@warlock.js/core 5.29.0 → 5.30.0

package/esm/http/uploads/load-variant-source.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"load-variant-source.mjs","names":[],"sources":["../../../../../../../../core/src/http/uploads/load-variant-source.ts"],"sourcesContent":["import fs from \"node:fs/promises\";\nimport { Image } from \"../../image\";\nimport { HttpError } from \"../errors\";\nimport { detectImageFormat } from \"./detect-image-format\";\nimport type { VariantSourceFormat } from \"./image-variant-types\";\n\n/**\n * Bounds and the expected format a source must match\n */\nexport type LoadVariantSourceOptions = {\n  maxSourceBytes: number;\n  maxSourcePixels: number;\n  expectedFormat: VariantSourceFormat;\n};\n\n/**\n * Read a variant source in full and check it before it is decoded.\n *\n * The caller has already sniffed the format from the file head; this re-checks\n * the bytes actually read, the same buffer that is then resized, so the file\n * cannot be swapped between the check and the render.\n *\n * - bytes over `maxSourceBytes` → 413\n * - magic bytes that no longer match `expectedFormat` → 415\n * - a header sharp cannot read (e.g. avif without a decoder) → 415\n * - width × height over `maxSourcePixels` → 413, read from the header only\n *\n * @throws HttpError with status 413 or 415. Any other error (sharp missing,\n * I/O) propagates unchanged.\n */\nexport async function loadVariantSource(\n  absolutePath: string,\n  { maxSourceBytes, maxSourcePixels, expectedFormat }: LoadVariantSourceOptions,\n): Promise<Image> {\n  const buffer = await fs.readFile(absolutePath);\n\n  if (buffer.length > maxSourceBytes) {\n    throw new HttpError(413, \"The source image is too large.\");\n  }\n\n  if (detectImageFormat(buffer) !== expectedFormat) {\n    throw new HttpError(415, \"The source image changed format while it was read.\");\n  }\n\n  // Constructed outside the try below: sharp being absent is a server fault\n  // (500 with the install hint), not an unsupported image.\n  const image = new Image(buffer);\n\n  let width: number | undefined;\n  let height: number | undefined;\n\n  try {\n    ({ width, height } = await image.metadata());\n  } catch {\n    throw new HttpError(415, \"The source image cannot be decoded.\");\n  }\n\n  if (!width || !height) {\n    throw new HttpError(415, \"The source image cannot be decoded.\");\n  }\n\n  if (width * height > maxSourcePixels) {\n    throw new HttpError(413, \"The source image has too many pixels.\");\n  }\n\n  return image;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AA8BA,eAAsB,kBACpB,cACA,EAAE,gBAAgB,iBAAiB,kBACnB;CAChB,MAAM,SAAS,MAAM,GAAG,SAAS,YAAY;CAE7C,IAAI,OAAO,SAAS,gBAClB,MAAM,IAAI,UAAU,KAAK,gCAAgC;CAG3D,IAAI,kBAAkB,MAAM,MAAM,gBAChC,MAAM,IAAI,UAAU,KAAK,oDAAoD;CAK/E,MAAM,QAAQ,IAAI,MAAM,MAAM;CAE9B,IAAI;CACJ,IAAI;CAEJ,IAAI;EACF,CAAC,CAAE,OAAO,UAAW,MAAM,MAAM,SAAS;CAC5C,QAAQ;EACN,MAAM,IAAI,UAAU,KAAK,qCAAqC;CAChE;CAEA,IAAI,CAAC,SAAS,CAAC,QACb,MAAM,IAAI,UAAU,KAAK,qCAAqC;CAGhE,IAAI,QAAQ,SAAS,iBACnB,MAAM,IAAI,UAAU,KAAK,uCAAuC;CAGlE,OAAO;AACT"}
+{"version":3,"file":"load-variant-source.mjs","names":[],"sources":["../../../../../../../../../packages/core/src/http/uploads/load-variant-source.ts"],"sourcesContent":["import fs from \"node:fs/promises\";\nimport { Image } from \"../../image\";\nimport { HttpError } from \"../errors\";\nimport { detectImageFormat } from \"./detect-image-format\";\nimport type { VariantSourceFormat } from \"./image-variant-types\";\n\n/**\n * Bounds and the expected format a source must match\n */\nexport type LoadVariantSourceOptions = {\n  maxSourceBytes: number;\n  maxSourcePixels: number;\n  expectedFormat: VariantSourceFormat;\n};\n\n/**\n * Read a variant source in full and check it before it is decoded.\n *\n * The caller has already sniffed the format from the file head; this re-checks\n * the bytes actually read, the same buffer that is then resized, so the file\n * cannot be swapped between the check and the render.\n *\n * - bytes over `maxSourceBytes` → 413\n * - magic bytes that no longer match `expectedFormat` → 415\n * - a header sharp cannot read (e.g. avif without a decoder) → 415\n * - width × height over `maxSourcePixels` → 413, read from the header only\n *\n * @throws HttpError with status 413 or 415. Any other error (sharp missing,\n * I/O) propagates unchanged.\n */\nexport async function loadVariantSource(\n  absolutePath: string,\n  { maxSourceBytes, maxSourcePixels, expectedFormat }: LoadVariantSourceOptions,\n): Promise<Image> {\n  const buffer = await fs.readFile(absolutePath);\n\n  if (buffer.length > maxSourceBytes) {\n    throw new HttpError(413, \"The source image is too large.\");\n  }\n\n  if (detectImageFormat(buffer) !== expectedFormat) {\n    throw new HttpError(415, \"The source image changed format while it was read.\");\n  }\n\n  // Constructed outside the try below: sharp being absent is a server fault\n  // (500 with the install hint), not an unsupported image.\n  const image = new Image(buffer);\n\n  let width: number | undefined;\n  let height: number | undefined;\n\n  try {\n    ({ width, height } = await image.metadata());\n  } catch {\n    throw new HttpError(415, \"The source image cannot be decoded.\");\n  }\n\n  if (!width || !height) {\n    throw new HttpError(415, \"The source image cannot be decoded.\");\n  }\n\n  if (width * height > maxSourcePixels) {\n    throw new HttpError(413, \"The source image has too many pixels.\");\n  }\n\n  return image;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AA8BA,eAAsB,kBACpB,cACA,EAAE,gBAAgB,iBAAiB,kBACnB;CAChB,MAAM,SAAS,MAAM,GAAG,SAAS,YAAY;CAE7C,IAAI,OAAO,SAAS,gBAClB,MAAM,IAAI,UAAU,KAAK,gCAAgC;CAG3D,IAAI,kBAAkB,MAAM,MAAM,gBAChC,MAAM,IAAI,UAAU,KAAK,oDAAoD;CAK/E,MAAM,QAAQ,IAAI,MAAM,MAAM;CAE9B,IAAI;CACJ,IAAI;CAEJ,IAAI;EACF,CAAC,CAAE,OAAO,UAAW,MAAM,MAAM,SAAS;CAC5C,QAAQ;EACN,MAAM,IAAI,UAAU,KAAK,qCAAqC;CAChE;CAEA,IAAI,CAAC,SAAS,CAAC,QACb,MAAM,IAAI,UAAU,KAAK,qCAAqC;CAGhE,IAAI,QAAQ,SAAS,iBACnB,MAAM,IAAI,UAAU,KAAK,uCAAuC;CAGlE,OAAO;AACT"}

package/esm/http/uploads/local-disk-root.mjs

@@ -0,0 +1,24 @@
+import { storage } from "../../storage/storage.mjs";
+import "../../storage/index.mjs";
+
+//#region ../../packages/core/src/http/uploads/local-disk-root.ts
+/**
+* Root directory of a local storage disk, or `undefined` when the disk is not
+* local (object storage has no directory to serve or cache from).
+*
+* Without a name this is the default disk, read through `storage.root()` as
+* `uploadedFileController` always has.
+*/
+function localDiskRoot(disk) {
+	if (disk === void 0) {
+		const root = storage.root();
+		return root && root !== "." ? root : void 0;
+	}
+	const driver = storage.getDriver(disk);
+	if (driver.name !== "local" || typeof driver.getRoot !== "function") return void 0;
+	return driver.getRoot();
+}
+
+//#endregion
+export { localDiskRoot };
+//# sourceMappingURL=local-disk-root.mjs.map

package/esm/http/uploads/local-disk-root.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"local-disk-root.mjs","names":[],"sources":["../../../../../../../../../packages/core/src/http/uploads/local-disk-root.ts"],"sourcesContent":["import { storage } from \"../../storage\";\nimport type { StorageDriverName } from \"../../storage/types\";\n\n/**\n * Root directory of a local storage disk, or `undefined` when the disk is not\n * local (object storage has no directory to serve or cache from).\n *\n * Without a name this is the default disk, read through `storage.root()` as\n * `uploadedFileController` always has.\n */\nexport function localDiskRoot(disk?: StorageDriverName): string | undefined {\n  if (disk === undefined) {\n    const root = storage.root();\n\n    return root && root !== \".\" ? root : undefined;\n  }\n\n  const driver = storage.getDriver(disk) as { name?: string; getRoot?: () => string };\n\n  if (driver.name !== \"local\" || typeof driver.getRoot !== \"function\") return undefined;\n\n  return driver.getRoot();\n}\n"],"mappings":";;;;;;;;;;;AAUA,SAAgB,cAAc,MAA8C;CAC1E,IAAI,SAAS,QAAW;EACtB,MAAM,OAAO,QAAQ,KAAK;EAE1B,OAAO,QAAQ,SAAS,MAAM,OAAO;CACvC;CAEA,MAAM,SAAS,QAAQ,UAAU,IAAI;CAErC,IAAI,OAAO,SAAS,WAAW,OAAO,OAAO,YAAY,YAAY,OAAO;CAE5E,OAAO,OAAO,QAAQ;AACxB"}

package/esm/http/uploads/matches-if-none-match.mjs

@@ -1,4 +1,4 @@
-//#region ../core/src/http/uploads/matches-if-none-match.ts
+//#region ../../packages/core/src/http/uploads/matches-if-none-match.ts
 /**
 * Whether an `If-None-Match` header matches an entity tag (weak comparison,
 * RFC 9110 §13.1.2): `*`, or any listed tag equal to `etag` once `W/` is dropped.

package/esm/http/uploads/matches-if-none-match.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"matches-if-none-match.mjs","names":[],"sources":["../../../../../../../../core/src/http/uploads/matches-if-none-match.ts"],"sourcesContent":["/**\n * Whether an `If-None-Match` header matches an entity tag (weak comparison,\n * RFC 9110 §13.1.2): `*`, or any listed tag equal to `etag` once `W/` is dropped.\n */\nexport function matchesIfNoneMatch(header: unknown, etag: string): boolean {\n  if (typeof header !== \"string\" || header === \"\") return false;\n\n  return header\n    .split(\",\")\n    .map((tag) => tag.trim().replace(/^W\\//, \"\"))\n    .some((tag) => tag === \"*\" || tag === etag);\n}\n"],"mappings":";;;;;AAIA,SAAgB,mBAAmB,QAAiB,MAAuB;CACzE,IAAI,OAAO,WAAW,YAAY,WAAW,IAAI,OAAO;CAExD,OAAO,OACJ,MAAM,GAAG,CAAC,CACV,KAAK,QAAQ,IAAI,KAAK,CAAC,CAAC,QAAQ,QAAQ,EAAE,CAAC,CAAC,CAC5C,MAAM,QAAQ,QAAQ,OAAO,QAAQ,IAAI;AAC9C"}
+{"version":3,"file":"matches-if-none-match.mjs","names":[],"sources":["../../../../../../../../../packages/core/src/http/uploads/matches-if-none-match.ts"],"sourcesContent":["/**\n * Whether an `If-None-Match` header matches an entity tag (weak comparison,\n * RFC 9110 §13.1.2): `*`, or any listed tag equal to `etag` once `W/` is dropped.\n */\nexport function matchesIfNoneMatch(header: unknown, etag: string): boolean {\n  if (typeof header !== \"string\" || header === \"\") return false;\n\n  return header\n    .split(\",\")\n    .map((tag) => tag.trim().replace(/^W\\//, \"\"))\n    .some((tag) => tag === \"*\" || tag === etag);\n}\n"],"mappings":";;;;;AAIA,SAAgB,mBAAmB,QAAiB,MAAuB;CACzE,IAAI,OAAO,WAAW,YAAY,WAAW,IAAI,OAAO;CAExD,OAAO,OACJ,MAAM,GAAG,CAAC,CACV,KAAK,QAAQ,IAAI,KAAK,CAAC,CAAC,QAAQ,QAAQ,EAAE,CAAC,CAAC,CAC5C,MAAM,QAAQ,QAAQ,OAAO,QAAQ,IAAI;AAC9C"}

package/esm/http/uploads/parse-uploaded-file-query.mjs

@@ -1,4 +1,4 @@
-//#region ../core/src/http/uploads/parse-uploaded-file-query.ts
+//#region ../../packages/core/src/http/uploads/parse-uploaded-file-query.ts
 const ALLOWED_KEYS = new Set(["variant", "format"]);
 /**
 * Read the query string of an uploads request, strictly.

