@de-otio/trellis 0.10.11 → 0.12.0

package/dist/lib/services/image-normalizer.d.ts

@@ -1,15 +1,73 @@
 /**
- * Image normalizer — no-op stub for AWS architecture.
+ * Image re-encode pipeline (T7 — transcode-and-discard).
  *
- * In the AWS stack, ICC profile normalization (Display P3 → sRGB) and
- * format conversion happen asynchronously in the Lambda media-processing-worker
- * via Sharp, triggered by the S3 upload event → SQS → Lambda pipeline.
+ * Re-encodes every uploaded image to a canonical safe raster format using
+ * sharp. This is the polyglot + pixel-bomb defense: a file that is
+ * simultaneously a valid image and valid JS/HTML/script payload is stripped to
+ * clean raster pixels by the transcode; a file that claims huge dimensions but
+ * tiny bytes is rejected by sharp's `limitInputPixels` guard before it can
+ * trigger a decompression bomb.
  *
- * The original Cloudflare Images synchronous path is no longer used.
+ * Design constraints:
+ * - `.rotate()` bakes EXIF orientation into pixels (so the tag becomes stale
+ *   and can safely be dropped — no `.withMetadata()` call).
+ * - NO `.withMetadata()` — metadata is intentionally dropped by the re-encode
+ *   (T6 owns the post-encode assertion that it is gone).
+ * - Runs BEFORE the SHA-256 hash so the CAS hash is of the cleaned bytes.
+ * - Accepted MIME types MUST equal the set sharp can write (HEIC/HEIF and SVG
+ *   are excluded — HEIC write is not supported without the optional libheif
+ *   native module, and SVG cannot be safely transcoded to raster).
+ *
+ * The async Lambda media-processing-worker (P0b) performs the same transcode
+ * for derivatives; this file is the P0a synchronous path in the upload handler.
+ */
+import type { Env } from "../../env.js";
+/**
+ * The MIME types that this build of sharp can reliably re-encode to a
+ * canonical raster format. Any type outside this set must be rejected at the
+ * allowlist boundary.
+ *
+ * Excluded:
+ * - `image/svg+xml` — no safe raster transcode; can embed scripts.
+ * - `image/heic` / `image/heif` — sharp write support requires the optional
+ *   libheif native module; absent = encode fails at runtime. Full HEIC UX is
+ *   deferred to P1/D12.
+ * - `image/tiff` — sharp can read but the tiff encoder is rarely needed;
+ *   excluded from P0a canonical set.
+ */
+export declare const REENCODABLE_IMAGE_TYPES: ReadonlySet<string>;
+/**
+ * Result of a successful re-encode.
+ */
+export interface ReencodeResult {
+    /** Re-encoded image bytes (the bytes to hash and store). */
+    buffer: Buffer;
+    /**
+     * The canonical MIME type of the output bytes.
+     * Always one of image/jpeg, image/png, image/webp (canonical set).
+     */
+    canonicalMimeType: string;
+}
+/**
+ * Re-encode an image buffer to the canonical safe raster format.
+ *
+ * @param inputBytes - Raw bytes of the uploaded file.
+ * @param env        - Application env (reads `env.media.maxPixels`,
+ *                     `env.media.canonicalFormat`, `env.media.canonicalQuality`).
+ * @returns Re-encoded bytes and the canonical MIME type.
+ * @throws If the input cannot be decoded (corrupt / pixel-bomb / unsupported),
+ *         or if `env.media.maxPixels` is exceeded.
+ */
+export declare function reencodeImage(inputBytes: Buffer | ArrayBuffer | Uint8Array, env: Pick<Env, "media">): Promise<ReencodeResult>;
+/**
+ * Legacy class kept so the existing import in `media.ts` continues to compile
+ * until T9 removes it. The class is now a thin shim over `reencodeImage`.
+ *
+ * @deprecated Use `reencodeImage` directly. This class will be removed in T9.
  */
 export declare class ImageNormalizer {
     constructor(_images: unknown, _mediaBucket: unknown);
-    /** Returns null — processing is async via Lambda media-processing-worker. */
+    /** No-op — the re-encode is now done inline in the upload handler. */
     normalize(_originalKey: string, _contentHash: string): Promise<string | null>;
 }
 //# sourceMappingURL=image-normalizer.d.ts.map

package/dist/lib/services/image-normalizer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"image-normalizer.d.ts","sourceRoot":"","sources":["../../../src/lib/services/image-normalizer.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,qBAAa,eAAe;gBAEd,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,OAAO;IAEnD,6EAA6E;IACvE,SAAS,CAAC,YAAY,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;CAGpF"}
+{"version":3,"file":"image-normalizer.d.ts","sourceRoot":"","sources":["../../../src/lib/services/image-normalizer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,cAAc,CAAC;AAExC;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,uBAAuB,EAAE,WAAW,CAAC,MAAM,CAMtD,CAAC;AAEH;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,4DAA4D;IAC5D,MAAM,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,iBAAiB,EAAE,MAAM,CAAC;CAC3B;AAED;;;;;;;;;GASG;AACH,wBAAsB,aAAa,CACjC,UAAU,EAAE,MAAM,GAAG,WAAW,GAAG,UAAU,EAC7C,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,GACtB,OAAO,CAAC,cAAc,CAAC,CAuCzB;AAED;;;;;GAKG;AACH,qBAAa,eAAe;gBAEd,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,OAAO;IAEnD,sEAAsE;IAChE,SAAS,CAAC,YAAY,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;CAGpF"}

package/dist/lib/services/image-normalizer.js

@@ -1,16 +1,98 @@
 /**
- * Image normalizer — no-op stub for AWS architecture.
+ * Image re-encode pipeline (T7 — transcode-and-discard).
  *
- * In the AWS stack, ICC profile normalization (Display P3 → sRGB) and
- * format conversion happen asynchronously in the Lambda media-processing-worker
- * via Sharp, triggered by the S3 upload event → SQS → Lambda pipeline.
+ * Re-encodes every uploaded image to a canonical safe raster format using
+ * sharp. This is the polyglot + pixel-bomb defense: a file that is
+ * simultaneously a valid image and valid JS/HTML/script payload is stripped to
+ * clean raster pixels by the transcode; a file that claims huge dimensions but
+ * tiny bytes is rejected by sharp's `limitInputPixels` guard before it can
+ * trigger a decompression bomb.
  *
- * The original Cloudflare Images synchronous path is no longer used.
+ * Design constraints:
+ * - `.rotate()` bakes EXIF orientation into pixels (so the tag becomes stale
+ *   and can safely be dropped — no `.withMetadata()` call).
+ * - NO `.withMetadata()` — metadata is intentionally dropped by the re-encode
+ *   (T6 owns the post-encode assertion that it is gone).
+ * - Runs BEFORE the SHA-256 hash so the CAS hash is of the cleaned bytes.
+ * - Accepted MIME types MUST equal the set sharp can write (HEIC/HEIF and SVG
+ *   are excluded — HEIC write is not supported without the optional libheif
+ *   native module, and SVG cannot be safely transcoded to raster).
+ *
+ * The async Lambda media-processing-worker (P0b) performs the same transcode
+ * for derivatives; this file is the P0a synchronous path in the upload handler.
+ */
+/**
+ * The MIME types that this build of sharp can reliably re-encode to a
+ * canonical raster format. Any type outside this set must be rejected at the
+ * allowlist boundary.
+ *
+ * Excluded:
+ * - `image/svg+xml` — no safe raster transcode; can embed scripts.
+ * - `image/heic` / `image/heif` — sharp write support requires the optional
+ *   libheif native module; absent = encode fails at runtime. Full HEIC UX is
+ *   deferred to P1/D12.
+ * - `image/tiff` — sharp can read but the tiff encoder is rarely needed;
+ *   excluded from P0a canonical set.
+ */
+export const REENCODABLE_IMAGE_TYPES = new Set([
+    "image/jpeg",
+    "image/jpg", // alias; normalised to image/jpeg
+    "image/png",
+    "image/webp",
+    "image/gif", // static raster in P0a (animated → first frame only)
+]);
+/**
+ * Re-encode an image buffer to the canonical safe raster format.
+ *
+ * @param inputBytes - Raw bytes of the uploaded file.
+ * @param env        - Application env (reads `env.media.maxPixels`,
+ *                     `env.media.canonicalFormat`, `env.media.canonicalQuality`).
+ * @returns Re-encoded bytes and the canonical MIME type.
+ * @throws If the input cannot be decoded (corrupt / pixel-bomb / unsupported),
+ *         or if `env.media.maxPixels` is exceeded.
+ */
+export async function reencodeImage(inputBytes, env) {
+    const { default: sharp } = await import("sharp");
+    const buf = inputBytes instanceof Buffer
+        ? inputBytes
+        : Buffer.from(inputBytes instanceof ArrayBuffer ? inputBytes : inputBytes.buffer);
+    const { maxPixels, canonicalFormat, canonicalQuality } = env.media;
+    // limitInputPixels MUST NOT be false or 0 — decompression-bomb guard.
+    const pipeline = sharp(buf, { limitInputPixels: maxPixels })
+        .rotate(); // bake EXIF orientation into pixels; drops orientation tag
+    // toFormat — NO withMetadata() so all metadata is dropped
+    let outputBuffer;
+    if (canonicalFormat === "png") {
+        outputBuffer = await pipeline.toFormat("png").toBuffer();
+    }
+    else if (canonicalFormat === "webp") {
+        outputBuffer = await pipeline
+            .toFormat("webp", { quality: canonicalQuality })
+            .toBuffer();
+    }
+    else {
+        // Default: jpeg
+        outputBuffer = await pipeline
+            .toFormat("jpeg", { quality: canonicalQuality })
+            .toBuffer();
+    }
+    const canonicalMimeType = canonicalFormat === "png"
+        ? "image/png"
+        : canonicalFormat === "webp"
+            ? "image/webp"
+            : "image/jpeg";
+    return { buffer: outputBuffer, canonicalMimeType };
+}
+/**
+ * Legacy class kept so the existing import in `media.ts` continues to compile
+ * until T9 removes it. The class is now a thin shim over `reencodeImage`.
+ *
+ * @deprecated Use `reencodeImage` directly. This class will be removed in T9.
  */
 export class ImageNormalizer {
     // eslint-disable-next-line @typescript-eslint/no-useless-constructor
     constructor(_images, _mediaBucket) { }
-    /** Returns null — processing is async via Lambda media-processing-worker. */
+    /** No-op — the re-encode is now done inline in the upload handler. */
     async normalize(_originalKey, _contentHash) {
         return null;
     }

