@aglyn/aglyn 1.0.0-beta.143

package/src/lib/app-utils/media-asset-facts.js

@@ -0,0 +1,467 @@
+import { _ as _extends } from "@swc/helpers/_/_extends";
+import { _ as _object_without_properties_loose } from "@swc/helpers/_/_object_without_properties_loose";
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ /**
+ * What a placed library asset is NOW, read from its DAM document when the
+ * page is composed rather than copied onto the node when it was picked: a
+ * film's length, shape and poster (AGL-2807), and an image's pixel pair
+ * (AGL-2833).
+ *
+ * ## Why the pick-time copy is not enough
+ *
+ * Picking a library asset copies facts onto the node. An image gets its pixel
+ * pair ({@link intrinsicMediaSize}), which `image.tsx` renders as the
+ * `<img>`'s `width`/`height` attributes so the browser can reserve the box
+ * before the bytes arrive. A film gets its running time, its frame's pair and
+ * a poster flag ({@link videoMediaProps}): the pair becomes the player's CSS
+ * `aspect-ratio`, the running time becomes `VideoObject.duration`, and the
+ * flag decides whether a lightbox `<img>` and a `thumbnailUrl` exist at all.
+ *
+ * A replace (AGL-2732) keeps the asset's id and URL and rewrites its document:
+ * an image's `width`/`height`, a film's `video` and `poster` records. It
+ * cannot rewrite the nodes, which sit in every screen, layout, component and
+ * published version that places the asset. So after a replace with a
+ * different shape, every page placing the image reserved the previous
+ * picture's box and shifted when the new one decoded, and every page placing
+ * the film kept the previous film's length and shape, until someone re-picked
+ * it.
+ *
+ * ## The rule
+ *
+ * Two surfaces read each placed asset's document and lay what it records over
+ * the node here: the tenant's composition, for the page a visitor gets
+ * (`libs/tenant/runtime/src/lib/get-media-asset-facts.ts`), and the console,
+ * for the besigner canvas an author edits and the Preview that checks it
+ * (AGL-2838, AGL-2849). Both decide what a read answers through
+ * {@link mediaAssetFactsFromDocument}, so the editor cannot disagree with the
+ * page about which assets answer. When the asset cannot be answered for (a
+ * failed or pending read, a missing or deleted document, an asset the CDN
+ * would not serve under this page's URL, one past the composition's cap), the
+ * node keeps what the pick stored. That is the render every page had before
+ * this, never a worse one. When the asset answers:
+ *
+ * - **A film's facts win, including their ABSENCE.** A film the replace left
+ *   with no `video` record has no known shape, so a stored pair describing
+ *   the previous film is dropped rather than published, and a poster flag the
+ *   document no longer backs is dropped with it. One stored value survives: a
+ *   running time the AUTHOR typed for a film the DAM has no running time for.
+ *   The pick only ever writes the duration together with the pixel pair
+ *   ({@link videoMediaProps} is all-or-nothing on the `video` record), and the
+ *   pair is not an author control. So a duration standing alone is an
+ *   author's, and a duration standing beside a pair is a copy of a film that
+ *   may no longer be the one in the bucket.
+ * - **An image's pair wins when the document records one.** When it records
+ *   none (an SVG, which the upload cannot measure, or a file older than
+ *   AGL-173), the stored pair stays, whether an author typed it through the
+ *   API or it is a copy of the file the asset held before. The asymmetry with
+ *   a film is in the render, not the data. A film's pair is the player's
+ *   permanent box, but an image's is only a reservation
+ *   (`aspect-ratio: auto w / h`), which the decoded picture's own ratio
+ *   replaces. Dropping the pair guarantees a shift of the image's full height
+ *   on every view. A stale pair shifts by the difference between two heights,
+ *   and a pair typed for a file the DAM cannot measure shifts by nothing.
+ *
+ * Nothing an author sets for the placement is touched: an image's CSS
+ * `width` and `height`, its fit and radius, and a film's own poster describe
+ * the placement rather than the file.
+ *
+ * Imported by path and never through a barrel: every `@aglyn/aglyn` barrel
+ * ships to published pages, and nothing here has a reason to reach one, so
+ * the composition and the console both import this module by path.
+ */ import { CANVAS_ROOT_ELEMENT_ID } from "../foundation/constants/canvas.js";
+import { mediaCdnScopeRefusal, parseMediaCdnScope } from "./media-cdn-scope.js";
+import { intrinsicMediaSize, videoMediaProps } from "./media-metadata.js";
+import { hostQualifiedScope, parseMediaRef } from "./media-ref.js";
+import { VIDEO_COMPONENT_ID } from "./video-object.js";
+/** The Image element's persisted component id (`image.tsx`), never renamed. */ export const IMAGE_COMPONENT_ID = 'image';
+/**
+ * The prop each element that holds a markdown-lite DOCUMENT keeps it in, and
+ * therefore every element whose body can name a library image (AGL-3149).
+ *
+ * The same two elements and the same two prop names `resolveMarkdownSource`
+ * walks for a table of contents (AGL-1162), which is the other reader of a
+ * body's contents. They differ: the Markdown element calls it `content` and a
+ * collection entry's body calls it `markdown`.
+ *
+ * Both ids are spelled out rather than imported. `markdown` belongs to a
+ * plugin, which core may never import; `collectionEntryBody` is exported by
+ * `collection-entries.ts`, but that module is 1,860 lines and drags
+ * `content-authors.ts` behind it, and this one is deliberately outside the
+ * barrel that ships to published pages. A persisted component id is a string
+ * that cannot change — renaming one orphans every document that stores it —
+ * so the copy cannot drift in the way an imported value would protect against.
+ */ const MARKDOWN_BODY_PROPS = {
+    markdown: 'content',
+    collectionEntryBody: 'markdown'
+};
+/** The root of a composed map, where a walk in document order starts. */ const ROOT_NODE_ID = CANVAS_ROOT_ELEMENT_ID;
+/**
+ * Every field an asset's facts are decided from, and the projection a reader
+ * asks Firestore for: ONE list, whichever surface reads. `width` and `height`
+ * (an image's) and `video` and `poster` (a film's) are the facts. The other
+ * three are the gates `serveMediaCdn` applies before it will serve an asset at
+ * all, so no surface shows the shape of a file its page's URL refuses.
+ */ export const MEDIA_ASSET_FACT_FIELDS = [
+    'width',
+    'height',
+    'video',
+    'poster',
+    'deletedAt',
+    'private',
+    'visibleTo'
+];
+const owns = (map, key)=>Object.prototype.hasOwnProperty.call(map, key);
+/**
+ * The key an asset's facts are filed under: the reference's own scope and id.
+ *
+ * Deliberately NOT the host-qualified scope a page renders. The document lives
+ * under the scope's owner whichever site places it, and which site may be
+ * shown it is the reader's question, answered once per page.
+ */ export function mediaAssetFactsKey(ref) {
+    return `${ref.scope}/${ref.mediaId}`;
+}
+/**
+ * Where an asset's media document lives: under the scope's OWNER, `orgs/` for
+ * the org library and `hosts/` for a site's own, whichever site places it.
+ * `null` for a scope the CDN would not parse, which no read can answer for.
+ */ export function mediaAssetDocumentPath(ref) {
+    const scope = parseMediaCdnScope(ref.scope);
+    if (!scope) return null;
+    return `${scope.isOrg ? 'orgs' : 'hosts'}/${scope.scopeId}/media/${ref.mediaId}`;
+}
+/**
+ * The facts one read of an asset's document yields for a placement rendered
+ * on `hostId`'s pages, or `undefined` when the placement keeps its stored
+ * props.
+ *
+ * An answer exists only for a document that was read, is live, is not
+ * private, and is visible to that site under the host-qualified scope the page
+ * renders: the verdict the CDN reaches when the browser asks for the bytes.
+ * The URL a page renders names the site doing the rendering
+ * (`resolveMediaSrc`), so visibility is asked of THAT scope, not of the scope
+ * the reference was stored with.
