@de-otio/trellis 0.12.3 → 0.14.0

package/dist/lib/media/moderation-status.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"moderation-status.d.ts","sourceRoot":"","sources":["../../../src/lib/media/moderation-status.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH;;;;;;;;;;GAUG;AACH,MAAM,MAAM,gBAAgB,GACxB,SAAS,GACT,UAAU,GACV,QAAQ,GACR,aAAa,GACb,UAAU,CAAC;AAEf;;;;;GAKG;AACH,MAAM,MAAM,kBAAkB,GAAG,UAAU,GAAG,QAAQ,GAAG,YAAY,CAAC;AAEtE;;;;;;;;GAQG;AACH,MAAM,MAAM,eAAe,GACvB;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,kBAAkB,CAAA;CAAE,GACpE;IAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,SAAS,GAAG,QAAQ,CAAA;CAAE,GACjE;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAE9B;;;;;GAKG;AACH,MAAM,MAAM,iBAAiB,GAAG;IAC9B,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IACnB,QAAQ,CAAC,MAAM,EAAE,oBAAoB,CAAC;IACtC,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC;IAChC,QAAQ,CAAC,KAAK,EAAE,eAAe,CAAC;CACjC,CAAC;AAEF,gDAAgD;AAChD,MAAM,MAAM,gBAAgB,GACxB;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,gBAAgB,CAAA;CAAE,GACxD,iBAAiB,CAAC;AAwBtB;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,UAAU,CACxB,OAAO,EAAE,gBAAgB,EACzB,KAAK,EAAE,eAAe,GACrB,gBAAgB,CAoClB;AA4BD,6EAA6E;AAC7E,eAAO,MAAM,uBAAuB,EAAE,SAAS,gBAAgB,EAExC,CAAC;AAExB,iFAAiF;AACjF,eAAO,MAAM,wBAAwB,EAAE,SAAS,kBAAkB,EAIxD,CAAC"}
+{"version":3,"file":"moderation-status.d.ts","sourceRoot":"","sources":["../../../src/lib/media/moderation-status.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH;;;;;;;;;;GAUG;AACH,MAAM,MAAM,gBAAgB,GACxB,SAAS,GACT,UAAU,GACV,QAAQ,GACR,aAAa,GACb,UAAU,CAAC;AAEf;;;;;GAKG;AACH,MAAM,MAAM,kBAAkB,GAAG,UAAU,GAAG,QAAQ,GAAG,YAAY,CAAC;AAEtE;;;;;;;;GAQG;AACH,MAAM,MAAM,eAAe,GACvB;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,kBAAkB,CAAA;CAAE,GACpE;IAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,SAAS,GAAG,QAAQ,CAAA;CAAE,GACjE;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAE9B;;;;;GAKG;AACH,MAAM,MAAM,iBAAiB,GAAG;IAC9B,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IACnB,QAAQ,CAAC,MAAM,EAAE,oBAAoB,CAAC;IACtC,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC;IAChC,QAAQ,CAAC,KAAK,EAAE,eAAe,CAAC;CACjC,CAAC;AAEF,gDAAgD;AAChD,MAAM,MAAM,gBAAgB,GACxB;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,gBAAgB,CAAA;CAAE,GACxD,iBAAiB,CAAC;AAwBtB;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,UAAU,CACxB,OAAO,EAAE,gBAAgB,EACzB,KAAK,EAAE,eAAe,GACrB,gBAAgB,CAoClB;AASD;;;;;;;;;;GAUG;AACH,wBAAgB,gBAAgB,CAC9B,QAAQ,EAAE,kBAAkB,GAC3B,gBAAgB,CAGlB;AAqBD,6EAA6E;AAC7E,eAAO,MAAM,uBAAuB,EAAE,SAAS,gBAAgB,EAExC,CAAC;AAExB,iFAAiF;AACjF,eAAO,MAAM,wBAAwB,EAAE,SAAS,kBAAkB,EAIxD,CAAC"}

