@antiphony/shared 0.4.0 → 0.5.1

package/dist/cjs/index.cjs

@@ -61,21 +61,129 @@ var FirestoreTimestampSchema = zod.z.union([
   return date;
 });
 var ProcessingStageStatusSchema = zod.z.enum(["pending", "ready", "failed", "skipped"]);
+var PROCESSING_STAGES = ["denoise", "trim", "transcribe", "waveform"];
+var ProcessingStageSchema = zod.z.enum(PROCESSING_STAGES);
+var BYTE_MUTATING_STAGES = ["denoise", "trim"];
+var DERIVED_STAGES = ["transcribe", "waveform"];
 var ProcessingRequestSchema = zod.z.object({
   transcribe: zod.z.boolean().optional(),
-  denoise: zod.z.boolean().optional()
+  denoise: zod.z.boolean().optional(),
+  trim: zod.z.boolean().optional(),
+  waveform: zod.z.boolean().optional(),
+  /**
+   * Whether a completed byte-mutating stage should invalidate and recompute
+   * the derived artifacts that describe the old audio. Defaults to **true**
+   * — a transcript of superseded audio is wrong, not merely stale.
+   *
+   * `false` opts out, for an app that would rather keep the existing
+   * transcript than pay to regenerate it. It does NOT name a stage, so a
+   * request carrying only `reprocess` requests no work.
+   */
+  reprocess: zod.z.boolean().optional()
 });
-var ProcessingStateSchema = zod.z.object({
+var ProcessingStageMapSchema = zod.z.object({
   transcribe: ProcessingStageStatusSchema.optional(),
   denoise: ProcessingStageStatusSchema.optional(),
-  /** Content CID of the denoised audio variant, once `denoise === 'ready'`. */
-  denoisedBlobCid: zod.z.string().optional(),
-  updatedAt: FirestoreTimestampSchema
+  trim: ProcessingStageStatusSchema.optional(),
+  waveform: ProcessingStageStatusSchema.optional()
 });
-var ProcessingViewSchema = zod.z.object({
-  transcribe: ProcessingStageStatusSchema.optional(),
-  denoise: ProcessingStageStatusSchema.optional()
+var ResolvedProcessingSchema = ProcessingStageMapSchema.extend({
+  reprocess: zod.z.boolean().optional()
+});
+var ProcessingStateSchema = ResolvedProcessingSchema.extend({
+  /**
+   * Content CID of the processed audio variant — the composed output of every
+   * byte-mutating stage that has completed. The record's own
+   * `embed.audio.ref.$link` stays the ORIGINAL CID (immutable content
+   * address); only the read-time view swaps playback to this variant.
+   */
+  processedBlobCid: zod.z.string().optional(),
+  /**
+   * MIME type of the processed variant. Present because providers may
+   * TRANSCODE — the ElevenLabs Voice Isolator returns MP3 regardless of what
+   * it is given — so the variant's type cannot be assumed to match
+   * `embed.audio.mimeType`. Anything reading the variant's bytes must use
+   * this, not the embed's.
+   */
+  processedMimeType: zod.z.string().optional(),
+  /**
+   * Duration of the processed variant, when a byte-mutating stage changed it
+   * (i.e. trim). Absent when the variant's duration matches the original.
+   */
+  processedDurationMs: zod.z.number().int().min(0).optional(),
+  /**
+   * Which denoiser produced the variant's denoise contribution — provenance,
+   * the counterpart to a transcript record's `model`.
+   *
+   * Lives here because a cleaned variant, unlike a transcript, has no record
+   * of its own to carry it: it is a blob CID on this state. Without it,
+   * changing denoisers leaves no way to tell which variants predate the
+   * switch, so nothing can identify what to re-run.
+   *
+   * Named for the STAGE, not the variant (`processedModel`), because it
+   * describes one link of the byte-mutating chain rather than the composed
+   * artifact. Trim contributes to the same variant and has no model, and a
+   * later external link would want its own field rather than to overwrite
+   * this one.
+   *
+   * Written on every successful denoise, never cleared — it moves with
+   * `processedBlobCid`, which is only ever set, never reset. A denoise that
+   * FAILS leaves both alone, which is correct: the variant still holds the
+   * previous denoiser's output, so the previous model still describes it.
