canopycms 0.0.56 → 0.0.58

package/dist/assets/asset-src.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Compute the root-relative public URL for an asset's meta. Shared helper -
+ * both the API layer (list/finalize responses) and later PRs (structured
+ * image field, MediaLibrary, `assetUrl()`) build URLs through this so the
+ * URL shape is defined in exactly one place.
+ *
+ * svg/pdf: served statically from the public object finalize wrote
+ * (`assets/{hash32}/{slug}.{ext}`, via keys.ts's `publicKey`).
+ *
+ * raster: served through the transform layer using the `orig` (identity)
+ * directive. The transform engine itself is PR 4's job, but the URL shape is
+ * decided now (rather than switching every raster URL over once transforms
+ * ship) so content written by this PR stays valid without a migration.
+ *
+ * Always root-relative - `media.publicBaseUrl` is editor-display-only (PR 6's
+ * concern) and must never be baked into stored/served content URLs.
+ */
+import { IDENTITY_TRANSFORM_DIRECTIVE } from './transform-directives';
+import type { AssetMeta } from './types';
+/** Re-exported for existing importers (assets/index.ts barrel) - the value now lives in transform-directives.ts, PR 4's pure directive module, so it's reachable without pulling keys.ts's node:crypto import into client bundles. */
+export { IDENTITY_TRANSFORM_DIRECTIVE };
+export declare function assetSrc(meta: Pick<AssetMeta, 'hash32' | 'slug' | 'ext' | 'kind'>): string;
+//# sourceMappingURL=asset-src.d.ts.map

package/dist/assets/asset-src.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"asset-src.d.ts","sourceRoot":"","sources":["../../src/assets/asset-src.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAGH,OAAO,EAAE,4BAA4B,EAAE,MAAM,wBAAwB,CAAA;AACrE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,SAAS,CAAA;AAExC,sOAAsO;AACtO,OAAO,EAAE,4BAA4B,EAAE,CAAA;AAEvC,wBAAgB,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,EAAE,QAAQ,GAAG,MAAM,GAAG,KAAK,GAAG,MAAM,CAAC,GAAG,MAAM,CAK1F"}

package/dist/assets/asset-src.js

@@ -0,0 +1,28 @@
+/**
+ * Compute the root-relative public URL for an asset's meta. Shared helper -
+ * both the API layer (list/finalize responses) and later PRs (structured
+ * image field, MediaLibrary, `assetUrl()`) build URLs through this so the
+ * URL shape is defined in exactly one place.
+ *
+ * svg/pdf: served statically from the public object finalize wrote
+ * (`assets/{hash32}/{slug}.{ext}`, via keys.ts's `publicKey`).
+ *
+ * raster: served through the transform layer using the `orig` (identity)
+ * directive. The transform engine itself is PR 4's job, but the URL shape is
+ * decided now (rather than switching every raster URL over once transforms
+ * ship) so content written by this PR stays valid without a migration.
+ *
+ * Always root-relative - `media.publicBaseUrl` is editor-display-only (PR 6's
+ * concern) and must never be baked into stored/served content URLs.
+ */
+import { ASSET_PREFIXES } from './asset-prefixes.js';
+import { IDENTITY_TRANSFORM_DIRECTIVE } from './transform-directives.js';
+/** Re-exported for existing importers (assets/index.ts barrel) - the value now lives in transform-directives.ts, PR 4's pure directive module, so it's reachable without pulling keys.ts's node:crypto import into client bundles. */
+export { IDENTITY_TRANSFORM_DIRECTIVE };
+export function assetSrc(meta) {
+    if (meta.kind === 'svg' || meta.kind === 'pdf') {
+        return `/${ASSET_PREFIXES.public}/${meta.hash32}/${meta.slug}.${meta.ext}`;
+    }
+    return `/${ASSET_PREFIXES.transform}/${IDENTITY_TRANSFORM_DIRECTIVE}/${meta.hash32}/${meta.slug}.${meta.ext}`;
+}
+//# sourceMappingURL=asset-src.js.map

package/dist/assets/asset-src.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"asset-src.js","sourceRoot":"","sources":["../../src/assets/asset-src.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAA;AACjD,OAAO,EAAE,4BAA4B,EAAE,MAAM,wBAAwB,CAAA;AAGrE,sOAAsO;AACtO,OAAO,EAAE,4BAA4B,EAAE,CAAA;AAEvC,MAAM,UAAU,QAAQ,CAAC,IAAyD;IAChF,IAAI,IAAI,CAAC,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;QAC/C,OAAO,IAAI,cAAc,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,GAAG,EAAE,CAAA;IAC5E,CAAC;IACD,OAAO,IAAI,cAAc,CAAC,SAAS,IAAI,4BAA4B,IAAI,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,GAAG,EAAE,CAAA;AAC/G,CAAC"}

package/dist/assets/asset-url.d.ts

@@ -0,0 +1,35 @@
+/**
+ * Build/adjust transform URLs for `<img>`/srcset without pulling in the
+ * server-only transform engine. Isomorphic - only depends on
+ * transform-directives.ts and the plain `ASSET_PREFIXES` constant, neither
+ * of which import node builtins, so this is safe to import from client
+ * (editor) code as well as during static builds.
+ */
+import { type CropRect, type OutputFormat } from './transform-directives';
+/** The minimal shape `assetUrl`/`assetSrcSet` need from a stored asset reference. */
+export interface AssetRef {
+    src: string;
+}
+export interface AssetUrlOptions {
+    width?: number;
+    format?: OutputFormat;
+    quality?: number;
+    crop?: CropRect;
+    /** Prefixed onto the result, e.g. `media.publicBaseUrl` when the editor is served from a different origin than the site. */
+    baseUrl?: string;
+}
+/**
+ * Build a transform URL, merging `opts` over the directives already present
+ * in `ref.src` (opts win). For static srcs (svg/pdf under `/assets/{hash}/...`,
+ * or any src that isn't one of our own transform URLs) the src is returned
+ * unchanged and `opts` are ignored - there is nothing to transform.
+ */
+export declare function assetUrl(ref: AssetRef, opts?: AssetUrlOptions): string;
+/**
+ * Build a comma-joined `url w` srcset descriptor list. `widths` must all be
+ * on the transform width allowlist (multiples of 160 in [160, 4096]) - this
+ * is developer-facing (a host app's own responsive-image markup), so an
+ * invalid width throws rather than silently dropping it.
+ */
+export declare function assetSrcSet(ref: AssetRef, widths: readonly number[], opts?: Omit<AssetUrlOptions, 'width'>): string;
+//# sourceMappingURL=asset-url.d.ts.map

