@momentumcms/storage 0.1.0

package/CHANGELOG.md

@@ -0,0 +1,10 @@
+## 0.1.0 (2026-02-16)
+
+### 🩹 Fixes
+
+- address security and reliability issues from code review ([#7](https://github.com/DonaldMurillo/momentum-cms/pull/7))
+
+### ❤️ Thank You
+
+- Claude Opus 4.5
+- Donald Murillo @DonaldMurillo

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2024-present Momentum CMS Contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,11 @@
+# storage
+
+This library was generated with [Nx](https://nx.dev).
+
+## Building
+
+Run `nx build storage` to build the library.
+
+## Running unit tests
+
+Run `nx test storage` to execute the unit tests via [Vitest](https://vitest.dev/).

package/package.json

@@ -0,0 +1,45 @@
+{
+	"name": "@momentumcms/storage",
+	"version": "0.1.0",
+	"description": "File storage adapters (local filesystem, S3) for Momentum CMS",
+	"license": "MIT",
+	"author": "Momentum CMS Contributors",
+	"repository": {
+		"type": "git",
+		"url": "https://github.com/momentum-cms/momentum-cms.git",
+		"directory": "libs/storage"
+	},
+	"homepage": "https://github.com/momentum-cms/momentum-cms#readme",
+	"bugs": {
+		"url": "https://github.com/momentum-cms/momentum-cms/issues"
+	},
+	"keywords": [
+		"cms",
+		"momentum-cms",
+		"storage",
+		"file-upload",
+		"s3"
+	],
+	"engines": {
+		"node": ">=18"
+	},
+	"type": "commonjs",
+	"main": "./src/index.js",
+	"types": "./src/index.d.ts",
+	"dependencies": {
+		"tslib": "^2.3.0"
+	},
+	"peerDependencies": {
+		"@momentumcms/core": ">=0.0.1",
+		"@aws-sdk/client-s3": "^3.0.0",
+		"@aws-sdk/s3-request-presigner": "^3.0.0"
+	},
+	"peerDependenciesMeta": {
+		"@aws-sdk/client-s3": {
+			"optional": true
+		},
+		"@aws-sdk/s3-request-presigner": {
+			"optional": true
+		}
+	}
+}

package/src/index.d.ts

@@ -0,0 +1,4 @@
+export * from './lib/storage.types';
+export { localStorageAdapter } from './lib/storage-local';
+export { s3StorageAdapter } from './lib/storage-s3';
+export { validateMimeType, isMimeTypeAllowed, detectMimeType, mimeTypeMatches, } from './lib/mime-validator';

package/src/index.js

@@ -0,0 +1,18 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.mimeTypeMatches = exports.detectMimeType = exports.isMimeTypeAllowed = exports.validateMimeType = exports.s3StorageAdapter = exports.localStorageAdapter = void 0;
+const tslib_1 = require("tslib");
+// Storage types
+tslib_1.__exportStar(require("./lib/storage.types"), exports);
+// Storage adapters
+var storage_local_1 = require("./lib/storage-local");
+Object.defineProperty(exports, "localStorageAdapter", { enumerable: true, get: function () { return storage_local_1.localStorageAdapter; } });
+var storage_s3_1 = require("./lib/storage-s3");
+Object.defineProperty(exports, "s3StorageAdapter", { enumerable: true, get: function () { return storage_s3_1.s3StorageAdapter; } });
+// MIME validation
+var mime_validator_1 = require("./lib/mime-validator");
+Object.defineProperty(exports, "validateMimeType", { enumerable: true, get: function () { return mime_validator_1.validateMimeType; } });
+Object.defineProperty(exports, "isMimeTypeAllowed", { enumerable: true, get: function () { return mime_validator_1.isMimeTypeAllowed; } });
+Object.defineProperty(exports, "detectMimeType", { enumerable: true, get: function () { return mime_validator_1.detectMimeType; } });
+Object.defineProperty(exports, "mimeTypeMatches", { enumerable: true, get: function () { return mime_validator_1.mimeTypeMatches; } });
+//# sourceMappingURL=index.js.map

package/src/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../libs/storage/src/index.ts"],"names":[],"mappings":";;;;AAAA,gBAAgB;AAChB,8DAAoC;AAEpC,mBAAmB;AACnB,qDAA0D;AAAjD,oHAAA,mBAAmB,OAAA;AAC5B,+CAAoD;AAA3C,8GAAA,gBAAgB,OAAA;AAEzB,kBAAkB;AAClB,uDAK8B;AAJ7B,kHAAA,gBAAgB,OAAA;AAChB,mHAAA,iBAAiB,OAAA;AACjB,gHAAA,cAAc,OAAA;AACd,iHAAA,eAAe,OAAA"}

package/src/lib/mime-validator.d.ts

@@ -0,0 +1,22 @@
+/**
+ * MIME Type Validator
+ * Validates files by checking magic bytes (file signatures)
+ */
+import type { MimeValidationResult } from './storage.types';
+/**
+ * Detect MIME type from file buffer using magic bytes.
+ */
+export declare function detectMimeType(buffer: Buffer): string | null;
+/**
+ * Check if a MIME type matches a pattern.
+ * Supports glob patterns like 'image/*' and 'video/*'.
+ */
+export declare function mimeTypeMatches(mimeType: string, pattern: string): boolean;
+/**
+ * Check if a MIME type is allowed by a list of patterns.
+ */
+export declare function isMimeTypeAllowed(mimeType: string, allowedTypes: string[]): boolean;
+/**
+ * Validate a file's MIME type by checking magic bytes.
+ */
+export declare function validateMimeType(buffer: Buffer, claimedType: string, allowedTypes?: string[]): MimeValidationResult;

