canopycms 0.0.57 → 0.0.59

package/dist/assets/finalize.js

@@ -0,0 +1,72 @@
+/**
+ * Store orchestration around the (pure) finalize pipeline: dedup, write, and
+ * best-effort staging cleanup. Split from pipeline.ts so the pipeline itself
+ * stays store-agnostic and trivially unit-testable with plain byte fixtures.
+ */
+import { runFinalizePipeline } from './pipeline.js';
+import { ASSET_PREFIXES } from './keys.js';
+/**
+ * A client-supplied staging key must be exactly `asset-staging/{uuid}` — the
+ * shape beginUpload generates. Without this check, finalize's read + cleanup
+ * would operate on ANY key the store can reach (asset-meta/, asset-originals/,
+ * or in a shared bucket even builds/), letting a non-admin delete arbitrary
+ * objects via the best-effort deleteStaging. Stores with overridden staging
+ * prefixes must parameterize this check if that escape hatch is ever used.
+ */
+const STAGING_UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
+export function isValidStagingKey(key) {
+    const prefix = `${ASSET_PREFIXES.staging}/`;
+    return key.startsWith(prefix) && STAGING_UUID_PATTERN.test(key.slice(prefix.length));
+}
+/**
+ * Run the finalize pipeline over raw bytes and persist the result.
+ *
+ * Order matters here too: dedup FIRST (after hashing, inside the pipeline) -
+ * if an identical blob already exists, return the existing meta and skip all
+ * writes entirely (first-name-wins). Otherwise write the original, then the
+ * optional public object, then `putMetaIfAbsent` LAST: meta is the commit
+ * point for an asset's existence, so a crash between `putOriginal` and here
+ * leaves only orphaned (harmless, content-addressed) blobs, never a meta
+ * record pointing at a missing blob.
+ */
+export async function finalizeAsset(store, input) {
+    const result = await runFinalizePipeline(input);
+    if (!result.ok)
+        return result;
+    const { meta, data, publicObject } = result;
+    const existing = await store.getMeta(meta.hash32);
+    if (existing)
+        return { ok: true, meta: existing };
+    await store.putOriginal({ hash32: meta.hash32, ext: meta.ext, data, contentType: meta.mime });
+    if (publicObject) {
+        await store.putPublicObject(publicObject);
+    }
+    const putResult = await store.putMetaIfAbsent(meta.hash32, meta);
+    if (putResult === 'already-exists') {
+        // Lost a race against a concurrent identical upload - the winner's meta
+        // (already committed) is authoritative; return it rather than ours.
+        const winner = await store.getMeta(meta.hash32);
+        if (winner)
+            return { ok: true, meta: winner };
+    }
+    return { ok: true, meta };
+}
+/**
+ * Finalize a previously-staged upload: read the staged bytes, run
+ * `finalizeAsset`, and best-effort delete the staging object regardless of
+ * outcome (success OR pipeline rejection - a rejected upload's staged bytes
+ * are just as much litter as an accepted one's).
+ */
+export async function finalizeStagedUpload(store, stagingKey, filename, uploadedBy) {
+    if (!isValidStagingKey(stagingKey)) {
+        return { ok: false, status: 400, error: 'Invalid staging key' };
+    }
+    const staged = await store.readStaging(stagingKey);
+    if (!staged) {
+        return { ok: false, status: 404, error: 'Staged upload not found or expired' };
+    }
+    const result = await finalizeAsset(store, { data: staged, filename, uploadedBy });
+    await store.deleteStaging(stagingKey).catch(() => { });
+    return result;
+}
+//# sourceMappingURL=finalize.js.map

package/dist/assets/finalize.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"finalize.js","sourceRoot":"","sources":["../../src/assets/finalize.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,mBAAmB,EAA8C,MAAM,YAAY,CAAA;AAC5F,OAAO,EAAE,cAAc,EAAE,MAAM,QAAQ,CAAA;AAGvC;;;;;;;GAOG;AACH,MAAM,oBAAoB,GAAG,gEAAgE,CAAA;AAE7F,MAAM,UAAU,iBAAiB,CAAC,GAAW;IAC3C,MAAM,MAAM,GAAG,GAAG,cAAc,CAAC,OAAO,GAAG,CAAA;IAC3C,OAAO,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,oBAAoB,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAA;AACtF,CAAC;AAID;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,KAAiB,EACjB,KAAoB;IAEpB,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,KAAK,CAAC,CAAA;IAC/C,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,OAAO,MAAM,CAAA;IAE7B,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,MAAM,CAAA;IAE3C,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;IACjD,IAAI,QAAQ;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAA;IAEjD,MAAM,KAAK,CAAC,WAAW,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAA;IAC7F,IAAI,YAAY,EAAE,CAAC;QACjB,MAAM,KAAK,CAAC,eAAe,CAAC,YAAY,CAAC,CAAA;IAC3C,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC,eAAe,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;IAChE,IAAI,SAAS,KAAK,gBAAgB,EAAE,CAAC;QACnC,wEAAwE;QACxE,oEAAoE;QACpE,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;QAC/C,IAAI,MAAM;YAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,CAAA;IAC/C,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAA;AAC3B,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,KAAiB,EACjB,UAAkB,EAClB,QAAgB,EAChB,UAAmB;IAEnB,IAAI,CAAC,iBAAiB,CAAC,UAAU,CAAC,EAAE,CAAC;QACnC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,qBAAqB,EAAE,CAAA;IACjE,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,WAAW,CAAC,UAAU,CAAC,CAAA;IAClD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,oCAAoC,EAAE,CAAA;IAChF,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC,CAAA;IACjF,MAAM,KAAK,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;IACrD,OAAO,MAAM,CAAA;AACf,CAAC"}

package/dist/assets/index.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Internal module barrel for the assets/ store implementation. NOT a package
+ * entrypoint — server code within canopycms imports from here or from the
+ * individual files; client-side code (the editor) must `import type` from
+ * ./types directly instead, so node:fs/S3-SDK imports never reach a browser
+ * bundle.
+ */
+export type { AssetMeta, AssetStore, BeginUploadInput, PublicObject, StagedUploadTarget, } from './types';
+export { ASSET_PREFIXES, createKeyBuilders, hashBytes, metaKey, metaPrefix, originalKey, originalPrefix, publicKey, slugifyFilename, stagingKey, type AssetPrefixes, } from './keys';
+export { LocalAssetStore, type LocalAssetStoreOptions } from './store-local';
+export { S3AssetStore, type S3AssetStoreOptions } from './store-s3';
+export { createAssetStore } from './factory';
+export { ALLOWED_UPLOAD_CONTENT_TYPES, runFinalizePipeline, type FinalizeInput, type FinalizePublicObject, type FinalizeResult, type FinalizeRejection, type FinalizeSuccess, } from './pipeline';
+export { finalizeAsset, finalizeStagedUpload, type FinalizeAssetResult } from './finalize';
+export { sanitizeSvg } from './svg-sanitizer';
+export { assetSrc, IDENTITY_TRANSFORM_DIRECTIVE } from './asset-src';
+export { formatDirectives, isAllowedTransformWidth, isValidCropRect, parseTransformPath, type CropRect, type IdentityDirectives, type OutputFormat, type ParsedTransformPath, type ParseTransformPathResult, type ResizeDirectives, type TransformDirectives, } from './transform-directives';
+export { applyTransform, type ApplyTransformInput, type TransformResult } from './transform';
+export { assetUrl, assetSrcSet, type AssetRef, type AssetUrlOptions } from './asset-url';
+//# sourceMappingURL=index.d.ts.map

