@aglyn/tenant-data-admin 1.0.0-beta.143

package/src/lib/server/media-quarantine.d.ts

@@ -0,0 +1,127 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/**
+ * Server half of asset quarantine (AGL-1512): the deny-list read that
+ * `serveMediaCdn` consults before any byte leaves Storage. The pure shape,
+ * key derivation and owner copy live in `@aglyn/aglyn`
+ * `app-utils/media-quarantine.ts`; this module adds the Admin-SDK read and
+ * the two properties only the server can hold.
+ *
+ * **One read for the whole feature.** The entire deny list is a single
+ * document, TTL-cached in-process, so a request for any asset — one, or the
+ * fifty tiles of a DAM grid, or every image on a published page — costs at
+ * most ONE Firestore read per process per {@link MEDIA_QUARANTINE_TTL_MS}.
+ * The alternative (a document per quarantined hash) would have made the
+ * cost scale with distinct assets requested, on the hottest unauthenticated
+ * path in the product. Same discipline as AGL-1302, same TTL as the
+ * lockdown verdict so both levers converge on the same clock.
+ *
+ * **Fail OPEN on infrastructure error**, matching the lockdown core: an
+ * unreachable Firestore is an outage, not a takedown, and a Firestore blip
+ * must not blank every customer image on every site. The residual risk is
+ * stated rather than traded away — during a Firestore outage a quarantined
+ * asset can serve. That is the same posture the platform already takes for
+ * a platform-wide security lockdown, and inverting it here would mean a
+ * database outage becomes a total media outage.
+ */
+import { type MediaQuarantineState } from '@aglyn/aglyn/server';
+/**
+ * Deny-list TTL. Deliberately the lockdown verdict's 15s: this is a
+ * takedown path, and 15s is the worst-case lag between staff pressing the
+ * button and a warm process refusing its next request for the asset. It is
+ * also the lag on a LIFT, which matters just as much — reversibility is the
+ * entire reason quarantine exists instead of deletion.
+ */
+export declare const MEDIA_QUARANTINE_TTL_MS = 15000;
+/**
+ * Drop the in-process deny list. The admin route calls it after a write so
+ * the process that took the action enforces immediately; every other
+ * process converges within the TTL. Tests need it between cases.
+ *
+ * Note what this canNOT do in production: the quarantine is written by the
+ * console app and enforced by the tenant app, different processes an
+ * in-process invalidation can never reach. The TTL is the real mechanism.
+ */
+export declare function invalidateMediaQuarantineCache(): void;
+/**
+ * Is this asset quarantined right now? Returns the state so a caller that
+ * wants to explain itself can (the console does); the CDN deliberately
+ * only uses the boolean, because its refusal must stay neutral.
+ *
+ * EVERY key is checked, and any one refusing is enough — see
+ * {@link mediaQuarantineKeys} for why none of them may be dropped. In
+ * short: the strong AGL-1614 `contentSha256`, the legacy truncated
+ * `contentHash`, and the per-asset fallback are all keys a quarantine in
+ * force may have been written under, and a takedown that stops biting
+ * because the document gained a better field would be the worst outcome
+ * this lever can produce. Checking all of them costs nothing: the deny list
+ * is already in memory.
+ */
+export declare function getMediaQuarantine(asset: {
+    contentSha256?: string | null;
+    contentHash?: string | null;
+    scopeSegment?: string | null;
+    mediaId?: string | null;
+}): Promise<MediaQuarantineState | null>;
+/**
+ * Is ANYTHING quarantined right now? (AGL-1612.)
+ *
+ * The cheap pre-check that makes an owner-facing surface affordable. A
+ * console surface asking "are any of these fifty assets disabled?" cannot
+ * take the client's word for the digests — that would turn the staff-only
+ * deny list into an oracle anyone could probe by guessing hashes — so it has
+ * to derive the keys from the media documents server-side, which is a read
+ * per asset.
+ *
+ * That cost is only ever worth paying when the deny list has something in
+ * it, and on this platform it is empty essentially always. So the caller
+ * asks this first: one already-cached read, `false`, and zero media reads on
+ * the overwhelmingly common path.
+ */
+export declare function hasMediaQuarantines(): Promise<boolean>;
+/**
+ * INGESTION refusal (AGL-1613) — the half AGL-1512 did not land.
+ *
+ * AGL-1512 keys quarantine by content digest precisely so that re-uploading
+ * the same bytes stays quarantined, and then kept that promise at DELIVERY
+ * only: `serveMediaCdn` refused the re-uploaded copy while the upload itself
+ * succeeded. The practical outcome for a customer whose malicious PDF was
+ * disabled was that they could re-upload it, it landed in their DAM, it was
+ * BILLED to their storage quota, and it 410'd for every visitor with nothing
+ * anywhere to say why. The control technically held and the product lied
+ * about it.
+ *
+ * So the chokepoints consult the same deny list before the write. It is the
+ * same one-document, TTL-cached read as the CDN's — a warm process pays
+ * nothing for this, and even a cold one pays one Firestore read on a path
+ * that is already doing several.
+ *
+ * **Returns a refusal, and leaves the cleanup to the caller.** A `Response`
+ * cannot delete an orphaned Storage object, and exactly one of the three
+ * chokepoints has one to delete (signed-upload finalize, where the bytes are
+ * in the bucket before anything of ours can look at them). Every caller must
+ * return this BEFORE it saves bytes, writes the media document, or moves
+ * `counters/media` — that counter is a billing input, and a refused upload
+ * that still incremented it would bill a customer for a file the platform
+ * refuses to keep.
+ */
+export declare function quarantinedUploadRefusal(asset: {
+    contentSha256?: string | null;
+    contentHash?: string | null;
+    scopeSegment?: string | null;
+    mediaId?: string | null;
+}): Promise<Response | null>;

package/src/lib/server/media-quarantine.js

@@ -0,0 +1,170 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ /**
+ * Server half of asset quarantine (AGL-1512): the deny-list read that
+ * `serveMediaCdn` consults before any byte leaves Storage. The pure shape,
+ * key derivation and owner copy live in `@aglyn/aglyn`
+ * `app-utils/media-quarantine.ts`; this module adds the Admin-SDK read and
+ * the two properties only the server can hold.
+ *
+ * **One read for the whole feature.** The entire deny list is a single
+ * document, TTL-cached in-process, so a request for any asset — one, or the
+ * fifty tiles of a DAM grid, or every image on a published page — costs at
+ * most ONE Firestore read per process per {@link MEDIA_QUARANTINE_TTL_MS}.
