@michaelthielemann/kestrel 3.0.1 → 4.0.0

package/layers/media/server/utils/relocate-ops.ts

@@ -1,341 +0,0 @@
-import { eq, inArray, getTableColumns, sql } from 'drizzle-orm'
-import { createError, type H3Event } from 'h3'
-import type { BetterSQLite3Database } from 'drizzle-orm/better-sqlite3'
-import type { AnySQLiteTable } from 'drizzle-orm/sqlite-core'
-import { media } from '../collections/media'
-import { folders } from '../database/folders'
-import { isUnder, parentOf, childName, rewritePrefix } from './folder-paths'
-import { sanitizeFolder, buildKey, suggestFreeName } from './naming'
-import { planRelocateInto, planRename, type ItemPlan } from './relocate-plan'
-import { relocateMedia, duplicateMedia } from './storage-relocate'
-import { ensureFolder } from './folders'
-import { collectAffected, deleteAffected, type OpItem, type AffectedSet } from './media-ops'
-import { useStorageDriver, type StorageDriver } from '../../../core/server/utils/storage'
-import { escapeLike } from '../../../core/server/utils/sql'
-
-export type OpType = 'move' | 'copy' | 'rename'
-export interface MediaOp { type: OpType; items: OpItem[]; dest?: string; name?: string }
-export interface Conflict { item: OpItem; targetPath: string; type: 'file-exists' | 'folder-exists' }
-export interface RelocationReport { summary: { files: number; folders: number; totalBytes: number }; conflicts: Conflict[] }
-
-/** Parse untrusted request input into well-formed op items (drops malformed entries). */
-export function coerceOpItems(raw: unknown): OpItem[] {
-  if (!Array.isArray(raw)) return []
-  const out: OpItem[] = []
-  for (const it of raw) {
-    if (!it || typeof it !== 'object') continue
-    const o = it as Record<string, unknown>
-    if (o.type === 'file' && Number.isInteger(o.id)) out.push({ type: 'file', id: o.id as number })
-    else if (o.type === 'folder' && typeof o.path === 'string') {
-      // Sanitize at the boundary so the disk cascade (removeDir) targets the same normalized path
-      // the DB cascade matches — a raw `..` would diverge them. Empty == root, not a valid item.
-      const path = sanitizeFolder(o.path)
-      if (path) out.push({ type: 'folder', path })
-    }
-  }
-  return out
-}
-
-/** Resolve one op item into its affected set + relocation plan (shared by preview and execute). */
-export function planItem(db: BetterSQLite3Database, op: MediaOp, item: OpItem): { affected: AffectedSet; plan: ItemPlan } {
-  const affected = collectAffected(db, [item])
-  const plan = op.type === 'rename'
-    ? planRename(item, affected, op.name ?? '')
-    : planRelocateInto(item, affected, op.dest ?? '')
-  return { affected, plan }
-}
-
-/** Reject malformed ops before any work: empty items, bad rename args, folder-into-itself moves. */
-export function validateOp(op: MediaOp): void {
-  if (!op.items.length) throw createError({ statusCode: 400, statusMessage: 'No items' })
-  if (op.type === 'rename') {
-    if (op.items.length !== 1 || !op.name) throw createError({ statusCode: 400, statusMessage: 'Rename needs exactly one item and a name' })
-    return
-  }
-  const dest = sanitizeFolder(op.dest ?? '')
-  for (const item of op.items) {
-    if (item.type === 'folder' && isUnder(item.path, dest)) {
-      throw createError({ statusCode: 400, statusMessage: 'Cannot move a folder into itself' })
-    }
-  }
-}
-
-/** Wave 1 (dryRun): plan the op, then report impact + target-occupancy conflicts. Mutates nothing. */
-export function previewRelocation(db: BetterSQLite3Database, op: MediaOp): RelocationReport {
-  validateOp(op)
-  const planned = op.items.map((item) => ({ item, ...planItem(db, op, item) }))
-
-  const summary = {
-    files: planned.reduce((n, p) => n + p.affected.media.length, 0),
-    folders: planned.reduce((n, p) => n + p.affected.folders.length, 0),
-    totalBytes: planned.reduce((n, p) => n + p.affected.media.reduce((s, m) => s + (m.size || 0), 0), 0),
-  }
-
-  // Bounded index lookups instead of materializing the whole media/folders tables: this runs once per
-  // item during execute for any onConflict other than 'abort' (applyStrategy re-previews in isolation),
-  // so a full scan here is O(items × table size) on a bulk move/copy. Both probed columns are uniquely
-  // indexed, so only the keys/paths THIS op's own items could possibly land on ever need checking —
-  // the loop below never queries either Set outside that set.