package/dist/assets/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/assets/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,YAAY,EACV,SAAS,EACT,UAAU,EACV,gBAAgB,EAChB,YAAY,EACZ,kBAAkB,GACnB,MAAM,SAAS,CAAA;AAEhB,OAAO,EACL,cAAc,EACd,iBAAiB,EACjB,SAAS,EACT,OAAO,EACP,UAAU,EACV,WAAW,EACX,cAAc,EACd,SAAS,EACT,eAAe,EACf,UAAU,EACV,KAAK,aAAa,GACnB,MAAM,QAAQ,CAAA;AAEf,OAAO,EAAE,eAAe,EAAE,KAAK,sBAAsB,EAAE,MAAM,eAAe,CAAA;AAC5E,OAAO,EAAE,YAAY,EAAE,KAAK,mBAAmB,EAAE,MAAM,YAAY,CAAA;AACnE,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAA;AAE5C,OAAO,EACL,4BAA4B,EAC5B,mBAAmB,EACnB,KAAK,aAAa,EAClB,KAAK,oBAAoB,EACzB,KAAK,cAAc,EACnB,KAAK,iBAAiB,EACtB,KAAK,eAAe,GACrB,MAAM,YAAY,CAAA;AAEnB,OAAO,EAAE,aAAa,EAAE,oBAAoB,EAAE,KAAK,mBAAmB,EAAE,MAAM,YAAY,CAAA;AAE1F,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAA;AAE7C,OAAO,EAAE,QAAQ,EAAE,4BAA4B,EAAE,MAAM,aAAa,CAAA;AAEpE,OAAO,EACL,gBAAgB,EAChB,uBAAuB,EACvB,eAAe,EACf,kBAAkB,EAClB,KAAK,QAAQ,EACb,KAAK,kBAAkB,EACvB,KAAK,YAAY,EACjB,KAAK,mBAAmB,EACxB,KAAK,wBAAwB,EAC7B,KAAK,gBAAgB,EACrB,KAAK,mBAAmB,GACzB,MAAM,wBAAwB,CAAA;AAE/B,OAAO,EAAE,cAAc,EAAE,KAAK,mBAAmB,EAAE,KAAK,eAAe,EAAE,MAAM,aAAa,CAAA;AAE5F,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,KAAK,QAAQ,EAAE,KAAK,eAAe,EAAE,MAAM,aAAa,CAAA"}

package/dist/assets/index.js

@@ -0,0 +1,19 @@
+/**
+ * Internal module barrel for the assets/ store implementation. NOT a package
+ * entrypoint — server code within canopycms imports from here or from the
+ * individual files; client-side code (the editor) must `import type` from
+ * ./types directly instead, so node:fs/S3-SDK imports never reach a browser
+ * bundle.
+ */
+export { ASSET_PREFIXES, createKeyBuilders, hashBytes, metaKey, metaPrefix, originalKey, originalPrefix, publicKey, slugifyFilename, stagingKey, } from './keys.js';
+export { LocalAssetStore } from './store-local.js';
+export { S3AssetStore } from './store-s3.js';
+export { createAssetStore } from './factory.js';
+export { ALLOWED_UPLOAD_CONTENT_TYPES, runFinalizePipeline, } from './pipeline.js';
+export { finalizeAsset, finalizeStagedUpload } from './finalize.js';
+export { sanitizeSvg } from './svg-sanitizer.js';
+export { assetSrc, IDENTITY_TRANSFORM_DIRECTIVE } from './asset-src.js';
+export { formatDirectives, isAllowedTransformWidth, isValidCropRect, parseTransformPath, } from './transform-directives.js';
+export { applyTransform } from './transform.js';
+export { assetUrl, assetSrcSet } from './asset-url.js';
+//# sourceMappingURL=index.js.map

package/dist/assets/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/assets/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAUH,OAAO,EACL,cAAc,EACd,iBAAiB,EACjB,SAAS,EACT,OAAO,EACP,UAAU,EACV,WAAW,EACX,cAAc,EACd,SAAS,EACT,eAAe,EACf,UAAU,GAEX,MAAM,QAAQ,CAAA;AAEf,OAAO,EAAE,eAAe,EAA+B,MAAM,eAAe,CAAA;AAC5E,OAAO,EAAE,YAAY,EAA4B,MAAM,YAAY,CAAA;AACnE,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAA;AAE5C,OAAO,EACL,4BAA4B,EAC5B,mBAAmB,GAMpB,MAAM,YAAY,CAAA;AAEnB,OAAO,EAAE,aAAa,EAAE,oBAAoB,EAA4B,MAAM,YAAY,CAAA;AAE1F,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAA;AAE7C,OAAO,EAAE,QAAQ,EAAE,4BAA4B,EAAE,MAAM,aAAa,CAAA;AAEpE,OAAO,EACL,gBAAgB,EAChB,uBAAuB,EACvB,eAAe,EACf,kBAAkB,GAQnB,MAAM,wBAAwB,CAAA;AAE/B,OAAO,EAAE,cAAc,EAAkD,MAAM,aAAa,CAAA;AAE5F,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAuC,MAAM,aAAa,CAAA"}

