@hartl-services/medusa-base 0.4.0 → 1.1.0

package/dist/email/types/template-data.js

@@ -0,0 +1,231 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.EmailRenderDataSchemas = exports.EmailPersistedDataSchemas = exports.RefundSummarySchema = exports.ReturnReceivedSummarySchema = exports.ReturnSummarySchema = exports.ShipmentSummarySchema = exports.OrderSummarySchema = void 0;
+const zod_1 = require("@medusajs/framework/zod");
+const affiliate_1 = require("@hartl-services/medusa-food-supplements-contracts/schemas/affiliate");
+const NonEmptyStringSchema = zod_1.z.string().trim().min(1);
+const NullableLocaleSchema = NonEmptyStringSchema.max(35).nullable();
+const DocumentsFactFingerprintSchema = zod_1.z
+    .string()
+    .regex(/^[a-f0-9]{64}$/)
+    .optional();
+const AmountSchema = zod_1.z.string().regex(/^-?\d+(\.\d+)?$/);
+const OptionalTextSchema = zod_1.z.string().nullable();
+const OrderSummaryAddressSchema = zod_1.z
+    .object({
+    first_name: OptionalTextSchema,
+    last_name: OptionalTextSchema,
+    company: OptionalTextSchema,
+    address_1: OptionalTextSchema,
+    address_2: OptionalTextSchema,
+    postal_code: OptionalTextSchema,
+    city: OptionalTextSchema,
+    country_code: OptionalTextSchema,
+})
+    .strict();
+/**
+ * Snapshot of an order when it was placed. Amounts are Medusa's gross
+ * decimal strings: item and shipping rows before discounts, so
+ * `original_item_total + original_shipping_total - discount_total` is the
+ * `total`, which already contains `tax_total`.
+ */
+exports.OrderSummarySchema = zod_1.z
+    .object({
+    display_id: zod_1.z.number().int().nullable(),
+    /** The order's e-mail address; `null` when the order has none. */
+    email: OptionalTextSchema,
+    /** When the order was placed (ISO 8601). */
+    placed_at: zod_1.z.string().datetime(),
+    currency_code: NonEmptyStringSchema,
+    items: zod_1.z.array(zod_1.z
+        .object({
+        title: NonEmptyStringSchema,
+        variant_title: OptionalTextSchema,
+        quantity: zod_1.z.number().positive(),
+        original_total: AmountSchema,
+    })
+        .strict()),
+    shipping_method_names: zod_1.z.array(NonEmptyStringSchema),
+    original_item_total: AmountSchema,
+    original_shipping_total: AmountSchema,
+    discount_total: AmountSchema,
+    tax_total: AmountSchema,
+    total: AmountSchema,
+    billing_address: OrderSummaryAddressSchema.nullable(),
+    shipping_address: OrderSummaryAddressSchema.nullable(),
+})
+    .strict();
+/**
+ * Snapshot of one shipment when it was shipped: the parcel's items (title
+ * of the order line, shipped quantity), tracking numbers and links as
+ * entered at shipping, and whether more of the order is still to be shipped.
+ */
+exports.ShipmentSummarySchema = zod_1.z
+    .object({
+    display_id: zod_1.z.number().int().nullable(),
+    shipping_method_name: OptionalTextSchema,
+    tracking: zod_1.z.array(zod_1.z
+        .object({
+        number: OptionalTextSchema,
+        url: OptionalTextSchema,
+    })
+        .strict()),
+    items: zod_1.z.array(zod_1.z
+        .object({
+        title: NonEmptyStringSchema,
+        variant_title: OptionalTextSchema,
+        quantity: zod_1.z.number().positive(),
+    })
+        .strict()),
+    delivery_address: OrderSummaryAddressSchema.nullable(),
+    more_to_follow: zod_1.z.boolean(),
+})
+    .strict();
+/**
+ * Snapshot of a return when it was requested: the return and order numbers,
+ * the items to send back (title of the order line, quantity, reason label),
+ * the return shipping option and where to send the parcel.
+ */
+exports.ReturnSummarySchema = zod_1.z
+    .object({
+    display_id: zod_1.z.number().int().nullable(),
+    order_display_id: zod_1.z.number().int().nullable(),
+    shipping_method_name: OptionalTextSchema,
+    items: zod_1.z.array(zod_1.z
+        .object({
+        title: NonEmptyStringSchema,
+        variant_title: OptionalTextSchema,
+        quantity: zod_1.z.number().positive(),
+        reason: OptionalTextSchema,
+    })
+        .strict()),
+    return_address: OrderSummaryAddressSchema.nullable(),
+})
+    .strict();
+/**
+ * Snapshot of a return when it was completely received: the return and
+ * order numbers, when it arrived and the received items (title of the order
+ * line, received quantity and how much of it arrived damaged).
+ */
+exports.ReturnReceivedSummarySchema = zod_1.z
+    .object({
+    display_id: zod_1.z.number().int().nullable(),
+    order_display_id: zod_1.z.number().int().nullable(),
+    received_at: zod_1.z.string().datetime().nullable(),
