@de-otio/trellis 0.10.11 → 0.12.0

package/dist/lambda/media-processing-worker.d.ts

@@ -1,3 +1,174 @@
-import type { SQSHandler } from "aws-lambda";
+import type { SQSHandler, SQSRecord } from "aws-lambda";
+import { Logger } from "@aws-lambda-powertools/logger";
+import type { Track } from "../lib/media/track-verdict.js";
+import type { StoragePort, TranscodePort, TranscribePort } from "../lib/media/media-ports.js";
+import type { MediaModerationProvider } from "../lib/media/moderation-provider.js";
+/**
+ * The minimal MediaFile row shape the worker reads. Re-declared (not imported
+ * from the Prisma client) so this module compiles in worktrees that have not
+ * regenerated the client, mirroring moderation-status.ts's discipline. The
+ * shell maps the real Prisma row to this shape at the persistence-port boundary.
+ */
+export interface MediaFileRow {
+    readonly id: string;
+    readonly tenantId: string;
+    readonly uploadId: string | null;
+}
+/**
+ * A copy of the operative moderation thresholds, snapshotted at job-submission
+ * time so historical decisions stay auditable after a threshold change. The
+ * shape mirrors Env.media.thresholds; the worker treats it as an opaque JSON
+ * blob and never reads individual values (no compiled threshold logic here).
+ */
+export type ThresholdSnapshot = Record<string, {
+    review: number;
+    quarantine: number;
+}>;
+/**
+ * The persistence operations the worker needs, narrowed to exactly what it
+ * uses. Implemented in production by a thin Prisma adapter; in tests by an
+ * in-memory fake. Keeping this narrow keeps the worker testable without the
+ * generated client and documents the worker's full DB surface in one place.
+ */
+export interface MediaPersistencePort {
+    /** Load the MediaFile row for an upload session, or null if none exists. */
+    findMediaByUploadId(uploadId: string): Promise<MediaFileRow | null>;
+    /** Persist a started per-track moderation job with its threshold snapshot. */
+    createModerationJob(input: {
+        mediaId: string;
+        track: Track;
+        jobId: string;
+        thresholdSnapshot: ThresholdSnapshot;
+    }): Promise<void>;
+    /**
+     * Persist the REAL content identity of the cleaned bytes onto the MediaFile
+     * row, replacing the upload-time `uploadId` placeholder contentHash with the
+     * SHA-256 of the transcoded output and recording the future serve key. The
+     * completion worker derives the promote target (`cas/{tenant}/{hash}`) from
+     * this persisted `contentHash`, so this write MUST happen before moderation
+     * fans in — otherwise the object can never promote.
+     */
+    persistCleanedContent(mediaId: string, content: {
+        contentHash: string;
+        originalKey: string;
+    }): Promise<void>;
+    /** Drive a media object's moderationStatus to REVIEW (poison path). */
+    markMediaForReview(mediaId: string): Promise<void>;
+}
+/**
+ * The slice of Env.media this worker consumes. Operational parameters arrive
+ * here as VALUES sourced from Env.media — never as literals in this file.
+ */
+export interface MediaProcessingConfig {
+    /** Hard duration cap (seconds). From Env.media.maxDurationSeconds. */
+    readonly maxDurationSeconds: number;
+    /** Current operative thresholds, snapshotted onto each started job. */
+    readonly thresholds: ThresholdSnapshot;
+}
+/**
+ * All capability seams the orchestration core binds to. The handler builds this
+ * from the injected concrete adapters; tests build it from the B0 Mocks + an
+ * in-memory persistence fake.
+ */
+export interface MediaProcessingDeps {
+    readonly storage: StoragePort;
+    readonly transcode: TranscodePort;
+    readonly transcribe: TranscribePort;
+    readonly moderation: MediaModerationProvider;
+    readonly persistence: MediaPersistencePort;
+    readonly config: MediaProcessingConfig;
+    /** The object-storage bucket handle moderation/transcription refs carry. */
+    readonly bucket: string;
+    /**
+     * Deterministic job-name factory for transcription/idempotency. Injected so
+     * the shell stays free of Date.now/Math.random in tests; production passes a
+     * uuid/time-based generator. `seed` is a stable per-call input (the cas key).
+     */
+    readonly newJobName: (seed: string) => string;
+    readonly logger: Pick<Logger, "info" | "warn" | "error">;
+}
+/**
+ * The disposition of one SQS record after orchestration.
+ *
+ * - `ack`  — remove from the queue (success, drop-non-pending, or poison routed
+ *            to REVIEW). A poison ack carries `poison: true` for observability.
+ * - `fail` — leave on the queue for SQS to retry (transient/retryable fault).
+ *            The handler maps this to a batchItemFailure.
+ */
+export type RecordOutcome = {
+    readonly disposition: "ack";
+    readonly reason: string;
+    readonly poison?: boolean;
+} | {
+    readonly disposition: "fail";
+    readonly reason: string;
+};
+/**
+ * Parse a triggering key as a `pending/{tenantId}/{uploadId}` key, validating
+ * the FORM by round-tripping the parsed parts back through `pendingKey()`. A
+ * key only parses if rebuilding it from its parts yields the identical string —
+ * so a path-traversal payload, extra segments, or a malformed id can never pass
+ * (cas-keys.ts owns the anchored allowlists).
+ *
+ * @returns the {tenantId, uploadId} when the key is a canonical pending key,
+ *          or null for ANY other key (which the caller ack-drops; we never
+ *          write outputs under pending/, so a non-pending key is not our work).
+ */
+export declare function parsePendingKey(key: string): {
+    tenantId: string;
+    uploadId: string;
+} | null;
+/** Every object key referenced by one SQS record's S3 event notification. */
+export declare function extractObjectKeys(recordBody: string): string[];
+/**
+ * Orchestrate processing for ONE already-extracted object key.
+ *
+ * Steps (every uncertainty fails closed; nothing here can yield APPROVED):
+ *  1. Reject any key that is not a canonical `pending/{tenant}/{upload}` key —
+ *     ack-drop it; outputs are NEVER written under pending/.
+ *  2. Load the MediaFile row by uploadId; re-derive tenant FROM THE ROW and
+ *     assert pendingKey(rowTenant, uploadId) === the triggering key. Mismatch
+ *     (or missing/uploadId-less row) is a hard reject → REVIEW + ack.
+ *  3. Probe duration; over-cap ⇒ poison ⇒ REVIEW + ack (no transcode).
+ *  4. Transcode-and-discard ⇒ cleaned bytes at the STAGING key (read back from
+ *     the cleaned key). The cleaned bytes are NOT written to cas/ here — cas/ is
+ *     the CDN-served prefix and must hold only APPROVED bytes (promotion happens
+ *     in the completion worker).