+   *
+   * Internal, like the other variant fields — `toProcessingView` projects
+   * stages only, so this never reaches a client.
+   */
+  denoiseModel: zod.z.string().optional(),
+  /**
+   * Peaks for the processed variant, once the `waveform` stage completes.
+   * Same normalization and bounds as `embed.waveform` (0–100, max 1000), so
+   * a view can never carry a larger payload than the record allows.
+   */
+  waveformPeaks: zod.z.array(zod.z.number().int().min(0).max(100)).max(1e3).optional(),
+  /**
+   * When the current runner's exclusive claim on this post expires.
+   *
+   * Queue delivery is at-least-once, so the same job can arrive twice and
+   * run CONCURRENTLY. `process()` is idempotent under sequential retry — it
+   * acts on `pending` and re-does nothing already settled — but two passes
+   * interleaved is a different failure: both read the same `pending` state,
+   * both bill the provider for the same stage, and both write
+   * `processedBlobCid`, so the surviving variant is whichever finished last
+   * and the other's blob is orphaned.
+   *
+   * A runner claims this field transactionally before doing any work and
+   * clears it when finished; a second runner finding it unexpired declines
+   * and returns. It is an EXPIRY, not a boolean lock, because the holder can
+   * die mid-run (instance recycled, process killed) with no chance to
+   * release — a plain flag would strand the post permanently, where a lapsed
+   * lease lets the next delivery pick it up.
+   *
+   * Internal, like the variant fields above: `toProcessingView` projects
+   * stages only, so this never reaches a client.
+   */
+  leaseUntil: FirestoreTimestampSchema.optional(),
+  updatedAt: FirestoreTimestampSchema
 });
+var ProcessingViewSchema = ProcessingStageMapSchema;
+function toProcessingView(state) {
+  const view = {};
+  for (const stage of PROCESSING_STAGES) {
+    if (state[stage] !== void 0) view[stage] = state[stage];
+  }
+  return view;
+}
+function resolveAudioVariant(canonical, state) {
+  var _a;
+  if (!state) return canonical;
+  const hasVariant = state.processedBlobCid !== void 0;
+  const peaksAreCurrent = state.waveform === "ready" && state.waveformPeaks !== void 0;
+  return {
+    blobCid: hasVariant ? state.processedBlobCid : canonical.blobCid,
+    durationMs: hasVariant ? (_a = state.processedDurationMs) != null ? _a : canonical.durationMs : canonical.durationMs,
+    waveform: peaksAreCurrent ? state.waveformPeaks : canonical.waveform
+  };
+}
 
 // types/audio.ts
 var StrongRefSchema = zod.z.object({
@@ -111,20 +219,34 @@ var TimedTranscriptSchema = zod.z.object({
 });
 var AudioEmbedViewSchema = zod.z.object({
   $type: zod.z.literal("dev.antiphony.embed.audio#view"),
+  /**
+   * `url`, `durationMs` and `waveform` are RESOLVED, not copied: once
+   * processing has produced an audio variant they describe that variant
+   * rather than the bytes the client uploaded. They always agree with one
+   * another — a duration and a set of peaks are only meaningful against the
+   * audio `url` actually points at.
+   *
+   * A client that stored `durationMs` at upload time should therefore expect
+   * it to change (trim removes leading/trailing silence), and should render
+   * these three as a set rather than caching them independently. The record's
+   * originals are immutable and unaffected; this is a read-time resolution.
+   */
   url: zod.z.string().url(),
   durationMs: zod.z.number().int().min(0).optional(),
-  // `alt`/`waveform` are copied from the stored embed; keep the same bounds
-  // so a view can never carry a larger payload than the record allows.
+  // `alt` is copied from the stored embed; keep the same bounds so a view can
+  // never carry a larger payload than the record allows.
   alt: zod.z.string().max(1e4).optional(),
   waveform: zod.z.array(zod.z.number().int().min(0).max(100)).max(1e3).optional(),
   /** Lifted from the transcript enrichment record; absent until transcription completes. */
   transcript: TimedTranscriptSchema.optional(),
   /**
-   * Per-stage audio-processing status (transcribe / denoise), when the app
-   * opted into processing on create. Absent otherwise. A `pending` stage
-   * means the client should poll (or re-render) for the result. When
-   * `denoise === 'ready'`, `url` above already resolves to the cleaned
-   * audio variant. See `types/processing.ts`.