package/esm/http/uploads/parse-uploaded-file-query.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"parse-uploaded-file-query.mjs","names":[],"sources":["../../../../../../../../core/src/http/uploads/parse-uploaded-file-query.ts"],"sourcesContent":["import type { UploadedFileQuery } from \"./image-variant-types\";\n\nconst ALLOWED_KEYS = new Set([\"variant\", \"format\"]);\n\n/**\n * Read the query string of an uploads request, strictly.\n *\n * It parses the raw URL rather than the framework's parsed query, because the\n * parsed form folds a repeated key into an array and a lone key into a string,\n * and a strict allowlist has to see both. Only `variant` and `format` are\n * accepted, each at most once, and `format` only next to `variant`.\n *\n * @param url - the raw request URL, path and query\n */\nexport function parseUploadedFileQuery(url: string): UploadedFileQuery {\n  const queryStart = url.indexOf(\"?\");\n  const rawQuery = queryStart === -1 ? \"\" : url.slice(queryStart + 1);\n\n  if (rawQuery === \"\") return { type: \"original\" };\n\n  const values = new Map<string, string>();\n\n  for (const [key, value] of new URLSearchParams(rawQuery)) {\n    if (!ALLOWED_KEYS.has(key)) {\n      return { type: \"invalid\", reason: `Unknown query parameter \"${key}\".` };\n    }\n\n    if (values.has(key)) {\n      return { type: \"invalid\", reason: `Query parameter \"${key}\" is repeated.` };\n    }\n\n    values.set(key, value);\n  }\n\n  const variant = values.get(\"variant\");\n  const format = values.get(\"format\");\n\n  if (variant === undefined) {\n    return values.size === 0\n      ? { type: \"original\" }\n      : { type: \"invalid\", reason: `\"format\" requires \"variant\".` };\n  }\n\n  if (variant === \"\") {\n    return { type: \"invalid\", reason: `\"variant\" must not be empty.` };\n  }\n\n  return format === undefined ? { type: \"variant\", variant } : { type: \"variant\", variant, format };\n}\n"],"mappings":";AAEA,MAAM,eAAe,IAAI,IAAI,CAAC,WAAW,QAAQ,CAAC;;;;;;;;;;;AAYlD,SAAgB,uBAAuB,KAAgC;CACrE,MAAM,aAAa,IAAI,QAAQ,GAAG;CAClC,MAAM,WAAW,eAAe,KAAK,KAAK,IAAI,MAAM,aAAa,CAAC;CAElE,IAAI,aAAa,IAAI,OAAO,EAAE,MAAM,WAAW;CAE/C,MAAM,yBAAS,IAAI,IAAoB;CAEvC,KAAK,MAAM,CAAC,KAAK,UAAU,IAAI,gBAAgB,QAAQ,GAAG;EACxD,IAAI,CAAC,aAAa,IAAI,GAAG,GACvB,OAAO;GAAE,MAAM;GAAW,QAAQ,4BAA4B,IAAI;EAAI;EAGxE,IAAI,OAAO,IAAI,GAAG,GAChB,OAAO;GAAE,MAAM;GAAW,QAAQ,oBAAoB,IAAI;EAAgB;EAG5E,OAAO,IAAI,KAAK,KAAK;CACvB;CAEA,MAAM,UAAU,OAAO,IAAI,SAAS;CACpC,MAAM,SAAS,OAAO,IAAI,QAAQ;CAElC,IAAI,YAAY,QACd,OAAO,OAAO,SAAS,IACnB,EAAE,MAAM,WAAW,IACnB;EAAE,MAAM;EAAW,QAAQ;CAA+B;CAGhE,IAAI,YAAY,IACd,OAAO;EAAE,MAAM;EAAW,QAAQ;CAA+B;CAGnE,OAAO,WAAW,SAAY;EAAE,MAAM;EAAW;CAAQ,IAAI;EAAE,MAAM;EAAW;EAAS;CAAO;AAClG"}
+{"version":3,"file":"parse-uploaded-file-query.mjs","names":[],"sources":["../../../../../../../../../packages/core/src/http/uploads/parse-uploaded-file-query.ts"],"sourcesContent":["import type { UploadedFileQuery } from \"./image-variant-types\";\n\nconst ALLOWED_KEYS = new Set([\"variant\", \"format\"]);\n\n/**\n * Read the query string of an uploads request, strictly.\n *\n * It parses the raw URL rather than the framework's parsed query, because the\n * parsed form folds a repeated key into an array and a lone key into a string,\n * and a strict allowlist has to see both. Only `variant` and `format` are\n * accepted, each at most once, and `format` only next to `variant`.\n *\n * @param url - the raw request URL, path and query\n */\nexport function parseUploadedFileQuery(url: string): UploadedFileQuery {\n  const queryStart = url.indexOf(\"?\");\n  const rawQuery = queryStart === -1 ? \"\" : url.slice(queryStart + 1);\n\n  if (rawQuery === \"\") return { type: \"original\" };\n\n  const values = new Map<string, string>();\n\n  for (const [key, value] of new URLSearchParams(rawQuery)) {\n    if (!ALLOWED_KEYS.has(key)) {\n      return { type: \"invalid\", reason: `Unknown query parameter \"${key}\".` };\n    }\n\n    if (values.has(key)) {\n      return { type: \"invalid\", reason: `Query parameter \"${key}\" is repeated.` };\n    }\n\n    values.set(key, value);\n  }\n\n  const variant = values.get(\"variant\");\n  const format = values.get(\"format\");\n\n  if (variant === undefined) {\n    return values.size === 0\n      ? { type: \"original\" }\n      : { type: \"invalid\", reason: `\"format\" requires \"variant\".` };\n  }\n\n  if (variant === \"\") {\n    return { type: \"invalid\", reason: `\"variant\" must not be empty.` };\n  }\n\n  return format === undefined ? { type: \"variant\", variant } : { type: \"variant\", variant, format };\n}\n"],"mappings":";AAEA,MAAM,eAAe,IAAI,IAAI,CAAC,WAAW,QAAQ,CAAC;;;;;;;;;;;AAYlD,SAAgB,uBAAuB,KAAgC;CACrE,MAAM,aAAa,IAAI,QAAQ,GAAG;CAClC,MAAM,WAAW,eAAe,KAAK,KAAK,IAAI,MAAM,aAAa,CAAC;CAElE,IAAI,aAAa,IAAI,OAAO,EAAE,MAAM,WAAW;CAE/C,MAAM,yBAAS,IAAI,IAAoB;CAEvC,KAAK,MAAM,CAAC,KAAK,UAAU,IAAI,gBAAgB,QAAQ,GAAG;EACxD,IAAI,CAAC,aAAa,IAAI,GAAG,GACvB,OAAO;GAAE,MAAM;GAAW,QAAQ,4BAA4B,IAAI;EAAI;EAGxE,IAAI,OAAO,IAAI,GAAG,GAChB,OAAO;GAAE,MAAM;GAAW,QAAQ,oBAAoB,IAAI;EAAgB;EAG5E,OAAO,IAAI,KAAK,KAAK;CACvB;CAEA,MAAM,UAAU,OAAO,IAAI,SAAS;CACpC,MAAM,SAAS,OAAO,IAAI,QAAQ;CAElC,IAAI,YAAY,QACd,OAAO,OAAO,SAAS,IACnB,EAAE,MAAM,WAAW,IACnB;EAAE,MAAM;EAAW,QAAQ;CAA+B;CAGhE,IAAI,YAAY,IACd,OAAO;EAAE,MAAM;EAAW,QAAQ;CAA+B;CAGnE,OAAO,WAAW,SAAY;EAAE,MAAM;EAAW;CAAQ,IAAI;EAAE,MAAM;EAAW;EAAS;CAAO;AAClG"}

package/esm/http/uploads/purge-image-variants.d.mts

@@ -0,0 +1,32 @@
+import { StorageDriverName } from "../../storage/types.mjs";
+
+//#region ../../packages/core/src/http/uploads/purge-image-variants.d.ts
+/**
+ * Options for {@link purgeImageVariants}
+ */
+type PurgeImageVariantsOptions = {
+  /**
+   * Local disk the source lives on; the default disk when omitted
+   */
+  disk?: StorageDriverName;
+};
+/**
+ * Remove cached image derivatives.
+ *
+ * - With a path: every derivative of that file, in every variant and format.
+ *   The file itself is untouched and does not need to exist.
+ * - Without a path: the whole derivative cache of the disk. When
+ *   `uploads.images.cacheDirectory` is set, that directory is shared by every
+ *   local disk, so this clears all of them.
+ *
+ * Deleting or moving a file through local storage (`storage.delete`,
+ * `deleteMany`, `move`) already purges its derivatives; call this for files
+ * removed some other way.
+ *
+ * @returns `true` when something was removed
+ * @throws ImageVariantsConfigError when the disk is not a local disk
+ */
+declare function purgeImageVariants(relativePath?: string, options?: PurgeImageVariantsOptions): Promise<boolean>;
+//#endregion
+export { PurgeImageVariantsOptions, purgeImageVariants };
+//# sourceMappingURL=purge-image-variants.d.mts.map

package/esm/http/uploads/purge-image-variants.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"purge-image-variants.d.mts","names":[],"sources":["../../../../../../../../../packages/core/src/http/uploads/purge-image-variants.ts"],"mappings":";;;;;AAUA;KAAY,yBAAA;;;AAIc;EAAxB,IAAA,GAAO,iBAAiB;AAAA;;;;;;;;AAsBhB;;;;;;;;;iBAHY,kBAAA,CACpB,YAAA,WACA,OAAA,GAAS,yBAAA,GACR,OAAO"}

package/esm/http/uploads/purge-image-variants.mjs

@@ -0,0 +1,46 @@
+import { purgeImageVariantsOfFile, variantCacheDirectoryFor } from "./image-variant-cache.mjs";
+import { ImageVariantsConfigError } from "./image-variants-config-error.mjs";
+import { localDiskRoot } from "./local-disk-root.mjs";
+import path from "node:path";
+import fs from "node:fs/promises";
+
+//#region ../../packages/core/src/http/uploads/purge-image-variants.ts
+/**
+* Remove cached image derivatives.
+*
+* - With a path: every derivative of that file, in every variant and format.
+*   The file itself is untouched and does not need to exist.
+* - Without a path: the whole derivative cache of the disk. When
+*   `uploads.images.cacheDirectory` is set, that directory is shared by every
+*   local disk, so this clears all of them.
+*
+* Deleting or moving a file through local storage (`storage.delete`,
+* `deleteMany`, `move`) already purges its derivatives; call this for files
+* removed some other way.
+*
+* @returns `true` when something was removed
+* @throws ImageVariantsConfigError when the disk is not a local disk
+*/
+async function purgeImageVariants(relativePath, options = {}) {
+	const diskRoot = localDiskRoot(options.disk);
+	if (!diskRoot) throw new ImageVariantsConfigError(options.disk === void 0 ? "purgeImageVariants needs a local storage driver with a root." : `purgeImageVariants needs a local disk; "${options.disk}" is not one.`);
+	if (relativePath === void 0) {
+		const directory = variantCacheDirectoryFor(diskRoot);
+		try {
+			await fs.access(directory);
+		} catch {
+			return false;
+		}
+		await fs.rm(directory, {
+			recursive: true,
+			force: true
+		});
+		return true;
+	}
+	const location = relativePath.replace(/\\/g, "/").replace(/^\/+/, "");
+	return purgeImageVariantsOfFile(diskRoot, path.resolve(diskRoot, location));
+}
+
+//#endregion
+export { purgeImageVariants };
+//# sourceMappingURL=purge-image-variants.mjs.map

package/esm/http/uploads/purge-image-variants.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"purge-image-variants.mjs","names":[],"sources":["../../../../../../../../../packages/core/src/http/uploads/purge-image-variants.ts"],"sourcesContent":["import fs from \"node:fs/promises\";\nimport path from \"node:path\";\nimport type { StorageDriverName } from \"../../storage/types\";\nimport { purgeImageVariantsOfFile, variantCacheDirectoryFor } from \"./image-variant-cache\";\nimport { ImageVariantsConfigError } from \"./image-variants-config-error\";\nimport { localDiskRoot } from \"./local-disk-root\";\n\n/**\n * Options for {@link purgeImageVariants}\n */\nexport type PurgeImageVariantsOptions = {\n  /**\n   * Local disk the source lives on; the default disk when omitted\n   */\n  disk?: StorageDriverName;\n};\n\n/**\n * Remove cached image derivatives.\n *\n * - With a path: every derivative of that file, in every variant and format.\n *   The file itself is untouched and does not need to exist.\n * - Without a path: the whole derivative cache of the disk. When\n *   `uploads.images.cacheDirectory` is set, that directory is shared by every\n *   local disk, so this clears all of them.\n *\n * Deleting or moving a file through local storage (`storage.delete`,\n * `deleteMany`, `move`) already purges its derivatives; call this for files\n * removed some other way.\n *\n * @returns `true` when something was removed\n * @throws ImageVariantsConfigError when the disk is not a local disk\n */\nexport async function purgeImageVariants(\n  relativePath?: string,\n  options: PurgeImageVariantsOptions = {},\n): Promise<boolean> {\n  const diskRoot = localDiskRoot(options.disk);\n\n  if (!diskRoot) {\n    throw new ImageVariantsConfigError(\n      options.disk === undefined\n        ? \"purgeImageVariants needs a local storage driver with a root.\"\n        : `purgeImageVariants needs a local disk; \"${options.disk}\" is not one.`,\n    );\n  }\n\n  if (relativePath === undefined) {\n    const directory = variantCacheDirectoryFor(diskRoot);\n\n    try {\n      await fs.access(directory);\n    } catch {\n      return false;\n    }\n\n    await fs.rm(directory, { recursive: true, force: true });\n\n    return true;\n  }\n\n  const location = relativePath.replace(/\\\\/g, \"/\").replace(/^\\/+/, \"\");\n\n  return purgeImageVariantsOfFile(diskRoot, path.resolve(diskRoot, location));\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAiCA,eAAsB,mBACpB,cACA,UAAqC,CAAC,GACpB;CAClB,MAAM,WAAW,cAAc,QAAQ,IAAI;CAE3C,IAAI,CAAC,UACH,MAAM,IAAI,yBACR,QAAQ,SAAS,SACb,iEACA,2CAA2C,QAAQ,KAAK,cAC9D;CAGF,IAAI,iBAAiB,QAAW;EAC9B,MAAM,YAAY,yBAAyB,QAAQ;EAEnD,IAAI;GACF,MAAM,GAAG,OAAO,SAAS;EAC3B,QAAQ;GACN,OAAO;EACT;EAEA,MAAM,GAAG,GAAG,WAAW;GAAE,WAAW;GAAM,OAAO;EAAK,CAAC;EAEvD,OAAO;CACT;CAEA,MAAM,WAAW,aAAa,QAAQ,OAAO,GAAG,CAAC,CAAC,QAAQ,QAAQ,EAAE;CAEpE,OAAO,yBAAyB,UAAU,KAAK,QAAQ,UAAU,QAAQ,CAAC;AAC5E"}

package/esm/http/uploads/read-file-head.mjs

@@ -1,6 +1,6 @@
 import fs from "node:fs/promises";
 
