parasor 0.1.0

package/server/fonts/installer.js

@@ -0,0 +1,201 @@
+import { createWriteStream } from "node:fs";
+import { mkdir, rename, rm, stat } from "node:fs/promises";
+import { homedir } from "node:os";
+import { dirname, join } from "node:path";
+import { Readable } from "node:stream";
+import { pipeline } from "node:stream/promises";
+import yauzl from "yauzl";
+export class FontInstallError extends Error {
+    kind;
+    constructor(message, kind) {
+        super(message);
+        this.kind = kind;
+    }
+}
+export function defaultCacheDir() {
+    const base = process.env.XDG_CACHE_HOME ?? join(homedir(), ".cache");
+    return join(base, "parasor", "fonts");
+}
+export class FontInstaller {
+    cacheDir;
+    fetchImpl;
+    inflight = new Map();
+    constructor(opts = {}) {
+        this.cacheDir = opts.cacheDir ?? defaultCacheDir();
+        this.fetchImpl = opts.fetchImpl ?? fetch;
+    }
+    getCacheDir() {
+        return this.cacheDir;
+    }
+    /**
+     * Path of the cached TTF if already installed, otherwise null. Used by the
+     * static serving route to short-circuit without touching the installer.
+     */
+    async resolveInstalled(id) {
+        const dir = join(this.cacheDir, id);
+        const ttfPath = join(dir, "font.ttf");
+        try {
+            const st = await stat(ttfPath);
+            if (!st.isFile() || st.size === 0)
+                return null;
+        }
+        catch {
+            return null;
+        }
+        try {
+            const familyFile = join(dir, "family.txt");
+            const { readFile } = await import("node:fs/promises");
+            const family = (await readFile(familyFile, "utf-8")).trim();
+            if (!family)
+                return null;
+            return { filePath: ttfPath, family };
+        }
+        catch {
+            return null;
+        }
+    }
+    async listInstalled() {
+        const { readdir } = await import("node:fs/promises");
+        try {
+            const entries = await readdir(this.cacheDir, { withFileTypes: true });
+            const installed = [];
+            for (const entry of entries) {
+                if (!entry.isDirectory())
+                    continue;
+                const resolved = await this.resolveInstalled(entry.name);
+                if (resolved)
+                    installed.push(entry.name);
+            }
+            return installed;
+        }
+        catch {
+            return [];
+        }
+    }
+    /**
+     * Install a preset. Concurrent calls for the same id share a single
+     * download -- the second caller awaits the first rather than kicking off a
+     * duplicate 700MB fetch.
+     */
+    async install(preset) {
+        const existing = this.inflight.get(preset.id);
+        if (existing)
+            return existing;
+        const promise = this.doInstall(preset).finally(() => {
+            this.inflight.delete(preset.id);
+        });
+        this.inflight.set(preset.id, promise);
+        return promise;
+    }
+    async doInstall(preset) {
+        const resolved = await this.resolveInstalled(preset.id);
+        if (resolved) {
+            return {
+                id: preset.id,
+                family: resolved.family,
+                filename: "font.ttf",
+                filePath: resolved.filePath,
+            };
+        }
+        const targetDir = join(this.cacheDir, preset.id);
+        await mkdir(targetDir, { recursive: true });
+        const zipPath = join(targetDir, "download.zip.tmp");
+        const ttfTmpPath = join(targetDir, "font.ttf.tmp");
+        const ttfPath = join(targetDir, "font.ttf");
+        const familyPath = join(targetDir, "family.txt");
+        try {
+            await this.downloadTo(preset.zipUrl, zipPath);
+            await this.extractRegularTtf(zipPath, preset.regularMatch, ttfTmpPath);
+            await rename(ttfTmpPath, ttfPath);
+            const { writeFile } = await import("node:fs/promises");
+            await writeFile(familyPath, preset.family, "utf-8");
+            return {
+                id: preset.id,
+                family: preset.family,
+                filename: "font.ttf",
+                filePath: ttfPath,
+            };
+        }
+        finally {
+            // Best-effort cleanup of temp artifacts.
+            await rm(zipPath, { force: true });
+            await rm(ttfTmpPath, { force: true });
+        }
+    }
+    async downloadTo(url, destPath) {
+        await mkdir(dirname(destPath), { recursive: true });
+        let response;
+        try {
+            response = await this.fetchImpl(url, { redirect: "follow" });
+        }
+        catch (error) {
+            throw new FontInstallError(`download failed: ${error.message}`, "download_failed");
+        }
+        if (!response.ok || !response.body) {
+            throw new FontInstallError(`download returned ${response.status}`, "download_failed");
+        }
+        try {
+            // response.body is a web-stream ReadableStream; Readable.fromWeb bridges
+            // it into a Node stream that pipeline() can consume.
+            const nodeStream = Readable.fromWeb(response.body);
+            await pipeline(nodeStream, createWriteStream(destPath));
+        }
+        catch (error) {
+            throw new FontInstallError(`write failed: ${error.message}`, "io_failed");
+        }
+    }
+    extractRegularTtf(zipPath, matchSubstring, destPath) {
+        const matchLower = matchSubstring.toLowerCase();
+        return new Promise((resolve, reject) => {
+            yauzl.open(zipPath, { lazyEntries: true }, (err, zipfile) => {
+                if (err || !zipfile) {
+                    reject(new FontInstallError(`zip open failed: ${err?.message ?? "no zipfile"}`, "extract_failed"));
+                    return;
+                }
+                let extracted = false;
+                zipfile.readEntry();
+                zipfile.on("entry", (entry) => {
+                    if (extracted) {
+                        zipfile.close();
+                        return;
+                    }
+                    const name = entry.fileName;
+                    const isDir = /\/$/.test(name);
+                    const lower = name.toLowerCase();
+                    const isMatch = !isDir && lower.endsWith(".ttf") && lower.includes(matchLower);
+                    if (!isMatch) {
+                        zipfile.readEntry();
+                        return;
+                    }
+                    zipfile.openReadStream(entry, (streamErr, readStream) => {
+                        if (streamErr || !readStream) {
+                            zipfile.close();
+                            reject(new FontInstallError(`read stream failed: ${streamErr?.message ?? "no stream"}`, "extract_failed"));
+                            return;
+                        }
+                        const writeStream = createWriteStream(destPath);
+                        pipeline(readStream, writeStream)
+                            .then(() => {
+                            extracted = true;
+                            zipfile.close();
+                            resolve();
+                        })
+                            .catch((pipeErr) => {
+                            zipfile.close();
+                            reject(new FontInstallError(`extract write failed: ${pipeErr.message}`, "extract_failed"));
+                        });
+                    });
+                });
+                zipfile.on("end", () => {
+                    if (!extracted) {
+                        reject(new FontInstallError(`no Regular TTF matching "${matchSubstring}" in zip`, "asset_not_found"));
+                    }
+                });
+                zipfile.on("error", (zipErr) => {
+                    reject(new FontInstallError(`zip error: ${zipErr.message}`, "extract_failed"));
+                });
+            });
+        });
+    }
+}
+//# sourceMappingURL=installer.js.map

