@de-otio/trellis 0.11.0 → 0.12.1

package/dist/lib/services/media-upload-service.js

@@ -8,6 +8,7 @@
  * 4. Reconciliation worker creates database record asynchronously
  */
 import { getLogger } from "../logger.js";
+import { casKey, isCasKeyError } from "../media/cas-keys.js";
 /**
  * Generate unique batch ID
  */
@@ -23,22 +24,20 @@ async function generateContentHash(file) {
     return hashArray.map((b) => b.toString(16).padStart(2, "0")).join("");
 }
 /**
- * Get file extension from MIME type
+ * Build the canonical CAS original key for a tenant-scoped object (T9 / D18).
+ *
+ * Delegates to the pure `casKey` builder (anchored allowlist validation). A
+ * validation failure here means the caller passed a malformed tenantId or hash
+ * — both are produced internally (tenantId resolved from auth context, hash
+ * from `crypto.subtle.digest`), so a failure is a programming error and is
+ * thrown rather than silently producing an unsafe key.
  */
-function getExtensionFromMimeType(mimeType) {
-    const mimeMap = {
-        "image/jpeg": "jpg",
-        "image/jpg": "jpg",
-        "image/png": "png",
-        "image/gif": "gif",
-        "image/webp": "webp",
-        "image/heic": "heic",
-        "image/heif": "heif",
-        "video/mp4": "mp4",
-        "video/webm": "webm",
-        "video/quicktime": "mov",
-    };
-    return mimeMap[mimeType] || "bin";
+function buildCasOriginalKey(tenantId, contentHash) {
+    const key = casKey(tenantId, contentHash);
+    if (isCasKeyError(key)) {
+        throw new Error(`Invalid CAS key inputs: ${key.kind}`);
+    }
+    return key;
 }
 export class MediaUploadService {
     r2Bucket;
@@ -57,7 +56,7 @@ export class MediaUploadService {
     /**
      * Upload single file
      */
-    async uploadSingle(file, userId, metadata, preReadBuffer) {
+    async uploadSingle(file, userId, tenantId, metadata, preReadBuffer) {
         const logger = getLogger();
         const batchId = generateBatchId();
         try {
@@ -66,8 +65,10 @@ export class MediaUploadService {
             // which may not work reliably on Cloudflare Workers for FormData Files)
             const fileBuffer = preReadBuffer ?? await file.arrayBuffer();
             const contentHash = await generateContentHash(fileBuffer);
-            const ext = getExtensionFromMimeType(file.type);
-            const originalKey = `originals/user-${userId}/${contentHash}.${ext}`;
+            // T9: the ONE canonical CAS scheme (D18) — `cas/{tenantId}/{hash}`.
+            // The same key is what the DB `originalKey` stores and what the serve
+            // path reads, so upload-target and serve-source can never disagree.
+            const originalKey = buildCasOriginalKey(tenantId, contentHash);
             logger.info("[MediaUpload] Starting upload", {
                 contentHash,
                 mimeType: file.type,
@@ -142,7 +143,7 @@ export class MediaUploadService {
     /**
      * Upload batch of files
      */
-    async uploadBatch(files, userId, metadataArray) {
+    async uploadBatch(files, userId, tenantId, metadataArray) {
         const logger = getLogger();
         const batchId = generateBatchId();
         logger.info("[MediaUpload] Starting batch upload", {
@@ -154,8 +155,8 @@ export class MediaUploadService {
         const uploadResults = await Promise.allSettled(files.map(async (file, index) => {
             const fileBuffer = await file.arrayBuffer();
             const contentHash = await generateContentHash(fileBuffer);
-            const ext = getExtensionFromMimeType(file.type);
-            const originalKey = `originals/user-${userId}/${contentHash}.${ext}`;
+            // T9: canonical CAS scheme — see uploadSingle.
+            const originalKey = buildCasOriginalKey(tenantId, contentHash);
             const metadata = metadataArray?.[index];
             const r2Metadata = {
                 contentHash,

