canopycms 0.0.57 → 0.0.59

package/dist/assets/svg-sanitizer.js

@@ -0,0 +1,222 @@
+/**
+ * SVG sanitization. Server-only - never import from client/editor code.
+ *
+ * Sanitizer choice: the design record (.claude/future-tasks/assets-media-system.md)
+ * suggested `dompurify` + a lightweight DOM shim (e.g. `linkedom`) in place of the
+ * heavier `jsdom`. In practice that pairing is unsafe: DOMPurify's own README warns
+ * that immature DOM shims can cause it to fail in ways that produce an XSS hole even
+ * when DOMPurify itself behaves correctly, and that is exactly what was reproduced
+ * here - `createDOMPurify(linkedomWindow).sanitize(dirtySvg)` returned the INPUT
+ * UNCHANGED (a `<script>`, `onload=`, and `<foreignObject>` all survived), because
+ * linkedom's window has no `NodeFilter` global and DOMPurify silently no-ops when it
+ * doesn't recognize the environment as supported. That is a dangerous failure mode
+ * for a security boundary, so this module uses `sanitize-html` instead: it works
+ * directly on the parser tree (htmlparser2, no DOM shim to be incomplete), is
+ * actively maintained, and - verified empirically - correctly strips scripts, event
+ * handler attributes, and `foreignObject` while preserving a valid, still-parseable
+ * SVG document.
+ *
+ * Allowlist-based (not blocklist): only elements/attributes known to be safe survive.
+ * `href`/`xlink:href` are further restricted to local fragment references (`#...`) so
+ * `<use>`/`<a>` can reference in-document defs but can never point at an external URL
+ * (tracking pixels, `javascript:` URLs, etc.) - sanitize-html's tag-level scheme
+ * allowlisting does not cover attribute name patterns like this, so it is enforced
+ * directly in `transformTags` below.
+ */
+import sanitizeHtml from 'sanitize-html';
+const ALLOWED_SVG_TAGS = [
+    'svg',
+    'g',
+    'defs',
+    'symbol',
+    'use',
+    'title',
+    'desc',
+    'rect',
+    'circle',
+    'ellipse',
+    'line',
+    'polyline',
+    'polygon',
+    'path',
+    'text',
+    'tspan',
+    'textPath',
+    'linearGradient',
+    'radialGradient',
+    'stop',
+    'clipPath',
+    'mask',
+    'pattern',
+    'filter',
+    'feGaussianBlur',
+    'feOffset',
+    'feBlend',
+    'feColorMatrix',
+    'feComponentTransfer',
+    'feFuncA',
+    'feFuncR',
+    'feFuncG',
+    'feFuncB',
+    'feComposite',
+    'feFlood',
+    'feMerge',
+    'feMergeNode',
+    'feMorphology',
+    'feTile',
+    'feTurbulence',
+    'feDropShadow',
+    'feDisplacementMap',
+    'image',
+    'a',
+    'marker',
+    'metadata',
+];
+const ALLOWED_SVG_ATTRS = [
+    'id',
+    'class',
+    'style',
+    'transform',
+    'fill',
+    'fill-rule',
+    'fill-opacity',
+    'stroke',
+    'stroke-width',
+    'stroke-linecap',
+    'stroke-linejoin',
+    'stroke-dasharray',
+    'stroke-opacity',
+    'opacity',
+    'd',
+    'x',
+    'y',
+    'width',
+    'height',
+    'cx',
+    'cy',
+    'r',
+    'rx',
+    'ry',
+    'x1',
+    'y1',
+    'x2',
+    'y2',
+    'points',
+    'viewBox',
+    'preserveAspectRatio',
+    'xmlns',
+    'xmlns:xlink',
+    'version',
+    'offset',
+    'stop-color',
+    'stop-opacity',
+    'gradientUnits',
+    'gradientTransform',
+    'patternUnits',
+    'patternTransform',
+    'href',
+    'xlink:href',
+    'clip-path',
+    'mask',
+    'filter',
+    'font-family',
+    'font-size',
+    'font-weight',
+    'text-anchor',
+    'dx',
+    'dy',
+    'marker-start',
+    'marker-mid',
+    'marker-end',
+];
+/**
+ * Elements whose entire subtree (tags AND text) is discarded when they are not
+ * in the allowlist. Without this, sanitize-html's default `disallowedTagsMode:
+ * 'discard'` removes the tag itself but leaves loose text content behind (e.g.
+ * a stripped `<foreignObject><div>evil</div></foreignObject>` would otherwise
+ * leave a bare "evil" text node in the sanitized output).
+ */
+const NON_TEXT_TAGS = ['script', 'style', 'textarea', 'option', 'foreignObject'];
+/**
+ * Presentation attributes (beyond `style`) whose SVG grammar accepts a
+ * `<funciri>` (`url(...)`) value - `fill`/`stroke` reference paint servers
+ * (gradients/patterns), `filter`/`mask`/`clip-path` reference filter-effect
+ * elements, and the three `marker-*` attributes reference `<marker>`
+ * elements. Every one of these is in `ALLOWED_SVG_ATTRS`, so every one of
+ * them is a route for the same external-fetch beacon `style`'s `url(...)`
+ * hardening (below) already closes: `<rect fill="url(https://evil/beacon)">`
+ * fetches externally the moment the SVG is opened as a document, exactly
+ * like a `style="background:url(...)"` would.
