@stapel/cdn-react 0.1.0

package/dist/model/hash.js

@@ -0,0 +1,59 @@
+/**
+ * SHA-256 of a file's bytes — the key the dedup pre-check is asked with.
+ *
+ * The backend computes the same digest over the same bytes
+ * (`Image.calculate_file_hash`, `hashlib.sha256(...).hexdigest()`), so the two
+ * agree by construction: 64 lowercase hex characters of the ORIGINAL upload,
+ * before any variant exists.
+ *
+ * ── Why this can be unavailable, and why that is not an error ──────────────
+ *
+ * `crypto.subtle` exists only in a SECURE CONTEXT. On `http://` (a LAN test
+ * box, an old staging host) it is simply not there, and neither is the
+ * pre-check. That is a lost optimisation, not a lost upload: the server
+ * deduplicates on its own side regardless, so the POST is still correct — it
+ * just costs the bytes. {@link canHashLocally} lets the flow say which of the
+ * two paths it took instead of failing, and `UploadItem.dedupSkipped` carries
+ * the reason all the way to a skin that wants to explain it.
+ *
+ * ── Why there is no progress here ──────────────────────────────────────────
+ *
+ * `SubtleCrypto.digest` takes the whole buffer and returns one promise; it
+ * reports nothing in between and cannot be chunked without hand-rolling
+ * SHA-256, which is not a thing to hand-roll. Hashing is therefore a PHASE
+ * with a duration, not a percentage — see `model/upload.ts` on why the whole
+ * bag is phase-shaped.
+ */
+/** Whether this context can compute the digest at all (see the header). */
+export function canHashLocally() {
+    return (typeof globalThis.crypto !== "undefined" &&
+        typeof globalThis.crypto.subtle?.digest === "function");
+}
+function toHex(buffer) {
+    const bytes = new Uint8Array(buffer);
+    let out = "";
+    for (const byte of bytes)
+        out += byte.toString(16).padStart(2, "0");
+    return out;
+}
+/**
+ * `digest` is handed a `Uint8Array` VIEW rather than the raw `ArrayBuffer`.
+ * Both are valid `BufferSource`, but a buffer that crossed a realm boundary
+ * fails a strict `instanceof ArrayBuffer` check in some implementations (jsdom
+ * is one, which is where this surfaced), while a typed-array view is accepted
+ * everywhere. The view costs nothing — no copy — and removes a portability
+ * hazard that would otherwise only show up in somebody else's environment.
+ */
+const bufferSource = (buffer) => new Uint8Array(buffer);
+/**
+ * The 64-character lowercase hex SHA-256 of `blob`'s bytes.
+ *
+ * Throws whatever the platform throws when there is no `crypto.subtle` — call
+ * {@link canHashLocally} first; the upload flow does.
+ */
+export async function sha256Hex(blob) {
+    const buffer = await blob.arrayBuffer();
+    const digest = await globalThis.crypto.subtle.digest("SHA-256", bufferSource(buffer));
+    return toHex(digest);
+}
+//# sourceMappingURL=hash.js.map

package/dist/model/hash.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hash.js","sourceRoot":"","sources":["../../src/model/hash.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,2EAA2E;AAC3E,MAAM,UAAU,cAAc;IAC5B,OAAO,CACL,OAAO,UAAU,CAAC,MAAM,KAAK,WAAW;QACxC,OAAO,UAAU,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,KAAK,UAAU,CACvD,CAAC;AACJ,CAAC;AAED,SAAS,KAAK,CAAC,MAAmB;IAChC,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC;IACrC,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,MAAM,IAAI,IAAI,KAAK;QAAE,GAAG,IAAI,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACpE,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,YAAY,GAAG,CAAC,MAAmB,EAA2B,EAAE,CACpE,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC;AAEzB;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,IAAU;IACxC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC;IACxC,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAClD,SAAS,EACT,YAAY,CAAC,MAAM,CAAC,CACrB,CAAC;IACF,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC;AACvB,CAAC"}

