAA,EAInD,YACkB,OACA,QAChB;AAFgB;AACA;AAAA,EACf;AAAA,EAFe;AAAA,EACA;AAAA,EALT,OAAO;AAAA,EACP,OAAO,CAAC,gBAAgB;AAAA,EAOjC,QAAQ,KAAyB;AAChC,eAAW,CAAC,QAAQ,MAAM,GAAG,QAAQ,KAAK,iBAAiB,KAAK,OAAO,KAAK,MAAM,GAAG;AACpF,UAAI,SAAS,QAAQ,MAAM,GAAG,QAAQ;AAAA,IACvC;AAAA,EACD;AACD;;;ACpBA,SAAS,gBAAgB,uBAAuB;","names":[]}

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@fonderie/media",
-	"version": "0.2.0",
+	"version": "0.2.1",
 	"description": "Provider-abstracted asset storage — upload, store, and serve user-owned images (avatars, logos) with a DB-blob backend by default and object storage as a one-line swap.",
 	"keywords": [
 		"fonderiejs",