-//#region ../core/src/http/uploads/read-file-head.ts
+//#region ../../packages/core/src/http/uploads/read-file-head.ts
 /**
 * Read at most the first `length` bytes of a file
 */

package/esm/http/uploads/read-file-head.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"read-file-head.mjs","names":[],"sources":["../../../../../../../../core/src/http/uploads/read-file-head.ts"],"sourcesContent":["import fs from \"node:fs/promises\";\n\n/**\n * Read at most the first `length` bytes of a file\n */\nexport async function readFileHead(absolutePath: string, length: number): Promise<Buffer> {\n  const handle = await fs.open(absolutePath, \"r\");\n\n  try {\n    const buffer = Buffer.alloc(length);\n    const { bytesRead } = await handle.read(buffer, 0, length, 0);\n\n    return buffer.subarray(0, bytesRead);\n  } finally {\n    await handle.close();\n  }\n}\n"],"mappings":";;;;;;AAKA,eAAsB,aAAa,cAAsB,QAAiC;CACxF,MAAM,SAAS,MAAM,GAAG,KAAK,cAAc,GAAG;CAE9C,IAAI;EACF,MAAM,SAAS,OAAO,MAAM,MAAM;EAClC,MAAM,EAAE,cAAc,MAAM,OAAO,KAAK,QAAQ,GAAG,QAAQ,CAAC;EAE5D,OAAO,OAAO,SAAS,GAAG,SAAS;CACrC,UAAU;EACR,MAAM,OAAO,MAAM;CACrB;AACF"}
+{"version":3,"file":"read-file-head.mjs","names":[],"sources":["../../../../../../../../../packages/core/src/http/uploads/read-file-head.ts"],"sourcesContent":["import fs from \"node:fs/promises\";\n\n/**\n * Read at most the first `length` bytes of a file\n */\nexport async function readFileHead(absolutePath: string, length: number): Promise<Buffer> {\n  const handle = await fs.open(absolutePath, \"r\");\n\n  try {\n    const buffer = Buffer.alloc(length);\n    const { bytesRead } = await handle.read(buffer, 0, length, 0);\n\n    return buffer.subarray(0, bytesRead);\n  } finally {\n    await handle.close();\n  }\n}\n"],"mappings":";;;;;;AAKA,eAAsB,aAAa,cAAsB,QAAiC;CACxF,MAAM,SAAS,MAAM,GAAG,KAAK,cAAc,GAAG;CAE9C,IAAI;EACF,MAAM,SAAS,OAAO,MAAM,MAAM;EAClC,MAAM,EAAE,cAAc,MAAM,OAAO,KAAK,QAAQ,GAAG,QAAQ,CAAC;EAE5D,OAAO,OAAO,SAAS,GAAG,SAAS;CACrC,UAAU;EACR,MAAM,OAAO,MAAM;CACrB;AACF"}

package/esm/http/uploads/resolve-image-variant.d.mts

@@ -0,0 +1,73 @@
+import { StorageDriverName } from "../../storage/types.mjs";
+import { VariantOutputFormat } from "./image-variant-types.mjs";
+
+//#region ../../packages/core/src/http/uploads/resolve-image-variant.d.ts
+/**
+ * What to render: a file on a local disk and a variant named in
+ * `uploads.images.variants`
+ */
+type ResolveImageVariantInput = {
+  /**
+   * Path of the source, relative to the disk root
+   */
+  path: string;
+  /**
+   * Variant name from `uploads.images.variants`
+   */
+  variant: string;
+  /**
+   * Output format; defaults to the source's own format. Must be the source
+   * format or one listed in `uploads.images.formats`.
+   */
+  format?: VariantOutputFormat;
+  /**
+   * Local disk the source lives on; the default disk when omitted
+   */
+  disk?: StorageDriverName;
+};
+/**
+ * A derivative on disk, ready to send
+ */
+type ResolvedImageVariant = {
+  /**
+   * Absolute path of the cached derivative
+   */
+  absolutePath: string;
+  /**
+   * sha256 of everything the derivative depends on; a strong ETag value
+   */
+  hash: string;
+  format: VariantOutputFormat;
+  contentType: string;
+};
+/**
+ * Resolve, and render on a cache miss, one variant of an image on a local
+ * disk. This is what `uploadedFileController` serves; call it from your own
+ * route to serve variants of a private disk behind authentication:
+ *
+ * ```ts
+ * const variant = await resolveImageVariant({ disk: "private", path, variant: "thumb" });
+ * if (!variant) return response.notFound();
+ * return response.sendBuffer(await fs.readFile(variant.absolutePath), {
+ *   contentType: variant.contentType,
+ * });
+ * ```
+ *
+ * The same guards apply as on the public route: the path must stay inside
+ * the disk root and outside the derivative cache, the source must be a
+ * jpeg/png/webp/avif within `maxSourceBytes`/`maxSourcePixels`, and only
+ * declared variants and formats render. Derivatives are generated once per
+ * key, even under concurrent calls, and older versions of a rewritten source
+ * are pruned once a new derivative is written.
+ *
+ * @returns `undefined` when the path does not resolve to a file on the disk
+ * @throws ImageVariantsConfigError when the disk is not a local disk
+ * @throws HttpError(400) when variants are not configured, or the variant or
+ * format is not allowed
+ * @throws HttpError(413) when the source is over the configured limits
+ * @throws HttpError(415) when the source is not jpeg, png, webp or avif
+ */
+declare function resolveImageVariant(input: ResolveImageVariantInput): Promise<ResolvedImageVariant | undefined>;
+//#endregion
+export { ResolveImageVariantInput, ResolvedImageVariant, resolveImageVariant };
+//# sourceMappingURL=resolve-image-variant.d.mts.map

package/esm/http/uploads/resolve-image-variant.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve-image-variant.d.mts","names":[],"sources":["../../../../../../../../../packages/core/src/http/uploads/resolve-image-variant.ts"],"mappings":";;;;;;AAoCA;;KAAY,wBAAA;EAoBc;;;EAhBxB,IAAA;EAWS;;;EANT,OAAA;EAWwB;AAM1B;;;EAXE,MAAA,GAAS,mBAAA;EAeT;;;EAVA,IAAA,GAAO,iBAAiB;AAAA;;AAmBb;AAwCb;KArDY,oBAAA;;;;EAIV,YAAA;EAmDQ;;;EA9CR,IAAA;EAEA,MAAA,EAAQ,mBAAmB;EAE3B,WAAA;AAAA;AA0C6B;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,iBAFT,mBAAA,CACpB,KAAA,EAAO,wBAAA,GACN,OAAA,CAAQ,oBAAA"}

package/esm/http/uploads/resolve-image-variant.mjs

@@ -0,0 +1,107 @@
+import { HttpError } from "../errors/errors.mjs";
+import { uploadsConfig } from "../uploads-config.mjs";
+import { variantCacheKey, variantCachePath, variantGenerationTag, variantSourceDirectory, variantSourceKey } from "./variant-cache-key.mjs";
+import { pruneStaleVariantGenerationsIfCurrent, retryOnVanishedDirectory, warnIfVariantCacheIsPublic } from "./image-variant-cache.mjs";
+import { generateImageVariant } from "./generate-image-variant.mjs";
+import { ImageVariantsConfigError } from "./image-variants-config-error.mjs";
+import { loadVariantSource } from "./load-variant-source.mjs";
+import { resolveImageVariantsConfig } from "./resolve-image-variants-config.mjs";
+import { resolveVariantCandidate } from "./resolve-variant-candidate.mjs";
+import { variantGenerations } from "./variant-generations.mjs";
+import { localDiskRoot } from "./local-disk-root.mjs";
+import fs from "node:fs/promises";
+
+//#region ../../packages/core/src/http/uploads/resolve-image-variant.ts
+const CONTENT_TYPES = {
+	jpeg: "image/jpeg",
+	png: "image/png",
+	webp: "image/webp",
+	avif: "image/avif"
+};
+async function exists(target) {
+	try {
+		await fs.access(target);
+		return true;
+	} catch {
+		return false;
+	}
+}
+/**
+* Resolve, and render on a cache miss, one variant of an image on a local
+* disk. This is what `uploadedFileController` serves; call it from your own
+* route to serve variants of a private disk behind authentication:
+*
+* ```ts
+* const variant = await resolveImageVariant({ disk: "private", path, variant: "thumb" });
+* if (!variant) return response.notFound();
+* return response.sendBuffer(await fs.readFile(variant.absolutePath), {
+*   contentType: variant.contentType,
+* });
+* ```
+*
+* The same guards apply as on the public route: the path must stay inside
+* the disk root and outside the derivative cache, the source must be a
+* jpeg/png/webp/avif within `maxSourceBytes`/`maxSourcePixels`, and only
+* declared variants and formats render. Derivatives are generated once per
+* key, even under concurrent calls, and older versions of a rewritten source
+* are pruned once a new derivative is written.
+*
+* @returns `undefined` when the path does not resolve to a file on the disk
+* @throws ImageVariantsConfigError when the disk is not a local disk
+* @throws HttpError(400) when variants are not configured, or the variant or
+* format is not allowed
+* @throws HttpError(413) when the source is over the configured limits
+* @throws HttpError(415) when the source is not jpeg, png, webp or avif
+*/
+async function resolveImageVariant(input) {
+	const diskRoot = localDiskRoot(input.disk);
+	if (!diskRoot) throw new ImageVariantsConfigError(input.disk === void 0 ? "Image variants need a local storage driver with a root." : `Image variants need a local disk; "${input.disk}" is not one.`);
+	const images = resolveImageVariantsConfig(uploadsConfig("images"), diskRoot);
+	if (!images) throw new HttpError(400, "Image variants are not configured.");
+	const variant = Object.prototype.hasOwnProperty.call(images.variants, input.variant) ? images.variants[input.variant] : void 0;
+	if (variant === void 0) throw new HttpError(400, `Unknown variant "${input.variant}".`);
+	if (input.format !== void 0 && !images.formats.includes(input.format)) throw new HttpError(400, `Format "${input.format}" is not allowed.`);
+	warnIfVariantCacheIsPublic(images.cacheDirectory);
+	const candidate = await resolveVariantCandidate(input.path, diskRoot, images);
+	if (!candidate) return void 0;
+	const { source, stats, sourceFormat } = candidate;
+	const format = input.format ?? sourceFormat;
+	const hash = variantCacheKey({
+		relativePath: source.relativePath,
+		sourceSize: stats.size,
+		sourceMtimeMs: stats.mtimeMs,
+		variant,
+		format
+	});
+	const sourceKey = variantSourceKey(source.root, source.relativePath);
+	const generation = variantGenerationTag(stats.size, stats.mtimeMs);
+	const target = variantCachePath(images.cacheDirectory, {
+		sourceKey,
+		generation
+	}, hash, format);
+	if (!await exists(target)) await variantGenerations.run(target, async () => {
+		if (await exists(target)) return;
+		const image = await loadVariantSource(source.absolutePath, {
+			maxSourceBytes: images.maxSourceBytes,
+			maxSourcePixels: images.maxSourcePixels,
+			expectedFormat: sourceFormat
+		});
+		await retryOnVanishedDirectory(() => generateImageVariant({
+			image: image.clone(),
+			variant,
+			format,
+			targetPath: target
+		}));
+		await pruneStaleVariantGenerationsIfCurrent(source.absolutePath, variantSourceDirectory(images.cacheDirectory, sourceKey), generation);
+	});
+	return {
+		absolutePath: target,
+		hash,
+		format,
+		contentType: CONTENT_TYPES[format]
+	};
+}
+
+//#endregion
+export { resolveImageVariant };
+//# sourceMappingURL=resolve-image-variant.mjs.map