+ */ export function mediaAssetFactsFromDocument(document, ref, hostId) {
+    if (!document) return undefined;
+    if (document.deletedAt || document.private === true) return undefined;
+    const served = parseMediaCdnScope(hostQualifiedScope(ref.scope, hostId));
+    if (!served || mediaCdnScopeRefusal(served, document.visibleTo)) {
+        return undefined;
+    }
+    return {
+        width: document.width,
+        height: document.height,
+        video: document.video,
+        poster: document.poster
+    };
+}
+/** The library asset an Image or Video node places, or null for anything else. */ function placedAsset(node, only) {
+    var _ref;
+    const componentId = node == null ? void 0 : node.componentId;
+    if (componentId !== IMAGE_COMPONENT_ID && componentId !== VIDEO_COMPONENT_ID) {
+        return null;
+    }
+    if (only && componentId !== only) return null;
+    // The precedence every other reader of the composed map uses: a node inside
+    // a repeated collection carries its bound values in the resolved copy.
+    const props = (_ref = node == null ? void 0 : node.resolvedProps) != null ? _ref : node == null ? void 0 : node.props;
+    return parseMediaRef(props == null ? void 0 : props['src']);
+}
+/** A compose-time token the tenant has not substituted — never a document. */ const UNRESOLVED_TOKEN = /^\{\{[^}]+\}\}$/;
+/**
+ * The markdown-lite document a node holds, or `''` for a node holding none.
+ *
+ * `resolvedProps` first, for the reason {@link placedAsset} gives: an entry
+ * body is the literal `{{entry.body}}` in `props` and the entry's real text in
+ * the resolved copy. An unsubstituted token is not a document — it can name no
+ * asset — so it is dropped here rather than walked for images that a canvas
+ * surface would never find.
+ */ function markdownBodyOf(props, componentId) {
+    const prop = componentId && owns(MARKDOWN_BODY_PROPS, componentId) ? MARKDOWN_BODY_PROPS[componentId] : undefined;
+    const text = prop ? props == null ? void 0 : props[prop] : undefined;
+    if (typeof text !== 'string' || UNRESOLVED_TOKEN.test(text.trim())) return '';
+    return text;
+}
+/** See {@link markdownBodyOf} — the body the page will actually render. */ function markdownBody(node) {
+    var _ref;
+    return markdownBodyOf((_ref = node == null ? void 0 : node.resolvedProps) != null ? _ref : node == null ? void 0 : node.props, node == null ? void 0 : node.componentId);
+}
+/**
+ * A markdown-lite image: `![alt](target)`, capturing only the target, and only
+ * up to the first whitespace or `)`.
+ *
+ * That is the whole of the syntax `markdown-lite.ts` accepts — no title string
+ * after the target, no angle-bracket form — so there is nowhere else in a body
+ * for a reference to hide, and matching more than the parser does would name
+ * assets the renderer never asks for.
+ */ const MARKDOWN_IMAGE_TARGET = /!\[[^\]]*\]\(\s*([^)\s]+)/g;
+/**
+ * Every library asset a markdown body's images name, in the order the body
+ * names them, each beside the target EXACTLY as the body wrote it.
+ *
+ * The raw target is carried because that is the key the renderer has: it holds
+ * the parsed block's `src`, the same string, and looking a pair up by it costs
+ * no second parse per image on every render.
+ *
+ * A target that is not a `media:` reference yields nothing — a hotlinked URL
+ * and a legacy stored path have no DAM document to read, and the renderer
+ * gives those today's markup unchanged.
+ */ function markdownImageRefs(text) {
+    if (!text.includes('![')) return [];
+    const found = [];
+    for (const match of text.matchAll(MARKDOWN_IMAGE_TARGET)){
+        const target = match[1];
+        const ref = parseMediaRef(target);
+        if (ref) found.push({
+            target,
+            ref
+        });
+    }
+    return found;
+}
+/**
+ * The map's node ids in document order: depth first from the root through
+ * each node's child ids, then every id the walk never reached (a map with no
+ * root, an orphan) in the order the map lists it. That puts the top of the
+ * page ahead of its footer, and it is the same order for the same map.
+ */ function documentOrder(nodes) {
+    const order = [];
+    const seen = new Set();
+    const stack = owns(nodes, ROOT_NODE_ID) ? [
+        ROOT_NODE_ID
+    ] : [];
+    while(stack.length){
+        var _nodes_id;
+        const id = stack.pop();
+        if (seen.has(id) || !owns(nodes, id)) continue;
+        seen.add(id);
+        order.push(id);
+        const children = (_nodes_id = nodes[id]) == null ? void 0 : _nodes_id.nodes;
+        if (!Array.isArray(children)) continue;
+        for(let index = children.length - 1; index >= 0; index -= 1){
+            const child = children[index];
+            if (typeof child === 'string' && !seen.has(child)) stack.push(child);
+        }
+    }
+    for(const id in nodes)if (!seen.has(id)) order.push(id);
+    return order;
+}
+/**
+ * Every distinct library asset the Image and Video nodes in a map place:
+ * films first, then images, each in document order.
+ *
+ * A read that is capped honors that order. A film goes first because its
+ * stale facts are the worse render (a player of the wrong shape and a
+ * thumbnail that 404s, against a reservation that corrects itself when an
+ * image decodes), and document order covers the top of the page before its
+ * footer.
+ *
+ * `[]` for a page that places none, so a caller that gates its read on the
+ * length spends nothing on it. A pinned and an unpinned reference to one
+ * asset are one entry: a pin names bytes, not a different asset.
+ */ export function mediaAssetRefs(nodes, options = {}) {
+    const refs = [];
+    if (!nodes) return refs;
+    const order = documentOrder(nodes);
+    const seen = new Set();
+    for (const element of [
+        VIDEO_COMPONENT_ID,
+        IMAGE_COMPONENT_ID
+    ]){
+        if (options.only && options.only !== element) continue;
+        for (const id of order){
+            const node = nodes[id];
+            if ((node == null ? void 0 : node.componentId) !== element) continue;
+            const ref = placedAsset(node);
+            if (!ref) continue;
+            const key = mediaAssetFactsKey(ref);
+            if (seen.has(key)) continue;
+            seen.add(key);
+            refs.push(ref);
+        }
+    }
+    // A markdown body's images come LAST, and only when the caller wants every
+    // element (AGL-3149). Last because of what a capped read costs each kind: a
+    // placement that misses out renders at its pick-time pair, a body image that
+    // misses out renders exactly as it does today, and a film that misses out
+    // gets a player of the wrong shape. Only-when-unfiltered because `only` asks
+    // for one ELEMENT's placements, and a body image is not a placement of the
+    // Image element — the video-asset reader would otherwise read image
+    // documents it has no use for.
+    if (options.only) return refs;
+    for (const id of order){
+        const body = markdownBody(nodes[id]);
+        for (const { ref } of markdownImageRefs(body)){
+            const key = mediaAssetFactsKey(ref);
+            if (seen.has(key)) continue;
+            seen.add(key);
+            refs.push(ref);
+        }
+    }
+    return refs;
+}
+const usable = (value)=>typeof value === 'number' && Number.isFinite(value) && value > 0;
+/** A film's props with its asset's facts laid over them. See the module note. */ function withFilmFacts(props, facts) {
+    const live = videoMediaProps({
+        componentId: VIDEO_COMPONENT_ID,
+        propName: 'src',
+        assetVideo: facts.video,
+        assetPoster: facts.poster
+    });
+    const { durationSeconds, intrinsicWidth, intrinsicHeight, posterFromSource: _storedPosterFlag } = props, next = _object_without_properties_loose(props, [
+        "durationSeconds",
+        "intrinsicWidth",
+        "intrinsicHeight",
+        "posterFromSource"
+    ]);
+    // The pick writes a duration only beside the pixel pair, so a pair is what
+    // marks the stored duration as a copy rather than an author's own.
+    const typedByAuthor = !(usable(intrinsicWidth) && usable(intrinsicHeight));
+    if (live.durationSeconds !== undefined) {
+        next['durationSeconds'] = live.durationSeconds;
+    } else if (typedByAuthor && durationSeconds !== undefined) {
+        next['durationSeconds'] = durationSeconds;
+    }
+    if (live.intrinsicWidth !== undefined && live.intrinsicHeight !== undefined) {
+        next['intrinsicWidth'] = live.intrinsicWidth;
+        next['intrinsicHeight'] = live.intrinsicHeight;
+    }
+    if (live.posterFromSource) next['posterFromSource'] = true;
+    return next;
+}
+/**
+ * An image's props with its asset's pair laid over them, or the SAME object
+ * when the document records no usable pair or the stored one already matches.
+ * See the module note.
+ */ function withImageFacts(props, facts) {
+    // Through the pick's own gate, so the overlay and the pick agree on what a
+    // usable pair is: both halves, finite and positive.
