canopycms 0.0.67-int.90 → 0.0.67

package/dist/assets/factory.js

@@ -2,8 +2,7 @@
  * Instantiate the configured AssetStore from a site's `media` config.
  *
  * This is the one place that turns the (currently-unconsumed) `media` config
- * into a real store — see .claude/future-tasks/assets-media-system.md for why
- * this was previously dead configuration.
+ * into a real store — see .claude/future-tasks/resolved/assets-media-system.md.
  */
 import { LocalAssetStore } from './store-local.js';
 import { S3AssetStore } from './store-s3.js';

package/dist/assets/finalize.d.ts

@@ -5,6 +5,7 @@
  */
 import { type FinalizeInput, type FinalizeRejection } from './pipeline.js';
 import type { AssetMeta, AssetStore } from './types.js';
+/** @internal Exported for tests. */
 export declare function isValidStagingKey(key: string): boolean;
 export type FinalizeAssetResult = {
     ok: true;
@@ -20,10 +21,11 @@ export type FinalizeAssetResult = {
  * point for an asset's existence, so a crash between `putOriginal` and here
  * leaves only orphaned (harmless, content-addressed) blobs, never a meta
  * record pointing at a missing blob.
+ * @internal Exported for tests.
  */
 export declare function finalizeAsset(store: AssetStore, input: FinalizeInput): Promise<FinalizeAssetResult>;
 /**
- * Finalize a previously-staged upload: read the staged bytes, run
+ * Finalize a staged upload: read the staged bytes, run
  * `finalizeAsset`, and best-effort delete the staging object regardless of
  * outcome (success OR pipeline rejection - a rejected upload's staged bytes
  * are just as much litter as an accepted one's).

package/dist/assets/finalize.js

@@ -14,6 +14,7 @@ import { ASSET_PREFIXES } from './keys.js';
  * prefixes must parameterize this check if that escape hatch is ever used.
  */
 const STAGING_UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
+/** @internal Exported for tests. */
 export function isValidStagingKey(key) {
     const prefix = `${ASSET_PREFIXES.staging}/`;
     return key.startsWith(prefix) && STAGING_UUID_PATTERN.test(key.slice(prefix.length));
@@ -28,6 +29,7 @@ export function isValidStagingKey(key) {
  * point for an asset's existence, so a crash between `putOriginal` and here
  * leaves only orphaned (harmless, content-addressed) blobs, never a meta
  * record pointing at a missing blob.
+ * @internal Exported for tests.
  */
 export async function finalizeAsset(store, input) {
     const result = await runFinalizePipeline(input);
@@ -52,7 +54,7 @@ export async function finalizeAsset(store, input) {
     return { ok: true, meta };
 }
 /**
- * Finalize a previously-staged upload: read the staged bytes, run
+ * Finalize a staged upload: read the staged bytes, run
  * `finalizeAsset`, and best-effort delete the staging object regardless of
  * outcome (success OR pipeline rejection - a rejected upload's staged bytes
  * are just as much litter as an accepted one's).

package/dist/assets/index.d.ts

@@ -10,10 +10,10 @@ export { ASSET_PREFIXES, createKeyBuilders, hashBytes, metaKey, metaPrefix, orig
 export { LocalAssetStore, type LocalAssetStoreOptions } from './store-local.js';
 export { S3AssetStore, type S3AssetStoreOptions } from './store-s3.js';
 export { createAssetStore } from './factory.js';
-export { ALLOWED_UPLOAD_CONTENT_TYPES, runFinalizePipeline, type FinalizeInput, type FinalizePublicObject, type FinalizeResult, type FinalizeRejection, type FinalizeSuccess, } from './pipeline.js';
+export { ALLOWED_UPLOAD_CONTENT_TYPES, runFinalizePipeline, type FinalizeInput, type FinalizeResult, type FinalizeRejection, } from './pipeline.js';
 export { finalizeAsset, finalizeStagedUpload, type FinalizeAssetResult } from './finalize.js';
 export { sanitizeSvg } from './svg-sanitizer.js';
-export { assetSrc, IDENTITY_TRANSFORM_DIRECTIVE } from './asset-src.js';
-export { formatDirectives, isAllowedTransformWidth, isValidCropRect, parseTransformPath, type CropRect, type IdentityDirectives, type OutputFormat, type ParsedTransformPath, type ParseTransformPathResult, type ResizeDirectives, type TransformDirectives, } from './transform-directives.js';
+export { assetSrc } from './asset-src.js';
+export { formatDirectives, isAllowedTransformWidth, isValidCropRect, parseTransformPath, type CropRect, type OutputFormat, type ParsedTransformPath, type ParseTransformPathResult, type TransformDirectives, } from './transform-directives.js';
 export { applyTransform, type ApplyTransformInput, type TransformResult } from './transform.js';
 export { assetUrl, assetSrcSet, type AssetRef, type AssetUrlOptions } from './asset-url.js';