package/dist/assets/keys.d.ts

@@ -0,0 +1,56 @@
+/**
+ * Pure key/hash/slug helpers for the asset store. No filesystem or network I/O
+ * here — keeps this file trivially unit-testable and safe to reason about for
+ * path-traversal / header-injection concerns.
+ *
+ * Bucket-prefix layout (see .claude/future-tasks/assets-media-system.md):
+ *   asset-originals/{hash32}.{ext}          private; full-fidelity originals
+ *   asset-staging/{uuid}                    presigned-POST target
+ *   asset-meta/{hash32}.json                private; filename/uploader/dims/mime
+ *   assets/t/{directives}/{hash32}/{slug}   transform outputs (see transform-directives.ts)
+ *   assets/{hash32}/{slug}.{ext}            public static: sanitized SVG + PDF only
+ *
+ * Stores must build keys through these helpers rather than hand-rolling prefix
+ * strings, so the layout stays defined in exactly one place.
+ */
+import { ASSET_PREFIXES, type AssetPrefixes } from './asset-prefixes';
+export { ASSET_PREFIXES, type AssetPrefixes };
+/** sha-256 of the given bytes, truncated to 32 hex chars (128 bits). */
+export declare function hashBytes(data: Uint8Array): string;
+/**
+ * Slugify an (untrusted) original filename into a safe slug + normalized
+ * extension. Never trust the input for path or header use directly — this
+ * strips directory components, non-ASCII/unsafe characters, and caps length.
+ *
+ * - Directory components (`/`, `\`, including `..` segments) are dropped —
+ *   only the final path segment is considered.
+ * - The slug charset is restricted to `[a-z0-9-]`; anything else (spaces,
+ *   unicode, punctuation) collapses to a single `-`, with leading/trailing
+ *   dashes stripped.
+ * - Diacritics are stripped (NFKD) before charset filtering, so an accented
+ *   "e"-with-acute-accent becomes plain "e" rather than being dropped entirely.
+ * - The extension (text after the last `.` in the final segment) is
+ *   lowercased and restricted to `[a-z0-9]`, capped at 10 chars.
+ * - An empty/unsafe result falls back to a fixed slug so callers never see
+ *   an empty string.
+ */
+export declare function slugifyFilename(name: string): {
+    slug: string;
+    ext: string;
+};
+/**
+ * Build the key helpers bound to a given prefix set. Stores that support prefix
+ * overrides (currently S3AssetStore) call this with their configured prefixes;
+ * everyone else uses the default export instances below.
+ */
+export declare function createKeyBuilders(prefixes?: AssetPrefixes): {
+    originalKey: (hash32: string, ext: string) => string;
+    /** Prefix used to look up an original by hash32 alone (extension unknown ahead of time). */
+    originalPrefix: (hash32: string) => string;
+    stagingKey: (uuid: string) => string;
+    metaKey: (hash32: string) => string;
+    metaPrefix: () => string;
+    publicKey: (hash32: string, slug: string, ext: string) => string;
+};
+export declare const originalKey: (hash32: string, ext: string) => string, originalPrefix: (hash32: string) => string, stagingKey: (uuid: string) => string, metaKey: (hash32: string) => string, metaPrefix: () => string, publicKey: (hash32: string, slug: string, ext: string) => string;
+//# sourceMappingURL=keys.d.ts.map

package/dist/assets/keys.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"keys.d.ts","sourceRoot":"","sources":["../../src/assets/keys.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAIH,OAAO,EAAE,cAAc,EAAE,KAAK,aAAa,EAAE,MAAM,kBAAkB,CAAA;AAErE,OAAO,EAAE,cAAc,EAAE,KAAK,aAAa,EAAE,CAAA;AAE7C,wEAAwE;AACxE,wBAAgB,SAAS,CAAC,IAAI,EAAE,UAAU,GAAG,MAAM,CAElD;AAMD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAkC3E;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,GAAE,aAA8B;0BAEhD,MAAM,OAAO,MAAM,KAAG,MAAM;IAClD,4FAA4F;6BACnE,MAAM,KAAG,MAAM;uBACrB,MAAM,KAAG,MAAM;sBAChB,MAAM,KAAG,MAAM;sBACjB,MAAM;wBACF,MAAM,QAAQ,MAAM,OAAO,MAAM,KAAG,MAAM;EAGjE;AAED,eAAO,MAAQ,WAAW,WAXA,MAAM,OAAO,MAAM,KAAG,MAAM,EAW1B,cAAc,WATb,MAAM,KAAG,MAAM,EASA,UAAU,SAR/B,MAAM,KAAG,MAAM,EAQkB,OAAO,WAPzC,MAAM,KAAG,MAAM,EAO4B,UAAU,QANvD,MAAM,EAMmD,SAAS,WAL9D,MAAM,QAAQ,MAAM,OAAO,MAAM,KAAG,MAMvC,CAAA"}