-  const probeKeys = new Set<string>()
-  const probeRoots = new Set<string>()
-  for (const { item, plan } of planned) {
-    if (item.type === 'file') {
-      const k = plan.media[0]?.toKey
-      if (k) probeKeys.add(k)
-    } else {
-      probeRoots.add(plan.toRoot)
-      probeKeys.add(plan.toRoot)
-      for (const m of plan.media) probeKeys.add(m.toKey)
-    }
-  }
-  const allKeys = probeKeys.size
-    ? new Set((db.select({ k: getTableColumns(media).storageKey }).from(media as AnySQLiteTable)
-        .where(inArray(getTableColumns(media).storageKey, [...probeKeys])).all() as { k: string }[]).map((r) => r.k))
-    : new Set<string>()
-  const allFolderPaths = probeRoots.size
-    ? new Set(db.select({ path: folders.path }).from(folders).where(inArray(folders.path, [...probeRoots])).all().map((f) => f.path))
-    : new Set<string>()
-
-  // Preview frees all source keys set-wise (order-independent), but execute vacates them one at a time — so a key-rotation batch (move A onto B's key while moving B) can pass preview yet hit relocateMedia's per-key 409 mid-execute; acceptable under the per-item compensating model.
-  const frees = op.type === 'copy' ? { keys: new Set<string>(), folders: new Set<string>() } : {
-    keys: new Set(planned.flatMap((p) => p.plan.media.map((m) => m.fromKey))),
-    folders: new Set(planned.flatMap((p) => p.affected.folders)),
-  }
-  const isOccupiedKey = (key: string) => allKeys.has(key) && !frees.keys.has(key)
-  const isOccupiedFolder = (path: string) => allFolderPaths.has(path) && !frees.folders.has(path)
-
-  // Targets claimed by earlier items in this same op, so two items whose new
-  // targets land on the same slot collide (the later one is flagged).
-  const claimedKeys = new Set<string>()
-  const claimedRoots = new Set<string>()
-
-  const conflicts: Conflict[] = []
-  for (const { item, plan } of planned) {
-    if (item.type === 'file') {
-      const toKey = plan.media[0]?.toKey
-      if (toKey && (isOccupiedKey(toKey) || claimedKeys.has(toKey))) conflicts.push({ item, targetPath: toKey, type: 'file-exists' })
-    // folder-exists ⇒ the destination subtree is occupied: an existing folder row, a FILE whose key equals the
-    // target root (a folder onto a file would mkdir over a file → 500 / DB-vs-disk desync), a descendant file
-    // key, or an intra-batch claim.
-    } else if (isOccupiedFolder(plan.toRoot) || isOccupiedKey(plan.toRoot) || claimedRoots.has(plan.toRoot) || claimedKeys.has(plan.toRoot) || plan.media.some((m) => isOccupiedKey(m.toKey) || claimedKeys.has(m.toKey))) {
-      conflicts.push({ item, targetPath: plan.toRoot, type: 'folder-exists' })
-    }
-    if (item.type === 'folder') claimedRoots.add(plan.toRoot)
-    for (const m of plan.media) claimedKeys.add(m.toKey)
-  }
-  return { summary, conflicts }
-}
-
-export interface OpResult {
-  item: OpItem
-  status: 'moved' | 'copied' | 'renamed' | 'skipped' | 'overwritten' | 'renamed-auto'
-  newPath?: string
-}
-
-/** Move/rename folder-item branch: repoint the folder rows in one transaction. */
-function relocateFolderRows(db: BetterSQLite3Database, plan: ItemPlan): void {
-  db.transaction(() => {
-    // Ensure the destination's PARENT chain (not toRoot) first: toRoot is created by re-pathing
-    // the source root row, so pre-inserting it would clash on the folders UNIQUE(path).
