@webiny/api-file-manager 0.0.0-unstable.e6f0dc8ca7 → 0.0.0-unstable.eb81deee7e

package/features/assetDelivery/assetTypes/image/transformImage.js

@@ -0,0 +1,146 @@
+import sharp from "sharp";
+import { WidthCollection } from "./WidthCollection.js";
+import { DEFAULT_IMAGE_QUALITY, contentTypeForFormat, formatFromContentType } from "./imageFormat.js";
+const applyOutputFormat = (pipeline, sourceContentType, options, qualityDefaults)=>{
+    const targetFormat = options.format ?? formatFromContentType(sourceContentType);
+    if (!targetFormat || !options.format && void 0 === options.quality) return {
+        pipeline,
+        contentType: sourceContentType
+    };
+    const quality = options.quality ?? qualityDefaults[targetFormat];
+    switch(targetFormat){
+        case "jpeg":
+            return {
+                pipeline: pipeline.jpeg({
+                    quality
+                }),
+                contentType: contentTypeForFormat("jpeg")
+            };
+        case "webp":
+            return {
+                pipeline: pipeline.webp({
+                    quality
+                }),
+                contentType: contentTypeForFormat("webp")
+            };
+        case "avif":
+            return {
+                pipeline: pipeline.avif({
+                    quality
+                }),
+                contentType: contentTypeForFormat("avif")
+            };
+        case "png":
+            return {
+                pipeline: pipeline.png({
+                    quality,
+                    compressionLevel: 9,
+                    adaptiveFiltering: true
+                }),
+                contentType: contentTypeForFormat("png")
+            };
+    }
+};
+const clamp01 = (n)=>Math.min(1, Math.max(0, n));
+const cropImageBuffer = async (buffer, crop)=>{
+    const image = sharp(buffer);
+    const meta = await image.metadata();
+    const w = meta.width ?? 0;
+    const h = meta.height ?? 0;
+    if (!w || !h) return buffer;
+    const left = Math.max(0, Math.min(w - 1, Math.round(clamp01(crop.left) * w)));
+    const top = Math.max(0, Math.min(h - 1, Math.round(clamp01(crop.top) * h)));
+    const width = Math.max(1, Math.min(w - left, Math.round((1 - clamp01(crop.left) - clamp01(crop.right)) * w)));
+    const height = Math.max(1, Math.min(h - top, Math.round((1 - clamp01(crop.top) - clamp01(crop.bottom)) * h)));
+    if (0 === left && 0 === top && width === w && height === h) return buffer;
+    return image.extract({
+        left,
+        top,
+        width,
+        height
+    }).toBuffer();
+};
+const cropToRect = (crop)=>{
+    const left = clamp01(crop?.left ?? 0);
+    const top = clamp01(crop?.top ?? 0);
+    return {
+        x: left,
+        y: top,
+        width: Math.max(0, 1 - left - clamp01(crop?.right ?? 0)),
+        height: Math.max(0, 1 - top - clamp01(crop?.bottom ?? 0))
+    };
+};
+const getVisibleRect = (imageWidth, imageHeight, crop, focal, aspectRatio)=>{
+    const cr = cropToRect(crop);
+    if (void 0 === aspectRatio || aspectRatio <= 0 || cr.width <= 0 || cr.height <= 0) return cr;
+    const iw = imageWidth > 0 ? imageWidth : 1;
+    const ih = imageHeight > 0 ? imageHeight : 1;
+    const cropAR = cr.width * iw / (cr.height * ih);
+    let w;
+    let h;
+    if (aspectRatio > cropAR) {
+        w = cr.width;
+        h = cr.width * iw / aspectRatio / ih;
+    } else {
+        h = cr.height;
+        w = cr.height * ih * aspectRatio / iw;
+    }
+    const fx = clamp01(focal?.x ?? 0.5);
+    const fy = clamp01(focal?.y ?? 0.5);
+    const maxX = cr.x + cr.width - w;
+    const maxY = cr.y + cr.height - h;
+    const x = Math.min(Math.max(fx - w / 2, cr.x), Math.max(cr.x, maxX));
+    const y = Math.min(Math.max(fy - h / 2, cr.y), Math.max(cr.y, maxY));
+    return {
+        x,
+        y,
+        width: w,
+        height: h
+    };
+};
+const hasFraming = (framing)=>{
+    const c = framing.crop;
+    const cropped = !!c && !(0 === c.top && 0 === c.left && 0 === c.bottom && 0 === c.right);
+    return cropped || void 0 !== framing.aspectRatio;
+};
+const extractFramedRegion = async (buffer, framing)=>{
+    if (!hasFraming(framing)) return buffer;
+    const image = sharp(buffer);
+    const meta = await image.metadata();
+    const w = meta.width ?? 0;
+    const h = meta.height ?? 0;
+    if (!w || !h) return buffer;
+    const rect = getVisibleRect(w, h, framing.crop, framing.focal, framing.aspectRatio);
+    const left = Math.max(0, Math.min(w - 1, Math.round(rect.x * w)));
+    const top = Math.max(0, Math.min(h - 1, Math.round(rect.y * h)));
+    const width = Math.max(1, Math.min(w - left, Math.round(rect.width * w)));
+    const height = Math.max(1, Math.min(h - top, Math.round(rect.height * h)));
+    if (0 === left && 0 === top && width === w && height === h) return buffer;
+    return image.extract({
+        left,
+        top,
+        width,
+        height
+    }).toBuffer();
+};
+const transformImageBuffer = async (params)=>{
+    let pipeline = sharp(params.buffer, {
+        animated: params.animated
+    }).withMetadata();
+    if (params.options.width) {
+        const width = WidthCollection.create(params.widths).getClosestOrMax(params.options.width);
+        pipeline = pipeline.resize({
+            width,
+            withoutEnlargement: true
+        });
+    }
+    const { pipeline: encoded, contentType } = applyOutputFormat(pipeline, params.sourceContentType, params.options, params.qualityDefaults ?? DEFAULT_IMAGE_QUALITY);
+    const buffer = await encoded.toBuffer();
+    return {
+        buffer,
+        contentType
+    };
+};
+export { cropImageBuffer, extractFramedRegion, getVisibleRect, hasFraming, transformImageBuffer };
+
+//# sourceMappingURL=transformImage.js.map