+   * Per-stage audio-processing status (denoise / trim / transcribe /
+   * waveform), when the app opted into processing. Absent otherwise. A
+   * `pending` stage means the client should poll (or re-render) for the
+   * result — including a stage that returns to `pending` after having been
+   * `ready`, which is how a recompute surfaces. Once a byte-mutating stage
+   * completes, `url`/`durationMs`/`waveform` above already resolve to the
+   * processed audio variant. See `types/processing.ts`.
    */
   processing: ProcessingViewSchema.optional()
 });
@@ -228,10 +350,15 @@ var ViewerStateSchema = zod.z.object({
   replyDisabledReason: zod.z.enum(["unauthenticated", "not_a_participant"]).optional()
 });
 var PostRecordPublicSchema = zod.z.object({
-  text: zod.z.string(),
-  title: zod.z.string().optional(),
+  // `text`, `title` and `langs` keep the record's bounds, for the same reason
+  // `AudioEmbedViewSchema.alt` does: a view must never be able to carry a
+  // larger payload than the record it projects. The write path already
+  // enforces these, so no stored post can exceed them — stating them here
+  // keeps the published contract honest rather than adding a new constraint.
+  text: zod.z.string().max(3e3),
+  title: zod.z.string().max(3e3).optional(),
   reply: ReplyRefSchema.optional(),
-  langs: zod.z.array(zod.z.string()).optional(),
+  langs: zod.z.array(zod.z.string()).max(3).optional(),
   selfLabels: zod.z.array(zod.z.string()).optional(),
   createdAt: FirestoreTimestampSchema
 });
@@ -266,9 +393,11 @@ var CreateAudioPostRequestSchema = zod.z.object({
   /** Author self-label values (content warnings). */
   selfLabels: zod.z.array(zod.z.string()).optional(),
   /**
-   * Opt-in audio processing for this post's audio (transcribe / denoise).
-   * Both default off. Stages the deployment can't provide come back marked
-   * `skipped` on the view rather than failing the create. See
+   * Opt-in audio processing for this post's audio (denoise / trim /
+   * transcribe / waveform). All default off. Stages the deployment can't
+   * provide come back marked `skipped` on the view rather than failing the
+   * create. A multi-stage request runs denoise → trim → (transcribe,
+   * waveform); request stages individually to override that order. See
    * `types/processing.ts`.
    */
   processing: ProcessingRequestSchema.optional()
@@ -301,6 +430,15 @@ var EMBED_NSID = {
   Audio: "dev.antiphony.embed.audio",
   RecordWithAudio: "dev.antiphony.embed.recordWithAudio"
 };
+var XRPC_NSID = {
+  // Queries (GET).
+  GetPost: "dev.antiphony.audio.getPost",
+  GetThread: "dev.antiphony.audio.getThread",
+  GetPlaybackUrl: "dev.antiphony.audio.getPlaybackUrl",
+  // Procedures (POST).
+  CreatePost: "dev.antiphony.audio.createPost",
+  ReprocessPost: "dev.antiphony.audio.reprocessPost"
+};
 var COLLECTIONS = {
   // One post collection + the transcript enrichment namespace.
