canopycms 0.0.56 → 0.0.58

package/dist/assets/store-s3.d.ts

@@ -0,0 +1,71 @@
+/**
+ * S3-backed AssetStore. Same bucket-prefix layout as LocalAssetStore (see
+ * keys.ts). Assumes an EXISTING content bucket (versioning/SSE/replication
+ * already configured by the site's CDK stack) — this store only ever reads
+ * and writes objects under the five asset prefixes.
+ */
+import { type AssetPrefixes } from './keys';
+import type { AssetMeta, AssetStore, BeginUploadInput, PublicObject, StagedUploadTarget } from './types';
+export interface S3AssetStoreOptions {
+    bucket: string;
+    region: string;
+    publicBaseUrl?: string;
+    /** Defaults to 50 MiB. */
+    maxUploadBytes?: number;
+    /** Override the default bucket-prefix layout (rarely needed). */
+    prefixes?: AssetPrefixes;
+}
+export declare class S3AssetStore implements AssetStore {
+    readonly capabilities: {
+        directUpload: boolean;
+    };
+    private readonly client;
+    private readonly bucket;
+    private readonly maxUploadBytes;
+    private readonly keys;
+    private readonly stagingPrefix;
+    constructor(options: S3AssetStoreOptions);
+    /**
+     * Staging methods accept caller-influenced keys (finalize receives the key
+     * from the client), so they must never operate outside the staging prefix —
+     * in a shared content bucket an unguarded deleteStaging would reach deploy
+     * artifacts under builds/. The API layer validates too; defense-in-depth.
+     */
+    private assertStagingKey;
+    beginUpload(input: BeginUploadInput): Promise<StagedUploadTarget>;
+    writeStaging(key: string, data: Uint8Array, contentType?: string): Promise<void>;
+    readStaging(key: string): Promise<Uint8Array | null>;
+    deleteStaging(key: string): Promise<void>;
+    putOriginal(input: {
+        hash32: string;
+        ext: string;
+        data: Uint8Array;
+        contentType: string;
+    }): Promise<void>;
+    readOriginal(hash32: string): Promise<{
+        data: Uint8Array;
+        ext: string;
+        contentType?: string;
+    } | null>;
+    putPublicObject(input: {
+        key: string;
+        data: Uint8Array;
+        contentType: string;
+        contentDisposition?: string;
+        cacheControl?: string;
+    }): Promise<void>;
+    readPublicObject(key: string): Promise<PublicObject | null>;
+    putMetaIfAbsent(hash32: string, meta: AssetMeta): Promise<'created' | 'already-exists'>;
+    getMeta(hash32: string): Promise<AssetMeta | null>;
+    listMeta(input?: {
+        cursor?: string;
+        limit?: number;
+    }): Promise<{
+        items: AssetMeta[];
+        nextCursor?: string;
+    }>;
+    deleteMeta(hash32: string): Promise<void>;
+    private getObject;
+    private getObjectBytes;
+}
+//# sourceMappingURL=store-s3.d.ts.map

package/dist/assets/store-s3.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"store-s3.d.ts","sourceRoot":"","sources":["../../src/assets/store-s3.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAYH,OAAO,EAAqC,KAAK,aAAa,EAAE,MAAM,QAAQ,CAAA;AAC9E,OAAO,KAAK,EACV,SAAS,EACT,UAAU,EACV,gBAAgB,EAChB,YAAY,EACZ,kBAAkB,EACnB,MAAM,SAAS,CAAA;AAEhB,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,MAAM,CAAA;IACd,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,0BAA0B;IAC1B,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,iEAAiE;IACjE,QAAQ,CAAC,EAAE,aAAa,CAAA;CACzB;AA2BD,qBAAa,YAAa,YAAW,UAAU;IAC7C,QAAQ,CAAC,YAAY;;MAAyB;IAC9C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAU;IACjC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAQ;IAC/B,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAQ;IACvC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAsC;IAC3D,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAQ;gBAE1B,OAAO,EAAE,mBAAmB;IASxC;;;;;OAKG;IACH,OAAO,CAAC,gBAAgB;IAMlB,WAAW,CAAC,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAiBjE,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAOhF,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC;IAKpD,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAKzC,WAAW,CAAC,KAAK,EAAE;QACvB,MAAM,EAAE,MAAM,CAAA;QACd,GAAG,EAAE,MAAM,CAAA;QACX,IAAI,EAAE,UAAU,CAAA;QAChB,WAAW,EAAE,MAAM,CAAA;KACpB,GAAG,OAAO,CAAC,IAAI,CAAC;IAWX,YAAY,CAChB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC;QAAE,IAAI,EAAE,UAAU,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IAepE,eAAe,CAAC,KAAK,EAAE;QAC3B,GAAG,EAAE,MAAM,CAAA;QACX,IAAI,EAAE,UAAU,CAAA;QAChB,WAAW,EAAE,MAAM,CAAA;QACnB,kBAAkB,CAAC,EAAE,MAAM,CAAA;QAC3B,YAAY,CAAC,EAAE,MAAM,CAAA;KACtB,GAAG,OAAO,CAAC,IAAI,CAAC;IAaX,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC;IAa3D,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC,SAAS,GAAG,gBAAgB,CAAC;IAkBvF,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC;IAMlD,QAAQ,CAAC,KAAK,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC;QACnE,KAAK,EAAE,SAAS,EAAE,CAAA;QAClB,UAAU,CAAC,EAAE,MAAM,CAAA;KACpB,CAAC;IA6BI,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;YAMjC,SAAS;YAST,cAAc;CAM7B"}

