@ryusenkei/maezae 0.17.0 → 0.18.1

package/README.md

@@ -181,6 +181,24 @@ const html = bodyToHtml(entry.body, {
 
 章の分割などで見出しの文字を使うときは、`plainOf(heading.content)` で文字にする（取り込みは見出しの文字を変えない）
 
+## 非公開のメディア（0.18.0 から）
+
+非公開の項目（型の宣言で `visibility: 'private'` のメディアと本文）の画像とファイルは、署名つき・期限つきの URL でだけ配信する。配信 API は `visibility: 'private'` と署名のない `url` を返すので、権利のある人に見せるときにサイトのサーバーが署名する
+
+- 鍵: 媒体の管理画面の「設定 → 連携」の非公開のメディアの署名の鍵。サイトの秘密値に入れ、ブラウザに出さない
+- 期限: `expiresInSec`（既定は3600秒）。ページを表示するたびに署名し、写しに署名つきの URL を保存しない
+- 画像の変換のクエリ（`w` など）は署名の後に足してよい（署名の対象はパスと期限だけ）
+- 署名のない URL は404、期限切れと別の鍵の署名は403。鍵を作り直すと古い鍵の署名はすぐ通らない
+
+```ts
+import { signMediaUrl, withImageParams } from '@ryusenkei/maezae/delivery';
+
+const src = image.visibility === 'private' ? await signMediaUrl(image.url, env.MEDIA_SIGNING_KEY, { expiresInSec: 1800 }) : image.url;
+const thumb = withImageParams(src, { w: 400, auto: 'format' });
+```
+
+ファイル（`kind: 'file'`）: `url` は `/files/<媒体>/<ID>.<拡張子>`、`name`（元のファイル名）・`mimeType`・`size` を持つ。本文のファイルのブロックも同じ実体を参照する
+
 ## プレビュー
 
 - CMS は媒体のサイトのオリジンへ、公開のページと同じパスで署名つきのリクエストを送信

package/dist/body.js

@@ -72,6 +72,32 @@ const SAFE_HREF = /^(?:https?:\/\/|mailto:|#|\/(?![/\\]))/i;
 const isSafeHref = (href) => SAFE_HREF.test(href);
 /** 許可しないリンク先の問題の文言 */
 const unsafeHrefMessage = (href) => `リンク先 ${href} は使えない（https://・http://・mailto:・/ で始まるサイト内のパス・# で始まるページ内のリンクだけ）`;
+// ../body/src/inline.ts
+/** 装飾の順序（外側から内側、Markdown と HTML の入れ子の順） */
+const MARK_ORDER = [
+	"strong",
+	"em",
+	"strike",
+	"underline",
+	"mark",
+	"sup",
+	"sub",
+	"code"
+];
+/** 装飾を MARK_ORDER の順に並べる（重複は1つ） */
+const sortMarks = (marks) => MARK_ORDER.filter((m) => marks?.includes(m));
+/** 装飾の描画の HTML の要素 */
+const MARK_HTML_TAGS = {
+	strong: "strong",
+	em: "em",
+	code: "code",
+	strike: "s",
+	mark: "mark",
+	sup: "sup",
+	sub: "sub",
+	underline: "u"
+};
+({ ...Object.fromEntries(Object.entries(MARK_HTML_TAGS).map(([mark, tag]) => [tag, mark])) });
 // ../body/src/profile.ts
 const MARK_LABELS = {
 	strong: "太字",
@@ -240,27 +266,6 @@ const ESCAPES = {
 };
 const esc = (s) => s.replace(/[&<>"']/g, (c) => ESCAPES[c]);
 const attrs = (pairs) => Object.entries(pairs).filter(([, v]) => v !== void 0 && v !== null && v !== false && v !== "").map(([k, v]) => ` ${k}="${esc(String(v))}"`).join("");
-const MARK_TAGS = {
-	strong: "strong",
-	em: "em",
-	code: "code",
-	strike: "s",
-	mark: "mark",
-	sup: "sup",
-	sub: "sub",
-	underline: "u"
-};
-/** 外側から内側の順 */
-const MARK_ORDER = [
-	"strong",
-	"em",
-	"strike",
-	"underline",
-	"mark",
-	"sup",
-	"sub",
-	"code"
-];
 const CSS_PROPERTY = {
 	color: "color",
 	background: "background-color",
@@ -294,7 +299,7 @@ function bodyToHtml(body, options) {
 		if (typeof i === "string") return esc(i).replaceAll("\n", "<br>");
 		if ("component" in i) return options.inlineComponent?.(i.component, i.props ?? {}, i.text ?? "") ?? esc(i.text ?? "");
 		let html = esc(i.text).replaceAll("\n", "<br>");
-		for (const m of [...MARK_ORDER].reverse()) if (i.marks?.includes(m)) html = `<${MARK_TAGS[m]}>${html}</${MARK_TAGS[m]}>`;
+		for (const m of sortMarks(i.marks).reverse()) html = `<${MARK_HTML_TAGS[m]}>${html}</${MARK_HTML_TAGS[m]}>`;
 		if (i.style) {
 			const a = styleAttr(i.style);
 			if (a) html = `<span${a}>${html}</span>`;

