canopycms 0.0.57 → 0.0.59

package/dist/assets/store-local.js

@@ -0,0 +1,254 @@
+/**
+ * Filesystem-backed AssetStore for dev and tests. Mirrors the same
+ * bucket-prefix layout as S3AssetStore (see keys.ts) so content behaves
+ * identically across adapters.
+ */
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import { randomUUID } from 'node:crypto';
+import { getErrorMessage, isFileExistsError, isNotFoundError } from '../utils/error.js';
+import { atomicWriteFile } from '../utils/atomic-write.js';
+import { ASSET_PREFIXES, metaKey, originalKey, stagingKey } from './keys.js';
+/** Matches S3AssetStore's default; local has no separate configuration knob for it. */
+const DEFAULT_MAX_UPLOAD_BYTES = 50 * 1024 * 1024;
+const DEFAULT_LIST_LIMIT = 24;
+const HEADERS_SIDECAR_SUFFIX = '.headers.json';
+export class LocalAssetStore {
+    constructor(options) {
+        this.capabilities = { directUpload: false };
+        this.root = path.resolve(options.root);
+    }
+    /**
+     * Resolve a store key to an absolute filesystem path, guarding against
+     * escape from the root. Keys are internally generated (never taken
+     * verbatim from user input), but this guard is kept as defense-in-depth
+     * (ported from the v1 LocalAssetStore).
+     *
+     * A naive `resolved.startsWith(root)` check would let a sibling directory
+     * that merely shares the root's name as a prefix (e.g. root `.../assets`,
+     * sibling `.../assets-evil`) pass. Comparing against `root + path.sep`
+     * closes that gap.
+     */
+    resolveKey(key) {
+        const resolved = path.resolve(this.root, key);
+        const rootWithSep = this.root.endsWith(path.sep) ? this.root : this.root + path.sep;
+        if (resolved !== this.root && !resolved.startsWith(rootWithSep)) {
+            throw new Error(`Path traversal detected for key: ${key}`);
+        }
+        return resolved;
+    }
+    headersSidecarPath(filePath) {
+        return `${filePath}${HEADERS_SIDECAR_SUFFIX}`;
+    }
+    async writeHeadersSidecar(filePath, headers) {
+        await atomicWriteFile(this.headersSidecarPath(filePath), JSON.stringify(headers));
+    }
+    async readHeadersSidecar(filePath) {
+        try {
+            const raw = await fs.readFile(this.headersSidecarPath(filePath), 'utf-8');
+            return JSON.parse(raw);
+        }
+        catch (err) {
+            if (isNotFoundError(err))
+                return {};
+            throw err;
+        }
+    }
+    async readFileOrNull(filePath) {
+        try {
+            const buf = await fs.readFile(filePath);
+            return new Uint8Array(buf.buffer, buf.byteOffset, buf.byteLength);
+        }
+        catch (err) {
+            if (isNotFoundError(err))
+                return null;
+            throw err;
+        }
+    }
+    async writeFile(filePath, data) {
+        await atomicWriteFile(filePath, Buffer.from(data));
+    }
+    async deleteFileIfPresent(filePath) {
+        try {
+            await fs.unlink(filePath);
+        }
+        catch (err) {
+            if (!isNotFoundError(err))
+                throw err;
+        }
+        // Best-effort sidecar cleanup; a missing sidecar is not an error.
+        await fs.unlink(this.headersSidecarPath(filePath)).catch(() => { });
+    }
+    async beginUpload(_input) {
+        return {
+            mode: 'proxied',
+            stagingKey: stagingKey(randomUUID()),
+            maxBytes: DEFAULT_MAX_UPLOAD_BYTES,
+        };
+    }
+    /**
+     * Staging methods accept caller-influenced keys (finalize receives the key
+     * from the client), so they must never operate outside the staging prefix —
+     * otherwise a crafted key turns the staging cleanup into an arbitrary-object
+     * delete. The API layer validates too; this is defense-in-depth.
