@kywi-software/core 0.1.0

package/dist/media/__tests__/upload-allowlist.test.js

@@ -0,0 +1,72 @@
+import { describe, it, expect } from 'vitest';
+import { checkUploadAllowed, fileExtension, normalizeMimeType } from '../upload-allowlist.js';
+const base = { provider: 'local' };
+describe('fileExtension', () => {
+    it('extracts a lowercase extension', () => {
+        expect(fileExtension('Photo.JPG')).toBe('jpg');
+        expect(fileExtension('archive.tar.gz')).toBe('gz');
+    });
+    it('returns "" when there is no usable extension', () => {
+        expect(fileExtension('noext')).toBe('');
+        expect(fileExtension('.hidden')).toBe('');
+        expect(fileExtension('trailingdot.')).toBe('');
+    });
+});
+describe('normalizeMimeType', () => {
+    it('strips parameters and lowercases', () => {
+        expect(normalizeMimeType('IMAGE/PNG; charset=utf-8')).toBe('image/png');
+        expect(normalizeMimeType('application/pdf')).toBe('application/pdf');
+    });
+});
+describe('checkUploadAllowed (defaults)', () => {
+    it('allows a normal image', () => {
+        expect(checkUploadAllowed('photo.png', 'image/png', base)).toEqual({ ok: true });
+    });
+    it('allows a PDF', () => {
+        expect(checkUploadAllowed('report.pdf', 'application/pdf', base)).toEqual({ ok: true });
+    });
+    it('allows common docs and video', () => {
+        expect(checkUploadAllowed('sheet.xlsx', 'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet', base).ok).toBe(true);
+        expect(checkUploadAllowed('clip.mp4', 'video/mp4', base).ok).toBe(true);
+    });
+    it('rejects an executable extension regardless of MIME', () => {
+        expect(checkUploadAllowed('malware.exe', 'application/octet-stream', base).ok).toBe(false);
+        // Even if the MIME is spoofed to a benign image type, the extension gate catches it.
+        expect(checkUploadAllowed('malware.exe', 'image/png', base).ok).toBe(false);
+    });
+    it('rejects a shell script and a php file', () => {
+        expect(checkUploadAllowed('run.sh', 'text/x-shellscript', base).ok).toBe(false);
+        expect(checkUploadAllowed('shell.php', 'application/x-php', base).ok).toBe(false);
+    });
+    it('rejects a SPOOFED extension: benign .jpg name but executable MIME', () => {
+        const res = checkUploadAllowed('totally-a-photo.jpg', 'application/x-msdownload', base);
+        expect(res.ok).toBe(false);
+        if (!res.ok)
+            expect(res.reason).toMatch(/type .* is not allowed/i);
+    });
+    it('defers to the extension when MIME is generic octet-stream', () => {
+        // A legit file whose browser could not type it still uploads on its extension.
+        expect(checkUploadAllowed('photo.png', 'application/octet-stream', base)).toEqual({ ok: true });
+        // ...but a generic MIME cannot rescue a disallowed extension.
+        expect(checkUploadAllowed('script.bat', 'application/octet-stream', base).ok).toBe(false);
+    });
+    it('rejects a file with no extension', () => {
+        expect(checkUploadAllowed('noextension', 'image/png', base).ok).toBe(false);
+    });
+    it('rejects an unknown extension', () => {
+        expect(checkUploadAllowed('data.xyz', 'application/octet-stream', base).ok).toBe(false);
+    });
+});
+describe('checkUploadAllowed (config override)', () => {
+    const restrictive = {
+        provider: 'local',
+        allowedExtensions: ['png'],
+        allowedMimeTypes: ['image/png'],
+    };
+    it('honors a custom allowlist', () => {
+        expect(checkUploadAllowed('a.png', 'image/png', restrictive).ok).toBe(true);
+        expect(checkUploadAllowed('a.pdf', 'application/pdf', restrictive).ok).toBe(false); // pdf not in custom list
+        expect(checkUploadAllowed('a.png', 'image/gif', restrictive).ok).toBe(false); // gif mime not in custom list
+    });
+});
+//# sourceMappingURL=upload-allowlist.test.js.map