+ *  5. Hash the cleaned bytes ⇒ realHash; PERSIST {contentHash: realHash,
+ *     originalKey: casKey(tenant, realHash)} onto the row, replacing the
+ *     upload-time uploadId placeholder so the completion worker can derive the
+ *     promote target.
+ *  6. START moderation on the cleaned STAGING object (NOT the raw pending upload,
+ *     NOT a cas/ key) — moderation must run on EXACTLY the bytes that will be
+ *     served: provider.startVideoModeration ⇒ persist VISUAL job (+ threshold
+ *     snapshot); transcribe.startTranscription ⇒ persist AUDIO job (+ snapshot).
+ *     The worker only STARTS jobs + persists jobIds; it never fetches verdicts.
+ */
+export declare function processObjectKey(triggeringKey: string, deps: MediaProcessingDeps): Promise<RecordOutcome>;
+/**
+ * Process one SQS record (which may carry several S3 object keys). The record
+ * fails (SQS retry) iff ANY of its keys produced a retryable fault; otherwise
+ * it is acked. Per-key poison is acked, never failed.
+ */
+export declare function processRecord(record: SQSRecord, deps: MediaProcessingDeps): Promise<RecordOutcome>;
+/**
+ * Inject the concrete media-processing seams. The consuming app (Skybber) calls
+ * this once at Lambda cold start with its ffmpeg/MediaConvert TranscodePort, S3
+ * StoragePort, Transcribe TranscribePort, injected MediaModerationProvider, and
+ * a Prisma-backed MediaPersistencePort. Core ships NO concrete adapters.
+ */
+export declare function setMediaProcessingDeps(deps: MediaProcessingDeps): void;
+/** Test helper: clear injected deps between cases. */
+export declare function __resetMediaProcessingDeps(): void;
+/**
+ * The SQS entry point. Preserves `reportBatchItemFailures` semantics: only the
+ * messageIds whose records produced a retryable fault are returned as batch
+ * item failures; everything else (success / drop / poison→REVIEW) is acked by
+ * omission.
+ *
+ * If no concrete deps were injected, the handler fails CLOSED: it throws, so the
+ * whole batch is retried rather than silently dropped. An un-wired worker must
+ * never ack-drop real uploads.
+ */
 export declare const handler: SQSHandler;
 //# sourceMappingURL=media-processing-worker.d.ts.map

package/dist/lambda/media-processing-worker.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"media-processing-worker.d.ts","sourceRoot":"","sources":["../../src/lambda/media-processing-worker.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAQ7C,eAAO,MAAM,OAAO,EAAE,UA8DrB,CAAC"}
+{"version":3,"file":"media-processing-worker.d.ts","sourceRoot":"","sources":["../../src/lambda/media-processing-worker.ts"],"names":[],"mappings":"AAiCA,OAAO,KAAK,EAAE,UAAU,EAAE,SAAS,EAAoB,MAAM,YAAY,CAAC;AAC1E,OAAO,EAAE,MAAM,EAAE,MAAM,+BAA+B,CAAC;AAUvD,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,+BAA+B,CAAC;AAC3D,OAAO,KAAK,EACV,WAAW,EACX,aAAa,EACb,cAAc,EACf,MAAM,6BAA6B,CAAC;AACrC,OAAO,KAAK,EACV,uBAAuB,EAExB,MAAM,qCAAqC,CAAC;AAM7C;;;;;GAKG;AACH,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;CAClC;AAED;;;;;GAKG;AACH,MAAM,MAAM,iBAAiB,GAAG,MAAM,CACpC,MAAM,EACN;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CACvC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,WAAW,oBAAoB;IACnC,4EAA4E;IAC5E,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAAC;IACpE,8EAA8E;IAC9E,mBAAmB,CAAC,KAAK,EAAE;QACzB,OAAO,EAAE,MAAM,CAAC;QAChB,KAAK,EAAE,KAAK,CAAC;QACb,KAAK,EAAE,MAAM,CAAC;QACd,iBAAiB,EAAE,iBAAiB,CAAC;KACtC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClB;;;;;;;OAOG;IACH,qBAAqB,CACnB,OAAO,EAAE,MAAM,EACf,OAAO,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,GACpD,OAAO,CAAC,IAAI,CAAC,CAAC;IACjB,uEAAuE;IACvE,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACpD;AAED;;;GAGG;AACH,MAAM,WAAW,qBAAqB;IACpC,sEAAsE;IACtE,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC,uEAAuE;IACvE,QAAQ,CAAC,UAAU,EAAE,iBAAiB,CAAC;CACxC;AAED;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC;IAC9B,QAAQ,CAAC,SAAS,EAAE,aAAa,CAAC;IAClC,QAAQ,CAAC,UAAU,EAAE,cAAc,CAAC;IACpC,QAAQ,CAAC,UAAU,EAAE,uBAAuB,CAAC;IAC7C,QAAQ,CAAC,WAAW,EAAE,oBAAoB,CAAC;IAC3C,QAAQ,CAAC,MAAM,EAAE,qBAAqB,CAAC;IACvC,4EAA4E;IAC5E,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB;;;;OAIG;IACH,QAAQ,CAAC,UAAU,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,CAAC;IAC9C,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,CAAC;CAC1D;AAMD;;;;;;;GAOG;AACH,MAAM,MAAM,aAAa,GACrB;IAAE,QAAQ,CAAC,WAAW,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAA;CAAE,GACnF;IAAE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAM9D;;;;;;;;;;GAUG;AACH,wBAAgB,eAAe,CAC7B,GAAG,EAAE,MAAM,GACV;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAY/C;AAMD,6EAA6E;AAC7E,wBAAgB,iBAAiB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,EAAE,CAc9D;AA2BD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAsB,gBAAgB,CACpC,aAAa,EAAE,MAAM,EACrB,IAAI,EAAE,mBAAmB,GACxB,OAAO,CAAC,aAAa,CAAC,CAoHxB;AAoCD;;;;GAIG;AACH,wBAAsB,aAAa,CACjC,MAAM,EAAE,SAAS,EACjB,IAAI,EAAE,mBAAmB,GACxB,OAAO,CAAC,aAAa,CAAC,CAuBxB;AAQD;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,mBAAmB,GAAG,IAAI,CAEtE;AAED,sDAAsD;AACtD,wBAAgB,0BAA0B,IAAI,IAAI,CAEjD;AAID;;;;;;;;;GASG;AACH,eAAO,MAAM,OAAO,EAAE,UAiCrB,CAAC"}

package/dist/lambda/media-processing-worker.js

@@ -1,60 +1,354 @@
-import { S3Client, GetObjectCommand, PutObjectCommand } from "@aws-sdk/client-s3";
+// media-processing-worker.ts — the P0b media-processing orchestration SHELL.