+ * The alternative (a document per quarantined hash) would have made the
+ * cost scale with distinct assets requested, on the hottest unauthenticated
+ * path in the product. Same discipline as AGL-1302, same TTL as the
+ * lockdown verdict so both levers converge on the same clock.
+ *
+ * **Fail OPEN on infrastructure error**, matching the lockdown core: an
+ * unreachable Firestore is an outage, not a takedown, and a Firestore blip
+ * must not blank every customer image on every site. The residual risk is
+ * stated rather than traded away — during a Firestore outage a quarantined
+ * asset can serve. That is the same posture the platform already takes for
+ * a platform-wide security lockdown, and inverting it here would mean a
+ * database outage becomes a total media outage.
+ */ import { isMediaQuarantineActive, MEDIA_QUARANTINE_ENTRIES_FIELD, MEDIA_QUARANTINE_INDEX_DOC_ID, MEDIA_QUARANTINE_UPLOAD_STATUS, MEDIA_QUARANTINES_COLLECTION, mediaQuarantineKeys, mediaQuarantineRefusalBody, normalizeMediaQuarantine } from "@aglyn/aglyn/server";
+import { firebaseAdmin } from "./firebase-admin.js";
+/**
+ * Deny-list TTL. Deliberately the lockdown verdict's 15s: this is a
+ * takedown path, and 15s is the worst-case lag between staff pressing the
+ * button and a warm process refusing its next request for the asset. It is
+ * also the lag on a LIFT, which matters just as much — reversibility is the
+ * entire reason quarantine exists instead of deletion.
+ */ export const MEDIA_QUARANTINE_TTL_MS = 15000;
+let indexCache;
+let indexPending;
+/**
+ * Drop the in-process deny list. The admin route calls it after a write so
+ * the process that took the action enforces immediately; every other
+ * process converges within the TTL. Tests need it between cases.
+ *
+ * Note what this canNOT do in production: the quarantine is written by the
+ * console app and enforced by the tenant app, different processes an
+ * in-process invalidation can never reach. The TTL is the real mechanism.
+ */ export function invalidateMediaQuarantineCache() {
+    indexCache = undefined;
+    indexPending = undefined;
+}
+/** The whole deny list, TTL-cached. `{}` on any error (fail open). */ async function readQuarantineIndex() {
+    if (indexCache && Date.now() - indexCache.at < MEDIA_QUARANTINE_TTL_MS) {
+        return indexCache.entries;
+    }
+    if (!indexPending) {
+        indexPending = (async ()=>{
+            let entries = {};
+            try {
+                const snapshot = await firebaseAdmin.app().firestore().collection(MEDIA_QUARANTINES_COLLECTION).doc(MEDIA_QUARANTINE_INDEX_DOC_ID).get();
+                const raw = snapshot.get(MEDIA_QUARANTINE_ENTRIES_FIELD);
+                if (raw && typeof raw === 'object' && !Array.isArray(raw)) {
+                    entries = raw;
+                }
+            } catch (unused) {
+            // Fail open — see the module header. An outage is not a takedown.
+            }
+            indexCache = {
+                at: Date.now(),
+                entries
+            };
+            return entries;
+        })().finally(()=>{
+            indexPending = undefined;
+        });
+    }
+    return indexPending;
+}
+/**
+ * Is this asset quarantined right now? Returns the state so a caller that
+ * wants to explain itself can (the console does); the CDN deliberately
+ * only uses the boolean, because its refusal must stay neutral.
+ *
+ * EVERY key is checked, and any one refusing is enough — see
+ * {@link mediaQuarantineKeys} for why none of them may be dropped. In
+ * short: the strong AGL-1614 `contentSha256`, the legacy truncated
+ * `contentHash`, and the per-asset fallback are all keys a quarantine in
+ * force may have been written under, and a takedown that stops biting
+ * because the document gained a better field would be the worst outcome
+ * this lever can produce. Checking all of them costs nothing: the deny list
+ * is already in memory.
+ */ export async function getMediaQuarantine(asset) {
+    const keys = mediaQuarantineKeys(asset);
+    if (!keys.length) return null;
+    const entries = await readQuarantineIndex();
+    const nowMs = Date.now();
+    for (const key of keys){
+        const state = normalizeMediaQuarantine(entries[key], key);
+        if (isMediaQuarantineActive(state, nowMs)) return state;
+    }
+    return null;
+}
+/**
+ * Is ANYTHING quarantined right now? (AGL-1612.)
+ *
+ * The cheap pre-check that makes an owner-facing surface affordable. A
+ * console surface asking "are any of these fifty assets disabled?" cannot
+ * take the client's word for the digests — that would turn the staff-only
+ * deny list into an oracle anyone could probe by guessing hashes — so it has
+ * to derive the keys from the media documents server-side, which is a read
+ * per asset.
+ *
+ * That cost is only ever worth paying when the deny list has something in
+ * it, and on this platform it is empty essentially always. So the caller
+ * asks this first: one already-cached read, `false`, and zero media reads on
+ * the overwhelmingly common path.
+ */ export async function hasMediaQuarantines() {
+    const entries = await readQuarantineIndex();
+    return Object.keys(entries).length > 0;
+}
+/**
+ * INGESTION refusal (AGL-1613) — the half AGL-1512 did not land.
+ *
+ * AGL-1512 keys quarantine by content digest precisely so that re-uploading
+ * the same bytes stays quarantined, and then kept that promise at DELIVERY
+ * only: `serveMediaCdn` refused the re-uploaded copy while the upload itself
+ * succeeded. The practical outcome for a customer whose malicious PDF was
+ * disabled was that they could re-upload it, it landed in their DAM, it was
+ * BILLED to their storage quota, and it 410'd for every visitor with nothing
+ * anywhere to say why. The control technically held and the product lied
+ * about it.
+ *
+ * So the chokepoints consult the same deny list before the write. It is the
+ * same one-document, TTL-cached read as the CDN's — a warm process pays
+ * nothing for this, and even a cold one pays one Firestore read on a path
+ * that is already doing several.
+ *
+ * **Returns a refusal, and leaves the cleanup to the caller.** A `Response`
+ * cannot delete an orphaned Storage object, and exactly one of the three
+ * chokepoints has one to delete (signed-upload finalize, where the bytes are
+ * in the bucket before anything of ours can look at them). Every caller must
+ * return this BEFORE it saves bytes, writes the media document, or moves
+ * `counters/media` — that counter is a billing input, and a refused upload
+ * that still incremented it would bill a customer for a file the platform
+ * refuses to keep.
