@gmickel/gno 1.32.0 → 1.34.0

package/src/publish/attachment-resolver.ts

@@ -0,0 +1,280 @@
+/**
+ * Parser-aware local attachment discovery, rewrite, and v1 bundling entrypoints.
+ *
+ * @module src/publish/attachment-resolver
+ */
+
+import type {
+  AttachmentDiagnostic,
+  AttachmentResolveContext,
+  PendingAssetPayload,
+} from "./attachment-types";
+
+import {
+  GNO_ASSET_SENTINEL_PREFIX,
+  MAX_PUBLISH_UPLOAD_BYTES,
+} from "./artifact-asset-contract";
+import { formatGnoAssetSentinel } from "./artifact-asset-sniff";
+import {
+  attachAssetsToV1Artifact,
+  buildDeterministicAssets,
+  emptyAssetEgressSummary,
+  summarizeAssetEgress,
+} from "./attachment-bundle";
+import {
+  discoverImageOccurrences,
+  type DiscoveredImageRef,
+} from "./attachment-discover";
+import { readAndValidateAsset } from "./attachment-load";
+import {
+  assertContainedFile,
+  buildAttachmentBasenameIndex,
+  diagnostic,
+  resolveCandidateRelPath,
+} from "./attachment-path";
+
+export type {
+  AttachmentDiagnostic,
+  AttachmentDiagnosticCode,
+  AttachmentResolveContext,
+  PendingAssetPayload,
+  PublishAssetEgressSummary,
+} from "./attachment-types";
+export {
+  attachAssetsToV1Artifact,
+  buildDeterministicAssets,
+  emptyAssetEgressSummary,
+  summarizeAssetEgress,
+} from "./attachment-bundle";
+export { buildAttachmentBasenameIndex } from "./attachment-path";
+
+export interface AttachmentRewriteResult {
+  diagnostics: AttachmentDiagnostic[];
+  externalCount: number;
+  markdown: string;
+  payloads: Map<string, PendingAssetPayload>;
+  /** Raw bytes summed per successful load before cross-ref dedup. */
+  preDedupRawBytes: number;
+}
+
+type ImageOccurrence = DiscoveredImageRef;
+
+const isExternalDestination = (value: string): boolean => {
+  const trimmed = value.trim();
+  return trimmed.startsWith("//") || /^[a-z][a-z0-9+.-]*:/iu.test(trimmed);
+};
+
+const isDataUrl = (value: string): boolean =>
+  value.trim().toLowerCase().startsWith("data:");
+
+const escapeMarkdownImageAlt = (value: string): string =>
+  value.replace(/[\\[\]]/gu, "\\$&");
+
+const formatMarkdownImageTitle = (value: string | null | undefined): string =>
+  value === null || value === undefined
+    ? ""
+    : ` "${value.replace(/[\\"]/gu, "\\$&")}"`;
+
+const rewriteOccurrence = (
+  occurrence: ImageOccurrence,
+  assetId: string
+): string => {
+  const sentinel = formatGnoAssetSentinel(assetId);
+  if (occurrence.kind === "markdown") {
+    return `![${escapeMarkdownImageAlt(occurrence.alt)}](${sentinel}${formatMarkdownImageTitle(occurrence.title)})`;
+  }
+  const alias = occurrence.alt.trim();
+  const display = alias.length > 0 && !/^\d+$/u.test(alias) ? alias : "";
+  return `![${display}](${sentinel})`;
+};
+
+const mergePayload = (
+  payloads: Map<string, PendingAssetPayload>,
+  loaded: PendingAssetPayload,
+  noteSlug: string,
+  relPath: string
+): void => {
+  const existing = payloads.get(loaded.sha256);
+  if (existing) {
+    existing.references.push({ noteSlug, sourceRef: relPath });
+    return;
+  }
+  payloads.set(loaded.sha256, loaded);
+};
+
+/**
+ * Discover local/external image refs in one parser-aware pass and rewrite
+ * successfully bundled destinations to gno-asset:<sha256>.
+ */
+export async function rewriteAttachmentsInMarkdown(
+  markdown: string,
+  ctx: AttachmentResolveContext
+): Promise<AttachmentRewriteResult> {
+  const occurrences = discoverImageOccurrences(markdown);
+  const diagnostics: AttachmentDiagnostic[] = [];
+  const payloads = new Map<string, PendingAssetPayload>();
+  let externalCount = 0;
+  let newEncodedAssetBytes = 0;
+  let preDedupRawBytes = 0;
+  const replacements: Array<{ end: number; start: number; text: string }> = [];
+
+  for (const occurrence of occurrences) {
+    const ref = occurrence.sourceRef.trim();
+    if (!ref) {
+      diagnostics.push(
+        diagnostic(
+          "ASSET_CORRUPT",