package/dist/assets/store-s3.js

@@ -0,0 +1,183 @@
+/**
+ * S3-backed AssetStore. Same bucket-prefix layout as LocalAssetStore (see
+ * keys.ts). Assumes an EXISTING content bucket (versioning/SSE/replication
+ * already configured by the site's CDK stack) — this store only ever reads
+ * and writes objects under the five asset prefixes.
+ */
+import { randomUUID } from 'node:crypto';
+import { DeleteObjectCommand, GetObjectCommand, ListObjectsV2Command, PutObjectCommand, S3Client, } from '@aws-sdk/client-s3';
+import { createPresignedPost } from '@aws-sdk/s3-presigned-post';
+import { ASSET_PREFIXES, createKeyBuilders } from './keys.js';
+const DEFAULT_MAX_UPLOAD_BYTES = 50 * 1024 * 1024;
+const PRESIGN_EXPIRY_SECONDS = 15 * 60;
+function matchesAwsError(err, name, httpStatusCode) {
+    if (!(err instanceof Error))
+        return false;
+    const shaped = err;
+    return shaped.name === name || shaped.$metadata?.httpStatusCode === httpStatusCode;
+}
+const isPreconditionFailed = (err) => matchesAwsError(err, 'PreconditionFailed', 412);
+const isNoSuchKey = (err) => matchesAwsError(err, 'NoSuchKey', 404);
+export class S3AssetStore {
+    constructor(options) {
+        this.capabilities = { directUpload: true };
+        this.bucket = options.bucket;
+        this.maxUploadBytes = options.maxUploadBytes ?? DEFAULT_MAX_UPLOAD_BYTES;
+        this.client = new S3Client({ region: options.region });
+        const prefixes = options.prefixes ?? ASSET_PREFIXES;
+        this.keys = createKeyBuilders(prefixes);
+        this.stagingPrefix = `${prefixes.staging}/`;
+    }
+    /**
+     * Staging methods accept caller-influenced keys (finalize receives the key
+     * from the client), so they must never operate outside the staging prefix —
+     * in a shared content bucket an unguarded deleteStaging would reach deploy
+     * artifacts under builds/. The API layer validates too; defense-in-depth.
+     */
+    assertStagingKey(key) {
+        if (!key.startsWith(this.stagingPrefix)) {
+            throw new Error(`Not a staging key: ${key}`);
+        }
+    }
+    async beginUpload(input) {
+        const key = this.keys.stagingKey(randomUUID());
+        const { url, fields } = await createPresignedPost(this.client, {
+            Bucket: this.bucket,
+            Key: key,
+            Conditions: [
+                ['content-length-range', 1, this.maxUploadBytes],
+                { 'Content-Type': input.contentType },
+            ],
+            Fields: {
+                'Content-Type': input.contentType,
+            },
+            Expires: PRESIGN_EXPIRY_SECONDS,
+        });
+        return { mode: 'direct', url, fields, stagingKey: key, maxBytes: this.maxUploadBytes };
+    }
+    async writeStaging(key, data, contentType) {
+        this.assertStagingKey(key);
+        await this.client.send(new PutObjectCommand({ Bucket: this.bucket, Key: key, Body: data, ContentType: contentType }));
+    }
+    async readStaging(key) {
+        this.assertStagingKey(key);
+        return this.getObjectBytes(key);
+    }
+    async deleteStaging(key) {
+        this.assertStagingKey(key);
+        await this.client.send(new DeleteObjectCommand({ Bucket: this.bucket, Key: key }));
+    }
+    async putOriginal(input) {
+        await this.client.send(new PutObjectCommand({
+            Bucket: this.bucket,
+            Key: this.keys.originalKey(input.hash32, input.ext),
+            Body: input.data,
+            ContentType: input.contentType,
+        }));
+    }
+    async readOriginal(hash32) {
+        const prefix = this.keys.originalPrefix(hash32);
+        const listed = await this.client.send(new ListObjectsV2Command({ Bucket: this.bucket, Prefix: prefix, MaxKeys: 1 }));
+        const foundKey = listed.Contents?.[0]?.Key;
+        if (!foundKey)
+            return null;
+        const result = await this.getObject(foundKey);
+        if (!result)
+            return null;
+        const data = await result.Body?.transformToByteArray();
+        if (!data)
+            return null;
+        return { data, ext: foundKey.slice(prefix.length), contentType: result.ContentType };
+    }
+    async putPublicObject(input) {
+        await this.client.send(new PutObjectCommand({
+            Bucket: this.bucket,
+            Key: input.key,
+            Body: input.data,
+            ContentType: input.contentType,
+            ContentDisposition: input.contentDisposition,
+            CacheControl: input.cacheControl,
+        }));
+    }
+    async readPublicObject(key) {
+        const result = await this.getObject(key);
+        if (!result)
+            return null;
+        const data = await result.Body?.transformToByteArray();
+        if (!data)
+            return null;
+        return {
+            data,
+            contentType: result.ContentType,
+            contentDisposition: result.ContentDisposition,
+            cacheControl: result.CacheControl,
+        };
+    }
+    async putMetaIfAbsent(hash32, meta) {
+        try {
+            await this.client.send(new PutObjectCommand({
+                Bucket: this.bucket,
+                Key: this.keys.metaKey(hash32),
+                Body: JSON.stringify(meta),
+                ContentType: 'application/json',
+                IfNoneMatch: '*',
+            }));
+            return 'created';
+        }
+        catch (err) {
+            if (isPreconditionFailed(err))
+                return 'already-exists';
+            throw err;
+        }
+    }
+    async getMeta(hash32) {
+        const bytes = await this.getObjectBytes(this.keys.metaKey(hash32));
+        if (!bytes)
+            return null;
+        return JSON.parse(Buffer.from(bytes).toString('utf-8'));
+    }
+    async listMeta(input) {
+        const listed = await this.client.send(new ListObjectsV2Command({
+            Bucket: this.bucket,
+            Prefix: this.keys.metaPrefix(),
+            MaxKeys: input?.limit,
+            ContinuationToken: input?.cursor,
+        }));
+        const objectKeys = (listed.Contents ?? [])
+            .map((obj) => obj.Key)
+            .filter((key) => Boolean(key));
+        const fetched = await Promise.all(objectKeys.map(async (key) => {
+            const bytes = await this.getObjectBytes(key);
+            // A meta object deleted between LIST and GET (deleteMeta race) reads
+            // as null; skip it rather than failing the whole page.
+            if (!bytes)
+                return null;
+            return JSON.parse(Buffer.from(bytes).toString('utf-8'));
+        }));
+        return {
+            items: fetched.filter((meta) => meta !== null),
+            nextCursor: listed.IsTruncated ? listed.NextContinuationToken : undefined,
+        };
+    }
+    async deleteMeta(hash32) {
+        await this.client.send(new DeleteObjectCommand({ Bucket: this.bucket, Key: this.keys.metaKey(hash32) }));
+    }
+    async getObject(key) {
+        try {
+            return await this.client.send(new GetObjectCommand({ Bucket: this.bucket, Key: key }));
+        }
+        catch (err) {
+            if (isNoSuchKey(err))
+                return null;
+            throw err;
+        }
+    }
+    async getObjectBytes(key) {
+        const result = await this.getObject(key);
+        if (!result)
+            return null;
+        const bytes = await result.Body?.transformToByteArray();
+        return bytes ?? null;
+    }
+}
+//# sourceMappingURL=store-s3.js.map