+     */
+    assertStagingKey(key) {
+        if (!key.startsWith(`${ASSET_PREFIXES.staging}/`)) {
+            throw new Error(`Not a staging key: ${key}`);
+        }
+    }
+    async writeStaging(key, data, _contentType) {
+        this.assertStagingKey(key);
+        await this.writeFile(this.resolveKey(key), data);
+    }
+    async readStaging(key) {
+        this.assertStagingKey(key);
+        return this.readFileOrNull(this.resolveKey(key));
+    }
+    async deleteStaging(key) {
+        this.assertStagingKey(key);
+        await this.deleteFileIfPresent(this.resolveKey(key));
+    }
+    async putOriginal(input) {
+        const filePath = this.resolveKey(originalKey(input.hash32, input.ext));
+        await this.writeFile(filePath, input.data);
+        await this.writeHeadersSidecar(filePath, { contentType: input.contentType });
+    }
+    async readOriginal(hash32) {
+        const dir = this.resolveKey(ASSET_PREFIXES.originals);
+        let entries;
+        try {
+            entries = await fs.readdir(dir);
+        }
+        catch (err) {
+            if (isNotFoundError(err))
+                return null;
+            throw err;
+        }
+        const prefix = `${hash32}.`;
+        const match = entries.find((name) => name.startsWith(prefix) && !name.endsWith(HEADERS_SIDECAR_SUFFIX));
+        if (!match)
+            return null;
+        const filePath = path.join(dir, match);
+        const data = await this.readFileOrNull(filePath);
+        if (!data)
+            return null;
+        const headers = await this.readHeadersSidecar(filePath);
+        return { data, ext: match.slice(prefix.length), contentType: headers.contentType };
+    }
+    async putPublicObject(input) {
+        const filePath = this.resolveKey(input.key);
+        await this.writeFile(filePath, input.data);
+        await this.writeHeadersSidecar(filePath, {
+            contentType: input.contentType,
+            contentDisposition: input.contentDisposition,
+            cacheControl: input.cacheControl,
+        });
+    }
+    async readPublicObject(key) {
+        const filePath = this.resolveKey(key);
+        const data = await this.readFileOrNull(filePath);
+        if (!data)
+            return null;
+        const headers = await this.readHeadersSidecar(filePath);
+        return {
+            data,
+            contentType: headers.contentType,
+            contentDisposition: headers.contentDisposition,
+            cacheControl: headers.cacheControl,
+        };
+    }
+    /**
+     * Atomic-exclusive create: opens with the `wx` flag so two concurrent
+     * writers racing on the same hash32 have exactly one winner ('created')
+     * and exactly one loser ('already-exists'). The rename-based
+     * `atomicWriteFile` helper is deliberately NOT used here — a rename
+     * always clobbers the destination, which would let the second writer
+     * silently overwrite the first instead of losing cleanly.
+     */
+    async putMetaIfAbsent(hash32, meta) {
+        const filePath = this.resolveKey(metaKey(hash32));
+        await fs.mkdir(path.dirname(filePath), { recursive: true });
+        try {
+            await fs.writeFile(filePath, JSON.stringify(meta), { flag: 'wx' });
+            return 'created';
+        }
+        catch (err) {
+            if (isFileExistsError(err))
+                return 'already-exists';
+            throw err;
+        }
+    }
+    async getMeta(hash32) {
+        const filePath = this.resolveKey(metaKey(hash32));
+        try {
+            const raw = await fs.readFile(filePath, 'utf-8');
+            return JSON.parse(raw);
+        }
+        catch (err) {
+            if (isNotFoundError(err))
+                return null;
+            throw err;
+        }
+    }
+    async listMeta(input) {
+        const limit = input?.limit ?? DEFAULT_LIST_LIMIT;
+        const dir = this.resolveKey(ASSET_PREFIXES.meta);
+        let filenames;
+        try {
+            filenames = (await fs.readdir(dir)).filter((name) => name.endsWith('.json'));
+        }
+        catch (err) {
+            if (isNotFoundError(err))
+                filenames = [];
+            else
+                throw err;
+        }
+        const all = [];
+        for (const name of filenames) {
+            try {
+                const raw = await fs.readFile(path.join(dir, name), 'utf-8');
+                all.push(JSON.parse(raw));
+            }
+            catch (err) {
+                // A meta file racing with deleteMeta is expected under concurrency;
+                // anything else is a real problem worth surfacing via getErrorMessage.
+                if (!isNotFoundError(err)) {
+                    throw new Error(`Failed to read asset meta file '${name}': ${getErrorMessage(err)}`);
+                }
+            }
+        }
+        // Newest first; hash32 is the deterministic tiebreak for equal timestamps
+        // (common in fast test loops using Date.now()), which keeps pagination
+        // stable and duplicate/gap-free across calls.
+        all.sort((a, b) => {
+            if (a.uploadedAt !== b.uploadedAt)
+                return a.uploadedAt < b.uploadedAt ? 1 : -1;
+            return a.hash32 < b.hash32 ? 1 : -1;
+        });
+        let startIndex = 0;
+        if (input?.cursor) {