package/dist/lib/services/media-upload-service.js.map

@@ -1 +1 @@
-{"version":3,"file":"media-upload-service.js","sourceRoot":"","sources":["../../../src/lib/services/media-upload-service.ts"],"names":[],"mappings":"AACA;;;;;;;;GAQG;AAEH,OAAO,EAAE,SAAS,EAAU,MAAM,cAAc,CAAC;AAOjD;;GAEG;AACH,SAAS,eAAe;IACtB,OAAO,SAAS,IAAI,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;AAC7E,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,mBAAmB,CAAC,IAAiB;IAClD,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IAC/D,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC;IACzD,OAAO,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACxE,CAAC;AAED;;GAEG;AACH,SAAS,wBAAwB,CAAC,QAAgB;IAChD,MAAM,OAAO,GAA2B;QACtC,YAAY,EAAE,KAAK;QACnB,WAAW,EAAE,KAAK;QAClB,WAAW,EAAE,KAAK;QAClB,WAAW,EAAE,KAAK;QAClB,YAAY,EAAE,MAAM;QACpB,YAAY,EAAE,MAAM;QACpB,YAAY,EAAE,MAAM;QACpB,WAAW,EAAE,KAAK;QAClB,YAAY,EAAE,MAAM;QACpB,iBAAiB,EAAE,KAAK;KACzB,CAAC;IACF,OAAO,OAAO,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC;AACpC,CAAC;AAED,MAAM,OAAO,kBAAkB;IACrB,QAAQ,CAAW;IACnB,KAAK,CAAoC;IACzC,SAAS,CAAS;IAClB,GAAG,CAAM;IAEjB,YAAY,GAAQ;QAClB,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;QACf,IAAI,CAAC,QAAQ,GAAG,GAAG,CAAC,eAAe,CAAC;QACpC,IAAI,CAAC,KAAK,GAAG,GAAG,CAAC,0BAA0B,CAAC;QAC5C,IAAI,CAAC,SAAS;YACZ,GAAG,CAAC,WAAW,KAAK,MAAM;gBACxB,CAAC,CAAC,yBAAyB;gBAC3B,CAAC,CAAC,qBAAqB,CAAC;IAC9B,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,YAAY,CAChB,IAAU,EACV,MAAc,EACd,QAAiE,EACjE,aAA2B;QAE3B,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;QAC3B,MAAM,OAAO,GAAG,eAAe,EAAE,CAAC;QAElC,IAAI,CAAC;YACH,2BAA2B;YAC3B,yEAAyE;YACzE,wEAAwE;YACxE,MAAM,UAAU,GAAG,aAAa,IAAI,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC;YAC7D,MAAM,WAAW,GAAG,MAAM,mBAAmB,CAAC,UAAU,CAAC,CAAC;YAC1D,MAAM,GAAG,GAAG,wBAAwB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAChD,MAAM,WAAW,GAAG,kBAAkB,MAAM,IAAI,WAAW,IAAI,GAAG,EAAE,CAAC;YAErE,MAAM,CAAC,IAAI,CAAC,+BAA+B,EAAE;gBAC3C,WAAW;gBACX,QAAQ,EAAE,IAAI,CAAC,IAAI;gBACnB,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,MAAM;gBACN,OAAO;aACR,CAAC,CAAC;YAEH,gCAAgC;YAChC,MAAM,UAAU,GAAoB;gBAClC,WAAW;gBACX,UAAU,EAAE,MAAM;gBAClB,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;gBACpC,QAAQ,EAAE,IAAI,CAAC,IAAI;gBACnB,mBAAmB,EAAE,MAAM;gBAC3B,UAAU,EAAE,OAAO;gBACnB,OAAO;gBACP,GAAG,CAAC,QAAQ,EAAE,KAAK,IAAI,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,QAAQ,EAAE,EAAE,CAAC;gBAC5D,GAAG,CAAC,QAAQ,EAAE,MAAM,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC;gBAC/D,GAAG,CAAC,QAAQ,EAAE,QAAQ,IAAI,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,CAAC,QAAQ,EAAE,EAAE,CAAC;aACtE,CAAC;YAEF,MAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,WAAW,EAAE,UAAU,EAAE;gBAC/C,YAAY,EAAE;oBACZ,WAAW,EAAE,IAAI,CAAC,IAAI;iBACvB;gBACD,cAAc,EAAE,UAA+C;aAChE,CAAC,CAAC;YAEH,MAAM,CAAC,IAAI,CAAC,oCAAoC,EAAE;gBAChD,WAAW;gBACX,WAAW;aACZ,CAAC,CAAC;YAEH,yCAAyC;YACzC,MAAM,OAAO,GAA+B;gBAC1C,IAAI,EAAE,eAAe;gBACrB,OAAO;gBACP,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;gBACrB,OAAO,EAAE;oBACP;wBACE,WAAW;wBACX,WAAW;wBACX,QAAQ,EAAE,IAAI,CAAC,IAAI;wBACnB,IAAI,EAAE,IAAI,CAAC,IAAI;wBACf,UAAU,EAAE,MAAM;wBAClB,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;wBACpC,GAAG,CAAC,QAAQ,EAAE,KAAK,IAAI,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC;wBACjD,GAAG,CAAC,QAAQ,EAAE,MAAM,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;wBACpD,GAAG,CAAC,QAAQ,EAAE,QAAQ,IAAI,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,CAAC;qBAC3D;iBACF;aACF,CAAC;YAEF,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAE/B,MAAM,CAAC,IAAI,CAAC,qCAAqC,EAAE;gBACjD,WAAW;gBACX,OAAO;aACR,CAAC,CAAC;YAEH,gCAAgC;YAChC,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,WAAW;gBACX,GAAG,EAAE,GAAG,IAAI,CAAC,SAAS,cAAc,WAAW,EAAE;gBACjD,MAAM,EAAE,UAAU;aACnB,CAAC;QACJ,CAAC;QAAC,OAAO,KAAU,EAAE,CAAC;YACpB,MAAM,CAAC,KAAK,CAAC,6BAA6B,EAAE;gBAC1C,KAAK,EAAE,KAAK,CAAC,OAAO;gBACpB,MAAM;gBACN,QAAQ,EAAE,IAAI,CAAC,IAAI;aACpB,CAAC,CAAC;YACH,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,WAAW,CACf,KAAa,EACb,MAAc,EACd,aAIE;QAEF,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;QAC3B,MAAM,OAAO,GAAG,eAAe,EAAE,CAAC;QAElC,MAAM,CAAC,IAAI,CAAC,qCAAqC,EAAE;YACjD,SAAS,EAAE,KAAK,CAAC,MAAM;YACvB,MAAM;YACN,OAAO;SACR,CAAC,CAAC;QAEH,qCAAqC;QACrC,MAAM,aAAa,GAAG,MAAM,OAAO,CAAC,UAAU,CAC5C,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE;YAC9B,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC;YAC5C,MAAM,WAAW,GAAG,MAAM,mBAAmB,CAAC,UAAU,CAAC,CAAC;YAC1D,MAAM,GAAG,GAAG,wBAAwB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAChD,MAAM,WAAW,GAAG,kBAAkB,MAAM,IAAI,WAAW,IAAI,GAAG,EAAE,CAAC;YACrE,MAAM,QAAQ,GAAG,aAAa,EAAE,CAAC,KAAK,CAAC,CAAC;YAExC,MAAM,UAAU,GAAoB;gBAClC,WAAW;gBACX,UAAU,EAAE,MAAM;gBAClB,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;gBACpC,QAAQ,EAAE,IAAI,CAAC,IAAI;gBACnB,mBAAmB,EAAE,MAAM;gBAC3B,UAAU,EAAE,OAAO;gBACnB,OAAO;gBACP,GAAG,CAAC,QAAQ,EAAE,KAAK,IAAI,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,QAAQ,EAAE,EAAE,CAAC;gBAC5D,GAAG,CAAC,QAAQ,EAAE,MAAM,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC;gBAC/D,GAAG,CAAC,QAAQ,EAAE,QAAQ,IAAI,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,CAAC,QAAQ,EAAE,EAAE,CAAC;aACtE,CAAC;YAEF,MAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,WAAW,EAAE,UAAU,EAAE;gBAC/C,YAAY,EAAE;oBACZ,WAAW,EAAE,IAAI,CAAC,IAAI;iBACvB;gBACD,cAAc,EAAE,UAA+C;aAChE,CAAC,CAAC;YAEH,OAAO;gBACL,WAAW;gBACX,WAAW;gBACX,QAAQ,EAAE,IAAI,CAAC,IAAI;gBACnB,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,UAAU,EAAE,MAAM;gBAClB,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;gBACpC,GAAG,CAAC,QAAQ,EAAE,KAAK,IAAI,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC;gBACjD,GAAG,CAAC,QAAQ,EAAE,MAAM,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;gBACpD,GAAG,CAAC,QAAQ,EAAE,QAAQ,IAAI,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,CAAC;aAC3D,CAAC;QACJ,CAAC,CAAC,CACH,CAAC;QAEF,6BAA6B;QAC7B,MAAM,UAAU,GAAG,aAAa;aAC7B,MAAM,CAAC,CAAC,CAAC,EAAoC,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,WAAW,CAAC;aACzE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QAEvB,MAAM,CAAC,IAAI,CAAC,wCAAwC,EAAE;YACpD,KAAK,EAAE,KAAK,CAAC,MAAM;YACnB,UAAU,EAAE,UAAU,CAAC,MAAM;YAC7B,MAAM,EAAE,KAAK,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM;YACxC,OAAO;SACR,CAAC,CAAC;QAEH,8CAA8C;QAC9C,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC1B,MAAM,OAAO,GAA+B;gBAC1C,IAAI,EAAE,cAAc;gBACpB,OAAO;gBACP,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;gBACrB,OAAO,EAAE,UAAU;aACpB,CAAC;YAEF,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAE/B,MAAM,CAAC,IAAI,CAAC,2CAA2C,EAAE;gBACvD,KAAK,EAAE,UAAU,CAAC,MAAM;gBACxB,OAAO;aACR,CAAC,CAAC;QACL,CAAC;QAED,iBAAiB;QACjB,OAAO,aAAa,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE;YACzC,IAAI,MAAM,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;gBAClC,OAAO;oBACL,OAAO,EAAE,IAAI;oBACb,WAAW,EAAE,MAAM,CAAC,KAAK,CAAC,WAAW;oBACrC,GAAG,EAAE,GAAG,IAAI,CAAC,SAAS,cAAc,MAAM,CAAC,KAAK,CAAC,WAAW,EAAE;oBAC9D,MAAM,EAAE,UAAmB;iBAC5B,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,WAAW,EAAE,EAAE;oBACf,GAAG,EAAE,EAAE;oBACP,MAAM,EAAE,UAAmB;oBAC3B,OAAO,EAAE,kBAAkB,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE;iBACnD,CAAC;YACJ,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;CACF"}
+{"version":3,"file":"media-upload-service.js","sourceRoot":"","sources":["../../../src/lib/services/media-upload-service.ts"],"names":[],"mappings":"AACA;;;;;;;;GAQG;AAEH,OAAO,EAAE,SAAS,EAAU,MAAM,cAAc,CAAC;AACjD,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAO7D;;GAEG;AACH,SAAS,eAAe;IACtB,OAAO,SAAS,IAAI,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;AAC7E,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,mBAAmB,CAAC,IAAiB;IAClD,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IAC/D,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC;IACzD,OAAO,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACxE,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,mBAAmB,CAAC,QAAgB,EAAE,WAAmB;IAChE,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;IAC1C,IAAI,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,2BAA2B,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;IACzD,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,OAAO,kBAAkB;IACrB,QAAQ,CAAW;IACnB,KAAK,CAAoC;IACzC,SAAS,CAAS;IAClB,GAAG,CAAM;IAEjB,YAAY,GAAQ;QAClB,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;QACf,IAAI,CAAC,QAAQ,GAAG,GAAG,CAAC,eAAe,CAAC;QACpC,IAAI,CAAC,KAAK,GAAG,GAAG,CAAC,0BAA0B,CAAC;QAC5C,IAAI,CAAC,SAAS;YACZ,GAAG,CAAC,WAAW,KAAK,MAAM;gBACxB,CAAC,CAAC,yBAAyB;gBAC3B,CAAC,CAAC,qBAAqB,CAAC;IAC9B,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,YAAY,CAChB,IAAU,EACV,MAAc,EACd,QAAgB,EAChB,QAAiE,EACjE,aAA2B;QAE3B,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;QAC3B,MAAM,OAAO,GAAG,eAAe,EAAE,CAAC;QAElC,IAAI,CAAC;YACH,2BAA2B;YAC3B,yEAAyE;YACzE,wEAAwE;YACxE,MAAM,UAAU,GAAG,aAAa,IAAI,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC;YAC7D,MAAM,WAAW,GAAG,MAAM,mBAAmB,CAAC,UAAU,CAAC,CAAC;YAC1D,oEAAoE;YACpE,sEAAsE;YACtE,oEAAoE;YACpE,MAAM,WAAW,GAAG,mBAAmB,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;YAE/D,MAAM,CAAC,IAAI,CAAC,+BAA+B,EAAE;gBAC3C,WAAW;gBACX,QAAQ,EAAE,IAAI,CAAC,IAAI;gBACnB,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,MAAM;gBACN,OAAO;aACR,CAAC,CAAC;YAEH,gCAAgC;YAChC,MAAM,UAAU,GAAoB;gBAClC,WAAW;gBACX,UAAU,EAAE,MAAM;gBAClB,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;gBACpC,QAAQ,EAAE,IAAI,CAAC,IAAI;gBACnB,mBAAmB,EAAE,MAAM;gBAC3B,UAAU,EAAE,OAAO;gBACnB,OAAO;gBACP,GAAG,CAAC,QAAQ,EAAE,KAAK,IAAI,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,QAAQ,EAAE,EAAE,CAAC;gBAC5D,GAAG,CAAC,QAAQ,EAAE,MAAM,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC;gBAC/D,GAAG,CAAC,QAAQ,EAAE,QAAQ,IAAI,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,CAAC,QAAQ,EAAE,EAAE,CAAC;aACtE,CAAC;YAEF,MAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,WAAW,EAAE,UAAU,EAAE;gBAC/C,YAAY,EAAE;oBACZ,WAAW,EAAE,IAAI,CAAC,IAAI;iBACvB;gBACD,cAAc,EAAE,UAA+C;aAChE,CAAC,CAAC;YAEH,MAAM,CAAC,IAAI,CAAC,oCAAoC,EAAE;gBAChD,WAAW;gBACX,WAAW;aACZ,CAAC,CAAC;YAEH,yCAAyC;YACzC,MAAM,OAAO,GAA+B;gBAC1C,IAAI,EAAE,eAAe;gBACrB,OAAO;gBACP,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;gBACrB,OAAO,EAAE;oBACP;wBACE,WAAW;wBACX,WAAW;wBACX,QAAQ,EAAE,IAAI,CAAC,IAAI;wBACnB,IAAI,EAAE,IAAI,CAAC,IAAI;wBACf,UAAU,EAAE,MAAM;wBAClB,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;wBACpC,GAAG,CAAC,QAAQ,EAAE,KAAK,IAAI,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC;wBACjD,GAAG,CAAC,QAAQ,EAAE,MAAM,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;wBACpD,GAAG,CAAC,QAAQ,EAAE,QAAQ,IAAI,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,CAAC;qBAC3D;iBACF;aACF,CAAC;YAEF,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAE/B,MAAM,CAAC,IAAI,CAAC,qCAAqC,EAAE;gBACjD,WAAW;gBACX,OAAO;aACR,CAAC,CAAC;YAEH,gCAAgC;YAChC,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,WAAW;gBACX,GAAG,EAAE,GAAG,IAAI,CAAC,SAAS,cAAc,WAAW,EAAE;gBACjD,MAAM,EAAE,UAAU;aACnB,CAAC;QACJ,CAAC;QAAC,OAAO,KAAU,EAAE,CAAC;YACpB,MAAM,CAAC,KAAK,CAAC,6BAA6B,EAAE;gBAC1C,KAAK,EAAE,KAAK,CAAC,OAAO;gBACpB,MAAM;gBACN,QAAQ,EAAE,IAAI,CAAC,IAAI;aACpB,CAAC,CAAC;YACH,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,WAAW,CACf,KAAa,EACb,MAAc,EACd,QAAgB,EAChB,aAIE;QAEF,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;QAC3B,MAAM,OAAO,GAAG,eAAe,EAAE,CAAC;QAElC,MAAM,CAAC,IAAI,CAAC,qCAAqC,EAAE;YACjD,SAAS,EAAE,KAAK,CAAC,MAAM;YACvB,MAAM;YACN,OAAO;SACR,CAAC,CAAC;QAEH,qCAAqC;QACrC,MAAM,aAAa,GAAG,MAAM,OAAO,CAAC,UAAU,CAC5C,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE;YAC9B,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC;YAC5C,MAAM,WAAW,GAAG,MAAM,mBAAmB,CAAC,UAAU,CAAC,CAAC;YAC1D,+CAA+C;YAC/C,MAAM,WAAW,GAAG,mBAAmB,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;YAC/D,MAAM,QAAQ,GAAG,aAAa,EAAE,CAAC,KAAK,CAAC,CAAC;YAExC,MAAM,UAAU,GAAoB;gBAClC,WAAW;gBACX,UAAU,EAAE,MAAM;gBAClB,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;gBACpC,QAAQ,EAAE,IAAI,CAAC,IAAI;gBACnB,mBAAmB,EAAE,MAAM;gBAC3B,UAAU,EAAE,OAAO;gBACnB,OAAO;gBACP,GAAG,CAAC,QAAQ,EAAE,KAAK,IAAI,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,QAAQ,EAAE,EAAE,CAAC;gBAC5D,GAAG,CAAC,QAAQ,EAAE,MAAM,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC;gBAC/D,GAAG,CAAC,QAAQ,EAAE,QAAQ,IAAI,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,CAAC,QAAQ,EAAE,EAAE,CAAC;aACtE,CAAC;YAEF,MAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,WAAW,EAAE,UAAU,EAAE;gBAC/C,YAAY,EAAE;oBACZ,WAAW,EAAE,IAAI,CAAC,IAAI;iBACvB;gBACD,cAAc,EAAE,UAA+C;aAChE,CAAC,CAAC;YAEH,OAAO;gBACL,WAAW;gBACX,WAAW;gBACX,QAAQ,EAAE,IAAI,CAAC,IAAI;gBACnB,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,UAAU,EAAE,MAAM;gBAClB,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;gBACpC,GAAG,CAAC,QAAQ,EAAE,KAAK,IAAI,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC;gBACjD,GAAG,CAAC,QAAQ,EAAE,MAAM,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;gBACpD,GAAG,CAAC,QAAQ,EAAE,QAAQ,IAAI,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,CAAC;aAC3D,CAAC;QACJ,CAAC,CAAC,CACH,CAAC;QAEF,6BAA6B;QAC7B,MAAM,UAAU,GAAG,aAAa;aAC7B,MAAM,CAAC,CAAC,CAAC,EAAoC,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,WAAW,CAAC;aACzE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QAEvB,MAAM,CAAC,IAAI,CAAC,wCAAwC,EAAE;YACpD,KAAK,EAAE,KAAK,CAAC,MAAM;YACnB,UAAU,EAAE,UAAU,CAAC,MAAM;YAC7B,MAAM,EAAE,KAAK,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM;YACxC,OAAO;SACR,CAAC,CAAC;QAEH,8CAA8C;QAC9C,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC1B,MAAM,OAAO,GAA+B;gBAC1C,IAAI,EAAE,cAAc;gBACpB,OAAO;gBACP,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;gBACrB,OAAO,EAAE,UAAU;aACpB,CAAC;YAEF,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAE/B,MAAM,CAAC,IAAI,CAAC,2CAA2C,EAAE;gBACvD,KAAK,EAAE,UAAU,CAAC,MAAM;gBACxB,OAAO;aACR,CAAC,CAAC;QACL,CAAC;QAED,iBAAiB;QACjB,OAAO,aAAa,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE;YACzC,IAAI,MAAM,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;gBAClC,OAAO;oBACL,OAAO,EAAE,IAAI;oBACb,WAAW,EAAE,MAAM,CAAC,KAAK,CAAC,WAAW;oBACrC,GAAG,EAAE,GAAG,IAAI,CAAC,SAAS,cAAc,MAAM,CAAC,KAAK,CAAC,WAAW,EAAE;oBAC9D,MAAM,EAAE,UAAmB;iBAC5B,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,WAAW,EAAE,EAAE;oBACf,GAAG,EAAE,EAAE;oBACP,MAAM,EAAE,UAAmB;oBAC3B,OAAO,EAAE,kBAAkB,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE;iBACnD,CAAC;YACJ,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;CACF"}