package/esm/http/uploads/resolve-image-variant.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve-image-variant.mjs","names":[],"sources":["../../../../../../../../../packages/core/src/http/uploads/resolve-image-variant.ts"],"sourcesContent":["import fs from \"node:fs/promises\";\nimport type { StorageDriverName } from \"../../storage/types\";\nimport { HttpError } from \"../errors\";\nimport { uploadsConfig } from \"../uploads-config\";\nimport { generateImageVariant } from \"./generate-image-variant\";\nimport {\n  pruneStaleVariantGenerationsIfCurrent,\n  retryOnVanishedDirectory,\n  warnIfVariantCacheIsPublic,\n} from \"./image-variant-cache\";\nimport { ImageVariantsConfigError } from \"./image-variants-config-error\";\nimport type { VariantOutputFormat } from \"./image-variant-types\";\nimport { loadVariantSource } from \"./load-variant-source\";\nimport { localDiskRoot } from \"./local-disk-root\";\nimport { resolveImageVariantsConfig } from \"./resolve-image-variants-config\";\nimport { resolveVariantCandidate } from \"./resolve-variant-candidate\";\nimport {\n  variantCacheKey,\n  variantCachePath,\n  variantGenerationTag,\n  variantSourceDirectory,\n  variantSourceKey,\n} from \"./variant-cache-key\";\nimport { variantGenerations } from \"./variant-generations\";\n\nconst CONTENT_TYPES: Record<VariantOutputFormat, string> = {\n  jpeg: \"image/jpeg\",\n  png: \"image/png\",\n  webp: \"image/webp\",\n  avif: \"image/avif\",\n};\n\n/**\n * What to render: a file on a local disk and a variant named in\n * `uploads.images.variants`\n */\nexport type ResolveImageVariantInput = {\n  /**\n   * Path of the source, relative to the disk root\n   */\n  path: string;\n\n  /**\n   * Variant name from `uploads.images.variants`\n   */\n  variant: string;\n\n  /**\n   * Output format; defaults to the source's own format. Must be the source\n   * format or one listed in `uploads.images.formats`.\n   */\n  format?: VariantOutputFormat;\n\n  /**\n   * Local disk the source lives on; the default disk when omitted\n   */\n  disk?: StorageDriverName;\n};\n\n/**\n * A derivative on disk, ready to send\n */\nexport type ResolvedImageVariant = {\n  /**\n   * Absolute path of the cached derivative\n   */\n  absolutePath: string;\n\n  /**\n   * sha256 of everything the derivative depends on; a strong ETag value\n   */\n  hash: string;\n\n  format: VariantOutputFormat;\n\n  contentType: string;\n};\n\nasync function exists(target: string): Promise<boolean> {\n  try {\n    await fs.access(target);\n\n    return true;\n  } catch {\n    return false;\n  }\n}\n\n/**\n * Resolve, and render on a cache miss, one variant of an image on a local\n * disk. This is what `uploadedFileController` serves; call it from your own\n * route to serve variants of a private disk behind authentication:\n *\n * ```ts\n * const variant = await resolveImageVariant({ disk: \"private\", path, variant: \"thumb\" });\n * if (!variant) return response.notFound();\n * return response.sendBuffer(await fs.readFile(variant.absolutePath), {\n *   contentType: variant.contentType,\n * });\n * ```\n *\n * The same guards apply as on the public route: the path must stay inside\n * the disk root and outside the derivative cache, the source must be a\n * jpeg/png/webp/avif within `maxSourceBytes`/`maxSourcePixels`, and only\n * declared variants and formats render. Derivatives are generated once per\n * key, even under concurrent calls, and older versions of a rewritten source\n * are pruned once a new derivative is written.\n *\n * @returns `undefined` when the path does not resolve to a file on the disk\n * @throws ImageVariantsConfigError when the disk is not a local disk\n * @throws HttpError(400) when variants are not configured, or the variant or\n * format is not allowed\n * @throws HttpError(413) when the source is over the configured limits\n * @throws HttpError(415) when the source is not jpeg, png, webp or avif\n */\nexport async function resolveImageVariant(\n  input: ResolveImageVariantInput,\n): Promise<ResolvedImageVariant | undefined> {\n  const diskRoot = localDiskRoot(input.disk);\n\n  if (!diskRoot) {\n    throw new ImageVariantsConfigError(\n      input.disk === undefined\n        ? \"Image variants need a local storage driver with a root.\"\n        : `Image variants need a local disk; \"${input.disk}\" is not one.`,\n    );\n  }\n\n  const images = resolveImageVariantsConfig(uploadsConfig(\"images\"), diskRoot);\n\n  if (!images) {\n    throw new HttpError(400, \"Image variants are not configured.\");\n  }\n\n  const variant = Object.prototype.hasOwnProperty.call(images.variants, input.variant)\n    ? images.variants[input.variant]\n    : undefined;\n\n  if (variant === undefined) {\n    throw new HttpError(400, `Unknown variant \"${input.variant}\".`);\n  }\n\n  if (input.format !== undefined && !images.formats.includes(input.format as never)) {\n    throw new HttpError(400, `Format \"${input.format}\" is not allowed.`);\n  }\n\n  warnIfVariantCacheIsPublic(images.cacheDirectory);\n\n  const candidate = await resolveVariantCandidate(input.path, diskRoot, images);\n\n  if (!candidate) return undefined;\n\n  const { source, stats, sourceFormat } = candidate;\n  const format: VariantOutputFormat = input.format ?? sourceFormat;\n  const hash = variantCacheKey({\n    relativePath: source.relativePath,\n    sourceSize: stats.size,\n    sourceMtimeMs: stats.mtimeMs,\n    variant,\n    format,\n  });\n  const sourceKey = variantSourceKey(source.root, source.relativePath);\n  const generation = variantGenerationTag(stats.size, stats.mtimeMs);\n  const target = variantCachePath(images.cacheDirectory, { sourceKey, generation }, hash, format);\n\n  if (!(await exists(target))) {\n    // Keyed on the target path, which includes the disk's real root: the\n    // same file on two disks (a mirror copied with its mtime) has the same\n    // `hash`, and joining the other disk's flight would leave this target\n    // unwritten.\n    await variantGenerations.run(target, async () => {\n      if (await exists(target)) return;\n\n      const image = await loadVariantSource(source.absolutePath, {\n        maxSourceBytes: images.maxSourceBytes,\n        maxSourcePixels: images.maxSourcePixels,\n        expectedFormat: sourceFormat,\n      });\n\n      await retryOnVanishedDirectory(() =>\n        generateImageVariant({ image: image.clone(), variant, format, targetPath: target }),\n      );\n      await pruneStaleVariantGenerationsIfCurrent(\n        source.absolutePath,\n        variantSourceDirectory(images.cacheDirectory, sourceKey),\n        generation,\n      );\n    });\n  }\n\n  return { absolutePath: target, hash, format, contentType: CONTENT_TYPES[format] };\n}\n"],"mappings":";;;;;;;;;;;;;;AAyBA,MAAM,gBAAqD;CACzD,MAAM;CACN,KAAK;CACL,MAAM;CACN,MAAM;AACR;AAgDA,eAAe,OAAO,QAAkC;CACtD,IAAI;EACF,MAAM,GAAG,OAAO,MAAM;EAEtB,OAAO;CACT,QAAQ;EACN,OAAO;CACT;AACF;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA6BA,eAAsB,oBACpB,OAC2C;CAC3C,MAAM,WAAW,cAAc,MAAM,IAAI;CAEzC,IAAI,CAAC,UACH,MAAM,IAAI,yBACR,MAAM,SAAS,SACX,4DACA,sCAAsC,MAAM,KAAK,cACvD;CAGF,MAAM,SAAS,2BAA2B,cAAc,QAAQ,GAAG,QAAQ;CAE3E,IAAI,CAAC,QACH,MAAM,IAAI,UAAU,KAAK,oCAAoC;CAG/D,MAAM,UAAU,OAAO,UAAU,eAAe,KAAK,OAAO,UAAU,MAAM,OAAO,IAC/E,OAAO,SAAS,MAAM,WACtB;CAEJ,IAAI,YAAY,QACd,MAAM,IAAI,UAAU,KAAK,oBAAoB,MAAM,QAAQ,GAAG;CAGhE,IAAI,MAAM,WAAW,UAAa,CAAC,OAAO,QAAQ,SAAS,MAAM,MAAe,GAC9E,MAAM,IAAI,UAAU,KAAK,WAAW,MAAM,OAAO,kBAAkB;CAGrE,2BAA2B,OAAO,cAAc;CAEhD,MAAM,YAAY,MAAM,wBAAwB,MAAM,MAAM,UAAU,MAAM;CAE5E,IAAI,CAAC,WAAW,OAAO;CAEvB,MAAM,EAAE,QAAQ,OAAO,iBAAiB;CACxC,MAAM,SAA8B,MAAM,UAAU;CACpD,MAAM,OAAO,gBAAgB;EAC3B,cAAc,OAAO;EACrB,YAAY,MAAM;EAClB,eAAe,MAAM;EACrB;EACA;CACF,CAAC;CACD,MAAM,YAAY,iBAAiB,OAAO,MAAM,OAAO,YAAY;CACnE,MAAM,aAAa,qBAAqB,MAAM,MAAM,MAAM,OAAO;CACjE,MAAM,SAAS,iBAAiB,OAAO,gBAAgB;EAAE;EAAW;CAAW,GAAG,MAAM,MAAM;CAE9F,IAAI,CAAE,MAAM,OAAO,MAAM,GAKvB,MAAM,mBAAmB,IAAI,QAAQ,YAAY;EAC/C,IAAI,MAAM,OAAO,MAAM,GAAG;EAE1B,MAAM,QAAQ,MAAM,kBAAkB,OAAO,cAAc;GACzD,gBAAgB,OAAO;GACvB,iBAAiB,OAAO;GACxB,gBAAgB;EAClB,CAAC;EAED,MAAM,+BACJ,qBAAqB;GAAE,OAAO,MAAM,MAAM;GAAG;GAAS;GAAQ,YAAY;EAAO,CAAC,CACpF;EACA,MAAM,sCACJ,OAAO,cACP,uBAAuB,OAAO,gBAAgB,SAAS,GACvD,UACF;CACF,CAAC;CAGH,OAAO;EAAE,cAAc;EAAQ;EAAM;EAAQ,aAAa,cAAc;CAAQ;AAClF"}

package/esm/http/uploads/resolve-image-variants-config.mjs

@@ -1,7 +1,7 @@
 import { ImageVariantsConfigError } from "./image-variants-config-error.mjs";
 import path from "node:path";
 
-//#region ../core/src/http/uploads/resolve-image-variants-config.ts
+//#region ../../packages/core/src/http/uploads/resolve-image-variants-config.ts
 /**
 * Largest width or height a variant may declare
 */