-    ensureFolder(db, parentOf(plan.toRoot) ?? '')
-    for (const f of plan.folders) db.update(folders).set({ path: f.to, updatedAt: new Date() }).where(eq(folders.path, f.from)).run()
-  })
-}
-
-/** Copy folder-item branch: create the destination folder rows. */
-function createCopiedFolderRows(db: BetterSQLite3Database, plan: ItemPlan): void {
-  for (const f of plan.folders) ensureFolder(db, f.to)
-}
-
-/** An item's result plus the media ids it actually LANDED on the target: for a copy those are the rows
- *  `duplicateMedia` created (the source rows never move), for a move/rename the source rows themselves.
- *  Internal to the batch loop — the wire shape stays `OpResult`. */
-type ExecutedItem = OpResult & { landedIds: number[] }
-
-/** Execute one already-planned item: relocate/duplicate its media rows and repoint/create its
- *  folder rows. No-op items short-circuit to 'skipped'. */
-async function executeItem(
-  db: BetterSQLite3Database, driver: StorageDriver, op: MediaOp, item: OpItem, plan: ItemPlan,
-): Promise<ExecutedItem> {
-  if (plan.media.every((m) => m.toKey === m.fromKey) && plan.folders.every((f) => f.from === f.to)) {
-    return { item, status: 'skipped', landedIds: [] }
-  }
-
-  if (op.type === 'copy') {
-    const landedIds: number[] = []
-    for (const m of plan.media) landedIds.push((await duplicateMedia(db, driver, m.id, { folder: m.toFolder, filename: m.toFilename })).id)
-    if (item.type === 'folder') {
-      createCopiedFolderRows(db, plan)
-      for (const f of plan.folders) await driver.ensureDir?.(f.to)
-    } else ensureFolder(db, plan.toRoot)
-    return { item, status: 'copied', newPath: item.type === 'folder' ? plan.toRoot : plan.media[0].toKey, landedIds }
-  }
-
-  for (const m of plan.media) await relocateMedia(db, driver, m.id, { folder: m.toFolder, filename: m.toFilename })
-  if (item.type === 'folder') {
-    relocateFolderRows(db, plan)
-    for (const f of plan.folders) await driver.ensureDir?.(f.to) // dest dirs incl. empty subfolders
-    // Clean the vacated source subtree ONLY when nothing unmanaged remains — removeDir is a recursive wipe,
-    // so a blind call would destroy non-media objects (extension/consumer blobs) living under the same path.
-    const remaining = driver.listPrefix ? await driver.listPrefix(item.path) : ['guard']
-    if (remaining.length === 0) await driver.removeDir?.(item.path)
-  } else ensureFolder(db, plan.toRoot)
-  return {
-    item, status: op.type === 'rename' ? 'renamed' : 'moved',
-    newPath: item.type === 'folder' ? plan.toRoot : plan.media[0].toKey,
-    landedIds: plan.media.map((m) => m.id),
-  }
-}
-
-/** Wave 2 (execute): re-validate (TOCTOU), then move/copy/rename each item in order, re-planning
- *  per item against the now-mutated db. `abort` rejects 409 up front if any conflict exists. */
-export async function executeRelocation(
-  db: BetterSQLite3Database, driver: StorageDriver, op: MediaOp,
-  onConflict: 'abort' | 'skip' | 'overwrite' | 'rename' = 'abort',
-): Promise<OpResult[]> {
-  validateOp(op)
-  const report = previewRelocation(db, op)
-  if (onConflict === 'abort' && report.conflicts.length) {
-    throw createError({ statusCode: 409, statusMessage: 'Conflicts prevent the operation', data: report })
-  }
-
-  // Ids this batch has already relocated ONTO their target — so a later item's 'overwrite' never treats
-  // an earlier item's freshly-landed row as a stale occupant to destroy (see deleteOccupant below).
-  const relocatedIds = new Set<number>()
-  const results: OpResult[] = []
-  for (const item of op.items) {
-    const { landedIds, ...result } = await applyStrategy(db, driver, op, item, onConflict, relocatedIds)
-    results.push(result)
-    for (const id of landedIds) relocatedIds.add(id)
-  }
-  return results
-}
-
-/**
- * Shared body for the move/copy/rename POST handlers (they differ only in the op shape): auth backstop,
- * parse + non-empty-check the items, build the op via `buildOp`, parse `onConflict`, then dispatch a
- * dry-run preview vs a real execute. Each route becomes a one-liner supplying only its op.