package/dist/lib/tenant-scope.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tenant-scope.d.ts","sourceRoot":"","sources":["../../src/lib/tenant-scope.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAOH,MAAM,MAAM,eAAe,GAAG,KAAK,GAAG,QAAQ,GAAG,SAAS,CAAC;AAE3D,6EAA6E;AAC7E,wBAAgB,sBAAsB,CACpC,GAAG,GAAE,MAAM,GAAG,SAAyC,GACtD,eAAe,CAEjB;AAED;;;GAGG;AACH,eAAO,MAAM,oBAAoB,EAAE,WAAW,CAAC,MAAM,CAwBnD,CAAC;AAEH;;;;;GAKG;AACH,eAAO,MAAM,eAAe,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CA2DtD,CAAC;AAqBH;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,CAG7D;AAYD,+EAA+E;AAC/E,MAAM,MAAM,SAAS,GACjB;IAAE,MAAM,EAAE,aAAa,CAAA;CAAE,GACzB;IAAE,MAAM,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GACpC;IAAE,MAAM,EAAE,SAAS,CAAC;IAAC,UAAU,EAAE,OAAO,CAAA;CAAE,GAC1C;IAAE,MAAM,EAAE,oBAAoB,CAAA;CAAE,GAChC;IAAE,MAAM,EAAE,SAAS,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,CAAC;AAEzD;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE;IACrC,IAAI,EAAE,eAAe,CAAC;IACtB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC;IAC1C,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7B,QAAQ,EAAE,OAAO,CAAC;CACnB,GAAG,SAAS,CAqDZ;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,eAAe;;;;EAyCzD"}
+{"version":3,"file":"tenant-scope.d.ts","sourceRoot":"","sources":["../../src/lib/tenant-scope.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAOH,MAAM,MAAM,eAAe,GAAG,KAAK,GAAG,QAAQ,GAAG,SAAS,CAAC;AAE3D,6EAA6E;AAC7E,wBAAgB,sBAAsB,CACpC,GAAG,GAAE,MAAM,GAAG,SAAyC,GACtD,eAAe,CAEjB;AAED;;;GAGG;AACH,eAAO,MAAM,oBAAoB,EAAE,WAAW,CAAC,MAAM,CA6BnD,CAAC;AAEH;;;;;GAKG;AACH,eAAO,MAAM,eAAe,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAqEtD,CAAC;AAqBH;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,CAG7D;AAYD,+EAA+E;AAC/E,MAAM,MAAM,SAAS,GACjB;IAAE,MAAM,EAAE,aAAa,CAAA;CAAE,GACzB;IAAE,MAAM,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GACpC;IAAE,MAAM,EAAE,SAAS,CAAC;IAAC,UAAU,EAAE,OAAO,CAAA;CAAE,GAC1C;IAAE,MAAM,EAAE,oBAAoB,CAAA;CAAE,GAChC;IAAE,MAAM,EAAE,SAAS,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,CAAC;AAEzD;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE;IACrC,IAAI,EAAE,eAAe,CAAC;IACtB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC;IAC1C,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7B,QAAQ,EAAE,OAAO,CAAC;CACnB,GAAG,SAAS,CAqDZ;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,eAAe;;;;EAyCzD"}