package/esm/http/uploads/resolve-image-variants-config.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"resolve-image-variants-config.mjs","names":[],"sources":["../../../../../../../../core/src/http/uploads/resolve-image-variants-config.ts"],"sourcesContent":["import path from \"node:path\";\nimport type {\n  ImageVariantDefinition,\n  ImageVariantFit,\n  ImageVariantOutputFormat,\n  UploadsImagesConfigurations,\n} from \"../uploads-types\";\nimport { ImageVariantsConfigError } from \"./image-variants-config-error\";\nimport type { ResolvedImageVariantsConfig } from \"./image-variant-types\";\n\n/**\n * Largest width or height a variant may declare\n */\nexport const MAX_VARIANT_DIMENSION = 8192;\n\n/**\n * Default `maxSourceBytes`: 25 MB\n */\nexport const DEFAULT_MAX_SOURCE_BYTES = 25 * 1024 * 1024;\n\n/**\n * Default `maxSourcePixels`\n */\nexport const DEFAULT_MAX_SOURCE_PIXELS = 40_000_000;\n\nconst FITS: readonly ImageVariantFit[] = [\"cover\", \"contain\", \"inside\"];\n\nconst OUTPUT_FORMATS: readonly ImageVariantOutputFormat[] = [\"avif\", \"webp\"];\n\nconst VARIANT_NAME = /^[A-Za-z0-9_-]+$/;\n\nfunction isPositiveInteger(value: unknown, max = Number.MAX_SAFE_INTEGER): value is number {\n  return typeof value === \"number\" && Number.isInteger(value) && value >= 1 && value <= max;\n}\n\nfunction resolveVariant(name: string, raw: unknown): ImageVariantDefinition {\n  const key = `uploads.images.variants.${name}`;\n\n  if (!VARIANT_NAME.test(name)) {\n    throw new ImageVariantsConfigError(\n      `${key}: a variant name may only use letters, digits, \"-\" and \"_\".`,\n    );\n  }\n\n  if (!raw || typeof raw !== \"object\") {\n    throw new ImageVariantsConfigError(`${key} must be an object with a width.`);\n  }\n\n  const { width, height, fit, quality, enlarge } = raw as Record<string, unknown>;\n\n  if (!isPositiveInteger(width, MAX_VARIANT_DIMENSION)) {\n    throw new ImageVariantsConfigError(\n      `${key}.width must be an integer from 1 to ${MAX_VARIANT_DIMENSION}, got ${JSON.stringify(width)}.`,\n    );\n  }\n\n  const variant: ImageVariantDefinition = { width };\n\n  if (height !== undefined) {\n    if (!isPositiveInteger(height, MAX_VARIANT_DIMENSION)) {\n      throw new ImageVariantsConfigError(\n        `${key}.height must be an integer from 1 to ${MAX_VARIANT_DIMENSION}, got ${JSON.stringify(height)}.`,\n      );\n    }\n\n    variant.height = height;\n  }\n\n  if (fit !== undefined) {\n    if (!FITS.includes(fit as ImageVariantFit)) {\n      throw new ImageVariantsConfigError(\n        `${key}.fit must be one of ${FITS.join(\", \")}, got ${JSON.stringify(fit)}.`,\n      );\n    }\n\n    variant.fit = fit as ImageVariantFit;\n  }\n\n  if (quality !== undefined) {\n    if (!isPositiveInteger(quality, 100)) {\n      throw new ImageVariantsConfigError(\n        `${key}.quality must be an integer from 1 to 100, got ${JSON.stringify(quality)}.`,\n      );\n    }\n\n    variant.quality = quality;\n  }\n\n  if (enlarge !== undefined && typeof enlarge !== \"boolean\") {\n    throw new ImageVariantsConfigError(\n      `${key}.enlarge must be a boolean, got ${JSON.stringify(enlarge)}.`,\n    );\n  }\n\n  // Always set, never left undefined: the effective flag (default false) is\n  // part of the normalized variant, so toggling it changes the cache key.\n  variant.enlarge = enlarge === true;\n\n  return variant;\n}\n\nfunction resolveFormats(raw: unknown): readonly ImageVariantOutputFormat[] {\n  if (raw === undefined) return [];\n\n  if (!Array.isArray(raw)) {\n    throw new ImageVariantsConfigError(`uploads.images.formats must be an array.`);\n  }\n\n  for (const format of raw) {\n    if (!OUTPUT_FORMATS.includes(format)) {\n      throw new ImageVariantsConfigError(\n        `uploads.images.formats may only contain ${OUTPUT_FORMATS.join(\", \")}, got ${JSON.stringify(format)}.`,\n      );\n    }\n  }\n\n  return [...new Set(raw as ImageVariantOutputFormat[])];\n}\n\nfunction resolveLimit(name: string, raw: unknown, fallback: number): number {\n  if (raw === undefined) return fallback;\n\n  if (!isPositiveInteger(raw)) {\n    throw new ImageVariantsConfigError(\n      `uploads.images.${name} must be a positive integer, got ${JSON.stringify(raw)}.`,\n    );\n  }\n\n  return raw;\n}\n\n/**\n * Validate the `uploads.images` config and apply its defaults.\n *\n * Every variant is copied field by field, so an unknown key in the config can\n * never reach sharp, and the result is what the cache key is computed from.\n *\n * @param images - the raw `uploads.images` value\n * @param storageRoot - the local storage root, base of the default cache directory\n * @returns the resolved config, or `undefined` when variants are not configured\n * @throws ImageVariantsConfigError when any value is out of bounds\n */\nexport function resolveImageVariantsConfig(\n  images: UploadsImagesConfigurations | undefined,\n  storageRoot: string,\n): ResolvedImageVariantsConfig | undefined {\n  if (images === undefined || images === null) return undefined;\n\n  if (typeof images !== \"object\") {\n    throw new ImageVariantsConfigError(\"uploads.images must be an object.\");\n  }\n\n  const rawVariants = (images as { variants?: unknown }).variants;\n\n  if (!rawVariants || typeof rawVariants !== \"object\" || Object.keys(rawVariants).length === 0) {\n    throw new ImageVariantsConfigError(\n      \"uploads.images.variants must declare at least one variant.\",\n    );\n  }\n\n  const variants: Record<string, ImageVariantDefinition> = {};\n\n  for (const [name, raw] of Object.entries(rawVariants)) {\n    variants[name] = resolveVariant(name, raw);\n  }\n\n  const cacheDirectory = images.cacheDirectory\n    ? path.resolve(images.cacheDirectory)\n    : path.join(storageRoot, \".cache\", \"image-variants\");\n\n  return {\n    variants,\n    formats: resolveFormats(images.formats),\n    maxSourceBytes: resolveLimit(\"maxSourceBytes\", images.maxSourceBytes, DEFAULT_MAX_SOURCE_BYTES),\n    maxSourcePixels: resolveLimit(\n      \"maxSourcePixels\",\n      images.maxSourcePixels,\n      DEFAULT_MAX_SOURCE_PIXELS,\n    ),\n    cacheDirectory,\n  };\n}\n"],"mappings":";;;;;;;AAaA,MAAa,wBAAwB;;;;AAKrC,MAAa,2BAA2B,KAAK,OAAO;;;;AAKpD,MAAa,4BAA4B;AAEzC,MAAM,OAAmC;CAAC;CAAS;CAAW;AAAQ;AAEtE,MAAM,iBAAsD,CAAC,QAAQ,MAAM;AAE3E,MAAM,eAAe;AAErB,SAAS,kBAAkB,OAAgB,MAAM,OAAO,kBAAmC;CACzF,OAAO,OAAO,UAAU,YAAY,OAAO,UAAU,KAAK,KAAK,SAAS,KAAK,SAAS;AACxF;AAEA,SAAS,eAAe,MAAc,KAAsC;CAC1E,MAAM,MAAM,2BAA2B;CAEvC,IAAI,CAAC,aAAa,KAAK,IAAI,GACzB,MAAM,IAAI,yBACR,GAAG,IAAI,4DACT;CAGF,IAAI,CAAC,OAAO,OAAO,QAAQ,UACzB,MAAM,IAAI,yBAAyB,GAAG,IAAI,iCAAiC;CAG7E,MAAM,EAAE,OAAO,QAAQ,KAAK,SAAS,YAAY;CAEjD,IAAI,CAAC,kBAAkB,WAA4B,GACjD,MAAM,IAAI,yBACR,GAAG,IAAI,sCAAsC,sBAAsB,QAAQ,KAAK,UAAU,KAAK,EAAE,EACnG;CAGF,MAAM,UAAkC,EAAE,MAAM;CAEhD,IAAI,WAAW,QAAW;EACxB,IAAI,CAAC,kBAAkB,YAA6B,GAClD,MAAM,IAAI,yBACR,GAAG,IAAI,uCAAuC,sBAAsB,QAAQ,KAAK,UAAU,MAAM,EAAE,EACrG;EAGF,QAAQ,SAAS;CACnB;CAEA,IAAI,QAAQ,QAAW;EACrB,IAAI,CAAC,KAAK,SAAS,GAAsB,GACvC,MAAM,IAAI,yBACR,GAAG,IAAI,sBAAsB,KAAK,KAAK,IAAI,EAAE,QAAQ,KAAK,UAAU,GAAG,EAAE,EAC3E;EAGF,QAAQ,MAAM;CAChB;CAEA,IAAI,YAAY,QAAW;EACzB,IAAI,CAAC,kBAAkB,SAAS,GAAG,GACjC,MAAM,IAAI,yBACR,GAAG,IAAI,iDAAiD,KAAK,UAAU,OAAO,EAAE,EAClF;EAGF,QAAQ,UAAU;CACpB;CAEA,IAAI,YAAY,UAAa,OAAO,YAAY,WAC9C,MAAM,IAAI,yBACR,GAAG,IAAI,kCAAkC,KAAK,UAAU,OAAO,EAAE,EACnE;CAKF,QAAQ,UAAU,YAAY;CAE9B,OAAO;AACT;AAEA,SAAS,eAAe,KAAmD;CACzE,IAAI,QAAQ,QAAW,OAAO,CAAC;CAE/B,IAAI,CAAC,MAAM,QAAQ,GAAG,GACpB,MAAM,IAAI,yBAAyB,0CAA0C;CAG/E,KAAK,MAAM,UAAU,KACnB,IAAI,CAAC,eAAe,SAAS,MAAM,GACjC,MAAM,IAAI,yBACR,2CAA2C,eAAe,KAAK,IAAI,EAAE,QAAQ,KAAK,UAAU,MAAM,EAAE,EACtG;CAIJ,OAAO,CAAC,GAAG,IAAI,IAAI,GAAiC,CAAC;AACvD;AAEA,SAAS,aAAa,MAAc,KAAc,UAA0B;CAC1E,IAAI,QAAQ,QAAW,OAAO;CAE9B,IAAI,CAAC,kBAAkB,GAAG,GACxB,MAAM,IAAI,yBACR,kBAAkB,KAAK,mCAAmC,KAAK,UAAU,GAAG,EAAE,EAChF;CAGF,OAAO;AACT;;;;;;;;;;;;AAaA,SAAgB,2BACd,QACA,aACyC;CACzC,IAAI,WAAW,UAAa,WAAW,MAAM,OAAO;CAEpD,IAAI,OAAO,WAAW,UACpB,MAAM,IAAI,yBAAyB,mCAAmC;CAGxE,MAAM,cAAe,OAAkC;CAEvD,IAAI,CAAC,eAAe,OAAO,gBAAgB,YAAY,OAAO,KAAK,WAAW,CAAC,CAAC,WAAW,GACzF,MAAM,IAAI,yBACR,4DACF;CAGF,MAAM,WAAmD,CAAC;CAE1D,KAAK,MAAM,CAAC,MAAM,QAAQ,OAAO,QAAQ,WAAW,GAClD,SAAS,QAAQ,eAAe,MAAM,GAAG;CAG3C,MAAM,iBAAiB,OAAO,iBAC1B,KAAK,QAAQ,OAAO,cAAc,IAClC,KAAK,KAAK,aAAa,UAAU,gBAAgB;CAErD,OAAO;EACL;EACA,SAAS,eAAe,OAAO,OAAO;EACtC,gBAAgB,aAAa,kBAAkB,OAAO,gBAAgB,wBAAwB;EAC9F,iBAAiB,aACf,mBACA,OAAO,iBACP,yBACF;EACA;CACF;AACF"}
+{"version":3,"file":"resolve-image-variants-config.mjs","names":[],"sources":["../../../../../../../../../packages/core/src/http/uploads/resolve-image-variants-config.ts"],"sourcesContent":["import path from \"node:path\";\nimport type {\n  ImageVariantDefinition,\n  ImageVariantFit,\n  ImageVariantOutputFormat,\n  UploadsImagesConfigurations,\n} from \"../uploads-types\";\nimport { ImageVariantsConfigError } from \"./image-variants-config-error\";\nimport type { ResolvedImageVariantsConfig } from \"./image-variant-types\";\n\n/**\n * Largest width or height a variant may declare\n */\nexport const MAX_VARIANT_DIMENSION = 8192;\n\n/**\n * Default `maxSourceBytes`: 25 MB\n */\nexport const DEFAULT_MAX_SOURCE_BYTES = 25 * 1024 * 1024;\n\n/**\n * Default `maxSourcePixels`\n */\nexport const DEFAULT_MAX_SOURCE_PIXELS = 40_000_000;\n\nconst FITS: readonly ImageVariantFit[] = [\"cover\", \"contain\", \"inside\"];\n\nconst OUTPUT_FORMATS: readonly ImageVariantOutputFormat[] = [\"avif\", \"webp\"];\n\nconst VARIANT_NAME = /^[A-Za-z0-9_-]+$/;\n\nfunction isPositiveInteger(value: unknown, max = Number.MAX_SAFE_INTEGER): value is number {\n  return typeof value === \"number\" && Number.isInteger(value) && value >= 1 && value <= max;\n}\n\nfunction resolveVariant(name: string, raw: unknown): ImageVariantDefinition {\n  const key = `uploads.images.variants.${name}`;\n\n  if (!VARIANT_NAME.test(name)) {\n    throw new ImageVariantsConfigError(\n      `${key}: a variant name may only use letters, digits, \"-\" and \"_\".`,\n    );\n  }\n\n  if (!raw || typeof raw !== \"object\") {\n    throw new ImageVariantsConfigError(`${key} must be an object with a width.`);\n  }\n\n  const { width, height, fit, quality, enlarge } = raw as Record<string, unknown>;\n\n  if (!isPositiveInteger(width, MAX_VARIANT_DIMENSION)) {\n    throw new ImageVariantsConfigError(\n      `${key}.width must be an integer from 1 to ${MAX_VARIANT_DIMENSION}, got ${JSON.stringify(width)}.`,\n    );\n  }\n\n  const variant: ImageVariantDefinition = { width };\n\n  if (height !== undefined) {\n    if (!isPositiveInteger(height, MAX_VARIANT_DIMENSION)) {\n      throw new ImageVariantsConfigError(\n        `${key}.height must be an integer from 1 to ${MAX_VARIANT_DIMENSION}, got ${JSON.stringify(height)}.`,\n      );\n    }\n\n    variant.height = height;\n  }\n\n  if (fit !== undefined) {\n    if (!FITS.includes(fit as ImageVariantFit)) {\n      throw new ImageVariantsConfigError(\n        `${key}.fit must be one of ${FITS.join(\", \")}, got ${JSON.stringify(fit)}.`,\n      );\n    }\n\n    variant.fit = fit as ImageVariantFit;\n  }\n\n  if (quality !== undefined) {\n    if (!isPositiveInteger(quality, 100)) {\n      throw new ImageVariantsConfigError(\n        `${key}.quality must be an integer from 1 to 100, got ${JSON.stringify(quality)}.`,\n      );\n    }\n\n    variant.quality = quality;\n  }\n\n  if (enlarge !== undefined && typeof enlarge !== \"boolean\") {\n    throw new ImageVariantsConfigError(\n      `${key}.enlarge must be a boolean, got ${JSON.stringify(enlarge)}.`,\n    );\n  }\n\n  // Always set, never left undefined: the effective flag (default false) is\n  // part of the normalized variant, so toggling it changes the cache key.\n  variant.enlarge = enlarge === true;\n\n  return variant;\n}\n\nfunction resolveFormats(raw: unknown): readonly ImageVariantOutputFormat[] {\n  if (raw === undefined) return [];\n\n  if (!Array.isArray(raw)) {\n    throw new ImageVariantsConfigError(`uploads.images.formats must be an array.`);\n  }\n\n  for (const format of raw) {\n    if (!OUTPUT_FORMATS.includes(format)) {\n      throw new ImageVariantsConfigError(\n        `uploads.images.formats may only contain ${OUTPUT_FORMATS.join(\", \")}, got ${JSON.stringify(format)}.`,\n      );\n    }\n  }\n\n  return [...new Set(raw as ImageVariantOutputFormat[])];\n}\n\nfunction resolveLimit(name: string, raw: unknown, fallback: number): number {\n  if (raw === undefined) return fallback;\n\n  if (!isPositiveInteger(raw)) {\n    throw new ImageVariantsConfigError(\n      `uploads.images.${name} must be a positive integer, got ${JSON.stringify(raw)}.`,\n    );\n  }\n\n  return raw;\n}\n\n/**\n * Validate the `uploads.images` config and apply its defaults.\n *\n * Every variant is copied field by field, so an unknown key in the config can\n * never reach sharp, and the result is what the cache key is computed from.\n *\n * @param images - the raw `uploads.images` value\n * @param storageRoot - the local storage root, base of the default cache directory\n * @returns the resolved config, or `undefined` when variants are not configured\n * @throws ImageVariantsConfigError when any value is out of bounds\n */\nexport function resolveImageVariantsConfig(\n  images: UploadsImagesConfigurations | undefined,\n  storageRoot: string,\n): ResolvedImageVariantsConfig | undefined {\n  if (images === undefined || images === null) return undefined;\n\n  if (typeof images !== \"object\") {\n    throw new ImageVariantsConfigError(\"uploads.images must be an object.\");\n  }\n\n  const rawVariants = (images as { variants?: unknown }).variants;\n\n  if (!rawVariants || typeof rawVariants !== \"object\" || Object.keys(rawVariants).length === 0) {\n    throw new ImageVariantsConfigError(\n      \"uploads.images.variants must declare at least one variant.\",\n    );\n  }\n\n  const variants: Record<string, ImageVariantDefinition> = {};\n\n  for (const [name, raw] of Object.entries(rawVariants)) {\n    variants[name] = resolveVariant(name, raw);\n  }\n\n  const cacheDirectory = images.cacheDirectory\n    ? path.resolve(images.cacheDirectory)\n    : path.join(storageRoot, \".cache\", \"image-variants\");\n\n  return {\n    variants,\n    formats: resolveFormats(images.formats),\n    maxSourceBytes: resolveLimit(\"maxSourceBytes\", images.maxSourceBytes, DEFAULT_MAX_SOURCE_BYTES),\n    maxSourcePixels: resolveLimit(\n      \"maxSourcePixels\",\n      images.maxSourcePixels,\n      DEFAULT_MAX_SOURCE_PIXELS,\n    ),\n    cacheDirectory,\n  };\n}\n"],"mappings":";;;;;;;AAaA,MAAa,wBAAwB;;;;AAKrC,MAAa,2BAA2B,KAAK,OAAO;;;;AAKpD,MAAa,4BAA4B;AAEzC,MAAM,OAAmC;CAAC;CAAS;CAAW;AAAQ;AAEtE,MAAM,iBAAsD,CAAC,QAAQ,MAAM;AAE3E,MAAM,eAAe;AAErB,SAAS,kBAAkB,OAAgB,MAAM,OAAO,kBAAmC;CACzF,OAAO,OAAO,UAAU,YAAY,OAAO,UAAU,KAAK,KAAK,SAAS,KAAK,SAAS;AACxF;AAEA,SAAS,eAAe,MAAc,KAAsC;CAC1E,MAAM,MAAM,2BAA2B;CAEvC,IAAI,CAAC,aAAa,KAAK,IAAI,GACzB,MAAM,IAAI,yBACR,GAAG,IAAI,4DACT;CAGF,IAAI,CAAC,OAAO,OAAO,QAAQ,UACzB,MAAM,IAAI,yBAAyB,GAAG,IAAI,iCAAiC;CAG7E,MAAM,EAAE,OAAO,QAAQ,KAAK,SAAS,YAAY;CAEjD,IAAI,CAAC,kBAAkB,WAA4B,GACjD,MAAM,IAAI,yBACR,GAAG,IAAI,sCAAsC,sBAAsB,QAAQ,KAAK,UAAU,KAAK,EAAE,EACnG;CAGF,MAAM,UAAkC,EAAE,MAAM;CAEhD,IAAI,WAAW,QAAW;EACxB,IAAI,CAAC,kBAAkB,YAA6B,GAClD,MAAM,IAAI,yBACR,GAAG,IAAI,uCAAuC,sBAAsB,QAAQ,KAAK,UAAU,MAAM,EAAE,EACrG;EAGF,QAAQ,SAAS;CACnB;CAEA,IAAI,QAAQ,QAAW;EACrB,IAAI,CAAC,KAAK,SAAS,GAAsB,GACvC,MAAM,IAAI,yBACR,GAAG,IAAI,sBAAsB,KAAK,KAAK,IAAI,EAAE,QAAQ,KAAK,UAAU,GAAG,EAAE,EAC3E;EAGF,QAAQ,MAAM;CAChB;CAEA,IAAI,YAAY,QAAW;EACzB,IAAI,CAAC,kBAAkB,SAAS,GAAG,GACjC,MAAM,IAAI,yBACR,GAAG,IAAI,iDAAiD,KAAK,UAAU,OAAO,EAAE,EAClF;EAGF,QAAQ,UAAU;CACpB;CAEA,IAAI,YAAY,UAAa,OAAO,YAAY,WAC9C,MAAM,IAAI,yBACR,GAAG,IAAI,kCAAkC,KAAK,UAAU,OAAO,EAAE,EACnE;CAKF,QAAQ,UAAU,YAAY;CAE9B,OAAO;AACT;AAEA,SAAS,eAAe,KAAmD;CACzE,IAAI,QAAQ,QAAW,OAAO,CAAC;CAE/B,IAAI,CAAC,MAAM,QAAQ,GAAG,GACpB,MAAM,IAAI,yBAAyB,0CAA0C;CAG/E,KAAK,MAAM,UAAU,KACnB,IAAI,CAAC,eAAe,SAAS,MAAM,GACjC,MAAM,IAAI,yBACR,2CAA2C,eAAe,KAAK,IAAI,EAAE,QAAQ,KAAK,UAAU,MAAM,EAAE,EACtG;CAIJ,OAAO,CAAC,GAAG,IAAI,IAAI,GAAiC,CAAC;AACvD;AAEA,SAAS,aAAa,MAAc,KAAc,UAA0B;CAC1E,IAAI,QAAQ,QAAW,OAAO;CAE9B,IAAI,CAAC,kBAAkB,GAAG,GACxB,MAAM,IAAI,yBACR,kBAAkB,KAAK,mCAAmC,KAAK,UAAU,GAAG,EAAE,EAChF;CAGF,OAAO;AACT;;;;;;;;;;;;AAaA,SAAgB,2BACd,QACA,aACyC;CACzC,IAAI,WAAW,UAAa,WAAW,MAAM,OAAO;CAEpD,IAAI,OAAO,WAAW,UACpB,MAAM,IAAI,yBAAyB,mCAAmC;CAGxE,MAAM,cAAe,OAAkC;CAEvD,IAAI,CAAC,eAAe,OAAO,gBAAgB,YAAY,OAAO,KAAK,WAAW,CAAC,CAAC,WAAW,GACzF,MAAM,IAAI,yBACR,4DACF;CAGF,MAAM,WAAmD,CAAC;CAE1D,KAAK,MAAM,CAAC,MAAM,QAAQ,OAAO,QAAQ,WAAW,GAClD,SAAS,QAAQ,eAAe,MAAM,GAAG;CAG3C,MAAM,iBAAiB,OAAO,iBAC1B,KAAK,QAAQ,OAAO,cAAc,IAClC,KAAK,KAAK,aAAa,UAAU,gBAAgB;CAErD,OAAO;EACL;EACA,SAAS,eAAe,OAAO,OAAO;EACtC,gBAAgB,aAAa,kBAAkB,OAAO,gBAAgB,wBAAwB;EAC9F,iBAAiB,aACf,mBACA,OAAO,iBACP,yBACF;EACA;CACF;AACF"}