package/dist/model/limits.d.ts

@@ -0,0 +1,86 @@
+/**
+ * The client-side mirror of stapel-cdn's own intake gates.
+ *
+ * ── Why mirror at all ──────────────────────────────────────────────────────
+ *
+ * Because the alternative is uploading 40 MB over a phone connection to be
+ * told "File is too large" by the server that just received all of it. The
+ * gates below are the cheap half of what `_validate_image_upload` does before
+ * it hashes a byte (`stapel_cdn/views.py`): the size ceiling and the extension
+ * allowlist. The expensive half — an actual libvips decode, which is what
+ * catches a `.jpg` full of HTML — has no browser equivalent and is not
+ * simulated here. A file that passes this mirror can still be refused, and
+ * that refusal renders through the same error contour as any other.
+ *
+ * ── The rule the mirror must never break ───────────────────────────────────
+ *
+ * A MIRROR THAT REFUSES WHAT THE SERVER WOULD ACCEPT IS WORSE THAN NO MIRROR.
+ * It blocks a valid upload with no way for the person to appeal, and the
+ * server never even hears about it. So every ceiling here is CONFIGURABLE on
+ * the runtime and defaults to the library's own default — because all of them
+ * are `STAPEL_CDN` settings a deployment moves (`stapel_cdn/conf.py`), and a
+ * hardcoded 20 MB would be a client-side lie on a host that raised it. The
+ * same argument in the opposite direction: a host that LOWERED the ceiling
+ * passes its number here and gets the refusal early, which is the point.
+ *
+ * The refusals below are raised with stapel-cdn's OWN error codes, so a skin
+ * renders "File is too large" from the generated bundle whether the sentence
+ * came from here or from the server. There is no second vocabulary for
+ * client-side refusals.
+ */
+import { StapelApiError } from "@stapel/core";
+/** `error.413.file_too_large` — the byte ceiling, from `MAX_*_SIZE`. */
+export declare const ERROR_FILE_TOO_LARGE = "error.413.file_too_large";
+/** `error.400.invalid_format` — the extension allowlist. */
+export declare const ERROR_INVALID_FORMAT = "error.400.invalid_format";
+/** `error.400.no_file` — an empty pick. */
+export declare const ERROR_NO_FILE = "error.400.no_file";
+/**
+ * The ceilings for one intake kind. Defaults reproduce `stapel_cdn/conf.py`'s
+ * `DEFAULTS` at the pinned contract (v0.12.0).
+ */
+export interface CdnIntakeLimits {
+    /** Byte ceiling. `STAPEL_CDN["MAX_IMAGE_SIZE" | …]`. */
+    readonly maxBytes: number;
+    /** Lowercase extensions INCLUDING the dot, as the backend stores them. */
+    readonly extensions: readonly string[];
+    /**
+     * MIME types the backend narrows on, when it narrows on MIME at all. Only
+     * the generic-file intake does (`ALLOWED_FILE_MIME_TYPES`); images and
+     * videos are gated on the extension plus a decode/sniff, so this is
+     * `undefined` for them rather than a guess. An empty array would mean
+     * "nothing is allowed", which is a different and wrong statement.
+     */
+    readonly mimeTypes?: readonly string[];
+}
+export interface CdnLimits {
+    readonly image: CdnIntakeLimits;
+    readonly video: CdnIntakeLimits;
+    readonly file: CdnIntakeLimits;
+}
+/** stapel-cdn's library defaults — the mirror's starting point. */
+export declare const CDN_DEFAULT_LIMITS: CdnLimits;
+/** Host overrides — every field optional, merged over the defaults. */
+export interface CdnLimitsOverride {
+    readonly image?: Partial<CdnIntakeLimits>;
+    readonly video?: Partial<CdnIntakeLimits>;
+    readonly file?: Partial<CdnIntakeLimits>;
+}
+export declare function resolveCdnLimits(override?: CdnLimitsOverride): CdnLimits;
+/** The lowercase extension of a filename, dot included, or `""`. */
+export declare function fileExtension(name: string): string;
+/**
+ * The `accept` attribute for a file input, built from the same allowlist the
+ * refusal is built from — so the picker and the gate cannot disagree.
+ */
+export declare function acceptAttribute(limits: CdnIntakeLimits): string;
+/**
+ * Check one file against one intake's ceilings.
+ *
+ * Returns the refusal as a {@link StapelApiError} in stapel-cdn's own
+ * vocabulary, or `null` when the file may be sent. Never throws: the caller
+ * (a queue admitting ten files at once) needs a per-file verdict, not a
+ * control-flow interruption on the first bad one.
+ */
+export declare function validateFile(file: File, limits: CdnIntakeLimits): StapelApiError | null;
+//# sourceMappingURL=limits.d.ts.map

package/dist/model/limits.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"limits.d.ts","sourceRoot":"","sources":["../../src/model/limits.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAE9C,wEAAwE;AACxE,eAAO,MAAM,oBAAoB,6BAA6B,CAAC;AAC/D,4DAA4D;AAC5D,eAAO,MAAM,oBAAoB,6BAA6B,CAAC;AAC/D,2CAA2C;AAC3C,eAAO,MAAM,aAAa,sBAAsB,CAAC;AAEjD;;;GAGG;AACH,MAAM,WAAW,eAAe;IAC9B,wDAAwD;IACxD,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,0EAA0E;IAC1E,QAAQ,CAAC,UAAU,EAAE,SAAS,MAAM,EAAE,CAAC;IACvC;;;;;;OAMG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACxC;AAED,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,KAAK,EAAE,eAAe,CAAC;IAChC,QAAQ,CAAC,KAAK,EAAE,eAAe,CAAC;IAChC,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAC;CAChC;AAID,mEAAmE;AACnE,eAAO,MAAM,kBAAkB,EAAE,SA+BhC,CAAC;AAEF,uEAAuE;AACvE,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC,eAAe,CAAC,CAAC;IAC1C,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC,eAAe,CAAC,CAAC;IAC1C,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,eAAe,CAAC,CAAC;CAC1C;AAkBD,wBAAgB,gBAAgB,CAAC,QAAQ,CAAC,EAAE,iBAAiB,GAAG,SAAS,CAMxE;AAED,oEAAoE;AACpE,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAIlD;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,eAAe,GAAG,MAAM,CAI/D;AAED;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAC1B,IAAI,EAAE,IAAI,EACV,MAAM,EAAE,eAAe,GACtB,cAAc,GAAG,IAAI,CA+CvB"}