package/dist/delivery.js

@@ -250,12 +250,22 @@ const EXTENSIONS = {
 	"image/webp": "webp",
 	"image/gif": "gif",
 	"video/mp4": "mp4",
-	"video/webm": "webm"
+	"video/webm": "webm",
+	"application/pdf": "pdf",
+	"application/zip": "zip",
+	"text/plain": "txt",
+	"text/csv": "csv",
+	"application/vnd.openxmlformats-officedocument.wordprocessingml.document": "docx",
+	"application/vnd.openxmlformats-officedocument.spreadsheetml.sheet": "xlsx",
+	"application/vnd.openxmlformats-officedocument.presentationml.presentation": "pptx"
 };
+/** 形式の実体の種類 */
+const mediaKindOf = (mimeType) => mimeType.startsWith("image/") ? "image" : mimeType.startsWith("video/") ? "video" : "file";
 /** 拡張子の形式（配信しない拡張子は null） */
 const mediaMimeOf = (ext) => Object.entries(EXTENSIONS).find(([, e]) => e === ext)?.[0] ?? null;
 const IMAGE_PATH = /^\/images\/([A-Za-z0-9_-]+)\/([A-Za-z0-9_-]+)-(\d+)x(\d+)\.([a-z0-9]+)$/;
 const VIDEO_PATH = /^\/videos\/([A-Za-z0-9_-]+)\/([A-Za-z0-9_-]+)\.([a-z0-9]+)$/;
+const FILE_PATH = /^\/files\/([A-Za-z0-9_-]+)\/([A-Za-z0-9_-]+)\.([a-z0-9]+)$/;
 /** 配信 URL のパスを解析（形が違えば null） */
 function parseMediaPath(pathname) {
 	const image = IMAGE_PATH.exec(pathname);
@@ -280,8 +290,39 @@ function parseMediaPath(pathname) {
 			ext
 		} : null;
 	}
+	const file = FILE_PATH.exec(pathname);
+	if (file) {
+		const [, project, id, ext] = file;
+		const mime = mediaMimeOf(ext);
+		return mime && mediaKindOf(mime) === "file" ? {
+			kind: "file",
+			project,
+			id,
+			ext
+		} : null;
+	}
 	return null;
 }
+const hex = (buf) => [...new Uint8Array(buf)].map((b) => b.toString(16).padStart(2, "0")).join("");
+/** 署名（HMAC-SHA256、対象はパスと期限、変換のクエリは含めない） */
+async function signatureOf(secret, pathname, exp) {
+	const key = await crypto.subtle.importKey("raw", new TextEncoder().encode(secret), {
+		name: "HMAC",
+		hash: "SHA-256"
+	}, false, ["sign"]);
+	return hex(await crypto.subtle.sign("HMAC", key, new TextEncoder().encode(`${pathname}:${exp}`)));
+}
+/**
+* 非公開のメディアの署名つきの URL（exp と sig のクエリを付ける、ほかのクエリは残す）
+* - secret: 媒体の非公開のメディアの署名の鍵、expiresInSec: 期限までの秒、now: 今の UNIX ミリ秒
+*/
+async function signMediaUrl(url, secret, options = {}) {
+	const u = new URL(url);
+	const exp = Math.floor((options.now ?? Date.now()) / 1e3) + (options.expiresInSec ?? 3600);
+	u.searchParams.set("exp", String(exp));
+	u.searchParams.set("sig", await signatureOf(secret, u.pathname, exp));
+	return u.toString();
+}
 /** 幅・高さの上限（画素） */
 const IMAGE_SIZE_MAX = 4096;
 const FITS = [
@@ -432,4 +473,4 @@ function createDeliveryClock(timeZone) {
 		})
 	};
 }
-export { DELIVERY_PATH, DeliveryError, cachedDelivery, createDeliveryClient, createDeliveryClock, deliveredImageUrl, fieldOf, imageParamsOf, limitOf, listParams, mediaOf, memoryDeliveryCache, optionLabels, pagePath, parseMediaPath, readChanges, subPath, withImageParams };
+export { DELIVERY_PATH, DeliveryError, cachedDelivery, createDeliveryClient, createDeliveryClock, deliveredImageUrl, fieldOf, imageParamsOf, limitOf, listParams, mediaOf, memoryDeliveryCache, optionLabels, pagePath, parseMediaPath, readChanges, signMediaUrl, subPath, withImageParams };

package/dist/dev.js

@@ -49,6 +49,11 @@ function relayDelivery({ origin, apiKey, previewSecret }) {
 		});
 	};
 }
+const DECODED_BODY_HEADERS = /* @__PURE__ */ new Set([
+	"content-encoding",
+	"content-length",
+	"transfer-encoding"
+]);
 /** 手元の配信 API のサーバー（/content/v1/… だけ、失敗は502、戻り値は origin と停止の関数） */
 async function serveDelivery(delivery, options = {}) {
 	const server = createServer(async (req, res) => {
@@ -67,7 +72,9 @@ async function serveDelivery(delivery, options = {}) {
 				...chunks.length ? { body: Buffer.concat(chunks).toString("utf8") } : {}
 			});
 			const out = {};
-			response.headers.forEach((v, k) => out[k] = v);
+			response.headers.forEach((v, k) => {
+				if (!DECODED_BODY_HEADERS.has(k)) out[k] = v;
+			});
 			res.writeHead(response.status, out);
 			res.end(Buffer.from(await response.arrayBuffer()));
 		} catch (e) {