package/dist/media/__tests__/upload-allowlist.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"upload-allowlist.test.js","sourceRoot":"","sources":["../../../src/media/__tests__/upload-allowlist.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAC7C,OAAO,EAAE,kBAAkB,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAA;AAG7F,MAAM,IAAI,GAAgB,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAA;AAE/C,QAAQ,CAAC,eAAe,EAAE,GAAG,EAAE;IAC7B,EAAE,CAAC,gCAAgC,EAAE,GAAG,EAAE;QACxC,MAAM,CAAC,aAAa,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QAC9C,MAAM,CAAC,aAAa,CAAC,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACpD,CAAC,CAAC,CAAA;IACF,EAAE,CAAC,8CAA8C,EAAE,GAAG,EAAE;QACtD,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;QACvC,MAAM,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;QACzC,MAAM,CAAC,aAAa,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IAChD,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,mBAAmB,EAAE,GAAG,EAAE;IACjC,EAAE,CAAC,kCAAkC,EAAE,GAAG,EAAE;QAC1C,MAAM,CAAC,iBAAiB,CAAC,0BAA0B,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;QACvE,MAAM,CAAC,iBAAiB,CAAC,iBAAiB,CAAC,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAA;IACtE,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,+BAA+B,EAAE,GAAG,EAAE;IAC7C,EAAE,CAAC,uBAAuB,EAAE,GAAG,EAAE;QAC/B,MAAM,CAAC,kBAAkB,CAAC,WAAW,EAAE,WAAW,EAAE,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAA;IAClF,CAAC,CAAC,CAAA;IACF,EAAE,CAAC,cAAc,EAAE,GAAG,EAAE;QACtB,MAAM,CAAC,kBAAkB,CAAC,YAAY,EAAE,iBAAiB,EAAE,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAA;IACzF,CAAC,CAAC,CAAA;IACF,EAAE,CAAC,8BAA8B,EAAE,GAAG,EAAE;QACtC,MAAM,CAAC,kBAAkB,CAAC,YAAY,EAAE,mEAAmE,EAAE,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACjI,MAAM,CAAC,kBAAkB,CAAC,UAAU,EAAE,WAAW,EAAE,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACzE,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,oDAAoD,EAAE,GAAG,EAAE;QAC5D,MAAM,CAAC,kBAAkB,CAAC,aAAa,EAAE,0BAA0B,EAAE,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QAC1F,qFAAqF;QACrF,MAAM,CAAC,kBAAkB,CAAC,aAAa,EAAE,WAAW,EAAE,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAC7E,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,uCAAuC,EAAE,GAAG,EAAE;QAC/C,MAAM,CAAC,kBAAkB,CAAC,QAAQ,EAAE,oBAAoB,EAAE,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QAC/E,MAAM,CAAC,kBAAkB,CAAC,WAAW,EAAE,mBAAmB,EAAE,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IACnF,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,mEAAmE,EAAE,GAAG,EAAE;QAC3E,MAAM,GAAG,GAAG,kBAAkB,CAAC,qBAAqB,EAAE,0BAA0B,EAAE,IAAI,CAAC,CAAA;QACvF,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QAC1B,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,yBAAyB,CAAC,CAAA;IACpE,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,2DAA2D,EAAE,GAAG,EAAE;QACnE,+EAA+E;QAC/E,MAAM,CAAC,kBAAkB,CAAC,WAAW,EAAE,0BAA0B,EAAE,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAA;QAC/F,8DAA8D;QAC9D,MAAM,CAAC,kBAAkB,CAAC,YAAY,EAAE,0BAA0B,EAAE,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAC3F,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,kCAAkC,EAAE,GAAG,EAAE;QAC1C,MAAM,CAAC,kBAAkB,CAAC,aAAa,EAAE,WAAW,EAAE,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAC7E,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,8BAA8B,EAAE,GAAG,EAAE;QACtC,MAAM,CAAC,kBAAkB,CAAC,UAAU,EAAE,0BAA0B,EAAE,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IACzF,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,sCAAsC,EAAE,GAAG,EAAE;IACpD,MAAM,WAAW,GAAgB;QAC/B,QAAQ,EAAE,OAAO;QACjB,iBAAiB,EAAE,CAAC,KAAK,CAAC;QAC1B,gBAAgB,EAAE,CAAC,WAAW,CAAC;KAChC,CAAA;IACD,EAAE,CAAC,2BAA2B,EAAE,GAAG,EAAE;QACnC,MAAM,CAAC,kBAAkB,CAAC,OAAO,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAC3E,MAAM,CAAC,kBAAkB,CAAC,OAAO,EAAE,iBAAiB,EAAE,WAAW,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA,CAAC,yBAAyB;QAC5G,MAAM,CAAC,kBAAkB,CAAC,OAAO,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA,CAAO,8BAA8B;IACnH,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}

package/dist/media/image-manipulation.d.ts

@@ -0,0 +1,14 @@
+export interface ImageManipulationOptions {
+    width?: number;
+    height?: number;
+    fit?: 'cover' | 'contain' | 'fill';
+    quality?: number;
+    format?: 'jpeg' | 'png' | 'webp' | 'avif';
+    blur?: number;
+    grayscale?: boolean;
+    rotate?: number;
+    flip?: boolean;
+    flop?: boolean;
+}
+export declare function manipulateImage(input: Buffer, opts: ImageManipulationOptions): Promise<Buffer>;
+//# sourceMappingURL=image-manipulation.d.ts.map

package/dist/media/image-manipulation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"image-manipulation.d.ts","sourceRoot":"","sources":["../../src/media/image-manipulation.ts"],"names":[],"mappings":"AAeA,MAAM,WAAW,wBAAwB;IACvC,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,GAAG,CAAC,EAAE,OAAO,GAAG,SAAS,GAAG,MAAM,CAAA;IAClC,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,MAAM,CAAC,EAAE,MAAM,GAAG,KAAK,GAAG,MAAM,GAAG,MAAM,CAAA;IACzC,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,SAAS,CAAC,EAAE,OAAO,CAAA;IACnB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,IAAI,CAAC,EAAE,OAAO,CAAA;IACd,IAAI,CAAC,EAAE,OAAO,CAAA;CACf;AAID,wBAAsB,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,wBAAwB,GAAG,OAAO,CAAC,MAAM,CAAC,CAkBpG"}

package/dist/media/image-manipulation.js

@@ -0,0 +1,33 @@
+// Lazy-load sharp so webpack doesn't attempt to bundle the native module.
+// webpackIgnore tells webpack to skip static analysis of this import.
+async function getSharp() {
+    // sharp is a CommonJS module (`export = sharp`); Node's ESM interop exposes
+    // its callable export as the dynamic-import namespace's `default`. Under
+    // esModuleInterop:false TypeScript doesn't synthesise that `default`, so we
+    // reach it through a typed view of the interop namespace.
+    const mod = (await import(/* webpackIgnore: true */ 'sharp'));
+    return mod.default;
+}
+// ─── manipulateImage ──────────────────────────────────────────────────────────
+export async function manipulateImage(input, opts) {
+    const sharp = await getSharp();
+    let pipeline = sharp(input);
+    if (opts.width || opts.height) {
+        pipeline = pipeline.resize(opts.width, opts.height, { fit: opts.fit ?? 'cover' });
+    }
+    if (opts.rotate)
+        pipeline = pipeline.rotate(opts.rotate);
+    if (opts.flip)
+        pipeline = pipeline.flip();
+    if (opts.flop)
+        pipeline = pipeline.flop();
+    if (opts.blur && opts.blur > 0)
+        pipeline = pipeline.blur(opts.blur);
+    if (opts.grayscale)
+        pipeline = pipeline.grayscale();
+    const format = opts.format ?? 'jpeg';
+    const quality = opts.quality ?? 80;
+    pipeline = pipeline[format]({ quality });
+    return pipeline.toBuffer();
+}
+//# sourceMappingURL=image-manipulation.js.map