+ */ export async function quarantinedUploadRefusal(asset) {
+    const state = await getMediaQuarantine(asset);
+    if (!state) return null;
+    return Response.json(mediaQuarantineRefusalBody(state), {
+        status: MEDIA_QUARANTINE_UPLOAD_STATUS,
+        // A takedown is reversible and a refusal is per-request; nothing between
+        // here and the browser should be able to answer the next attempt from a
+        // cached copy of this one. Same reasoning as the CDN's `no-store`.
+        headers: {
+            'cache-control': 'no-store'
+        }
+    });
+}
+
+//# sourceMappingURL=media-quarantine.js.map

package/src/lib/server/media-quarantine.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../../libs/tenant/data/admin/src/lib/server/media-quarantine.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * Server half of asset quarantine (AGL-1512): the deny-list read that\n * `serveMediaCdn` consults before any byte leaves Storage. The pure shape,\n * key derivation and owner copy live in `@aglyn/aglyn`\n * `app-utils/media-quarantine.ts`; this module adds the Admin-SDK read and\n * the two properties only the server can hold.\n *\n * **One read for the whole feature.** The entire deny list is a single\n * document, TTL-cached in-process, so a request for any asset — one, or the\n * fifty tiles of a DAM grid, or every image on a published page — costs at\n * most ONE Firestore read per process per {@link MEDIA_QUARANTINE_TTL_MS}.\n * The alternative (a document per quarantined hash) would have made the\n * cost scale with distinct assets requested, on the hottest unauthenticated\n * path in the product. Same discipline as AGL-1302, same TTL as the\n * lockdown verdict so both levers converge on the same clock.\n *\n * **Fail OPEN on infrastructure error**, matching the lockdown core: an\n * unreachable Firestore is an outage, not a takedown, and a Firestore blip\n * must not blank every customer image on every site. The residual risk is\n * stated rather than traded away — during a Firestore outage a quarantined\n * asset can serve. That is the same posture the platform already takes for\n * a platform-wide security lockdown, and inverting it here would mean a\n * database outage becomes a total media outage.\n */\n\nimport {\n  isMediaQuarantineActive,\n  MEDIA_QUARANTINE_ENTRIES_FIELD,\n  MEDIA_QUARANTINE_INDEX_DOC_ID,\n  MEDIA_QUARANTINE_UPLOAD_STATUS,\n  MEDIA_QUARANTINES_COLLECTION,\n  type MediaQuarantineEntry,\n  type MediaQuarantineState,\n  mediaQuarantineKeys,\n  mediaQuarantineRefusalBody,\n  normalizeMediaQuarantine,\n} from '@aglyn/aglyn/server'\nimport { firebaseAdmin } from './firebase-admin'\n\n/**\n * Deny-list TTL. Deliberately the lockdown verdict's 15s: this is a\n * takedown path, and 15s is the worst-case lag between staff pressing the\n * button and a warm process refusing its next request for the asset. It is\n * also the lag on a LIFT, which matters just as much — reversibility is the\n * entire reason quarantine exists instead of deletion.\n */\nexport const MEDIA_QUARANTINE_TTL_MS = 15_000\n\ntype QuarantineIndex = Record<string, Partial<MediaQuarantineEntry>>\n\nlet indexCache: { at: number; entries: QuarantineIndex } | undefined\nlet indexPending: Promise<QuarantineIndex> | undefined\n\n/**\n * Drop the in-process deny list. The admin route calls it after a write so\n * the process that took the action enforces immediately; every other\n * process converges within the TTL. Tests need it between cases.\n *\n * Note what this canNOT do in production: the quarantine is written by the\n * console app and enforced by the tenant app, different processes an\n * in-process invalidation can never reach. The TTL is the real mechanism.\n */\nexport function invalidateMediaQuarantineCache(): void {\n  indexCache = undefined\n  indexPending = undefined\n}\n\n/** The whole deny list, TTL-cached. `{}` on any error (fail open). */\nasync function readQuarantineIndex(): Promise<QuarantineIndex> {\n  if (indexCache && Date.now() - indexCache.at < MEDIA_QUARANTINE_TTL_MS) {\n    return indexCache.entries\n  }\n  if (!indexPending) {\n    indexPending = (async () => {\n      let entries: QuarantineIndex = {}\n      try {\n        const snapshot = await firebaseAdmin\n          .app()\n          .firestore()\n          .collection(MEDIA_QUARANTINES_COLLECTION)\n          .doc(MEDIA_QUARANTINE_INDEX_DOC_ID)\n          .get()\n        const raw = snapshot.get(MEDIA_QUARANTINE_ENTRIES_FIELD)\n        if (raw && typeof raw === 'object' && !Array.isArray(raw)) {\n          entries = raw as QuarantineIndex\n        }\n      } catch {\n        // Fail open — see the module header. An outage is not a takedown.\n      }\n      indexCache = { at: Date.now(), entries }\n      return entries\n    })().finally(() => {\n      indexPending = undefined\n    })\n  }\n  return indexPending\n}\n\n/**\n * Is this asset quarantined right now? Returns the state so a caller that\n * wants to explain itself can (the console does); the CDN deliberately\n * only uses the boolean, because its refusal must stay neutral.\n *\n * EVERY key is checked, and any one refusing is enough — see\n * {@link mediaQuarantineKeys} for why none of them may be dropped. In\n * short: the strong AGL-1614 `contentSha256`, the legacy truncated\n * `contentHash`, and the per-asset fallback are all keys a quarantine in\n * force may have been written under, and a takedown that stops biting\n * because the document gained a better field would be the worst outcome\n * this lever can produce. Checking all of them costs nothing: the deny list\n * is already in memory.