+          "Empty image destination",
+          ctx.noteSlug,
+          ref
+        )
+      );
+      replacements.push({
+        start: occurrence.start,
+        end: occurrence.end,
+        text: "",
+      });
+      continue;
+    }
+    if (isDataUrl(ref)) {
+      diagnostics.push(
+        diagnostic(
+          "ASSET_UNSUPPORTED_FORMAT",
+          "data: image URLs are unsupported",
+          ctx.noteSlug,
+          ref
+        )
+      );
+      replacements.push({
+        start: occurrence.start,
+        end: occurrence.end,
+        text: "",
+      });
+      continue;
+    }
+    if (ref.startsWith(GNO_ASSET_SENTINEL_PREFIX)) {
+      diagnostics.push(
+        diagnostic(
+          "ASSET_CORRUPT",
+          "Authored gno-asset references are reserved for publish export",
+          ctx.noteSlug,
+          ref
+        )
+      );
+      replacements.push({
+        start: occurrence.start,
+        end: occurrence.end,
+        text: "",
+      });
+      continue;
+    }
+    if (isExternalDestination(ref)) {
+      if (/^https?:/iu.test(ref) || ref.startsWith("//")) {
+        externalCount += 1;
+        continue;
+      }
+      diagnostics.push(
+        diagnostic(
+          "ASSET_UNSUPPORTED_FORMAT",
+          `Unsupported image protocol in "${ref}"`,
+          ctx.noteSlug,
+          ref
+        )
+      );
+      replacements.push({
+        start: occurrence.start,
+        end: occurrence.end,
+        text: "",
+      });
+      continue;
+    }
+    const resolved = resolveCandidateRelPath(ref, ctx, occurrence.kind);
+    if (!resolved.ok) {
+      if (resolved.diagnostic.code === "ASSET_TRAVERSAL") {
+        throw new Error(
+          `ASSET_TRAVERSAL: ${resolved.diagnostic.message} (${ref})`
+        );
+      }
+      diagnostics.push(resolved.diagnostic);
+      replacements.push({
+        start: occurrence.start,
+        end: occurrence.end,
+        text: "",
+      });
+      continue;
+    }
+
+    const contained = await assertContainedFile(
+      ctx.collectionRoot,
+      resolved.relPath,
+      ctx.noteSlug,
+      ref,
+      ctx.collectionExcludes
+    );
+    if ("code" in contained) {
+      diagnostics.push(contained);
+      replacements.push({
+        start: occurrence.start,
+        end: occurrence.end,
+        text: "",
+      });
+      continue;
+    }
+
+    const loaded = await readAndValidateAsset(
+      contained.absPath,
+      ctx.noteSlug,
+      ref,
+      resolved.relPath
+    );
+    if ("code" in loaded) {
+      diagnostics.push(loaded);
+      replacements.push({
+        start: occurrence.start,
+        end: occurrence.end,
+        text: "",
+      });
+      continue;
+    }
+
+    preDedupRawBytes += loaded.byteLength;
+    const isNewAsset =
+      !payloads.has(loaded.sha256) && !ctx.existingAssetIds?.has(loaded.sha256);
+    if (isNewAsset) {
+      const projectedEncodedBytes =
+        (ctx.existingEncodedAssetBytes ?? 0) +
+        newEncodedAssetBytes +
+        loaded.data.length;
+      if (projectedEncodedBytes > MAX_PUBLISH_UPLOAD_BYTES) {
+        throw new Error(
+          `ENVELOPE_OVERSIZE: encoded asset data exceeds ${MAX_PUBLISH_UPLOAD_BYTES} bytes`
+        );
+      }
+      newEncodedAssetBytes += loaded.data.length;
+    }
+    mergePayload(payloads, loaded, ctx.noteSlug, resolved.relPath);
+    replacements.push({
+      start: occurrence.start,
+      end: occurrence.end,
+      text: rewriteOccurrence(occurrence, loaded.sha256),
+    });
+  }
+
+  let output = markdown;
+  for (const replacement of [...replacements].sort(
+    (a, b) => b.start - a.start
+  )) {
+    output =
+      output.slice(0, replacement.start) +
+      replacement.text +
+      output.slice(replacement.end);
+  }
+
+  return {
+    diagnostics,
+    externalCount,
+    markdown: output,
+    payloads,
+    preDedupRawBytes,
+  };
+}