package/dist/lib/tenant-scope.js

@@ -67,6 +67,11 @@ export const TENANT_SCOPED_MODELS = new Set([
     // this middleware, always filter tenant_id explicitly).
     "Relationship",
     "EntityRelationship",
+    // D18: MediaFile is now tenant-scoped (carries its own tenantId). Dedup is
+    // within-tenant via @@unique([tenantId, contentHash]). PostMedia is
+    // "by-relation" (no own tenantId) and crosses the scope boundary via
+    // the post→media join — flagged for T9/integration.
+    "MediaFile",
 ]);
 /**
  * Every other model, with the reason it is NOT auto-scoped. Exhaustive on
@@ -91,7 +96,12 @@ export const UNSCOPED_MODELS = new Map([
     ["FeatureToggle", "global"],
     ["IngestState", "global"],
     ["RoleMetadata", "global"],
-    ["MediaFile", "global-content-addressed"],
+    // P0b moderation-message dedupe ledger: a system-global exactly-once table
+    // keyed on an opaque messageDedupeKey. No tenantId column; identical bytes
+    // share fan-in across tenants by design — never auto-scoped.
+    ["ProcessedModerationMessage", "global"],
+    // Note: MediaFile was here as "global-content-addressed" prior to D18.
+    // It now carries its own tenantId and is in TENANT_SCOPED_MODELS above.
     // User-scoped (boundary is userId, not tenant).
     ["User", "user"],
     ["CircleConfig", "user"],
@@ -114,6 +124,11 @@ export const UNSCOPED_MODELS = new Map([
     ["DirectMessage", "user-pair"],
     // Scoped-by-relation: no own tenantId yet (doc/14 §04 C / WS0). Rely on the
     // parent's scope + the RLS backstop until tenantId is denormalized onto them.
+    // P0b moderation job: tenant-scoped through its parent MediaFile via mediaId
+    // (onDelete: Cascade). No own tenantId column, so it cannot be auto-scoped by
+    // the where-merge/create-stamp extension — same posture as the other
+    // by-relation child tables (parent scope + RLS backstop).
+    ["MediaModerationJob", "by-relation"],
     ["PostMedia", "by-relation"],
     ["PostSentiment", "by-relation"],
     ["PostSubject", "by-relation"],