+//
+// This is the imperative shell over the pure functional-core media units. It is
+// NOT itself a functional-core unit: it performs I/O (object storage, transcode,
+// transcription, moderation, DB writes). BUT all of that I/O arrives through
+// INJECTED capability seams (TranscodePort / StoragePort / TranscribePort /
+// MediaModerationProvider) and a Prisma-shaped persistence port, so the
+// orchestration logic is exercised in unit tests against the B0 in-memory Mocks
+// — no real cloud, no real encoder, no real DB.
+//
+// Per the seam discipline (see lib/media/media-ports.ts and
+// lib/media/moderation-provider.ts): CORE ships the interfaces + mocks; the
+// consuming app (Skybber) injects the concrete cloud adapters at startup via
+// `setMediaProcessingDeps()`. Until they are injected, the handler fails CLOSED
+// (throws → SQS retry), never silently approves or drops work.
+//
+// Fail-closed posture, end to end:
+//   - A key that is not a well-formed `pending/{tenant}/{upload}` key is dropped
+//     (ack) and NEVER written under — the re-trigger-loop guard.
+//   - The tenant is re-derived FROM THE ROW, and the triggering key must equal
+//     pendingKey(rowTenant, uploadId); a mismatch is a hard reject (poison →
+//     REVIEW + ack), so a forged/odd key cannot make us moderate the wrong cas/.
+//   - Over-cap duration is poison → REVIEW + ack (no transcode attempted).
+//   - The worker ONLY starts moderation jobs + persists their jobIds; it never
+//     fetches verdicts (a separate poller owns fan-in). Moderation runs on the
+//     cleaned bytes at the STAGING key, NOT the raw pending upload — and the
+//     cleaned bytes are NOT written to cas/ here. cas/ is the CDN-served prefix,
+//     so it must only ever hold APPROVED cleaned bytes; the completion worker
+//     promotes staging -> cas/ on approval ("cleaned-staging, promote-on-approval").
+//   - classifyWorkerError() splits permanent media/payload defects (poison →
+//     REVIEW + ack, no DLQ loop) from transient infra faults (retryable → throw
+//     → SQS retry → DLQ + alert backstop).
 import { Logger } from "@aws-lambda-powertools/logger";
+import { createHash } from "node:crypto";
+import { pendingKey, casKey, isCasKeyError, } from "../lib/media/cas-keys.js";
+import { exceedsDurationCap } from "../lib/media/duration-cap.js";
+import { classifyWorkerError } from "../lib/media/classify-worker-error.js";
+// ---------------------------------------------------------------------------
+// Key parsing — pending/{tenantId}/{uploadId}
+// ---------------------------------------------------------------------------
+/**
+ * Parse a triggering key as a `pending/{tenantId}/{uploadId}` key, validating
+ * the FORM by round-tripping the parsed parts back through `pendingKey()`. A
+ * key only parses if rebuilding it from its parts yields the identical string —
+ * so a path-traversal payload, extra segments, or a malformed id can never pass
+ * (cas-keys.ts owns the anchored allowlists).
+ *
+ * @returns the {tenantId, uploadId} when the key is a canonical pending key,
+ *          or null for ANY other key (which the caller ack-drops; we never
+ *          write outputs under pending/, so a non-pending key is not our work).
+ */
+export function parsePendingKey(key) {
+    const parts = key.split("/");
+    if (parts.length !== 3 || parts[0] !== "pending") {
+        return null;
+    }
+    const tenantId = parts[1];
+    const uploadId = parts[2];
+    const rebuilt = pendingKey(tenantId, uploadId);
+    if (isCasKeyError(rebuilt) || rebuilt !== key) {
+        return null;
+    }
+    return { tenantId, uploadId };
+}
+// ---------------------------------------------------------------------------
+// S3-event-over-SQS extraction
+// ---------------------------------------------------------------------------
+/** Every object key referenced by one SQS record's S3 event notification. */
+export function extractObjectKeys(recordBody) {
+    const parsed = JSON.parse(recordBody);
+    const s3Records = parsed.Records ?? [];
+    const keys = [];
+    for (const r of s3Records) {
+        const raw = r?.s3?.object?.key;
+        if (typeof raw === "string") {
+            // S3 URL-encodes keys and uses '+' for spaces in notifications.
+            keys.push(decodeURIComponent(raw.replace(/\+/g, " ")));
+        }
+    }
+    return keys;
+}
+// ---------------------------------------------------------------------------
+// Typed errors the orchestration core throws internally
+// ---------------------------------------------------------------------------
+/** A permanent payload defect: the key did not match the row's tenant/upload. */
+class KeyTenantMismatchError extends Error {
+    constructor() {
+        // The name is in classify-worker-error's poison fragment set ("validation").
+        super("media key/tenant validation mismatch: triggering key does not match the row");
+        this.name = "ValidationError";
+    }
+}
+/** A permanent payload defect: the probed duration exceeds the configured cap. */
+class DurationCapExceededError extends Error {
+    constructor() {
+        super("media duration cap exceeded");
+        this.name = "DurationCapExceeded";
+    }
+}
+// ---------------------------------------------------------------------------
+// Orchestration core — testable against the B0 Mocks
+// ---------------------------------------------------------------------------
+/**
+ * Orchestrate processing for ONE already-extracted object key.
+ *
+ * Steps (every uncertainty fails closed; nothing here can yield APPROVED):
+ *  1. Reject any key that is not a canonical `pending/{tenant}/{upload}` key —
+ *     ack-drop it; outputs are NEVER written under pending/.
+ *  2. Load the MediaFile row by uploadId; re-derive tenant FROM THE ROW and
+ *     assert pendingKey(rowTenant, uploadId) === the triggering key. Mismatch
+ *     (or missing/uploadId-less row) is a hard reject → REVIEW + ack.
+ *  3. Probe duration; over-cap ⇒ poison ⇒ REVIEW + ack (no transcode).
+ *  4. Transcode-and-discard ⇒ cleaned bytes at the STAGING key (read back from
+ *     the cleaned key). The cleaned bytes are NOT written to cas/ here — cas/ is
+ *     the CDN-served prefix and must hold only APPROVED bytes (promotion happens
+ *     in the completion worker).
