canopycms 0.0.56 → 0.0.58

package/dist/assets/transform-directives.js

@@ -0,0 +1,267 @@
+/**
+ * Pure parser/formatter for `/assets/t/{directives}/{hash32}/{slug}.{ext}`
+ * transform URLs. Isomorphic and dependency-free by design: this module has
+ * NO imports (not even other files in this directory) so it can be imported
+ * from client bundles (via `assetUrl`/`assetSrcSet` in asset-url.ts, exported
+ * off the package's main entry) as well as from the server-only transform
+ * engine (transform.ts) and the future prod transform Lambda (PR 7), without
+ * ever pulling in node:crypto, sharp, or any other server-only dependency.
+ *
+ * `{directives}` is either the literal identity token (`orig`) or a
+ * comma-separated list of `key=value` pairs drawn from:
+ *   w={int}   output width - allowlisted to multiples of 160 in [160, 4096]
+ *             (bounds cache-stuffing; upscaling is rejected at transform
+ *             time via `withoutEnlargement`, not here)
+ *   f={fmt}   output format: webp | jpeg | png - when present, the URL's
+ *             `{ext}` must equal it exactly
+ *   q={int}   quality 1..100 (encoder-dependent)
+ *   c={rect}  normalized crop rect `x:y:w:h`, four floats in [0,1] with
+ *             x+w<=1 and y+h<=1, w>0 and h>0 (colon-separated - commas are
+ *             the directive separator)
+ *
+ * Duplicate keys, unknown keys, and empty directive strings are rejected.
+ * `orig` must appear alone.
+ */
+/** The identity transform directive name - EXIF-strip only, no other change. */
+export const IDENTITY_TRANSFORM_DIRECTIVE = 'orig';
+const MIN_WIDTH = 160;
+const MAX_WIDTH = 4096;
+const WIDTH_STEP = 160;
+/**
+ * Decompression-bomb cap: the max `width * height` (post-decode pixel count)
+ * any raster the pipeline handles may have - checked both at upload finalize
+ * time (pipeline.ts, against the raw source dims) and at transform decode
+ * time (transform.ts, via sharp's `limitInputPixels`). Shared here (rather
+ * than duplicated in each server-only module) so it stays a single number,
+ * and because this file is dependency-free/isomorphic it can be imported by
+ * both without pulling sharp or file-type into anything. 4096x4096 (16.7 MP)
+ * comfortably covers the largest output this system ever serves (MAX_WIDTH)
+ * while still bounding decode-time memory for a small/compressible-but-huge
+ * source (e.g. a 30000x30000 solid-color PNG).
+ */
+export const MAX_INPUT_PIXELS = 4096 * 4096;
+// Quality is allowlisted (multiples of 5 in [30, 95] - 14 values) for the
+// same cache-stuffing reason as width: every accepted directive combination
+// becomes a stored cache object in prod, so unbounded q would multiply the
+// per-asset variant space by 100. Crop remains the one effectively unbounded
+// dimension (editor rects need float precision) - prod mitigation (rate
+// limiting / signed crops) is tracked in the design record for the CDK PR.
+const MIN_QUALITY = 30;
+const MAX_QUALITY = 95;
+const QUALITY_STEP = 5;
+const CROP_PRECISION = 4;
+const HASH32_RE = /^[a-f0-9]{32}$/;
+const SLUG_RE = /^[a-z0-9-]+$/;
+const EXT_RE = /^[a-z0-9]{1,10}$/;
+const POSITIVE_INT_RE = /^[1-9][0-9]*$/;
+// The two alternatives are mutually exclusive on their very first character
+// ('0' vs '1'), and neither branch nests a quantifier inside another - each
+// character class match advances the position by exactly one, so there is
+// exactly one way to parse any matching string (no backtracking ambiguity).
+// The security plugin's heuristic flags any alternation-plus-quantifier
+// shape regardless; input here is also a single bounded URL path segment,
+// not attacker-scalable text.
+// eslint-disable-next-line security/detect-unsafe-regex
+const UNIT_FLOAT_RE = /^(?:0(?:\.[0-9]+)?|1(?:\.0+)?)$/;
+const KNOWN_DIRECTIVE_KEYS = new Set(['w', 'f', 'q', 'c']);
+function isOutputFormat(value) {
+    return value === 'webp' || value === 'jpeg' || value === 'png';
+}
+/** True if `width` is on the allowlist: a multiple of 160 in [160, 4096]. */
+export function isAllowedTransformWidth(width) {
+    return (Number.isInteger(width) && width >= MIN_WIDTH && width <= MAX_WIDTH && width % WIDTH_STEP === 0);
+}
+function parseWidth(value) {
+    if (!POSITIVE_INT_RE.test(value))
+        return null;
+    const n = Number(value);
+    return isAllowedTransformWidth(n) ? n : null;
+}
+/** True if `quality` is on the allowlist: a multiple of 5 in [30, 95]. */
+export function isAllowedTransformQuality(quality) {
+    return (Number.isInteger(quality) &&
+        quality >= MIN_QUALITY &&
+        quality <= MAX_QUALITY &&
+        quality % QUALITY_STEP === 0);
+}
+function parseQuality(value) {
+    if (!POSITIVE_INT_RE.test(value))
+        return null;
+    const n = Number(value);
+    return isAllowedTransformQuality(n) ? n : null;
+}
+function parseUnitFloat(value) {
+    if (!UNIT_FLOAT_RE.test(value))
+        return null;
+    const n = Number(value);
+    return n >= 0 && n <= 1 ? n : null;
+}
+/**
+ * True when x, y, w, h describe a valid normalized crop rect: all four values
+ * finite and in [0,1], w and h strictly positive, and the rect fits within
+ * bounds (x+w<=1, y+h<=1). Shared by the URL-directive parser (`parseCrop`,
+ * below, from a `x:y:w:h` string) and image field value validation (from a
+ * `{x,y,w,h}` object, in validation/entry-validator.ts) so both enforce
+ * identical constraints.
+ */
+export function isValidCropRect(x, y, w, h) {
+    for (const n of [x, y, w, h]) {
+        if (!Number.isFinite(n) || n < 0 || n > 1)
+            return false;
+    }
+    if (w <= 0 || h <= 0)
+        return false;
+    if (x + w > 1 || y + h > 1)
