@devultur/self-host 1.1.0 → 1.3.0

package/dist/index.d.ts

@@ -1,6 +1,6 @@
 import * as hono_types from 'hono/types';
 import { Context, MiddlewareHandler, Hono } from 'hono';
-import { Visibility, ObjectLock, SecurityPolicy, CacheRule, TranscodeSettings, TranscodeOutputKeys, TranscodeOutputUrls } from '@devultur/core';
+import { Visibility, ObjectLock, SecurityPolicy, CacheRule, TranscodeSettings, RetentionMode, TranscodeOutputKeys, TranscodeOutputUrls } from '@devultur/core';
 import { T as TranscodeContainerNamespace } from './cloudflare-kZ7J3LQ2.js';
 
 /** What an upload token allows (claims `res`, `visibility`, `max_bytes`, `max_files`, `file_ttl`, `lock`). */
@@ -167,7 +167,22 @@ interface WorkerConfig {
      */
     lock?: ObjectLock;
     transcode?: TranscodeConfig;
+    /**
+     * What an upload whose first bytes contradict its declared Content-Type gets (see `ContentSniffingMode`). Every
+     * mismatch is logged (`[content-sniff] {declared, detected, key, action}`). A transcode's outputs are never checked.
+     * Unset: `scriptable`.
+     */
+    contentSniffing?: ContentSniffingMode;
 }
+/**
+ * - `scriptable` (default): `415 content_type_mismatch` only when the bytes are markup (HTML, SVG, XML) under an inert
+ *   type; any other mismatch is stored with its declared type.
+ * - `reject`: `415` for every mismatch.
+ * - `octet-stream`: a single PUT that mismatches is stored as `application/octet-stream`; a multipart upload is
+ *   rejected (R2 fixes its type when it starts).
+ * - `off`: no check.
+ */
+type ContentSniffingMode = "scriptable" | "reject" | "octet-stream" | "off";
 /** What an auth plugin established about the request's credential. */
 interface RequestAccess {
     /**
@@ -444,6 +459,9 @@ declare const LOCK_UNTIL_HEADER = "x-devultur-lock-until";
 /** `true` while a hold is set. */
 declare const LOCK_HOLD_HEADER = "x-devultur-lock-hold";
 
+/** `customMetadata` key holding the lock set at upload (JSON `{ retention?, hold }`). Owned by the Worker. */
+declare const LOCK_METADATA_KEY = "lock";
+
 /** Prefixes the Worker keeps for lock sidecars and audit records: no route reads or writes a key under them. */
 declare const RESERVED_LOCK_PREFIXES: readonly ["__lock/", "__lock-audit/"];
 
@@ -458,8 +476,113 @@ interface HoldSkip {
     reason: "not_found" | "unchanged" | "lock_conflict" | "lock_record_unreadable";
 }
 
