@de-otio/trellis 0.10.11 → 0.12.0

package/dist/lib/realtime/realtime-transport.js

@@ -0,0 +1,23 @@
+// CONTRACT: stable — coordinate changes.
+//
+// The RealtimeTransport capability interface — THE seam every other workstream
+// and the Skybber client binds to. The interface body lives in types.ts (single
+// source of truth for the frozen type set); this module re-exports it under its
+// own name so consumers can import the contract from a file whose name states
+// what it is, and so the CONTRACT banner sits with the interface.
+//
+// Binding rules for every transport implementor (poll, noop, appsync-events):
+//   - deliver() is BEST-EFFORT and NEVER rolls back a persisted write. It
+//     resolves with a DeliveryResult; it must catch its own transport errors
+//     and surface them as { delivered: false, reason: "transport_error" }.
+//   - The policy fence (the safety floor) runs INSIDE every deliver(), never at
+//     the call site. A transport author MUST call the resolver and honor a
+//     { deliver: false } by NOT sending. PollTransport, NoopRealtimeTransport,
+//     and Skybber's AppSyncEventsTransport all obey this.
+//   - payload is OPAQUE bytes the transport never parses (blind relay). Anything
+//     sensitive is client-side ciphertext; content-free wakeups use
+//     encodeWakeup().
+//   - Implementations MUST NOT durably log connection/delivery metadata as
+//     ordinary operational data (CLAUDE.md rule 7; retention is runtime config).
+export {};
+//# sourceMappingURL=realtime-transport.js.map

package/dist/lib/realtime/realtime-transport.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"realtime-transport.js","sourceRoot":"","sources":["../../../src/lib/realtime/realtime-transport.ts"],"names":[],"mappings":"AAAA,yCAAyC;AACzC,EAAE;AACF,+EAA+E;AAC/E,gFAAgF;AAChF,gFAAgF;AAChF,8EAA8E;AAC9E,kEAAkE;AAClE,EAAE;AACF,8EAA8E;AAC9E,0EAA0E;AAC1E,6EAA6E;AAC7E,2EAA2E;AAC3E,gFAAgF;AAChF,2EAA2E;AAC3E,+EAA+E;AAC/E,0DAA0D;AAC1D,iFAAiF;AACjF,oEAAoE;AACpE,sBAAsB;AACtB,2EAA2E;AAC3E,iFAAiF"}

package/dist/lib/realtime/setting-store.d.ts

@@ -0,0 +1,30 @@
+import type { ChangeCursorStore, ChangedSettingMeta, EncryptedBlob, PutResult, SettingStore } from "./types.js";
+export type { SettingStore };
+/**
+ * In-memory `SettingStore` with optimistic-concurrency semantics. Keyed by
+ * `userId \0 namespace`. The server NEVER parses `ciphertext`.
+ *
+ * Optimistic concurrency:
+ *  - First write of a (user, namespace) requires `expectVersion === 0`; a
+ *    non-zero `expectVersion` against an absent record => `not_found`.
+ *  - A write whose `expectVersion` does not equal the stored version =>
+ *    `version_conflict` carrying the current blob for client-side merge.
+ *  - On success the stored version is set to `expectVersion + 1` and
+ *    `updatedAt` is server-assigned from the injectable clock.
+ */
+export declare class InMemorySettingStore implements SettingStore, ChangeCursorStore {
+    private readonly now;
+    private readonly store;
+    constructor(now?: () => Date);
+    private key;
+    get(userId: string, namespace: string): Promise<EncryptedBlob | null>;
+    put(userId: string, namespace: string, blob: EncryptedBlob, expectVersion: number): Promise<PutResult>;
+    /**
+     * Track C — offline backfill. Returns metadata for this user's namespaces whose
+     * `version` advanced strictly past `sinceVersion`. METADATA ONLY: never carries
+     * `ciphertext`. Sorted by ascending `version` so the caller can advance its
+     * cursor to the last entry's `version`.
+     */
+    listChangedSince(userId: string, sinceVersion: number): Promise<ChangedSettingMeta[]>;
+}
+//# sourceMappingURL=setting-store.d.ts.map

package/dist/lib/realtime/setting-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"setting-store.d.ts","sourceRoot":"","sources":["../../../src/lib/realtime/setting-store.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EACV,iBAAiB,EACjB,kBAAkB,EAClB,aAAa,EACb,SAAS,EACT,YAAY,EACb,MAAM,YAAY,CAAC;AAEpB,YAAY,EAAE,YAAY,EAAE,CAAC;AAE7B;;;;;;;;;;;GAWG;AACH,qBAAa,oBAAqB,YAAW,YAAY,EAAE,iBAAiB;IAQ9D,OAAO,CAAC,QAAQ,CAAC,GAAG;IALhC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAGlB;gBAEyB,GAAG,GAAE,MAAM,IAAuB;IAE/D,OAAO,CAAC,GAAG;IAIL,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC;IAIrE,GAAG,CACP,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,aAAa,EACnB,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC,SAAS,CAAC;IAgCrB;;;;;OAKG;IACG,gBAAgB,CACpB,MAAM,EAAE,MAAM,EACd,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,kBAAkB,EAAE,CAAC;CAcjC"}