+            const afterHash32 = Buffer.from(input.cursor, 'base64').toString('utf-8');
+            const idx = all.findIndex((m) => m.hash32 === afterHash32);
+            startIndex = idx === -1 ? 0 : idx + 1;
+        }
+        const items = all.slice(startIndex, startIndex + limit);
+        const hasMore = startIndex + limit < all.length;
+        const nextCursor = hasMore
+            ? Buffer.from(items[items.length - 1].hash32, 'utf-8').toString('base64')
+            : undefined;
+        return { items, nextCursor };
+    }
+    async deleteMeta(hash32) {
+        const filePath = this.resolveKey(metaKey(hash32));
+        try {
+            await fs.unlink(filePath);
+        }
+        catch (err) {
+            if (isNotFoundError(err))
+                return;
+            throw err;
+        }
+    }
+}
+//# sourceMappingURL=store-local.js.map

package/dist/assets/store-local.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"store-local.js","sourceRoot":"","sources":["../../src/assets/store-local.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,MAAM,kBAAkB,CAAA;AACjC,OAAO,IAAI,MAAM,WAAW,CAAA;AAC5B,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAExC,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAA;AACpF,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAA;AACvD,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAA;AAczE,uFAAuF;AACvF,MAAM,wBAAwB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAA;AACjD,MAAM,kBAAkB,GAAG,EAAE,CAAA;AAC7B,MAAM,sBAAsB,GAAG,eAAe,CAAA;AAS9C,MAAM,OAAO,eAAe;IAI1B,YAAY,OAA+B;QAHlC,iBAAY,GAAG,EAAE,YAAY,EAAE,KAAK,EAAE,CAAA;QAI7C,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;IACxC,CAAC;IAED;;;;;;;;;;OAUG;IACK,UAAU,CAAC,GAAW;QAC5B,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;QAC7C,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,GAAG,CAAA;QACnF,IAAI,QAAQ,KAAK,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;YAChE,MAAM,IAAI,KAAK,CAAC,oCAAoC,GAAG,EAAE,CAAC,CAAA;QAC5D,CAAC;QACD,OAAO,QAAQ,CAAA;IACjB,CAAC;IAEO,kBAAkB,CAAC,QAAgB;QACzC,OAAO,GAAG,QAAQ,GAAG,sBAAsB,EAAE,CAAA;IAC/C,CAAC;IAEO,KAAK,CAAC,mBAAmB,CAAC,QAAgB,EAAE,OAAsB;QACxE,MAAM,eAAe,CAAC,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAA;IACnF,CAAC;IAEO,KAAK,CAAC,kBAAkB,CAAC,QAAgB;QAC/C,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC,CAAA;YACzE,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAkB,CAAA;QACzC,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,IAAI,eAAe,CAAC,GAAG,CAAC;gBAAE,OAAO,EAAE,CAAA;YACnC,MAAM,GAAG,CAAA;QACX,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,cAAc,CAAC,QAAgB;QAC3C,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAA;YACvC,OAAO,IAAI,UAAU,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,UAAU,CAAC,CAAA;QACnE,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,IAAI,eAAe,CAAC,GAAG,CAAC;gBAAE,OAAO,IAAI,CAAA;YACrC,MAAM,GAAG,CAAA;QACX,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,SAAS,CAAC,QAAgB,EAAE,IAAgB;QACxD,MAAM,eAAe,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAA;IACpD,CAAC;IAEO,KAAK,CAAC,mBAAmB,CAAC,QAAgB;QAChD,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAA;QAC3B,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC;gBAAE,MAAM,GAAG,CAAA;QACtC,CAAC;QACD,kEAAkE;QAClE,MAAM,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;IACpE,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,MAAwB;QACxC,OAAO;YACL,IAAI,EAAE,SAAS;YACf,UAAU,EAAE,UAAU,CAAC,UAAU,EAAE,CAAC;YACpC,QAAQ,EAAE,wBAAwB;SACnC,CAAA;IACH,CAAC;IAED;;;;;OAKG;IACK,gBAAgB,CAAC,GAAW;QAClC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,cAAc,CAAC,OAAO,GAAG,CAAC,EAAE,CAAC;YAClD,MAAM,IAAI,KAAK,CAAC,sBAAsB,GAAG,EAAE,CAAC,CAAA;QAC9C,CAAC;IACH,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,GAAW,EAAE,IAAgB,EAAE,YAAqB;QACrE,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAA;QAC1B,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,CAAA;IAClD,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,GAAW;QAC3B,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAA;QAC1B,OAAO,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAA;IAClD,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,GAAW;QAC7B,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAA;QAC1B,MAAM,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAA;IACtD,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,KAKjB;QACC,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAA;QACtE,MAAM,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,CAAC,CAAA;QAC1C,MAAM,IAAI,CAAC,mBAAmB,CAAC,QAAQ,EAAE,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,CAAA;IAC9E,CAAC;IAED,KAAK,CAAC,YAAY,CAChB,MAAc;QAEd,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC,SAAS,CAAC,CAAA;QACrD,IAAI,OAAiB,CAAA;QACrB,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QACjC,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,IAAI,eAAe,CAAC,GAAG,CAAC;gBAAE,OAAO,IAAI,CAAA;YACrC,MAAM,GAAG,CAAA;QACX,CAAC;QACD,MAAM,MAAM,GAAG,GAAG,MAAM,GAAG,CAAA;QAC3B,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CACxB,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,sBAAsB,CAAC,CAC5E,CAAA;QACD,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAA;QAEvB,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;QACtC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAA;QAChD,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAA;QACtB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAA;QACvD,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,CAAA;IACpF,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,KAMrB;QACC,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QAC3C,MAAM,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,CAAC,CAAA;QAC1C,MAAM,IAAI,CAAC,mBAAmB,CAAC,QAAQ,EAAE;YACvC,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;YAC5C,YAAY,EAAE,KAAK,CAAC,YAAY;SACjC,CAAC,CAAA;IACJ,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,GAAW;QAChC,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAA;QACrC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAA;QAChD,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAA;QACtB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAA;QACvD,OAAO;YACL,IAAI;YACJ,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,kBAAkB,EAAE,OAAO,CAAC,kBAAkB;YAC9C,YAAY,EAAE,OAAO,CAAC,YAAY;SACnC,CAAA;IACH,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,eAAe,CAAC,MAAc,EAAE,IAAe;QACnD,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAA;QACjD,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QAC3D,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAA;YAClE,OAAO,SAAS,CAAA;QAClB,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,IAAI,iBAAiB,CAAC,GAAG,CAAC;gBAAE,OAAO,gBAAgB,CAAA;YACnD,MAAM,GAAG,CAAA;QACX,CAAC;IACH,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,MAAc;QAC1B,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAA;QACjD,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAA;YAChD,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAc,CAAA;QACrC,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,IAAI,eAAe,CAAC,GAAG,CAAC;gBAAE,OAAO,IAAI,CAAA;YACrC,MAAM,GAAG,CAAA;QACX,CAAC;IACH,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,KAA2C;QAIxD,MAAM,KAAK,GAAG,KAAK,EAAE,KAAK,IAAI,kBAAkB,CAAA;QAChD,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC,IAAI,CAAC,CAAA;QAEhD,IAAI,SAAmB,CAAA;QACvB,IAAI,CAAC;YACH,SAAS,GAAG,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAA;QAC9E,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,IAAI,eAAe,CAAC,GAAG,CAAC;gBAAE,SAAS,GAAG,EAAE,CAAA;;gBACnC,MAAM,GAAG,CAAA;QAChB,CAAC;QAED,MAAM,GAAG,GAAgB,EAAE,CAAA;QAC3B,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;YAC7B,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,OAAO,CAAC,CAAA;gBAC5D,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAc,CAAC,CAAA;YACxC,CAAC;YAAC,OAAO,GAAY,EAAE,CAAC;gBACtB,oEAAoE;gBACpE,uEAAuE;gBACvE,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC;oBAC1B,MAAM,IAAI,KAAK,CAAC,mCAAmC,IAAI,MAAM,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;gBACtF,CAAC;YACH,CAAC;QACH,CAAC;QAED,0EAA0E;QAC1E,uEAAuE;QACvE,8CAA8C;QAC9C,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;YAChB,IAAI,CAAC,CAAC,UAAU,KAAK,CAAC,CAAC,UAAU;gBAAE,OAAO,CAAC,CAAC,UAAU,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;YAC9E,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;QACrC,CAAC,CAAC,CAAA;QAEF,IAAI,UAAU,GAAG,CAAC,CAAA;QAClB,IAAI,KAAK,EAAE,MAAM,EAAE,CAAC;YAClB,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAA;YACzE,MAAM,GAAG,GAAG,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,WAAW,CAAC,CAAA;YAC1D,UAAU,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAA;QACvC,CAAC;QAED,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,UAAU,EAAE,UAAU,GAAG,KAAK,CAAC,CAAA;QACvD,MAAM,OAAO,GAAG,UAAU,GAAG,KAAK,GAAG,GAAG,CAAC,MAAM,CAAA;QAC/C,MAAM,UAAU,GAAG,OAAO;YACxB,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;YACzE,CAAC,CAAC,SAAS,CAAA;QAEb,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,CAAA;IAC9B,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,MAAc;QAC7B,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAA;QACjD,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAA;QAC3B,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,IAAI,eAAe,CAAC,GAAG,CAAC;gBAAE,OAAM;YAChC,MAAM,GAAG,CAAA;QACX,CAAC;IACH,CAAC;CACF"}

package/dist/assets/store-s3.d.ts

@@ -0,0 +1,71 @@
+/**
+ * S3-backed AssetStore. Same bucket-prefix layout as LocalAssetStore (see
+ * keys.ts). Assumes an EXISTING content bucket (versioning/SSE/replication
+ * already configured by the site's CDK stack) — this store only ever reads
+ * and writes objects under the five asset prefixes.
+ */
+import { type AssetPrefixes } from './keys';
+import type { AssetMeta, AssetStore, BeginUploadInput, PublicObject, StagedUploadTarget } from './types';
+export interface S3AssetStoreOptions {
+    bucket: string;
+    region: string;
+    publicBaseUrl?: string;
+    /** Defaults to 50 MiB. */
+    maxUploadBytes?: number;
+    /** Override the default bucket-prefix layout (rarely needed). */
+    prefixes?: AssetPrefixes;
+}
+export declare class S3AssetStore implements AssetStore {
+    readonly capabilities: {
+        directUpload: boolean;
+    };
+    private readonly client;
+    private readonly bucket;
+    private readonly maxUploadBytes;
+    private readonly keys;
+    private readonly stagingPrefix;
+    constructor(options: S3AssetStoreOptions);
+    /**
+     * Staging methods accept caller-influenced keys (finalize receives the key
+     * from the client), so they must never operate outside the staging prefix —
+     * in a shared content bucket an unguarded deleteStaging would reach deploy
+     * artifacts under builds/. The API layer validates too; defense-in-depth.