-/** `customMetadata` key holding the lock set at upload (JSON `{ retention?, hold }`). Owned by the Worker. */
-declare const LOCK_METADATA_KEY = "lock";
+/** The lock in force on one stored object. */
+interface StoredObjectLock {
+    /** True while the object can't be deleted or overwritten. */
+    locked: boolean;
+    /** A hold is set (an unreadable lock record reads as one). */
+    hold: boolean;
+    /** ISO time the retention ends; left out with no retention, or while a hold keeps a `period` from starting. */
+    until?: string;
+    mode?: RetentionMode;
+    /** The lock record can't be read, so it's held until an operator repairs it. */
+    unreadable?: true;
+    /**
+     * The key isn't laid out like the Worker's (`{storage prefix}{public|private}/…`), so its lock record can't be
+     * found: it's kept, never deleted.
+     */
+    unrecognized?: true;
+    /** Storage key of the original the lock belongs to, when it isn't the object itself (a video's raw, say). */
+    lockedBy?: string;
+}
+interface LockLookupOptions {
+    mediaBucket: R2Bucket;
+    /**
+     * The storage prefix the keys live under (the Worker's `storagePrefix`, `""` for the bucket root). Omitted: read
+     * from each key, as everything before its first `public` or `private` segment. Pass it when a prefix of yours
+     * has a segment named `public` or `private`.
+     */
+    root?: string;
+    /** Default: now. */
+    now?: Date;
+}
+/**
+ * The lock in force on the object at `storageKey` (the full R2 key), or `null` when there's no such object (or it's
+ * a lock record). A file under a video's folder (an HLS segment, a caption) is locked by the video's raws unless
+ * they're `original-only`; an image variant by its original, likewise.
+ */
+declare function readObjectLock(options: LockLookupOptions, storageKey: string): Promise<StoredObjectLock | null>;
+
+interface PrefixWalkOptions extends LockLookupOptions {
+    /** Storage prefix to walk (full R2 keys, the storage prefix of the keys included). */
+    prefix: string;
+    /** From a previous call's result, to go on where it stopped. */
+    cursor?: string;
+    /** Objects listed per page. Default 100, at most 1000. */
+    batchSize?: number;
+    /**
+     * Bucket calls this call may make. Default 40: under the free plan's 50 subrequests per request, with room for the
+     * caller's own. Raise it on a paid plan.
+     */
+    maxSubrequests?: number;
+}
+
+/**
+ * No `now`: locks are judged by the real clock, so no caller can make a retention read as expired. (The read-only
+ * `readObjectLock` and `retainedSummary` take one, to ask "what about then?".)
+ */
+interface PrefixDeleteOptions extends Omit<PrefixWalkOptions, "now"> {
+    /** The Worker's `KEYS_BUCKET`, when it has one: the encryption keys of what's deleted go too. */
+    keysBucket?: R2Bucket;
+}
+/** An object kept because it's locked (or its original is, or its key isn't laid out like the Worker's). */
+interface RetainedObject extends StoredObjectLock {
+    /** Its storage key. */
+    key: string;
+    size: number;
+}
+interface PrefixDeleteResult {
+    deletedCount: number;
+    /** The sizes of the versions deleted, read right before each delete. */
+    deletedBytes: number;
+    /** Encryption keys deleted from the keys bucket. */
+    deletedKeyCount: number;
+    retainedCount: number;
+    retainedBytes: number;
+    /** What this call kept, in key order. */
+    retained: RetainedObject[];
+    /** Lock records and audit objects passed over (never deleted). */
+    skippedCount: number;
+    /** Set when the prefix isn't done: pass it back to go on. */
+    cursor?: string;
+    /** Bucket calls this call made. */
+    subrequests: number;
+}
+/**
+ * Deletes what's free under `options.prefix` (full storage keys) and keeps what's locked. Bounded: it never makes more
+ * than `maxSubrequests` bucket calls, and returns a `cursor` to call it again with. Nothing is audited: log `retained`
+ * if you need a trail. R2 deletes aren't conditional: a lock set between an object's check and its delete isn't seen
+ * (milliseconds for its own lock; for a lock it inherits, up to `LOCK_CACHE_MAX_AGE_MS`, as that lock is cached).
+ */
+declare function deletePrefixRespectingLocks(options: PrefixDeleteOptions): Promise<PrefixDeleteResult>;
+
+interface RetainedSummary {
+    /** Objects looked at (lock records and audit not included). */
+    scannedCount: number;
+    /** What a delete would keep, keys not laid out like the Worker's included. */
+    retainedCount: number;
+    retainedBytes: number;
+    /** The latest retention end among what's retained (ISO). Holds have none: see `hasHold`. */
+    latestUntil?: string;
+    /** Something retained is held (or has an unreadable lock record): it stays until released, not until a date. */
+    hasHold: boolean;
+    /** Set when the prefix isn't done: pass it back to go on. Combine the counts of every call. */
+    cursor?: string;
+    /** Bucket calls this call made. */
+    subrequests: number;
+}
+/** What's retained under `options.prefix` (full storage keys). Bounded and resumable like the delete. */
+declare function retainedSummary(options: PrefixWalkOptions): Promise<RetainedSummary>;
 
 declare const LOCK_SIDECAR_PREFIX = "__lock/";
 interface LockSidecar {
@@ -644,4 +767,4 @@ interface CreateWorkerOptions {
 }
 declare function createWorker(options?: CreateWorkerOptions): Hono<WorkerApp, hono_types.BlankSchema, "/">;
 