package/server/fonts/installer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"installer.js","sourceRoot":"","sources":["../../src/fonts/installer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,SAAS,CAAC;AAC5C,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAC3D,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACvC,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAChD,OAAO,KAAK,MAAM,OAAO,CAAC;AA8B1B,MAAM,OAAO,gBAAiB,SAAQ,KAAK;IAG9B;IAFX,YACE,OAAe,EACN,IAIM;QAEf,KAAK,CAAC,OAAO,CAAC,CAAC;QANN,SAAI,GAAJ,IAAI,CAIE;IAGjB,CAAC;CACF;AASD,MAAM,UAAU,eAAe;IAC7B,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,QAAQ,CAAC,CAAC;IACrE,OAAO,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;AACxC,CAAC;AAED,MAAM,OAAO,aAAa;IACP,QAAQ,CAAS;IACjB,SAAS,CAAe;IACxB,QAAQ,GAAG,IAAI,GAAG,EAAkC,CAAC;IAEtE,YAAY,OAAyB,EAAE;QACrC,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,eAAe,EAAE,CAAC;QACnD,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC;IAC3C,CAAC;IAED,WAAW;QACT,OAAO,IAAI,CAAC,QAAQ,CAAC;IACvB,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,gBAAgB,CACpB,EAAU;QAEV,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;QACpC,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;QACtC,IAAI,CAAC;YACH,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,CAAC;YAC/B,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,IAAI,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;QACjD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;YAC3C,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAC;YACtD,MAAM,MAAM,GAAG,CAAC,MAAM,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAC5D,IAAI,CAAC,MAAM;gBAAE,OAAO,IAAI,CAAC;YACzB,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;QACvC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,KAAK,CAAC,aAAa;QACjB,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAC;QACrD,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;YACtE,MAAM,SAAS,GAAa,EAAE,CAAC;YAC/B,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;gBAC5B,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE;oBAAE,SAAS;gBACnC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;gBACzD,IAAI,QAAQ;oBAAE,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAC3C,CAAC;YACD,OAAO,SAAS,CAAC;QACnB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,OAAO,CAAC,MAAkB;QAC9B,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC9C,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAC9B,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE;YAClD,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAClC,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;QACtC,OAAO,OAAO,CAAC;IACjB,CAAC;IAEO,KAAK,CAAC,SAAS,CAAC,MAAkB;QACxC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACxD,IAAI,QAAQ,EAAE,CAAC;YACb,OAAO;gBACL,EAAE,EAAE,MAAM,CAAC,EAAE;gBACb,MAAM,EAAE,QAAQ,CAAC,MAAM;gBACvB,QAAQ,EAAE,UAAU;gBACpB,QAAQ,EAAE,QAAQ,CAAC,QAAQ;aAC5B,CAAC;QACJ,CAAC;QAED,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;QACjD,MAAM,KAAK,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC5C,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,EAAE,kBAAkB,CAAC,CAAC;QACpD,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC;QACnD,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;QAC5C,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;QAEjD,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;YAC9C,MAAM,IAAI,CAAC,iBAAiB,CAAC,OAAO,EAAE,MAAM,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC;YACvE,