package/features/assetDelivery/assetTypes/image/transformImage.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"features/assetDelivery/assetTypes/image/transformImage.js","sources":["../../../../../src/features/assetDelivery/assetTypes/image/transformImage.ts"],"sourcesContent":["/**\n * The sharp-backed image pipeline. This module imports `sharp` (a native module),\n * so it must ONLY be imported by the transform strategies (the image Lambda) —\n * never from the barrel (`index.ts`) or from anything the GraphQL API handler\n * loads. See `imageFormat.ts` for the reasoning.\n */\nimport sharp from \"sharp\";\nimport type { Sharp } from \"sharp\";\nimport { WidthCollection } from \"./WidthCollection.js\";\nimport {\n    contentTypeForFormat,\n    DEFAULT_IMAGE_QUALITY,\n    formatFromContentType,\n    type ImageFormat\n} from \"./imageFormat.js\";\n\ninterface ApplyOutputFormatResult {\n    pipeline: Sharp;\n    contentType: string;\n}\n\n/**\n * Apply the target format + quality to a sharp pipeline. When no `format` is given,\n * re-encodes in the source format only if a `quality` was requested; otherwise the\n * pipeline is left untouched.\n */\nconst applyOutputFormat = (\n    pipeline: Sharp,\n    sourceContentType: string,\n    options: { format?: ImageFormat; quality?: number },\n    qualityDefaults: Record<ImageFormat, number>\n): ApplyOutputFormatResult => {\n    const targetFormat = options.format ?? formatFromContentType(sourceContentType);\n\n    // Nothing to change: unknown source format, or neither a conversion nor a quality.\n    if (!targetFormat || (!options.format && options.quality === undefined)) {\n        return { pipeline, contentType: sourceContentType };\n    }\n\n    const quality = options.quality ?? qualityDefaults[targetFormat];\n\n    switch (targetFormat) {\n        case \"jpeg\":\n            return {\n                pipeline: pipeline.jpeg({ quality }),\n                contentType: contentTypeForFormat(\"jpeg\")\n            };\n        case \"webp\":\n            return {\n                pipeline: pipeline.webp({ quality }),\n                contentType: contentTypeForFormat(\"webp\")\n            };\n        case \"avif\":\n            return {\n                pipeline: pipeline.avif({ quality }),\n                contentType: contentTypeForFormat(\"avif\")\n            };\n        case \"png\":\n            return {\n                pipeline: pipeline.png({ quality, compressionLevel: 9, adaptiveFiltering: true }),\n                contentType: contentTypeForFormat(\"png\")\n            };\n    }\n};\n\nexport interface TransformImageParams {\n    buffer: Buffer;\n    animated: boolean;\n    sourceContentType: string;\n    widths: number[];\n    options: { width?: number; format?: ImageFormat; quality?: number };\n    qualityDefaults?: Record<ImageFormat, number>;\n}\n\nexport interface TransformImageResult {\n    buffer: Buffer;\n    contentType: string;\n}\n\n/**\n * Single sharp pipeline shared by the S3 and local transform strategies: optional\n * resize (snapped to the configured width ladder) → optional format conversion +\n * quality. Returns the resulting buffer and its content type.\n */\ninterface CropInsets {\n    top: number;\n    left: number;\n    bottom: number;\n    right: number;\n}\n\nconst clamp01 = (n: number) => Math.min(1, Math.max(0, n));\n\n/**\n * Extract the crop region (edge insets, 0..1) from an image buffer. Returns the\n * original buffer unchanged if the crop is empty/full or the dimensions are unknown.\n */\nexport const cropImageBuffer = async (buffer: Buffer, crop: CropInsets): Promise<Buffer> => {\n    const image = sharp(buffer);\n    const meta = await image.metadata();\n    const w = meta.width ?? 0;\n    const h = meta.height ?? 0;\n    if (!w || !h) {\n        return buffer;\n    }\n\n    const left = Math.max(0, Math.min(w - 1, Math.round(clamp01(crop.left) * w)));\n    const top = Math.max(0, Math.min(h - 1, Math.round(clamp01(crop.top) * h)));\n    const width = Math.max(\n        1,\n        Math.min(w - left, Math.round((1 - clamp01(crop.left) - clamp01(crop.right)) * w))\n    );\n    const height = Math.max(\n        1,\n        Math.min(h - top, Math.round((1 - clamp01(crop.top) - clamp01(crop.bottom)) * h))\n    );\n\n    if (left === 0 && top === 0 && width === w && height === h) {\n        return buffer;\n    }\n\n    return image.extract({ left, top, width, height }).toBuffer();\n};\n\ninterface NormalizedRect {\n    x: number;\n    y: number;\n    width: number;\n    height: number;\n}\n\nconst cropToRect = (crop?: CropInsets): NormalizedRect => {\n    const left = clamp01(crop?.left ?? 0);\n    const top = clamp01(crop?.top ?? 0);\n    return {\n        x: left,\n        y: top,\n        width: Math.max(0, 1 - left - clamp01(crop?.right ?? 0)),\n        height: Math.max(0, 1 - top - clamp01(crop?.bottom ?? 0))\n    };\n};\n\n/**\n * The visible region (normalized 0–1) for the given framing. The largest rectangle\n * of `aspectRatio` that fits inside the crop, centered on the focal point.\n */\nexport const getVisibleRect = (\n    imageWidth: number,\n    imageHeight: number,\n    crop?: CropInsets,\n    focal?: { x: number; y: number },\n    aspectRatio?: number\n): NormalizedRect => {\n    const cr = cropToRect(crop);\n    if (aspectRatio === undefined || aspectRatio <= 0 || cr.width <= 0 || cr.height <= 0) {\n        return cr;\n    }\n    const iw = imageWidth > 0 ? imageWidth : 1;\n    const ih = imageHeight > 0 ? imageHeight : 1;\n    const cropAR = (cr.width * iw) / (cr.height * ih);\n\n    let w: number;\n    let h: number;\n    if (aspectRatio > cropAR) {\n        w = cr.width;\n        h = (cr.width * iw) / aspectRatio / ih;\n    } else {\n        h = cr.height;\n        w = (cr.height * ih * aspectRatio) / iw;\n    }\n\n    const fx = clamp01(focal?.x ?? 0.5);\n    const fy = clamp01(focal?.y ?? 0.5);\n    const maxX = cr.x + cr.width - w;\n    const maxY = cr.y + cr.height - h;\n    const x = Math.min(Math.max(fx - w / 2, cr.x), Math.max(cr.x, maxX));\n    const y = Math.min(Math.max(fy - h / 2, cr.y), Math.max(cr.y, maxY));\n    return { x, y, width: w, height: h };\n};\n\nexport interface Framing {\n    crop?: CropInsets;\n    focal?: { x: number; y: number };\n    aspectRatio?: number;\n}\n\nexport const hasFraming = (framing: Framing): boolean => {\n    const c = framing.crop;\n    const cropped = !!c && !(c.top === 0 && c.left === 0 && c.bottom === 0 && c.right === 0);\n    return cropped || framing.aspectRatio !== undefined;\n};\n\nexport const extractFramedRegion = async (buffer: Buffer, framing: Framing): Promise<Buffer> => {\n    if (!hasFraming(framing)) {\n        return buffer;\n    }\n    const image = sharp(buffer);\n    const meta = await image.metadata();\n    const w = meta.width ?? 0;\n    const h = meta.height ?? 0;\n    if (!w || !h) {\n        return buffer;\n    }\n\n    const rect = getVisibleRect(w, h, framing.crop, framing.focal, framing.aspectRatio);\n    const left = Math.max(0, Math.min(w - 1, Math.round(rect.x * w)));\n    const top = Math.max(0, Math.min(h - 1, Math.round(rect.y * h)));\n    const width = Math.max(1, Math.min(w - left, Math.round(rect.width * w)));\n    const height = Math.max(1, Math.min(h - top, Math.round(rect.height * h)));\n\n    if (left === 0 && top === 0 && width === w && height === h) {\n        return buffer;\n    }\n    return image.extract({ left, top, width, height }).toBuffer();\n};\n\nexport const transformImageBuffer = async (\n    params: TransformImageParams\n): Promise<TransformImageResult> => {\n    let pipeline = sharp(params.buffer, { animated: params.animated }).withMetadata();\n\n    if (params.options.width) {\n        const width = WidthCollection.create(params.widths).getClosestOrMax(params.options.width);\n        pipeline = pipeline.resize({ width, withoutEnlargement: true });\n    }\n\n    const { pipeline: encoded, contentType } = applyOutputFormat(\n        pipeline,\n        params.sourceContentType,\n        params.options,\n        params.qualityDefaults ?? DEFAULT_IMAGE_QUALITY\n    );\n\n    const buffer = await encoded.toBuffer();\n\n    return { buffer, contentType };\n};\n"],"names":["applyOutputFormat","pipeline","sourceContentType","options","qualityDefaults","targetFormat","formatFromContentType","undefined","quality","contentTypeForFormat","clamp01","n","Math","cropImageBuffer","buffer","crop","image","sharp","meta","w","h","left","top","width","height","cropToRect","getVisibleRect","imageWidth","imageHeight","focal","aspectRatio","cr","iw","ih","cropAR","fx","fy","maxX","maxY","x","y","hasFraming","framing","c","cropped","extractFramedRegion","rect","transformImageBuffer","params","WidthCollection","encoded","contentType","DEFAULT_IMAGE_QUALITY"],"mappings":";;;AA0BA,MAAMA,oBAAoB,CACtBC,UACAC,mBACAC,SACAC;IAEA,MAAMC,eAAeF,QAAQ,MAAM,IAAIG,sBAAsBJ;IAG7D,IAAI,CAACG,gBAAiB,CAACF,QAAQ,MAAM,IAAIA,AAAoBI,WAApBJ,QAAQ,OAAO,EACpD,OAAO;QAAEF;QAAU,aAAaC;IAAkB;IAGtD,MAAMM,UAAUL,QAAQ,OAAO,IAAIC,eAAe,CAACC,aAAa;IAEhE,OAAQA;QACJ,KAAK;YACD,OAAO;gBACH,UAAUJ,SAAS,IAAI,CAAC;oBAAEO;gBAAQ;gBAClC,aAAaC,qBAAqB;YACtC;QACJ,KAAK;YACD,OAAO;gBACH,UAAUR,SAAS,IAAI,CAAC;oBAAEO;gBAAQ;gBAClC,aAAaC,qBAAqB;YACtC;QACJ,KAAK;YACD,OAAO;gBACH,UAAUR,SAAS,IAAI,CAAC;oBAAEO;gBAAQ;gBAClC,aAAaC,qBAAqB;YACtC;QACJ,KAAK;YACD,OAAO;gBACH,UAAUR,SAAS,GAAG,CAAC;oBAAEO;oBAAS,kBAAkB;oBAAG,mBAAmB;gBAAK;gBAC/E,aAAaC,qBAAqB;YACtC;IACR;AACJ;AA4BA,MAAMC,UAAU,CAACC,IAAcC,KAAK,GAAG,CAAC,GAAGA,KAAK,GAAG,CAAC,GAAGD;AAMhD,MAAME,kBAAkB,OAAOC,QAAgBC;IAClD,MAAMC,QAAQC,MAAMH;IACpB,MAAMI,OAAO,MAAMF,MAAM,QAAQ;IACjC,MAAMG,IAAID,KAAK,KAAK,IAAI;IACxB,MAAME,IAAIF,KAAK,MAAM,IAAI;IACzB,IAAI,CAACC,KAAK,CAACC,GACP,OAAON;IAGX,MAAMO,OAAOT,KAAK,GAAG,CAAC,GAAGA,KAAK,GAAG,CAACO,IAAI,GAAGP,KAAK,KAAK,CAACF,QAAQK,KAAK,IAAI,IAAII;IACzE,MAAMG,MAAMV,KAAK,GAAG,CAAC,GAAGA,KAAK,GAAG,CAACQ,IAAI,GAAGR,KAAK,KAAK,CAACF,QAAQK,KAAK,GAAG,IAAIK;IACvE,MAAMG,QAAQX,KAAK,GAAG,CAClB,GACAA,KAAK,GAAG,CAACO,IAAIE,MAAMT,KAAK,KAAK,CAAE,KAAIF,QAAQK,KAAK,IAAI,IAAIL,QAAQK,KAAK,KAAK,KAAKI;IAEnF,MAAMK,SAASZ,KAAK,GAAG,CACnB,GACAA,KAAK,GAAG,CAACQ,IAAIE,KAAKV,KAAK,KAAK,CAAE,KAAIF,QAAQK,KAAK,GAAG,IAAIL,QAAQK,KAAK,MAAM,KAAKK;IAGlF,IAAIC,AAAS,MAATA,QAAcC,AAAQ,MAARA,OAAaC,UAAUJ,KAAKK,WAAWJ,GACrD,OAAON;IAGX,OAAOE,MAAM,OAAO,CAAC;QAAEK;QAAMC;QAAKC;QAAOC;IAAO,GAAG,QAAQ;AAC/D;AASA,MAAMC,aAAa,CAACV;IAChB,MAAMM,OAAOX,QAAQK,MAAM,QAAQ;IACnC,MAAMO,MAAMZ,QAAQK,MAAM,OAAO;IACjC,OAAO;QACH,GAAGM;QACH,GAAGC;QACH,OAAOV,KAAK,GAAG,CAAC,GAAG,IAAIS,OAAOX,QAAQK,MAAM,SAAS;QACrD,QAAQH,KAAK,GAAG,CAAC,GAAG,IAAIU,MAAMZ,QAAQK,MAAM,UAAU;IAC1D;AACJ;AAMO,MAAMW,iBAAiB,CAC1BC,YACAC,aACAb,MACAc,OACAC;IAEA,MAAMC,KAAKN,WAAWV;IACtB,IAAIe,AAAgBvB,WAAhBuB,eAA6BA,eAAe,KAAKC,GAAG,KAAK,IAAI,KAAKA,GAAG,MAAM,IAAI,GAC/E,OAAOA;IAEX,MAAMC,KAAKL,aAAa,IAAIA,aAAa;IACzC,MAAMM,KAAKL,cAAc,IAAIA,cAAc;IAC3C,MAAMM,SAAUH,GAAG,KAAK,GAAGC,KAAOD,CAAAA,GAAG,MAAM,GAAGE,EAAC;IAE/C,IAAId;IACJ,IAAIC;IACJ,IAAIU,cAAcI,QAAQ;QACtBf,IAAIY,GAAG,KAAK;QACZX,IAAKW,GAAG,KAAK,GAAGC,KAAMF,cAAcG;IACxC,OAAO;QACHb,IAAIW,GAAG,MAAM;QACbZ,IAAKY,GAAG,MAAM,GAAGE,KAAKH,cAAeE;IACzC;IAEA,MAAMG,KAAKzB,QAAQmB,OAAO,KAAK;IAC/B,MAAMO,KAAK1B,QAAQmB,OAAO,KAAK;IAC/B,MAAMQ,OAAON,GAAG,CAAC,GAAGA,GAAG,KAAK,GAAGZ;IAC/B,MAAMmB,OAAOP,GAAG,CAAC,GAAGA,GAAG,MAAM,GAAGX;IAChC,MAAMmB,IAAI3B,KAAK,GAAG,CAACA,KAAK,GAAG,CAACuB,KAAKhB,IAAI,GAAGY,GAAG,CAAC,GAAGnB,KAAK,GAAG,CAACmB,GAAG,CAAC,EAAEM;IAC9D,MAAMG,IAAI5B,KAAK,GAAG,CAACA,KAAK,GAAG,CAACwB,KAAKhB,IAAI,GAAGW,GAAG,CAAC,GAAGnB,KAAK,GAAG,CAACmB,GAAG,CAAC,EAAEO;IAC9D,OAAO;QAAEC;QAAGC;QAAG,OAAOrB;QAAG,QAAQC;IAAE;AACvC;AAQO,MAAMqB,aAAa,CAACC;IACvB,MAAMC,IAAID,QAAQ,IAAI;IACtB,MAAME,UAAU,CAAC,CAACD,KAAK,CAAEA,CAAAA,AAAU,MAAVA,EAAE,GAAG,IAAUA,AAAW,MAAXA,EAAE,IAAI,IAAUA,AAAa,MAAbA,EAAE,MAAM,IAAUA,AAAY,MAAZA,EAAE,KAAK,AAAK;IACtF,OAAOC,WAAWF,AAAwBnC,WAAxBmC,QAAQ,WAAW;AACzC;AAEO,MAAMG,sBAAsB,OAAO/B,QAAgB4B;IACtD,IAAI,CAACD,WAAWC,UACZ,OAAO5B;IAEX,MAAME,QAAQC,MAAMH;IACpB,MAAMI,OAAO,MAAMF,MAAM,QAAQ;IACjC,MAAMG,IAAID,KAAK,KAAK,IAAI;IACxB,MAAME,IAAIF,KAAK,MAAM,IAAI;IACzB,IAAI,CAACC,KAAK,CAACC,GACP,OAAON;IAGX,MAAMgC,OAAOpB,eAAeP,GAAGC,GAAGsB,QAAQ,IAAI,EAAEA,QAAQ,KAAK,EAAEA,QAAQ,WAAW;IAClF,MAAMrB,OAAOT,KAAK,GAAG,CAAC,GAAGA,KAAK,GAAG,CAACO,IAAI,GAAGP,KAAK,KAAK,CAACkC,KAAK,CAAC,GAAG3B;IAC7D,MAAMG,MAAMV,KAAK,GAAG,CAAC,GAAGA,KAAK,GAAG,CAACQ,IAAI,GAAGR,KAAK,KAAK,CAACkC,KAAK,CAAC,GAAG1B;IAC5D,MAAMG,QAAQX,KAAK,GAAG,CAAC,GAAGA,KAAK,GAAG,CAACO,IAAIE,MAAMT,KAAK,KAAK,CAACkC,KAAK,KAAK,GAAG3B;IACrE,MAAMK,SAASZ,KAAK,GAAG,CAAC,GAAGA,KAAK,GAAG,CAACQ,IAAIE,KAAKV,KAAK,KAAK,CAACkC,KAAK,MAAM,GAAG1B;IAEtE,IAAIC,AAAS,MAATA,QAAcC,AAAQ,MAARA,OAAaC,UAAUJ,KAAKK,WAAWJ,GACrD,OAAON;IAEX,OAAOE,MAAM,OAAO,CAAC;QAAEK;QAAMC;QAAKC;QAAOC;IAAO,GAAG,QAAQ;AAC/D;AAEO,MAAMuB,uBAAuB,OAChCC;IAEA,IAAI/C,WAAWgB,MAAM+B,OAAO,MAAM,EAAE;QAAE,UAAUA,OAAO,QAAQ;IAAC,GAAG,YAAY;IAE/E,IAAIA,OAAO,OAAO,CAAC,KAAK,EAAE;QACtB,MAAMzB,QAAQ0B,gBAAgB,MAAM,CAACD,OAAO,MAAM,EAAE,eAAe,CAACA,OAAO,OAAO,CAAC,KAAK;QACxF/C,WAAWA,SAAS,MAAM,CAAC;YAAEsB;YAAO,oBAAoB;QAAK;IACjE;IAEA,MAAM,EAAE,UAAU2B,OAAO,EAAEC,WAAW,EAAE,GAAGnD,kBACvCC,UACA+C,OAAO,iBAAiB,EACxBA,OAAO,OAAO,EACdA,OAAO,eAAe,IAAII;IAG9B,MAAMtC,SAAS,MAAMoC,QAAQ,QAAQ;IAErC,OAAO;QAAEpC;QAAQqC;IAAY;AACjC"}