+    items: zod_1.z.array(zod_1.z
+        .object({
+        title: NonEmptyStringSchema,
+        variant_title: OptionalTextSchema,
+        quantity: zod_1.z.number().positive(),
+        damaged_quantity: zod_1.z.number().nonnegative(),
+    })
+        .strict()),
+})
+    .strict();
+/**
+ * Snapshot of one refund when its Documents fact arrived: the order number,
+ * the refunded gross amount, when it was refunded and the refund reason
+ * chosen in the Admin.
+ */
+exports.RefundSummarySchema = zod_1.z
+    .object({
+    order_display_id: zod_1.z.number().int().nullable(),
+    amount: AmountSchema,
+    currency_code: NonEmptyStringSchema,
+    refunded_at: zod_1.z.string().datetime().nullable(),
+    reason: OptionalTextSchema,
+})
+    .strict();
+exports.EmailPersistedDataSchemas = {
+    "order.received": zod_1.z
+        .object({
+        order_id: NonEmptyStringSchema,
+        // Optional: messages stored before the summary existed have none.
+        summary: exports.OrderSummarySchema.optional(),
+    })
+        .strict(),
+    "order.received.admin": zod_1.z
+        .object({
+        order_id: NonEmptyStringSchema,
+        // Optional: messages stored before the summary existed have none.
+        summary: exports.OrderSummarySchema.optional(),
+    })
+        .strict(),
+    "order.shipped": zod_1.z
+        .object({
+        order_id: NonEmptyStringSchema,
+        fulfillment_id: NonEmptyStringSchema,
+        documents_fact_fingerprint: DocumentsFactFingerprintSchema,
+        // Optional: messages stored before the snapshot existed have none.
+        shipment: exports.ShipmentSummarySchema.optional(),
+        /** The invoice PDF is attached (Documents chose this shipment). */
+        invoice_attached: zod_1.z.boolean().optional(),
+    })
+        .strict(),
+    "order.canceled": zod_1.z
+        .object({
+        order_id: NonEmptyStringSchema,
+        documents_fact_fingerprint: DocumentsFactFingerprintSchema,
+        // Optional: messages stored before the snapshot existed have none.
+        summary: exports.OrderSummarySchema.optional(),
+        /** When the order was canceled (ISO 8601). */
+        canceled_at: zod_1.z.string().datetime().optional(),
+        /** A cancellation document PDF is attached (from Documents). */
+        cancellation_attached: zod_1.z.boolean().optional(),
+    })
+        .strict(),
+    "order.return_requested": zod_1.z
+        .object({
+        order_id: NonEmptyStringSchema,
+        return_id: NonEmptyStringSchema,
+        // Optional: messages stored before the snapshot existed have none.
+        summary: exports.ReturnSummarySchema.optional(),
+    })
+        .strict(),
+    "order.return_received": zod_1.z
+        .object({
+        order_id: NonEmptyStringSchema,
+        return_id: NonEmptyStringSchema,
+        // Optional: messages stored before the snapshot existed have none.
+        summary: exports.ReturnReceivedSummarySchema.optional(),
+    })
+        .strict(),
+    "order.refunded": zod_1.z
+        .object({
+        order_id: NonEmptyStringSchema,
+        refund_id: NonEmptyStringSchema,
+        documents_fact_fingerprint: DocumentsFactFingerprintSchema,
+        // Optional: messages stored before the snapshot existed have none.
+        summary: exports.RefundSummarySchema.optional(),
+        /** A cancellation document PDF is attached (from Documents). */
+        cancellation_attached: zod_1.z.boolean().optional(),
+    })
+        .strict(),
+    "auth.password_reset": zod_1.z
+        .object({
+        locale: NullableLocaleSchema,
+    })
+        .strict(),
+    "affiliate.consignment_report_due": zod_1.z
+        .object({
+        affiliate_display_name: NonEmptyStringSchema,
+        period_start: affiliate_1.CalendarMonthSchema,
+        due_date: affiliate_1.CalendarDateSchema,
+        locale: NullableLocaleSchema,
+    })
+        .strict(),
+    "user.invite": zod_1.z.object({}).strict(),
+};
+exports.EmailRenderDataSchemas = {
+    ...exports.EmailPersistedDataSchemas,
+    "auth.password_reset": exports.EmailPersistedDataSchemas["auth.password_reset"].extend({
+        reset_url: zod_1.z.string().url(),
+        /** How long the reset link is valid, from the token; `undefined` if unknown. */
+        valid_minutes: zod_1.z.number().int().positive().optional(),
+    }),
+    "user.invite": exports.EmailPersistedDataSchemas["user.invite"].extend({
+        invite_url: zod_1.z.string().url(),
+        /** When the invite expires (ISO 8601), from the current invite. */
+        expires_at: zod_1.z.string().datetime().optional(),
+    }),
+};