\n */\nexport async function getMediaQuarantine(asset: {\n  contentSha256?: string | null\n  contentHash?: string | null\n  scopeSegment?: string | null\n  mediaId?: string | null\n}): Promise<MediaQuarantineState | null> {\n  const keys = mediaQuarantineKeys(asset)\n  if (!keys.length) return null\n  const entries = await readQuarantineIndex()\n  const nowMs = Date.now()\n  for (const key of keys) {\n    const state = normalizeMediaQuarantine(entries[key], key)\n    if (isMediaQuarantineActive(state, nowMs)) return state\n  }\n  return null\n}\n\n/**\n * Is ANYTHING quarantined right now? (AGL-1612.)\n *\n * The cheap pre-check that makes an owner-facing surface affordable. A\n * console surface asking \"are any of these fifty assets disabled?\" cannot\n * take the client's word for the digests — that would turn the staff-only\n * deny list into an oracle anyone could probe by guessing hashes — so it has\n * to derive the keys from the media documents server-side, which is a read\n * per asset.\n *\n * That cost is only ever worth paying when the deny list has something in\n * it, and on this platform it is empty essentially always. So the caller\n * asks this first: one already-cached read, `false`, and zero media reads on\n * the overwhelmingly common path.\n */\nexport async function hasMediaQuarantines(): Promise<boolean> {\n  const entries = await readQuarantineIndex()\n  return Object.keys(entries).length > 0\n}\n\n/**\n * INGESTION refusal (AGL-1613) — the half AGL-1512 did not land.\n *\n * AGL-1512 keys quarantine by content digest precisely so that re-uploading\n * the same bytes stays quarantined, and then kept that promise at DELIVERY\n * only: `serveMediaCdn` refused the re-uploaded copy while the upload itself\n * succeeded. The practical outcome for a customer whose malicious PDF was\n * disabled was that they could re-upload it, it landed in their DAM, it was\n * BILLED to their storage quota, and it 410'd for every visitor with nothing\n * anywhere to say why. The control technically held and the product lied\n * about it.\n *\n * So the chokepoints consult the same deny list before the write. It is the\n * same one-document, TTL-cached read as the CDN's — a warm process pays\n * nothing for this, and even a cold one pays one Firestore read on a path\n * that is already doing several.\n *\n * **Returns a refusal, and leaves the cleanup to the caller.** A `Response`\n * cannot delete an orphaned Storage object, and exactly one of the three\n * chokepoints has one to delete (signed-upload finalize, where the bytes are\n * in the bucket before anything of ours can look at them). Every caller must\n * return this BEFORE it saves bytes, writes the media document, or moves\n * `counters/media` — that counter is a billing input, and a refused upload\n * that still incremented it would bill a customer for a file the platform\n * refuses to keep.\n */\nexport async function quarantinedUploadRefusal(asset: {\n  contentSha256?: string | null\n  contentHash?: string | null\n  scopeSegment?: string | null\n  mediaId?: string | null\n}): Promise<Response | null> {\n  const state = await getMediaQuarantine(asset)\n  if (!state) return null\n  return Response.json(mediaQuarantineRefusalBody(state), {\n    status: MEDIA_QUARANTINE_UPLOAD_STATUS,\n    // A takedown is reversible and a refusal is per-request; nothing between\n    // here and the browser should be able to answer the next attempt from a\n    // cached copy of this one. Same reasoning as the CDN's `no-store`.\n    headers: { 'cache-control': 'no-store' },\n  })\n}\n"],"names":["isMediaQuarantineActive","MEDIA_QUARANTINE_ENTRIES_FIELD","MEDIA_QUARANTINE_INDEX_DOC_ID","MEDIA_QUARANTINE_UPLOAD_STATUS","MEDIA_QUARANTINES_COLLECTION","mediaQuarantineKeys","mediaQuarantineRefusalBody","normalizeMediaQuarantine","firebaseAdmin","MEDIA_QUARANTINE_TTL_MS","indexCache","indexPending","invalidateMediaQuarantineCache","undefined","readQuarantineIndex","Date","now","at","entries","snapshot","app","firestore","collection","doc","get","raw","Array","isArray","finally","getMediaQuarantine","asset","keys","length","nowMs","key","state","hasMediaQuarantines","Object","quarantinedUploadRefusal","Response","json","status","headers"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;;;;;;;;;;;;;;;CAuBC,GAED,SACEA,uBAAuB,EACvBC,8BAA8B,EAC9BC,6BAA6B,EAC7BC,8BAA8B,EAC9BC,4BAA4B,EAG5BC,mBAAmB,EACnBC,0BAA0B,EAC1BC,wBAAwB,QACnB,sBAAqB;AAC5B,SAASC,aAAa,QAAQ,sBAAkB;AAEhD;;;;;;CAMC,GACD,OAAO,MAAMC,0BAA0B,MAAM;AAI7C,IAAIC;AACJ,IAAIC;AAEJ;;;;;;;;CAQC,GACD,OAAO,SAASC;IACdF,aAAaG;IACbF,eAAeE;AACjB;AAEA,oEAAoE,GACpE,eAAeC;IACb,IAAIJ,cAAcK,KAAKC,GAAG,KAAKN,WAAWO,EAAE,GAAGR,yBAAyB;QACtE,OAAOC,WAAWQ,OAAO;IAC3B;IACA,IAAI,CAACP,cAAc;QACjBA,eAAe,AAAC,CAAA;YACd,IAAIO,UAA2B,CAAC;YAChC,IAAI;gBACF,MAAMC,WAAW,MAAMX,cACpBY,GAAG,GACHC,SAAS,GACTC,UAAU,CAAClB,8BACXmB,GAAG,CAACrB,+BACJsB,GAAG;gBACN,MAAMC,MAAMN,SAASK,GAAG,CAACvB;gBACzB,IAAIwB,OAAO,OAAOA,QAAQ,YAAY,CAACC,MAAMC,OAAO,CAACF,MAAM;oBACzDP,UAAUO;gBACZ;YACF,EAAE,eAAM;YACN,kEAAkE;YACpE;YACAf,aAAa;gBAAEO,IAAIF,KAAKC,GAAG;gBAAIE;YAAQ;YACvC,OAAOA;QACT,CAAA,IAAKU,OAAO,CAAC;YACXjB,eAAeE;QACjB;IACF;IACA,OAAOF;AACT;AAEA;;;;;;;;;;;;;CAaC,GACD,OAAO,eAAekB,mBAAmBC,KAKxC;IACC,MAAMC,OAAO1B,oBAAoByB;IACjC,IAAI,CAACC,KAAKC,MAAM,EAAE,OAAO;IACzB,MAAMd,UAAU,MAAMJ;IACtB,MAAMmB,QAAQlB,KAAKC,GAAG;IACtB,KAAK,MAAMkB,OAAOH,KAAM;QACtB,MAAMI,QAAQ5B,yBAAyBW,OAAO,CAACgB,IAAI,EAAEA;QACrD,IAAIlC,wBAAwBmC,OAAOF,QAAQ,OAAOE;IACpD;IACA,OAAO;AACT;AAEA;;;;;;;;;;;;;;CAcC,GACD,OAAO,eAAeC;IACpB,MAAMlB,UAAU,MAAMJ;IACtB,OAAOuB,OAAON,IAAI,CAACb,SAASc,MAAM,GAAG;AACvC;AAEA;;;;;;;;;;;;;;;;;;;;;;;;;CAyBC,GACD,OAAO,eAAeM,yBAAyBR,KAK9C;IACC,MAAMK,QAAQ,MAAMN,mBAAmBC;IACvC,IAAI,CAACK,OAAO,OAAO;IACnB,OAAOI,SAASC,IAAI,CAAClC,2BAA2B6B,QAAQ;QACtDM,QAAQtC;QACR,yEAAyE;QACzE,wEAAwE;QACxE,mEAAmE;QACnEuC,SAAS;YAAE,iBAAiB;QAAW;IACzC;AACF"}

package/src/lib/server/media-signing.d.ts

@@ -0,0 +1,126 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/**
+ * Signed access to a PRIVATE media asset (AGL-1051).