package/src/lib/mime-validator.js

@@ -0,0 +1,233 @@
+"use strict";
+/**
+ * MIME Type Validator
+ * Validates files by checking magic bytes (file signatures)
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.detectMimeType = detectMimeType;
+exports.mimeTypeMatches = mimeTypeMatches;
+exports.isMimeTypeAllowed = isMimeTypeAllowed;
+exports.validateMimeType = validateMimeType;
+/**
+ * Common file signatures (magic bytes) for MIME type detection.
+ */
+const FILE_SIGNATURES = [
+    // Images
+    { mimeType: 'image/jpeg', bytes: [0xff, 0xd8, 0xff] },
+    { mimeType: 'image/png', bytes: [0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a] },
+    { mimeType: 'image/gif', bytes: [0x47, 0x49, 0x46, 0x38] }, // GIF8
+    { mimeType: 'image/webp', bytes: [0x52, 0x49, 0x46, 0x46], offset: 0 }, // RIFF (need to check for WEBP at offset 8)
+    { mimeType: 'image/bmp', bytes: [0x42, 0x4d] }, // BM
+    { mimeType: 'image/tiff', bytes: [0x49, 0x49, 0x2a, 0x00] }, // Little-endian TIFF
+    { mimeType: 'image/tiff', bytes: [0x4d, 0x4d, 0x00, 0x2a] }, // Big-endian TIFF
+    { mimeType: 'image/x-icon', bytes: [0x00, 0x00, 0x01, 0x00] }, // ICO
+    { mimeType: 'image/svg+xml', bytes: [0x3c, 0x73, 0x76, 0x67] }, // <svg (partial match)
+    // Documents
+    { mimeType: 'application/pdf', bytes: [0x25, 0x50, 0x44, 0x46] }, // %PDF
+    // Archives
+    { mimeType: 'application/zip', bytes: [0x50, 0x4b, 0x03, 0x04] }, // PK
+    { mimeType: 'application/gzip', bytes: [0x1f, 0x8b] },
+    { mimeType: 'application/x-rar-compressed', bytes: [0x52, 0x61, 0x72, 0x21] }, // Rar!
+    // Audio
+    { mimeType: 'audio/mpeg', bytes: [0x49, 0x44, 0x33] }, // ID3 (MP3)
+    { mimeType: 'audio/mpeg', bytes: [0xff, 0xfb] }, // MP3 frame sync
+    { mimeType: 'audio/wav', bytes: [0x52, 0x49, 0x46, 0x46] }, // RIFF (need to check for WAVE)
+    { mimeType: 'audio/ogg', bytes: [0x4f, 0x67, 0x67, 0x53] }, // OggS
+    { mimeType: 'audio/flac', bytes: [0x66, 0x4c, 0x61, 0x43] }, // fLaC
+    // Video
+    { mimeType: 'video/mp4', bytes: [0x00, 0x00, 0x00], offset: 0 }, // Need to check for ftyp at offset 4
+    { mimeType: 'video/webm', bytes: [0x1a, 0x45, 0xdf, 0xa3] }, // EBML header
+    { mimeType: 'video/avi', bytes: [0x52, 0x49, 0x46, 0x46] }, // RIFF (need to check for AVI)
+    // Executables (for blocking)
+    { mimeType: 'application/x-executable', bytes: [0x7f, 0x45, 0x4c, 0x46] }, // ELF
+    { mimeType: 'application/x-msdownload', bytes: [0x4d, 0x5a] }, // MZ (Windows EXE)
+];
+/**
+ * Detect MIME type from file buffer using magic bytes.
+ */
+function detectMimeType(buffer) {
+    var _a;
+    for (const sig of FILE_SIGNATURES) {
+        const offset = (_a = sig.offset) !== null && _a !== void 0 ? _a : 0;
+        if (buffer.length < offset + sig.bytes.length) {
+            continue;
+        }
+        let match = true;
+        for (let i = 0; i < sig.bytes.length; i++) {
+            if (buffer[offset + i] !== sig.bytes[i]) {
+                match = false;
+                break;
+            }
+        }
+        if (match) {
+            // Special handling for RIFF-based formats
+            if (sig.bytes[0] === 0x52 && sig.bytes[1] === 0x49) {
+                // Check for WEBP
+                if (buffer.length >= 12) {
+                    const formatId = buffer.slice(8, 12).toString('ascii');
+                    if (formatId === 'WEBP') {
+                        return 'image/webp';
+                    }
+                    if (formatId === 'WAVE') {
+                        return 'audio/wav';
+                    }
+                    if (formatId === 'AVI ') {
+                        return 'video/avi';
+                    }
+                }
+            }
+            // Special handling for MP4 (check for ftyp box)
+            if (sig.mimeType === 'video/mp4' && buffer.length >= 8) {
+                const boxType = buffer.slice(4, 8).toString('ascii');
+                if (boxType === 'ftyp') {
+                    return 'video/mp4';
+                }
+            }
+            return sig.mimeType;
+        }
+    }
+    // Check for text/plain or JSON
+    if (isTextContent(buffer)) {
+        const text = buffer.toString('utf8', 0, Math.min(buffer.length, 1000));
+        if (text.trim().startsWith('{') || text.trim().startsWith('[')) {
+            return 'application/json';
+        }
+        if (text.trim().startsWith('<')) {
+            if (text.includes('<svg')) {
+                return 'image/svg+xml';
+            }
+            if (text.includes('<!DOCTYPE html') || text.includes('<html')) {
+                return 'text/html';
+            }
+            return 'application/xml';
+        }
+        return 'text/plain';
+    }
+    return null;
+}
+/**
+ * Check if buffer appears to be text content.
+ */
+function isTextContent(buffer) {
+    // Check first 512 bytes for non-text characters
+    const checkLength = Math.min(buffer.length, 512);
+    for (let i = 0; i < checkLength; i++) {
+        const byte = buffer[i];
+        // Allow printable ASCII, newlines, tabs, and UTF-8 continuation bytes
+        if (byte < 0x09 || // Control chars before tab
+            (byte > 0x0d && byte < 0x20) || // Control chars between CR and space
+            byte === 0x7f // DEL
+        ) {
+            // Allow UTF-8 continuation bytes (0x80-0xBF when following a lead byte)
+            if (byte >= 0x80 && byte <= 0xbf) {
+                continue;
+            }
+            // Allow UTF-8 lead bytes
+            if (byte >= 0xc0 && byte <= 0xf7) {
+                continue;
+            }
+            return false;
+        }
+    }
+    return true;
+}
+/**
+ * Check if a MIME type matches a pattern.
+ * Supports glob patterns like 'image/*' and 'video/*'.
+ */
+function mimeTypeMatches(mimeType, pattern) {
+    if (pattern === '*' || pattern === '*/*') {
+        return true;
+    }
+    if (pattern.endsWith('/*')) {
+        // Category pattern like 'image/*'
+        const category = pattern.slice(0, -2);
+        return mimeType.startsWith(`${category}/`);
+    }
+    // Exact match
+    return mimeType === pattern;
+}
+/**
+ * Check if a MIME type is allowed by a list of patterns.
+ */
+function isMimeTypeAllowed(mimeType, allowedTypes) {
+    if (allowedTypes.length === 0) {
+        return true; // No restrictions
+    }
+    return allowedTypes.some((pattern) => mimeTypeMatches(mimeType, pattern));
+}
+/**
+ * Validate a file's MIME type by checking magic bytes.
+ */
+function validateMimeType(buffer, claimedType, allowedTypes) {
+    const detectedType = detectMimeType(buffer);
+    // Check if detected type is in allowed list
+    if (allowedTypes && allowedTypes.length > 0) {
+        const typeToCheck = detectedType !== null && detectedType !== void 0 ? detectedType : claimedType;
+        if (!isMimeTypeAllowed(typeToCheck, allowedTypes)) {
+            return {
+                valid: false,
+                detectedType,
+                claimedType,
+                error: `File type '${typeToCheck}' is not allowed. Allowed types: ${allowedTypes.join(', ')}`,
+            };
+        }
+    }
+    // If we couldn't detect the type, trust the claimed type (for unknown formats)
+    if (!detectedType) {
+        return {
+            valid: true,
+            detectedType: null,
+            claimedType,
+        };
+    }
+    // Check if detected type matches claimed type (allow compatible types)
+    const compatible = areMimeTypesCompatible(detectedType, claimedType);
+    if (!compatible) {
+        return {
+            valid: false,
+            detectedType,
+            claimedType,
+            error: `File appears to be '${detectedType}' but was uploaded as '${claimedType}'`,
+        };
+    }
+    return {
+        valid: true,
+        detectedType,
+        claimedType,
+    };
+}
+/**
+ * Check if two MIME types are compatible (allowing for variations).
+ */
+function areMimeTypesCompatible(detected, claimed) {
+    // Exact match
+    if (detected === claimed) {
+        return true;
+    }
+    // Same category (e.g., image/jpeg vs image/jpg)
+    const [detectedCategory] = detected.split('/');
+    const [claimedCategory] = claimed.split('/');
+    if (detectedCategory !== claimedCategory) {
+        return false;
+    }
+    // Allow common variations
+    const variations = {
+        'image/jpeg': ['image/jpg', 'image/pjpeg'],
+        'text/plain': ['text/x-plain'],
+        'application/json': ['text/json'],
+        'application/javascript': ['text/javascript', 'application/x-javascript'],
+    };
+    const allowedVariations = variations[detected];
+    if (allowedVariations && allowedVariations.includes(claimed)) {
+        return true;
+    }
+    // Check reverse
+    for (const [canonical, variants] of Object.entries(variations)) {
+        if (variants.includes(detected) && (canonical === claimed || variants.includes(claimed))) {
+            return true;
+        }
+    }
+    return false;
+}
+//# sourceMappingURL=mime-validator.js.map

