@plumix/plugin-media 0.1.0

package/dist/rpc.js

@@ -0,0 +1,352 @@
+import { and, authenticated, base, entries, eq, withBasePath, } from "plumix/plugin";
+import * as v from "valibot";
+import { DIMENSION_SAMPLE_SIZE, readImageDimensions, } from "./image-dimensions.js";
+import { looksLikeMime, MAGIC_BYTE_SAMPLE_SIZE } from "./magic-bytes.js";
+import { parseMediaMeta } from "./meta.js";
+import { extensionForMime } from "./mime.js";
+import { listMedia, MEDIA_ENTRY_TYPE, mediaListInputSchema, MediaReadError, resolveMediaUrl, thumbnailFor, } from "./read-service.js";
+// Reject control characters and whitespace. Browsers send a bare
+// `Content-Type: image/png` (no space, no parameters) when uploading
+// a File via XHR; anything else here is a sign of a malformed client.
+const CONTENT_TYPE_RE = /^[\x21-\x7E]+$/;
+/**
+ * Load a media-entry row and verify the caller is either the owner or
+ * holds the supplied capability. Used by `update` and `remove`, which
+ * share the same load + ownership pattern but differ on the capability
+ * a non-owner needs.
+ */
+async function loadOwnedMediaRow(context, id, options) {
+    const { capability, errors } = options;
+    const notFound = () => errors.NOT_FOUND({ data: { kind: "media", id } });
+    const [row] = await context.db
+        .select()
+        .from(entries)
+        .where(eq(entries.id, id))
+        .limit(1);
+    if (row?.type !== MEDIA_ENTRY_TYPE)
+        throw notFound();
+    const isOwner = row.authorId === context.user.id;
+    if (!isOwner && !context.auth.can(capability)) {
+        throw errors.FORBIDDEN({ data: { capability } });
+    }
+    return row;
+}
+export function createMediaRouter(options) {
+    const acceptedTypeSet = new Set(options.acceptedTypes);
+    // Capability gating already keeps `entry:media:create` to the
+    // contributor+ tier (`registerEntryType` derives it). For at-scale
+    // deployments add a per-user quota or rate limit on this procedure —
+    // a single contributor can otherwise mint as many presigned URLs as
+    // they like and fill the bucket. Tracked as follow-up work; the
+    // server-side draft GC + KV-backed counter belong here.
+    const createUploadUrl = base
+        .use(authenticated)
+        .input(v.object({
+        filename: v.pipe(v.string(), v.minLength(1), v.maxLength(255)),
+        contentType: v.pipe(v.string(), v.minLength(1), v.maxLength(255), v.regex(CONTENT_TYPE_RE)),
+        size: v.pipe(v.number(), v.integer(), v.minValue(0)),
+    }))
+        .handler(async ({ input, context, errors }) => {
+        if (!context.auth.can("entry:media:create")) {
+            throw errors.FORBIDDEN({
+                data: { capability: "entry:media:create" },
+            });
+        }
+        if (input.size > options.maxUploadSize) {
+            throw errors.PAYLOAD_TOO_LARGE({
+                data: { limit: options.maxUploadSize, received: input.size },
+            });
+        }
+        // Normalize once at the entry point: strip parameters
+        // (`; charset=utf-8`), lowercase. We compare against the
+        // bare-mime allowlist; the worker-route's content-type check
+        // also splits on `;`, so storing the bare form keeps both
+        // sides in agreement.
+        const normalizedMime = normalizeMime(input.contentType);
+        if (!acceptedTypeSet.has(normalizedMime)) {
+            throw errors.UNSUPPORTED_MEDIA_TYPE({
+                data: { mime: normalizedMime },
+            });
+        }
+        const storage = context.storage;
+        if (!storage) {
+            throw errors.CONFLICT({ data: { reason: "storage_not_configured" } });
+        }
+        const id = crypto.randomUUID();
+        const ext = sanitizeExtension(input.filename) ?? extensionForMime(normalizedMime);
+        const datePrefix = new Date()
+            .toISOString()
+            .slice(0, 7)
+            .replace("-", "/");
+        const storageKey = ext === undefined
+            ? `${datePrefix}/${id}`
+            : `${datePrefix}/${id}.${ext}`;
+        const [created] = await context.db
+            .insert(entries)
+            .values({
+            type: MEDIA_ENTRY_TYPE,
+            title: input.filename,
+            slug: id,
+            status: "draft",
+            authorId: context.user.id,
+            meta: {
+                mime: normalizedMime,
+                size: input.size,
+                originalName: input.filename,
+                storageKey,
+            },
+        })
+            .returning();
+        if (!created) {
+            throw errors.CONFLICT({ data: { reason: "db_insert_failed" } });
+        }
+        if (storage.presignPut) {
+            let presigned;
+            try {
+                presigned = await storage.presignPut(storageKey, {
+                    contentType: normalizedMime,
+                    maxBytes: input.size,
+                    // 60s is plenty for a same-page XHR PUT and tightens the
+                    // replay window if the URL leaks (logs, browser history).
+                    expiresIn: 60,
+                });
+            }
+            catch (error) {
+                await context.db.delete(entries).where(eq(entries.id, created.id));
+                throw error;
+            }
+            return {
+                uploadUrl: presigned.url,
+                method: presigned.method,
+                headers: presigned.headers,
+                mediaId: created.id,
+                storageKey,
+                expiresAt: presigned.expiresAt,
+            };
+        }
+        // Worker-routed fallback — when the runtime has the binding
+        // but no S3 credentials. Bytes flow through `env.MEDIA.put()`
+        // and the upload-route enforces the size cap on the actual
+        // stream, not just the Content-Length header.