package/dist/media/image-manipulation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"image-manipulation.js","sourceRoot":"","sources":["../../src/media/image-manipulation.ts"],"names":[],"mappings":"AAAA,0EAA0E;AAC1E,sEAAsE;AACtE,KAAK,UAAU,QAAQ;IACrB,4EAA4E;IAC5E,yEAAyE;IACzE,4EAA4E;IAC5E,0DAA0D;IAC1D,MAAM,GAAG,GAAG,CAAC,MAAM,MAAM,CAAC,yBAAyB,CAAC,OAAO,CAAC,CAE3D,CAAA;IACD,OAAO,GAAG,CAAC,OAAO,CAAA;AACpB,CAAC;AAiBD,iFAAiF;AAEjF,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,KAAa,EAAE,IAA8B;IACjF,MAAM,KAAK,GAAG,MAAM,QAAQ,EAAE,CAAA;IAC9B,IAAI,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,CAAA;IAE3B,IAAI,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAC9B,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,IAAI,OAAO,EAAE,CAAC,CAAA;IACnF,CAAC;IACD,IAAI,IAAI,CAAC,MAAM;QAAE,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;IACxD,IAAI,IAAI,CAAC,IAAI;QAAE,QAAQ,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAA;IACzC,IAAI,IAAI,CAAC,IAAI;QAAE,QAAQ,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAA;IACzC,IAAI,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,GAAG,CAAC;QAAE,QAAQ,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACnE,IAAI,IAAI,CAAC,SAAS;QAAE,QAAQ,GAAG,QAAQ,CAAC,SAAS,EAAE,CAAA;IAEnD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,MAAM,CAAA;IACpC,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,EAAE,CAAA;IAClC,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAA;IAExC,OAAO,QAAQ,CAAC,QAAQ,EAAE,CAAA;AAC5B,CAAC"}

package/dist/media/image-processor.d.ts

@@ -0,0 +1,8 @@
+import type { ImageSizeConfig } from './types.js';
+export declare function isImage(mimeType: string): boolean;
+export declare function processImageVariants(source: Buffer, sizes: Record<string, ImageSizeConfig> | undefined): Promise<Record<string, Buffer>>;
+export declare function getImageMetadata(buffer: Buffer): Promise<{
+    width: number;
+    height: number;
+} | null>;
+//# sourceMappingURL=image-processor.d.ts.map

package/dist/media/image-processor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"image-processor.d.ts","sourceRoot":"","sources":["../../src/media/image-processor.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAejD,wBAAgB,OAAO,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAEjD;AAED,wBAAsB,oBAAoB,CACxC,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,GAAG,SAAS,GACjD,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAajC;AAED,wBAAsB,gBAAgB,CACpC,MAAM,EAAE,MAAM,GACb,OAAO,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAAC,CAOnD"}

package/dist/media/image-processor.js

@@ -0,0 +1,41 @@
+// Lazy-load sharp so webpack doesn't attempt to bundle the native module.
+// webpackIgnore tells webpack to skip static analysis of this import.
+async function getSharp() {
+    // sharp is a CommonJS module (`export = sharp`); Node's ESM interop exposes
+    // its callable export as the dynamic-import namespace's `default`. Under
+    // esModuleInterop:false TypeScript doesn't synthesise that `default`, so we
+    // reach it through a typed view of the interop namespace.
+    const mod = (await import(/* webpackIgnore: true */ 'sharp'));
+    return mod.default;
+}
+export function isImage(mimeType) {
+    return mimeType.startsWith('image/');
+}
+export async function processImageVariants(source, sizes) {
+    if (!sizes || Object.keys(sizes).length === 0)
+        return {};
+    const sharp = await getSharp();
+    const variants = {};
+    for (const [name, config] of Object.entries(sizes)) {
+        variants[name] = await sharp(source).resize({
+            width: config.width,
+            height: config.height,
+            fit: config.fit ?? 'cover',
+            withoutEnlargement: true,
+        }).toBuffer();
+    }
+    return variants;
+}
+export async function getImageMetadata(buffer) {
+    try {
+        const sharp = await getSharp();
+        const meta = await sharp(buffer).metadata();
+        if (meta.width && meta.height)
+            return { width: meta.width, height: meta.height };
+        return null;
+    }
+    catch {
+        return null;
+    }
+}
+//# sourceMappingURL=image-processor.js.map

package/dist/media/image-processor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"image-processor.js","sourceRoot":"","sources":["../../src/media/image-processor.ts"],"names":[],"mappings":"AAEA,0EAA0E;AAC1E,sEAAsE;AACtE,KAAK,UAAU,QAAQ;IACrB,4EAA4E;IAC5E,yEAAyE;IACzE,4EAA4E;IAC5E,0DAA0D;IAC1D,MAAM,GAAG,GAAG,CAAC,MAAM,MAAM,CAAC,yBAAyB,CAAC,OAAO,CAAC,CAE3D,CAAA;IACD,OAAO,GAAG,CAAC,OAAO,CAAA;AACpB,CAAC;AAED,MAAM,UAAU,OAAO,CAAC,QAAgB;IACtC,OAAO,QAAQ,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAA;AACtC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,MAAc,EACd,KAAkD;IAElD,IAAI,CAAC,KAAK,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAA;IACxD,MAAM,KAAK,GAAG,MAAM,QAAQ,EAAE,CAAA;IAC9B,MAAM,QAAQ,GAA2B,EAAE,CAAA;IAC3C,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACnD,QAAQ,CAAC,IAAI,CAAC,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC;YAC1C,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,GAAG,EAAE,MAAM,CAAC,GAAG,IAAI,OAAO;YAC1B,kBAAkB,EAAE,IAAI;SACzB,CAAC,CAAC,QAAQ,EAAE,CAAA;IACf,CAAC;IACD,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,MAAc;IAEd,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,QAAQ,EAAE,CAAA;QAC9B,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAA;QAC3C,IAAI,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,MAAM;YAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAA;QAChF,OAAO,IAAI,CAAA;IACb,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,IAAI,CAAA;IAAC,CAAC;AACzB,CAAC"}