package/dist/assets/keys.js

@@ -0,0 +1,88 @@
+/**
+ * Pure key/hash/slug helpers for the asset store. No filesystem or network I/O
+ * here — keeps this file trivially unit-testable and safe to reason about for
+ * path-traversal / header-injection concerns.
+ *
+ * Bucket-prefix layout (see .claude/future-tasks/assets-media-system.md):
+ *   asset-originals/{hash32}.{ext}          private; full-fidelity originals
+ *   asset-staging/{uuid}                    presigned-POST target
+ *   asset-meta/{hash32}.json                private; filename/uploader/dims/mime
+ *   assets/t/{directives}/{hash32}/{slug}   transform outputs (see transform-directives.ts)
+ *   assets/{hash32}/{slug}.{ext}            public static: sanitized SVG + PDF only
+ *
+ * Stores must build keys through these helpers rather than hand-rolling prefix
+ * strings, so the layout stays defined in exactly one place.
+ */
+import { createHash } from 'node:crypto';
+import { ASSET_PREFIXES } from './asset-prefixes.js';
+export { ASSET_PREFIXES };
+/** sha-256 of the given bytes, truncated to 32 hex chars (128 bits). */
+export function hashBytes(data) {
+    return createHash('sha256').update(data).digest('hex').slice(0, 32);
+}
+const MAX_SLUG_LENGTH = 80;
+const MAX_EXT_LENGTH = 10;
+const FALLBACK_SLUG = 'file';
+/**
+ * Slugify an (untrusted) original filename into a safe slug + normalized
+ * extension. Never trust the input for path or header use directly — this
+ * strips directory components, non-ASCII/unsafe characters, and caps length.
+ *
+ * - Directory components (`/`, `\`, including `..` segments) are dropped —
+ *   only the final path segment is considered.
+ * - The slug charset is restricted to `[a-z0-9-]`; anything else (spaces,
+ *   unicode, punctuation) collapses to a single `-`, with leading/trailing
+ *   dashes stripped.
+ * - Diacritics are stripped (NFKD) before charset filtering, so an accented
+ *   "e"-with-acute-accent becomes plain "e" rather than being dropped entirely.
+ * - The extension (text after the last `.` in the final segment) is
+ *   lowercased and restricted to `[a-z0-9]`, capped at 10 chars.
+ * - An empty/unsafe result falls back to a fixed slug so callers never see
+ *   an empty string.
+ */
+export function slugifyFilename(name) {
+    // Drop any directory components (handles both `/` and `\`, and `..` segments)
+    // so the untrusted original filename can never influence a constructed path.
+    const segments = name.split(/[/\\]+/);
+    const basename = segments[segments.length - 1] ?? '';
+    const lastDot = basename.lastIndexOf('.');
+    const hasExt = lastDot > 0 && lastDot < basename.length - 1;
+    const base = hasExt ? basename.slice(0, lastDot) : basename;
+    const extRaw = hasExt ? basename.slice(lastDot + 1) : '';
+    const ext = extRaw
+        .toLowerCase()
+        .replace(/[^a-z0-9]/g, '')
+        .slice(0, MAX_EXT_LENGTH);
+    // U+0300-U+036F is the combining-diacritical-marks block, stripped after NFKD
+    // decomposition. Built from fixed char codes (not a literal regex) so this
+    // file's source stays pure ASCII; the pattern is not derived from input, so
+    // there is no injection risk despite the non-literal RegExp constructor.
+    // eslint-disable-next-line security/detect-non-literal-regexp
+    const COMBINING_MARKS = new RegExp(`[${String.fromCharCode(0x0300)}-${String.fromCharCode(0x036f)}]`, 'g');
+    let slug = base
+        .normalize('NFKD')
+        .replace(COMBINING_MARKS, '')
+        .toLowerCase()
+        .replace(/[^a-z0-9]+/g, '-')
+        .replace(/^-+|-+$/g, '');
+    slug = slug.slice(0, MAX_SLUG_LENGTH).replace(/-+$/g, '');
+    return { slug: slug || FALLBACK_SLUG, ext };
+}
+/**
+ * Build the key helpers bound to a given prefix set. Stores that support prefix
+ * overrides (currently S3AssetStore) call this with their configured prefixes;
+ * everyone else uses the default export instances below.
+ */
+export function createKeyBuilders(prefixes = ASSET_PREFIXES) {
+    return {
+        originalKey: (hash32, ext) => `${prefixes.originals}/${hash32}.${ext}`,
+        /** Prefix used to look up an original by hash32 alone (extension unknown ahead of time). */
+        originalPrefix: (hash32) => `${prefixes.originals}/${hash32}.`,
+        stagingKey: (uuid) => `${prefixes.staging}/${uuid}`,
+        metaKey: (hash32) => `${prefixes.meta}/${hash32}.json`,
+        metaPrefix: () => `${prefixes.meta}/`,
+        publicKey: (hash32, slug, ext) => `${prefixes.public}/${hash32}/${slug}.${ext}`,
+    };
+}
+export const { originalKey, originalPrefix, stagingKey, metaKey, metaPrefix, publicKey } = createKeyBuilders();
+//# sourceMappingURL=keys.js.map

package/dist/assets/keys.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"keys.js","sourceRoot":"","sources":["../../src/assets/keys.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAExC,OAAO,EAAE,cAAc,EAAsB,MAAM,kBAAkB,CAAA;AAErE,OAAO,EAAE,cAAc,EAAsB,CAAA;AAE7C,wEAAwE;AACxE,MAAM,UAAU,SAAS,CAAC,IAAgB;IACxC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;AACrE,CAAC;AAED,MAAM,eAAe,GAAG,EAAE,CAAA;AAC1B,MAAM,cAAc,GAAG,EAAE,CAAA;AACzB,MAAM,aAAa,GAAG,MAAM,CAAA;AAE5B;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,eAAe,CAAC,IAAY;IAC1C,8EAA8E;IAC9E,6EAA6E;IAC7E,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAA;IACrC,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,CAAA;IAEpD,MAAM,OAAO,GAAG,QAAQ,CAAC,WAAW,CAAC,GAAG,CAAC,CAAA;IACzC,MAAM,MAAM,GAAG,OAAO,GAAG,CAAC,IAAI,OAAO,GAAG,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAA;IAC3D,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAA;IAC3D,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;IAExD,MAAM,GAAG,GAAG,MAAM;SACf,WAAW,EAAE;SACb,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC;SACzB,KAAK,CAAC,CAAC,EAAE,cAAc,CAAC,CAAA;IAE3B,8EAA8E;IAC9E,2EAA2E;IAC3E,4EAA4E;IAC5E,yEAAyE;IACzE,8DAA8D;IAC9D,MAAM,eAAe,GAAG,IAAI,MAAM,CAChC,IAAI,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,GAAG,EACjE,GAAG,CACJ,CAAA;IACD,IAAI,IAAI,GAAG,IAAI;SACZ,SAAS,CAAC,MAAM,CAAC;SACjB,OAAO,CAAC,eAAe,EAAE,EAAE,CAAC;SAC5B,WAAW,EAAE;SACb,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC;SAC3B,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAA;IAC1B,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,eAAe,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;IAEzD,OAAO,EAAE,IAAI,EAAE,IAAI,IAAI,aAAa,EAAE,GAAG,EAAE,CAAA;AAC7C,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,WAA0B,cAAc;IACxE,OAAO;QACL,WAAW,EAAE,CAAC,MAAc,EAAE,GAAW,EAAU,EAAE,CAAC,GAAG,QAAQ,CAAC,SAAS,IAAI,MAAM,IAAI,GAAG,EAAE;QAC9F,4FAA4F;QAC5F,cAAc,EAAE,CAAC,MAAc,EAAU,EAAE,CAAC,GAAG,QAAQ,CAAC,SAAS,IAAI,MAAM,GAAG;QAC9E,UAAU,EAAE,CAAC,IAAY,EAAU,EAAE,CAAC,GAAG,QAAQ,CAAC,OAAO,IAAI,IAAI,EAAE;QACnE,OAAO,EAAE,CAAC,MAAc,EAAU,EAAE,CAAC,GAAG,QAAQ,CAAC,IAAI,IAAI,MAAM,OAAO;QACtE,UAAU,EAAE,GAAW,EAAE,CAAC,GAAG,QAAQ,CAAC,IAAI,GAAG;QAC7C,SAAS,EAAE,CAAC,MAAc,EAAE,IAAY,EAAE,GAAW,EAAU,EAAE,CAC/D,GAAG,QAAQ,CAAC,MAAM,IAAI,MAAM,IAAI,IAAI,IAAI,GAAG,EAAE;KAChD,CAAA;AACH,CAAC;AAED,MAAM,CAAC,MAAM,EAAE,WAAW,EAAE,cAAc,EAAE,UAAU,EAAE,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,GACtF,iBAAiB,EAAE,CAAA"}