+        return false;
+    return true;
+}
+function parseCrop(value) {
+    const parts = value.split(':');
+    if (parts.length !== 4)
+        return null;
+    const nums = parts.map(parseUnitFloat);
+    if (nums.some((n) => n === null))
+        return null;
+    const [x, y, w, h] = nums;
+    if (!isValidCropRect(x, y, w, h))
+        return null;
+    return { x, y, w, h };
+}
+function formatUnitFloat(n) {
+    return n.toFixed(CROP_PRECISION);
+}
+function err(error) {
+    return { ok: false, error };
+}
+/**
+ * Parse a `key=value,key=value` directive string (everything between
+ * `assets/t/` and the hash32 segment) into a `TransformDirectives`, or
+ * `orig` into the identity directive.
+ */
+function parseDirectivesString(raw) {
+    if (raw === IDENTITY_TRANSFORM_DIRECTIVE) {
+        return { ok: true, directives: { identity: true } };
+    }
+    if (raw.length === 0) {
+        return err('Empty directives');
+    }
+    const seen = new Set();
+    let width;
+    let format;
+    let quality;
+    let crop;
+    for (const pair of raw.split(',')) {
+        const eqIdx = pair.indexOf('=');
+        // Also catches `orig` combined with other directives (e.g. `orig,w=320`):
+        // `orig` has no `=`, so it falls into this same malformed-pair branch -
+        // `orig` is only ever valid when it is the entire directives string.
+        if (eqIdx <= 0 || eqIdx === pair.length - 1) {
+            return err(`Malformed directive: '${pair}'`);
+        }
+        const key = pair.slice(0, eqIdx);
+        const value = pair.slice(eqIdx + 1);
+        if (!KNOWN_DIRECTIVE_KEYS.has(key)) {
+            return err(`Unknown directive key: '${key}'`);
+        }
+        if (seen.has(key)) {
+            return err(`Duplicate directive key: '${key}'`);
+        }
+        seen.add(key);
+        switch (key) {
+            case 'w': {
+                const w = parseWidth(value);
+                if (w === null)
+                    return err(`Invalid width: '${value}'`);
+                width = w;
+                break;
+            }
+            case 'f': {
+                if (!isOutputFormat(value))
+                    return err(`Invalid format: '${value}'`);
+                format = value;
+                break;
+            }
+            case 'q': {
+                const q = parseQuality(value);
+                if (q === null)
+                    return err(`Invalid quality: '${value}'`);
+                quality = q;
+                break;
+            }
+            case 'c': {
+                const c = parseCrop(value);
+                if (!c)
+                    return err(`Invalid crop: '${value}'`);
+                crop = c;
+                break;
+            }
+        }
+    }
+    return { ok: true, directives: { identity: false, width, format, quality, crop } };
+}
+/**
+ * Parse the three path segments after the `assets/t/` prefix:
+ * `[directivesRaw, hash32, "{slug}.{ext}"]`. The raw route strips the
+ * `assets/t/` prefix and splits the remaining key by `/` before calling this.
+ */
+export function parseTransformPath(segments) {
+    if (segments.length !== 3) {
+        return err(`Expected 3 path segments (directives/hash32/slug.ext), got ${segments.length}`);
+    }
+    const [directivesRaw, hash32, slugExt] = segments;
+    if (!HASH32_RE.test(hash32)) {
+        return err(`Invalid hash32: '${hash32}'`);
+    }
+    const lastDot = slugExt.lastIndexOf('.');
+    if (lastDot <= 0 || lastDot === slugExt.length - 1) {
+        return err(`Invalid slug.ext segment: '${slugExt}'`);
+    }
+    const slug = slugExt.slice(0, lastDot);
+    const ext = slugExt.slice(lastDot + 1);
+    if (!SLUG_RE.test(slug)) {
+        return err(`Invalid slug: '${slug}'`);
+    }
+    if (!EXT_RE.test(ext)) {
+        return err(`Invalid ext: '${ext}'`);
+    }
+    const parsedDirectives = parseDirectivesString(directivesRaw);
+    if (!parsedDirectives.ok) {
+        return parsedDirectives;
+    }
+    const { directives } = parsedDirectives;
+    if (!directives.identity && directives.format !== undefined && directives.format !== ext) {
+        return err(`Extension '${ext}' does not match format '${directives.format}'`);
+    }
+    return { ok: true, directives, hash32, slug, ext };
+}
+/**
+ * Canonical string form of a directive set, so equivalent directive sets
+ * (different key order, different float formatting) always map to the same
+ * cache key. Order is fixed alphabetically by key: c, f, q, w.
+ */
+export function formatDirectives(directives) {
+    if (directives.identity) {
+        return IDENTITY_TRANSFORM_DIRECTIVE;
+    }
+    const parts = [];
+    if (directives.crop) {
+        const { x, y, w, h } = directives.crop;
+        parts.push(`c=${formatUnitFloat(x)}:${formatUnitFloat(y)}:${formatUnitFloat(w)}:${formatUnitFloat(h)}`);
+    }
+    if (directives.format !== undefined) {
+        parts.push(`f=${directives.format}`);
+    }
+    if (directives.quality !== undefined) {
+        parts.push(`q=${directives.quality}`);
+    }
+    if (directives.width !== undefined) {
+        parts.push(`w=${directives.width}`);
+    }
+    // A validly-parsed ResizeDirectives always has at least one field set
+    // (parseDirectivesString rejects an empty directive string), but a
+    // programmatically-constructed one (e.g. from asset-url.ts's merge logic)
+    // could end up all-undefined - fall back to identity rather than emit an
+    // empty directives segment.
+    return parts.length > 0 ? parts.join(',') : IDENTITY_TRANSFORM_DIRECTIVE;
+}
+//# sourceMappingURL=transform-directives.js.map