package/dist/lib/tenant-scope.js.map

@@ -1 +1 @@
-{"version":3,"file":"tenant-scope.js","sourceRoot":"","sources":["../../src/lib/tenant-scope.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AACxC,OAAO,EAAE,kBAAkB,EAAE,MAAM,iCAAiC,CAAC;AACrE,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAIxC,6EAA6E;AAC7E,MAAM,UAAU,sBAAsB,CACpC,MAA0B,OAAO,CAAC,GAAG,CAAC,iBAAiB;IAEvD,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC;AAC7D,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAwB,IAAI,GAAG,CAAC;IAC/D,MAAM;IACN,aAAa;IACb,QAAQ;IACR,cAAc;IACd,aAAa;IACb,OAAO;IACP,aAAa;IACb,iBAAiB;IACjB,gBAAgB;IAChB,0BAA0B;IAC1B,mBAAmB;IACnB,kBAAkB;IAClB,eAAe;IACf,6EAA6E;IAC7E,8EAA8E;IAC9E,2EAA2E;IAC3E,gBAAgB;IAChB,wEAAwE;IACxE,2EAA2E;IAC3E,4EAA4E;IAC5E,wDAAwD;IACxD,cAAc;IACd,oBAAoB;CACrB,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,eAAe,GAAgC,IAAI,GAAG,CAAC;IAClE,8EAA8E;IAC9E,8EAA8E;IAC9E,6DAA6D;IAC7D,CAAC,QAAQ,EAAE,cAAc,CAAC;IAC1B,CAAC,cAAc,EAAE,cAAc,CAAC;IAChC,CAAC,cAAc,EAAE,cAAc,CAAC;IAChC,CAAC,wBAAwB,EAAE,cAAc,CAAC;IAC1C,CAAC,mBAAmB,EAAE,cAAc,CAAC;IACrC,CAAC,kBAAkB,EAAE,cAAc,CAAC;IACpC,oBAAoB;IACpB,CAAC,UAAU,EAAE,QAAQ,CAAC;IACtB,CAAC,kBAAkB,EAAE,QAAQ,CAAC;IAC9B,CAAC,kBAAkB,EAAE,QAAQ,CAAC;IAC9B,CAAC,eAAe,EAAE,QAAQ,CAAC;IAC3B,CAAC,aAAa,EAAE,QAAQ,CAAC;IACzB,CAAC,cAAc,EAAE,QAAQ,CAAC;IAC1B,CAAC,WAAW,EAAE,0BAA0B,CAAC;IACzC,gDAAgD;IAChD,CAAC,MAAM,EAAE,MAAM,CAAC;IAChB,CAAC,cAAc,EAAE,MAAM,CAAC;IACxB,CAAC,iBAAiB,EAAE,MAAM,CAAC;IAC3B,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAC1B,CAAC,sBAAsB,EAAE,MAAM,CAAC;IAChC,CAAC,eAAe,EAAE,MAAM,CAAC;IACzB,CAAC,eAAe,EAAE,MAAM,CAAC;IACzB,CAAC,mBAAmB,EAAE,MAAM,CAAC;IAC7B,CAAC,sBAAsB,EAAE,MAAM,CAAC;IAChC,CAAC,SAAS,EAAE,MAAM,CAAC;IACnB,CAAC,wBAAwB,EAAE,MAAM,CAAC;IAClC,6EAA6E;IAC7E,gEAAgE;IAChE,6EAA6E;IAC7E,CAAC,QAAQ,EAAE,MAAM,CAAC;IAClB,CAAC,cAAc,EAAE,MAAM,CAAC;IACxB,CAAC,kBAAkB,EAAE,MAAM,CAAC;IAC5B,CAAC,YAAY,EAAE,MAAM,CAAC;IACtB,CAAC,eAAe,EAAE,WAAW,CAAC;IAC9B,4EAA4E;IAC5E,8EAA8E;IAC9E,CAAC,WAAW,EAAE,aAAa,CAAC;IAC5B,CAAC,eAAe,EAAE,aAAa,CAAC;IAChC,CAAC,aAAa,EAAE,aAAa,CAAC;IAC9B,CAAC,kBAAkB,EAAE,aAAa,CAAC;IACnC,CAAC,kBAAkB,EAAE,aAAa,CAAC;IACnC,CAAC,mBAAmB,EAAE,aAAa,CAAC;IACpC,CAAC,iBAAiB,EAAE,aAAa,CAAC;IAClC,CAAC,oBAAoB,EAAE,oBAAoB,CAAC;IAC5C,CAAC,WAAW,EAAE,aAAa,CAAC;IAC5B,CAAC,cAAc,EAAE,aAAa,CAAC;IAC/B,2EAA2E;IAC3E,6BAA6B;IAC7B,CAAC,eAAe,EAAE,gBAAgB,CAAC;IACnC,CAAC,YAAY,EAAE,gBAAgB,CAAC;IAChC,yEAAyE;IACzE,yEAAyE;IACzE,2EAA2E;IAC3E,qEAAqE;IACrE,CAAC,kBAAkB,EAAE,gBAAgB,CAAC;CACvC,CAAC,CAAC;AAEH,yEAAyE;AACzE,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC;IAC9B,WAAW;IACX,kBAAkB;IAClB,UAAU;IACV,OAAO;IACP,WAAW;IACX,SAAS;IACT,YAAY;IACZ,YAAY;CACb,CAAC,CAAC;AACH,yEAAyE;AACzE,+EAA+E;AAC/E,6DAA6D;AAE7D,0EAA0E;AAC1E,4EAA4E;AAC5E,MAAM,eAAe,GAAG,IAAI,iBAAiB,EAAQ,CAAC;AAEtD;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CAAI,MAAc,EAAE,EAAW;IACxD,SAAS,EAAE,CAAC,IAAI,CAAC,kDAAkD,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;IACjF,OAAO,eAAe,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;AACvC,CAAC;AACD,SAAS,UAAU;IACjB,OAAO,eAAe,CAAC,QAAQ,EAAE,KAAK,IAAI,CAAC;AAC7C,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc,EAAE,QAAgB;IAChD,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACvC,OAAO,EAAE,GAAG,EAAE,CAAC,KAAgC,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;IACnE,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,CAAC;AACtB,CAAC;AAUD;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,KAO/B;IACC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC;IAEnE,IAAI,IAAI,KAAK,KAAK,IAAI,QAAQ,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QACnE,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IACnC,CAAC;IAED,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,IAAI,KAAK,SAAS;YACvB,CAAC,CAAC;gBACE,MAAM,EAAE,OAAO;gBACf,OAAO,EAAE,kBAAkB,KAAK,IAAI,SAAS,6BAA6B;aAC3E;YACH,CAAC,CAAC,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;IACvC,CAAC;IAED,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtB,MAAM,CAAC,GAAI,IAAI,EAAE,KAA6C,IAAI,SAAS,CAAC;QAC5E,MAAM,UAAU,GAAG,CAAC,CAClB,CAAC,IAAI,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,EAAE,UAAU,CAAC,CACzD,CAAC;QACF,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC;IAC3C,CAAC;IAED,UAAU;IACV,MAAM,CAAC,GAAG,IAAI,IAAI,EAAE,CAAC;IACrB,IAAI,eAAe,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;QACnC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,KAAK,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC;IACnF,CAAC;IACD,IAAI,SAAS,KAAK,QAAQ,EAAE,CAAC;QAC3B,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE,EAAE,GAAI,CAAC,CAAC,IAAe,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IAC1F,CAAC;IACD,IAAI,SAAS,KAAK,YAAY,EAAE,CAAC;QAC/B,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC;QACpB,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;YACjC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAI,CAAY,EAAE,QAAQ,EAAE,CAAC,CAAC;YACnD,CAAC,CAAC,EAAE,GAAI,IAAe,EAAE,QAAQ,EAAE,CAAC;QACtC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,CAAC;IAC9D,CAAC;IACD,IAAI,SAAS,KAAK,QAAQ,EAAE,CAAC;QAC3B,OAAO;YACL,MAAM,EAAE,SAAS;YACjB,IAAI,EAAE;gBACJ,GAAG,CAAC;gBACJ,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,KAAK,EAAE,QAAQ,CAAC;gBAClC,MAAM,EAAE,EAAE,GAAI,CAAC,CAAC,MAAiB,EAAE,QAAQ,EAAE;gBAC7C,MAAM,EAAE,CAAC,CAAC,MAAM;aACjB;SACF,CAAC;IACJ,CAAC;IACD,6EAA6E;IAC7E,0BAA0B;IAC1B,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;AACnC,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAAqB;IACxD,OAAO,MAAM,CAAC,eAAe,CAAC;QAC5B,IAAI,EAAE,cAAc;QACpB,KAAK,EAAE;YACL,UAAU,EAAE;gBACV,KAAK,CAAC,cAAc,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE;oBACpD,MAAM,IAAI,GAAG,eAAe,CAAC;wBAC3B,IAAI;wBACJ,KAAK;wBACL,SAAS;wBACT,IAAI,EAAE,IAA2C;wBACjD,QAAQ,EAAE,kBAAkB,EAAE;wBAC9B,QAAQ,EAAE,UAAU,EAAE;qBACvB,CAAC,CAAC;oBAEH,QAAQ,IAAI,CAAC,MAAM,EAAE,CAAC;wBACpB,KAAK,aAAa;4BAChB,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC;wBACrB,KAAK,OAAO;4BACV,MAAM,IAAI,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;wBAChC,KAAK,oBAAoB;4BACvB,SAAS,EAAE,CAAC,IAAI,CACd,wDAAwD,EACxD,EAAE,KAAK,EAAE,SAAS,EAAE,CACrB,CAAC;4BACF,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC;wBACrB,KAAK,SAAS;4BACZ,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;gCACpB,SAAS,EAAE,CAAC,IAAI,CAAC,yCAAyC,EAAE;oCAC1D,KAAK;oCACL,SAAS;iCACV,CAAC,CAAC;4BACL,CAAC;4BACD,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC;wBACrB,KAAK,SAAS;4BACZ,OAAO,KAAK,CAAC,IAAI,CAAC,IAAmB,CAAC,CAAC;oBAC3C,CAAC;gBACH,CAAC;aACF;SACF;KACF,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"tenant-scope.js","sourceRoot":"","sources":["../../src/lib/tenant-scope.