MAAM,MAAM,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;YAClC,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAC;YACvD,MAAM,SAAS,CAAC,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;YACpD,OAAO;gBACL,EAAE,EAAE,MAAM,CAAC,EAAE;gBACb,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,QAAQ,EAAE,UAAU;gBACpB,QAAQ,EAAE,OAAO;aAClB,CAAC;QACJ,CAAC;gBAAS,CAAC;YACT,yCAAyC;YACzC,MAAM,EAAE,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YACnC,MAAM,EAAE,CAAC,UAAU,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACxC,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,UAAU,CAAC,GAAW,EAAE,QAAgB;QACpD,MAAM,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACpD,IAAI,QAAkB,CAAC;QACvB,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC;QAC/D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,gBAAgB,CACxB,oBAAqB,KAAe,CAAC,OAAO,EAAE,EAC9C,iBAAiB,CAClB,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;YACnC,MAAM,IAAI,gBAAgB,CACxB,qBAAqB,QAAQ,CAAC,MAAM,EAAE,EACtC,iBAAiB,CAClB,CAAC;QACJ,CAAC;QACD,IAAI,CAAC;YACH,yEAAyE;YACzE,qDAAqD;YACrD,MAAM,UAAU,GAAG,QAAQ,CAAC,OAAO,CACjC,QAAQ,CAAC,IAA8C,CACxD,CAAC;YACF,MAAM,QAAQ,CAAC,UAAU,EAAE,iBAAiB,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC1D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,gBAAgB,CACxB,iBAAkB,KAAe,CAAC,OAAO,EAAE,EAC3C,WAAW,CACZ,CAAC;QACJ,CAAC;IACH,CAAC;IAEO,iBAAiB,CACvB,OAAe,EACf,cAAsB,EACtB,QAAgB;QAEhB,MAAM,UAAU,GAAG,cAAc,CAAC,WAAW,EAAE,CAAC;QAChD,OAAO,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC3C,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,EAAE;gBAC1D,IAAI,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;oBACpB,MAAM,CACJ,IAAI,gBAAgB,CAClB,oBAAoB,GAAG,EAAE,OAAO,IAAI,YAAY,EAAE,EAClD,gBAAgB,CACjB,CACF,CAAC;oBACF,OAAO;gBACT,CAAC;gBACD,IAAI,SAAS,GAAG,KAAK,CAAC;gBACtB,OAAO,CAAC,SAAS,EAAE,CAAC;gBACpB,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAkB,EAAE,EAAE;oBACzC,IAAI,SAAS,EAAE,CAAC;wBACd,OAAO,CAAC,KAAK,EAAE,CAAC;wBAChB,OAAO;oBACT,CAAC;oBACD,MAAM,IAAI,GAAG,KAAK,CAAC,QAAQ,CAAC;oBAC5B,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;oBAC/B,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;oBACjC,MAAM,OAAO,GACX,CAAC,KAAK,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;oBACjE,IAAI,CAAC,OAAO,EAAE,CAAC;wBACb,OAAO,CAAC,SAAS,EAAE,CAAC;wBACpB,OAAO;oBACT,CAAC;oBACD,OAAO,CAAC,cAAc,CAAC,KAAK,EAAE,CAAC,SAAS,EAAE,UAAU,EAAE,EAAE;wBACtD,IAAI,SAAS,IAAI,CAAC,UAAU,EAAE,CAAC;4BAC7B,OAAO,CAAC,KAAK,EAAE,CAAC;4BAChB,MAAM,CACJ,IAAI,gBAAgB,CAClB,uBAAuB,SAAS,EAAE,OAAO,IAAI,WAAW,EAAE,EAC1D,gBAAgB,CACjB,CACF,CAAC;4BACF,OAAO;wBACT,CAAC;wBACD,MAAM,WAAW,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;wBAChD,QAAQ,CAAC,UAAU,EAAE,WAAW,CAAC;6BAC9B,IAAI,CAAC,GAAG,EAAE;4BACT,SAAS,GAAG,IAAI,CAAC;4BACjB,OAAO,CAAC,KAAK,EAAE,CAAC;4BAChB,OAAO,EAAE,CAAC;wBACZ,CAAC,CAAC;6BACD,KAAK,CAAC,CAAC,OAAO,EAAE,EAAE;4BACjB,OAAO,CAAC,KAAK,EAAE,CAAC;4BAChB,MAAM,CACJ,IAAI,gBAAgB,CAClB,yBAA0B,OAAiB,CAAC,OAAO,EAAE,EACrD,gBAAgB,CACjB,CACF,CAAC;wBACJ,CAAC,CAAC,CAAC;oBACP,CAAC,CAAC,CAAC;gBACL,CAAC,CAAC,CAAC;gBACH,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;oBACrB,IAAI,CAAC,SAAS,EAAE,CAAC;wBACf,MAAM,CACJ,IAAI,gBAAgB,CAClB,4BAA4B,cAAc,UAAU,EACpD,iBAAiB,CAClB,CACF,CAAC;oBACJ,CAAC;gBACH,CAAC,CAAC,CAAC;gBACH,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE,EAAE;oBAC7B,MAAM,CACJ,IAAI,gBAAgB,CAClB,cAAc,MAAM,CAAC,OAAO,EAAE,EAC9B,gBAAgB,CACjB,CACF,CAAC;gBACJ,CAAC,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;CACF"}