package/dist/media/index.d.ts

@@ -0,0 +1,8 @@
+export * from './types.js';
+export * from './image-manipulation.js';
+export { createLocalStorage } from './local-storage.js';
+export { createS3Storage } from './s3-storage.js';
+export { checkUploadAllowed, fileExtension, normalizeMimeType, DEFAULT_ALLOWED_EXTENSIONS, DEFAULT_ALLOWED_MIME_TYPES, type UploadAllowResult, } from './upload-allowlist.js';
+import type { MediaConfig, StorageProvider } from './types.js';
+export declare function createStorageProvider(config: MediaConfig): StorageProvider;
+//# sourceMappingURL=index.d.ts.map

package/dist/media/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/media/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAA;AAC1B,cAAc,yBAAyB,CAAA;AACvC,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAA;AACvD,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAA;AACjD,OAAO,EACL,kBAAkB,EAClB,aAAa,EACb,iBAAiB,EACjB,0BAA0B,EAC1B,0BAA0B,EAC1B,KAAK,iBAAiB,GACvB,MAAM,uBAAuB,CAAA;AAE9B,OAAO,KAAK,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAI9D,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,WAAW,GAAG,eAAe,CAK1E"}

package/dist/media/index.js

@@ -0,0 +1,14 @@
+export * from './types.js';
+export * from './image-manipulation.js';
+export { createLocalStorage } from './local-storage.js';
+export { createS3Storage } from './s3-storage.js';
+export { checkUploadAllowed, fileExtension, normalizeMimeType, DEFAULT_ALLOWED_EXTENSIONS, DEFAULT_ALLOWED_MIME_TYPES, } from './upload-allowlist.js';
+import { createLocalStorage } from './local-storage.js';
+import { createS3Storage } from './s3-storage.js';
+export function createStorageProvider(config) {
+    if (config.provider === 's3' && config.s3) {
+        return createS3Storage(config.s3);
+    }
+    return createLocalStorage(config.localPath ?? './uploads');
+}
+//# sourceMappingURL=index.js.map

package/dist/media/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/media/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAA;AAC1B,cAAc,yBAAyB,CAAA;AACvC,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAA;AACvD,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAA;AACjD,OAAO,EACL,kBAAkB,EAClB,aAAa,EACb,iBAAiB,EACjB,0BAA0B,EAC1B,0BAA0B,GAE3B,MAAM,uBAAuB,CAAA;AAG9B,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAA;AACvD,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAA;AAEjD,MAAM,UAAU,qBAAqB,CAAC,MAAmB;IACvD,IAAI,MAAM,CAAC,QAAQ,KAAK,IAAI,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;QAC1C,OAAO,eAAe,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;IACnC,CAAC;IACD,OAAO,kBAAkB,CAAC,MAAM,CAAC,SAAS,IAAI,WAAW,CAAC,CAAA;AAC5D,CAAC"}

package/dist/media/local-storage.d.ts

@@ -0,0 +1,3 @@
+import type { StorageProvider } from './types.js';
+export declare function createLocalStorage(basePath: string): StorageProvider;
+//# sourceMappingURL=local-storage.d.ts.map

package/dist/media/local-storage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"local-storage.d.ts","sourceRoot":"","sources":["../../src/media/local-storage.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAEjD,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,eAAe,CAiBpE"}

package/dist/media/local-storage.js

@@ -0,0 +1,30 @@
+import { mkdir, readFile, writeFile, unlink, access } from 'node:fs/promises';
+import { join, dirname } from 'node:path';
+export function createLocalStorage(basePath) {
+    return {
+        async write(key, data) {
+            const filePath = join(basePath, key);
+            await mkdir(dirname(filePath), { recursive: true });
+            await writeFile(filePath, data);
+        },
+        async read(key) {
+            return readFile(join(basePath, key));
+        },
+        async delete(key) {
+            try {
+                await unlink(join(basePath, key));
+            }
+            catch { }
+        },
+        async exists(key) {
+            try {
+                await access(join(basePath, key));
+                return true;
+            }
+            catch {
+                return false;
+            }
+        },
+    };
+}
+//# sourceMappingURL=local-storage.js.map

package/dist/media/local-storage.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"local-storage.js","sourceRoot":"","sources":["../../src/media/local-storage.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAA;AAC7E,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AAGzC,MAAM,UAAU,kBAAkB,CAAC,QAAgB;IACjD,OAAO;QACL,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI;YACnB,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAA;YACpC,MAAM,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;YACnD,MAAM,SAAS,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAA;QACjC,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,GAAG;YACZ,OAAO,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAA;QACtC,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,GAAG;YACd,IAAI,CAAC;gBAAC,MAAM,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAA;YAAC,CAAC;YAAC,MAAM,CAAC,CAAA,CAAC;QACpD,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,GAAG;YACd,IAAI,CAAC;gBAAC,MAAM,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC;gBAAC,OAAO,IAAI,CAAA;YAAC,CAAC;YAAC,MAAM,CAAC;gBAAC,OAAO,KAAK,CAAA;YAAC,CAAC;QAC/E,CAAC;KACF,CAAA;AACH,CAAC"}

package/dist/media/s3-storage.d.ts

@@ -0,0 +1,3 @@
+import type { StorageProvider, S3Config } from './types.js';
+export declare function createS3Storage(config: S3Config): StorageProvider;
+//# sourceMappingURL=s3-storage.d.ts.map

