cabloy 5.1.101 → 5.1.103

package/vona/src/suite-vendor/a-file/modules/a-file/src/lib/fileUploadUrl.ts

@@ -0,0 +1,329 @@
+import fse from 'fs-extra';
+import { lookup as dnsLookup } from 'node:dns/promises';
+import https from 'node:https';
+import net from 'node:net';
+import os from 'node:os';
+import path from 'node:path';
+import { Transform } from 'node:stream';
+import { pipeline } from 'node:stream/promises';
+
+import type { IFileUploadUrlPolicyResolved } from '../types/file.ts';
+
+import { getFileExtension, matchesFileMimeType } from './fileUploadValidation.ts';
+
+const MAX_REDIRECTS = 3;
+const CONNECT_TIMEOUT = 10_000;
+const RESPONSE_TIMEOUT = 15_000;
+const READ_TIMEOUT = 15_000;
+const OVERALL_TIMEOUT = 30_000;
+
+export interface IRemoteFileUploadUrlInput {
+  url: string;
+  filename?: string;
+  policy: IFileUploadUrlPolicyResolved;
+}
+
+export interface IRemoteFileUploadUrlResult {
+  file: string;
+  filename: string;
+  contentType?: string;
+  size: number;
+  cleanup: () => Promise<void>;
+}
+
+interface IRemoteResponse {
+  request: import('node:http').ClientRequest;
+  response: import('node:http').IncomingMessage;
+}
+
+export async function downloadFileUploadUrl(
+  input: IRemoteFileUploadUrlInput,
+): Promise<IRemoteFileUploadUrlResult> {
+  const tempDir = await fse.mkdtemp(path.join(os.tmpdir(), 'cabloy-file-url-'));
+  let active: import('node:http').ClientRequest | import('node:http').IncomingMessage | undefined;
+  const overallTimer = setTimeout(() => {
+    active?.destroy(new Error('Remote file fetch timed out'));
+  }, OVERALL_TIMEOUT);
+  try {
+    let url = validateRemoteUrl(input.url);
+    let remote: IRemoteResponse | undefined;
+    for (let redirects = 0; redirects <= MAX_REDIRECTS; redirects++) {
+      remote = await requestRemote(url, item => {
+        active = item;
+      });
+      const location = remote.response.headers.location;
+      if (isRedirect(remote.response.statusCode) && location) {
+        if (redirects === MAX_REDIRECTS) {
+          throw new Error(`Remote file exceeded redirect limit: ${MAX_REDIRECTS}`);
+        }
+        remote.response.resume();
+        url = validateRemoteUrl(new URL(location, url).toString());
+        continue;
+      }
+      break;
+    }
+    if (!remote || isRedirect(remote.response.statusCode)) {
+      throw new Error('Remote file redirect response is missing a location');
+    }
+    if (
+      !remote.response.statusCode ||
+      remote.response.statusCode < 200 ||
+      remote.response.statusCode >= 300
+    ) {
+      throw new Error(`Remote file fetch failed: ${remote.response.statusCode ?? 0}`);
+    }
+
+    const filename = sanitizeFilename(input.filename) ?? filenameFromUrl(url);
+    validateExtension(filename, input.policy);
+    const contentType = normalizeContentType(remote.response.headers['content-type']);
+    validateContentType(contentType, input.policy);
+    const contentLength = parseContentLength(remote.response.headers['content-length']);
+    if (contentLength !== undefined) validateSize(contentLength, input.policy);
+
+    const file = path.join(tempDir, 'download');
+    let size = 0;
+    const limit = new Transform({
+      transform(chunk: Buffer, _encoding, callback) {
+        size += chunk.length;
+        try {
+          validateSize(size, input.policy);
+          callback(null, chunk);
+        } catch (error) {
+          callback(error as Error);
+        }
+      },
+    });
+    remote.response.setTimeout(READ_TIMEOUT, () => {
+      remote.response.destroy(new Error('Remote file read timed out'));
+    });
+    active = remote.response;
+    await pipeline(remote.response, limit, fse.createWriteStream(file, { mode: 0o600 }));
+    validateSize(size, input.policy);
+    return {
+      file,
+      filename,
+      contentType,
+      size,
+      cleanup: async () => await fse.remove(tempDir),