package/features/assetDelivery/assetTypes/image/utils.d.ts

@@ -0,0 +1,26 @@
+import type { Framing } from "./imageTypes.js";
+declare const SUPPORTED_TRANSFORMABLE_IMAGES: string[];
+declare const getOptimizedImageKeyPrefix: (key: string, cropSignature?: string) => string;
+declare const getOptimizedTransformedImageKeyPrefix: (key: string, transformationsHash: string, cropSignature?: string) => string;
+interface Crop {
+    top: number;
+    left: number;
+    bottom: number;
+    right: number;
+}
+/** Short, stable signature of a crop; `undefined` for no/empty crop (so keys are unchanged). */
+declare const getCropSignature: (crop?: Crop) => string | undefined;
+interface GetImageKeyParams {
+    key: string;
+    transformations?: any;
+    cropSignature?: string;
+}
+declare const getImageKey: ({ key, transformations, cropSignature }: GetImageKeyParams) => string;
+/**
+ * Signature for a full framing (crop + focal + aspect ratio) used to namespace
+ * cached derivatives. `undefined` when the framing is a no-op. A crop-only framing
+ * intentionally hashes to the same value as `getCropSignature`, so existing
+ * asset-level-crop derivatives keep their cache keys (backward compatible).
+ */
+declare const getFramingSignature: (framing: Framing) => string | undefined;
+export { SUPPORTED_TRANSFORMABLE_IMAGES, getImageKey, getCropSignature, getFramingSignature, getOptimizedImageKeyPrefix, getOptimizedTransformedImageKeyPrefix };