package/src/lib/mime-validator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mime-validator.js","sourceRoot":"","sources":["../../../../../libs/storage/src/lib/mime-validator.ts"],"names":[],"mappings":";AAAA;;;GAGG;;AA+CH,wCAgEC;AAkCD,0CAaC;AAKD,8CAMC;AAKD,4CA6CC;AAvND;;GAEG;AACH,MAAM,eAAe,GAAoB;IACxC,SAAS;IACT,EAAE,QAAQ,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE;IACrD,EAAE,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE;IAClF,EAAE,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,OAAO;IACnE,EAAE,QAAQ,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,EAAE,4CAA4C;IACpH,EAAE,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK;IACrD,EAAE,QAAQ,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,qBAAqB;IAClF,EAAE,QAAQ,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,kBAAkB;IAC/E,EAAE,QAAQ,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,MAAM;IACrE,EAAE,QAAQ,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,uBAAuB;IAEvF,YAAY;IACZ,EAAE,QAAQ,EAAE,iBAAiB,EAAE,KAAK,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,OAAO;IAEzE,WAAW;IACX,EAAE,QAAQ,EAAE,iBAAiB,EAAE,KAAK,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK;IACvE,EAAE,QAAQ,EAAE,kBAAkB,EAAE,KAAK,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE;IACrD,EAAE,QAAQ,EAAE,8BAA8B,EAAE,KAAK,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,OAAO;IAEtF,QAAQ;IACR,EAAE,QAAQ,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,YAAY;IACnE,EAAE,QAAQ,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,iBAAiB;IAClE,EAAE,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,gCAAgC;IAC5F,EAAE,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,OAAO;IACnE,EAAE,QAAQ,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,OAAO;IAEpE,QAAQ;IACR,EAAE,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,EAAE,qCAAqC;IACtG,EAAE,QAAQ,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,cAAc;IAC3E,EAAE,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,+BAA+B;IAE3F,6BAA6B;IAC7B,EAAE,QAAQ,EAAE,0BAA0B,EAAE,KAAK,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,MAAM;IACjF,EAAE,QAAQ,EAAE,0BAA0B,EAAE,KAAK,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,mBAAmB;CAClF,CAAC;AAEF;;GAEG;AACH,SAAgB,cAAc,CAAC,MAAc;;IAC5C,KAAK,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;QACnC,MAAM,MAAM,GAAG,MAAA,GAAG,CAAC,MAAM,mCAAI,CAAC,CAAC;QAC/B,IAAI,MAAM,CAAC,MAAM,GAAG,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;YAC/C,SAAS;QACV,CAAC;QAED,IAAI,KAAK,GAAG,IAAI,CAAC;QACjB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YAC3C,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,KAAK,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;gBACzC,KAAK,GAAG,KAAK,CAAC;gBACd,MAAM;YACP,CAAC;QACF,CAAC;QAED,IAAI,KAAK,EAAE,CAAC;YACX,0CAA0C;YAC1C,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;gBACpD,iBAAiB;gBACjB,IAAI,MAAM,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC;oBACzB,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;oBACvD,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;wBACzB,OAAO,YAAY,CAAC;oBACrB,CAAC;oBACD,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;wBACzB,OAAO,WAAW,CAAC;oBACpB,CAAC;oBACD,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;wBACzB,OAAO,WAAW,CAAC;oBACpB,CAAC;gBACF,CAAC;YACF,CAAC;YAED,gDAAgD;YAChD,IAAI,GAAG,CAAC,QAAQ,KAAK,WAAW,IAAI,MAAM,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;gBACxD,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;gBACrD,IAAI,OAAO,KAAK,MAAM,EAAE,CAAC;oBACxB,OAAO,WAAW,CAAC;gBACpB,CAAC;YACF,CAAC;YAED,OAAO,GAAG,CAAC,QAAQ,CAAC;QACrB,CAAC;IACF,CAAC;IAED,+BAA+B;IAC/B,IAAI,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC;QACvE,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAChE,OAAO,kBAAkB,CAAC;QAC3B,CAAC;QACD,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACjC,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC3B,OAAO,eAAe,CAAC;YACxB,CAAC;YACD,IAAI,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC/D,OAAO,WAAW,CAAC;YACpB,CAAC;YACD,OAAO,iBAAiB,CAAC;QAC1B,CAAC;QACD,OAAO,YAAY,CAAC;IACrB,CAAC;IAED,OAAO,IAAI,CAAC;AACb,CAAC;AAED;;GAEG;AACH,SAAS,aAAa,CAAC,MAAc;IACpC,gDAAgD;IAChD,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IACjD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,WAAW,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QACvB,sEAAsE;QACtE,IACC,IAAI,GAAG,IAAI,IAAI,2BAA2B;YAC1C,CAAC,IAAI,GAAG,IAAI,IAAI,IAAI,GAAG,IAAI,CAAC,IAAI,qCAAqC;YACrE,IAAI,KAAK,IAAI,CAAC,MAAM;UACnB,CAAC;YACF,wEAAwE;YACxE,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,EAAE,CAAC;gBAClC,SAAS;YACV,CAAC;YACD,yBAAyB;YACzB,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,EAAE,CAAC;gBAClC,SAAS;YACV,CAAC;YACD,OAAO,KAAK,CAAC;QACd,CAAC;IACF,CAAC;IACD,OAAO,IAAI,CAAC;AACb,CAAC;AAED;;;GAGG;AACH,SAAgB,eAAe,CAAC,QAAgB,EAAE,OAAe;IAChE,IAAI,OAAO,KAAK,GAAG,IAAI,OAAO,KAAK,KAAK,EAAE,CAAC;QAC1C,OAAO,IAAI,CAAC;IACb,CAAC;IAED,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5B,kCAAkC;QAClC,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QACtC,OAAO,QAAQ,CAAC,UAAU,CAAC,GAAG,QAAQ,GAAG,CAAC,CAAC;IAC5C,CAAC;IAED,cAAc;IACd,OAAO,QAAQ,KAAK,OAAO,CAAC;AAC7B,CAAC;AAED;;GAEG;AACH,SAAgB,iBAAiB,CAAC,QAAgB,EAAE,YAAsB;IACzE,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/B,OAAO,IAAI,CAAC,CAAC,kBAAkB;IAChC,CAAC;IAED,OAAO,YAAY,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,eAAe,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;AAC3E,CAAC;AAED;;GAEG;AACH,SAAgB,gBAAgB,CAC/B,MAAc,EACd,WAAmB,EACnB,YAAuB;IAEvB,MAAM,YAAY,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;IAE5C,4CAA4C;IAC5C,IAAI,YAAY,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7C,MAAM,WAAW,GAAG,YAAY,aAAZ,YAAY,cAAZ,YAAY,GAAI,WAAW,CAAC;QAChD,IAAI,CAAC,iBAAiB,CAAC,WAAW,EAAE,YAAY,CAAC,EAAE,CAAC;YACnD,OAAO;gBACN,KAAK,EAAE,KAAK;gBACZ,YAAY;gBACZ,WAAW;gBACX,KAAK,EAAE,cAAc,WAAW,oCAAoC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;aAC7F,CAAC;QACH,CAAC;IACF,CAAC;IAED,+EAA+E;IAC/E,IAAI,CAAC,YAAY,EAAE,CAAC;QACnB,OAAO;YACN,KAAK,EAAE,IAAI;YACX,YAAY,EAAE,IAAI;YAClB,WAAW;SACX,CAAC;IACH,CAAC;IAED,uEAAuE;IACvE,MAAM,UAAU,GAAG,sBAAsB,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC;IACrE,IAAI,CAAC,UAAU,EAAE,CAAC;QACjB,OAAO;YACN,KAAK,EAAE,KAAK;YACZ,YAAY;YACZ,WAAW;YACX,KAAK,EAAE,uBAAuB,YAAY,0BAA0B,WAAW,GAAG;SAClF,CAAC;IACH,CAAC;IAED,OAAO;QACN,KAAK,EAAE,IAAI;QACX,YAAY;QACZ,WAAW;KACX,CAAC;AACH,CAAC;AAED;;GAEG;AACH,SAAS,sBAAsB,CAAC,QAAgB,EAAE,OAAe;IAChE,cAAc;IACd,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;QAC1B,OAAO,IAAI,CAAC;IACb,CAAC;IAED,gDAAgD;IAChD,MAAM,CAAC,gBAAgB,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/C,MAAM,CAAC,eAAe,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC7C,IAAI,gBAAgB,KAAK,eAAe,EAAE,CAAC;QAC1C,OAAO,KAAK,CAAC;IACd,CAAC;IAED,0BAA0B;IAC1B,MAAM,UAAU,GAA6B;QAC5C,YAAY,EAAE,CAAC,WAAW,EAAE,aAAa,CAAC;QAC1C,YAAY,EAAE,CAAC,cAAc,CAAC;QAC9B,kBAAkB,EAAE,CAAC,WAAW,CAAC;QACjC,wBAAwB,EAAE,CAAC,iBAAiB,EAAE,0BAA0B,CAAC;KACzE,CAAC;IAEF,MAAM,iBAAiB,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;IAC/C,IAAI,iBAAiB,IAAI,iBAAiB,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QAC9D,OAAO,IAAI,CAAC;IACb,CAAC;IAED,gBAAgB;IAChB,KAAK,MAAM,CAAC,SAAS,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;QAChE,IAAI,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,SAAS,KAAK,OAAO,IAAI,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;YAC1F,OAAO,IAAI,CAAC;QACb,CAAC;IACF,CAAC;IAED,OAAO,KAAK,CAAC;AACd,CAAC"}