+ *  5. Hash the cleaned bytes ⇒ realHash; PERSIST {contentHash: realHash,
+ *     originalKey: casKey(tenant, realHash)} onto the row, replacing the
+ *     upload-time uploadId placeholder so the completion worker can derive the
+ *     promote target.
+ *  6. START moderation on the cleaned STAGING object (NOT the raw pending upload,
+ *     NOT a cas/ key) — moderation must run on EXACTLY the bytes that will be
+ *     served: provider.startVideoModeration ⇒ persist VISUAL job (+ threshold
+ *     snapshot); transcribe.startTranscription ⇒ persist AUDIO job (+ snapshot).
+ *     The worker only STARTS jobs + persists jobIds; it never fetches verdicts.
+ */
+export async function processObjectKey(triggeringKey, deps) {
+    try {
+        // --- 1. Pending-key form gate (re-trigger-loop guard). ---
+        const parsed = parsePendingKey(triggeringKey);
+        if (parsed === null) {
+            deps.logger.info("Dropping non-pending key (not our work)", {
+                key: triggeringKey,
+            });
+            return { disposition: "ack", reason: "non-pending-key" };
+        }
+        const { uploadId } = parsed;
+        // --- 2. Load row; re-derive tenant FROM THE ROW; assert key match. ---
+        const row = await deps.persistence.findMediaByUploadId(uploadId);
+        if (row === null || row.uploadId === null) {
+            // No row, or a row that lost its upload session — cannot certify this
+            // object. Permanent w.r.t. these bytes: fail closed to human review.
+            throw new KeyTenantMismatchError();
+        }
+        const rowTenant = row.tenantId;
+        const expectedKey = pendingKey(rowTenant, uploadId);
+        if (isCasKeyError(expectedKey) || expectedKey !== triggeringKey) {
+            // The triggering key's tenant segment disagrees with the owning tenant,
+            // OR the row's tenant is itself malformed. Either way: hard reject.
+            throw new KeyTenantMismatchError();
+        }
+        // --- 3. Duration cap (probe BEFORE transcoding — cost + abuse guard). ---
+        const probed = await deps.transcode.probeDurationSeconds(triggeringKey);
+        if (exceedsDurationCap(probed, deps.config.maxDurationSeconds)) {
+            throw new DurationCapExceededError();
+        }
+        // --- 4. Transcode-and-discard ⇒ cleaned bytes. ---
+        // The cleaned output is written to a transient staging key OUTSIDE pending/
+        // (so re-uploading the cleaned bytes can never re-trigger this worker).
+        const cleanedStagingKey = `processing/${rowTenant}/${uploadId}`;
+        const posterStagingKey = `processing/${rowTenant}/${uploadId}.poster`;
+        const transcodeResult = await deps.transcode.transcodeVideo({
+            inputPath: triggeringKey,
+            outputPath: cleanedStagingKey,
+            posterPath: posterStagingKey,
+            maxDurationSeconds: deps.config.maxDurationSeconds,
+        });
+        const cleanedStagingKeyOut = transcodeResult.cleanedPath;
+        const cleanedBytes = await deps.storage.getObject(cleanedStagingKeyOut);
+        // --- 5. Hash the CLEANED bytes ⇒ real content identity; persist it. ---
+        // We do NOT write the cleaned bytes to cas/ here: they already live at the
+        // STAGING key, and cas/ (the CDN-served prefix) must only ever hold APPROVED
+        // bytes. We persist the real hash + future serve key so the completion
+        // worker can promote staging -> cas/ on approval.
+        const contentHash = createHash("sha256").update(cleanedBytes).digest("hex");
+        const cleanedCasKey = casKey(rowTenant, contentHash);
+        if (isCasKeyError(cleanedCasKey)) {
+            // The hash/tenant failed the CAS allowlist — a permanent defect in our own
+            // derivation inputs (e.g. a malformed tenant that slipped the row check).
+            // Fail closed: route to review rather than serve un-addressable bytes.
+            throw new KeyTenantMismatchError();
+        }
+        // Replace the upload-time uploadId placeholder contentHash with the REAL
+        // hash and record the future serve key (cas/{tenant}/{hash}).
+        await deps.persistence.persistCleanedContent(row.id, {
+            contentHash,
+            originalKey: cleanedCasKey,
+        });
+        // --- 6. START moderation on the CLEANED STAGING object (the exact bytes ---
+        // that will be served), NOT the raw pending upload and NOT a cas/ key.
+        const stagingRef = { bucket: deps.bucket, key: cleanedStagingKeyOut };
+        const visual = await deps.moderation.startVideoModeration(stagingRef);
+        await deps.persistence.createModerationJob({
+            mediaId: row.id,
+            track: "VISUAL",
+            jobId: visual.jobId,
+            // Snapshot the CURRENT operative thresholds onto the job at submission.
+            thresholdSnapshot: deps.config.thresholds,
+        });
+        const audio = await deps.transcribe.startTranscription({
+            key: cleanedStagingKeyOut,
+            jobName: deps.newJobName(cleanedStagingKeyOut),
+        });
+        await deps.persistence.createModerationJob({
+            mediaId: row.id,
+            track: "AUDIO",
+            jobId: audio.jobId,
+            thresholdSnapshot: deps.config.thresholds,
+        });
+        deps.logger.info("Started per-track moderation jobs", {
+            mediaId: row.id,
+            stagingKey: cleanedStagingKeyOut,
+            casKey: cleanedCasKey,
+            visualJobId: visual.jobId,
+            audioJobId: audio.jobId,
+        });
+        return { disposition: "ack", reason: "started-moderation" };
+    }
+    catch (err) {
+        // Single classification point: poison ⇒ REVIEW + ack; retryable ⇒ fail.
+        const klass = classifyWorkerError(err);
+        if (klass === "poison") {
+            // Best-effort route to REVIEW. If we can identify the row, mark it; if we
+            // cannot (e.g. the failure was the row lookup itself), there is nothing to
+            // mark and the ack simply drops a message that would loop forever.
+            const reviewReason = await routePoisonToReview(triggeringKey, deps, err);
+            return { disposition: "ack", reason: reviewReason, poison: true };
+        }
+        deps.logger.error("Retryable media-processing fault — letting SQS retry", {
+            key: triggeringKey,
+            error: err,
+        });
+        return { disposition: "fail", reason: "retryable" };
+    }
+}
+/**
+ * Best-effort: drive the owning MediaFile to REVIEW for a poison failure. Never
+ * throws — a failure to mark must not convert a poison ack into an infinite
+ * retry. Returns an observability reason string.