package/server/fonts/routes.d.ts

@@ -0,0 +1,4 @@
+import { Hono } from "hono";
+import { type FontInstaller } from "./installer.js";
+export declare function createFontRoutes(installer: FontInstaller): Hono;
+//# sourceMappingURL=routes.d.ts.map

package/server/fonts/routes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"routes.d.ts","sourceRoot":"","sources":["../../src/fonts/routes.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAQ5B,OAAO,EAAoB,KAAK,aAAa,EAAE,MAAM,gBAAgB,CAAC;AActE,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,aAAa,GAAG,IAAI,CA6E/D"}

package/server/fonts/routes.js

@@ -0,0 +1,91 @@
+import { createReadStream } from "node:fs";
+import { stat } from "node:fs/promises";
+import { Readable } from "node:stream";
+import { Hono } from "hono";
+import { stream } from "hono/streaming";
+import { FONT_PRESETS, findPreset, isValidPresetId, toPublicPreset, } from "./catalog.js";
+import { FontInstallError } from "./installer.js";
+/*
+ * Font download / serving routes.
+ *
+ * GET  /api/fonts/catalog      list presets + which ones are already cached
+ * POST /api/fonts/install      body { id } -> cache miss triggers zip DL
+ * GET  /api/fonts/file/:id     stream the cached TTF, 404 if not installed
+ *
+ * Everything lives under /api so the session-auth middleware (cookie or
+ * token) protects each endpoint. The TTF download is large but infrequent,
+ * so there is no separate unauthenticated static mount -- any client that
+ * can reach /api has the cookie a @font-face GET needs.
+ */
+export function createFontRoutes(installer) {
+    const app = new Hono();
+    app.get("/catalog", async (c) => {
+        const installedIds = new Set(await installer.listInstalled());
+        const presets = FONT_PRESETS.map((preset) => ({
+            ...toPublicPreset(preset),
+            installed: installedIds.has(preset.id),
+        }));
+        return c.json({ presets });
+    });
+    app.post("/install", async (c) => {
+        const body = (await c.req.json().catch(() => null));
+        const id = body?.id;
+        if (!isValidPresetId(id)) {
+            return c.json({ error: "unknown preset id" }, 400);
+        }
+        const preset = findPreset(id);
+        if (!preset) {
+            return c.json({ error: "unknown preset id" }, 400);
+        }
+        try {
+            const result = await installer.install(preset);
+            return c.json({
+                id: result.id,
+                family: result.family,
+                url: `/api/fonts/file/${result.id}`,
+                installed: true,
+            });
+        }
+        catch (error) {
+            if (error instanceof FontInstallError) {
+                const status = error.kind === "download_failed"
+                    ? 502
+                    : error.kind === "asset_not_found"
+                        ? 404
+                        : 500;
+                return c.json({ error: error.message, kind: error.kind }, status);
+            }
+            throw error;
+        }
+    });
+    app.get("/file/:id", async (c) => {
+        const id = c.req.param("id");
+        if (!isValidPresetId(id)) {
+            return c.json({ error: "unknown preset id" }, 400);
+        }
+        const resolved = await installer.resolveInstalled(id);
+        if (!resolved) {
+            return c.json({ error: "not installed" }, 404);
+        }
+        let size;
+        try {
+            size = (await stat(resolved.filePath)).size;
+        }
+        catch {
+            return c.json({ error: "not installed" }, 404);
+        }
+        c.header("Content-Type", "font/ttf");
+        c.header("Content-Length", String(size));
+        // TTFs are immutable per-install (same version always produces the same
+        // bytes) -- let the browser cache aggressively so picking an installed
+        // preset a second time doesn't re-fetch.
+        c.header("Cache-Control", "public, max-age=31536000, immutable");
+        return stream(c, async (s) => {
+            const nodeStream = createReadStream(resolved.filePath);
+            const webStream = Readable.toWeb(nodeStream);
+            await s.pipe(webStream);
+        });
+    });
+    return app;
+}
+//# sourceMappingURL=routes.js.map

package/server/fonts/routes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"routes.js","sourceRoot":"","sources":["../../src/fonts/routes.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAC;AAC3C,OAAO,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AACxC,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACvC,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AACxC,OAAO,EACL,YAAY,EACZ,UAAU,EACV,eAAe,EACf,cAAc,GACf,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,gBAAgB,EAAsB,MAAM,gBAAgB,CAAC;AAEtE;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,gBAAgB,CAAC,SAAwB;IACvD,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IAEvB,GAAG,CAAC,GAAG,CAAC,UAAU,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC9B,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,MAAM,SAAS,CAAC,aAAa,EAAE,CAAC,CAAC;QAC9D,MAAM,OAAO,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YAC5C,GAAG,cAAc,CAAC,MAAM,CAAC;YACzB,SAAS,EAAE,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;SACvC,CAAC,CAAC,CAAC;QACJ,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;IAC7B,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC/B,MAAM,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAE1C,CAAC;QACT,MAAM,EAAE,GAAG,IAAI,EAAE,EAAE,CAAC;QACpB,IAAI,CAAC,eAAe,CAAC,EAAE,CAAC,EAAE,CAAC;YACzB,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,EAAE,GAAG,CAAC,CAAC;QACrD,CAAC;QACD,MAAM,MAAM,GAAG,UAAU,CAAC,EAAE,CAAC,CAAC;QAC9B,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,EAAE,GAAG,CAAC,CAAC;QACrD,CAAC;QACD,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YAC/C,OAAO,CAAC,CAAC,IAAI,CAAC;gBACZ,EAAE,EAAE,MAAM,CAAC,EAAE;gBACb,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,GAAG,EAAE,mBAAmB,MAAM,CAAC,EAAE,EAAE;gBACnC,SAAS,EAAE,IAAI;aAChB,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,gBAAgB,EAAE,CAAC;gBACtC,MAAM,MAAM,GACV,KAAK,CAAC,IAAI,KAAK,iBAAiB;oBAC9B,CAAC,CAAC,GAAG;oBACL,CAAC,CAAC,KAAK,CAAC,IAAI,KAAK,iBAAiB;wBAChC,CAAC,CAAC,GAAG;wBACL,CAAC,CAAC,GAAG,CAAC;gBACZ,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,EAAE,MAAM,CAAC,CAAC;YACpE,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC/B,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC7B,IAAI,CAAC,eAAe,CAAC,EAAE,CAAC,EAAE,CAAC;YACzB,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,EAAE,GAAG,CAAC,CAAC;QACrD,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAC;QACtD,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,EAAE,GAAG,CAAC,CAAC;QACjD,CAAC;QACD,IAAI,IAAwB,CAAC;QAC7B,IAAI,CAAC;YACH,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;QAC9C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,EAAE,GAAG,CAAC,CAAC;QACjD,CAAC;QACD,CAAC,CAAC,MAAM,CAAC,cAAc,EAAE,UAAU,CAAC,CAAC;QACrC,CAAC,CAAC,MAAM,CAAC,gBAAgB,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QACzC,wEAAwE;QACxE,uEAAuE;QACvE,yCAAyC;QACzC,CAAC,CAAC,MAAM,CAAC,eAAe,EAAE,qCAAqC,CAAC,CAAC;QACjE,OAAO,MAAM,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;YAC3B,MAAM,UAAU,GAAG,gBAAgB,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;YACvD,MAAM,SAAS,GAAG,QAAQ,CAAC,KAAK,CAC9B,UAAU,CACmB,CAAC;YAChC,MAAM,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC1B,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,OAAO,GAAG,CAAC;AACb,CAAC"}