+        return {
+            uploadUrl: withBasePath(`/_plumix/media/upload/${String(created.id)}`, context.basePath),
+            method: "PUT",
+            headers: { "content-type": normalizedMime },
+            mediaId: created.id,
+            storageKey,
+            expiresAt: Math.floor(Date.now() / 1000) + 60,
+        };
+    });
+    const confirm = base
+        .use(authenticated)
+        .input(v.object({ id: v.pipe(v.number(), v.integer(), v.minValue(1)) }))
+        .handler(async ({ input, context, errors }) => {
+        const notFound = () => errors.NOT_FOUND({ data: { kind: "media", id: input.id } });
+        const [row] = await context.db
+            .select()
+            .from(entries)
+            .where(eq(entries.id, input.id))
+            .limit(1);
+        if (row?.type !== MEDIA_ENTRY_TYPE)
+            throw notFound();
+        // Confirm is owner-only — `entry:media:edit_any` is for editing
+        // existing assets, not finalizing someone else's drafts. A
+        // non-owner shouldn't be able to publish another user's
+        // half-completed upload.
+        if (row.authorId !== context.user.id) {
+            throw errors.FORBIDDEN({
+                data: { capability: "entry:media:create" },
+            });
+        }
+        const meta = parseMediaMeta(row.meta);
+        if (!meta) {
+            throw errors.CONFLICT({ data: { reason: "media_meta_invalid" } });
+        }
+        const storage = context.storage;
+        if (!storage) {
+            throw errors.CONFLICT({ data: { reason: "storage_not_configured" } });
+        }
+        // Size check — bytes are not signed into the SigV4 query, so
+        // `meta.size` is just the client's claim at draft creation. Use
+        // head() to verify the actually-stored bytes don't exceed it.
+        const head = await storage.head(meta.storageKey);
+        if (!head) {
+            throw errors.CONFLICT({ data: { reason: "object_not_found" } });
+        }
+        if (head.size > meta.size) {
+            await storage.delete(meta.storageKey);
+            throw errors.PAYLOAD_TOO_LARGE({
+                data: { limit: meta.size, received: head.size },
+            });
+        }
+        // Verify the bytes match the claimed mime via magic-byte sniff.
+        // Delete on mismatch so an attacker can't force-leave junk in
+        // the bucket between a forged claim and our detection. The same
+        // sample feeds the dimension probe below, so read the larger of
+        // the two windows in one range request.
+        const sampleObj = await storage.get(meta.storageKey, {
+            range: {
+                offset: 0,
+                length: Math.max(MAGIC_BYTE_SAMPLE_SIZE, DIMENSION_SAMPLE_SIZE),
+            },
+        });
+        if (!sampleObj) {
+            throw errors.CONFLICT({ data: { reason: "object_not_found" } });
+        }
+        const sample = new Uint8Array(await sampleObj.arrayBuffer());
+        if (!looksLikeMime(sample, meta.mime)) {
+            await storage.delete(meta.storageKey);
+            throw errors.CONFLICT({ data: { reason: "mime_mismatch" } });
+        }
+        // Best-effort intrinsic dimensions — null for vector/unknown formats
+        // or a header we couldn't parse. Never blocks the confirm.
+        const dimensions = readImageDimensions(sample, meta.mime);
+        const dims = {
+            width: dimensions?.width ?? null,
+            height: dimensions?.height ?? null,
+        };
+        // CAS the draft → published transition: the WHERE clause
+        // includes `status = 'draft'`. Two concurrent confirms on the
+        // same draft will race the sniff but exactly one will flip the
+        // row; the loser sees `already_confirmed` instead of double-
+        // publishing or stomping `publishedAt`.
+        const [published] = await context.db
+            .update(entries)
+            .set({
+            status: "published",
+            publishedAt: new Date(),
+            meta: { ...meta, ...dims },
+        })
+            .where(and(eq(entries.id, input.id), eq(entries.status, "draft")))
+            .returning();
+        if (!published) {
+            throw errors.CONFLICT({ data: { reason: "already_confirmed" } });
+        }
+        const url = await resolveMediaUrl(storage, meta.storageKey, published.id, context.basePath);
+        return {
+            id: published.id,
+            url,
+            thumbnailUrl: thumbnailFor(context, url, meta.mime),
+            storageKey: meta.storageKey,
+            mime: meta.mime,
+            size: meta.size,
+            ...dims,
+        };
+    });
+    const list = base
+        .use(authenticated)
+        .input(mediaListInputSchema)
+        .handler(async ({ input, context, errors }) => {
+        try {
+            return await listMedia(context, input);
+        }
+        catch (error) {
+            throw mapMediaReadError(error, errors);
+        }
+    });
+    const update = base
+        .use(authenticated)
+        .input(v.object({
+        id: v.pipe(v.number(), v.integer(), v.minValue(1)),
+        title: v.optional(v.pipe(v.string(), v.minLength(1), v.maxLength(255))),
+        alt: v.optional(v.pipe(v.string(), v.maxLength(1024))),
+    }))
+        .handler(async ({ input, context, errors }) => {
+        const notFound = () => errors.NOT_FOUND({ data: { kind: "media", id: input.id } });
+        const row = await loadOwnedMediaRow(context, input.id, {
+            capability: "entry:media:edit_any",
+            errors,
+        });
+        const meta = parseMediaMeta(row.meta);
+        if (!meta) {
+            throw errors.CONFLICT({ data: { reason: "media_meta_invalid" } });
+        }
+        const nextMeta = {
+            ...meta,
+            alt: input.alt ?? meta.alt,
+        };
+        const [updated] = await context.db
+            .update(entries)
+            .set({
+            title: input.title ?? row.title,
+            meta: nextMeta,
+        })
+            .where(eq(entries.id, input.id))
+            .returning();
+        if (!updated)
+            throw notFound();
+        return {
+            id: updated.id,
+            title: updated.title,
+            alt: nextMeta.alt,
+        };
+    });
+    const remove = base
+        .use(authenticated)
+        .input(v.object({ id: v.pipe(v.number(), v.integer(), v.minValue(1)) }))
+        .handler(async ({ input, context, errors }) => {
+        const notFound = () => errors.NOT_FOUND({ data: { kind: "media", id: input.id } });
+        const row = await loadOwnedMediaRow(context, input.id, {
+            capability: "entry:media:delete",
+            errors,
+        });
+        // Delete the row first, then the bytes. If the storage delete
+        // fails we'd rather leave an orphan in the bucket (admin can
+        // sweep) than a row pointing at a deleted file (which would
+        // surface as a permanent broken card). DB delete is the
+        // authoritative state.