package/dist/lib/services/image-normalizer.js.map

@@ -1 +1 @@
-{"version":3,"file":"image-normalizer.js","sourceRoot":"","sources":["../../../src/lib/services/image-normalizer.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,MAAM,OAAO,eAAe;IAC1B,qEAAqE;IACrE,YAAY,OAAgB,EAAE,YAAqB,IAAG,CAAC;IAEvD,6EAA6E;IAC7E,KAAK,CAAC,SAAS,CAAC,YAAoB,EAAE,YAAoB;QACxD,OAAO,IAAI,CAAC;IACd,CAAC;CACF"}
+{"version":3,"file":"image-normalizer.js","sourceRoot":"","sources":["../../../src/lib/services/image-normalizer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAIH;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAwB,IAAI,GAAG,CAAC;IAClE,YAAY;IACZ,WAAW,EAAI,kCAAkC;IACjD,WAAW;IACX,YAAY;IACZ,WAAW,EAAI,qDAAqD;CACrE,CAAC,CAAC;AAeH;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,UAA6C,EAC7C,GAAuB;IAEvB,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,CAAC;IAEjD,MAAM,GAAG,GACP,UAAU,YAAY,MAAM;QAC1B,CAAC,CAAC,UAAU;QACZ,CAAC,CAAC,MAAM,CAAC,IAAI,CACT,UAAU,YAAY,WAAW,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CACnE,CAAC;IAER,MAAM,EAAE,SAAS,EAAE,eAAe,EAAE,gBAAgB,EAAE,GAAG,GAAG,CAAC,KAAK,CAAC;IAEnE,sEAAsE;IACtE,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,EAAE,EAAE,gBAAgB,EAAE,SAAS,EAAE,CAAC;SACzD,MAAM,EAAE,CAAC,CAAC,2DAA2D;IAExE,0DAA0D;IAC1D,IAAI,YAAoB,CAAC;IACzB,IAAI,eAAe,KAAK,KAAK,EAAE,CAAC;QAC9B,YAAY,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,QAAQ,EAAE,CAAC;IAC3D,CAAC;SAAM,IAAI,eAAe,KAAK,MAAM,EAAE,CAAC;QACtC,YAAY,GAAG,MAAM,QAAQ;aAC1B,QAAQ,CAAC,MAAM,EAAE,EAAE,OAAO,EAAE,gBAAgB,EAAE,CAAC;aAC/C,QAAQ,EAAE,CAAC;IAChB,CAAC;SAAM,CAAC;QACN,gBAAgB;QAChB,YAAY,GAAG,MAAM,QAAQ;aAC1B,QAAQ,CAAC,MAAM,EAAE,EAAE,OAAO,EAAE,gBAAgB,EAAE,CAAC;aAC/C,QAAQ,EAAE,CAAC;IAChB,CAAC;IAED,MAAM,iBAAiB,GACrB,eAAe,KAAK,KAAK;QACvB,CAAC,CAAC,WAAW;QACb,CAAC,CAAC,eAAe,KAAK,MAAM;YAC1B,CAAC,CAAC,YAAY;YACd,CAAC,CAAC,YAAY,CAAC;IAErB,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,iBAAiB,EAAE,CAAC;AACrD,CAAC;AAED;;;;;GAKG;AACH,MAAM,OAAO,eAAe;IAC1B,qEAAqE;IACrE,YAAY,OAAgB,EAAE,YAAqB,IAAG,CAAC;IAEvD,sEAAsE;IACtE,KAAK,CAAC,SAAS,CAAC,YAAoB,EAAE,YAAoB;QACxD,OAAO,IAAI,CAAC;IACd,CAAC;CACF"}

package/dist/lib/services/media-upload-service.d.ts

@@ -8,7 +8,7 @@ export declare class MediaUploadService {
     /**
      * Upload single file
      */
-    uploadSingle(file: File, userId: string, metadata?: {
+    uploadSingle(file: File, userId: string, tenantId: string, metadata?: {
         width?: number;
         height?: number;
         duration?: number;
@@ -16,7 +16,7 @@ export declare class MediaUploadService {
     /**
      * Upload batch of files
      */
-    uploadBatch(files: File[], userId: string, metadataArray?: Array<{
+    uploadBatch(files: File[], userId: string, tenantId: string, metadataArray?: Array<{
         width?: number;
         height?: number;
         duration?: number;

package/dist/lib/services/media-upload-service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"media-upload-service.d.ts","sourceRoot":"","sources":["../../../src/lib/services/media-upload-service.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAGV,YAAY,EACb,MAAM,kCAAkC,CAAC;AAqC1C,qBAAa,kBAAkB;IAC7B,OAAO,CAAC,QAAQ,CAAW;IAC3B,OAAO,CAAC,KAAK,CAAoC;IACjD,OAAO,CAAC,SAAS,CAAS;IAC1B,OAAO,CAAC,GAAG,CAAM;gBAEL,GAAG,EAAE,GAAG;IAUpB;;OAEG;IACG,YAAY,CAChB,IAAI,EAAE,IAAI,EACV,MAAM,EAAE,MAAM,EACd,QAAQ,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,EACjE,aAAa,CAAC,EAAE,WAAW,GAC1B,OAAO,CAAC,YAAY,CAAC;IA2FxB;;OAEG;IACG,WAAW,CACf,KAAK,EAAE,IAAI,EAAE,EACb,MAAM,EAAE,MAAM,EACd,aAAa,CAAC,EAAE,KAAK,CAAC;QACpB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB,CAAC,GACD,OAAO,CAAC,YAAY,EAAE,CAAC;CAsG3B"}
+{"version":3,"file":"media-upload-service.d.ts","sourceRoot":"","sources":["../../../src/lib/services/media-upload-service.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAGV,YAAY,EACb,MAAM,kCAAkC,CAAC;AAmC1C,qBAAa,kBAAkB;IAC7B,OAAO,CAAC,QAAQ,CAAW;IAC3B,OAAO,CAAC,KAAK,CAAoC;IACjD,OAAO,CAAC,SAAS,CAAS;IAC1B,OAAO,CAAC,GAAG,CAAM;gBAEL,GAAG,EAAE,GAAG;IAUpB;;OAEG;IACG,YAAY,CAChB,IAAI,EAAE,IAAI,EACV,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,QAAQ,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,EACjE,aAAa,CAAC,EAAE,WAAW,GAC1B,OAAO,CAAC,YAAY,CAAC;IA6FxB;;OAEG;IACG,WAAW,CACf,KAAK,EAAE,IAAI,EAAE,EACb,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,aAAa,CAAC,EAAE,KAAK,CAAC;QACpB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB,CAAC,GACD,OAAO,CAAC,YAAY,EAAE,CAAC;CAsG3B"}

package/dist/lib/services/media-upload-service.js

@@ -8,6 +8,7 @@
  * 4. Reconciliation worker creates database record asynchronously
  */
 import { getLogger } from "../logger.js";
+import { casKey, isCasKeyError } from "../media/cas-keys.js";
 /**
  * Generate unique batch ID
  */
@@ -23,22 +24,20 @@ async function generateContentHash(file) {
     return hashArray.map((b) => b.toString(16).padStart(2, "0")).join("");
 }
 /**
- * Get file extension from MIME type
+ * Build the canonical CAS original key for a tenant-scoped object (T9 / D18).
+ *
+ * Delegates to the pure `casKey` builder (anchored allowlist validation). A
+ * validation failure here means the caller passed a malformed tenantId or hash
+ * — both are produced internally (tenantId resolved from auth context, hash
+ * from `crypto.subtle.digest`), so a failure is a programming error and is
+ * thrown rather than silently producing an unsafe key.
  */
-function getExtensionFromMimeType(mimeType) {
-    const mimeMap = {
-        "image/jpeg": "jpg",
-        "image/jpg": "jpg",
-        "image/png": "png",
-        "image/gif": "gif",
-        "image/webp": "webp",
-        "image/heic": "heic",
-        "image/heif": "heif",
-        "video/mp4": "mp4",
-        "video/webm": "webm",
-        "video/quicktime": "mov",
-    };
-    return mimeMap[mimeType] || "bin";
+function buildCasOriginalKey(tenantId, contentHash) {
+    const key = casKey(tenantId, contentHash);
+    if (isCasKeyError(key)) {
+        throw new Error(`Invalid CAS key inputs: ${key.kind}`);
+    }
+    return key;
 }
 export class MediaUploadService {
     r2Bucket;
@@ -57,7 +56,7 @@ export class MediaUploadService {
     /**
      * Upload single file
      */
-    async uploadSingle(file, userId, metadata, preReadBuffer) {
+    async uploadSingle(file, userId, tenantId, metadata, preReadBuffer) {
         const logger = getLogger();
         const batchId = generateBatchId();
         try {
@@ -66,8 +65,10 @@ export class MediaUploadService {
             // which may not work reliably on Cloudflare Workers for FormData Files)
             const fileBuffer = preReadBuffer ?? await file.arrayBuffer();
             const contentHash = await generateContentHash(fileBuffer);
-            const ext = getExtensionFromMimeType(file.type);
-            const originalKey = `originals/user-${userId}/${contentHash}.${ext}`;
+            // T9: the ONE canonical CAS scheme (D18) — `cas/{tenantId}/{hash}`.
+            // The same key is what the DB `originalKey` stores and what the serve
+            // path reads, so upload-target and serve-source can never disagree.
+            const originalKey = buildCasOriginalKey(tenantId, contentHash);
             logger.info("[MediaUpload] Starting upload", {
                 contentHash,
                 mimeType: file.type,
@@ -142,7 +143,7 @@ export class MediaUploadService {
     /**
      * Upload batch of files
      */
-    async uploadBatch(files, userId, metadataArray) {
+    async uploadBatch(files, userId, tenantId, metadataArray) {
         const logger = getLogger();
         const batchId = generateBatchId();
         logger.info("[MediaUpload] Starting batch upload", {
@@ -154,8 +155,8 @@ export class MediaUploadService {
         const uploadResults = await Promise.allSettled(files.map(async (file, index) => {
             const fileBuffer = await file.arrayBuffer();
             const contentHash = await generateContentHash(fileBuffer);
-            const ext = getExtensionFromMimeType(file.type);
-            const originalKey = `originals/user-${userId}/${contentHash}.${ext}`;
+            // T9: canonical CAS scheme — see uploadSingle.
+            const originalKey = buildCasOriginalKey(tenantId, contentHash);
             const metadata = metadataArray?.[index];
             const r2Metadata = {
                 contentHash,