package/dist/files/config/index.d.ts

@@ -0,0 +1,32 @@
+import { type FileGatewayOptions, type FileModuleConfiguration, type S3CacheFileModuleConfigOptions, type S3CacheOptions, type S3CacheOptionsCache, type S3CacheStorageConfiguration, type ValidatedS3CacheProviderOptions } from "../types";
+export declare const validateS3CacheProviderOptions: (input: {
+    cache?: S3CacheOptionsCache;
+    gateway?: FileGatewayOptions;
+    s3?: S3CacheOptions;
+}) => ValidatedS3CacheProviderOptions;
+export declare const createS3CacheFileModuleConfig: (options?: S3CacheFileModuleConfigOptions) => FileModuleConfiguration;
+/**
+ * Validates the options once and returns both parts S3 Cache Storage needs:
+ * the File Module with the S3 provider (under `modules`) and the `gateway`
+ * part of the base plugin's `files` option that serves its `/files` routes.
+ * Both carry the same signing secret, so every URL the provider signs is one
+ * the routes accept.
+ */
+export declare const createS3CacheStorageConfig: (options: Omit<S3CacheFileModuleConfigOptions, "enabled" | "local">) => S3CacheStorageConfiguration;
+/**
+ * `medusa build` loads the configuration without deployment secrets. These
+ * placeholders only satisfy the required-variable checks of a build; they
+ * never reach a running server.
+ */
+export declare const S3_BUILD_PLACEHOLDERS: Readonly<Record<string, string>>;
+/**
+ * Static S3 credentials are optional (the AWS credential chain applies
+ * otherwise) but must be complete when present. They are never read during
+ * a build.
+ */
+export declare const resolveS3Credentials: (environment: NodeJS.ProcessEnv, phase: "build" | "runtime") => {
+    readonly accessKeyId: string;
+    readonly secretAccessKey: string;
+    readonly sessionToken?: string;
+} | undefined;
+export declare const resolveExpirationStrategy: (environment: NodeJS.ProcessEnv, defaultValue: "absolute" | "sliding") => "absolute" | "sliding";