package/dist/assets/transform-directives.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"transform-directives.js","sourceRoot":"","sources":["../../src/assets/transform-directives.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,gFAAgF;AAChF,MAAM,CAAC,MAAM,4BAA4B,GAAG,MAAM,CAAA;AAsClD,MAAM,SAAS,GAAG,GAAG,CAAA;AACrB,MAAM,SAAS,GAAG,IAAI,CAAA;AACtB,MAAM,UAAU,GAAG,GAAG,CAAA;AAEtB;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,IAAI,GAAG,IAAI,CAAA;AAC3C,0EAA0E;AAC1E,4EAA4E;AAC5E,2EAA2E;AAC3E,6EAA6E;AAC7E,wEAAwE;AACxE,2EAA2E;AAC3E,MAAM,WAAW,GAAG,EAAE,CAAA;AACtB,MAAM,WAAW,GAAG,EAAE,CAAA;AACtB,MAAM,YAAY,GAAG,CAAC,CAAA;AACtB,MAAM,cAAc,GAAG,CAAC,CAAA;AAExB,MAAM,SAAS,GAAG,gBAAgB,CAAA;AAClC,MAAM,OAAO,GAAG,cAAc,CAAA;AAC9B,MAAM,MAAM,GAAG,kBAAkB,CAAA;AACjC,MAAM,eAAe,GAAG,eAAe,CAAA;AACvC,4EAA4E;AAC5E,4EAA4E;AAC5E,0EAA0E;AAC1E,4EAA4E;AAC5E,wEAAwE;AACxE,0EAA0E;AAC1E,8BAA8B;AAC9B,wDAAwD;AACxD,MAAM,aAAa,GAAG,iCAAiC,CAAA;AAEvD,MAAM,oBAAoB,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAA;AAE1D,SAAS,cAAc,CAAC,KAAa;IACnC,OAAO,KAAK,KAAK,MAAM,IAAI,KAAK,KAAK,MAAM,IAAI,KAAK,KAAK,KAAK,CAAA;AAChE,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,uBAAuB,CAAC,KAAa;IACnD,OAAO,CACL,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,SAAS,IAAI,KAAK,IAAI,SAAS,IAAI,KAAK,GAAG,UAAU,KAAK,CAAC,CAChG,CAAA;AACH,CAAC;AAED,SAAS,UAAU,CAAC,KAAa;IAC/B,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IAC7C,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAA;IACvB,OAAO,uBAAuB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;AAC9C,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,yBAAyB,CAAC,OAAe;IACvD,OAAO,CACL,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC;QACzB,OAAO,IAAI,WAAW;QACtB,OAAO,IAAI,WAAW;QACtB,OAAO,GAAG,YAAY,KAAK,CAAC,CAC7B,CAAA;AACH,CAAC;AAED,SAAS,YAAY,CAAC,KAAa;IACjC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IAC7C,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAA;IACvB,OAAO,yBAAyB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;AAChD,CAAC;AAED,SAAS,cAAc,CAAC,KAAa;IACnC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IAC3C,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAA;IACvB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;AACpC,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,eAAe,CAAC,CAAS,EAAE,CAAS,EAAE,CAAS,EAAE,CAAS;IACxE,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;QAC7B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,OAAO,KAAK,CAAA;IACzD,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAA;IAClC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAA;IACxC,OAAO,IAAI,CAAA;AACb,CAAC;AAED,SAAS,SAAS,CAAC,KAAa;IAC9B,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAC9B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IACnC,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,cAAc,CAAC,CAAA;IACtC,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC;QAAE,OAAO,IAAI,CAAA;IAC7C,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,GAAG,IAAgB,CAAA;IACrC,IAAI,CAAC,eAAe,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QAAE,OAAO,IAAI,CAAA;IAC7C,OAAO,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAA;AACvB,CAAC;AAED,SAAS,eAAe,CAAC,CAAS;IAChC,OAAO,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,CAAA;AAClC,CAAC;AAED,SAAS,GAAG,CAAC,KAAa;IACxB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAA;AAC7B,CAAC;AAED;;;;GAIG;AACH,SAAS,qBAAqB,CAC5B,GAAW;IAEX,IAAI,GAAG,KAAK,4BAA4B,EAAE,CAAC;QACzC,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,CAAA;IACrD,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrB,OAAO,GAAG,CAAC,kBAAkB,CAAC,CAAA;IAChC,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAA;IAC9B,IAAI,KAAyB,CAAA;IAC7B,IAAI,MAAgC,CAAA;IACpC,IAAI,OAA2B,CAAA;IAC/B,IAAI,IAA0B,CAAA;IAE9B,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QAClC,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QAC/B,0EAA0E;QAC1E,wEAAwE;QACxE,qEAAqE;QACrE,IAAI,KAAK,IAAI,CAAC,IAAI,KAAK,KAAK,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC5C,OAAO,GAAG,CAAC,yBAAyB,IAAI,GAAG,CAAC,CAAA;QAC9C,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAA;QAChC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAA;QAEnC,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACnC,OAAO,GAAG,CAAC,2BAA2B,GAAG,GAAG,CAAC,CAAA;QAC/C,CAAC;QACD,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAClB,OAAO,GAAG,CAAC,6BAA6B,GAAG,GAAG,CAAC,CAAA;QACjD,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QAEb,QAAQ,GAAG,EAAE,CAAC;YACZ,KAAK,GAAG,CAAC,CAAC,CAAC;gBACT,MAAM,CAAC,GAAG,UAAU,CAAC,KAAK,CAAC,CAAA;gBAC3B,IAAI,CAAC,KAAK,IAAI;oBAAE,OAAO,GAAG,CAAC,mBAAmB,KAAK,GAAG,CAAC,CAAA;gBACvD,KAAK,GAAG,CAAC,CAAA;gBACT,MAAK;YACP,CAAC;YACD,KAAK,GAAG,CAAC,CAAC,CAAC;gBACT,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC;oBAAE,OAAO,GAAG,CAAC,oBAAoB,KAAK,GAAG,CAAC,CAAA;gBACpE,MAAM,GAAG,KAAK,CAAA;gBACd,MAAK;YACP,CAAC;YACD,KAAK,GAAG,CAAC,CAAC,CAAC;gBACT,MAAM,CAAC,GAAG,YAAY,CAAC,KAAK,CAAC,CAAA;gBAC7B,IAAI,CAAC,KAAK,IAAI;oBAAE,OAAO,GAAG,CAAC,qBAAqB,KAAK,GAAG,CAAC,CAAA;gBACzD,OAAO,GAAG,CAAC,CAAA;gBACX,MAAK;YACP,CAAC;YACD,KAAK,GAAG,CAAC,CAAC,CAAC;gBACT,MAAM,CAAC,GAAG,SAAS,CAAC,KAAK,CAAC,CAAA;gBAC1B,IAAI,CAAC,CAAC;oBAAE,OAAO,GAAG,CAAC,kBAAkB,KAAK,GAAG,CAAC,CAAA;gBAC9C,IAAI,GAAG,CAAC,CAAA;gBACR,MAAK;YACP,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,CAAA;AACpF,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,QAA2B;IAC5D,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,GAAG,CAAC,8DAA8D,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAA;IAC7F,CAAC;IACD,MAAM,CAAC,aAAa,EAAE,MAAM,EAAE,OAAO,CAAC,GAAG,QAAQ,CAAA;IAEjD,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QAC5B,OAAO,GAAG,CAAC,oBAAoB,MAAM,GAAG,CAAC,CAAA;IAC3C,CAAC;IAED,MAAM,OAAO,GAAG,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,CAAA;IACxC,IAAI,OAAO,IAAI,CAAC,IAAI,OAAO,KAAK,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACnD,OAAO,GAAG,CAAC,8BAA8B,OAAO,GAAG,CAAC,CAAA;IACtD,CAAC;IACD,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,CAAA;IACtC,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC,CAAA;IACtC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACxB,OAAO,GAAG,CAAC,kBAAkB,IAAI,GAAG,CAAC,CAAA;IACvC,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACtB,OAAO,GAAG,CAAC,iBAAiB,GAAG,GAAG,CAAC,CAAA;IACrC,CAAC;IAED,MAAM,gBAAgB,GAAG,qBAAqB,CAAC,aAAa,CAAC,CAAA;IAC7D,IAAI,CAAC,gBAAgB,CAAC,EAAE,EAAE,CAAC;QACzB,OAAO,gBAAgB,CAAA;IACzB,CAAC;IAED,MAAM,EAAE,UAAU,EAAE,GAAG,gBAAgB,CAAA;IACvC,IAAI,CAAC,UAAU,CAAC,QAAQ,IAAI,UAAU,CAAC,MAAM,KAAK,SAAS,IAAI,UAAU,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QACzF,OAAO,GAAG,CAAC,cAAc,GAAG,4BAA4B,UAAU,CAAC,MAAM,GAAG,CAAC,CAAA;IAC/E,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,CAAA;AACpD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,UAA+B;IAC9D,IAAI,UAAU,CAAC,QAAQ,EAAE,CAAC;QACxB,OAAO,4BAA4B,CAAA;IACrC,CAAC;IAED,MAAM,KAAK,GAAa,EAAE,CAAA;IAC1B,IAAI,UAAU,CAAC,IAAI,EAAE,CAAC;QACpB,MAAM,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,GAAG,UAAU,CAAC,IAAI,CAAA;QACtC,KAAK,CAAC,IAAI,CACR,KAAK,eAAe,CAAC,CAAC,CAAC,IAAI,eAAe,CAAC,CAAC,CAAC,IAAI,eAAe,CAAC,CAAC,CAAC,IAAI,eAAe,CAAC,CAAC,CAAC,EAAE,CAC5F,CAAA;IACH,CAAC;IACD,IAAI,UAAU,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QACpC,KAAK,CAAC,IAAI,CAAC,KAAK,UAAU,CAAC,MAAM,EAAE,CAAC,CAAA;IACtC,CAAC;IACD,IAAI,UAAU,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QACrC,KAAK,CAAC,IAAI,CAAC,KAAK,UAAU,CAAC,OAAO,EAAE,CAAC,CAAA;IACvC,CAAC;IACD,IAAI,UAAU,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QACnC,KAAK,CAAC,IAAI,CAAC,KAAK,UAAU,CAAC,KAAK,EAAE,CAAC,CAAA;IACrC,CAAC;IAED,sEAAsE;IACtE,mEAAmE;IACnE,0EAA0E;IAC1E,yEAAyE;IACzE,4BAA4B;IAC5B,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,4BAA4B,CAAA;AAC1E,CAAC"}