package/esm/http/uploads/resolve-inline-image-content-type.mjs

@@ -1,6 +1,6 @@
 import path from "node:path";
 
-//#region ../core/src/http/uploads/resolve-inline-image-content-type.ts
+//#region ../../packages/core/src/http/uploads/resolve-inline-image-content-type.ts
 /**
 * Extensions an upload original may carry for each raster format that is
 * allowed to render inline. Anything else — including `.gif`, since gif is

package/esm/http/uploads/resolve-inline-image-content-type.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"resolve-inline-image-content-type.mjs","names":[],"sources":["../../../../../../../../core/src/http/uploads/resolve-inline-image-content-type.ts"],"sourcesContent":["import path from \"node:path\";\nimport type { DetectedImageFormat, VariantSourceFormat } from \"./image-variant-types\";\n\n/**\n * Extensions an upload original may carry for each raster format that is\n * allowed to render inline. Anything else — including `.gif`, since gif is\n * not a variant source format — is never served inline, regardless of what\n * its bytes sniff as.\n */\nconst EXTENSION_IMAGE_FORMATS: Readonly<Record<string, VariantSourceFormat>> = {\n  \".jpg\": \"jpeg\",\n  \".jpeg\": \"jpeg\",\n  \".png\": \"png\",\n  \".webp\": \"webp\",\n  \".avif\": \"avif\",\n};\n\n/**\n * Content type an inline response must advertise for each raster format,\n * used instead of an extension-derived guess.\n */\nconst INLINE_IMAGE_CONTENT_TYPES: Readonly<Record<VariantSourceFormat, string>> = {\n  jpeg: \"image/jpeg\",\n  png: \"image/png\",\n  webp: \"image/webp\",\n  avif: \"image/avif\",\n};\n\n/**\n * Content type to serve an upload original inline with, or `undefined` when\n * it must go out as an attachment instead.\n *\n * `sendFile` sets `Content-Type` from the file's EXTENSION, not its bytes.\n * The inline branch in `uploaded-file.controller.ts` only sniffs the bytes to\n * decide \"is this raster\" — so a JPEG-signature file named `x.html` sniffed\n * as jpeg (raster, so \"safe\") would still have been sent by `sendFile` as\n * `text/html`: a polyglot JPEG/HTML stored-XSS vector, the reverse of the\n * already-fixed SVG-named-`.png` case.\n *\n * Inline is therefore only safe when the sniffed format AND the\n * extension-derived format agree — the extension maps to the SAME image\n * type the bytes sniffed as. Any mismatch (raster bytes under a non-image or\n * different-image extension) returns `undefined`, sending the caller to the\n * attachment path instead of trusting either signal alone.\n */\nexport function resolveInlineImageContentType(\n  filePath: string,\n  sniffedFormat: DetectedImageFormat | undefined,\n): string | undefined {\n  if (sniffedFormat === undefined) return undefined;\n\n  const extensionFormat = EXTENSION_IMAGE_FORMATS[path.extname(filePath).toLowerCase()];\n\n  if (extensionFormat === undefined || extensionFormat !== sniffedFormat) return undefined;\n\n  return INLINE_IMAGE_CONTENT_TYPES[extensionFormat];\n}\n"],"mappings":";;;;;;;;;AASA,MAAM,0BAAyE;CAC7E,QAAQ;CACR,SAAS;CACT,QAAQ;CACR,SAAS;CACT,SAAS;AACX;;;;;AAMA,MAAM,6BAA4E;CAChF,MAAM;CACN,KAAK;CACL,MAAM;CACN,MAAM;AACR;;;;;;;;;;;;;;;;;;AAmBA,SAAgB,8BACd,UACA,eACoB;CACpB,IAAI,kBAAkB,QAAW,OAAO;CAExC,MAAM,kBAAkB,wBAAwB,KAAK,QAAQ,QAAQ,CAAC,CAAC,YAAY;CAEnF,IAAI,oBAAoB,UAAa,oBAAoB,eAAe,OAAO;CAE/E,OAAO,2BAA2B;AACpC"}
+{"version":3,"file":"resolve-inline-image-content-type.mjs","names":[],"sources":["../../../../../../../../../packages/core/src/http/uploads/resolve-inline-image-content-type.ts"],"sourcesContent":["import path from \"node:path\";\nimport type { DetectedImageFormat, VariantSourceFormat } from \"./image-variant-types\";\n\n/**\n * Extensions an upload original may carry for each raster format that is\n * allowed to render inline. Anything else — including `.gif`, since gif is\n * not a variant source format — is never served inline, regardless of what\n * its bytes sniff as.\n */\nconst EXTENSION_IMAGE_FORMATS: Readonly<Record<string, VariantSourceFormat>> = {\n  \".jpg\": \"jpeg\",\n  \".jpeg\": \"jpeg\",\n  \".png\": \"png\",\n  \".webp\": \"webp\",\n  \".avif\": \"avif\",\n};\n\n/**\n * Content type an inline response must advertise for each raster format,\n * used instead of an extension-derived guess.\n */\nconst INLINE_IMAGE_CONTENT_TYPES: Readonly<Record<VariantSourceFormat, string>> = {\n  jpeg: \"image/jpeg\",\n  png: \"image/png\",\n  webp: \"image/webp\",\n  avif: \"image/avif\",\n};\n\n/**\n * Content type to serve an upload original inline with, or `undefined` when\n * it must go out as an attachment instead.\n *\n * `sendFile` sets `Content-Type` from the file's EXTENSION, not its bytes.\n * The inline branch in `uploaded-file.controller.ts` only sniffs the bytes to\n * decide \"is this raster\" — so a JPEG-signature file named `x.html` sniffed\n * as jpeg (raster, so \"safe\") would still have been sent by `sendFile` as\n * `text/html`: a polyglot JPEG/HTML stored-XSS vector, the reverse of the\n * already-fixed SVG-named-`.png` case.\n *\n * Inline is therefore only safe when the sniffed format AND the\n * extension-derived format agree — the extension maps to the SAME image\n * type the bytes sniffed as. Any mismatch (raster bytes under a non-image or\n * different-image extension) returns `undefined`, sending the caller to the\n * attachment path instead of trusting either signal alone.\n */\nexport function resolveInlineImageContentType(\n  filePath: string,\n  sniffedFormat: DetectedImageFormat | undefined,\n): string | undefined {\n  if (sniffedFormat === undefined) return undefined;\n\n  const extensionFormat = EXTENSION_IMAGE_FORMATS[path.extname(filePath).toLowerCase()];\n\n  if (extensionFormat === undefined || extensionFormat !== sniffedFormat) return undefined;\n\n  return INLINE_IMAGE_CONTENT_TYPES[extensionFormat];\n}\n"],"mappings":";;;;;;;;;AASA,MAAM,0BAAyE;CAC7E,QAAQ;CACR,SAAS;CACT,QAAQ;CACR,SAAS;CACT,SAAS;AACX;;;;;AAMA,MAAM,6BAA4E;CAChF,MAAM;CACN,KAAK;CACL,MAAM;CACN,MAAM;AACR;;;;;;;;;;;;;;;;;;AAmBA,SAAgB,8BACd,UACA,eACoB;CACpB,IAAI,kBAAkB,QAAW,OAAO;CAExC,MAAM,kBAAkB,wBAAwB,KAAK,QAAQ,QAAQ,CAAC,CAAC,YAAY;CAEnF,IAAI,oBAAoB,UAAa,oBAAoB,eAAe,OAAO;CAE/E,OAAO,2BAA2B;AACpC"}

package/esm/http/uploads/resolve-original-content-type.mjs

@@ -1,6 +1,6 @@
 import mime from "mime";
 