package/dist/assets/asset-url.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"asset-url.d.ts","sourceRoot":"","sources":["../../src/assets/asset-url.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,EAIL,KAAK,QAAQ,EACb,KAAK,YAAY,EAElB,MAAM,wBAAwB,CAAA;AAE/B,qFAAqF;AACrF,MAAM,WAAW,QAAQ;IACvB,GAAG,EAAE,MAAM,CAAA;CACZ;AAED,MAAM,WAAW,eAAe;IAC9B,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,MAAM,CAAC,EAAE,YAAY,CAAA;IACrB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,IAAI,CAAC,EAAE,QAAQ,CAAA;IACf,4HAA4H;IAC5H,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB;AA+BD;;;;;GAKG;AACH,wBAAgB,QAAQ,CAAC,GAAG,EAAE,QAAQ,EAAE,IAAI,GAAE,eAAoB,GAAG,MAAM,CAuB1E;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CACzB,GAAG,EAAE,QAAQ,EACb,MAAM,EAAE,SAAS,MAAM,EAAE,EACzB,IAAI,GAAE,IAAI,CAAC,eAAe,EAAE,OAAO,CAAM,GACxC,MAAM,CAWR"}

package/dist/assets/asset-url.js

@@ -0,0 +1,77 @@
+/**
+ * Build/adjust transform URLs for `<img>`/srcset without pulling in the
+ * server-only transform engine. Isomorphic - only depends on
+ * transform-directives.ts and the plain `ASSET_PREFIXES` constant, neither
+ * of which import node builtins, so this is safe to import from client
+ * (editor) code as well as during static builds.
+ */
+import { ASSET_PREFIXES } from './asset-prefixes.js';
+import { formatDirectives, isAllowedTransformWidth, parseTransformPath, } from './transform-directives.js';
+const TRANSFORM_URL_PREFIX = `/${ASSET_PREFIXES.transform}/`;
+function joinBaseUrl(baseUrl, urlPath) {
+    if (!baseUrl)
+        return urlPath;
+    const trimmedBase = baseUrl.endsWith('/') ? baseUrl.slice(0, -1) : baseUrl;
+    const trimmedPath = urlPath.startsWith('/') ? urlPath : `/${urlPath}`;
+    return `${trimmedBase}${trimmedPath}`;
+}
+/**
+ * Merge `opts` over an already-parsed directive set - opts win when given,
+ * otherwise the existing value (if any) carries over. Returns `undefined`
+ * fields as "unset" (there is no way to explicitly clear a directive via
+ * opts - only to override it).
+ */
+function mergeDirectives(current, opts) {
+    const existing = current.identity ? undefined : current;
+    const width = opts.width ?? existing?.width;
+    const format = opts.format ?? existing?.format;
+    const quality = opts.quality ?? existing?.quality;
+    const crop = opts.crop ?? existing?.crop;
+    if (width === undefined && format === undefined && quality === undefined && crop === undefined) {
+        return { identity: true };
+    }
+    return { identity: false, width, format, quality, crop };
+}
+/**
+ * Build a transform URL, merging `opts` over the directives already present
+ * in `ref.src` (opts win). For static srcs (svg/pdf under `/assets/{hash}/...`,
+ * or any src that isn't one of our own transform URLs) the src is returned
+ * unchanged and `opts` are ignored - there is nothing to transform.
+ */
+export function assetUrl(ref, opts = {}) {
+    const { src } = ref;
+    if (!src.startsWith(TRANSFORM_URL_PREFIX)) {
+        return joinBaseUrl(opts.baseUrl, src);
+    }
+    const rest = src.slice(TRANSFORM_URL_PREFIX.length);
+    const parsed = parseTransformPath(rest.split('/'));
+    if (!parsed.ok) {
+        // Malformed src (shouldn't happen for a src canopycms itself wrote) -
+        // nothing sensible to merge onto, so return it unchanged rather than throw.
+        return joinBaseUrl(opts.baseUrl, src);
+    }
+    const merged = mergeDirectives(parsed.directives, opts);
+    // Ext follows the format: an explicit format (new or carried over) always
+    // wins; with no format at all, the ext must keep preserving the source's
+    // real extension, which is exactly what `parsed.ext` already is here.
+    const ext = !merged.identity && merged.format !== undefined ? merged.format : parsed.ext;
+    const newSrc = `${TRANSFORM_URL_PREFIX}${formatDirectives(merged)}/${parsed.hash32}/${parsed.slug}.${ext}`;
+    return joinBaseUrl(opts.baseUrl, newSrc);
+}
+/**
+ * Build a comma-joined `url w` srcset descriptor list. `widths` must all be
+ * on the transform width allowlist (multiples of 160 in [160, 4096]) - this
+ * is developer-facing (a host app's own responsive-image markup), so an
+ * invalid width throws rather than silently dropping it.
+ */
+export function assetSrcSet(ref, widths, opts = {}) {
+    return widths
+        .map((width) => {
+        if (!isAllowedTransformWidth(width)) {
+            throw new Error(`assetSrcSet: width ${width} is not allowed (must be a multiple of 160 between 160 and 4096)`);
+        }
+        return `${assetUrl(ref, { ...opts, width })} ${width}w`;
+    })
+        .join(', ');
+}
+//# sourceMappingURL=asset-url.js.map