package/features/assetDelivery/assetTypes/image/utils.js

@@ -0,0 +1,47 @@
+import object_hash from "object-hash";
+import node_path from "node:path";
+const SUPPORTED_TRANSFORMABLE_IMAGES = [
+    "jpg",
+    "jpeg",
+    "png",
+    "webp"
+];
+const parseKey = (key)=>{
+    const filename = node_path.basename(key);
+    const dirname = node_path.dirname(key);
+    return {
+        filename,
+        dirname
+    };
+};
+const cropSegment = (cropSignature)=>cropSignature ? `${cropSignature}/` : "";
+const getOptimizedImageKeyPrefix = (key, cropSignature)=>{
+    const { filename, dirname } = parseKey(key);
+    return `${dirname}/optimized/${cropSegment(cropSignature)}${filename}`;
+};
+const getOptimizedTransformedImageKeyPrefix = (key, transformationsHash, cropSignature)=>{
+    const { filename, dirname } = parseKey(key);
+    return `${dirname}/optimized/${cropSegment(cropSignature)}${transformationsHash}-${filename}`;
+};
+const getCropSignature = (crop)=>{
+    if (!crop || 0 === crop.top && 0 === crop.left && 0 === crop.bottom && 0 === crop.right) return;
+    return object_hash(crop).slice(0, 16);
+};
+const getImageKey = ({ key, transformations, cropSignature })=>{
+    if (!transformations) return getOptimizedImageKeyPrefix(key, cropSignature);
+    return getOptimizedTransformedImageKeyPrefix(key, object_hash(transformations), cropSignature);
+};
+const getFramingSignature = (framing)=>{
+    const { crop, focal, aspectRatio } = framing;
+    const cropped = !!crop && !(0 === crop.top && 0 === crop.left && 0 === crop.bottom && 0 === crop.right);
+    if (!cropped && void 0 === aspectRatio) return;
+    if (cropped && void 0 === focal && void 0 === aspectRatio) return object_hash(crop).slice(0, 16);
+    return object_hash({
+        crop: cropped ? crop : void 0,
+        focal,
+        aspectRatio
+    }).slice(0, 16);
+};
+export { SUPPORTED_TRANSFORMABLE_IMAGES, getCropSignature, getFramingSignature, getImageKey, getOptimizedImageKeyPrefix, getOptimizedTransformedImageKeyPrefix };
+
+//# sourceMappingURL=utils.js.map

package/features/assetDelivery/assetTypes/image/utils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"features/assetDelivery/assetTypes/image/utils.js","sources":["../../../../../src/features/assetDelivery/assetTypes/image/utils.ts"],"sourcesContent":["import objectHash from \"object-hash\";\nimport path from \"node:path\";\nimport type { Framing } from \"./imageTypes.js\";\n\nconst SUPPORTED_TRANSFORMABLE_IMAGES = [\"jpg\", \"jpeg\", \"png\", \"webp\"];\n\nconst parseKey = (key: string) => {\n    const filename = path.basename(key);\n    const dirname = path.dirname(key);\n\n    return { filename, dirname };\n};\n\n// An optional per-file crop signature segment. Keeps un-cropped keys unchanged\n// (backward compatible) while giving cropped files their own cache namespace, so\n// changing a file's crop invalidates its derivatives.\nconst cropSegment = (cropSignature?: string): string => {\n    return cropSignature ? `${cropSignature}/` : \"\";\n};\n\nconst getOptimizedImageKeyPrefix = (key: string, cropSignature?: string): string => {\n    const { filename, dirname } = parseKey(key);\n\n    return `${dirname}/optimized/${cropSegment(cropSignature)}${filename}`;\n};\n\nconst getOptimizedTransformedImageKeyPrefix = (\n    key: string,\n    transformationsHash: string,\n    cropSignature?: string\n): string => {\n    const { filename, dirname } = parseKey(key);\n\n    return `${dirname}/optimized/${cropSegment(cropSignature)}${transformationsHash}-${filename}`;\n};\n\ninterface Crop {\n    top: number;\n    left: number;\n    bottom: number;\n    right: number;\n}\n\n/** Short, stable signature of a crop; `undefined` for no/empty crop (so keys are unchanged). */\nconst getCropSignature = (crop?: Crop): string | undefined => {\n    if (!crop || (crop.top === 0 && crop.left === 0 && crop.bottom === 0 && crop.right === 0)) {\n        return undefined;\n    }\n    return objectHash(crop).slice(0, 16);\n};\n\ninterface GetImageKeyParams {\n    key: string;\n    transformations?: any;\n    cropSignature?: string;\n}\n\nconst getImageKey = ({ key, transformations, cropSignature }: GetImageKeyParams): string => {\n    if (!transformations) {\n        return getOptimizedImageKeyPrefix(key, cropSignature);\n    }\n\n    return getOptimizedTransformedImageKeyPrefix(key, objectHash(transformations), cropSignature);\n};\n\n/**\n * Signature for a full framing (crop + focal + aspect ratio) used to namespace\n * cached derivatives. `undefined` when the framing is a no-op. A crop-only framing\n * intentionally hashes to the same value as `getCropSignature`, so existing\n * asset-level-crop derivatives keep their cache keys (backward compatible).\n */\nconst getFramingSignature = (framing: Framing): string | undefined => {\n    const { crop, focal, aspectRatio } = framing;\n    const cropped =\n        !!crop && !(crop.top === 0 && crop.left === 0 && crop.bottom === 0 && crop.right === 0);\n\n    if (!cropped && aspectRatio === undefined) {\n        return undefined;\n    }\n    if (cropped && focal === undefined && aspectRatio === undefined) {\n        return objectHash(crop).slice(0, 16);\n    }\n    return objectHash({ crop: cropped ? crop : undefined, focal, aspectRatio }).slice(0, 16);\n};\n\nexport {\n    SUPPORTED_TRANSFORMABLE_IMAGES,\n    getImageKey,\n    getCropSignature,\n    getFramingSignature,\n    getOptimizedImageKeyPrefix,\n    getOptimizedTransformedImageKeyPrefix\n};\n"],"names":["SUPPORTED_TRANSFORMABLE_IMAGES","parseKey","key","filename","path","dirname","cropSegment","cropSignature","getOptimizedImageKeyPrefix","getOptimizedTransformedImageKeyPrefix","transformationsHash","getCropSignature","crop","objectHash","getImageKey","transformations","getFramingSignature","framing","focal","aspectRatio","cropped","undefined"],"mappings":";;AAIA,MAAMA,iCAAiC;IAAC;IAAO;IAAQ;IAAO;CAAO;AAErE,MAAMC,WAAW,CAACC;IACd,MAAMC,WAAWC,UAAAA,QAAa,CAACF;IAC/B,MAAMG,UAAUD,UAAAA,OAAY,CAACF;IAE7B,OAAO;QAAEC;QAAUE;IAAQ;AAC/B;AAKA,MAAMC,cAAc,CAACC,gBACVA,gBAAgB,GAAGA,cAAc,CAAC,CAAC,GAAG;AAGjD,MAAMC,6BAA6B,CAACN,KAAaK;IAC7C,MAAM,EAAEJ,QAAQ,EAAEE,OAAO,EAAE,GAAGJ,SAASC;IAEvC,OAAO,GAAGG,QAAQ,WAAW,EAAEC,YAAYC,iBAAiBJ,UAAU;AAC1E;AAEA,MAAMM,wCAAwC,CAC1CP,KACAQ,qBACAH;IAEA,MAAM,EAAEJ,QAAQ,EAAEE,OAAO,EAAE,GAAGJ,SAASC;IAEvC,OAAO,GAAGG,QAAQ,WAAW,EAAEC,YAAYC,iBAAiBG,oBAAoB,CAAC,EAAEP,UAAU;AACjG;AAUA,MAAMQ,mBAAmB,CAACC;IACtB,IAAI,CAACA,QAASA,AAAa,MAAbA,KAAK,GAAG,IAAUA,AAAc,MAAdA,KAAK,IAAI,IAAUA,AAAgB,MAAhBA,KAAK,MAAM,IAAUA,AAAe,MAAfA,KAAK,KAAK,EAC9E;IAEJ,OAAOC,YAAWD,MAAM,KAAK,CAAC,GAAG;AACrC;AAQA,MAAME,cAAc,CAAC,EAAEZ,GAAG,EAAEa,eAAe,EAAER,aAAa,EAAqB;IAC3E,IAAI,CAACQ,iBACD,OAAOP,2BAA2BN,KAAKK;IAG3C,OAAOE,sCAAsCP,KAAKW,YAAWE,kBAAkBR;AACnF;AAQA,MAAMS,sBAAsB,CAACC;IACzB,MAAM,EAAEL,IAAI,EAAEM,KAAK,EAAEC,WAAW,EAAE,GAAGF;IACrC,MAAMG,UACF,CAAC,CAACR,QAAQ,CAAEA,CAAAA,AAAa,MAAbA,KAAK,GAAG,IAAUA,AAAc,MAAdA,KAAK,IAAI,IAAUA,AAAgB,MAAhBA,KAAK,MAAM,IAAUA,AAAe,MAAfA,KAAK,KAAK,AAAK;IAEzF,IAAI,CAACQ,WAAWD,AAAgBE,WAAhBF,aACZ;IAEJ,IAAIC,WAAWF,AAAUG,WAAVH,SAAuBC,AAAgBE,WAAhBF,aAClC,OAAON,YAAWD,MAAM,KAAK,CAAC,GAAG;IAErC,OAAOC,YAAW;QAAE,MAAMO,UAAUR,OAAOS;QAAWH;QAAOC;IAAY,GAAG,KAAK,CAAC,GAAG;AACzF"}

package/features/assetDelivery/feature.d.ts

@@ -0,0 +1,4 @@
+export declare const AssetDeliveryFeature: {
+    name: string;
+    register(container: import("@webiny/di").Container): void;
+};