package/dist/lib/media/moderation-status.js

@@ -93,6 +93,21 @@ export function nextStatus(current, event) {
 function illegal(from, event) {
     return { ok: false, reason: "illegal-transition", from, event };
 }
+/**
+ * Map a classifier {@link ModerationDecision} to the {@link ModerationStatus} a
+ * freshly-uploaded (PENDING) object should land in — a thin shell over
+ * {@link nextStatus} for the synchronous image-upload path.
+ *
+ * Drives the transition `PENDING --decision <d>--> status` and returns the
+ * resulting status. The transition out of PENDING on a `decision` event is
+ * always legal, but should the machine ever report a not-ok transition we fail
+ * closed to `REVIEW` (never `APPROVED`): an unexpected refusal must degrade to
+ * human review, not to serving.
+ */
+export function decisionToStatus(decision) {
+    const result = nextStatus("PENDING", { kind: "decision", decision });
+    return result.ok ? result.status : "REVIEW";
+}
 /**
  * Compile-time exhaustiveness guard for {@link ModerationStatus}.
  *

package/dist/lib/media/moderation-status.js.map

@@ -1 +1 @@
-{"version":3,"file":"moderation-status.js","sourceRoot":"","sources":["../../../src/lib/media/moderation-status.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AA4DH;;;;;;;GAOG;AACH,SAAS,iBAAiB,CAAC,QAA4B;IACrD,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,UAAU;YACb,OAAO,UAAU,CAAC;QACpB,KAAK,QAAQ;YACX,OAAO,QAAQ,CAAC;QAClB,KAAK,YAAY;YACf,OAAO,aAAa,CAAC;QACvB;YACE,8DAA8D;YAC9D,OAAO,QAAQ,CAAC;IACpB,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,UAAU,UAAU,CACxB,OAAyB,EACzB,KAAsB;IAEtB,wEAAwE;IACxE,gCAAgC;IAChC,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QAC1B,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;IAC1C,CAAC;IAED,QAAQ,OAAO,EAAE,CAAC;QAChB,KAAK,SAAS,CAAC,CAAC,CAAC;YACf,yDAAyD;YACzD,IAAI,KAAK,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;gBAC9B,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,iBAAiB,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;YACjE,CAAC;YACD,OAAO,OAAO,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACjC,CAAC;QAED,KAAK,QAAQ,CAAC;QACd,KAAK,aAAa,CAAC,CAAC,CAAC;YACnB,yCAAyC;YACzC,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;gBAC3B,OAAO;oBACL,EAAE,EAAE,IAAI;oBACR,MAAM,EAAE,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU;iBAC7D,CAAC;YACJ,CAAC;YACD,OAAO,OAAO,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACjC,CAAC;QAED,KAAK,UAAU,CAAC;QAChB,KAAK,UAAU;YACb,sCAAsC;YACtC,OAAO,OAAO,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAEjC;YACE,OAAO,OAAO,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACnC,CAAC;AACH,CAAC;AAED,SAAS,OAAO,CACd,IAAsB,EACtB,KAAsB;IAEtB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;AAClE,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,yBAAyB,GAAG;IAChC,OAAO,EAAE,IAAI;IACb,QAAQ,EAAE,IAAI;IACd,MAAM,EAAE,IAAI;IACZ,WAAW,EAAE,IAAI;IACjB,QAAQ,EAAE,IAAI;CACmC,CAAC;AAEpD,6EAA6E;AAC7E,MAAM,CAAC,MAAM,uBAAuB,GAAgC,MAAM,CAAC,IAAI,CAC7E,yBAAyB,CACJ,CAAC;AAExB,iFAAiF;AACjF,MAAM,CAAC,MAAM,wBAAwB,GAAkC;IACrE,UAAU;IACV,QAAQ;IACR,YAAY;CACJ,CAAC"}
+{"version":3,"file":"moderation-status.js","sourceRoot":"","sources":["../../../src/lib/media/moderation-status.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AA4DH;;;;;;;GAOG;AACH,SAAS,iBAAiB,CAAC,QAA4B;IACrD,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,UAAU;YACb,OAAO,UAAU,CAAC;QACpB,KAAK,QAAQ;YACX,OAAO,QAAQ,CAAC;QAClB,KAAK,YAAY;YACf,OAAO,aAAa,CAAC;QACvB;YACE,8DAA8D;YAC9D,OAAO,QAAQ,CAAC;IACpB,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,UAAU,UAAU,CACxB,OAAyB,EACzB,KAAsB;IAEtB,wEAAwE;IACxE,gCAAgC;IAChC,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QAC1B,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;IAC1C,CAAC;IAED,QAAQ,OAAO,EAAE,CAAC;QAChB,KAAK,SAAS,CAAC,CAAC,CAAC;YACf,yDAAyD;YACzD,IAAI,KAAK,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;gBAC9B,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,iBAAiB,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;YACjE,CAAC;YACD,OAAO,OAAO,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACjC,CAAC;QAED,KAAK,QAAQ,CAAC;QACd,KAAK,aAAa,CAAC,CAAC,CAAC;YACnB,yCAAyC;YACzC,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;gBAC3B,OAAO;oBACL,EAAE,EAAE,IAAI;oBACR,MAAM,EAAE,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU;iBAC7D,CAAC;YACJ,CAAC;YACD,OAAO,OAAO,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACjC,CAAC;QAED,KAAK,UAAU,CAAC;QAChB,KAAK,UAAU;YACb,sCAAsC;YACtC,OAAO,OAAO,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAEjC;YACE,OAAO,OAAO,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACnC,CAAC;AACH,CAAC;AAED,SAAS,OAAO,CACd,IAAsB,EACtB,KAAsB;IAEtB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;AAClE,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,gBAAgB,CAC9B,QAA4B;IAE5B,MAAM,MAAM,GAAG,UAAU,CAAC,SAAS,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC,CAAC;IACrE,OAAO,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC;AAC9C,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,yBAAyB,GAAG;IAChC,OAAO,EAAE,IAAI;IACb,QAAQ,EAAE,IAAI;IACd,MAAM,EAAE,IAAI;IACZ,WAAW,EAAE,IAAI;IACjB,QAAQ,EAAE,IAAI;CACmC,CAAC;AAEpD,6EAA6E;AAC7E,MAAM,CAAC,MAAM,uBAAuB,GAAgC,MAAM,CAAC,IAAI,CAC7E,yBAAyB,CACJ,CAAC;AAExB,iFAAiF;AACjF,MAAM,CAAC,MAAM,wBAAwB,GAAkC;IACrE,UAAU;IACV,QAAQ;IACR,YAAY;CACJ,CAAC"}

