@aglyn/aglyn 1.0.0-beta.143

package/src/lib/app-utils/media-quarantine.js

@@ -0,0 +1,323 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ /**
+ * ASSET QUARANTINE (AGL-1512) — the proportionate lever beside the AGL-1501
+ * panic button.
+ *
+ * When the infection is ONE uploaded file (malware in a PDF, an abusive
+ * image, a DMCA-noticed asset), locking the whole host punishes a customer
+ * for one object. Quarantine refuses that object at the CDN while the site
+ * keeps running — and, unlike deletion, it is REVERSIBLE, which is what a
+ * false-positive scan or a successful DMCA counter-notice needs.
+ *
+ * ## Three design calls, argued
+ *
+ * **Keyed by content digest, not by media document.** By hash covers every
+ * document that shares the bytes — a template duplicated into forty
+ * workspaces is forty documents and one hash — and it survives a re-upload
+ * of the same file, which a per-document key does not. The limits of that
+ * promise are stated honestly at {@link mediaQuarantineHashKey}; it is not
+ * a content-identity guarantee, and pretending otherwise would be worse
+ * than the gap.
+ *
+ * AGL-1614 added the full-width `contentSha256` beside the legacy truncated
+ * `contentHash` and made the lookup check BOTH (see
+ * {@link mediaQuarantineKeys}). The preference is the strong digest; the
+ * non-negotiable is that the legacy key is never dropped, because entries
+ * written under it are live takedowns and a takedown that lifts itself is
+ * the one failure this lever must never have.
+ *
+ * **A per-asset key exists as a FALLBACK, not an alternative.** Some
+ * documents carry no `contentHash` at all: the signed-upload route only
+ * learns one from GCS's `md5Hash` (absent on composite objects), and every
+ * asset uploaded before that route computed one has none. A takedown lever
+ * that silently cannot touch the largest files is not a takedown lever, so
+ * {@link mediaQuarantineKey} falls back to `asset--{scope}--{mediaId}` — and
+ * only there, so the hash key stays the norm.
+ *
+ * **ONE deny-list document, not one document per quarantine.** The consult
+ * sits on the hottest unauthenticated path in the product: every image, in
+ * every grid, on every published page. A document per quarantined hash would
+ * be one Firestore read per DISTINCT ASSET per TTL — a fifty-tile DAM grid
+ * would go from one lock read to fifty-one. The whole deny list is instead
+ * one document (`mediaQuarantines/index`), so the entire feature costs ONE
+ * read per process per TTL no matter how many assets are requested or how
+ * many are quarantined. This is the tombstone/deny-list pattern the issue
+ * names, and it is the same read-cost discipline as AGL-1302.
+ *
+ * ## What quarantine deliberately does NOT do
+ *
+ * It does not delete the object, does not touch the media document, and
+ * **does not change `sizeBytes` or the `counters/media` accounting**. The
+ * storage counter is a billing input: the file still exists and still
+ * belongs to the org. It is SUPPRESSED, not erased, and a lever that
+ * silently re-bills a customer while refusing their file would be a
+ * different bug than the one it fixed.
+ *
+ * The state lives in `mediaQuarantines/index`, which has **no Firestore
+ * rules block on purpose**. The collection is Admin-SDK-only — written by
+ * `/api/admin/media-quarantine`, read by `serveMediaCdn` — so the default
+ * deny is already the exactly-correct posture, and it needs no rules
+ * deploy to be safe. A staff READ block becomes necessary only if a
+ * client-side surface ever reads it directly; the staff surfaces here read
+ * through the API route instead.
+ */ import { isLockdownActive } from "./lockdown.js";
+import { operatorContactLine } from "./operator-identity.js";
+const MEDIA_QUARANTINE_REASON_KEYS = {
+    malware: true,
+    abuse: true,
+    dmca: true,
+    legal: true,
+    manual: true
+};
+export const MEDIA_QUARANTINE_REASONS = Object.keys(MEDIA_QUARANTINE_REASON_KEYS);
+export function isMediaQuarantineReason(value) {
+    return typeof value === 'string' && value in MEDIA_QUARANTINE_REASON_KEYS;
+}
+/** Staff-surface labels; the key stays the wire/API identity. */ export const MEDIA_QUARANTINE_REASON_LABELS = {
+    malware: 'Malware or malicious content',
+    abuse: 'Abuse report',
+    dmca: 'DMCA takedown notice',
+    legal: 'Other legal demand',
+    manual: 'Staff decision (other)'
+};
+export const MEDIA_QUARANTINES_COLLECTION = 'mediaQuarantines';
+/**
+ * The single deny-list document. One document, one read, whole feature —
+ * see the read-cost argument in the module header.
+ */ export const MEDIA_QUARANTINE_INDEX_DOC_ID = 'index';
+/** The map field inside that document: quarantine key → entry. */ export const MEDIA_QUARANTINE_ENTRIES_FIELD = 'entries';
+/**
+ * How many entries one index document may hold.
+ *
+ * A Firestore document caps at 1 MiB and an entry is a few hundred bytes,
+ * so the real ceiling is thousands — this cap is far below it on purpose.
+ * The write path REFUSES past it rather than growing a document that would
+ * one day fail to write, because the failure mode of an over-full deny list
+ * is "a takedown silently did not land", which is the exact thing this
+ * mechanism exists to prevent. Sharding is a filed follow-up, not a
+ * surprise.