package/features/assetDelivery/feature.js

@@ -0,0 +1,35 @@
+import { createFeature } from "@webiny/feature/api";
+import { FeatureFlags } from "@webiny/api-core/features/featureFlags/abstractions.js";
+import { AssetProcessor } from "./abstractions.js";
+import { FilesAssetRequestResolverImpl } from "./FilesAssetRequestResolver.js";
+import { NullAssetResolverImpl } from "./NullAssetResolver.js";
+import { NullAssetOutputStrategyImpl } from "./NullAssetOutputStrategy.js";
+import { AssetFactory } from "./Asset/Asset.js";
+import { ObjectKey } from "./ObjectKey/ObjectKey.js";
+import { StreamAssetReply } from "./StreamAssetReply/StreamAssetReply.js";
+import { TransformationAssetProcessor } from "./transformation/TransformationAssetProcessor.js";
+import { ImageAssetType } from "./assetTypes/image/ImageAssetType.js";
+import { PrivateFileAssetRequestResolverDecorator } from "./privateFiles/PrivateFileAssetRequestResolver.js";
+import { PrivateAuthenticatedAuthorizerImpl } from "./privateFiles/PrivateAuthenticatedAuthorizer.js";
+import { PrivateFilesAssetProcessorDecorator } from "./privateFiles/PrivateFilesAssetProcessor.js";
+const AssetDeliveryFeature = createFeature({
+    name: "AssetDelivery",
+    register (container) {
+        container.register(FilesAssetRequestResolverImpl);
+        container.register(NullAssetResolverImpl);
+        container.register(NullAssetOutputStrategyImpl);
+        container.register(AssetFactory).inSingletonScope();
+        container.register(ObjectKey).inSingletonScope();
+        container.register(StreamAssetReply).inSingletonScope();
+        container.register(ImageAssetType);
+        container.registerInstance(AssetProcessor, new TransformationAssetProcessor(container));
+        container.registerDecorator(PrivateFileAssetRequestResolverDecorator);
+        if (container.resolve(FeatureFlags).get().isEnabled("advancedAccessControlLayer.privateFiles")) {
+            container.register(PrivateAuthenticatedAuthorizerImpl);
+            container.registerDecorator(PrivateFilesAssetProcessorDecorator);
+        }
+    }
+});
+export { AssetDeliveryFeature };
+
+//# sourceMappingURL=feature.js.map

package/features/assetDelivery/feature.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"features/assetDelivery/feature.js","sources":["../../../src/features/assetDelivery/feature.ts"],"sourcesContent":["import { createFeature } from \"@webiny/feature/api\";\nimport { FeatureFlags } from \"@webiny/api-core/features/featureFlags/abstractions.js\";\nimport { AssetProcessor } from \"./abstractions.js\";\nimport { FilesAssetRequestResolverImpl } from \"./FilesAssetRequestResolver.js\";\nimport { NullAssetResolverImpl } from \"./NullAssetResolver.js\";\nimport { NullAssetOutputStrategyImpl } from \"./NullAssetOutputStrategy.js\";\nimport { AssetFactory } from \"./Asset/Asset.js\";\nimport { ObjectKey } from \"./ObjectKey/ObjectKey.js\";\nimport { StreamAssetReply } from \"./StreamAssetReply/StreamAssetReply.js\";\nimport { TransformationAssetProcessor } from \"./transformation/TransformationAssetProcessor.js\";\nimport { ImageAssetType } from \"./assetTypes/image/ImageAssetType.js\";\nimport { PrivateFileAssetRequestResolverDecorator } from \"./privateFiles/PrivateFileAssetRequestResolver.js\";\nimport { PrivateAuthenticatedAuthorizerImpl } from \"./privateFiles/PrivateAuthenticatedAuthorizer.js\";\nimport { PrivateFilesAssetProcessorDecorator } from \"./privateFiles/PrivateFilesAssetProcessor.js\";\n\nexport const AssetDeliveryFeature = createFeature({\n    name: \"AssetDelivery\",\n    register(container) {\n        container.register(FilesAssetRequestResolverImpl);\n        container.register(NullAssetResolverImpl);\n        container.register(NullAssetOutputStrategyImpl);\n        container.register(AssetFactory).inSingletonScope();\n        container.register(ObjectKey).inSingletonScope();\n        container.register(StreamAssetReply).inSingletonScope();\n        container.register(ImageAssetType);\n        container.registerInstance(AssetProcessor, new TransformationAssetProcessor(container));\n\n        container.registerDecorator(PrivateFileAssetRequestResolverDecorator);\n\n        // Register-time gate on the effective feature flags (userFlag && live WCP license). Valid at\n        // register() time because the license is refreshed PRE-register (WcpLicenseLoader.load in\n        // registerApiRequestStack) and FeatureFlags reads that process cache — and it re-evaluates per\n        // request since the child re-registers, so a license change takes effect on the next request.\n        if (\n            container\n                .resolve(FeatureFlags)\n                .get()\n                .isEnabled(\"advancedAccessControlLayer.privateFiles\")\n        ) {\n            container.register(PrivateAuthenticatedAuthorizerImpl);\n            container.registerDecorator(PrivateFilesAssetProcessorDecorator);\n        }\n    }\n});\n"],"names":["AssetDeliveryFeature","createFeature","container","FilesAssetRequestResolverImpl","NullAssetResolverImpl","NullAssetOutputStrategyImpl","AssetFactory","ObjectKey","StreamAssetReply","ImageAssetType","AssetProcessor","TransformationAssetProcessor","PrivateFileAssetRequestResolverDecorator","FeatureFlags","PrivateAuthenticatedAuthorizerImpl","PrivateFilesAssetProcessorDecorator"],"mappings":";;;;;;;;;;;;;;AAeO,MAAMA,uBAAuBC,cAAc;IAC9C,MAAM;IACN,UAASC,SAAS;QACdA,UAAU,QAAQ,CAACC;QACnBD,UAAU,QAAQ,CAACE;QACnBF,UAAU,QAAQ,CAACG;QACnBH,UAAU,QAAQ,CAACI,cAAc,gBAAgB;QACjDJ,UAAU,QAAQ,CAACK,WAAW,gBAAgB;QAC9CL,UAAU,QAAQ,CAACM,kBAAkB,gBAAgB;QACrDN,UAAU,QAAQ,CAACO;QACnBP,UAAU,gBAAgB,CAACQ,gBAAgB,IAAIC,6BAA6BT;QAE5EA,UAAU,iBAAiB,CAACU;QAM5B,IACIV,UACK,OAAO,CAACW,cACR,GAAG,GACH,SAAS,CAAC,4CACjB;YACEX,UAAU,QAAQ,CAACY;YACnBZ,UAAU,iBAAiB,CAACa;QAChC;IACJ;AACJ"}

package/features/assetDelivery/privateFiles/NotAuthorizedAssetReply.d.ts

@@ -0,0 +1,4 @@
+import { AssetReply } from "../../../delivery/AssetDelivery/abstractions/AssetReply.js";
+export declare class NotAuthorizedAssetReply extends AssetReply {
+    constructor();
+}

package/features/assetDelivery/privateFiles/NotAuthorizedAssetReply.js

@@ -0,0 +1,20 @@
+import { ResponseHeaders } from "@webiny/handler";
+import { AssetReply } from "../../../delivery/AssetDelivery/abstractions/AssetReply.js";
+class NotAuthorizedAssetReply extends AssetReply {
+    constructor(){
+        super({
+            code: 403,
+            headers: ResponseHeaders.create({
+                "cache-control": "no-store",
+                "content-type": "application/json; charset=utf-8"
+            }),
+            body: ()=>({
+                    error: "Not authorized!",
+                    code: "NOT_AUTHORIZED"
+                })
+        });
+    }
+}
+export { NotAuthorizedAssetReply };
+
+//# sourceMappingURL=NotAuthorizedAssetReply.js.map

package/features/assetDelivery/privateFiles/NotAuthorizedAssetReply.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"features/assetDelivery/privateFiles/NotAuthorizedAssetReply.js","sources":["../../../../src/features/assetDelivery/privateFiles/NotAuthorizedAssetReply.ts"],"sourcesContent":["import { ResponseHeaders } from \"@webiny/handler\";\nimport { AssetReply } from \"~/delivery/AssetDelivery/abstractions/AssetReply.js\";\n\nexport class NotAuthorizedAssetReply extends AssetReply {\n    constructor() {\n        super({\n            code: 403,\n            headers: ResponseHeaders.create({\n                \"cache-control\": \"no-store\",\n                \"content-type\": \"application/json; charset=utf-8\"\n            }),\n            body: () => ({ error: \"Not authorized!\", code: \"NOT_AUTHORIZED\" })\n        });\n    }\n}\n"],"names":["NotAuthorizedAssetReply","AssetReply","ResponseHeaders"],"mappings":";;AAGO,MAAMA,gCAAgCC;IACzC,aAAc;QACV,KAAK,CAAC;YACF,MAAM;YACN,SAASC,gBAAgB,MAAM,CAAC;gBAC5B,iBAAiB;gBACjB,gBAAgB;YACpB;YACA,MAAM,IAAO;oBAAE,OAAO;oBAAmB,MAAM;gBAAiB;QACpE;IACJ;AACJ"}