package/dist/lib/realtime/setting-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"setting-store.js","sourceRoot":"","sources":["../../../src/lib/realtime/setting-store.ts"],"names":[],"mappings":"AAAA,8DAA8D;AAC9D,EAAE;AACF,wEAAwE;AACxE,sDAAsD;AACtD,8EAA8E;AAC9E,+EAA+E;AAC/E,wDAAwD;AAYxD;;;;;;;;;;;GAWG;AACH,MAAM,OAAO,oBAAoB;IAQF;IAP7B,+EAA+E;IAC/E,6EAA6E;IAC5D,KAAK,GAAG,IAAI,GAAG,EAG7B,CAAC;IAEJ,YAA6B,MAAkB,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE;QAAlC,QAAG,GAAH,GAAG,CAA+B;IAAG,CAAC;IAE3D,GAAG,CAAC,MAAc,EAAE,SAAiB;QAC3C,OAAO,GAAG,MAAM,IAAI,SAAS,EAAE,CAAC;IAClC,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,MAAc,EAAE,SAAiB;QACzC,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,EAAE,IAAI,IAAI,IAAI,CAAC;IACnE,CAAC;IAED,KAAK,CAAC,GAAG,CACP,MAAc,EACd,SAAiB,EACjB,IAAmB,EACnB,aAAqB;QAErB,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QACtC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAChC,MAAM,OAAO,GAAG,KAAK,EAAE,IAAI,CAAC;QAE5B,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,iEAAiE;YACjE,IAAI,aAAa,KAAK,CAAC,EAAE,CAAC;gBACxB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;YAC3D,CAAC;YACD,MAAM,MAAM,GAAkB;gBAC5B,UAAU,EAAE,IAAI,CAAC,UAAU;gBAC3B,OAAO,EAAE,CAAC;gBACV,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;aACpC,CAAC;YACF,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;YACvD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;QAC9B,CAAC;QAED,IAAI,OAAO,CAAC,OAAO,KAAK,aAAa,EAAE,CAAC;YACtC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,kBAAkB,EAAE,OAAO,EAAE,CAAC;QAC5D,CAAC;QAED,MAAM,MAAM,GAAkB;YAC5B,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,OAAO,EAAE,OAAO,CAAC,OAAO,GAAG,CAAC;YAC5B,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;SACpC,CAAC;QACF,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;QACvD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAC9B,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,gBAAgB,CACpB,MAAc,EACd,YAAoB;QAEpB,MAAM,GAAG,GAAyB,EAAE,CAAC;QACrC,KAAK,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;YACrE,IAAI,KAAK,KAAK,MAAM;gBAAE,SAAS;YAC/B,IAAI,IAAI,CAAC,OAAO,IAAI,YAAY;gBAAE,SAAS;YAC3C,GAAG,CAAC,IAAI,CAAC;gBACP,SAAS;gBACT,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,SAAS,EAAE,IAAI,CAAC,SAAS;aAC1B,CAAC,CAAC;QACL,CAAC;QACD,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC;QAC1C,OAAO,GAAG,CAAC;IACb,CAAC;CACF"}

