@holo-js/media 0.2.5 → 0.3.0

package/dist/chunk-VIEJQKMM.mjs

@@ -0,0 +1,17 @@
+// src/projectConfig.ts
+import { registerConfigNormalizer } from "@holo-js/config/registry";
+function normalizeMediaConfig(config = {}) {
+  return Object.freeze({ ...config });
+}
+function defineMediaConfig(config) {
+  return Object.freeze({ ...config });
+}
+registerConfigNormalizer({
+  name: "media",
+  normalize: normalizeMediaConfig
+});
+
+export {
+  normalizeMediaConfig,
+  defineMediaConfig
+};

package/dist/index.d.ts

@@ -1,6 +1,7 @@
 import * as _holo_js_db from '@holo-js/db';
 import { Entity, TableDefinition, ModelRecord, RelationMap, DynamicRelationResolver, ModelQueryBuilder, ModelRelationPath, RelationConstraintDefinition, RelatedColumnNameForRelationPath, ModelCollection, EntityWithLoaded, PaginatedResult, SimplePaginatedResult, CursorPaginatedResult, ResolveEagerLoads } from '@holo-js/db';
 import { StorageContent } from '@holo-js/storage/runtime';
+export { HoloMediaConfig, defineMediaConfig, normalizeMediaConfig } from './projectConfig.js';
 import { QueueJobDefinition, QueueJsonValue } from '@holo-js/queue';
 
 interface MediaCollectionDefinition<TName extends string = string> {

package/dist/index.mjs

@@ -1,3 +1,8 @@
+import {
+  defineMediaConfig,
+  normalizeMediaConfig
+} from "./chunk-VIEJQKMM.mjs";
+
 // src/model/entity.ts
 import { Entity as Entity2 } from "@holo-js/db";
 
@@ -370,11 +375,15 @@ var Media = defineModel(mediaTable, {
 });
 
 // src/model/adder.ts
-import { isIP } from "net";
+import { randomUUID } from "crypto";
+import { lookup } from "dns/promises";
+import { readFile, realpath } from "fs/promises";
+import { request as requestHttp } from "http";
+import { request as requestHttps } from "https";
+import { BlockList, isIP } from "net";
 import { tmpdir } from "os";
 import { basename as basename2, resolve, sep } from "path";
-import { readFile, realpath } from "fs/promises";
-import { randomUUID } from "crypto";
+import { Readable } from "stream";
 import { Storage as Storage3 } from "@holo-js/storage/runtime";
 import { connectionAsyncContext as connectionAsyncContext4 } from "@holo-js/db";
 