-export { type AllowedCredential, type AssetListEntry, type AuthorizeLockChangeHook, type BeforeLinkRedeemHook, type ComposedPlugins, type CreateWorkerOptions, type CredentialDecision, type CredentialKind, type CredentialPolicyOptions, type CredentialRequest, DownloadLink, type DownloadLinkInfo, type DownloadLinkRecord, type DownloadLinkStorage, ENCRYPTION_KEY_MISSING_CODE, type EncodeMetrics, HOLD_PAGE_SIZE, type HoldSkip, type ImageTransformParams, type IssueCredentialHook, type Json, KEYS_BUCKET_MISSING_CODE, LOCK_AUDIT_PREFIX, LOCK_HOLD_HEADER, LOCK_METADATA_KEY, LOCK_SIDECAR_PREFIX, LOCK_UNTIL_HEADER, type LockAuditAction, type LockAuditRecord, type LockChangeAction, type LockChangeDecision, type LockChangeRequest, type LockSidecar, type LockSource, MAX_ASSET_LIST_LIMIT, MAX_EXPIRED_LOOKUPS, MAX_UPLOAD_TOKEN_TTL_SECONDS, MaxResolution, ObjectMeta, type OnLockAuditHook, type PendingUploadInfo, type PluginContext, type PluginMiddleware, type PluginRoute, RESERVED_LOCK_PREFIXES, type RawStorageClass, type RequestAccess, type RequestState, type RequestStatePatch, type RouteResult, TOKEN_REJECTED_CODE, type TranscodeConfig, type TranscodeJob, UPLOAD_TOKEN_TYPE, type UploadGrant, type UploadRules, type UploadTypeRule, type WorkerApp, WorkerAuthErrorCode, type WorkerConfig, type WorkerEnv, type WorkerPlugin, type WorkerVariables, cancelPendingUpload, createWorker, credentialPolicy, defaultPlugins, deletePrefix, downloadLinks, edgeCacheTag, getPendingUpload, getRequestState, getRouteResult, hashKey, imageOriginAuthorization, isAuthenticated, isImageOriginRequest, isObjectExpired, isOpenRoute, isServiceToken, isUploadUrl, isVariantKey, logEncodeMetrics, parseEncodeMetrics, parseTransformParams, readImageOriginScope, readStoryboardKey, readTokenScopes, readTranscodeOutputKeys, readTranscodeOutputs, servedCacheControl, staticConfig, storageKey, updateRequestState, uploadGrantFromClaims, variantPrefix, vcpuSecondsPerVideoMinute, verifyViewerToken, withOutputUrls, workerSecretAuth };
+export { type AllowedCredential, type AssetListEntry, type AuthorizeLockChangeHook, type BeforeLinkRedeemHook, type ComposedPlugins, type ContentSniffingMode, type CreateWorkerOptions, type CredentialDecision, type CredentialKind, type CredentialPolicyOptions, type CredentialRequest, DownloadLink, type DownloadLinkInfo, type DownloadLinkRecord, type DownloadLinkStorage, ENCRYPTION_KEY_MISSING_CODE, type EncodeMetrics, HOLD_PAGE_SIZE, type HoldSkip, type ImageTransformParams, type IssueCredentialHook, type Json, KEYS_BUCKET_MISSING_CODE, LOCK_AUDIT_PREFIX, LOCK_HOLD_HEADER, LOCK_METADATA_KEY, LOCK_SIDECAR_PREFIX, LOCK_UNTIL_HEADER, type LockAuditAction, type LockAuditRecord, type LockChangeAction, type LockChangeDecision, type LockChangeRequest, type LockLookupOptions, type LockSidecar, type LockSource, MAX_ASSET_LIST_LIMIT, MAX_EXPIRED_LOOKUPS, MAX_UPLOAD_TOKEN_TTL_SECONDS, MaxResolution, ObjectMeta, type OnLockAuditHook, type PendingUploadInfo, type PluginContext, type PluginMiddleware, type PluginRoute, type PrefixDeleteOptions, type PrefixDeleteResult, type PrefixWalkOptions, RESERVED_LOCK_PREFIXES, type RawStorageClass, type RequestAccess, type RequestState, type RequestStatePatch, type RetainedObject, type RetainedSummary, type RouteResult, type StoredObjectLock, TOKEN_REJECTED_CODE, type TranscodeConfig, type TranscodeJob, UPLOAD_TOKEN_TYPE, type UploadGrant, type UploadRules, type UploadTypeRule, type WorkerApp, WorkerAuthErrorCode, type WorkerConfig, type WorkerEnv, type WorkerPlugin, type WorkerVariables, cancelPendingUpload, createWorker, credentialPolicy, defaultPlugins, deletePrefix, deletePrefixRespectingLocks, downloadLinks, edgeCacheTag, getPendingUpload, getRequestState, getRouteResult, hashKey, imageOriginAuthorization, isAuthenticated, isImageOriginRequest, isObjectExpired, isOpenRoute, isServiceToken, isUploadUrl, isVariantKey, logEncodeMetrics, parseEncodeMetrics, parseTransformParams, readImageOriginScope, readObjectLock, readStoryboardKey, readTokenScopes, readTranscodeOutputKeys, readTranscodeOutputs, retainedSummary, servedCacheControl, staticConfig, storageKey, updateRequestState, uploadGrantFromClaims, variantPrefix, vcpuSecondsPerVideoMinute, verifyViewerToken, withOutputUrls, workerSecretAuth };