   [NSID.AudioPost]: "posts",
@@ -401,23 +539,29 @@ exports.AudioEmbedSchema = AudioEmbedSchema;
 exports.AudioEmbedViewSchema = AudioEmbedViewSchema;
 exports.AudioPostRecordSchema = AudioPostRecordSchema;
 exports.AudioPostViewSchema = AudioPostViewSchema;
+exports.BYTE_MUTATING_STAGES = BYTE_MUTATING_STAGES;
 exports.BlobRefSchema = BlobRefSchema;
 exports.COLLECTIONS = COLLECTIONS;
 exports.ConflictError = ConflictError;
 exports.CreateAudioPostRequestSchema = CreateAudioPostRequestSchema;
+exports.DERIVED_STAGES = DERIVED_STAGES;
 exports.EMBED_NSID = EMBED_NSID;
 exports.FirestoreTimestampSchema = FirestoreTimestampSchema;
 exports.ForbiddenError = ForbiddenError;
 exports.NSID = NSID;
 exports.NotFoundError = NotFoundError;
+exports.PROCESSING_STAGES = PROCESSING_STAGES;
 exports.PatchAudioPostRequestSchema = PatchAudioPostRequestSchema;
 exports.PostRecordPublicSchema = PostRecordPublicSchema;
 exports.ProcessingRequestSchema = ProcessingRequestSchema;
+exports.ProcessingStageMapSchema = ProcessingStageMapSchema;
+exports.ProcessingStageSchema = ProcessingStageSchema;
 exports.ProcessingStageStatusSchema = ProcessingStageStatusSchema;
 exports.ProcessingStateSchema = ProcessingStateSchema;
 exports.ProcessingViewSchema = ProcessingViewSchema;
 exports.RateLimitError = RateLimitError;
 exports.ReplyRefSchema = ReplyRefSchema;
+exports.ResolvedProcessingSchema = ResolvedProcessingSchema;
 exports.ServiceError = ServiceError;
 exports.StrongRefSchema = StrongRefSchema;
 exports.TimedTranscriptSchema = TimedTranscriptSchema;
@@ -426,6 +570,9 @@ exports.TranscriptSegmentSchema = TranscriptSegmentSchema;
 exports.UnauthorizedError = UnauthorizedError;
 exports.ValidationError = ValidationError;
 exports.ViewerStateSchema = ViewerStateSchema;
+exports.XRPC_NSID = XRPC_NSID;
 exports.buildReportedErrorEvent = buildReportedErrorEvent;
 exports.isFirestoreTimestamp = isFirestoreTimestamp;
 exports.reportError = reportError;
+exports.resolveAudioVariant = resolveAudioVariant;
+exports.toProcessingView = toProcessingView;

package/dist/cjs/index.d.cts

@@ -1,93 +1,10 @@
 export { CreateAudioPostRequest, CreateAudioPostRequestSchema, PatchAudioPostRequest, PatchAudioPostRequestSchema } from './api-codecs.cjs';
 export { FirestoreTimestamp, FirestoreTimestampSchema } from './types/records.cjs';
 export { ActorProfileRecord, ActorProfileRecordSchema, AudioEmbed, AudioEmbedSchema, AudioEmbedView, AudioEmbedViewSchema, AudioPostRecord, AudioPostRecordSchema, AudioPostView, AudioPostViewSchema, PostRecordPublic, PostRecordPublicSchema, ReplyRef, ReplyRefSchema, StrongRef, StrongRefSchema, TimedTranscript, TimedTranscriptSchema, TranscriptEnrichmentRecord, TranscriptEnrichmentRecordSchema, TranscriptSegment, TranscriptSegmentSchema, ViewerState, ViewerStateSchema } from './types/audio.cjs';
-import { z } from 'zod';
+export { BYTE_MUTATING_STAGES, CanonicalAudioFields, DERIVED_STAGES, PROCESSING_STAGES, ProcessingRequest, ProcessingRequestSchema, ProcessingStage, ProcessingStageMap, ProcessingStageMapSchema, ProcessingStageSchema, ProcessingStageStatus, ProcessingStageStatusSchema, ProcessingState, ProcessingStateSchema, ProcessingView, ProcessingViewSchema, ResolvedProcessing, ResolvedProcessingSchema, resolveAudioVariant, toProcessingView } from './types/processing.cjs';
 export { BlobRef, BlobRefSchema } from './types/blob.cjs';
-export { COLLECTIONS, EMBED_NSID, NSID, NsidValue, StoredNsidValue } from './nsid.cjs';
+export { COLLECTIONS, EMBED_NSID, NSID, NsidValue, StoredNsidValue, XRPC_NSID, XrpcNsidValue } from './nsid.cjs';
 export { ConflictError, ForbiddenError, NotFoundError, RateLimitError, ServiceError, UnauthorizedError, ValidationError } from './errors/index.cjs';
 export { isFirestoreTimestamp } from './utils/index.cjs';
 export { ReportedErrorEvent, buildReportedErrorEvent, reportError } from './observability/report-error.cjs';
-
-/**
- * Audio hygiene / enrichment processing (B5).
- *
- * Antiphony can, when the calling app opts in, run two pieces of audio
- * processing on a post's audio: **transcription** (machine transcript, the
- * `dev.antiphony.audio.transcript` enrichment) and **denoise** (a cleaned
- * audio variant for playback). Both are OFF by default — the app asks for
- * them per post via `CreateAudioPostRequest.processing`.