+ */ export const MEDIA_QUARANTINE_MAX_ENTRIES = 2000;
+/** Staff-typed notice text is owner-facing; keep it bounded and plain. */ export const MEDIA_QUARANTINE_MESSAGE_MAX = 500;
+/** Internal staff rationale — never shown to the customer. */ export const MEDIA_QUARANTINE_NOTE_MAX = 1000;
+/**
+ * A quarantine key derived from a content digest — either the strong
+ * `contentSha256` or the legacy truncated `contentHash`. One key space on
+ * purpose: an entry set from either field is looked up by
+ * {@link mediaQuarantineKeys}, so widening the digest never stranded a
+ * takedown that was already in force.
+ *
+ * **What the LEGACY field promises, and what it does not** (AGL-1614).
+ * `contentHash` is a 16-hex character (64-bit) TRUNCATED digest, and it is
+ * produced by two different algorithms depending on which route ingested the
+ * bytes: sha256 for the server-side upload and replace routes, GCS's md5 for
+ * the signed-upload route. Two consequences, both stated rather than hidden:
+ *
+ *  1. The same bytes uploaded through DIFFERENT routes do not share a
+ *     `contentHash`, so "re-uploading the same file stays quarantined"
+ *     holds within an ingestion path, not across all of them. This is NOT
+ *     fixed by `contentSha256` and cannot be: the signed-upload route never
+ *     holds the bytes, and GCS computes only md5 and crc32c.
+ *  2. 64 truncated bits is collision-resistant by accident, not by design.
+ *     An unrelated asset colliding by chance is negligible at this scale;
+ *     an asset colliding by CONSTRUCTION is reachable — cheaply so on the
+ *     md5-derived half, where a chosen-prefix collision produces two files
+ *     with the same full digest and therefore the same truncation. The
+ *     consequence is bounded: a collision can only ever cause MORE refusal,
+ *     never less, so it is an availability bug and never a disclosure one.
+ *
+ * `contentSha256` has neither the truncation nor the md5 property, which is
+ * why {@link mediaQuarantineKeys} prefers it. The key is normalized to lower
+ * case so a hand-entered hash from a staff form cannot miss its own record.
+ */ export function mediaQuarantineHashKey(contentHash) {
+    return `hash--${String(contentHash).trim().toLowerCase()}`;
+}
+/**
+ * The per-asset fallback key, for documents that carry no `contentHash`.
+ * Scope-qualified because a media id is only unique within its own
+ * `orgs/{id}` or `hosts/{id}` library.
+ */ export function mediaQuarantineAssetKey(scopeSegment, mediaId) {
+    return `asset--${scopeSegment}--${mediaId}`;
+}
+/**
+ * THE key for one asset: its content hash when it has one, its identity
+ * when it does not. `null` is impossible in practice (a media id always
+ * exists) and returned anyway rather than emitting a key like
+ * `asset----`, which would be a deny-list entry matching nothing and
+ * looking like it matched everything.
+ */ export function mediaQuarantineKey(asset) {
+    var _asset_contentSha256, _asset_contentHash, _asset_scopeSegment, _asset_mediaId;
+    const strong = String((_asset_contentSha256 = asset.contentSha256) != null ? _asset_contentSha256 : '').trim();
+    if (strong) return mediaQuarantineHashKey(strong);
+    const hash = String((_asset_contentHash = asset.contentHash) != null ? _asset_contentHash : '').trim();
+    if (hash) return mediaQuarantineHashKey(hash);
+    const scopeSegment = String((_asset_scopeSegment = asset.scopeSegment) != null ? _asset_scopeSegment : '').trim();
+    const mediaId = String((_asset_mediaId = asset.mediaId) != null ? _asset_mediaId : '').trim();
+    if (!scopeSegment || !mediaId) return null;
+    return mediaQuarantineAssetKey(scopeSegment, mediaId);
+}
+/**
+ * EVERY key that may refuse this asset, in preference order and without
+ * duplicates. Any one of them matching an active entry is a refusal.
+ *
+ * The list, rather than {@link mediaQuarantineKey}'s single answer, is what
+ * makes AGL-1614's stronger digest safe to introduce. A media document may
+ * now carry BOTH a `contentSha256` and the legacy truncated `contentHash`,
+ * and quarantine entries in force were keyed on whichever field existed when
+ * staff pressed the button. Checking only the preferred key would mean a
+ * live takedown, keyed on the legacy hash, silently stops biting the moment
+ * an asset gains a strong one — a takedown lifting itself is the single
+ * worst failure this lever can have, so the legacy key is never dropped.
+ *
+ * The per-asset key stays in the list for the same reason it was added in
+ * AGL-1512: an entry set while a document had no hash at all must keep
+ * biting after a replace gives it one. Checking all three costs nothing —
+ * the deny list is one already-in-memory map.
+ */ export function mediaQuarantineKeys(asset) {
+    var _asset_contentSha256, _asset_contentHash;
+    const keys = [];
+    const push = (key)=>{
+        if (key && !keys.includes(key)) keys.push(key);
+    };
+    const strong = String((_asset_contentSha256 = asset.contentSha256) != null ? _asset_contentSha256 : '').trim();
+    if (strong) push(mediaQuarantineHashKey(strong));
+    const hash = String((_asset_contentHash = asset.contentHash) != null ? _asset_contentHash : '').trim();
+    if (hash) push(mediaQuarantineHashKey(hash));
+    push(mediaQuarantineKey({
+        scopeSegment: asset.scopeSegment,
+        mediaId: asset.mediaId
+    }));
+    return keys;
+}
+/**
+ * Entry → state. A malformed entry (no recognised reason) is refused
+ * WHOLE rather than defaulted, matching `normalizeLockdownDoc`: the
+ * takedown path does not guess, and a record nobody can explain is not a
+ * record anyone should enforce.
+ *
+ * `note` is deliberately not carried into the state — the staff rationale
+ * must not be able to reach a surface that renders `message`.