- */
-export async function runRelocation(event: H3Event, buildOp: (items: OpItem[], body: Record<string, unknown>) => MediaOp) {
-  requireAdmin(event)
-  const body = (await readBody(event)) as Record<string, unknown> | null
-  const items = coerceOpItems(body?.items)
-  if (!items.length) throw createError({ statusCode: 400, statusMessage: 'No items' })
-  const op = buildOp(items, body ?? {})
-  const oc = body?.onConflict
-  const onConflict = oc === 'skip' || oc === 'overwrite' || oc === 'rename' ? oc : 'abort'
-  const db = useDb()
-  if (body?.dryRun === true) return previewRelocation(db, op)
-  return executeRelocation(db, useStorageDriver(), op, onConflict)
-}
-
-/** Per-item conflict dispatch. Re-checks this item's status against the live db (earlier items in
- *  the batch are already committed), then resolves per `onConflict`. No-Merge: a folder conflict is
- *  handled at the subtree root (skip/overwrite/rename the whole subtree, never per file). */
-async function applyStrategy(
-  db: BetterSQLite3Database, driver: StorageDriver, op: MediaOp, item: OpItem,
-  onConflict: 'abort' | 'skip' | 'overwrite' | 'rename', relocatedIds: Set<number>,
-): Promise<ExecutedItem> {
-  const conflicts = onConflict === 'abort' ? [] : previewRelocation(db, { ...op, items: [item] }).conflicts
-  const { plan } = planItem(db, op, item)
-
-  if (conflicts.length) {
-    if (onConflict === 'skip') return { item, status: 'skipped', landedIds: [] }
-    if (onConflict === 'overwrite') {
-      // Copy/paste into the file's own folder: the "occupant" of the target key IS the source.
-      // Overwriting a file with a copy of itself is a no-op — deleting the occupant here would
-      // destroy the only copy (executeItem then short-circuits as a no-op and copies nothing).
-      const isNoop = plan.media.every((m) => m.toKey === m.fromKey) && plan.folders.every((f) => f.from === f.to)
-      if (isNoop) return { item, status: 'skipped', landedIds: [] }
-      // The per-item re-preview above sees only the LIVE db, so it can't tell a genuine pre-existing
-      // occupant from an earlier item in THIS SAME batch that already landed there — deleting the latter
-      // would silently destroy real data this very operation just placed, one item after reporting it
-      // as a success. Refuse and skip this item instead (its source is left untouched).
-      if (!(await deleteOccupant(db, driver, item, plan, relocatedIds))) return { item, status: 'skipped', landedIds: [] }
-      const r = await executeItem(db, driver, op, item, plan)
-      return { ...r, status: 'overwritten' }
-    }
-    const freePlan = freeRenamePlan(db, item, plan)
-    const r = await executeItem(db, driver, op, item, freePlan)
-    const newPath = item.type === 'file' ? freePlan.media[0]?.toKey : freePlan.toRoot
-    return { ...r, status: 'renamed-auto', newPath }
-  }
-
-  return executeItem(db, driver, op, item, plan)
-}
-
-/** True when no media row currently occupies this storage key. */
-function keyIsFree(db: BetterSQLite3Database, key: string): boolean {
-  const cols = getTableColumns(media)
-  const row = db.select({ id: cols.id }).from(media as AnySQLiteTable).where(eq(cols.storageKey, key)).get()
-  return !row
-}
-
-/** True when no folders row has this path, no FILE sits exactly at it, AND no media key sits under it. */
-function folderRootIsFree(db: BetterSQLite3Database, path: string): boolean {
-  const cols = getTableColumns(media)
-  const folderRow = db.select({ path: folders.path }).from(folders).where(eq(folders.path, path)).get()
-  if (folderRow) return false
-  // A file whose storageKey EQUALS this path blocks the folder root too — a folder can't live where a file
-  // already is (mkdir over a file 500s; the per-media guard only checks descendant keys, never the root).