+    };
+  } catch (error) {
+    await fse.remove(tempDir);
+    throw error;
+  } finally {
+    clearTimeout(overallTimer);
+  }
+}
+
+function validateRemoteUrl(value: string) {
+  let url: URL;
+  try {
+    url = new URL(value);
+  } catch {
+    throw new TypeError('Remote file URL is invalid');
+  }
+  if (url.protocol !== 'https:') {
+    throw new TypeError('Remote file URL must use HTTPS');
+  }
+  if (url.username || url.password) {
+    throw new TypeError('Remote file URL must not include credentials');
+  }
+  if (url.port && url.port !== '443') {
+    throw new TypeError('Remote file URL must use port 443');
+  }
+  if (!url.hostname) {
+    throw new TypeError('Remote file URL must include a hostname');
+  }
+  return url;
+}
+
+async function requestRemote(
+  url: URL,
+  setActive: (
+    item: import('node:http').ClientRequest | import('node:http').IncomingMessage,
+  ) => void,
+): Promise<IRemoteResponse> {
+  const address = await resolvePublicAddress(url.hostname);
+  return await new Promise<IRemoteResponse>((resolve, reject) => {
+    let settled = false;
+    const rejectOnce = (error: Error) => {
+      if (settled) return;
+      settled = true;
+      reject(error);
+    };
+    const request = https.request(
+      url,
+      {
+        agent: false,
+        lookup(hostname, _options, callback) {
+          if (hostname !== url.hostname) {
+            callback(
+              Object.assign(new Error('Remote file DNS hostname mismatch'), {
+                code: 'EHOSTUNREACH',
+              }),
+              address.address,
+              address.family,
+            );
+            return;
+          }
+          callback(null, address.address, address.family);
+        },
+      },
+      response => {
+        if (settled) {
+          response.destroy();
+          return;
+        }
+        settled = true;
+        response.setTimeout(RESPONSE_TIMEOUT, () => {
+          response.destroy(new Error('Remote file response timed out'));
+        });
+        setActive(response);
+        resolve({ request, response });
+      },
+    );
+    request.setTimeout(CONNECT_TIMEOUT, () => {
+      request.destroy(new Error('Remote file connection timed out'));
+    });
+    request.once('error', rejectOnce);
+    setActive(request);
+    request.end();
+  });
+}
+
+async function resolvePublicAddress(hostname: string) {
+  const literalFamily = net.isIP(hostname);
+  const addresses = literalFamily
+    ? [{ address: hostname, family: literalFamily }]
+    : await dnsLookup(hostname, { all: true, verbatim: true });
+  if (!addresses.length) throw new Error('Remote file hostname did not resolve');
+  for (const address of addresses) {
+    if (!isPublicAddress(address.address, address.family)) {
+      throw new Error(`Remote file hostname resolved to a prohibited address: ${address.address}`);
+    }
+  }
+  return addresses[0]!;
+}
+
+function isRedirect(statusCode?: number) {
+  return [301, 302, 303, 307, 308].includes(statusCode ?? 0);
+}
+
+function normalizeContentType(value: string | string[] | undefined) {
+  const contentType = Array.isArray(value) ? value[0] : value;
+  return contentType?.split(';', 1)[0]?.trim().toLowerCase() || undefined;
+}
+
+function parseContentLength(value: string | string[] | undefined) {
+  const contentLength = Array.isArray(value) ? value[0] : value;
+  if (contentLength === undefined) return undefined;
+  if (!/^\d+$/.test(contentLength)) throw new Error('Remote file Content-Length is invalid');
+  const size = Number(contentLength);
+  if (!Number.isSafeInteger(size)) throw new Error('Remote file Content-Length is invalid');
+  return size;
+}
+
+function validateSize(size: number, policy: IFileUploadUrlPolicyResolved) {
+  if (policy.maxSize !== undefined && size > policy.maxSize) {
+    throw new Error(`Remote file is too large: maxSize=${policy.maxSize}`);