package/src/lib/storage-local.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Local Filesystem Storage Adapter
+ * Stores files on the local filesystem
+ */
+import type { StorageAdapter } from '@momentumcms/core';
+import type { LocalStorageOptions } from './storage.types';
+/**
+ * Creates a local filesystem storage adapter.
+ *
+ * @example
+ * ```typescript
+ * const storage = localStorageAdapter({
+ *   directory: './uploads',
+ *   baseUrl: 'http://localhost:4200/uploads'
+ * });
+ * ```
+ */
+export declare function localStorageAdapter(options: LocalStorageOptions): StorageAdapter;

package/src/lib/storage-local.js

@@ -0,0 +1,132 @@
+"use strict";
+/**
+ * Local Filesystem Storage Adapter
+ * Stores files on the local filesystem
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.localStorageAdapter = localStorageAdapter;
+const tslib_1 = require("tslib");
+const node_fs_1 = require("node:fs");
+const node_path_1 = require("node:path");
+const node_crypto_1 = require("node:crypto");
+/**
+ * Creates a local filesystem storage adapter.
+ *
+ * @example
+ * ```typescript
+ * const storage = localStorageAdapter({
+ *   directory: './uploads',
+ *   baseUrl: 'http://localhost:4200/uploads'
+ * });
+ * ```
+ */
+function localStorageAdapter(options) {
+    const { directory, baseUrl } = options;
+    const resolvedRoot = (0, node_path_1.resolve)(directory);
+    // Ensure the upload directory exists
+    if (!(0, node_fs_1.existsSync)(resolvedRoot)) {
+        (0, node_fs_1.mkdirSync)(resolvedRoot, { recursive: true });
+    }
+    /**
+     * Sanitize a path to prevent directory traversal attacks.
+     * Resolves the path relative to the upload root and verifies it stays within bounds.
+     */
+    function safePath(unsafePath) {
+        const normalized = (0, node_path_1.normalize)(unsafePath).replace(/^(\.\.(\/|\\|$))+/, '');
+        const full = (0, node_path_1.resolve)(resolvedRoot, normalized);
+        if (!full.startsWith(resolvedRoot)) {
+            throw new Error('Invalid path: directory traversal not allowed');
+        }
+        // Reject symlinks to prevent escape via symlink chains
+        if ((0, node_fs_1.existsSync)(full) && (0, node_fs_1.lstatSync)(full).isSymbolicLink()) {
+            throw new Error('Invalid path: symbolic links not allowed');
+        }
+        return full;
+    }
+    return {
+        upload(file, uploadOptions) {
+            return tslib_1.__awaiter(this, void 0, void 0, function* () {
+                var _a;
+                // Generate unique filename
+                const ext = (0, node_path_1.extname)(file.originalName) || getExtensionFromMimeType(file.mimeType);
+                const filename = (uploadOptions === null || uploadOptions === void 0 ? void 0 : uploadOptions.filename)
+                    ? `${uploadOptions.filename}${ext}`
+                    : `${(0, node_crypto_1.randomUUID)()}${ext}`;
+                // Determine subdirectory (sanitized)
+                const subdir = (_a = uploadOptions === null || uploadOptions === void 0 ? void 0 : uploadOptions.directory) !== null && _a !== void 0 ? _a : '';
+                const targetDir = subdir ? safePath(subdir) : resolvedRoot;
+                // Ensure subdirectory exists
+                if (subdir && !(0, node_fs_1.existsSync)(targetDir)) {
+                    (0, node_fs_1.mkdirSync)(targetDir, { recursive: true });
+                }
+                // Write file to disk (validate full path)
+                const filePath = safePath(subdir ? (0, node_path_1.join)(subdir, filename) : filename);
+                const relativePath = subdir ? (0, node_path_1.join)((0, node_path_1.normalize)(subdir), filename) : filename;
+                (0, node_fs_1.writeFileSync)(filePath, file.buffer);
+                // Generate URL
+                const url = baseUrl ? `${baseUrl}/${relativePath}` : `/api/media/file/${relativePath}`;
+                return {
+                    path: relativePath,
+                    url,
+                    filename,
+                    mimeType: file.mimeType,
+                    size: file.size,
+                };
+            });
+        },
+        delete(path) {
+            return tslib_1.__awaiter(this, void 0, void 0, function* () {
+                const filePath = safePath(path);
+                if ((0, node_fs_1.existsSync)(filePath)) {
+                    (0, node_fs_1.unlinkSync)(filePath);
+                    return true;
+                }
+                return false;
+            });
+        },
+        getUrl(path) {
+            return baseUrl ? `${baseUrl}/${path}` : `/api/media/file/${path}`;
+        },
+        exists(path) {
+            return tslib_1.__awaiter(this, void 0, void 0, function* () {
+                const filePath = safePath(path);
+                return (0, node_fs_1.existsSync)(filePath);
+            });
+        },
+        read(path) {
+            return tslib_1.__awaiter(this, void 0, void 0, function* () {
+                const filePath = safePath(path);
+                if ((0, node_fs_1.existsSync)(filePath)) {
+                    return (0, node_fs_1.readFileSync)(filePath);
+                }
+                return null;
+            });
+        },
+    };
+}
+/**
+ * Get file extension from MIME type.
+ */
+function getExtensionFromMimeType(mimeType) {
+    var _a;
+    const mimeToExt = {
+        'image/jpeg': '.jpg',
+        'image/png': '.png',
+        'image/gif': '.gif',
+        'image/webp': '.webp',
+        'image/svg+xml': '.svg',
+        'application/pdf': '.pdf',
+        'application/json': '.json',
+        'text/plain': '.txt',
+        'text/html': '.html',
+        'text/css': '.css',
+        'application/javascript': '.js',
+        'video/mp4': '.mp4',
+        'video/webm': '.webm',
+        'audio/mpeg': '.mp3',
+        'audio/wav': '.wav',
+        'application/zip': '.zip',
+    };
+    return (_a = mimeToExt[mimeType]) !== null && _a !== void 0 ? _a : '';
+}
+//# sourceMappingURL=storage-local.js.map