package/dist/assets/pipeline.d.ts

@@ -0,0 +1,50 @@
+/**
+ * Finalize pipeline: turns raw uploaded bytes into a validated AssetMeta
+ * (+ optional public object for svg/pdf), or a typed rejection. Pure
+ * transform - no store I/O here (see finalize.ts for the store orchestration
+ * that dedups, writes, and calls this).
+ *
+ * Server-only - never import this module from client/editor code. It pulls
+ * in `file-type`, `image-size`, and the SVG sanitizer, none of which belong
+ * in a browser bundle.
+ */
+import type { AssetMeta } from './types';
+/** Client-declared content types accepted at presign time (UX only - never trusted at finalize). */
+export declare const ALLOWED_UPLOAD_CONTENT_TYPES: Set<string>;
+export interface FinalizeInput {
+    data: Uint8Array;
+    filename: string;
+    uploadedBy?: string;
+}
+export interface FinalizePublicObject {
+    key: string;
+    data: Uint8Array;
+    contentType: string;
+    contentDisposition: string;
+    cacheControl: string;
+}
+export interface FinalizeSuccess {
+    ok: true;
+    meta: AssetMeta;
+    /** Canonical bytes to persist as the original - sanitized bytes for svg, untouched otherwise. */
+    data: Uint8Array;
+    publicObject?: FinalizePublicObject;
+}
+export interface FinalizeRejection {
+    ok: false;
+    status: 413 | 415;
+    error: string;
+}
+export type FinalizeResult = FinalizeSuccess | FinalizeRejection;
+/**
+ * Run the finalize pipeline over freshly-uploaded bytes: sniff the real file
+ * type (never trust the client-declared contentType beyond presign-time UX),
+ * sanitize if svg, hash, extract dimensions, and build the AssetMeta + any
+ * public object (svg/pdf only) the caller should persist.
+ *
+ * Order matters: for SVG, sanitization happens BEFORE hashing - the sanitized
+ * bytes are what get hashed and stored, so a later re-sanitization (e.g. a
+ * stricter sanitizer version) cannot desync a stored hash from its content.
+ */
+export declare function runFinalizePipeline(input: FinalizeInput): Promise<FinalizeResult>;
+//# sourceMappingURL=pipeline.d.ts.map

package/dist/assets/pipeline.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pipeline.d.ts","sourceRoot":"","sources":["../../src/assets/pipeline.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AASH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,SAAS,CAAA;AAMxC,oGAAoG;AACpG,eAAO,MAAM,4BAA4B,aAIvC,CAAA;AAkBF,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,UAAU,CAAA;IAChB,QAAQ,EAAE,MAAM,CAAA;IAChB,UAAU,CAAC,EAAE,MAAM,CAAA;CACpB;AAED,MAAM,WAAW,oBAAoB;IACnC,GAAG,EAAE,MAAM,CAAA;IACX,IAAI,EAAE,UAAU,CAAA;IAChB,WAAW,EAAE,MAAM,CAAA;IACnB,kBAAkB,EAAE,MAAM,CAAA;IAC1B,YAAY,EAAE,MAAM,CAAA;CACrB;AAED,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,IAAI,CAAA;IACR,IAAI,EAAE,SAAS,CAAA;IACf,iGAAiG;IACjG,IAAI,EAAE,UAAU,CAAA;IAChB,YAAY,CAAC,EAAE,oBAAoB,CAAA;CACpC;AAED,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,KAAK,CAAA;IACT,MAAM,EAAE,GAAG,GAAG,GAAG,CAAA;IACjB,KAAK,EAAE,MAAM,CAAA;CACd;AAED,MAAM,MAAM,cAAc,GAAG,eAAe,GAAG,iBAAiB,CAAA;AAoEhE;;;;;;;;;GASG;AACH,wBAAsB,mBAAmB,CAAC,KAAK,EAAE,aAAa,GAAG,OAAO,CAAC,cAAc,CAAC,CA8FvF"}