+  }
+}
+
+function validateContentType(
+  contentType: string | undefined,
+  policy: IFileUploadUrlPolicyResolved,
+) {
+  if (
+    policy.mimeTypes?.length &&
+    (!contentType || !matchesFileMimeType(contentType, policy.mimeTypes))
+  ) {
+    throw new Error(`Unsupported remote file mimeType: ${contentType ?? 'missing'}`);
+  }
+}
+
+function validateExtension(filename: string, policy: IFileUploadUrlPolicyResolved) {
+  const extension = getFileExtension(filename);
+  if (policy.extensions?.length && !policy.extensions.includes(extension)) {
+    throw new Error(`Unsupported remote file extension: ${extension || 'missing'}`);
+  }
+}
+
+function filenameFromUrl(url: URL) {
+  const pathname = decodeURIComponent(url.pathname);
+  return sanitizeFilename(path.posix.basename(pathname)) ?? 'download';
+}
+
+function sanitizeFilename(value: string | undefined) {
+  if (!value) return undefined;
+  const filename = path
+    .basename(value.replaceAll('\\', '/'))
+    .replace(/\p{Cc}/gu, '')
+    .trim();
+  return filename || undefined;
+}
+
+function isPublicAddress(address: string, family: number) {
+  if (family === 4) return isPublicIpv4(address);
+  if (family === 6) return isPublicIpv6(address);
+  return false;
+}
+
+function isPublicIpv4(address: string) {
+  const octets = address.split('.').map(Number);
+  if (
+    octets.length !== 4 ||
+    octets.some(item => !Number.isInteger(item) || item < 0 || item > 255)
+  ) {
+    return false;
+  }
+  const [a, b, c] = octets;
+  if (a === 0 || a === 10 || a === 127 || a >= 224) return false;
+  if (a === 100 && b >= 64 && b <= 127) return false;
+  if (a === 169 && b === 254) return false;
+  if (a === 172 && b >= 16 && b <= 31) return false;
+  if (a === 192 && (b === 0 || b === 168)) return false;
+  if (a === 192 && b === 88 && c === 99) return false;
+  if (a === 192 && b === 0 && c === 2) return false;
+  if (a === 198 && (b === 18 || b === 19 || b === 51)) return false;
+  if (a === 203 && b === 0 && c === 113) return false;
+  return true;
+}
+
+function isPublicIpv6(address: string) {
+  const normalized = address.toLowerCase();
+  if (normalized === '::' || normalized === '::1') return false;
+  const mapped = normalized.match(/^::ffff:(\d+\.\d+\.\d+\.\d+)$/);
+  if (mapped) return isPublicIpv4(mapped[1]!);
+  const value = parseIpv6(normalized);
+  if (value === undefined) return false;
+  if (inIpv6Range(value, 0xfc000000000000000000000000000000n, 7)) return false;
+  if (inIpv6Range(value, 0xfe800000000000000000000000000000n, 10)) return false;
+  if (inIpv6Range(value, 0xff000000000000000000000000000000n, 8)) return false;
+  if (!inIpv6Range(value, 0x20000000000000000000000000000000n, 3)) return false;
+  if (inIpv6Range(value, 0x20010db8000000000000000000000000n, 32)) return false;
+  if (inIpv6Range(value, 0x2001000000000000000000000000000n, 32)) return false;
+  if (inIpv6Range(value, 0x2002000000000000000000000000000n, 16)) return false;
+  return true;
+}
+
+function parseIpv6(value: string): bigint | undefined {
+  const parts = value.split('::');
+  if (parts.length > 2) return undefined;
+  const [head, tail] = parts;
+  const left = head ? head.split(':') : [];
+  const right = tail ? tail.split(':') : [];
+  if ((tail === undefined && left.length !== 8) || left.length + right.length > 8) {
+    return undefined;
+  }
+  const groups: string[] = [
+    ...left,
+    ...Array.from<string>({ length: 8 - left.length - right.length }).fill('0'),
+    ...right,
+  ];
+  if (groups.some(group => !/^[0-9a-f]{1,4}$/.test(group))) return undefined;
+  return groups.reduce<bigint>((result, group) => (result << 16n) + BigInt(`0x${group}`), 0n);
+}
+
+function inIpv6Range(value: bigint, prefix: bigint, bits: number) {
+  const mask = ((1n << BigInt(bits)) - 1n) << BigInt(128 - bits);
+  return (value & mask) === (prefix & mask);
+}