package/src/lib/storage-local.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"storage-local.js","sourceRoot":"","sources":["../../../../../libs/storage/src/lib/storage-local.ts"],"names":[],"mappings":";AAAA;;;GAGG;;AAmBH,kDAsFC;;AAvGD,qCAAoG;AACpG,yCAA8D;AAC9D,6CAAyC;AAIzC;;;;;;;;;;GAUG;AACH,SAAgB,mBAAmB,CAAC,OAA4B;IAC/D,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;IACvC,MAAM,YAAY,GAAG,IAAA,mBAAO,EAAC,SAAS,CAAC,CAAC;IAExC,qCAAqC;IACrC,IAAI,CAAC,IAAA,oBAAU,EAAC,YAAY,CAAC,EAAE,CAAC;QAC/B,IAAA,mBAAS,EAAC,YAAY,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9C,CAAC;IAED;;;OAGG;IACH,SAAS,QAAQ,CAAC,UAAkB;QACnC,MAAM,UAAU,GAAG,IAAA,qBAAS,EAAC,UAAU,CAAC,CAAC,OAAO,CAAC,mBAAmB,EAAE,EAAE,CAAC,CAAC;QAC1E,MAAM,IAAI,GAAG,IAAA,mBAAO,EAAC,YAAY,EAAE,UAAU,CAAC,CAAC;QAC/C,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;YACpC,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;QAClE,CAAC;QACD,uDAAuD;QACvD,IAAI,IAAA,oBAAU,EAAC,IAAI,CAAC,IAAI,IAAA,mBAAS,EAAC,IAAI,CAAC,CAAC,cAAc,EAAE,EAAE,CAAC;YAC1D,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;QAC7D,CAAC;QACD,OAAO,IAAI,CAAC;IACb,CAAC;IAED,OAAO;QACA,MAAM,CAAC,IAAkB,EAAE,aAA6B;;;gBAC7D,2BAA2B;gBAC3B,MAAM,GAAG,GAAG,IAAA,mBAAO,EAAC,IAAI,CAAC,YAAY,CAAC,IAAI,wBAAwB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;gBAClF,MAAM,QAAQ,GAAG,CAAA,aAAa,aAAb,aAAa,uBAAb,aAAa,CAAE,QAAQ;oBACvC,CAAC,CAAC,GAAG,aAAa,CAAC,QAAQ,GAAG,GAAG,EAAE;oBACnC,CAAC,CAAC,GAAG,IAAA,wBAAU,GAAE,GAAG,GAAG,EAAE,CAAC;gBAE3B,qCAAqC;gBACrC,MAAM,MAAM,GAAG,MAAA,aAAa,aAAb,aAAa,uBAAb,aAAa,CAAE,SAAS,mCAAI,EAAE,CAAC;gBAC9C,MAAM,SAAS,GAAG,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC;gBAE3D,6BAA6B;gBAC7B,IAAI,MAAM,IAAI,CAAC,IAAA,oBAAU,EAAC,SAAS,CAAC,EAAE,CAAC;oBACtC,IAAA,mBAAS,EAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;gBAC3C,CAAC;gBAED,0CAA0C;gBAC1C,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,IAAA,gBAAI,EAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;gBACtE,MAAM,YAAY,GAAG,MAAM,CAAC,CAAC,CAAC,IAAA,gBAAI,EAAC,IAAA,qBAAS,EAAC,MAAM,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;gBAC3E,IAAA,uBAAa,EAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;gBAErC,eAAe;gBACf,MAAM,GAAG,GAAG,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,IAAI,YAAY,EAAE,CAAC,CAAC,CAAC,mBAAmB,YAAY,EAAE,CAAC;gBAEvF,OAAO;oBACN,IAAI,EAAE,YAAY;oBAClB,GAAG;oBACH,QAAQ;oBACR,QAAQ,EAAE,IAAI,CAAC,QAAQ;oBACvB,IAAI,EAAE,IAAI,CAAC,IAAI;iBACf,CAAC;YACH,CAAC;SAAA;QAEK,MAAM,CAAC,IAAY;;gBACxB,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;gBAChC,IAAI,IAAA,oBAAU,EAAC,QAAQ,CAAC,EAAE,CAAC;oBAC1B,IAAA,oBAAU,EAAC,QAAQ,CAAC,CAAC;oBACrB,OAAO,IAAI,CAAC;gBACb,CAAC;gBACD,OAAO,KAAK,CAAC;YACd,CAAC;SAAA;QAED,MAAM,CAAC,IAAY;YAClB,OAAO,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,mBAAmB,IAAI,EAAE,CAAC;QACnE,CAAC;QAEK,MAAM,CAAC,IAAY;;gBACxB,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;gBAChC,OAAO,IAAA,oBAAU,EAAC,QAAQ,CAAC,CAAC;YAC7B,CAAC;SAAA;QAEK,IAAI,CAAC,IAAY;;gBACtB,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;gBAChC,IAAI,IAAA,oBAAU,EAAC,QAAQ,CAAC,EAAE,CAAC;oBAC1B,OAAO,IAAA,sBAAY,EAAC,QAAQ,CAAC,CAAC;gBAC/B,CAAC;gBACD,OAAO,IAAI,CAAC;YACb,CAAC;SAAA;KACD,CAAC;AACH,CAAC;AAED;;GAEG;AACH,SAAS,wBAAwB,CAAC,QAAgB;;IACjD,MAAM,SAAS,GAA2B;QACzC,YAAY,EAAE,MAAM;QACpB,WAAW,EAAE,MAAM;QACnB,WAAW,EAAE,MAAM;QACnB,YAAY,EAAE,OAAO;QACrB,eAAe,EAAE,MAAM;QACvB,iBAAiB,EAAE,MAAM;QACzB,kBAAkB,EAAE,OAAO;QAC3B,YAAY,EAAE,MAAM;QACpB,WAAW,EAAE,OAAO;QACpB,UAAU,EAAE,MAAM;QAClB,wBAAwB,EAAE,KAAK;QAC/B,WAAW,EAAE,MAAM;QACnB,YAAY,EAAE,OAAO;QACrB,YAAY,EAAE,MAAM;QACpB,WAAW,EAAE,MAAM;QACnB,iBAAiB,EAAE,MAAM;KACzB,CAAC;IAEF,OAAO,MAAA,SAAS,CAAC,QAAQ,CAAC,mCAAI,EAAE,CAAC;AAClC,CAAC"}