package/features/assetDelivery/privateFiles/NotAuthorizedOutputStrategy.d.ts

@@ -0,0 +1,5 @@
+import type { AssetReply } from "../../../delivery/AssetDelivery/abstractions/AssetReply.js";
+import type { IAssetOutputStrategy } from "../abstractions.js";
+export declare class NotAuthorizedOutputStrategy implements IAssetOutputStrategy {
+    output(): Promise<AssetReply>;
+}

package/features/assetDelivery/privateFiles/NotAuthorizedOutputStrategy.js

@@ -0,0 +1,9 @@
+import { NotAuthorizedAssetReply } from "./NotAuthorizedAssetReply.js";
+class NotAuthorizedOutputStrategy {
+    async output() {
+        return new NotAuthorizedAssetReply();
+    }
+}
+export { NotAuthorizedOutputStrategy };
+
+//# sourceMappingURL=NotAuthorizedOutputStrategy.js.map

package/features/assetDelivery/privateFiles/NotAuthorizedOutputStrategy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"features/assetDelivery/privateFiles/NotAuthorizedOutputStrategy.js","sources":["../../../../src/features/assetDelivery/privateFiles/NotAuthorizedOutputStrategy.ts"],"sourcesContent":["import type { AssetReply } from \"~/delivery/AssetDelivery/abstractions/AssetReply.js\";\nimport { NotAuthorizedAssetReply } from \"./NotAuthorizedAssetReply.js\";\nimport type { IAssetOutputStrategy } from \"../abstractions.js\";\n\nexport class NotAuthorizedOutputStrategy implements IAssetOutputStrategy {\n    async output(): Promise<AssetReply> {\n        return new NotAuthorizedAssetReply();\n    }\n}\n"],"names":["NotAuthorizedOutputStrategy","NotAuthorizedAssetReply"],"mappings":";AAIO,MAAMA;IACT,MAAM,SAA8B;QAChC,OAAO,IAAIC;IACf;AACJ"}

package/features/assetDelivery/privateFiles/PrivateAuthenticatedAuthorizer.d.ts

@@ -0,0 +1,11 @@
+import type { File } from "../../../domain/file/types.js";
+import { IdentityContext } from "@webiny/api-core/features/security/IdentityContext/index.js";
+import { type IAssetAuthorizer } from "../abstractions.js";
+export declare class PrivateAuthenticatedAuthorizer implements IAssetAuthorizer {
+    private identityContext;
+    constructor(identityContext: IdentityContext.Interface);
+    authorize(file: File): Promise<void>;
+}
+export declare const PrivateAuthenticatedAuthorizerImpl: typeof PrivateAuthenticatedAuthorizer & {
+    __abstraction: import("@webiny/di").Abstraction<IAssetAuthorizer>;
+};

package/features/assetDelivery/privateFiles/PrivateAuthenticatedAuthorizer.js

@@ -0,0 +1,26 @@
+import error from "@webiny/error";
+import { IdentityContext } from "@webiny/api-core/features/security/IdentityContext/index.js";
+import { AssetAuthorizer } from "../abstractions.js";
+class PrivateAuthenticatedAuthorizer {
+    constructor(identityContext){
+        this.identityContext = identityContext;
+    }
+    async authorize(file) {
+        if (file.accessControl && "private-authenticated" === file.accessControl.type) {
+            const identity = this.identityContext.getIdentity();
+            if (!identity) throw new error({
+                code: "NOT_AUTHORIZED",
+                message: "You're not authorized to access this asset!"
+            });
+        }
+    }
+}
+const PrivateAuthenticatedAuthorizerImpl = AssetAuthorizer.createImplementation({
+    implementation: PrivateAuthenticatedAuthorizer,
+    dependencies: [
+        IdentityContext
+    ]
+});
+export { PrivateAuthenticatedAuthorizer, PrivateAuthenticatedAuthorizerImpl };
+
+//# sourceMappingURL=PrivateAuthenticatedAuthorizer.js.map

package/features/assetDelivery/privateFiles/PrivateAuthenticatedAuthorizer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"features/assetDelivery/privateFiles/PrivateAuthenticatedAuthorizer.js","sources":["../../../../src/features/assetDelivery/privateFiles/PrivateAuthenticatedAuthorizer.ts"],"sourcesContent":["import Error from \"@webiny/error\";\nimport type { File } from \"~/domain/file/types.js\";\nimport { IdentityContext } from \"@webiny/api-core/features/security/IdentityContext/index.js\";\nimport { AssetAuthorizer, type IAssetAuthorizer } from \"../abstractions.js\";\n\nexport class PrivateAuthenticatedAuthorizer implements IAssetAuthorizer {\n    private identityContext: IdentityContext.Interface;\n\n    constructor(identityContext: IdentityContext.Interface) {\n        this.identityContext = identityContext;\n    }\n\n    async authorize(file: File) {\n        if (file.accessControl && file.accessControl.type === \"private-authenticated\") {\n            const identity = this.identityContext.getIdentity();\n\n            if (!identity) {\n                throw new Error({\n                    code: \"NOT_AUTHORIZED\",\n                    message: \"You're not authorized to access this asset!\"\n                });\n            }\n        }\n    }\n}\n\nexport const PrivateAuthenticatedAuthorizerImpl = AssetAuthorizer.createImplementation({\n    implementation: PrivateAuthenticatedAuthorizer,\n    dependencies: [IdentityContext]\n});\n"],"names":["PrivateAuthenticatedAuthorizer","identityContext","file","identity","Error","PrivateAuthenticatedAuthorizerImpl","AssetAuthorizer","IdentityContext"],"mappings":";;;AAKO,MAAMA;IAGT,YAAYC,eAA0C,CAAE;QACpD,IAAI,CAAC,eAAe,GAAGA;IAC3B;IAEA,MAAM,UAAUC,IAAU,EAAE;QACxB,IAAIA,KAAK,aAAa,IAAIA,AAA4B,4BAA5BA,KAAK,aAAa,CAAC,IAAI,EAA8B;YAC3E,MAAMC,WAAW,IAAI,CAAC,eAAe,CAAC,WAAW;YAEjD,IAAI,CAACA,UACD,MAAM,IAAIC,MAAM;gBACZ,MAAM;gBACN,SAAS;YACb;QAER;IACJ;AACJ;AAEO,MAAMC,qCAAqCC,gBAAgB,oBAAoB,CAAC;IACnF,gBAAgBN;IAChB,cAAc;QAACO;KAAgB;AACnC"}

package/features/assetDelivery/privateFiles/PrivateCache.d.ts

@@ -0,0 +1,8 @@
+import type { Asset } from "../../../delivery/AssetDelivery/Asset.js";
+import type { AssetReply } from "../../../delivery/AssetDelivery/abstractions/AssetReply.js";
+import type { IAssetOutputStrategy } from "../abstractions.js";
+export declare class PrivateCache implements IAssetOutputStrategy {
+    private strategy;
+    constructor(strategy: IAssetOutputStrategy);
+    output(asset: Asset): Promise<AssetReply>;
+}

package/features/assetDelivery/privateFiles/PrivateCache.js

@@ -0,0 +1,22 @@
+import { parse, stringify } from "cache-control-parser";
+class PrivateCache {
+    constructor(strategy){
+        this.strategy = strategy;
+    }
+    async output(asset) {
+        const reply = await this.strategy.output(asset);
+        reply.setHeaders((headers)=>{
+            headers.set("cache-control", (value = "")=>{
+                const cacheControl = parse(value);
+                cacheControl["private"] = true;
+                cacheControl["public"] = false;
+                return stringify(cacheControl);
+            });
+            return headers;
+        });
+        return reply;
+    }
+}
+export { PrivateCache };
+
+//# sourceMappingURL=PrivateCache.js.map

package/features/assetDelivery/privateFiles/PrivateCache.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"features/assetDelivery/privateFiles/PrivateCache.js","sources":["../../../../src/features/assetDelivery/privateFiles/PrivateCache.ts"],"sourcesContent":["import { parse, stringify } from \"cache-control-parser\";\nimport type { Asset } from \"~/delivery/AssetDelivery/Asset.js\";\nimport type { AssetReply } from \"~/delivery/AssetDelivery/abstractions/AssetReply.js\";\nimport type { IAssetOutputStrategy } from \"../abstractions.js\";\n\nexport class PrivateCache implements IAssetOutputStrategy {\n    private strategy: IAssetOutputStrategy;\n\n    constructor(strategy: IAssetOutputStrategy) {\n        this.strategy = strategy;\n    }\n\n    async output(asset: Asset): Promise<AssetReply> {\n        const reply = await this.strategy.output(asset);\n\n        reply.setHeaders(headers => {\n            headers.set(\"cache-control\", (value = \"\") => {\n                const cacheControl = parse(value);\n                cacheControl[\"private\"] = true;\n                cacheControl[\"public\"] = false;\n                return stringify(cacheControl);\n            });\n            return headers;\n        });\n\n        return reply;\n    }\n}\n"],"names":["PrivateCache","strategy","asset","reply","headers","value","cacheControl","parse","stringify"],"mappings":";AAKO,MAAMA;IAGT,YAAYC,QAA8B,CAAE;QACxC,IAAI,CAAC,QAAQ,GAAGA;IACpB;IAEA,MAAM,OAAOC,KAAY,EAAuB;QAC5C,MAAMC,QAAQ,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,CAACD;QAEzCC,MAAM,UAAU,CAACC,CAAAA;YACbA,QAAQ,GAAG,CAAC,iBAAiB,CAACC,QAAQ,EAAE;gBACpC,MAAMC,eAAeC,MAAMF;gBAC3BC,YAAY,CAAC,UAAU,GAAG;gBAC1BA,YAAY,CAAC,SAAS,GAAG;gBACzB,OAAOE,UAAUF;YACrB;YACA,OAAOF;QACX;QAEA,OAAOD;IACX;AACJ"}