package/dist/assets/asset-url.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"asset-url.js","sourceRoot":"","sources":["../../src/assets/asset-url.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAA;AACjD,OAAO,EACL,gBAAgB,EAChB,uBAAuB,EACvB,kBAAkB,GAInB,MAAM,wBAAwB,CAAA;AAgB/B,MAAM,oBAAoB,GAAG,IAAI,cAAc,CAAC,SAAS,GAAG,CAAA;AAE5D,SAAS,WAAW,CAAC,OAA2B,EAAE,OAAe;IAC/D,IAAI,CAAC,OAAO;QAAE,OAAO,OAAO,CAAA;IAC5B,MAAM,WAAW,GAAG,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAA;IAC1E,MAAM,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,OAAO,EAAE,CAAA;IACrE,OAAO,GAAG,WAAW,GAAG,WAAW,EAAE,CAAA;AACvC,CAAC;AAED;;;;;GAKG;AACH,SAAS,eAAe,CAAC,OAA4B,EAAE,IAAqB;IAC1E,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAA;IAEvD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,QAAQ,EAAE,KAAK,CAAA;IAC3C,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,QAAQ,EAAE,MAAM,CAAA;IAC9C,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,QAAQ,EAAE,OAAO,CAAA;IACjD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,QAAQ,EAAE,IAAI,CAAA;IAExC,IAAI,KAAK,KAAK,SAAS,IAAI,MAAM,KAAK,SAAS,IAAI,OAAO,KAAK,SAAS,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QAC/F,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAA;IAC3B,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,CAAA;AAC1D,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,QAAQ,CAAC,GAAa,EAAE,OAAwB,EAAE;IAChE,MAAM,EAAE,GAAG,EAAE,GAAG,GAAG,CAAA;IAEnB,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,oBAAoB,CAAC,EAAE,CAAC;QAC1C,OAAO,WAAW,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,CAAA;IACvC,CAAC;IAED,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,oBAAoB,CAAC,MAAM,CAAC,CAAA;IACnD,MAAM,MAAM,GAAG,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAA;IAClD,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,sEAAsE;QACtE,4EAA4E;QAC5E,OAAO,WAAW,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,CAAA;IACvC,CAAC;IAED,MAAM,MAAM,GAAG,eAAe,CAAC,MAAM,CAAC,UAAU,EAAE,IAAI,CAAC,CAAA;IACvD,0EAA0E;IAC1E,yEAAyE;IACzE,sEAAsE;IACtE,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAA;IAExF,MAAM,MAAM,GAAG,GAAG,oBAAoB,GAAG,gBAAgB,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,IAAI,GAAG,EAAE,CAAA;IAC1G,OAAO,WAAW,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;AAC1C,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CACzB,GAAa,EACb,MAAyB,EACzB,OAAuC,EAAE;IAEzC,OAAO,MAAM;SACV,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;QACb,IAAI,CAAC,uBAAuB,CAAC,KAAK,CAAC,EAAE,CAAC;YACpC,MAAM,IAAI,KAAK,CACb,sBAAsB,KAAK,kEAAkE,CAC9F,CAAA;QACH,CAAC;QACD,OAAO,GAAG,QAAQ,CAAC,GAAG,EAAE,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,CAAC,IAAI,KAAK,GAAG,CAAA;IACzD,CAAC,CAAC;SACD,IAAI,CAAC,IAAI,CAAC,CAAA;AACf,CAAC"}

package/dist/assets/factory.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Instantiate the configured AssetStore from a site's `media` config.
+ *
+ * This is the one place that turns the (currently-unconsumed) `media` config
+ * into a real store — see .claude/future-tasks/assets-media-system.md for why
+ * this was previously dead configuration.
+ */
+import type { MediaConfig } from '../config/types';
+import type { AssetStore } from './types';
+/**
+ * @param media - The site's `media` config (`config.media`), or undefined if unset.
+ * @param opts.devAssetsDir - Root directory for the implicit local fallback store used
+ *   when `media` is undefined, or when `adapter: 'local'` omits `directory`.
+ */
+export declare function createAssetStore(media: MediaConfig | undefined, opts?: {
+    devAssetsDir?: string;
+}): AssetStore | undefined;
+//# sourceMappingURL=factory.d.ts.map

package/dist/assets/factory.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"factory.d.ts","sourceRoot":"","sources":["../../src/assets/factory.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAA;AAGlD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,SAAS,CAAA;AAEzC;;;;GAIG;AACH,wBAAgB,gBAAgB,CAC9B,KAAK,EAAE,WAAW,GAAG,SAAS,EAC9B,IAAI,GAAE;IAAE,YAAY,CAAC,EAAE,MAAM,CAAA;CAAO,GACnC,UAAU,GAAG,SAAS,CA2BxB"}

package/dist/assets/factory.js

@@ -0,0 +1,42 @@
+/**
+ * Instantiate the configured AssetStore from a site's `media` config.
+ *
+ * This is the one place that turns the (currently-unconsumed) `media` config
+ * into a real store — see .claude/future-tasks/assets-media-system.md for why
+ * this was previously dead configuration.
+ */
+import { LocalAssetStore } from './store-local.js';
+import { S3AssetStore } from './store-s3.js';
+/**
+ * @param media - The site's `media` config (`config.media`), or undefined if unset.
+ * @param opts.devAssetsDir - Root directory for the implicit local fallback store used
+ *   when `media` is undefined, or when `adapter: 'local'` omits `directory`.
+ */
+export function createAssetStore(media, opts = {}) {
+    if (!media) {
+        return opts.devAssetsDir ? new LocalAssetStore({ root: opts.devAssetsDir }) : undefined;
+    }
+    switch (media.adapter) {
+        case 's3':
+            return new S3AssetStore({
+                bucket: media.bucket,
+                region: media.region,
+                publicBaseUrl: media.publicBaseUrl,
+                maxUploadBytes: media.maxUploadBytes,
+            });
+        case 'local': {
+            const root = media.directory ?? opts.devAssetsDir;
+            return root ? new LocalAssetStore({ root }) : undefined;
+        }
+        case 'lfs':
+            // Config literal kept for forward compatibility; no lfs adapter is
+            // implemented yet (see BACKLOG.md "Asset adapters").
+            return undefined;
+        default:
+            // Defensive: mediaSchema is a closed discriminated union, so this is
+            // unreachable via validated config, but guards against an unrecognized
+            // adapter string reaching here some other way.
+            return undefined;
+    }
+}
+//# sourceMappingURL=factory.js.map