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AACxC,OAAO,EAAE,kBAAkB,EAAE,MAAM,iCAAiC,CAAC;AACrE,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAIxC,6EAA6E;AAC7E,MAAM,UAAU,sBAAsB,CACpC,MAA0B,OAAO,CAAC,GAAG,CAAC,iBAAiB;IAEvD,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC;AAC7D,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAwB,IAAI,GAAG,CAAC;IAC/D,MAAM;IACN,aAAa;IACb,QAAQ;IACR,cAAc;IACd,aAAa;IACb,OAAO;IACP,aAAa;IACb,iBAAiB;IACjB,gBAAgB;IAChB,0BAA0B;IAC1B,mBAAmB;IACnB,kBAAkB;IAClB,eAAe;IACf,6EAA6E;IAC7E,8EAA8E;IAC9E,2EAA2E;IAC3E,gBAAgB;IAChB,wEAAwE;IACxE,2EAA2E;IAC3E,4EAA4E;IAC5E,wDAAwD;IACxD,cAAc;IACd,oBAAoB;IACpB,2EAA2E;IAC3E,oEAAoE;IACpE,qEAAqE;IACrE,oDAAoD;IACpD,WAAW;CACZ,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,eAAe,GAAgC,IAAI,GAAG,CAAC;IAClE,8EAA8E;IAC9E,8EAA8E;IAC9E,6DAA6D;IAC7D,CAAC,QAAQ,EAAE,cAAc,CAAC;IAC1B,CAAC,cAAc,EAAE,cAAc,CAAC;IAChC,CAAC,cAAc,EAAE,cAAc,CAAC;IAChC,CAAC,wBAAwB,EAAE,cAAc,CAAC;IAC1C,CAAC,mBAAmB,EAAE,cAAc,CAAC;IACrC,CAAC,kBAAkB,EAAE,cAAc,CAAC;IACpC,oBAAoB;IACpB,CAAC,UAAU,EAAE,QAAQ,CAAC;IACtB,CAAC,kBAAkB,EAAE,QAAQ,CAAC;IAC9B,CAAC,kBAAkB,EAAE,QAAQ,CAAC;IAC9B,CAAC,eAAe,EAAE,QAAQ,CAAC;IAC3B,CAAC,aAAa,EAAE,QAAQ,CAAC;IACzB,CAAC,cAAc,EAAE,QAAQ,CAAC;IAC1B,2EAA2E;IAC3E,2EAA2E;IAC3E,6DAA6D;IAC7D,CAAC,4BAA4B,EAAE,QAAQ,CAAC;IACxC,uEAAuE;IACvE,wEAAwE;IACxE,gDAAgD;IAChD,CAAC,MAAM,EAAE,MAAM,CAAC;IAChB,CAAC,cAAc,EAAE,MAAM,CAAC;IACxB,CAAC,iBAAiB,EAAE,MAAM,CAAC;IAC3B,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAC1B,CAAC,sBAAsB,EAAE,MAAM,CAAC;IAChC,CAAC,eAAe,EAAE,MAAM,CAAC;IACzB,CAAC,eAAe,EAAE,MAAM,CAAC;IACzB,CAAC,mBAAmB,EAAE,MAAM,CAAC;IAC7B,CAAC,sBAAsB,EAAE,MAAM,CAAC;IAChC,CAAC,SAAS,EAAE,MAAM,CAAC;IACnB,CAAC,wBAAwB,EAAE,MAAM,CAAC;IAClC,6EAA6E;IAC7E,gEAAgE;IAChE,6EAA6E;IAC7E,CAAC,QAAQ,EAAE,MAAM,CAAC;IAClB,CAAC,cAAc,EAAE,MAAM,CAAC;IACxB,CAAC,kBAAkB,EAAE,MAAM,CAAC;IAC5B,CAAC,YAAY,EAAE,MAAM,CAAC;IACtB,CAAC,eAAe,EAAE,WAAW,CAAC;IAC9B,4EAA4E;IAC5E,8EAA8E;IAC9E,6EAA6E;IAC7E,8EAA8E;IAC9E,qEAAqE;IACrE,0DAA0D;IAC1D,CAAC,oBAAoB,EAAE,aAAa,CAAC;IACrC,CAAC,WAAW,EAAE,aAAa,CAAC;IAC5B,CAAC,eAAe,EAAE,aAAa,CAAC;IAChC,CAAC,aAAa,EAAE,aAAa,CAAC;IAC9B,CAAC,kBAAkB,EAAE,aAAa,CAAC;IACnC,CAAC,kBAAkB,EAAE,aAAa,CAAC;IACnC,CAAC,mBAAmB,EAAE,aAAa,CAAC;IACpC,CAAC,iBAAiB,EAAE,aAAa,CAAC;IAClC,CAAC,oBAAoB,EAAE,oBAAoB,CAAC;IAC5C,CAAC,WAAW,EAAE,aAAa,CAAC;IAC5B,CAAC,cAAc,EAAE,aAAa,CAAC;IAC/B,2EAA2E;IAC3E,6BAA6B;IAC7B,CAAC,eAAe,EAAE,gBAAgB,CAAC;IACnC,CAAC,YAAY,EAAE,gBAAgB,CAAC;IAChC,yEAAyE;IACzE,yEAAyE;IACzE,2EAA2E;IAC3E,qEAAqE;IACrE,CAAC,kBAAkB,EAAE,gBAAgB,CAAC;CACvC,CAAC,CAAC;AAEH,yEAAyE;AACzE,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC;IAC9B,WAAW;IACX,kBAAkB;IAClB,UAAU;IACV,OAAO;IACP,WAAW;IACX,SAAS;IACT,YAAY;IACZ,YAAY;CACb,CAAC,CAAC;AACH,yEAAyE;AACzE,+EAA+E;AAC/E,6DAA6D;AAE7D,0EAA0E;AAC1E,4EAA4E;AAC5E,MAAM,eAAe,GAAG,IAAI,iBAAiB,EAAQ,CAAC;AAEtD;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CAAI,MAAc,EAAE,EAAW;IACxD,SAAS,EAAE,CAAC,IAAI,CAAC,kDAAkD,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;IACjF,OAAO,eAAe,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;AACvC,CAAC;AACD,SAAS,UAAU;IACjB,OAAO,eAAe,CAAC,QAAQ,EAAE,KAAK,IAAI,CAAC;AAC7C,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc,EAAE,QAAgB;IAChD,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACvC,OAAO,EAAE,GAAG,EAAE,CAAC,KAAgC,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;IACnE,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,CAAC;AACtB,CAAC;AAUD;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,KAO/B;IACC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC;IAEnE,IAAI,IAAI,KAAK,KAAK,IAAI,QAAQ,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QACnE,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IACnC,CAAC;IAED,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,IAAI,KAAK,SAAS;YACvB,CAAC,CAAC;gBACE,MAAM,EAAE,OAAO;gBACf,OAAO,EAAE,kBAAkB,KAAK,IAAI,SAAS,6BAA6B;aAC3E;YACH,CAAC,CAAC,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;IACvC,CAAC;IAED,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtB,MAAM,CAAC,GAAI,IAAI,EAAE,KAA6C,IAAI,SAAS,CAAC;QAC5E,MAAM,UAAU,GAAG,CAAC,CAClB,CAAC,IAAI,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,EAAE,UAAU,CAAC,CACzD,CAAC;QACF,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC;IAC3C,CAAC;IAED,UAAU;IACV,MAAM,CAAC,GAAG,IAAI,IAAI,EAAE,CAAC;IACrB,IAAI,eAAe,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;QACnC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,KAAK,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC;IACnF,CAAC;IACD,IAAI,SAAS,KAAK,QAAQ,EAAE,CAAC;QAC3B,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE,EAAE,GAAI,CAAC,CAAC,IAAe,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IAC1F,CAAC;IACD,IAAI,SAAS,KAAK,YAAY,EAAE,CAAC;QAC/B,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC;QACpB,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;YACjC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAI,CAAY,EAAE,QAAQ,EAAE,CAAC,CAAC;YACnD,CAAC,CAAC,EAAE,GAAI,IAAe,EAAE,QAAQ,EAAE,CAAC;QACtC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,CAAC;IAC9D,CAAC;IACD,IAAI,SAAS,KAAK,QAAQ,EAAE,CAAC;QAC3B,OAAO;YACL,MAAM,EAAE,SAAS;YACjB,IAAI,EAAE;gBACJ,GAAG,CAAC;gBACJ,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,KAAK,EAAE,QAAQ,CAAC;gBAClC,MAAM,EAAE,EAAE,GAAI,CAAC,CAAC,MAAiB,EAAE,QAAQ,EAAE;gBAC7C,MAAM,EAAE,CAAC,CAAC,MAAM;aACjB;SACF,CAAC;IACJ,CAAC;IACD,6EAA6E;IAC7E,0BAA0B;IAC1B,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;AACnC,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAAqB;IACxD,OAAO,MAAM,CAAC,eAAe,CAAC;QAC5B,IAAI,EAAE,cAAc;QACpB,KAAK,EAAE;YACL,UAAU,EAAE;gBACV,KAAK,CAAC,cAAc,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE;oBACpD,MAAM,IAAI,GAAG,eAAe,CAAC;wBAC3B,IAAI;wBACJ,KAAK;wBACL,SAAS;wBACT,IAAI,EAAE,IAA2C;wBACjD,QAAQ,EAAE,kBAAkB,EAAE;wBAC9B,QAAQ,EAAE,UAAU,EAAE;qBACvB,CAAC,CAAC;oBAEH,QAAQ,IAAI,CAAC,MAAM,EAAE,CAAC;wBACpB,KAAK,aAAa;4BAChB,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC;wBACrB,KAAK,OAAO;4BACV,MAAM,IAAI,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;wBAChC,KAAK,oBAAoB;4BACvB,SAAS,EAAE,CAAC,IAAI,CACd,wDAAwD,EACxD,EAAE,KAAK,EAAE,SAAS,EAAE,CACrB,CAAC;4BACF,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC;wBACrB,KAAK,SAAS;4BACZ,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;gCACpB,SAAS,EAAE,CAAC,IAAI,CAAC,yCAAyC,EAAE;oCAC1D,KAAK;oCACL,SAAS;iCACV,CAAC,CAAC;4BACL,CAAC;4BACD,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC;wBACrB,KAAK,SAAS;4BACZ,OAAO,KAAK,CAAC,IAAI,CAAC,IAAmB,CAAC,CAAC;oBAC3C,CAAC;gBACH,CAAC;aACF;SACF;KACF,CAAC,CAAC;AACL,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@de-otio/trellis",
-  "version": "0.11.0",
+  "version": "0.12.1",
   "license": "AGPL-3.0-or-later",
   "type": "module",
   "main": "./dist/index.js",
@@ -91,6 +91,7 @@
     "@vitest/ui": "^4.1.8",
     "aws-sdk-client-mock": "^4.1.0",
     "esbuild": "^0.28.1",
+    "fast-check": "^3.23.2",
     "form-data": "^4.0.1",
     "mailparser": "^3.9.11",
     "prettier": "^3.8.4",