package/vona/src/suite-vendor/a-file/modules/a-file/src/lib/index.ts

@@ -1,3 +1,4 @@
 export * from './fileProvider.ts';
 export * from './fileScene.ts';
+export * from './fileUploadUrl.ts';
 export * from './fileUploadValidation.ts';

package/vona/src/suite-vendor/a-file/modules/a-file/src/types/file.ts

@@ -4,12 +4,18 @@ import type { IFileProviderClientOptions, IFileProviderRecord } from './fileProv
 import type { IFileSceneRecord } from './fileScene.ts';
 
 export type TypeFileMeta = Record<string, unknown>;
-export type TypeFileDeliveryExpiry = Date | string | number;
+export type TypeFileDirectUploadExpiry = Date | string | number;
+export type TypeFileStatus = 'draft' | 'ready' | 'expired';
 
 export interface IFileDeliveryOptions {
-  signed?: boolean;
   expiresIn?: number;
-  expiresAt?: TypeFileDeliveryExpiry;
+  audience?: boolean;
+  responseMode?: 'auto' | 'buffer' | 'url';
+}
+
+export interface IFileProviderDeliveryOptions {
+  protected: boolean;
+  expiresIn?: number;
   responseMode?: 'auto' | 'buffer' | 'url';
 }
 
@@ -25,6 +31,7 @@ export interface IFileUploadInput<TMeta extends TypeFileMeta = TypeFileMeta> {
 
 export interface IFileUploadUrlInput<TMeta extends TypeFileMeta = TypeFileMeta> {
   url: string;
+  policy?: IFileUploadUrlPolicyResolved;
   filename?: string;
   contentType?: string;
   size?: number;
@@ -40,7 +47,7 @@ export interface IFileDirectUploadInput<TMeta extends TypeFileMeta = TypeFileMet
   objectKey?: string;
   public?: boolean;
   meta?: TMeta;
-  expiry?: TypeFileDeliveryExpiry;
+  expiry?: TypeFileDirectUploadExpiry;
 }
 
 export interface IFileUploadContextResolved<TMeta extends TypeFileMeta = TypeFileMeta> {
@@ -92,6 +99,9 @@ export interface IFileResource<
   provider: keyof IFileProviderRecord;
   clientName: string;
   fileScene?: keyof IFileSceneRecord | string;
+  status?: TypeFileStatus;
+  draftExpiresAt?: Date;
+  finalizedAt?: Date;
   uploadedAt?: Date;
 }
 
@@ -104,6 +114,37 @@ export interface IFileDirectUploadResult<
   method?: 'PUT' | 'POST';
 }
 
+export interface IFileActionResponse {
+  id: TableIdentity;
+  filename?: string;
+  contentType?: string;
+  size?: number;
+  public?: boolean;
+  uploadedAt?: Date;
+  url: string;
+  signed: boolean;
+}
+
+export interface IFileDirectUploadResponse {
+  id: TableIdentity;
+  uploadUrl: string;
+  headers?: Record<string, string>;
+  method?: 'PUT' | 'POST';
+  filename?: string;
+  public?: boolean;
+}
+
+export interface IFileView {
+  id: TableIdentity;
+  filename?: string;
+  contentType?: string;
+  size?: number;
+  public?: boolean;
+  uploadedAt?: Date;
+  downloadUrl: string;
+  signed?: boolean;
+}
+
 export interface IFileUploadOptions<
   TClientOptions extends IFileProviderClientOptions = IFileProviderClientOptions,
   TMeta extends TypeFileMeta = TypeFileMeta,
@@ -115,26 +156,26 @@ export interface IFileUploadOptions<
   fileScene?: keyof IFileSceneRecord;
 }
 
-export interface IFileUploadPolicyResolved<
+export interface IFileUploadUrlPolicyResolved<
   TMeta extends TypeFileMeta = TypeFileMeta,
 > extends IFileUploadContextResolved<TMeta> {
   maxSize?: number;
   mimeTypes?: string[];
   extensions?: string[];
   multiple?: boolean;
-  fileSize: number;
-  mimeType: string;
 }
 
-export interface IFileUploadTokenPayload<
+export interface IFileUploadPolicyResolved<
   TMeta extends TypeFileMeta = TypeFileMeta,
-> extends IFileUploadPolicyResolved<TMeta> {
-  kind: 'fileUpload';
+> extends IFileUploadUrlPolicyResolved<TMeta> {
+  fileSize: number;
+  mimeType: string;
 }
 
 export interface IFileDownloadTokenPayload {
   kind: 'fileDownload';
   fileId: TableIdentity;
+  audienceUserId?: TableIdentity;
 }
 