+     */
+    private assertStagingKey;
+    beginUpload(input: BeginUploadInput): Promise<StagedUploadTarget>;
+    writeStaging(key: string, data: Uint8Array, contentType?: string): Promise<void>;
+    readStaging(key: string): Promise<Uint8Array | null>;
+    deleteStaging(key: string): Promise<void>;
+    putOriginal(input: {
+        hash32: string;
+        ext: string;
+        data: Uint8Array;
+        contentType: string;
+    }): Promise<void>;
+    readOriginal(hash32: string): Promise<{
+        data: Uint8Array;
+        ext: string;
+        contentType?: string;
+    } | null>;
+    putPublicObject(input: {
+        key: string;
+        data: Uint8Array;
+        contentType: string;
+        contentDisposition?: string;
+        cacheControl?: string;
+    }): Promise<void>;
+    readPublicObject(key: string): Promise<PublicObject | null>;
+    putMetaIfAbsent(hash32: string, meta: AssetMeta): Promise<'created' | 'already-exists'>;
+    getMeta(hash32: string): Promise<AssetMeta | null>;
+    listMeta(input?: {
+        cursor?: string;
+        limit?: number;
+    }): Promise<{
+        items: AssetMeta[];
+        nextCursor?: string;
+    }>;
+    deleteMeta(hash32: string): Promise<void>;
+    private getObject;
+    private getObjectBytes;
+}
+//# sourceMappingURL=store-s3.d.ts.map

package/dist/assets/store-s3.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"store-s3.d.ts","sourceRoot":"","sources":["../../src/assets/store-s3.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAYH,OAAO,EAAqC,KAAK,aAAa,EAAE,MAAM,QAAQ,CAAA;AAC9E,OAAO,KAAK,EACV,SAAS,EACT,UAAU,EACV,gBAAgB,EAChB,YAAY,EACZ,kBAAkB,EACnB,MAAM,SAAS,CAAA;AAEhB,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,MAAM,CAAA;IACd,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,0BAA0B;IAC1B,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,iEAAiE;IACjE,QAAQ,CAAC,EAAE,aAAa,CAAA;CACzB;AA2BD,qBAAa,YAAa,YAAW,UAAU;IAC7C,QAAQ,CAAC,YAAY;;MAAyB;IAC9C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAU;IACjC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAQ;IAC/B,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAQ;IACvC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAsC;IAC3D,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAQ;gBAE1B,OAAO,EAAE,mBAAmB;IASxC;;;;;OAKG;IACH,OAAO,CAAC,gBAAgB;IAMlB,WAAW,CAAC,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAiBjE,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAOhF,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC;IAKpD,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAKzC,WAAW,CAAC,KAAK,EAAE;QACvB,MAAM,EAAE,MAAM,CAAA;QACd,GAAG,EAAE,MAAM,CAAA;QACX,IAAI,EAAE,UAAU,CAAA;QAChB,WAAW,EAAE,MAAM,CAAA;KACpB,GAAG,OAAO,CAAC,IAAI,CAAC;IAWX,YAAY,CAChB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC;QAAE,IAAI,EAAE,UAAU,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IAepE,eAAe,CAAC,KAAK,EAAE;QAC3B,GAAG,EAAE,MAAM,CAAA;QACX,IAAI,EAAE,UAAU,CAAA;QAChB,WAAW,EAAE,MAAM,CAAA;QACnB,kBAAkB,CAAC,EAAE,MAAM,CAAA;QAC3B,YAAY,CAAC,EAAE,MAAM,CAAA;KACtB,GAAG,OAAO,CAAC,IAAI,CAAC;IAaX,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC;IAa3D,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC,SAAS,GAAG,gBAAgB,CAAC;IAkBvF,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC;IAMlD,QAAQ,CAAC,KAAK,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC;QACnE,KAAK,EAAE,SAAS,EAAE,CAAA;QAClB,UAAU,CAAC,EAAE,MAAM,CAAA;KACpB,CAAC;IA6BI,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;YAMjC,SAAS;YAST,cAAc;CAM7B"}

package/dist/assets/store-s3.js

@@ -0,0 +1,183 @@
+/**
+ * S3-backed AssetStore. Same bucket-prefix layout as LocalAssetStore (see
+ * keys.ts). Assumes an EXISTING content bucket (versioning/SSE/replication
+ * already configured by the site's CDK stack) — this store only ever reads
+ * and writes objects under the five asset prefixes.
+ */
+import { randomUUID } from 'node:crypto';
+import { DeleteObjectCommand, GetObjectCommand, ListObjectsV2Command, PutObjectCommand, S3Client, } from '@aws-sdk/client-s3';
+import { createPresignedPost } from '@aws-sdk/s3-presigned-post';
+import { ASSET_PREFIXES, createKeyBuilders } from './keys.js';
+const DEFAULT_MAX_UPLOAD_BYTES = 50 * 1024 * 1024;
+const PRESIGN_EXPIRY_SECONDS = 15 * 60;
+function matchesAwsError(err, name, httpStatusCode) {
+    if (!(err instanceof Error))
+        return false;
+    const shaped = err;
+    return shaped.name === name || shaped.$metadata?.httpStatusCode === httpStatusCode;
+}
+const isPreconditionFailed = (err) => matchesAwsError(err, 'PreconditionFailed', 412);
+const isNoSuchKey = (err) => matchesAwsError(err, 'NoSuchKey', 404);
+export class S3AssetStore {
+    constructor(options) {
+        this.capabilities = { directUpload: true };
+        this.bucket = options.bucket;
+        this.maxUploadBytes = options.maxUploadBytes ?? DEFAULT_MAX_UPLOAD_BYTES;
+        this.client = new S3Client({ region: options.region });
+        const prefixes = options.prefixes ?? ASSET_PREFIXES;
+        this.keys = createKeyBuilders(prefixes);
+        this.stagingPrefix = `${prefixes.staging}/`;
+    }
+    /**
+     * Staging methods accept caller-influenced keys (finalize receives the key
+     * from the client), so they must never operate outside the staging prefix —
+     * in a shared content bucket an unguarded deleteStaging would reach deploy
+     * artifacts under builds/. The API layer validates too; defense-in-depth.