package/server/fs/drops.d.ts

@@ -0,0 +1,50 @@
+import { open } from "node:fs/promises";
+/**
+ * Drops handler shared by chat-input image paste / DnD. Files are persisted
+ * under a caller-supplied `targetDir`; in production that is an
+ * `UploadStaging`-managed temp directory outside the project tree (issue
+ * upload staging isolation). The function does not create the dir -- the caller is expected to
+ * have produced it via `UploadStaging.acquire(sessionId)` so that the 3-
+ * layer GC owns its lifetime.
+ */
+export type DropRejectReason = "path-traversal" | "control-char" | "too-long" | "empty" | "reserved";
+export declare class InvalidFilenameError extends Error {
+    readonly reason: DropRejectReason;
+    constructor(reason: DropRejectReason, message?: string);
+}
+/**
+ * Replace characters the OS filesystem or pty pipe cannot safely carry:
+ * path separators, NUL, C0 controls, ASCII and NBSP whitespace. Reject
+ * the request outright for the three strings that silently resolve to
+ * a parent directory (`""`, `"."`, `".."`) or that include a `..`
+ * segment. Caller further fences the result against the target dir
+ * before writing (defence in depth).
+ */
+export declare function sanitizeFilename(input: string): string;
+export interface SaveDropsDeps {
+    /** Returns the current wall-clock. Injected for deterministic tests. */
+    now?: () => Date;
+    /**
+     * Test-only override for the `O_EXCL` filename-claim step. Production
+     * code always uses `node:fs/promises.open`; tests inject a stub that
+     * fakes EEXIST to exercise the collision-retry loop without pre-
+     * populating 1000+ real files on disk.
+     */
+    openForTest?: typeof open;
+}
+export interface DropInput {
+    /** Original filename as provided by the client. Sanitized internally. */
+    filename: string;
+    /** Raw file bytes to persist. */
+    bytes: Uint8Array;
+}
+/**
+ * Persist drops under `targetDir` (already created by the caller --
+ * typically `UploadStaging.acquire(sessionId)`) and return the absolute
+ * written paths in the same order as the input. Collisions in the same
+ * second get a `-2`, `-3`, ... suffix inserted before the final
+ * extension. `writeFileAtomic` guarantees partial writes are
+ * impossible: the temp file is renamed into place only after flush.
+ */
+export declare function saveDrops(targetDir: string, inputs: readonly DropInput[], deps?: SaveDropsDeps): Promise<string[]>;
+//# sourceMappingURL=drops.d.ts.map

package/server/fs/drops.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"drops.d.ts","sourceRoot":"","sources":["../../src/fs/drops.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAY,MAAM,kBAAkB,CAAC;AAIlD;;;;;;;GAOG;AAEH,MAAM,MAAM,gBAAgB,GACxB,gBAAgB,GAChB,cAAc,GACd,UAAU,GACV,OAAO,GACP,UAAU,CAAC;AAEf,qBAAa,oBAAqB,SAAQ,KAAK;IAC7C,QAAQ,CAAC,MAAM,EAAE,gBAAgB,CAAC;gBACtB,MAAM,EAAE,gBAAgB,EAAE,OAAO,CAAC,EAAE,MAAM;CAKvD;AAgBD;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAiBtD;AAeD,MAAM,WAAW,aAAa;IAC5B,wEAAwE;IACxE,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;IACjB;;;;;OAKG;IACH,WAAW,CAAC,EAAE,OAAO,IAAI,CAAC;CAC3B;AAED,MAAM,WAAW,SAAS;IACxB,yEAAyE;IACzE,QAAQ,EAAE,MAAM,CAAC;IACjB,iCAAiC;IACjC,KAAK,EAAE,UAAU,CAAC;CACnB;AAED;;;;;;;GAOG;AACH,wBAAsB,SAAS,CAC7B,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,SAAS,SAAS,EAAE,EAC5B,IAAI,GAAE,aAAkB,GACvB,OAAO,CAAC,MAAM,EAAE,CAAC,CAoEnB"}