package/features/assetDelivery/privateFiles/PrivateFileAssetRequestResolver.d.ts

@@ -0,0 +1,11 @@
+import type { Request } from "@webiny/handler/types.js";
+import { AssetRequest } from "../../../delivery/AssetDelivery/AssetRequest.js";
+import { type IAssetRequestResolver } from "../abstractions.js";
+export declare class PrivateFileAssetRequestResolver implements IAssetRequestResolver {
+    private readonly resolver;
+    constructor(resolver: IAssetRequestResolver);
+    resolve(request: Request): Promise<AssetRequest | undefined>;
+}
+export declare const PrivateFileAssetRequestResolverDecorator: typeof PrivateFileAssetRequestResolver & {
+    __abstraction: import("@webiny/di").Abstraction<IAssetRequestResolver>;
+};

package/features/assetDelivery/privateFiles/PrivateFileAssetRequestResolver.js

@@ -0,0 +1,31 @@
+import { AssetRequest } from "../../../delivery/AssetDelivery/AssetRequest.js";
+import { AssetRequestResolver } from "../abstractions.js";
+class PrivateFileAssetRequestResolver {
+    constructor(resolver){
+        this.resolver = resolver;
+    }
+    async resolve(request) {
+        if (!request.url?.startsWith("/private/")) return this.resolver.resolve(request);
+        const params = request.params ?? {};
+        const query = request.query ?? {};
+        const path = params["*"];
+        return new AssetRequest({
+            key: decodeURI(path).replace("/private/", ""),
+            context: {
+                url: request.url ?? "",
+                private: true
+            },
+            options: {
+                ...query,
+                width: query.width ? parseInt(query.width) : void 0
+            }
+        });
+    }
+}
+const PrivateFileAssetRequestResolverDecorator = AssetRequestResolver.createDecorator({
+    decorator: PrivateFileAssetRequestResolver,
+    dependencies: []
+});
+export { PrivateFileAssetRequestResolver, PrivateFileAssetRequestResolverDecorator };
+
+//# sourceMappingURL=PrivateFileAssetRequestResolver.js.map

package/features/assetDelivery/privateFiles/PrivateFileAssetRequestResolver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"features/assetDelivery/privateFiles/PrivateFileAssetRequestResolver.js","sources":["../../../../src/features/assetDelivery/privateFiles/PrivateFileAssetRequestResolver.ts"],"sourcesContent":["import type { Request } from \"@webiny/handler/types.js\";\nimport { AssetRequest } from \"~/delivery/AssetDelivery/AssetRequest.js\";\nimport { AssetRequestResolver, type IAssetRequestResolver } from \"../abstractions.js\";\n\nexport class PrivateFileAssetRequestResolver implements IAssetRequestResolver {\n    private readonly resolver: IAssetRequestResolver;\n\n    constructor(resolver: IAssetRequestResolver) {\n        this.resolver = resolver;\n    }\n\n    async resolve(request: Request): Promise<AssetRequest | undefined> {\n        if (!request.url?.startsWith(\"/private/\")) {\n            return this.resolver.resolve(request);\n        }\n\n        const params = (request.params ?? {}) as Record<string, any>;\n        const query = (request.query ?? {}) as Record<string, any>;\n\n        const path = params[\"*\"];\n\n        return new AssetRequest({\n            key: decodeURI(path).replace(\"/private/\", \"\"),\n            context: {\n                url: request.url ?? \"\",\n                private: true\n            },\n            options: {\n                ...query,\n                width: query.width ? parseInt(query.width) : undefined\n            }\n        });\n    }\n}\n\nexport const PrivateFileAssetRequestResolverDecorator = AssetRequestResolver.createDecorator({\n    decorator: PrivateFileAssetRequestResolver,\n    dependencies: []\n});\n"],"names":["PrivateFileAssetRequestResolver","resolver","request","params","query","path","AssetRequest","decodeURI","parseInt","undefined","PrivateFileAssetRequestResolverDecorator","AssetRequestResolver"],"mappings":";;AAIO,MAAMA;IAGT,YAAYC,QAA+B,CAAE;QACzC,IAAI,CAAC,QAAQ,GAAGA;IACpB;IAEA,MAAM,QAAQC,OAAgB,EAAqC;QAC/D,IAAI,CAACA,QAAQ,GAAG,EAAE,WAAW,cACzB,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAACA;QAGjC,MAAMC,SAAUD,QAAQ,MAAM,IAAI,CAAC;QACnC,MAAME,QAASF,QAAQ,KAAK,IAAI,CAAC;QAEjC,MAAMG,OAAOF,MAAM,CAAC,IAAI;QAExB,OAAO,IAAIG,aAAa;YACpB,KAAKC,UAAUF,MAAM,OAAO,CAAC,aAAa;YAC1C,SAAS;gBACL,KAAKH,QAAQ,GAAG,IAAI;gBACpB,SAAS;YACb;YACA,SAAS;gBACL,GAAGE,KAAK;gBACR,OAAOA,MAAM,KAAK,GAAGI,SAASJ,MAAM,KAAK,IAAIK;YACjD;QACJ;IACJ;AACJ;AAEO,MAAMC,2CAA2CC,qBAAqB,eAAe,CAAC;IACzF,WAAWX;IACX,cAAc,EAAE;AACpB"}

package/features/assetDelivery/privateFiles/PrivateFilesAssetProcessor.d.ts

@@ -0,0 +1,19 @@
+import type { Asset } from "../../../delivery/AssetDelivery/Asset.js";
+import type { AssetRequest } from "../../../delivery/AssetDelivery/AssetRequest.js";
+import { IdentityContext } from "@webiny/api-core/features/security/IdentityContext/index.js";
+import { GetFileUseCase } from "../../../features/file/GetFile/index.js";
+import { type IAssetProcessor, type IAssetAuthorizer } from "../abstractions.js";
+export declare class PrivateFilesAssetProcessor implements IAssetProcessor {
+    private readonly identityContext;
+    private readonly getFile;
+    private readonly assetAuthorizer;
+    private readonly assetProcessor;
+    constructor(identityContext: IdentityContext.Interface, getFile: GetFileUseCase.Interface, assetAuthorizer: IAssetAuthorizer, assetProcessor: IAssetProcessor);
+    process(assetRequest: AssetRequest, asset: Asset): Promise<Asset>;
+    private isPrivate;
+    private requestedViaPrivateEndpoint;
+    private requestedViaPublicEndpoint;
+}
+export declare const PrivateFilesAssetProcessorDecorator: typeof PrivateFilesAssetProcessor & {
+    __abstraction: import("@webiny/di").Abstraction<IAssetProcessor>;
+};

package/features/assetDelivery/privateFiles/PrivateFilesAssetProcessor.js

@@ -0,0 +1,65 @@
+import { IdentityContext } from "@webiny/api-core/features/security/IdentityContext/index.js";
+import { GetFileUseCase } from "../../file/GetFile/index.js";
+import { NotAuthorizedOutputStrategy } from "./NotAuthorizedOutputStrategy.js";
+import { RedirectToPublicUrlOutputStrategy } from "./RedirectToPublicUrlOutputStrategy.js";
+import { RedirectToPrivateUrlOutputStrategy } from "./RedirectToPrivateUrlOutputStrategy.js";
+import { PrivateCache } from "./PrivateCache.js";
+import { PublicCache } from "./PublicCache.js";
+import { AssetAuthorizer, AssetProcessor } from "../abstractions.js";
+class PrivateFilesAssetProcessor {
+    constructor(identityContext, getFile, assetAuthorizer, assetProcessor){
+        this.identityContext = identityContext;
+        this.getFile = getFile;
+        this.assetAuthorizer = assetAuthorizer;
+        this.assetProcessor = assetProcessor;
+    }
+    async process(assetRequest, asset) {
+        const id = asset.getId();
+        const file = await this.identityContext.withoutAuthorization(async ()=>{
+            const fileResult = await this.getFile.execute(id);
+            if (fileResult.isFail()) throw fileResult.error;
+            return fileResult.value;
+        });
+        const isPrivateFile = this.isPrivate(file);
+        if (!isPrivateFile && this.requestedViaPrivateEndpoint(assetRequest)) {
+            asset.setOutputStrategy(new RedirectToPublicUrlOutputStrategy(assetRequest));
+            return asset;
+        }
+        if (isPrivateFile && this.requestedViaPublicEndpoint(assetRequest)) {
+            asset.setOutputStrategy(new RedirectToPrivateUrlOutputStrategy(assetRequest));
+            return asset;
+        }
+        try {
+            await this.assetAuthorizer.authorize(file);
+        } catch  {
+            asset.setOutputStrategy(new NotAuthorizedOutputStrategy());
+            return asset;
+        }
+        const processedAsset = await this.assetProcessor.process(assetRequest, asset);
+        processedAsset.setOutputStrategy((strategy)=>{
+            if (!strategy) throw Error("No asset output strategy is configured!");
+            return isPrivateFile ? new PrivateCache(strategy) : new PublicCache(strategy);
+        });
+        return processedAsset;
+    }
+    isPrivate(file) {
+        return file.accessControl && file.accessControl.type.startsWith("private-");
+    }
+    requestedViaPrivateEndpoint(assetRequest) {
+        return assetRequest.getContext().private;
+    }
+    requestedViaPublicEndpoint(assetRequest) {
+        return !this.requestedViaPrivateEndpoint(assetRequest);
+    }
+}
+const PrivateFilesAssetProcessorDecorator = AssetProcessor.createDecorator({
+    decorator: PrivateFilesAssetProcessor,
+    dependencies: [
+        IdentityContext,
+        GetFileUseCase,
+        AssetAuthorizer
+    ]
+});
+export { PrivateFilesAssetProcessor, PrivateFilesAssetProcessorDecorator };
+
+//# sourceMappingURL=PrivateFilesAssetProcessor.js.map