package/dist/assets/store-s3.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"store-s3.js","sourceRoot":"","sources":["../../src/assets/store-s3.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EACL,mBAAmB,EACnB,gBAAgB,EAChB,oBAAoB,EACpB,gBAAgB,EAChB,QAAQ,GACT,MAAM,oBAAoB,CAAA;AAC3B,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAA;AAEhE,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAsB,MAAM,QAAQ,CAAA;AAmB9E,MAAM,wBAAwB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAA;AACjD,MAAM,sBAAsB,GAAG,EAAE,GAAG,EAAE,CAAA;AAatC,SAAS,eAAe,CAAC,GAAY,EAAE,IAAY,EAAE,cAAsB;IACzE,IAAI,CAAC,CAAC,GAAG,YAAY,KAAK,CAAC;QAAE,OAAO,KAAK,CAAA;IACzC,MAAM,MAAM,GAAG,GAAmC,CAAA;IAClD,OAAO,MAAM,CAAC,IAAI,KAAK,IAAI,IAAI,MAAM,CAAC,SAAS,EAAE,cAAc,KAAK,cAAc,CAAA;AACpF,CAAC;AAED,MAAM,oBAAoB,GAAG,CAAC,GAAY,EAAW,EAAE,CACrD,eAAe,CAAC,GAAG,EAAE,oBAAoB,EAAE,GAAG,CAAC,CAAA;AAEjD,MAAM,WAAW,GAAG,CAAC,GAAY,EAAW,EAAE,CAAC,eAAe,CAAC,GAAG,EAAE,WAAW,EAAE,GAAG,CAAC,CAAA;AAErF,MAAM,OAAO,YAAY;IAQvB,YAAY,OAA4B;QAP/B,iBAAY,GAAG,EAAE,YAAY,EAAE,IAAI,EAAE,CAAA;QAQ5C,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAA;QAC5B,IAAI,CAAC,cAAc,GAAG,OAAO,CAAC,cAAc,IAAI,wBAAwB,CAAA;QACxE,IAAI,CAAC,MAAM,GAAG,IAAI,QAAQ,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAA;QACtD,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,cAAc,CAAA;QACnD,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAA;QACvC,IAAI,CAAC,aAAa,GAAG,GAAG,QAAQ,CAAC,OAAO,GAAG,CAAA;IAC7C,CAAC;IAED;;;;;OAKG;IACK,gBAAgB,CAAC,GAAW;QAClC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC;YACxC,MAAM,IAAI,KAAK,CAAC,sBAAsB,GAAG,EAAE,CAAC,CAAA;QAC9C,CAAC;IACH,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,KAAuB;QACvC,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,EAAE,CAAC,CAAA;QAC9C,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,MAAM,mBAAmB,CAAC,IAAI,CAAC,MAAM,EAAE;YAC7D,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,GAAG,EAAE,GAAG;YACR,UAAU,EAAE;gBACV,CAAC,sBAAsB,EAAE,CAAC,EAAE,IAAI,CAAC,cAAc,CAAC;gBAChD,EAAE,cAAc,EAAE,KAAK,CAAC,WAAW,EAAE;aACtC;YACD,MAAM,EAAE;gBACN,cAAc,EAAE,KAAK,CAAC,WAAW;aAClC;YACD,OAAO,EAAE,sBAAsB;SAChC,CAAC,CAAA;QACF,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,CAAC,cAAc,EAAE,CAAA;IACxF,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,GAAW,EAAE,IAAgB,EAAE,WAAoB;QACpE,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAA;QAC1B,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CACpB,IAAI,gBAAgB,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,WAAW,EAAE,CAAC,CAC9F,CAAA;IACH,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,GAAW;QAC3B,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAA;QAC1B,OAAO,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,CAAA;IACjC,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,GAAW;QAC7B,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAA;QAC1B,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,mBAAmB,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,CAAA;IACpF,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,KAKjB;QACC,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CACpB,IAAI,gBAAgB,CAAC;YACnB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,GAAG,CAAC;YACnD,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,WAAW,EAAE,KAAK,CAAC,WAAW;SAC/B,CAAC,CACH,CAAA;IACH,CAAC;IAED,KAAK,CAAC,YAAY,CAChB,MAAc;QAEd,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,CAAA;QAC/C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CACnC,IAAI,oBAAoB,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC,CAC9E,CAAA;QACD,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,CAAA;QAC1C,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAA;QAE1B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAA;QAC7C,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAA;QACxB,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,oBAAoB,EAAE,CAAA;QACtD,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAA;QACtB,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,CAAA;IACtF,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,KAMrB;QACC,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CACpB,IAAI,gBAAgB,CAAC;YACnB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,GAAG,EAAE,KAAK,CAAC,GAAG;YACd,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;YAC5C,YAAY,EAAE,KAAK,CAAC,YAAY;SACjC,CAAC,CACH,CAAA;IACH,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,GAAW;QAChC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAA;QACxC,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAA;QACxB,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,oBAAoB,EAAE,CAAA;QACtD,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAA;QACtB,OAAO;YACL,IAAI;YACJ,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,kBAAkB,EAAE,MAAM,CAAC,kBAAkB;YAC7C,YAAY,EAAE,MAAM,CAAC,YAAY;SAClC,CAAA;IACH,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,MAAc,EAAE,IAAe;QACnD,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CACpB,IAAI,gBAAgB,CAAC;gBACnB,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;gBAC9B,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;gBAC1B,WAAW,EAAE,kBAAkB;gBAC/B,WAAW,EAAE,GAAG;aACjB,CAAC,CACH,CAAA;YACD,OAAO,SAAS,CAAA;QAClB,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,IAAI,oBAAoB,CAAC,GAAG,CAAC;gBAAE,OAAO,gBAAgB,CAAA;YACtD,MAAM,GAAG,CAAA;QACX,CAAC;IACH,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,MAAc;QAC1B,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAA;QAClE,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAA;QACvB,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAc,CAAA;IACtE,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,KAA2C;QAIxD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CACnC,IAAI,oBAAoB,CAAC;YACvB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE;YAC9B,OAAO,EAAE,KAAK,EAAE,KAAK;YACrB,iBAAiB,EAAE,KAAK,EAAE,MAAM;SACjC,CAAC,CACH,CAAA;QACD,MAAM,UAAU,GAAG,CAAC,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAC;aACvC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC;aACrB,MAAM,CAAC,CAAC,GAAG,EAAiB,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAA;QAE/C,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAC/B,UAAU,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;YAC3B,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,CAAA;YAC5C,qEAAqE;YACrE,uDAAuD;YACvD,IAAI,CAAC,KAAK;gBAAE,OAAO,IAAI,CAAA;YACvB,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAc,CAAA;QACtE,CAAC,CAAC,CACH,CAAA;QAED,OAAO;YACL,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,EAAqB,EAAE,CAAC,IAAI,KAAK,IAAI,CAAC;YACjE,UAAU,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAAC,CAAC,SAAS;SAC1E,CAAA;IACH,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,MAAc;QAC7B,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CACpB,IAAI,mBAAmB,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CACjF,CAAA;IACH,CAAC;IAEO,KAAK,CAAC,SAAS,CAAC,GAAW;QACjC,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,gBAAgB,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,CAAA;QACxF,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,IAAI,WAAW,CAAC,GAAG,CAAC;gBAAE,OAAO,IAAI,CAAA;YACjC,MAAM,GAAG,CAAA;QACX,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,cAAc,CAAC,GAAW;QACtC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAA;QACxC,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAA;QACxB,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,oBAAoB,EAAE,CAAA;QACvD,OAAO,KAAK,IAAI,IAAI,CAAA;IACtB,CAAC;CACF"}