package/dist/model.js

@@ -344,11 +344,13 @@ const fieldUnion = z.discriminatedUnion("type", [
 		type: z.literal("media"),
 		accept: z.array(z.enum(["image", "video"])).optional(),
 		multiple: z.boolean().optional(),
-		frames: z.array(frame).optional()
+		frames: z.array(frame).optional(),
+		visibility: z.literal("private").optional()
 	}),
 	z.object({
 		...base,
 		type: z.literal("body"),
+		visibility: z.literal("private").optional(),
 		profile: z.object({
 			headings: z.array(z.number()),
 			marks: z.array(z.string()),
@@ -509,6 +511,9 @@ const modelSchema = z.object({
 /** コンテンツスキーマの JSON を検査して返却（形が合わなければ例外、理由は zod の issues） */
 const parseModel = (json) => modelSchema.parse(normalizeLegacyModel(json));
 // ../model/src/screens.ts
+const TYPE_PREFIX = "type:";
+/** メニュー項目の id（コンテンツタイプ） */
+const typeItem = (type) => `${TYPE_PREFIX}${type}`;
 /** メニューにある全項目の id（グループの中も、上から順） */
 const menuItemsOf = (menu) => menu.flatMap((e) => typeof e === "string" ? [e] : e.items);
 /** 編集画面に配置した項目の id（セクションの順） */
@@ -542,296 +547,203 @@ const parseScreens = (json) => screensSchema.parse(json);
 // ../cms-contract/src/transfer.ts
 /** スキーマと設定の形式の名前 */
 const CONFIG_FORMAT = "cms-config";
-// src/defaults.ts
 /** 中立の既定のスキーマ（新しい媒体の作成で適用する型: post・author・tag・image・video、設定の移入の土台） */
-const DEFAULT_SCHEMA = { "types": [
+const DEFAULT_SCHEMA = { types: [
 	{
-		"id": "post",
-		"label": "投稿",
-		"publishing": "review",
-		"roles": {
-			"title": "title",
-			"image": "image",
-			"body": "body"
+		id: "post",
+		label: "投稿",
+		publishing: "review",
+		roles: {
+			title: "title",
+			image: "image",
+			body: "body"
 		},
-		"fields": [
+		fields: [
 			{
-				"key": "title",
-				"label": "タイトル",
-				"type": "text",
-				"required": "save"
+				key: "title",
+				label: "タイトル",
+				type: "text",
+				required: "save"
 			},
 			{
-				"key": "writers",
-				"label": "著者",
-				"type": "reference",
-				"to": "author",
-				"multiple": true
+				key: "writers",
+				label: "著者",
+				type: "reference",
+				to: "author",
+				multiple: true
 			},
 			{
-				"key": "image",
-				"label": "メインの画像",
-				"type": "media",
-				"accept": ["image"]
+				key: "image",
+				label: "メインの画像",
+				type: "media",
+				accept: ["image"]
 			},
 			{
-				"key": "body",
-				"label": "本文",
-				"type": "body",
-				"profile": {
-					"headings": [
+				key: "body",
+				label: "本文",
+				type: "body",
+				profile: {
+					headings: [
 						2,
 						3,
 						4
 					],
-					"marks": [
+					marks: [
 						"strong",
 						"em",
 						"code",
 						"strike"
 					],
-					"list": {
-						"ordered": true,
-						"nested": true
+					list: {
+						ordered: true,
+						nested: true
 					},
-					"quote": {
-						"multiple": true,
-						"cite": true
+					quote: {
+						multiple: true,
+						cite: true
 					},
-					"code": { "caption": false },
-					"table": {
-						"head": "optional",
-						"caption": "optional"
+					code: { caption: false },
+					table: {
+						head: "optional",
+						caption: "optional"
 					},
-					"divider": true,
-					"components": ["gallery", "link-card"]
+					divider: true,
+					components: ["gallery", "link-card"]
 				}
 			},
 			{
-				"key": "revised_at",
-				"label": "更新日時",
-				"type": "datetime"
+				key: "revised_at",
+				label: "更新日時",
+				type: "datetime"
 			},
 			{
-				"key": "tags",
-				"label": "タグ",
-				"type": "reference",
-				"to": "tag",
-				"multiple": true
+				key: "tags",
+				label: "タグ",
+				type: "reference",
+				to: "tag",
+				multiple: true
 			},
 			{
-				"key": "excerpt",
-				"label": "抜粋",
-				"type": "textarea",
-				"computed": {
-					"kind": "excerpt",
-					"from": "body"
+				key: "excerpt",
+				label: "抜粋",
+				type: "textarea",
+				computed: {
+					kind: "excerpt",
+					from: "body"
 				}
 			},
 			{
-				"key": "read_min",
-				"label": "読了の分",
-				"type": "number",
-				"computed": {
-					"kind": "read_min",
-					"from": "body"
+				key: "read_min",
+				label: "読了の分",
+				type: "number",
+				computed: {
+					kind: "read_min",
+					from: "body"
 				}
 			},
 			{
-				"key": "links",
-				"label": "リンク先",
-				"type": "text",
-				"multiple": true,
-				"computed": {
-					"kind": "links",
-					"from": "body"
+				key: "links",
+				label: "リンク先",
+				type: "text",
+				multiple: true,
+				computed: {
+					kind: "links",
+					from: "body"
 				}
 			}
 		],
-		"pages": [{