package/dist/model/limits.js

@@ -0,0 +1,163 @@
+/**
+ * The client-side mirror of stapel-cdn's own intake gates.
+ *
+ * ── Why mirror at all ──────────────────────────────────────────────────────
+ *
+ * Because the alternative is uploading 40 MB over a phone connection to be
+ * told "File is too large" by the server that just received all of it. The
+ * gates below are the cheap half of what `_validate_image_upload` does before
+ * it hashes a byte (`stapel_cdn/views.py`): the size ceiling and the extension
+ * allowlist. The expensive half — an actual libvips decode, which is what
+ * catches a `.jpg` full of HTML — has no browser equivalent and is not
+ * simulated here. A file that passes this mirror can still be refused, and
+ * that refusal renders through the same error contour as any other.
+ *
+ * ── The rule the mirror must never break ───────────────────────────────────
+ *
+ * A MIRROR THAT REFUSES WHAT THE SERVER WOULD ACCEPT IS WORSE THAN NO MIRROR.
+ * It blocks a valid upload with no way for the person to appeal, and the
+ * server never even hears about it. So every ceiling here is CONFIGURABLE on
+ * the runtime and defaults to the library's own default — because all of them
+ * are `STAPEL_CDN` settings a deployment moves (`stapel_cdn/conf.py`), and a
+ * hardcoded 20 MB would be a client-side lie on a host that raised it. The
+ * same argument in the opposite direction: a host that LOWERED the ceiling
+ * passes its number here and gets the refusal early, which is the point.
+ *
+ * The refusals below are raised with stapel-cdn's OWN error codes, so a skin
+ * renders "File is too large" from the generated bundle whether the sentence
+ * came from here or from the server. There is no second vocabulary for
+ * client-side refusals.
+ */
+import { StapelApiError } from "@stapel/core";
+/** `error.413.file_too_large` — the byte ceiling, from `MAX_*_SIZE`. */
+export const ERROR_FILE_TOO_LARGE = "error.413.file_too_large";
+/** `error.400.invalid_format` — the extension allowlist. */
+export const ERROR_INVALID_FORMAT = "error.400.invalid_format";
+/** `error.400.no_file` — an empty pick. */
+export const ERROR_NO_FILE = "error.400.no_file";
+const MB = 1024 * 1024;
+/** stapel-cdn's library defaults — the mirror's starting point. */
+export const CDN_DEFAULT_LIMITS = {
+    image: {
+        maxBytes: 20 * MB,
+        extensions: [".jpg", ".jpeg", ".png", ".gif", ".webp", ".bmp", ".heic", ".heif"],
+    },
+    video: {
+        maxBytes: 100 * MB,
+        extensions: [".mp4", ".webm", ".mov", ".avi", ".mkv"],
+    },
+    file: {
+        maxBytes: 50 * MB,
+        extensions: [
+            ".pdf", ".doc", ".docx", ".xls", ".xlsx", ".ppt", ".pptx",
+            ".txt", ".csv", ".zip", ".rar", ".7z", ".gz",
+        ],
+        mimeTypes: [
+            "application/pdf",
+            "application/msword",
+            "application/vnd.openxmlformats-officedocument.wordprocessingml.document",
+            "application/vnd.ms-excel",
+            "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",
+            "application/vnd.ms-powerpoint",
+            "application/vnd.openxmlformats-officedocument.presentationml.presentation",
+            "text/plain",
+            "text/csv",
+            "application/zip",
+            "application/x-rar-compressed",
+            "application/x-7z-compressed",
+            "application/gzip",
+        ],
+    },
+};
+function mergeIntake(base, override) {
+    if (override === undefined)
+        return base;
+    return {
+        maxBytes: override.maxBytes ?? base.maxBytes,
+        extensions: override.extensions ?? base.extensions,
+        ...(override.mimeTypes !== undefined
+            ? { mimeTypes: override.mimeTypes }
+            : base.mimeTypes !== undefined
+                ? { mimeTypes: base.mimeTypes }
+                : {}),
+    };
+}
+export function resolveCdnLimits(override) {
+    return {
+        image: mergeIntake(CDN_DEFAULT_LIMITS.image, override?.image),
+        video: mergeIntake(CDN_DEFAULT_LIMITS.video, override?.video),
+        file: mergeIntake(CDN_DEFAULT_LIMITS.file, override?.file),
+    };
+}
+/** The lowercase extension of a filename, dot included, or `""`. */
+export function fileExtension(name) {
+    const dot = name.lastIndexOf(".");
+    if (dot <= 0 || dot === name.length - 1)
+        return "";
+    return name.slice(dot).toLowerCase();
+}
+/**
+ * The `accept` attribute for a file input, built from the same allowlist the
+ * refusal is built from — so the picker and the gate cannot disagree.
+ */
+export function acceptAttribute(limits) {
+    const parts = [...limits.extensions];
+    if (limits.mimeTypes !== undefined)
+        parts.push(...limits.mimeTypes);
+    return parts.join(",");
+}
+/**
+ * Check one file against one intake's ceilings.
+ *
+ * Returns the refusal as a {@link StapelApiError} in stapel-cdn's own
+ * vocabulary, or `null` when the file may be sent. Never throws: the caller
+ * (a queue admitting ten files at once) needs a per-file verdict, not a
+ * control-flow interruption on the first bad one.
+ */
+export function validateFile(file, limits) {
+    if (file.size === 0) {
+        return new StapelApiError({
+            code: ERROR_NO_FILE,
+            message: "No file provided",
+            status: 400,
+        });
+    }
+    if (file.size > limits.maxBytes) {
+        return new StapelApiError({
+            code: ERROR_FILE_TOO_LARGE,
+            message: "File is too large",
+            // The server answers 413 for this; the mirror says the same number so a
+            // host branching on `status` cannot tell the two apart — which is the
+            // intent. `params` carries what the sentence would need to be specific,
+            // even though the backend's own copy has no slots today.
+            status: 413,
+            params: { max_bytes: limits.maxBytes, size: file.size },
+        });
+    }
+    const extension = fileExtension(file.name);
+    if (!limits.extensions.includes(extension)) {
+        return new StapelApiError({
+            code: ERROR_INVALID_FORMAT,
+            message: "Unsupported file format",
+            status: 400,
+            params: { extension, allowed: limits.extensions.join(", ") },
+        });
+    }
+    // MIME is checked only where the backend checks it, and only when the
+    // browser actually supplied one. A blank `file.type` is common (an
+    // extension the OS does not know) and is NOT evidence of a bad file — the
+    // backend reads the declared Content-Type the same way, as a narrowing
+    // device rather than a verdict.
+    if (limits.mimeTypes !== undefined &&
+        file.type.length > 0 &&
+        !limits.mimeTypes.includes(file.type)) {
+        return new StapelApiError({
+            code: ERROR_INVALID_FORMAT,
+            message: "Unsupported file format",
+            status: 400,
+            params: { mime: file.type },
+        });
+    }
+    return null;
+}
+//# sourceMappingURL=limits.js.map