+ *
+ * The rest of this project controls *discovery and use* — `visibleTo` says
+ * which sites may reference an asset. It cannot control secrecy, because
+ * the CDN route is unauthenticated by necessity (it serves images to
+ * anonymous visitors) and a URL, once shared, is a bearer capability with
+ * no revocation. An asset marked `private` opts out of that model: it gets
+ * no `cdnPath`, and the only way to fetch it is a signature that expires.
+ *
+ * Signed with the shared, fail-closed `TOKEN_SIGNING_SECRET`
+ * (docs/COMMERCE_TOKEN_SIGNING.md) rather than a new secret — it is already
+ * provisioned as one team-level variable on both the console and tenant
+ * projects, and a second secret would be a second thing to keep in step
+ * across two apps, which is the failure mode that doc exists to describe.
+ * The `media:` prefix namespaces this payload so a token minted here can
+ * never be replayed as a download or stream token.
+ */
+export declare function tokenSigningSecret(): string;
+/**
+ * Fifteen minutes, matching the gated-video stream token.
+ *
+ * The TTL is the only revocation this scheme has, so it is deliberately
+ * short: long enough to open a link and download the file, too short for a
+ * URL pasted into a chat to stay useful. Console previews re-mint per view.
+ */
+export declare const MEDIA_SIGNATURE_TTL_MS: number;
+/**
+ * How long one viewing session of a purchased, gated video stays playable
+ * (AGL-2814): four hours.
+ *
+ * The console's fifteen minutes is the wrong number for playback, because a
+ * video is not fetched once. Every seek, every resume after a pause and every
+ * buffer refill is another byte-range request under the same URL, so the
+ * signature has to outlive the sitting rather than the first request. Four
+ * hours covers a feature-length recording plus the breaks people take inside
+ * one sitting.
+ *
+ * It stays hours, not days, because the URL is a bearer capability. Anyone who
+ * copies it out of a buyer's network panel holds the whole film until it
+ * expires, and past four hours a pause is long enough that asking the stream
+ * endpoint again is the right answer anyway: that endpoint re-checks the
+ * entitlement before it signs another session, and the gated player asks it
+ * again on its own when a request under an expired URL fails.
+ */
+export declare const GATED_VIDEO_SESSION_TTL_MS: number;
+/**
+ * How long a paid download's link works (AGL-2847): one hour.
+ *
+ * A download is one transfer rather than a sitting, so it needs far less than
+ * a viewing session. It gets more than the console's fifteen minutes because a
+ * large file on a slow connection can take longer than that to arrive, and a
+ * download manager that resumes a broken transfer asks again under the same
+ * URL. A refused resume sends the buyer back to the receipt link, which counts
+ * another attempt against the download limit, so the window is sized to make
+ * that rare while a forwarded link still dies the same evening.
+ */
+export declare const PAID_DOWNLOAD_LINK_TTL_MS: number;
+/**
+ * The longest lifetime any signature may claim, enforced by the VERIFIER as
+ * well as the minter.
+ *
+ * `exp` is inside the signed payload, so nobody without the secret can stretch
+ * it. What this bounds is the platform's own mistakes: a minter that one day
+ * passes a day where it meant an hour would otherwise hand out links nothing
+ * downstream ever questions.
+ */
+export declare const MEDIA_SIGNATURE_MAX_TTL_MS: number;
+/**
+ * The signature over one asset at one expiry.
+ *
+ * `scope` is inside the payload, not just alongside it. Without it a
+ * signature minted for `org:{orgId}` would verify against
+ * `hosts/{hostId}` — different documents, same id space — so a caller
+ * authorized for one library could read the other's asset of the same id.
+ */
+export declare function signMediaAccess(scope: string, mediaId: string, expiresAtMs: number): string;
+export interface MediaSignature {
+    exp: number;
+    sig: string;
+}
+/**
+ * Whether a presented signature authorizes this asset right now.
+ *
+ * Compared with `safeEqual`, which is constant-time on equal-length inputs and
+ * length-checks first because `timingSafeEqual` THROWS on a length mismatch —
+ * and an attacker controls that length, so an exception here would be a 500
+ * where a 403 belongs. That dance was hand-written in six files before
+ * AGL-1902 lifted it into one.
+ */
+export declare function verifyMediaAccess(scope: string, mediaId: string, presented: Partial<MediaSignature> | undefined, nowMs?: number): boolean;
+/** The query string that carries a signature on a CDN URL. */
+export declare function mediaSignatureQuery(signature: MediaSignature): string;
+/**
+ * Throws unless `ttlMs` is a lifetime the platform issues: positive, and no
+ * longer than {@link MEDIA_SIGNATURE_MAX_TTL_MS}.
+ *
+ * It THROWS rather than clamping. The verifier refuses a longer link, so
+ * minting one would hand out a URL that is dead on arrival, and a quiet clamp
+ * would hide the caller asking for the wrong thing. Exported for the minters
+ * that sign something other than a CDN URL, such as a Storage read, so every
+ * expiring link the platform hands out obeys the same bound.
+ */
+export declare function assertMediaSignatureTtl(ttlMs: number): void;
+/**
+ * Mints a signature valid for `ttlMs` from now — {@link MEDIA_SIGNATURE_TTL_MS}
+ * unless the caller names a longer window, bounded by
+ * {@link assertMediaSignatureTtl}.
+ */
+export declare function mintMediaSignature(scope: string, mediaId: string, nowMs?: number, ttlMs?: number): MediaSignature;

package/src/lib/server/media-signing.js

@@ -0,0 +1,159 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ import { createHmac } from "crypto";
+import { safeEqual } from "./safe-equal.js";
+/**
+ * Signed access to a PRIVATE media asset (AGL-1051).
+ *
+ * The rest of this project controls *discovery and use* — `visibleTo` says
+ * which sites may reference an asset. It cannot control secrecy, because
+ * the CDN route is unauthenticated by necessity (it serves images to
+ * anonymous visitors) and a URL, once shared, is a bearer capability with
+ * no revocation. An asset marked `private` opts out of that model: it gets
+ * no `cdnPath`, and the only way to fetch it is a signature that expires.