package/server/fs/drops.js

@@ -0,0 +1,137 @@
+import { open, realpath } from "node:fs/promises";
+import { extname, resolve, sep } from "node:path";
+import writeFileAtomic from "write-file-atomic";
+export class InvalidFilenameError extends Error {
+    reason;
+    constructor(reason, message) {
+        super(message ?? `invalid filename: ${reason}`);
+        this.reason = reason;
+        this.name = "InvalidFilenameError";
+    }
+}
+/**
+ * Drop naming: `{YYYYMMDD-HHMMSS}_{sanitized}` in local time. Local time
+ * is an explicit product decision (by design) -- the CLI user wants to
+ * reference "the file I just dropped" by human-readable wall-clock,
+ * not UTC.
+ */
+function formatTimestamp(date) {
+    const pad = (n) => n.toString().padStart(2, "0");
+    return (`${date.getFullYear()}${pad(date.getMonth() + 1)}${pad(date.getDate())}` +
+        `-${pad(date.getHours())}${pad(date.getMinutes())}${pad(date.getSeconds())}`);
+}
+/**
+ * Replace characters the OS filesystem or pty pipe cannot safely carry:
+ * path separators, NUL, C0 controls, ASCII and NBSP whitespace. Reject
+ * the request outright for the three strings that silently resolve to
+ * a parent directory (`""`, `"."`, `".."`) or that include a `..`
+ * segment. Caller further fences the result against the target dir
+ * before writing (defence in depth).
+ */
+export function sanitizeFilename(input) {
+    const nfc = input.normalize("NFC");
+    if (nfc === "" || nfc === "." || nfc === "..") {
+        throw new InvalidFilenameError("path-traversal");
+    }
+    if (/(^|[\\/])\.\.([\\/]|$)/.test(nfc)) {
+        throw new InvalidFilenameError("path-traversal");
+    }
+    // biome-ignore lint/suspicious/noControlCharactersInRegex: upload filenames intentionally rewrite C0/DEL bytes.
+    const replaced = nfc.replace(/[\\/\x00-\x1f\x7f 　]/g, "_");
+    if (replaced === "." || replaced === "..") {
+        throw new InvalidFilenameError("path-traversal");
+    }
+    if (replaced.length <= 255)
+        return replaced;
+    const ext = extname(replaced);
+    const base = replaced.slice(0, 255 - ext.length);
+    return base + ext;
+}
+/**
+ * `extname("image.tar.gz") === ".gz"`, so suffix insertion happens before
+ * the final extension only; conflict-count inserts ahead of `.gz` rather
+ * than in front of `.tar`. Agreed tradeoff -- the alternative (strip every
+ * tail ext) mis-handles dotted filenames like `component.test.tsx`.
+ */
+function splitBasenameExt(name) {
+    const ext = extname(name);
+    return { base: ext ? name.slice(0, -ext.length) : name, ext };
+}
+const MAX_SUFFIX_ATTEMPTS = 1000;
+/**
+ * Persist drops under `targetDir` (already created by the caller --
+ * typically `UploadStaging.acquire(sessionId)`) and return the absolute
+ * written paths in the same order as the input. Collisions in the same
+ * second get a `-2`, `-3`, ... suffix inserted before the final
+ * extension. `writeFileAtomic` guarantees partial writes are
+ * impossible: the temp file is renamed into place only after flush.
+ */
+export async function saveDrops(targetDir, inputs, deps = {}) {
+    if (inputs.length === 0)
+        return [];
+    const now = deps.now ?? (() => new Date());
+    const openFn = deps.openForTest ?? open;
+    /**
+     * Realpath the supplied dir as defence in depth: even though the
+     * caller is expected to have done this, a regression upstream (e.g.
+     * passing a pre-canonical path that contains a symlink) would otherwise
+     * let a planted symlink under `targetDir` redirect writes outside it.
+     * We compare canonical paths when fencing each claim.
+     */
+    const canonicalTarget = await realpath(targetDir);
+    const saved = [];
+    for (const input of inputs) {
+        const sanitized = sanitizeFilename(input.filename);
+        const timestamp = formatTimestamp(now());
+        const { base, ext } = splitBasenameExt(sanitized);
+        const prefix = `${timestamp}_${base}`;
+        let finalName = `${prefix}${ext}`;
+        let attempt = 2;
+        let target = resolve(canonicalTarget, finalName);
+        /**
+         * Claim the final filename with an exclusive create (`O_EXCL`). This
+         * closes the check-then-write TOCTOU window that a `statSync + write`
+         * probe would leave open: two parallel uploads of `notes.txt` in the
+         * same second would otherwise both pass the exists-check and race
+         * each other's `writeFileAtomic(rename)` to overwrite the winner.
+         * `wx` fails with EEXIST if the file exists, so losers fall through
+         * to the next suffix.
+         */
+        while (true) {
+            // Fence against sanitizer misses: the claimed path must live under
+            // the canonicalized target dir.
+            if (!target.startsWith(canonicalTarget + sep)) {
+                throw new InvalidFilenameError("path-traversal", `refusing to write outside ${canonicalTarget}`);
+            }
+            try {
+                const fh = await openFn(target, "wx");
+                await fh.close();
+                break;
+            }
+            catch (err) {
+                if (!isNodeErrorWithCode(err, "EEXIST"))
+                    throw err;
+                if (attempt > MAX_SUFFIX_ATTEMPTS) {
+                    throw new Error(`saveDrops: exhausted ${MAX_SUFFIX_ATTEMPTS} collision slots for ${sanitized}`);
+                }
+                finalName = `${prefix}-${attempt}${ext}`;
+                target = resolve(canonicalTarget, finalName);
+                attempt += 1;
+            }
+        }
+        // write-file-atomic expects `string | Buffer`. Wrap without copying:
+        // `Buffer.from(Uint8Array)` shares the backing ArrayBuffer.
+        // The `O_EXCL` claim above has already reserved the final filename,
+        // so the atomic rename inside writeFileAtomic now only overwrites
+        // our own empty claim file -- never another uploader's content.
+        await writeFileAtomic(target, Buffer.from(input.bytes));
+        saved.push(target);
+    }
+    return saved;
+}
+function isNodeErrorWithCode(err, code) {
+    return (err instanceof Error &&
+        "code" in err &&
+        err.code === code);
+}
+//# sourceMappingURL=drops.js.map