package/dist/model/limits.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"limits.js","sourceRoot":"","sources":["../../src/model/limits.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAE9C,wEAAwE;AACxE,MAAM,CAAC,MAAM,oBAAoB,GAAG,0BAA0B,CAAC;AAC/D,4DAA4D;AAC5D,MAAM,CAAC,MAAM,oBAAoB,GAAG,0BAA0B,CAAC;AAC/D,2CAA2C;AAC3C,MAAM,CAAC,MAAM,aAAa,GAAG,mBAAmB,CAAC;AA2BjD,MAAM,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAEvB,mEAAmE;AACnE,MAAM,CAAC,MAAM,kBAAkB,GAAc;IAC3C,KAAK,EAAE;QACL,QAAQ,EAAE,EAAE,GAAG,EAAE;QACjB,UAAU,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC;KACjF;IACD,KAAK,EAAE;QACL,QAAQ,EAAE,GAAG,GAAG,EAAE;QAClB,UAAU,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;KACtD;IACD,IAAI,EAAE;QACJ,QAAQ,EAAE,EAAE,GAAG,EAAE;QACjB,UAAU,EAAE;YACV,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO;YACzD,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK;SAC7C;QACD,SAAS,EAAE;YACT,iBAAiB;YACjB,oBAAoB;YACpB,yEAAyE;YACzE,0BAA0B;YAC1B,mEAAmE;YACnE,+BAA+B;YAC/B,2EAA2E;YAC3E,YAAY;YACZ,UAAU;YACV,iBAAiB;YACjB,8BAA8B;YAC9B,6BAA6B;YAC7B,kBAAkB;SACnB;KACF;CACF,CAAC;AASF,SAAS,WAAW,CAClB,IAAqB,EACrB,QAA8C;IAE9C,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACxC,OAAO;QACL,QAAQ,EAAE,QAAQ,CAAC,QAAQ,IAAI,IAAI,CAAC,QAAQ;QAC5C,UAAU,EAAE,QAAQ,CAAC,UAAU,IAAI,IAAI,CAAC,UAAU;QAClD,GAAG,CAAC,QAAQ,CAAC,SAAS,KAAK,SAAS;YAClC,CAAC,CAAC,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS,EAAE;YACnC,CAAC,CAAC,IAAI,CAAC,SAAS,KAAK,SAAS;gBAC5B,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE;gBAC/B,CAAC,CAAC,EAAE,CAAC;KACV,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,QAA4B;IAC3D,OAAO;QACL,KAAK,EAAE,WAAW,CAAC,kBAAkB,CAAC,KAAK,EAAE,QAAQ,EAAE,KAAK,CAAC;QAC7D,KAAK,EAAE,WAAW,CAAC,kBAAkB,CAAC,KAAK,EAAE,QAAQ,EAAE,KAAK,CAAC;QAC7D,IAAI,EAAE,WAAW,CAAC,kBAAkB,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC;KAC3D,CAAC;AACJ,CAAC;AAED,oEAAoE;AACpE,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,GAAG,IAAI,CAAC,IAAI,GAAG,KAAK,IAAI,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,EAAE,CAAC;IACnD,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;AACvC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,MAAuB;IACrD,MAAM,KAAK,GAAG,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC;IACrC,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS;QAAE,KAAK,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC;IACpE,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACzB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,YAAY,CAC1B,IAAU,EACV,MAAuB;IAEvB,IAAI,IAAI,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QACpB,OAAO,IAAI,cAAc,CAAC;YACxB,IAAI,EAAE,aAAa;YACnB,OAAO,EAAE,kBAAkB;YAC3B,MAAM,EAAE,GAAG;SACZ,CAAC,CAAC;IACL,CAAC;IACD,IAAI,IAAI,CAAC,IAAI,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC;QAChC,OAAO,IAAI,cAAc,CAAC;YACxB,IAAI,EAAE,oBAAoB;YAC1B,OAAO,EAAE,mBAAmB;YAC5B,wEAAwE;YACxE,sEAAsE;YACtE,wEAAwE;YACxE,yDAAyD;YACzD,MAAM,EAAE,GAAG;YACX,MAAM,EAAE,EAAE,SAAS,EAAE,MAAM,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE;SACxD,CAAC,CAAC;IACL,CAAC;IACD,MAAM,SAAS,GAAG,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC3C,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QAC3C,OAAO,IAAI,cAAc,CAAC;YACxB,IAAI,EAAE,oBAAoB;YAC1B,OAAO,EAAE,yBAAyB;YAClC,MAAM,EAAE,GAAG;YACX,MAAM,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;SAC7D,CAAC,CAAC;IACL,CAAC;IACD,sEAAsE;IACtE,mEAAmE;IACnE,0EAA0E;IAC1E,uEAAuE;IACvE,gCAAgC;IAChC,IACE,MAAM,CAAC,SAAS,KAAK,SAAS;QAC9B,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC;QACpB,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EACrC,CAAC;QACD,OAAO,IAAI,cAAc,CAAC;YACxB,IAAI,EAAE,oBAAoB;YAC1B,OAAO,EAAE,yBAAyB;YAClC,MAAM,EAAE,GAAG;YACX,MAAM,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE;SAC5B,CAAC,CAAC;IACL,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/model/queries.d.ts