package/src/publish/attachment-types.ts

@@ -0,0 +1,54 @@
+/**
+ * Shared attachment diagnostic and payload types for publish export.
+ *
+ * @module src/publish/attachment-types
+ */
+
+import type {
+  PublishArtifactAsset,
+  PublishArtifactAssetReference,
+  PublishAssetDiagnosticCode,
+} from "./artifact-asset-contract";
+
+export type AttachmentDiagnosticCode =
+  | PublishAssetDiagnosticCode
+  | "ASSET_AMBIGUOUS"
+  | "ASSET_EXTERNAL";
+
+export interface AttachmentDiagnostic {
+  code: AttachmentDiagnosticCode;
+  message: string;
+  noteSlug: string;
+  sourceRef: string;
+}
+
+export interface PublishAssetEgressSummary {
+  assetCount: number;
+  dedupSavedBytes: number;
+  diagnostics: AttachmentDiagnostic[];
+  encodedBytes: number;
+  externalCount: number;
+  finalUploadBytes: number;
+  rawBytes: number;
+  referenceCount: number;
+}
+
+export interface PendingAssetPayload {
+  byteLength: number;
+  data: string;
+  height: number;
+  mediaType: PublishArtifactAsset["mediaType"];
+  references: PublishArtifactAssetReference[];
+  sha256: string;
+  width: number;
+}
+
+export interface AttachmentResolveContext {
+  basenameIndex: Map<string, string[]>;
+  collectionExcludes?: readonly string[];
+  collectionRoot: string;
+  existingAssetIds?: ReadonlySet<string>;
+  existingEncodedAssetBytes?: number;
+  noteSlug: string;
+  sourceRelPath: string;
+}

package/src/publish/encrypted-export.ts

@@ -1,14 +1,25 @@
-import { randomBytes, webcrypto } from "node:crypto";
+/**
+ * Client-encrypted publish payload builder (v2).
+ * Raster assets are embedded only inside AES-GCM plaintext ReaderSpaceData.
+ *
+ * @module src/publish/encrypted-export
+ */
 
-import type { EncryptedArtifactPayload, PublishArtifactNote } from "./artifact";
+import type {
+  EncryptedArtifactPayload,
+  PublishArtifactAsset,
+  PublishArtifactNote,
+} from "./artifact";
 
-const { subtle } = webcrypto;
+import { encodeBytesToBase64 } from "./artifact-asset-codec";
+import { BUNDLED_RASTER_ASSETS_CAPABILITY } from "./artifact-asset-contract";
 
 const PBKDF2_ITERATIONS = 210_000;
 const IV_BYTES = 12;
 const SALT_BYTES = 16;
 
 const encoder = new TextEncoder();
+const decoder = new TextDecoder();
 
 type MetadataEntry = {
   label: string;
@@ -47,14 +58,19 @@ type ReaderNoteCard = {
   title: string;
 };
 
-type ReaderSpaceData = {
+/** AES-GCM plaintext shape for encrypted shares (assets stay client-only). */
+export type EncryptedReaderSpaceData = {
+  /** Always empty — encrypted shares never project server asset manifests. */
   assetManifest: [];
+  /** Validated descriptors + base64 bytes; omitted when asset-free. */
+  assets?: PublishArtifactAsset[];
   currentNote: ReaderNoteCard;
   homeNoteSlug?: string;
   metadataPreview: MetadataEntry[];
   nextNoteSlug?: string;
   noteCards: ReaderNoteCard[];
   previousNoteSlug?: string;
+  requiredCapabilities?: Array<typeof BUNDLED_RASTER_ASSETS_CAPABILITY>;
   searchIndex: Array<{
     excerpt: string;
     haystack: string;
@@ -77,7 +93,28 @@ type ReaderSpaceData = {
   visibility: "encrypted";
 };
 