package/server/fs/drops.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"drops.js","sourceRoot":"","sources":["../../src/fs/drops.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAClD,OAAO,eAAe,MAAM,mBAAmB,CAAC;AAkBhD,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IACpC,MAAM,CAAmB;IAClC,YAAY,MAAwB,EAAE,OAAgB;QACpD,KAAK,CAAC,OAAO,IAAI,qBAAqB,MAAM,EAAE,CAAC,CAAC;QAChD,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;IACrC,CAAC;CACF;AAED;;;;;GAKG;AACH,SAAS,eAAe,CAAC,IAAU;IACjC,MAAM,GAAG,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACzD,OAAO,CACL,GAAG,IAAI,CAAC,WAAW,EAAE,GAAG,GAAG,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,GAAG,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,EAAE;QACxE,IAAI,GAAG,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,GAAG,GAAG,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC,GAAG,GAAG,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC,EAAE,CAC7E,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAa;IAC5C,MAAM,GAAG,GAAG,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACnC,IAAI,GAAG,KAAK,EAAE,IAAI,GAAG,KAAK,GAAG,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;QAC9C,MAAM,IAAI,oBAAoB,CAAC,gBAAgB,CAAC,CAAC;IACnD,CAAC;IACD,IAAI,wBAAwB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACvC,MAAM,IAAI,oBAAoB,CAAC,gBAAgB,CAAC,CAAC;IACnD,CAAC;IACD,gHAAgH;IAChH,MAAM,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC,uBAAuB,EAAE,GAAG,CAAC,CAAC;IAC3D,IAAI,QAAQ,KAAK,GAAG,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QAC1C,MAAM,IAAI,oBAAoB,CAAC,gBAAgB,CAAC,CAAC;IACnD,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG;QAAE,OAAO,QAAQ,CAAC;IAC5C,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC9B,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC;IACjD,OAAO,IAAI,GAAG,GAAG,CAAC;AACpB,CAAC;AAED;;;;;GAKG;AACH,SAAS,gBAAgB,CAAC,IAAY;IACpC,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1B,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC;AAChE,CAAC;AAED,MAAM,mBAAmB,GAAG,IAAI,CAAC;AAqBjC;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,SAAiB,EACjB,MAA4B,EAC5B,OAAsB,EAAE;IAExB,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACnC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;IAC3C,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC;IAExC;;;;;;OAMG;IACH,MAAM,eAAe,GAAG,MAAM,QAAQ,CAAC,SAAS,CAAC,CAAC;IAElD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,SAAS,GAAG,gBAAgB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACnD,MAAM,SAAS,GAAG,eAAe,CAAC,GAAG,EAAE,CAAC,CAAC;QACzC,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,gBAAgB,CAAC,SAAS,CAAC,CAAC;QAClD,MAAM,MAAM,GAAG,GAAG,SAAS,IAAI,IAAI,EAAE,CAAC;QAEtC,IAAI,SAAS,GAAG,GAAG,MAAM,GAAG,GAAG,EAAE,CAAC;QAClC,IAAI,OAAO,GAAG,CAAC,CAAC;QAChB,IAAI,MAAM,GAAG,OAAO,CAAC,eAAe,EAAE,SAAS,CAAC,CAAC;QACjD;;;;;;;;WAQG;QACH,OAAO,IAAI,EAAE,CAAC;YACZ,mEAAmE;YACnE,gCAAgC;YAChC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,eAAe,GAAG,GAAG,CAAC,EAAE,CAAC;gBAC9C,MAAM,IAAI,oBAAoB,CAC5B,gBAAgB,EAChB,6BAA6B,eAAe,EAAE,CAC/C,CAAC;YACJ,CAAC;YACD,IAAI,CAAC;gBACH,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;gBACtC,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC;gBACjB,MAAM;YACR,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,CAAC,mBAAmB,CAAC,GAAG,EAAE,QAAQ,CAAC;oBAAE,MAAM,GAAG,CAAC;gBACnD,IAAI,OAAO,GAAG,mBAAmB,EAAE,CAAC;oBAClC,MAAM,IAAI,KAAK,CACb,wBAAwB,mBAAmB,wBAAwB,SAAS,EAAE,CAC/E,CAAC;gBACJ,CAAC;gBACD,SAAS,GAAG,GAAG,MAAM,IAAI,OAAO,GAAG,GAAG,EAAE,CAAC;gBACzC,MAAM,GAAG,OAAO,CAAC,eAAe,EAAE,SAAS,CAAC,CAAC;gBAC7C,OAAO,IAAI,CAAC,CAAC;YACf,CAAC;QACH,CAAC;QAED,qEAAqE;QACrE,4DAA4D;QAC5D,oEAAoE;QACpE,kEAAkE;QAClE,gEAAgE;QAChE,MAAM,eAAe,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;QACxD,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACrB,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,mBAAmB,CAAC,GAAY,EAAE,IAAY;IACrD,OAAO,CACL,GAAG,YAAY,KAAK;QACpB,MAAM,IAAI,GAAG;QACZ,GAA6B,CAAC,IAAI,KAAK,IAAI,CAC7C,CAAC;AACJ,CAAC"}