package/dist/assets/transform.d.ts

@@ -0,0 +1,51 @@
+/**
+ * The shared transform engine: applies a parsed `TransformDirectives` to
+ * source image bytes with sharp. Server-only - never import this from
+ * client/editor code (this is why it lives in its own file, separate from
+ * the dependency-free transform-directives.ts). Used by the dev-mode lazy
+ * `/assets/t/*` emulation in api/assets.ts today, and will be reused
+ * unchanged by the prod transform Lambda (PR 7).
+ *
+ * Pipeline: a cheap metadata-only probe (`limitInputPixels: MAX_INPUT_PIXELS`,
+ * decompression-bomb defense #1) learns the real page count, so animated
+ * GIF/WebP frames can be capped at `MAX_ANIMATED_FRAMES` (decompression-bomb
+ * defense #2) without exceeding it and making sharp throw -> load for real
+ * with `{ pages: min(totalPages, MAX_ANIMATED_FRAMES), limitInputPixels }` ->
+ * `.rotate()` with no args (bakes EXIF orientation into pixels,
+ * dropping the orientation tag) -> optional crop via `.extract()` -> optional
+ * `.resize({ width, withoutEnlargement: true })` (never upscales) -> encode.
+ *
+ * Identity (`orig`) and any request that omits an explicit `f=` format
+ * re-encode through the SOURCE format rather than a fixed one: this is what
+ * guarantees EXIF/GPS gets stripped even when no other change is requested
+ * (sharp strips metadata by default on re-encode - `withMetadata()` is never
+ * called here, which would undo that).
+ *
+ * GIF has no EXIF segment (EXIF is a JPEG/TIFF APP1 marker; GIF has no such
+ * extension block), so an identity GIF has nothing to strip - it is still
+ * re-encoded through sharp's `.gif()` (verified: current sharp bundles cgif
+ * and re-encodes multi-frame GIFs through the `{ animated: true }` input
+ * path with no extra native dependency) purely for pipeline uniformity, not
+ * because GIF needs stripping.
+ */
+import { type TransformDirectives } from './transform-directives';
+export interface ApplyTransformInput {
+    data: Uint8Array;
+    /** Source extension (lowercased file-type ext, e.g. 'png' | 'jpg' | 'webp' | 'gif'). */
+    ext: string;
+}
+export interface TransformSuccess {
+    ok: true;
+    data: Uint8Array;
+    contentType: string;
+    ext: string;
+}
+export interface TransformRejection {
+    ok: false;
+    /** 400: unsupported input; 413: output too large; 422: sharp failed to process the input. */
+    status: 400 | 413 | 422;
+    error: string;
+}
+export type TransformResult = TransformSuccess | TransformRejection;
+export declare function applyTransform(input: ApplyTransformInput, directives: TransformDirectives): Promise<TransformResult>;
+//# sourceMappingURL=transform.d.ts.map