+    const live = intrinsicMediaSize({
+        componentId: IMAGE_COMPONENT_ID,
+        propName: 'src',
+        assetWidth: facts.width,
+        assetHeight: facts.height
+    });
+    if (live.intrinsicWidth === undefined || live.intrinsicHeight === undefined) {
+        return props;
+    }
+    if (props['intrinsicWidth'] === live.intrinsicWidth && props['intrinsicHeight'] === live.intrinsicHeight) {
+        return props;
+    }
+    return _extends({}, props, {
+        intrinsicWidth: live.intrinsicWidth,
+        intrinsicHeight: live.intrinsicHeight
+    });
+}
+/**
+ * The prop a markdown body carries its images' pixel pairs in, keyed by the
+ * target the body wrote (AGL-3149).
+ *
+ * A body image is not a node, so it cannot take `intrinsicWidth` and
+ * `intrinsicHeight` the way a placement does; the pairs travel together on the
+ * element that holds the document, and the renderer looks each one up by the
+ * parsed block's `src`.
+ */ export const BODY_IMAGE_SIZES_PROP = 'intrinsicSizes';
+/**
+ * A markdown body's props with a pair for each library image it names, or the
+ * SAME object when no image in it can be answered for.
+ *
+ * Only images whose document records a usable pair get an entry, through the
+ * same {@link intrinsicMediaSize} gate a placement goes through. An image left
+ * out is one the renderer must give today's markup: `srcSet` without the pair
+ * makes `sizes` the image's rendered width, which upscales anything narrower
+ * than the column, so a partial answer is worse here than no answer.
+ */ function withBodyImageFacts(props, componentId, facts) {
+    // THIS object's own body, never the node's resolved one: `props` on a bound
+    // entry body still holds the `{{entry.body}}` token, and pairs for images it
+    // does not name are bytes in the tree that nothing can ever look up.
+    let sizes;
+    for (const { target, ref } of markdownImageRefs(markdownBodyOf(props, componentId))){
+        const found = facts.get(mediaAssetFactsKey(ref));
+        if (!found) continue;
+        const live = intrinsicMediaSize({
+            componentId: IMAGE_COMPONENT_ID,
+            propName: 'src',
+            assetWidth: found.width,
+            assetHeight: found.height
+        });
+        if (live.intrinsicWidth === undefined || live.intrinsicHeight === undefined) {
+            continue;
+        }
+        if (!sizes) sizes = {};
+        sizes[target] = {
+            width: live.intrinsicWidth,
+            height: live.intrinsicHeight
+        };
+    }
+    if (!sizes) return props;
+    return _extends({}, props, {
+        [BODY_IMAGE_SIZES_PROP]: sizes
+    });
+}
+/**
+ * The composed map with each placed asset's facts laid over its node, and each
+ * markdown body's images' pairs laid over the element holding the body.
+ *
+ * `facts` is keyed by {@link mediaAssetFactsKey}. A placement with no entry,
+ * because the reader could not answer for its asset, keeps its stored props.
+ * The SAME map comes back when nothing changes, so a page with no library
+ * asset pays for one walk and no copy, and the input is never mutated either
+ * way.
+ */ export function applyMediaAssetFacts(nodes, facts, options = {}) {
+    if (!facts.size) return nodes;
+    let applied;
+    const write = (id, node, next)=>{
+        if (!applied) applied = _extends({}, nodes);
+        applied[id] = _extends({}, node, next.props ? {
+            props: next.props
+        } : {}, next.resolvedProps ? {
+            resolvedProps: next.resolvedProps
+        } : {});
+    };
+    for(const id in nodes){
+        const node = nodes[id];
+        const ref = placedAsset(node, options.only);
+        const found = ref ? facts.get(mediaAssetFactsKey(ref)) : undefined;
+        if (found) {
+            const overlay = node.componentId === VIDEO_COMPONENT_ID ? withFilmFacts : withImageFacts;
+            const props = node.props && overlay(node.props, found);
+            const resolvedProps = node.resolvedProps && overlay(node.resolvedProps, found);
+            if (props === node.props && resolvedProps === node.resolvedProps) continue;
+            write(id, node, {
+                props,
+                resolvedProps
+            });
+            continue;
+        }
+        // A markdown body, under the same `only` rule `mediaAssetRefs` collects
+        // under: a body image is not a placement of the Image element, so a reader
+        // asking for one element's placements is not asking about bodies.
+        if (options.only) continue;
+        const { componentId } = node;
+        if (!componentId || !owns(MARKDOWN_BODY_PROPS, componentId)) continue;
+        const props = node.props && withBodyImageFacts(node.props, componentId, facts);
+        const resolvedProps = node.resolvedProps && withBodyImageFacts(node.resolvedProps, componentId, facts);
+        if (props === node.props && resolvedProps === node.resolvedProps) continue;
+        write(id, node, {
+            props,
+            resolvedProps
+        });
+    }
+    return applied ? applied : nodes;
+}
+
+//# sourceMappingURL=media-asset-facts.js.map

package/src/lib/app-utils/media-asset-facts.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../libs/aglyn/src/lib/app-utils/media-asset-facts.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * What a placed library asset is NOW, read from its DAM document when the\n * page is composed rather than copied onto the node when it was picked: a\n * film's length, shape and poster (AGL-2807), and an image's pixel pair\n * (AGL-2833).\n *\n * ## Why the pick-time copy is not enough\n *\n * Picking a library asset copies facts onto the node. An image gets its pixel\n * pair ({@link intrinsicMediaSize}), which `image.tsx` renders as the\n * `<img>`'s `width`/`height` attributes so the browser can reserve the box\n * before the bytes arrive. A film gets its running time, its frame's pair and\n * a poster flag ({@link videoMediaProps}): the pair becomes the player's CSS\n * `aspect-ratio`, the running time becomes `VideoObject.duration`, and the\n * flag decides whether a lightbox `<img>` and a `thumbnailUrl` exist at all.\n *\n * A replace (AGL-2732) keeps the asset's id and URL and rewrites its document:\n * an image's `width`/`height`, a film's `video` and `poster` records. It\n * cannot rewrite the nodes, which sit in every screen, layout, component and\n * published version that places the asset. So after a replace with a\n * different shape, every page placing the image reserved the previous\n * picture's box and shifted when the new one decoded, and every page placing\n * the film kept the previous film's length and shape, until someone re-picked\n * it.