package/dist/lib/realtime/types.d.ts

@@ -0,0 +1,200 @@
+import type { NotificationType, AgeTier } from "@prisma/client";
+/**
+ * Coarse class of realtime traffic. Lets policy/transport route and rate-shape.
+ * v1 ships ONLY the user-scoped kinds (`wakeup`, `setting_sync`, `safety`);
+ * `message` and `thread` are taxonomy-reserved but unused (DEFERRED).
+ */
+export type ChannelKind = "wakeup" | "setting_sync" | "safety" | "message" | "thread";
+/** The scope a channel addresses. v1 ships only `"user"`. */
+export type ScopeType = "user" | "conversation" | "thread";
+/**
+ * A push-delivery channel — a content-free routing address, ALWAYS tenant- and
+ * scope-bound and server-verified. The canonical string form is produced ONLY
+ * by `channelName()` and parsed ONLY by `parseChannel()` (and the Skybber
+ * `@skybber/realtime-channels` parser, which must round-trip them).
+ *
+ * FROZEN kind→scopeType map (v1 ships ONLY user-scoped kinds):
+ *   wakeup | setting_sync | safety  -> scopeType "user",  scopeId = recipient userId
+ *   message                         -> scopeType "conversation" (DEFERRED)
+ *   thread                          -> scopeType "thread"        (DEFERRED)
+ */
+export interface Channel {
+    kind: ChannelKind;
+    /** Server-resolved tenant scope. */
+    tenantId: string;
+    scopeType: ScopeType;
+    /** userId (v1) | conversationId | threadId (deferred). */
+    scopeId: string;
+}
+/**
+ * Verified identity. Derived ONLY from Cognito claims (custom:userId,
+ * custom:activeTenantId) — by the in-core handler AND the Skybber authorizer
+ * Lambda — so both call the SAME function. Never an ambient Session, never a
+ * client-asserted path.
+ */
+export interface VerifiedIdentity {
+    userId: string;
+    tenantId: string;
+}
+/** Recipient address for `deliver()`. Both fields server-resolved. */
+export interface DeliveryTarget {
+    userId: string;
+    tenantId: string;
+}
+/**
+ * Result of a `deliver()` attempt. `deliver()` is BEST-EFFORT: it NEVER rejects
+ * in a way that rolls back a persisted write. It resolves with this result;
+ * transports catch their own errors. The policy fence runs INSIDE every
+ * transport's `deliver()`.
+ */
+export type DeliveryResult = {
+    delivered: true;
+} | {
+    delivered: false;
+    reason: "policy_denied" | "no_transport" | "transport_error";
+};
+/**
+ * Input the policy resolver sees. Built by the caller from its own args
+ * (`createNotification` has no Session), enriched with recipient ageTier /
+ * blocked-sender as needed for the floor.
+ */
+export interface DeliveryContext {
+    type: NotificationType;
+    recipientUserId: string;
+    tenantId: string;
+    /** blocked-sender floor input. */
+    senderUserId?: string;
+    /** minor-protection floor input. */
+    recipientAgeTier?: AgeTier;
+    now: Date;
+    quietHours?: QuietHoursConfig | null;
+}
+/** What the resolver decided for ONE delivery attempt. */
+export type DeliveryDecision = {
+    deliver: true;
+} | {
+    deliver: false;
+    reason: "preference" | "quiet_hours" | "blocked_sender" | "floor";
+};
+/**
+ * Quiet-hours window. `start`/`end` are opaque to the contract; the resolver
+ * that produced the context owns their interpretation. (The core resolver
+ * encodes minutes-since-midnight as decimal strings to reproduce the existing
+ * `User.quietHoursStart/End` integer behavior byte-identically.)
+ */
+export interface QuietHoursConfig {
+    enabled: boolean;
+    start: string;
+    end: string;
+}
+/**
+ * The ONLY shape push payloads for wakeup/setting_sync may take. It has NO
+ * free-form field — content-free is a property of the TYPE, not a test
+ * heuristic. WS4/WS5 are FORBIDDEN from constructing arbitrary Uint8Array for
+ * these kinds; they must use `encodeWakeup()`.
+ */
+export interface WakeupEnvelope {
+    v: 1;
+    kind: ChannelKind;
+    /** opaque version pointer for setting_sync (NOT ciphertext). */
+    changeToken?: string;
+}
+/** Encode a wakeup envelope to its canonical content-free byte form. */
+export declare function encodeWakeup(e: WakeupEnvelope): Uint8Array;
+/** Decode a wakeup envelope. Throws on unknown fields or malformed input. */
+export declare function decodeWakeup(b: Uint8Array): WakeupEnvelope;
+/**
+ * Opaque AEAD ciphertext + plaintext sync metadata. The server NEVER reads
+ * `ciphertext`. `version`/`updatedAt` are deliberately plaintext (they leak
+ * only THAT/WHEN a setting changed, not WHAT).
+ */
+export interface EncryptedBlob {
+    /** Base64url AEAD ciphertext of the client's JSON document. */
+    ciphertext: string;
+    /** Monotonic per (userId, namespace). Drives optimistic concurrency. */
+    version: number;
+    /** ISO-8601; server-assigned on write. */
+    updatedAt: string;
+}
+/**
+ * Result of `putSetting` — optimistic-concurrency outcome. Never throws on
+ * conflict; the caller (and ultimately the client) reconciles against
+ * `current`.
+ */
+export type PutResult = {
+    ok: true;
+    stored: EncryptedBlob;
+} | {
+    ok: false;
+    reason: "version_conflict";
+    current: EncryptedBlob;
+} | {
+    ok: false;
+    reason: "not_found";
+    current: null;
+};
+/**
+ * Minimal store port the transports use for blob sync. WS5 supplies
+ * `PrismaEncryptedSettingsStore`; WS1 ships `InMemorySettingStore` so core
+ * runs/tests with zero infra. Holds CIPHERTEXT ONLY.
+ *
+ * FROZEN (§2.5): do NOT add methods here. Offline-backfill (Track C) is layered
+ * as the SEPARATE optional `ChangeCursorStore` capability below so this contract
+ * stays byte-stable for every consumer bound to it.
+ */
+export interface SettingStore {
+    get(userId: string, namespace: string): Promise<EncryptedBlob | null>;
+    put(userId: string, namespace: string, blob: EncryptedBlob, expectVersion: number): Promise<PutResult>;
+}
+/**
+ * Metadata for ONE namespace whose version advanced past a client's cursor.
+ *
+ * SERVER-BLIND: deliberately carries NO `ciphertext`. It leaks only THAT/WHEN a