package/dist/assets/transform.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"transform.d.ts","sourceRoot":"","sources":["../../src/assets/transform.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAKH,OAAO,EAIL,KAAK,mBAAmB,EACzB,MAAM,wBAAwB,CAAA;AAyC/B,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,UAAU,CAAA;IAChB,wFAAwF;IACxF,GAAG,EAAE,MAAM,CAAA;CACZ;AAED,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,IAAI,CAAA;IACR,IAAI,EAAE,UAAU,CAAA;IAChB,WAAW,EAAE,MAAM,CAAA;IACnB,GAAG,EAAE,MAAM,CAAA;CACZ;AAED,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,KAAK,CAAA;IACT,6FAA6F;IAC7F,MAAM,EAAE,GAAG,GAAG,GAAG,GAAG,GAAG,CAAA;IACvB,KAAK,EAAE,MAAM,CAAA;CACd;AAED,MAAM,MAAM,eAAe,GAAG,gBAAgB,GAAG,kBAAkB,CAAA;AAgFnE,wBAAsB,cAAc,CAClC,KAAK,EAAE,mBAAmB,EAC1B,UAAU,EAAE,mBAAmB,GAC9B,OAAO,CAAC,eAAe,CAAC,CAwE1B"}

package/dist/assets/transform.js

@@ -0,0 +1,190 @@
+/**
+ * The shared transform engine: applies a parsed `TransformDirectives` to
+ * source image bytes with sharp. Server-only - never import this from
+ * client/editor code (this is why it lives in its own file, separate from
+ * the dependency-free transform-directives.ts). Used by the dev-mode lazy
+ * `/assets/t/*` emulation in api/assets.ts today, and will be reused
+ * unchanged by the prod transform Lambda (PR 7).
+ *
+ * Pipeline: a cheap metadata-only probe (`limitInputPixels: MAX_INPUT_PIXELS`,
+ * decompression-bomb defense #1) learns the real page count, so animated
+ * GIF/WebP frames can be capped at `MAX_ANIMATED_FRAMES` (decompression-bomb
+ * defense #2) without exceeding it and making sharp throw -> load for real
+ * with `{ pages: min(totalPages, MAX_ANIMATED_FRAMES), limitInputPixels }` ->
+ * `.rotate()` with no args (bakes EXIF orientation into pixels,
+ * dropping the orientation tag) -> optional crop via `.extract()` -> optional
+ * `.resize({ width, withoutEnlargement: true })` (never upscales) -> encode.
+ *
+ * Identity (`orig`) and any request that omits an explicit `f=` format
+ * re-encode through the SOURCE format rather than a fixed one: this is what
+ * guarantees EXIF/GPS gets stripped even when no other change is requested
+ * (sharp strips metadata by default on re-encode - `withMetadata()` is never
+ * called here, which would undo that).
+ *
+ * GIF has no EXIF segment (EXIF is a JPEG/TIFF APP1 marker; GIF has no such
+ * extension block), so an identity GIF has nothing to strip - it is still
+ * re-encoded through sharp's `.gif()` (verified: current sharp bundles cgif
+ * and re-encodes multi-frame GIFs through the `{ animated: true }` input
+ * path with no extra native dependency) purely for pipeline uniformity, not
+ * because GIF needs stripping.
+ */
+import sharp from 'sharp';
+import { getErrorMessage } from '../utils/error.js';
+import { MAX_INPUT_PIXELS, } from './transform-directives.js';
+/** Raster formats the transform engine accepts as input. svg/pdf never reach here - they're served statically. */
+const ALLOWED_INPUT_EXTS = new Set(['png', 'jpg', 'jpeg', 'webp', 'gif']);
+/** Defensive cap on encoded output size - prevents cache-stuffing with giant re-encodes. */
+const MAX_OUTPUT_BYTES = 10 * 1024 * 1024;
+/**
+ * Cap on decoded animated frames (GIF/WebP) - without this, `{ animated: true }`
+ * (sharp's `pages: -1`) decodes every frame of a maliciously-crafted
+ * many-thousand-frame animation into memory at once, a decompression-bomb
+ * vector distinct from (and not covered by) `limitInputPixels`, which only
+ * bounds a single frame's width x height. 60 frames covers any reasonable
+ * animated asset (2s at 30fps) with headroom.
+ */
+const MAX_ANIMATED_FRAMES = 60;
+const CONTENT_TYPE_BY_FORMAT = {
+    webp: 'image/webp',
+    jpeg: 'image/jpeg',
+    png: 'image/png',
+};
+const CONTENT_TYPE_BY_EXT = {
+    png: 'image/png',
+    jpg: 'image/jpeg',
+    jpeg: 'image/jpeg',
+    webp: 'image/webp',
+    gif: 'image/gif',
+};
+/**
+ * Dimensions AFTER `.rotate()` has auto-oriented the pixels. sharp's
+ * `metadata()` reports the RAW (pre-rotation) width/height plus the EXIF
+ * `orientation` tag; for orientation 5-8 (the 90-degree rotations that
+ * portrait phone photos almost always carry) the visual axes are swapped.
+ * The crop rect was normalized by the editor against the browser's
+ * auto-oriented preview, so `.extract()` - which runs on the post-rotation
+ * pipeline - must be computed against these swapped dims, NOT the raw ones.
+ * Using the raw dims makes the extract region exceed the rotated image's
+ * bounds and sharp throws `bad extract area`. sharp >=0.33 also exposes an
+ * `autoOrient` block with the corrected dims; prefer it when present.
+ */
+function orientedDimensions(meta) {
+    const auto = meta.autoOrient;
+    if (auto && auto.width && auto.height) {
+        return { width: auto.width, height: auto.height };
+    }
+    if (!meta.width || !meta.height)
+        return null;
+    const swap = typeof meta.orientation === 'number' && meta.orientation >= 5 && meta.orientation <= 8;
+    return swap
+        ? { width: meta.height, height: meta.width }