\n *\n * ## The rule\n *\n * Two surfaces read each placed asset's document and lay what it records over\n * the node here: the tenant's composition, for the page a visitor gets\n * (`libs/tenant/runtime/src/lib/get-media-asset-facts.ts`), and the console,\n * for the besigner canvas an author edits and the Preview that checks it\n * (AGL-2838, AGL-2849). Both decide what a read answers through\n * {@link mediaAssetFactsFromDocument}, so the editor cannot disagree with the\n * page about which assets answer. When the asset cannot be answered for (a\n * failed or pending read, a missing or deleted document, an asset the CDN\n * would not serve under this page's URL, one past the composition's cap), the\n * node keeps what the pick stored. That is the render every page had before\n * this, never a worse one. When the asset answers:\n *\n * - **A film's facts win, including their ABSENCE.** A film the replace left\n *   with no `video` record has no known shape, so a stored pair describing\n *   the previous film is dropped rather than published, and a poster flag the\n *   document no longer backs is dropped with it. One stored value survives: a\n *   running time the AUTHOR typed for a film the DAM has no running time for.\n *   The pick only ever writes the duration together with the pixel pair\n *   ({@link videoMediaProps} is all-or-nothing on the `video` record), and the\n *   pair is not an author control. So a duration standing alone is an\n *   author's, and a duration standing beside a pair is a copy of a film that\n *   may no longer be the one in the bucket.\n * - **An image's pair wins when the document records one.** When it records\n *   none (an SVG, which the upload cannot measure, or a file older than\n *   AGL-173), the stored pair stays, whether an author typed it through the\n *   API or it is a copy of the file the asset held before. The asymmetry with\n *   a film is in the render, not the data. A film's pair is the player's\n *   permanent box, but an image's is only a reservation\n *   (`aspect-ratio: auto w / h`), which the decoded picture's own ratio\n *   replaces. Dropping the pair guarantees a shift of the image's full height\n *   on every view. A stale pair shifts by the difference between two heights,\n *   and a pair typed for a file the DAM cannot measure shifts by nothing.\n *\n * Nothing an author sets for the placement is touched: an image's CSS\n * `width` and `height`, its fit and radius, and a film's own poster describe\n * the placement rather than the file.\n *\n * Imported by path and never through a barrel: every `@aglyn/aglyn` barrel\n * ships to published pages, and nothing here has a reason to reach one, so\n * the composition and the console both import this module by path.\n */\n\nimport { CANVAS_ROOT_ELEMENT_ID } from '../foundation/constants/canvas'\nimport { mediaCdnScopeRefusal, parseMediaCdnScope } from './media-cdn-scope'\nimport { intrinsicMediaSize, videoMediaProps } from './media-metadata'\nimport { hostQualifiedScope, type MediaRef, parseMediaRef } from './media-ref'\nimport { VIDEO_COMPONENT_ID } from './video-object'\n\n/** The Image element's persisted component id (`image.tsx`), never renamed. */\nexport const IMAGE_COMPONENT_ID = 'image'\n\n/**\n * The prop each element that holds a markdown-lite DOCUMENT keeps it in, and\n * therefore every element whose body can name a library image (AGL-3149).\n *\n * The same two elements and the same two prop names `resolveMarkdownSource`\n * walks for a table of contents (AGL-1162), which is the other reader of a\n * body's contents. They differ: the Markdown element calls it `content` and a\n * collection entry's body calls it `markdown`.\n *\n * Both ids are spelled out rather than imported. `markdown` belongs to a\n * plugin, which core may never import; `collectionEntryBody` is exported by\n * `collection-entries.ts`, but that module is 1,860 lines and drags\n * `content-authors.ts` behind it, and this one is deliberately outside the\n * barrel that ships to published pages. A persisted component id is a string\n * that cannot change — renaming one orphans every document that stores it —\n * so the copy cannot drift in the way an imported value would protect against.\n */\nconst MARKDOWN_BODY_PROPS: Readonly<Record<string, string>> = {\n  markdown: 'content',\n  collectionEntryBody: 'markdown',\n}\n\n/** The root of a composed map, where a walk in document order starts. */\nconst ROOT_NODE_ID: string = CANVAS_ROOT_ELEMENT_ID\n\n/**\n * What a readable asset's media document records, as the overlay consumes it.\n *\n * Raw on purpose: {@link intrinsicMediaSize} and {@link videoMediaProps} are\n * where a pair and a `video` record are bounded, and a second reading of the\n * same numbers here is how two files come to disagree about what a partial\n * record means.\n */\nexport interface MediaAssetFacts {\n  /** The document's `width`: an image's, read from its bytes at upload. */\n  width?: unknown\n  /** The document's `height`, the other half of {@link width}. */\n  height?: unknown\n  /** The document's `video` record: `durationMs`, `width` and `height`. */\n  video?: unknown\n  /** The document's generated `poster` record, when it has one. */\n  poster?: unknown\n}\n\n/**\n * Every field an asset's facts are decided from, and the projection a reader\n * asks Firestore for: ONE list, whichever surface reads. `width` and `height`\n * (an image's) and `video` and `poster` (a film's) are the facts. The other\n * three are the gates `serveMediaCdn` applies before it will serve an asset at\n * all, so no surface shows the shape of a file its page's URL refuses.\n */\nexport const MEDIA_ASSET_FACT_FIELDS = [\n  'width',\n  'height',\n  'video',\n  'poster',\n  'deletedAt',\n  'private',\n  'visibleTo',\n] as const\n\n/** An asset's media document, as far as {@link MEDIA_ASSET_FACT_FIELDS} reach. */\nexport type MediaAssetDocument = Partial<\n  Record<(typeof MEDIA_ASSET_FACT_FIELDS)[number], unknown>\n>\n\n/** The elements whose placements follow their file. */\nexport type MediaAssetElement =\n  | typeof IMAGE_COMPONENT_ID\n  | typeof VIDEO_COMPONENT_ID\n\nexport interface MediaAssetFactsOptions {\n  /**\n   * One element's placements only, by persisted component id. Absent means\n   * both, which is what the composition asks for.\n   */\n  only?: MediaAssetElement\n}\n\n/** A node as the composed map holds it: flat, children by id. */\ninterface ComposedMediaNode {\n  componentId?: string\n  nodes?: unknown\n  props?: Record<string, unknown>\n  resolvedProps?: Record<string, unknown>\n}\n\nconst owns = (map: object, key: string) =>\n  Object.prototype.hasOwnProperty.call(map, key)\n\n/**\n * The key an asset's facts are filed under: the reference's own scope and id.\n *\n * Deliberately NOT the host-qualified scope a page renders. The document lives\n * under the scope's owner whichever site places it, and which site may be\n * shown it is the reader's question, answered once per page.