package/dist/assets/index.js

@@ -12,7 +12,7 @@ export { createAssetStore } from './factory.js';
 export { ALLOWED_UPLOAD_CONTENT_TYPES, runFinalizePipeline, } from './pipeline.js';
 export { finalizeAsset, finalizeStagedUpload } from './finalize.js';
 export { sanitizeSvg } from './svg-sanitizer.js';
-export { assetSrc, IDENTITY_TRANSFORM_DIRECTIVE } from './asset-src.js';
+export { assetSrc } from './asset-src.js';
 export { formatDirectives, isAllowedTransformWidth, isValidCropRect, parseTransformPath, } from './transform-directives.js';
 export { applyTransform } from './transform.js';
 export { assetUrl, assetSrcSet } from './asset-url.js';

package/dist/assets/keys.d.ts

@@ -3,7 +3,7 @@
  * here — keeps this file trivially unit-testable and safe to reason about for
  * path-traversal / header-injection concerns.
  *
- * Bucket-prefix layout (see .claude/future-tasks/assets-media-system.md):
+ * Bucket-prefix layout (see .claude/future-tasks/resolved/assets-media-system.md):
  *   asset-originals/{hash32}.{ext}          private; full-fidelity originals
  *   asset-staging/{uuid}                    presigned-POST target
  *   asset-meta/{hash32}.json                private; filename/uploader/dims/mime
@@ -45,11 +45,13 @@ export declare function slugifyFilename(name: string): {
  */
 export declare function createKeyBuilders(prefixes?: AssetPrefixes): {
     originalKey: (hash32: string, ext: string) => string;
-    /** Prefix used to look up an original by hash32 alone (extension unknown ahead of time). */
+    /** Prefix for looking up an original by hash32 alone (extension unknown ahead of time). */
     originalPrefix: (hash32: string) => string;
     stagingKey: (uuid: string) => string;
     metaKey: (hash32: string) => string;
     metaPrefix: () => string;
     publicKey: (hash32: string, slug: string, ext: string) => string;
 };
-export declare const originalKey: (hash32: string, ext: string) => string, originalPrefix: (hash32: string) => string, stagingKey: (uuid: string) => string, metaKey: (hash32: string) => string, metaPrefix: () => string, publicKey: (hash32: string, slug: string, ext: string) => string;
+export declare const originalKey: (hash32: string, ext: string) => string, stagingKey: (uuid: string) => string, metaKey: (hash32: string) => string, publicKey: (hash32: string, slug: string, ext: string) => string;
+/** @internal Exported for tests. */
+export declare const originalPrefix: (hash32: string) => string, metaPrefix: () => string;

package/dist/assets/keys.js

@@ -3,7 +3,7 @@
  * here — keeps this file trivially unit-testable and safe to reason about for
  * path-traversal / header-injection concerns.
  *
- * Bucket-prefix layout (see .claude/future-tasks/assets-media-system.md):
+ * Bucket-prefix layout (see .claude/future-tasks/resolved/assets-media-system.md):
  *   asset-originals/{hash32}.{ext}          private; full-fidelity originals
  *   asset-staging/{uuid}                    presigned-POST target
  *   asset-meta/{hash32}.json                private; filename/uploader/dims/mime
@@ -76,7 +76,7 @@ export function slugifyFilename(name) {
 export function createKeyBuilders(prefixes = ASSET_PREFIXES) {
     return {
         originalKey: (hash32, ext) => `${prefixes.originals}/${hash32}.${ext}`,
-        /** Prefix used to look up an original by hash32 alone (extension unknown ahead of time). */
+        /** Prefix for looking up an original by hash32 alone (extension unknown ahead of time). */
         originalPrefix: (hash32) => `${prefixes.originals}/${hash32}.`,
         stagingKey: (uuid) => `${prefixes.staging}/${uuid}`,
         metaKey: (hash32) => `${prefixes.meta}/${hash32}.json`,
@@ -84,4 +84,7 @@ export function createKeyBuilders(prefixes = ASSET_PREFIXES) {
         publicKey: (hash32, slug, ext) => `${prefixes.public}/${hash32}/${slug}.${ext}`,
     };
 }
-export const { originalKey, originalPrefix, stagingKey, metaKey, metaPrefix, publicKey } = createKeyBuilders();
+const keyBuilders = createKeyBuilders();
+export const { originalKey, stagingKey, metaKey, publicKey } = keyBuilders;
+/** @internal Exported for tests. */
+export const { originalPrefix, metaPrefix } = keyBuilders;