+ *
+ * Signed with the shared, fail-closed `TOKEN_SIGNING_SECRET`
+ * (docs/COMMERCE_TOKEN_SIGNING.md) rather than a new secret — it is already
+ * provisioned as one team-level variable on both the console and tenant
+ * projects, and a second secret would be a second thing to keep in step
+ * across two apps, which is the failure mode that doc exists to describe.
+ * The `media:` prefix namespaces this payload so a token minted here can
+ * never be replayed as a download or stream token.
+ */ export function tokenSigningSecret() {
+    const secret = process.env['TOKEN_SIGNING_SECRET'];
+    // No fallback, deliberately. AGL-509 was `STRIPE_SECRET_KEY ?? 'aglyn'`:
+    // every payload is built from public identifiers, so a default key makes
+    // signatures forgeable on any deploy missing the real one.
+    if (!secret) throw new Error('TOKEN_SIGNING_SECRET is not configured');
+    return secret;
+}
+/**
+ * Fifteen minutes, matching the gated-video stream token.
+ *
+ * The TTL is the only revocation this scheme has, so it is deliberately
+ * short: long enough to open a link and download the file, too short for a
+ * URL pasted into a chat to stay useful. Console previews re-mint per view.
+ */ export const MEDIA_SIGNATURE_TTL_MS = 15 * 60 * 1000;
+/**
+ * How long one viewing session of a purchased, gated video stays playable
+ * (AGL-2814): four hours.
+ *
+ * The console's fifteen minutes is the wrong number for playback, because a
+ * video is not fetched once. Every seek, every resume after a pause and every
+ * buffer refill is another byte-range request under the same URL, so the
+ * signature has to outlive the sitting rather than the first request. Four
+ * hours covers a feature-length recording plus the breaks people take inside
+ * one sitting.
+ *
+ * It stays hours, not days, because the URL is a bearer capability. Anyone who
+ * copies it out of a buyer's network panel holds the whole film until it
+ * expires, and past four hours a pause is long enough that asking the stream
+ * endpoint again is the right answer anyway: that endpoint re-checks the
+ * entitlement before it signs another session, and the gated player asks it
+ * again on its own when a request under an expired URL fails.
+ */ export const GATED_VIDEO_SESSION_TTL_MS = 4 * 60 * 60 * 1000;
+/**
+ * How long a paid download's link works (AGL-2847): one hour.
+ *
+ * A download is one transfer rather than a sitting, so it needs far less than
+ * a viewing session. It gets more than the console's fifteen minutes because a
+ * large file on a slow connection can take longer than that to arrive, and a
+ * download manager that resumes a broken transfer asks again under the same
+ * URL. A refused resume sends the buyer back to the receipt link, which counts
+ * another attempt against the download limit, so the window is sized to make
+ * that rare while a forwarded link still dies the same evening.
+ */ export const PAID_DOWNLOAD_LINK_TTL_MS = 60 * 60 * 1000;
+/**
+ * The longest lifetime any signature may claim, enforced by the VERIFIER as
+ * well as the minter.
+ *
+ * `exp` is inside the signed payload, so nobody without the secret can stretch
+ * it. What this bounds is the platform's own mistakes: a minter that one day
+ * passes a day where it meant an hour would otherwise hand out links nothing
+ * downstream ever questions.
+ */ export const MEDIA_SIGNATURE_MAX_TTL_MS = GATED_VIDEO_SESSION_TTL_MS;
+/**
+ * Allowance for the minting and verifying instances disagreeing about the
+ * time. The console signs and the tenant app verifies, on different machines.
+ */ const MEDIA_SIGNATURE_CLOCK_SKEW_MS = 60 * 1000;
+/**
+ * The signature over one asset at one expiry.
+ *
+ * `scope` is inside the payload, not just alongside it. Without it a
+ * signature minted for `org:{orgId}` would verify against
+ * `hosts/{hostId}` — different documents, same id space — so a caller
+ * authorized for one library could read the other's asset of the same id.
+ */ export function signMediaAccess(scope, mediaId, expiresAtMs) {
+    return createHmac('sha256', tokenSigningSecret()).update(`media:${scope}:${mediaId}:${expiresAtMs}`).digest('hex').slice(0, 32);
+}
+/**
+ * Whether a presented signature authorizes this asset right now.
+ *
+ * Compared with `safeEqual`, which is constant-time on equal-length inputs and
+ * length-checks first because `timingSafeEqual` THROWS on a length mismatch —
+ * and an attacker controls that length, so an exception here would be a 500
+ * where a 403 belongs. That dance was hand-written in six files before
+ * AGL-1902 lifted it into one.
+ */ export function verifyMediaAccess(scope, mediaId, presented, nowMs = Date.now()) {
+    var _ref, _ref1;
+    const exp = Number((_ref = presented == null ? void 0 : presented.exp) != null ? _ref : 0);
+    const sig = String((_ref1 = presented == null ? void 0 : presented.sig) != null ? _ref1 : '');
+    if (!Number.isFinite(exp) || exp <= nowMs) return false;
+    // Refused whatever the signature says: no minter issues a lifetime this
+    // long, so a link that claims one was never meant to exist.
+    if (exp - nowMs > MEDIA_SIGNATURE_MAX_TTL_MS + MEDIA_SIGNATURE_CLOCK_SKEW_MS) {
+        return false;
+    }
+    let expected;
+    try {
+        expected = signMediaAccess(scope, mediaId, exp);
+    } catch (unused) {
+        // Secret missing — fail closed rather than serving the bytes.
+        return false;
+    }
+    return safeEqual(sig, expected);
+}
+/** The query string that carries a signature on a CDN URL. */ export function mediaSignatureQuery(signature) {
+    return `exp=${signature.exp}&sig=${encodeURIComponent(signature.sig)}`;
+}
+/**
+ * Throws unless `ttlMs` is a lifetime the platform issues: positive, and no
+ * longer than {@link MEDIA_SIGNATURE_MAX_TTL_MS}.
+ *
+ * It THROWS rather than clamping. The verifier refuses a longer link, so
+ * minting one would hand out a URL that is dead on arrival, and a quiet clamp
+ * would hide the caller asking for the wrong thing. Exported for the minters
+ * that sign something other than a CDN URL, such as a Storage read, so every
+ * expiring link the platform hands out obeys the same bound.
+ */ export function assertMediaSignatureTtl(ttlMs) {
+    if (!(ttlMs > 0) || ttlMs > MEDIA_SIGNATURE_MAX_TTL_MS) {
+        throw new RangeError(`A media link lifetime must be between 1 ms and ${MEDIA_SIGNATURE_MAX_TTL_MS} ms`);
+    }
+}
+/**
+ * Mints a signature valid for `ttlMs` from now — {@link MEDIA_SIGNATURE_TTL_MS}
+ * unless the caller names a longer window, bounded by
+ * {@link assertMediaSignatureTtl}.