+     */
+    assertStagingKey(key) {
+        if (!key.startsWith(this.stagingPrefix)) {
+            throw new Error(`Not a staging key: ${key}`);
+        }
+    }
+    async beginUpload(input) {
+        const key = this.keys.stagingKey(randomUUID());
+        const { url, fields } = await createPresignedPost(this.client, {
+            Bucket: this.bucket,
+            Key: key,
+            Conditions: [
+                ['content-length-range', 1, this.maxUploadBytes],
+                { 'Content-Type': input.contentType },
+            ],
+            Fields: {
+                'Content-Type': input.contentType,
+            },
+            Expires: PRESIGN_EXPIRY_SECONDS,
+        });
+        return { mode: 'direct', url, fields, stagingKey: key, maxBytes: this.maxUploadBytes };
+    }
+    async writeStaging(key, data, contentType) {
+        this.assertStagingKey(key);
+        await this.client.send(new PutObjectCommand({ Bucket: this.bucket, Key: key, Body: data, ContentType: contentType }));
+    }
+    async readStaging(key) {
+        this.assertStagingKey(key);
+        return this.getObjectBytes(key);
+    }
+    async deleteStaging(key) {
+        this.assertStagingKey(key);
+        await this.client.send(new DeleteObjectCommand({ Bucket: this.bucket, Key: key }));
+    }
+    async putOriginal(input) {
+        await this.client.send(new PutObjectCommand({
+            Bucket: this.bucket,
+            Key: this.keys.originalKey(input.hash32, input.ext),
+            Body: input.data,
+            ContentType: input.contentType,
+        }));
+    }
+    async readOriginal(hash32) {
+        const prefix = this.keys.originalPrefix(hash32);
+        const listed = await this.client.send(new ListObjectsV2Command({ Bucket: this.bucket, Prefix: prefix, MaxKeys: 1 }));
+        const foundKey = listed.Contents?.[0]?.Key;
+        if (!foundKey)
+            return null;
+        const result = await this.getObject(foundKey);
+        if (!result)
+            return null;
+        const data = await result.Body?.transformToByteArray();
+        if (!data)
+            return null;
+        return { data, ext: foundKey.slice(prefix.length), contentType: result.ContentType };
+    }
+    async putPublicObject(input) {
+        await this.client.send(new PutObjectCommand({
+            Bucket: this.bucket,
+            Key: input.key,
+            Body: input.data,
+            ContentType: input.contentType,
+            ContentDisposition: input.contentDisposition,
+            CacheControl: input.cacheControl,
+        }));
+    }
+    async readPublicObject(key) {
+        const result = await this.getObject(key);
+        if (!result)
+            return null;
+        const data = await result.Body?.transformToByteArray();
+        if (!data)
+            return null;
+        return {
+            data,
+            contentType: result.ContentType,
+            contentDisposition: result.ContentDisposition,
+            cacheControl: result.CacheControl,
+        };
+    }
+    async putMetaIfAbsent(hash32, meta) {
+        try {
+            await this.client.send(new PutObjectCommand({
+                Bucket: this.bucket,
+                Key: this.keys.metaKey(hash32),
+                Body: JSON.stringify(meta),
+                ContentType: 'application/json',
+                IfNoneMatch: '*',
+            }));
+            return 'created';
+        }
+        catch (err) {
+            if (isPreconditionFailed(err))
+                return 'already-exists';
+            throw err;
+        }
+    }
+    async getMeta(hash32) {
+        const bytes = await this.getObjectBytes(this.keys.metaKey(hash32));
+        if (!bytes)
+            return null;
+        return JSON.parse(Buffer.from(bytes).toString('utf-8'));
+    }
+    async listMeta(input) {
+        const listed = await this.client.send(new ListObjectsV2Command({
+            Bucket: this.bucket,
+            Prefix: this.keys.metaPrefix(),
+            MaxKeys: input?.limit,
+            ContinuationToken: input?.cursor,
+        }));
+        const objectKeys = (listed.Contents ?? [])
+            .map((obj) => obj.Key)
+            .filter((key) => Boolean(key));
+        const fetched = await Promise.all(objectKeys.map(async (key) => {
+            const bytes = await this.getObjectBytes(key);
+            // A meta object deleted between LIST and GET (deleteMeta race) reads
+            // as null; skip it rather than failing the whole page.