+ */ export function normalizeMediaQuarantine(entry, key) {
+    if (!entry) return null;
+    if (!isMediaQuarantineReason(entry.reason)) return null;
+    return {
+        key,
+        reason: entry.reason,
+        message: typeof entry.message === 'string' && entry.message ? entry.message.slice(0, MEDIA_QUARANTINE_MESSAGE_MAX) : undefined,
+        atMs: typeof entry.atMs === 'number' ? entry.atMs : undefined,
+        untilMs: typeof entry.untilMs === 'number' && Number.isFinite(entry.untilMs) ? entry.untilMs : undefined,
+        actorUid: typeof entry.actorUid === 'string' ? entry.actorUid : undefined
+    };
+}
+/**
+ * Active now? Expiry passing deactivates with no write — the same
+ * semantics as `isLockdownActive`, which this calls rather than restates
+ * so the two levers can never drift on what "expired" means.
+ */ export function isMediaQuarantineActive(state, nowMs) {
+    return state != null && isLockdownActive(state, nowMs);
+}
+/**
+ * The address on the owner-facing quarantine notice, from operator
+ * configuration (AGL-2016).
+ *
+ * Was a `'support@aglyn.com'` literal. The notice is shown to the org that
+ * owns the asset, so on a self-host install it told the operator's OWN
+ * customer to write to Aglyn about a file Aglyn never stored — and only the
+ * operator's staff can lift the quarantine they applied.
+ */ export function mediaQuarantineSupportEmail() {
+    return operatorContactLine('support').address;
+}
+/**
+ * The OWNER-facing notice: "this file was disabled: {reason} — contact
+ * support". Shown in the console to the org that owns the asset, never on
+ * the CDN response (which stays a neutral 410 — see the refusal argument
+ * in `serve-media-cdn.ts`).
+ *
+ * A staff-typed `message` replaces the body; the title and the contact
+ * line stay per-reason so an operator cannot accidentally strip the "how
+ * do I get this back" affordance. Every body says the file still EXISTS —
+ * a customer whose asset is refused must not conclude their data was
+ * deleted, because for every reason here it was not.
+ */ export function mediaQuarantineNotice(state) {
+    var _mediaQuarantineSupportEmail;
+    const custom = typeof state.message === 'string' && state.message.trim() ? state.message.trim() : undefined;
+    const contact = (_mediaQuarantineSupportEmail = mediaQuarantineSupportEmail()) != null ? _mediaQuarantineSupportEmail : undefined;
+    switch(state.reason){
+        case 'malware':
+            return {
+                title: 'This file was disabled',
+                body: custom != null ? custom : 'This file was disabled after it was flagged as malicious. It ' + 'has not been deleted and still counts toward your storage. ' + 'If you believe this is a mistake, contact support.',
+                contact
+            };
+        case 'abuse':
+            return {
+                title: 'This file was disabled',
+                body: custom != null ? custom : 'This file was disabled following an abuse report. It has not ' + 'been deleted and still counts toward your storage. Contact ' + 'support to discuss it.',
+                contact
+            };
+        case 'dmca':
+            return {
+                title: 'This file was disabled',
+                body: custom != null ? custom : 'This file was disabled in response to a copyright takedown ' + 'notice. It has not been deleted and still counts toward your ' + 'storage. Contact support if you want to file a counter-notice.',
+                contact
+            };
+        case 'legal':
+            return {
+                title: 'This file was disabled',
+                body: custom != null ? custom : 'This file was disabled in response to a legal demand. It has ' + 'not been deleted and still counts toward your storage. ' + 'Contact support for details.',
+                contact
+            };
+        case 'manual':
+        default:
+            return {
+                title: 'This file was disabled',
+                body: custom != null ? custom : // "by Aglyn staff" named the wrong company on every self-host
+                // install (AGL-2016). "the operator of this service" is true on
+                // ours too — it is who disabled it, from the owner's point of view.
+                'This file was disabled by the operator of this service. It has ' + 'not been deleted and still counts toward your storage. Contact ' + 'support to find out why.',
+                contact
+            };
+    }
+}
+/**
+ * The status an INGESTION chokepoint refuses a quarantined upload with
+ * (AGL-1613).
+ *
+ * Deliberately NOT the CDN's 410 and NOT the lockdown's 423. The CDN answers
+ * an anonymous fetcher, so its refusal is neutral by design and says nothing
+ * about why. This caller is authenticated and is the OWNER of the bytes, so
+ * the AGL-1506 discipline applies in the other direction: they are told. And
+ * it is not 423, because 423 means "your workspace is locked" — a different
+ * lever with a different remedy, and a client that cannot tell them apart
+ * would send a customer to the wrong support conversation.
+ *
+ * 403 rather than 409: the request is understood, it is refused, and
+ * repeating it verbatim will not help. Nothing about the workspace state
+ * needs to change first.