+ */ export function mintMediaSignature(scope, mediaId, nowMs = Date.now(), ttlMs = MEDIA_SIGNATURE_TTL_MS) {
+    assertMediaSignatureTtl(ttlMs);
+    const exp = nowMs + ttlMs;
+    return {
+        exp,
+        sig: signMediaAccess(scope, mediaId, exp)
+    };
+}
+
+//# sourceMappingURL=media-signing.js.map

package/src/lib/server/media-signing.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../../libs/tenant/data/admin/src/lib/server/media-signing.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { createHmac } from 'crypto'\nimport { safeEqual } from './safe-equal'\n\n/**\n * Signed access to a PRIVATE media asset (AGL-1051).\n *\n * The rest of this project controls *discovery and use* — `visibleTo` says\n * which sites may reference an asset. It cannot control secrecy, because\n * the CDN route is unauthenticated by necessity (it serves images to\n * anonymous visitors) and a URL, once shared, is a bearer capability with\n * no revocation. An asset marked `private` opts out of that model: it gets\n * no `cdnPath`, and the only way to fetch it is a signature that expires.\n *\n * Signed with the shared, fail-closed `TOKEN_SIGNING_SECRET`\n * (docs/COMMERCE_TOKEN_SIGNING.md) rather than a new secret — it is already\n * provisioned as one team-level variable on both the console and tenant\n * projects, and a second secret would be a second thing to keep in step\n * across two apps, which is the failure mode that doc exists to describe.\n * The `media:` prefix namespaces this payload so a token minted here can\n * never be replayed as a download or stream token.\n */\nexport function tokenSigningSecret(): string {\n  const secret = process.env['TOKEN_SIGNING_SECRET']\n  // No fallback, deliberately. AGL-509 was `STRIPE_SECRET_KEY ?? 'aglyn'`:\n  // every payload is built from public identifiers, so a default key makes\n  // signatures forgeable on any deploy missing the real one.\n  if (!secret) throw new Error('TOKEN_SIGNING_SECRET is not configured')\n  return secret\n}\n\n/**\n * Fifteen minutes, matching the gated-video stream token.\n *\n * The TTL is the only revocation this scheme has, so it is deliberately\n * short: long enough to open a link and download the file, too short for a\n * URL pasted into a chat to stay useful. Console previews re-mint per view.\n */\nexport const MEDIA_SIGNATURE_TTL_MS = 15 * 60 * 1000\n\n/**\n * How long one viewing session of a purchased, gated video stays playable\n * (AGL-2814): four hours.\n *\n * The console's fifteen minutes is the wrong number for playback, because a\n * video is not fetched once. Every seek, every resume after a pause and every\n * buffer refill is another byte-range request under the same URL, so the\n * signature has to outlive the sitting rather than the first request. Four\n * hours covers a feature-length recording plus the breaks people take inside\n * one sitting.\n *\n * It stays hours, not days, because the URL is a bearer capability. Anyone who\n * copies it out of a buyer's network panel holds the whole film until it\n * expires, and past four hours a pause is long enough that asking the stream\n * endpoint again is the right answer anyway: that endpoint re-checks the\n * entitlement before it signs another session, and the gated player asks it\n * again on its own when a request under an expired URL fails.\n */\nexport const GATED_VIDEO_SESSION_TTL_MS = 4 * 60 * 60 * 1000\n\n/**\n * How long a paid download's link works (AGL-2847): one hour.\n *\n * A download is one transfer rather than a sitting, so it needs far less than\n * a viewing session. It gets more than the console's fifteen minutes because a\n * large file on a slow connection can take longer than that to arrive, and a\n * download manager that resumes a broken transfer asks again under the same\n * URL. A refused resume sends the buyer back to the receipt link, which counts\n * another attempt against the download limit, so the window is sized to make\n * that rare while a forwarded link still dies the same evening.\n */\nexport const PAID_DOWNLOAD_LINK_TTL_MS = 60 * 60 * 1000\n\n/**\n * The longest lifetime any signature may claim, enforced by the VERIFIER as\n * well as the minter.\n *\n * `exp` is inside the signed payload, so nobody without the secret can stretch\n * it. What this bounds is the platform's own mistakes: a minter that one day\n * passes a day where it meant an hour would otherwise hand out links nothing\n * downstream ever questions.\n */\nexport const MEDIA_SIGNATURE_MAX_TTL_MS = GATED_VIDEO_SESSION_TTL_MS\n\n/**\n * Allowance for the minting and verifying instances disagreeing about the\n * time. The console signs and the tenant app verifies, on different machines.\n */\nconst MEDIA_SIGNATURE_CLOCK_SKEW_MS = 60 * 1000\n\n/**\n * The signature over one asset at one expiry.\n *\n * `scope` is inside the payload, not just alongside it. Without it a\n * signature minted for `org:{orgId}` would verify against\n * `hosts/{hostId}` — different documents, same id space — so a caller\n * authorized for one library could read the other's asset of the same id.