package/dist/index.js

@@ -73,7 +73,7 @@ import { cors } from "hono/cors";
 import { logger } from "hono/logger";
 
 // src/object-lock/guard.ts
-import { decodeEncryptionMeta, effectiveUntil, isVideoRawKey } from "@devultur/core";
+import { isVideoRawKey } from "@devultur/core";
 
 // src/plugin-hooks.ts
 var PLUGIN_HOOKS_VARIABLE = "pluginHooks";
@@ -152,11 +152,47 @@ async function recordLockAudit(context, input) {
   await inBackground(context, deliver(context, root, record));
 }
 
+// src/object-lock/object-keys.ts
+import { decodeEncryptionMeta } from "@devultur/core";
+var DELETE_BATCH_SIZE = 1e3;
+async function listAll(bucket, options) {
+  const objects = [];
+  let cursor;
+  do {
+    const listing = await bucket.list({ ...options, ...cursor ? { cursor } : {} });
+    objects.push(...listing.objects);
+    cursor = listing.truncated ? listing.cursor : void 0;
+  } while (cursor);
+  return objects;
+}
+var isWrittenBy = (key, writtenBy) => key.uploaded.getTime() <= writtenBy.getTime();
+async function keysWrittenBy(keysBucket, prefix, writtenBy) {
+  return (await listAll(keysBucket, { prefix })).filter((key) => isWrittenBy(key, writtenBy)).map((key) => key.key);
+}
+async function objectKeysToDelete(keysBucket, fullKey, deleted) {
+  const own = await listAll(keysBucket, { prefix: `${fullKey}/`, delimiter: "/" });
+  const keys = new Set(own.filter((key) => isWrittenBy(key, deleted.uploaded)).map((key) => key.key));
+  const meta = decodeEncryptionMeta(deleted.customMetadata?.enc);
+  if (meta) keys.add(`${fullKey}/${meta.keyId}`);
+  for (const variantKey of await listAll(keysBucket, { prefix: variantPrefix(fullKey) })) keys.add(variantKey.key);
+  return [...keys];
+}
+var deleteCallsFor = (keys) => Math.ceil(keys.length / DELETE_BATCH_SIZE);
+async function deleteKeys(keysBucket, keys) {
+  for (let start = 0; start < keys.length; start += DELETE_BATCH_SIZE) {
+    await keysBucket.delete(keys.slice(start, start + DELETE_BATCH_SIZE));
+  }
+  return keys.length;
+}
+async function sweepObjectKeys(keysBucket, fullKey, deleted) {
+  return deleteKeys(keysBucket, await objectKeysToDelete(keysBucket, fullKey, deleted));
+}
+
 // src/object-lock/sidecar.ts
 import { isIsoInstant, validateLock as validateLock2 } from "@devultur/core";
 