+ */ export const MEDIA_QUARANTINE_UPLOAD_STATUS = 403;
+export function mediaQuarantineRefusalBody(state) {
+    var _notice_contact;
+    const notice = mediaQuarantineNotice(state);
+    return {
+        error: notice.body,
+        quarantined: true,
+        title: notice.title,
+        reason: state.reason,
+        contact: (_notice_contact = notice.contact) != null ? _notice_contact : null
+    };
+}
+
+//# sourceMappingURL=media-quarantine.js.map

package/src/lib/app-utils/media-quarantine.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../libs/aglyn/src/lib/app-utils/media-quarantine.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * ASSET QUARANTINE (AGL-1512) — the proportionate lever beside the AGL-1501\n * panic button.\n *\n * When the infection is ONE uploaded file (malware in a PDF, an abusive\n * image, a DMCA-noticed asset), locking the whole host punishes a customer\n * for one object. Quarantine refuses that object at the CDN while the site\n * keeps running — and, unlike deletion, it is REVERSIBLE, which is what a\n * false-positive scan or a successful DMCA counter-notice needs.\n *\n * ## Three design calls, argued\n *\n * **Keyed by content digest, not by media document.** By hash covers every\n * document that shares the bytes — a template duplicated into forty\n * workspaces is forty documents and one hash — and it survives a re-upload\n * of the same file, which a per-document key does not. The limits of that\n * promise are stated honestly at {@link mediaQuarantineHashKey}; it is not\n * a content-identity guarantee, and pretending otherwise would be worse\n * than the gap.\n *\n * AGL-1614 added the full-width `contentSha256` beside the legacy truncated\n * `contentHash` and made the lookup check BOTH (see\n * {@link mediaQuarantineKeys}). The preference is the strong digest; the\n * non-negotiable is that the legacy key is never dropped, because entries\n * written under it are live takedowns and a takedown that lifts itself is\n * the one failure this lever must never have.\n *\n * **A per-asset key exists as a FALLBACK, not an alternative.** Some\n * documents carry no `contentHash` at all: the signed-upload route only\n * learns one from GCS's `md5Hash` (absent on composite objects), and every\n * asset uploaded before that route computed one has none. A takedown lever\n * that silently cannot touch the largest files is not a takedown lever, so\n * {@link mediaQuarantineKey} falls back to `asset--{scope}--{mediaId}` — and\n * only there, so the hash key stays the norm.\n *\n * **ONE deny-list document, not one document per quarantine.** The consult\n * sits on the hottest unauthenticated path in the product: every image, in\n * every grid, on every published page. A document per quarantined hash would\n * be one Firestore read per DISTINCT ASSET per TTL — a fifty-tile DAM grid\n * would go from one lock read to fifty-one. The whole deny list is instead\n * one document (`mediaQuarantines/index`), so the entire feature costs ONE\n * read per process per TTL no matter how many assets are requested or how\n * many are quarantined. This is the tombstone/deny-list pattern the issue\n * names, and it is the same read-cost discipline as AGL-1302.\n *\n * ## What quarantine deliberately does NOT do\n *\n * It does not delete the object, does not touch the media document, and\n * **does not change `sizeBytes` or the `counters/media` accounting**. The\n * storage counter is a billing input: the file still exists and still\n * belongs to the org. It is SUPPRESSED, not erased, and a lever that\n * silently re-bills a customer while refusing their file would be a\n * different bug than the one it fixed.\n *\n * The state lives in `mediaQuarantines/index`, which has **no Firestore\n * rules block on purpose**. The collection is Admin-SDK-only — written by\n * `/api/admin/media-quarantine`, read by `serveMediaCdn` — so the default\n * deny is already the exactly-correct posture, and it needs no rules\n * deploy to be safe. A staff READ block becomes necessary only if a\n * client-side surface ever reads it directly; the staff surfaces here read\n * through the API route instead.\n */\n\nimport { isLockdownActive } from './lockdown'\nimport { operatorContactLine } from './operator-identity'\n\n/**\n * Why a file was disabled. Deliberately NOT `LockdownReasonCode`: the\n * lockdown vocabulary (security / billing / maintenance / manual) cannot\n * say \"DMCA\", and a takedown recorded as \"security\" is a record that\n * cannot answer the only question anyone asks about it a year later.\n *\n * The field FAMILY around it is AGL-1501's, unchanged — `reason`,\n * `message`, `atMs`, `untilMs`, `actorUid` — so an operator reading an\n * audit row is reading the same shape either way.