package/prisma/migrations/20260625000000_media_tenant_scope_and_moderation_status/migration.sql

@@ -0,0 +1,49 @@
+-- T8: MediaFile tenant-scope reclassification + moderation status (D18, D13).
+--
+-- Summary of changes:
+--   + tenantId (NOT NULL) — every object belongs to exactly one tenant
+--   + ModerationStatus enum — PENDING | APPROVED | REVIEW | QUARANTINED | REJECTED
+--   + moderationStatus column defaulting to PENDING (fail-closed)
+--   - contentHash @unique (bare global unique) dropped
+--   + @@unique([tenantId, contentHash]) — within-tenant dedup replaces global dedup
+--   - gpsLatitude / gpsLongitude columns dropped (data-minimization, D13)
+--   - @@index([gpsLatitude, gpsLongitude]) dropped with the columns
+--   ~ metadataVisible default changed true -> false (D13 P0a)
+--   + @@index([moderationStatus]) — moderation-queue queries
+--   + @@index([tenantId, contentHash]) — tenant-scoped CAS serve path
+--
+-- Greenfield: Skybber is not live. No backfill. Dev media wiped + re-seeded
+-- (human checkpoint per README §9 item 1 before apply).
+
+-- CreateEnum
+CREATE TYPE "ModerationStatus" AS ENUM ('PENDING', 'APPROVED', 'REVIEW', 'QUARANTINED', 'REJECTED');
+
+-- AlterTable: add tenantId (NOT NULL), moderationStatus; drop GPS columns;
+-- flip metadataVisible default.
+ALTER TABLE "media_files"
+    ADD COLUMN "tenant_id" TEXT NOT NULL,
+    ADD COLUMN "moderation_status" "ModerationStatus" NOT NULL DEFAULT 'PENDING',
+    DROP COLUMN "gps_latitude",
+    DROP COLUMN "gps_longitude",
+    ALTER COLUMN "metadata_visible" SET DEFAULT false;
+
+-- DropIndex: remove bare global unique on content_hash
+DROP INDEX "media_files_content_hash_key";
+
+-- DropIndex: the GPS composite index is already removed by the DROP COLUMN
+-- above (Postgres cascades indexes that depend on a dropped column). IF EXISTS
+-- makes this explicit drop a safe no-op whether or not the index is still
+-- present / was ever named this in the migration history.
+DROP INDEX IF EXISTS "media_files_gps_latitude_gps_longitude_idx";
+
+-- CreateIndex: within-tenant dedup (replaces bare @unique)
+CREATE UNIQUE INDEX "media_files_tenant_id_content_hash_key" ON "media_files"("tenant_id", "content_hash");
+
+-- CreateIndex: moderation queue lookups
+CREATE INDEX "media_files_moderation_status_idx" ON "media_files"("moderation_status");
+
+-- CreateIndex: tenant-scoped CAS serve path
+CREATE INDEX "media_files_tenant_id_content_hash_idx" ON "media_files"("tenant_id", "content_hash");
+
+-- AddForeignKey: tenantId references tenants
+ALTER TABLE "media_files" ADD CONSTRAINT "media_files_tenant_id_fkey" FOREIGN KEY ("tenant_id") REFERENCES "tenants"("id") ON DELETE CASCADE ON UPDATE CASCADE;

package/prisma/migrations/20260625000001_p0b_moderation_jobs/migration.sql

@@ -0,0 +1,73 @@
+-- P0b: moderation job tracking — schema additions.
+--
+-- Summary of changes:
+--   ~ media_files.original_key: DROP NOT NULL (nullable for video pending transcode)
+--   ~ media_files.content_hash: DROP NOT NULL (null until the worker hashes the
+--     transcoded bytes; @@unique([tenant, content_hash]) tolerates many NULLs)
+--   + media_files.upload_id (TEXT, UNIQUE, nullable) — client idempotency key
+--   + CREATE TYPE moderation_track AS ENUM ('VISUAL', 'AUDIO')
+--   + CREATE TABLE media_moderation_jobs — per-track job records with FK + indexes
+--   + CREATE TABLE processed_moderation_messages — SQS exactly-once dedup table
+--
+-- Not deployed standalone: consumed by Trellis as an npm dependency; migration
+-- is applied when Trellis bumps @de-otio/trellis and runs prisma migrate deploy.
+
+-- AlterTable: make original_key nullable (video rows have no key until post-transcode)
+ALTER TABLE "media_files"
+    ALTER COLUMN "original_key" DROP NOT NULL;
+
+-- AlterTable: make content_hash nullable (video has no hash until the worker
+-- hashes the transcoded bytes; the within-tenant unique tolerates many NULLs)
+ALTER TABLE "media_files"
+    ALTER COLUMN "content_hash" DROP NOT NULL;
+
+-- AlterTable: add upload_id for client-side idempotency
+ALTER TABLE "media_files"
+    ADD COLUMN "upload_id" TEXT;
+
+-- CreateIndex: unique constraint on upload_id (one row per upload session)
+CREATE UNIQUE INDEX "media_files_upload_id_key" ON "media_files"("upload_id");
+
+-- CreateEnum: moderation track discriminator
+CREATE TYPE "ModerationTrack" AS ENUM ('VISUAL', 'AUDIO');
+
+-- CreateTable: per-track moderation job records
+CREATE TABLE "media_moderation_jobs" (
+    "id"                 TEXT NOT NULL,
+    "media_id"           TEXT NOT NULL,
+    "track"              "ModerationTrack" NOT NULL,
+    "job_id"             TEXT NOT NULL,
+    "decision"           TEXT,
+    "threshold_snapshot" JSONB NOT NULL,
+    "created_at"         TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "updated_at"         TIMESTAMP(3) NOT NULL,
+
+    CONSTRAINT "media_moderation_jobs_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateIndex: unique constraint on job_id (one row per provider job)
+CREATE UNIQUE INDEX "media_moderation_jobs_job_id_key" ON "media_moderation_jobs"("job_id");
+
+-- CreateIndex: lookup jobs by media (used by the pipeline to find in-flight jobs)
+CREATE INDEX "media_moderation_jobs_media_id_idx" ON "media_moderation_jobs"("media_id");
+
+-- CreateIndex: lookup by job_id (used by the result-callback path)
+CREATE INDEX "media_moderation_jobs_job_id_idx" ON "media_moderation_jobs"("job_id");
+
+-- AddForeignKey: media_moderation_jobs -> media_files (cascade on delete)
+ALTER TABLE "media_moderation_jobs"
+    ADD CONSTRAINT "media_moderation_jobs_media_id_fkey"
+    FOREIGN KEY ("media_id") REFERENCES "media_files"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- CreateTable: SQS exactly-once dedup for moderation result messages
+CREATE TABLE "processed_moderation_messages" (
+    "id"                  TEXT NOT NULL,
+    "message_dedupe_key"  TEXT NOT NULL,
+    "processed_at"        TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+
+    CONSTRAINT "processed_moderation_messages_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateIndex: unique constraint on dedupe key (collision = duplicate message)
+CREATE UNIQUE INDEX "processed_moderation_messages_message_dedupe_key_key"
+    ON "processed_moderation_messages"("message_dedupe_key");

package/prisma/schema.prisma

@@ -66,6 +66,18 @@ enum EntityStatus {
   TRANSFERRED
 }
 
+// Media moderation lifecycle state. Mirrors the hand-written ModerationStatus
+// union in apps/api/src/lib/media/moderation-status.ts — spelling must match.
+// Every new MediaFile is born PENDING (fail-closed); only the moderation
+// pipeline can advance to APPROVED.
+enum ModerationStatus {
+  PENDING
+  APPROVED
+  REVIEW
+  QUARANTINED
+  REJECTED
+}
+
 model PostGeoIndex {
   postUri   String   @id @map("post_uri")
   // Multi-tenancy — denormalized from the owning post; location data is
@@ -180,7 +192,7 @@ model User {
   // migration. (WebFinger/AP still resolve on `username` until the federation
   // repoint — that change is code-only, no data migration, since `handle` is the
   // stable key.)
-  handle    String  @unique
+  handle    String   @unique
   createdAt DateTime @default(now()) @map("created_at")
 