-			"path": "/posts/{id}",
-			"public": [{
-				"key": "status",
-				"in": ["published"]
+		pages: [{
+			path: "/posts/{id}",
+			public: [{
+				key: "status",
+				in: ["published"]
 			}, {
-				"key": "published_at",
-				"notFuture": true
+				key: "published_at",
+				notFuture: true
 			}]
 		}]
 	},
 	{
-		"id": "author",
-		"label": "著者",
-		"roles": {
-			"title": "name",
-			"image": "portrait"
+		id: "author",
+		label: "著者",
+		roles: {
+			title: "name",
+			image: "portrait"
 		},
-		"fields": [
+		fields: [
 			{
-				"key": "name",
-				"label": "名前",
-				"type": "text",
-				"required": "save"
+				key: "name",
+				label: "名前",
+				type: "text",
+				required: "save"
 			},
 			{
-				"key": "bio",
-				"label": "紹介",
-				"type": "textarea"
+				key: "bio",
+				label: "紹介",
+				type: "textarea"
 			},
 			{
-				"key": "portrait",
-				"label": "顔の画像",
-				"type": "media",
-				"accept": ["image"]
+				key: "portrait",
+				label: "顔の画像",
+				type: "media",
+				accept: ["image"]
 			}
 		],
-		"pages": [{ "path": "/authors/{id}" }]
+		pages: [{ path: "/authors/{id}" }]
 	},
 	{
-		"id": "tag",
-		"label": "タグ",
-		"roles": { "title": "label" },
-		"fields": [{
-			"key": "label",
-			"label": "名前",
-			"type": "text",
-			"required": "save"
+		id: "tag",
+		label: "タグ",
+		roles: { title: "label" },
+		fields: [{
+			key: "label",
+			label: "名前",
+			type: "text",
+			required: "save"
 		}]
 	},
-	{
-		"id": "image",
-		"label": "画像",
-		"description": "見せたい点（hotspot）と切り抜き（crop）を画像ごとに1つ保持、切り抜く場所すべてで共通",
-		"fields": [
-			{
-				"key": "mime_type",
-				"label": "形式",
-				"type": "text",
-				"required": "save",
-				"description": "MIME タイプ"
-			},
-			{
-				"key": "size",
-				"label": "サイズ",
-				"type": "number",
-				"required": "save",
-				"description": "バイト数"
-			},
-			{
-				"key": "width",
-				"label": "幅",
-				"type": "number",
-				"required": "save",
-				"description": "px"
-			},
-			{
-				"key": "height",
-				"label": "高さ",
-				"type": "number",
-				"required": "save",
-				"description": "px"
-			},
-			{
-				"key": "alt",
-				"label": "代替テキスト",
-				"type": "text",
-				"description": "使用する側の既定の値、使用する場所ごとに上書き可"
-			}
-		]
-	},
-	{
-		"id": "video",
-		"label": "動画",
-		"fields": [
-			{
-				"key": "mime_type",
-				"label": "形式",
-				"type": "text",
-				"required": "save",
-				"description": "MIME タイプ"
-			},
-			{
-				"key": "size",
-				"label": "サイズ",
-				"type": "number",
-				"required": "save",
-				"description": "バイト数"
-			},
-			{
-				"key": "width",
-				"label": "幅",
-				"type": "number",
-				"required": "save",
-				"description": "px"
-			},
-			{
-				"key": "height",
-				"label": "高さ",
-				"type": "number",
-				"required": "save",
-				"description": "px"
-			},
-			{
-				"key": "alt",
-				"label": "代替テキスト",
-				"type": "text",
-				"description": "使用する側の既定の値、使用する場所ごとに上書き可"
-			},
-			{
-				"key": "duration",
-				"label": "長さ",
-				"type": "number",
-				"description": "秒"
-			},
-			{
-				"key": "poster",
-				"label": "ポスター画像",
-				"type": "media",
-				"accept": ["image"],
-				"description": "読み込み前・動きを抑える設定・OG で代わりに表示"
-			}
-		]
-	}
+	IMAGE_TYPE,
+	VIDEO_TYPE
 ] };
 /** 既定の画面設定（新しい媒体の作成で適用する中立の値、移入する screens の土台） */
 const DEFAULT_SCREENS = {
-	"menu": [
+	menu: [
 		"dashboard",
 		"calendar",
 		{
-			"id": "content",
-			"label": "コンテンツ",
-			"items": ["type:post", "media"]
+			id: "content",
+			label: "コンテンツ",
+			items: [typeItem("post"), "media"]
 		},
 		{
-			"id": "masters",
-			"label": "マスタ",
-			"items": ["type:tag", "type:author"]
+			id: "masters",
+			label: "マスタ",
+			items: [typeItem("tag"), typeItem("author")]
 		}
 	],
-	"editors": { "post": { "sections": [
+	editors: { post: { sections: [
 		{
-			"id": "classify",
-			"label": "分類",
-			"items": ["writers", "tags"]
+			id: "classify",
+			label: "分類",
+			items: ["writers", "tags"]
 		},
 		{
-			"id": "publish",
-			"label": "公開",
-			"items": ["published_at", "revised_at"]
+			id: "publish",
+			label: "公開",
+			items: ["published_at", "revised_at"]
 		},
 		{
-			"id": "excerpt",
-			"label": "説明",
-			"items": ["excerpt"]
+			id: "excerpt",
+			label: "説明",
+			items: ["excerpt"]
 		},
 		{
-			"id": "image",
-			"label": "メインの画像",
-			"items": ["image"]
+			id: "image",
+			label: "メインの画像",
+			items: ["image"]
 		}
 	] } },
-	"columns": { "post": [
+	columns: { post: [
 		"status",
 		"writers",
 		"assignee",