package/dist/assets/pipeline.js

@@ -0,0 +1,202 @@
+/**
+ * Finalize pipeline: turns raw uploaded bytes into a validated AssetMeta
+ * (+ optional public object for svg/pdf), or a typed rejection. Pure
+ * transform - no store I/O here (see finalize.ts for the store orchestration
+ * that dedups, writes, and calls this).
+ *
+ * Server-only - never import this module from client/editor code. It pulls
+ * in `file-type`, `image-size`, and the SVG sanitizer, none of which belong
+ * in a browser bundle.
+ */
+import { fileTypeFromBuffer } from 'file-type';
+import { imageSize } from 'image-size';
+import { create as createContentDisposition } from 'content-disposition';
+import { hashBytes, publicKey, slugifyFilename } from './keys.js';
+import { sanitizeSvg } from './svg-sanitizer.js';
+import { MAX_INPUT_PIXELS } from './transform-directives.js';
+const RASTER_MIME_TYPES = new Set(['image/png', 'image/jpeg', 'image/webp', 'image/gif']);
+const PDF_MIME_TYPE = 'application/pdf';
+const SVG_MIME_TYPE = 'image/svg+xml';
+/** Client-declared content types accepted at presign time (UX only - never trusted at finalize). */
+export const ALLOWED_UPLOAD_CONTENT_TYPES = new Set([
+    ...RASTER_MIME_TYPES,
+    PDF_MIME_TYPE,
+    SVG_MIME_TYPE,
+]);
+const PDF_MAX_BYTES = 25 * 1024 * 1024;
+/**
+ * Defensive raster byte cap, independent of whatever the configured
+ * AssetStore's own upload-size limit happens to be (that limit lives at the
+ * store/API boundary, not here) - mirrors PDF_MAX_BYTES's role as a
+ * pipeline-level backstop rather than the sole enforcement point.
+ */
+const RASTER_MAX_BYTES = 50 * 1024 * 1024;
+/** EXIF orientation values 5-8 are 90-degree rotations, which swap width/height. */
+const isRotated90 = (orientation) => orientation !== undefined && orientation >= 5 && orientation <= 8;
+const PUBLIC_CACHE_CONTROL = 'public, max-age=31536000, immutable';
+/** U+FEFF (byte-order mark). Built from a char code, not a literal, so this file's source stays pure ASCII. */
+const BOM = String.fromCharCode(0xfeff);
+/**
+ * Strip anything that may legally precede the root `<svg>` element: a BOM,
+ * whitespace, XML comments, the `<?xml ... ?>` prolog, and a `<!DOCTYPE ...>`
+ * declaration - in any order, any number of times (some tools emit more than
+ * one comment). Loops until a pass makes no further change.
+ */
+function stripSvgPreamble(text) {
+    let stripped = text.startsWith(BOM) ? text.slice(BOM.length) : text;
+    let previous;
+    do {
+        previous = stripped;
+        stripped = stripped.replace(/^\s+/, '');
+        stripped = stripped.replace(/^<!--[\s\S]*?-->/, '');
+        stripped = stripped.replace(/^<\?xml[\s\S]*?\?>/i, '');
+        stripped = stripped.replace(/^<!DOCTYPE[\s\S]*?>/i, '');
+    } while (stripped !== previous);
+    return stripped;
+}
+/**
+ * Detect whether `data` is an SVG document. `file-type` cannot do this (SVG is
+ * a text format, not magic-byte-detectable) - and, discovered empirically,
+ * `file-type` does NOT simply return `undefined` for all SVGs either: an SVG
+ * with an `<?xml ?>` prolog gets positively sniffed as generic `application/xml`.
+ * So the pipeline's real branch condition is "not a recognized raster/pdf mime"
+ * (which covers both file-type returning undefined AND returning some other
+ * non-allowlisted guess like application/xml), and within that branch this
+ * function does the actual SVG determination: decode as UTF-8 (reject on
+ * failure), strip anything that may precede the root element, and require the
+ * first element to be `<svg` (case-insensitive).
+ *
+ * Returns the decoded text on success (so the caller doesn't have to decode
+ * twice), or `null` if this is not a decodable SVG document.
+ */
+function sniffSvg(data) {
+    let text;
+    try {
+        text = new TextDecoder('utf-8', { fatal: true }).decode(data);
+    }
+    catch {
+        return null;
+    }
+    const stripped = stripSvgPreamble(text);
+    return /^<svg[\s>/]/i.test(stripped) ? text : null;
+}
+/**
+ * Extract width/height (rasters and svg only - PDFs have no pixel dims).
+ * Non-fatal on failure: a corrupt-but-magic-byte-valid file still finalizes,
+ * just without dimensions (AssetMeta.width/height are optional).
+ */
+function computeDimensions(data) {
+    try {
+        const result = imageSize(data);
+        let { width, height } = result;
+        if (isRotated90(result.orientation)) {
+            ;
+            [width, height] = [height, width];
+        }
+        return { width, height };
+    }
+    catch {
+        return {};
+    }
+}
+/**
+ * Run the finalize pipeline over freshly-uploaded bytes: sniff the real file
+ * type (never trust the client-declared contentType beyond presign-time UX),
+ * sanitize if svg, hash, extract dimensions, and build the AssetMeta + any
+ * public object (svg/pdf only) the caller should persist.
+ *
+ * Order matters: for SVG, sanitization happens BEFORE hashing - the sanitized
+ * bytes are what get hashed and stored, so a later re-sanitization (e.g. a
+ * stricter sanitizer version) cannot desync a stored hash from its content.
+ */
+export async function runFinalizePipeline(input) {
+    const sniffed = await fileTypeFromBuffer(input.data);
+    let kind;
+    let mime;
+    let ext;
+    let canonicalData = input.data;
+    if (sniffed && RASTER_MIME_TYPES.has(sniffed.mime)) {
+        if (input.data.byteLength > RASTER_MAX_BYTES) {
+            return {
+                ok: false,
+                status: 413,
+                error: `Raster image exceeds the ${RASTER_MAX_BYTES}-byte limit`,
+            };
+        }
+        kind = 'raster';
+        mime = sniffed.mime;
+        ext = sniffed.ext;
+    }
+    else if (sniffed && sniffed.mime === PDF_MIME_TYPE) {
+        if (input.data.byteLength > PDF_MAX_BYTES) {
+            return { ok: false, status: 413, error: `PDF exceeds the ${PDF_MAX_BYTES}-byte limit` };
+        }
+        kind = 'pdf';
+        mime = PDF_MIME_TYPE;
+        ext = sniffed.ext;
+    }
+    else {
+        // Not a recognized raster/pdf - could be a bare/prolog'd SVG, or genuine junk.
+        const svgText = sniffSvg(input.data);
+        if (!svgText) {
+            return { ok: false, status: 415, error: 'Unsupported or unrecognized file type' };
+        }
+        kind = 'svg';
+        mime = SVG_MIME_TYPE;
+        ext = 'svg';
+        canonicalData = new TextEncoder().encode(sanitizeSvg(svgText));
+    }
+    const hash32 = hashBytes(canonicalData);
+    const { slug } = slugifyFilename(input.filename);
+    const dims = kind === 'pdf' ? {} : computeDimensions(canonicalData);
+    // Decompression-bomb defense: a raster's on-disk size says nothing about
+    // its decoded pixel count (a solid-color 30000x30000 PNG compresses to a
+    // few KB) - reject on width*height before this asset is ever finalized, so
+    // the transform engine (transform.ts's own `limitInputPixels`) is never the
+    // only thing standing between an attacker and a huge decode. SVG is exempt:
+    // `computeDimensions` reads its declared viewBox/width/height attributes,
+    // not a decoded raster, so there is no analogous decode-time memory cost.
+    if (kind === 'raster' && dims.width !== undefined && dims.height !== undefined) {
+        const pixelCount = dims.width * dims.height;
+        if (pixelCount > MAX_INPUT_PIXELS) {
+            return {
+                ok: false,
+                status: 413,
+                error: `Image dimensions ${dims.width}x${dims.height} (${pixelCount} pixels) exceed the ${MAX_INPUT_PIXELS}-pixel limit`,
+            };
+        }
+    }
+    const meta = {
+        hash32,
+        filename: input.filename,
+        slug,
+        ext,
+        mime,
+        size: canonicalData.byteLength,
+        ...(dims.width !== undefined && { width: dims.width }),
+        ...(dims.height !== undefined && { height: dims.height }),
+        kind,
+        ...(input.uploadedBy && { uploadedBy: input.uploadedBy }),
+        uploadedAt: new Date().toISOString(),
+    };
+    let publicObject;
+    if (kind === 'svg' || kind === 'pdf') {
+        // svg: rendered inline by the browser. pdf: downloaded under its real
+        // original filename (never the slug) via Content-Disposition, built with
+        // the content-disposition package (RFC 5987) rather than string
+        // interpolation, so header-injection characters in the filename can never
+        // reach a raw HTTP header value.
+        const contentDisposition = createContentDisposition(input.filename, {
+            type: kind === 'svg' ? 'inline' : 'attachment',
+        });
+        publicObject = {
+            key: publicKey(hash32, slug, ext),
+            data: canonicalData,
+            contentType: mime,
+            contentDisposition,
+            cacheControl: PUBLIC_CACHE_CONTROL,
+        };
+    }
+    return { ok: true, meta, data: canonicalData, publicObject };
+}
+//# sourceMappingURL=pipeline.js.map