+        const [deleted] = await context.db
+            .delete(entries)
+            .where(eq(entries.id, input.id))
+            .returning();
+        if (!deleted)
+            throw notFound();
+        const meta = parseMediaMeta(row.meta);
+        if (meta && context.storage) {
+            try {
+                await context.storage.delete(meta.storageKey);
+            }
+            catch (error) {
+                context.logger.warn("media_delete_storage_failed", {
+                    error,
+                    id: row.id,
+                    storageKey: meta.storageKey,
+                });
+            }
+        }
+        return { id: deleted.id };
+    });
+    return { createUploadUrl, confirm, list, update, delete: remove };
+}
+// Map a media-read domain error to the oRPC typed error to throw; non-domain
+// errors pass through for the caller to rethrow.
+function mapMediaReadError(error, errors) {
+    if (!(error instanceof MediaReadError))
+        return error;
+    switch (error.data.code) {
+        case "forbidden":
+            return errors.FORBIDDEN({ data: { capability: error.data.capability } });
+        case "not_found":
+            return errors.NOT_FOUND({ data: { kind: "media", id: error.data.id } });
+    }
+}
+function normalizeMime(raw) {
+    const semi = raw.indexOf(";");
+    return (semi === -1 ? raw : raw.slice(0, semi)).trim().toLowerCase();
+}
+const SAFE_EXT_RE = /^[a-z0-9]+$/;
+const MAX_EXT_LEN = 10;
+function sanitizeExtension(filename) {
+    const lastDot = filename.lastIndexOf(".");
+    // `lastDot === 0` means the name starts with a dot (`.bashrc`) — that's
+    // a dotfile, not a `name.ext` shape. Treat as no extension.
+    if (lastDot <= 0 || lastDot === filename.length - 1)
+        return undefined;
+    const ext = filename.slice(lastDot + 1).toLowerCase();
+    if (ext.length > MAX_EXT_LEN)
+        return undefined;
+    if (!SAFE_EXT_RE.test(ext))
+        return undefined;
+    return ext;
+}
+//# sourceMappingURL=rpc.js.map

package/dist/rpc.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rpc.js","sourceRoot":"","sources":["../src/rpc.ts"],"names":[],"mappings":"AACA,OAAO,EACL,GAAG,EACH,aAAa,EACb,IAAI,EACJ,OAAO,EACP,EAAE,EACF,YAAY,GACb,MAAM,eAAe,CAAC;AACvB,OAAO,KAAK,CAAC,MAAM,SAAS,CAAC;AAE7B,OAAO,EACL,qBAAqB,EACrB,mBAAmB,GACpB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,aAAa,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AACzE,OAAO,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAC3C,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EACL,SAAS,EACT,gBAAgB,EAChB,oBAAoB,EACpB,cAAc,EACd,eAAe,EACf,YAAY,GACb,MAAM,mBAAmB,CAAC;AAqC3B,iEAAiE;AACjE,qEAAqE;AACrE,sEAAsE;AACtE,MAAM,eAAe,GAAG,gBAAgB,CAAC;AASzC;;;;;GAKG;AACH,KAAK,UAAU,iBAAiB,CAC9B,OAAgC,EAChC,EAAU,EACV,OAAyE;IAEzE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;IACvC,MAAM,QAAQ,GAAG,GAAU,EAAE,CAC3B,MAAM,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;IAEpD,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,OAAO,CAAC,EAAE;SAC3B,MAAM,EAAE;SACR,IAAI,CAAC,OAAO,CAAC;SACb,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;SACzB,KAAK,CAAC,CAAC,CAAC,CAAC;IACZ,IAAI,GAAG,EAAE,IAAI,KAAK,gBAAgB;QAAE,MAAM,QAAQ,EAAE,CAAC;IAErD,MAAM,OAAO,GAAG,GAAG,CAAC,QAAQ,KAAK,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;IACjD,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;QAC9C,MAAM,MAAM,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,EAAE,UAAU,EAAE,EAAE,CAAC,CAAC;IACnD,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,iBAAiB,CAC/B,OAAwB;IAExB,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IAEvD,8DAA8D;IAC9D,mEAAmE;IACnE,qEAAqE;IACrE,oEAAoE;IACpE,gEAAgE;IAChE,wDAAwD;IACxD,MAAM,eAAe,GAAG,IAAI;SACzB,GAAG,CAAC,aAAa,CAAC;SAClB,KAAK,CACJ,CAAC,CAAC,MAAM,CAAC;QACP,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QAC9D,WAAW,EAAE,CAAC,CAAC,IAAI,CACjB,CAAC,CAAC,MAAM,EAAE,EACV,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EACd,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,EAChB,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC,CACzB;QACD,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;KACrD,CAAC,CACH;SACA,OAAO,CACN,KAAK,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,EAAoC,EAAE;QACrE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,oBAAoB,CAAC,EAAE,CAAC;YAC5C,MAAM,MAAM,CAAC,SAAS,CAAC;gBACrB,IAAI,EAAE,EAAE,UAAU,EAAE,oBAAoB,EAAE;aAC3C,CAAC,CAAC;QACL,CAAC;QACD,IAAI,KAAK,CAAC,IAAI,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC;YACvC,MAAM,MAAM,CAAC,iBAAiB,CAAC;gBAC7B,IAAI,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,aAAa,EAAE,QAAQ,EAAE,KAAK,CAAC,IAAI,EAAE;aAC7D,CAAC,CAAC;QACL,CAAC;QACD,sDAAsD;QACtD,yDAAyD;QACzD,6DAA6D;QAC7D,0DAA0D;QAC1D,sBAAsB;QACtB,MAAM,cAAc,GAAG,aAAa,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QACxD,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,CAAC;YACzC,MAAM,MAAM,CAAC,sBAAsB,CAAC;gBAClC,IAAI,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE;aAC/B,CAAC,CAAC;QACL,CAAC;QAED,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;QAChC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,MAAM,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,wBAAwB,EAAE,EAAE,CAAC,CAAC;QACxE