appos 0.3.2-0 → 0.3.3-0

package/dist/exports/api/workflows/generate-preview.mjs

@@ -1 +1,160 @@
-import{defineWorkflow as e}from"../workflow.mjs";import t from"zod";import{join as n}from"node:path";import{spawn as r}from"node:child_process";const i=e({input:t.object({blobId:t.string(),timeInSeconds:t.number().optional()}),async run({container:e,input:{blobId:t,timeInSeconds:i=1},step:a}){let o=await a(`fetch-blob`,async()=>e.storage.primary.getBlob(t));if(!o)throw Error(`Blob ${t} not found`);let s=await a(`download-blob`,async()=>e.storage.primary.downloadBlob(t));if(!s)throw Error(`Failed to download blob ${t}`);let c=null;if(o.contentType?.startsWith(`video/`))c=await a(`generate-video-preview`,async()=>new Promise((n,a)=>{try{let o=r(`ffmpeg`,[`-i`,`pipe:0`,`-ss`,i.toString(),`-frames:v`,`1`,`-f`,`image2pipe`,`-c:v`,`png`,`pipe:1`]),c=[],l=[];o.stdout.on(`data`,e=>{c.push(e)}),o.stderr.on(`data`,e=>{l.push(e)}),o.on(`close`,async r=>{if(r===0)try{let e=Buffer.concat(c),t=(await import(`sharp`)).default;n(await t(e).jpeg({quality:80}).toBuffer())}catch(n){e.logger.error({error:n,blobId:t},`Failed to convert video frame to JPEG`),a(n)}else{let n=Buffer.concat(l).toString(),i=Error(`FFmpeg exited with code ${r}: ${n}`);e.logger.error({error:i,blobId:t,code:r,stderr:n},`Failed to generate video preview`),a(i)}}),o.on(`error`,n=>{e.logger.error({error:n,blobId:t},`Failed to spawn FFmpeg process`),a(n)}),o.stdin.on(`error`,n=>{n.code!==`EPIPE`&&e.logger.error({error:n,blobId:t},`Failed to write to FFmpeg stdin`)}),o.stdin.write(s),o.stdin.end()}catch(n){e.logger.error({error:n,blobId:t},`Failed to generate video preview`),a(n)}}));else if(o.contentType===`application/pdf`)c=await a(`generate-pdf-preview`,async()=>{try{let e=await import(`pdfjs-dist/legacy/build/pdf.mjs`),{createCanvas:t}=await import(`canvas`),r=(await import(`sharp`)).default,i=`${n(process.cwd(),`node_modules/pdfjs-dist/standard_fonts`)}/`,a=await(await e.getDocument({data:new Uint8Array(s),standardFontDataUrl:i}).promise).getPage(1),o=a.getViewport({scale:2}),c=t(o.width,o.height),l=c.getContext(`2d`);return await a.render({canvasContext:l,viewport:o,canvas:c}).promise,await r(c.toBuffer(`image/png`)).resize(800,800,{fit:`inside`,withoutEnlargement:!0}).jpeg({quality:85}).toBuffer()}catch(n){throw e.logger.error({error:n,errorMessage:n instanceof Error?n.message:String(n),errorStack:n instanceof Error?n.stack:void 0,errorCode:n?.code,blobId:t},`Failed to generate PDF preview`),n}});else if(o.contentType?.startsWith(`image/`))c=await a(`generate-image-preview`,async()=>{let e=(await import(`sharp`)).default;return await e(s).resize(800,800,{fit:`inside`,withoutEnlargement:!0}).jpeg({quality:85}).toBuffer()});else throw Error(`Preview generation not supported for content type: ${o.contentType}`);let l=await a(`store-preview`,async()=>await e.storage.primary.createVariant(t,{preview:!0},c));return e.logger.info({blobId:t,previewId:l.id,contentType:o.contentType},`Preview generated`),l}});export{i as generatePreview};
+import { defineWorkflow } from "./api/workflow.mjs";
+import z$1 from "zod";
+import { join } from "node:path";
+import { spawn } from "node:child_process";
+
+//#region src/api/workflows/generate-preview.ts
+/**
+* Generate preview workflow. Creates preview images/thumbnails for PDFs and videos.
+*
+* Algorithm:
+* 1. Fetch blob by ID
+* 2. Download blob content
+* 3. Generate preview based on content type:
+*    - Video: Extract frame at specified time using FFmpeg
+*    - PDF: Render first page using pdfjs-dist + canvas
+*    - Image: Resize to max 800x800 maintaining aspect ratio
+* 4. Store preview as a special variant with "preview" transformation key
+*/
+const generatePreview = defineWorkflow({
+	input: z$1.object({
+		blobId: z$1.string(),
+		timeInSeconds: z$1.number().optional()
+	}),
+	async run({ container, input: { blobId, timeInSeconds = 1 }, step }) {
+		const blob = await step("fetch-blob", async () => {
+			return container.storage.primary.getBlob(blobId);
+		});
+		if (!blob) throw new Error(`Blob ${blobId} not found`);
+		const buffer = await step("download-blob", async () => {
+			return container.storage.primary.downloadBlob(blobId);
+		});