+ */
+async function routePoisonToReview(triggeringKey, deps, cause) {
+    deps.logger.warn("Poison media — routing to REVIEW + ack", {
+        key: triggeringKey,
+        error: cause,
+    });
+    const parsed = parsePendingKey(triggeringKey);
+    if (parsed === null) {
+        return "poison-no-row";
+    }
+    try {
+        const row = await deps.persistence.findMediaByUploadId(parsed.uploadId);
+        if (row === null) {
+            return "poison-no-row";
+        }
+        await deps.persistence.markMediaForReview(row.id);
+        return "poison-review";
+    }
+    catch (markErr) {
+        deps.logger.error("Failed to mark poison media for REVIEW (acking anyway)", {
+            key: triggeringKey,
+            error: markErr,
+        });
+        return "poison-mark-failed";
+    }
+}
+/**
+ * Process one SQS record (which may carry several S3 object keys). The record
+ * fails (SQS retry) iff ANY of its keys produced a retryable fault; otherwise
+ * it is acked. Per-key poison is acked, never failed.
+ */
+export async function processRecord(record, deps) {
+    let keys;
+    try {
+        keys = extractObjectKeys(record.body);
+    }
+    catch (err) {
+        // A body we cannot even parse is a permanent payload defect (poison): a
+        // retry re-parses the same bytes to the same failure. Ack to avoid a loop.
+        deps.logger.warn("Unparseable SQS record body — acking as poison", {
+            messageId: record.messageId,
+            error: err,
+        });
+        return { disposition: "ack", reason: "unparseable-body", poison: true };
+    }
+    for (const key of keys) {
+        const outcome = await processObjectKey(key, deps);
+        if (outcome.disposition === "fail") {
+            // First retryable key fails the whole record; SQS redelivers it. Already-
+            // started keys are idempotent on the dedupe path (deriveDedupeKey).
+            return outcome;
+        }
+    }
+    return { disposition: "ack", reason: "record-complete" };
+}
+// ---------------------------------------------------------------------------
+// Deps injection seam (consuming app wires concrete adapters at startup)
+// ---------------------------------------------------------------------------
+let injectedDeps;
+/**
+ * Inject the concrete media-processing seams. The consuming app (Skybber) calls
+ * this once at Lambda cold start with its ffmpeg/MediaConvert TranscodePort, S3
+ * StoragePort, Transcribe TranscribePort, injected MediaModerationProvider, and
+ * a Prisma-backed MediaPersistencePort. Core ships NO concrete adapters.
+ */
+export function setMediaProcessingDeps(deps) {
+    injectedDeps = deps;
+}
+/** Test helper: clear injected deps between cases. */
+export function __resetMediaProcessingDeps() {
+    injectedDeps = undefined;
+}
 const logger = new Logger({ serviceName: "media-processing-worker" });
-const s3 = new S3Client({ region: process.env.AWS_REGION });
+/**
+ * The SQS entry point. Preserves `reportBatchItemFailures` semantics: only the
+ * messageIds whose records produced a retryable fault are returned as batch
+ * item failures; everything else (success / drop / poison→REVIEW) is acked by
+ * omission.
+ *
+ * If no concrete deps were injected, the handler fails CLOSED: it throws, so the
+ * whole batch is retried rather than silently dropped. An un-wired worker must
+ * never ack-drop real uploads.
+ */
 export const handler = async (event) => {
-    const failedIds = [];
+    if (injectedDeps === undefined) {
+        // Fail closed: no backend wired ⇒ retry the batch, never drop. The
+        // consuming app must call setMediaProcessingDeps() at startup.
+        logger.error("media-processing-worker invoked with no injected deps — refusing to" +
+            " process. Call setMediaProcessingDeps() at cold start.");
+        throw new Error("media-processing-worker: deps not injected");
+    }
+    const deps = injectedDeps;
+    const batchItemFailures = [];
     for (const record of event.Records) {
+        let outcome;
         try {
-            // S3 event notification comes via SQS
-            const s3Event = JSON.parse(record.body);
-            const s3Records = s3Event.Records || [];
-            for (const s3Record of s3Records) {
-                const bucket = s3Record.s3.bucket.name;
-                const key = decodeURIComponent(s3Record.s3.object.key.replace(/\+/g, " "));
-                if (!key.startsWith("originals/"))
-                    continue;
-                // Get original
-                const original = await s3.send(new GetObjectCommand({ Bucket: bucket, Key: key }));
-                const chunks = [];
-                for await (const chunk of original.Body) {
-                    chunks.push(chunk);
-                }
-                const buffer = Buffer.concat(chunks);
-                // Process with Sharp (must be installed as ARM64 binary)
-                // dynamic import to avoid bundling issues
-                const sharp = (await import("sharp")).default;
-                const hash = key.split("/").pop().replace(/\.[^.]+$/, "");
-                // Thumbnail: 300px WebP
-                const thumbnail = await sharp(buffer)
-                    .resize(300, 300, { fit: "cover" })
-                    .webp({ quality: 80 })
-                    .toBuffer();
-                // Optimized: 1200px WebP
-                const optimized = await sharp(buffer)
-                    .resize(1200, 1200, { fit: "inside", withoutEnlargement: true })
-                    .webp({ quality: 85 })
-                    .toBuffer();
-                await Promise.all([
-                    s3.send(new PutObjectCommand({
-                        Bucket: bucket, Key: `thumbnails/${hash}.webp`,
-                        Body: thumbnail, ContentType: "image/webp",
-                    })),
-                    s3.send(new PutObjectCommand({
-                        Bucket: bucket, Key: `optimized/${hash}.webp`,
-                        Body: optimized, ContentType: "image/webp",
-                    })),
-                ]);
-                logger.info("Media processed", { key, hash });
-            }
+            outcome = await processRecord(record, deps);
         }
         catch (err) {
-            logger.error("Media processing failed", { error: err, messageId: record.messageId });
-            failedIds.push(record.messageId);
+            // Defensive: processRecord is designed not to throw, but if it does, treat
+            // it as retryable (fail closed for retry; DLQ + alert is the backstop).