package/dist/assets/pipeline.d.ts

@@ -19,14 +19,14 @@ export interface FinalizeInput {
     filename: string;
     uploadedBy?: string;
 }
-export interface FinalizePublicObject {
+interface FinalizePublicObject {
     key: string;
     data: Uint8Array;
     contentType: string;
     contentDisposition: string;
     cacheControl: string;
 }
-export interface FinalizeSuccess {
+interface FinalizeSuccess {
     ok: true;
     meta: AssetMeta;
     /** Canonical bytes to persist as the original - sanitized bytes for svg, untouched otherwise. */
@@ -57,3 +57,4 @@ export type FinalizeResult = FinalizeSuccess | FinalizeRejection;
  * stricter sanitizer version) cannot desync a stored hash from its content.
  */
 export declare function runFinalizePipeline(input: FinalizeInput): Promise<FinalizeResult>;
+export {};

package/dist/assets/pipeline.js

@@ -114,67 +114,33 @@ const DECODE_CHECK_SIZE = 8;
  */
 const UNDECODABLE_RASTER_ERROR = 'This image could not be decoded - it may be corrupt or truncated. Try re-exporting it and uploading again.';
 /**
- * Force a REAL pixel decode of a raster upload, catching the defect
- * `computeDimensions` above (header-only, explicitly non-fatal) cannot: a
- * corrupt PNG IDAT / truncated JPEG scan / etc. still carries a perfectly
- * valid IHDR/SOF, so `file-type`/`image-size` both accept bytes that the
- * transform engine's real sharp/libvips decoder (transform.ts's
- * `applyTransform`) later refuses - with a raw "vipspng: libpng read error"
- * - by which point the asset has already "uploaded successfully" and renders
- * broken everywhere it's shown. This makes finalize use the same decoder
- * transform.ts does, before the bytes are ever persisted, instead of only
- * discovering the mismatch at render time.
+ * Force a real pixel decode of a raster upload: `computeDimensions` above is header-only, so
+ * a corrupt PNG IDAT / truncated JPEG scan with a valid IHDR/SOF passes it, then fails at
+ * transform.ts's real sharp/libvips decode later - "uploads fine, renders broken". This runs
+ * the same decoder before the bytes are ever persisted, not just at render time.
  *
- * `.resize()` to a tiny output - NOT `.metadata()` - is what makes this a
- * real test: `metadata()` only reads header fields, exactly what
- * `computeDimensions` above already does and exactly what fails to catch
- * this class of bug. libvips cannot compute a resized pixel buffer without
- * fully decoding the source, so a corrupt IDAT/scan still throws here even
- * though it would not throw from a header-only read. The output itself is
- * immediately discarded - decode is the expensive, unavoidable part of this
- * check; encoding an 8x8 buffer is not.
+ * `.resize()` to a tiny output, not `.metadata()`: libvips cannot compute a resized pixel
+ * buffer without fully decoding the source, so a corrupt IDAT/scan throws here even though a
+ * header-only read would not. The 8x8 output is discarded; decode is the expensive part.
  *
- * ANIMATION: sharp defaults to `pages: 1`, i.e. frame 0 only. That is not
- * enough to mirror `applyTransform`, which reads
- * `min(totalPages, MAX_ANIMATED_FRAMES)` frames - a GIF/WebP whose frame 0 is
- * clean but whose frame 3 is corrupt passed this check and then threw
- * `gifload_buffer: Invalid frame data` at transform time, which is the very
- * "accepted at upload, unrenderable at render" state this function exists to
- * prevent, just moved from single-frame to animated sources. So the page
- * count is probed and passed through, with the SAME cap constant transform.ts
- * uses (both import it from transform-directives.ts) - which also means the
- * two sides ignore the same frames past the cap, so a many-hundred-frame
- * source cannot produce a disagreement either.
+ * ANIMATION: sharp defaults to `pages: 1` (frame 0 only), which is not enough to mirror
+ * `applyTransform`, so the real page count is probed first and read as
+ * `min(totalPages, MAX_ANIMATED_FRAMES)` - the SAME cap constant transform.ts uses (both
+ * import it from transform-directives.ts), so the two decoders never disagree on which
+ * frames past the cap they ignore. The probe is required, not optional: `pages` is a fixed
+ * request, not an upper bound, and a value exceeding the source's real page count makes sharp
+ * throw "bad page number" (transform.ts documents the same constraint at its call site).
  *
- * The probe is a separate, deliberate step rather than a guess: sharp's
- * `pages` is a fixed request, not an upper bound, so a value EXCEEDING the
- * source's real page count makes it throw "bad page number" (transform.ts
- * documents the same constraint at its own call site). A metadata-only probe
- * costs effectively nothing - it is a header read, not a decode.
- *
- * `limitInputPixels: MAX_INPUT_PIXELS` reuses transform.ts's own
- * decompression-bomb cap (imported above, not redefined) so this validation
- * step cannot itself become a bomb vector on a header that lied about its
- * dimensions - in practice the pixel-count check in the caller below already
- * rejects those before this function is ever reached, but the cap is cheap
- * insurance against relying on that ordering. Note the caller's check reads
- * single-frame dimensions from `image-size`, so for animated sources it is
- * `limitInputPixels` here (which sees the full multi-page strip) that bounds
- * total decoded pixels - exactly as it does in transform.ts.
+ * `limitInputPixels: MAX_INPUT_PIXELS` reuses transform.ts's own decompression-bomb cap so
+ * this validation step cannot itself become a bomb vector. The caller's own pixel-count check
+ * (below) already rejects oversized single-frame dims from `image-size` before this runs, but
+ * for animated sources only this multi-page `limitInputPixels` bounds total decoded pixels.
  *
  * Fails OPEN vs. fails CLOSED, deliberately different failure modes:
- * - sharp itself cannot be loaded (native binary missing for this
- *   platform/architecture, e.g. a cross-arch build) - there is no decoder
- *   available in this environment at all, which is an environment problem,
- *   not a fact about the uploaded file. Log it and let the upload through
- *   unvalidated (the pre-fix behavior) rather than failing every raster
- *   upload because of a deployment issue.
- * - sharp loads fine but its decoder REJECTS the bytes - that IS a fact
- *   about this specific file, and an actionable one. Return false so the
- *   caller rejects the upload. A throw from the page-count probe counts as
- *   this case, not the one above: the module loaded, so an unreadable header
- *   is again a fact about the file, and `applyTransform` would reject the
- *   same bytes from its own probe with the same 422.
+ * - sharp cannot be loaded at all (missing/wrong-arch native binary) - an environment
+ *   problem, not a fact about the file. Log it and let the upload through unvalidated.
+ * - sharp loads but its decoder REJECTS the bytes (including a page-count-probe throw) -
+ *   that IS a fact about this file. Return false so the caller rejects the upload.
  */
 async function rasterIsDecodable(data) {
     // `loadSharp()` has already logged the load failure once for the process;