-  const fileAtRoot = db.select({ id: cols.id }).from(media as AnySQLiteTable).where(eq(cols.storageKey, path)).get()
-  if (fileAtRoot) return false
-  const descendant = db.select({ id: cols.id }).from(media as AnySQLiteTable)
-    .where(sql`${cols.storageKey} like ${`${escapeLike(path)}/%`} escape '\\'`).get()
-  return !descendant
-}
-
-/** Delete whatever currently occupies the item's target so the move/copy can proceed. No-op if free.
- *  Returns false (refuses to delete) when the occupant is itself a media id THIS SAME BATCH already
- *  relocated onto that target — an intra-batch name collision, not a stale pre-existing occupant. */
-async function deleteOccupant(
-  db: BetterSQLite3Database, driver: StorageDriver, item: OpItem, plan: ItemPlan, relocatedIds: Set<number>,
-): Promise<boolean> {
-  // Occupant is deleted before the move commits, so a runtime fault mid-move loses it — inherent to overwrite.
-  if (item.type === 'file') {
-    const key = plan.media[0]?.toKey
-    if (!key) return true
-    const cols = getTableColumns(media)
-    const row = db.select({ id: cols.id }).from(media as AnySQLiteTable).where(eq(cols.storageKey, key)).get() as { id: number } | undefined
-    if (row) {
-      if (relocatedIds.has(row.id)) return false
-      await deleteAffected(db, driver, [{ type: 'file', id: row.id }], false)
-    }
-    return true
-  }
-  const occupant = collectAffected(db, [{ type: 'folder', path: plan.toRoot }])
-  if (occupant.media.some((m) => relocatedIds.has(m.id))) return false
-  await deleteAffected(db, driver, [{ type: 'folder', path: plan.toRoot }], false)
-  return true
-}
-
-/** Build a plan whose target is free, for the rename strategy (file → freed filename; folder → freed root). */
-function freeRenamePlan(db: BetterSQLite3Database, item: OpItem, plan: ItemPlan): ItemPlan {
-  if (item.type === 'file') {
-    const m = plan.media[0]
-    const name = suggestFreeName(m.toFilename, (n) => keyIsFree(db, buildKey(m.toFolder, n)))
-    return { ...plan, media: [{ ...m, toFilename: name, toKey: buildKey(m.toFolder, name) }] }
-  }
-  const freeRoot = freeFolderRoot(db, plan.toRoot)
-  return rebasePlan(plan, plan.toRoot, freeRoot)
-}
-
-/** Pick a fresh sibling segment for a colliding folder root: `archive/sub` → `archive/sub-2`. */
-function freeFolderRoot(db: BetterSQLite3Database, toRoot: string): string {
-  const parent = parentOf(toRoot) ?? ''
-  const seg = childName(toRoot)
-  const freeSeg = suggestFreeName(seg, (s) => folderRootIsFree(db, parent === '' ? s : `${parent}/${s}`))
-  return parent === '' ? freeSeg : `${parent}/${freeSeg}`
-}
-
-/** Re-base every target in a folder plan from `from` onto `to` (the whole subtree moves under the new root). */
-function rebasePlan(plan: ItemPlan, from: string, to: string): ItemPlan {
-  return {
-    toRoot: to,
-    media: plan.media.map((m) => {
-      const toFolder = rewritePrefix(m.toFolder, from, to)
-      return { ...m, toFolder, toKey: buildKey(toFolder, m.toFilename) }
-    }),
-    folders: plan.folders.map((f) => ({ from: f.from, to: rewritePrefix(f.to, from, to) })),
-  }
-}

package/layers/media/server/utils/relocate-plan.ts

@@ -1,63 +0,0 @@
-import { createError } from 'h3'
-import { sanitizeFolder, buildKey, withExtension, extensionOf } from './naming'
-import { childName, parentOf, rewritePrefix } from './folder-paths'
-import type { OpItem, AffectedSet, AffectedMedia } from './media-ops'
-
-export interface PlannedMedia {
-  id: number
-  fromKey: string
-  toFolder: string
-  toFilename: string
-  toKey: string
-}
-export interface PlannedFolder { from: string; to: string }
-export interface ItemPlan { toRoot: string; media: PlannedMedia[]; folders: PlannedFolder[] }
-
-/** A rename must not introduce a path separator: take the last clean segment, never empty. */
-function sanitizeSegment(name: string): string {
-  const seg = childName(sanitizeFolder(name))
-  if (!seg) throw createError({ statusCode: 400, statusMessage: 'Invalid name' })
-  return seg
-}
-
-const planMedia = (m: AffectedMedia, toFolder: string): PlannedMedia => ({
-  id: m.id, fromKey: m.storageKey, toFolder, toFilename: m.filename, toKey: buildKey(toFolder, m.filename),
-})
-
-/** Re-base every affected media row + folder path from the `from` subtree onto `to`. */