@@ -0,0 +1,29 @@
+import type { LoadState } from "@stapel/core";
+import type { CdnImage, CdnRef } from "../api/types.js";
+/**
+ * Resolve a stored `<type>/<hash>` reference back to the CDN row — the read
+ * that lets a composer REOPEN a draft and show what is already attached to it.
+ *
+ * ── The scope this read has, stated rather than discovered ─────────────────
+ *
+ * `file/exists/` filters on `uploaded_by=request.user`, always. So this
+ * resolves the CALLER'S OWN references and nothing else: it is the right
+ * instrument for "my draft's photos" and the wrong one for "this seller's
+ * photos". A buyer's storefront renders a listing's images from what the
+ * listings API gives it, not from here — stapel-cdn exposes no public
+ * read-by-reference endpoint at all (recorded as an upstream gap in the
+ * package README).
+ *
+ * A reference that resolves to nothing answers `ready(null)`, not `failed`:
+ * `{exists: false}` is a 200 and a true answer. "This reference is not mine /
+ * no longer stored" and "we could not ask" are different sentences and a skin
+ * must be able to tell them apart — which is why the value behind `ready` is
+ * nullable and the failure lives in the discriminant.
+ */
+export interface CdnRefBag {
+    readonly state: LoadState<CdnImage | null>;
+    readonly isFetching: boolean;
+    refetch(): void;
+}
+export declare function useCdnRef(ref: CdnRef | null | undefined): CdnRefBag;
+//# sourceMappingURL=queries.d.ts.map

package/dist/model/queries.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"queries.d.ts","sourceRoot":"","sources":["../../src/model/queries.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,KAAK,EAAyB,QAAQ,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAK/E;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC;IAC3C,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;IAC7B,OAAO,IAAI,IAAI,CAAC;CACjB;AAED,wBAAgB,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,SAAS,CA6BnE"}

package/dist/model/queries.js

@@ -0,0 +1,32 @@
+import { useQuery } from "@tanstack/react-query";
+import { loadStateFromQuery, useActiveSessionReady } from "@stapel/core";
+import { useCdnApi } from "./context.js";
+import { cdnQueryKeys } from "./queryKeys.js";
+import { parseCdnRef } from "./refs.js";
+export function useCdnRef(ref) {
+    const api = useCdnApi();
+    // Gated on the session for the reason core's own doc comment gives: the
+    // endpoint is `IsAuthenticated`, so firing it during the login bootstrap
+    // buys one guaranteed 401 per mounted thumbnail.
+    const sessionReady = useActiveSessionReady();
+    const parsed = ref === null || ref === undefined ? null : parseCdnRef(ref);
+    const query = useQuery({
+        queryKey: cdnQueryKeys.exists(parsed?.fileHash ?? ""),
+        queryFn: ({ signal }) => api.fileExists(parsed?.fileHash ?? "", { signal }),
+        enabled: sessionReady && parsed !== null,
+        // A content-addressed row does not change. Its VARIANTS do, once, when the
+        // background task finishes — the upload flow waits for that itself, so a
+        // refetch here would only re-ask a settled question.
+        staleTime: Number.POSITIVE_INFINITY,
+        retry: false,
+        select: (data) => data.exists && data.type === "image" && data.file !== null
+            ? data.file
+            : null,
+    });
+    return {
+        state: loadStateFromQuery(query),
+        isFetching: query.isFetching,
+        refetch: () => void query.refetch(),
+    };
+}
+//# sourceMappingURL=queries.js.map