package/dist/lib/media/request-moderation.d.ts

@@ -0,0 +1,18 @@
+import { type MediaModerationProvider } from "./moderation-provider.js";
+/**
+ * Consuming app (Skybber) calls this at startup with its concrete moderation
+ * provider (e.g. an AWS Rekognition adapter). MUST run before the upload route
+ * serves. Re-exported from `@de-otio/trellis` (apps/api/src/index.ts).
+ */
+export declare function setMediaModerationProvider(provider: MediaModerationProvider): void;
+/**
+ * Returns the injected provider if one was registered, else a fail-closed
+ * {@link NullModerationProvider} (every verdict = `review`). The upload handler
+ * calls this on each sync-image request. Defaulting to Null — rather than
+ * throwing — means an un-wired deploy degrades to REVIEW (never serves, never
+ * 500), which is the safe behaviour for a moderation seam.
+ */
+export declare function getMediaModerationProvider(): MediaModerationProvider;
+/** Test-only: clear the injected provider so tests don't leak across cases. */
+export declare function __resetMediaModerationProviderForTests(): void;
+//# sourceMappingURL=request-moderation.d.ts.map

package/dist/lib/media/request-moderation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"request-moderation.d.ts","sourceRoot":"","sources":["../../../src/lib/media/request-moderation.ts"],"names":[],"mappings":"AAeA,OAAO,EACL,KAAK,uBAAuB,EAE7B,MAAM,0BAA0B,CAAC;AAWlC;;;;GAIG;AACH,wBAAgB,0BAA0B,CACxC,QAAQ,EAAE,uBAAuB,GAChC,IAAI,CAEN;AAED;;;;;;GAMG;AACH,wBAAgB,0BAA0B,IAAI,uBAAuB,CAEpE;AAED,+EAA+E;AAC/E,wBAAgB,sCAAsC,IAAI,IAAI,CAE7D"}