package/dist/files/config/index.js

@@ -0,0 +1,255 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolveExpirationStrategy = exports.resolveS3Credentials = exports.S3_BUILD_PLACEHOLDERS = exports.createS3CacheStorageConfig = exports.createS3CacheFileModuleConfig = exports.validateS3CacheProviderOptions = void 0;
+const PACKAGE_NAME = "medusa-s3-cache-storage";
+const DEFAULT_CACHE = {
+    cleanupIntervalMs: 900_000,
+    dir: "./.medusa-s3-cache",
+    expirationStrategy: "absolute",
+    ttlMs: 3_600_000,
+};
+const DEFAULT_PRIVATE_DOWNLOAD_DURATION_SECONDS = 3_600;
+const invalid = (message) => {
+    throw new TypeError(`${PACKAGE_NAME}: ${message}`);
+};
+const requireNonBlankString = (value, field) => {
+    if (typeof value === "string") {
+        const trimmed = value.trim();
+        if (trimmed) {
+            return trimmed;
+        }
+    }
+    return invalid(`${field} must be a non-blank string`);
+};
+const validateHttpUrl = (value, field) => {
+    const url = requireNonBlankString(value, field);
+    try {
+        const parsed = new URL(url);
+        if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
+            invalid(`${field} must be an HTTP(S) URL`);
+        }
+        if (parsed.username || parsed.password || parsed.search || parsed.hash) {
+            invalid(`${field} must not include credentials, a query, or a fragment`);
+        }
+        return parsed.toString().replace(/\/$/u, "");
+    }
+    catch (error) {
+        if (error instanceof TypeError && error.message.startsWith(PACKAGE_NAME)) {
+            throw error;
+        }
+        return invalid(`${field} must be an HTTP(S) URL`);
+    }
+};
+const validateSafePrefix = (value, field) => {
+    if (value === undefined) {
+        return "";
+    }
+    const prefix = requireNonBlankString(value, field).replaceAll("\\", "/");
+    const segments = prefix.split("/");
+    if (segments.some((segment) => !segment ||
+        segment === "." ||
+        segment === ".." ||
+        /[\u0000-\u001F\u007F]/u.test(segment))) {
+        invalid(`${field} must contain only safe path segments`);
+    }
+    return segments.join("/");
+};
+const validateFiniteNumber = (value, field, minimum, maximum, defaultValue) => {
+    if (value === undefined) {
+        return defaultValue;
+    }
+    if (typeof value !== "number") {
+        return invalid(`${field} must be an integer from ${minimum} through ${maximum}`);
+    }
+    if (!Number.isFinite(value) ||
+        !Number.isInteger(value) ||
+        value < minimum ||
+        value > maximum) {
+        return invalid(`${field} must be an integer from ${minimum} through ${maximum}`);
+    }
+    return value;
+};
+const validateCacheOptions = (cache) => {
+    const expirationStrategy = cache?.expirationStrategy ?? DEFAULT_CACHE.expirationStrategy;
+    if (expirationStrategy !== "absolute" && expirationStrategy !== "sliding") {
+        invalid("cache.expirationStrategy must be 'absolute' or 'sliding'");
+    }
+    return {
+        cleanupIntervalMs: validateFiniteNumber(cache?.cleanupIntervalMs, "cache.cleanupIntervalMs", 1, 86_400_000, DEFAULT_CACHE.cleanupIntervalMs),
+        dir: cache?.dir
+            ? requireNonBlankString(cache.dir, "cache.dir")
+            : DEFAULT_CACHE.dir,
+        expirationStrategy,
+        ttlMs: validateFiniteNumber(cache?.ttlMs, "cache.ttlMs", 0, 604_800_000, DEFAULT_CACHE.ttlMs),
+    };
+};
+const validateCredentials = (credentials) => {
+    if (!credentials) {
+        return undefined;
+    }
+    const accessKeyId = credentials.accessKeyId;
+    const secretAccessKey = credentials.secretAccessKey;
+    if (!accessKeyId && !secretAccessKey && !credentials.sessionToken) {
+        invalid("s3.credentials must contain accessKeyId and secretAccessKey");
+    }
+    return {
+        accessKeyId: requireNonBlankString(accessKeyId, "s3.credentials.accessKeyId"),
+        secretAccessKey: requireNonBlankString(secretAccessKey, "s3.credentials.secretAccessKey"),
+        ...(credentials.sessionToken
+            ? {
+                sessionToken: requireNonBlankString(credentials.sessionToken, "s3.credentials.sessionToken"),
+            }
+            : {}),
+    };
+};
+const validateGatewayOptions = (gateway) => {
+    if (!gateway) {
+        return invalid("gateway options are required when enabled is true");
+    }
+    return {
+        baseUrl: validateHttpUrl(gateway.baseUrl, "gateway.baseUrl"),
+        privateDownloadDurationSeconds: validateFiniteNumber(gateway.privateDownloadDurationSeconds, "gateway.privateDownloadDurationSeconds", 1, 604_800, DEFAULT_PRIVATE_DOWNLOAD_DURATION_SECONDS),
+        signingSecret: requireNonBlankString(gateway.signingSecret, "gateway.signingSecret"),
+    };
+};
+const validateS3CacheProviderOptions = (input) => {
+    const s3 = input.s3;
+    if (!s3) {
+        return invalid("s3 options are required when enabled is true");
+    }
+    if (s3.forcePathStyle !== undefined &&
+        typeof s3.forcePathStyle !== "boolean") {
+        invalid("s3.forcePathStyle must be a boolean");
+    }
+    if (s3.endpoint !== undefined) {
+        validateHttpUrl(s3.endpoint, "s3.endpoint");
+    }
+    return {