+        : { width: meta.width, height: meta.height };
+}
+/**
+ * Compute a sharp `.extract()` region from a normalized crop rect and the
+ * (post-rotation) image dimensions. Rounds the left/top and right/bottom
+ * edges independently, then derives width/height from their difference -
+ * rounding width/height directly from `crop.w`/`crop.h` could drift the
+ * region past the image bounds when combined with independently-rounded
+ * left/top. Clamped defensively so float error can never produce an
+ * out-of-range extract (which sharp throws on).
+ */
+function computeExtractRegion(crop, width, height) {
+    const left = Math.min(Math.max(Math.round(crop.x * width), 0), Math.max(width - 1, 0));
+    const top = Math.min(Math.max(Math.round(crop.y * height), 0), Math.max(height - 1, 0));
+    const right = Math.min(Math.round((crop.x + crop.w) * width), width);
+    const bottom = Math.min(Math.round((crop.y + crop.h) * height), height);
+    const extractWidth = Math.max(1, right - left);
+    const extractHeight = Math.max(1, bottom - top);
+    return { left, top, width: extractWidth, height: extractHeight };
+}
+function encode(pipeline, format, quality) {
+    const options = quality !== undefined ? { quality } : undefined;
+    switch (format) {
+        case 'webp':
+            return pipeline.webp(options);
+        case 'jpeg':
+            return pipeline.jpeg(options);
+        case 'png':
+            return pipeline.png(options);
+    }
+}
+/** Re-encode through the source container format - used for identity and for requests that omit `f=`. */
+function encodeSourceFormat(pipeline, sourceExt) {
+    switch (sourceExt) {
+        case 'gif':
+            return pipeline.gif();
+        case 'webp':
+            return pipeline.webp();
+        case 'jpg':
+        case 'jpeg':
+            return pipeline.jpeg();
+        case 'png':
+        default:
+            return pipeline.png();
+    }
+}
+export async function applyTransform(input, directives) {
+    const sourceExt = input.ext.toLowerCase();
+    if (!ALLOWED_INPUT_EXTS.has(sourceExt)) {
+        return {
+            ok: false,
+            status: 400,
+            error: `Unsupported input format for transform: '${sourceExt}'`,
+        };
+    }
+    const resize = directives.identity ? undefined : directives;
+    const format = resize?.format;
+    const quality = resize?.quality;
+    try {
+        // A cheap header/metadata-only probe (no pixel decode - verified this
+        // costs effectively nothing even for a several-hundred-frame source) to
+        // learn the source's real page count before deciding whether to cap it.
+        // This has to happen before constructing the real pipeline: sharp's
+        // `pages` constructor option is a fixed request, not an upper bound - a
+        // `pages` value that EXCEEDS the source's actual page count makes sharp
+        // throw ("bad page number") rather than clamping, so `MAX_ANIMATED_FRAMES`
+        // can only be applied as `Math.min(totalPages, MAX_ANIMATED_FRAMES)`.
+        // `limitInputPixels` gates this probe exactly like it gates the real
+        // pipeline below - an oversized source throws here already, before any
+        // pixel buffer is ever allocated.
+        const probeMeta = await sharp(input.data, { limitInputPixels: MAX_INPUT_PIXELS }).metadata();
+        const totalPages = probeMeta.pages ?? 1;
+        const pagesToRead = Math.min(totalPages, MAX_ANIMATED_FRAMES);
+        let pipeline = sharp(input.data, {
+            pages: pagesToRead,
+            limitInputPixels: MAX_INPUT_PIXELS,
+        }).rotate();
+        if (resize?.crop) {
+            const oriented = orientedDimensions(await pipeline.metadata());
+            if (!oriented) {
+                return { ok: false, status: 422, error: 'Could not read image dimensions for crop' };
+            }
+            pipeline = pipeline.extract(computeExtractRegion(resize.crop, oriented.width, oriented.height));
+        }
+        if (resize?.width) {
+            pipeline = pipeline.resize({ width: resize.width, withoutEnlargement: true });
+        }
+        pipeline = format ? encode(pipeline, format, quality) : encodeSourceFormat(pipeline, sourceExt);
+        const data = await pipeline.toBuffer();
+        if (data.byteLength > MAX_OUTPUT_BYTES) {
+            return {
+                ok: false,
+                status: 413,
+                error: `Transformed output (${data.byteLength} bytes) exceeds the ${MAX_OUTPUT_BYTES}-byte cap`,
+            };
+        }
+        const outExt = format ?? sourceExt;
+        const contentType = format ? CONTENT_TYPE_BY_FORMAT[format] : CONTENT_TYPE_BY_EXT[sourceExt];
+        return {
+            ok: true,
+            data: new Uint8Array(data.buffer, data.byteOffset, data.byteLength),
+            contentType,
+            ext: outExt,
+        };
+    }
+    catch (err) {
+        return { ok: false, status: 422, error: `Transform failed: ${getErrorMessage(err)}` };
+    }
+}
+//# sourceMappingURL=transform.js.map