package/dist/media/s3-storage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"s3-storage.d.ts","sourceRoot":"","sources":["../../src/media/s3-storage.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAA;AAE3D,wBAAgB,eAAe,CAAC,MAAM,EAAE,QAAQ,GAAG,eAAe,CAgDjE"}

package/dist/media/s3-storage.js

@@ -0,0 +1,52 @@
+import { S3Client, PutObjectCommand, GetObjectCommand, DeleteObjectCommand, HeadObjectCommand } from '@aws-sdk/client-s3';
+export function createS3Storage(config) {
+    const client = new S3Client({
+        region: config.region,
+        ...(config.accessKeyId && config.secretAccessKey ? {
+            credentials: { accessKeyId: config.accessKeyId, secretAccessKey: config.secretAccessKey },
+        } : {}),
+        ...(config.endpoint ? { endpoint: config.endpoint } : {}),
+    });
+    return {
+        async write(key, data) {
+            await client.send(new PutObjectCommand({ Bucket: config.bucket, Key: key, Body: data }));
+        },
+        async read(key) {
+            const res = await client.send(new GetObjectCommand({ Bucket: config.bucket, Key: key }));
+            const stream = res.Body;
+            const chunks = [];
+            const reader = stream.getReader();
+            while (true) {
+                const { done, value } = await reader.read();
+                if (done)
+                    break;
+                chunks.push(value);
+            }
+            return Buffer.concat(chunks);
+        },
+        async delete(key) {
+            await client.send(new DeleteObjectCommand({ Bucket: config.bucket, Key: key }));
+        },
+        async exists(key) {
+            try {
+                await client.send(new HeadObjectCommand({ Bucket: config.bucket, Key: key }));
+                return true;
+            }
+            catch {
+                return false;
+            }
+        },
+        getPublicUrl(key) {
+            if (config.publicUrl) {
+                const base = config.publicUrl.replace(/\/+$/, '');
+                return `${base}/${key}`;
+            }
+            if (config.endpoint) {
+                const base = config.endpoint.replace(/\/+$/, '');
+                return `${base}/${config.bucket}/${key}`;
+            }
+            return `https://${config.bucket}.s3.${config.region}.amazonaws.com/${key}`;
+        },
+    };
+}
+//# sourceMappingURL=s3-storage.js.map

package/dist/media/s3-storage.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"s3-storage.js","sourceRoot":"","sources":["../../src/media/s3-storage.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAA;AAGzH,MAAM,UAAU,eAAe,CAAC,MAAgB;IAC9C,MAAM,MAAM,GAAG,IAAI,QAAQ,CAAC;QAC1B,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,GAAG,CAAC,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC;YACjD,WAAW,EAAE,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,eAAe,EAAE,MAAM,CAAC,eAAe,EAAE;SAC1F,CAAC,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1D,CAAC,CAAA;IAEF,OAAO;QACL,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI;YACnB,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,gBAAgB,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAA;QAC1F,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,GAAG;YACZ,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,gBAAgB,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,CAAA;YACxF,MAAM,MAAM,GAAG,GAAG,CAAC,IAAsB,CAAA;YACzC,MAAM,MAAM,GAAiB,EAAE,CAAA;YAC/B,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,EAAE,CAAA;YACjC,OAAO,IAAI,EAAE,CAAC;gBACZ,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAA;gBAC3C,IAAI,IAAI;oBAAE,MAAK;gBACf,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;YACpB,CAAC;YACD,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;QAC9B,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,GAAG;YACd,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,mBAAmB,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,CAAA;QACjF,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,GAAG;YACd,IAAI,CAAC;gBACH,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,iBAAiB,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,CAAA;gBAC7E,OAAO,IAAI,CAAA;YACb,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,KAAK,CAAA;YACd,CAAC;QACH,CAAC;QACD,YAAY,CAAC,GAAG;YACd,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;gBACrB,MAAM,IAAI,GAAG,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;gBACjD,OAAO,GAAG,IAAI,IAAI,GAAG,EAAE,CAAA;YACzB,CAAC;YACD,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;gBACpB,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;gBAChD,OAAO,GAAG,IAAI,IAAI,MAAM,CAAC,MAAM,IAAI,GAAG,EAAE,CAAA;YAC1C,CAAC;YACD,OAAO,WAAW,MAAM,CAAC,MAAM,OAAO,MAAM,CAAC,MAAM,kBAAkB,GAAG,EAAE,CAAA;QAC5E,CAAC;KACF,CAAA;AACH,CAAC"}

package/dist/media/types.d.ts

@@ -0,0 +1,37 @@
+export interface StorageProvider {
+    write(key: string, data: Buffer): Promise<void>;
+    read(key: string): Promise<Buffer>;
+    delete(key: string): Promise<void>;
+    exists(key: string): Promise<boolean>;
+    getPublicUrl?(key: string): string;
+}
+export interface ImageSizeConfig {
+    width: number;
+    height?: number | undefined;
+    fit?: 'cover' | 'contain' | 'fill';
+}
+export interface S3Config {
+    bucket: string;
+    region: string;
+    accessKeyId?: string;
+    secretAccessKey?: string;
+    endpoint?: string;
+    publicUrl?: string;
+}
+export interface MediaConfig {
+    provider: 'local' | 's3';
+    localPath?: string;
+    s3?: S3Config;
+    imageSizes?: Record<string, ImageSizeConfig>;
+    maxUploadSizeMb?: number;
+    /**
+     * Upload allowlist. When omitted, sensible defaults apply (images, PDF, common
+     * office docs, audio, video — executables/scripts rejected). Extensions are
+     * lowercase, without the leading dot. Both the file extension and the declared
+     * MIME type must pass, so a dangerous file cannot slip in under a spoofed
+     * extension. See media/upload-allowlist.ts.
+     */
+    allowedExtensions?: string[];
+    allowedMimeTypes?: string[];
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/media/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/media/types.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,eAAe;IAC9B,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAC/C,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;IAClC,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAClC,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IACrC,YAAY,CAAC,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAA;CACnC;AAED,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,MAAM,CAAA;IACb,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IAC3B,GAAG,CAAC,EAAE,OAAO,GAAG,SAAS,GAAG,MAAM,CAAA;CACnC;AAED,MAAM,WAAW,QAAQ;IACvB,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,MAAM,CAAA;IACd,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,EAAE,OAAO,GAAG,IAAI,CAAA;IACxB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,EAAE,CAAC,EAAE,QAAQ,CAAA;IACb,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAA;IAC5C,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB;;;;;;OAMG;IACH,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAA;IAC5B,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAA;CAC5B"}