+        cache: validateCacheOptions(input.cache),
+        gateway: validateGatewayOptions(input.gateway),
+        s3: {
+            bucket: requireNonBlankString(s3.bucket, "s3.bucket"),
+            credentials: validateCredentials(s3.credentials),
+            endpoint: s3.endpoint === undefined
+                ? undefined
+                : validateHttpUrl(s3.endpoint, "s3.endpoint"),
+            forcePathStyle: s3.forcePathStyle ?? false,
+            region: requireNonBlankString(s3.region, "s3.region"),
+            storagePrefix: validateSafePrefix(s3.storagePrefix, "s3.storagePrefix"),
+        },
+    };
+};
+exports.validateS3CacheProviderOptions = validateS3CacheProviderOptions;
+const buildLocalProviderOptions = (options) => ({
+    ...(options?.backendUrl ? { backend_url: options.backendUrl } : {}),
+    ...(options?.privateUploadDir
+        ? { private_upload_dir: options.privateUploadDir }
+        : {}),
+    ...(options?.uploadDir ? { upload_dir: options.uploadDir } : {}),
+});
+const createS3CacheFileModuleConfig = (options = {}) => {
+    if (options.enabled !== true) {
+        return {
+            options: {
+                providers: [
+                    {
+                        id: "local",
+                        options: buildLocalProviderOptions(options.local),
+                        resolve: "@medusajs/medusa/file-local",
+                    },
+                ],
+            },
+            resolve: "@medusajs/medusa/file",
+        };
+    }
+    return s3FileModule((0, exports.validateS3CacheProviderOptions)(options));
+};
+exports.createS3CacheFileModuleConfig = createS3CacheFileModuleConfig;
+const s3FileModule = (validated) => ({
+    options: {
+        providers: [
+            {
+                id: "s3-cache",
+                options: {
+                    cache: validated.cache,
+                    gateway: validated.gateway,
+                    s3: validated.s3,
+                },
+                resolve: "@hartl-services/medusa-base/providers/s3-cache",
+            },
+        ],
+    },
+    resolve: "@medusajs/medusa/file",
+});
+/**
+ * Validates the options once and returns both parts S3 Cache Storage needs:
+ * the File Module with the S3 provider (under `modules`) and the `gateway`
+ * part of the base plugin's `files` option that serves its `/files` routes.
+ * Both carry the same signing secret, so every URL the provider signs is one
+ * the routes accept.
+ */
+const createS3CacheStorageConfig = (options) => {
+    const validated = (0, exports.validateS3CacheProviderOptions)(options);
+    return {
+        fileModule: s3FileModule(validated),
+        gateway: { signingSecret: validated.gateway.signingSecret },
+    };
+};
+exports.createS3CacheStorageConfig = createS3CacheStorageConfig;
+/**
+ * `medusa build` loads the configuration without deployment secrets. These
+ * placeholders only satisfy the required-variable checks of a build; they
+ * never reach a running server.
+ */
+exports.S3_BUILD_PLACEHOLDERS = {
+    S3_CACHE_STORAGE_BUCKET: "build-bucket",
+    S3_CACHE_STORAGE_REGION: "build-placeholder",
+};
+const optionalEnvironment = (environment, name) => {
+    const value = environment[name]?.trim();
+    return value ? value : undefined;
+};
+/**
+ * Static S3 credentials are optional (the AWS credential chain applies
+ * otherwise) but must be complete when present. They are never read during
+ * a build.
+ */
+const resolveS3Credentials = (environment, phase) => {
+    if (phase === "build") {
+        return undefined;
+    }
+    const accessKeyId = optionalEnvironment(environment, "S3_CACHE_STORAGE_ACCESS_KEY_ID");
+    const secretAccessKey = optionalEnvironment(environment, "S3_CACHE_STORAGE_SECRET_ACCESS_KEY");
+    const sessionToken = optionalEnvironment(environment, "S3_CACHE_STORAGE_SESSION_TOKEN");
+    // A declared but blank key still counts: it signals intended static
+    // credentials, which must then be complete.
+    if (!("S3_CACHE_STORAGE_ACCESS_KEY_ID" in environment) &&
+        !("S3_CACHE_STORAGE_SECRET_ACCESS_KEY" in environment) &&
+        !sessionToken) {
+        return undefined;
+    }
+    const missing = [
+        accessKeyId ? undefined : "S3_CACHE_STORAGE_ACCESS_KEY_ID",
+        secretAccessKey ? undefined : "S3_CACHE_STORAGE_SECRET_ACCESS_KEY",
+    ].filter((name) => name !== undefined);
+    if (missing.length > 0) {
+        throw new TypeError(`Missing required environment variables: ${missing.join(", ")}.`);
+    }
+    return {
+        accessKeyId: accessKeyId,
+        secretAccessKey: secretAccessKey,
+        ...(sessionToken ? { sessionToken } : {}),
+    };
+};
+exports.resolveS3Credentials = resolveS3Credentials;
+const resolveExpirationStrategy = (environment, defaultValue) => {
+    const value = optionalEnvironment(environment, "S3_CACHE_STORAGE_EXPIRATION_STRATEGY");
+    if (value === undefined) {
+        return defaultValue;
+    }
+    if (value !== "absolute" && value !== "sliding") {
+        throw new TypeError('S3_CACHE_STORAGE_EXPIRATION_STRATEGY must be either "absolute" or "sliding".');
+    }
+    return value;
+};
+exports.resolveExpirationStrategy = resolveExpirationStrategy;