package/dist/types/body/src/inline.d.ts

@@ -0,0 +1,20 @@
+import type { Mark, TextStyle } from './types.js';
+/** 装飾の順序（外側から内側、Markdown と HTML の入れ子の順） */
+export declare const MARK_ORDER: readonly ["strong", "em", "strike", "underline", "mark", "sup", "sub", "code"];
+/** 装飾を MARK_ORDER の順に並べる（重複は1つ） */
+export declare const sortMarks: (marks: readonly Mark[] | undefined) => Mark[];
+/** 装飾の描画の HTML の要素 */
+export declare const MARK_HTML_TAGS: {
+    readonly strong: "strong";
+    readonly em: "em";
+    readonly code: "code";
+    readonly strike: "s";
+    readonly mark: "mark";
+    readonly sup: "sup";
+    readonly sub: "sub";
+    readonly underline: "u";
+};
+/** HTML の要素の装飾（描画の要素と、リッチエディタが使うほかの要素） */
+export declare const HTML_TAG_MARKS: Readonly<Record<string, Mark>>;
+/** 内側の見た目に外側の見た目を重ねる（内側を優先、名前のついた装飾は合わせる） */
+export declare const mergeStyle: (outer: TextStyle | undefined, inner: TextStyle | undefined) => TextStyle | undefined;

package/dist/types/body/src/normalize.d.ts

@@ -1,6 +1,4 @@
-import { type Body, type Mark, type Rich } from './types.js';
-/** 装飾の順序（Markdown では外側から内側） */
-export declare const MARK_ORDER: readonly Mark[];
+import { type Body, type Rich } from './types.js';
 /** インラインの断片の列を正規化 */
 export declare function normalizeRich(rich: Rich): Rich;
 /** 本文を正規化 */

package/dist/types/cms-contract/src/assets.d.ts

@@ -8,3 +8,5 @@ export declare const ASSET_BULK_MAX = 500;
 export declare const ASSET_IMAGE_TYPES: readonly ["image/jpeg", "image/png", "image/webp", "image/gif"];
 /** 画像1枚の大きさの上限（バイト、アップロード・取り込みで共通） */
 export declare const ASSET_SIZE_MAX: number;
+/** ファイルの実体の大きさの上限（バイト、本文の中のファイルの取り込み） */
+export declare const ASSET_FILE_SIZE_MAX: number;

package/dist/types/cms-contract/src/errors.d.ts

@@ -10,6 +10,7 @@ export declare const ERROR_STATUS: {
     readonly file_required: 400;
     readonly file_too_large: 400;
     readonly unsupported_image: 400;
+    readonly unsupported_file: 400;
     readonly invalid_dimensions: 400;
     readonly https_required: 400;
     readonly invalid_style: 400;
@@ -74,7 +75,7 @@ export type ErrorParams = {
     /** 状態の不一致の理由: invalid_state */
     reason?: 'not_draft' | 'no_draft' | 'not_in_review' | 'request_handled' | 'deleted' | 'not_deleted' | 'schema_confirm' | 'no_publishing' | 'no_review' | 'not_published';
     /** 取得の対象: upstream_failed */
-    resource?: 'page' | 'image' | 'webhook' | 'microcms';
+    resource?: 'page' | 'image' | 'webhook' | 'microcms' | 'file';
     /**
      * 名前
      * - no_linked_entry: 結び付くコンテンツタイプの表示名、account_not_found: メールアドレス

package/dist/types/cms-contract/src/import.d.ts

@@ -107,6 +107,7 @@ export type MicroCmsApiInput = Readonly<{
     format: 'list' | 'object';
     schema: unknown;
     relations: Readonly<Record<string, string>>;
+    privateMedia?: boolean;
 }>;
 /** microCMS の型の変換の注意（path は型の id と項目） */
 export type MicroCmsNote = Readonly<{

package/dist/types/cms-contract/src/index.d.ts

@@ -1,5 +1,5 @@
 export { API_KEY_ALL_TYPES, API_KEY_KINDS, API_KEY_OPERATIONS, API_KEY_RATE, API_KEY_WRITE_OPERATIONS, PUBLIC_FAILURE_RATE, apiKeyAllows, type ApiKey, type ApiKeyKind, type ApiKeyOperation, type ApiKeyPermissions, DEFAULT_API_KEY_PERMISSIONS } from './apiKeys.js';
-export { ASSET_BULK_MAX, ASSET_IMAGE_TYPES, ASSET_SIZE_MAX } from './assets.js';
+export { ASSET_BULK_MAX, ASSET_FILE_SIZE_MAX, ASSET_IMAGE_TYPES, ASSET_SIZE_MAX } from './assets.js';
 export { errorLabel, errorTitle, mergeMessages, TARGET_LABELS, targetOf, type TargetMessages } from './errorLabels.js';
 export { ERROR_STATUS, JSON_BODY_MAX, type ErrorBody, type ErrorCode, type ErrorParams, type ErrorTarget } from './errors.js';
 export { CHANGES_LABELS, STATUS } from './labels.js';