\n */\nexport type MediaQuarantineReason =\n  | 'malware'\n  | 'abuse'\n  | 'dmca'\n  | 'legal'\n  | 'manual'\n\nconst MEDIA_QUARANTINE_REASON_KEYS: Record<MediaQuarantineReason, true> = {\n  malware: true,\n  abuse: true,\n  dmca: true,\n  legal: true,\n  manual: true,\n}\n\nexport const MEDIA_QUARANTINE_REASONS = Object.keys(\n  MEDIA_QUARANTINE_REASON_KEYS,\n) as MediaQuarantineReason[]\n\nexport function isMediaQuarantineReason(\n  value: unknown,\n): value is MediaQuarantineReason {\n  return typeof value === 'string' && value in MEDIA_QUARANTINE_REASON_KEYS\n}\n\n/** Staff-surface labels; the key stays the wire/API identity. */\nexport const MEDIA_QUARANTINE_REASON_LABELS: Record<\n  MediaQuarantineReason,\n  string\n> = {\n  malware: 'Malware or malicious content',\n  abuse: 'Abuse report',\n  dmca: 'DMCA takedown notice',\n  legal: 'Other legal demand',\n  manual: 'Staff decision (other)',\n}\n\nexport const MEDIA_QUARANTINES_COLLECTION = 'mediaQuarantines'\n\n/**\n * The single deny-list document. One document, one read, whole feature —\n * see the read-cost argument in the module header.\n */\nexport const MEDIA_QUARANTINE_INDEX_DOC_ID = 'index'\n\n/** The map field inside that document: quarantine key → entry. */\nexport const MEDIA_QUARANTINE_ENTRIES_FIELD = 'entries'\n\n/**\n * How many entries one index document may hold.\n *\n * A Firestore document caps at 1 MiB and an entry is a few hundred bytes,\n * so the real ceiling is thousands — this cap is far below it on purpose.\n * The write path REFUSES past it rather than growing a document that would\n * one day fail to write, because the failure mode of an over-full deny list\n * is \"a takedown silently did not land\", which is the exact thing this\n * mechanism exists to prevent. Sharding is a filed follow-up, not a\n * surprise.\n */\nexport const MEDIA_QUARANTINE_MAX_ENTRIES = 2000\n\n/** Staff-typed notice text is owner-facing; keep it bounded and plain. */\nexport const MEDIA_QUARANTINE_MESSAGE_MAX = 500\n\n/** Internal staff rationale — never shown to the customer. */\nexport const MEDIA_QUARANTINE_NOTE_MAX = 1000\n\n/**\n * A quarantine key derived from a content digest — either the strong\n * `contentSha256` or the legacy truncated `contentHash`. One key space on\n * purpose: an entry set from either field is looked up by\n * {@link mediaQuarantineKeys}, so widening the digest never stranded a\n * takedown that was already in force.\n *\n * **What the LEGACY field promises, and what it does not** (AGL-1614).\n * `contentHash` is a 16-hex character (64-bit) TRUNCATED digest, and it is\n * produced by two different algorithms depending on which route ingested the\n * bytes: sha256 for the server-side upload and replace routes, GCS's md5 for\n * the signed-upload route. Two consequences, both stated rather than hidden:\n *\n *  1. The same bytes uploaded through DIFFERENT routes do not share a\n *     `contentHash`, so \"re-uploading the same file stays quarantined\"\n *     holds within an ingestion path, not across all of them. This is NOT\n *     fixed by `contentSha256` and cannot be: the signed-upload route never\n *     holds the bytes, and GCS computes only md5 and crc32c.\n *  2. 64 truncated bits is collision-resistant by accident, not by design.\n *     An unrelated asset colliding by chance is negligible at this scale;\n *     an asset colliding by CONSTRUCTION is reachable — cheaply so on the\n *     md5-derived half, where a chosen-prefix collision produces two files\n *     with the same full digest and therefore the same truncation. The\n *     consequence is bounded: a collision can only ever cause MORE refusal,\n *     never less, so it is an availability bug and never a disclosure one.\n *\n * `contentSha256` has neither the truncation nor the md5 property, which is\n * why {@link mediaQuarantineKeys} prefers it. The key is normalized to lower\n * case so a hand-entered hash from a staff form cannot miss its own record.\n */\nexport function mediaQuarantineHashKey(contentHash: string): string {\n  return `hash--${String(contentHash).trim().toLowerCase()}`\n}\n\n/**\n * The per-asset fallback key, for documents that carry no `contentHash`.\n * Scope-qualified because a media id is only unique within its own\n * `orgs/{id}` or `hosts/{id}` library.\n */\nexport function mediaQuarantineAssetKey(\n  scopeSegment: string,\n  mediaId: string,\n): string {\n  return `asset--${scopeSegment}--${mediaId}`\n}\n\n/**\n * THE key for one asset: its content hash when it has one, its identity\n * when it does not. `null` is impossible in practice (a media id always\n * exists) and returned anyway rather than emitting a key like\n * `asset----`, which would be a deny-list entry matching nothing and\n * looking like it matched everything.\n */\nexport function mediaQuarantineKey(asset: {\n  contentSha256?: string | null\n  contentHash?: string | null\n  scopeSegment?: string | null\n  mediaId?: string | null\n}): string | null {\n  const strong = String(asset.contentSha256 ?? '').trim()\n  if (strong) return mediaQuarantineHashKey(strong)\n  const hash = String(asset.contentHash ?? '').trim()\n  if (hash) return mediaQuarantineHashKey(hash)\n  const scopeSegment = String(asset.scopeSegment ?? '').trim()\n  const mediaId = String(asset.mediaId ?? '').trim()\n  if (!scopeSegment || !mediaId) return null\n  return mediaQuarantineAssetKey(scopeSegment, mediaId)\n}\n\n/**\n * EVERY key that may refuse this asset, in preference order and without\n * duplicates. Any one of them matching an active entry is a refusal.