package/src/lib/storage-s3.d.ts

@@ -0,0 +1,27 @@
+/**
+ * S3-compatible Storage Adapter
+ * Stores files in Amazon S3 or compatible services (MinIO, DigitalOcean Spaces, etc.)
+ */
+import type { StorageAdapter } from '@momentumcms/core';
+import type { S3StorageOptions } from './storage.types';
+/**
+ * Creates an S3-compatible storage adapter.
+ *
+ * @example
+ * ```typescript
+ * // Amazon S3
+ * const storage = s3StorageAdapter({
+ *   bucket: 'my-bucket',
+ *   region: 'us-east-1',
+ * });
+ *
+ * // MinIO
+ * const storage = s3StorageAdapter({
+ *   bucket: 'my-bucket',
+ *   region: 'us-east-1',
+ *   endpoint: 'http://localhost:9000',
+ *   forcePathStyle: true,
+ * });
+ * ```
+ */
+export declare function s3StorageAdapter(options: S3StorageOptions): StorageAdapter;

package/src/lib/storage-s3.js

@@ -0,0 +1,235 @@
+"use strict";
+/**
+ * S3-compatible Storage Adapter
+ * Stores files in Amazon S3 or compatible services (MinIO, DigitalOcean Spaces, etc.)
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.s3StorageAdapter = s3StorageAdapter;
+const tslib_1 = require("tslib");
+const node_crypto_1 = require("node:crypto");
+const node_path_1 = require("node:path");
+// Dynamic import for AWS SDK to avoid bundling issues
+let S3Client;
+let PutObjectCommand;
+let DeleteObjectCommand;
+let HeadObjectCommand;
+let GetObjectCommand;
+let getSignedUrl;
+/**
+ * Load AWS SDK modules dynamically.
+ */
+function loadAwsSdk() {
+    return tslib_1.__awaiter(this, void 0, void 0, function* () {
+        if (S3Client)
+            return;
+        const s3Module = yield Promise.resolve().then(() => require('@aws-sdk/client-s3'));
+        const presignerModule = yield Promise.resolve().then(() => require('@aws-sdk/s3-request-presigner'));
+        S3Client = s3Module.S3Client;
+        PutObjectCommand = s3Module.PutObjectCommand;
+        DeleteObjectCommand = s3Module.DeleteObjectCommand;
+        HeadObjectCommand = s3Module.HeadObjectCommand;
+        GetObjectCommand = s3Module.GetObjectCommand;
+        getSignedUrl = presignerModule.getSignedUrl;
+    });
+}
+/**
+ * Creates an S3-compatible storage adapter.
+ *
+ * @example
+ * ```typescript
+ * // Amazon S3
+ * const storage = s3StorageAdapter({
+ *   bucket: 'my-bucket',
+ *   region: 'us-east-1',
+ * });
+ *
+ * // MinIO
+ * const storage = s3StorageAdapter({
+ *   bucket: 'my-bucket',
+ *   region: 'us-east-1',
+ *   endpoint: 'http://localhost:9000',
+ *   forcePathStyle: true,
+ * });
+ * ```
+ */
+function s3StorageAdapter(options) {
+    const { bucket, region, accessKeyId, secretAccessKey, endpoint, baseUrl, forcePathStyle = false, acl = 'private', presignedUrlExpiry = 3600, } = options;
+    // Lazy-initialized S3 client
+    let client = null;
+    function getClient() {
+        return tslib_1.__awaiter(this, void 0, void 0, function* () {
+            yield loadAwsSdk();
+            if (!client) {
+                const clientConfig = {
+                    region,
+                    forcePathStyle,
+                };
+                if (endpoint) {
+                    clientConfig.endpoint = endpoint;
+                }
+                if (accessKeyId && secretAccessKey) {
+                    clientConfig.credentials = {
+                        accessKeyId,
+                        secretAccessKey,
+                    };
+                }
+                client = new S3Client(clientConfig);
+            }
+            return client;
+        });
+    }
+    /**
+     * Get the public URL for a file.
+     */
+    function getPublicUrl(key) {
+        if (baseUrl) {
+            return `${baseUrl}/${key}`;
+        }
+        if (endpoint) {
+            return `${endpoint}/${bucket}/${key}`;
+        }
+        return `https://${bucket}.s3.${region}.amazonaws.com/${key}`;
+    }
+    return {
+        upload(file, uploadOptions) {
+            return tslib_1.__awaiter(this, void 0, void 0, function* () {
+                const s3 = yield getClient();
+                // Generate unique key
+                const ext = (0, node_path_1.extname)(file.originalName) || getExtensionFromMimeType(file.mimeType);
+                const filename = (uploadOptions === null || uploadOptions === void 0 ? void 0 : uploadOptions.filename)
+                    ? `${uploadOptions.filename}${ext}`
+                    : `${(0, node_crypto_1.randomUUID)()}${ext}`;
+                // Build the S3 key
+                const key = (uploadOptions === null || uploadOptions === void 0 ? void 0 : uploadOptions.directory) ? `${uploadOptions.directory}/${filename}` : filename;
+                // Upload to S3
+                yield s3.send(new PutObjectCommand({
+                    Bucket: bucket,
+                    Key: key,
+                    Body: file.buffer,
+                    ContentType: file.mimeType,
+                    ACL: acl,
+                }));
+                return {
+                    path: key,
+                    url: acl === 'public-read' ? getPublicUrl(key) : `/api/media/file/${key}`,
+                    filename,
+                    mimeType: file.mimeType,
+                    size: file.size,
+                };
+            });
+        },
+        delete(path) {
+            return tslib_1.__awaiter(this, void 0, void 0, function* () {
+                const s3 = yield getClient();
+                try {
+                    yield s3.send(new DeleteObjectCommand({
+                        Bucket: bucket,
+                        Key: path,
+                    }));
+                    return true;
+                }
+                catch (_a) {
+                    return false;
+                }
+            });
+        },
+        getUrl(path) {
+            if (acl === 'public-read') {
+                return getPublicUrl(path);
+            }
+            return `/api/media/file/${path}`;
+        },
+        exists(path) {
+            return tslib_1.__awaiter(this, void 0, void 0, function* () {
+                const s3 = yield getClient();
+                try {
+                    yield s3.send(new HeadObjectCommand({
+                        Bucket: bucket,
+                        Key: path,
+                    }));
+                    return true;
+                }
+                catch (_a) {
+                    return false;
+                }
+            });
+        },
+        getSignedUrl(path, expiresIn) {
+            return tslib_1.__awaiter(this, void 0, void 0, function* () {
+                const s3 = yield getClient();
+                yield loadAwsSdk();
+                const command = new GetObjectCommand({
+                    Bucket: bucket,
+                    Key: path,
+                });
+                return getSignedUrl(s3, command, {
+                    expiresIn: expiresIn !== null && expiresIn !== void 0 ? expiresIn : presignedUrlExpiry,
+                });
+            });
+        },
+        read(path) {
+            return tslib_1.__awaiter(this, void 0, void 0, function* () {
+                var _a, e_1, _b, _c;
+                const s3 = yield getClient();
+                try {
+                    const response = yield s3.send(new GetObjectCommand({
+                        Bucket: bucket,
+                        Key: path,
+                    }));
+                    if (!response.Body) {
+                        return null;
+                    }
+                    // Convert stream to buffer
+                    const chunks = [];
+                    // eslint-disable-next-line @typescript-eslint/consistent-type-assertions -- AWS SDK Body type needs cast to iterate
+                    const body = response.Body;
+                    try {
+                        for (var _d = true, body_1 = tslib_1.__asyncValues(body), body_1_1; body_1_1 = yield body_1.next(), _a = body_1_1.done, !_a; _d = true) {
+                            _c = body_1_1.value;
+                            _d = false;
+                            const chunk = _c;
+                            chunks.push(chunk);
+                        }
+                    }
+                    catch (e_1_1) { e_1 = { error: e_1_1 }; }
+                    finally {
+                        try {
+                            if (!_d && !_a && (_b = body_1.return)) yield _b.call(body_1);
+                        }
+                        finally { if (e_1) throw e_1.error; }
+                    }
+                    return Buffer.concat(chunks);
+                }
+                catch (_e) {
+                    return null;
+                }
+            });
+        },
+    };
+}
+/**
+ * Get file extension from MIME type.
+ */
+function getExtensionFromMimeType(mimeType) {
+    var _a;
+    const mimeToExt = {
+        'image/jpeg': '.jpg',
+        'image/png': '.png',
+        'image/gif': '.gif',
+        'image/webp': '.webp',
+        'image/svg+xml': '.svg',
+        'application/pdf': '.pdf',
+        'application/json': '.json',
+        'text/plain': '.txt',
+        'text/html': '.html',
+        'text/css': '.css',
+        'application/javascript': '.js',
+        'video/mp4': '.mp4',
+        'video/webm': '.webm',
+        'audio/mpeg': '.mp3',
+        'audio/wav': '.wav',
+        'application/zip': '.zip',
+    };
+    return (_a = mimeToExt[mimeType]) !== null && _a !== void 0 ? _a : '';
+}
+//# sourceMappingURL=storage-s3.js.map