package/dist/types/model/src/asset.d.ts

@@ -25,7 +25,7 @@ export type LocalImage = Readonly<{
     height: number;
     format: string;
 }>;
-/** 実体の共通の項目（ID は UUID で R2 のキーと同じ、sha256 は内容のハッシュで同じ画像の重複を防止、ファイル名は保存しない） */
+/** 実体の共通の項目（ID は UUID で R2 のキーと同じ、sha256 は内容のハッシュで同じ画像の重複を防止、visibility は非公開の実体だけ private） */
 type AssetBase = Readonly<{
     id: string;
     mimeType: string;
@@ -37,6 +37,7 @@ type AssetBase = Readonly<{
     hotspot?: Hotspot;
     crop?: Crop;
     createdAt: string;
+    visibility?: 'private';
 }>;
 /** 画像の実体（Sanity の sanity.imageAsset、代替テキストと hotspot は画像ごとに1つ） */
 export type ImageAsset = AssetBase & Readonly<{
@@ -48,12 +49,33 @@ export type VideoAsset = AssetBase & Readonly<{
     duration?: number;
     poster?: string;
 }>;
+/** ファイルの実体（本文の中のファイル、name は元のファイル名、寸法は0） */
+export type FileAsset = AssetBase & Readonly<{
+    kind: 'file';
+    name?: string;
+}>;
 /** 実体（CMS のメディアにある1件） */
-export type Asset = ImageAsset | VideoAsset;
+export type Asset = ImageAsset | VideoAsset | FileAsset;
 /** 使用する側が保存する実体の参照（Sanity の image の asset、表示のときに実体の寸法・代替テキスト・hotspot を合わせて Media に解決） */
 export type AssetRef = Readonly<{
     asset: string;
 }>;
+/** 配信 API が解決した実体（url は配信 URL で配信のオリジンがある CMS だけ、hotspot・crop は元の画像に対する割合） */
+export type DeliveredAsset = Readonly<{
+    id: string;
+    kind: 'image' | 'video' | 'file';
+    url?: string;
+    width: number;
+    height: number;
+    alt: string;
+    hotspot?: Hotspot;
+    crop?: Crop;
+    poster?: DeliveredAsset | null; /** 非公開の実体（url は署名のない配信 URL、signMediaUrl で署名して渡す） */
+    visibility?: 'private'; /** ファイルの元のファイル名・形式・大きさ（バイト） */
+    name?: string;
+    mimeType?: string;
+    size?: number;
+}>;
 /**
  * 表示する素材の共通の項目
  * - src: URL（CMS の実体）か、ビルドで読み込んだ画像

package/dist/types/model/src/index.d.ts

@@ -1,14 +1,14 @@
 export { fieldZod, jsonSchemaOf, normalizeValues, zodOf, type ValueOptions } from './input.js';
-export { assetRefSchema, cropSchema, hotspotSchema, mediaSchema, type Asset, type AssetRef, type Crop, type Hotspot, type LocalImage, type Media } from './asset.js';
+export { assetRefSchema, cropSchema, hotspotSchema, mediaSchema, type Asset, type AssetRef, type Crop, type DeliveredAsset, type Hotspot, type LocalImage, type Media } from './asset.js';
 export { coverPosition, coverStart, cropRect, croppedHotspot, objectPosition, stillOf, type CropRect } from './image.js';
 export { IMAGE_TYPE, VIDEO_TYPE } from './media.js';
-export { IMAGE_SIZE_MAX, imageParamsOf, mediaExtOf, mediaMimeOf, mediaPathOf, parseMediaPath, withImageParams, type ImageParams, type MediaPath } from './mediaUrl.js';
+export { IMAGE_SIZE_MAX, imageParamsOf, MEDIA_SIGNING_KEY_BLOB, mediaBlobKeyOf, mediaExtOf, mediaKindOf, mediaMimeOf, mediaPathOf, parseMediaPath, signMediaUrl, verifyMediaUrl, withImageParams, type ImageParams, type AssetKind, type MediaPath } from './mediaUrl.js';
 export { diffSchema, renameType, type ChangeKind, type ChangeLevel, type DiffOptions, type SchemaChange } from './changes.js';
 export { dateRoleFieldsOf, primaryTypeOf, requiredPrimaryTypeOf, SOURCES_FIELD, sourceIdsOf, sourcesFieldOf, sourceTypeOf, type SourcesField } from './capabilities.js';
 export { appliesTo, checkFields, fieldsFor } from './check.js';
 export { deliveredFields, emptyValues, pickValues, referencedIds, referencesOf, valueFieldsOf } from './values.js';
 export { entryRefsOf, type EntryRef } from './refs.js';
-export { acceptsRole, bodyFieldsOf, computedFieldsOf, FIELD_ROLES, idInputOf, initialValueOf, isEditorial, isInputField, isListType, isMediaType, isSingleton, isStoredType, MEDIA_TYPE_IDS, optionLabelOf, optionsOf, publishingOf, requestReferencesOf, resolvedRolesOf, roleFieldOf, toneOf, typeOf, type ComputedKind, type FieldRole, type FieldRoles, type FieldComputed, type ContentFormat, type ContentModel, type ContentType, type FieldCondition, type FieldDef, type FieldDerive, type FieldFixedBy, type CountDef, type FieldProblem, type MediaKind, type OptionTone, type Publishing, type ReferenceRules, type SelectOption, usesReview } from './model.js';
+export { acceptsRole, bodyFieldsOf, computedFieldsOf, FIELD_ROLES, idInputOf, initialValueOf, isPublishable, isInputField, isListType, isMediaType, isSingleton, isStoredType, MEDIA_TYPE_IDS, optionLabelOf, optionsOf, publishingOf, requestReferencesOf, resolvedRolesOf, roleFieldOf, toneOf, typeOf, type ComputedKind, type FieldRole, type FieldRoles, type FieldComputed, type ContentFormat, type ContentModel, type ContentType, type FieldCondition, type FieldDef, type FieldDerive, type FieldFixedBy, type CountDef, type FieldProblem, type MediaKind, type OptionTone, type Publishing, type ReferenceRules, type SelectOption, usesReview } from './model.js';
 export { hasPublicPage, imageFrameOf, pagePathOf, publicPathOf, withPagesFrom, type ImageFrame, type ImageFrameDef, type PageDef, type PageEntry, type PageRule } from './page.js';
 export { schemaRulesOf, type SchemaRule } from './rules.js';
 export { parseModel } from './schema.js';