package/dist/lib/services/media-upload-service.js.map

@@ -1 +1 @@
-{"version":3,"file":"media-upload-service.js","sourceRoot":"","sources":["../../../src/lib/services/media-upload-service.ts"],"names":[],"mappings":"AACA;;;;;;;;GAQG;AAEH,OAAO,EAAE,SAAS,EAAU,MAAM,cAAc,CAAC;AAOjD;;GAEG;AACH,SAAS,eAAe;IACtB,OAAO,SAAS,IAAI,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;AAC7E,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,mBAAmB,CAAC,IAAiB;IAClD,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IAC/D,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC;IACzD,OAAO,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACxE,CAAC;AAED;;GAEG;AACH,SAAS,wBAAwB,CAAC,QAAgB;IAChD,MAAM,OAAO,GAA2B;QACtC,YAAY,EAAE,KAAK;QACnB,WAAW,EAAE,KAAK;QAClB,WAAW,EAAE,KAAK;QAClB,WAAW,EAAE,KAAK;QAClB,YAAY,EAAE,MAAM;QACpB,YAAY,EAAE,MAAM;QACpB,YAAY,EAAE,MAAM;QACpB,WAAW,EAAE,KAAK;QAClB,YAAY,EAAE,MAAM;QACpB,iBAAiB,EAAE,KAAK;KACzB,CAAC;IACF,OAAO,OAAO,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC;AACpC,CAAC;AAED,MAAM,OAAO,kBAAkB;IACrB,QAAQ,CAAW;IACnB,KAAK,CAAoC;IACzC,SAAS,CAAS;IAClB,GAAG,CAAM;IAEjB,YAAY,GAAQ;QAClB,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;QACf,IAAI,CAAC,QAAQ,GAAG,GAAG,CAAC,eAAe,CAAC;QACpC,IAAI,CAAC,KAAK,GAAG,GAAG,CAAC,0BAA0B,CAAC;QAC5C,IAAI,CAAC,SAAS;YACZ,GAAG,CAAC,WAAW,KAAK,MAAM;gBACxB,CAAC,CAAC,yBAAyB;gBAC3B,CAAC,CAAC,qBAAqB,CAAC;IAC9B,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,YAAY,CAChB,IAAU,EACV,MAAc,EACd,QAAiE,EACjE,aAA2B;QAE3B,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;QAC3B,MAAM,OAAO,GAAG,eAAe,EAAE,CAAC;QAElC,IAAI,CAAC;YACH,2BAA2B;YAC3B,yEAAyE;YACzE,wEAAwE;YACxE,MAAM,UAAU,GAAG,aAAa,IAAI,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC;YAC7D,MAAM,WAAW,GAAG,MAAM,mBAAmB,CAAC,UAAU,CAAC,CAAC;YAC1D,MAAM,GAAG,GAAG,wBAAwB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAChD,MAAM,WAAW,GAAG,kBAAkB,MAAM,IAAI,WAAW,IAAI,GAAG,EAAE,CAAC;YAErE,MAAM,CAAC,IAAI,CAAC,+BAA+B,EAAE;gBAC3C,WAAW;gBACX,QAAQ,EAAE,IAAI,CAAC,IAAI;gBACnB,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,MAAM;gBACN,OAAO;aACR,CAAC,CAAC;YAEH,gCAAgC;YAChC,MAAM,UAAU,GAAoB;gBAClC,WAAW;gBACX,UAAU,EAAE,MAAM;gBAClB,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;gBACpC,QAAQ,EAAE,IAAI,CAAC,IAAI;gBACnB,mBAAmB,EAAE,MAAM;gBAC3B,UAAU,EAAE,OAAO;gBACnB,OAAO;gBACP,GAAG,CAAC,QAAQ,EAAE,KAAK,IAAI,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,QAAQ,EAAE,EAAE,CAAC;gBAC5D,GAAG,CAAC,QAAQ,EAAE,MAAM,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC;gBAC/D,GAAG,CAAC,QAAQ,EAAE,QAAQ,IAAI,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,CAAC,QAAQ,EAAE,EAAE,CAAC;aACtE,CAAC;YAEF,MAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,WAAW,EAAE,UAAU,EAAE;gBAC/C,YAAY,EAAE;oBACZ,WAAW,EAAE,IAAI,CAAC,IAAI;iBACvB;gBACD,cAAc,EAAE,UAA+C;aAChE,CAAC,CAAC;YAEH,MAAM,CAAC,IAAI,CAAC,oCAAoC,EAAE;gBAChD,WAAW;gBACX,WAAW;aACZ,CAAC,CAAC;YAEH,yCAAyC;YACzC,MAAM,OAAO,GAA+B;gBAC1C,IAAI,EAAE,eAAe;gBACrB,OAAO;gBACP,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;gBACrB,OAAO,EAAE;oBACP;wBACE,WAAW;wBACX,WAAW;wBACX,QAAQ,EAAE,IAAI,CAAC,IAAI;wBACnB,IAAI,EAAE,IAAI,CAAC,IAAI;wBACf,UAAU,EAAE,MAAM;wBAClB,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;wBACpC,GAAG,CAAC,QAAQ,EAAE,KAAK,IAAI,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC;wBACjD,GAAG,CAAC,QAAQ,EAAE,MAAM,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;wBACpD,GAAG,CAAC,QAAQ,EAAE,QAAQ,IAAI,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,CAAC;qBAC3D;iBACF;aACF,CAAC;YAEF,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAE/B,MAAM,CAAC,IAAI,CAAC,qCAAqC,EAAE;gBACjD,WAAW;gBACX,OAAO;aACR,CAAC,CAAC;YAEH,gCAAgC;YAChC,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,WAAW;gBACX,GAAG,EAAE,GAAG,IAAI,CAAC,SAAS,cAAc,WAAW,EAAE;gBACjD,MAAM,EAAE,UAAU;aACnB,CAAC;QACJ,CAAC;QAAC,OAAO,KAAU,EAAE,CAAC;YACpB,MAAM,CAAC,KAAK,CAAC,6BAA6B,EAAE;gBAC1C,KAAK,EAAE,KAAK,CAAC,OAAO;gBACpB,MAAM;gBACN,QAAQ,EAAE,IAAI,CAAC,IAAI;aACpB,CAAC,CAAC;YACH,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,WAAW,CACf,KAAa,EACb,MAAc,EACd,aAIE;QAEF,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;QAC3B,MAAM,OAAO,GAAG,eAAe,EAAE,CAAC;QAElC,MAAM,CAAC,IAAI,CAAC,qCAAqC,EAAE;YACjD,SAAS,EAAE,KAAK,CAAC,MAAM;YACvB,MAAM;YACN,OAAO;SACR,CAAC,CAAC;QAEH,qCAAqC;QACrC,MAAM,aAAa,GAAG,MAAM,OAAO,CAAC,UAAU,CAC5C,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE;YAC9B,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC;YAC5C,MAAM,WAAW,GAAG,MAAM,mBAAmB,CAAC,UAAU,CAAC,CAAC;YAC1D,MAAM,GAAG,GAAG,wBAAwB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAChD,MAAM,WAAW,GAAG,kBAAkB,MAAM,IAAI,WAAW,IAAI,GAAG,EAAE,CAAC;YACrE,MAAM,QAAQ,GAAG,aAAa,EAAE,CAAC,KAAK,CAAC,CAAC;YAExC,MAAM,UAAU,GAAoB;gBAClC,WAAW;gBACX,UAAU,EAAE,MAAM;gBAClB,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;gBACpC,QAAQ,EAAE,IAAI,CAAC,IAAI;gBACnB,mBAAmB,EAAE,MAAM;gBAC3B,UAAU,EAAE,OAAO;gBACnB,OAAO;gBACP,GAAG,CAAC,QAAQ,EAAE,KAAK,IAAI,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,QAAQ,EAAE,EAAE,CAAC;gBAC5D,GAAG,CAAC,QAAQ,EAAE,MAAM,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC;gBAC/D,GAAG,CAAC,QAAQ,EAAE,QAAQ,IAAI,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,CAAC,QAAQ,EAAE,EAAE,CAAC;aACtE,CAAC;YAEF,MAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,WAAW,EAAE,UAAU,EAAE;gBAC/C,YAAY,EAAE;oBACZ,WAAW,EAAE,IAAI,CAAC,IAAI;iBACvB;gBACD,cAAc,EAAE,UAA+C;aAChE,CAAC,CAAC;YAEH,OAAO;gBACL,WAAW;gBACX,WAAW;gBACX,QAAQ,EAAE,IAAI,CAAC,IAAI;gBACnB,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,UAAU,EAAE,MAAM;gBAClB,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;gBACpC,GAAG,CAAC,QAAQ,EAAE,KAAK,IAAI,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC;gBACjD,GAAG,CAAC,QAAQ,EAAE,MAAM,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;gBACpD,GAAG,CAAC,QAAQ,EAAE,QAAQ,IAAI,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,CAAC;aAC3D,CAAC;QACJ,CAAC,CAAC,CACH,CAAC;QAEF,6BAA6B;QAC7B,MAAM,UAAU,GAAG,aAAa;aAC7B,MAAM,CAAC,CAAC,CAAC,EAAoC,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,WAAW,CAAC;aACzE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QAEvB,MAAM,CAAC,IAAI,CAAC,wCAAwC,EAAE;YACpD,KAAK,EAAE,KAAK,CAAC,MAAM;YACnB,UAAU,EAAE,UAAU,CAAC,MAAM;YAC7B,MAAM,EAAE,KAAK,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM;YACxC,OAAO;SACR,CAAC,CAAC;QAEH,8CAA8C;QAC9C,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC1B,MAAM,OAAO,GAA+B;gBAC1C,IAAI,EAAE,cAAc;gBACpB,OAAO;gBACP,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;gBACrB,OAAO,EAAE,UAAU;aACpB,CAAC;YAEF,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAE/B,MAAM,CAAC,IAAI,CAAC,2CAA2C,EAAE;gBACvD,KAAK,EAAE,UAAU,CAAC,MAAM;gBACxB,OAAO;aACR,CAAC,CAAC;QACL,CAAC;QAED,iBAAiB;QACjB,OAAO,aAAa,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE;YACzC,IAAI,MAAM,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;gBAClC,OAAO;oBACL,OAAO,EAAE,IAAI;oBACb,WAAW,EAAE,MAAM,CAAC,KAAK,CAAC,WAAW;oBACrC,GAAG,EAAE,GAAG,IAAI,CAAC,SAAS,cAAc,MAAM,CAAC,KAAK,CAAC,WAAW,EAAE;oBAC9D,MAAM,EAAE,UAAmB;iBAC5B,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,WAAW,EAAE,EAAE;oBACf,GAAG,EAAE,EAAE;oBACP,MAAM,EAAE,UAAmB;oBAC3B,OAAO,EAAE,kBAAkB,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE;iBACnD,CAAC;YACJ,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;CACF"}