package/dist/assets/factory.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"factory.js","sourceRoot":"","sources":["../../src/assets/factory.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAA;AAC/C,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAA;AAGzC;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAC9B,KAA8B,EAC9B,OAAkC,EAAE;IAEpC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,eAAe,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;IACzF,CAAC;IAED,QAAQ,KAAK,CAAC,OAAO,EAAE,CAAC;QACtB,KAAK,IAAI;YACP,OAAO,IAAI,YAAY,CAAC;gBACtB,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,aAAa,EAAE,KAAK,CAAC,aAAa;gBAClC,cAAc,EAAE,KAAK,CAAC,cAAc;aACrC,CAAC,CAAA;QACJ,KAAK,OAAO,CAAC,CAAC,CAAC;YACb,MAAM,IAAI,GAAG,KAAK,CAAC,SAAS,IAAI,IAAI,CAAC,YAAY,CAAA;YACjD,OAAO,IAAI,CAAC,CAAC,CAAC,IAAI,eAAe,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;QACzD,CAAC;QACD,KAAK,KAAK;YACR,mEAAmE;YACnE,qDAAqD;YACrD,OAAO,SAAS,CAAA;QAClB;YACE,qEAAqE;YACrE,uEAAuE;YACvE,+CAA+C;YAC/C,OAAO,SAAS,CAAA;IACpB,CAAC;AACH,CAAC"}

package/dist/assets/finalize.d.ts

@@ -0,0 +1,36 @@
+/**
+ * Store orchestration around the (pure) finalize pipeline: dedup, write, and
+ * best-effort staging cleanup. Split from pipeline.ts so the pipeline itself
+ * stays store-agnostic and trivially unit-testable with plain byte fixtures.
+ */
+import { type FinalizeInput, type FinalizeRejection } from './pipeline';
+import type { AssetMeta, AssetStore } from './types';
+export declare function isValidStagingKey(key: string): boolean;
+export type FinalizeAssetResult = {
+    ok: true;
+    meta: AssetMeta;
+} | FinalizeRejection;
+/**
+ * Run the finalize pipeline over raw bytes and persist the result.
+ *
+ * Order matters here too: dedup FIRST (after hashing, inside the pipeline) -
+ * if an identical blob already exists, return the existing meta and skip all
+ * writes entirely (first-name-wins). Otherwise write the original, then the
+ * optional public object, then `putMetaIfAbsent` LAST: meta is the commit
+ * point for an asset's existence, so a crash between `putOriginal` and here
+ * leaves only orphaned (harmless, content-addressed) blobs, never a meta
+ * record pointing at a missing blob.
+ */
+export declare function finalizeAsset(store: AssetStore, input: FinalizeInput): Promise<FinalizeAssetResult>;
+/**
+ * Finalize a previously-staged upload: read the staged bytes, run
+ * `finalizeAsset`, and best-effort delete the staging object regardless of
+ * outcome (success OR pipeline rejection - a rejected upload's staged bytes
+ * are just as much litter as an accepted one's).
+ */
+export declare function finalizeStagedUpload(store: AssetStore, stagingKey: string, filename: string, uploadedBy?: string): Promise<FinalizeAssetResult | {
+    ok: false;
+    status: 400 | 404;
+    error: string;
+}>;
+//# sourceMappingURL=finalize.d.ts.map

package/dist/assets/finalize.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"finalize.d.ts","sourceRoot":"","sources":["../../src/assets/finalize.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAuB,KAAK,aAAa,EAAE,KAAK,iBAAiB,EAAE,MAAM,YAAY,CAAA;AAE5F,OAAO,KAAK,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,SAAS,CAAA;AAYpD,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAGtD;AAED,MAAM,MAAM,mBAAmB,GAAG;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,SAAS,CAAA;CAAE,GAAG,iBAAiB,CAAA;AAEnF;;;;;;;;;;GAUG;AACH,wBAAsB,aAAa,CACjC,KAAK,EAAE,UAAU,EACjB,KAAK,EAAE,aAAa,GACnB,OAAO,CAAC,mBAAmB,CAAC,CAuB9B;AAED;;;;;GAKG;AACH,wBAAsB,oBAAoB,CACxC,KAAK,EAAE,UAAU,EACjB,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,MAAM,EAChB,UAAU,CAAC,EAAE,MAAM,GAClB,OAAO,CAAC,mBAAmB,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,GAAG,GAAG,GAAG,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,CAYhF"}

package/dist/assets/finalize.js

@@ -0,0 +1,72 @@
+/**
+ * Store orchestration around the (pure) finalize pipeline: dedup, write, and
+ * best-effort staging cleanup. Split from pipeline.ts so the pipeline itself
+ * stays store-agnostic and trivially unit-testable with plain byte fixtures.
+ */
+import { runFinalizePipeline } from './pipeline.js';
+import { ASSET_PREFIXES } from './keys.js';
+/**
+ * A client-supplied staging key must be exactly `asset-staging/{uuid}` — the
+ * shape beginUpload generates. Without this check, finalize's read + cleanup
+ * would operate on ANY key the store can reach (asset-meta/, asset-originals/,
+ * or in a shared bucket even builds/), letting a non-admin delete arbitrary
+ * objects via the best-effort deleteStaging. Stores with overridden staging
+ * prefixes must parameterize this check if that escape hatch is ever used.
+ */
+const STAGING_UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
+export function isValidStagingKey(key) {
+    const prefix = `${ASSET_PREFIXES.staging}/`;
+    return key.startsWith(prefix) && STAGING_UUID_PATTERN.test(key.slice(prefix.length));
+}
+/**
+ * Run the finalize pipeline over raw bytes and persist the result.
+ *
+ * Order matters here too: dedup FIRST (after hashing, inside the pipeline) -
+ * if an identical blob already exists, return the existing meta and skip all
+ * writes entirely (first-name-wins). Otherwise write the original, then the
+ * optional public object, then `putMetaIfAbsent` LAST: meta is the commit
+ * point for an asset's existence, so a crash between `putOriginal` and here
+ * leaves only orphaned (harmless, content-addressed) blobs, never a meta
+ * record pointing at a missing blob.
+ */
+export async function finalizeAsset(store, input) {
+    const result = await runFinalizePipeline(input);
+    if (!result.ok)
+        return result;
+    const { meta, data, publicObject } = result;
+    const existing = await store.getMeta(meta.hash32);
+    if (existing)
+        return { ok: true, meta: existing };
+    await store.putOriginal({ hash32: meta.hash32, ext: meta.ext, data, contentType: meta.mime });
+    if (publicObject) {
+        await store.putPublicObject(publicObject);
+    }
+    const putResult = await store.putMetaIfAbsent(meta.hash32, meta);
+    if (putResult === 'already-exists') {
+        // Lost a race against a concurrent identical upload - the winner's meta
+        // (already committed) is authoritative; return it rather than ours.
+        const winner = await store.getMeta(meta.hash32);
+        if (winner)
+            return { ok: true, meta: winner };
+    }
+    return { ok: true, meta };
+}
+/**
+ * Finalize a previously-staged upload: read the staged bytes, run
+ * `finalizeAsset`, and best-effort delete the staging object regardless of
+ * outcome (success OR pipeline rejection - a rejected upload's staged bytes
+ * are just as much litter as an accepted one's).
+ */
+export async function finalizeStagedUpload(store, stagingKey, filename, uploadedBy) {
+    if (!isValidStagingKey(stagingKey)) {
+        return { ok: false, status: 400, error: 'Invalid staging key' };
+    }
+    const staged = await store.readStaging(stagingKey);
+    if (!staged) {
+        return { ok: false, status: 404, error: 'Staged upload not found or expired' };
+    }
+    const result = await finalizeAsset(store, { data: staged, filename, uploadedBy });
+    await store.deleteStaging(stagingKey).catch(() => { });
+    return result;
+}
+//# sourceMappingURL=finalize.js.map