+ * namespace changed (already-plaintext sync metadata), never WHAT. A client that
+ * sees its namespace here re-pulls the blob over the authenticated GET. The
+ * absence of `ciphertext` is a TYPE-level guarantee, asserted by the tests.
+ */
+export interface ChangedSettingMeta {
+    namespace: string;
+    /** Monotonic per (userId, namespace) — the new high-watermark for this row. */
+    version: number;
+    /** ISO-8601 server-assigned write time. */
+    updatedAt: string;
+}
+/**
+ * OPTIONAL offline-backfill capability (Track C), layered ALONGSIDE the frozen
+ * `SettingStore` rather than baked into it. A store MAY also implement this to
+ * answer "which of my namespaces changed since I was last online?".
+ *
+ * The cursor (`sinceVersion`) is an opaque per-user version high-watermark: the
+ * largest `version` the client has already observed across ALL its namespaces.
+ * `listChangedSince` returns metadata for every namespace whose stored `version`
+ * is strictly greater than that watermark — METADATA ONLY, never `ciphertext`.
+ */
+export interface ChangeCursorStore {
+    listChangedSince(userId: string, sinceVersion: number): Promise<ChangedSettingMeta[]>;
+}
+/** Narrowing helper: does this store also provide the change-cursor capability? */
+export declare function supportsChangeCursor(store: SettingStore): store is SettingStore & ChangeCursorStore;
+/**
+ * The capability seam. Core ships `PollTransport` (default) + `NoopRealtimeTransport`
+ * (CI); a consuming app injects a concrete transport (e.g. Skybber's
+ * `AppSyncEventsTransport`) via `setRealtimeProvider()` WITHOUT core ever
+ * importing an AWS SDK.
+ *
+ * `subscribeInContext` is intentionally NOT part of the v1 freeze (in-context
+ * liveness is messaging-era; adding an optional method later is non-breaking).
+ */
+export interface RealtimeTransport {
+    readonly kind: "poll" | "appsync-events" | "noop";
+    /** Best-effort push. Runs the policy fence (floor) internally, every transport. */
+    deliver(target: DeliveryTarget, channel: Channel, payload: Uint8Array): Promise<DeliveryResult>;
+    getSetting(userId: string, namespace: string): Promise<EncryptedBlob | null>;
+    putSetting(userId: string, namespace: string, blob: EncryptedBlob, expectVersion: number): Promise<PutResult>;
+    shutdown?(): Promise<void>;
+}
+/** The policy port. WS1 ships `CalmDeliveryResolver`; WS3 may layer it. */
+export interface DeliveryPolicyResolver {
+    decide(ctx: DeliveryContext): DeliveryDecision;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/lib/realtime/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/lib/realtime/types.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,gBAAgB,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAC;AAMhE;;;;GAIG;AACH,MAAM,MAAM,WAAW,GACnB,QAAQ,GACR,cAAc,GACd,QAAQ,GACR,SAAS,GACT,QAAQ,CAAC;AAEb,6DAA6D;AAC7D,MAAM,MAAM,SAAS,GAAG,MAAM,GAAG,cAAc,GAAG,QAAQ,CAAC;AAE3D;;;;;;;;;;GAUG;AACH,MAAM,WAAW,OAAO;IACtB,IAAI,EAAE,WAAW,CAAC;IAClB,oCAAoC;IACpC,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,SAAS,CAAC;IACrB,0DAA0D;IAC1D,OAAO,EAAE,MAAM,CAAC;CACjB;AAMD;;;;;GAKG;AACH,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;CAClB;AAMD,sEAAsE;AACtE,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;;;;GAKG;AACH,MAAM,MAAM,cAAc,GACtB;IAAE,SAAS,EAAE,IAAI,CAAA;CAAE,GACnB;IACE,SAAS,EAAE,KAAK,CAAC;IACjB,MAAM,EAAE,eAAe,GAAG,cAAc,GAAG,iBAAiB,CAAC;CAC9D,CAAC;AAEN;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,gBAAgB,CAAC;IACvB,eAAe,EAAE,MAAM,CAAC;IACxB,QAAQ,EAAE,MAAM,CAAC;IACjB,kCAAkC;IAClC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,oCAAoC;IACpC,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,GAAG,EAAE,IAAI,CAAC;IACV,UAAU,CAAC,EAAE,gBAAgB,GAAG,IAAI,CAAC;CACtC;AAED,0DAA0D;AAC1D,MAAM,MAAM,gBAAgB,GACxB;IAAE,OAAO,EAAE,IAAI,CAAA;CAAE,GACjB;IACE,OAAO,EAAE,KAAK,CAAC;IACf,MAAM,EAAE,YAAY,GAAG,aAAa,GAAG,gBAAgB,GAAG,OAAO,CAAC;CACnE,CAAC;AAEN;;;;;GAKG;AACH,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;CACb;AAMD;;;;;GAKG;AACH,MAAM,WAAW,cAAc;IAC7B,CAAC,EAAE,CAAC,CAAC;IACL,IAAI,EAAE,WAAW,CAAC;IAClB,gEAAgE;IAChE,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,wEAAwE;AACxE,wBAAgB,YAAY,CAAC,CAAC,EAAE,cAAc,GAAG,UAAU,CAQ1D;AAED,6EAA6E;AAC7E,wBAAgB,YAAY,CAAC,CAAC,EAAE,UAAU,GAAG,cAAc,CA6B1D;AAMD;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC5B,+DAA+D;IAC/D,UAAU,EAAE,MAAM,CAAC;IACnB,wEAAwE;IACxE,OAAO,EAAE,MAAM,CAAC;IAChB,0CAA0C;IAC1C,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;;GAIG;AACH,MAAM,MAAM,SAAS,GACjB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,aAAa,CAAA;CAAE,GACnC;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,kBAAkB,CAAC;IAAC,OAAO,EAAE,aAAa,CAAA;CAAE,GACjE;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,WAAW,CAAC;IAAC,OAAO,EAAE,IAAI,CAAA;CAAE,CAAC;AAEtD;;;;;;;;GAQG;AACH,MAAM,WAAW,YAAY;IAC3B,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAAC;IACtE,GAAG,CACD,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,aAAa,EACnB,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC,SAAS,CAAC,CAAC;CACvB;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,kBAAkB;IACjC,SAAS,EAAE,MAAM,CAAC;IAClB,+EAA+E;IAC/E,OAAO,EAAE,MAAM,CAAC;IAChB,2CAA2C;IAC3C,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,iBAAiB;IAChC,gBAAgB,CACd,MAAM,EAAE,MAAM,EACd,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAAC;CAClC;AAED,mFAAmF;AACnF,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,YAAY,GAClB,KAAK,IAAI,YAAY,GAAG,iBAAiB,CAI3C;AAMD;;;;;;;;GAQG;AACH,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,gBAAgB,GAAG,MAAM,CAAC;IAClD,mFAAmF;IACnF,OAAO,CACL,MAAM,EAAE,cAAc,EACtB,OAAO,EAAE,OAAO,EAChB,OAAO,EAAE,UAAU,GAClB,OAAO,CAAC,cAAc,CAAC,CAAC;IAC3B,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAAC;IAC7E,UAAU,CACR,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,aAAa,EACnB,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC,SAAS,CAAC,CAAC;IACtB,QAAQ,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC5B;AAED,2EAA2E;AAC3E,MAAM,WAAW,sBAAsB;IACrC,MAAM,CAAC,GAAG,EAAE,eAAe,GAAG,gBAAgB,CAAC;CAChD"}