+{"version":3,"file":"media-upload-service.js","sourceRoot":"","sources":["../../../src/lib/services/media-upload-service.ts"],"names":[],"mappings":"AACA;;;;;;;;GAQG;AAEH,OAAO,EAAE,SAAS,EAAU,MAAM,cAAc,CAAC;AACjD,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAO7D;;GAEG;AACH,SAAS,eAAe;IACtB,OAAO,SAAS,IAAI,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;AAC7E,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,mBAAmB,CAAC,IAAiB;IAClD,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IAC/D,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC;IACzD,OAAO,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACxE,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,mBAAmB,CAAC,QAAgB,EAAE,WAAmB;IAChE,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;IAC1C,IAAI,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,2BAA2B,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;IACzD,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,OAAO,kBAAkB;IACrB,QAAQ,CAAW;IACnB,KAAK,CAAoC;IACzC,SAAS,CAAS;IAClB,GAAG,CAAM;IAEjB,YAAY,GAAQ;QAClB,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;QACf,IAAI,CAAC,QAAQ,GAAG,GAAG,CAAC,eAAe,CAAC;QACpC,IAAI,CAAC,KAAK,GAAG,GAAG,CAAC,0BAA0B,CAAC;QAC5C,IAAI,CAAC,SAAS;YACZ,GAAG,CAAC,WAAW,KAAK,MAAM;gBACxB,CAAC,CAAC,yBAAyB;gBAC3B,CAAC,CAAC,qBAAqB,CAAC;IAC9B,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,YAAY,CAChB,IAAU,EACV,MAAc,EACd,QAAgB,EAChB,QAAiE,EACjE,aAA2B;QAE3B,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;QAC3B,MAAM,OAAO,GAAG,eAAe,EAAE,CAAC;QAElC,IAAI,CAAC;YACH,2BAA2B;YAC3B,yEAAyE;YACzE,wEAAwE;YACxE,MAAM,UAAU,GAAG,aAAa,IAAI,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC;YAC7D,MAAM,WAAW,GAAG,MAAM,mBAAmB,CAAC,UAAU,CAAC,CAAC;YAC1D,oEAAoE;YACpE,sEAAsE;YACtE,oEAAoE;YACpE,MAAM,WAAW,GAAG,mBAAmB,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;YAE/D,MAAM,CAAC,IAAI,CAAC,+BAA+B,EAAE;gBAC3C,WAAW;gBACX,QAAQ,EAAE,IAAI,CAAC,IAAI;gBACnB,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,MAAM;gBACN,OAAO;aACR,CAAC,CAAC;YAEH,gCAAgC;YAChC,MAAM,UAAU,GAAoB;gBAClC,WAAW;gBACX,UAAU,EAAE,MAAM;gBAClB,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;gBACpC,QAAQ,EAAE,IAAI,CAAC,IAAI;gBACnB,mBAAmB,EAAE,MAAM;gBAC3B,UAAU,EAAE,OAAO;gBACnB,OAAO;gBACP,GAAG,CAAC,QAAQ,EAAE,KAAK,IAAI,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,QAAQ,EAAE,EAAE,CAAC;gBAC5D,GAAG,CAAC,QAAQ,EAAE,MAAM,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC;gBAC/D,GAAG,CAAC,QAAQ,EAAE,QAAQ,IAAI,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,CAAC,QAAQ,EAAE,EAAE,CAAC;aACtE,CAAC;YAEF,MAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,WAAW,EAAE,UAAU,EAAE;gBAC/C,YAAY,EAAE;oBACZ,WAAW,EAAE,IAAI,CAAC,IAAI;iBACvB;gBACD,cAAc,EAAE,UAA+C;aAChE,CAAC,CAAC;YAEH,MAAM,CAAC,IAAI,CAAC,oCAAoC,EAAE;gBAChD,WAAW;gBACX,WAAW;aACZ,CAAC,CAAC;YAEH,yCAAyC;YACzC,MAAM,OAAO,GAA+B;gBAC1C,IAAI,EAAE,eAAe;gBACrB,OAAO;gBACP,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;gBACrB,OAAO,EAAE;oBACP;wBACE,WAAW;wBACX,WAAW;wBACX,QAAQ,EAAE,IAAI,CAAC,IAAI;wBACnB,IAAI,EAAE,IAAI,CAAC,IAAI;wBACf,UAAU,EAAE,MAAM;wBAClB,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;wBACpC,GAAG,CAAC,QAAQ,EAAE,KAAK,IAAI,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC;wBACjD,GAAG,CAAC,QAAQ,EAAE,MAAM,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;wBACpD,GAAG,CAAC,QAAQ,EAAE,QAAQ,IAAI,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,CAAC;qBAC3D;iBACF;aACF,CAAC;YAEF,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAE/B,MAAM,CAAC,IAAI,CAAC,qCAAqC,EAAE;gBACjD,WAAW;gBACX,OAAO;aACR,CAAC,CAAC;YAEH,gCAAgC;YAChC,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,WAAW;gBACX,GAAG,EAAE,GAAG,IAAI,CAAC,SAAS,cAAc,WAAW,EAAE;gBACjD,MAAM,EAAE,UAAU;aACnB,CAAC;QACJ,CAAC;QAAC,OAAO,KAAU,EAAE,CAAC;YACpB,MAAM,CAAC,KAAK,CAAC,6BAA6B,EAAE;gBAC1C,KAAK,EAAE,KAAK,CAAC,OAAO;gBACpB,MAAM;gBACN,QAAQ,EAAE,IAAI,CAAC,IAAI;aACpB,CAAC,CAAC;YACH,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,WAAW,CACf,KAAa,EACb,MAAc,EACd,QAAgB,EAChB,aAIE;QAEF,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;QAC3B,MAAM,OAAO,GAAG,eAAe,EAAE,CAAC;QAElC,MAAM,CAAC,IAAI,CAAC,qCAAqC,EAAE;YACjD,SAAS,EAAE,KAAK,CAAC,MAAM;YACvB,MAAM;YACN,OAAO;SACR,CAAC,CAAC;QAEH,qCAAqC;QACrC,MAAM,aAAa,GAAG,MAAM,OAAO,CAAC,UAAU,CAC5C,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE;YAC9B,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC;YAC5C,MAAM,WAAW,GAAG,MAAM,mBAAmB,CAAC,UAAU,CAAC,CAAC;YAC1D,+CAA+C;YAC/C,MAAM,WAAW,GAAG,mBAAmB,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;YAC/D,MAAM,QAAQ,GAAG,aAAa,EAAE,CAAC,KAAK,CAAC,CAAC;YAExC,MAAM,UAAU,GAAoB;gBAClC,WAAW;gBACX,UAAU,EAAE,MAAM;gBAClB,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;gBACpC,QAAQ,EAAE,IAAI,CAAC,IAAI;gBACnB,mBAAmB,EAAE,MAAM;gBAC3B,UAAU,EAAE,OAAO;gBACnB,OAAO;gBACP,GAAG,CAAC,QAAQ,EAAE,KAAK,IAAI,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,QAAQ,EAAE,EAAE,CAAC;gBAC5D,GAAG,CAAC,QAAQ,EAAE,MAAM,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC;gBAC/D,GAAG,CAAC,QAAQ,EAAE,QAAQ,IAAI,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,CAAC,QAAQ,EAAE,EAAE,CAAC;aACtE,CAAC;YAEF,MAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,WAAW,EAAE,UAAU,EAAE;gBAC/C,YAAY,EAAE;oBACZ,WAAW,EAAE,IAAI,CAAC,IAAI;iBACvB;gBACD,cAAc,EAAE,UAA+C;aAChE,CAAC,CAAC;YAEH,OAAO;gBACL,WAAW;gBACX,WAAW;gBACX,QAAQ,EAAE,IAAI,CAAC,IAAI;gBACnB,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,UAAU,EAAE,MAAM;gBAClB,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;gBACpC,GAAG,CAAC,QAAQ,EAAE,KAAK,IAAI,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC;gBACjD,GAAG,CAAC,QAAQ,EAAE,MAAM,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;gBACpD,GAAG,CAAC,QAAQ,EAAE,QAAQ,IAAI,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,CAAC;aAC3D,CAAC;QACJ,CAAC,CAAC,CACH,CAAC;QAEF,6BAA6B;QAC7B,MAAM,UAAU,GAAG,aAAa;aAC7B,MAAM,CAAC,CAAC,CAAC,EAAoC,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,WAAW,CAAC;aACzE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QAEvB,MAAM,CAAC,IAAI,CAAC,wCAAwC,EAAE;YACpD,KAAK,EAAE,KAAK,CAAC,MAAM;YACnB,UAAU,EAAE,UAAU,CAAC,MAAM;YAC7B,MAAM,EAAE,KAAK,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM;YACxC,OAAO;SACR,CAAC,CAAC;QAEH,8CAA8C;QAC9C,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC1B,MAAM,OAAO,GAA+B;gBAC1C,IAAI,EAAE,cAAc;gBACpB,OAAO;gBACP,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;gBACrB,OAAO,EAAE,UAAU;aACpB,CAAC;YAEF,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAE/B,MAAM,CAAC,IAAI,CAAC,2CAA2C,EAAE;gBACvD,KAAK,EAAE,UAAU,CAAC,MAAM;gBACxB,OAAO;aACR,CAAC,CAAC;QACL,CAAC;QAED,iBAAiB;QACjB,OAAO,aAAa,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE;YACzC,IAAI,MAAM,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;gBAClC,OAAO;oBACL,OAAO,EAAE,IAAI;oBACb,WAAW,EAAE,MAAM,CAAC,KAAK,CAAC,WAAW;oBACrC,GAAG,EAAE,GAAG,IAAI,CAAC,SAAS,cAAc,MAAM,CAAC,KAAK,CAAC,WAAW,EAAE;oBAC9D,MAAM,EAAE,UAAmB;iBAC5B,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,WAAW,EAAE,EAAE;oBACf,GAAG,EAAE,EAAE;oBACP,MAAM,EAAE,UAAmB;oBAC3B,OAAO,EAAE,kBAAkB,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE;iBACnD,CAAC;YACJ,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;CACF"}