,CAAC;QAED,MAAM,EAAE,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;QAC/B,MAAM,GAAG,GACP,iBAAiB,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,gBAAgB,CAAC,cAAc,CAAC,CAAC;QACxE,MAAM,UAAU,GAAG,IAAI,IAAI,EAAE;aAC1B,WAAW,EAAE;aACb,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;aACX,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACrB,MAAM,UAAU,GACd,GAAG,KAAK,SAAS;YACf,CAAC,CAAC,GAAG,UAAU,IAAI,EAAE,EAAE;YACvB,CAAC,CAAC,GAAG,UAAU,IAAI,EAAE,IAAI,GAAG,EAAE,CAAC;QAEnC,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,OAAO,CAAC,EAAE;aAC/B,MAAM,CAAC,OAAO,CAAC;aACf,MAAM,CAAC;YACN,IAAI,EAAE,gBAAgB;YACtB,KAAK,EAAE,KAAK,CAAC,QAAQ;YACrB,IAAI,EAAE,EAAE;YACR,MAAM,EAAE,OAAO;YACf,QAAQ,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE;YACzB,IAAI,EAAE;gBACJ,IAAI,EAAE,cAAc;gBACpB,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,YAAY,EAAE,KAAK,CAAC,QAAQ;gBAC5B,UAAU;aACX;SACF,CAAC;aACD,SAAS,EAAE,CAAC;QACf,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,MAAM,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,EAAE,CAAC,CAAC;QAClE,CAAC;QAED,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;YACvB,IAAI,SAAS,CAAC;YACd,IAAI,CAAC;gBACH,SAAS,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,UAAU,EAAE;oBAC/C,WAAW,EAAE,cAAc;oBAC3B,QAAQ,EAAE,KAAK,CAAC,IAAI;oBACpB,yDAAyD;oBACzD,0DAA0D;oBAC1D,SAAS,EAAE,EAAE;iBACd,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,OAAO,CAAC,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,EAAE,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;gBACnE,MAAM,KAAK,CAAC;YACd,CAAC;YACD,OAAO;gBACL,SAAS,EAAE,SAAS,CAAC,GAAG;gBACxB,MAAM,EAAE,SAAS,CAAC,MAAM;gBACxB,OAAO,EAAE,SAAS,CAAC,OAAO;gBAC1B,OAAO,EAAE,OAAO,CAAC,EAAE;gBACnB,UAAU;gBACV,SAAS,EAAE,SAAS,CAAC,SAAS;aAC/B,CAAC;QACJ,CAAC;QAED,4DAA4D;QAC5D,8DAA8D;QAC9D,2DAA2D;QAC3D,8CAA8C;QAC9C,OAAO;YACL,SAAS,EAAE,YAAY,CACrB,yBAAyB,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,EAC7C,OAAO,CAAC,QAAQ,CACjB;YACD,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,EAAE,cAAc,EAAE,cAAc,EAAE;YAC3C,OAAO,EAAE,OAAO,CAAC,EAAE;YACnB,UAAU;YACV,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE;SAC9C,CAAC;IACJ,CAAC,CACF,CAAC;IAEJ,MAAM,OAAO,GAAG,IAAI;SACjB,GAAG,CAAC,aAAa,CAAC;SAClB,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;SACvE,OAAO,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,EAA4B,EAAE;QACtE,MAAM,QAAQ,GAAG,GAAU,EAAE,CAC3B,MAAM,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QAE9D,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,OAAO,CAAC,EAAE;aAC3B,MAAM,EAAE;aACR,IAAI,CAAC,OAAO,CAAC;aACb,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,EAAE,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;aAC/B,KAAK,CAAC,CAAC,CAAC,CAAC;QACZ,IAAI,GAAG,EAAE,IAAI,KAAK,gBAAgB;YAAE,MAAM,QAAQ,EAAE,CAAC;QAErD,gEAAgE;QAChE,2DAA2D;QAC3D,wDAAwD;QACxD,yBAAyB;QACzB,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YACrC,MAAM,MAAM,CAAC,SAAS,CAAC;gBACrB,IAAI,EAAE,EAAE,UAAU,EAAE,oBAAoB,EAAE;aAC3C,CAAC,CAAC;QACL,CAAC;QAED,MAAM,IAAI,GAAG,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACtC,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,MAAM,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,oBAAoB,EAAE,EAAE,CAAC,CAAC;QACpE,CAAC;QAED,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;QAChC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,MAAM,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,wBAAwB,EAAE,EAAE,CAAC,CAAC;QACxE,CAAC;QAED,6DAA6D;QAC7D,gEAAgE;QAChE,8DAA8D;QAC9D,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACjD,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,MAAM,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,EAAE,CAAC,CAAC;QAClE,CAAC;QACD,IAAI,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;YAC1B,MAAM,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YACtC,MAAM,MAAM,CAAC,iBAAiB,CAAC;gBAC7B,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE;aAChD,CAAC,CAAC;QACL,CAAC;QAED,gEAAgE;QAChE,8DAA8D;QAC9D,gEAAgE;QAChE,gEAAgE;QAChE,wCAAwC;QACxC,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,EAAE;YACnD,KAAK,EAAE;gBACL,MAAM,EAAE,CAAC;gBACT,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,sBAAsB,EAAE,qBAAqB,CAAC;aAChE;SACF,CAAC,CAAC;QACH,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,MAAM,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,EAAE,CAAC,CAAC;QAClE,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,MAAM,SAAS,CAAC,WAAW,EAAE,CAAC,CAAC;QAC7D,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACtC,MAAM,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YACtC,MAAM,MAAM,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,eAAe,EAAE,EAAE,CAAC,CAAC;QAC/D,CAAC;QAED,qEAAqE;QACrE,2DAA2D;QAC3D,MAAM,UAAU,GAAG,mBAAmB,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1D,MAAM,IAAI,GAAG;YACX,KAAK,EAAE,UAAU,EAAE,KAAK,IAAI,IAAI;YAChC,MAAM,EAAE,UAAU,EAAE,MAAM,IAAI,IAAI;SACnC,CAAC;QAEF,yDAAyD;QACzD,8DAA8D;QAC9D,+DAA+D;QAC/D,6DAA6D;QAC7D,wCAAwC;QACxC,MAAM,CAAC,SAAS,CAAC,GAAG,MAAM,OAAO,CAAC,EAAE;aACjC,MAAM,CAAC,OAAO,CAAC;aACf,GAAG,CAAC;YACH,MAAM,EAAE,WAAW;YACnB,WAAW,EAAE,IAAI,IAAI,EAAE;YACvB,IAAI,EAAE,EAAE,GAAG,IAAI,EAAE,GAAG,IAAI,EAAE;SAC3B,CAAC;aACD,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,OAAO,CAAC,EAAE,EAAE,