\n */\nexport function mediaAssetFactsKey(\n  ref: Pick<MediaRef, 'scope' | 'mediaId'>,\n): string {\n  return `${ref.scope}/${ref.mediaId}`\n}\n\n/**\n * Where an asset's media document lives: under the scope's OWNER, `orgs/` for\n * the org library and `hosts/` for a site's own, whichever site places it.\n * `null` for a scope the CDN would not parse, which no read can answer for.\n */\nexport function mediaAssetDocumentPath(\n  ref: Pick<MediaRef, 'scope' | 'mediaId'>,\n): string | null {\n  const scope = parseMediaCdnScope(ref.scope)\n  if (!scope) return null\n  return `${scope.isOrg ? 'orgs' : 'hosts'}/${scope.scopeId}/media/${ref.mediaId}`\n}\n\n/**\n * The facts one read of an asset's document yields for a placement rendered\n * on `hostId`'s pages, or `undefined` when the placement keeps its stored\n * props.\n *\n * An answer exists only for a document that was read, is live, is not\n * private, and is visible to that site under the host-qualified scope the page\n * renders: the verdict the CDN reaches when the browser asks for the bytes.\n * The URL a page renders names the site doing the rendering\n * (`resolveMediaSrc`), so visibility is asked of THAT scope, not of the scope\n * the reference was stored with.\n */\nexport function mediaAssetFactsFromDocument(\n  document: MediaAssetDocument | null | undefined,\n  ref: Pick<MediaRef, 'scope'>,\n  hostId: string,\n): MediaAssetFacts | undefined {\n  if (!document) return undefined\n  if (document.deletedAt || document.private === true) return undefined\n  const served = parseMediaCdnScope(hostQualifiedScope(ref.scope, hostId))\n  if (!served || mediaCdnScopeRefusal(served, document.visibleTo)) {\n    return undefined\n  }\n  return {\n    width: document.width,\n    height: document.height,\n    video: document.video,\n    poster: document.poster,\n  }\n}\n\n/** The library asset an Image or Video node places, or null for anything else. */\nfunction placedAsset(\n  node: ComposedMediaNode | null | undefined,\n  only?: MediaAssetElement,\n): MediaRef | null {\n  const componentId = node?.componentId\n  if (componentId !== IMAGE_COMPONENT_ID && componentId !== VIDEO_COMPONENT_ID) {\n    return null\n  }\n  if (only && componentId !== only) return null\n  // The precedence every other reader of the composed map uses: a node inside\n  // a repeated collection carries its bound values in the resolved copy.\n  const props = node?.resolvedProps ?? node?.props\n  return parseMediaRef(props?.['src'])\n}\n\n/** A compose-time token the tenant has not substituted — never a document. */\nconst UNRESOLVED_TOKEN = /^\\{\\{[^}]+\\}\\}$/\n\n/**\n * The markdown-lite document a node holds, or `''` for a node holding none.\n *\n * `resolvedProps` first, for the reason {@link placedAsset} gives: an entry\n * body is the literal `{{entry.body}}` in `props` and the entry's real text in\n * the resolved copy. An unsubstituted token is not a document — it can name no\n * asset — so it is dropped here rather than walked for images that a canvas\n * surface would never find.\n */\nfunction markdownBodyOf(\n  props: Record<string, unknown> | undefined,\n  componentId: string | undefined,\n): string {\n  const prop =\n    componentId && owns(MARKDOWN_BODY_PROPS, componentId)\n      ? MARKDOWN_BODY_PROPS[componentId]\n      : undefined\n  const text = prop ? props?.[prop] : undefined\n  if (typeof text !== 'string' || UNRESOLVED_TOKEN.test(text.trim())) return ''\n  return text\n}\n\n/** See {@link markdownBodyOf} — the body the page will actually render. */\nfunction markdownBody(node: ComposedMediaNode | null | undefined): string {\n  return markdownBodyOf(\n    node?.resolvedProps ?? node?.props,\n    node?.componentId,\n  )\n}\n\n/**\n * A markdown-lite image: `![alt](target)`, capturing only the target, and only\n * up to the first whitespace or `)`.\n *\n * That is the whole of the syntax `markdown-lite.ts` accepts — no title string\n * after the target, no angle-bracket form — so there is nowhere else in a body\n * for a reference to hide, and matching more than the parser does would name\n * assets the renderer never asks for.\n */\nconst MARKDOWN_IMAGE_TARGET = /!\\[[^\\]]*\\]\\(\\s*([^)\\s]+)/g\n\n/**\n * Every library asset a markdown body's images name, in the order the body\n * names them, each beside the target EXACTLY as the body wrote it.\n *\n * The raw target is carried because that is the key the renderer has: it holds\n * the parsed block's `src`, the same string, and looking a pair up by it costs\n * no second parse per image on every render.\n *\n * A target that is not a `media:` reference yields nothing — a hotlinked URL\n * and a legacy stored path have no DAM document to read, and the renderer\n * gives those today's markup unchanged.\n */\nfunction markdownImageRefs(\n  text: string,\n): Array<{ target: string; ref: MediaRef }> {\n  if (!text.includes('![')) return []\n  const found: Array<{ target: string; ref: MediaRef }> = []\n  for (const match of text.matchAll(MARKDOWN_IMAGE_TARGET)) {\n    const target = match[1]\n    const ref = parseMediaRef(target)\n    if (ref) found.push({ target, ref })\n  }\n  return found\n}\n\n/**\n * The map's node ids in document order: depth first from the root through\n * each node's child ids, then every id the walk never reached (a map with no\n * root, an orphan) in the order the map lists it. That puts the top of the\n * page ahead of its footer, and it is the same order for the same map.\n */\nfunction documentOrder(nodes: Record<string, unknown>): string[] {\n  const order: string[] = []\n  const seen = new Set<string>()\n  const stack = owns(nodes, ROOT_NODE_ID) ? [ROOT_NODE_ID] : []\n  while (stack.length) {\n    const id = stack.pop() as string\n    if (seen.has(id) || !owns(nodes, id)) continue\n    seen.add(id)\n    order.push(id)\n    const children = (nodes[id] as ComposedMediaNode | null)?.nodes\n    if (!Array.isArray(children)) continue\n    for (let index = children.length - 1; index >= 0; index -= 1) {\n      const child = children[index]\n      if (typeof child === 'string' && !seen.has(child)) stack.push(child)\n    }\n  }\n  for (const id in nodes) if (!seen.has(id)) order.push(id)\n  return order\n}\n\n/**\n * Every distinct library asset the Image and Video nodes in a map place:\n * films first, then images, each in document order.\n *\n * A read that is capped honors that order. A film goes first because its\n * stale facts are the worse render (a player of the wrong shape and a\n * thumbnail that 404s, against a reservation that corrects itself when an\n * image decodes), and document order covers the top of the page before its\n * footer.