@@ -895,10 +904,23 @@ var MediaItem = class {
 
 // src/model/adder.ts
 var DEFAULT_REMOTE_MEDIA_MAX_SIZE = 10 * 1024 * 1024;
+var BLOCKED_REMOTE_MEDIA_ADDRESSES = createBlockedRemoteMediaAddresses();
 var LOCAL_MEDIA_SOURCE_ROOTS = Object.freeze([
   tmpdir(),
   resolve(process.cwd(), "storage")
 ]);
+var defaultRemoteMediaAddressResolver = async (hostname) => await lookup(hostname, {
+  all: true,
+  verbatim: true
+});
+function createRemoteMediaDownloader(resolver, requester) {
+  return async (url) => {
+    const address = await resolveRemoteMediaAddress(url, resolver);
+    return await requester(url, address);
+  };
+}
+var defaultRemoteMediaDownloader = createRemoteMediaDownloader(defaultRemoteMediaAddressResolver, requestRemoteMedia);
+var remoteMediaDownloader = defaultRemoteMediaDownloader;
 var MediaAddValidationException = class extends Error {
   error;
   constructor(details) {
@@ -923,17 +945,10 @@ function resolveImplicitDiskName() {
   return defaultDisk.name;
 }
 function parseRemoteFileName(url) {
-  try {
-    const parsedUrl = new URL(url);
-    return basename2(parsedUrl.pathname) || "media.bin";
-  } catch {
-    return "media.bin";
-  }
+  const parsedUrl = new URL(url);
+  return basename2(parsedUrl.pathname) || "media.bin";
 }
 function formatBytes(bytes) {
-  if (!Number.isFinite(bytes) || bytes < 0) {
-    return "0 bytes";
-  }
   const units = ["bytes", "KB", "MB", "GB"];
   let value = bytes;
   let unitIndex = 0;
@@ -974,7 +989,7 @@ async function readRemoteMediaContents(response, fileName, maxSize, collectionNa
   if (!response.body) {
     const contents2 = new Uint8Array(await response.arrayBuffer());
     if (contents2.byteLength > resolvedMaxSize) {
-      throw createMaxSizeError(fileName, collectionName ?? "default", resolvedMaxSize, contents2.byteLength);
+      throw createMaxSizeError(fileName, collectionName, resolvedMaxSize, contents2.byteLength);
     }
     return contents2;
   }
@@ -993,7 +1008,7 @@ async function readRemoteMediaContents(response, fileName, maxSize, collectionNa
       totalSize += value.byteLength;
       if (totalSize > resolvedMaxSize) {
         await reader.cancel().catch(() => void 0);
-        throw createMaxSizeError(fileName, collectionName ?? "default", resolvedMaxSize, totalSize);
+        throw createMaxSizeError(fileName, collectionName, resolvedMaxSize, totalSize);
       }
       chunks.push(value);
     }
@@ -1014,8 +1029,8 @@ async function resolveMediaSource(input, overrideFileName, overrideName, options
       { url: input },
       overrideFileName,
       overrideName,
-      options?.maxSize,
-      options?.collectionName
+      options.maxSize,
+      options.collectionName
     );
   }
   if (typeof input !== "string" && isUrlInput(input)) {
@@ -1023,8 +1038,8 @@ async function resolveMediaSource(input, overrideFileName, overrideName, options
       input,
       overrideFileName,
       overrideName,
-      options?.maxSize,
-      options?.collectionName
+      options.maxSize,
+      options.collectionName
     );
   }
   if (typeof input === "string" || isPathInput(input)) {
@@ -1079,26 +1094,24 @@ function isUrlInput(input) {
 }
 async function resolveRemoteMediaSource(input, overrideFileName, overrideName, maxSize, collectionName) {
   const remoteUrl = resolveRemoteMediaUrl(input.url);
-  const response = await fetch(remoteUrl, {
-    redirect: "manual"
-  });
+  const response = await remoteMediaDownloader(remoteUrl);
   if (response.status >= 300 && response.status < 400) {
     throw new Error("[@holo-js/media] Remote media downloads do not follow redirects.");
   }
   if (!response.ok) {
     throw new Error(
-      `[Holo Media] Failed to download media from "${remoteUrl}" (${response.status} ${response.statusText}).`
+      `[Holo Media] Failed to download media from "${remoteUrl.toString()}" (${response.status} ${response.statusText}).`
     );
   }
   const fileName = sanitizeFileName(
-    overrideFileName ?? input.fileName ?? parseRemoteFileName(remoteUrl)
+    overrideFileName ?? input.fileName ?? parseRemoteFileName(remoteUrl.toString())
   );
   const responseMimeType = response.headers.get("content-type")?.split(";")[0];
   const contentLengthHeader = response.headers.get("content-length");
   const contentLength = contentLengthHeader?.trim() ? Number(contentLengthHeader) : Number.NaN;
   const resolvedMaxSize = typeof maxSize === "number" ? maxSize : DEFAULT_REMOTE_MEDIA_MAX_SIZE;
   if (Number.isFinite(contentLength) && contentLength > resolvedMaxSize) {
-    throw createMaxSizeError(fileName, collectionName ?? "default", resolvedMaxSize, contentLength);
+    throw createMaxSizeError(fileName, collectionName, resolvedMaxSize, contentLength);
   }
   const contents = await readRemoteMediaContents(
     response,
@@ -1142,22 +1155,91 @@ function resolveRemoteMediaUrl(value) {
   if (isBlockedRemoteMediaHost(url.hostname)) {
     throw new Error("[@holo-js/media] Remote media URLs must not target local or private hosts.");
   }
-  return url.toString();
+  return url;
+}
+function createBlockedRemoteMediaAddresses() {
+  const blockList = new BlockList();
+  for (const [network, prefix] of [
+    ["0.0.0.0", 8],
+    ["10.0.0.0", 8],
+    ["100.64.0.0", 10],
+    ["127.0.0.0", 8],
+    ["169.254.0.0", 16],
+    ["172.16.0.0", 12],
+    ["192.0.0.0", 24],
+    ["192.0.2.0", 24],
+    ["192.168.0.0", 16],
+    ["198.18.0.0", 15],
+    ["198.51.100.0", 24],
+    ["203.0.113.0", 24],
+    ["224.0.0.0", 4]
+  ]) {
+    blockList.addSubnet(network, prefix, "ipv4");
+  }
+  for (const [network, prefix] of [
+    ["::", 128],
+    ["::1", 128],
+    ["fc00::", 7],
+    ["fe80::", 10],
+    ["ff00::", 8]
+  ]) {
+    blockList.addSubnet(network, prefix, "ipv6");
+  }
+  return blockList;
+}
+function isBlockedRemoteMediaAddress(address) {
+  return BLOCKED_REMOTE_MEDIA_ADDRESSES.check(address.address, address.family === 4 ? "ipv4" : "ipv6");
+}
+async function resolveRemoteMediaAddress(url, resolver) {
+  const addresses = await resolver(url.hostname);
+  if (addresses.length === 0 || addresses.some(isBlockedRemoteMediaAddress)) {
+    throw new Error("[@holo-js/media] Remote media URLs must not resolve to local or private hosts.");
+  }
+  return addresses[0];
+}
+function requestRemoteMedia(url, address) {
+  return new Promise((resolveResponse, reject) => {
+    const request = resolveRemoteMediaRequest(url.protocol)(url, {
+      headers: {
+        host: url.host
+      },
+      lookup: createPinnedRemoteMediaLookup(address)
+    }, (response) => {
+      const headers = new Headers();
+      appendRemoteMediaHeaders(headers, response.headers);
+      resolveResponse(new Response(Readable.toWeb(response), {
+        status: response.statusCode,
+        statusText: response.statusMessage,
+        headers
+      }));
+    });
+    request.on("error", reject);
+    request.end();
+  });
+}
+function createPinnedRemoteMediaLookup(address) {
+  return (_hostname, options, callback) => options.all ? callback(null, [address]) : callback(null, address.address, address.family);
+}
+function appendRemoteMediaHeaders(headers, source) {
+  for (const [name, value] of Object.entries(source)) {
+    if (Array.isArray(value)) {
+      for (const entry of value) headers.append(name, entry);
+    } else if (typeof value === "string") {
+      headers.set(name, value);
+    }
+  }
+}
+function resolveRemoteMediaRequest(protocol) {
+  return protocol === "https:" ? requestHttps : requestHttp;
 }
 function isBlockedRemoteMediaHost(hostname) {
-  const normalized = hostname.toLowerCase();
+  const lowerCaseHostname = hostname.toLowerCase();
+  const normalized = lowerCaseHostname.startsWith("[") && lowerCaseHostname.endsWith("]") ? lowerCaseHostname.slice(1, -1) : lowerCaseHostname;
   if (normalized === "localhost" || normalized.endsWith(".localhost")) {
     return true;
   }
-  const ipVersion = isIP(normalized);
-  if (ipVersion === 4) {
-    const [first = 0, second = 0] = normalized.split(".").map(Number);
-    return first === 0 || first === 10 || first === 127 || first === 169 && second === 254 || first === 172 && second >= 16 && second <= 31 || first === 192 && second === 168 || first >= 224;
-  }
-  if (ipVersion === 6) {
-    return normalized === "::1" || normalized === "::" || normalized.startsWith("fc") || normalized.startsWith("fd") || normalized.startsWith("fe80:");
-  }
-  return false;
+  const family = isIP(normalized);
+  return family !== 0 && isBlockedRemoteMediaAddress({ address: normalized, family });
 }
 function validateSource(collection2, source) {
   if (typeof collection2.maxSize === "number" && source.size > collection2.maxSize) {
@@ -1754,6 +1836,7 @@ export {
   conversion,
   createDefaultMediaConversionExecutor,
   defaultMediaConversionExecutor,
+  defineMediaConfig,
   defineMediaModel,
   dispatchQueuedMediaConversions,
   ensureMediaQueueJobRegistered,
@@ -1763,6 +1846,7 @@ export {
   getMediaPathGenerator,
   normalizeCollectionDefinitions,
   normalizeConversionDefinitions,
+  normalizeMediaConfig,
   normalizeMediaDefinition,
   registerMediaDefinition,
   requireMediaDefinition,