package/dist/lib/media/request-moderation.js

@@ -0,0 +1,45 @@
+// CONTRACT: stable — coordinate changes.
+//
+// Request-path provider seam for SYNCHRONOUS image moderation. Mirrors the
+// realtime-transport seam (apps/api/src/lib/realtime/index.ts): a consuming app
+// (Skybber) calls setMediaModerationProvider() ONCE at startup with its concrete
+// cloud adapter, and the upload handler reads it via getMediaModerationProvider()
+// on every sync-image request. Core imports no cloud SDK.
+//
+// FAIL-CLOSED DEFAULT: when no provider has been injected, getMediaModerationProvider()
+// returns a NullModerationProvider (every verdict = "review") rather than throwing.
+// An un-wired deploy must degrade to REVIEW (never serve, never 500) — a thrown
+// error here would turn every image upload into a 500. The startup guard
+// (assertModerationProviderAllowed) is the place that loudly refuses to run Null
+// outside dev; this seam is the safe runtime fallback.
+import { NullModerationProvider, } from "./moderation-provider.js";
+// ---------------------------------------------------------------------------
+// Provider-injection hook (mirrors setRealtimeProvider). A consuming app calls
+// setMediaModerationProvider() at startup, BEFORE the upload route serves, with
+// its concrete provider. getMediaModerationProvider() returns the injected
+// provider if present, else a fail-closed Null default.
+// ---------------------------------------------------------------------------
+let injected;
+/**
+ * Consuming app (Skybber) calls this at startup with its concrete moderation
+ * provider (e.g. an AWS Rekognition adapter). MUST run before the upload route
+ * serves. Re-exported from `@de-otio/trellis` (apps/api/src/index.ts).
+ */
+export function setMediaModerationProvider(provider) {
+    injected = provider;
+}
+/**
+ * Returns the injected provider if one was registered, else a fail-closed
+ * {@link NullModerationProvider} (every verdict = `review`). The upload handler
+ * calls this on each sync-image request. Defaulting to Null — rather than
+ * throwing — means an un-wired deploy degrades to REVIEW (never serves, never
+ * 500), which is the safe behaviour for a moderation seam.
+ */
+export function getMediaModerationProvider() {
+    return injected ?? new NullModerationProvider();
+}
+/** Test-only: clear the injected provider so tests don't leak across cases. */
+export function __resetMediaModerationProviderForTests() {
+    injected = undefined;
+}
+//# sourceMappingURL=request-moderation.js.map

package/dist/lib/media/request-moderation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"request-moderation.js","sourceRoot":"","sources":["../../../src/lib/media/request-moderation.ts"],"names":[],"mappings":"AAAA,yCAAyC;AACzC,EAAE;AACF,2EAA2E;AAC3E,gFAAgF;AAChF,iFAAiF;AACjF,kFAAkF;AAClF,0DAA0D;AAC1D,EAAE;AACF,wFAAwF;AACxF,oFAAoF;AACpF,gFAAgF;AAChF,yEAAyE;AACzE,iFAAiF;AACjF,uDAAuD;AAEvD,OAAO,EAEL,sBAAsB,GACvB,MAAM,0BAA0B,CAAC;AAElC,8EAA8E;AAC9E,+EAA+E;AAC/E,gFAAgF;AAChF,2EAA2E;AAC3E,wDAAwD;AACxD,8EAA8E;AAE9E,IAAI,QAA6C,CAAC;AAElD;;;;GAIG;AACH,MAAM,UAAU,0BAA0B,CACxC,QAAiC;IAEjC,QAAQ,GAAG,QAAQ,CAAC;AACtB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,0BAA0B;IACxC,OAAO,QAAQ,IAAI,IAAI,sBAAsB,EAAE,CAAC;AAClD,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,sCAAsC;IACpD,QAAQ,GAAG,SAAS,CAAC;AACvB,CAAC"}

package/dist/lib/media/route-upload.d.ts

@@ -24,9 +24,10 @@
 /**
  * The three ingest routes for an uploaded object.
  *
- * - `sync-image`    — re-encode synchronously; the upload handler completes
- *                     the full pipeline inline and records the object as APPROVED
- *                     after the re-encode pass.
+ * - `sync-image`    — re-encode synchronously, then determine
+ *                     APPROVED/REVIEW/QUARANTINED via the injected
+ *                     moderateImage provider; the handler stages the cleaned
+ *                     bytes and promotes them to cas/ only on APPROVED.
  * - `async-pending` — store as-is, record as PENDING, fan out to the P0b
  *                     async processing worker.
  * - `reject`        — refuse the upload at the type-routing boundary (before