package/dist/assets/finalize.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"finalize.js","sourceRoot":"","sources":["../../src/assets/finalize.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,mBAAmB,EAA8C,MAAM,YAAY,CAAA;AAC5F,OAAO,EAAE,cAAc,EAAE,MAAM,QAAQ,CAAA;AAGvC;;;;;;;GAOG;AACH,MAAM,oBAAoB,GAAG,gEAAgE,CAAA;AAE7F,MAAM,UAAU,iBAAiB,CAAC,GAAW;IAC3C,MAAM,MAAM,GAAG,GAAG,cAAc,CAAC,OAAO,GAAG,CAAA;IAC3C,OAAO,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,oBAAoB,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAA;AACtF,CAAC;AAID;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,KAAiB,EACjB,KAAoB;IAEpB,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,KAAK,CAAC,CAAA;IAC/C,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,OAAO,MAAM,CAAA;IAE7B,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,MAAM,CAAA;IAE3C,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;IACjD,IAAI,QAAQ;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAA;IAEjD,MAAM,KAAK,CAAC,WAAW,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAA;IAC7F,IAAI,YAAY,EAAE,CAAC;QACjB,MAAM,KAAK,CAAC,eAAe,CAAC,YAAY,CAAC,CAAA;IAC3C,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC,eAAe,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;IAChE,IAAI,SAAS,KAAK,gBAAgB,EAAE,CAAC;QACnC,wEAAwE;QACxE,oEAAoE;QACpE,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;QAC/C,IAAI,MAAM;YAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,CAAA;IAC/C,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAA;AAC3B,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,KAAiB,EACjB,UAAkB,EAClB,QAAgB,EAChB,UAAmB;IAEnB,IAAI,CAAC,iBAAiB,CAAC,UAAU,CAAC,EAAE,CAAC;QACnC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,qBAAqB,EAAE,CAAA;IACjE,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,WAAW,CAAC,UAAU,CAAC,CAAA;IAClD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,oCAAoC,EAAE,CAAA;IAChF,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC,CAAA;IACjF,MAAM,KAAK,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;IACrD,OAAO,MAAM,CAAA;AACf,CAAC"}

package/dist/assets/index.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Internal module barrel for the assets/ store implementation. NOT a package
+ * entrypoint — server code within canopycms imports from here or from the
+ * individual files; client-side code (the editor) must `import type` from
+ * ./types directly instead, so node:fs/S3-SDK imports never reach a browser
+ * bundle.
+ */
+export type { AssetMeta, AssetStore, BeginUploadInput, PublicObject, StagedUploadTarget, } from './types';
+export { ASSET_PREFIXES, createKeyBuilders, hashBytes, metaKey, metaPrefix, originalKey, originalPrefix, publicKey, slugifyFilename, stagingKey, type AssetPrefixes, } from './keys';
+export { LocalAssetStore, type LocalAssetStoreOptions } from './store-local';
+export { S3AssetStore, type S3AssetStoreOptions } from './store-s3';
+export { createAssetStore } from './factory';
+export { ALLOWED_UPLOAD_CONTENT_TYPES, runFinalizePipeline, type FinalizeInput, type FinalizePublicObject, type FinalizeResult, type FinalizeRejection, type FinalizeSuccess, } from './pipeline';
+export { finalizeAsset, finalizeStagedUpload, type FinalizeAssetResult } from './finalize';
+export { sanitizeSvg } from './svg-sanitizer';
+export { assetSrc, IDENTITY_TRANSFORM_DIRECTIVE } from './asset-src';
+export { formatDirectives, isAllowedTransformWidth, isValidCropRect, parseTransformPath, type CropRect, type IdentityDirectives, type OutputFormat, type ParsedTransformPath, type ParseTransformPathResult, type ResizeDirectives, type TransformDirectives, } from './transform-directives';
+export { applyTransform, type ApplyTransformInput, type TransformResult } from './transform';
+export { assetUrl, assetSrcSet, type AssetRef, type AssetUrlOptions } from './asset-url';
+//# sourceMappingURL=index.d.ts.map