-function cascade(affected: AffectedSet, from: string, to: string): Pick<ItemPlan, 'media' | 'folders'> {
-  return {
-    media: affected.media.map((m) => planMedia(m, rewritePrefix(m.folder ?? '', from, to))),
-    folders: affected.folders.map((fp) => ({ from: fp, to: rewritePrefix(fp, from, to) })),
-  }
-}
-
-/** Targets for moving/copying an item into `dest` (file → dest unchanged; folder → dest/<name>). */
-export function planRelocateInto(item: OpItem, affected: AffectedSet, dest: string): ItemPlan {
-  const to = sanitizeFolder(dest)
-  if (item.type === 'file') {
-    const m = affected.media[0]
-    if (!m) throw createError({ statusCode: 404, statusMessage: 'Media not found' })
-    return { toRoot: to, media: [planMedia(m, to)], folders: [] }
-  }
-  const toRoot = to === '' ? childName(item.path) : `${to}/${childName(item.path)}`
-  return { toRoot, ...cascade(affected, item.path, toRoot) }
-}
-
-/** Targets for renaming an item in place (file → new filename; folder → new last segment). */
-export function planRename(item: OpItem, affected: AffectedSet, name: string): ItemPlan {
-  if (item.type === 'file') {
-    const m = affected.media[0]
-    if (!m) throw createError({ statusCode: 404, statusMessage: 'Media not found' })
-    const toFolder = m.folder ?? ''
-    const toFilename = withExtension(name, extensionOf(m.filename))
-    return {
-      toRoot: toFolder, folders: [],
-      media: [{ id: m.id, fromKey: m.storageKey, toFolder, toFilename, toKey: buildKey(toFolder, toFilename) }],
-    }
-  }
-  const parent = parentOf(item.path) ?? ''
-  const seg = sanitizeSegment(name)
-  const toRoot = parent === '' ? seg : `${parent}/${seg}`
-  return { toRoot, ...cascade(affected, item.path, toRoot) }
-}

package/layers/media/server/utils/resolve.ts

@@ -1,98 +0,0 @@
-import { inArray, getTableColumns } from 'drizzle-orm'
-import type { BetterSQLite3Database } from 'drizzle-orm/better-sqlite3'
-import { primaryLocale } from '../../../core/server/utils/locale'
-import { media } from '../collections/media'
-import type { DerivativeManifest } from './record'
-
-/** One derivative, tagged with its parsed name + format so `<picture>` rendering can group by format. */
-export interface MediaVariant { name: string; format: string; url: string; width: number; height: number }
-
-/** The disclosure-relevant subset of the IPTC Digital Source Type vocabulary (EU AI Act Art. 50). */
-export type AiSourceType = 'trainedAlgorithmicMedia' | 'compositeWithTrainedAlgorithmicMedia' | 'algorithmicallyEnhanced'
-
-export interface ResolvedMedia {
-  id: number
-  /** The media's storage folder ('' at the media root) — lets the field open the picker there. */
-  folder: string
-  alt: string | null
-  title: string | null
-  description: string | null
-  mime: string
-  width: number | null
-  height: number | null
-  thumbhash: string | null
-  src: string
-  /** WebP-only responsive srcset (kept for the admin thumb/grid/field/viewer `<img>`s). */
-  srcset: { url: string; width: number }[]
-  /** Every derivative, name+format-tagged — the source `KestrelImg`/`useMediaVariant` build `<picture>` from. */
-  variants: MediaVariant[]
-  /** EU AI Act Art. 50 disclosure, set by an editor — null when unset. Always resolved regardless of
-   *  `kestrel.config.ts`'s `aiDisclosure.enabled` (that flag only gates the admin UI). Kestrel never
-   *  renders this automatically; read it directly or opt into `KestrelImg`'s `aiBadge` prop. */
-  aiDisclosure: { sourceType: AiSourceType; note: string | null } | null
-}
-
-interface MediaRow {
-  id: number
-  folder: string | null
-  storageKey: string
-  mime: string
-  width: number | null
-  height: number | null
-  thumbhash: string | null
-  derivatives: DerivativeManifest | null
-  translations: Record<string, { alt?: string; title?: string; description?: string }> | null
-  aiSourceType: string | null
-  aiNote: string | null
-}
-
-export function resolveMedia(row: MediaRow, locale: string, publicUrl: (key: string) => string): ResolvedMedia {
-  // Per-FIELD locale fallback, not whole-locale: a locale entry that carries e.g. only `title` (the PATCH
-  // API creates partial per-locale objects) must not suppress the primary's `alt` — that silently drops
-  // accessibility text on that locale's pages. Each field falls back to the primary locale independently.