package/dist/lib/tenant-scope.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tenant-scope.d.ts","sourceRoot":"","sources":["../../src/lib/tenant-scope.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAOH,MAAM,MAAM,eAAe,GAAG,KAAK,GAAG,QAAQ,GAAG,SAAS,CAAC;AAE3D,6EAA6E;AAC7E,wBAAgB,sBAAsB,CACpC,GAAG,GAAE,MAAM,GAAG,SAAyC,GACtD,eAAe,CAEjB;AAED;;;GAGG;AACH,eAAO,MAAM,oBAAoB,EAAE,WAAW,CAAC,MAAM,CAuBnD,CAAC;AAEH;;;;;GAKG;AACH,eAAO,MAAM,eAAe,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CA0DtD,CAAC;AAqBH;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,CAG7D;AAYD,+EAA+E;AAC/E,MAAM,MAAM,SAAS,GACjB;IAAE,MAAM,EAAE,aAAa,CAAA;CAAE,GACzB;IAAE,MAAM,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GACpC;IAAE,MAAM,EAAE,SAAS,CAAC;IAAC,UAAU,EAAE,OAAO,CAAA;CAAE,GAC1C;IAAE,MAAM,EAAE,oBAAoB,CAAA;CAAE,GAChC;IAAE,MAAM,EAAE,SAAS,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,CAAC;AAEzD;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE;IACrC,IAAI,EAAE,eAAe,CAAC;IACtB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC;IAC1C,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7B,QAAQ,EAAE,OAAO,CAAC;CACnB,GAAG,SAAS,CAqDZ;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,eAAe;;;;EAyCzD"}
+{"version":3,"file":"tenant-scope.d.ts","sourceRoot":"","sources":["../../src/lib/tenant-scope.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAOH,MAAM,MAAM,eAAe,GAAG,KAAK,GAAG,QAAQ,GAAG,SAAS,CAAC;AAE3D,6EAA6E;AAC7E,wBAAgB,sBAAsB,CACpC,GAAG,GAAE,MAAM,GAAG,SAAyC,GACtD,eAAe,CAEjB;AAED;;;GAGG;AACH,eAAO,MAAM,oBAAoB,EAAE,WAAW,CAAC,MAAM,CA6BnD,CAAC;AAEH;;;;;GAKG;AACH,eAAO,MAAM,eAAe,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAqEtD,CAAC;AAqBH;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,CAG7D;AAYD,+EAA+E;AAC/E,MAAM,MAAM,SAAS,GACjB;IAAE,MAAM,EAAE,aAAa,CAAA;CAAE,GACzB;IAAE,MAAM,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GACpC;IAAE,MAAM,EAAE,SAAS,CAAC;IAAC,UAAU,EAAE,OAAO,CAAA;CAAE,GAC1C;IAAE,MAAM,EAAE,oBAAoB,CAAA;CAAE,GAChC;IAAE,MAAM,EAAE,SAAS,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,CAAC;AAEzD;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE;IACrC,IAAI,EAAE,eAAe,CAAC;IACtB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC;IAC1C,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7B,QAAQ,EAAE,OAAO,CAAC;CACnB,GAAG,SAAS,CAqDZ;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,eAAe;;;;EAyCzD"}

package/dist/lib/tenant-scope.js

@@ -48,6 +48,7 @@ export const TENANT_SCOPED_MODELS = new Set([
     "PostComment",
     "Entity",
     "Notification",
+    "BlockedUser",
     "Group",
     "GroupMember",
     "EntityOwnership",
@@ -66,6 +67,11 @@ export const TENANT_SCOPED_MODELS = new Set([
     // this middleware, always filter tenant_id explicitly).
     "Relationship",
     "EntityRelationship",
+    // D18: MediaFile is now tenant-scoped (carries its own tenantId). Dedup is
+    // within-tenant via @@unique([tenantId, contentHash]). PostMedia is
+    // "by-relation" (no own tenantId) and crosses the scope boundary via
+    // the post→media join — flagged for T9/integration.
+    "MediaFile",
 ]);
 /**
  * Every other model, with the reason it is NOT auto-scoped. Exhaustive on
@@ -90,7 +96,12 @@ export const UNSCOPED_MODELS = new Map([
     ["FeatureToggle", "global"],
     ["IngestState", "global"],
     ["RoleMetadata", "global"],
-    ["MediaFile", "global-content-addressed"],
+    // P0b moderation-message dedupe ledger: a system-global exactly-once table
+    // keyed on an opaque messageDedupeKey. No tenantId column; identical bytes
+    // share fan-in across tenants by design — never auto-scoped.
+    ["ProcessedModerationMessage", "global"],
+    // Note: MediaFile was here as "global-content-addressed" prior to D18.
+    // It now carries its own tenantId and is in TENANT_SCOPED_MODELS above.
     // User-scoped (boundary is userId, not tenant).
     ["User", "user"],
     ["CircleConfig", "user"],
@@ -100,6 +111,7 @@ export const UNSCOPED_MODELS = new Map([
     ["UploadSession", "user"],
     ["MfaEnrollment", "user"],
     ["UserEncryptionKey", "user"],
+    ["EncryptedUserSetting", "user"],
     ["Consent", "user"],
     ["NotificationPreference", "user"],
     // Generalized report model (Surveillance-hardening Phase 0, E3; folds in the
@@ -112,6 +124,11 @@ export const UNSCOPED_MODELS = new Map([
     ["DirectMessage", "user-pair"],
     // Scoped-by-relation: no own tenantId yet (doc/14 §04 C / WS0). Rely on the
     // parent's scope + the RLS backstop until tenantId is denormalized onto them.
+    // P0b moderation job: tenant-scoped through its parent MediaFile via mediaId
+    // (onDelete: Cascade). No own tenantId column, so it cannot be auto-scoped by
+    // the where-merge/create-stamp extension — same posture as the other
+    // by-relation child tables (parent scope + RLS backstop).
+    ["MediaModerationJob", "by-relation"],
     ["PostMedia", "by-relation"],
     ["PostSentiment", "by-relation"],
     ["PostSubject", "by-relation"],