+            if (!bytes)
+                return null;
+            return JSON.parse(Buffer.from(bytes).toString('utf-8'));
+        }));
+        return {
+            items: fetched.filter((meta) => meta !== null),
+            nextCursor: listed.IsTruncated ? listed.NextContinuationToken : undefined,
+        };
+    }
+    async deleteMeta(hash32) {
+        await this.client.send(new DeleteObjectCommand({ Bucket: this.bucket, Key: this.keys.metaKey(hash32) }));
+    }
+    async getObject(key) {
+        try {
+            return await this.client.send(new GetObjectCommand({ Bucket: this.bucket, Key: key }));
+        }
+        catch (err) {
+            if (isNoSuchKey(err))
+                return null;
+            throw err;
+        }
+    }
+    async getObjectBytes(key) {
+        const result = await this.getObject(key);
+        if (!result)
+            return null;
+        const bytes = await result.Body?.transformToByteArray();
+        return bytes ?? null;
+    }
+}
+//# sourceMappingURL=store-s3.js.map

package/dist/assets/store-s3.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"store-s3.js","sourceRoot":"","sources":["../../src/assets/store-s3.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EACL,mBAAmB,EACnB,gBAAgB,EAChB,oBAAoB,EACpB,gBAAgB,EAChB,QAAQ,GACT,MAAM,oBAAoB,CAAA;AAC3B,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAA;AAEhE,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAsB,MAAM,QAAQ,CAAA;AAmB9E,MAAM,wBAAwB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAA;AACjD,MAAM,sBAAsB,GAAG,EAAE,GAAG,EAAE,CAAA;AAatC,SAAS,eAAe,CAAC,GAAY,EAAE,IAAY,EAAE,cAAsB;IACzE,IAAI,CAAC,CAAC,GAAG,YAAY,KAAK,CAAC;QAAE,OAAO,KAAK,CAAA;IACzC,MAAM,MAAM,GAAG,GAAmC,CAAA;IAClD,OAAO,MAAM,CAAC,IAAI,KAAK,IAAI,IAAI,MAAM,CAAC,SAAS,EAAE,cAAc,KAAK,cAAc,CAAA;AACpF,CAAC;AAED,MAAM,oBAAoB,GAAG,CAAC,GAAY,EAAW,EAAE,CACrD,eAAe,CAAC,GAAG,EAAE,oBAAoB,EAAE,GAAG,CAAC,CAAA;AAEjD,MAAM,WAAW,GAAG,CAAC,GAAY,EAAW,EAAE,CAAC,eAAe,CAAC,GAAG,EAAE,WAAW,EAAE,GAAG,CAAC,CAAA;AAErF,MAAM,OAAO,YAAY;IAQvB,YAAY,OAA4B;QAP/B,iBAAY,GAAG,EAAE,YAAY,EAAE,IAAI,EAAE,CAAA;QAQ5C,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAA;QAC5B,IAAI,CAAC,cAAc,GAAG,OAAO,CAAC,cAAc,IAAI,wBAAwB,CAAA;QACxE,IAAI,CAAC,MAAM,GAAG,IAAI,QAAQ,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAA;QACtD,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,cAAc,CAAA;QACnD,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAA;QACvC,IAAI,CAAC,aAAa,GAAG,GAAG,QAAQ,CAAC,OAAO,GAAG,CAAA;IAC7C,CAAC;IAED;;;;;OAKG;IACK,gBAAgB,CAAC,GAAW;QAClC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC;YACxC,MAAM,IAAI,KAAK,CAAC,sBAAsB,GAAG,EAAE,CAAC,CAAA;QAC9C,CAAC;IACH,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,KAAuB;QACvC,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,EAAE,CAAC,CAAA;QAC9C,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,MAAM,mBAAmB,CAAC,IAAI,CAAC,MAAM,EAAE;YAC7D,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,GAAG,EAAE,GAAG;YACR,UAAU,EAAE;gBACV,CAAC,sBAAsB,EAAE,CAAC,EAAE,IAAI,CAAC,cAAc,CAAC;gBAChD,EAAE,cAAc,EAAE,KAAK,CAAC,WAAW,EAAE;aACtC;YACD,MAAM,EAAE;gBACN,cAAc,EAAE,KAAK,CAAC,WAAW;aAClC;YACD,OAAO,EAAE,sBAAsB;SAChC,CAAC,CAAA;QACF,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,CAAC,cAAc,EAAE,CAAA;IACxF,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,GAAW,EAAE,IAAgB,EAAE,WAAoB;QACpE,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAA;QAC1B,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CACpB,IAAI,gBAAgB,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,WAAW,EAAE,CAAC,CAC9F,CAAA;IACH,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,GAAW;QAC3B,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAA;QAC1B,OAAO,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,CAAA;IACjC,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,GAAW;QAC7B,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAA;QAC1B,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,mBAAmB,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,CAAA;IACpF,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,KAKjB;QACC,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CACpB,IAAI,gBAAgB,CAAC;YACnB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,GAAG,CAAC;YACnD,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,WAAW,EAAE,KAAK,CAAC,WAAW;SAC/B,CAAC,CACH,CAAA;IACH,CAAC;IAED,KAAK,CAAC,YAAY,CAChB,MAAc;QAEd,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,CAAA;QAC/C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CACnC,IAAI,oBAAoB,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC,CAC9E,CAAA;QACD,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,CAAA;QAC1C,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAA;QAE1B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAA;QAC7C,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAA;QACxB,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,oBAAoB,EAAE,CAAA;QACtD,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAA;QACtB,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,CAAA;IACtF,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,KAMrB;QACC,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CACpB,IAAI,gBAAgB,CAAC;YACnB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,GAAG,EAAE,KAAK,CAAC,GAAG;YACd,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;YAC5C,YAAY,EAAE,KAAK,CAAC,YAAY;SACjC,CAAC,CACH,CAAA;IACH,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,GAAW;QAChC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAA;QACxC,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAA;QACxB,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