+		if (!buffer) throw new Error(`Failed to download blob ${blobId}`);
+		let previewBuffer = null;
+		if (blob.contentType?.startsWith("video/")) previewBuffer = await step("generate-video-preview", async () => {
+			return new Promise((resolve, reject) => {
+				try {
+					const ffmpeg = spawn("ffmpeg", [
+						"-i",
+						"pipe:0",
+						"-ss",
+						timeInSeconds.toString(),
+						"-frames:v",
+						"1",
+						"-f",
+						"image2pipe",
+						"-c:v",
+						"png",
+						"pipe:1"
+					]);
+					const chunks = [];
+					const errorChunks = [];
+					ffmpeg.stdout.on("data", (chunk) => {
+						chunks.push(chunk);
+					});
+					ffmpeg.stderr.on("data", (chunk) => {
+						errorChunks.push(chunk);
+					});
+					ffmpeg.on("close", async (code) => {
+						if (code === 0) try {
+							const pngBuffer = Buffer.concat(chunks);
+							const sharp = (await import("sharp")).default;
+							resolve(await sharp(pngBuffer).jpeg({ quality: 80 }).toBuffer());
+						} catch (error) {
+							container.logger.error({
+								error,
+								blobId
+							}, "Failed to convert video frame to JPEG");
+							reject(error);
+						}
+						else {
+							const errorMessage = Buffer.concat(errorChunks).toString();
+							const error = /* @__PURE__ */ new Error(`FFmpeg exited with code ${code}: ${errorMessage}`);
+							container.logger.error({
+								error,
+								blobId,
+								code,
+								stderr: errorMessage
+							}, "Failed to generate video preview");
+							reject(error);
+						}
+					});
+					ffmpeg.on("error", (error) => {
+						container.logger.error({
+							error,
+							blobId
+						}, "Failed to spawn FFmpeg process");
+						reject(error);
+					});
+					ffmpeg.stdin.on("error", (error) => {
+						if (error.code !== "EPIPE") container.logger.error({
+							error,
+							blobId
+						}, "Failed to write to FFmpeg stdin");
+					});
+					ffmpeg.stdin.write(buffer);
+					ffmpeg.stdin.end();
+				} catch (error) {
+					container.logger.error({
+						error,
+						blobId
+					}, "Failed to generate video preview");
+					reject(error);
+				}
+			});
+		});
+		else if (blob.contentType === "application/pdf") previewBuffer = await step("generate-pdf-preview", async () => {
+			try {
+				const pdfjsLib = await import("pdfjs-dist/legacy/build/pdf.mjs");
+				const { createCanvas } = await import("canvas");
+				const sharp = (await import("sharp")).default;
+				const standardFontDataUrl = `${join(process.cwd(), "node_modules/pdfjs-dist/standard_fonts")}/`;
+				const page = await (await pdfjsLib.getDocument({
+					data: new Uint8Array(buffer),
+					standardFontDataUrl
+				}).promise).getPage(1);
+				const viewport = page.getViewport({ scale: 2 });
+				const canvas = createCanvas(viewport.width, viewport.height);
+				const context = canvas.getContext("2d");
+				await page.render({
+					canvasContext: context,
+					viewport,
+					canvas
+				}).promise;
+				return await sharp(canvas.toBuffer("image/png")).resize(800, 800, {
+					fit: "inside",
+					withoutEnlargement: true
+				}).jpeg({ quality: 85 }).toBuffer();
+			} catch (error) {
+				container.logger.error({
+					error,
+					errorMessage: error instanceof Error ? error.message : String(error),
+					errorStack: error instanceof Error ? error.stack : void 0,
+					errorCode: error?.code,
+					blobId
+				}, "Failed to generate PDF preview");
+				throw error;
+			}
+		});
+		else if (blob.contentType?.startsWith("image/")) previewBuffer = await step("generate-image-preview", async () => {
+			const sharp = (await import("sharp")).default;
+			return await sharp(buffer).resize(800, 800, {
+				fit: "inside",
+				withoutEnlargement: true
+			}).jpeg({ quality: 85 }).toBuffer();
+		});
+		else throw new Error(`Preview generation not supported for content type: ${blob.contentType}`);
+		const preview = await step("store-preview", async () => {
+			return await container.storage.primary.createVariant(blobId, { preview: true }, previewBuffer);
+		});
+		container.logger.info({
+			blobId,
+			previewId: preview.id,
+			contentType: blob.contentType
+		}, "Preview generated");
+		return preview;
+	}
+});
+
+//#endregion
+export { generatePreview };