package/dist/assets/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/assets/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,YAAY,EACV,SAAS,EACT,UAAU,EACV,gBAAgB,EAChB,YAAY,EACZ,kBAAkB,GACnB,MAAM,SAAS,CAAA;AAEhB,OAAO,EACL,cAAc,EACd,iBAAiB,EACjB,SAAS,EACT,OAAO,EACP,UAAU,EACV,WAAW,EACX,cAAc,EACd,SAAS,EACT,eAAe,EACf,UAAU,EACV,KAAK,aAAa,GACnB,MAAM,QAAQ,CAAA;AAEf,OAAO,EAAE,eAAe,EAAE,KAAK,sBAAsB,EAAE,MAAM,eAAe,CAAA;AAC5E,OAAO,EAAE,YAAY,EAAE,KAAK,mBAAmB,EAAE,MAAM,YAAY,CAAA;AACnE,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAA;AAE5C,OAAO,EACL,4BAA4B,EAC5B,mBAAmB,EACnB,KAAK,aAAa,EAClB,KAAK,oBAAoB,EACzB,KAAK,cAAc,EACnB,KAAK,iBAAiB,EACtB,KAAK,eAAe,GACrB,MAAM,YAAY,CAAA;AAEnB,OAAO,EAAE,aAAa,EAAE,oBAAoB,EAAE,KAAK,mBAAmB,EAAE,MAAM,YAAY,CAAA;AAE1F,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAA;AAE7C,OAAO,EAAE,QAAQ,EAAE,4BAA4B,EAAE,MAAM,aAAa,CAAA;AAEpE,OAAO,EACL,gBAAgB,EAChB,uBAAuB,EACvB,eAAe,EACf,kBAAkB,EAClB,KAAK,QAAQ,EACb,KAAK,kBAAkB,EACvB,KAAK,YAAY,EACjB,KAAK,mBAAmB,EACxB,KAAK,wBAAwB,EAC7B,KAAK,gBAAgB,EACrB,KAAK,mBAAmB,GACzB,MAAM,wBAAwB,CAAA;AAE/B,OAAO,EAAE,cAAc,EAAE,KAAK,mBAAmB,EAAE,KAAK,eAAe,EAAE,MAAM,aAAa,CAAA;AAE5F,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,KAAK,QAAQ,EAAE,KAAK,eAAe,EAAE,MAAM,aAAa,CAAA"}

package/dist/assets/index.js

@@ -0,0 +1,19 @@
+/**
+ * Internal module barrel for the assets/ store implementation. NOT a package
+ * entrypoint — server code within canopycms imports from here or from the
+ * individual files; client-side code (the editor) must `import type` from
+ * ./types directly instead, so node:fs/S3-SDK imports never reach a browser
+ * bundle.
+ */
+export { ASSET_PREFIXES, createKeyBuilders, hashBytes, metaKey, metaPrefix, originalKey, originalPrefix, publicKey, slugifyFilename, stagingKey, } from './keys.js';
+export { LocalAssetStore } from './store-local.js';
+export { S3AssetStore } from './store-s3.js';
+export { createAssetStore } from './factory.js';
+export { ALLOWED_UPLOAD_CONTENT_TYPES, runFinalizePipeline, } from './pipeline.js';
+export { finalizeAsset, finalizeStagedUpload } from './finalize.js';
+export { sanitizeSvg } from './svg-sanitizer.js';
+export { assetSrc, IDENTITY_TRANSFORM_DIRECTIVE } from './asset-src.js';
+export { formatDirectives, isAllowedTransformWidth, isValidCropRect, parseTransformPath, } from './transform-directives.js';
+export { applyTransform } from './transform.js';
+export { assetUrl, assetSrcSet } from './asset-url.js';
+//# sourceMappingURL=index.js.map

package/dist/assets/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/assets/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAUH,OAAO,EACL,cAAc,EACd,iBAAiB,EACjB,SAAS,EACT,OAAO,EACP,UAAU,EACV,WAAW,EACX,cAAc,EACd,SAAS,EACT,eAAe,EACf,UAAU,GAEX,MAAM,QAAQ,CAAA;AAEf,OAAO,EAAE,eAAe,EAA+B,MAAM,eAAe,CAAA;AAC5E,OAAO,EAAE,YAAY,EAA4B,MAAM,YAAY,CAAA;AACnE,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAA;AAE5C,OAAO,EACL,4BAA4B,EAC5B,mBAAmB,GAMpB,MAAM,YAAY,CAAA;AAEnB,OAAO,EAAE,aAAa,EAAE,oBAAoB,EAA4B,MAAM,YAAY,CAAA;AAE1F,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAA;AAE7C,OAAO,EAAE,QAAQ,EAAE,4BAA4B,EAAE,MAAM,aAAa,CAAA;AAEpE,OAAO,EACL,gBAAgB,EAChB,uBAAuB,EACvB,eAAe,EACf,kBAAkB,GAQnB,MAAM,wBAAwB,CAAA;AAE/B,OAAO,EAAE,cAAc,EAAkD,MAAM,aAAa,CAAA;AAE5F,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAuC,MAAM,aAAa,CAAA"}