\n *\n * `[]` for a page that places none, so a caller that gates its read on the\n * length spends nothing on it. A pinned and an unpinned reference to one\n * asset are one entry: a pin names bytes, not a different asset.\n */\nexport function mediaAssetRefs(\n  nodes: Record<string, unknown> | null | undefined,\n  options: MediaAssetFactsOptions = {},\n): MediaRef[] {\n  const refs: MediaRef[] = []\n  if (!nodes) return refs\n  const order = documentOrder(nodes)\n  const seen = new Set<string>()\n  for (const element of [VIDEO_COMPONENT_ID, IMAGE_COMPONENT_ID] as const) {\n    if (options.only && options.only !== element) continue\n    for (const id of order) {\n      const node = nodes[id] as ComposedMediaNode | null\n      if (node?.componentId !== element) continue\n      const ref = placedAsset(node)\n      if (!ref) continue\n      const key = mediaAssetFactsKey(ref)\n      if (seen.has(key)) continue\n      seen.add(key)\n      refs.push(ref)\n    }\n  }\n  // A markdown body's images come LAST, and only when the caller wants every\n  // element (AGL-3149). Last because of what a capped read costs each kind: a\n  // placement that misses out renders at its pick-time pair, a body image that\n  // misses out renders exactly as it does today, and a film that misses out\n  // gets a player of the wrong shape. Only-when-unfiltered because `only` asks\n  // for one ELEMENT's placements, and a body image is not a placement of the\n  // Image element — the video-asset reader would otherwise read image\n  // documents it has no use for.\n  if (options.only) return refs\n  for (const id of order) {\n    const body = markdownBody(nodes[id] as ComposedMediaNode | null)\n    for (const { ref } of markdownImageRefs(body)) {\n      const key = mediaAssetFactsKey(ref)\n      if (seen.has(key)) continue\n      seen.add(key)\n      refs.push(ref)\n    }\n  }\n  return refs\n}\n\nconst usable = (value: unknown): value is number =>\n  typeof value === 'number' && Number.isFinite(value) && value > 0\n\n/** A film's props with its asset's facts laid over them. See the module note. */\nfunction withFilmFacts(\n  props: Record<string, unknown>,\n  facts: MediaAssetFacts,\n): Record<string, unknown> {\n  const live = videoMediaProps({\n    componentId: VIDEO_COMPONENT_ID,\n    propName: 'src',\n    assetVideo: facts.video,\n    assetPoster: facts.poster,\n  })\n  const {\n    durationSeconds,\n    intrinsicWidth,\n    intrinsicHeight,\n    posterFromSource: _storedPosterFlag,\n    ...next\n  } = props\n  // The pick writes a duration only beside the pixel pair, so a pair is what\n  // marks the stored duration as a copy rather than an author's own.\n  const typedByAuthor = !(usable(intrinsicWidth) && usable(intrinsicHeight))\n  if (live.durationSeconds !== undefined) {\n    next['durationSeconds'] = live.durationSeconds\n  } else if (typedByAuthor && durationSeconds !== undefined) {\n    next['durationSeconds'] = durationSeconds\n  }\n  if (live.intrinsicWidth !== undefined && live.intrinsicHeight !== undefined) {\n    next['intrinsicWidth'] = live.intrinsicWidth\n    next['intrinsicHeight'] = live.intrinsicHeight\n  }\n  if (live.posterFromSource) next['posterFromSource'] = true\n  return next\n}\n\n/**\n * An image's props with its asset's pair laid over them, or the SAME object\n * when the document records no usable pair or the stored one already matches.\n * See the module note.\n */\nfunction withImageFacts(\n  props: Record<string, unknown>,\n  facts: MediaAssetFacts,\n): Record<string, unknown> {\n  // Through the pick's own gate, so the overlay and the pick agree on what a\n  // usable pair is: both halves, finite and positive.\n  const live = intrinsicMediaSize({\n    componentId: IMAGE_COMPONENT_ID,\n    propName: 'src',\n    assetWidth: facts.width,\n    assetHeight: facts.height,\n  })\n  if (live.intrinsicWidth === undefined || live.intrinsicHeight === undefined) {\n    return props\n  }\n  if (\n    props['intrinsicWidth'] === live.intrinsicWidth &&\n    props['intrinsicHeight'] === live.intrinsicHeight\n  ) {\n    return props\n  }\n  return {\n    ...props,\n    intrinsicWidth: live.intrinsicWidth,\n    intrinsicHeight: live.intrinsicHeight,\n  }\n}\n\n/**\n * The prop a markdown body carries its images' pixel pairs in, keyed by the\n * target the body wrote (AGL-3149).\n *\n * A body image is not a node, so it cannot take `intrinsicWidth` and\n * `intrinsicHeight` the way a placement does; the pairs travel together on the\n * element that holds the document, and the renderer looks each one up by the\n * parsed block's `src`.\n */\nexport const BODY_IMAGE_SIZES_PROP = 'intrinsicSizes'\n\n/** One body image's pair, as {@link BODY_IMAGE_SIZES_PROP} carries it. */\nexport interface BodyImageSize {\n  width: number\n  height: number\n}\n\n/**\n * A markdown body's props with a pair for each library image it names, or the\n * SAME object when no image in it can be answered for.\n *\n * Only images whose document records a usable pair get an entry, through the\n * same {@link intrinsicMediaSize} gate a placement goes through. An image left\n * out is one the renderer must give today's markup: `srcSet` without the pair\n * makes `sizes` the image's rendered width, which upscales anything narrower\n * than the column, so a partial answer is worse here than no answer.\n */\nfunction withBodyImageFacts(\n  props: Record<string, unknown>,\n  componentId: string | undefined,\n  facts: ReadonlyMap<string, MediaAssetFacts>,\n): Record<string, unknown> {\n  // THIS object's own body, never the node's resolved one: `props` on a bound\n  // entry body still holds the `{{entry.body}}` token, and pairs for images it\n  // does not name are bytes in the tree that nothing can ever look up.\n  let sizes: Record<string, BodyImageSize> | undefined\n  for (const { target, ref } of markdownImageRefs(\n    markdownBodyOf(props, componentId),\n  )) {\n    const found = facts.get(mediaAssetFactsKey(ref))\n    if (!found) continue\n    const live = intrinsicMediaSize({\n      componentId: IMAGE_COMPONENT_ID,\n      propName: 'src',\n      assetWidth: found.width,\n      assetHeight: found.height,\n    })\n    if (\n      live.intrinsicWidth === undefined ||\n      live.intrinsicHeight === undefined\n    ) {\n      continue\n    }\n    if (!sizes) sizes = {}\n    sizes[target] = {\n      width: live.intrinsicWidth,\n      height: live.intrinsicHeight,\n    }\n  }\n  if (!sizes) return props\n  return { ...props, [BODY_IMAGE_SIZES_PROP]: sizes }\n}\n\n/**\n * The composed map with each placed asset's facts laid over its node, and each\n * markdown body's images' pairs laid over the element holding the body.\n *\n * `facts` is keyed by {@link mediaAssetFactsKey}. A placement with no entry,\n * because the reader could not answer for its asset, keeps its stored props.