package/dist/lib/media/route-upload.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"route-upload.d.ts","sourceRoot":"","sources":["../../../src/lib/media/route-upload.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH;;;;;;;;;;GAUG;AACH,MAAM,MAAM,WAAW,GACnB;IAAE,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAA;CAAE,GAC/B;IAAE,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAA;CAAE,GAClC;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAA;CAAE,CAAC;AAOhC;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,WAAW,CAAC,WAAW,EAAE,MAAM,GAAG,WAAW,CAyC5D"}
+{"version":3,"file":"route-upload.d.ts","sourceRoot":"","sources":["../../../src/lib/media/route-upload.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,WAAW,GACnB;IAAE,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAA;CAAE,GAC/B;IAAE,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAA;CAAE,GAClC;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAA;CAAE,CAAC;AAOhC;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,WAAW,CAAC,WAAW,EAAE,MAAM,GAAG,WAAW,CAyC5D"}

package/dist/lib/media/route-upload.js.map

@@ -1 +1 @@
-{"version":3,"file":"route-upload.js","sourceRoot":"","sources":["../../../src/lib/media/route-upload.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAkBH,gEAAgE;AAChE,MAAM,UAAU,GAAgB,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;AACvD,MAAM,aAAa,GAAgB,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC;AAC7D,MAAM,MAAM,GAAgB,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;AAE/C;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,WAAW,CAAC,WAAmB;IAC7C,wCAAwC;IACxC,IAAI,CAAC,WAAW,IAAI,OAAO,WAAW,KAAK,QAAQ,EAAE,CAAC;QACpD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,2EAA2E;IAC3E,8CAA8C;IAC9C,MAAM,IAAI,GAAG,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAE5D,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,8EAA8E;IAC9E,kEAAkE;IAClE,2EAA2E;IAC3E,oDAAoD;IACpD,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,YAAY,CAAC;QAClB,KAAK,WAAW,CAAC,CAAC,6CAA6C;QAC/D,KAAK,WAAW,CAAC;QACjB,KAAK,YAAY,CAAC;QAClB,KAAK,WAAW,EAAE,qDAAqD;YACrE,OAAO,UAAU,CAAC;IACtB,CAAC;IAED,8EAA8E;IAC9E,oEAAoE;IACpE,IAAI,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC3D,sEAAsE;QACtE,gCAAgC;QAChC,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;QAClD,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO,aAAa,CAAC;QACvB,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,wEAAwE;IACxE,OAAO,MAAM,CAAC;AAChB,CAAC"}
+{"version":3,"file":"route-upload.js","sourceRoot":"","sources":["../../../src/lib/media/route-upload.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAmBH,gEAAgE;AAChE,MAAM,UAAU,GAAgB,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;AACvD,MAAM,aAAa,GAAgB,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC;AAC7D,MAAM,MAAM,GAAgB,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;AAE/C;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,WAAW,CAAC,WAAmB;IAC7C,wCAAwC;IACxC,IAAI,CAAC,WAAW,IAAI,OAAO,WAAW,KAAK,QAAQ,EAAE,CAAC;QACpD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,2EAA2E;IAC3E,8CAA8C;IAC9C,MAAM,IAAI,GAAG,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAE5D,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,8EAA8E;IAC9E,kEAAkE;IAClE,2EAA2E;IAC3E,oDAAoD;IACpD,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,YAAY,CAAC;QAClB,KAAK,WAAW,CAAC,CAAC,6CAA6C;QAC/D,KAAK,WAAW,CAAC;QACjB,KAAK,YAAY,CAAC;QAClB,KAAK,WAAW,EAAE,qDAAqD;YACrE,OAAO,UAAU,CAAC;IACtB,CAAC;IAED,8EAA8E;IAC9E,oEAAoE;IACpE,IAAI,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC3D,sEAAsE;QACtE,gCAAgC;QAChC,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;QAClD,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO,aAAa,CAAC;QACvB,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,wEAAwE;IACxE,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/lib/routes/media.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"media.d.ts","sourceRoot":"","sources":["../../../src/lib/routes/media.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AA+BH,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AAoPxC;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,gBAAgB,CACpC,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,OAAO,EAChB,GAAG,EAAE,GAAG,EACR,OAAO,EAAE;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,GAC1B,OAAO,CAAC,QAAQ,CAAC,CA+HnB;AAoDD,eAAO,MAAM,WAAW,EAAE,KAAK,EA8xE9B,CAAC"}
+{"version":3,"file":"media.d.ts","sourceRoot":"","sources":["../../../src/lib/routes/media.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAiCH,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AAoPxC;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,gBAAgB,CACpC,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,OAAO,EAChB,GAAG,EAAE,GAAG,EACR,OAAO,EAAE;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,GAC1B,OAAO,CAAC,QAAQ,CAAC,CA+HnB;AAoDD,eAAO,MAAM,WAAW,EAAE,KAAK,EAi5E9B,CAAC"}