package/dist/exports/api/workflows/index.mjs

@@ -1 +1,3 @@
-import{trackDbChanges as e}from"./track-db-changes.mjs";export{e as trackDbChanges};
+import { trackDbChanges } from "./track-db-changes.mjs";
+
+export { trackDbChanges };

package/dist/exports/api/workflows/purge-attachment.mjs

@@ -1 +1,34 @@
-import{defineWorkflow as e}from"../workflow.mjs";import t from"zod";const n=e({input:t.object({attachmentIds:t.array(t.string()).min(1)}),async run({container:e,input:{attachmentIds:t},step:n}){let r=await n(`fetch-attachments`,async()=>(await e.storage.primary.getAttachmentsByIds(t)).filter(e=>e.blob!==null).map(e=>({attachmentId:e.id,blobId:e.blob.id})));return await n(`delete-attachments`,async()=>{for(let{attachmentId:t}of r)await e.storage.primary.deleteAttachment(t)}),await n(`delete-blobs`,async()=>{for(let{blobId:t}of r)await e.storage.primary.deleteBlob(t)}),e.logger.info({attachmentIds:t,blobCount:r.length},`Attachments and blobs purged`),{purgedCount:r.length}}});export{n as purgeAttachment};
+import { defineWorkflow } from "./api/workflow.mjs";
+import z$1 from "zod";
+
+//#region src/api/workflows/purge-attachment.ts
+/**
+* Purge attachment workflow. Deletes attachments and their associated blobs
+* in the background. This workflow is enqueued by `.purge_later()` calls on
+* attachment objects.
+*/
+const purgeAttachment = defineWorkflow({
+	input: z$1.object({ attachmentIds: z$1.array(z$1.string()).min(1) }),
+	async run({ container, input: { attachmentIds }, step }) {
+		const attachments = await step("fetch-attachments", async () => {
+			return (await container.storage.primary.getAttachmentsByIds(attachmentIds)).filter((r) => r.blob !== null).map((r) => ({
+				attachmentId: r.id,
+				blobId: r.blob.id
+			}));
+		});
+		await step("delete-attachments", async () => {
+			for (const { attachmentId } of attachments) await container.storage.primary.deleteAttachment(attachmentId);
+		});
+		await step("delete-blobs", async () => {
+			for (const { blobId } of attachments) await container.storage.primary.deleteBlob(blobId);
+		});
+		container.logger.info({
+			attachmentIds,
+			blobCount: attachments.length
+		}, "Attachments and blobs purged");
+		return { purgedCount: attachments.length };
+	}
+});
+
+//#endregion
+export { purgeAttachment };