package/dist/files/gateway/index.d.ts

@@ -0,0 +1,30 @@
+export declare const toPublicFileGatewayUrl: (baseUrl: string, logicalFileKey: string) => string;
+export declare const publicFileGatewayKey: (asset: string) => string;
+export declare const createPrivateFileGatewayUrl: (input: {
+    baseUrl: string;
+    durationSeconds: number;
+    fileKey: string;
+    now?: number;
+    signingSecret: string;
+}) => string;
+export declare const createFileGatewayUploadUrl: (input: {
+    baseUrl: string;
+    durationSeconds: number;
+    fileKey: string;
+    now?: number;
+    signingSecret: string;
+}) => string;
+export declare const verifyPrivateFileGatewayToken: (input: {
+    expires: number;
+    now?: number;
+    signature: string;
+    signingSecret: string;
+    token: string;
+}) => string | undefined;
+export declare const verifyFileGatewayUploadToken: (input: {
+    expires: number;
+    now?: number;
+    signature: string;
+    signingSecret: string;
+    token: string;
+}) => string | undefined;

package/dist/files/gateway/index.js

@@ -0,0 +1,114 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.verifyFileGatewayUploadToken = exports.verifyPrivateFileGatewayToken = exports.createFileGatewayUploadUrl = exports.createPrivateFileGatewayUrl = exports.publicFileGatewayKey = exports.toPublicFileGatewayUrl = void 0;
+const node_crypto_1 = require("node:crypto");
+const PRIVATE_SIGNATURE_VERSION = "v1";
+const safeLogicalKey = (value) => {
+    if (!value ||
+        value.startsWith("/") ||
+        value.includes("\\") ||
+        value
+            .split("/")
+            .some((segment) => !segment ||
+            segment === "." ||
+            segment === ".." ||
+            /[\u0000-\u001F\u007F]/u.test(segment))) {
+        throw new TypeError("File gateway key must be a safe relative path");
+    }
+    return value;
+};
+const gatewayUrl = (baseUrl, path) => {
+    const url = new URL(`${baseUrl.replace(/\/$/u, "")}/`);
+    url.pathname = `${url.pathname.replace(/\/$/u, "")}/${path}`;
+    return url;
+};
+const signatureFor = (input) => (0, node_crypto_1.createHmac)("sha256", input.secret)
+    .update(`${PRIVATE_SIGNATURE_VERSION}\n${input.action}\n${input.token}\n${input.expires}`)
+    .digest("base64url");
+const createPrivateCapabilityUrl = (input) => {
+    const fileKey = safeLogicalKey(input.fileKey);
+    if (input.action === "download" && fileKey.startsWith("public/")) {
+        throw new TypeError("Public files must not use private gateway URLs");
+    }
+    const token = Buffer.from(fileKey, "utf8").toString("base64url");
+    const expires = Math.floor((input.now ?? Date.now()) / 1_000) + input.durationSeconds;
+    const url = gatewayUrl(input.baseUrl, `${input.path}/${token}`);
+    url.searchParams.set("expires", String(expires));
+    url.searchParams.set("signature", signatureFor({
+        action: input.action,
+        expires,
+        secret: input.signingSecret,
+        token,
+    }));
+    return url.toString();
+};
+const verifyPrivateCapabilityToken = (input) => {
+    if (!Number.isSafeInteger(input.expires) ||
+        input.expires < Math.floor((input.now ?? Date.now()) / 1_000)) {
+        return undefined;
+    }
+    const expected = Buffer.from(signatureFor({
+        action: input.action,
+        expires: input.expires,