package/dist/assets/sharp-loader.d.ts

@@ -6,16 +6,8 @@
  *
  * Why lazily. sharp is a native addon, and loading it dlopens libvips. A
  * static `import sharp from 'sharp'` makes importing the MODULE GRAPH load
- * libvips. With sharp external, as in an adopter's Next 16 standalone build,
- * Turbopack wraps it in an async module that awaits the load when the graph is
- * evaluated (cms-image-build-epic.md in `.claude/future-tasks/`, "Every route
- * loads sharp"). transform.ts is reachable from `canopycms/server` and, through
- * api/assets.ts, from `canopycms/http` and so from `canopycms-next`, which a
- * host app's root layout can import (that adopter's did). When the libvips
- * `.so` was missing from its standalone output, that one static import turned
- * it into a 500 on every on-demand route, 404s included, and defeated
- * pipeline.ts's deliberate fail-open. Loaded on first use, a missing binary
- * affects only the image operations that need it.
+ * libvips. Loaded on first use, a missing binary affects only the image
+ * operations that need it.
  *
  * Memoized INCLUDING a rejection: a failed dlopen does not heal inside a
  * running process, so a retry would only pay for the failure again and log

package/dist/assets/sharp-loader.js

@@ -6,16 +6,8 @@
  *
  * Why lazily. sharp is a native addon, and loading it dlopens libvips. A
  * static `import sharp from 'sharp'` makes importing the MODULE GRAPH load
- * libvips. With sharp external, as in an adopter's Next 16 standalone build,
- * Turbopack wraps it in an async module that awaits the load when the graph is
- * evaluated (cms-image-build-epic.md in `.claude/future-tasks/`, "Every route
- * loads sharp"). transform.ts is reachable from `canopycms/server` and, through
- * api/assets.ts, from `canopycms/http` and so from `canopycms-next`, which a
- * host app's root layout can import (that adopter's did). When the libvips
- * `.so` was missing from its standalone output, that one static import turned
- * it into a 500 on every on-demand route, 404s included, and defeated
- * pipeline.ts's deliberate fail-open. Loaded on first use, a missing binary
- * affects only the image operations that need it.
+ * libvips. Loaded on first use, a missing binary affects only the image
+ * operations that need it.
  *
  * Memoized INCLUDING a rejection: a failed dlopen does not heal inside a
  * running process, so a retry would only pay for the failure again and log