+ */
+const URL_BEARING_ATTRS = new Set([
+    'style',
+    'fill',
+    'stroke',
+    'filter',
+    'mask',
+    'clip-path',
+    'marker-start',
+    'marker-mid',
+    'marker-end',
+]);
+/**
+ * True when `value` is safe for a URL-bearing presentation attribute: either
+ * it has no `url(...)` funciri and no backslash at all (the common case -
+ * plain colors, `none`, etc.), or its only `url(...)` reference is a local
+ * fragment (`url(#foo)`) - the same in-document-only allowance `href`/
+ * `xlink:href` get, and exactly what gradients/filters/markers legitimately
+ * need to reference document-local `<linearGradient>`/`<filter>`/`<marker>`
+ * defs. Backslashes are rejected unconditionally (even alongside an
+ * otherwise-local `url(#foo)`): CSS escapes (e.g. `\75 rl(...)` -> `url(...)`)
+ * let a crafted value slip past a plain `url(` text match yet still resolve
+ * to an external fetch in the browser's CSS/SVG value parser, and
+ * backslashes have no legitimate use in any of these attribute values.
+ */
+function isSafeUrlBearingValue(value) {
+    if (value.includes('\\'))
+        return false;
+    const urlMatches = value.matchAll(/url\s*\(\s*(['"]?)\s*([^)'"]*?)\s*\1\s*\)/gi);
+    let sawUrl = false;
+    for (const match of urlMatches) {
+        sawUrl = true;
+        if (!match[2].startsWith('#'))
+            return false;
+    }
+    return sawUrl ? true : !/url\s*\(/i.test(value);
+}
+/**
+ * Sanitize an SVG document (as text). Strips scripts, event-handler attributes,
+ * `<foreignObject>` (and its content), inline `<style>` (CSS injection surface),
+ * any `href`/`xlink:href` that isn't a local fragment reference, and any
+ * `url(...)` reference on a paint/filter/marker attribute that isn't a local
+ * fragment reference (external-fetch tracking beacon).
+ *
+ * Input must already be confirmed to be an SVG document (see `sniffSvg` in
+ * pipeline.ts) - this function does not re-validate the root element.
+ */
+export function sanitizeSvg(svgText) {
+    return sanitizeHtml(svgText, {
+        allowedTags: ALLOWED_SVG_TAGS,
+        allowedAttributes: { '*': ALLOWED_SVG_ATTRS },
+        nonTextTags: NON_TEXT_TAGS,
+        // xmlMode makes htmlparser2 treat this as XML (self-closing tags, no HTML
+        // element-specific parsing quirks) rather than HTML, which matters for SVG.
+        parser: { xmlMode: true, decodeEntities: true },
+        transformTags: {
+            '*': (tagName, attribs) => {
+                const filtered = {};
+                for (const [key, value] of Object.entries(attribs)) {
+                    if ((key === 'href' || key === 'xlink:href') && !value.startsWith('#')) {
+                        continue; // drop external/non-local references
+                    }
+                    if (URL_BEARING_ATTRS.has(key) && !isSafeUrlBearingValue(value)) {
+                        continue; // drop external/non-local url(...) references (or any backslash)
+                    }
+                    filtered[key] = value;
+                }
+                return { tagName, attribs: filtered };
+            },
+        },
+    });
+}
+//# sourceMappingURL=svg-sanitizer.js.map

package/dist/assets/svg-sanitizer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"svg-sanitizer.js","sourceRoot":"","sources":["../../src/assets/svg-sanitizer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,YAAY,MAAM,eAAe,CAAA;AAExC,MAAM,gBAAgB,GAAG;IACvB,KAAK;IACL,GAAG;IACH,MAAM;IACN,QAAQ;IACR,KAAK;IACL,OAAO;IACP,MAAM;IACN,MAAM;IACN,QAAQ;IACR,SAAS;IACT,MAAM;IACN,UAAU;IACV,SAAS;IACT,MAAM;IACN,MAAM;IACN,OAAO;IACP,UAAU;IACV,gBAAgB;IAChB,gBAAgB;IAChB,MAAM;IACN,UAAU;IACV,MAAM;IACN,SAAS;IACT,QAAQ;IACR,gBAAgB;IAChB,UAAU;IACV,SAAS;IACT,eAAe;IACf,qBAAqB;IACrB,SAAS;IACT,SAAS;IACT,SAAS;IACT,SAAS;IACT,aAAa;IACb,SAAS;IACT,SAAS;IACT,aAAa;IACb,cAAc;IACd,QAAQ;IACR,cAAc;IACd,cAAc;IACd,mBAAmB;IACnB,OAAO;IACP,GAAG;IACH,QAAQ;IACR,UAAU;CACX,CAAA;AAED,MAAM,iBAAiB,GAAG;IACxB,IAAI;IACJ,OAAO;IACP,OAAO;IACP,WAAW;IACX,MAAM;IACN,WAAW;IACX,cAAc;IACd,QAAQ;IACR,cAAc;IACd,gBAAgB;IAChB,iBAAiB;IACjB,kBAAkB;IAClB,gBAAgB;IAChB,SAAS;IACT,GAAG;IACH,GAAG;IACH,GAAG;IACH,OAAO;IACP,QAAQ;IACR,IAAI;IACJ,IAAI;IACJ,GAAG;IACH,IAAI;IACJ,IAAI;IACJ,IAAI;IACJ,IAAI;IACJ,IAAI;IACJ,IAAI;IACJ,QAAQ;IACR,SAAS;IACT,qBAAqB;IACrB,OAAO;IACP,aAAa;IACb,SAAS;IACT,QAAQ;IACR,YAAY;IACZ,cAAc;IACd,eAAe;IACf,mBAAmB;IACnB,cAAc;IACd,kBAAkB;IAClB,MAAM;IACN,YAAY;IACZ,WAAW;IACX,MAAM;IACN,QAAQ;IACR,aAAa;IACb,WAAW;IACX,aAAa;IACb,aAAa;IACb,IAAI;IACJ,IAAI;IACJ,cAAc;IACd,YAAY;IACZ,YAAY;CACb,CAAA;AAED;;;;;;GAMG;AACH,MAAM,aAAa,GAAG,CAAC,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,eAAe,CAAC,CAAA;AAEhF;;;;;;;;;;GAUG;AACH,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC;IAChC,OAAO;IACP,MAAM;IACN,QAAQ;IACR,QAAQ;IACR,MAAM;IACN,WAAW;IACX,cAAc;IACd,YAAY;IACZ,YAAY;CACb,CAAC,CAAA;AAEF;;;;;;;;;;;;GAYG;AACH,SAAS,qBAAqB,CAAC,KAAa;IAC1C,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAA;IACtC,MAAM,UAAU,GAAG,KAAK,CAAC,QAAQ,CAAC,6CAA6C,CAAC,CAAA;IAChF,IAAI,MAAM,GAAG,KAAK,CAAA;IAClB,KAAK,MAAM,KAAK,IAAI,UAAU,EAAE,CAAC;QAC/B,MAAM,GAAG,IAAI,CAAA;QACb,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