package/src/lib/storage-s3.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"storage-s3.js","sourceRoot":"","sources":["../../../../../libs/storage/src/lib/storage-s3.ts"],"names":[],"mappings":";AAAA;;;GAGG;;AAoDH,4CAyKC;;AA3ND,6CAAyC;AACzC,yCAAoC;AAIpC,sDAAsD;AACtD,IAAI,QAAsD,CAAC;AAC3D,IAAI,gBAAsE,CAAC;AAC3E,IAAI,mBAA4E,CAAC;AACjF,IAAI,iBAAwE,CAAC;AAC7E,IAAI,gBAAsE,CAAC;AAC3E,IAAI,YAAyE,CAAC;AAE9E;;GAEG;AACH,SAAe,UAAU;;QACxB,IAAI,QAAQ;YAAE,OAAO;QAErB,MAAM,QAAQ,GAAG,2CAAa,oBAAoB,EAAC,CAAC;QACpD,MAAM,eAAe,GAAG,2CAAa,+BAA+B,EAAC,CAAC;QAEtE,QAAQ,GAAG,QAAQ,CAAC,QAAQ,CAAC;QAC7B,gBAAgB,GAAG,QAAQ,CAAC,gBAAgB,CAAC;QAC7C,mBAAmB,GAAG,QAAQ,CAAC,mBAAmB,CAAC;QACnD,iBAAiB,GAAG,QAAQ,CAAC,iBAAiB,CAAC;QAC/C,gBAAgB,GAAG,QAAQ,CAAC,gBAAgB,CAAC;QAC7C,YAAY,GAAG,eAAe,CAAC,YAAY,CAAC;IAC7C,CAAC;CAAA;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,SAAgB,gBAAgB,CAAC,OAAyB;IACzD,MAAM,EACL,MAAM,EACN,MAAM,EACN,WAAW,EACX,eAAe,EACf,QAAQ,EACR,OAAO,EACP,cAAc,GAAG,KAAK,EACtB,GAAG,GAAG,SAAS,EACf,kBAAkB,GAAG,IAAI,GACzB,GAAG,OAAO,CAAC;IAEZ,6BAA6B;IAC7B,IAAI,MAAM,GAAyC,IAAI,CAAC;IAExD,SAAe,SAAS;;YACvB,MAAM,UAAU,EAAE,CAAC;YAEnB,IAAI,CAAC,MAAM,EAAE,CAAC;gBACb,MAAM,YAAY,GAA8C;oBAC/D,MAAM;oBACN,cAAc;iBACd,CAAC;gBAEF,IAAI,QAAQ,EAAE,CAAC;oBACd,YAAY,CAAC,QAAQ,GAAG,QAAQ,CAAC;gBAClC,CAAC;gBAED,IAAI,WAAW,IAAI,eAAe,EAAE,CAAC;oBACpC,YAAY,CAAC,WAAW,GAAG;wBAC1B,WAAW;wBACX,eAAe;qBACf,CAAC;gBACH,CAAC;gBAED,MAAM,GAAG,IAAI,QAAQ,CAAC,YAAY,CAAC,CAAC;YACrC,CAAC;YAED,OAAO,MAAM,CAAC;QACf,CAAC;KAAA;IAED;;OAEG;IACH,SAAS,YAAY,CAAC,GAAW;QAChC,IAAI,OAAO,EAAE,CAAC;YACb,OAAO,GAAG,OAAO,IAAI,GAAG,EAAE,CAAC;QAC5B,CAAC;QACD,IAAI,QAAQ,EAAE,CAAC;YACd,OAAO,GAAG,QAAQ,IAAI,MAAM,IAAI,GAAG,EAAE,CAAC;QACvC,CAAC;QACD,OAAO,WAAW,MAAM,OAAO,MAAM,kBAAkB,GAAG,EAAE,CAAC;IAC9D,CAAC;IAED,OAAO;QACA,MAAM,CAAC,IAAkB,EAAE,aAA6B;;gBAC7D,MAAM,EAAE,GAAG,MAAM,SAAS,EAAE,CAAC;gBAE7B,sBAAsB;gBACtB,MAAM,GAAG,GAAG,IAAA,mBAAO,EAAC,IAAI,CAAC,YAAY,CAAC,IAAI,wBAAwB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;gBAClF,MAAM,QAAQ,GAAG,CAAA,aAAa,aAAb,aAAa,uBAAb,aAAa,CAAE,QAAQ;oBACvC,CAAC,CAAC,GAAG,aAAa,CAAC,QAAQ,GAAG,GAAG,EAAE;oBACnC,CAAC,CAAC,GAAG,IAAA,wBAAU,GAAE,GAAG,GAAG,EAAE,CAAC;gBAE3B,mBAAmB;gBACnB,MAAM,GAAG,GAAG,CAAA,aAAa,aAAb,aAAa,uBAAb,aAAa,CAAE,SAAS,EAAC,CAAC,CAAC,GAAG,aAAa,CAAC,SAAS,IAAI,QAAQ,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC;gBAE3F,eAAe;gBACf,MAAM,EAAE,CAAC,IAAI,CACZ,IAAI,gBAAgB,CAAC;oBACpB,MAAM,EAAE,MAAM;oBACd,GAAG,EAAE,GAAG;oBACR,IAAI,EAAE,IAAI,CAAC,MAAM;oBACjB,WAAW,EAAE,IAAI,CAAC,QAAQ;oBAC1B,GAAG,EAAE,GAAG;iBACR,CAAC,CACF,CAAC;gBAEF,OAAO;oBACN,IAAI,EAAE,GAAG;oBACT,GAAG,EAAE,GAAG,KAAK,aAAa,CAAC,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,mBAAmB,GAAG,EAAE;oBACzE,QAAQ;oBACR,QAAQ,EAAE,IAAI,CAAC,QAAQ;oBACvB,IAAI,EAAE,IAAI,CAAC,IAAI;iBACf,CAAC;YACH,CAAC;SAAA;QAEK,MAAM,CAAC,IAAY;;gBACxB,MAAM,EAAE,GAAG,MAAM,SAAS,EAAE,CAAC;gBAE7B,IAAI,CAAC;oBACJ,MAAM,EAAE,CAAC,IAAI,CACZ,IAAI,mBAAmB,CAAC;wBACvB,MAAM,EAAE,MAAM;wBACd,GAAG,EAAE,IAAI;qBACT,CAAC,CACF,CAAC;oBACF,OAAO,IAAI,CAAC;gBACb,CAAC;gBAAC,WAAM,CAAC;oBACR,OAAO,KAAK,CAAC;gBACd,CAAC;YACF,CAAC;SAAA;QAED,MAAM,CAAC,IAAY;YAClB,IAAI,GAAG,KAAK,aAAa,EAAE,CAAC;gBAC3B,OAAO,YAAY,CAAC,IAAI,CAAC,CAAC;YAC3B,CAAC;YACD,OAAO,mBAAmB,IAAI,EAAE,CAAC;QAClC,CAAC;QAEK,MAAM,CAAC,IAAY;;gBACxB,MAAM,EAAE,GAAG,MAAM,SAAS,EAAE,CAAC;gBAE7B,IAAI,CAAC;oBACJ,MAAM,EAAE,CAAC,IAAI,CACZ,IAAI,iBAAiB,CAAC;wBACrB,MAAM,EAAE,MAAM;wBACd,GAAG,EAAE,IAAI;qBACT,CAAC,CACF,CAAC;oBACF,OAAO,IAAI,CAAC;gBACb,CAAC;gBAAC,WAAM,CAAC;oBACR,OAAO,KAAK,CAAC;gBACd,CAAC;YACF,CAAC;SAAA;QAEK,YAAY,CAAC,IAAY,EAAE,SAAkB;;gBAClD,MAAM,EAAE,GAAG,MAAM,SAAS,EAAE,CAAC;gBAC7B,MAAM,UAAU,EAAE,CAAC;gBAEnB,MAAM,OAAO,GAAG,IAAI,gBAAgB,CAAC;oBACpC,MAAM,EAAE,MAAM;oBACd,GAAG,EAAE,IAAI;iBACT,CAAC,CAAC;gBAEH,OAAO,YAAY,CAAC,EAAE,EAAE,OAAO,EAAE;oBAChC,SAAS,EAAE,SAAS,aAAT,SAAS,cAAT,SAAS,GAAI,kBAAkB;iBAC1C,CAAC,CAAC;YACJ,CAAC;SAAA;QAEK,IAAI,CAAC,IAAY;;;gBACtB,MAAM,EAAE,GAAG,MAAM,SAAS,EAAE,CAAC;gBAE7B,IAAI,CAAC;oBACJ,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,IAAI,CAC7B,IAAI,gBAAgB,CAAC;wBACpB,MAAM,EAAE,MAAM;wBACd,GAAG,EAAE,IAAI;qBACT,CAAC,CACF,CAAC;oBAEF,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;wBACpB,OAAO,IAAI,CAAC;oBACb,CAAC;oBAED,2BAA2B;oBAC3B,MAAM,MAAM,GAAiB,EAAE,CAAC;oBAChC,oHAAoH;oBACpH,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAiC,CAAC;;wBACxD,KAA0B,eAAA,SAAA,sBAAA,IAAI,CAAA,UAAA,sEAAE,CAAC;4BAAP,oBAAI;4BAAJ,WAAI;4BAAnB,MAAM,KAAK,KAAA,CAAA;4BACrB,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;wBACpB,CAAC;;;;;;;;;oBACD,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;gBAC9B,CAAC;gBAAC,WAAM,CAAC;oBACR,OAAO,IAAI,CAAC;gBACb,CAAC;YACF,CAAC;SAAA;KACD,CAAC;AACH,CAAC;AAED;;GAEG;AACH,SAAS,wBAAwB,CAAC,QAAgB;;IACjD,MAAM,SAAS,GAA2B;QACzC,YAAY,EAAE,MAAM;QACpB,WAAW,EAAE,MAAM;QACnB,WAAW,EAAE,MAAM;QACnB,YAAY,EAAE,OAAO;QACrB,eAAe,EAAE,MAAM;QACvB,iBAAiB,EAAE,MAAM;QACzB,kBAAkB,EAAE,OAAO;QAC3B,YAAY,EAAE,MAAM;QACpB,WAAW,EAAE,OAAO;QACpB,UAAU,EAAE,MAAM;QAClB,wBAAwB,EAAE,KAAK;QAC/B,WAAW,EAAE,MAAM;QACnB,YAAY,EAAE,OAAO;QACrB,YAAY,EAAE,MAAM;QACpB,WAAW,EAAE,MAAM;QACnB,iBAAiB,EAAE,MAAM;KACzB,CAAC;IAEF,OAAO,MAAA,SAAS,CAAC,QAAQ,CAAC,mCAAI,EAAE,CAAC;AAClC,CAAC"}