package/dist/assets/svg-sanitizer.d.ts

@@ -0,0 +1,37 @@
+/**
+ * SVG sanitization. Server-only - never import from client/editor code.
+ *
+ * Sanitizer choice: the design record (.claude/future-tasks/assets-media-system.md)
+ * suggested `dompurify` + a lightweight DOM shim (e.g. `linkedom`) in place of the
+ * heavier `jsdom`. In practice that pairing is unsafe: DOMPurify's own README warns
+ * that immature DOM shims can cause it to fail in ways that produce an XSS hole even
+ * when DOMPurify itself behaves correctly, and that is exactly what was reproduced
+ * here - `createDOMPurify(linkedomWindow).sanitize(dirtySvg)` returned the INPUT
+ * UNCHANGED (a `<script>`, `onload=`, and `<foreignObject>` all survived), because
+ * linkedom's window has no `NodeFilter` global and DOMPurify silently no-ops when it
+ * doesn't recognize the environment as supported. That is a dangerous failure mode
+ * for a security boundary, so this module uses `sanitize-html` instead: it works
+ * directly on the parser tree (htmlparser2, no DOM shim to be incomplete), is
+ * actively maintained, and - verified empirically - correctly strips scripts, event
+ * handler attributes, and `foreignObject` while preserving a valid, still-parseable
+ * SVG document.
+ *
+ * Allowlist-based (not blocklist): only elements/attributes known to be safe survive.
+ * `href`/`xlink:href` are further restricted to local fragment references (`#...`) so
+ * `<use>`/`<a>` can reference in-document defs but can never point at an external URL
+ * (tracking pixels, `javascript:` URLs, etc.) - sanitize-html's tag-level scheme
+ * allowlisting does not cover attribute name patterns like this, so it is enforced
+ * directly in `transformTags` below.
+ */
+/**
+ * Sanitize an SVG document (as text). Strips scripts, event-handler attributes,
+ * `<foreignObject>` (and its content), inline `<style>` (CSS injection surface),
+ * any `href`/`xlink:href` that isn't a local fragment reference, and any
+ * `url(...)` reference on a paint/filter/marker attribute that isn't a local
+ * fragment reference (external-fetch tracking beacon).
+ *
+ * Input must already be confirmed to be an SVG document (see `sniffSvg` in
+ * pipeline.ts) - this function does not re-validate the root element.
+ */
+export declare function sanitizeSvg(svgText: string): string;
+//# sourceMappingURL=svg-sanitizer.d.ts.map

package/dist/assets/svg-sanitizer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"svg-sanitizer.d.ts","sourceRoot":"","sources":["../../src/assets/svg-sanitizer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAuKH;;;;;;;;;GASG;AACH,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAwBnD"}