-const toBase64 = (value: Uint8Array) => Buffer.from(value).toString("base64");
+const toBase64 = (value: Uint8Array): string => encodeBytesToBase64(value);
+
+const fromBase64 = (value: string): Uint8Array => {
+  const binary = atob(value);
+  const bytes = new Uint8Array(binary.length);
+  for (let i = 0; i < binary.length; i += 1) {
+    bytes[i] = binary.charCodeAt(i);
+  }
+  return bytes;
+};
+
+const randomBytes = (size: number): Uint8Array => {
+  const bytes = new Uint8Array(size);
+  crypto.getRandomValues(bytes);
+  return bytes;
+};
+
+const toArrayBuffer = (value: Uint8Array): ArrayBuffer =>
+  value.buffer.slice(
+    value.byteOffset,
+    value.byteOffset + value.byteLength
+  ) as ArrayBuffer;
 
 const stripFrontmatter = (markdown: string) => {
   if (!markdown.startsWith("---\n")) {
@@ -134,6 +171,7 @@ const deriveExcerpt = (summary: string, blocks: NoteBlock[]) => {
 };
 
 const deriveReaderPayload = (input: {
+  assets: PublishArtifactAsset[];
   exportedAt: string;
   homeNoteSlug?: string;
   notes: PublishArtifactNote[];
@@ -141,7 +179,7 @@ const deriveReaderPayload = (input: {
   sourceType: "note" | "collection";
   summary: string;
   title: string;
-}) => {
+}): { payload: EncryptedReaderSpaceData; secretToken: string } => {
   const noteCards: ReaderNoteCard[] = input.notes.map((note) => {
     const blocks = parseMarkdownBlocks(note.markdown);
     return {
@@ -173,43 +211,55 @@ const deriveReaderPayload = (input: {
     (note) => note.noteId === currentNote.noteId
   );
   const sharePath = `/locked/${makeToken(input.routeSlug)}`;
+  const hasAssets = input.assets.length > 0;
+
+  const payload: EncryptedReaderSpaceData = {
+    sharePath,
+    shareLabel: "Encrypted share",
+    visibility: "encrypted",
+    sourceType: input.sourceType,
+    title: input.title,
+    summary: input.summary,
+    snapshot: {
+      id: `snapshot-${input.routeSlug}-encrypted-v1`,
+      version: 1,
+      createdAt: input.exportedAt,
+      lastIndexedAt: input.exportedAt,
+      searchEnabled: noteCards.length > 1,
+    },
+    metadataPreview: [],
+    assetManifest: [],
+    searchIndex: noteCards.map((note) => ({
+      noteId: note.noteId,
+      slug: note.slug,
+      title: note.title,
+      excerpt: note.excerpt,
+      haystack: `${note.title} ${note.summary}`.toLowerCase(),
+    })),
+    noteCards,
+    currentNote,
+    previousNoteSlug: noteCards[currentIndex - 1]?.slug,
+    nextNoteSlug: noteCards[currentIndex + 1]?.slug,
+    homeNoteSlug: input.homeNoteSlug ?? noteCards[0]?.slug,
+  };
+
+  if (hasAssets) {
+    payload.assets = input.assets;
+    payload.requiredCapabilities = [BUNDLED_RASTER_ASSETS_CAPABILITY];
+  }
 