\n *\n * The list, rather than {@link mediaQuarantineKey}'s single answer, is what\n * makes AGL-1614's stronger digest safe to introduce. A media document may\n * now carry BOTH a `contentSha256` and the legacy truncated `contentHash`,\n * and quarantine entries in force were keyed on whichever field existed when\n * staff pressed the button. Checking only the preferred key would mean a\n * live takedown, keyed on the legacy hash, silently stops biting the moment\n * an asset gains a strong one — a takedown lifting itself is the single\n * worst failure this lever can have, so the legacy key is never dropped.\n *\n * The per-asset key stays in the list for the same reason it was added in\n * AGL-1512: an entry set while a document had no hash at all must keep\n * biting after a replace gives it one. Checking all three costs nothing —\n * the deny list is one already-in-memory map.\n */\nexport function mediaQuarantineKeys(asset: {\n  contentSha256?: string | null\n  contentHash?: string | null\n  scopeSegment?: string | null\n  mediaId?: string | null\n}): string[] {\n  const keys: string[] = []\n  const push = (key: string | null) => {\n    if (key && !keys.includes(key)) keys.push(key)\n  }\n  const strong = String(asset.contentSha256 ?? '').trim()\n  if (strong) push(mediaQuarantineHashKey(strong))\n  const hash = String(asset.contentHash ?? '').trim()\n  if (hash) push(mediaQuarantineHashKey(hash))\n  push(\n    mediaQuarantineKey({\n      scopeSegment: asset.scopeSegment,\n      mediaId: asset.mediaId,\n    }),\n  )\n  return keys\n}\n\n/**\n * One entry as stored in the index document's `entries` map.\n *\n * Every optional field is written as an explicit `null` rather than left\n * off (the repo's standing Firestore rule — a converter or a partial write\n * must never carry `undefined`), so a reader can distinguish \"no expiry\"\n * from \"this record predates expiry\".\n */\nexport interface MediaQuarantineEntry {\n  reason: MediaQuarantineReason\n  /** Owner-facing notice text; `null` uses the per-reason default copy. */\n  message?: string | null\n  /** Staff-only rationale. NEVER rendered to the customer. */\n  note?: string | null\n  atMs?: number | null\n  /** Optional expiry — passing it restores delivery with no write. */\n  untilMs?: number | null\n  actorUid?: string | null\n  /**\n   * Where the quarantine was set FROM, for the audit trail only. A hash\n   * key can cover documents in many orgs; this records the one an operator\n   * was looking at, and is never used to decide whether to refuse.\n   */\n  originScopeSegment?: string | null\n  originMediaId?: string | null\n}\n\n/** The normalized, in-memory shape every consumer reads. */\nexport interface MediaQuarantineState {\n  key: string\n  reason: MediaQuarantineReason\n  message?: string\n  atMs?: number\n  untilMs?: number\n  actorUid?: string\n}\n\n/**\n * Entry → state. A malformed entry (no recognised reason) is refused\n * WHOLE rather than defaulted, matching `normalizeLockdownDoc`: the\n * takedown path does not guess, and a record nobody can explain is not a\n * record anyone should enforce.\n *\n * `note` is deliberately not carried into the state — the staff rationale\n * must not be able to reach a surface that renders `message`.\n */\nexport function normalizeMediaQuarantine(\n  entry: Partial<MediaQuarantineEntry> | null | undefined,\n  key: string,\n): MediaQuarantineState | null {\n  if (!entry) return null\n  if (!isMediaQuarantineReason(entry.reason)) return null\n  return {\n    key,\n    reason: entry.reason,\n    message:\n      typeof entry.message === 'string' && entry.message\n        ? entry.message.slice(0, MEDIA_QUARANTINE_MESSAGE_MAX)\n        : undefined,\n    atMs: typeof entry.atMs === 'number' ? entry.atMs : undefined,\n    untilMs:\n      typeof entry.untilMs === 'number' && Number.isFinite(entry.untilMs)\n        ? entry.untilMs\n        : undefined,\n    actorUid: typeof entry.actorUid === 'string' ? entry.actorUid : undefined,\n  }\n}\n\n/**\n * Active now? Expiry passing deactivates with no write — the same\n * semantics as `isLockdownActive`, which this calls rather than restates\n * so the two levers can never drift on what \"expired\" means.\n */\nexport function isMediaQuarantineActive(\n  state: MediaQuarantineState | null | undefined,\n  nowMs: number,\n): boolean {\n  return state != null && isLockdownActive(state, nowMs)\n}\n\nexport interface MediaQuarantineNotice {\n  title: string\n  body: string\n  contact?: string\n}\n\n/**\n * The address on the owner-facing quarantine notice, from operator\n * configuration (AGL-2016).