,OAAO,KAAK,CAAA;IAC7C,CAAC;IACD,OAAO,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;AACjD,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,WAAW,CAAC,OAAe;IACzC,OAAO,YAAY,CAAC,OAAO,EAAE;QAC3B,WAAW,EAAE,gBAAgB;QAC7B,iBAAiB,EAAE,EAAE,GAAG,EAAE,iBAAiB,EAAE;QAC7C,WAAW,EAAE,aAAa;QAC1B,0EAA0E;QAC1E,4EAA4E;QAC5E,MAAM,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE;QAC/C,aAAa,EAAE;YACb,GAAG,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE;gBACxB,MAAM,QAAQ,GAA2B,EAAE,CAAA;gBAC3C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;oBACnD,IAAI,CAAC,GAAG,KAAK,MAAM,IAAI,GAAG,KAAK,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;wBACvE,SAAQ,CAAC,qCAAqC;oBAChD,CAAC;oBACD,IAAI,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,qBAAqB,CAAC,KAAK,CAAC,EAAE,CAAC;wBAChE,SAAQ,CAAC,iEAAiE;oBAC5E,CAAC;oBACD,QAAQ,CAAC,GAAG,CAAC,GAAG,KAAK,CAAA;gBACvB,CAAC;gBACD,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAA;YACvC,CAAC;SACF;KACF,CAAC,CAAA;AACJ,CAAC"}

package/dist/assets/transform-directives.d.ts

@@ -0,0 +1,97 @@
+/**
+ * Pure parser/formatter for `/assets/t/{directives}/{hash32}/{slug}.{ext}`
+ * transform URLs. Isomorphic and dependency-free by design: this module has
+ * NO imports (not even other files in this directory) so it can be imported
+ * from client bundles (via `assetUrl`/`assetSrcSet` in asset-url.ts, exported
+ * off the package's main entry) as well as from the server-only transform
+ * engine (transform.ts) and the future prod transform Lambda (PR 7), without
+ * ever pulling in node:crypto, sharp, or any other server-only dependency.
+ *
+ * `{directives}` is either the literal identity token (`orig`) or a
+ * comma-separated list of `key=value` pairs drawn from:
+ *   w={int}   output width - allowlisted to multiples of 160 in [160, 4096]
+ *             (bounds cache-stuffing; upscaling is rejected at transform
+ *             time via `withoutEnlargement`, not here)
+ *   f={fmt}   output format: webp | jpeg | png - when present, the URL's
+ *             `{ext}` must equal it exactly
+ *   q={int}   quality 1..100 (encoder-dependent)
+ *   c={rect}  normalized crop rect `x:y:w:h`, four floats in [0,1] with
+ *             x+w<=1 and y+h<=1, w>0 and h>0 (colon-separated - commas are
+ *             the directive separator)
+ *
+ * Duplicate keys, unknown keys, and empty directive strings are rejected.
+ * `orig` must appear alone.
+ */
+/** The identity transform directive name - EXIF-strip only, no other change. */
+export declare const IDENTITY_TRANSFORM_DIRECTIVE = "orig";
+export type OutputFormat = 'webp' | 'jpeg' | 'png';
+export interface CropRect {
+    readonly x: number;
+    readonly y: number;
+    readonly w: number;
+    readonly h: number;
+}
+/** Identity ('orig'): EXIF-strip only, no resize/format/quality change. */
+export interface IdentityDirectives {
+    readonly identity: true;
+}
+/** Non-identity directive set - every field optional, but at least one is present. */
+export interface ResizeDirectives {
+    readonly identity: false;
+    readonly width?: number;
+    readonly format?: OutputFormat;
+    readonly quality?: number;
+    readonly crop?: CropRect;
+}
+export type TransformDirectives = IdentityDirectives | ResizeDirectives;
+export interface ParsedTransformPath {
+    readonly directives: TransformDirectives;
+    readonly hash32: string;
+    readonly slug: string;
+    readonly ext: string;
+}
+export type ParseTransformPathResult = ({
+    readonly ok: true;
+} & ParsedTransformPath) | {
+    readonly ok: false;
+    readonly error: string;
+};
+/**
+ * Decompression-bomb cap: the max `width * height` (post-decode pixel count)
+ * any raster the pipeline handles may have - checked both at upload finalize
+ * time (pipeline.ts, against the raw source dims) and at transform decode
+ * time (transform.ts, via sharp's `limitInputPixels`). Shared here (rather
+ * than duplicated in each server-only module) so it stays a single number,
+ * and because this file is dependency-free/isomorphic it can be imported by
+ * both without pulling sharp or file-type into anything. 4096x4096 (16.7 MP)
+ * comfortably covers the largest output this system ever serves (MAX_WIDTH)
+ * while still bounding decode-time memory for a small/compressible-but-huge
+ * source (e.g. a 30000x30000 solid-color PNG).
+ */
+export declare const MAX_INPUT_PIXELS: number;
+/** True if `width` is on the allowlist: a multiple of 160 in [160, 4096]. */
+export declare function isAllowedTransformWidth(width: number): boolean;
+/** True if `quality` is on the allowlist: a multiple of 5 in [30, 95]. */
+export declare function isAllowedTransformQuality(quality: number): boolean;
+/**
+ * True when x, y, w, h describe a valid normalized crop rect: all four values
+ * finite and in [0,1], w and h strictly positive, and the rect fits within
+ * bounds (x+w<=1, y+h<=1). Shared by the URL-directive parser (`parseCrop`,
+ * below, from a `x:y:w:h` string) and image field value validation (from a
+ * `{x,y,w,h}` object, in validation/entry-validator.ts) so both enforce
+ * identical constraints.