+            logger.error("Unexpected throw from processRecord — retrying record", {
+                messageId: record.messageId,
+                error: err,
+            });
+            batchItemFailures.push({ itemIdentifier: record.messageId });
+            continue;
+        }
+        if (outcome.disposition === "fail") {
+            batchItemFailures.push({ itemIdentifier: record.messageId });
         }
     }
-    if (failedIds.length > 0) {
-        return { batchItemFailures: failedIds.map((id) => ({ itemIdentifier: id })) };
-    }
+    return { batchItemFailures };
 };
 //# sourceMappingURL=media-processing-worker.js.map

package/dist/lambda/media-processing-worker.js.map

@@ -1 +1 @@
-{"version":3,"file":"media-processing-worker.js","sourceRoot":"","sources":["../../src/lambda/media-processing-worker.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAClF,OAAO,EAAE,MAAM,EAAE,MAAM,+BAA+B,CAAC;AAEvD,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,EAAE,WAAW,EAAE,yBAAyB,EAAE,CAAC,CAAC;AAEtE,MAAM,EAAE,GAAG,IAAI,QAAQ,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC;AAE5D,MAAM,CAAC,MAAM,OAAO,GAAe,KAAK,EAAE,KAAK,EAAE,EAAE;IACjD,MAAM,SAAS,GAAa,EAAE,CAAC;IAE/B,KAAK,MAAM,MAAM,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QACnC,IAAI,CAAC;YACH,sCAAsC;YACtC,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YACxC,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC;YAExC,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;gBACjC,MAAM,MAAM,GAAG,QAAQ,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC;gBACvC,MAAM,GAAG,GAAG,kBAAkB,CAAC,QAAQ,CAAC,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;gBAE3E,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,YAAY,CAAC;oBAAE,SAAS;gBAE5C,eAAe;gBACf,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,IAAI,gBAAgB,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;gBACnF,MAAM,MAAM,GAAiB,EAAE,CAAC;gBAChC,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,QAAQ,CAAC,IAAiC,EAAE,CAAC;oBACrE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBACrB,CAAC;gBACD,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;gBAErC,yDAAyD;gBACzD,0CAA0C;gBAC1C,MAAM,KAAK,GAAG,CAAC,MAAM,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC;gBAC9C,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAG,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;gBAE3D,wBAAwB;gBACxB,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC;qBAClC,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;qBAClC,IAAI,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;qBACrB,QAAQ,EAAE,CAAC;gBAEd,yBAAyB;gBACzB,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC;qBAClC,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,QAAQ,EAAE,kBAAkB,EAAE,IAAI,EAAE,CAAC;qBAC/D,IAAI,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;qBACrB,QAAQ,EAAE,CAAC;gBAEd,MAAM,OAAO,CAAC,GAAG,CAAC;oBAChB,EAAE,CAAC,IAAI,CAAC,IAAI,gBAAgB,CAAC;wBAC3B,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,cAAc,IAAI,OAAO;wBAC9C,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,YAAY;qBAC3C,CAAC,CAAC;oBACH,EAAE,CAAC,IAAI,CAAC,IAAI,gBAAgB,CAAC;wBAC3B,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,aAAa,IAAI,OAAO;wBAC7C,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,YAAY;qBAC3C,CAAC,CAAC;iBACJ,CAAC,CAAC;gBAEH,MAAM,CAAC,IAAI,CAAC,iBAAiB,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC;YAChD,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,KAAK,CAAC,yBAAyB,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC;YACrF,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACnC,CAAC;IACH,CAAC;IAED,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzB,OAAO,EAAE,iBAAiB,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,cAAc,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC;IAChF,CAAC;AACH,CAAC,CAAC"}
+{"version":3,"file":"media-processing-worker.js","sourceRoot":"","sources":["../../src/lambda/media-processing-worker.ts"],"names":[],"mappings":"AAAA,6EAA6E;AAC7E,EAAE;AACF,gFAAgF;AAChF,iFAAiF;AACjF,6EAA6E;AAC7E,4EAA4E;AAC5E,wEAAwE;AACxE,gFAAgF;AAChF,gDAAgD;AAChD,EAAE;AACF,4DAA4D;AAC5D,4EAA4E;AAC5E,6EAA6E;AAC7E,gFAAgF;AAChF,+DAA+D;AAC/D,EAAE;AACF,mCAAmC;AACnC,iFAAiF;AACjF,iEAAiE;AACjE,+EAA+E;AAC/E,6EAA6E;AAC7E,iFAAiF;AACjF,2EAA2E;AAC3E,+EAA+E;AAC/E,+EAA+E;AAC/E,6EAA6E;AAC7E,iFAAiF;AACjF,8EAA8E;AAC9E,qFAAqF;AACrF,6EAA6E;AAC7E,gFAAgF;AAChF,2CAA2C;AAG3C,OAAO,EAAE,MAAM,EAAE,MAAM,+BAA+B,CAAC;AACvD,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EACL,UAAU,EACV,MAAM,EACN,aAAa,GACd,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAC;AAClE,OAAO,EAAE,mBAAmB,EAAE,MAAM,uCAAuC,CAAC;AAyH5E,8EAA8E;AAC9E,8CAA8C;AAC9C,8EAA8E;AAE9E;;;;;;;;;;GAUG;AACH,MAAM,UAAU,eAAe,CAC7B,GAAW;IAEX,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,SAAS,EAAE,CAAC;QACjD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IAC1B,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IAC1B,MAAM,OAAO,GAAG,UAAU,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAC/C,IAAI,aAAa,CAAC,OAAO,CAAC,IAAI,OAAO,KAAK,GAAG,EAAE,CAAC;QAC9C,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;AAChC,CAAC;AAED,8EAA8E;AAC9E,+BAA+B;AAC/B,8EAA8E;AAE9E,6EAA6E;AAC7E,MAAM,UAAU,iBAAiB,CAAC,UAAkB;IAClD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAEnC,CAAC;IACF,