- *
- * The work runs asynchronously (outside the create request), so a post
- * carries a mutable `processing` state that starts `pending` and settles to
- * `ready`/`failed`/`skipped` per stage. That state is a storage-layer field —
- * it is NOT part of the canonical lexicon record and never enters the record
- * CID (like `kind` and `threadParticipants`), so processing can update it
- * without changing the post's content address.
- */
-/**
- * Per-stage status.
- *  - `pending`  — requested, not yet done (the worker acts on these).
- *  - `ready`    — completed.
- *  - `failed`   — attempted and errored.
- *  - `skipped`  — requested but this deployment has no provider for it.
- */
-declare const ProcessingStageStatusSchema: z.ZodEnum<["pending", "ready", "failed", "skipped"]>;
-type ProcessingStageStatus = z.infer<typeof ProcessingStageStatusSchema>;
-/**
- * What the calling app opts into, on `CreateAudioPostRequest`. Both default
- * off; only `true` values request a stage.
- */
-declare const ProcessingRequestSchema: z.ZodObject<{
-    transcribe: z.ZodOptional<z.ZodBoolean>;
-    denoise: z.ZodOptional<z.ZodBoolean>;
-}, "strip", z.ZodTypeAny, {
-    transcribe?: boolean | undefined;
-    denoise?: boolean | undefined;
-}, {
-    transcribe?: boolean | undefined;
-    denoise?: boolean | undefined;
-}>;
-type ProcessingRequest = z.infer<typeof ProcessingRequestSchema>;
-/**
- * Stored processing state on the post record (storage-layer; not in the CID).
- * A stage key is present iff that stage was requested. `denoisedBlobCid`
- * points at the cleaned audio variant once denoise completes — the record's
- * own `embed.audio.ref.$link` stays the ORIGINAL CID (immutable content
- * address); only the read-time view swaps playback to the cleaned variant.
- */
-declare const ProcessingStateSchema: z.ZodObject<{
-    transcribe: z.ZodOptional<z.ZodEnum<["pending", "ready", "failed", "skipped"]>>;
-    denoise: z.ZodOptional<z.ZodEnum<["pending", "ready", "failed", "skipped"]>>;
-    /** Content CID of the denoised audio variant, once `denoise === 'ready'`. */
-    denoisedBlobCid: z.ZodOptional<z.ZodString>;
-    updatedAt: z.ZodEffects<z.ZodUnion<[z.ZodType<unknown, z.ZodTypeDef, unknown>, z.ZodString, z.ZodNumber, z.ZodDate]>, Date, unknown>;
-}, "strip", z.ZodTypeAny, {
-    updatedAt: Date;
-    transcribe?: "pending" | "ready" | "failed" | "skipped" | undefined;
-    denoise?: "pending" | "ready" | "failed" | "skipped" | undefined;
-    denoisedBlobCid?: string | undefined;
-}, {
-    transcribe?: "pending" | "ready" | "failed" | "skipped" | undefined;
-    denoise?: "pending" | "ready" | "failed" | "skipped" | undefined;
-    denoisedBlobCid?: string | undefined;
-    updatedAt?: unknown;
-}>;
-type ProcessingState = z.infer<typeof ProcessingStateSchema>;
-/**
- * The processing status surfaced on the hydrated view — the per-stage status
- * only (no internal storage fields). Absent when no processing was requested.
- * Clients treat any `pending` stage as "still working".
- */
-declare const ProcessingViewSchema: z.ZodObject<{
-    transcribe: z.ZodOptional<z.ZodEnum<["pending", "ready", "failed", "skipped"]>>;
-    denoise: z.ZodOptional<z.ZodEnum<["pending", "ready", "failed", "skipped"]>>;
-}, "strip", z.ZodTypeAny, {
-    transcribe?: "pending" | "ready" | "failed" | "skipped" | undefined;
-    denoise?: "pending" | "ready" | "failed" | "skipped" | undefined;
-}, {
-    transcribe?: "pending" | "ready" | "failed" | "skipped" | undefined;
-    denoise?: "pending" | "ready" | "failed" | "skipped" | undefined;
-}>;
-type ProcessingView = z.infer<typeof ProcessingViewSchema>;
-
-export { type ProcessingRequest, ProcessingRequestSchema, type ProcessingStageStatus, ProcessingStageStatusSchema, type ProcessingState, ProcessingStateSchema, type ProcessingView, ProcessingViewSchema };
+import 'zod';

package/dist/cjs/nsid.cjs

@@ -16,6 +16,15 @@ var EMBED_NSID = {
   Audio: "dev.antiphony.embed.audio",
   RecordWithAudio: "dev.antiphony.embed.recordWithAudio"
 };
+var XRPC_NSID = {
+  // Queries (GET).