+        secret: input.signingSecret,
+        token: input.token,
+    }), "base64url");
+    const provided = Buffer.from(input.signature, "base64url");
+    if (provided.toString("base64url") !== input.signature ||
+        provided.length !== expected.length ||
+        !(0, node_crypto_1.timingSafeEqual)(provided, expected)) {
+        return undefined;
+    }
+    try {
+        const fileKeyBuffer = Buffer.from(input.token, "base64url");
+        if (fileKeyBuffer.toString("base64url") !== input.token) {
+            return undefined;
+        }
+        const fileKey = safeLogicalKey(fileKeyBuffer.toString("utf8"));
+        return input.action === "download" && fileKey.startsWith("public/")
+            ? undefined
+            : fileKey;
+    }
+    catch {
+        return undefined;
+    }
+};
+const toPublicFileGatewayUrl = (baseUrl, logicalFileKey) => {
+    const key = safeLogicalKey(logicalFileKey);
+    if (!key.startsWith("public/")) {
+        throw new TypeError("Only public file keys can have public gateway URLs");
+    }
+    const asset = key.slice("public/".length);
+    if (!asset || asset.includes("/")) {
+        throw new TypeError("Public gateway files must have one opaque asset name");
+    }
+    return gatewayUrl(baseUrl, encodeURIComponent(asset)).toString();
+};
+exports.toPublicFileGatewayUrl = toPublicFileGatewayUrl;
+const publicFileGatewayKey = (asset) => {
+    if (!asset || asset.includes("/") || asset.includes("\\")) {
+        throw new TypeError("Public gateway asset is invalid");
+    }
+    return safeLogicalKey(`public/${asset}`);
+};
+exports.publicFileGatewayKey = publicFileGatewayKey;
+const createPrivateFileGatewayUrl = (input) => {
+    return createPrivateCapabilityUrl({
+        ...input,
+        action: "download",
+        path: "private",
+    });
+};
+exports.createPrivateFileGatewayUrl = createPrivateFileGatewayUrl;
+const createFileGatewayUploadUrl = (input) => createPrivateCapabilityUrl({
+    ...input,
+    action: "upload",
+    path: "upload",
+});
+exports.createFileGatewayUploadUrl = createFileGatewayUploadUrl;
+const verifyPrivateFileGatewayToken = (input) => {
+    return verifyPrivateCapabilityToken({ ...input, action: "download" });
+};
+exports.verifyPrivateFileGatewayToken = verifyPrivateFileGatewayToken;
+const verifyFileGatewayUploadToken = (input) => verifyPrivateCapabilityToken({ ...input, action: "upload" });
+exports.verifyFileGatewayUploadToken = verifyFileGatewayUploadToken;

package/dist/files/types/index.d.ts

@@ -0,0 +1,2 @@
+export type { CacheExpirationStrategy, FileGatewayOptions, FilesPluginOptions, FileModuleConfiguration, FileModuleProviderConfiguration, LocalFileProviderOptions, S3CacheCredentials, S3CacheFileModuleConfigOptions, S3CacheOptions, S3CacheOptionsCache, S3CacheStorageConfiguration, ValidatedS3CacheCredentials, ValidatedFileGatewayOptions, ValidatedS3CacheOptions, ValidatedS3CacheProviderOptions, } from "./public";
+export { BASE_PLUGIN_RESOLVE } from "./public";

package/dist/files/types/index.js

@@ -0,0 +1,5 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.BASE_PLUGIN_RESOLVE = void 0;
+var public_1 = require("./public");
+Object.defineProperty(exports, "BASE_PLUGIN_RESOLVE", { enumerable: true, get: function () { return public_1.BASE_PLUGIN_RESOLVE; } });