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;aACjE,SAAS,EAAE,CAAC;QACf,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,MAAM,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,mBAAmB,EAAE,EAAE,CAAC,CAAC;QACnE,CAAC;QAED,MAAM,GAAG,GAAG,MAAM,eAAe,CAC/B,OAAO,EACP,IAAI,CAAC,UAAU,EACf,SAAS,CAAC,EAAE,EACZ,OAAO,CAAC,QAAQ,CACjB,CAAC;QACF,OAAO;YACL,EAAE,EAAE,SAAS,CAAC,EAAE;YAChB,GAAG;YACH,YAAY,EAAE,YAAY,CAAC,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC;YACnD,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,GAAG,IAAI;SACR,CAAC;IACJ,CAAC,CAAC,CAAC;IAEL,MAAM,IAAI,GAAG,IAAI;SACd,GAAG,CAAC,aAAa,CAAC;SAClB,KAAK,CAAC,oBAAoB,CAAC;SAC3B,OAAO,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE;QAC5C,IAAI,CAAC;YACH,OAAO,MAAM,SAAS,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACzC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,iBAAiB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QACzC,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,MAAM,MAAM,GAAG,IAAI;SAChB,GAAG,CAAC,aAAa,CAAC;SAClB,KAAK,CACJ,CAAC,CAAC,MAAM,CAAC;QACP,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;QAClD,KAAK,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;QACvE,GAAG,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;KACvD,CAAC,CACH;SACA,OAAO,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,EAA2B,EAAE;QACrE,MAAM,QAAQ,GAAG,GAAU,EAAE,CAC3B,MAAM,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QAC9D,MAAM,GAAG,GAAG,MAAM,iBAAiB,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,EAAE;YACrD,UAAU,EAAE,sBAAsB;YAClC,MAAM;SACP,CAAC,CAAC;QAEH,MAAM,IAAI,GAAG,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACtC,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,MAAM,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,oBAAoB,EAAE,EAAE,CAAC,CAAC;QACpE,CAAC;QAED,MAAM,QAAQ,GAAG;YACf,GAAG,IAAI;YACP,GAAG,EAAE,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG;SAC3B,CAAC;QACF,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,OAAO,CAAC,EAAE;aAC/B,MAAM,CAAC,OAAO,CAAC;aACf,GAAG,CAAC;YACH,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,GAAG,CAAC,KAAK;YAC/B,IAAI,EAAE,QAAQ;SACf,CAAC;aACD,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,EAAE,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;aAC/B,SAAS,EAAE,CAAC;QACf,IAAI,CAAC,OAAO;YAAE,MAAM,QAAQ,EAAE,CAAC;QAE/B,OAAO;YACL,EAAE,EAAE,OAAO,CAAC,EAAE;YACd,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,GAAG,EAAE,QAAQ,CAAC,GAAG;SAClB,CAAC;IACJ,CAAC,CAAC,CAAC;IAEL,MAAM,MAAM,GAAG,IAAI;SAChB,GAAG,CAAC,aAAa,CAAC;SAClB,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;SACvE,OAAO,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,EAA2B,EAAE;QACrE,MAAM,QAAQ,GAAG,GAAU,EAAE,CAC3B,MAAM,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QAC9D,MAAM,GAAG,GAAG,MAAM,iBAAiB,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,EAAE;YACrD,UAAU,EAAE,oBAAoB;YAChC,MAAM;SACP,CAAC,CAAC;QAEH,8DAA8D;QAC9D,6DAA6D;QAC7D,4DAA4D;QAC5D,wDAAwD;QACxD,uBAAuB;QACvB,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,OAAO,CAAC,EAAE;aAC/B,MAAM,CAAC,OAAO,CAAC;aACf,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,EAAE,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;aAC/B,SAAS,EAAE,CAAC;QACf,IAAI,CAAC,OAAO;YAAE,MAAM,QAAQ,EAAE,CAAC;QAE/B,MAAM,IAAI,GAAG,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACtC,IAAI,IAAI,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;YAC5B,IAAI,CAAC;gBACH,MAAM,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YAChD,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,6BAA6B,EAAE;oBACjD,KAAK;oBACL,EAAE,EAAE,GAAG,CAAC,EAAE;oBACV,UAAU,EAAE,IAAI,CAAC,UAAU;iBAC5B,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,OAAO,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC;IAC5B,CAAC,CAAC,CAAC;IAEL,OAAO,EAAE,eAAe,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;AACpE,CAAC;AAED,6EAA6E;AAC7E,iDAAiD;AACjD,SAAS,iBAAiB,CAAC,KAAc,EAAE,MAAsB;IAC/D,IAAI,CAAC,CAAC,KAAK,YAAY,cAAc,CAAC;QAAE,OAAO,KAAK,CAAC;IACrD,QAAQ,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QACxB,KAAK,WAAW;YACd,OAAO,MAAM,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,EAAE,UAAU,EAAE,KAAK,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;QAC3E,KAAK,WAAW;YACd,OAAO,MAAM,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;IAC5E,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,GAAW;IAChC,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC9B,OAAO,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;AACvE,CAAC;AAED,MAAM,WAAW,GAAG,aAAa,CAAC;AAClC,MAAM,WAAW,GAAG,EAAE,CAAC;AAEvB,SAAS,iBAAiB,CAAC,QAAgB;IACzC,MAAM,OAAO,GAAG,QAAQ,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAC1C,wEAAwE;IACxE,4DAA4D;IAC5D,IAAI,OAAO,IAAI,CAAC,IAAI,OAAO,KAAK,QAAQ,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IACtE,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;IACtD,IAAI,GAAG,CAAC,MAAM,GAAG,WAAW;QAAE,OAAO,SAAS,CAAC;IAC/C,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IAC7C,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/serve-route.d.ts

@@ -0,0 +1,19 @@
+import type { AppContext } from "plumix/plugin";
+/**
+ * Worker-proxied media serve. Mounted at `GET /_plumix/media/serve/<id>`
+ * via `ctx.registerRoute({ path: "/serve/*", auth: "public" })`.