package/dist/lib/tenant-scope.js.map

@@ -1 +1 @@
-{"version":3,"file":"tenant-scope.js","sourceRoot":"","sources":["../../src/lib/tenant-scope.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AACxC,OAAO,EAAE,kBAAkB,EAAE,MAAM,iCAAiC,CAAC;AACrE,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAIxC,6EAA6E;AAC7E,MAAM,UAAU,sBAAsB,CACpC,MAA0B,OAAO,CAAC,GAAG,CAAC,iBAAiB;IAEvD,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC;AAC7D,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAwB,IAAI,GAAG,CAAC;IAC/D,MAAM;IACN,aAAa;IACb,QAAQ;IACR,cAAc;IACd,OAAO;IACP,aAAa;IACb,iBAAiB;IACjB,gBAAgB;IAChB,0BAA0B;IAC1B,mBAAmB;IACnB,kBAAkB;IAClB,eAAe;IACf,6EAA6E;IAC7E,8EAA8E;IAC9E,2EAA2E;IAC3E,gBAAgB;IAChB,wEAAwE;IACxE,2EAA2E;IAC3E,4EAA4E;IAC5E,wDAAwD;IACxD,cAAc;IACd,oBAAoB;CACrB,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,eAAe,GAAgC,IAAI,GAAG,CAAC;IAClE,8EAA8E;IAC9E,8EAA8E;IAC9E,6DAA6D;IAC7D,CAAC,QAAQ,EAAE,cAAc,CAAC;IAC1B,CAAC,cAAc,EAAE,cAAc,CAAC;IAChC,CAAC,cAAc,EAAE,cAAc,CAAC;IAChC,CAAC,wBAAwB,EAAE,cAAc,CAAC;IAC1C,CAAC,mBAAmB,EAAE,cAAc,CAAC;IACrC,CAAC,kBAAkB,EAAE,cAAc,CAAC;IACpC,oBAAoB;IACpB,CAAC,UAAU,EAAE,QAAQ,CAAC;IACtB,CAAC,kBAAkB,EAAE,QAAQ,CAAC;IAC9B,CAAC,kBAAkB,EAAE,QAAQ,CAAC;IAC9B,CAAC,eAAe,EAAE,QAAQ,CAAC;IAC3B,CAAC,aAAa,EAAE,QAAQ,CAAC;IACzB,CAAC,cAAc,EAAE,QAAQ,CAAC;IAC1B,CAAC,WAAW,EAAE,0BAA0B,CAAC;IACzC,gDAAgD;IAChD,CAAC,MAAM,EAAE,MAAM,CAAC;IAChB,CAAC,cAAc,EAAE,MAAM,CAAC;IACxB,CAAC,iBAAiB,EAAE,MAAM,CAAC;IAC3B,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAC1B,CAAC,sBAAsB,EAAE,MAAM,CAAC;IAChC,CAAC,eAAe,EAAE,MAAM,CAAC;IACzB,CAAC,eAAe,EAAE,MAAM,CAAC;IACzB,CAAC,mBAAmB,EAAE,MAAM,CAAC;IAC7B,CAAC,SAAS,EAAE,MAAM,CAAC;IACnB,CAAC,wBAAwB,EAAE,MAAM,CAAC;IAClC,6EAA6E;IAC7E,gEAAgE;IAChE,6EAA6E;IAC7E,CAAC,QAAQ,EAAE,MAAM,CAAC;IAClB,CAAC,cAAc,EAAE,MAAM,CAAC;IACxB,CAAC,kBAAkB,EAAE,MAAM,CAAC;IAC5B,CAAC,YAAY,EAAE,MAAM,CAAC;IACtB,CAAC,eAAe,EAAE,WAAW,CAAC;IAC9B,4EAA4E;IAC5E,8EAA8E;IAC9E,CAAC,WAAW,EAAE,aAAa,CAAC;IAC5B,CAAC,eAAe,EAAE,aAAa,CAAC;IAChC,CAAC,aAAa,EAAE,aAAa,CAAC;IAC9B,CAAC,kBAAkB,EAAE,aAAa,CAAC;IACnC,CAAC,kBAAkB,EAAE,aAAa,CAAC;IACnC,CAAC,mBAAmB,EAAE,aAAa,CAAC;IACpC,CAAC,iBAAiB,EAAE,aAAa,CAAC;IAClC,CAAC,oBAAoB,EAAE,oBAAoB,CAAC;IAC5C,CAAC,WAAW,EAAE,aAAa,CAAC;IAC5B,CAAC,cAAc,EAAE,aAAa,CAAC;IAC/B,2EAA2E;IAC3E,6BAA6B;IAC7B,CAAC,eAAe,EAAE,gBAAgB,CAAC;IACnC,CAAC,YAAY,EAAE,gBAAgB,CAAC;IAChC,yEAAyE;IACzE,yEAAyE;IACzE,2EAA2E;IAC3E,qEAAqE;IACrE,CAAC,kBAAkB,EAAE,gBAAgB,CAAC;CACvC,CAAC,CAAC;AAEH,yEAAyE;AACzE,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC;IAC9B,WAAW;IACX,kBAAkB;IAClB,UAAU;IACV,OAAO;IACP,WAAW;IACX,SAAS;IACT,YAAY;IACZ,YAAY;CACb,CAAC,CAAC;AACH,yEAAyE;AACzE,+EAA+E;AAC/E,6DAA6D;AAE7D,0EAA0E;AAC1E,4EAA4E;AAC5E,MAAM,eAAe,GAAG,IAAI,iBAAiB,EAAQ,CAAC;AAEtD;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CAAI,MAAc,EAAE,EAAW;IACxD,SAAS,EAAE,CAAC,IAAI,CAAC,kDAAkD,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;IACjF,OAAO,eAAe,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;AACvC,CAAC;AACD,SAAS,UAAU;IACjB,OAAO,eAAe,CAAC,QAAQ,EAAE,KAAK,IAAI,CAAC;AAC7C,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc,EAAE,QAAgB;IAChD,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACvC,OAAO,EAAE,GAAG,EAAE,CAAC,KAAgC,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;IACnE,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,CAAC;AACtB,CAAC;AAUD;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,KAO/B;IACC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC;IAEnE,IAAI,IAAI,KAAK,KAAK,IAAI,QAAQ,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QACnE,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IACnC,CAAC;IAED,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,IAAI,KAAK,SAAS;YACvB,CAAC,CAAC;gBACE,MAAM,EAAE,OAAO;gBACf,OAAO,EAAE,kBAAkB,KAAK,IAAI,SAAS,6BAA6B;aAC3E;YACH,CAAC,CAAC,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;IACvC,CAAC;IAED,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtB,MAAM,CAAC,GAAI,IAAI,EAAE,KAA6C,IAAI,SAAS,CAAC;QAC5E,MAAM,UAAU,GAAG,CAAC,CAClB,CAAC,IAAI,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,EAAE,UAAU,CAAC,CACzD,CAAC;QACF,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC;IAC3C,CAAC;IAED,UAAU;IACV,MAAM,CAAC,GAAG,IAAI,IAAI,EAAE,CAAC;IACrB,IAAI,eAAe,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;QACnC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,KAAK,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC;IACnF,CAAC;IACD,IAAI,SAAS,KAAK,QAAQ,EAAE,CAAC;QAC3B,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE,EAAE,GAAI,CAAC,CAAC,IAAe,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IAC1F,CAAC;IACD,IAAI,SAAS,KAAK,YAAY,EAAE,CAAC;QAC/B,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC;QACpB,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;YACjC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAI,CAAY,EAAE,QAAQ,EAAE,CAAC,CAAC;YACnD,CAAC,CAAC,EAAE,GAAI,IAAe,EAAE,QAAQ,EAAE,CAAC;QACtC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,CAAC;IAC9D,CAAC;IACD,IAAI,SAAS,KAAK,QAAQ,EAAE,CAAC;QAC3B,OAAO;YACL,MAAM,EAAE,SAAS;YACjB,IAAI,EAAE;gBACJ,GAAG,CAAC;gBACJ,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,KAAK,EAAE,QAAQ,CAAC;gBAClC,MAAM,EAAE,EAAE,GAAI,CAAC,CAAC,MAAiB,EAAE,QAAQ,EAAE;gBAC7C,MAAM,EAAE,CAAC,CAAC,MAAM;aACjB;SACF,CAAC;IACJ,CAAC;IACD,6EAA6E;IAC7E,0BAA0B;IAC1B,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;AACnC,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAAqB;IACxD,OAAO,MAAM,CAAC,eAAe,CAAC;QAC5B,IAAI,EAAE,cAAc;QACpB,KAAK,EAAE;YACL,UAAU,EAAE;gBACV,KAAK,CAAC,cAAc,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE;oBACpD,MAAM,IAAI,GAAG,eAAe,CAAC;wBAC3B,IAAI;wBACJ,KAAK;wBACL,SAAS;wBACT,IAAI,EAAE,IAA2C;wBACjD,QAAQ,EAAE,kBAAkB,EAAE;wBAC9B,QAAQ,EAAE,UAAU,EAAE;qBACvB,CAAC,CAAC;oBAEH,QAAQ,IAAI,CAAC,MAAM,EAAE,CAAC;wBACpB,KAAK,aAAa;4BAChB,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC;wBACrB,KAAK,OAAO;4BACV,MAAM,IAAI,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;wBAChC,KAAK,oBAAoB;4BACvB,SAAS,EAAE,CAAC,IAAI,CACd,wDAAwD,EACxD,EAAE,KAAK,EAAE,SAAS,EAAE,CACrB,CAAC;4BACF,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC;wBACrB,KAAK,SAAS;4BACZ,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;gCACpB,SAAS,EAAE,CAAC,IAAI,CAAC,yCAAyC,EAAE;oCAC1D,KAAK;oCACL,SAAS;iCACV,CAAC,CAAC;4BACL,CAAC;4BACD,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC;wBACrB,KAAK,SAAS;4BACZ,OAAO,KAAK,CAAC,IAAI,CAAC,IAAmB,CAAC,CAAC;oBAC3C,CAAC;gBACH,CAAC;aACF;SACF;KACF,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"tenant-scope.js","sourceRoot":"","sources":["../../src/lib/tenant-scope.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AACxC,OAAO,EAAE,kBAAkB,EAAE,MAAM,iCAAiC,CAAC;AACrE,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAIxC,6EAA6E;AAC7E,MAAM,UAAU,sBAAsB,CACpC,MAA0B,OAAO,CAAC,GAAG,CAAC,iBAAiB;IAEvD,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC;AAC7D,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAwB,IAAI,GAAG,CAAC;IAC/D,MAAM;IACN,aAAa;IACb,QAAQ;IACR,cAAc;IACd,aAAa;IACb,OAAO;IACP,aAAa;IACb,iBAAiB;IACjB,gBAAgB;IAChB,0BAA0B;IAC1B,mBAAmB;IACnB,kBAAkB;IAClB,eAAe;IACf,6EAA6E;IAC7E,8EAA8E;IAC9E,2EAA2E;IAC3E,gBAAgB;IAChB,wEAAwE;IACxE,2EAA2E;IAC3E,4EAA4E;IAC5E,wDAAwD;IACxD,cAAc;IACd,oBAAoB;IACpB,2EAA2E;IAC3E,oEAAoE;IACpE,qEAAqE;IACrE,oDAAoD;IACpD,WAAW;CACZ,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,eAAe,GAAgC,IAAI,GAAG,CAAC;IAClE,8EAA8E;IAC9E,8EAA8E;IAC9E,6DAA6D;IAC7D,CAAC,QAAQ,EAAE,cAAc,CAAC;IAC1B,CAAC,cAAc,EAAE,cAAc,CAAC;IAChC,CAAC,cAAc,EAAE,cAAc,CAAC;IAChC,CAAC,wBAAwB,EAAE,cAAc,CAAC;IAC1C,CAAC,mBAAmB,EAAE,cAAc,CAAC;IACrC,CAAC,kBAAkB,EAAE,cAAc,CAAC;IACpC,oBAAoB;IACpB,CAAC,UAAU,EAAE,QAAQ,CAAC;IACtB,CAAC,kBAAkB,EAAE,QAAQ,CAAC;IAC9B,CAAC,kBAAkB,EAAE,QAAQ,CAAC;IAC9B,CAAC,eAAe,EAAE,QAAQ,CAAC;IAC3B,CAAC,aAAa,EAAE,QAAQ,CAAC;IACzB,CAAC,cAAc,EAAE,QAAQ,CAAC;IAC1B,2EAA2E;IAC3E,2EAA2E;IAC3E,6DAA6D;IAC7D,CAAC,4BAA4B,EAAE,QAAQ,CAAC;IACxC,uEAAuE;IACvE,wEAAwE;IACxE,gDAAgD;IAChD,CAAC,MAAM,EAAE,MAAM,CAAC;IAChB,CAAC,cAAc,EAAE,MAAM,CAAC;IACxB,CAAC,iBAAiB,EAAE,MAAM,CAAC;IAC3B,