 // src/object-lock/state.ts
-import { isLocked, validateLock } from "@devultur/core";
+import { effectiveUntil, isLocked, validateLock } from "@devultur/core";
 var LOCK_METADATA_KEY = "lock";
 function encodeLockMetadata(lock) {
   if (!lock || !lock.retention && !lock.hold) return void 0;
@@ -187,6 +223,13 @@ function isStateLocked(state, now) {
     return true;
   }
 }
+function untilOf(state) {
+  try {
+    return effectiveUntil(state.lock, { uploadedAt: state.uploadedAt, holdReleasedAt: state.holdReleasedAt });
+  } catch {
+    return void 0;
+  }
+}
 
 // src/object-lock/sidecar.ts
 var LOCK_SIDECAR_PREFIX = "__lock/";
@@ -289,32 +332,34 @@ function protectsDerived(state) {
   const derivatives = state.lock.retention?.derivatives ?? "inherit";
   return derivatives === "inherit";
 }
-async function lockedOriginal(context, root, key, now) {
-  const object = await context.env.MEDIA_BUCKET.head(`${root}${key}`);
-  const state = object ? (await effectiveLock(context.env.MEDIA_BUCKET, root, key, object)).state : null;
+async function lockedObject(bucket, root, key, object, now) {
+  const { state } = await effectiveLock(bucket, root, key, object);
   return state && isStateLocked(state, now) ? { key, state } : null;
 }
-async function lockedRaw(context, root, rawPrefix, now) {
+async function lockedOriginal(bucket, root, key, now) {
+  const object = await bucket.head(`${root}${key}`);
+  return object ? lockedObject(bucket, root, key, object, now) : null;
+}
+async function lockedRaw(bucket, root, rawPrefix, now) {
   let cursor;
   do {
-    const listing = await context.env.MEDIA_BUCKET.list({ prefix: `${root}${rawPrefix}`, cursor });
+    const listing = await bucket.list({ prefix: `${root}${rawPrefix}`, cursor });
     for (const listed of listing.objects) {
       const key = listed.key.slice(root.length);
-      const object = await context.env.MEDIA_BUCKET.head(listed.key);
-      const state = object ? (await effectiveLock(context.env.MEDIA_BUCKET, root, key, object)).state : null;
+      const object = await bucket.head(listed.key);
+      const state = object ? (await effectiveLock(bucket, root, key, object)).state : null;
       if (state && protectsDerived(state) && isStateLocked(state, now)) return { key, state };
     }
     cursor = listing.truncated ? listing.cursor : void 0;
   } while (cursor);
   return null;
 }
+function findLockedOriginal(bucket, root, subject, now) {
+  return subject.kind === "original" ? lockedOriginal(bucket, root, subject.key, now) : lockedRaw(bucket, root, subject.rawPrefix, now);
+}
 function retentionActive(context, locked, op) {
-  const { lock, uploadedAt, holdReleasedAt } = locked.state;
-  let until;
-  try {
-    until = effectiveUntil(lock, { uploadedAt, holdReleasedAt });
-  } catch {
-  }
+  const { lock } = locked.state;
+  const until = untilOf(locked.state);
   const verb = op === "delete" ? "deleted" : "overwritten";
   return context.json(
     {
@@ -339,7 +384,7 @@ async function assertWritable(context, keys, op, root = getRequestState(context)
     const subjectId = subject.kind === "original" ? subject.key : subject.rawPrefix;