package/dist/lib/realtime/types.js

@@ -0,0 +1,61 @@
+// CONTRACT: stable — coordinate changes.
+//
+// This file is the FROZEN WS1 contract for the Trellis RealtimeTransport seam.
+// Every other workstream (WS2 AppSync infra, WS3 authorizer, WS4 push, WS5
+// settings-sync, WS7 conformance) and the Skybber Flutter client bind to the
+// exact signatures below. Any change after WS1 merges is a BREAKING change
+// requiring a coordinated version bump and re-fan-out. See
+// plans/appsync-skybber/00b-integration-and-frozen-contract.md §2.
+//
+// HARD RULE: nothing in apps/api/src/lib/realtime/** may import an AWS SDK
+// (`@aws-sdk/*`, `aws-appsync`, `aws-amplify`) or a socket library. Enforced by
+// test/unit/realtime/no-aws-import.test.ts.
+/** Encode a wakeup envelope to its canonical content-free byte form. */
+export function encodeWakeup(e) {
+    if (e.v !== 1) {
+        throw new Error(`encodeWakeup: unsupported version ${String(e.v)}`);
+    }
+    // Canonical, field-ordered JSON — no free-form passthrough.
+    const canonical = { v: 1, kind: e.kind };
+    if (e.changeToken !== undefined)
+        canonical.changeToken = e.changeToken;
+    return new TextEncoder().encode(JSON.stringify(canonical));
+}
+/** Decode a wakeup envelope. Throws on unknown fields or malformed input. */
+export function decodeWakeup(b) {
+    let parsed;
+    try {
+        parsed = JSON.parse(new TextDecoder().decode(b));
+    }
+    catch {
+        throw new Error("decodeWakeup: not valid JSON");
+    }
+    if (typeof parsed !== "object" || parsed === null) {
+        throw new Error("decodeWakeup: not an object");
+    }
+    const obj = parsed;
+    const allowed = new Set(["v", "kind", "changeToken"]);
+    for (const key of Object.keys(obj)) {
+        if (!allowed.has(key)) {
+            throw new Error(`decodeWakeup: unknown field "${key}"`);
+        }
+    }
+    if (obj.v !== 1) {
+        throw new Error("decodeWakeup: unsupported version");
+    }
+    if (typeof obj.kind !== "string") {
+        throw new Error("decodeWakeup: missing/invalid kind");
+    }
+    if (obj.changeToken !== undefined && typeof obj.changeToken !== "string") {
+        throw new Error("decodeWakeup: invalid changeToken");
+    }
+    const env = { v: 1, kind: obj.kind };
+    if (obj.changeToken !== undefined)
+        env.changeToken = obj.changeToken;
+    return env;
+}
+/** Narrowing helper: does this store also provide the change-cursor capability? */
+export function supportsChangeCursor(store) {
+    return (typeof store.listChangedSince === "function");
+}
+//# sourceMappingURL=types.js.map

package/dist/lib/realtime/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/lib/realtime/types.ts"],"names":[],"mappings":"AAAA,yCAAyC;AACzC,EAAE;AACF,+EAA+E;AAC/E,2EAA2E;AAC3E,6EAA6E;AAC7E,2EAA2E;AAC3E,2DAA2D;AAC3D,mEAAmE;AACnE,EAAE;AACF,2EAA2E;AAC3E,gFAAgF;AAChF,4CAA4C;AAuI5C,wEAAwE;AACxE,MAAM,UAAU,YAAY,CAAC,CAAiB;IAC5C,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CAAC,qCAAqC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACtE,CAAC;IACD,4DAA4D;IAC5D,MAAM,SAAS,GAA4B,EAAE,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAClE,IAAI,CAAC,CAAC,WAAW,KAAK,SAAS;QAAE,SAAS,CAAC,WAAW,GAAG,CAAC,CAAC,WAAW,CAAC;IACvE,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC;AAC7D,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,YAAY,CAAC,CAAa;IACxC,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IACnD,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;IAClD,CAAC;IACD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QAClD,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IACjD,CAAC;IACD,MAAM,GAAG,GAAG,MAAiC,CAAC;IAC9C,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,EAAE,MAAM,EAAE,aAAa,CAAC,CAAC,CAAC;IACtD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACnC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CAAC,gCAAgC,GAAG,GAAG,CAAC,CAAC;QAC1D,CAAC;IACH,CAAC;IACD,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IACvD,CAAC;IACD,IAAI,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;IACxD,CAAC;IACD,IAAI,GAAG,CAAC,WAAW,KAAK,SAAS,IAAI,OAAO,GAAG,CAAC,WAAW,KAAK,QAAQ,EAAE,CAAC;QACzE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IACvD,CAAC;IACD,MAAM,GAAG,GAAmB,EAAE,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,IAAmB,EAAE,CAAC;IACpE,IAAI,GAAG,CAAC,WAAW,KAAK,SAAS;QAAE,GAAG,CAAC,WAAW,GAAG,GAAG,CAAC,WAAW,CAAC;IACrE,OAAO,GAAG,CAAC;AACb,CAAC;AAkFD,mFAAmF;AACnF,MAAM,UAAU,oBAAoB,CAClC,KAAmB;IAEnB,OAAO,CACL,OAAQ,KAAoC,CAAC,gBAAgB,KAAK,UAAU,CAC7E,CAAC;AACJ,CAAC"}

package/dist/lib/routes/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/lib/routes/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAwDH,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AAsPxC,eAAO,MAAM,MAAM,EAAE,KAAK,EAkBzB,CAAC;AAGF,YAAY,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/lib/routes/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAyDH,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AAwPxC,eAAO,MAAM,MAAM,EAAE,KAAK,EAkBzB,CAAC;AAGF,YAAY,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC"}

package/dist/lib/routes/index.js

@@ -62,6 +62,7 @@ import { productTaxonomyRoutes } from "./products.js";
 import { notificationsRoutes } from "./notifications.js";
 import { parentalControlRoutes } from "./parental-controls.js";
 import { sentimentsRoutes } from "./sentiments.js";
+import { settingsRoutes } from "./settings.js";
 import { taxonomyRoutes } from "./taxonomy.js";
 import { taxonomyAnalyticsRoutes } from "./taxonomy-analytics.js";
 import { tenantRoutes } from "./tenants.js";
@@ -169,6 +170,8 @@ const coreRoutes = [
     ...commentsRoutes,
     // Sentiments/Reactions
     ...sentimentsRoutes,
+    // Realtime / server-blind settings sync
+    ...settingsRoutes,
     // Media uploads
     ...mediaRoutes,
     // Media metadata privacy controls