-  const loc = row.translations?.[locale] ?? {}
-  const prim = row.translations?.[primaryLocale()] ?? {}
-  const t = { alt: loc.alt ?? prim.alt, title: loc.title ?? prim.title, description: loc.description ?? prim.description }
-  // Every derivative, name+format-tagged (the manifest key is `<name>.<format>`; names are dot-free so the
-  // last dot splits cleanly). `srcset` is the webp slice, kept for the admin `<img>`s.
-  const variants = Object.entries(row.derivatives ?? {}).map(([mk, d]) => {
-    const dot = mk.lastIndexOf('.')
-    const name = dot > 0 ? mk.slice(0, dot) : mk
-    const format = dot > 0 ? mk.slice(dot + 1) : (d.mime.split('/').pop() ?? '')
-    return { name, format, url: publicUrl(d.key), width: d.width, height: d.height }
-  })
-  const srcset = variants
-    .filter((v) => v.format === 'webp')
-    .map((v) => ({ url: v.url, width: v.width }))
-    .sort((a, b) => a.width - b.width)
-  return {
-    id: row.id,
-    folder: row.folder ?? '', // root files store folder NULL → ''
-    alt: t.alt ?? null,
-    title: t.title ?? null,
-    description: t.description ?? null,
-    mime: row.mime,
-    width: row.width,
-    height: row.height,
-    thumbhash: row.thumbhash,
-    src: publicUrl(row.storageKey),
-    srcset,
-    variants,
-    // A note without a source type is only evidence (e.g. the upload scan's pre-fill), not a disclosure —
-    // never emit a half-filled object a consumer might render as one.
-    aiDisclosure: row.aiSourceType ? { sourceType: row.aiSourceType as AiSourceType, note: row.aiNote ?? null } : null,
-  }
-}
-
-/** Reorder rows to match the requested id order, dropping ids that resolved to nothing. */
-export function orderById<T extends { id: number }>(ids: number[], rows: T[]): T[] {
-  const byId = new Map(rows.map((r) => [r.id, r]))
-  return ids.map((id) => byId.get(id)).filter((r): r is T => !!r)
-}
-
-export function resolveManyByIds(db: BetterSQLite3Database, ids: number[], locale: string, publicUrl: (key: string) => string): ResolvedMedia[] {
-  if (!ids.length) return []
-  const cols = getTableColumns(media) as Record<string, never>
-  const rows = db.select().from(media).where(inArray(cols.id, ids)).all() as MediaRow[]
-  return orderById(ids, rows.map((r) => resolveMedia(r, locale, publicUrl)))
-}

package/layers/media/server/utils/sanitize-svg.ts

@@ -1,12 +0,0 @@
-import { JSDOM } from 'jsdom'
-import createDOMPurify from 'dompurify'
-
-const purify = createDOMPurify(new JSDOM('').window as unknown as Parameters<typeof createDOMPurify>[0])
-
-export function sanitizeSvg(svg: string): string {
-  return purify.sanitize(svg, {
-    USE_PROFILES: { svg: true, svgFilters: true },
-    FORBID_TAGS: ['script', 'foreignObject'],
-    FORBID_ATTR: ['onload', 'onerror', 'onclick'],
-  })
-}

package/layers/media/server/utils/sniff.ts

@@ -1,68 +0,0 @@
-import { fileTypeFromBuffer } from 'file-type'
-
-/** Default upload allow-list — sniffable, safe formats. NO executable/active types (html/js/swf →
- *  XSS from the media origin) and no plain-text (txt/csv: no magic bytes → unsniffable). Override
- *  the whole set via KESTREL_MEDIA_ALLOWED_MIME (see resolveAllowedMimes). Exact file-type@22 MIMEs. */
-export const DEFAULT_ALLOWED_MIME = new Set([