\n *\n * Was a `'support@aglyn.com'` literal. The notice is shown to the org that\n * owns the asset, so on a self-host install it told the operator's OWN\n * customer to write to Aglyn about a file Aglyn never stored — and only the\n * operator's staff can lift the quarantine they applied.\n */\nexport function mediaQuarantineSupportEmail(): string | null {\n  return operatorContactLine('support').address\n}\n\n/**\n * The OWNER-facing notice: \"this file was disabled: {reason} — contact\n * support\". Shown in the console to the org that owns the asset, never on\n * the CDN response (which stays a neutral 410 — see the refusal argument\n * in `serve-media-cdn.ts`).\n *\n * A staff-typed `message` replaces the body; the title and the contact\n * line stay per-reason so an operator cannot accidentally strip the \"how\n * do I get this back\" affordance. Every body says the file still EXISTS —\n * a customer whose asset is refused must not conclude their data was\n * deleted, because for every reason here it was not.\n */\nexport function mediaQuarantineNotice(\n  state: Pick<MediaQuarantineState, 'reason' | 'message'>,\n): MediaQuarantineNotice {\n  const custom =\n    typeof state.message === 'string' && state.message.trim()\n      ? state.message.trim()\n      : undefined\n  const contact = mediaQuarantineSupportEmail() ?? undefined\n  switch (state.reason) {\n    case 'malware':\n      return {\n        title: 'This file was disabled',\n        body:\n          custom ??\n          'This file was disabled after it was flagged as malicious. It ' +\n            'has not been deleted and still counts toward your storage. ' +\n            'If you believe this is a mistake, contact support.',\n        contact,\n      }\n    case 'abuse':\n      return {\n        title: 'This file was disabled',\n        body:\n          custom ??\n          'This file was disabled following an abuse report. It has not ' +\n            'been deleted and still counts toward your storage. Contact ' +\n            'support to discuss it.',\n        contact,\n      }\n    case 'dmca':\n      return {\n        title: 'This file was disabled',\n        body:\n          custom ??\n          'This file was disabled in response to a copyright takedown ' +\n            'notice. It has not been deleted and still counts toward your ' +\n            'storage. Contact support if you want to file a counter-notice.',\n        contact,\n      }\n    case 'legal':\n      return {\n        title: 'This file was disabled',\n        body:\n          custom ??\n          'This file was disabled in response to a legal demand. It has ' +\n            'not been deleted and still counts toward your storage. ' +\n            'Contact support for details.',\n        contact,\n      }\n    case 'manual':\n    default:\n      return {\n        title: 'This file was disabled',\n        body:\n          custom ??\n          // \"by Aglyn staff\" named the wrong company on every self-host\n          // install (AGL-2016). \"the operator of this service\" is true on\n          // ours too — it is who disabled it, from the owner's point of view.\n          'This file was disabled by the operator of this service. It has ' +\n            'not been deleted and still counts toward your storage. Contact ' +\n            'support to find out why.',\n        contact,\n      }\n  }\n}\n\n/**\n * The status an INGESTION chokepoint refuses a quarantined upload with\n * (AGL-1613).\n *\n * Deliberately NOT the CDN's 410 and NOT the lockdown's 423. The CDN answers\n * an anonymous fetcher, so its refusal is neutral by design and says nothing\n * about why. This caller is authenticated and is the OWNER of the bytes, so\n * the AGL-1506 discipline applies in the other direction: they are told. And\n * it is not 423, because 423 means \"your workspace is locked\" — a different\n * lever with a different remedy, and a client that cannot tell them apart\n * would send a customer to the wrong support conversation.\n *\n * 403 rather than 409: the request is understood, it is refused, and\n * repeating it verbatim will not help. Nothing about the workspace state\n * needs to change first.\n */\nexport const MEDIA_QUARANTINE_UPLOAD_STATUS = 403\n\n/**\n * The JSON an ingestion refusal answers with.\n *\n * `error` carries the notice BODY because that is the field every console\n * upload surface already renders into its snackbar — a refusal whose\n * explanation lands in a field nothing reads is a silent failure with extra\n * steps. The structured fields ride alongside for a surface that wants to\n * render the notice properly (AGL-1612).\n *\n * Built from {@link mediaQuarantineNotice}, which takes only `reason` and\n * `message`. That is the containment for the staff `note`: it is dropped by\n * `normalizeMediaQuarantine` before a state exists, and this function never\n * sees a raw entry to reach past it into.