\n * The SAME map comes back when nothing changes, so a page with no library\n * asset pays for one walk and no copy, and the input is never mutated either\n * way.\n */\nexport function applyMediaAssetFacts<T extends Record<string, unknown>>(\n  nodes: T,\n  facts: ReadonlyMap<string, MediaAssetFacts>,\n  options: MediaAssetFactsOptions = {},\n): T {\n  if (!facts.size) return nodes\n  let applied: Record<string, unknown> | undefined\n  const write = (id: string, node: ComposedMediaNode, next: {\n    props?: Record<string, unknown>\n    resolvedProps?: Record<string, unknown>\n  }): void => {\n    if (!applied) applied = { ...nodes }\n    applied[id] = {\n      ...node,\n      ...(next.props ? { props: next.props } : {}),\n      ...(next.resolvedProps ? { resolvedProps: next.resolvedProps } : {}),\n    }\n  }\n  for (const id in nodes) {\n    const node = nodes[id] as ComposedMediaNode\n    const ref = placedAsset(node, options.only)\n    const found = ref ? facts.get(mediaAssetFactsKey(ref)) : undefined\n    if (found) {\n      const overlay =\n        node.componentId === VIDEO_COMPONENT_ID ? withFilmFacts : withImageFacts\n      const props = node.props && overlay(node.props, found)\n      const resolvedProps =\n        node.resolvedProps && overlay(node.resolvedProps, found)\n      if (props === node.props && resolvedProps === node.resolvedProps) continue\n      write(id, node, { props, resolvedProps })\n      continue\n    }\n    // A markdown body, under the same `only` rule `mediaAssetRefs` collects\n    // under: a body image is not a placement of the Image element, so a reader\n    // asking for one element's placements is not asking about bodies.\n    if (options.only) continue\n    const { componentId } = node\n    if (!componentId || !owns(MARKDOWN_BODY_PROPS, componentId)) continue\n    const props =\n      node.props && withBodyImageFacts(node.props, componentId, facts)\n    const resolvedProps =\n      node.resolvedProps &&\n      withBodyImageFacts(node.resolvedProps, componentId, facts)\n    if (props === node.props && resolvedProps === node.resolvedProps) continue\n    write(id, node, { props, resolvedProps })\n  }\n  return applied ? (applied as T) : nodes\n}\n"],"names":["CANVAS_ROOT_ELEMENT_ID","mediaCdnScopeRefusal","parseMediaCdnScope","intrinsicMediaSize","videoMediaProps","hostQualifiedScope","parseMediaRef","VIDEO_COMPONENT_ID","IMAGE_COMPONENT_ID","MARKDOWN_BODY_PROPS","markdown","collectionEntryBody","ROOT_NODE_ID","MEDIA_ASSET_FACT_FIELDS","owns","map","key","Object","prototype","hasOwnProperty","call","mediaAssetFactsKey","ref","scope","mediaId","mediaAssetDocumentPath","isOrg","scopeId","mediaAssetFactsFromDocument","document","hostId","undefined","deletedAt","private","served","visibleTo","width","height","video","poster","placedAsset","node","only","componentId","props","resolvedProps","UNRESOLVED_TOKEN","markdownBodyOf","prop","text","test","trim","markdownBody","MARKDOWN_IMAGE_TARGET","markdownImageRefs","includes","found","match","matchAll","target","push","documentOrder","nodes","order","seen","Set","stack","length","id","pop","has","add","children","Array","isArray","index","child","mediaAssetRefs","options","refs","element","body","usable","value","Number","isFinite","withFilmFacts","facts","live","propName","assetVideo","assetPoster","durationSeconds","intrinsicWidth","intrinsicHeight","posterFromSource","_storedPosterFlag","next","typedByAuthor","withImageFacts","assetWidth","assetHeight","BODY_IMAGE_SIZES_PROP","withBodyImageFacts","sizes","get","applyMediaAssetFacts","size","applied","write","overlay"],"mappings":";;AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAmEC,GAED,SAASA,sBAAsB,QAAQ,oCAAgC;AACvE,SAASC,oBAAoB,EAAEC,kBAAkB,QAAQ,uBAAmB;AAC5E,SAASC,kBAAkB,EAAEC,eAAe,QAAQ,sBAAkB;AACtE,SAASC,kBAAkB,EAAiBC,aAAa,QAAQ,iBAAa;AAC9E,SAASC,kBAAkB,QAAQ,oBAAgB;AAEnD,6EAA6E,GAC7E,OAAO,MAAMC,qBAAqB,QAAO;AAEzC;;;;;;;;;;;;;;;;CAgBC,GACD,MAAMC,sBAAwD;IAC5DC,UAAU;IACVC,qBAAqB;AACvB;AAEA,uEAAuE,GACvE,MAAMC,eAAuBZ;AAqB7B;;;;;;CAMC,GACD,OAAO,MAAMa,0BAA0B;IACrC;IACA;IACA;IACA;IACA;IACA;IACA;CACD,CAAS;AA4BV,MAAMC,OAAO,CAACC,KAAaC,MACzBC,OAAOC,SAAS,CAACC,cAAc,CAACC,IAAI,CAACL,KAAKC;AAE5C;;;;;;CAMC,GACD,OAAO,SAASK,mBACdC,GAAwC;IAExC,OAAO,GAAGA,IAAIC,KAAK,CAAC,CAAC,EAAED,IAAIE,OAAO,EAAE;AACtC;AAEA;;;;CAIC,GACD,OAAO,SAASC,uBACdH,GAAwC;IAExC,MAAMC,QAAQrB,mBAAmBoB,IAAIC,KAAK;IAC1C,IAAI,CAACA,OAAO,OAAO;IACnB,OAAO,GAAGA,MAAMG,KAAK,GAAG,SAAS,QAAQ,CAAC,EAAEH,MAAMI,OAAO,CAAC,OAAO,EAAEL,IAAIE,OAAO,EAAE;AAClF;AAEA;;;;;;;;;;;CAWC,GACD,OAAO,SAASI,4BACdC,QAA+C,EAC/CP,GAA4B,EAC5BQ,MAAc;IAEd,IAAI,CAACD,UAAU,OAAOE;IACtB,IAAIF,SAASG,SAAS,IAAIH,SAASI,OAAO,KAAK,MAAM,OAAOF;IAC5D,MAAMG,SAAShC,mBAAmBG,mBAAmBiB,IAAIC,KAAK,EAAEO;IAChE,IAAI,CAACI,UAAUjC,qBAAqBiC,QAAQL,SAASM,SAAS,GAAG;QAC/D,OAAOJ;IACT;IACA,OAAO;QACLK,OAAOP,SAASO,KAAK;QACrBC,QAAQR,SAASQ,MAAM;QACvBC,OAAOT,SAASS,KAAK;QACrBC,QAAQV,SAASU,MAAM;IACzB;AACF;AAEA,gFAAgF,GAChF,SAASC,YACPC,IAA0C,EAC1CC,IAAwB;;IAExB,MAAMC,cAAcF,wBAAAA,KAAME,WAAW;IACrC,IAAIA,gBAAgBnC,sBAAsBmC,gBAAgBpC,oBAAoB;QAC5E,OAAO;IACT;IACA,IAAImC,QAAQC,gBAAgBD,MAAM,OAAO;IACzC,4EAA4E;IAC5E,uEAAuE;IACvE,MAAME,gBAAQH,wBAAAA,KAAMI,aAAa,mBAAIJ,wBAAAA,KAAMG,KAAK;IAChD,OAAOtC,cAAcsC,yBAAAA,KAAO,CAAC,MAAM;AACrC;AAEA,4EAA4E,GAC5E,MAAME,mBAAmB;AAEzB;;;;;;;;CAQC,GACD,SAASC,eACPH,KAA0C,EAC1CD,WAA+B;IAE/B,MAAMK,OACJL,eAAe7B,KAAKL,qBAAqBkC,eACrClC,mBAAmB,CAACkC,YAAY,GAChCZ;IACN,MAAMkB,OAAOD,OAAOJ,yBAAAA,KAAO,CAACI,KAAK,GAAGjB;IACpC,IAAI,OAAOkB,SAAS,YAAYH,iBAAiBI,IAAI,CAACD,KAAKE,IAAI,KAAK,OAAO;IAC3E,OAAOF;AACT;AAEA,yEAAyE,GACzE,SAASG,aAAaX,IAA0C;;IAC9D,OAAOM,uBACLN,wBAAAA,KAAMI,aAAa,mBAAIJ,wBAAAA,KAAMG,KAAK,EAClCH,wBAAAA,KAAME,WAAW;AAErB;AAEA;;;;;;;;CAQC,GACD,MAAMU,wBAAwB;AAE9B;;;;;;;;;;;CAWC,GACD,SAASC,kBACPL,IAAY;IAEZ,IAAI,CAACA,KAAKM,QAAQ,CAAC,OAAO,OAAO,EAAE;IACnC,MAAMC,QAAkD,EAAE;IAC1D,KAAK,MAAMC,SAASR,KAAKS,QAAQ,CAACL,uBAAwB;QACxD,MAAMM,SAASF,KAAK,CAAC,EAAE;QACvB,MAAMnC,MAAMhB,cAAcqD;QAC1B,IAAIrC,KAAKkC,MAAMI,IAAI,CAAC;YAAED;YAAQrC;QAAI;IACpC;IACA,OAAOkC;AACT;AAEA;;;;;CAKC,GACD,SAASK,cAAcC,KAA8B;IACnD,MAAMC,QAAkB,EAAE;IAC1B,MAAMC,OAAO,IAAIC;IACjB,MAAMC,QAAQpD,KAAKgD,OAAOlD,gBAAgB;QAACA;KAAa,GAAG,EAAE;IAC7D,MAAOsD,MAAMC,MAAM,CAAE;YAKDL;QAJlB,MAAMM,KAAKF,MAAMG,GAAG;QACpB,IAAIL,KAAKM,GAAG,CAACF,OAAO,CAACtD,KAAKgD,OAAOM,KAAK;QACtCJ,KAAKO,GAAG,CAACH;QACTL,MAAMH,IAAI,CAACQ;QACX,MAAMI,YAAYV,YAAAA,KAAK,CAACM,GAAG,qBAAV,AAACN,UAAwCA,KAAK;QAC/D,IAAI,CAACW,MAAMC,OAAO,CAACF,WAAW;QAC9B,IAAK,IAAIG,QAAQH,SAASL,MAAM,GAAG,GAAGQ,SAAS,GAAGA,SAAS,EAAG;YAC5D,MAAMC,QAAQJ,QAAQ,CAACG,MAAM;YAC7B,IAAI,OAAOC,UAAU,YAAY,CAACZ,KAAKM,GAAG,CAACM,QAAQV,MAAMN,IAAI,CAACgB;QAChE;IACF;IACA,IAAK,MAAMR,MAAMN,MAAO,IAAI,CAACE,KAAKM,GAAG,CAACF,KAAKL,MAAMH,IAAI,CAACQ;IACtD,OAAOL;AACT;AAEA;;;;;;;;;;;;;CAaC,GACD,OAAO,SAASc,eACdf,KAAiD,EACjDgB,UAAkC,CAAC,CAAC;IAEpC,MAAMC,OAAmB,EAAE;IAC3B,IAAI,CAACjB,OAAO,OAAOiB;IACnB,MAAMhB,QAAQF,cAAcC;IAC5B,MAAME,OAAO,IAAIC;IACjB