package/dist/media/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/media/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/media/types.ts"],"names":[],"mappings":""}

package/dist/media/upload-allowlist.d.ts

@@ -0,0 +1,32 @@
+import type { MediaConfig } from './types.js';
+/**
+ * Server-side upload allowlist (GAP-08-E).
+ *
+ * Media uploads are gated on BOTH the file extension and the declared MIME type.
+ * Requiring both to pass means a dangerous payload cannot be smuggled in under a
+ * benign-looking extension (a `.jpg` carrying `application/x-msdownload` is
+ * rejected on its MIME) nor under a benign-looking MIME (a `.exe` claiming
+ * `image/png` is rejected on its extension). A generic `application/octet-stream`
+ * (or an empty MIME) is treated as "unknown" and deferred to the extension gate,
+ * so a legitimate file whose browser could not type it still uploads.
+ */
+/** Default allowed extensions (lowercase, no leading dot). Executables/scripts are excluded. */
+export declare const DEFAULT_ALLOWED_EXTENSIONS: readonly string[];
+/** Default allowed MIME types. Executable/script types are excluded. */
+export declare const DEFAULT_ALLOWED_MIME_TYPES: readonly string[];
+/** Lowercased extension of a filename, without the leading dot. '' when none. */
+export declare function fileExtension(filename: string): string;
+/** Normalize a Content-Type header value to a bare lowercase MIME (strip params). */
+export declare function normalizeMimeType(mimeType: string): string;
+export type UploadAllowResult = {
+    ok: true;
+} | {
+    ok: false;
+    reason: string;
+};
+/**
+ * Decide whether an upload is allowed given its filename and declared MIME type.
+ * Both gates must pass (extension always; MIME unless it is generic/unknown).
+ */
+export declare function checkUploadAllowed(filename: string, mimeType: string, config: MediaConfig | undefined): UploadAllowResult;
+//# sourceMappingURL=upload-allowlist.d.ts.map

package/dist/media/upload-allowlist.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"upload-allowlist.d.ts","sourceRoot":"","sources":["../../src/media/upload-allowlist.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAA;AAE7C;;;;;;;;;;GAUG;AAEH,gGAAgG;AAChG,eAAO,MAAM,0BAA0B,EAAE,SAAS,MAAM,EAWvD,CAAA;AAED,wEAAwE;AACxE,eAAO,MAAM,0BAA0B,EAAE,SAAS,MAAM,EAoBvD,CAAA;AAOD,iFAAiF;AACjF,wBAAgB,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAKtD;AAED,qFAAqF;AACrF,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAE1D;AAED,MAAM,MAAM,iBAAiB,GAAG;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAA;AAE5E;;;GAGG;AACH,wBAAgB,kBAAkB,CAChC,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,WAAW,GAAG,SAAS,GAC9B,iBAAiB,CAkBnB"}

package/dist/media/upload-allowlist.js

@@ -0,0 +1,83 @@
+/**
+ * Server-side upload allowlist (GAP-08-E).
+ *
+ * Media uploads are gated on BOTH the file extension and the declared MIME type.
+ * Requiring both to pass means a dangerous payload cannot be smuggled in under a
+ * benign-looking extension (a `.jpg` carrying `application/x-msdownload` is
+ * rejected on its MIME) nor under a benign-looking MIME (a `.exe` claiming
+ * `image/png` is rejected on its extension). A generic `application/octet-stream`
+ * (or an empty MIME) is treated as "unknown" and deferred to the extension gate,
+ * so a legitimate file whose browser could not type it still uploads.
+ */
+/** Default allowed extensions (lowercase, no leading dot). Executables/scripts are excluded. */
+export const DEFAULT_ALLOWED_EXTENSIONS = [
+    // images
+    'jpg', 'jpeg', 'png', 'gif', 'webp', 'svg', 'avif', 'bmp', 'ico', 'tif', 'tiff', 'heic', 'heif',
+    // documents
+    'pdf', 'txt', 'csv', 'md', 'rtf',
+    'doc', 'docx', 'xls', 'xlsx', 'ppt', 'pptx',
+    'odt', 'ods', 'odp',
+    // video
+    'mp4', 'webm', 'mov', 'm4v', 'avi', 'mkv',
+    // audio
+    'mp3', 'wav', 'ogg', 'oga', 'm4a', 'aac', 'flac',
+];
+/** Default allowed MIME types. Executable/script types are excluded. */
+export const DEFAULT_ALLOWED_MIME_TYPES = [
+    // images
+    'image/jpeg', 'image/png', 'image/gif', 'image/webp', 'image/svg+xml', 'image/avif',
+    'image/bmp', 'image/x-icon', 'image/vnd.microsoft.icon', 'image/tiff', 'image/heic', 'image/heif',
+    // documents
+    'application/pdf',
+    'text/plain', 'text/csv', 'text/markdown', 'application/rtf', 'text/rtf',
+    'application/msword',
+    'application/vnd.openxmlformats-officedocument.wordprocessingml.document',
+    'application/vnd.ms-excel',
+    'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet',
+    'application/vnd.ms-powerpoint',
+    'application/vnd.openxmlformats-officedocument.presentationml.presentation',
+    'application/vnd.oasis.opendocument.text',
+    'application/vnd.oasis.opendocument.spreadsheet',
+    'application/vnd.oasis.opendocument.presentation',
+    // video
+    'video/mp4', 'video/webm', 'video/quicktime', 'video/x-msvideo', 'video/x-matroska',
+    // audio
+    'audio/mpeg', 'audio/wav', 'audio/x-wav', 'audio/ogg', 'audio/mp4', 'audio/aac', 'audio/flac',
+];
+/** A MIME type we treat as "unknown" — defer to the extension gate. */
+function isGenericMime(mime) {
+    return mime === '' || mime === 'application/octet-stream';
+}
+/** Lowercased extension of a filename, without the leading dot. '' when none. */
+export function fileExtension(filename) {
+    const base = filename.split('/').pop() ?? filename;
+    const dot = base.lastIndexOf('.');
+    if (dot <= 0 || dot === base.length - 1)
+        return '';
+    return base.slice(dot + 1).toLowerCase();
+}
+/** Normalize a Content-Type header value to a bare lowercase MIME (strip params). */
+export function normalizeMimeType(mimeType) {
+    return (mimeType.split(';')[0] ?? '').trim().toLowerCase();
+}
+/**
+ * Decide whether an upload is allowed given its filename and declared MIME type.
+ * Both gates must pass (extension always; MIME unless it is generic/unknown).
+ */
+export function checkUploadAllowed(filename, mimeType, config) {
+    const allowedExt = config?.allowedExtensions ?? DEFAULT_ALLOWED_EXTENSIONS;
+    const allowedMime = config?.allowedMimeTypes ?? DEFAULT_ALLOWED_MIME_TYPES;
+    const ext = fileExtension(filename);
+    if (!ext) {
+        return { ok: false, reason: 'File has no extension; upload type could not be determined' };
+    }
+    if (!allowedExt.includes(ext)) {
+        return { ok: false, reason: `File extension ".${ext}" is not allowed` };
+    }
+    const mime = normalizeMimeType(mimeType);
+    if (!isGenericMime(mime) && !allowedMime.includes(mime)) {
+        return { ok: false, reason: `File type "${mime}" is not allowed` };
+    }
+    return { ok: true };
+}
+//# sourceMappingURL=upload-allowlist.js.map