\n */\nexport interface MediaQuarantineRefusalBody {\n  error: string\n  quarantined: true\n  title: string\n  reason: MediaQuarantineReason\n  contact: string | null\n}\n\nexport function mediaQuarantineRefusalBody(\n  state: Pick<MediaQuarantineState, 'reason' | 'message'>,\n): MediaQuarantineRefusalBody {\n  const notice = mediaQuarantineNotice(state)\n  return {\n    error: notice.body,\n    quarantined: true,\n    title: notice.title,\n    reason: state.reason,\n    contact: notice.contact ?? null,\n  }\n}\n"],"names":["isLockdownActive","operatorContactLine","MEDIA_QUARANTINE_REASON_KEYS","malware","abuse","dmca","legal","manual","MEDIA_QUARANTINE_REASONS","Object","keys","isMediaQuarantineReason","value","MEDIA_QUARANTINE_REASON_LABELS","MEDIA_QUARANTINES_COLLECTION","MEDIA_QUARANTINE_INDEX_DOC_ID","MEDIA_QUARANTINE_ENTRIES_FIELD","MEDIA_QUARANTINE_MAX_ENTRIES","MEDIA_QUARANTINE_MESSAGE_MAX","MEDIA_QUARANTINE_NOTE_MAX","mediaQuarantineHashKey","contentHash","String","trim","toLowerCase","mediaQuarantineAssetKey","scopeSegment","mediaId","mediaQuarantineKey","asset","strong","contentSha256","hash","mediaQuarantineKeys","push","key","includes","normalizeMediaQuarantine","entry","reason","message","slice","undefined","atMs","untilMs","Number","isFinite","actorUid","isMediaQuarantineActive","state","nowMs","mediaQuarantineSupportEmail","address","mediaQuarantineNotice","custom","contact","title","body","MEDIA_QUARANTINE_UPLOAD_STATUS","mediaQuarantineRefusalBody","notice","error","quarantined"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA6DC,GAED,SAASA,gBAAgB,QAAQ,gBAAY;AAC7C,SAASC,mBAAmB,QAAQ,yBAAqB;AAmBzD,MAAMC,+BAAoE;IACxEC,SAAS;IACTC,OAAO;IACPC,MAAM;IACNC,OAAO;IACPC,QAAQ;AACV;AAEA,OAAO,MAAMC,2BAA2BC,OAAOC,IAAI,CACjDR,8BAC0B;AAE5B,OAAO,SAASS,wBACdC,KAAc;IAEd,OAAO,OAAOA,UAAU,YAAYA,SAASV;AAC/C;AAEA,+DAA+D,GAC/D,OAAO,MAAMW,iCAGT;IACFV,SAAS;IACTC,OAAO;IACPC,MAAM;IACNC,OAAO;IACPC,QAAQ;AACV,EAAC;AAED,OAAO,MAAMO,+BAA+B,mBAAkB;AAE9D;;;CAGC,GACD,OAAO,MAAMC,gCAAgC,QAAO;AAEpD,gEAAgE,GAChE,OAAO,MAAMC,iCAAiC,UAAS;AAEvD;;;;;;;;;;CAUC,GACD,OAAO,MAAMC,+BAA+B,KAAI;AAEhD,wEAAwE,GACxE,OAAO,MAAMC,+BAA+B,IAAG;AAE/C,4DAA4D,GAC5D,OAAO,MAAMC,4BAA4B,KAAI;AAE7C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA6BC,GACD,OAAO,SAASC,uBAAuBC,WAAmB;IACxD,OAAO,CAAC,MAAM,EAAEC,OAAOD,aAAaE,IAAI,GAAGC,WAAW,IAAI;AAC5D;AAEA;;;;CAIC,GACD,OAAO,SAASC,wBACdC,YAAoB,EACpBC,OAAe;IAEf,OAAO,CAAC,OAAO,EAAED,aAAa,EAAE,EAAEC,SAAS;AAC7C;AAEA;;;;;;CAMC,GACD,OAAO,SAASC,mBAAmBC,KAKlC;QACuBA,sBAEFA,oBAEQA,qBACLA;IALvB,MAAMC,SAASR,QAAOO,uBAAAA,MAAME,aAAa,YAAnBF,uBAAuB,IAAIN,IAAI;IACrD,IAAIO,QAAQ,OAAOV,uBAAuBU;IAC1C,MAAME,OAAOV,QAAOO,qBAAAA,MAAMR,WAAW,YAAjBQ,qBAAqB,IAAIN,IAAI;IACjD,IAAIS,MAAM,OAAOZ,uBAAuBY;IACxC,MAAMN,eAAeJ,QAAOO,sBAAAA,MAAMH,YAAY,YAAlBG,sBAAsB,IAAIN,IAAI;IAC1D,MAAMI,UAAUL,QAAOO,iBAAAA,MAAMF,OAAO,YAAbE,iBAAiB,IAAIN,IAAI;IAChD,IAAI,CAACG,gBAAgB,CAACC,SAAS,OAAO;IACtC,OAAOF,wBAAwBC,cAAcC;AAC/C;AAEA;;;;;;;;;;;;;;;;;CAiBC,GACD,OAAO,SAASM,oBAAoBJ,KAKnC;QAKuBA,sBAEFA;IANpB,MAAMnB,OAAiB,EAAE;IACzB,MAAMwB,OAAO,CAACC;QACZ,IAAIA,OAAO,CAACzB,KAAK0B,QAAQ,CAACD,MAAMzB,KAAKwB,IAAI,CAACC;IAC5C;IACA,MAAML,SAASR,QAAOO,uBAAAA,MAAME,aAAa,YAAnBF,uBAAuB,IAAIN,IAAI;IACrD,IAAIO,QAAQI,KAAKd,uBAAuBU;IACxC,MAAME,OAAOV,QAAOO,qBAAAA,MAAMR,WAAW,YAAjBQ,qBAAqB,IAAIN,IAAI;IACjD,IAAIS,MAAME,KAAKd,uBAAuBY;IACtCE,KACEN,mBAAmB;QACjBF,cAAcG,MAAMH,YAAY;QAChCC,SAASE,MAAMF,OAAO;IACxB;IAEF,OAAOjB;AACT;AAuCA;;;;;;;;CAQC,GACD,OAAO,SAAS2B,yBACdC,KAAuD,EACvDH,GAAW;IAEX,IAAI,CAACG,OAAO,OAAO;IACnB,IAAI,CAAC3B,wBAAwB2B,MAAMC,MAAM,GAAG,OAAO;IACnD,OAAO;QACLJ;QACAI,QAAQD,MAAMC,MAAM;QACpBC,SACE,OAAOF,MAAME,OAAO,KAAK,YAAYF,MAAME,OAAO,GAC9CF,MAAME,OAAO,CAACC,KAAK,CAAC,GAAGvB,gCACvBwB;QACNC,MAAM,OAAOL,MAAMK,IAAI,KAAK,WAAWL,MAAMK,IAAI,GAAGD;QACpDE,SACE,OAAON,MAAMM,OAAO,KAAK,YAAYC,OAAOC,QAAQ,CAACR,MAAMM,OAAO,IAC9DN,MAAMM,OAAO,GACbF;QACNK,UAAU,OAAOT,MAAMS,QAAQ,KAAK,WAAWT,MAAMS,QAAQ,GAAGL;IAClE;AACF;AAEA;;;;CAIC,GACD,OAAO,SAASM,wBACdC,KAA8C,EAC9CC,KAAa;IAEb,OAAOD,SAAS,QAAQjD,iBAAiBiD,OAAOC;AAClD;AAQA;;;;;;;;CAQC,GACD,OAAO,SAASC;IACd,OAAOlD,oBAAoB,WAAWmD,OAAO;AAC/C;AAEA;;;;;;;;;;;CAWC,GACD,OAAO,SAASC,sBACdJ,KAAuD;QAMvCE;IAJhB,MAAMG,SACJ,OAAOL,MAAMT,OAAO,KAAK,YAAYS,MAAMT,OAAO,CAACjB,IAAI,KACnD0B,MAAMT,OAAO,CAACjB,IAAI,KAClBmB;IACN,MAAMa,WAAUJ,+BAAAA,yCAAAA,+BAAiCT;IACjD,OAAQO,MAAMV,MAAM;QAClB,KAAK;YACH,OAAO;gBACLiB,OAAO;gBACPC,IAAI,EACFH,iBAAAA,SACA,kEACE,gEACA;gBACJC;YACF;QACF,KAAK;YACH,OAAO;gBACLC,OAAO;gBACPC,IAAI,EACFH,iBAAAA,SACA,kEACE,gEACA;gBACJC;YACF;QACF,KAAK;YACH,OAAO;gBACLC,OAAO;gBACPC,IAAI,EACFH,iBAAAA,SACA,gEACE,kEACA;gBACJC;YACF;QACF,KAAK;YACH,OAAO;gBACLC,OAAO;gBACPC,IAAI,EACFH,iBAAAA,SACA,kEACE,4DACA;gBACJC;YACF;QACF,KAAK;QACL;YACE,OAAO;gBACLC,OAAO;gBACPC,IAAI,EACFH,iBAAAA,SACA,8DAA8D;gBAC9D,gEAAgE;gBAChE,oEAAoE;gBACpE,oEACE,oEACA;gBACJC;YACF;IACJ;AACF;AAEA;;;;;;;;;;;;;;;CAeC,GACD,OAAO,MAAMG,iCAAiC,IAAG;AAwBjD,OAAO,SAASC,2BACdV,KAAuD;QAQ5CW;IANX,MAAMA,SAASP,sBAAsBJ;IACrC,OAAO;QACLY,OAAOD,OAAOH,IAAI;QAClBK,aAAa;QACbN,OAAOI,OAAOJ,KAAK;QACnBjB,QAAQU,MAAMV,MAAM;QACpBgB,OAAO,GAAEK,kBAAAA,OAAOL,OAAO,YAAdK,kBAAkB;IAC7B;AACF"}