package/dist/assets/pipeline.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pipeline.js","sourceRoot":"","sources":["../../src/assets/pipeline.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAA;AAC9C,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAA;AACtC,OAAO,EAAE,MAAM,IAAI,wBAAwB,EAAE,MAAM,qBAAqB,CAAA;AAExE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,QAAQ,CAAA;AAC9D,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAA;AAC7C,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAA;AAGzD,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,YAAY,EAAE,YAAY,EAAE,WAAW,CAAC,CAAC,CAAA;AACzF,MAAM,aAAa,GAAG,iBAAiB,CAAA;AACvC,MAAM,aAAa,GAAG,eAAe,CAAA;AAErC,oGAAoG;AACpG,MAAM,CAAC,MAAM,4BAA4B,GAAG,IAAI,GAAG,CAAS;IAC1D,GAAG,iBAAiB;IACpB,aAAa;IACb,aAAa;CACd,CAAC,CAAA;AAEF,MAAM,aAAa,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAA;AAEtC;;;;;GAKG;AACH,MAAM,gBAAgB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAA;AAEzC,oFAAoF;AACpF,MAAM,WAAW,GAAG,CAAC,WAA+B,EAAW,EAAE,CAC/D,WAAW,KAAK,SAAS,IAAI,WAAW,IAAI,CAAC,IAAI,WAAW,IAAI,CAAC,CAAA;AAEnE,MAAM,oBAAoB,GAAG,qCAAqC,CAAA;AAgClE,+GAA+G;AAC/G,MAAM,GAAG,GAAG,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,CAAA;AAEvC;;;;;GAKG;AACH,SAAS,gBAAgB,CAAC,IAAY;IACpC,IAAI,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IACnE,IAAI,QAAgB,CAAA;IACpB,GAAG,CAAC;QACF,QAAQ,GAAG,QAAQ,CAAA;QACnB,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;QACvC,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,kBAAkB,EAAE,EAAE,CAAC,CAAA;QACnD,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,qBAAqB,EAAE,EAAE,CAAC,CAAA;QACtD,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,sBAAsB,EAAE,EAAE,CAAC,CAAA;IACzD,CAAC,QAAQ,QAAQ,KAAK,QAAQ,EAAC;IAC/B,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,SAAS,QAAQ,CAAC,IAAgB;IAChC,IAAI,IAAY,CAAA;IAChB,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;IAC/D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;IACD,MAAM,QAAQ,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAA;IACvC,OAAO,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAA;AACpD,CAAC;AAED;;;;GAIG;AACH,SAAS,iBAAiB,CAAC,IAAgB;IACzC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,CAAC,CAAA;QAC9B,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,MAAM,CAAA;QAC9B,IAAI,WAAW,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC;YACpC,CAAC;YAAA,CAAC,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,CAAA;QACpC,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAA;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAA;IACX,CAAC;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,KAAoB;IAC5D,MAAM,OAAO,GAAG,MAAM,kBAAkB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IAEpD,IAAI,IAAuB,CAAA;IAC3B,IAAI,IAAY,CAAA;IAChB,IAAI,GAAW,CAAA;IACf,IAAI,aAAa,GAAe,KAAK,CAAC,IAAI,CAAA;IAE1C,IAAI,OAAO,IAAI,iBAAiB,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACnD,IAAI,KAAK,CAAC,IAAI,CAAC,UAAU,GAAG,gBAAgB,EAAE,CAAC;YAC7C,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,GAAG;gBACX,KAAK,EAAE,4BAA4B,gBAAgB,aAAa;aACjE,CAAA;QACH,CAAC;QACD,IAAI,GAAG,QAAQ,CAAA;QACf,IAAI,GAAG,OAAO,CAAC,IAAI,CAAA;QACnB,GAAG,GAAG,OAAO,CAAC,GAAG,CAAA;IACnB,CAAC;SAAM,IAAI,OAAO,IAAI,OAAO,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;QACrD,IAAI,KAAK,CAAC,IAAI,CAAC,UAAU,GAAG,aAAa,EAAE,CAAC;YAC1C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,mBAAmB,aAAa,aAAa,EAAE,CAAA;QACzF,CAAC;QACD,IAAI,GAAG,KAAK,CAAA;QACZ,IAAI,GAAG,aAAa,CAAA;QACpB,GAAG,GAAG,OAAO,CAAC,GAAG,CAAA;IACnB,CAAC;SAAM,CAAC;QACN,+EAA+E;QAC/E,MAAM,OAAO,GAAG,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;QACpC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,uCAAuC,EAAE,CAAA;QACnF,CAAC;QACD,IAAI,GAAG,KAAK,CAAA;QACZ,IAAI,GAAG,aAAa,CAAA;QACpB,GAAG,GAAG,KAAK,CAAA;QACX,aAAa,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAA;IAChE,CAAC;IAED,MAAM,MAAM,GAAG,SAAS,CAAC,aAAa,CAAC,CAAA;IACvC,MAAM,EAAE,IAAI,EAAE,GAAG,eAAe,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAA;IAChD,MAAM,IAAI,GAAG,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,iBAAiB,CAAC,aAAa,CAAC,CAAA;IAEnE,yEAAyE;IACzE,yEAAyE;IACzE,2EAA2E;IAC3E,4EAA4E;IAC5E,4EAA4E;IAC5E,0EAA0E;IAC1E,0EAA0E;IAC1E,IAAI,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAC/E,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,MAAM,CAAA;QAC3C,IAAI,UAAU,GAAG,gBAAgB,EAAE,CAAC;YAClC,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,GAAG;gBACX,KAAK,EAAE,oBAAoB,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,MAAM,KAAK,UAAU,uBAAuB,gBAAgB,cAAc;aACzH,CAAA;QACH,CAAC;IACH,CAAC;IAED,MAAM,IAAI,GAAc;QACtB,MAAM;QACN,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,IAAI;QACJ,GAAG;QACH,IAAI;QACJ,IAAI,EAAE,aAAa,CAAC,UAAU;QAC9B,GAAG,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;QACtD,GAAG,CAAC,IAAI,CAAC,MAAM,KAAK,SAAS,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;QACzD,IAAI;QACJ,GAAG,CAAC,KAAK,CAAC,UAAU,IAAI,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC;QACzD,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACrC,CAAA;IAED,IAAI,YAA8C,CAAA;IAClD,IAAI,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC;QACrC,sEAAsE;QACtE,yEAAyE;QACzE,gEAAgE;QAChE,0EAA0E;QAC1E,iCAAiC;QACjC,MAAM,kBAAkB,GAAG,wBAAwB,CAAC,KAAK,CAAC,QAAQ,EAAE;YAClE,IAAI,EAAE,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,YAAY;SAC/C,CAAC,CAAA;QACF,YAAY,GAAG;YACb,GAAG,EAAE,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC;YACjC,IAAI,EAAE,aAAa;YACnB,WAAW,EAAE,IAAI;YACjB,kBAAkB;YAClB,YAAY,EAAE,oBAAoB;SACnC,CAAA;IACH,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,aAAa,EAAE,YAAY,EAAE,CAAA;AAC9D,CAAC"}