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC;IACvC,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,KAAK,MAAM,CAAC,IAAI,SAAS,EAAE,CAAC;QAC1B,MAAM,GAAG,GAAG,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC;QAC/B,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;YAC5B,gEAAgE;YAChE,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;QACzD,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,8EAA8E;AAC9E,wDAAwD;AACxD,8EAA8E;AAE9E,iFAAiF;AACjF,MAAM,sBAAuB,SAAQ,KAAK;IACxC;QACE,6EAA6E;QAC7E,KAAK,CAAC,6EAA6E,CAAC,CAAC;QACrF,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;IAChC,CAAC;CACF;AAED,kFAAkF;AAClF,MAAM,wBAAyB,SAAQ,KAAK;IAC1C;QACE,KAAK,CAAC,6BAA6B,CAAC,CAAC;QACrC,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF;AAED,8EAA8E;AAC9E,qDAAqD;AACrD,8EAA8E;AAE9E;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,aAAqB,EACrB,IAAyB;IAEzB,IAAI,CAAC;QACH,4DAA4D;QAC5D,MAAM,MAAM,GAAG,eAAe,CAAC,aAAa,CAAC,CAAC;QAC9C,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACpB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,yCAAyC,EAAE;gBAC1D,GAAG,EAAE,aAAa;aACnB,CAAC,CAAC;YACH,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;QAC3D,CAAC;QACD,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,CAAC;QAE5B,wEAAwE;QACxE,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,mBAAmB,CAAC,QAAQ,CAAC,CAAC;QACjE,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;YAC1C,sEAAsE;YACtE,qEAAqE;YACrE,MAAM,IAAI,sBAAsB,EAAE,CAAC;QACrC,CAAC;QACD,MAAM,SAAS,GAAG,GAAG,CAAC,QAAQ,CAAC;QAC/B,MAAM,WAAW,GAAG,UAAU,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;QACpD,IAAI,aAAa,CAAC,WAAW,CAAC,IAAI,WAAW,KAAK,aAAa,EAAE,CAAC;YAChE,wEAAwE;YACxE,oEAAoE;YACpE,MAAM,IAAI,sBAAsB,EAAE,CAAC;QACrC,CAAC;QAED,2EAA2E;QAC3E,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,oBAAoB,CAAC,aAAa,CAAC,CAAC;QACxE,IAAI,kBAAkB,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,kBAAkB,CAAC,EAAE,CAAC;YAC/D,MAAM,IAAI,wBAAwB,EAAE,CAAC;QACvC,CAAC;QAED,oDAAoD;QACpD,4EAA4E;QAC5E,wEAAwE;QACxE,MAAM,iBAAiB,GAAG,cAAc,SAAS,IAAI,QAAQ,EAAE,CAAC;QAChE,MAAM,gBAAgB,GAAG,cAAc,SAAS,IAAI,QAAQ,SAAS,CAAC;QACtE,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC;YAC1D,SAAS,EAAE,aAAa;YACxB,UAAU,EAAE,iBAAiB;YAC7B,UAAU,EAAE,gBAAgB;YAC5B,kBAAkB,EAAE,IAAI,CAAC,MAAM,CAAC,kBAAkB;SACnD,CAAC,CAAC;QACH,MAAM,oBAAoB,GAAG,eAAe,CAAC,WAAW,CAAC;QACzD,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,oBAAoB,CAAC,CAAC;QAExE,yEAAyE;QACzE,2EAA2E;QAC3E,6EAA6E;QAC7E,uEAAuE;QACvE,kDAAkD;QAClD,MAAM,WAAW,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC5E,MAAM,aAAa,GAAG,MAAM,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;QACrD,IAAI,aAAa,CAAC,aAAa,CAAC,EAAE,CAAC;YACjC,2EAA2E;YAC3E,0EAA0E;YAC1E,uEAAuE;YACvE,MAAM,IAAI,sBAAsB,EAAE,CAAC;QACrC,CAAC;QACD,yEAAyE;QACzE,8DAA8D;QAC9D,MAAM,IAAI,CAAC,WAAW,CAAC,qBAAqB,CAAC,GAAG,CAAC,EAAE,EAAE;YACnD,WAAW;YACX,WAAW,EAAE,aAAa;SAC3B,CAAC,CAAC;QAEH,6EAA6E;QAC7E,uEAAuE;QACvE,MAAM,UAAU,GAAU,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,oBAAoB,EAAE,CAAC;QAE7E,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,oBAAoB,CAAC,UAAU,CAAC,CAAC;QACtE,MAAM,IAAI,CAAC,WAAW,CAAC,mBAAmB,CAAC;YACzC,OAAO,EAAE,GAAG,CAAC,EAAE;YACf,KAAK,EAAE,QAAQ;YACf,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,wEAAwE;YACxE,iBAAiB,EAAE,IAAI,CAAC,MAAM,CAAC,UAAU;SAC1C,CAAC,CAAC;QAEH,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,kBAAkB,CAAC;YACrD,GAAG,EAAE,oBAAoB;YACzB,OAAO,EAAE,IAAI,CAAC,UAAU,CAAC,oBAAoB,CAAC;SAC/C,CAAC,CAAC;QACH,MAAM,IAAI,CAAC,WAAW,CAAC,mBAAmB,CAAC;YACzC,OAAO,EAAE,GAAG,CAAC,EAAE;YACf,KAAK,EAAE,OAAO;YACd,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,iBAAiB,EAAE,IAAI,CAAC,MAAM,CAAC,UAAU;SAC1C,CAAC,CAAC;QAEH,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,mCAAmC,EAAE;YACpD,OAAO,EAAE,GAAG,CAAC,EAAE;YACf,UAAU,EAAE,oBAAoB;YAChC,MAAM,EAAE,aAAa;YACrB,WAAW,EAAE,MAAM,CAAC,KAAK;YACzB,UAAU,EAAE,KAAK,CAAC,KAAK;SACxB,CAAC,CAAC;QAEH,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;IAC9D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,wEAAwE;QACxE,MAAM,KAAK,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC;QACvC,IAAI,KAAK,KAAK,QAAQ,EAAE,CAAC;YACvB,0EAA0E;YAC1E,2EAA2E;YAC3E,mEAAmE;YACnE,MAAM,YAAY,GAAG,MAAM,mBAAmB,CAAC,aAAa,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;YACzE,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;QACpE,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,sDAAsD,EAAE;YACxE,GAAG,EAAE,aAAa;YAClB,KAAK,EAAE,GAAG;SACX,CAAC,CAAC;QACH,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IACtD,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,mBAAmB,CAChC,aAAqB,EACrB,IAAyB,EACzB,KAAc;IAEd,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,wCAAwC,EAAE;QACzD,GAAG,EAAE,aAAa;QAClB,KAAK,EAAE,KAAK;KACb,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,eAAe,CAAC,aAAa,CAAC,CAAC;IAC9C,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACpB,OAAO,eAAe,CAAC;IACzB,CAAC;IACD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,mBAAmB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACxE,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;YACjB,OAAO,eAAe,CAAC;QACzB,CAAC;QACD,MAAM,IAAI,CAAC,WAAW,CAAC,kBAAkB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAClD,OAAO,eAAe,CAAC;IACzB,CAAC;IAAC,OAAO,OAAO,EAAE,CAAC;QACjB