package/dist/assets/keys.d.ts

@@ -0,0 +1,56 @@
+/**
+ * Pure key/hash/slug helpers for the asset store. No filesystem or network I/O
+ * here — keeps this file trivially unit-testable and safe to reason about for
+ * path-traversal / header-injection concerns.
+ *
+ * Bucket-prefix layout (see .claude/future-tasks/assets-media-system.md):
+ *   asset-originals/{hash32}.{ext}          private; full-fidelity originals
+ *   asset-staging/{uuid}                    presigned-POST target
+ *   asset-meta/{hash32}.json                private; filename/uploader/dims/mime
+ *   assets/t/{directives}/{hash32}/{slug}   transform outputs (see transform-directives.ts)
+ *   assets/{hash32}/{slug}.{ext}            public static: sanitized SVG + PDF only
+ *
+ * Stores must build keys through these helpers rather than hand-rolling prefix
+ * strings, so the layout stays defined in exactly one place.
+ */
+import { ASSET_PREFIXES, type AssetPrefixes } from './asset-prefixes';
+export { ASSET_PREFIXES, type AssetPrefixes };
+/** sha-256 of the given bytes, truncated to 32 hex chars (128 bits). */
+export declare function hashBytes(data: Uint8Array): string;
+/**
+ * Slugify an (untrusted) original filename into a safe slug + normalized
+ * extension. Never trust the input for path or header use directly — this
+ * strips directory components, non-ASCII/unsafe characters, and caps length.
+ *
+ * - Directory components (`/`, `\`, including `..` segments) are dropped —
+ *   only the final path segment is considered.
+ * - The slug charset is restricted to `[a-z0-9-]`; anything else (spaces,
+ *   unicode, punctuation) collapses to a single `-`, with leading/trailing
+ *   dashes stripped.
+ * - Diacritics are stripped (NFKD) before charset filtering, so an accented
+ *   "e"-with-acute-accent becomes plain "e" rather than being dropped entirely.
+ * - The extension (text after the last `.` in the final segment) is
+ *   lowercased and restricted to `[a-z0-9]`, capped at 10 chars.
+ * - An empty/unsafe result falls back to a fixed slug so callers never see
+ *   an empty string.
+ */
+export declare function slugifyFilename(name: string): {
+    slug: string;
+    ext: string;
+};
+/**
+ * Build the key helpers bound to a given prefix set. Stores that support prefix
+ * overrides (currently S3AssetStore) call this with their configured prefixes;
+ * everyone else uses the default export instances below.
+ */
+export declare function createKeyBuilders(prefixes?: AssetPrefixes): {
+    originalKey: (hash32: string, ext: string) => string;
+    /** Prefix used to look up an original by hash32 alone (extension unknown ahead of time). */
+    originalPrefix: (hash32: string) => string;
+    stagingKey: (uuid: string) => string;
+    metaKey: (hash32: string) => string;
+    metaPrefix: () => string;
+    publicKey: (hash32: string, slug: string, ext: string) => string;
+};
+export declare const originalKey: (hash32: string, ext: string) => string, originalPrefix: (hash32: string) => string, stagingKey: (uuid: string) => string, metaKey: (hash32: string) => string, metaPrefix: () => string, publicKey: (hash32: string, slug: string, ext: string) => string;
+//# sourceMappingURL=keys.d.ts.map

package/dist/assets/keys.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"keys.d.ts","sourceRoot":"","sources":["../../src/assets/keys.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAIH,OAAO,EAAE,cAAc,EAAE,KAAK,aAAa,EAAE,MAAM,kBAAkB,CAAA;AAErE,OAAO,EAAE,cAAc,EAAE,KAAK,aAAa,EAAE,CAAA;AAE7C,wEAAwE;AACxE,wBAAgB,SAAS,CAAC,IAAI,EAAE,UAAU,GAAG,MAAM,CAElD;AAMD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAkC3E;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,GAAE,aAA8B;0BAEhD,MAAM,OAAO,MAAM,KAAG,MAAM;IAClD,4FAA4F;6BACnE,MAAM,KAAG,MAAM;uBACrB,MAAM,KAAG,MAAM;sBAChB,MAAM,KAAG,MAAM;sBACjB,MAAM;wBACF,MAAM,QAAQ,MAAM,OAAO,MAAM,KAAG,MAAM;EAGjE;AAED,eAAO,MAAQ,WAAW,WAXA,MAAM,OAAO,MAAM,KAAG,MAAM,EAW1B,cAAc,WATb,MAAM,KAAG,MAAM,EASA,UAAU,SAR/B,MAAM,KAAG,MAAM,EAQkB,OAAO,WAPzC,MAAM,KAAG,MAAM,EAO4B,UAAU,QANvD,MAAM,EAMmD,SAAS,WAL9D,MAAM,QAAQ,MAAM,OAAO,MAAM,KAAG,MAMvC,CAAA"}

package/dist/assets/keys.js

@@ -0,0 +1,88 @@
+/**
+ * Pure key/hash/slug helpers for the asset store. No filesystem or network I/O
+ * here — keeps this file trivially unit-testable and safe to reason about for
+ * path-traversal / header-injection concerns.
+ *
+ * Bucket-prefix layout (see .claude/future-tasks/assets-media-system.md):
+ *   asset-originals/{hash32}.{ext}          private; full-fidelity originals
+ *   asset-staging/{uuid}                    presigned-POST target
+ *   asset-meta/{hash32}.json                private; filename/uploader/dims/mime
+ *   assets/t/{directives}/{hash32}/{slug}   transform outputs (see transform-directives.ts)
+ *   assets/{hash32}/{slug}.{ext}            public static: sanitized SVG + PDF only
+ *
+ * Stores must build keys through these helpers rather than hand-rolling prefix
+ * strings, so the layout stays defined in exactly one place.
+ */
+import { createHash } from 'node:crypto';
+import { ASSET_PREFIXES } from './asset-prefixes.js';
+export { ASSET_PREFIXES };
+/** sha-256 of the given bytes, truncated to 32 hex chars (128 bits). */
+export function hashBytes(data) {
+    return createHash('sha256').update(data).digest('hex').slice(0, 32);
+}
+const MAX_SLUG_LENGTH = 80;
+const MAX_EXT_LENGTH = 10;
+const FALLBACK_SLUG = 'file';
+/**
+ * Slugify an (untrusted) original filename into a safe slug + normalized
+ * extension. Never trust the input for path or header use directly — this
+ * strips directory components, non-ASCII/unsafe characters, and caps length.
+ *
+ * - Directory components (`/`, `\`, including `..` segments) are dropped —
+ *   only the final path segment is considered.
+ * - The slug charset is restricted to `[a-z0-9-]`; anything else (spaces,
+ *   unicode, punctuation) collapses to a single `-`, with leading/trailing
+ *   dashes stripped.
+ * - Diacritics are stripped (NFKD) before charset filtering, so an accented
+ *   "e"-with-acute-accent becomes plain "e" rather than being dropped entirely.
+ * - The extension (text after the last `.` in the final segment) is
+ *   lowercased and restricted to `[a-z0-9]`, capped at 10 chars.
+ * - An empty/unsafe result falls back to a fixed slug so callers never see
+ *   an empty string.
+ */
+export function slugifyFilename(name) {
+    // Drop any directory components (handles both `/` and `\`, and `..` segments)
+    // so the untrusted original filename can never influence a constructed path.
+    const segments = name.split(/[/\\]+/);
+    const basename = segments[segments.length - 1] ?? '';
+    const lastDot = basename.lastIndexOf('.');
+    const hasExt = lastDot > 0 && lastDot < basename.length - 1;
+    const base = hasExt ? basename.slice(0, lastDot) : basename;
+    const extRaw = hasExt ? basename.slice(lastDot + 1) : '';
+    const ext = extRaw
+        .toLowerCase()
+        .replace(/[^a-z0-9]/g, '')
+        .slice(0, MAX_EXT_LENGTH);
+    // U+0300-U+036F is the combining-diacritical-marks block, stripped after NFKD
+    // decomposition. Built from fixed char codes (not a literal regex) so this
+    // file's source stays pure ASCII; the pattern is not derived from input, so
+    // there is no injection risk despite the non-literal RegExp constructor.
+    // eslint-disable-next-line security/detect-non-literal-regexp
+    const COMBINING_MARKS = new RegExp(`[${String.fromCharCode(0x0300)}-${String.fromCharCode(0x036f)}]`, 'g');
+    let slug = base
+        .normalize('NFKD')
+        .replace(COMBINING_MARKS, '')
+        .toLowerCase()
+        .replace(/[^a-z0-9]+/g, '-')
+        .replace(/^-+|-+$/g, '');
+    slug = slug.slice(0, MAX_SLUG_LENGTH).replace(/-+$/g, '');
+    return { slug: slug || FALLBACK_SLUG, ext };
+}
+/**
+ * Build the key helpers bound to a given prefix set. Stores that support prefix
+ * overrides (currently S3AssetStore) call this with their configured prefixes;
+ * everyone else uses the default export instances below.
+ */
+export function createKeyBuilders(prefixes = ASSET_PREFIXES) {
+    return {
+        originalKey: (hash32, ext) => `${prefixes.originals}/${hash32}.${ext}`,
+        /** Prefix used to look up an original by hash32 alone (extension unknown ahead of time). */
+        originalPrefix: (hash32) => `${prefixes.originals}/${hash32}.`,
+        stagingKey: (uuid) => `${prefixes.staging}/${uuid}`,
+        metaKey: (hash32) => `${prefixes.meta}/${hash32}.json`,
+        metaPrefix: () => `${prefixes.meta}/`,
+        publicKey: (hash32, slug, ext) => `${prefixes.public}/${hash32}/${slug}.${ext}`,
+    };
+}
+export const { originalKey, originalPrefix, stagingKey, metaKey, metaPrefix, publicKey } = createKeyBuilders();
+//# sourceMappingURL=keys.js.map