package/dist/assets/transform.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"transform.js","sourceRoot":"","sources":["../../src/assets/transform.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,OAAO,KAAK,MAAM,OAAO,CAAA;AAEzB,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAA;AAChD,OAAO,EACL,gBAAgB,GAIjB,MAAM,wBAAwB,CAAA;AAW/B,kHAAkH;AAClH,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC,CAAA;AAEzE,4FAA4F;AAC5F,MAAM,gBAAgB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAA;AAEzC;;;;;;;GAOG;AACH,MAAM,mBAAmB,GAAG,EAAE,CAAA;AAE9B,MAAM,sBAAsB,GAAiC;IAC3D,IAAI,EAAE,YAAY;IAClB,IAAI,EAAE,YAAY;IAClB,GAAG,EAAE,WAAW;CACjB,CAAA;AAED,MAAM,mBAAmB,GAA2B;IAClD,GAAG,EAAE,WAAW;IAChB,GAAG,EAAE,YAAY;IACjB,IAAI,EAAE,YAAY;IAClB,IAAI,EAAE,YAAY;IAClB,GAAG,EAAE,WAAW;CACjB,CAAA;AAwBD;;;;;;;;;;;GAWG;AACH,SAAS,kBAAkB,CACzB,IAAoD;IAEpD,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,CAAA;IAC5B,IAAI,IAAI,IAAI,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QACtC,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAA;IACnD,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAA;IAC5C,MAAM,IAAI,GACR,OAAO,IAAI,CAAC,WAAW,KAAK,QAAQ,IAAI,IAAI,CAAC,WAAW,IAAI,CAAC,IAAI,IAAI,CAAC,WAAW,IAAI,CAAC,CAAA;IACxF,OAAO,IAAI;QACT,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,KAAK,EAAE;QAC5C,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAA;AAChD,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,oBAAoB,CAC3B,IAAc,EACd,KAAa,EACb,MAAc;IAEd,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,KAAK,CAAC,EAAE,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;IACtF,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;IACvF,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,EAAE,KAAK,CAAC,CAAA;IACpE,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,EAAE,MAAM,CAAC,CAAA;IACvE,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,CAAA;IAC9C,MAAM,aAAa,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,GAAG,GAAG,CAAC,CAAA;IAC/C,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,YAAY,EAAE,MAAM,EAAE,aAAa,EAAE,CAAA;AAClE,CAAC;AAED,SAAS,MAAM,CAAC,QAAuB,EAAE,MAAoB,EAAE,OAA2B;IACxF,MAAM,OAAO,GAAG,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,SAAS,CAAA;IAC/D,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,MAAM;YACT,OAAO,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;QAC/B,KAAK,MAAM;YACT,OAAO,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;QAC/B,KAAK,KAAK;YACR,OAAO,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;IAChC,CAAC;AACH,CAAC;AAED,yGAAyG;AACzG,SAAS,kBAAkB,CAAC,QAAuB,EAAE,SAAiB;IACpE,QAAQ,SAAS,EAAE,CAAC;QAClB,KAAK,KAAK;YACR,OAAO,QAAQ,CAAC,GAAG,EAAE,CAAA;QACvB,KAAK,MAAM;YACT,OAAO,QAAQ,CAAC,IAAI,EAAE,CAAA;QACxB,KAAK,KAAK,CAAC;QACX,KAAK,MAAM;YACT,OAAO,QAAQ,CAAC,IAAI,EAAE,CAAA;QACxB,KAAK,KAAK,CAAC;QACX;YACE,OAAO,QAAQ,CAAC,GAAG,EAAE,CAAA;IACzB,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,KAA0B,EAC1B,UAA+B;IAE/B,MAAM,SAAS,GAAG,KAAK,CAAC,GAAG,CAAC,WAAW,EAAE,CAAA;IACzC,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;QACvC,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,GAAG;YACX,KAAK,EAAE,4CAA4C,SAAS,GAAG;SAChE,CAAA;IACH,CAAC;IAED,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,CAAA;IAC3D,MAAM,MAAM,GAAG,MAAM,EAAE,MAAM,CAAA;IAC7B,MAAM,OAAO,GAAG,MAAM,EAAE,OAAO,CAAA;IAE/B,IAAI,CAAC;QACH,sEAAsE;QACtE,wEAAwE;QACxE,wEAAwE;QACxE,oEAAoE;QACpE,wEAAwE;QACxE,wEAAwE;QACxE,2EAA2E;QAC3E,sEAAsE;QACtE,qEAAqE;QACrE,uEAAuE;QACvE,kCAAkC;QAClC,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAA;QAC5F,MAAM,UAAU,GAAG,SAAS,CAAC,KAAK,IAAI,CAAC,CAAA;QACvC,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,mBAAmB,CAAC,CAAA;QAE7D,IAAI,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE;YAC/B,KAAK,EAAE,WAAW;YAClB,gBAAgB,EAAE,gBAAgB;SACnC,CAAC,CAAC,MAAM,EAAE,CAAA;QAEX,IAAI,MAAM,EAAE,IAAI,EAAE,CAAC;YACjB,MAAM,QAAQ,GAAG,kBAAkB,CAAC,MAAM,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAA;YAC9D,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,0CAA0C,EAAE,CAAA;YACtF,CAAC;YACD,QAAQ,GAAG,QAAQ,CAAC,OAAO,CACzB,oBAAoB,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,CACnE,CAAA;QACH,CAAC;QAED,IAAI,MAAM,EAAE,KAAK,EAAE,CAAC;YAClB,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,kBAAkB,EAAE,IAAI,EAAE,CAAC,CAAA;QAC/E,CAAC;QAED,QAAQ,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAA;QAE/F,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,CAAA;QACtC,IAAI,IAAI,CAAC,UAAU,GAAG,gBAAgB,EAAE,CAAC;YACvC,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,GAAG;gBACX,KAAK,EAAE,uBAAuB,IAAI,CAAC,UAAU,uBAAuB,gBAAgB,WAAW;aAChG,CAAA;QACH,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,IAAI,SAAS,CAAA;QAClC,MAAM,WAAW,GAAG,MAAM,CAAC,CAAC,CAAC,sBAAsB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,mBAAmB,CAAC,SAAS,CAAC,CAAA;QAE5F,OAAO;YACL,EAAE,EAAE,IAAI;YACR,IAAI,EAAE,IAAI,UAAU,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,UAAU,CAAC;YACnE,WAAW;YACX,GAAG,EAAE,MAAM;SACZ,CAAA;IACH,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,qBAAqB,eAAe,CAAC,GAAG,CAAC,EAAE,EAAE,CAAA;IACvF,CAAC;AACH,CAAC"}