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,wDAAwD,EAAE;YAC1E,GAAG,EAAE,aAAa;YAClB,KAAK,EAAE,OAAO;SACf,CAAC,CAAC;QACH,OAAO,oBAAoB,CAAC;IAC9B,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,MAAiB,EACjB,IAAyB;IAEzB,IAAI,IAAc,CAAC;IACnB,IAAI,CAAC;QACH,IAAI,GAAG,iBAAiB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACxC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,wEAAwE;QACxE,2EAA2E;QAC3E,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,gDAAgD,EAAE;YACjE,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,KAAK,EAAE,GAAG;SACX,CAAC,CAAC;QACH,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,kBAAkB,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IAC1E,CAAC;IAED,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAClD,IAAI,OAAO,CAAC,WAAW,KAAK,MAAM,EAAE,CAAC;YACnC,0EAA0E;YAC1E,oEAAoE;YACpE,OAAO,OAAO,CAAC;QACjB,CAAC;IACH,CAAC;IACD,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;AAC3D,CAAC;AAED,8EAA8E;AAC9E,yEAAyE;AACzE,8EAA8E;AAE9E,IAAI,YAA6C,CAAC;AAElD;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CAAC,IAAyB;IAC9D,YAAY,GAAG,IAAI,CAAC;AACtB,CAAC;AAED,sDAAsD;AACtD,MAAM,UAAU,0BAA0B;IACxC,YAAY,GAAG,SAAS,CAAC;AAC3B,CAAC;AAED,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,EAAE,WAAW,EAAE,yBAAyB,EAAE,CAAC,CAAC;AAEtE;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,OAAO,GAAe,KAAK,EAAE,KAAK,EAA6B,EAAE;IAC5E,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;QAC/B,mEAAmE;QACnE,+DAA+D;QAC/D,MAAM,CAAC,KAAK,CACV,qEAAqE;YACnE,wDAAwD,CAC3D,CAAC;QACF,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAChE,CAAC;IACD,MAAM,IAAI,GAAG,YAAY,CAAC;IAE1B,MAAM,iBAAiB,GAAiC,EAAE,CAAC;IAC3D,KAAK,MAAM,MAAM,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QACnC,IAAI,OAAsB,CAAC;QAC3B,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,aAAa,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAC9C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,2EAA2E;YAC3E,wEAAwE;YACxE,MAAM,CAAC,KAAK,CAAC,uDAAuD,EAAE;gBACpE,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,KAAK,EAAE,GAAG;aACX,CAAC,CAAC;YACH,iBAAiB,CAAC,IAAI,CAAC,EAAE,cAAc,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC;YAC7D,SAAS;QACX,CAAC;QACD,IAAI,OAAO,CAAC,WAAW,KAAK,MAAM,EAAE,CAAC;YACnC,iBAAiB,CAAC,IAAI,CAAC,EAAE,cAAc,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC;QAC/D,CAAC;IACH,CAAC;IAED,OAAO,EAAE,iBAAiB,EAAE,CAAC;AAC/B,CAAC,CAAC"}

package/dist/lib/app.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"app.d.ts","sourceRoot":"","sources":["../../src/lib/app.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,EAAE,IAAI,EAAgB,KAAK,iBAAiB,EAAE,MAAM,MAAM,CAAC;AAMlE,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAErC,OAAO,EAAE,cAAc,EAAE,KAAK,UAAU,EAA0B,MAAM,iBAAiB,CAAC;AAC1F,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAwElE;;;;GAIG;AACH,MAAM,WAAW,YAAY;IAC3B,UAAU,EAAE,GAAG,CAAC;IAChB,cAAc,CAAC,EAAE,qBAAqB,CAAC;CACxC;AAED,KAAK,MAAM,GAAG;IAAE,QAAQ,EAAE,YAAY,CAAA;CAAE,CAAC;AA+BzC;;;;;;GAMG;AACH,iBAAS,gBAAgB,CAAC,EAAE,EAAE,UAAU,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAcnE;AAkBD;;;;;;;;;;GAUG;AACH,wBAAgB,eAAe,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CA6BzD;AAqDD,6EAA6E;AAC7E,OAAO,EAAE,gBAAgB,EAAE,CAAC;AAC5B,OAAO,EAAE,cAAc,EAAE,CAAC;AAgH1B;;;;GAIG;AACH,eAAO,MAAM,iBAAiB,EAAE,aAAa,CAAC,MAAM,CAEnD,CAAC;AAiCF;;;;GAIG;AACH,wBAAgB,YAAY,IAAI,IAAI,CAAC,MAAM,CAAC,CA+E3C"}
+{"version":3,"file":"app.d.ts","sourceRoot":"","sources":["../../src/lib/app.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,EAAE,IAAI,EAAgB,KAAK,iBAAiB,EAAE,MAAM,MAAM,CAAC;AAMlE,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAErC,OAAO,EAAE,cAAc,EAAE,KAAK,UAAU,EAA0B,MAAM,iBAAiB,CAAC;AAC1F,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAyElE;;;;GAIG;AACH,MAAM,WAAW,YAAY;IAC3B,UAAU,EAAE,GAAG,CAAC;IAChB,cAAc,CAAC,EAAE,qBAAqB,CAAC;CACxC;AAED,KAAK,MAAM,GAAG;IAAE,QAAQ,EAAE,YAAY,CAAA;CAAE,CAAC;AA+BzC;;;;;;GAMG;AACH,iBAAS,gBAAgB,CAAC,EAAE,EAAE,UAAU,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAcnE;AAkBD;;;;;;;;;;GAUG;AACH,wBAAgB,eAAe,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CA6BzD;AAqDD,6EAA6E;AAC7E,OAAO,EAAE,gBAAgB,EAAE,CAAC;AAC5B,OAAO,EAAE,cAAc,EAAE,CAAC;AAoH1B;;;;GAIG;AACH,eAAO,MAAM,iBAAiB,EAAE,aAAa,CAAC,MAAM,CAEnD,CAAC;AAiCF;;;;GAIG;AACH,wBAAgB,YAAY,IAAI,IAAI,CAAC,MAAM,CAAC,CA+E3C"}

package/dist/lib/app.js

@@ -81,6 +81,7 @@ import { privacyRoutes } from "./routes/privacy.js";
 import { productTaxonomyRoutes } from "./routes/products.js";
 import { relationshipRoutes } from "./routes/relationships.js";
 import { sentimentsRoutes } from "./routes/sentiments.js";
+import { settingsRoutes } from "./routes/settings.js";
 import { setupStatusRoutes } from "./routes/setup-status.js";
 import { taxonomyRoutes } from "./routes/taxonomy.js";
 import { taxonomyAnalyticsRoutes } from "./routes/taxonomy-analytics.js";
@@ -319,6 +320,10 @@ const PORTED_ROUTE_SETS = [
     postsRoutes,
     productTaxonomyRoutes,
     sentimentsRoutes,
+    // settings.ts: CHANGES_PATTERN is exact (/api/settings/changes) and listed
+    // first in the set so it wins over the NAMESPACE_PATTERN ([^/]+) capture in
+    // registration order — "changes" is never matched as a :namespace.
+    settingsRoutes,
     setupStatusRoutes,
     tenantRoutes,
     tenantAuditRoutes,