package/dist/assets/svg-sanitizer.js

@@ -0,0 +1,222 @@
+/**
+ * SVG sanitization. Server-only - never import from client/editor code.
+ *
+ * Sanitizer choice: the design record (.claude/future-tasks/assets-media-system.md)
+ * suggested `dompurify` + a lightweight DOM shim (e.g. `linkedom`) in place of the
+ * heavier `jsdom`. In practice that pairing is unsafe: DOMPurify's own README warns
+ * that immature DOM shims can cause it to fail in ways that produce an XSS hole even
+ * when DOMPurify itself behaves correctly, and that is exactly what was reproduced
+ * here - `createDOMPurify(linkedomWindow).sanitize(dirtySvg)` returned the INPUT
+ * UNCHANGED (a `<script>`, `onload=`, and `<foreignObject>` all survived), because
+ * linkedom's window has no `NodeFilter` global and DOMPurify silently no-ops when it
+ * doesn't recognize the environment as supported. That is a dangerous failure mode
+ * for a security boundary, so this module uses `sanitize-html` instead: it works
+ * directly on the parser tree (htmlparser2, no DOM shim to be incomplete), is
+ * actively maintained, and - verified empirically - correctly strips scripts, event
+ * handler attributes, and `foreignObject` while preserving a valid, still-parseable
+ * SVG document.
+ *
+ * Allowlist-based (not blocklist): only elements/attributes known to be safe survive.
+ * `href`/`xlink:href` are further restricted to local fragment references (`#...`) so
+ * `<use>`/`<a>` can reference in-document defs but can never point at an external URL
+ * (tracking pixels, `javascript:` URLs, etc.) - sanitize-html's tag-level scheme
+ * allowlisting does not cover attribute name patterns like this, so it is enforced
+ * directly in `transformTags` below.
+ */
+import sanitizeHtml from 'sanitize-html';
+const ALLOWED_SVG_TAGS = [
+    'svg',
+    'g',
+    'defs',
+    'symbol',
+    'use',
+    'title',
+    'desc',
+    'rect',
+    'circle',
+    'ellipse',
+    'line',
+    'polyline',
+    'polygon',
+    'path',
+    'text',
+    'tspan',
+    'textPath',
+    'linearGradient',
+    'radialGradient',
+    'stop',
+    'clipPath',
+    'mask',
+    'pattern',
+    'filter',
+    'feGaussianBlur',
+    'feOffset',
+    'feBlend',
+    'feColorMatrix',
+    'feComponentTransfer',
+    'feFuncA',
+    'feFuncR',
+    'feFuncG',
+    'feFuncB',
+    'feComposite',
+    'feFlood',
+    'feMerge',
+    'feMergeNode',
+    'feMorphology',
+    'feTile',
+    'feTurbulence',
+    'feDropShadow',
+    'feDisplacementMap',
+    'image',
+    'a',
+    'marker',
+    'metadata',
+];
+const ALLOWED_SVG_ATTRS = [
+    'id',
+    'class',
+    'style',
+    'transform',
+    'fill',
+    'fill-rule',
+    'fill-opacity',
+    'stroke',
+    'stroke-width',
+    'stroke-linecap',
+    'stroke-linejoin',
+    'stroke-dasharray',
+    'stroke-opacity',
+    'opacity',
+    'd',
+    'x',
+    'y',
+    'width',
+    'height',
+    'cx',
+    'cy',
+    'r',
+    'rx',
+    'ry',
+    'x1',
+    'y1',
+    'x2',
+    'y2',
+    'points',
+    'viewBox',
+    'preserveAspectRatio',
+    'xmlns',
+    'xmlns:xlink',
+    'version',
+    'offset',
+    'stop-color',
+    'stop-opacity',
+    'gradientUnits',
+    'gradientTransform',
+    'patternUnits',
+    'patternTransform',
+    'href',
+    'xlink:href',
+    'clip-path',
+    'mask',
+    'filter',
+    'font-family',
+    'font-size',
+    'font-weight',
+    'text-anchor',
+    'dx',
+    'dy',
+    'marker-start',
+    'marker-mid',
+    'marker-end',
+];
+/**
+ * Elements whose entire subtree (tags AND text) is discarded when they are not
+ * in the allowlist. Without this, sanitize-html's default `disallowedTagsMode:
+ * 'discard'` removes the tag itself but leaves loose text content behind (e.g.
+ * a stripped `<foreignObject><div>evil</div></foreignObject>` would otherwise
+ * leave a bare "evil" text node in the sanitized output).
+ */