-  'image/png', 'image/jpeg', 'image/webp', 'image/gif', 'image/avif', 'image/svg+xml',
-  'application/pdf',
-  'application/vnd.openxmlformats-officedocument.wordprocessingml.document',
-  'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet',
-  'application/vnd.openxmlformats-officedocument.presentationml.presentation',
-  'application/vnd.oasis.opendocument.text',
-  'application/vnd.oasis.opendocument.spreadsheet',
-  'application/vnd.oasis.opendocument.presentation',
-  'video/mp4', 'video/webm', 'video/quicktime',
-  // audio (file-type emits 'audio/x-m4a' for typical m4a, 'audio/ogg; codecs=opus' for opus)
-  'audio/mpeg', 'audio/ogg', 'audio/ogg; codecs=opus', 'audio/wav', 'audio/flac', 'audio/x-m4a', 'audio/mp4',
-])
-
-/** Resolve the effective allow-list: a non-empty comma list overrides the default entirely. */
-export function resolveAllowedMimes(configured: string | undefined): Set<string> {
-  const list = (configured ?? '').split(',').map((s) => s.trim()).filter(Boolean)
-  return list.length ? new Set(list) : DEFAULT_ALLOWED_MIME
-}
-
-const EXT_BY_MIME: Record<string, string> = {
-  'image/png': 'png', 'image/jpeg': 'jpg', 'image/webp': 'webp', 'image/gif': 'gif',
-  'image/avif': 'avif', 'application/pdf': 'pdf', 'image/svg+xml': 'svg',
-  'application/vnd.openxmlformats-officedocument.wordprocessingml.document': 'docx',
-  'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet': 'xlsx',
-  'application/vnd.openxmlformats-officedocument.presentationml.presentation': 'pptx',
-  'application/vnd.oasis.opendocument.text': 'odt',
-  'application/vnd.oasis.opendocument.spreadsheet': 'ods',
-  'application/vnd.oasis.opendocument.presentation': 'odp',
-  'video/mp4': 'mp4', 'video/webm': 'webm', 'video/quicktime': 'mov',
-  'audio/mpeg': 'mp3', 'audio/ogg': 'ogg', 'audio/ogg; codecs=opus': 'opus',
-  'audio/wav': 'wav', 'audio/flac': 'flac', 'audio/x-m4a': 'm4a', 'audio/mp4': 'm4a',
-}
-
-function looksLikeSvg(bytes: Buffer): boolean {
-  let head = bytes.subarray(0, 1024).toString('utf8').trimStart()
-  // Skip any leading XML declaration, DOCTYPE, and comments (some exporters emit these before <svg>),
-  // then require the root element to be <svg>.
-  for (let prev = ''; head !== prev; ) {
-    prev = head
-    head = head
-      .replace(/^<\?xml\b[^>]*\?>\s*/i, '')
-      .replace(/^<!DOCTYPE\b[^>]*>\s*/i, '')
-      .replace(/^<!--[\s\S]*?-->\s*/, '')
-      .trimStart()
-  }
-  return /^<svg[\s>]/i.test(head)
-}
-
-/** Detect the real MIME from the bytes (magic-byte sniff, then an SVG text heuristic). Pure
- *  detection — authorization against the allow-list is the caller's job. */
-export async function sniffMime(bytes: Buffer): Promise<string | null> {
-  const ft = await fileTypeFromBuffer(bytes)
-  // An SVG that opens with an XML declaration / DOCTYPE is reported by the magic-byte sniff as generic XML;
-  // promote it to image/svg+xml when the root element is actually <svg>. A non-XML detection is trusted as-is.
-  if (ft && ft.mime !== 'application/xml' && ft.mime !== 'text/xml') return ft.mime
-  if (looksLikeSvg(bytes)) return 'image/svg+xml'
-  return ft ? ft.mime : null
-}
-
-export function extForMime(mime: string): string {
-  return EXT_BY_MIME[mime] ?? 'bin'
-}