package/dist/media/upload-allowlist.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"upload-allowlist.js","sourceRoot":"","sources":["../../src/media/upload-allowlist.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;GAUG;AAEH,gGAAgG;AAChG,MAAM,CAAC,MAAM,0BAA0B,GAAsB;IAC3D,SAAS;IACT,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;IAC/F,YAAY;IACZ,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK;IAChC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM;IAC3C,KAAK,EAAE,KAAK,EAAE,KAAK;IACnB,QAAQ;IACR,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK;IACzC,QAAQ;IACR,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM;CACjD,CAAA;AAED,wEAAwE;AACxE,MAAM,CAAC,MAAM,0BAA0B,GAAsB;IAC3D,SAAS;IACT,YAAY,EAAE,WAAW,EAAE,WAAW,EAAE,YAAY,EAAE,eAAe,EAAE,YAAY;IACnF,WAAW,EAAE,cAAc,EAAE,0BAA0B,EAAE,YAAY,EAAE,YAAY,EAAE,YAAY;IACjG,YAAY;IACZ,iBAAiB;IACjB,YAAY,EAAE,UAAU,EAAE,eAAe,EAAE,iBAAiB,EAAE,UAAU;IACxE,oBAAoB;IACpB,yEAAyE;IACzE,0BAA0B;IAC1B,mEAAmE;IACnE,+BAA+B;IAC/B,2EAA2E;IAC3E,yCAAyC;IACzC,gDAAgD;IAChD,iDAAiD;IACjD,QAAQ;IACR,WAAW,EAAE,YAAY,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,kBAAkB;IACnF,QAAQ;IACR,YAAY,EAAE,WAAW,EAAE,aAAa,EAAE,WAAW,EAAE,WAAW,EAAE,WAAW,EAAE,YAAY;CAC9F,CAAA;AAED,uEAAuE;AACvE,SAAS,aAAa,CAAC,IAAY;IACjC,OAAO,IAAI,KAAK,EAAE,IAAI,IAAI,KAAK,0BAA0B,CAAA;AAC3D,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,aAAa,CAAC,QAAgB;IAC5C,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,QAAQ,CAAA;IAClD,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAA;IACjC,IAAI,GAAG,IAAI,CAAC,IAAI,GAAG,KAAK,IAAI,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,EAAE,CAAA;IAClD,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,CAAA;AAC1C,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,iBAAiB,CAAC,QAAgB;IAChD,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;AAC5D,CAAC;AAID;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAChC,QAAgB,EAChB,QAAgB,EAChB,MAA+B;IAE/B,MAAM,UAAU,GAAG,MAAM,EAAE,iBAAiB,IAAI,0BAA0B,CAAA;IAC1E,MAAM,WAAW,GAAG,MAAM,EAAE,gBAAgB,IAAI,0BAA0B,CAAA;IAE1E,MAAM,GAAG,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAA;IACnC,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,4DAA4D,EAAE,CAAA;IAC5F,CAAC;IACD,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC9B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,GAAG,kBAAkB,EAAE,CAAA;IACzE,CAAC;IAED,MAAM,IAAI,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAA;IACxC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACxD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,IAAI,kBAAkB,EAAE,CAAA;IACpE,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAA;AACrB,CAAC"}

package/dist/multisite/__tests__/pool-resolution.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=pool-resolution.test.d.ts.map

package/dist/multisite/__tests__/pool-resolution.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pool-resolution.test.d.ts","sourceRoot":"","sources":["../../../src/multisite/__tests__/pool-resolution.test.ts"],"names":[],"mappings":""}