package/dist/assets/types.d.ts

@@ -0,0 +1,82 @@
+/**
+ * Asset store v2 contract.
+ *
+ * Pure type declarations only — no runtime imports. This lets client-side code
+ * (the editor) `import type` from this file without ever pulling node:fs or the
+ * S3 SDK into a browser bundle. The concrete stores (store-local.ts, store-s3.ts)
+ * and the factory are server-only and must never be imported from client code.
+ */
+export interface AssetMeta {
+    hash32: string;
+    filename: string;
+    slug: string;
+    ext: string;
+    mime: string;
+    size: number;
+    width?: number;
+    height?: number;
+    kind: 'raster' | 'svg' | 'pdf';
+    uploadedBy?: string;
+    uploadedAt: string;
+}
+export type StagedUploadTarget = {
+    mode: 'direct';
+    url: string;
+    fields: Record<string, string>;
+    stagingKey: string;
+    maxBytes: number;
+} | {
+    mode: 'proxied';
+    stagingKey: string;
+    maxBytes: number;
+};
+export interface BeginUploadInput {
+    filename: string;
+    contentType: string;
+    size?: number;
+}
+export interface PublicObject {
+    data: Uint8Array;
+    contentType?: string;
+    contentDisposition?: string;
+    cacheControl?: string;
+}
+export interface AssetStore {
+    readonly capabilities: {
+        directUpload: boolean;
+    };
+    beginUpload(input: BeginUploadInput): Promise<StagedUploadTarget>;
+    writeStaging(stagingKey: string, data: Uint8Array, contentType?: string): Promise<void>;
+    readStaging(stagingKey: string): Promise<Uint8Array | null>;
+    deleteStaging(stagingKey: string): Promise<void>;
+    putOriginal(input: {
+        hash32: string;
+        ext: string;
+        data: Uint8Array;
+        contentType: string;
+    }): Promise<void>;
+    readOriginal(hash32: string): Promise<{
+        data: Uint8Array;
+        ext: string;
+        contentType?: string;
+    } | null>;
+    putPublicObject(input: {
+        key: string;
+        data: Uint8Array;
+        contentType: string;
+        contentDisposition?: string;
+        cacheControl?: string;
+    }): Promise<void>;
+    readPublicObject(key: string): Promise<PublicObject | null>;
+    putMetaIfAbsent(hash32: string, meta: AssetMeta): Promise<'created' | 'already-exists'>;
+    getMeta(hash32: string): Promise<AssetMeta | null>;
+    listMeta(input?: {
+        cursor?: string;
+        limit?: number;
+    }): Promise<{
+        items: AssetMeta[];
+        nextCursor?: string;
+    }>;
+    deleteMeta(hash32: string): Promise<void>;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/assets/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/assets/types.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,MAAM,WAAW,SAAS;IACxB,MAAM,EAAE,MAAM,CAAA;IACd,QAAQ,EAAE,MAAM,CAAA;IAChB,IAAI,EAAE,MAAM,CAAA;IACZ,GAAG,EAAE,MAAM,CAAA;IACX,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,MAAM,CAAA;IACZ,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,IAAI,EAAE,QAAQ,GAAG,KAAK,GAAG,KAAK,CAAA;IAC9B,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,UAAU,EAAE,MAAM,CAAA;CACnB;AAED,MAAM,MAAM,kBAAkB,GAC1B;IACE,IAAI,EAAE,QAAQ,CAAA;IACd,GAAG,EAAE,MAAM,CAAA;IACX,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC9B,UAAU,EAAE,MAAM,CAAA;IAClB,QAAQ,EAAE,MAAM,CAAA;CACjB,GACD;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAA;AAE7D,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,MAAM,CAAA;IAChB,WAAW,EAAE,MAAM,CAAA;IACnB,IAAI,CAAC,EAAE,MAAM,CAAA;CACd;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,UAAU,CAAA;IAChB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,kBAAkB,CAAC,EAAE,MAAM,CAAA;IAC3B,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,YAAY,EAAE;QAAE,YAAY,EAAE,OAAO,CAAA;KAAE,CAAA;IAChD,WAAW,CAAC,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAA;IACjE,YAAY,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACvF,WAAW,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAAA;IAC3D,aAAa,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAChD,WAAW,CAAC,KAAK,EAAE;QACjB,MAAM,EAAE,MAAM,CAAA;QACd,GAAG,EAAE,MAAM,CAAA;QACX,IAAI,EAAE,UAAU,CAAA;QAChB,WAAW,EAAE,MAAM,CAAA;KACpB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACjB,YAAY,CACV,MAAM,EAAE,MAAM,GACb,OAAO,CAAC;QAAE,IAAI,EAAE,UAAU,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC,CAAA;IAC1E,eAAe,CAAC,KAAK,EAAE;QACrB,GAAG,EAAE,MAAM,CAAA;QACX,IAAI,EAAE,UAAU,CAAA;QAChB,WAAW,EAAE,MAAM,CAAA;QACnB,kBAAkB,CAAC,EAAE,MAAM,CAAA;QAC3B,YAAY,CAAC,EAAE,MAAM,CAAA;KACtB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACjB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAAA;IAC3D,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC,SAAS,GAAG,gBAAgB,CAAC,CAAA;IACvF,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAAA;IAClD,QAAQ,CAAC,KAAK,CAAC,EAAE;QACf,MAAM,CAAC,EAAE,MAAM,CAAA;QACf,KAAK,CAAC,EAAE,MAAM,CAAA;KACf,GAAG,OAAO,CAAC;QAAE,KAAK,EAAE,SAAS,EAAE,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IACxD,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CAC1C"}

package/dist/assets/types.js

@@ -0,0 +1,10 @@
+/**
+ * Asset store v2 contract.
+ *
+ * Pure type declarations only — no runtime imports. This lets client-side code
+ * (the editor) `import type` from this file without ever pulling node:fs or the
+ * S3 SDK into a browser bundle. The concrete stores (store-local.ts, store-s3.ts)
+ * and the factory are server-only and must never be imported from client code.
+ */
+export {};
+//# sourceMappingURL=types.js.map

package/dist/assets/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/assets/types.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG"}

package/dist/authorization/groups/schema.d.ts

@@ -28,8 +28,8 @@ export declare const GroupsFileSchema: z.ZodObject<{
         description?: string | undefined;
     }>, "many">;
 }, "strip", z.ZodTypeAny, {
-    updatedAt: string;
     version: 1;
+    updatedAt: string;
     groups: {
         name: string;
         members: string[];
@@ -39,8 +39,8 @@ export declare const GroupsFileSchema: z.ZodObject<{
     updatedBy: string;
     contentVersion?: number | undefined;
 }, {
-    updatedAt: string;
     version: 1;
+    updatedAt: string;
     groups: {
         name: string;
         members: string[];