\n */\nexport function signMediaAccess(\n  scope: string,\n  mediaId: string,\n  expiresAtMs: number,\n): string {\n  return createHmac('sha256', tokenSigningSecret())\n    .update(`media:${scope}:${mediaId}:${expiresAtMs}`)\n    .digest('hex')\n    .slice(0, 32)\n}\n\nexport interface MediaSignature {\n  exp: number\n  sig: string\n}\n\n/**\n * Whether a presented signature authorizes this asset right now.\n *\n * Compared with `safeEqual`, which is constant-time on equal-length inputs and\n * length-checks first because `timingSafeEqual` THROWS on a length mismatch —\n * and an attacker controls that length, so an exception here would be a 500\n * where a 403 belongs. That dance was hand-written in six files before\n * AGL-1902 lifted it into one.\n */\nexport function verifyMediaAccess(\n  scope: string,\n  mediaId: string,\n  presented: Partial<MediaSignature> | undefined,\n  nowMs: number = Date.now(),\n): boolean {\n  const exp = Number(presented?.exp ?? 0)\n  const sig = String(presented?.sig ?? '')\n  if (!Number.isFinite(exp) || exp <= nowMs) return false\n  // Refused whatever the signature says: no minter issues a lifetime this\n  // long, so a link that claims one was never meant to exist.\n  if (exp - nowMs > MEDIA_SIGNATURE_MAX_TTL_MS + MEDIA_SIGNATURE_CLOCK_SKEW_MS) {\n    return false\n  }\n  let expected: string\n  try {\n    expected = signMediaAccess(scope, mediaId, exp)\n  } catch {\n    // Secret missing — fail closed rather than serving the bytes.\n    return false\n  }\n  return safeEqual(sig, expected)\n}\n\n/** The query string that carries a signature on a CDN URL. */\nexport function mediaSignatureQuery(signature: MediaSignature): string {\n  return `exp=${signature.exp}&sig=${encodeURIComponent(signature.sig)}`\n}\n\n/**\n * Throws unless `ttlMs` is a lifetime the platform issues: positive, and no\n * longer than {@link MEDIA_SIGNATURE_MAX_TTL_MS}.\n *\n * It THROWS rather than clamping. The verifier refuses a longer link, so\n * minting one would hand out a URL that is dead on arrival, and a quiet clamp\n * would hide the caller asking for the wrong thing. Exported for the minters\n * that sign something other than a CDN URL, such as a Storage read, so every\n * expiring link the platform hands out obeys the same bound.\n */\nexport function assertMediaSignatureTtl(ttlMs: number): void {\n  if (!(ttlMs > 0) || ttlMs > MEDIA_SIGNATURE_MAX_TTL_MS) {\n    throw new RangeError(\n      `A media link lifetime must be between 1 ms and ${MEDIA_SIGNATURE_MAX_TTL_MS} ms`,\n    )\n  }\n}\n\n/**\n * Mints a signature valid for `ttlMs` from now — {@link MEDIA_SIGNATURE_TTL_MS}\n * unless the caller names a longer window, bounded by\n * {@link assertMediaSignatureTtl}.\n */\nexport function mintMediaSignature(\n  scope: string,\n  mediaId: string,\n  nowMs: number = Date.now(),\n  ttlMs: number = MEDIA_SIGNATURE_TTL_MS,\n): MediaSignature {\n  assertMediaSignatureTtl(ttlMs)\n  const exp = nowMs + ttlMs\n  return { exp, sig: signMediaAccess(scope, mediaId, exp) }\n}\n"],"names":["createHmac","safeEqual","tokenSigningSecret","secret","process","env","Error","MEDIA_SIGNATURE_TTL_MS","GATED_VIDEO_SESSION_TTL_MS","PAID_DOWNLOAD_LINK_TTL_MS","MEDIA_SIGNATURE_MAX_TTL_MS","MEDIA_SIGNATURE_CLOCK_SKEW_MS","signMediaAccess","scope","mediaId","expiresAtMs","update","digest","slice","verifyMediaAccess","presented","nowMs","Date","now","exp","Number","sig","String","isFinite","expected","mediaSignatureQuery","signature","encodeURIComponent","assertMediaSignatureTtl","ttlMs","RangeError","mintMediaSignature"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED,SAASA,UAAU,QAAQ,SAAQ;AACnC,SAASC,SAAS,QAAQ,kBAAc;AAExC;;;;;;;;;;;;;;;;;CAiBC,GACD,OAAO,SAASC;IACd,MAAMC,SAASC,QAAQC,GAAG,CAAC,uBAAuB;IAClD,yEAAyE;IACzE,yEAAyE;IACzE,2DAA2D;IAC3D,IAAI,CAACF,QAAQ,MAAM,IAAIG,MAAM;IAC7B,OAAOH;AACT;AAEA;;;;;;CAMC,GACD,OAAO,MAAMI,yBAAyB,KAAK,KAAK,KAAI;AAEpD;;;;;;;;;;;;;;;;;CAiBC,GACD,OAAO,MAAMC,6BAA6B,IAAI,KAAK,KAAK,KAAI;AAE5D;;;;;;;;;;CAUC,GACD,OAAO,MAAMC,4BAA4B,KAAK,KAAK,KAAI;AAEvD;;;;;;;;CAQC,GACD,OAAO,MAAMC,6BAA6BF,2BAA0B;AAEpE;;;CAGC,GACD,MAAMG,gCAAgC,KAAK;AAE3C;;;;;;;CAOC,GACD,OAAO,SAASC,gBACdC,KAAa,EACbC,OAAe,EACfC,WAAmB;IAEnB,OAAOf,WAAW,UAAUE,sBACzBc,MAAM,CAAC,CAAC,MAAM,EAAEH,MAAM,CAAC,EAAEC,QAAQ,CAAC,EAAEC,aAAa,EACjDE,MAAM,CAAC,OACPC,KAAK,CAAC,GAAG;AACd;AAOA;;;;;;;;CAQC,GACD,OAAO,SAASC,kBACdN,KAAa,EACbC,OAAe,EACfM,SAA8C,EAC9CC,QAAgBC,KAAKC,GAAG,EAAE;;IAE1B,MAAMC,MAAMC,eAAOL,6BAAAA,UAAWI,GAAG,mBAAI;IACrC,MAAME,MAAMC,gBAAOP,6BAAAA,UAAWM,GAAG,oBAAI;IACrC,IAAI,CAACD,OAAOG,QAAQ,CAACJ,QAAQA,OAAOH,OAAO,OAAO;IAClD,wEAAwE;IACxE,4DAA4D;IAC5D,IAAIG,MAAMH,QAAQX,6BAA6BC,+BAA+B;QAC5E,OAAO;IACT;IACA,IAAIkB;IACJ,IAAI;QACFA,WAAWjB,gBAAgBC,OAAOC,SAASU;IAC7C,EAAE,eAAM;QACN,8DAA8D;QAC9D,OAAO;IACT;IACA,OAAOvB,UAAUyB,KAAKG;AACxB;AAEA,4DAA4D,GAC5D,OAAO,SAASC,oBAAoBC,SAAyB;IAC3D,OAAO,CAAC,IAAI,EAAEA,UAAUP,GAAG,CAAC,KAAK,EAAEQ,mBAAmBD,UAAUL,GAAG,GAAG;AACxE;AAEA;;;;;;;;;CASC,GACD,OAAO,SAASO,wBAAwBC,KAAa;IACnD,IAAI,CAAEA,CAAAA,QAAQ,CAAA,KAAMA,QAAQxB,4BAA4B;QACtD,MAAM,IAAIyB,WACR,CAAC,+CAA+C,EAAEzB,2BAA2B,GAAG,CAAC;IAErF;AACF;AAEA;;;;CAIC,GACD,OAAO,SAAS0B,mBACdvB,KAAa,EACbC,OAAe,EACfO,QAAgBC,KAAKC,GAAG,EAAE,EAC1BW,QAAgB3B,sBAAsB;IAEtC0B,wBAAwBC;IACxB,MAAMV,MAAMH,QAAQa;IACpB,OAAO;QAAEV;QAAKE,KAAKd,gBAAgBC,OAAOC,SAASU;IAAK;AAC1D"}