package/dist/lib/routes/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/lib/routes/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAC5D,OAAO,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAChE,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AACzD,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC1D,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AACvD,OAAO,EAAE,UAAU,IAAI,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAC5E,OAAO,EAAE,mBAAmB,EAAE,MAAM,iCAAiC,CAAC;AACtE,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAC;AAChE,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,EAAE,aAAa,IAAI,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACjE,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,EAAE,wBAAwB,EAAE,MAAM,2BAA2B,CAAC;AACrE,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AACrC,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AACrC,OAAO,EAAE,6BAA6B,EAAE,MAAM,gCAAgC,CAAC;AAC/E,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC1D,OAAO,EAAE,yBAAyB,EAAE,MAAM,4BAA4B,CAAC;AACvE,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AACrC,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AACtD,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,EAAE,uBAAuB,EAAE,MAAM,yBAAyB,CAAC;AAElE,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAC;AAChE,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AACpE,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAE1D;;;;;;;GAOG;AACH,SAAS,cAAc,CAAC,MAAe;IACrC,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;AACzD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,kBAAkB,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,KAAK,MAAM,CAAC;AAEtE;;;;;GAKG;AACH,MAAM,OAAO,GAAG,CAAC,KAAY,EAAW,EAAE,CACxC,kBAAkB;IAClB,CAAC,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC;AAErE;;;GAGG;AACH,MAAM,UAAU,GAAY;IAC1B,8CAA8C;IAC9C,GAAG,YAAY;IAEf,2EAA2E;IAC3E,GAAG,cAAc,CAAC,kBAAkB,CAAC;IAErC,iBAAiB;IACjB,GAAG,UAAU;IAEb,kDAAkD;IAClD,GAAG,cAAc,CAAC,kBAAkB,CAAC;IAErC,oCAAoC;IACpC,GAAG,SAAS;IAEZ,0BAA0B;IAC1B,GAAG,UAAU;IAEb,4BAA4B;IAC5B,GAAG,cAAc,CAAC,YAAY,CAAC;IAE/B,6BAA6B;IAC7B,GAAG,cAAc,CAAC,kBAAkB,CAAC;IAErC,kCAAkC;IAClC,GAAG,cAAc,CAAC,eAAe,CAAC;IAElC,0CAA0C;IAC1C,GAAG,cAAc,CAAC,kBAAkB,CAAC;IAErC,8BAA8B;IAC9B,GAAG,cAAc,CAAC,uBAAuB,CAAC;IAE1C,mBAAmB;IACnB,GAAG,cAAc,CAAC,iBAAiB,CAAC;IAEpC,mCAAmC;IACnC,GAAG,cAAc,CAAC,sBAAsB,CAAC;IAEzC,8BAA8B;IAC9B,GAAG,cAAc,CAAC,iBAAiB,CAAC;IAEpC,uDAAuD;IACvD,GAAG,cAAc,CAAC,WAAW,CAAC;IAE9B,4CAA4C;IAC5C,GAAG,cAAc,CAAC,oBAAoB,CAAC;IAEvC,6CAA6C;IAC7C,GAAG,cAAc,CAAC,mBAAmB,CAAC;IAEtC,yBAAyB;IACzB,GAAG,kBAAkB;IAErB,0EAA0E;IAC1E,GAAG,yBAAyB;IAE5B,6DAA6D;IAC7D,GAAG,eAAe;IAClB,GAAG,WAAW;IAEd,4EAA4E;IAC5E,GAAG,eAAe;IAElB,SAAS;IACT,GAAG,YAAY;IAEf,YAAY;IACZ,GAAG,eAAe;IAElB,cAAc;IACd,GAAG,iBAAiB;IAEpB,MAAM;IACN,GAAG,SAAS;IAEZ,mDAAmD;IACnD,GAAG,cAAc;IAEjB,QAAQ;IACR,GAAG,WAAW;IAEd,QAAQ;IACR,GAAG,WAAW;IAEd,WAAW;IACX,GAAG,cAAc;IAEjB,uBAAuB;IACvB,GAAG,gBAAgB;IAEnB,gBAAgB;IAChB,GAAG,WAAW;IAEd,kCAAkC;IAClC,GAAG,6BAA6B;IAEhC,6CAA6C;IAC7C,GAAG,mBAAmB;IAEtB,4BAA4B;IAC5B,GAAG,mBAAmB;IAEtB,sBAAsB;IACtB,GAAG,aAAa;IAEhB,sCAAsC;IACtC,GAAG,mBAAmB;IAEtB,0CAA0C;IAC1C,GAAG,qBAAqB;IAExB,cAAc;IACd,GAAG,YAAY;IAEf,mBAAmB;IACnB,GAAG,cAAc;IAEjB,0BAA0B;IAC1B,GAAG,gBAAgB;IAEnB,qDAAqD;IACrD,GAAG,kBAAkB;IAErB,0BAA0B;IAC1B,GAAG,YAAY;IAEf,0CAA0C;IAC1C,GAAG,wBAAwB;IAE3B,mBAAmB;IACnB,GAAG,oBAAoB;IAEvB,YAAY;IACZ,GAAG,eAAe;IAElB,WAAW;IACX,GAAG,cAAc;IAEjB,oBAAoB;IACpB,GAAG,sBAAsB;IAEzB,qBAAqB;IACrB,GAAG,uBAAuB;IAE1B,wBAAwB;IACxB,GAAG,qBAAqB;IAExB,gBAAgB;IAChB,GAAG,kBAAkB;IAErB,eAAe;IACf,GAAG,gBAAgB;IAEnB,+DAA+D;IAC/D,GAAG,SAAS;IAEZ,qEAAqE;IACrE,gFAAgF;IAChF,8EAA8E;IAC9E,+EAA+E;IAC/E,+CAA+C;IAC/C,GAAG,CAAC,kBAAkB;QACpB,CAAC,CAAC;YACE,GAAG,eAAe;YAClB,GAAG,WAAW;YACd,GAAG,WAAW;YACd,GAAG,YAAY;YACf,GAAG,aAAa;YAChB,GAAG,WAAW;YACd,GAAG,gBAAgB;YACnB,GAAG,mBAAmB;YACtB,GAAG,qBAAqB;SACzB;QACH,CAAC,CAAC,EAAE,CAAC;IAEP,2EAA2E;IAC3E,wEAAwE;IACxE,GAAG,aAAa,CAAC,MAAM,CAAC,OAAO,CAAC;IAEhC,0EAA0E;IAC1E,kDAAkD;IAClD,GAAG,cAAc,CAAC,MAAM,CAAC,OAAO,CAAC;CAClC,CAAC;AAEF,kDAAkD;AAClD,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,mBAAmB,EAAE,MAAM,+BAA+B,CAAC;AAEpE,MAAM,eAAe,GAAY;IAC/B,gDAAgD;IAChD,GAAG,aAAa,EAAE,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,MAAiB,CAAC;IAC1D,+EAA+E;IAC/E,GAAG,aAAa,EAAE,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC;CAC9D,CAAC;AAEF,MAAM,CAAC,MAAM,MAAM,GAAY;IAC7B,GAAG,UAAU;IACb,GAAG,eAAe;IAElB,6BAA6B;IAC7B;QACE,IAAI,EAAE,GAAG;QACT,MAAM,EAAE,GAAG;QACX,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE;YAC9B,MAAM,eAAe,GAAG,IAAI,eAAe,CAAC,GAAG,CAAC,CAAC;YACjD,OAAO,eAAe,CAAC,oBAAoB,CACzC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,EACtC,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE,CACjE,CAAC;QACJ,CAAC;QACD,UAAU,EAAE,CAAC,cAAc,EAAE,CAAC;QAC9B,WAAW,EAAE,eAAe;KAC7B;CACF,