 declare module 'vona' {

package/vona/src/suite-vendor/a-file/modules/a-file/src/types/fileProvider.ts

@@ -4,8 +4,8 @@ import type { ServiceOnion, TypeOnionOptionsEnableSimple } from 'vona-module-a-o
 import type { EntityFile } from '../entity/file.ts';
 import type { EntityFileProvider } from '../entity/fileProvider.ts';
 import type {
-  IFileDeliveryOptions,
   IFileDirectUploadInput,
+  IFileProviderDeliveryOptions,
   IFileDownloadResult,
   IFileProviderDirectUploadResource,
   IFileProviderResource,
@@ -78,19 +78,24 @@ export interface IFileProviderExecute<
     clientOptions: T,
     options: O,
   ): Promise<IFileProviderDirectUploadResource>;
+  finalizeDirectUpload?(
+    file: EntityFile,
+    clientOptions: T,
+    options: O,
+  ): Promise<IFileProviderResource | undefined>;
   get(file: EntityFile, clientOptions: T, options: O): Promise<IFileProviderResource | undefined>;
   delete(file: EntityFile, clientOptions: T, options: O): Promise<void>;
   getDownloadUrl(
     file: EntityFile,
     clientOptions: T,
     options: O,
-    deliveryOptions?: IFileDeliveryOptions,
+    deliveryOptions?: IFileProviderDeliveryOptions,
   ): Promise<string>;
   download?(
     file: EntityFile,
     clientOptions: T,
     options: O,
-    deliveryOptions?: IFileDeliveryOptions,
+    deliveryOptions?: IFileProviderDeliveryOptions,
   ): Promise<IFileDownloadResult>;
 }
 

package/vona/src/suite-vendor/a-file/modules/a-file/src/types/fileScene.ts

@@ -10,7 +10,6 @@ export interface IFileSceneOptionsUpload {
   mimeTypes?: string[];
   extensions?: string[];
   multiple?: boolean;
-  public?: boolean;
 }
 
 export interface IDecoratorFileSceneOptionsProvider {
@@ -33,6 +32,7 @@ export type TypeFileSceneOptionsMetaResolver = (
 export interface IDecoratorFileSceneOptions {
   provider?: TypeDecoratorFileSceneOptionsProvider;
   upload?: IFileSceneOptionsUpload;
+  public?: boolean;
   meta?: Record<string, any> | TypeFileSceneOptionsMetaResolver;
 }
 

package/vona/src/suite-vendor/a-file/modules/file-cloudflare/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vona-module-file-cloudflare",
-  "version": "5.0.3",
+  "version": "5.0.4",
   "description": "",
   "keywords": [
     "Vona Module"

package/vona/src/suite-vendor/a-file/modules/file-cloudflare/src/bean/fileProvider.cloudflare.ts

@@ -1,8 +1,8 @@
 import type {
   EntityFile,
   IDecoratorFileProviderOptions,
-  IFileDeliveryOptions,
   IFileDirectUploadInput,
+  IFileProviderDeliveryOptions,
   IFileDownloadResult,
   IFileProviderClientOptions,
   IFileProviderClientRecord,
@@ -66,6 +66,14 @@ export class FileProviderCloudflare
     return await this.scope.service.fileCloudflare.createDirectUpload(input, clientOptions);
   }
 
+  async finalizeDirectUpload(
+    file: EntityFile,
+    clientOptions: IFileProviderCloudflareClientOptions,
+    _options: IFileProviderOptionsCloudflare,
+  ) {
+    return await this.scope.service.fileCloudflare.finalizeDirectUpload(file, clientOptions);
+  }
+
   async get(
     file: EntityFile,
     clientOptions: IFileProviderCloudflareClientOptions,
@@ -97,7 +105,7 @@ export class FileProviderCloudflare
     file: EntityFile,
     clientOptions: IFileProviderCloudflareClientOptions,
     _options: IFileProviderOptionsCloudflare,
-    deliveryOptions?: IFileDeliveryOptions,
+    deliveryOptions?: IFileProviderDeliveryOptions,
   ) {
     return await this.scope.service.fileCloudflare.getDownloadUrl(
       file,
@@ -110,14 +118,14 @@ export class FileProviderCloudflare
     file: EntityFile,
     clientOptions: IFileProviderCloudflareClientOptions,
     options: IFileProviderOptionsCloudflare,
-    deliveryOptions?: IFileDeliveryOptions,
+    deliveryOptions?: IFileProviderDeliveryOptions,
   ): Promise<IFileDownloadResult> {
     return {
       kind: 'url',
       url: await this.getDownloadUrl(file, clientOptions, options, deliveryOptions),
       filename: file.filename,
       contentType: file.contentType,
-      signed: !!(deliveryOptions?.signed ?? !(file.public ?? clientOptions.public)),
+      signed: !!deliveryOptions?.protected,
     };
   }
 }

package/vona/src/suite-vendor/a-file/modules/file-cloudflare/src/service/fileCloudflare.ts