package/dist/assets/store-local.d.ts

@@ -17,8 +17,7 @@ export declare class LocalAssetStore implements AssetStore {
     /**
      * Resolve a store key to an absolute filesystem path, guarding against
      * escape from the root. Keys are internally generated (never taken
-     * verbatim from user input), but this guard is kept as defense-in-depth
-     * (ported from the v1 LocalAssetStore).
+     * verbatim from user input), but this guard is kept as defense-in-depth.
      *
      * A naive `resolved.startsWith(root)` check would let a sibling directory
      * that merely shares the root's name as a prefix (e.g. root `.../assets`,

package/dist/assets/store-local.js

@@ -21,8 +21,7 @@ export class LocalAssetStore {
     /**
      * Resolve a store key to an absolute filesystem path, guarding against
      * escape from the root. Keys are internally generated (never taken
-     * verbatim from user input), but this guard is kept as defense-in-depth
-     * (ported from the v1 LocalAssetStore).
+     * verbatim from user input), but this guard is kept as defense-in-depth.
      *
      * A naive `resolved.startsWith(root)` check would let a sibling directory
      * that merely shares the root's name as a prefix (e.g. root `.../assets`,

package/dist/assets/store-s3.d.ts

@@ -16,10 +16,9 @@ export interface S3AssetStoreOptions {
      * returns. Absolute http(s) URL or a site-relative path. See `mediaSchema`'s s3 branch for
      * what this is for; see `isHttpUrlOrSameOriginPath` for what is accepted.
      *
-     * This is NOT the `publicBaseUrl` that used to live on this interface and was deleted for
-     * looking like the store emitted prefixed URLs. Nothing is joined onto this value and it is
-     * never rendered or stored — it is the endpoint the browser posts to, and it is returned to
-     * the client inside the presign response rather than in the client config.
+     * Not a public base URL: nothing is joined onto it and it is never rendered or stored -
+     * it is the endpoint the browser posts to, returned to the client inside the presign
+     * response rather than in the client config.
      */
     uploadUrl?: string;
     /** Override the default bucket-prefix layout (rarely needed). */

package/dist/assets/svg-sanitizer.d.ts

@@ -1,20 +1,12 @@
 /**
  * SVG sanitization. Server-only - never import from client/editor code.
  *
- * Sanitizer choice: the design record (.claude/future-tasks/assets-media-system.md)
- * suggested `dompurify` + a lightweight DOM shim (e.g. `linkedom`) in place of the
- * heavier `jsdom`. In practice that pairing is unsafe: DOMPurify's own README warns
- * that immature DOM shims can cause it to fail in ways that produce an XSS hole even
- * when DOMPurify itself behaves correctly, and that is exactly what was reproduced
- * here - `createDOMPurify(linkedomWindow).sanitize(dirtySvg)` returned the INPUT
- * UNCHANGED (a `<script>`, `onload=`, and `<foreignObject>` all survived), because
- * linkedom's window has no `NodeFilter` global and DOMPurify silently no-ops when it
- * doesn't recognize the environment as supported. That is a dangerous failure mode
- * for a security boundary, so this module uses `sanitize-html` instead: it works
- * directly on the parser tree (htmlparser2, no DOM shim to be incomplete), is
- * actively maintained, and - verified empirically - correctly strips scripts, event
- * handler attributes, and `foreignObject` while preserving a valid, still-parseable
- * SVG document.
+ * Sanitizer choice: `dompurify` + a DOM shim (e.g. `linkedom`) is unsafe here - DOMPurify
+ * silently returns its input unchanged when the DOM shim lacks globals it expects (linkedom
+ * has no `NodeFilter`), producing an XSS hole with no error raised. This module uses
+ * `sanitize-html` instead: it works directly on the parser tree (htmlparser2, no DOM shim to
+ * be incomplete) and strips scripts, event handler attributes, and `foreignObject` while
+ * preserving a valid, still-parseable SVG document.
  *
  * Allowlist-based (not blocklist): only elements/attributes known to be safe survive.
  * `href`/`xlink:href` are further restricted to local fragment references (`#...`) so