package/dist/exports/api/workflows/purge-audit-logs.mjs

@@ -1 +1,47 @@
-import{defineAuthSchema as e}from"../auth-schema.mjs";import{defineScheduledWorkflow as t}from"../workflow.mjs";import{lt as n}from"drizzle-orm";const r=e();function i(e=`0 0 * * *`){return t({crontab:e,async run({container:e,step:t,scheduledTime:i}){let a=e.auth.auditLog?.retentionDays??90,o=new Date(i);o.setDate(o.getDate()-a);let s=o.toISOString(),c=await t(`delete-old-logs`,async()=>{let{auditLogs:t}=r.tables;return(await e.db.primary.delete(t).where(n(t.createdAt,s)).returning({id:t.id})).length});e.logger.info({deletedCount:c,retentionDays:a,cutoffDate:s},`Audit log purge completed`)}})}export{i as definePurgeAuditLogs};
+import { defineAuthSchema } from "./api/auth-schema.mjs";
+import { defineScheduledWorkflow } from "./api/workflow.mjs";
+import { lt } from "drizzle-orm";
+
+//#region src/api/workflows/purge-audit-logs.ts
+const authSchema = defineAuthSchema();
+/**
+* Default cron: midnight daily
+*/
+const DEFAULT_CRON = "0 0 * * *";
+/**
+* Default retention period: 90 days
+*/
+const DEFAULT_RETENTION_DAYS = 90;
+/**
+* Defines purge audit logs workflow with configurable cron schedule.
+*
+* Algorithm:
+* 1. Calculate cutoff date from scheduledTime minus retentionDays
+* 2. Delete all audit logs with createdAt before cutoff
+* 3. Log the number of deleted records
+*
+* @param crontab - Cron expression from auth.auditLog.purgeCron.
+*/
+function definePurgeAuditLogs(crontab = DEFAULT_CRON) {
+	return defineScheduledWorkflow({
+		crontab,
+		async run({ container, step, scheduledTime }) {
+			const retentionDays = container.auth.auditLog?.retentionDays ?? DEFAULT_RETENTION_DAYS;
+			const cutoffDate = new Date(scheduledTime);
+			cutoffDate.setDate(cutoffDate.getDate() - retentionDays);
+			const cutoffISO = cutoffDate.toISOString();
+			const deletedCount = await step("delete-old-logs", async () => {
+				const { auditLogs } = authSchema.tables;
+				return (await container.db.primary.delete(auditLogs).where(lt(auditLogs.createdAt, cutoffISO)).returning({ id: auditLogs.id })).length;
+			});
+			container.logger.info({
+				deletedCount,
+				retentionDays,
+				cutoffDate: cutoffISO
+			}, "Audit log purge completed");
+		}
+	});
+}
+
+//#endregion
+export { definePurgeAuditLogs };

package/dist/exports/api/workflows/purge-unattached-blobs.mjs

@@ -1 +1,46 @@
-import{defineScheduledWorkflow as e}from"../workflow.mjs";function t(t=`0 0 * * *`){return e({crontab:t,async run({container:e,step:t}){let n=new Date(Date.now()-2880*60*1e3).toISOString(),r=await t(`fetch-unattached-blobs`,async()=>e.storage.primary.getUnattachedBlobs({olderThan:n})),i=await t(`fetch-pending-blobs`,async()=>e.storage.primary.getPendingBlobs(n)),a=[...r,...i],o=0;for(let n of a)await t(`delete-blob`,async()=>{await e.storage.primary.deleteBlob(n.id),o++});e.logger.info({purgedCount:o,unattachedCount:r.length,pendingCount:i.length},`Orphaned blobs purged`)}})}export{t as definePurgeUnattachedBlobs};
+import { defineScheduledWorkflow } from "./api/workflow.mjs";
+
+//#region src/api/workflows/purge-unattached-blobs.ts
+/**
+* Default cron: midnight daily
+*/
+const DEFAULT_CRON = "0 0 * * *";
+/**
+* Defines purge unattached blobs workflow with configurable cron schedule.
+*
+* Algorithm:
+* 1. Fetch unattached blobs older than 48 hours
+* 2. Fetch pending blobs (stuck direct uploads) older than 48 hours
+* 3. Delete each orphaned blob from storage and database
+* 4. Log the purge summary
+*
+* @param crontab - Cron expression for when to run (default: daily at midnight)
+*/
+function definePurgeUnattachedBlobs(crontab = DEFAULT_CRON) {
+	return defineScheduledWorkflow({
+		crontab,
+		async run({ container, step }) {
+			const olderThan = (/* @__PURE__ */ new Date(Date.now() - 2880 * 60 * 1e3)).toISOString();
+			const unattachedBlobs = await step("fetch-unattached-blobs", async () => {
+				return container.storage.primary.getUnattachedBlobs({ olderThan });
+			});
+			const pendingBlobs = await step("fetch-pending-blobs", async () => {
+				return container.storage.primary.getPendingBlobs(olderThan);
+			});
+			const allOrphans = [...unattachedBlobs, ...pendingBlobs];
+			let purgedCount = 0;
+			for (const blob of allOrphans) await step("delete-blob", async () => {
+				await container.storage.primary.deleteBlob(blob.id);
+				purgedCount++;
+			});
+			container.logger.info({
+				purgedCount,
+				unattachedCount: unattachedBlobs.length,
+				pendingCount: pendingBlobs.length
+			}, "Orphaned blobs purged");
+		}
+	});
+}
+
+//#endregion
+export { definePurgeUnattachedBlobs };