package/dist/lib/routes/media.js

@@ -9,9 +9,11 @@ import { CorsHandler } from "../cors-handler.js";
 import { sharedDatabaseConnectionManager } from "../database-connection-manager.js";
 import { QueryTimeoutPresets, withQueryTimeoutAndRetry, } from "../db-query-helper.js";
 import { getLogger } from "../logger.js";
-import { casKey, isCasKeyError, pendingKey, validateContentHash } from "../media/cas-keys.js";
+import { casKey, isCasKeyError, pendingKey, processingKey, validateContentHash } from "../media/cas-keys.js";
 import { buildMediaUpsertArgs } from "../media/media-upsert.js";
 import { checkUploadQuota } from "../media/quota-check.js";
+import { decisionToStatus } from "../media/moderation-status.js";
+import { getMediaModerationProvider } from "../media/request-moderation.js";
 import { canonicalContentType, isServable, } from "../media/serve-gate.js";
 import { resolveMediaTenantId } from "../media/tenant-resolution.js";
 import { routeUpload } from "../media/route-upload.js";
@@ -903,19 +905,29 @@ export const mediaRoutes = [
                     height: extracted?.exifData?.height || extracted?.videoMetadata?.height,
                     duration: extracted?.videoMetadata?.duration,
                 };
-                // Use MediaUploadService for eventual consistency upload.
-                // Pass the re-encoded buffer (uploadBuffer) so the content hash is of
-                // the clean output bytes, not the raw upload. The service writes the
-                // bytes to the canonical CAS key `cas/{tenantId}/{hash}`.
-                const uploadService = new MediaUploadService(env);
-                const result = await uploadService.uploadSingle(file, session.userId, tenantId, metadata, uploadBuffer);
-                // T9: the DB originalKey stores the SAME canonical CAS key the bytes
-                // were written to, so the serve path reads exactly what upload wrote.
-                const uploadOriginalKey = casKey(tenantId, result.contentHash);
-                if (isCasKeyError(uploadOriginalKey)) {
-                    logger.error("[Media Upload] Failed to build CAS key", {
+                // --- STAGE → MODERATE → PROMOTE-ON-APPROVE -----------------------------
+                // Synchronous image moderation. The cleaned (re-encoded) bytes are
+                // written to a STAGING key first, moderated, and only PROMOTED to the
+                // canonical `cas/` key when the verdict is APPROVED. `cas/` therefore
+                // only ever holds approved bytes; REVIEW/QUARANTINED bytes stay at
+                // staging out of the serve path (the gate is APPROVED-only). FAIL-CLOSED
+                // throughout — any uncertainty resolves to REVIEW, never APPROVED.
+                // 1. Hash the CLEANED output bytes so the CAS key addresses clean bytes
+                //    (the same scheme MediaUploadService used: SHA-256 hex of the buffer).
+                const hashBuffer = await crypto.subtle.digest("SHA-256", uploadBuffer);
+                const contentHash = Array.from(new Uint8Array(hashBuffer))
+                    .map((b) => b.toString(16).padStart(2, "0"))
+                    .join("");
+                // 2. Build the canonical cas/ key (final serve location) and the
+                //    processing/ staging key (pre-promotion location).
+                const uploadOriginalKey = casKey(tenantId, contentHash);
+                const stagingKey = processingKey(tenantId, contentHash);
+                if (isCasKeyError(uploadOriginalKey) || isCasKeyError(stagingKey)) {
+                    logger.error("[Media Upload] Failed to build CAS/staging key", {
                         userId: session.userId,
-                        kind: uploadOriginalKey.kind,
+                        kind: isCasKeyError(uploadOriginalKey)
+                            ? uploadOriginalKey.kind
+                            : stagingKey.kind,
                     });
                     const errorResponse = securityHeaders.createSecureResponse(JSON.stringify({
                         error: "Database error",
@@ -923,9 +935,95 @@ export const mediaRoutes = [
                     }), { status: 500, headers: { "content-type": "application/json" } });
                     return CorsHandler.addCorsHeaders(errorResponse, request, env);
                 }
-                // Create MediaFile DB record synchronously so post creation can
-                // reference it immediately (reconciliation will enrich it later).
-                // Dedup is within-tenant via @@unique([tenantId, contentHash]) (D18).
+                const mediaBucket = env.MEDIA_BUCKET_R2 || env.R2_BUCKET;
+                if (!mediaBucket) {
+                    // No object store to stage into — fail closed (cannot moderate, must