+  GetPost: "dev.antiphony.audio.getPost",
+  GetThread: "dev.antiphony.audio.getThread",
+  GetPlaybackUrl: "dev.antiphony.audio.getPlaybackUrl",
+  // Procedures (POST).
+  CreatePost: "dev.antiphony.audio.createPost",
+  ReprocessPost: "dev.antiphony.audio.reprocessPost"
+};
 var COLLECTIONS = {
   // One post collection + the transcript enrichment namespace.
   [NSID.AudioPost]: "posts",
@@ -25,3 +34,4 @@ var COLLECTIONS = {
 exports.COLLECTIONS = COLLECTIONS;
 exports.EMBED_NSID = EMBED_NSID;
 exports.NSID = NSID;
+exports.XRPC_NSID = XRPC_NSID;

package/dist/cjs/nsid.d.cts

@@ -23,6 +23,30 @@ declare const EMBED_NSID: {
     readonly Audio: "dev.antiphony.embed.audio";
     readonly RecordWithAudio: "dev.antiphony.embed.recordWithAudio";
 };
+/**
+ * XRPC method NSIDs — the `/xrpc/<nsid>` surface (see
+ * specs/xrpc-and-atproto-lex-strategy.md).
+ *
+ * These are **siblings** of the record NSIDs in `NSID`, not children of them.
+ * A method shares the authority segment (`dev.antiphony.audio`) with the record
+ * but never nests under the record's own name: the record is
+ * `dev.antiphony.audio.post` and the query that fetches it is
+ * `dev.antiphony.audio.getPost`. Deriving one by appending to the other
+ * produces `dev.antiphony.audio.post.getPost`, a different and undefined
+ * namespace — hence a separate map rather than a helper over `NSID`.
+ *
+ * Queries are `GET`, procedures are `POST`; the grouping below follows that
+ * split because it is also the auth split (procedures always require an acting
+ * actor, queries may be viewer-less).
+ */
+declare const XRPC_NSID: {
+    readonly GetPost: "dev.antiphony.audio.getPost";
+    readonly GetThread: "dev.antiphony.audio.getThread";
+    readonly GetPlaybackUrl: "dev.antiphony.audio.getPlaybackUrl";
+    readonly CreatePost: "dev.antiphony.audio.createPost";
+    readonly ReprocessPost: "dev.antiphony.audio.reprocessPost";
+};
+type XrpcNsidValue = typeof XRPC_NSID[keyof typeof XRPC_NSID];
 /**
  * Maps the STORED AT Protocol record-type NSIDs to Firestore collection
  * names. When migrating to a PDS, this mapping becomes the adapter layer.
@@ -30,4 +54,4 @@ declare const EMBED_NSID: {
  */
 declare const COLLECTIONS: Record<StoredNsidValue, string>;
 
-export { COLLECTIONS, EMBED_NSID, NSID, type NsidValue, type StoredNsidValue };
+export { COLLECTIONS, EMBED_NSID, NSID, type NsidValue, type StoredNsidValue, XRPC_NSID, type XrpcNsidValue };

package/dist/cjs/types/audio.cjs

@@ -46,21 +46,109 @@ var FirestoreTimestampSchema = zod.z.union([
   return date;
 });
 var ProcessingStageStatusSchema = zod.z.enum(["pending", "ready", "failed", "skipped"]);
+var PROCESSING_STAGES = ["denoise", "trim", "transcribe", "waveform"];
+zod.z.enum(PROCESSING_STAGES);
 zod.z.object({
   transcribe: zod.z.boolean().optional(),
-  denoise: zod.z.boolean().optional()
+  denoise: zod.z.boolean().optional(),
+  trim: zod.z.boolean().optional(),
+  waveform: zod.z.boolean().optional(),
+  /**
+   * Whether a completed byte-mutating stage should invalidate and recompute
+   * the derived artifacts that describe the old audio. Defaults to **true**
+   * — a transcript of superseded audio is wrong, not merely stale.