package/dist/types/model/src/mediaUrl.d.ts

@@ -1,11 +1,15 @@
 import type { CropRect } from './image.js';
+/** 実体の種類 */
+export type AssetKind = 'image' | 'video' | 'file';
+/** 形式の実体の種類 */
+export declare const mediaKindOf: (mimeType: string) => AssetKind;
 /** 形式の拡張子（配信しない形式は null） */
 export declare const mediaExtOf: (mimeType: string) => string | null;
 /** 拡張子の形式（配信しない拡張子は null） */
 export declare const mediaMimeOf: (ext: string) => string | null;
 /** 配信 URL のパスの要素（寸法は画像だけ） */
 export type MediaPath = Readonly<{
-    kind: 'image' | 'video';
+    kind: AssetKind;
     project: string;
     id: string;
     ext: string;
@@ -14,7 +18,7 @@ export type MediaPath = Readonly<{
 }>;
 /** 配信 URL のパス（媒体・ID の形が不正、配信しない形式なら null） */
 export declare function mediaPathOf({ kind, project, id, mimeType, width, height }: Readonly<{
-    kind: 'image' | 'video';
+    kind: AssetKind;
     project: string;
     id: string;
     mimeType: string;
@@ -23,6 +27,20 @@ export declare function mediaPathOf({ kind, project, id, mimeType, width, height
 }>): string | null;
 /** 配信 URL のパスを解析（形が違えば null） */
 export declare function parseMediaPath(pathname: string): MediaPath | null;
+/** 保存先のキー（媒体の接頭辞の後、非公開は private/ の下） */
+export declare const mediaBlobKeyOf: (id: string, visibility: "public" | "private") => string;
+/** 非公開のメディアの署名の鍵の保存先のキー（媒体の接頭辞の後、配信 URL の ID の形にない「.」で始め、パスから届かない） */
+export declare const MEDIA_SIGNING_KEY_BLOB = ".media-signing";
+/**
+ * 非公開のメディアの署名つきの URL（exp と sig のクエリを付ける、ほかのクエリは残す）
+ * - secret: 媒体の非公開のメディアの署名の鍵、expiresInSec: 期限までの秒、now: 今の UNIX ミリ秒
+ */
+export declare function signMediaUrl(url: string, secret: string, options?: Readonly<{
+    expiresInSec?: number;
+    now?: number;
+}>): Promise<string>;
+/** 署名つきの URL の検査（期限の内で、どれかの鍵の署名と一致すれば期限の UNIX 秒、ほかは null） */
+export declare function verifyMediaUrl(url: URL, secrets: readonly string[], now?: number): Promise<number | null>;
 /** 画像の変換のクエリ（w・h は表示の画素、rect は元の画像の画素での切り抜き、auto=format はブラウザに合わせた形式） */
 export type ImageParams = Readonly<{
     w?: number;

package/dist/types/model/src/model.d.ts

@@ -112,10 +112,12 @@ export type FieldDef = FieldBase & Readonly<{
     type: 'media'; /** 受け付けるメディアの種類（なしはすべて） */
     accept?: readonly MediaKind[];
     multiple?: boolean; /** 画像の枠（先頭から条件に合うもの、page.ts） */
-    frames?: readonly ImageFrameDef[];
+    frames?: readonly ImageFrameDef[]; /** 非公開のメディアだけ（アップロードと取り込みは非公開、公開の実体は保存で拒否） */
+    visibility?: 'private';
 } & Counts) | {
     type: 'body';
-    profile: BodyProfile;
+    profile: BodyProfile; /** 本文の画像とファイルは非公開のメディアだけ */
+    visibility?: 'private';
 } | ({
     type: 'group'; /** まとまりの中の項目（Sanity の object、microCMS のカスタムフィールド） */
     fields: readonly FieldDef[];
@@ -181,7 +183,7 @@ export declare const isListType: (type: ContentType) => boolean;
  * - 機能: 版・楽観ロック・編集中のリース・コメント・公開の前の点検
  * - 提出と差し戻し・担当者: レビューありの型だけ（usesReview）
  */
-export declare const isEditorial: (type: ContentType) => boolean;
+export declare const isPublishable: (type: ContentType) => boolean;
 /**
  * レビューのワークフローを持つ型か（レビューありの一覧の型）
  * - 機能: 提出と差し戻し・担当者（レビューを担当するアカウント）