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAC1B,CAAC,sBAAsB,EAAE,MAAM,CAAC;IAChC,CAAC,eAAe,EAAE,MAAM,CAAC;IACzB,CAAC,eAAe,EAAE,MAAM,CAAC;IACzB,CAAC,mBAAmB,EAAE,MAAM,CAAC;IAC7B,CAAC,sBAAsB,EAAE,MAAM,CAAC;IAChC,CAAC,SAAS,EAAE,MAAM,CAAC;IACnB,CAAC,wBAAwB,EAAE,MAAM,CAAC;IAClC,6EAA6E;IAC7E,gEAAgE;IAChE,6EAA6E;IAC7E,CAAC,QAAQ,EAAE,MAAM,CAAC;IAClB,CAAC,cAAc,EAAE,MAAM,CAAC;IACxB,CAAC,kBAAkB,EAAE,MAAM,CAAC;IAC5B,CAAC,YAAY,EAAE,MAAM,CAAC;IACtB,CAAC,eAAe,EAAE,WAAW,CAAC;IAC9B,4EAA4E;IAC5E,8EAA8E;IAC9E,6EAA6E;IAC7E,8EAA8E;IAC9E,qEAAqE;IACrE,0DAA0D;IAC1D,CAAC,oBAAoB,EAAE,aAAa,CAAC;IACrC,CAAC,WAAW,EAAE,aAAa,CAAC;IAC5B,CAAC,eAAe,EAAE,aAAa,CAAC;IAChC,CAAC,aAAa,EAAE,aAAa,CAAC;IAC9B,CAAC,kBAAkB,EAAE,aAAa,CAAC;IACnC,CAAC,kBAAkB,EAAE,aAAa,CAAC;IACnC,CAAC,mBAAmB,EAAE,aAAa,CAAC;IACpC,CAAC,iBAAiB,EAAE,aAAa,CAAC;IAClC,CAAC,oBAAoB,EAAE,oBAAoB,CAAC;IAC5C,CAAC,WAAW,EAAE,aAAa,CAAC;IAC5B,CAAC,cAAc,EAAE,aAAa,CAAC;IAC/B,2EAA2E;IAC3E,6BAA6B;IAC7B,CAAC,eAAe,EAAE,gBAAgB,CAAC;IACnC,CAAC,YAAY,EAAE,gBAAgB,CAAC;IAChC,yEAAyE;IACzE,yEAAyE;IACzE,2EAA2E;IAC3E,qEAAqE;IACrE,CAAC,kBAAkB,EAAE,gBAAgB,CAAC;CACvC,CAAC,CAAC;AAEH,yEAAyE;AACzE,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC;IAC9B,WAAW;IACX,kBAAkB;IAClB,UAAU;IACV,OAAO;IACP,WAAW;IACX,SAAS;IACT,YAAY;IACZ,YAAY;CACb,CAAC,CAAC;AACH,yEAAyE;AACzE,+EAA+E;AAC/E,6DAA6D;AAE7D,0EAA0E;AAC1E,4EAA4E;AAC5E,MAAM,eAAe,GAAG,IAAI,iBAAiB,EAAQ,CAAC;AAEtD;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CAAI,MAAc,EAAE,EAAW;IACxD,SAAS,EAAE,CAAC,IAAI,CAAC,kDAAkD,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;IACjF,OAAO,eAAe,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;AACvC,CAAC;AACD,SAAS,UAAU;IACjB,OAAO,eAAe,CAAC,QAAQ,EAAE,KAAK,IAAI,CAAC;AAC7C,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc,EAAE,QAAgB;IAChD,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACvC,OAAO,EAAE,GAAG,EAAE,CAAC,KAAgC,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;IACnE,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,CAAC;AACtB,CAAC;AAUD;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,KAO/B;IACC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC;IAEnE,IAAI,IAAI,KAAK,KAAK,IAAI,QAAQ,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QACnE,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IACnC,CAAC;IAED,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,IAAI,KAAK,SAAS;YACvB,CAAC,CAAC;gBACE,MAAM,EAAE,OAAO;gBACf,OAAO,EAAE,kBAAkB,KAAK,IAAI,SAAS,6BAA6B;aAC3E;YACH,CAAC,CAAC,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;IACvC,CAAC;IAED,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtB,MAAM,CAAC,GAAI,IAAI,EAAE,KAA6C,IAAI,SAAS,CAAC;QAC5E,MAAM,UAAU,GAAG,CAAC,CAClB,CAAC,IAAI,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,EAAE,UAAU,CAAC,CACzD,CAAC;QACF,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC;IAC3C,CAAC;IAED,UAAU;IACV,MAAM,CAAC,GAAG,IAAI,IAAI,EAAE,CAAC;IACrB,IAAI,eAAe,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;QACnC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,KAAK,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC;IACnF,CAAC;IACD,IAAI,SAAS,KAAK,QAAQ,EAAE,CAAC;QAC3B,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE,EAAE,GAAI,CAAC,CAAC,IAAe,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IAC1F,CAAC;IACD,IAAI,SAAS,KAAK,YAAY,EAAE,CAAC;QAC/B,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC;QACpB,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;YACjC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAI,CAAY,EAAE,QAAQ,EAAE,CAAC,CAAC;YACnD,CAAC,CAAC,EAAE,GAAI,IAAe,EAAE,QAAQ,EAAE,CAAC;QACtC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,CAAC;IAC9D,CAAC;IACD,IAAI,SAAS,KAAK,QAAQ,EAAE,CAAC;QAC3B,OAAO;YACL,MAAM,EAAE,SAAS;YACjB,IAAI,EAAE;gBACJ,GAAG,CAAC;gBACJ,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,KAAK,EAAE,QAAQ,CAAC;gBAClC,MAAM,EAAE,EAAE,GAAI,CAAC,CAAC,MAAiB,EAAE,QAAQ,EAAE;gBAC7C,MAAM,EAAE,CAAC,CAAC,MAAM;aACjB;SACF,CAAC;IACJ,CAAC;IACD,6EAA6E;IAC7E,0BAA0B;IAC1B,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;AACnC,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAAqB;IACxD,OAAO,MAAM,CAAC,eAAe,CAAC;QAC5B,IAAI,EAAE,cAAc;QACpB,KAAK,EAAE;YACL,UAAU,EAAE;gBACV,KAAK,CAAC,cAAc,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE;oBACpD,MAAM,IAAI,GAAG,eAAe,CAAC;wBAC3B,IAAI;wBACJ,KAAK;wBACL,SAAS;wBACT,IAAI,EAAE,IAA2C;wBACjD,QAAQ,EAAE,kBAAkB,EAAE;wBAC9B,QAAQ,EAAE,UAAU,EAAE;qBACvB,CAAC,CAAC;oBAEH,QAAQ,IAAI,CAAC,MAAM,EAAE,CAAC;wBACpB,KAAK,aAAa;4BAChB,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC;wBACrB,KAAK,OAAO;4BACV,MAAM,IAAI,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;wBAChC,KAAK,oBAAoB;4BACvB,SAAS,EAAE,CAAC,IAAI,CACd,wDAAwD,EACxD,EAAE,KAAK,EAAE,SAAS,EAAE,CACrB,CAAC;4BACF,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC;wBACrB,KAAK,SAAS;4BACZ,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;gCACpB,SAAS,EAAE,CAAC,IAAI,CAAC,yCAAyC,EAAE;oCAC1D,KAAK;oCACL,SAAS;iCACV,CAAC,CAAC;4BACL,CAAC;4BACD,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC;wBACrB,KAAK,SAAS;4BACZ,OAAO,KAAK,CAAC,IAAI,CAAC,IAAmB,CAAC,CAAC;oBAC3C,CAAC;gBACH,CAAC;aACF;SACF;KACF,CAAC,CAAC;AACL,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@de-otio/trellis",
-  "version": "0.10.11",
+  "version": "0.12.0",
   "license": "AGPL-3.0-or-later",
   "type": "module",
   "main": "./dist/index.js",
@@ -49,22 +49,22 @@
     "@aws-lambda-powertools/logger": "^2.32.0",
     "@aws-lambda-powertools/metrics": "^2.32.0",
     "@aws-lambda-powertools/parameters": "^2.33.1",
-    "@aws-sdk/client-cloudwatch": "^3.1066.0",
-    "@aws-sdk/client-cloudwatch-logs": "^3.1066.0",
-    "@aws-sdk/client-cognito-identity-provider": "^3.1066.0",
-    "@aws-sdk/client-dynamodb": "^3.1066.0",
-    "@aws-sdk/client-kms": "^3.1066.0",
-    "@aws-sdk/client-s3": "^3.1066.0",
-    "@aws-sdk/client-secrets-manager": "^3.1066.0",
-    "@aws-sdk/client-ses": "^3.1066.0",
-    "@aws-sdk/client-sns": "^3.1066.0",
-    "@aws-sdk/client-sqs": "^3.1066.0",
-    "@aws-sdk/client-ssm": "^3.1066.0",
-    "@aws-sdk/s3-request-presigner": "^3.1066.0",
-    "@aws-sdk/util-dynamodb": "^3.996.4",
+    "@aws-sdk/client-cloudwatch": "^3.1071.0",
+    "@aws-sdk/client-cloudwatch-logs": "^3.1071.0",
+    "@aws-sdk/client-cognito-identity-provider": "^3.1071.0",
+    "@aws-sdk/client-dynamodb": "^3.1071.0",
+    "@aws-sdk/client-kms": "^3.1071.0",
+    "@aws-sdk/client-s3": "^3.1071.0",
+    "@aws-sdk/client-secrets-manager": "^3.1071.0",
+    "@aws-sdk/client-ses": "^3.1071.0",
+    "@aws-sdk/client-sns": "^3.1071.0",
+    "@aws-sdk/client-sqs": "^3.1071.0",
+    "@aws-sdk/client-ssm": "^3.1071.0",
+    "@aws-sdk/s3-request-presigner": "^3.1071.0",
+    "@aws-sdk/util-dynamodb": "^3.996.5",
     "@de-otio/saas-foundation": "^0.3.0",
     "@de-otio/trellis-extension-api": "^0.3.0",
-    "@de-otio/vestibulum": "^0.3.0",
+    "@de-otio/vestibulum": "^0.3.2",
     "@fedify/fedify": "2.2.5",
     "@prisma/adapter-pg": "^7.8.0",
     "@prisma/client": "^7.8.0",
@@ -78,21 +78,22 @@
     "zod": "^4.4.3"
   },
   "devDependencies": {
-    "@aws-sdk/client-bedrock-agent-runtime": "^3.1066.0",
-    "@aws-sdk/client-cost-explorer": "^3.1066.0",
-    "@aws-sdk/client-ecs": "^3.1066.0",
-    "@aws-sdk/client-lambda": "^3.1066.0",
+    "@aws-sdk/client-bedrock-agent-runtime": "^3.1071.0",
+    "@aws-sdk/client-cost-explorer": "^3.1071.0",
+    "@aws-sdk/client-ecs": "^3.1071.0",
+    "@aws-sdk/client-lambda": "^3.1071.0",
     "@types/aws-lambda": "^8.10.162",
     "@types/js-yaml": "^4.0.9",
     "@types/node": "^25.9.3",
     "@types/pg": "^8.18.0",
-    "@types/sharp": "^0.31.0",
-    "@vitest/coverage-v8": "^4.1.8",
+    "@types/sharp": "^0.32.0",
+    "@vitest/coverage-v8": "^4.1.9",
     "@vitest/ui": "^4.1.8",
     "aws-sdk-client-mock": "^4.1.0",
     "esbuild": "^0.28.1",
+    "fast-check": "^3.23.2",
     "form-data": "^4.0.1",
-    "mailparser": "^3.9.9",
+    "mailparser": "^3.9.11",
     "prettier": "^3.8.4",
     "prisma": "^7.8.0",
     "tsx": "^4.22.4",