+ */
+export declare function isValidCropRect(x: number, y: number, w: number, h: number): boolean;
+/**
+ * Parse the three path segments after the `assets/t/` prefix:
+ * `[directivesRaw, hash32, "{slug}.{ext}"]`. The raw route strips the
+ * `assets/t/` prefix and splits the remaining key by `/` before calling this.
+ */
+export declare function parseTransformPath(segments: readonly string[]): ParseTransformPathResult;
+/**
+ * Canonical string form of a directive set, so equivalent directive sets
+ * (different key order, different float formatting) always map to the same
+ * cache key. Order is fixed alphabetically by key: c, f, q, w.
+ */
+export declare function formatDirectives(directives: TransformDirectives): string;
+//# sourceMappingURL=transform-directives.d.ts.map

package/dist/assets/transform-directives.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"transform-directives.d.ts","sourceRoot":"","sources":["../../src/assets/transform-directives.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,gFAAgF;AAChF,eAAO,MAAM,4BAA4B,SAAS,CAAA;AAElD,MAAM,MAAM,YAAY,GAAG,MAAM,GAAG,MAAM,GAAG,KAAK,CAAA;AAElD,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAA;IAClB,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAA;IAClB,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAA;IAClB,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAA;CACnB;AAED,2EAA2E;AAC3E,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAA;CACxB;AAED,sFAAsF;AACtF,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,QAAQ,EAAE,KAAK,CAAA;IACxB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,MAAM,CAAC,EAAE,YAAY,CAAA;IAC9B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAA;CACzB;AAED,MAAM,MAAM,mBAAmB,GAAG,kBAAkB,GAAG,gBAAgB,CAAA;AAEvE,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,UAAU,EAAE,mBAAmB,CAAA;IACxC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;CACrB;AAED,MAAM,MAAM,wBAAwB,GAChC,CAAC;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG,mBAAmB,CAAC,GAC7C;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAA;AAMlD;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,gBAAgB,QAAc,CAAA;AAgC3C,6EAA6E;AAC7E,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAI9D;AAQD,0EAA0E;AAC1E,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAOlE;AAcD;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,OAAO,CAOnF;AA0FD;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,GAAG,wBAAwB,CAkCxF;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,UAAU,EAAE,mBAAmB,GAAG,MAAM,CA4BxE"}

package/dist/assets/transform-directives.js

@@ -0,0 +1,267 @@
+/**
+ * Pure parser/formatter for `/assets/t/{directives}/{hash32}/{slug}.{ext}`
+ * transform URLs. Isomorphic and dependency-free by design: this module has
+ * NO imports (not even other files in this directory) so it can be imported
+ * from client bundles (via `assetUrl`/`assetSrcSet` in asset-url.ts, exported
+ * off the package's main entry) as well as from the server-only transform
+ * engine (transform.ts) and the future prod transform Lambda (PR 7), without
+ * ever pulling in node:crypto, sharp, or any other server-only dependency.
+ *
+ * `{directives}` is either the literal identity token (`orig`) or a
+ * comma-separated list of `key=value` pairs drawn from:
+ *   w={int}   output width - allowlisted to multiples of 160 in [160, 4096]
+ *             (bounds cache-stuffing; upscaling is rejected at transform
+ *             time via `withoutEnlargement`, not here)
+ *   f={fmt}   output format: webp | jpeg | png - when present, the URL's
+ *             `{ext}` must equal it exactly
+ *   q={int}   quality 1..100 (encoder-dependent)
+ *   c={rect}  normalized crop rect `x:y:w:h`, four floats in [0,1] with
+ *             x+w<=1 and y+h<=1, w>0 and h>0 (colon-separated - commas are
+ *             the directive separator)
+ *
+ * Duplicate keys, unknown keys, and empty directive strings are rejected.
+ * `orig` must appear alone.
+ */
+/** The identity transform directive name - EXIF-strip only, no other change. */
+export const IDENTITY_TRANSFORM_DIRECTIVE = 'orig';
+const MIN_WIDTH = 160;
+const MAX_WIDTH = 4096;
+const WIDTH_STEP = 160;
+/**
+ * Decompression-bomb cap: the max `width * height` (post-decode pixel count)
+ * any raster the pipeline handles may have - checked both at upload finalize
+ * time (pipeline.ts, against the raw source dims) and at transform decode
+ * time (transform.ts, via sharp's `limitInputPixels`). Shared here (rather
+ * than duplicated in each server-only module) so it stays a single number,
+ * and because this file is dependency-free/isomorphic it can be imported by
+ * both without pulling sharp or file-type into anything. 4096x4096 (16.7 MP)
+ * comfortably covers the largest output this system ever serves (MAX_WIDTH)
+ * while still bounding decode-time memory for a small/compressible-but-huge
+ * source (e.g. a 30000x30000 solid-color PNG).
+ */
+export const MAX_INPUT_PIXELS = 4096 * 4096;
+// Quality is allowlisted (multiples of 5 in [30, 95] - 14 values) for the
+// same cache-stuffing reason as width: every accepted directive combination
+// becomes a stored cache object in prod, so unbounded q would multiply the
+// per-asset variant space by 100. Crop remains the one effectively unbounded
+// dimension (editor rects need float precision) - prod mitigation (rate
+// limiting / signed crops) is tracked in the design record for the CDK PR.