+   *
+   * `false` opts out, for an app that would rather keep the existing
+   * transcript than pay to regenerate it. It does NOT name a stage, so a
+   * request carrying only `reprocess` requests no work.
+   */
+  reprocess: zod.z.boolean().optional()
 });
-var ProcessingStateSchema = zod.z.object({
+var ProcessingStageMapSchema = zod.z.object({
   transcribe: ProcessingStageStatusSchema.optional(),
   denoise: ProcessingStageStatusSchema.optional(),
-  /** Content CID of the denoised audio variant, once `denoise === 'ready'`. */
-  denoisedBlobCid: zod.z.string().optional(),
-  updatedAt: FirestoreTimestampSchema
+  trim: ProcessingStageStatusSchema.optional(),
+  waveform: ProcessingStageStatusSchema.optional()
 });
-var ProcessingViewSchema = zod.z.object({
-  transcribe: ProcessingStageStatusSchema.optional(),
-  denoise: ProcessingStageStatusSchema.optional()
+var ResolvedProcessingSchema = ProcessingStageMapSchema.extend({
+  reprocess: zod.z.boolean().optional()
 });
+var ProcessingStateSchema = ResolvedProcessingSchema.extend({
+  /**
+   * Content CID of the processed audio variant — the composed output of every
+   * byte-mutating stage that has completed. The record's own
+   * `embed.audio.ref.$link` stays the ORIGINAL CID (immutable content
+   * address); only the read-time view swaps playback to this variant.
+   */
+  processedBlobCid: zod.z.string().optional(),
+  /**
+   * MIME type of the processed variant. Present because providers may
+   * TRANSCODE — the ElevenLabs Voice Isolator returns MP3 regardless of what
+   * it is given — so the variant's type cannot be assumed to match
+   * `embed.audio.mimeType`. Anything reading the variant's bytes must use
+   * this, not the embed's.
+   */
+  processedMimeType: zod.z.string().optional(),
+  /**
+   * Duration of the processed variant, when a byte-mutating stage changed it
+   * (i.e. trim). Absent when the variant's duration matches the original.
+   */
+  processedDurationMs: zod.z.number().int().min(0).optional(),
+  /**
+   * Which denoiser produced the variant's denoise contribution — provenance,
+   * the counterpart to a transcript record's `model`.
+   *
+   * Lives here because a cleaned variant, unlike a transcript, has no record
+   * of its own to carry it: it is a blob CID on this state. Without it,
+   * changing denoisers leaves no way to tell which variants predate the
+   * switch, so nothing can identify what to re-run.
+   *
+   * Named for the STAGE, not the variant (`processedModel`), because it
+   * describes one link of the byte-mutating chain rather than the composed
+   * artifact. Trim contributes to the same variant and has no model, and a
+   * later external link would want its own field rather than to overwrite
+   * this one.
+   *
+   * Written on every successful denoise, never cleared — it moves with
+   * `processedBlobCid`, which is only ever set, never reset. A denoise that
+   * FAILS leaves both alone, which is correct: the variant still holds the
+   * previous denoiser's output, so the previous model still describes it.
+   *
+   * Internal, like the other variant fields — `toProcessingView` projects
+   * stages only, so this never reaches a client.
+   */
+  denoiseModel: zod.z.string().optional(),
+  /**
+   * Peaks for the processed variant, once the `waveform` stage completes.
+   * Same normalization and bounds as `embed.waveform` (0–100, max 1000), so
+   * a view can never carry a larger payload than the record allows.
+   */
+  waveformPeaks: zod.z.array(zod.z.number().int().min(0).max(100)).max(1e3).optional(),
+  /**
+   * When the current runner's exclusive claim on this post expires.
+   *
+   * Queue delivery is at-least-once, so the same job can arrive twice and
+   * run CONCURRENTLY. `process()` is idempotent under sequential retry — it
+   * acts on `pending` and re-does nothing already settled — but two passes
+   * interleaved is a different failure: both read the same `pending` state,
+   * both bill the provider for the same stage, and both write
+   * `processedBlobCid`, so the surviving variant is whichever finished last
+   * and the other's blob is orphaned.