,oBAAoB,EAAE,CAAA;QACtD,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAA;QACtB,OAAO;YACL,IAAI;YACJ,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,kBAAkB,EAAE,MAAM,CAAC,kBAAkB;YAC7C,YAAY,EAAE,MAAM,CAAC,YAAY;SAClC,CAAA;IACH,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,MAAc,EAAE,IAAe;QACnD,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CACpB,IAAI,gBAAgB,CAAC;gBACnB,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;gBAC9B,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;gBAC1B,WAAW,EAAE,kBAAkB;gBAC/B,WAAW,EAAE,GAAG;aACjB,CAAC,CACH,CAAA;YACD,OAAO,SAAS,CAAA;QAClB,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,IAAI,oBAAoB,CAAC,GAAG,CAAC;gBAAE,OAAO,gBAAgB,CAAA;YACtD,MAAM,GAAG,CAAA;QACX,CAAC;IACH,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,MAAc;QAC1B,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAA;QAClE,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAA;QACvB,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAc,CAAA;IACtE,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,KAA2C;QAIxD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CACnC,IAAI,oBAAoB,CAAC;YACvB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE;YAC9B,OAAO,EAAE,KAAK,EAAE,KAAK;YACrB,iBAAiB,EAAE,KAAK,EAAE,MAAM;SACjC,CAAC,CACH,CAAA;QACD,MAAM,UAAU,GAAG,CAAC,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAC;aACvC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC;aACrB,MAAM,CAAC,CAAC,GAAG,EAAiB,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAA;QAE/C,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAC/B,UAAU,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;YAC3B,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,CAAA;YAC5C,qEAAqE;YACrE,uDAAuD;YACvD,IAAI,CAAC,KAAK;gBAAE,OAAO,IAAI,CAAA;YACvB,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAc,CAAA;QACtE,CAAC,CAAC,CACH,CAAA;QAED,OAAO;YACL,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,EAAqB,EAAE,CAAC,IAAI,KAAK,IAAI,CAAC;YACjE,UAAU,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAAC,CAAC,SAAS;SAC1E,CAAA;IACH,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,MAAc;QAC7B,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CACpB,IAAI,mBAAmB,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CACjF,CAAA;IACH,CAAC;IAEO,KAAK,CAAC,SAAS,CAAC,GAAW;QACjC,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,gBAAgB,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,CAAA;QACxF,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,IAAI,WAAW,CAAC,GAAG,CAAC;gBAAE,OAAO,IAAI,CAAA;YACjC,MAAM,GAAG,CAAA;QACX,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,cAAc,CAAC,GAAW;QACtC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAA;QACxC,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAA;QACxB,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,oBAAoB,EAAE,CAAA;QACvD,OAAO,KAAK,IAAI,IAAI,CAAA;IACtB,CAAC;CACF"}

package/dist/assets/svg-sanitizer.d.ts

@@ -0,0 +1,37 @@
+/**
+ * SVG sanitization. Server-only - never import from client/editor code.
+ *
+ * Sanitizer choice: the design record (.claude/future-tasks/assets-media-system.md)
+ * suggested `dompurify` + a lightweight DOM shim (e.g. `linkedom`) in place of the
+ * heavier `jsdom`. In practice that pairing is unsafe: DOMPurify's own README warns
+ * that immature DOM shims can cause it to fail in ways that produce an XSS hole even
+ * when DOMPurify itself behaves correctly, and that is exactly what was reproduced
+ * here - `createDOMPurify(linkedomWindow).sanitize(dirtySvg)` returned the INPUT
+ * UNCHANGED (a `<script>`, `onload=`, and `<foreignObject>` all survived), because
+ * linkedom's window has no `NodeFilter` global and DOMPurify silently no-ops when it
+ * doesn't recognize the environment as supported. That is a dangerous failure mode
+ * for a security boundary, so this module uses `sanitize-html` instead: it works
+ * directly on the parser tree (htmlparser2, no DOM shim to be incomplete), is
+ * actively maintained, and - verified empirically - correctly strips scripts, event
+ * handler attributes, and `foreignObject` while preserving a valid, still-parseable
+ * SVG document.
+ *
+ * Allowlist-based (not blocklist): only elements/attributes known to be safe survive.
+ * `href`/`xlink:href` are further restricted to local fragment references (`#...`) so
+ * `<use>`/`<a>` can reference in-document defs but can never point at an external URL
+ * (tracking pixels, `javascript:` URLs, etc.) - sanitize-html's tag-level scheme
+ * allowlisting does not cover attribute name patterns like this, so it is enforced
+ * directly in `transformTags` below.
+ */
+/**
+ * Sanitize an SVG document (as text). Strips scripts, event-handler attributes,
+ * `<foreignObject>` (and its content), inline `<style>` (CSS injection surface),
+ * any `href`/`xlink:href` that isn't a local fragment reference, and any
+ * `url(...)` reference on a paint/filter/marker attribute that isn't a local
+ * fragment reference (external-fetch tracking beacon).
+ *
+ * Input must already be confirmed to be an SVG document (see `sniffSvg` in
+ * pipeline.ts) - this function does not re-validate the root element.
+ */
+export declare function sanitizeSvg(svgText: string): string;
+//# sourceMappingURL=svg-sanitizer.d.ts.map

package/dist/assets/svg-sanitizer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"svg-sanitizer.d.ts","sourceRoot":"","sources":["../../src/assets/svg-sanitizer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAuKH;;;;;;;;;GASG;AACH,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAwBnD"}