     if (checked.has(subjectId)) continue;
     checked.add(subjectId);
-    const locked = subject.kind === "original" ? await lockedOriginal(context, root, subject.key, now) : await lockedRaw(context, root, subject.rawPrefix, now);
+    const locked = await findLockedOriginal(context.env.MEDIA_BUCKET, root, subject, now);
     if (!locked) continue;
     const requested = key === locked.key ? [key] : [key, locked.key];
     await recordLockAudit(context, {
@@ -355,7 +400,7 @@ async function assertWritable(context, keys, op, root = getRequestState(context)
   }
   return null;
 }
-var DELETE_BATCH_SIZE = 1e3;
+var DELETE_BATCH_SIZE2 = 1e3;
 async function guardedDeletePrefix(context, prefix) {
   const root = getRequestState(context).storagePrefix;
   const storageKeys = [];
@@ -368,38 +413,17 @@ async function guardedDeletePrefix(context, prefix) {
   const keys = storageKeys.map((key) => key.slice(root.length));
   const blocked = await assertWritable(context, keys, "delete");
   if (blocked) return { blocked };
-  for (let start = 0; start < storageKeys.length; start += DELETE_BATCH_SIZE) {
-    await context.env.MEDIA_BUCKET.delete(storageKeys.slice(start, start + DELETE_BATCH_SIZE));
+  for (let start = 0; start < storageKeys.length; start += DELETE_BATCH_SIZE2) {
+    await context.env.MEDIA_BUCKET.delete(storageKeys.slice(start, start + DELETE_BATCH_SIZE2));
   }
   return { deletedCount: storageKeys.length };
 }
-async function ownKeysOf(keysBucket, fullKey) {
-  const keys = [];
-  let cursor;
-  do {
-    const listing = await keysBucket.list({ prefix: `${fullKey}/`, delimiter: "/", cursor });
-    keys.push(...listing.objects);
-    cursor = listing.truncated ? listing.cursor : void 0;
-  } while (cursor);
-  return keys;
-}
-function isKeyOfDeletedVersion(key, deleted) {
-  return key.uploaded.getTime() <= deleted.uploaded.getTime();
-}
 async function deleteKeysFor(context, objectKey, deleted) {
   const blocked = await assertWritable(context, [objectKey], "delete");
   if (blocked) return { blocked };
   const keysBucket = context.env.KEYS_BUCKET;
   if (!keysBucket) return { deletedCount: 0 };
-  const fullKey = storageKey(context, objectKey);
-  const ownKeys = new Set(
-    (await ownKeysOf(keysBucket, fullKey)).filter((key) => isKeyOfDeletedVersion(key, deleted)).map((key) => key.key)
-  );
-  const meta = decodeEncryptionMeta(deleted.customMetadata?.enc);
-  if (meta) ownKeys.add(`${fullKey}/${meta.keyId}`);
-  if (ownKeys.size > 0) await keysBucket.delete([...ownKeys]);
-  const variantKeyCount = await deletePrefix(keysBucket, variantPrefix(fullKey));
-  return { deletedCount: variantKeyCount + ownKeys.size };
+  return { deletedCount: await sweepObjectKeys(keysBucket, storageKey(context, objectKey), deleted) };
 }
 async function deleteFolderKeys(context, videoFolder) {
   const blocked = await assertWritable(context, [videoFolder], "delete");
@@ -777,6 +801,62 @@ function addRouteResult(context, result) {
   context.set(ROUTE_RESULT_VARIABLE, { ...getRouteResult(context), ...result });
 }
 