package/dist/assets/svg-sanitizer.js

@@ -1,20 +1,12 @@
 /**
  * SVG sanitization. Server-only - never import from client/editor code.
  *
- * Sanitizer choice: the design record (.claude/future-tasks/assets-media-system.md)
- * suggested `dompurify` + a lightweight DOM shim (e.g. `linkedom`) in place of the
- * heavier `jsdom`. In practice that pairing is unsafe: DOMPurify's own README warns
- * that immature DOM shims can cause it to fail in ways that produce an XSS hole even
- * when DOMPurify itself behaves correctly, and that is exactly what was reproduced
- * here - `createDOMPurify(linkedomWindow).sanitize(dirtySvg)` returned the INPUT
- * UNCHANGED (a `<script>`, `onload=`, and `<foreignObject>` all survived), because
- * linkedom's window has no `NodeFilter` global and DOMPurify silently no-ops when it
- * doesn't recognize the environment as supported. That is a dangerous failure mode
- * for a security boundary, so this module uses `sanitize-html` instead: it works
- * directly on the parser tree (htmlparser2, no DOM shim to be incomplete), is
- * actively maintained, and - verified empirically - correctly strips scripts, event
- * handler attributes, and `foreignObject` while preserving a valid, still-parseable
- * SVG document.
+ * Sanitizer choice: `dompurify` + a DOM shim (e.g. `linkedom`) is unsafe here - DOMPurify
+ * silently returns its input unchanged when the DOM shim lacks globals it expects (linkedom
+ * has no `NodeFilter`), producing an XSS hole with no error raised. This module uses
+ * `sanitize-html` instead: it works directly on the parser tree (htmlparser2, no DOM shim to
+ * be incomplete) and strips scripts, event handler attributes, and `foreignObject` while
+ * preserving a valid, still-parseable SVG document.
  *
  * Allowlist-based (not blocklist): only elements/attributes known to be safe survive.
  * `href`/`xlink:href` are further restricted to local fragment references (`#...`) so

package/dist/assets/transform-directives.d.ts

@@ -32,11 +32,11 @@ export interface CropRect {
     readonly h: number;
 }
 /** Identity ('orig'): EXIF-strip only, no resize/format/quality change. */
-export interface IdentityDirectives {
+interface IdentityDirectives {
     readonly identity: true;
 }
 /** Non-identity directive set - every field optional, but at least one is present. */
-export interface ResizeDirectives {
+interface ResizeDirectives {
     readonly identity: false;
     readonly width?: number;
     readonly format?: OutputFormat;
@@ -89,8 +89,6 @@ export declare const MAX_INPUT_PIXELS: number;
 export declare const MAX_ANIMATED_FRAMES = 60;
 /** True if `width` is on the allowlist: a multiple of 160 in [160, 4096]. */
 export declare function isAllowedTransformWidth(width: number): boolean;
-/** True if `quality` is on the allowlist: a multiple of 5 in [30, 95]. */
-export declare function isAllowedTransformQuality(quality: number): boolean;
 /**
  * True when x, y, w, h describe a valid normalized crop rect: all four values
  * finite and in [0,1], w and h strictly positive, and the rect fits within
@@ -112,3 +110,4 @@ export declare function parseTransformPath(segments: readonly string[]): ParseTr
  * cache key. Order is fixed alphabetically by key: c, f, q, w.
  */
 export declare function formatDirectives(directives: TransformDirectives): string;
+export {};

package/dist/assets/transform-directives.js

@@ -96,7 +96,7 @@ function parseWidth(value) {
     return isAllowedTransformWidth(n) ? n : null;
 }
 /** True if `quality` is on the allowlist: a multiple of 5 in [30, 95]. */
-export function isAllowedTransformQuality(quality) {
+function isAllowedTransformQuality(quality) {
     return (Number.isInteger(quality) &&
         quality >= MIN_QUALITY &&
         quality <= MAX_QUALITY &&