,KAAK,MAAMe,WAAW;QAACzE;QAAoBC;KAAmB,CAAW;QACvE,IAAIsE,QAAQpC,IAAI,IAAIoC,QAAQpC,IAAI,KAAKsC,SAAS;QAC9C,KAAK,MAAMZ,MAAML,MAAO;YACtB,MAAMtB,OAAOqB,KAAK,CAACM,GAAG;YACtB,IAAI3B,CAAAA,wBAAAA,KAAME,WAAW,MAAKqC,SAAS;YACnC,MAAM1D,MAAMkB,YAAYC;YACxB,IAAI,CAACnB,KAAK;YACV,MAAMN,MAAMK,mBAAmBC;YAC/B,IAAI0C,KAAKM,GAAG,CAACtD,MAAM;YACnBgD,KAAKO,GAAG,CAACvD;YACT+D,KAAKnB,IAAI,CAACtC;QACZ;IACF;IACA,2EAA2E;IAC3E,4EAA4E;IAC5E,6EAA6E;IAC7E,0EAA0E;IAC1E,6EAA6E;IAC7E,2EAA2E;IAC3E,oEAAoE;IACpE,+BAA+B;IAC/B,IAAIwD,QAAQpC,IAAI,EAAE,OAAOqC;IACzB,KAAK,MAAMX,MAAML,MAAO;QACtB,MAAMkB,OAAO7B,aAAaU,KAAK,CAACM,GAAG;QACnC,KAAK,MAAM,EAAE9C,GAAG,EAAE,IAAIgC,kBAAkB2B,MAAO;YAC7C,MAAMjE,MAAMK,mBAAmBC;YAC/B,IAAI0C,KAAKM,GAAG,CAACtD,MAAM;YACnBgD,KAAKO,GAAG,CAACvD;YACT+D,KAAKnB,IAAI,CAACtC;QACZ;IACF;IACA,OAAOyD;AACT;AAEA,MAAMG,SAAS,CAACC,QACd,OAAOA,UAAU,YAAYC,OAAOC,QAAQ,CAACF,UAAUA,QAAQ;AAEjE,+EAA+E,GAC/E,SAASG,cACP1C,KAA8B,EAC9B2C,KAAsB;IAEtB,MAAMC,OAAOpF,gBAAgB;QAC3BuC,aAAapC;QACbkF,UAAU;QACVC,YAAYH,MAAMjD,KAAK;QACvBqD,aAAaJ,MAAMhD,MAAM;IAC3B;IACA,MAAM,EACJqD,eAAe,EACfC,cAAc,EACdC,eAAe,EACfC,kBAAkBC,iBAAiB,EAEpC,GAAGpD,OADCqD,wCACDrD;;;;;;IACJ,2EAA2E;IAC3E,mEAAmE;IACnE,MAAMsD,gBAAgB,CAAEhB,CAAAA,OAAOW,mBAAmBX,OAAOY,gBAAe;IACxE,IAAIN,KAAKI,eAAe,KAAK7D,WAAW;QACtCkE,IAAI,CAAC,kBAAkB,GAAGT,KAAKI,eAAe;IAChD,OAAO,IAAIM,iBAAiBN,oBAAoB7D,WAAW;QACzDkE,IAAI,CAAC,kBAAkB,GAAGL;IAC5B;IACA,IAAIJ,KAAKK,cAAc,KAAK9D,aAAayD,KAAKM,eAAe,KAAK/D,WAAW;QAC3EkE,IAAI,CAAC,iBAAiB,GAAGT,KAAKK,cAAc;QAC5CI,IAAI,CAAC,kBAAkB,GAAGT,KAAKM,eAAe;IAChD;IACA,IAAIN,KAAKO,gBAAgB,EAAEE,IAAI,CAAC,mBAAmB,GAAG;IACtD,OAAOA;AACT;AAEA;;;;CAIC,GACD,SAASE,eACPvD,KAA8B,EAC9B2C,KAAsB;IAEtB,2EAA2E;IAC3E,oDAAoD;IACpD,MAAMC,OAAOrF,mBAAmB;QAC9BwC,aAAanC;QACbiF,UAAU;QACVW,YAAYb,MAAMnD,KAAK;QACvBiE,aAAad,MAAMlD,MAAM;IAC3B;IACA,IAAImD,KAAKK,cAAc,KAAK9D,aAAayD,KAAKM,eAAe,KAAK/D,WAAW;QAC3E,OAAOa;IACT;IACA,IACEA,KAAK,CAAC,iBAAiB,KAAK4C,KAAKK,cAAc,IAC/CjD,KAAK,CAAC,kBAAkB,KAAK4C,KAAKM,eAAe,EACjD;QACA,OAAOlD;IACT;IACA,OAAO,aACFA;QACHiD,gBAAgBL,KAAKK,cAAc;QACnCC,iBAAiBN,KAAKM,eAAe;;AAEzC;AAEA;;;;;;;;CAQC,GACD,OAAO,MAAMQ,wBAAwB,iBAAgB;AAQrD;;;;;;;;;CASC,GACD,SAASC,mBACP3D,KAA8B,EAC9BD,WAA+B,EAC/B4C,KAA2C;IAE3C,4EAA4E;IAC5E,6EAA6E;IAC7E,qEAAqE;IACrE,IAAIiB;IACJ,KAAK,MAAM,EAAE7C,MAAM,EAAErC,GAAG,EAAE,IAAIgC,kBAC5BP,eAAeH,OAAOD,cACrB;QACD,MAAMa,QAAQ+B,MAAMkB,GAAG,CAACpF,mBAAmBC;QAC3C,IAAI,CAACkC,OAAO;QACZ,MAAMgC,OAAOrF,mBAAmB;YAC9BwC,aAAanC;YACbiF,UAAU;YACVW,YAAY5C,MAAMpB,KAAK;YACvBiE,aAAa7C,MAAMnB,MAAM;QAC3B;QACA,IACEmD,KAAKK,cAAc,KAAK9D,aACxByD,KAAKM,eAAe,KAAK/D,WACzB;YACA;QACF;QACA,IAAI,CAACyE,OAAOA,QAAQ,CAAC;QACrBA,KAAK,CAAC7C,OAAO,GAAG;YACdvB,OAAOoD,KAAKK,cAAc;YAC1BxD,QAAQmD,KAAKM,eAAe;QAC9B;IACF;IACA,IAAI,CAACU,OAAO,OAAO5D;IACnB,OAAO,aAAKA;QAAO,CAAC0D,sBAAsB,EAAEE;;AAC9C;AAEA;;;;;;;;;CASC,GACD,OAAO,SAASE,qBACd5C,KAAQ,EACRyB,KAA2C,EAC3CT,UAAkC,CAAC,CAAC;IAEpC,IAAI,CAACS,MAAMoB,IAAI,EAAE,OAAO7C;IACxB,IAAI8C;IACJ,MAAMC,QAAQ,CAACzC,IAAY3B,MAAyBwD;QAIlD,IAAI,CAACW,SAASA,UAAU,aAAK9C;QAC7B8C,OAAO,CAACxC,GAAG,GAAG,aACT3B,MACCwD,KAAKrD,KAAK,GAAG;YAAEA,OAAOqD,KAAKrD,KAAK;QAAC,IAAI,CAAC,GACtCqD,KAAKpD,aAAa,GAAG;YAAEA,eAAeoD,KAAKpD,aAAa;QAAC,IAAI,CAAC;IAEtE;IACA,IAAK,MAAMuB,MAAMN,MAAO;QACtB,MAAMrB,OAAOqB,KAAK,CAACM,GAAG;QACtB,MAAM9C,MAAMkB,YAAYC,MAAMqC,QAAQpC,IAAI;QAC1C,MAAMc,QAAQlC,MAAMiE,MAAMkB,GAAG,CAACpF,mBAAmBC,QAAQS;QACzD,IAAIyB,OAAO;YACT,MAAMsD,UACJrE,KAAKE,WAAW,KAAKpC,qBAAqB+E,gBAAgBa;YAC5D,MAAMvD,QAAQH,KAAKG,KAAK,IAAIkE,QAAQrE,KAAKG,KAAK,EAAEY;YAChD,MAAMX,gBACJJ,KAAKI,aAAa,IAAIiE,QAAQrE,KAAKI,aAAa,EAAEW;YACpD,IAAIZ,UAAUH,KAAKG,KAAK,IAAIC,kBAAkBJ,KAAKI,aAAa,EAAE;YAClEgE,MAAMzC,IAAI3B,MAAM;gBAAEG;gBAAOC;YAAc;YACvC;QACF;QACA,wEAAwE;QACxE,2EAA2E;QAC3E,kEAAkE;QAClE,IAAIiC,QAAQpC,IAAI,EAAE;QAClB,MAAM,EAAEC,WAAW,EAAE,GAAGF;QACxB,IAAI,CAACE,eAAe,CAAC7B,KAAKL,qBAAqBkC,cAAc;QAC7D,MAAMC,QACJH,KAAKG,KAAK,IAAI2D,mBAAmB9D,KAAKG,KAAK,EAAED,aAAa4C;QAC5D,MAAM1C,gBACJJ,KAAKI,aAAa,IAClB0D,mBAAmB9D,KAAKI,aAAa,EAAEF,aAAa4C;QACtD,IAAI3C,UAAUH,KAAKG,KAAK,IAAIC,kBAAkBJ,KAAKI,aAAa,EAAE;QAClEgE,MAAMzC,IAAI3B,MAAM;YAAEG;YAAOC;QAAc;IACzC;IACA,OAAO+D,UAAWA,UAAgB9C;AACpC"}

package/src/lib/app-utils/media-cdn-scope.d.ts

@@ -0,0 +1,65 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/** One CDN path segment: a host id, an org id, a media id or a content hash. */
+export declare const MEDIA_CDN_SEGMENT: RegExp;
+/**
+ * The parsed CDN scope segment (AGL-1043). Shapes:
+ *
+ * - `{hostId}` — that host's own library
+ * - `org:{orgId}` — the org library, ORG-WIDE assets only
+ * - `org:{orgId}:{hostId}` — an org asset in one site's context
+ *
+ * The host is in the URL rather than sniffed from the `Host` header on
+ * purpose. A header is the requester's CHOICE: anyone holding a restricted
+ * asset's id could fetch it through a domain that IS permitted and get the
+ * bytes, so header-based enforcement stops accidents while looking like a
+ * boundary. Here the decision is a pure function of (URL, doc), and since
+ * the cache key IS the URL, one host's answer can never reach another.
+ */
+export interface MediaCdnScope {
+    isOrg: boolean;
+    scopeId: string;
+    /** Only on the `org:{orgId}:{hostId}` form. */
+    contextHostId?: string;
+}
+export declare function parseMediaCdnScope(scopeSegment: string): MediaCdnScope | null;
+/**
+ * The three ways an org asset can be refused under a CDN URL.
+ *
+ * They are one 404 on the wire — whether a restricted asset exists is not
+ * something an anonymous caller has standing to learn — and three different
+ * faults to whoever is looking at the broken page:
+ *
+ * - `restricted` — the asset carries a scope and this URL is not in it. The
+ *   URL is what is wrong: a restricted asset has to be requested through the
+ *   form that names the site (`hostQualifiedCdnPath`), and the same asset
+ *   serves normally from the site it is shared with.
+ * - `unscoped` — no `visibleTo` at all, so the asset is undeliverable under
+ *   EVERY URL form there is. The document is what is wrong, and it means a
+ *   creation path wrote it without a scope: `newResourceScopeFields` is what
+ *   stops that at compile time, and the scope backfill is what repairs the
+ *   documents already written (`docs/SCOPE_DRIFT.md`).
+ * - `no-sites` — a stored empty array: somebody chose nobody. Equally
+ *   undeliverable, and NOT repairable by the backfill, which leaves an empty
+ *   array alone rather than widening a resource nobody asked to widen — so
+ *   this one needs a person either way.
+ */
+export type MediaCdnScopeRefusal = 'restricted' | 'unscoped' | 'no-sites';
+/** Why the asset is refused under this URL; `null` when it is not. */
+export declare function mediaCdnScopeRefusal(scope: MediaCdnScope, visibleTo: unknown): MediaCdnScopeRefusal | null;
+/** Whether the asset may be served under this URL. */
+export declare function mediaCdnAllows(scope: MediaCdnScope, visibleTo: unknown): boolean;