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/lib/routes/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAC5D,OAAO,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAChE,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AACzD,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC1D,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AACvD,OAAO,EAAE,UAAU,IAAI,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAC5E,OAAO,EAAE,mBAAmB,EAAE,MAAM,iCAAiC,CAAC;AACtE,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAC;AAChE,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,EAAE,aAAa,IAAI,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACjE,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,EAAE,wBAAwB,EAAE,MAAM,2BAA2B,CAAC;AACrE,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AACrC,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AACrC,OAAO,EAAE,6BAA6B,EAAE,MAAM,gCAAgC,CAAC;AAC/E,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC1D,OAAO,EAAE,yBAAyB,EAAE,MAAM,4BAA4B,CAAC;AACvE,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AACrC,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AACtD,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,EAAE,uBAAuB,EAAE,MAAM,yBAAyB,CAAC;AAElE,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAC;AAChE,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AACpE,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAE1D;;;;;;;GAOG;AACH,SAAS,cAAc,CAAC,MAAe;IACrC,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;AACzD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,kBAAkB,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,KAAK,MAAM,CAAC;AAEtE;;;;;GAKG;AACH,MAAM,OAAO,GAAG,CAAC,KAAY,EAAW,EAAE,CACxC,kBAAkB;IAClB,CAAC,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC;AAErE;;;GAGG;AACH,MAAM,UAAU,GAAY;IAC1B,8CAA8C;IAC9C,GAAG,YAAY;IAEf,2EAA2E;IAC3E,GAAG,cAAc,CAAC,kBAAkB,CAAC;IAErC,iBAAiB;IACjB,GAAG,UAAU;IAEb,kDAAkD;IAClD,GAAG,cAAc,CAAC,kBAAkB,CAAC;IAErC,oCAAoC;IACpC,GAAG,SAAS;IAEZ,0BAA0B;IAC1B,GAAG,UAAU;IAEb,4BAA4B;IAC5B,GAAG,cAAc,CAAC,YAAY,CAAC;IAE/B,6BAA6B;IAC7B,GAAG,cAAc,CAAC,kBAAkB,CAAC;IAErC,kCAAkC;IAClC,GAAG,cAAc,CAAC,eAAe,CAAC;IAElC,0CAA0C;IAC1C,GAAG,cAAc,CAAC,kBAAkB,CAAC;IAErC,8BAA8B;IAC9B,GAAG,cAAc,CAAC,uBAAuB,CAAC;IAE1C,mBAAmB;IACnB,GAAG,cAAc,CAAC,iBAAiB,CAAC;IAEpC,mCAAmC;IACnC,GAAG,cAAc,CAAC,sBAAsB,CAAC;IAEzC,8BAA8B;IAC9B,GAAG,cAAc,CAAC,iBAAiB,CAAC;IAEpC,uDAAuD;IACvD,GAAG,cAAc,CAAC,WAAW,CAAC;IAE9B,4CAA4C;IAC5C,GAAG,cAAc,CAAC,oBAAoB,CAAC;IAEvC,6CAA6C;IAC7C,GAAG,cAAc,CAAC,mBAAmB,CAAC;IAEtC,yBAAyB;IACzB,GAAG,kBAAkB;IAErB,0EAA0E;IAC1E,GAAG,yBAAyB;IAE5B,6DAA6D;IAC7D,GAAG,eAAe;IAClB,GAAG,WAAW;IAEd,4EAA4E;IAC5E,GAAG,eAAe;IAElB,SAAS;IACT,GAAG,YAAY;IAEf,YAAY;IACZ,GAAG,eAAe;IAElB,cAAc;IACd,GAAG,iBAAiB;IAEpB,MAAM;IACN,GAAG,SAAS;IAEZ,mDAAmD;IACnD,GAAG,cAAc;IAEjB,QAAQ;IACR,GAAG,WAAW;IAEd,QAAQ;IACR,GAAG,WAAW;IAEd,WAAW;IACX,GAAG,cAAc;IAEjB,uBAAuB;IACvB,GAAG,gBAAgB;IACnB,wCAAwC;IACxC,GAAG,cAAc;IAEjB,gBAAgB;IAChB,GAAG,WAAW;IAEd,kCAAkC;IAClC,GAAG,6BAA6B;IAEhC,6CAA6C;IAC7C,GAAG,mBAAmB;IAEtB,4BAA4B;IAC5B,GAAG,mBAAmB;IAEtB,sBAAsB;IACtB,GAAG,aAAa;IAEhB,sCAAsC;IACtC,GAAG,mBAAmB;IAEtB,0CAA0C;IAC1C,GAAG,qBAAqB;IAExB,cAAc;IACd,GAAG,YAAY;IAEf,mBAAmB;IACnB,GAAG,cAAc;IAEjB,0BAA0B;IAC1B,GAAG,gBAAgB;IAEnB,qDAAqD;IACrD,GAAG,kBAAkB;IAErB,0BAA0B;IAC1B,GAAG,YAAY;IAEf,0CAA0C;IAC1C,GAAG,wBAAwB;IAE3B,mBAAmB;IACnB,GAAG,oBAAoB;IAEvB,YAAY;IACZ,GAAG,eAAe;IAElB,WAAW;IACX,GAAG,cAAc;IAEjB,oBAAoB;IACpB,GAAG,sBAAsB;IAEzB,qBAAqB;IACrB,GAAG,uBAAuB;IAE1B,wBAAwB;IACxB,GAAG,qBAAqB;IAExB,gBAAgB;IAChB,GAAG,kBAAkB;IAErB,eAAe;IACf,GAAG,gBAAgB;IAEnB,+DAA+D;IAC/D,GAAG,SAAS;IAEZ,qEAAqE;IACrE,gFAAgF;IAChF,8EAA8E;IAC9E,+EAA+E;IAC/E,+CAA+C;IAC/C,GAAG,CAAC,kBAAkB;QACpB,CAAC,CAAC;YACE,GAAG,eAAe;YAClB,GAAG,WAAW;YACd,GAAG,WAAW;YACd,GAAG,YAAY;YACf,GAAG,aAAa;YAChB,GAAG,WAAW;YACd,GAAG,gBAAgB;YACnB,GAAG,mBAAmB;YACtB,GAAG,qBAAqB;SACzB;QACH,CAAC,CAAC,EAAE,CAAC;IAEP,2EAA2E;IAC3E,wEAAwE;IACxE,GAAG,aAAa,CAAC,MAAM,CAAC,OAAO,CAAC;IAEhC,0EAA0E;IAC1E,kDAAkD;IAClD,GAAG,cAAc,CAAC,MAAM,CAAC,OAAO,CAAC;CAClC,CAAC;AAEF,kDAAkD;AAClD,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,mBAAmB,EAAE,MAAM,+BAA+B,CAAC;AAEpE,MAAM,eAAe,GAAY;IAC/B,gDAAgD;IAChD,GAAG,aAAa,EAAE,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,MAAiB,CAAC;IAC1D,+EAA+E;IAC/E,GAAG,aAAa,EAAE,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC;CAC9D,CAAC;AAEF,MAAM,CAAC,MAAM,MAAM,GAAY;IAC7B,GAAG,UAAU;IACb,GAAG,eAAe;IAElB,6BAA6B;IAC7B;QACE,IAAI,EAAE,GAAG;QACT,MAAM,EAAE,GAAG;QACX,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE;YAC9B,MAAM,eAAe,GAAG,IAAI,eAAe,CAAC,GAAG,CAAC,CAAC;YACjD,OAAO,eAAe,CAAC,oBAAoB,CACzC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,EACtC,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE,CACjE,CAAC;QACJ,CAAC;QACD,UAAU,EAAE,CAAC,cAAc,EAAE,CAAC;QAC9B,WAAW,EAAE,eAAe;KAC7B;CACF,CAAC"}