+ *
+ * Public on purpose — published media is meant to be embeddable in
+ * pages/posts. Three guards:
+ *
+ * 1. **Published-only**: looks up `entries` by id and requires
+ *    `type='media' AND status='published'`. Drafts and trashed rows
+ *    return 404.
+ * 2. **Mime sandboxing**: `X-Content-Type-Options: nosniff` always;
+ *    `Content-Disposition: attachment` for any mime not in the
+ *    inline-safe allowlist (forces download instead of render).
+ * 3. **Etag round-trip**: 304 on `If-None-Match` match so the worker
+ *    isn't re-streaming bytes for every page view.
+ */
+export declare function handleMediaServe(request: Request, ctx: AppContext): Promise<Response>;
+//# sourceMappingURL=serve-route.d.ts.map

package/dist/serve-route.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"serve-route.d.ts","sourceRoot":"","sources":["../src/serve-route.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AA0BhD;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,gBAAgB,CACpC,OAAO,EAAE,OAAO,EAChB,GAAG,EAAE,UAAU,GACd,OAAO,CAAC,QAAQ,CAAC,CA6DnB"}

package/dist/serve-route.js

@@ -0,0 +1,122 @@
+import { and, entries, eq } from "plumix/plugin";
+import { parseMediaMeta } from "./meta.js";
+const PREFIX = "/_plumix/media/serve/";
+const MEDIA_ENTRY_TYPE = "media";
+// Mimes safe to render inline same-origin. Everything else gets
+// `Content-Disposition: attachment` to force download — defense
+// against stored-XSS via uploaded content (text/html in a `.txt`,
+// scripted SVG, polyglot bytes).
+const INLINE_SAFE_MIMES = new Set([
+    "image/jpeg",
+    "image/png",
+    "image/gif",
+    "image/webp",
+    "image/avif",
+    "audio/mpeg",
+    "audio/wav",
+    "audio/ogg",
+    "video/mp4",
+    "video/webm",
+    "video/quicktime",
+]);
+/**
+ * Worker-proxied media serve. Mounted at `GET /_plumix/media/serve/<id>`
+ * via `ctx.registerRoute({ path: "/serve/*", auth: "public" })`.
+ *
+ * Public on purpose — published media is meant to be embeddable in
+ * pages/posts. Three guards:
+ *
+ * 1. **Published-only**: looks up `entries` by id and requires
+ *    `type='media' AND status='published'`. Drafts and trashed rows
+ *    return 404.
+ * 2. **Mime sandboxing**: `X-Content-Type-Options: nosniff` always;
+ *    `Content-Disposition: attachment` for any mime not in the
+ *    inline-safe allowlist (forces download instead of render).
+ * 3. **Etag round-trip**: 304 on `If-None-Match` match so the worker
+ *    isn't re-streaming bytes for every page view.
+ */
+export async function handleMediaServe(request, ctx) {
+    const url = new URL(request.url);
+    if (!url.pathname.startsWith(PREFIX)) {
+        return new Response(null, { status: 404 });
+    }
+    const idStr = url.pathname.slice(PREFIX.length);
+    // 15 digits max keeps the parsed value below Number.MAX_SAFE_INTEGER
+    // (~9.007e15) — 16 digits could round on parseInt.
+    if (!/^[1-9]\d{0,14}$/.test(idStr)) {
+        return new Response(null, { status: 400 });
+    }
+    const id = Number.parseInt(idStr, 10);
+    const [row] = await ctx.db
+        .select()
+        .from(entries)
+        .where(and(eq(entries.id, id), eq(entries.type, MEDIA_ENTRY_TYPE), eq(entries.status, "published")))
+        .limit(1);
+    if (!row)
+        return new Response(null, { status: 404 });
+    const meta = parseMediaMeta(row.meta);
+    if (!meta)
+        return new Response(null, { status: 404 });
+    const storage = ctx.storage;
+    if (!storage)
+        return new Response(null, { status: 503 });
+    const obj = await storage.get(meta.storageKey);
+    if (!obj)
+        return new Response(null, { status: 404 });
+    const ifNoneMatch = request.headers.get("if-none-match");
+    if (ifNoneMatch && obj.etag && weakEtagMatch(ifNoneMatch, obj.etag)) {
+        return new Response(null, {
+            status: 304,
+            headers: { etag: obj.etag, "cache-control": cacheControl() },
+        });
+    }
+    // `?attachment=1` forces a download regardless of mime. The admin's
+    // Download button uses this so the response carries the attachment
+    // disposition even when `publicUrlBase` would otherwise route around
+    // the worker (HTML `<a download>` is silently ignored cross-origin
+    // without a matching `Content-Disposition` header).