-//#region ../core/src/http/uploads/resolve-original-content-type.ts
+//#region ../../packages/core/src/http/uploads/resolve-original-content-type.ts
 /**
 * Extension-derived MIME types that are never safe to advertise as-is: a
 * browser that trusts one of these will parse and execute the response body

package/esm/http/uploads/resolve-original-content-type.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"resolve-original-content-type.mjs","names":[],"sources":["../../../../../../../../core/src/http/uploads/resolve-original-content-type.ts"],"sourcesContent":["import mime from \"mime\";\n\n/**\n * Extension-derived MIME types that are never safe to advertise as-is: a\n * browser that trusts one of these will parse and execute the response body\n * (inline `<script>` in an svg, markup and script in html/xhtml/xml), so an\n * upload served under its real type is stored XSS the moment it is fetched\n * from the app's own origin.\n */\nconst INLINE_EXECUTABLE_MIME_TYPES = new Set([\n  \"image/svg+xml\",\n  \"text/html\",\n  \"application/xhtml+xml\",\n  \"text/xml\",\n  \"application/xml\",\n]);\n\n/**\n * Content type for an upload original that is being served as an\n * `attachment` (see `uploaded-file.controller.ts`): the extension-derived\n * type, except the svg/html/xml family, which is downgraded to\n * `application/octet-stream` so a browser never sniffs or renders it.\n */\nexport function resolveOriginalContentType(filePath: string): string {\n  const type = mime.getType(filePath) || \"application/octet-stream\";\n\n  return INLINE_EXECUTABLE_MIME_TYPES.has(type) ? \"application/octet-stream\" : type;\n}\n"],"mappings":";;;;;;;;;;AASA,MAAM,+BAA+B,IAAI,IAAI;CAC3C;CACA;CACA;CACA;CACA;AACF,CAAC;;;;;;;AAQD,SAAgB,2BAA2B,UAA0B;CACnE,MAAM,OAAO,KAAK,QAAQ,QAAQ,KAAK;CAEvC,OAAO,6BAA6B,IAAI,IAAI,IAAI,6BAA6B;AAC/E"}
+{"version":3,"file":"resolve-original-content-type.mjs","names":[],"sources":["../../../../../../../../../packages/core/src/http/uploads/resolve-original-content-type.ts"],"sourcesContent":["import mime from \"mime\";\n\n/**\n * Extension-derived MIME types that are never safe to advertise as-is: a\n * browser that trusts one of these will parse and execute the response body\n * (inline `<script>` in an svg, markup and script in html/xhtml/xml), so an\n * upload served under its real type is stored XSS the moment it is fetched\n * from the app's own origin.\n */\nconst INLINE_EXECUTABLE_MIME_TYPES = new Set([\n  \"image/svg+xml\",\n  \"text/html\",\n  \"application/xhtml+xml\",\n  \"text/xml\",\n  \"application/xml\",\n]);\n\n/**\n * Content type for an upload original that is being served as an\n * `attachment` (see `uploaded-file.controller.ts`): the extension-derived\n * type, except the svg/html/xml family, which is downgraded to\n * `application/octet-stream` so a browser never sniffs or renders it.\n */\nexport function resolveOriginalContentType(filePath: string): string {\n  const type = mime.getType(filePath) || \"application/octet-stream\";\n\n  return INLINE_EXECUTABLE_MIME_TYPES.has(type) ? \"application/octet-stream\" : type;\n}\n"],"mappings":";;;;;;;;;;AASA,MAAM,+BAA+B,IAAI,IAAI;CAC3C;CACA;CACA;CACA;CACA;AACF,CAAC;;;;;;;AAQD,SAAgB,2BAA2B,UAA0B;CACnE,MAAM,OAAO,KAAK,QAAQ,QAAQ,KAAK;CAEvC,OAAO,6BAA6B,IAAI,IAAI,IAAI,6BAA6B;AAC/E"}

package/esm/http/uploads/resolve-upload-path.mjs

@@ -2,7 +2,7 @@ import { isPathInside, isPathWithin } from "./is-path-inside.mjs";
 import path from "node:path";
 import fs from "node:fs/promises";
 
-//#region ../core/src/http/uploads/resolve-upload-path.ts
+//#region ../../packages/core/src/http/uploads/resolve-upload-path.ts
 async function realpathOrSelf(target) {
 	try {
 		return await fs.realpath(target);
@@ -47,7 +47,8 @@ async function resolveUploadPath(wildcard, storageRoot, excludedDirectories = []
 	}
 	return {
 		absolutePath: realPath,
-		relativePath: path.relative(realRoot, realPath).split(path.sep).join("/")
+		relativePath: path.relative(realRoot, realPath).split(path.sep).join("/"),
+		root: realRoot
 	};
 }
 

package/esm/http/uploads/resolve-upload-path.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"resolve-upload-path.mjs","names":[],"sources":["../../../../../../../../core/src/http/uploads/resolve-upload-path.ts"],"sourcesContent":["import fs from \"node:fs/promises\";\nimport path from \"node:path\";\nimport { isPathInside, isPathWithin } from \"./is-path-inside\";\n\n/**\n * A request path that resolved to a regular file inside the storage root\n */\nexport type ResolvedUploadPath = {\n  /**\n   * Real (symlink-free) absolute path of the file\n   */\n  absolutePath: string;\n\n  /**\n   * Path of the file relative to the real storage root, `/`-separated\n   */\n  relativePath: string;\n};\n\nasync function realpathOrSelf(target: string): Promise<string> {\n  try {\n    return await fs.realpath(target);\n  } catch {\n    return target;\n  }\n}\n\n/**\n * Resolve the wildcard of an uploads route to a file inside the storage root.\n *\n * The wildcard arrives already decoded once by the router and is NOT decoded\n * again: a second decode would turn `%252e%252e%252f` into `../`.\n *\n * Returns `undefined` — the caller answers 404 for every case, so the response\n * is no existence oracle — when the path:\n * - is empty, carries a NUL byte, or is absolute\n * - resolves outside the root, or to the root itself\n * - lies in one of the `excludedDirectories` (the variant cache)\n * - does not exist, or is not a regular file\n * - is (or passes through) a symlink whose target leaves the root\n */\nexport async function resolveUploadPath(\n  wildcard: unknown,\n  storageRoot: string,\n  excludedDirectories: readonly string[] = [],\n): Promise<ResolvedUploadPath | undefined> {\n  if (typeof wildcard !== \"string\" || wildcard === \"\" || wildcard.includes(\"\\0\")) {\n    return undefined;\n  }\n\n  if (path.isAbsolute(wildcard) || path.win32.isAbsolute(wildcard) || /^[A-Za-z]:/.test(wildcard)) {\n    return undefined;\n  }\n\n  const root = path.resolve(storageRoot);\n  const resolved = path.resolve(root, wildcard);\n\n  if (!isPathInside(resolved, root)) return undefined;\n\n  for (const excluded of excludedDirectories) {\n    if (isPathWithin(resolved, path.resolve(excluded))) return undefined;\n  }\n\n  let realPath: string;\n\n  try {\n    realPath = await fs.realpath(resolved);\n  } catch {\n    return undefined;\n  }\n\n  const realRoot = await realpathOrSelf(root);\n\n  if (!isPathInside(realPath, realRoot)) return undefined;\n\n  for (const excluded of excludedDirectories) {\n    if (isPathWithin(realPath, await realpathOrSelf(path.resolve(excluded)))) return undefined;\n  }\n\n  try {\n    const stats = await fs.stat(realPath);\n\n    if (!stats.isFile()) return undefined;\n  } catch {\n    return undefined;\n  }\n\n  return {\n    absolutePath: realPath,\n    relativePath: path.relative(realRoot, realPath).split(path.sep).join(\"/\"),\n  };\n}\n"],"mappings":";;;;;AAmBA,eAAe,eAAe,QAAiC;CAC7D,IAAI;EACF,OAAO,MAAM,GAAG,SAAS,MAAM;CACjC,QAAQ;EACN,OAAO;CACT;AACF;;;;;;;;;;;;;;;AAgBA,eAAsB,kBACpB,UACA,aACA,sBAAyC,CAAC,GACD;CACzC,IAAI,OAAO,aAAa,YAAY,aAAa,MAAM,SAAS,SAAS,IAAI,GAC3E;CAGF,IAAI,KAAK,WAAW,QAAQ,KAAK,KAAK,MAAM,WAAW,QAAQ,KAAK,aAAa,KAAK,QAAQ,GAC5F;CAGF,MAAM,OAAO,KAAK,QAAQ,WAAW;CACrC,MAAM,WAAW,KAAK,QAAQ,MAAM,QAAQ;CAE5C,IAAI,CAAC,aAAa,UAAU,IAAI,GAAG,OAAO;CAE1C,KAAK,MAAM,YAAY,qBACrB,IAAI,aAAa,UAAU,KAAK,QAAQ,QAAQ,CAAC,GAAG,OAAO;CAG7D,IAAI;CAEJ,IAAI;EACF,WAAW,MAAM,GAAG,SAAS,QAAQ;CACvC,QAAQ;EACN;CACF;CAEA,MAAM,WAAW,MAAM,eAAe,IAAI;CAE1C,IAAI,CAAC,aAAa,UAAU,QAAQ,GAAG,OAAO;CAE9C,KAAK,MAAM,YAAY,qBACrB,IAAI,aAAa,UAAU,MAAM,eAAe,KAAK,QAAQ,QAAQ,CAAC,CAAC,GAAG,OAAO;CAGnF,IAAI;EAGF,IAAI,EAAC,MAFe,GAAG,KAAK,QAAQ,EAE1B,CAAC,OAAO,GAAG,OAAO;CAC9B,QAAQ;EACN;CACF;CAEA,OAAO;EACL,cAAc;EACd,cAAc,KAAK,SAAS,UAAU,QAAQ,CAAC,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,GAAG;CAC1E;AACF"}
+{"version":3,"file":"resolve-upload-path.mjs","names":[],"sources":["../../../../../../../../../packages/core/src/http/uploads/resolve-upload-path.ts"],"sourcesContent":["import fs from \"node:fs/promises\";\nimport path from \"node:path\";\nimport { isPathInside, isPathWithin } from \"./is-path-inside\";\n\n/**\n * A request path that resolved to a regular file inside the storage root\n */\nexport type ResolvedUploadPath = {\n  /**\n   * Real (symlink-free) absolute path of the file\n   */\n  absolutePath: string;\n\n  /**\n   * Path of the file relative to the real storage root, `/`-separated\n   */\n  relativePath: string;\n\n  /**\n   * Real (symlink-free) absolute path of the storage root\n   */\n  root: string;\n};\n\nasync function realpathOrSelf(target: string): Promise<string> {\n  try {\n    return await fs.realpath(target);\n  } catch {\n    return target;\n  }\n}\n\n/**\n * Resolve the wildcard of an uploads route to a file inside the storage root.\n *\n * The wildcard arrives already decoded once by the router and is NOT decoded\n * again: a second decode would turn `%252e%252e%252f` into `../`.\n *\n * Returns `undefined` — the caller answers 404 for every case, so the response\n * is no existence oracle — when the path:\n * - is empty, carries a NUL byte, or is absolute\n * - resolves outside the root, or to the root itself\n * - lies in one of the `excludedDirectories` (the variant cache)\n * - does not exist, or is not a regular file\n * - is (or passes through) a symlink whose target leaves the root\n */\nexport async function resolveUploadPath(\n  wildcard: unknown,\n  storageRoot: string,\n  excludedDirectories: readonly string[] = [],\n): Promise<ResolvedUploadPath | undefined> {\n  if (typeof wildcard !== \"string\" || wildcard === \"\" || wildcard.includes(\"\\0\")) {\n    return undefined;\n  }\n\n  if (path.isAbsolute(wildcard) || path.win32.isAbsolute(wildcard) || /^[A-Za-z]:/.test(wildcard)) {\n    return undefined;\n  }\n\n  const root = path.resolve(storageRoot);\n  const resolved = path.resolve(root, wildcard);\n\n  if (!isPathInside(resolved, root)) return undefined;\n\n  for (const excluded of excludedDirectories) {\n    if (isPathWithin(resolved, path.resolve(excluded))) return undefined;\n  }\n\n  let realPath: string;\n\n  try {\n    realPath = await fs.realpath(resolved);\n  } catch {\n    return undefined;\n  }\n\n  const realRoot = await realpathOrSelf(root);\n\n  if (!isPathInside(realPath, realRoot)) return undefined;\n\n  for (const excluded of excludedDirectories) {\n    if (isPathWithin(realPath, await realpathOrSelf(path.resolve(excluded)))) return undefined;\n  }\n\n  try {\n    const stats = await fs.stat(realPath);\n\n    if (!stats.isFile()) return undefined;\n  } catch {\n    return undefined;\n  }\n\n  return {\n    absolutePath: realPath,\n    relativePath: path.relative(realRoot, realPath).split(path.sep).join(\"/\"),\n    root: realRoot,\n  };\n}\n"],"mappings":";;;;;AAwBA,eAAe,eAAe,QAAiC;CAC7D,IAAI;EACF,OAAO,MAAM,GAAG,SAAS,MAAM;CACjC,QAAQ;EACN,OAAO;CACT;AACF;;;;;;;;;;;;;;;AAgBA,eAAsB,kBACpB,UACA,aACA,sBAAyC,CAAC,GACD;CACzC,IAAI,OAAO,aAAa,YAAY,aAAa,MAAM,SAAS,SAAS,IAAI,GAC3E;CAGF,IAAI,KAAK,WAAW,QAAQ,KAAK,KAAK,MAAM,WAAW,QAAQ,KAAK,aAAa,KAAK,QAAQ,GAC5F;CAGF,MAAM,OAAO,KAAK,QAAQ,WAAW;CACrC,MAAM,WAAW,KAAK,QAAQ,MAAM,QAAQ;CAE5C,IAAI,CAAC,aAAa,UAAU,IAAI,GAAG,OAAO;CAE1C,KAAK,MAAM,YAAY,qBACrB,IAAI,aAAa,UAAU,KAAK,QAAQ,QAAQ,CAAC,GAAG,OAAO;CAG7D,IAAI;CAEJ,IAAI;EACF,WAAW,MAAM,GAAG,SAAS,QAAQ;CACvC,QAAQ;EACN;CACF;CAEA,MAAM,WAAW,MAAM,eAAe,IAAI;CAE1C,IAAI,CAAC,aAAa,UAAU,QAAQ,GAAG,OAAO;CAE9C,KAAK,MAAM,YAAY,qBACrB,IAAI,aAAa,UAAU,MAAM,eAAe,KAAK,QAAQ,QAAQ,CAAC,CAAC,GAAG,OAAO;CAGnF,IAAI;EAGF,IAAI,EAAC,MAFe,GAAG,KAAK,QAAQ,EAE1B,CAAC,OAAO,GAAG,OAAO;CAC9B,QAAQ;EACN;CACF;CAEA,OAAO;EACL,cAAc;EACd,cAAc,KAAK,SAAS,UAAU,QAAQ,CAAC,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,GAAG;EACxE,MAAM;CACR;AACF"}