+const NON_TEXT_TAGS = ['script', 'style', 'textarea', 'option', 'foreignObject'];
+/**
+ * Presentation attributes (beyond `style`) whose SVG grammar accepts a
+ * `<funciri>` (`url(...)`) value - `fill`/`stroke` reference paint servers
+ * (gradients/patterns), `filter`/`mask`/`clip-path` reference filter-effect
+ * elements, and the three `marker-*` attributes reference `<marker>`
+ * elements. Every one of these is in `ALLOWED_SVG_ATTRS`, so every one of
+ * them is a route for the same external-fetch beacon `style`'s `url(...)`
+ * hardening (below) already closes: `<rect fill="url(https://evil/beacon)">`
+ * fetches externally the moment the SVG is opened as a document, exactly
+ * like a `style="background:url(...)"` would.
+ */
+const URL_BEARING_ATTRS = new Set([
+    'style',
+    'fill',
+    'stroke',
+    'filter',
+    'mask',
+    'clip-path',
+    'marker-start',
+    'marker-mid',
+    'marker-end',
+]);
+/**
+ * True when `value` is safe for a URL-bearing presentation attribute: either
+ * it has no `url(...)` funciri and no backslash at all (the common case -
+ * plain colors, `none`, etc.), or its only `url(...)` reference is a local
+ * fragment (`url(#foo)`) - the same in-document-only allowance `href`/
+ * `xlink:href` get, and exactly what gradients/filters/markers legitimately
+ * need to reference document-local `<linearGradient>`/`<filter>`/`<marker>`
+ * defs. Backslashes are rejected unconditionally (even alongside an
+ * otherwise-local `url(#foo)`): CSS escapes (e.g. `\75 rl(...)` -> `url(...)`)
+ * let a crafted value slip past a plain `url(` text match yet still resolve
+ * to an external fetch in the browser's CSS/SVG value parser, and
+ * backslashes have no legitimate use in any of these attribute values.
+ */
+function isSafeUrlBearingValue(value) {
+    if (value.includes('\\'))
+        return false;
+    const urlMatches = value.matchAll(/url\s*\(\s*(['"]?)\s*([^)'"]*?)\s*\1\s*\)/gi);
+    let sawUrl = false;
+    for (const match of urlMatches) {
+        sawUrl = true;
+        if (!match[2].startsWith('#'))
+            return false;
+    }
+    return sawUrl ? true : !/url\s*\(/i.test(value);
+}
+/**
+ * Sanitize an SVG document (as text). Strips scripts, event-handler attributes,
+ * `<foreignObject>` (and its content), inline `<style>` (CSS injection surface),
+ * any `href`/`xlink:href` that isn't a local fragment reference, and any
+ * `url(...)` reference on a paint/filter/marker attribute that isn't a local
+ * fragment reference (external-fetch tracking beacon).
+ *
+ * Input must already be confirmed to be an SVG document (see `sniffSvg` in
+ * pipeline.ts) - this function does not re-validate the root element.
+ */
+export function sanitizeSvg(svgText) {
+    return sanitizeHtml(svgText, {
+        allowedTags: ALLOWED_SVG_TAGS,
+        allowedAttributes: { '*': ALLOWED_SVG_ATTRS },
+        nonTextTags: NON_TEXT_TAGS,
+        // xmlMode makes htmlparser2 treat this as XML (self-closing tags, no HTML
+        // element-specific parsing quirks) rather than HTML, which matters for SVG.
+        parser: { xmlMode: true, decodeEntities: true },
+        transformTags: {
+            '*': (tagName, attribs) => {
+                const filtered = {};
+                for (const [key, value] of Object.entries(attribs)) {
+                    if ((key === 'href' || key === 'xlink:href') && !value.startsWith('#')) {
+                        continue; // drop external/non-local references
+                    }
+                    if (URL_BEARING_ATTRS.has(key) && !isSafeUrlBearingValue(value)) {
+                        continue; // drop external/non-local url(...) references (or any backslash)
+                    }
+                    filtered[key] = value;
+                }
+                return { tagName, attribs: filtered };
+            },
+        },
+    });
+}
+//# sourceMappingURL=svg-sanitizer.js.map