package/server/fs/file-uploads.d.ts

@@ -0,0 +1,57 @@
+import { open } from "node:fs/promises";
+import type { FileUploadDisposition, FileUploadRejectReason, FileUploadResultEntry } from "@parasor/shared";
+export type InvalidTargetReason = "path-traversal" | "not-a-dir" | "missing";
+export declare class InvalidUploadFilenameError extends Error {
+    readonly reason: FileUploadRejectReason;
+    constructor(reason: FileUploadRejectReason, message?: string);
+}
+export declare class InvalidUploadTargetError extends Error {
+    readonly reason: InvalidTargetReason;
+    constructor(reason: InvalidTargetReason, message?: string);
+}
+export declare class UploadConflictError extends Error {
+    readonly conflicts: string[];
+    constructor(conflicts: string[]);
+}
+/**
+ * Same character/length policy as `fs/drops.ts#sanitizeFilename`. The
+ * difference: drops always live under `{root}/.parasor/drops/`, whereas
+ * uploads target an arbitrary subdir. Both protect against `..` segments
+ * and control characters at the filename layer; the realpath fence below
+ * protects the directory layer.
+ */
+export declare function sanitizeUploadFilename(input: string): string;
+/**
+ * Resolve `relative` against `projectRoot` and prove the result is an
+ * existing directory inside the project. Returns the canonicalized
+ * (realpath-ed) absolute path; the caller writes into it.
+ *
+ * `relative` is the value submitted by the client via the `path` query
+ * parameter. An empty string (or `.`) means "the project root itself".
+ */
+export declare function resolveTargetDir(projectRoot: string, relative: string): Promise<string>;
+export interface UploadInput {
+    filename: string;
+    bytes: Uint8Array;
+}
+export interface SaveUploadsDeps {
+    /** Test-only override for the `O_EXCL` filename-claim step. */
+    openForTest?: typeof open;
+}
+/**
+ * Persist `inputs` into `targetDir` (already validated by
+ * `resolveTargetDir`) and return a result entry per input describing
+ * what happened on disk.
+ *
+ * `disposition` decides conflict semantics:
+ * - `replace`   -- overwrite existing files in place via atomic rename
+ * - `keep-both` -- write next to the existing file with `-2`, `-3`, ...
+ * - `skip`      -- preflight all collisions; if any exist, throw
+ *                 `UploadConflictError` and write nothing
+ *
+ * `targetDir` must be the canonical (realpath-ed) directory; this
+ * function asserts every claim path lives under it as a defence-in-depth
+ * fence behind `resolveTargetDir`.
+ */
+export declare function saveUploads(targetDir: string, inputs: readonly UploadInput[], disposition: FileUploadDisposition, deps?: SaveUploadsDeps): Promise<FileUploadResultEntry[]>;
+//# sourceMappingURL=file-uploads.d.ts.map

package/server/fs/file-uploads.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"file-uploads.d.ts","sourceRoot":"","sources":["../../src/fs/file-uploads.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAkB,MAAM,kBAAkB,CAAC;AAExD,OAAO,KAAK,EACV,qBAAqB,EACrB,sBAAsB,EACtB,qBAAqB,EACtB,MAAM,iBAAiB,CAAC;AAGzB,MAAM,MAAM,mBAAmB,GAAG,gBAAgB,GAAG,WAAW,GAAG,SAAS,CAAC;AAE7E,qBAAa,0BAA2B,SAAQ,KAAK;IACnD,QAAQ,CAAC,MAAM,EAAE,sBAAsB,CAAC;gBAC5B,MAAM,EAAE,sBAAsB,EAAE,OAAO,CAAC,EAAE,MAAM;CAK7D;AAED,qBAAa,wBAAyB,SAAQ,KAAK;IACjD,QAAQ,CAAC,MAAM,EAAE,mBAAmB,CAAC;gBACzB,MAAM,EAAE,mBAAmB,EAAE,OAAO,CAAC,EAAE,MAAM;CAK1D;AAED,qBAAa,mBAAoB,SAAQ,KAAK;IAC5C,QAAQ,CAAC,SAAS,EAAE,MAAM,EAAE,CAAC;gBACjB,SAAS,EAAE,MAAM,EAAE;CAKhC;AAED;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAiB5D;AASD;;;;;;;GAOG;AACH,wBAAsB,gBAAgB,CACpC,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,MAAM,CAAC,CA8CjB;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,UAAU,CAAC;CACnB;AAED,MAAM,WAAW,eAAe;IAC9B,+DAA+D;IAC/D,WAAW,CAAC,EAAE,OAAO,IAAI,CAAC;CAC3B;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,WAAW,CAC/B,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,SAAS,WAAW,EAAE,EAC9B,WAAW,EAAE,qBAAqB,EAClC,IAAI,GAAE,eAAoB,GACzB,OAAO,CAAC,qBAAqB,EAAE,CAAC,CAsFlC"}