import type { ServerResponse } from 'http'; import type { Connect } from 'vite'; export declare const createMediaRouter: (config: PathConfig) => { handleList: (req: any, res: any) => Promise; handleDelete: (req: Connect.IncomingMessage, res: any) => Promise; handlePost: (req: Connect.IncomingMessage, res: ServerResponse) => Promise; }; export declare const parseMediaFolder: (str: string) => string; interface MediaArgs { searchPath: string; cursor?: string; limit?: string; } interface File { src: string; filename: string; size: number; } interface ListMediaRes { directories: string[]; files: File[]; cursor?: string; error?: string; } export interface PathConfig { rootPath: string; apiURL: string; publicFolder: string; mediaRoot: string; } type SuccessRecord = { ok: true; } | { ok: false; message: string; }; /** * Handles media file operations (list, delete) for the Vite-based dev server. * * @security Every method that accepts a user-supplied `searchPath` validates * it against the media root using `resolveWithinBase` (list) or * `resolveStrictlyWithinBase` (delete) before any filesystem access. * * - **list** uses `resolveWithinBase` because listing the media root itself * (empty path / exact base match) is a valid operation. * - **delete** uses `resolveStrictlyWithinBase` because deleting the media * root directory itself must never be allowed. * * Both methods catch `PathTraversalError` and re-throw it so that the * route handler can return a 403 response. Other errors are caught and * returned as structured error responses (this avoids leaking stack traces * to the client). */ export declare class MediaModel { readonly rootPath: string; readonly publicFolder: string; readonly mediaRoot: string; constructor({ rootPath, publicFolder, mediaRoot }: PathConfig); listMedia(args: MediaArgs): Promise; deleteMedia(args: MediaArgs): Promise; } export {};