+   *
+   * A runner claims this field transactionally before doing any work and
+   * clears it when finished; a second runner finding it unexpired declines
+   * and returns. It is an EXPIRY, not a boolean lock, because the holder can
+   * die mid-run (instance recycled, process killed) with no chance to
+   * release — a plain flag would strand the post permanently, where a lapsed
+   * lease lets the next delivery pick it up.
+   *
+   * Internal, like the variant fields above: `toProcessingView` projects
+   * stages only, so this never reaches a client.
+   */
+  leaseUntil: FirestoreTimestampSchema.optional(),
+  updatedAt: FirestoreTimestampSchema
+});
+var ProcessingViewSchema = ProcessingStageMapSchema;
 
 // types/audio.ts
 var StrongRefSchema = zod.z.object({
@@ -96,20 +184,34 @@ var TimedTranscriptSchema = zod.z.object({
 });
 var AudioEmbedViewSchema = zod.z.object({
   $type: zod.z.literal("dev.antiphony.embed.audio#view"),
+  /**
+   * `url`, `durationMs` and `waveform` are RESOLVED, not copied: once
+   * processing has produced an audio variant they describe that variant
+   * rather than the bytes the client uploaded. They always agree with one
+   * another — a duration and a set of peaks are only meaningful against the
+   * audio `url` actually points at.
+   *
+   * A client that stored `durationMs` at upload time should therefore expect
+   * it to change (trim removes leading/trailing silence), and should render
+   * these three as a set rather than caching them independently. The record's
+   * originals are immutable and unaffected; this is a read-time resolution.
+   */
   url: zod.z.string().url(),
   durationMs: zod.z.number().int().min(0).optional(),
-  // `alt`/`waveform` are copied from the stored embed; keep the same bounds
-  // so a view can never carry a larger payload than the record allows.
+  // `alt` is copied from the stored embed; keep the same bounds so a view can
+  // never carry a larger payload than the record allows.
   alt: zod.z.string().max(1e4).optional(),
   waveform: zod.z.array(zod.z.number().int().min(0).max(100)).max(1e3).optional(),
   /** Lifted from the transcript enrichment record; absent until transcription completes. */
   transcript: TimedTranscriptSchema.optional(),
   /**
-   * Per-stage audio-processing status (transcribe / denoise), when the app
-   * opted into processing on create. Absent otherwise. A `pending` stage
-   * means the client should poll (or re-render) for the result. When
-   * `denoise === 'ready'`, `url` above already resolves to the cleaned
-   * audio variant. See `types/processing.ts`.
+   * Per-stage audio-processing status (denoise / trim / transcribe /
+   * waveform), when the app opted into processing. Absent otherwise. A
+   * `pending` stage means the client should poll (or re-render) for the
+   * result — including a stage that returns to `pending` after having been
+   * `ready`, which is how a recompute surfaces. Once a byte-mutating stage
+   * completes, `url`/`durationMs`/`waveform` above already resolve to the
+   * processed audio variant. See `types/processing.ts`.
    */
   processing: ProcessingViewSchema.optional()
 });
@@ -213,10 +315,15 @@ var ViewerStateSchema = zod.z.object({
   replyDisabledReason: zod.z.enum(["unauthenticated", "not_a_participant"]).optional()
 });
 var PostRecordPublicSchema = zod.z.object({
-  text: zod.z.string(),
-  title: zod.z.string().optional(),
+  // `text`, `title` and `langs` keep the record's bounds, for the same reason
+  // `AudioEmbedViewSchema.alt` does: a view must never be able to carry a
+  // larger payload than the record it projects. The write path already
+  // enforces these, so no stored post can exceed them — stating them here
+  // keeps the published contract honest rather than adding a new constraint.
+  text: zod.z.string().max(3e3),
+  title: zod.z.string().max(3e3).optional(),
   reply: ReplyRefSchema.optional(),
-  langs: zod.z.array(zod.z.string()).optional(),
+  langs: zod.z.array(zod.z.string()).max(3).optional(),
   selfLabels: zod.z.array(zod.z.string()).optional(),
   createdAt: FirestoreTimestampSchema
 });