package/features/assetDelivery/privateFiles/PrivateFilesAssetProcessor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"features/assetDelivery/privateFiles/PrivateFilesAssetProcessor.js","sources":["../../../../src/features/assetDelivery/privateFiles/PrivateFilesAssetProcessor.ts"],"sourcesContent":["import type { File } from \"~/domain/file/types.js\";\nimport type { Asset } from \"~/delivery/AssetDelivery/Asset.js\";\nimport type { AssetRequest } from \"~/delivery/AssetDelivery/AssetRequest.js\";\nimport { IdentityContext } from \"@webiny/api-core/features/security/IdentityContext/index.js\";\nimport { GetFileUseCase } from \"~/features/file/GetFile/index.js\";\nimport { NotAuthorizedOutputStrategy } from \"./NotAuthorizedOutputStrategy.js\";\nimport { RedirectToPublicUrlOutputStrategy } from \"./RedirectToPublicUrlOutputStrategy.js\";\nimport { RedirectToPrivateUrlOutputStrategy } from \"./RedirectToPrivateUrlOutputStrategy.js\";\nimport { PrivateCache } from \"./PrivateCache.js\";\nimport { PublicCache } from \"./PublicCache.js\";\nimport {\n    AssetProcessor,\n    AssetAuthorizer,\n    type IAssetProcessor,\n    type IAssetAuthorizer\n} from \"../abstractions.js\";\n\ninterface MaybePrivate {\n    private?: boolean;\n}\n\nexport class PrivateFilesAssetProcessor implements IAssetProcessor {\n    private readonly identityContext: IdentityContext.Interface;\n    private readonly getFile: GetFileUseCase.Interface;\n    private readonly assetAuthorizer: IAssetAuthorizer;\n    private readonly assetProcessor: IAssetProcessor;\n\n    constructor(\n        identityContext: IdentityContext.Interface,\n        getFile: GetFileUseCase.Interface,\n        assetAuthorizer: IAssetAuthorizer,\n        assetProcessor: IAssetProcessor\n    ) {\n        this.identityContext = identityContext;\n        this.getFile = getFile;\n        this.assetAuthorizer = assetAuthorizer;\n        this.assetProcessor = assetProcessor;\n    }\n\n    async process(assetRequest: AssetRequest, asset: Asset): Promise<Asset> {\n        // Only registered when private files are licensed (register-time gate in AssetDeliveryFeature),\n        // so no per-request license guard is needed here.\n        const id = asset.getId();\n\n        const file = await this.identityContext.withoutAuthorization(async () => {\n            const fileResult = await this.getFile.execute(id);\n            if (fileResult.isFail()) {\n                throw fileResult.error;\n            }\n            return fileResult.value;\n        });\n\n        const isPrivateFile = this.isPrivate(file);\n\n        if (!isPrivateFile && this.requestedViaPrivateEndpoint(assetRequest)) {\n            asset.setOutputStrategy(new RedirectToPublicUrlOutputStrategy(assetRequest));\n            return asset;\n        }\n\n        if (isPrivateFile && this.requestedViaPublicEndpoint(assetRequest)) {\n            asset.setOutputStrategy(new RedirectToPrivateUrlOutputStrategy(assetRequest));\n            return asset;\n        }\n\n        try {\n            await this.assetAuthorizer.authorize(file);\n        } catch {\n            asset.setOutputStrategy(new NotAuthorizedOutputStrategy());\n            return asset;\n        }\n\n        const processedAsset = await this.assetProcessor.process(assetRequest, asset);\n\n        processedAsset.setOutputStrategy(strategy => {\n            if (!strategy) {\n                throw Error(`No asset output strategy is configured!`);\n            }\n            return isPrivateFile ? new PrivateCache(strategy) : new PublicCache(strategy);\n        });\n\n        return processedAsset;\n    }\n\n    private isPrivate(file: File) {\n        return file.accessControl && file.accessControl.type.startsWith(\"private-\");\n    }\n\n    private requestedViaPrivateEndpoint(assetRequest: AssetRequest) {\n        return assetRequest.getContext<MaybePrivate>().private;\n    }\n\n    private requestedViaPublicEndpoint(assetRequest: AssetRequest) {\n        return !this.requestedViaPrivateEndpoint(assetRequest);\n    }\n}\n\nexport const PrivateFilesAssetProcessorDecorator = AssetProcessor.createDecorator({\n    decorator: PrivateFilesAssetProcessor,\n    dependencies: [IdentityContext, GetFileUseCase, AssetAuthorizer]\n});\n"],"names":["PrivateFilesAssetProcessor","identityContext","getFile","assetAuthorizer","assetProcessor","assetRequest","asset","id","file","fileResult","isPrivateFile","RedirectToPublicUrlOutputStrategy","RedirectToPrivateUrlOutputStrategy","NotAuthorizedOutputStrategy","processedAsset","strategy","Error","PrivateCache","PublicCache","PrivateFilesAssetProcessorDecorator","AssetProcessor","IdentityContext","GetFileUseCase","AssetAuthorizer"],"mappings":";;;;;;;;AAqBO,MAAMA;IAMT,YACIC,eAA0C,EAC1CC,OAAiC,EACjCC,eAAiC,EACjCC,cAA+B,CACjC;QACE,IAAI,CAAC,eAAe,GAAGH;QACvB,IAAI,CAAC,OAAO,GAAGC;QACf,IAAI,CAAC,eAAe,GAAGC;QACvB,IAAI,CAAC,cAAc,GAAGC;IAC1B;IAEA,MAAM,QAAQC,YAA0B,EAAEC,KAAY,EAAkB;QAGpE,MAAMC,KAAKD,MAAM,KAAK;QAEtB,MAAME,OAAO,MAAM,IAAI,CAAC,eAAe,CAAC,oBAAoB,CAAC;YACzD,MAAMC,aAAa,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAACF;YAC9C,IAAIE,WAAW,MAAM,IACjB,MAAMA,WAAW,KAAK;YAE1B,OAAOA,WAAW,KAAK;QAC3B;QAEA,MAAMC,gBAAgB,IAAI,CAAC,SAAS,CAACF;QAErC,IAAI,CAACE,iBAAiB,IAAI,CAAC,2BAA2B,CAACL,eAAe;YAClEC,MAAM,iBAAiB,CAAC,IAAIK,kCAAkCN;YAC9D,OAAOC;QACX;QAEA,IAAII,iBAAiB,IAAI,CAAC,0BAA0B,CAACL,eAAe;YAChEC,MAAM,iBAAiB,CAAC,IAAIM,mCAAmCP;YAC/D,OAAOC;QACX;QAEA,IAAI;YACA,MAAM,IAAI,CAAC,eAAe,CAAC,SAAS,CAACE;QACzC,EAAE,OAAM;YACJF,MAAM,iBAAiB,CAAC,IAAIO;YAC5B,OAAOP;QACX;QAEA,MAAMQ,iBAAiB,MAAM,IAAI,CAAC,cAAc,CAAC,OAAO,CAACT,cAAcC;QAEvEQ,eAAe,iBAAiB,CAACC,CAAAA;YAC7B,IAAI,CAACA,UACD,MAAMC,MAAM;YAEhB,OAAON,gBAAgB,IAAIO,aAAaF,YAAY,IAAIG,YAAYH;QACxE;QAEA,OAAOD;IACX;IAEQ,UAAUN,IAAU,EAAE;QAC1B,OAAOA,KAAK,aAAa,IAAIA,KAAK,aAAa,CAAC,IAAI,CAAC,UAAU,CAAC;IACpE;IAEQ,4BAA4BH,YAA0B,EAAE;QAC5D,OAAOA,aAAa,UAAU,GAAiB,OAAO;IAC1D;IAEQ,2BAA2BA,YAA0B,EAAE;QAC3D,OAAO,CAAC,IAAI,CAAC,2BAA2B,CAACA;IAC7C;AACJ;AAEO,MAAMc,sCAAsCC,eAAe,eAAe,CAAC;IAC9E,WAAWpB;IACX,cAAc;QAACqB;QAAiBC;QAAgBC;KAAgB;AACpE"}

package/features/assetDelivery/privateFiles/PublicCache.d.ts

@@ -0,0 +1,8 @@
+import type { Asset } from "../../../delivery/AssetDelivery/Asset.js";
+import type { AssetReply } from "../../../delivery/AssetDelivery/abstractions/AssetReply.js";
+import type { IAssetOutputStrategy } from "../abstractions.js";
+export declare class PublicCache implements IAssetOutputStrategy {
+    private strategy;
+    constructor(strategy: IAssetOutputStrategy);
+    output(asset: Asset): Promise<AssetReply>;
+}