   return {
-    payload: {
-      sharePath,
-      shareLabel: "Encrypted share",
-      visibility: "encrypted" as const,
-      sourceType: input.sourceType,
-      title: input.title,
-      summary: input.summary,
-      snapshot: {
-        id: `snapshot-${input.routeSlug}-encrypted-v1`,
-        version: 1,
-        createdAt: input.exportedAt,
-        lastIndexedAt: input.exportedAt,
-        searchEnabled: noteCards.length > 1,
-      },
-      metadataPreview: [],
-      assetManifest: [],
-      searchIndex: noteCards.map((note) => ({
-        noteId: note.noteId,
-        slug: note.slug,
-        title: note.title,
-        excerpt: note.excerpt,
-        haystack: `${note.title} ${note.summary}`.toLowerCase(),
-      })),
-      noteCards,
-      currentNote,
-      previousNoteSlug: noteCards[currentIndex - 1]?.slug,
-      nextNoteSlug: noteCards[currentIndex + 1]?.slug,
-      homeNoteSlug: input.homeNoteSlug ?? noteCards[0]?.slug,
-    } satisfies ReaderSpaceData,
+    payload,
     secretToken: sharePath.replace("/locked/", ""),
   };
 };
 
-const deriveKey = async (passphrase: string, salt: Uint8Array) => {
-  const material = await subtle.importKey(
+const deriveKey = async (
+  passphrase: string,
+  salt: Uint8Array,
+  usages: KeyUsage[]
+) => {
+  const material = await crypto.subtle.importKey(
     "raw",
     encoder.encode(passphrase),
     "PBKDF2",
@@ -217,11 +267,11 @@ const deriveKey = async (passphrase: string, salt: Uint8Array) => {
     ["deriveKey"]
   );
 
-  return subtle.deriveKey(
+  return crypto.subtle.deriveKey(
     {
       name: "PBKDF2",
       hash: "SHA-256",
-      salt: Uint8Array.from(salt),
+      salt: toArrayBuffer(salt),
       iterations: PBKDF2_ITERATIONS,
     },
     material,
@@ -230,7 +280,7 @@ const deriveKey = async (passphrase: string, salt: Uint8Array) => {
       length: 256,
     },
     false,
-    ["encrypt"]
+    usages
   );
 };
 
@@ -240,10 +290,10 @@ const encryptJson = async (
 ): Promise<EncryptedArtifactPayload> => {
   const salt = randomBytes(SALT_BYTES);
   const iv = randomBytes(IV_BYTES);
-  const key = await deriveKey(passphrase, salt);
+  const key = await deriveKey(passphrase, salt, ["encrypt"]);
   const plaintext = encoder.encode(JSON.stringify(payload));
-  const ciphertext = await subtle.encrypt(
-    { name: "AES-GCM", iv },
+  const ciphertext = await crypto.subtle.encrypt(
+    { name: "AES-GCM", iv: toArrayBuffer(iv) },
     key,
     plaintext
   );
@@ -256,7 +306,25 @@ const encryptJson = async (
   };
 };
 
+export const decryptEncryptedArtifactPayload = async <
+  T = EncryptedReaderSpaceData,
+>(
+  passphrase: string,
+  payload: EncryptedArtifactPayload
+): Promise<T> => {
+  const key = await deriveKey(passphrase, fromBase64(payload.salt), [
+    "decrypt",
+  ]);
+  const plaintext = await crypto.subtle.decrypt(
+    { name: "AES-GCM", iv: toArrayBuffer(fromBase64(payload.iv)) },
+    key,
+    toArrayBuffer(fromBase64(payload.ciphertext))
+  );
+  return JSON.parse(decoder.decode(plaintext)) as T;
+};
+
 export const buildEncryptedArtifactPayload = async (input: {
+  assets?: PublishArtifactAsset[];
   exportedAt: string;
   homeNoteSlug?: string;
   notes: PublishArtifactNote[];
@@ -266,7 +334,16 @@ export const buildEncryptedArtifactPayload = async (input: {
   summary: string;
   title: string;
 }) => {
-  const { payload, secretToken } = deriveReaderPayload(input);
+  const { payload, secretToken } = deriveReaderPayload({
+    assets: input.assets ?? [],
+    exportedAt: input.exportedAt,
+    homeNoteSlug: input.homeNoteSlug,
+    notes: input.notes,
+    routeSlug: input.routeSlug,
+    sourceType: input.sourceType,
+    summary: input.summary,
+    title: input.title,
+  });
 
   return {
     encryptedPayload: await encryptJson(input.passphrase, payload),