   // Cognito Auth integration
@@ -362,8 +374,8 @@ model User {
 
   // Realtime / server-blind settings sync
   encryptedSettings EncryptedUserSetting[]
-  blocksInitiated   BlockedUser[]         @relation("BlockedUserBlocker")
-  blockedBy         BlockedUser[]         @relation("BlockedUserBlocked")
+  blocksInitiated   BlockedUser[]          @relation("BlockedUserBlocker")
+  blockedBy         BlockedUser[]          @relation("BlockedUserBlocked")
 
   // Connection codes (out-of-band invite mechanism)
   createdConnectionCodes  ConnectionCode[]           @relation("ConnectionCodeCreator")
@@ -605,16 +617,32 @@ model Post {
   @@map("posts")
 }
 
-// Media files (content-addressed storage)
+// Media files (tenant-scoped content-addressed storage).
+// tenantId is NOT NULL — every object belongs to exactly one tenant.
+// Dedup is within-tenant: @@unique([tenantId, contentHash]).
+// Every new object is born PENDING (fail-closed); the moderation pipeline
+// advances objects to APPROVED before they can be served.
 model MediaFile {
   id           String  @id @default(cuid())
-  contentHash  String  @unique @map("content_hash") // SHA-256 hash
+  tenantId     String  @map("tenant_id") // Tenant that owns this object (NOT NULL)
+  contentHash  String? @map("content_hash") // SHA-256 hash (lowercase hex); null until post-transcode for video (set by the P0b worker)
   cid          String? @unique // AT Protocol CID (optional, for compatibility)
   mimeType     String  @map("mime_type")
   size         Int
-  originalKey  String  @map("original_key") // S3 key: media/{hash}.{ext}
-  thumbnailKey String? @map("thumbnail_key") // S3 key: media/{hash}_thumb.webp
-  optimizedKey String? @map("optimized_key") // S3 key: media/{hash}_opt.webp
+  // uploadId: client-side idempotency key for the upload session. Nullable
+  // because rows created before P0b (or via the reconciliation path) have no
+  // upload session. UNIQUE so the same upload cannot race into two rows.
+  uploadId     String? @unique @map("upload_id")
+  // originalKey: S3 CAS key for the raw ingested object. Nullable for video —
+  // the CAS key is computed post-transcode by the pipeline worker; the row
+  // exists before transcoding completes.
+  originalKey  String? @map("original_key") // S3 key: cas/{tenantId}/{hash} (null until transcode for video)
+  thumbnailKey String? @map("thumbnail_key") // S3 key: cas/{tenantId}/{hash}/thumb
+  optimizedKey String? @map("optimized_key") // S3 key: cas/{tenantId}/{hash}/opt
+
+  // Moderation state — the lifecycle gate (see ModerationStatus enum above).
+  // Default PENDING means every object is fail-closed until approved.
+  moderationStatus ModerationStatus @default(PENDING) @map("moderation_status")
 
   // Media metadata (extracted from file headers)
   width    Int? // Image/video width in pixels
@@ -627,13 +655,13 @@ model MediaFile {
   videoMetadata Json? @map("video_metadata")
 
   // Denormalized/unified metadata fields
-  dateTaken    DateTime? @map("date_taken")
-  gpsLatitude  Float?    @map("gps_latitude")
-  gpsLongitude Float?    @map("gps_longitude")
-  keywords     String[]  @default([]) @map("keywords")
+  // GPS coordinates are NOT stored — dropped at ingestion (data-minimization).
+  dateTaken DateTime? @map("date_taken")
+  keywords  String[]  @default([]) @map("keywords")
 
-  // Privacy flags
-  metadataVisible Boolean @default(true) @map("metadata_visible")
+  // Privacy flags. metadataVisible defaults false: metadata is private unless
+  // the owner explicitly shares it (data-minimization default).
+  metadataVisible Boolean @default(false) @map("metadata_visible")
   locationVisible Boolean @default(false) @map("location_visible")
 
   // Media visibility and deletion tracking
@@ -659,16 +687,18 @@ model MediaFile {
   updatedAt DateTime @updatedAt @map("updated_at")
 
   // Relations
-  posts PostMedia[] // Many-to-many with posts
+  posts          PostMedia[] // Many-to-many with posts
+  moderationJobs MediaModerationJob[] // P0b: per-track moderation job records
 
-  @@index([contentHash])
+  @@unique([tenantId, contentHash]) // Within-tenant dedup (replaces bare contentHash @unique)
   @@index([cid])
+  @@index([moderationStatus]) // Gate queries: find PENDING for the moderation queue
+  @@index([tenantId, contentHash]) // Serve path: tenant-scoped CAS lookup
   @@index([hidden, deletedAt]) // For filtering visible media
   @@index([createdAt]) // For chronological sorting
   @@index([dateTaken])
   @@index([metadataVisible])
   @@index([locationVisible])
-  @@index([gpsLatitude, gpsLongitude])
   @@index([uploadStatus])
   @@index([uploadedBy])
   @@index([uploadBatchId])
@@ -693,6 +723,54 @@ model UploadSession {
   @@map("upload_sessions")
 }
 
+// ============================================================================
+// P0b — Moderation job tracking
+// ============================================================================
+
+// Discriminator for the two parallel moderation tracks.
+// VISUAL — frame/thumbnail-level visual content analysis.
+// AUDIO  — speech-to-text + audio content analysis.
+enum ModerationTrack {
+  VISUAL
+  AUDIO
+}
+
+// One row per (media, track) moderation job submitted to an external provider.
+// decision is String (not an enum) so the schema stays decoupled from
+// ModerationDecision evolution; app code validates the value on read.
+// thresholdSnapshot captures the operative thresholds at job-submission time
+// so historical decisions remain auditable after a threshold change.
+model MediaModerationJob {
+  id                String          @id @default(cuid())
+  mediaId           String          @map("media_id")
+  media             MediaFile       @relation(fields: [mediaId], references: [id], onDelete: Cascade)
+  track             ModerationTrack
+  // jobId: the external provider's job identifier (unique per provider call).
+  jobId             String          @unique @map("job_id")
+  // decision: resolved ModerationDecision value, or null while the job is in flight.
+  decision          String?
+  // thresholdSnapshot: a copy of env.media.thresholds at submission time (JSON).
+  thresholdSnapshot Json            @map("threshold_snapshot")
+  createdAt         DateTime        @default(now()) @map("created_at")
+  updatedAt         DateTime        @updatedAt @map("updated_at")
+
+  @@index([mediaId])
+  @@index([jobId])
+  @@map("media_moderation_jobs")
+}
+
+// Deduplication table for SQS moderation-result messages (exactly-once delivery).
+// A row is inserted (with ON CONFLICT DO NOTHING / unique-constraint) before
+// processing; duplicate deliveries of the same message find the row present and
+// are skipped. Rows may be pruned after a retention window by a cron worker.
+model ProcessedModerationMessage {
+  id               String   @id @default(cuid())
+  messageDedupeKey String   @unique @map("message_dedupe_key")
+  processedAt      DateTime @default(now()) @map("processed_at")
+
+  @@map("processed_moderation_messages")
+}
+
 // Post media
 model PostMedia {
   id       String  @id @default(cuid())