+const MIN_QUALITY = 30;
+const MAX_QUALITY = 95;
+const QUALITY_STEP = 5;
+const CROP_PRECISION = 4;
+const HASH32_RE = /^[a-f0-9]{32}$/;
+const SLUG_RE = /^[a-z0-9-]+$/;
+const EXT_RE = /^[a-z0-9]{1,10}$/;
+const POSITIVE_INT_RE = /^[1-9][0-9]*$/;
+// The two alternatives are mutually exclusive on their very first character
+// ('0' vs '1'), and neither branch nests a quantifier inside another - each
+// character class match advances the position by exactly one, so there is
+// exactly one way to parse any matching string (no backtracking ambiguity).
+// The security plugin's heuristic flags any alternation-plus-quantifier
+// shape regardless; input here is also a single bounded URL path segment,
+// not attacker-scalable text.
+// eslint-disable-next-line security/detect-unsafe-regex
+const UNIT_FLOAT_RE = /^(?:0(?:\.[0-9]+)?|1(?:\.0+)?)$/;
+const KNOWN_DIRECTIVE_KEYS = new Set(['w', 'f', 'q', 'c']);
+function isOutputFormat(value) {
+    return value === 'webp' || value === 'jpeg' || value === 'png';
+}
+/** True if `width` is on the allowlist: a multiple of 160 in [160, 4096]. */
+export function isAllowedTransformWidth(width) {
+    return (Number.isInteger(width) && width >= MIN_WIDTH && width <= MAX_WIDTH && width % WIDTH_STEP === 0);
+}
+function parseWidth(value) {
+    if (!POSITIVE_INT_RE.test(value))
+        return null;
+    const n = Number(value);
+    return isAllowedTransformWidth(n) ? n : null;
+}
+/** True if `quality` is on the allowlist: a multiple of 5 in [30, 95]. */
+export function isAllowedTransformQuality(quality) {
+    return (Number.isInteger(quality) &&
+        quality >= MIN_QUALITY &&
+        quality <= MAX_QUALITY &&
+        quality % QUALITY_STEP === 0);
+}
+function parseQuality(value) {
+    if (!POSITIVE_INT_RE.test(value))
+        return null;
+    const n = Number(value);
+    return isAllowedTransformQuality(n) ? n : null;
+}
+function parseUnitFloat(value) {
+    if (!UNIT_FLOAT_RE.test(value))
+        return null;
+    const n = Number(value);
+    return n >= 0 && n <= 1 ? n : null;
+}
+/**
+ * True when x, y, w, h describe a valid normalized crop rect: all four values
+ * finite and in [0,1], w and h strictly positive, and the rect fits within
+ * bounds (x+w<=1, y+h<=1). Shared by the URL-directive parser (`parseCrop`,
+ * below, from a `x:y:w:h` string) and image field value validation (from a
+ * `{x,y,w,h}` object, in validation/entry-validator.ts) so both enforce
+ * identical constraints.
+ */
+export function isValidCropRect(x, y, w, h) {
+    for (const n of [x, y, w, h]) {
+        if (!Number.isFinite(n) || n < 0 || n > 1)
+            return false;
+    }
+    if (w <= 0 || h <= 0)
+        return false;
+    if (x + w > 1 || y + h > 1)
+        return false;
+    return true;
+}
+function parseCrop(value) {
+    const parts = value.split(':');
+    if (parts.length !== 4)
+        return null;
+    const nums = parts.map(parseUnitFloat);
+    if (nums.some((n) => n === null))
+        return null;
+    const [x, y, w, h] = nums;
+    if (!isValidCropRect(x, y, w, h))
+        return null;
+    return { x, y, w, h };
+}
+function formatUnitFloat(n) {
+    return n.toFixed(CROP_PRECISION);
+}
+function err(error) {
+    return { ok: false, error };
+}
+/**
+ * Parse a `key=value,key=value` directive string (everything between
+ * `assets/t/` and the hash32 segment) into a `TransformDirectives`, or
+ * `orig` into the identity directive.
+ */
+function parseDirectivesString(raw) {
+    if (raw === IDENTITY_TRANSFORM_DIRECTIVE) {
+        return { ok: true, directives: { identity: true } };
+    }
+    if (raw.length === 0) {
+        return err('Empty directives');
+    }
+    const seen = new Set();
+    let width;
+    let format;
+    let quality;
+    let crop;
+    for (const pair of raw.split(',')) {
+        const eqIdx = pair.indexOf('=');
+        // Also catches `orig` combined with other directives (e.g. `orig,w=320`):
+        // `orig` has no `=`, so it falls into this same malformed-pair branch -
+        // `orig` is only ever valid when it is the entire directives string.
+        if (eqIdx <= 0 || eqIdx === pair.length - 1) {
+            return err(`Malformed directive: '${pair}'`);
+        }
+        const key = pair.slice(0, eqIdx);
+        const value = pair.slice(eqIdx + 1);
+        if (!KNOWN_DIRECTIVE_KEYS.has(key)) {
+            return err(`Unknown directive key: '${key}'`);
+        }
+        if (seen.has(key)) {
+            return err(`Duplicate directive key: '${key}'`);
+        }
+        seen.add(key);
+        switch (key) {
+            case 'w': {
+                const w = parseWidth(value);
+                if (w === null)
+                    return err(`Invalid width: '${value}'`);
+                width = w;
+                break;
+            }
+            case 'f': {
+                if (!isOutputFormat(value))
+                    return err(`Invalid format: '${value}'`);
+                format = value;
+                break;
+            }
+            case 'q': {
+                const q = parseQuality(value);
+                if (q === null)
+                    return err(`Invalid quality: '${value}'`);
+                quality = q;
+                break;
+            }
+            case 'c': {
+                const c = parseCrop(value);
+                if (!c)
+                    return err(`Invalid crop: '${value}'`);
+                crop = c;
+                break;
+            }
+        }
+    }
+    return { ok: true, directives: { identity: false, width, format, quality, crop } };
+}
+/**
+ * Parse the three path segments after the `assets/t/` prefix:
+ * `[directivesRaw, hash32, "{slug}.{ext}"]`. The raw route strips the
+ * `assets/t/` prefix and splits the remaining key by `/` before calling this.