package/dist/projectConfig.d.ts

@@ -0,0 +1,12 @@
+interface HoloMediaConfig {
+    readonly [key: string]: unknown;
+}
+declare module '@holo-js/config' {
+    interface HoloConfigRegistry {
+        media: Readonly<HoloMediaConfig>;
+    }
+}
+declare function normalizeMediaConfig(config?: HoloMediaConfig): Readonly<HoloMediaConfig>;
+declare function defineMediaConfig<TConfig extends HoloMediaConfig>(config: TConfig): Readonly<TConfig>;
+
+export { type HoloMediaConfig, defineMediaConfig, normalizeMediaConfig };

package/dist/projectConfig.mjs

@@ -0,0 +1,8 @@
+import {
+  defineMediaConfig,
+  normalizeMediaConfig
+} from "./chunk-VIEJQKMM.mjs";
+export {
+  defineMediaConfig,
+  normalizeMediaConfig
+};

package/package.json

@@ -1,13 +1,19 @@
 {
   "name": "@holo-js/media",
-  "version": "0.2.5",
+  "version": "0.3.0",
   "description": "Holo-JS Framework - media collections and conversions for Holo-JS models",
   "type": "module",
   "license": "MIT",
   "exports": {
     ".": {
       "types": "./dist/index.d.ts",
-      "import": "./dist/index.mjs"
+      "import": "./dist/index.mjs",
+      "default": "./dist/index.mjs"
+    },
+    "./config": {
+      "types": "./dist/projectConfig.d.ts",
+      "import": "./dist/projectConfig.mjs",
+      "default": "./dist/projectConfig.mjs"
     }
   },
   "main": "./dist/index.mjs",
@@ -22,12 +28,14 @@
     "test": "vitest --run"
   },
   "dependencies": {
-    "@holo-js/db": "^0.2.5",
-    "@holo-js/queue": "^0.2.5",
-    "@holo-js/storage": "^0.2.5",
+    "@holo-js/config": "^0.3.0",
+    "@holo-js/db": "^0.3.0",
+    "@holo-js/queue": "^0.3.0",
+    "@holo-js/storage": "^0.3.0",
     "sharp": "^0.34.4"
   },
   "devDependencies": {
+    "@holo-js/db-sqlite": "^0.3.0",
     "tsup": "^8.3.5",
     "typescript": "^5.7.2",
     "vitest": "^4.1.5"