Append iframe=true query param to a URL when in iframe mode

Build embed snippets (script and iframe variants) for a ticket URL

Build a frame-ancestors CSP value from allowed embed hosts. Returns null if the list is empty (allow embedding from anywhere).

Check whether a bunny subdomain is available.

Delete a file, routing to local or Bunny based on config.

Upload and publish new script code to a Bunny edge script (defaults to this host's own script when scriptId is omitted).

Detect iframe mode from a request URL and store it for the current request. A no-op outside a request, so a direct render cannot set the ambient mode.

Detect the actual image type from magic bytes. Returns the MIME type if matched, null otherwise.

Download and decrypt a file. Returns the decrypted bytes, or null if the file does not exist.

Download raw bytes from storage. Returns null if the file does not exist.

Generate a random CDN filename preserving the original name for readability

Generate a random .webp filename. Every uploaded image is transcoded to WebP, so stored image variants always carry the .webp extension.

Extract the basename from a path (handles both forward and backslash separators)

Get CDN hostname (delegates to bunnyCdnApi for testability).

Get the current request's iframe mode

Images are encrypted at rest, so browsers load them through this route.

Get the MIME type for an image filename from its extension.

Returns which storage backend is active: "bunny", "local", or "none".

Check if image storage is enabled (Bunny CDN or local filesystem).

List files in storage matching a prefix (names only), sorted by name.

List files (with size metadata) matching a path prefix, sorted by name. The prefix may name a subfolder (see splitListingPrefix); returned names always include that folder so callers can download/delete them directly. For Bunny CDN the size comes from the Length field of the listing API.

Parse a comma-separated list of hosts into trimmed, lowercased entries. Filters out empty strings from trailing commas etc.

Register a bunny subdomain (DNS + CDN).

Run fn with an isolated storage configuration (test-only).

Strip a path's basename down with each [pattern, replacement] rule in turn, falling back to "file" when nothing is left. Shared by every filename sanitiser — each supplies its own character rules.

Test-only: set the suite-level storage config that describeWithEnv's storage option applies. A directly-exported named function (not an export {} list, which the test-hook scanner does not detect, nor a module-level alias) so it is visible to and registered in ALLOWED_TEST_HOOKS (test/lib/code-quality.test.ts), alongside runWithStorageConfig.

Name of the configured Bunny storage zone, or null when Bunny is not the active backend. Shown to operators so they can tell which zone a page reads.

Upload an attachment to Bunny storage. Encrypts the file bytes before uploading. Uses the provided filename (caller generates via generateAttachmentFilename). Returns the filename on success.

Upload raw bytes to storage, routing to local or Bunny based on config

Validate an attachment file: check size only (any file type allowed).

Validate a custom domain (delegates to bunnyCdnApi for testability).

Validate a comma-separated list of host patterns. Returns null if all valid, or the first error message.

Validate a single host pattern Returns null if valid, or an error message if invalid

Validate an image file: check size, the declared MIME type, and the magic bytes. Both the declared type and the sniffed content must be an accepted upload format; a mismatch or an unsupported format (e.g. a GIF, or a file whose bytes don't match any decodable format) is rejected. On success, detectedType is the sniffed format the transcoder will decode.

Attachment validation error

Attachment validation result

Image validation error

Image validation result

A stored file with its name and size in bytes.

User-facing messages for attachment validation errors

Stubbable API for testing. Every cross-client route in the impls below goes back through this object, so a stub on one method reroutes that step. The three composed entries carry return types because they reference this very object in their wiring.

Matches a valid hostname like "example.com" or "sub.example.com"

User-facing messages for image validation errors

Maximum attachment file size in bytes (default: 25MB)

Transcode an uploaded image to WebP, one stored file per target, returned in the order of targets.