package/dist/assets/store-local.d.ts

@@ -0,0 +1,84 @@
+/**
+ * Filesystem-backed AssetStore for dev and tests. Mirrors the same
+ * bucket-prefix layout as S3AssetStore (see keys.ts) so content behaves
+ * identically across adapters.
+ */
+import type { AssetMeta, AssetStore, BeginUploadInput, PublicObject, StagedUploadTarget } from './types';
+export interface LocalAssetStoreOptions {
+    /** Root directory. The five bucket prefixes are created as subdirectories under it. */
+    root: string;
+}
+export declare class LocalAssetStore implements AssetStore {
+    readonly capabilities: {
+        directUpload: boolean;
+    };
+    private readonly root;
+    constructor(options: LocalAssetStoreOptions);
+    /**
+     * Resolve a store key to an absolute filesystem path, guarding against
+     * escape from the root. Keys are internally generated (never taken
+     * verbatim from user input), but this guard is kept as defense-in-depth
+     * (ported from the v1 LocalAssetStore).
+     *
+     * A naive `resolved.startsWith(root)` check would let a sibling directory
+     * that merely shares the root's name as a prefix (e.g. root `.../assets`,
+     * sibling `.../assets-evil`) pass. Comparing against `root + path.sep`
+     * closes that gap.
+     */
+    private resolveKey;
+    private headersSidecarPath;
+    private writeHeadersSidecar;
+    private readHeadersSidecar;
+    private readFileOrNull;
+    private writeFile;
+    private deleteFileIfPresent;
+    beginUpload(_input: BeginUploadInput): Promise<StagedUploadTarget>;
+    /**
+     * Staging methods accept caller-influenced keys (finalize receives the key
+     * from the client), so they must never operate outside the staging prefix —
+     * otherwise a crafted key turns the staging cleanup into an arbitrary-object
+     * delete. The API layer validates too; this is defense-in-depth.
+     */
+    private assertStagingKey;
+    writeStaging(key: string, data: Uint8Array, _contentType?: string): Promise<void>;
+    readStaging(key: string): Promise<Uint8Array | null>;
+    deleteStaging(key: string): Promise<void>;
+    putOriginal(input: {
+        hash32: string;
+        ext: string;
+        data: Uint8Array;
+        contentType: string;
+    }): Promise<void>;
+    readOriginal(hash32: string): Promise<{
+        data: Uint8Array;
+        ext: string;
+        contentType?: string;
+    } | null>;
+    putPublicObject(input: {
+        key: string;
+        data: Uint8Array;
+        contentType: string;
+        contentDisposition?: string;
+        cacheControl?: string;
+    }): Promise<void>;
+    readPublicObject(key: string): Promise<PublicObject | null>;
+    /**
+     * Atomic-exclusive create: opens with the `wx` flag so two concurrent
+     * writers racing on the same hash32 have exactly one winner ('created')
+     * and exactly one loser ('already-exists'). The rename-based
+     * `atomicWriteFile` helper is deliberately NOT used here — a rename
+     * always clobbers the destination, which would let the second writer
+     * silently overwrite the first instead of losing cleanly.
+     */
+    putMetaIfAbsent(hash32: string, meta: AssetMeta): Promise<'created' | 'already-exists'>;
+    getMeta(hash32: string): Promise<AssetMeta | null>;
+    listMeta(input?: {
+        cursor?: string;
+        limit?: number;
+    }): Promise<{
+        items: AssetMeta[];
+        nextCursor?: string;
+    }>;
+    deleteMeta(hash32: string): Promise<void>;
+}
+//# sourceMappingURL=store-local.d.ts.map

package/dist/assets/store-local.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"store-local.d.ts","sourceRoot":"","sources":["../../src/assets/store-local.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AASH,OAAO,KAAK,EACV,SAAS,EACT,UAAU,EACV,gBAAgB,EAChB,YAAY,EACZ,kBAAkB,EACnB,MAAM,SAAS,CAAA;AAEhB,MAAM,WAAW,sBAAsB;IACrC,uFAAuF;IACvF,IAAI,EAAE,MAAM,CAAA;CACb;AAcD,qBAAa,eAAgB,YAAW,UAAU;IAChD,QAAQ,CAAC,YAAY;;MAA0B;IAC/C,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAQ;gBAEjB,OAAO,EAAE,sBAAsB;IAI3C;;;;;;;;;;OAUG;IACH,OAAO,CAAC,UAAU;IASlB,OAAO,CAAC,kBAAkB;YAIZ,mBAAmB;YAInB,kBAAkB;YAUlB,cAAc;YAUd,SAAS;YAIT,mBAAmB;IAU3B,WAAW,CAAC,MAAM,EAAE,gBAAgB,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAQxE;;;;;OAKG;IACH,OAAO,CAAC,gBAAgB;IAMlB,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,YAAY,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAKjF,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC;IAKpD,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAKzC,WAAW,CAAC,KAAK,EAAE;QACvB,MAAM,EAAE,MAAM,CAAA;QACd,GAAG,EAAE,MAAM,CAAA;QACX,IAAI,EAAE,UAAU,CAAA;QAChB,WAAW,EAAE,MAAM,CAAA;KACpB,GAAG,OAAO,CAAC,IAAI,CAAC;IAMX,YAAY,CAChB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC;QAAE,IAAI,EAAE,UAAU,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IAsBpE,eAAe,CAAC,KAAK,EAAE;QAC3B,GAAG,EAAE,MAAM,CAAA;QACX,IAAI,EAAE,UAAU,CAAA;QAChB,WAAW,EAAE,MAAM,CAAA;QACnB,kBAAkB,CAAC,EAAE,MAAM,CAAA;QAC3B,YAAY,CAAC,EAAE,MAAM,CAAA;KACtB,GAAG,OAAO,CAAC,IAAI,CAAC;IAUX,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC;IAajE;;;;;;;OAOG;IACG,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC,SAAS,GAAG,gBAAgB,CAAC;IAYvF,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC;IAWlD,QAAQ,CAAC,KAAK,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC;QACnE,KAAK,EAAE,SAAS,EAAE,CAAA;QAClB,UAAU,CAAC,EAAE,MAAM,CAAA;KACpB,CAAC;IAkDI,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAShD"}