package/dist/lib/routes/media.d.ts

@@ -5,5 +5,26 @@
  * Implements content-addressed storage (CAS) with SHA-256 hashing for deduplication.
  */
 import type { Route } from "./types.js";
+/**
+ * Serve media file by content hash (T5: fail-closed APPROVED-only gate).
+ *
+ * Shared function used by both /api/media/:mediaId and /api/media/:hash routes.
+ *
+ * Decision flow (functional core in `media/serve-gate.ts`):
+ *  1. Validate the inbound URL hash via `validateContentHash` BEFORE any lookup.
+ *  2. Look up the DB record (the ONLY source of a servable key — the no-DB
+ *     storage-probe maze was deleted in T9; storage is never probed for
+ *     un-recorded bytes).
+ *  3. `isServable` gate: serve ONLY when `moderationStatus === "APPROVED"` AND
+ *     not `hidden` AND not soft-deleted — for EVERY viewer incl. the owner.
+ *  4. Every other outcome (incl. not-found / DB-error / invalid-hash / error
+ *     path) returns the single byte-identical {@link mediaDenyResponse}.
+ *
+ * `variant` is retained for call-site compatibility but never influences the
+ * gate; the served key is always the canonical `originalKey` from the DB record.
+ */
+export declare function serveMediaByHash(contentHash: string, variant: string, request: Request, env: any, session: {
+    userId: string;
+}): Promise<Response>;
 export declare const mediaRoutes: Route[];
 //# sourceMappingURL=media.d.ts.map

package/dist/lib/routes/media.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"media.d.ts","sourceRoot":"","sources":["../../../src/lib/routes/media.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAgBH,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AAipBxC,eAAO,MAAM,WAAW,EAAE,KAAK,EA+5D9B,CAAC"}
+{"version":3,"file":"media.d.ts","sourceRoot":"","sources":["../../../src/lib/routes/media.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AA+BH,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AAoPxC;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,gBAAgB,CACpC,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,OAAO,EAChB,GAAG,EAAE,GAAG,EACR,OAAO,EAAE;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,GAC1B,OAAO,CAAC,QAAQ,CAAC,CA+HnB;AAoDD,eAAO,MAAM,WAAW,EAAE,KAAK,EA8xE9B,CAAC"}