+    const forceAttachment = url.searchParams.get("attachment") === "1";
+    const inline = !forceAttachment && INLINE_SAFE_MIMES.has(meta.mime);
+    const headers = new Headers();
+    headers.set("content-type", meta.mime);
+    headers.set("content-length", String(obj.size));
+    headers.set("cache-control", cacheControl());
+    headers.set("x-content-type-options", "nosniff");
+    if (obj.etag)
+        headers.set("etag", obj.etag);
+    if (!inline)
+        headers.set("content-disposition", contentDisposition(row.title));
+    return new Response(obj.body, { status: 200, headers });
+}
+function contentDisposition(title) {
+    // RFC 6266: ASCII fallback in `filename="..."` plus a UTF-8
+    // `filename*=UTF-8''...` so non-Latin titles aren't mangled.
+    const ascii = sanitizeFilename(title);
+    const utf8 = encodeURIComponent(title);
+    return `attachment; filename="${ascii}"; filename*=UTF-8''${utf8}`;
+}
+function cacheControl() {
+    // Short cache + revalidate. Long max-age + key reuse (alt updates
+    // don't change bytes; future replace-file flows might) leaves
+    // intermediaries serving stale bytes for hours.
+    return "public, max-age=60, must-revalidate";
+}
+function weakEtagMatch(ifNoneMatch, etag) {
+    // `If-None-Match` accepts comma-separated tags; either side may be
+    // weak (`W/"..."`). Normalize and check membership.
+    const normalize = (s) => s.replace(/^W\//, "").trim();
+    const target = normalize(etag);
+    return ifNoneMatch
+        .split(",")
+        .map((t) => normalize(t))
+        .some((t) => t === target || t === "*");
+}
+const SAFE_FILENAME_RE = /[^a-zA-Z0-9._-]/g;
+function sanitizeFilename(title) {
+    // Strip anything that could break the Content-Disposition quoting
+    // or attempt directory traversal in the suggested name. ASCII-safe
+    // subset; non-ASCII titles fall back to a stable placeholder.
+    const cleaned = title.replace(SAFE_FILENAME_RE, "_").slice(0, 100);
+    return cleaned.length > 0 ? cleaned : "download";
+}
+//# sourceMappingURL=serve-route.js.map

package/dist/serve-route.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"serve-route.js","sourceRoot":"","sources":["../src/serve-route.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,eAAe,CAAC;AAEjD,OAAO,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAE3C,MAAM,MAAM,GAAG,uBAAuB,CAAC;AACvC,MAAM,gBAAgB,GAAG,OAAO,CAAC;AAEjC,gEAAgE;AAChE,gEAAgE;AAChE,kEAAkE;AAClE,iCAAiC;AACjC,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAS;IACxC,YAAY;IACZ,WAAW;IACX,WAAW;IACX,YAAY;IACZ,YAAY;IACZ,YAAY;IACZ,WAAW;IACX,WAAW;IACX,WAAW;IACX,YAAY;IACZ,iBAAiB;CAClB,CAAC,CAAC;AAEH;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,OAAgB,EAChB,GAAe;IAEf,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QACrC,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IAC7C,CAAC;IACD,MAAM,KAAK,GAAG,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAChD,qEAAqE;IACrE,mDAAmD;IACnD,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACnC,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IAC7C,CAAC;IACD,MAAM,EAAE,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAEtC,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,GAAG,CAAC,EAAE;SACvB,MAAM,EAAE;SACR,IAAI,CAAC,OAAO,CAAC;SACb,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,CAAC,EAClB,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,gBAAgB,CAAC,EAClC,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,WAAW,CAAC,CAChC,CACF;SACA,KAAK,CAAC,CAAC,CAAC,CAAC;IACZ,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IAErD,MAAM,IAAI,GAAG,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACtC,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IAEtD,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC;IAC5B,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IAEzD,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC/C,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IAErD,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IACzD,IAAI,WAAW,IAAI,GAAG,CAAC,IAAI,IAAI,aAAa,CAAC,WAAW,EAAE,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QACpE,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE;YACxB,MAAM,EAAE,GAAG;YACX,OAAO,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,eAAe,EAAE,YAAY,EAAE,EAAE;SAC7D,CAAC,CAAC;IACL,CAAC;IAED,oEAAoE;IACpE,mEAAmE;IACnE,qEAAqE;IACrE,mEAAmE;IACnE,oDAAoD;IACpD,MAAM,eAAe,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,CAAC,KAAK,GAAG,CAAC;IACnE,MAAM,MAAM,GAAG,CAAC,eAAe,IAAI,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAEpE,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;IAC9B,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IACvC,OAAO,CAAC,GAAG,CAAC,gBAAgB,EAAE,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;IAChD,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,YAAY,EAAE,CAAC,CAAC;IAC7C,OAAO,CAAC,GAAG,CAAC,wBAAwB,EAAE,SAAS,CAAC,CAAC;IACjD,IAAI,GAAG,CAAC,IAAI;QAAE,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;IAC5C,IAAI,CAAC,MAAM;QACT,OAAO,CAAC,GAAG,CAAC,qBAAqB,EAAE,kBAAkB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;IAEpE,OAAO,IAAI,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC;AAC1D,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAa;IACvC,4DAA4D;IAC5D,6DAA6D;IAC7D,MAAM,KAAK,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;IACtC,MAAM,IAAI,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC;IACvC,OAAO,yBAAyB,KAAK,uBAAuB,IAAI,EAAE,CAAC;AACrE,CAAC;AAED,SAAS,YAAY;IACnB,kEAAkE;IAClE,8DAA8D;IAC9D,gDAAgD;IAChD,OAAO,qCAAqC,CAAC;AAC/C,CAAC;AAED,SAAS,aAAa,CAAC,WAAmB,EAAE,IAAY;IACtD,mEAAmE;IACnE,oDAAoD;IACpD,MAAM,SAAS,GAAG,CAAC,CAAS,EAAU,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACtE,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAC/B,OAAO,WAAW;SACf,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;SACxB,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,MAAM,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC;AAC5C,CAAC;AAED,MAAM,gBAAgB,GAAG,kBAAkB,CAAC;AAC5C,SAAS,gBAAgB,CAAC,KAAa;IACrC,kEAAkE;IAClE,mEAAmE;IACnE,8DAA8D;IAC9D,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,gBAAgB,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACnE,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC;AACnD,CAAC"}

package/dist/upload-route.d.ts

@@ -0,0 +1,17 @@
+import type { AppContext } from "plumix/plugin";
+/**
+ * Worker-routed upload handler. Mounted at `PUT /_plumix/media/upload/<id>`
+ * via `ctx.registerRoute({ path: "/upload/*", auth: "authenticated" })`.