package/dist/model/queries.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"queries.js","sourceRoot":"","sources":["../../src/model/queries.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AACjD,OAAO,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AAGzE,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AA4BxC,MAAM,UAAU,SAAS,CAAC,GAA8B;IACtD,MAAM,GAAG,GAAG,SAAS,EAAE,CAAC;IACxB,wEAAwE;IACxE,yEAAyE;IACzE,iDAAiD;IACjD,MAAM,YAAY,GAAG,qBAAqB,EAAE,CAAC;IAC7C,MAAM,MAAM,GAAG,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAE3E,MAAM,KAAK,GAAG,QAAQ,CAAC;QACrB,QAAQ,EAAE,YAAY,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,IAAI,EAAE,CAAC;QACrD,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,EAAkC,EAAE,CACtD,GAAG,CAAC,UAAU,CAAC,MAAM,EAAE,QAAQ,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC;QACpD,OAAO,EAAE,YAAY,IAAI,MAAM,KAAK,IAAI;QACxC,2EAA2E;QAC3E,yEAAyE;QACzE,qDAAqD;QACrD,SAAS,EAAE,MAAM,CAAC,iBAAiB;QACnC,KAAK,EAAE,KAAK;QACZ,MAAM,EAAE,CAAC,IAAI,EAAmB,EAAE,CAChC,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI;YACxD,CAAC,CAAE,IAAI,CAAC,IAAiB;YACzB,CAAC,CAAC,IAAI;KACX,CAAC,CAAC;IAEH,OAAO;QACL,KAAK,EAAE,kBAAkB,CAAC,KAAK,CAAC;QAChC,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,OAAO,EAAE,GAAG,EAAE,CAAC,KAAK,KAAK,CAAC,OAAO,EAAE;KACpC,CAAC;AACJ,CAAC"}

package/dist/model/queryKeys.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Namespaced TanStack Query keys (frontend-standard §2). Everything under the
+ * `"cdn"` root so a host can invalidate the whole module or match a single
+ * read.
+ *
+ * There is exactly one cached read in this pair, and it is keyed on the CONTENT
+ * HASH rather than on the reference string. Two references that differ only in
+ * asset type (`avatar/<h>` and `product/<h>`) resolve through the same
+ * `file/exists/` call and must not fetch twice; and because the hash IS the
+ * identity of the bytes, a key built from it can never go stale in the way a
+ * mutable row's key can. Uploads are mutations and cache nothing.
+ */
+export declare const cdnQueryKeys: {
+    readonly all: readonly ["cdn"];
+    /** The owner-scoped `file/exists/` read for one content hash. */
+    exists(fileHash: string): readonly ["cdn", "exists", string];
+};
+//# sourceMappingURL=queryKeys.d.ts.map

package/dist/model/queryKeys.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"queryKeys.d.ts","sourceRoot":"","sources":["../../src/model/queryKeys.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAIH,eAAO,MAAM,YAAY,EAAE;IACzB,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAC,KAAK,CAAC,CAAC;IAC/B,iEAAiE;IACjE,MAAM,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;CAI9D,CAAC"}

package/dist/model/queryKeys.js

@@ -0,0 +1,18 @@
+/**
+ * Namespaced TanStack Query keys (frontend-standard §2). Everything under the
+ * `"cdn"` root so a host can invalidate the whole module or match a single
+ * read.
+ *
+ * There is exactly one cached read in this pair, and it is keyed on the CONTENT
+ * HASH rather than on the reference string. Two references that differ only in
+ * asset type (`avatar/<h>` and `product/<h>`) resolve through the same
+ * `file/exists/` call and must not fetch twice; and because the hash IS the
+ * identity of the bytes, a key built from it can never go stale in the way a
+ * mutable row's key can. Uploads are mutations and cache nothing.
+ */
+const ROOT = "cdn";
+export const cdnQueryKeys = {
+    all: [ROOT],
+    exists: (fileHash) => [ROOT, "exists", fileHash],
+};
+//# sourceMappingURL=queryKeys.js.map

package/dist/model/queryKeys.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"queryKeys.js","sourceRoot":"","sources":["../../src/model/queryKeys.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,MAAM,IAAI,GAAG,KAAc,CAAC;AAE5B,MAAM,CAAC,MAAM,YAAY,GAIrB;IACF,GAAG,EAAE,CAAC,IAAI,CAAC;IACX,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,QAAQ,EAAE,QAAQ,CAAC;CACjD,CAAC"}