package/esm/http/uploads/resolve-variant-candidate.mjs

@@ -4,7 +4,7 @@ import { readFileHead } from "./read-file-head.mjs";
 import { resolveUploadPath } from "./resolve-upload-path.mjs";
 import fs from "node:fs/promises";
 
-//#region ../core/src/http/uploads/resolve-variant-candidate.ts
+//#region ../../packages/core/src/http/uploads/resolve-variant-candidate.ts
 /**
 * Resolve a path to a variant source, applying the guards both the on-demand
 * route and the `generateImageVariants` ingest helper need: containment

package/esm/http/uploads/resolve-variant-candidate.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"resolve-variant-candidate.mjs","names":[],"sources":["../../../../../../../../core/src/http/uploads/resolve-variant-candidate.ts"],"sourcesContent":["import fs from \"node:fs/promises\";\nimport { HttpError } from \"../errors\";\nimport {\n  detectImageFormat,\n  IMAGE_SIGNATURE_BYTES,\n  isVariantSourceFormat,\n} from \"./detect-image-format\";\nimport type { ResolvedImageVariantsConfig, VariantSourceFormat } from \"./image-variant-types\";\nimport { readFileHead } from \"./read-file-head\";\nimport { resolveUploadPath, type ResolvedUploadPath } from \"./resolve-upload-path\";\n\n/**\n * A request path resolved to a usable variant source\n */\nexport type VariantCandidate = {\n  source: ResolvedUploadPath;\n  stats: { size: number; mtimeMs: number };\n  sourceFormat: VariantSourceFormat;\n};\n\n/**\n * Resolve a path to a variant source, applying the guards both the on-demand\n * route and the `generateImageVariants` ingest helper need: containment\n * (via `resolveUploadPath`), the byte-size limit, and the source format,\n * detected from magic bytes rather than the file extension.\n *\n * @returns `undefined` when the path does not resolve to a file inside the\n * storage root — the caller answers 404, the same as a missing file, so the\n * response is no existence oracle\n * @throws HttpError(413) when the source is over `images.maxSourceBytes`\n * @throws HttpError(415) when the source is not jpeg, png, webp or avif\n */\nexport async function resolveVariantCandidate(\n  wildcard: unknown,\n  storageRoot: string,\n  images: ResolvedImageVariantsConfig,\n): Promise<VariantCandidate | undefined> {\n  const source = await resolveUploadPath(wildcard, storageRoot, [images.cacheDirectory]);\n\n  if (!source) return undefined;\n\n  const stats = await fs.stat(source.absolutePath);\n\n  if (stats.size > images.maxSourceBytes) {\n    throw new HttpError(413, \"The source image is too large.\");\n  }\n\n  const sourceFormat = detectImageFormat(\n    await readFileHead(source.absolutePath, IMAGE_SIGNATURE_BYTES),\n  );\n\n  if (!isVariantSourceFormat(sourceFormat)) {\n    throw new HttpError(415, \"Variants are only available for jpeg, png, webp and avif images.\");\n  }\n\n  return {\n    source,\n    stats: { size: stats.size, mtimeMs: stats.mtimeMs },\n    sourceFormat,\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;AAgCA,eAAsB,wBACpB,UACA,aACA,QACuC;CACvC,MAAM,SAAS,MAAM,kBAAkB,UAAU,aAAa,CAAC,OAAO,cAAc,CAAC;CAErF,IAAI,CAAC,QAAQ,OAAO;CAEpB,MAAM,QAAQ,MAAM,GAAG,KAAK,OAAO,YAAY;CAE/C,IAAI,MAAM,OAAO,OAAO,gBACtB,MAAM,IAAI,UAAU,KAAK,gCAAgC;CAG3D,MAAM,eAAe,kBACnB,MAAM,aAAa,OAAO,iBAAmC,CAC/D;CAEA,IAAI,CAAC,sBAAsB,YAAY,GACrC,MAAM,IAAI,UAAU,KAAK,kEAAkE;CAG7F,OAAO;EACL;EACA,OAAO;GAAE,MAAM,MAAM;GAAM,SAAS,MAAM;EAAQ;EAClD;CACF;AACF"}
+{"version":3,"file":"resolve-variant-candidate.mjs","names":[],"sources":["../../../../../../../../../packages/core/src/http/uploads/resolve-variant-candidate.ts"],"sourcesContent":["import fs from \"node:fs/promises\";\nimport { HttpError } from \"../errors\";\nimport {\n  detectImageFormat,\n  IMAGE_SIGNATURE_BYTES,\n  isVariantSourceFormat,\n} from \"./detect-image-format\";\nimport type { ResolvedImageVariantsConfig, VariantSourceFormat } from \"./image-variant-types\";\nimport { readFileHead } from \"./read-file-head\";\nimport { resolveUploadPath, type ResolvedUploadPath } from \"./resolve-upload-path\";\n\n/**\n * A request path resolved to a usable variant source\n */\nexport type VariantCandidate = {\n  source: ResolvedUploadPath;\n  stats: { size: number; mtimeMs: number };\n  sourceFormat: VariantSourceFormat;\n};\n\n/**\n * Resolve a path to a variant source, applying the guards both the on-demand\n * route and the `generateImageVariants` ingest helper need: containment\n * (via `resolveUploadPath`), the byte-size limit, and the source format,\n * detected from magic bytes rather than the file extension.\n *\n * @returns `undefined` when the path does not resolve to a file inside the\n * storage root — the caller answers 404, the same as a missing file, so the\n * response is no existence oracle\n * @throws HttpError(413) when the source is over `images.maxSourceBytes`\n * @throws HttpError(415) when the source is not jpeg, png, webp or avif\n */\nexport async function resolveVariantCandidate(\n  wildcard: unknown,\n  storageRoot: string,\n  images: ResolvedImageVariantsConfig,\n): Promise<VariantCandidate | undefined> {\n  const source = await resolveUploadPath(wildcard, storageRoot, [images.cacheDirectory]);\n\n  if (!source) return undefined;\n\n  const stats = await fs.stat(source.absolutePath);\n\n  if (stats.size > images.maxSourceBytes) {\n    throw new HttpError(413, \"The source image is too large.\");\n  }\n\n  const sourceFormat = detectImageFormat(\n    await readFileHead(source.absolutePath, IMAGE_SIGNATURE_BYTES),\n  );\n\n  if (!isVariantSourceFormat(sourceFormat)) {\n    throw new HttpError(415, \"Variants are only available for jpeg, png, webp and avif images.\");\n  }\n\n  return {\n    source,\n    stats: { size: stats.size, mtimeMs: stats.mtimeMs },\n    sourceFormat,\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;AAgCA,eAAsB,wBACpB,UACA,aACA,QACuC;CACvC,MAAM,SAAS,MAAM,kBAAkB,UAAU,aAAa,CAAC,OAAO,cAAc,CAAC;CAErF,IAAI,CAAC,QAAQ,OAAO;CAEpB,MAAM,QAAQ,MAAM,GAAG,KAAK,OAAO,YAAY;CAE/C,IAAI,MAAM,OAAO,OAAO,gBACtB,MAAM,IAAI,UAAU,KAAK,gCAAgC;CAG3D,MAAM,eAAe,kBACnB,MAAM,aAAa,OAAO,iBAAmC,CAC/D;CAEA,IAAI,CAAC,sBAAsB,YAAY,GACrC,MAAM,IAAI,UAAU,KAAK,kEAAkE;CAG7F,OAAO;EACL;EACA,OAAO;GAAE,MAAM,MAAM;GAAM,SAAS,MAAM;EAAQ;EAClD;CACF;AACF"}

package/esm/http/uploads/single-flight.mjs

@@ -1,4 +1,4 @@
-//#region ../core/src/http/uploads/single-flight.ts
+//#region ../../packages/core/src/http/uploads/single-flight.ts
 /**
 * Runs a task once per key at a time.
 *

package/esm/http/uploads/single-flight.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"single-flight.mjs","names":[],"sources":["../../../../../../../../core/src/http/uploads/single-flight.ts"],"sourcesContent":["/**\n * Runs a task once per key at a time.\n *\n * A caller that arrives while the task for its key is still running gets the\n * same promise instead of starting a second run, so N concurrent cache misses\n * for one derivative generate it once. The entry is dropped when the task\n * settles, success or failure, so a failed run is retried by the next request.\n */\nexport class SingleFlight<T> {\n  protected readonly inflight = new Map<string, Promise<T>>();\n\n  /**\n   * Run `task` for `key`, or join the run already in flight\n   */\n  public run(key: string, task: () => Promise<T>): Promise<T> {\n    const existing = this.inflight.get(key);\n\n    if (existing) return existing;\n\n    const promise = (async () => {\n      try {\n        return await task();\n      } finally {\n        this.inflight.delete(key);\n      }\n    })();\n\n    this.inflight.set(key, promise);\n\n    return promise;\n  }\n\n  /**\n   * Number of keys currently in flight\n   */\n  public get size(): number {\n    return this.inflight.size;\n  }\n}\n"],"mappings":";;;;;;;;;AAQA,IAAa,eAAb,MAA6B;;kCACG,IAAI,IAAwB;;;;;CAK1D,AAAO,IAAI,KAAa,MAAoC;EAC1D,MAAM,WAAW,KAAK,SAAS,IAAI,GAAG;EAEtC,IAAI,UAAU,OAAO;EAErB,MAAM,WAAW,YAAY;GAC3B,IAAI;IACF,OAAO,MAAM,KAAK;GACpB,UAAU;IACR,KAAK,SAAS,OAAO,GAAG;GAC1B;EACF,EAAC,CAAE;EAEH,KAAK,SAAS,IAAI,KAAK,OAAO;EAE9B,OAAO;CACT;;;;CAKA,IAAW,OAAe;EACxB,OAAO,KAAK,SAAS;CACvB;AACF"}
+{"version":3,"file":"single-flight.mjs","names":[],"sources":["../../../../../../../../../packages/core/src/http/uploads/single-flight.ts"],"sourcesContent":["/**\n * Runs a task once per key at a time.\n *\n * A caller that arrives while the task for its key is still running gets the\n * same promise instead of starting a second run, so N concurrent cache misses\n * for one derivative generate it once. The entry is dropped when the task\n * settles, success or failure, so a failed run is retried by the next request.\n */\nexport class SingleFlight<T> {\n  protected readonly inflight = new Map<string, Promise<T>>();\n\n  /**\n   * Run `task` for `key`, or join the run already in flight\n   */\n  public run(key: string, task: () => Promise<T>): Promise<T> {\n    const existing = this.inflight.get(key);\n\n    if (existing) return existing;\n\n    const promise = (async () => {\n      try {\n        return await task();\n      } finally {\n        this.inflight.delete(key);\n      }\n    })();\n\n    this.inflight.set(key, promise);\n\n    return promise;\n  }\n\n  /**\n   * Number of keys currently in flight\n   */\n  public get size(): number {\n    return this.inflight.size;\n  }\n}\n"],"mappings":";;;;;;;;;AAQA,IAAa,eAAb,MAA6B;;kCACG,IAAI,IAAwB;;;;;CAK1D,AAAO,IAAI,KAAa,MAAoC;EAC1D,MAAM,WAAW,KAAK,SAAS,IAAI,GAAG;EAEtC,IAAI,UAAU,OAAO;EAErB,MAAM,WAAW,YAAY;GAC3B,IAAI;IACF,OAAO,MAAM,KAAK;GACpB,UAAU;IACR,KAAK,SAAS,OAAO,GAAG;GAC1B;EACF,EAAC,CAAE;EAEH,KAAK,SAAS,IAAI,KAAK,OAAO;EAE9B,OAAO;CACT;;;;CAKA,IAAW,OAAe;EACxB,OAAO,KAAK,SAAS;CACvB;AACF"}