+ */
+export function parseTransformPath(segments) {
+    if (segments.length !== 3) {
+        return err(`Expected 3 path segments (directives/hash32/slug.ext), got ${segments.length}`);
+    }
+    const [directivesRaw, hash32, slugExt] = segments;
+    if (!HASH32_RE.test(hash32)) {
+        return err(`Invalid hash32: '${hash32}'`);
+    }
+    const lastDot = slugExt.lastIndexOf('.');
+    if (lastDot <= 0 || lastDot === slugExt.length - 1) {
+        return err(`Invalid slug.ext segment: '${slugExt}'`);
+    }
+    const slug = slugExt.slice(0, lastDot);
+    const ext = slugExt.slice(lastDot + 1);
+    if (!SLUG_RE.test(slug)) {
+        return err(`Invalid slug: '${slug}'`);
+    }
+    if (!EXT_RE.test(ext)) {
+        return err(`Invalid ext: '${ext}'`);
+    }
+    const parsedDirectives = parseDirectivesString(directivesRaw);
+    if (!parsedDirectives.ok) {
+        return parsedDirectives;
+    }
+    const { directives } = parsedDirectives;
+    if (!directives.identity && directives.format !== undefined && directives.format !== ext) {
+        return err(`Extension '${ext}' does not match format '${directives.format}'`);
+    }
+    return { ok: true, directives, hash32, slug, ext };
+}
+/**
+ * Canonical string form of a directive set, so equivalent directive sets
+ * (different key order, different float formatting) always map to the same
+ * cache key. Order is fixed alphabetically by key: c, f, q, w.
+ */
+export function formatDirectives(directives) {
+    if (directives.identity) {
+        return IDENTITY_TRANSFORM_DIRECTIVE;
+    }
+    const parts = [];
+    if (directives.crop) {
+        const { x, y, w, h } = directives.crop;
+        parts.push(`c=${formatUnitFloat(x)}:${formatUnitFloat(y)}:${formatUnitFloat(w)}:${formatUnitFloat(h)}`);
+    }
+    if (directives.format !== undefined) {
+        parts.push(`f=${directives.format}`);
+    }
+    if (directives.quality !== undefined) {
+        parts.push(`q=${directives.quality}`);
+    }
+    if (directives.width !== undefined) {
+        parts.push(`w=${directives.width}`);
+    }
+    // A validly-parsed ResizeDirectives always has at least one field set
+    // (parseDirectivesString rejects an empty directive string), but a
+    // programmatically-constructed one (e.g. from asset-url.ts's merge logic)
+    // could end up all-undefined - fall back to identity rather than emit an
+    // empty directives segment.
+    return parts.length > 0 ? parts.join(',') : IDENTITY_TRANSFORM_DIRECTIVE;
+}
+//# sourceMappingURL=transform-directives.js.map

package/dist/assets/transform-directives.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"transform-directives.js","sourceRoot":"","sources":["../../src/assets/transform-directives.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,gFAAgF;AAChF,MAAM,CAAC,MAAM,4BAA4B,GAAG,MAAM,CAAA;AAsClD,MAAM,SAAS,GAAG,GAAG,CAAA;AACrB,MAAM,SAAS,GAAG,IAAI,CAAA;AACtB,MAAM,UAAU,GAAG,GAAG,CAAA;AAEtB;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,IAAI,GAAG,IAAI,CAAA;AAC3C,0EAA0E;AAC1E,4EAA4E;AAC5E,2EAA2E;AAC3E,6EAA6E;AAC7E,wEAAwE;AACxE,2EAA2E;AAC3E,MAAM,WAAW,GAAG,EAAE,CAAA;AACtB,MAAM,WAAW,GAAG,EAAE,CAAA;AACtB,MAAM,YAAY,GAAG,CAAC,CAAA;AACtB,MAAM,cAAc,GAAG,CAAC,CAAA;AAExB,MAAM,SAAS,GAAG,gBAAgB,CAAA;AAClC,MAAM,OAAO,GAAG,cAAc,CAAA;AAC9B,MAAM,MAAM,GAAG,kBAAkB,CAAA;AACjC,MAAM,eAAe,GAAG,eAAe,CAAA;AACvC,4EAA4E;AAC5E,4EAA4E;AAC5E,0EAA0E;AAC1E,4EAA4E;AAC5E,wEAAwE;AACxE,0EAA0E;AAC1E,8BAA8B;AAC9B,wDAAwD;AACxD,MAAM,aAAa,GAAG,iCAAiC,CAAA;AAEvD,MAAM,oBAAoB,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAA;AAE1D,SAAS,cAAc,CAAC,KAAa;IACnC,OAAO,KAAK,KAAK,MAAM,IAAI,KAAK,KAAK,MAAM,IAAI,KAAK,KAAK,KAAK,CAAA;AAChE,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,uBAAuB,CAAC,KAAa;IACnD,OAAO,CACL,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,SAAS,IAAI,KAAK,IAAI,SAAS,IAAI,KAAK,GAAG,UAAU,KAAK,CAAC,CAChG,CAAA;AACH,CAAC;AAED,SAAS,UAAU,CAAC,KAAa;IAC/B,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IAC7C,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAA;IACvB,OAAO,uBAAuB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;AAC9C,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,yBAAyB,CAAC,OAAe;IACvD,OAAO,CACL,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC;QACzB,OAAO,IAAI,WAAW;QACtB,OAAO,IAAI,WAAW;QACtB,OAAO,GAAG,YAAY,KAAK,CAAC,CAC7B,CAAA;AACH,CAAC;AAED,SAAS,YAAY,CAAC,KAAa;IACjC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IAC7C,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAA;IACvB,OAAO,yBAAyB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;AAChD,CAAC;AAED,SAAS,cAAc,CAAC,KAAa;IACnC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IAC3C,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAA;IACvB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;AACpC,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,eAAe,CAAC,CAAS,EAAE,CAAS,EAAE,CAAS,EAAE,CAAS;IACxE,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;QAC7B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,OAAO,KAAK,CAAA;IACzD,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAA;IAClC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAA;IACxC,OAAO,IAAI,CAAA;AACb,CAAC;AAED,SAAS,SAAS,CAAC,KAAa;IAC9B,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAC9B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IACnC,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,cAAc,CAAC,CAAA;IACtC,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC;QAAE,OAAO,IAAI,CAAA;IAC7C,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,GAAG,IAAgB,CAAA;IACrC,IAAI,CAAC,eAAe,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QAAE,OAAO,IAAI,CAAA;IAC7C,OAAO,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAA;AACvB,CAAC;AAED,SAAS,eAAe,CAAC,CAAS;IAChC,OAAO,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,CAAA;AAClC,CAAC;AAED,SAAS,GAAG,CAAC,KAAa;IACxB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAA;AAC7B,CAAC;AAED;;;;GAIG;AACH,SAAS,qBAAqB,CAC5B,GAAW;IAEX,IAAI,GAAG,KAAK,4BAA4B,EAAE,CAAC;QACzC,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,CAAA;IACrD,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrB,OAAO,GAAG,CAAC,kBAAkB,CAAC,CAAA;IAChC,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAA;IAC9B,IAAI,KAAyB,CAAA;IAC7B,IAAI,MAAgC,CAAA;IACpC,IAAI,OAA2B,CAAA;IAC/B,IAAI,IAA0B,CAAA;IAE9B,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QAClC,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QAC/B,0EAA0E;QAC1E,wEAAwE;QACxE,qEAAqE;QACrE,IAAI,KAAK,IAAI,CAAC,IAAI,KAAK,KAAK,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC5C,OAAO,GAAG,CAAC,yBAAyB,IAAI,GAAG,CAAC,CAAA;QAC9C,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAA;QAChC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAA;QAEnC,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACnC,OAAO,GAAG,CAAC,2BAA2B,GAAG,GAAG,CAAC,CAAA;QAC/C,CAAC;QACD,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAClB,OAAO,GAAG,CAAC,6BAA6B,GAAG,GAAG,CAAC,CAAA;QACjD,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QAEb,QAAQ,GAAG,EAAE,CAAC;YACZ,KAAK,GAAG,CAAC,CAAC,CAAC;gBACT,MAAM,CAAC,GAAG,UAAU,CAAC,KAAK,CAAC,CAAA;gBAC3B,IAAI,CAAC,KAAK,IAAI;oBAAE,OAAO,GAAG,CAAC,mBAAmB,KAAK,GAAG,CAAC,CAAA;gBACvD,KAAK,GAAG,CAAC,CAAA;gBACT,MAAK;YACP,CAAC;YACD,KAAK,GAAG,CAAC,CAAC,CAAC;gBACT,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC;oBAAE,OAAO,GAAG,CAAC,oBAAoB,KAAK,GAAG,CAAC,CAAA;gBACpE,MAAM,GAAG,KAAK,CAAA;gBACd,MAAK;YACP,CAAC;YACD,KAAK,GAAG,CAAC,CAAC,CAAC;gBACT,MAAM,CAAC,GAAG,YAAY,CAAC,KAAK,CAAC,CAAA;gBAC7B,IAAI,CAAC,KAAK,IAAI;oBAAE,OAAO,GAAG,CAAC,qBAAqB,KAAK,GAAG,CAAC,CAAA;gBACzD,OAAO,GAAG,CAAC,CAAA;gBACX,MAAK;YACP,CAAC;YACD,KAAK,GAAG,CAAC,CAAC,CAAC;gBACT,MAAM,CAAC,GAAG,SAAS,CAAC,KAAK,CAAC,CAAA;gBAC1B,IAAI,CAAC,CAAC;oBAAE,OAAO,GAAG,CAAC,kBAAkB,KAAK,GAAG,CAAC,CAAA;gBAC9C,IAAI,GAAG,CAAC,CAAA;gBACR,MAAK;YACP,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,CAAA;AACpF,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,QAA2B;IAC5D,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,GAAG,CAAC,8DAA8D,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAA;IAC7F,CAAC;IACD,MAAM,CAAC,aAAa,EAAE,MAAM,EAAE,OAAO,CAAC,GAAG,QAAQ,CAAA;IAEjD,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QAC5B,OAAO,GAAG,CAAC,oBAAoB,MAAM,GAAG,CAAC,CAAA;IAC3C,CAAC;IAED,MAAM,OAAO,GAAG,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,CAAA;IACxC,IAAI,OAAO,IAAI,CAAC,IAAI,OAAO,KAAK,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACnD,OAAO,GAAG,CAAC,8BAA8B,OAAO,GAAG,CAAC,CAAA;IACtD,CAAC;IACD,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,CAAA;IACtC,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC,CAAA;IACtC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACxB,OAAO,GAAG,CAAC,kBAAkB,IAAI,GAAG,CAAC,CAAA;IACvC,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACtB,OAAO,GAAG,CAAC,iBAAiB,GAAG,GAAG,CAAC,CAAA;IACrC,CAAC;IAED,MAAM,gBAAgB,GAAG,qBAAqB,CAAC,aAAa,CAAC,CAAA;IAC7D,IAAI,CAAC,gBAAgB,CAAC,EAAE,EAAE,CAAC;QACzB,OAAO,gBAAgB,CAAA;IACzB,CAAC;IAED,MAAM,EAAE,UAAU,EAAE,GAAG,gBAAgB,CAAA;IACvC,IAAI,CAAC,UAAU,CAAC,QAAQ,IAAI,UAAU,CAAC,MAAM,KAAK,SAAS,IAAI,UAAU,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QACzF,OAAO,GAAG,CAAC,cAAc,GAAG,4BAA4B,UAAU,CAAC,MAAM,GAAG,CAAC,CAAA