package/dist/model/refs.d.ts

@@ -0,0 +1,54 @@
+/**
+ * The `<type>/<hash>` reference — the unit this pair hands out — and the one
+ * conversion between stapel-cdn's variant ladder and `@stapel/image`'s.
+ *
+ * `Profile.avatar` stores a reference. `Listing.images_draft` stores a list of
+ * them ("Opaque list of CDN image references", `stapel_listings/models.py`).
+ * Neither stores a URL, and this pair does not invent one: the reference is
+ * content-addressed and opaque, and the URLs live on the row the CDN returns.
+ */
+import type { StapelImage } from "@stapel/image";
+import type { CdnImage, CdnRef, ParsedCdnRef } from "../api/types.js";
+/** Build the reference for an asset type and a content hash. */
+export declare function formatCdnRef(assetType: string, fileHash: string): CdnRef;
+/**
+ * Split a reference into its halves, or `null` when the string is not one.
+ *
+ * Strict about the hash (64 lowercase hex — what the backend writes) and
+ * deliberately loose about the type, which is whatever this deployment put in
+ * `STAPEL_CDN["ASSET_TYPES"]` plus the hardcoded `product` of the general
+ * image endpoint. Rejecting an unfamiliar type here would refuse a host's own
+ * configuration.
+ */
+export declare function parseCdnRef(ref: CdnRef): ParsedCdnRef | null;
+/**
+ * Convert an uploaded image row into the source-agnostic descriptor
+ * `@stapel/image`'s `<Image>` consumes.
+ *
+ * THE TWO CONTRACTS DISAGREE ON ONE FIELD AND THIS IS THE ONLY PLACE THAT
+ * KNOWS. stapel-cdn's `variants_meta[].tier` is an integer; `@stapel/image`
+ * reads the `stapel_core.media.dto` form, where `tier` is a decimal STRING
+ * with an `"original"` sentinel. Converting at the boundary costs one map and
+ * keeps both sides honest; teaching either one the other's shape would put a
+ * conditional in every renderer.
+ *
+ * `branch` is optional upstream and absent for thumbnail-class tiers; the
+ * renderer's contract wants an explicit `null` there, which is the same
+ * statement said out loud.
+ *
+ * The type import above is TYPE-ONLY and `@stapel/image` is an OPTIONAL peer:
+ * a host that renders its own images carries no dependency on it and this
+ * function still typechecks, because nothing of it survives to runtime.
+ */
+export declare function toStapelImage(image: CdnImage): StapelImage;
+/**
+ * The reference for an uploaded image row.
+ *
+ * Reads `prefix` — the serializer's own `<type>/<hash>` — rather than
+ * rebuilding it from `type` and `file_hash`, so a host that reconfigures the
+ * layout upstream does not get a reference this pair invented.
+ */
+export declare function refOf(image: {
+    readonly prefix: string;
+}): CdnRef;
+//# sourceMappingURL=refs.d.ts.map

package/dist/model/refs.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"refs.d.ts","sourceRoot":"","sources":["../../src/model/refs.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,KAAK,EAAE,WAAW,EAAe,MAAM,eAAe,CAAC;AAC9D,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAItE,gEAAgE;AAChE,wBAAgB,YAAY,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAExE;AAED;;;;;;;;GAQG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,YAAY,GAAG,IAAI,CAO5D;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,QAAQ,GAAG,WAAW,CA2B1D;AAED;;;;;;GAMG;AACH,wBAAgB,KAAK,CAAC,KAAK,EAAE;IAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAEhE"}

package/dist/model/refs.js

@@ -0,0 +1,82 @@
+const HASH = /^[0-9a-f]{64}$/;
+/** Build the reference for an asset type and a content hash. */
+export function formatCdnRef(assetType, fileHash) {
+    return `${assetType}/${fileHash}`;
+}
+/**
+ * Split a reference into its halves, or `null` when the string is not one.
+ *
+ * Strict about the hash (64 lowercase hex — what the backend writes) and
+ * deliberately loose about the type, which is whatever this deployment put in
+ * `STAPEL_CDN["ASSET_TYPES"]` plus the hardcoded `product` of the general
+ * image endpoint. Rejecting an unfamiliar type here would refuse a host's own
+ * configuration.
+ */
+export function parseCdnRef(ref) {
+    const slash = ref.indexOf("/");
+    if (slash <= 0)
+        return null;
+    const assetType = ref.slice(0, slash);
+    const fileHash = ref.slice(slash + 1);
+    if (!HASH.test(fileHash))
+        return null;
+    return { assetType, fileHash };
+}
+/**
+ * Convert an uploaded image row into the source-agnostic descriptor
+ * `@stapel/image`'s `<Image>` consumes.
+ *
+ * THE TWO CONTRACTS DISAGREE ON ONE FIELD AND THIS IS THE ONLY PLACE THAT
+ * KNOWS. stapel-cdn's `variants_meta[].tier` is an integer; `@stapel/image`
+ * reads the `stapel_core.media.dto` form, where `tier` is a decimal STRING
+ * with an `"original"` sentinel. Converting at the boundary costs one map and
+ * keeps both sides honest; teaching either one the other's shape would put a
+ * conditional in every renderer.
+ *
+ * `branch` is optional upstream and absent for thumbnail-class tiers; the
+ * renderer's contract wants an explicit `null` there, which is the same
+ * statement said out loud.
+ *
+ * The type import above is TYPE-ONLY and `@stapel/image` is an OPTIONAL peer:
+ * a host that renders its own images carries no dependency on it and this
+ * function still typechecks, because nothing of it survives to runtime.
+ */
+export function toStapelImage(image) {
+    const variants = image.variants_meta.map((variant) => ({
+        tier: String(variant.tier),
+        branch: variant.branch ?? null,
+        url: variant.url,
+        width: variant.width,
+        height: variant.height,
+    }));
+    const width = image.original_width;
+    const height = image.original_height;
+    return {
+        source: "cdn",
+        url: image.original_url,
+        // The CDN row carries the extension, not the MIME type, and the variants
+        // are all WebP regardless of what came in. Saying `null` is the true
+        // statement; guessing a MIME from the extension would be the wrong one.
+        mime: null,
+        width,
+        height,
+        aspect: height > 0 ? width / height : null,
+        square: width === height,
+        // stapel-cdn generates no inline blur placeholder. `<Image>` degrades to
+        // the aspect box, which is the layout-shift protection that actually
+        // matters here.
+        preview_b64: null,
+        variants,
+    };
+}
+/**
+ * The reference for an uploaded image row.
+ *
+ * Reads `prefix` — the serializer's own `<type>/<hash>` — rather than
+ * rebuilding it from `type` and `file_hash`, so a host that reconfigures the
+ * layout upstream does not get a reference this pair invented.
+ */
+export function refOf(image) {
+    return image.prefix;
+}
+//# sourceMappingURL=refs.js.map