package/dist/exports/api/workflows/track-db-changes.mjs

@@ -1 +1,110 @@
-import{defineAuthSchema as e}from"../auth-schema.mjs";import{dbChangesEvent as t}from"../event.mjs";import{defineWorkflow as n}from"../workflow.mjs";import{z as r}from"zod";const i=e(),a=r.object({changes:r.array(r.object({_table:r.string(),old:r.record(r.string(),r.unknown()).nullable(),new:r.record(r.string(),r.unknown()).nullable()})),dbName:r.string(),organizationId:r.string().nullable(),requestId:r.string(),sessionId:r.string().nullable(),userId:r.string().nullable()});function o(e){return e.old===null?`INSERT`:e.new===null?`DELETE`:`UPDATE`}const s=n({input:a,async run({container:e,step:n,input:r}){let{dbName:a,changes:s,organizationId:c,userId:l,sessionId:u,requestId:d}=r;if(s.length===0)return{processed:0,audited:0,published:0};let f=new Date().toISOString(),p=0,m=0;for(let r of s){let s=r._table,h=o(r),g=`${a}.${s}`;e.auth.shouldAudit(g)&&(await n(`audit:${g}`,async()=>{await e.db.primary.insert(i.tables.auditLogs).values({tableName:g,action:h,oldData:r.old,newData:r.new,organizationId:c,userId:l,sessionId:u,requestId:d,createdAt:f})}),p++),await n(`event:${g}`,async()=>{await t.emit({action:h,oldData:r.old,newData:r.new,organizationId:c,tableName:g,timestamp:f,userId:l})}),m++}return{processed:s.length,audited:p,published:m}}});export{s as trackDbChanges};
+import { defineAuthSchema } from "./api/auth-schema.mjs";
+import { dbChangesEvent } from "./api/event.mjs";
+import { defineWorkflow } from "./api/workflow.mjs";
+import { z } from "zod";
+
+//#region src/api/workflows/track-db-changes.ts
+const authSchema = defineAuthSchema();
+/**
+* Input schema for trackDbChanges workflow.
+* Accepts dbChanges() output directly from .returning() clause.
+*/
+const trackDbChangesInputSchema = z.object({
+	changes: z.array(z.object({
+		_table: z.string(),
+		old: z.record(z.string(), z.unknown()).nullable(),
+		new: z.record(z.string(), z.unknown()).nullable()
+	})),
+	dbName: z.string(),
+	organizationId: z.string().nullable(),
+	requestId: z.string(),
+	sessionId: z.string().nullable(),
+	userId: z.string().nullable()
+});
+/**
+* Infers action type from change record based on old/new nullness.
+* Uses uppercase SQL-style actions to match OCSF/CADF standards.
+*
+* Algorithm:
+* - old is null → INSERT (new row created)
+* - new is null → DELETE (row removed)
+* - both present → UPDATE (row modified)
+*
+* @param change - Change record with old and new values
+* @returns Action type: "INSERT" if old is null, "DELETE" if new is null, otherwise "UPDATE"
+*/
+function inferAction(change) {
+	if (change.old === null) return "INSERT";
+	if (change.new === null) return "DELETE";
+	return "UPDATE";
+}
+/**
+* Built-in workflow for processing database changes.
+* Handles audit logging and pub/sub notifications with type-safe table filtering.
+*
+* Algorithm:
+* 1. For each change in input, infer the action (INSERT/UPDATE/DELETE)
+* 2. If table is not excluded from audit logging:
+*    - Insert into audit_logs table with full context
+* 3. Emit to dbChangesEvent (publishes via Redis if subscribed handlers exist)
+*
+* Filtering is configured via:
+* - `container.auth.shouldAudit()` - Check if table should be audited
+*
+* @returns Object with counts: processed (total changes), audited (logged to audit_logs), published (emitted to event)
+*/
+const trackDbChanges = defineWorkflow({
+	input: trackDbChangesInputSchema,
+	async run({ container, step, input }) {
+		const { dbName, changes, organizationId, userId, sessionId, requestId } = input;
+		if (changes.length === 0) return {
+			processed: 0,
+			audited: 0,
+			published: 0
+		};
+		const timestamp = (/* @__PURE__ */ new Date()).toISOString();
+		let audited = 0;
+		let published = 0;
+		for (const change of changes) {
+			const tableName = change._table;
+			const action = inferAction(change);
+			const qualifiedTable = `${dbName}.${tableName}`;
+			if (container.auth.shouldAudit(qualifiedTable)) {
+				await step(`audit:${qualifiedTable}`, async () => {
+					await container.db.primary.insert(authSchema.tables.auditLogs).values({
+						tableName: qualifiedTable,
+						action,
+						oldData: change.old,
+						newData: change.new,
+						organizationId,
+						userId,
+						sessionId,
+						requestId,
+						createdAt: timestamp
+					});
+				});
+				audited++;
+			}
+			await step(`event:${qualifiedTable}`, async () => {
+				await dbChangesEvent.emit({
+					action,
+					oldData: change.old,
+					newData: change.new,
+					organizationId,
+					tableName: qualifiedTable,
+					timestamp,
+					userId
+				});
+			});
+			published++;
+		}
+		return {
+			processed: changes.length,
+			audited,
+			published
+		};
+	}
+});
+
+//#endregion
+export { trackDbChanges };