;IAC/E,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,CAAA;AACpD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,UAA+B;IAC9D,IAAI,UAAU,CAAC,QAAQ,EAAE,CAAC;QACxB,OAAO,4BAA4B,CAAA;IACrC,CAAC;IAED,MAAM,KAAK,GAAa,EAAE,CAAA;IAC1B,IAAI,UAAU,CAAC,IAAI,EAAE,CAAC;QACpB,MAAM,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,GAAG,UAAU,CAAC,IAAI,CAAA;QACtC,KAAK,CAAC,IAAI,CACR,KAAK,eAAe,CAAC,CAAC,CAAC,IAAI,eAAe,CAAC,CAAC,CAAC,IAAI,eAAe,CAAC,CAAC,CAAC,IAAI,eAAe,CAAC,CAAC,CAAC,EAAE,CAC5F,CAAA;IACH,CAAC;IACD,IAAI,UAAU,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QACpC,KAAK,CAAC,IAAI,CAAC,KAAK,UAAU,CAAC,MAAM,EAAE,CAAC,CAAA;IACtC,CAAC;IACD,IAAI,UAAU,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QACrC,KAAK,CAAC,IAAI,CAAC,KAAK,UAAU,CAAC,OAAO,EAAE,CAAC,CAAA;IACvC,CAAC;IACD,IAAI,UAAU,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QACnC,KAAK,CAAC,IAAI,CAAC,KAAK,UAAU,CAAC,KAAK,EAAE,CAAC,CAAA;IACrC,CAAC;IAED,sEAAsE;IACtE,mEAAmE;IACnE,0EAA0E;IAC1E,yEAAyE;IACzE,4BAA4B;IAC5B,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,4BAA4B,CAAA;AAC1E,CAAC"}

package/dist/assets/transform.d.ts

@@ -0,0 +1,51 @@
+/**
+ * The shared transform engine: applies a parsed `TransformDirectives` to
+ * source image bytes with sharp. Server-only - never import this from
+ * client/editor code (this is why it lives in its own file, separate from
+ * the dependency-free transform-directives.ts). Used by the dev-mode lazy
+ * `/assets/t/*` emulation in api/assets.ts today, and will be reused
+ * unchanged by the prod transform Lambda (PR 7).
+ *
+ * Pipeline: a cheap metadata-only probe (`limitInputPixels: MAX_INPUT_PIXELS`,
+ * decompression-bomb defense #1) learns the real page count, so animated
+ * GIF/WebP frames can be capped at `MAX_ANIMATED_FRAMES` (decompression-bomb
+ * defense #2) without exceeding it and making sharp throw -> load for real
+ * with `{ pages: min(totalPages, MAX_ANIMATED_FRAMES), limitInputPixels }` ->
+ * `.rotate()` with no args (bakes EXIF orientation into pixels,
+ * dropping the orientation tag) -> optional crop via `.extract()` -> optional
+ * `.resize({ width, withoutEnlargement: true })` (never upscales) -> encode.
+ *
+ * Identity (`orig`) and any request that omits an explicit `f=` format
+ * re-encode through the SOURCE format rather than a fixed one: this is what
+ * guarantees EXIF/GPS gets stripped even when no other change is requested
+ * (sharp strips metadata by default on re-encode - `withMetadata()` is never
+ * called here, which would undo that).
+ *
+ * GIF has no EXIF segment (EXIF is a JPEG/TIFF APP1 marker; GIF has no such
+ * extension block), so an identity GIF has nothing to strip - it is still
+ * re-encoded through sharp's `.gif()` (verified: current sharp bundles cgif
+ * and re-encodes multi-frame GIFs through the `{ animated: true }` input
+ * path with no extra native dependency) purely for pipeline uniformity, not
+ * because GIF needs stripping.
+ */
+import { type TransformDirectives } from './transform-directives';
+export interface ApplyTransformInput {
+    data: Uint8Array;
+    /** Source extension (lowercased file-type ext, e.g. 'png' | 'jpg' | 'webp' | 'gif'). */
+    ext: string;
+}
+export interface TransformSuccess {
+    ok: true;
+    data: Uint8Array;
+    contentType: string;
+    ext: string;
+}
+export interface TransformRejection {
+    ok: false;
+    /** 400: unsupported input; 413: output too large; 422: sharp failed to process the input. */
+    status: 400 | 413 | 422;
+    error: string;
+}
+export type TransformResult = TransformSuccess | TransformRejection;
+export declare function applyTransform(input: ApplyTransformInput, directives: TransformDirectives): Promise<TransformResult>;
+//# sourceMappingURL=transform.d.ts.map

package/dist/assets/transform.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"transform.d.ts","sourceRoot":"","sources":["../../src/assets/transform.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAKH,OAAO,EAIL,KAAK,mBAAmB,EACzB,MAAM,wBAAwB,CAAA;AAyC/B,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,UAAU,CAAA;IAChB,wFAAwF;IACxF,GAAG,EAAE,MAAM,CAAA;CACZ;AAED,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,IAAI,CAAA;IACR,IAAI,EAAE,UAAU,CAAA;IAChB,WAAW,EAAE,MAAM,CAAA;IACnB,GAAG,EAAE,MAAM,CAAA;CACZ;AAED,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,KAAK,CAAA;IACT,6FAA6F;IAC7F,MAAM,EAAE,GAAG,GAAG,GAAG,GAAG,GAAG,CAAA;IACvB,KAAK,EAAE,MAAM,CAAA;CACd;AAED,MAAM,MAAM,eAAe,GAAG,gBAAgB,GAAG,kBAAkB,CAAA;AAgFnE,wBAAsB,cAAc,CAClC,KAAK,EAAE,mBAAmB,EAC1B,UAAU,EAAE,mBAAmB,GAC9B,OAAO,CAAC,eAAe,CAAC,CAwE1B"}