package/prisma/migrations/20260620051144_add_encrypted_user_settings/migration.sql

@@ -0,0 +1,24 @@
+-- WS5 — encrypted-settings state-sync. Server-blind per-namespace encrypted
+-- setting blob with optimistic-concurrency version + cascade on user delete.
+
+-- CreateTable
+CREATE TABLE "encrypted_user_settings" (
+    "id" TEXT NOT NULL,
+    "user_id" TEXT NOT NULL,
+    "namespace" TEXT NOT NULL,
+    "ciphertext" TEXT NOT NULL,
+    "version" INTEGER NOT NULL DEFAULT 1,
+    "updated_at" TIMESTAMP(3) NOT NULL,
+    "created_at" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+
+    CONSTRAINT "encrypted_user_settings_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateIndex
+CREATE INDEX "encrypted_user_settings_user_id_idx" ON "encrypted_user_settings"("user_id");
+
+-- CreateIndex
+CREATE UNIQUE INDEX "encrypted_user_settings_user_id_namespace_key" ON "encrypted_user_settings"("user_id", "namespace");
+
+-- AddForeignKey
+ALTER TABLE "encrypted_user_settings" ADD CONSTRAINT "encrypted_user_settings_user_id_fkey" FOREIGN KEY ("user_id") REFERENCES "users"("id") ON DELETE CASCADE ON UPDATE CASCADE;

package/prisma/migrations/20260620120000_add_blocked_users/migration.sql

@@ -0,0 +1,29 @@
+-- Track D — block-list store for the realtime delivery FLOOR. Directed,
+-- tenant-scoped block edges (blocker has blocked blocked). Consulted by
+-- BlockStore.isBlocked to drop a blocked sender's wakeup at the floor.
+
+-- CreateTable
+CREATE TABLE "blocked_users" (
+    "id" TEXT NOT NULL,
+    "tenant_id" TEXT NOT NULL,
+    "blocker_id" TEXT NOT NULL,
+    "blocked_id" TEXT NOT NULL,
+    "created_at" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+
+    CONSTRAINT "blocked_users_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateIndex
+CREATE INDEX "blocked_users_tenant_id_blocker_id_idx" ON "blocked_users"("tenant_id", "blocker_id");
+
+-- CreateIndex
+CREATE UNIQUE INDEX "blocked_users_tenant_id_blocker_id_blocked_id_key" ON "blocked_users"("tenant_id", "blocker_id", "blocked_id");
+
+-- AddForeignKey
+ALTER TABLE "blocked_users" ADD CONSTRAINT "blocked_users_tenant_id_fkey" FOREIGN KEY ("tenant_id") REFERENCES "tenants"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "blocked_users" ADD CONSTRAINT "blocked_users_blocker_id_fkey" FOREIGN KEY ("blocker_id") REFERENCES "users"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "blocked_users" ADD CONSTRAINT "blocked_users_blocked_id_fkey" FOREIGN KEY ("blocked_id") REFERENCES "users"("id") ON DELETE CASCADE ON UPDATE CASCADE;

package/prisma/migrations/20260625000000_media_tenant_scope_and_moderation_status/migration.sql

@@ -0,0 +1,49 @@
+-- T8: MediaFile tenant-scope reclassification + moderation status (D18, D13).
+--
+-- Summary of changes:
+--   + tenantId (NOT NULL) — every object belongs to exactly one tenant
+--   + ModerationStatus enum — PENDING | APPROVED | REVIEW | QUARANTINED | REJECTED
+--   + moderationStatus column defaulting to PENDING (fail-closed)
+--   - contentHash @unique (bare global unique) dropped
+--   + @@unique([tenantId, contentHash]) — within-tenant dedup replaces global dedup
+--   - gpsLatitude / gpsLongitude columns dropped (data-minimization, D13)
+--   - @@index([gpsLatitude, gpsLongitude]) dropped with the columns
+--   ~ metadataVisible default changed true -> false (D13 P0a)
+--   + @@index([moderationStatus]) — moderation-queue queries
+--   + @@index([tenantId, contentHash]) — tenant-scoped CAS serve path
+--
+-- Greenfield: Skybber is not live. No backfill. Dev media wiped + re-seeded
+-- (human checkpoint per README §9 item 1 before apply).
+
+-- CreateEnum
+CREATE TYPE "ModerationStatus" AS ENUM ('PENDING', 'APPROVED', 'REVIEW', 'QUARANTINED', 'REJECTED');
+
+-- AlterTable: add tenantId (NOT NULL), moderationStatus; drop GPS columns;
+-- flip metadataVisible default.
+ALTER TABLE "media_files"
+    ADD COLUMN "tenant_id" TEXT NOT NULL,
+    ADD COLUMN "moderation_status" "ModerationStatus" NOT NULL DEFAULT 'PENDING',
+    DROP COLUMN "gps_latitude",
+    DROP COLUMN "gps_longitude",
+    ALTER COLUMN "metadata_visible" SET DEFAULT false;
+
+-- DropIndex: remove bare global unique on content_hash
+DROP INDEX "media_files_content_hash_key";
+
+-- DropIndex: the GPS composite index is already removed by the DROP COLUMN
+-- above (Postgres cascades indexes that depend on a dropped column). IF EXISTS
+-- makes this explicit drop a safe no-op whether or not the index is still
+-- present / was ever named this in the migration history.
+DROP INDEX IF EXISTS "media_files_gps_latitude_gps_longitude_idx";
+
+-- CreateIndex: within-tenant dedup (replaces bare @unique)
+CREATE UNIQUE INDEX "media_files_tenant_id_content_hash_key" ON "media_files"("tenant_id", "content_hash");
+
+-- CreateIndex: moderation queue lookups
+CREATE INDEX "media_files_moderation_status_idx" ON "media_files"("moderation_status");
+
+-- CreateIndex: tenant-scoped CAS serve path
+CREATE INDEX "media_files_tenant_id_content_hash_idx" ON "media_files"("tenant_id", "content_hash");
+
+-- AddForeignKey: tenantId references tenants
+ALTER TABLE "media_files" ADD CONSTRAINT "media_files_tenant_id_fkey" FOREIGN KEY ("tenant_id") REFERENCES "tenants"("id") ON DELETE CASCADE ON UPDATE CASCADE;