+                    // not serve). Mirrors the async-pending path's 503.
+                    logger.error("[Media Upload] No media bucket configured for staging", {
+                        userId: session.userId,
+                    });
+                    const errorResponse = securityHeaders.createSecureResponse(JSON.stringify({ error: "Upload unavailable" }), { status: 503, headers: { "content-type": "application/json" } });
+                    return CorsHandler.addCorsHeaders(errorResponse, request, env);
+                }
+                // 3. Write the cleaned bytes to STAGING (NOT cas/). cas/ is written only
+                //    on APPROVED, below.
+                try {
+                    await mediaBucket.put(stagingKey, uploadBuffer, {
+                        httpMetadata: { contentType: mimeType },
+                    });
+                }
+                catch (stageError) {
+                    logger.error("[Media Upload] Staging write failed", {
+                        userId: session.userId,
+                        error: stageError?.message,
+                    });
+                    const errorResponse = securityHeaders.createSecureResponse(JSON.stringify({ error: "Upload failed" }), { status: 500, headers: { "content-type": "application/json" } });
+                    return CorsHandler.addCorsHeaders(errorResponse, request, env);
+                }
+                // 4. Moderate the STAGED object via the injected provider. FAIL-CLOSED:
+                //    any throw/timeout is treated as `review` (→ REVIEW, never promoted).
+                //    The provider owns all thresholds (threshold-secrecy); core passes no
+                //    numbers.
+                // The bucket handle the moderation ref carries is the RESOLVED media
+                // bucket name from the env — identical to what MEDIA_BUCKET_R2 (the
+                // binding the staging write went to) wraps, including the
+                // `${stage}-${appName}-media` fallback. Reading it back from the env
+                // (never re-deriving the name or fallback here) guarantees the staging
+                // WRITE and the moderation READ point at the same bucket, so it is never
+                // empty. The injected provider uses {bucket, key} to locate the STAGED
+                // object.
+                const moderationBucketName = env.MEDIA_BUCKET_NAME;
+                let decision;
+                try {
+                    const verdict = await getMediaModerationProvider().moderateImage({
+                        bucket: moderationBucketName,
+                        key: stagingKey,
+                    });
+                    decision = decisionToStatus(verdict.decision);
+                }
+                catch (moderationError) {
+                    logger.warn("[Media Upload] Image moderation failed — failing closed to REVIEW", {
+                        userId: session.userId,
+                        error: moderationError?.message,
+                    });
+                    decision = "REVIEW";
+                }
+                // 5. PROMOTE on APPROVED: copy staging → cas/ (the cleaned bytes we
+                //    already hold in memory), then best-effort delete the staging copy.
+                //    Anything else (REVIEW/QUARANTINED/REJECTED) leaves the bytes at
+                //    staging and NEVER writes cas/.
+                if (decision === "APPROVED") {
+                    try {
+                        await mediaBucket.put(uploadOriginalKey, uploadBuffer, {
+                            httpMetadata: { contentType: mimeType },
+                        });
+                    }
+                    catch (promoteError) {
+                        // Promotion failed — the bytes are still safely at staging and the
+                        // row has not been written. Fail the upload so the client retries
+                        // rather than recording an APPROVED row with no servable cas/ object.
+                        logger.error("[Media Upload] CAS promotion failed", {
+                            userId: session.userId,
+                            error: promoteError?.message,
+                        });
+                        const errorResponse = securityHeaders.createSecureResponse(JSON.stringify({ error: "Upload failed" }), { status: 500, headers: { "content-type": "application/json" } });
+                        return CorsHandler.addCorsHeaders(errorResponse, request, env);
+                    }
+                    // Best-effort staging cleanup — cas/ is what serves, so a leftover
+                    // staging object is harmless (lifecycle-expired) and never fatal.
+                    try {
+                        await mediaBucket.delete(stagingKey);