@@ -1,7 +1,7 @@
 import type {
   EntityFile,
-  IFileDeliveryOptions,
   IFileDirectUploadInput,
+  IFileProviderDeliveryOptions,
   IFileProviderDirectUploadResource,
   IFileProviderResource,
   IFileUploadInput,
@@ -20,6 +20,7 @@ import fse from 'fs-extra';
 import path from 'node:path';
 import { BeanBase, uuidv4 } from 'vona';
 import { Service } from 'vona-module-a-bean';
+import { downloadFileUploadUrl } from 'vona-module-a-file';
 
 import type { IFileProviderCloudflareClientOptions } from '../bean/fileProvider.cloudflare.ts';
 
@@ -67,32 +68,28 @@ export class ServiceFileCloudflare extends BeanBase {
     input: IFileUploadUrlInput,
     options: IFileProviderCloudflareClientOptions,
   ): Promise<IFileProviderResource> {
-    const response = await fetch(input.url);
-    if (!response.ok) {
-      throw new Error(`Remote file fetch failed: ${response.status}`);
+    if (!input.policy) {
+      throw new Error('Resolved file upload policy is required for remote URL ingestion');
     }
-    const tempDir = await this.app.util.getPublicPathPhysical('.temp-file-cloudflare', true);
-    const tempFile = path.join(
-      tempDir,
-      `${uuidv4()}${path.extname(input.filename ?? new URL(input.url).pathname)}`,
-    );
-    const arrayBuffer = await response.arrayBuffer();
-    await fse.writeFile(tempFile, Buffer.from(arrayBuffer));
+    const downloaded = await downloadFileUploadUrl({
+      url: input.url,
+      filename: input.filename,
+      policy: input.policy,
+    });
     try {
       return await this.upload(
         {
-          file: tempFile,
-          filename: input.filename ?? path.basename(new URL(input.url).pathname),
-          contentType: input.contentType ?? response.headers.get('content-type') ?? undefined,
-          size: input.size,
-          objectKey: input.objectKey,
+          file: downloaded.file,
+          filename: downloaded.filename,
+          contentType: downloaded.contentType,
+          size: downloaded.size,
           public: input.public,
           meta: input.meta,
         },
         options,
       );
     } finally {
-      await fse.remove(tempFile);
+      await downloaded.cleanup();
     }
   }
 
@@ -126,6 +123,43 @@ export class ServiceFileCloudflare extends BeanBase {
     };
   }
 
+  async finalizeDirectUpload(
+    file: EntityFile,
+    options: IFileProviderCloudflareClientOptions,
+  ): Promise<IFileProviderResource | undefined> {
+    let metadata;
+    try {
+      metadata = await this.getMetadata(file, options);
+    } catch (error: any) {
+      if (error?.$metadata?.httpStatusCode === 404 || error?.name === 'NotFound') return undefined;
+      throw error;
+    }
+    if (!metadata?.ContentLength) return undefined;
+    const size = Number(metadata.ContentLength);
+    if (file.size !== undefined && size !== file.size) {
+      throw new Error(`direct upload size mismatch: expected=${file.size}, actual=${size}`);
+    }
+    const contentType = metadata.ContentType?.toLowerCase();
+    if (file.contentType && contentType !== file.contentType.toLowerCase()) {
+      throw new Error(
+        `direct upload content type mismatch: expected=${file.contentType}, actual=${contentType}`,
+      );
+    }
+    return {
+      resourceId: file.resourceId,
+      bucket: file.bucket,
+      objectKey: file.objectKey,
+      filename: file.filename,
+      contentType: metadata.ContentType ?? file.contentType,
+      size,
+      etag: this._normalizeEtag(metadata.ETag),
+      public: file.public,
+      meta: file.meta,
+      deliveryBaseUrl: file.deliveryBaseUrl,
+      raw: metadata,
+    };
+  }
+
   async remove(
     file: Pick<EntityFile, 'bucket' | 'objectKey'>,
     options: IFileProviderCloudflareClientOptions,
@@ -143,7 +177,7 @@ export class ServiceFileCloudflare extends BeanBase {
   async getDownloadUrl(
     file: Pick<EntityFile, 'bucket' | 'objectKey' | 'deliveryBaseUrl' | 'public'>,
     options: IFileProviderCloudflareClientOptions,
-    deliveryOptions?: IFileDeliveryOptions,
+    deliveryOptions?: IFileProviderDeliveryOptions,
   ) {
     const normalized = this._normalizeClientOptions(options);
     const bucket = file.bucket ?? normalized.bucket;

package/vona/src/suite-vendor/a-file/modules/file-native/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vona-module-file-native",
-  "version": "5.0.3",
+  "version": "5.0.4",
   "description": "",
   "keywords": [
     "Vona Module"