package/dist/model/refs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"refs.js","sourceRoot":"","sources":["../../src/model/refs.ts"],"names":[],"mappings":"AAYA,MAAM,IAAI,GAAG,gBAAgB,CAAC;AAE9B,gEAAgE;AAChE,MAAM,UAAU,YAAY,CAAC,SAAiB,EAAE,QAAgB;IAC9D,OAAO,GAAG,SAAS,IAAI,QAAQ,EAAE,CAAC;AACpC,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,WAAW,CAAC,GAAW;IACrC,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,KAAK,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5B,MAAM,SAAS,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IACtC,MAAM,QAAQ,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;IACtC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IACtC,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;AACjC,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,aAAa,CAAC,KAAe;IAC3C,MAAM,QAAQ,GAAkB,KAAK,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QACpE,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC;QAC1B,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,IAAI;QAC9B,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,MAAM,EAAE,OAAO,CAAC,MAAM;KACvB,CAAC,CAAC,CAAC;IACJ,MAAM,KAAK,GAAG,KAAK,CAAC,cAAc,CAAC;IACnC,MAAM,MAAM,GAAG,KAAK,CAAC,eAAe,CAAC;IACrC,OAAO;QACL,MAAM,EAAE,KAAK;QACb,GAAG,EAAE,KAAK,CAAC,YAAY;QACvB,yEAAyE;QACzE,qEAAqE;QACrE,wEAAwE;QACxE,IAAI,EAAE,IAAI;QACV,KAAK;QACL,MAAM;QACN,MAAM,EAAE,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI;QAC1C,MAAM,EAAE,KAAK,KAAK,MAAM;QACxB,yEAAyE;QACzE,qEAAqE;QACrE,gBAAgB;QAChB,WAAW,EAAE,IAAI;QACjB,QAAQ;KACT,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,KAAK,CAAC,KAAkC;IACtD,OAAO,KAAK,CAAC,MAAM,CAAC;AACtB,CAAC"}

package/dist/model/runtime.d.ts

@@ -0,0 +1,40 @@
+import type { CreateModuleRuntimeOptions, ModuleRuntime } from "@stapel/core";
+import type { CdnApi } from "../api/cdnApi.js";
+import type { CdnLimits, CdnLimitsOverride } from "./limits.js";
+import type { CdnVariantWaitOptions } from "./upload.js";
+/**
+ * The wired CDN runtime — core's `ModuleRuntime` bound to this pair's API,
+ * plus the two things an upload pair has and a plain read pair does not: the
+ * DEPLOYMENT's intake ceilings, and how long to wait for a variant ladder.
+ *
+ * Both are runtime configuration rather than module state, so they ride here
+ * instead of through a second provider — the same argument chat-react makes
+ * for its socket URL.
+ */
+export type CdnRuntime = ModuleRuntime<CdnApi> & {
+    readonly limits: CdnLimits;
+    readonly variants: CdnVariantWaitOptions | undefined;
+};
+export interface CreateCdnRuntimeOptions extends CreateModuleRuntimeOptions {
+    /**
+     * Override the client-side mirror of `STAPEL_CDN`'s ceilings. Defaults to
+     * the library's own defaults — see `model/limits.ts` for why this is a knob
+     * and not a constant.
+     */
+    readonly limits?: CdnLimitsOverride;
+    /** How long the flow waits for the variant ladder after a store. */
+    readonly variants?: CdnVariantWaitOptions;
+}
+/**
+ * ```tsx
+ * const runtime = createCdnRuntime({ baseUrl: "/cdn/api/v1/" });
+ * <CdnProvider runtime={runtime}>{app}</CdnProvider>
+ * ```
+ *
+ * NOT ANONYMOUS. Every endpoint this pair calls needs at least a guest
+ * identity (`IsNotAnonymousUser`), and the avatar intake and the dedup
+ * pre-check need a real session (`IsAuthenticated`). A storefront mounts this
+ * behind its member routes; the public catalogue never touches it.
+ */
+export declare function createCdnRuntime(options: CreateCdnRuntimeOptions): CdnRuntime;
+//# sourceMappingURL=runtime.d.ts.map

package/dist/model/runtime.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime.d.ts","sourceRoot":"","sources":["../../src/model/runtime.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,0BAA0B,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAE9E,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAE/C,OAAO,KAAK,EAAE,SAAS,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAChE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAEzD;;;;;;;;GAQG;AACH,MAAM,MAAM,UAAU,GAAG,aAAa,CAAC,MAAM,CAAC,GAAG;IAC/C,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,qBAAqB,GAAG,SAAS,CAAC;CACtD,CAAC;AAEF,MAAM,WAAW,uBAAwB,SAAQ,0BAA0B;IACzE;;;;OAIG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,iBAAiB,CAAC;IACpC,oEAAoE;IACpE,QAAQ,CAAC,QAAQ,CAAC,EAAE,qBAAqB,CAAC;CAC3C;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,uBAAuB,GAAG,UAAU,CAO7E"}