package/dist/assets/svg-sanitizer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"svg-sanitizer.js","sourceRoot":"","sources":["../../src/assets/svg-sanitizer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,YAAY,MAAM,eAAe,CAAA;AAExC,MAAM,gBAAgB,GAAG;IACvB,KAAK;IACL,GAAG;IACH,MAAM;IACN,QAAQ;IACR,KAAK;IACL,OAAO;IACP,MAAM;IACN,MAAM;IACN,QAAQ;IACR,SAAS;IACT,MAAM;IACN,UAAU;IACV,SAAS;IACT,MAAM;IACN,MAAM;IACN,OAAO;IACP,UAAU;IACV,gBAAgB;IAChB,gBAAgB;IAChB,MAAM;IACN,UAAU;IACV,MAAM;IACN,SAAS;IACT,QAAQ;IACR,gBAAgB;IAChB,UAAU;IACV,SAAS;IACT,eAAe;IACf,qBAAqB;IACrB,SAAS;IACT,SAAS;IACT,SAAS;IACT,SAAS;IACT,aAAa;IACb,SAAS;IACT,SAAS;IACT,aAAa;IACb,cAAc;IACd,QAAQ;IACR,cAAc;IACd,cAAc;IACd,mBAAmB;IACnB,OAAO;IACP,GAAG;IACH,QAAQ;IACR,UAAU;CACX,CAAA;AAED,MAAM,iBAAiB,GAAG;IACxB,IAAI;IACJ,OAAO;IACP,OAAO;IACP,WAAW;IACX,MAAM;IACN,WAAW;IACX,cAAc;IACd,QAAQ;IACR,cAAc;IACd,gBAAgB;IAChB,iBAAiB;IACjB,kBAAkB;IAClB,gBAAgB;IAChB,SAAS;IACT,GAAG;IACH,GAAG;IACH,GAAG;IACH,OAAO;IACP,QAAQ;IACR,IAAI;IACJ,IAAI;IACJ,GAAG;IACH,IAAI;IACJ,IAAI;IACJ,IAAI;IACJ,IAAI;IACJ,IAAI;IACJ,IAAI;IACJ,QAAQ;IACR,SAAS;IACT,qBAAqB;IACrB,OAAO;IACP,aAAa;IACb,SAAS;IACT,QAAQ;IACR,YAAY;IACZ,cAAc;IACd,eAAe;IACf,mBAAmB;IACnB,cAAc;IACd,kBAAkB;IAClB,MAAM;IACN,YAAY;IACZ,WAAW;IACX,MAAM;IACN,QAAQ;IACR,aAAa;IACb,WAAW;IACX,aAAa;IACb,aAAa;IACb,IAAI;IACJ,IAAI;IACJ,cAAc;IACd,YAAY;IACZ,YAAY;CACb,CAAA;AAED;;;;;;GAMG;AACH,MAAM,aAAa,GAAG,CAAC,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,eAAe,CAAC,CAAA;AAEhF;;;;;;;;;;GAUG;AACH,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC;IAChC,OAAO;IACP,MAAM;IACN,QAAQ;IACR,QAAQ;IACR,MAAM;IACN,WAAW;IACX,cAAc;IACd,YAAY;IACZ,YAAY;CACb,CAAC,CAAA;AAEF;;;;;;;;;;;;GAYG;AACH,SAAS,qBAAqB,CAAC,KAAa;IAC1C,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAA;IACtC,MAAM,UAAU,GAAG,KAAK,CAAC,QAAQ,CAAC,6CAA6C,CAAC,CAAA;IAChF,IAAI,MAAM,GAAG,KAAK,CAAA;IAClB,KAAK,MAAM,KAAK,IAAI,UAAU,EAAE,CAAC;QAC/B,MAAM,GAAG,IAAI,CAAA;QACb,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,OAAO,KAAK,CAAA;IAC7C,CAAC;IACD,OAAO,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;AACjD,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,WAAW,CAAC,OAAe;IACzC,OAAO,YAAY,CAAC,OAAO,EAAE;QAC3B,WAAW,EAAE,gBAAgB;QAC7B,iBAAiB,EAAE,EAAE,GAAG,EAAE,iBAAiB,EAAE;QAC7C,WAAW,EAAE,aAAa;QAC1B,0EAA0E;QAC1E,4EAA4E;QAC5E,MAAM,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE;QAC/C,aAAa,EAAE;YACb,GAAG,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE;gBACxB,MAAM,QAAQ,GAA2B,EAAE,CAAA;gBAC3C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;oBACnD,IAAI,CAAC,GAAG,KAAK,MAAM,IAAI,GAAG,KAAK,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;wBACvE,SAAQ,CAAC,qCAAqC;oBAChD,CAAC;oBACD,IAAI,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,qBAAqB,CAAC,KAAK,CAAC,EAAE,CAAC;wBAChE,SAAQ,CAAC,iEAAiE;oBAC5E,CAAC;oBACD,QAAQ,CAAC,GAAG,CAAC,GAAG,KAAK,CAAA;gBACvB,CAAC;gBACD,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAA;YACvC,CAAC;SACF;KACF,CAAC,CAAA;AACJ,CAAC"}