package/dist/multisite/__tests__/pool-resolution.test.js

@@ -0,0 +1,59 @@
+import { describe, it, expect } from 'vitest';
+import { resolvePoolSiteId } from '../resolve.js';
+describe('resolvePoolSiteId', () => {
+    const sites = [
+        {
+            id: 'child-1', name: 'Child 1', domain: 'child1.example.com',
+            defaultLocale: 'en', theme: 'default',
+            filePoolSiteId: 'parent',
+            categoryPoolSiteId: 'parent',
+            contentPoolSiteId: 'parent',
+            memberUserPoolSiteId: 'parent',
+            systemUserPoolSiteId: 'parent',
+        },
+        {
+            id: 'child-2', name: 'Child 2', domain: 'child2.example.com',
+            defaultLocale: 'en', theme: 'default',
+            filePoolSiteId: 'parent',
+        },
+        {
+            id: 'parent', name: 'Parent', domain: 'parent.example.com',
+            defaultLocale: 'en', theme: 'default',
+        },
+        {
+            id: 'standalone', name: 'Standalone', domain: 'standalone.example.com',
+            defaultLocale: 'en', theme: 'default',
+        },
+    ];
+    it('resolves filePoolSiteId when set', () => {
+        const site = sites.find(s => s.id === 'child-1');
+        expect(resolvePoolSiteId(site, 'filePoolSiteId')).toBe('parent');
+    });
+    it('resolves categoryPoolSiteId when set', () => {
+        const site = sites.find(s => s.id === 'child-1');
+        expect(resolvePoolSiteId(site, 'categoryPoolSiteId')).toBe('parent');
+    });
+    it('resolves contentPoolSiteId when set', () => {
+        const site = sites.find(s => s.id === 'child-1');
+        expect(resolvePoolSiteId(site, 'contentPoolSiteId')).toBe('parent');
+    });
+    it('resolves memberUserPoolSiteId when set', () => {
+        const site = sites.find(s => s.id === 'child-1');
+        expect(resolvePoolSiteId(site, 'memberUserPoolSiteId')).toBe('parent');
+    });
+    it('resolves systemUserPoolSiteId when set', () => {
+        const site = sites.find(s => s.id === 'child-1');
+        expect(resolvePoolSiteId(site, 'systemUserPoolSiteId')).toBe('parent');
+    });
+    it('falls back to site.id when pool field is not set', () => {
+        const site = sites.find(s => s.id === 'standalone');
+        expect(resolvePoolSiteId(site, 'filePoolSiteId')).toBe('standalone');
+    });
+    it('falls back for unset pool fields on partially configured site', () => {
+        const site = sites.find(s => s.id === 'child-2');
+        expect(resolvePoolSiteId(site, 'filePoolSiteId')).toBe('parent');
+        expect(resolvePoolSiteId(site, 'categoryPoolSiteId')).toBe('child-2');
+        expect(resolvePoolSiteId(site, 'contentPoolSiteId')).toBe('child-2');
+    });
+});
+//# sourceMappingURL=pool-resolution.test.js.map

package/dist/multisite/__tests__/pool-resolution.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pool-resolution.test.js","sourceRoot":"","sources":["../../../src/multisite/__tests__/pool-resolution.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAC7C,OAAO,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAA;AAGjD,QAAQ,CAAC,mBAAmB,EAAE,GAAG,EAAE;IACjC,MAAM,KAAK,GAAiB;QAC1B;YACE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,oBAAoB;YAC5D,aAAa,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS;YACrC,cAAc,EAAE,QAAQ;YACxB,kBAAkB,EAAE,QAAQ;YAC5B,iBAAiB,EAAE,QAAQ;YAC3B,oBAAoB,EAAE,QAAQ;YAC9B,oBAAoB,EAAE,QAAQ;SAC/B;QACD;YACE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,oBAAoB;YAC5D,aAAa,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS;YACrC,cAAc,EAAE,QAAQ;SACzB;QACD;YACE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,oBAAoB;YAC1D,aAAa,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS;SACtC;QACD;YACE,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,wBAAwB;YACtE,aAAa,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS;SACtC;KACF,CAAA;IAED,EAAE,CAAC,kCAAkC,EAAE,GAAG,EAAE;QAC1C,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,SAAS,CAAE,CAAA;QACjD,MAAM,CAAC,iBAAiB,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;IAClE,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,sCAAsC,EAAE,GAAG,EAAE;QAC9C,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,SAAS,CAAE,CAAA;QACjD,MAAM,CAAC,iBAAiB,CAAC,IAAI,EAAE,oBAAoB,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;IACtE,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,qCAAqC,EAAE,GAAG,EAAE;QAC7C,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,SAAS,CAAE,CAAA;QACjD,MAAM,CAAC,iBAAiB,CAAC,IAAI,EAAE,mBAAmB,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;IACrE,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,wCAAwC,EAAE,GAAG,EAAE;QAChD,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,SAAS,CAAE,CAAA;QACjD,MAAM,CAAC,iBAAiB,CAAC,IAAI,EAAE,sBAAsB,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;IACxE,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,wCAAwC,EAAE,GAAG,EAAE;QAChD,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,SAAS,CAAE,CAAA;QACjD,MAAM,CAAC,iBAAiB,CAAC,IAAI,EAAE,sBAAsB,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;IACxE,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,kDAAkD,EAAE,GAAG,EAAE;QAC1D,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,YAAY,CAAE,CAAA;QACpD,MAAM,CAAC,iBAAiB,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAA;IACtE,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,+DAA+D,EAAE,GAAG,EAAE;QACvE,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,SAAS,CAAE,CAAA;QACjD,MAAM,CAAC,iBAAiB,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QAChE,MAAM,CAAC,iBAAiB,CAAC,IAAI,EAAE,oBAAoB,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;QACrE,MAAM,CAAC,iBAAiB,CAAC,IAAI,EAAE,mBAAmB,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;IACtE,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}

package/dist/multisite/__tests__/reconcile.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=reconcile.test.d.ts.map

package/dist/multisite/__tests__/reconcile.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"reconcile.test.d.ts","sourceRoot":"","sources":["../../../src/multisite/__tests__/reconcile.test.ts"],"names":[],"mappings":""}