package/dist/assets/transform.d.ts

@@ -1,38 +1,25 @@
 /**
- * The shared transform engine: applies a parsed `TransformDirectives` to
- * source image bytes with sharp. Server-only - never import this from
- * client/editor code (this is why it lives in its own file, separate from
- * the dependency-free transform-directives.ts). Used by the dev-mode lazy
- * `/assets/t/*` emulation in api/assets.ts and, unchanged, by the prod
- * transform Lambda (packages/canopycms-cdk/lambda/asset-transform).
+ * The shared transform engine: applies a parsed `TransformDirectives` to source image bytes
+ * with sharp. Server-only - never import this from client/editor code (kept in its own file,
+ * separate from the dependency-free transform-directives.ts). Used by the dev-mode lazy
+ * `/assets/t/*` emulation in api/assets.ts and, unchanged, by the prod transform Lambda
+ * (packages/canopycms-cdk/lambda/asset-transform).
  *
- * sharp is imported for its TYPES only and loaded on first use through
- * `loadSharp()` (sharp-loader.ts), so importing this module never loads
- * libvips. That matters because this module sits in the import graph of
- * `canopycms/server` and `canopycms/http`: see sharp-loader.ts for the
- * adopter outage a static import caused, and eslint.config.mjs for the rule
- * that keeps it from coming back.
+ * sharp is imported for its TYPES only and loaded on first use through `loadSharp()`
+ * (sharp-loader.ts), so importing this module never loads libvips - see sharp-loader.ts for
+ * why, and eslint.config.mjs for the rule that keeps a static import from coming back.
  *
- * Pipeline: a cheap metadata-only probe (`limitInputPixels: MAX_INPUT_PIXELS`,
- * decompression-bomb defense #1) learns the real page count, so animated
- * GIF/WebP frames can be capped at `MAX_ANIMATED_FRAMES` (decompression-bomb
- * defense #2) without exceeding it and making sharp throw -> load for real
- * with `{ pages: min(totalPages, MAX_ANIMATED_FRAMES), limitInputPixels }` ->
- * `.rotate()` with no args (bakes EXIF orientation into pixels,
- * dropping the orientation tag) -> optional crop via `.extract()` -> optional
- * `.resize({ width, withoutEnlargement: true })` (never upscales) -> encode.
+ * Pipeline: metadata probe learns the page count (decompression-bomb defenses #1/#2) -> real
+ * load capped at `min(totalPages, MAX_ANIMATED_FRAMES)` -> `.rotate()` (bakes EXIF orientation
+ * into pixels) -> optional crop/resize (never upscales) -> encode.
  *
- * Identity (`orig`) and any request that omits an explicit `f=` format
- * re-encode through the SOURCE format rather than a fixed one: this is what
- * guarantees EXIF/GPS gets stripped even when no other change is requested
- * (sharp strips metadata by default on re-encode - `withMetadata()` is never
- * called here, which would undo that).
+ * Identity (`orig`) and any request that omits an explicit `f=` format re-encode through the
+ * SOURCE format rather than a fixed one: this is what guarantees EXIF/GPS gets stripped even
+ * when no other change is requested (sharp strips metadata by default on re-encode -
+ * `withMetadata()` is never called here, which would undo that).
  *
- * GIF has no EXIF segment (EXIF is a JPEG/TIFF APP1 marker; GIF has no such
- * extension block), so an identity GIF has nothing to strip - it is still
- * re-encoded through sharp's `.gif()` (verified: current sharp bundles cgif
- * and re-encodes multi-frame GIFs through the `{ animated: true }` input
- * path with no extra native dependency) purely for pipeline uniformity, not
+ * GIF has no EXIF segment (EXIF is a JPEG/TIFF APP1 marker), so an identity GIF has nothing to
+ * strip - it is still re-encoded through sharp's `.gif()` purely for pipeline uniformity, not
  * because GIF needs stripping.
  */
 import { type TransformDirectives } from './transform-directives.js';
@@ -41,12 +28,14 @@ export interface ApplyTransformInput {
     /** Source extension (lowercased file-type ext, e.g. 'png' | 'jpg' | 'webp' | 'gif'). */
     ext: string;
 }
+/** @internal Exported for tests. */
 export interface TransformSuccess {
     ok: true;
     data: Uint8Array;
     contentType: string;
     ext: string;
 }
+/** @internal Exported for tests. */
 export interface TransformRejection {
     ok: false;
     /** 400: unsupported input; 413: output too large; 422: sharp failed to process the input. */