package/dist/exports/cli/_virtual/rolldown_runtime.mjs

@@ -1 +1,36 @@
-var e=Object.defineProperty,t=Object.getOwnPropertyDescriptor,n=Object.getOwnPropertyNames,r=Object.prototype.hasOwnProperty,i=(t,n)=>{let r={};for(var i in t)e(r,i,{get:t[i],enumerable:!0});return n&&e(r,Symbol.toStringTag,{value:`Module`}),r},a=(i,a,o,s)=>{if(a&&typeof a==`object`||typeof a==`function`)for(var c=n(a),l=0,u=c.length,d;l<u;l++)d=c[l],!r.call(i,d)&&d!==o&&e(i,d,{get:(e=>a[e]).bind(null,d),enumerable:!(s=t(a,d))||s.enumerable});return i},o=(e,t,n)=>(a(e,t,`default`),n&&a(n,t,`default`));export{i as __export,o as __reExport};
+//#region rolldown:runtime
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (all, symbols) => {
+	let target = {};
+	for (var name in all) {
+		__defProp(target, name, {
+			get: all[name],
+			enumerable: true
+		});
+	}
+	if (symbols) {
+		__defProp(target, Symbol.toStringTag, { value: "Module" });
+	}
+	return target;
+};
+var __copyProps = (to, from, except, desc) => {
+	if (from && typeof from === "object" || typeof from === "function") {
+		for (var keys = __getOwnPropNames(from), i = 0, n = keys.length, key; i < n; i++) {
+			key = keys[i];
+			if (!__hasOwnProp.call(to, key) && key !== except) {
+				__defProp(to, key, {
+					get: ((k) => from[k]).bind(null, key),
+					enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable
+				});
+			}
+		}
+	}
+	return to;
+};
+var __reExport = (target, mod, secondTarget) => (__copyProps(target, mod, "default"), secondTarget && __copyProps(secondTarget, mod, "default"));
+
+//#endregion
+export { __export, __reExport };