package/dist/types/{sdk/src/defaults.d.ts → platform/src/defaultModel.d.ts}

@@ -1,4 +1,7 @@
-import type { ContentModel, ScreenSettings } from '../../model/src/index.js';
+import type { BodyProfile } from '../../body/src/index.js';
+import { type ContentModel, type ScreenSettings } from '../../model/src/index.js';
+/** 既定の本文の設定（本文の項目 profile と同じ値） */
+export declare const DEFAULT_BODY_PROFILE: BodyProfile;
 /** 中立の既定のスキーマ（新しい媒体の作成で適用する型: post・author・tag・image・video、設定の移入の土台） */
 export declare const DEFAULT_SCHEMA: ContentModel;
 /** 既定の画面設定（新しい媒体の作成で適用する中立の値、移入する screens の土台） */

package/dist/types/sdk/src/delivery/index.d.ts

@@ -2,8 +2,8 @@ export { cachedDelivery, memoryDeliveryCache, type DeliveryCache } from './cache
 export { readChanges, type Change, type ChangesPage } from './changes.js';
 export { createDeliveryClient, DELIVERY_PATH, DeliveryError, subPath, type BundleResult, type Delivery, type DeliveryClient, type Prefetched } from './client.js';
 export { deliveredImageUrl, mediaOf, type ImageUrl, type MediaOf } from './media.js';
-export { imageParamsOf, parseMediaPath, withImageParams, type ImageParams, type MediaPath } from '../../../model/src/index.js';
+export { imageParamsOf, parseMediaPath, signMediaUrl, withImageParams, type DeliveredAsset, type ImageParams, type MediaPath } from '../../../model/src/index.js';
 export type { FieldPath, Selected } from './fields.js';
 export { listParams, type ListFilter, type ListQuery, type Page } from './query.js';
 export { createDeliveryClock, fieldOf, limitOf, optionLabels, pagePath, type DeliveryClock } from './schema.js';
-export type { DeliveredAsset, FieldValue, Item, ItemMeta, ItemOf } from './values.js';
+export type { FieldValue, Item, ItemMeta, ItemOf } from './values.js';

package/dist/types/sdk/src/delivery/values.d.ts

@@ -1,19 +1,7 @@
 import type { Body } from '../../../body/src/index.js';
-import type { ContentType, Crop, DateString, FieldDef, Hotspot } from '../../../model/src/index.js';
+import type { ContentType, DateString, DeliveredAsset, FieldDef } from '../../../model/src/index.js';
 /** 配信 API の1件の値（id・項目の key・メタ情報 _meta） */
 export type Item = Readonly<Record<string, unknown>>;
-/** 配信 API が解決した実体（url は配信 URL で配信のオリジンがある CMS だけ、hotspot・crop は元の画像に対する割合） */
-export type DeliveredAsset = Readonly<{
-    id: string;
-    kind: 'image' | 'video';
-    url?: string;
-    width: number;
-    height: number;
-    alt: string;
-    hotspot?: Hotspot;
-    crop?: Crop;
-    poster?: DeliveredAsset | null;
-}>;
 /** 項目の1つ分の値（複数の値を持つ項目は FieldValue が配列に、query.ts の絞り込みの値と共通） */
 export type SingleValue<F extends FieldDef> = F extends {
     type: 'text' | 'textarea';

package/dist/types/sdk/src/delivery.d.ts

@@ -1,2 +1,2 @@
-export { cachedDelivery, createDeliveryClient, createDeliveryClock, deliveredImageUrl, DELIVERY_PATH, DeliveryError, fieldOf, imageParamsOf, limitOf, listParams, mediaOf, memoryDeliveryCache, optionLabels, pagePath, parseMediaPath, readChanges, subPath, withImageParams } from './delivery/index.js';
+export { cachedDelivery, createDeliveryClient, createDeliveryClock, deliveredImageUrl, DELIVERY_PATH, DeliveryError, fieldOf, imageParamsOf, limitOf, listParams, mediaOf, memoryDeliveryCache, optionLabels, pagePath, parseMediaPath, readChanges, signMediaUrl, subPath, withImageParams } from './delivery/index.js';
 export type { BundleResult, Change, ChangesPage, DeliveredAsset, Delivery, DeliveryCache, DeliveryClient, DeliveryClock, FieldValue, ImageParams, ImageUrl, Item, ItemMeta, ItemOf, FieldPath, ListFilter, ListQuery, MediaOf, MediaPath, Page, Prefetched, Selected } from './delivery/index.js';

package/dist/types/sdk/src/model.d.ts

@@ -2,4 +2,4 @@ export { coverPosition, coverStart, createClock, cropRect, croppedHotspot, IMAGE
 export type { Asset, AssetRef, Clock, ContentModel, ContentType, Crop, CropRect, DateString, FieldDef, Hotspot, LocalImage, Media, PageDef, PageEntry, ScreenSettings } from '../../model/src/index.js';
 export { CONFIG_FORMAT } from '../../cms-contract/src/index.js';
 export type { ConfigBundle } from '../../cms-contract/src/index.js';
-export { DEFAULT_SCHEMA, DEFAULT_SCREENS } from './defaults.js';
+export { DEFAULT_SCHEMA, DEFAULT_SCREENS } from '../../platform/src/defaultModel.js';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ryusenkei/maezae",
-  "version": "0.17.0",
+  "version": "0.18.1",
   "description": "maezae の導入先のサイト向けの SDK（配信 API の取得・本文の型・プレビューの署名・手元の開発の配信 API）",
   "license": "UNLICENSED",
   "author": "RYUSENKEI",