package/dist/assets/transform.js

@@ -1,38 +1,25 @@
 /**
- * The shared transform engine: applies a parsed `TransformDirectives` to
- * source image bytes with sharp. Server-only - never import this from
- * client/editor code (this is why it lives in its own file, separate from
- * the dependency-free transform-directives.ts). Used by the dev-mode lazy
- * `/assets/t/*` emulation in api/assets.ts and, unchanged, by the prod
- * transform Lambda (packages/canopycms-cdk/lambda/asset-transform).
+ * The shared transform engine: applies a parsed `TransformDirectives` to source image bytes
+ * with sharp. Server-only - never import this from client/editor code (kept in its own file,
+ * separate from the dependency-free transform-directives.ts). Used by the dev-mode lazy
+ * `/assets/t/*` emulation in api/assets.ts and, unchanged, by the prod transform Lambda
+ * (packages/canopycms-cdk/lambda/asset-transform).
  *
- * sharp is imported for its TYPES only and loaded on first use through
- * `loadSharp()` (sharp-loader.ts), so importing this module never loads
- * libvips. That matters because this module sits in the import graph of
- * `canopycms/server` and `canopycms/http`: see sharp-loader.ts for the
- * adopter outage a static import caused, and eslint.config.mjs for the rule
- * that keeps it from coming back.
+ * sharp is imported for its TYPES only and loaded on first use through `loadSharp()`
+ * (sharp-loader.ts), so importing this module never loads libvips - see sharp-loader.ts for
+ * why, and eslint.config.mjs for the rule that keeps a static import from coming back.
  *
- * Pipeline: a cheap metadata-only probe (`limitInputPixels: MAX_INPUT_PIXELS`,
- * decompression-bomb defense #1) learns the real page count, so animated
- * GIF/WebP frames can be capped at `MAX_ANIMATED_FRAMES` (decompression-bomb
- * defense #2) without exceeding it and making sharp throw -> load for real
- * with `{ pages: min(totalPages, MAX_ANIMATED_FRAMES), limitInputPixels }` ->
- * `.rotate()` with no args (bakes EXIF orientation into pixels,
- * dropping the orientation tag) -> optional crop via `.extract()` -> optional
- * `.resize({ width, withoutEnlargement: true })` (never upscales) -> encode.
+ * Pipeline: metadata probe learns the page count (decompression-bomb defenses #1/#2) -> real
+ * load capped at `min(totalPages, MAX_ANIMATED_FRAMES)` -> `.rotate()` (bakes EXIF orientation
+ * into pixels) -> optional crop/resize (never upscales) -> encode.
  *
- * Identity (`orig`) and any request that omits an explicit `f=` format
- * re-encode through the SOURCE format rather than a fixed one: this is what
- * guarantees EXIF/GPS gets stripped even when no other change is requested
- * (sharp strips metadata by default on re-encode - `withMetadata()` is never
- * called here, which would undo that).
+ * Identity (`orig`) and any request that omits an explicit `f=` format re-encode through the
+ * SOURCE format rather than a fixed one: this is what guarantees EXIF/GPS gets stripped even
+ * when no other change is requested (sharp strips metadata by default on re-encode -
+ * `withMetadata()` is never called here, which would undo that).
  *
- * GIF has no EXIF segment (EXIF is a JPEG/TIFF APP1 marker; GIF has no such
- * extension block), so an identity GIF has nothing to strip - it is still
- * re-encoded through sharp's `.gif()` (verified: current sharp bundles cgif
- * and re-encodes multi-frame GIFs through the `{ animated: true }` input
- * path with no extra native dependency) purely for pipeline uniformity, not
+ * GIF has no EXIF segment (EXIF is a JPEG/TIFF APP1 marker), so an identity GIF has nothing to
+ * strip - it is still re-encoded through sharp's `.gif()` purely for pipeline uniformity, not
  * because GIF needs stripping.
  */
 import { getErrorMessage } from '../utils/error.js';
@@ -109,7 +96,7 @@ function encode(pipeline, format, quality) {
 }
 /**
  * Re-encode through the source container format - used for identity and for
- * requests that omit `f=`. `quality` (C3) is honoured here exactly like
+ * requests that omit `f=`. `quality` is honoured here exactly like
  * `encode()` does for an explicit `f=`, so a `q=` directive without `f=` is
  * never silently dropped - the cache key (`formatDirectives` in
  * transform-directives.ts) already includes `q=` unconditionally, so the

package/dist/auth/cache.d.ts

@@ -1,7 +1,6 @@
 /**
- * Server-only auth cache exports.
- * These use node:fs/promises and must NOT be imported in client bundles.
- * Use 'canopycms/auth/cache' as the import path.
+ * Server-only: these use node:fs/promises and must NOT reach a client bundle.
+ * Import them as 'canopycms/auth/cache'.
  */
 export { FileBasedAuthCache, writeAuthCacheSnapshot } from './file-based-auth-cache.js';
 export { CachingAuthPlugin } from './caching-auth-plugin.js';

package/dist/auth/cache.js

@@ -1,7 +1,6 @@
 /**
- * Server-only auth cache exports.
- * These use node:fs/promises and must NOT be imported in client bundles.
- * Use 'canopycms/auth/cache' as the import path.
+ * Server-only: these use node:fs/promises and must NOT reach a client bundle.
+ * Import them as 'canopycms/auth/cache'.
  */
 export { FileBasedAuthCache, writeAuthCacheSnapshot } from './file-based-auth-cache.js';
 export { CachingAuthPlugin } from './caching-auth-plugin.js';