package/src/lib/storage.types.d.ts

@@ -0,0 +1,94 @@
+/**
+ * Storage Types for Momentum CMS
+ * Re-exports core storage interfaces and adds implementation-specific types
+ */
+export type { StorageAdapter, UploadedFile, StoredFile, UploadOptions } from '@momentumcms/core';
+/**
+ * Options for local filesystem storage adapter.
+ */
+export interface LocalStorageOptions {
+    /**
+     * Directory to store uploaded files.
+     * @default './uploads'
+     */
+    directory: string;
+    /**
+     * Base URL for serving files.
+     * If not provided, files will be served via the API.
+     * @example 'http://localhost:4200/uploads'
+     */
+    baseUrl?: string;
+}
+/**
+ * Options for S3-compatible storage adapter.
+ */
+export interface S3StorageOptions {
+    /**
+     * S3 bucket name.
+     */
+    bucket: string;
+    /**
+     * AWS region (e.g., 'us-east-1').
+     */
+    region: string;
+    /**
+     * AWS access key ID.
+     * Can also be set via AWS_ACCESS_KEY_ID environment variable.
+     */
+    accessKeyId?: string;
+    /**
+     * AWS secret access key.
+     * Can also be set via AWS_SECRET_ACCESS_KEY environment variable.
+     */
+    secretAccessKey?: string;
+    /**
+     * Custom endpoint URL for S3-compatible services (MinIO, DigitalOcean Spaces, etc.).
+     * @example 'http://localhost:9000' for MinIO
+     */
+    endpoint?: string;
+    /**
+     * Base URL for public file access.
+     * If not provided, uses standard S3 URL format or generates presigned URLs.
+     */
+    baseUrl?: string;
+    /**
+     * Force path-style URLs instead of virtual-hosted style.
+     * Required for some S3-compatible services like MinIO.
+     * @default false
+     */
+    forcePathStyle?: boolean;
+    /**
+     * Default ACL for uploaded files.
+     * @default 'private'
+     */
+    acl?: 'private' | 'public-read' | 'public-read-write' | 'authenticated-read';
+    /**
+     * Default expiration time for presigned URLs in seconds.
+     * @default 3600 (1 hour)
+     */
+    presignedUrlExpiry?: number;
+}
+/**
+ * MIME type validation result.
+ */
+export interface MimeValidationResult {
+    /** Whether the file is valid */
+    valid: boolean;
+    /** Detected MIME type from file signature */
+    detectedType: string | null;
+    /** Claimed MIME type from upload */
+    claimedType: string;
+    /** Error message if invalid */
+    error?: string;
+}
+/**
+ * File signature (magic bytes) for MIME type detection.
+ */
+export interface FileSignature {
+    /** MIME type this signature identifies */
+    mimeType: string;
+    /** Byte pattern to match */
+    bytes: number[];
+    /** Offset from start of file */
+    offset?: number;
+}

package/src/lib/storage.types.js

@@ -0,0 +1,7 @@
+"use strict";
+/**
+ * Storage Types for Momentum CMS
+ * Re-exports core storage interfaces and adds implementation-specific types
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=storage.types.js.map

package/src/lib/storage.types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"storage.types.js","sourceRoot":"","sources":["../../../../../libs/storage/src/lib/storage.types.ts"],"names":[],"mappings":";AAAA;;;GAGG"}