package/dist/assets/transform-directives.d.ts

@@ -0,0 +1,97 @@
+/**
+ * Pure parser/formatter for `/assets/t/{directives}/{hash32}/{slug}.{ext}`
+ * transform URLs. Isomorphic and dependency-free by design: this module has
+ * NO imports (not even other files in this directory) so it can be imported
+ * from client bundles (via `assetUrl`/`assetSrcSet` in asset-url.ts, exported
+ * off the package's main entry) as well as from the server-only transform
+ * engine (transform.ts) and the future prod transform Lambda (PR 7), without
+ * ever pulling in node:crypto, sharp, or any other server-only dependency.
+ *
+ * `{directives}` is either the literal identity token (`orig`) or a
+ * comma-separated list of `key=value` pairs drawn from:
+ *   w={int}   output width - allowlisted to multiples of 160 in [160, 4096]
+ *             (bounds cache-stuffing; upscaling is rejected at transform
+ *             time via `withoutEnlargement`, not here)
+ *   f={fmt}   output format: webp | jpeg | png - when present, the URL's
+ *             `{ext}` must equal it exactly
+ *   q={int}   quality 1..100 (encoder-dependent)
+ *   c={rect}  normalized crop rect `x:y:w:h`, four floats in [0,1] with
+ *             x+w<=1 and y+h<=1, w>0 and h>0 (colon-separated - commas are
+ *             the directive separator)
+ *
+ * Duplicate keys, unknown keys, and empty directive strings are rejected.
+ * `orig` must appear alone.
+ */
+/** The identity transform directive name - EXIF-strip only, no other change. */
+export declare const IDENTITY_TRANSFORM_DIRECTIVE = "orig";
+export type OutputFormat = 'webp' | 'jpeg' | 'png';
+export interface CropRect {
+    readonly x: number;
+    readonly y: number;
+    readonly w: number;
+    readonly h: number;
+}
+/** Identity ('orig'): EXIF-strip only, no resize/format/quality change. */
+export interface IdentityDirectives {
+    readonly identity: true;
+}
+/** Non-identity directive set - every field optional, but at least one is present. */
+export interface ResizeDirectives {
+    readonly identity: false;
+    readonly width?: number;
+    readonly format?: OutputFormat;
+    readonly quality?: number;
+    readonly crop?: CropRect;
+}
+export type TransformDirectives = IdentityDirectives | ResizeDirectives;
+export interface ParsedTransformPath {
+    readonly directives: TransformDirectives;
+    readonly hash32: string;
+    readonly slug: string;
+    readonly ext: string;
+}
+export type ParseTransformPathResult = ({
+    readonly ok: true;
+} & ParsedTransformPath) | {
+    readonly ok: false;
+    readonly error: string;
+};
+/**
+ * Decompression-bomb cap: the max `width * height` (post-decode pixel count)
+ * any raster the pipeline handles may have - checked both at upload finalize
+ * time (pipeline.ts, against the raw source dims) and at transform decode
+ * time (transform.ts, via sharp's `limitInputPixels`). Shared here (rather
+ * than duplicated in each server-only module) so it stays a single number,
+ * and because this file is dependency-free/isomorphic it can be imported by
+ * both without pulling sharp or file-type into anything. 4096x4096 (16.7 MP)
+ * comfortably covers the largest output this system ever serves (MAX_WIDTH)
+ * while still bounding decode-time memory for a small/compressible-but-huge
+ * source (e.g. a 30000x30000 solid-color PNG).
+ */
+export declare const MAX_INPUT_PIXELS: number;
+/** True if `width` is on the allowlist: a multiple of 160 in [160, 4096]. */
+export declare function isAllowedTransformWidth(width: number): boolean;
+/** True if `quality` is on the allowlist: a multiple of 5 in [30, 95]. */
+export declare function isAllowedTransformQuality(quality: number): boolean;
+/**
+ * True when x, y, w, h describe a valid normalized crop rect: all four values
+ * finite and in [0,1], w and h strictly positive, and the rect fits within
+ * bounds (x+w<=1, y+h<=1). Shared by the URL-directive parser (`parseCrop`,
+ * below, from a `x:y:w:h` string) and image field value validation (from a
+ * `{x,y,w,h}` object, in validation/entry-validator.ts) so both enforce
+ * identical constraints.
+ */
+export declare function isValidCropRect(x: number, y: number, w: number, h: number): boolean;
+/**
+ * Parse the three path segments after the `assets/t/` prefix:
+ * `[directivesRaw, hash32, "{slug}.{ext}"]`. The raw route strips the
+ * `assets/t/` prefix and splits the remaining key by `/` before calling this.
+ */
+export declare function parseTransformPath(segments: readonly string[]): ParseTransformPathResult;
+/**
+ * Canonical string form of a directive set, so equivalent directive sets
+ * (different key order, different float formatting) always map to the same
+ * cache key. Order is fixed alphabetically by key: c, f, q, w.
+ */
+export declare function formatDirectives(directives: TransformDirectives): string;
+//# sourceMappingURL=transform-directives.d.ts.map

package/dist/assets/transform-directives.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"transform-directives.d.ts","sourceRoot":"","sources":["../../src/assets/transform-directives.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,gFAAgF;AAChF,eAAO,MAAM,4BAA4B,SAAS,CAAA;AAElD,MAAM,MAAM,YAAY,GAAG,MAAM,GAAG,MAAM,GAAG,KAAK,CAAA;AAElD,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAA;IAClB,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAA;IAClB,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAA;IAClB,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAA;CACnB;AAED,2EAA2E;AAC3E,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAA;CACxB;AAED,sFAAsF;AACtF,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,QAAQ,EAAE,KAAK,CAAA;IACxB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,MAAM,CAAC,EAAE,YAAY,CAAA;IAC9B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAA;CACzB;AAED,MAAM,MAAM,mBAAmB,GAAG,kBAAkB,GAAG,gBAAgB,CAAA;AAEvE,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,UAAU,EAAE,mBAAmB,CAAA;IACxC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;CACrB;AAED,MAAM,MAAM,wBAAwB,GAChC,CAAC;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG,mBAAmB,CAAC,GAC7C;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAA;AAMlD;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,gBAAgB,QAAc,CAAA;AAgC3C,6EAA6E;AAC7E,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAI9D;AAQD,0EAA0E;AAC1E,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAOlE;AAcD;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,OAAO,CAOnF;AA0FD;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,GAAG,wBAAwB,CAkCxF;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,UAAU,EAAE,mBAAmB,GAAG,MAAM,CA4BxE"}