+                    }
+                    catch (deleteError) {
+                        logger.warn("[Media Upload] Staging delete tolerated", {
+                            userId: session.userId,
+                            error: deleteError?.message,
+                        });
+                    }
+                }
+                // 6. Create the MediaFile DB record synchronously so post creation can
+                //    reference it immediately. Dedup is within-tenant via
+                //    @@unique([tenantId, contentHash]) (D18).
                 try {
                     await withQueryTimeoutAndRetry(sharedDatabaseConnectionManager, uploadRegion, env, async (db) => {
                         // T9: a within-tenant dedup hit (identical bytes re-uploaded)
@@ -933,10 +1031,10 @@ export const mediaRoutes = [
                         // buildMediaUpsertArgs guarantees the `update` payload touches
                         // neither uploadedBy nor moderationStatus — subsequent uploaders
                         // get a reference (via the post→media relation), not a mutation
-                        // of the shared row.
+                        // of the shared row. The verdict applies to the `create` only.
                         return await db.mediaFile.upsert(buildMediaUpsertArgs({
                             tenantId,
-                            contentHash: result.contentHash,
+                            contentHash,
                             mimeType,
                             size: file.size,
                             originalKey: uploadOriginalKey,
@@ -944,6 +1042,7 @@ export const mediaRoutes = [
                             width: metadata?.width,
                             height: metadata?.height,
                             duration: metadata?.duration,
+                            moderationStatus: decision,
                         }));
                     }, {
                         ...QueryTimeoutPresets.USER_FACING,
@@ -958,7 +1057,7 @@ export const mediaRoutes = [
                     // DB record is required for post creation to validate media ownership.
                     // If this fails, the upload must fail so the frontend can retry.
                     logger.error("[Media Upload] Synchronous DB record creation failed", {
-                        contentHash: result.contentHash,
+                        contentHash,
                         error: dbError.message,
                     });
                     const dbErrorResponse = securityHeaders.createSecureResponse(JSON.stringify({
@@ -971,9 +1070,10 @@ export const mediaRoutes = [
                     return CorsHandler.addCorsHeaders(dbErrorResponse, request, env);
                 }
                 logger.debug("[Media Upload] DB record created successfully", {
-                    contentHash: result.contentHash,
+                    contentHash,
                     uploadedBy: session.userId,
                     originalKey: uploadOriginalKey,
+                    moderationStatus: decision,
                     uploadRegion,
                 });
                 logger.info("Media upload successful", {
@@ -981,14 +1081,22 @@ export const mediaRoutes = [
                     fileName: file.name,
                     fileSize: file.size,
                     mimeType,
-                    contentHash: result.contentHash,
-                    status: result.status,
+                    contentHash,
+                    moderationStatus: decision,
                 });
+                // Reconstruct the client serve URL (same scheme MediaUploadService
+                // used). This is the public API URL the client GETs by hash — NOT a
+                // storage key (the serve gate resolves the storage key from the DB row,
+                // never by interpolating the hash; see serve-maze-removed.test.ts).
+                const apiDomain = env.ENVIRONMENT === "prod"
+                    ? "https://api.example.com"
+                    : "https://api.rkm1.de";
+                const serveUrl = `${apiDomain}/api/media/${encodeURIComponent(contentHash)}`;
                 const response = securityHeaders.createSecureResponse(JSON.stringify({
-                    url: result.url,
-                    mediaKey: result.contentHash,
-                    contentHash: result.contentHash,
-                    status: result.status,
+                    url: serveUrl,
+                    mediaKey: contentHash,
+                    contentHash,
+                    status: decision === "APPROVED" ? "approved" : "pending",
                 }), { status: 200, headers: { "content-type": "application/json" } });
                 return CorsHandler.addCorsHeaders(response, request, env);
             }