package/dist/assets/keys.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"keys.js","sourceRoot":"","sources":["../../src/assets/keys.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAExC,OAAO,EAAE,cAAc,EAAsB,MAAM,kBAAkB,CAAA;AAErE,OAAO,EAAE,cAAc,EAAsB,CAAA;AAE7C,wEAAwE;AACxE,MAAM,UAAU,SAAS,CAAC,IAAgB;IACxC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;AACrE,CAAC;AAED,MAAM,eAAe,GAAG,EAAE,CAAA;AAC1B,MAAM,cAAc,GAAG,EAAE,CAAA;AACzB,MAAM,aAAa,GAAG,MAAM,CAAA;AAE5B;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,eAAe,CAAC,IAAY;IAC1C,8EAA8E;IAC9E,6EAA6E;IAC7E,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAA;IACrC,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,CAAA;IAEpD,MAAM,OAAO,GAAG,QAAQ,CAAC,WAAW,CAAC,GAAG,CAAC,CAAA;IACzC,MAAM,MAAM,GAAG,OAAO,GAAG,CAAC,IAAI,OAAO,GAAG,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAA;IAC3D,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAA;IAC3D,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;IAExD,MAAM,GAAG,GAAG,MAAM;SACf,WAAW,EAAE;SACb,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC;SACzB,KAAK,CAAC,CAAC,EAAE,cAAc,CAAC,CAAA;IAE3B,8EAA8E;IAC9E,2EAA2E;IAC3E,4EAA4E;IAC5E,yEAAyE;IACzE,8DAA8D;IAC9D,MAAM,eAAe,GAAG,IAAI,MAAM,CAChC,IAAI,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,GAAG,EACjE,GAAG,CACJ,CAAA;IACD,IAAI,IAAI,GAAG,IAAI;SACZ,SAAS,CAAC,MAAM,CAAC;SACjB,OAAO,CAAC,eAAe,EAAE,EAAE,CAAC;SAC5B,WAAW,EAAE;SACb,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC;SAC3B,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAA;IAC1B,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,eAAe,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;IAEzD,OAAO,EAAE,IAAI,EAAE,IAAI,IAAI,aAAa,EAAE,GAAG,EAAE,CAAA;AAC7C,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,WAA0B,cAAc;IACxE,OAAO;QACL,WAAW,EAAE,CAAC,MAAc,EAAE,GAAW,EAAU,EAAE,CAAC,GAAG,QAAQ,CAAC,SAAS,IAAI,MAAM,IAAI,GAAG,EAAE;QAC9F,4FAA4F;QAC5F,cAAc,EAAE,CAAC,MAAc,EAAU,EAAE,CAAC,GAAG,QAAQ,CAAC,SAAS,IAAI,MAAM,GAAG;QAC9E,UAAU,EAAE,CAAC,IAAY,EAAU,EAAE,CAAC,GAAG,QAAQ,CAAC,OAAO,IAAI,IAAI,EAAE;QACnE,OAAO,EAAE,CAAC,MAAc,EAAU,EAAE,CAAC,GAAG,QAAQ,CAAC,IAAI,IAAI,MAAM,OAAO;QACtE,UAAU,EAAE,GAAW,EAAE,CAAC,GAAG,QAAQ,CAAC,IAAI,GAAG;QAC7C,SAAS,EAAE,CAAC,MAAc,EAAE,IAAY,EAAE,GAAW,EAAU,EAAE,CAC/D,GAAG,QAAQ,CAAC,MAAM,IAAI,MAAM,IAAI,IAAI,IAAI,GAAG,EAAE;KAChD,CAAA;AACH,CAAC;AAED,MAAM,CAAC,MAAM,EAAE,WAAW,EAAE,cAAc,EAAE,UAAU,EAAE,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,GACtF,iBAAiB,EAAE,CAAA"}