+ *
+ * Defends against:
+ * - **Unbounded body**: `meta.size` (signed at draft creation) caps the
+ *   actual byte stream, not just the Content-Length header. Chunked
+ *   uploads or a lying header trip the counting transform and abort.
+ * - **Path confusion**: only `/upload/<digits>` matches; trailing
+ *   segments or non-numeric ids are rejected before any DB hit.
+ *
+ * CSRF is enforced at the `/_plumix/*` dispatcher boundary (X-Plumix-
+ * Request header + Origin check); we don't re-check here.
+ */
+export declare function handleWorkerUpload(request: Request, ctx: AppContext): Promise<Response>;
+//# sourceMappingURL=upload-route.d.ts.map

package/dist/upload-route.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"upload-route.d.ts","sourceRoot":"","sources":["../src/upload-route.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAYhD;;;;;;;;;;;;;GAaG;AACH,wBAAsB,kBAAkB,CACtC,OAAO,EAAE,OAAO,EAChB,GAAG,EAAE,UAAU,GACd,OAAO,CAAC,QAAQ,CAAC,CAiFnB"}

package/dist/upload-route.js

@@ -0,0 +1,106 @@
+import { and, entries, eq } from "plumix/plugin";
+import { parseMediaMeta } from "./meta.js";
+const MEDIA_ENTRY_TYPE = "media";
+// Anchored: digits only, no leading zeros, ≤16 chars (well above any
+// realistic SQLite int). Rejects scientific notation, signs, padding
+// whitespace, and unicode digits.
+const ID_RE = /^[1-9]\d{0,15}$/;
+/**
+ * Worker-routed upload handler. Mounted at `PUT /_plumix/media/upload/<id>`
+ * via `ctx.registerRoute({ path: "/upload/*", auth: "authenticated" })`.
+ *
+ * Defends against:
+ * - **Unbounded body**: `meta.size` (signed at draft creation) caps the
+ *   actual byte stream, not just the Content-Length header. Chunked
+ *   uploads or a lying header trip the counting transform and abort.
+ * - **Path confusion**: only `/upload/<digits>` matches; trailing
+ *   segments or non-numeric ids are rejected before any DB hit.
+ *
+ * CSRF is enforced at the `/_plumix/*` dispatcher boundary (X-Plumix-
+ * Request header + Origin check); we don't re-check here.
+ */
+export async function handleWorkerUpload(request, ctx) {
+    const user = ctx.user;
+    if (!user)
+        return jsonError(401, "unauthorized");
+    const url = new URL(request.url);
+    const idStr = url.pathname.slice(url.pathname.lastIndexOf("/") + 1);
+    if (!ID_RE.test(idStr))
+        return jsonError(400, "invalid_id");
+    const id = Number.parseInt(idStr, 10);
+    // Reject `/upload/<id>/<extra>` — the route is mounted via "/upload/*"
+    // wildcard, so we have to enforce shape here.
+    if (url.pathname !== `/_plumix/media/upload/${idStr}`) {
+        return jsonError(400, "invalid_path");
+    }
+    const storage = ctx.storage;
+    if (!storage)
+        return jsonError(503, "storage_not_configured");
+    const [row] = await ctx.db
+        .select()
+        .from(entries)
+        .where(and(eq(entries.id, id), eq(entries.type, MEDIA_ENTRY_TYPE)))
+        .limit(1);
+    if (!row)
+        return jsonError(404, "not_found");
+    if (row.status !== "draft")
+        return jsonError(409, "not_a_draft");
+    const isOwner = row.authorId === user.id;
+    if (!isOwner && !ctx.auth.can("entry:media:edit_any")) {
+        return jsonError(403, "forbidden");
+    }
+    const meta = parseMediaMeta(row.meta);
+    if (!meta)
+        return jsonError(409, "media_meta_invalid");
+    const declared = request.headers.get("content-type") ?? "";
+    const declaredBase = declared.split(";")[0]?.trim().toLowerCase();
+    if (declaredBase !== meta.mime.toLowerCase()) {
+        return jsonError(415, "content_type_mismatch");
+    }
+    // Reject missing CL (chunked is unbounded) or CL > meta.size; HTTP
+    // framing truncates the actual stream to the declared length.
+    const declaredLengthHeader = request.headers.get("content-length");
+    if (declaredLengthHeader === null) {
+        return jsonError(411, "content_length_required");
+    }
+    const declaredLength = Number(declaredLengthHeader);
+    if (!Number.isInteger(declaredLength) ||
+        declaredLength < 0 ||
+        declaredLength > meta.size) {
+        return jsonError(413, "payload_too_large");
+    }
+    const body = request.body;
+    if (!body)
+        return jsonError(400, "empty_body");
+    // Stream the body straight to R2 per the docs example:
+    //   await env.R2.put(key, request.body, { httpMetadata })
+    try {
+        await storage.put(meta.storageKey, body, { contentType: meta.mime });
+    }
+    catch (error) {
+        // Best-effort cleanup — a partial put can leave junk behind.
+        try {
+            await storage.delete(meta.storageKey);
+        }
+        catch (cleanupError) {
+            ctx.logger.warn("media_worker_upload_cleanup_failed", {
+                error: cleanupError,
+                key: meta.storageKey,
+            });
+        }
+        ctx.logger.warn("media_worker_upload_failed", {
+            error,
+            id,
+            storageKey: meta.storageKey,
+        });
+        return jsonError(502, "storage_put_failed");
+    }
+    return new Response(null, { status: 204 });
+}
+function jsonError(status, reason) {
+    return new Response(JSON.stringify({ error: reason }), {
+        status,
+        headers: { "content-type": "application/json" },
+    });
+}
+//# sourceMappingURL=upload-route.js.map