+// src/routes/content-safety.ts
+var SANDBOX_CSP = "sandbox; default-src 'none'";
+var SAFE_INLINE_TYPES = /* @__PURE__ */ new Set([
+  "image/png",
+  "image/jpeg",
+  "image/webp",
+  "image/gif",
+  "image/avif",
+  "application/pdf",
+  "text/plain",
+  "text/csv",
+  "application/json",
+  "text/vtt",
+  "application/vnd.apple.mpegurl",
+  "application/x-mpegurl"
+]);
+var SAFE_INLINE_FAMILIES = ["video/", "audio/"];
+function contentTypeEssence(contentType) {
+  return contentType?.split(";")[0]?.trim().toLowerCase() ?? "";
+}
+function isSafeInlineType(contentType) {
+  const essence = contentTypeEssence(contentType);
+  if (SAFE_INLINE_TYPES.has(essence)) return true;
+  return SAFE_INLINE_FAMILIES.some((family) => essence.startsWith(family));
+}
+function attachmentOf(disposition, filename) {
+  if (disposition?.startsWith("attachment")) return disposition;
+  if (disposition?.startsWith("inline")) return `attachment${disposition.slice("inline".length)}`;
+  return contentDispositionAttachment(filename || "download");
+}
+function applyContentSafety(headers, filename, isPublic) {
+  headers.set("X-Content-Type-Options", "nosniff");
+  if (isPublic) headers.set("Cross-Origin-Resource-Policy", "cross-origin");
+  if (isSafeInlineType(headers.get("Content-Type"))) return;
+  headers.set("Content-Security-Policy", SANDBOX_CSP);
+  headers.set("Content-Disposition", attachmentOf(headers.get("Content-Disposition"), filename));
+}
+function basenameOf(url) {
+  const last = new URL(url).pathname.split("/").pop() ?? "";
+  try {
+    return decodeURIComponent(last);
+  } catch {
+    return last;
+  }
+}
+function isPublicMediaUrl(url) {
+  return new URL(url).pathname.startsWith("/v1/media/public/");
+}
+var contentSafety = async (context, next) => {
+  await next();
+  const headers = new Headers(context.res.headers);
+  applyContentSafety(headers, basenameOf(context.req.url), isPublicMediaUrl(context.req.url));
+  const { body, status, statusText } = context.res;
+  context.res = new Response(body, { status, statusText, headers });
+};
+
 // src/routes/object-response.ts
 import {
   AES_BLOCK_BYTES,
@@ -841,6 +921,25 @@ async function digestBody(body, declared, header) {
   if (expected && expected !== actual) return { mismatch: { expected, actual } };
   return { sha256: actual };
 }
+async function checkPartSha256(context, multipart, body) {
+  const partSha256 = headerSha256(context);
+  if (partSha256 === null) {
+    return context.json({ error: "x-devultur-sha256 must be a 64-character hex string", code: "invalid_sha256" }, 400);
+  }
+  if (multipart.sha256 && !partSha256) {
+    return context.json(
+      {
+        error: "Each part must carry its x-devultur-sha256 when the upload declares one",
+        code: "part_sha256_required"
+      },
+      400
+    );
+  }
+  if (!partSha256) return null;
+  const digest = await digestBody(body, void 0, partSha256);
+  if ("mismatch" in digest) return sha256Mismatch(context, digest.mismatch.expected, digest.mismatch.actual);
+  return null;
+}
 function lockMetadata(lock) {
   const encoded = encodeLockMetadata(lock);
   return encoded ? { [LOCK_METADATA_KEY]: encoded } : {};
@@ -1029,6 +1128,7 @@ async function gateRedemption(context, stub) {
   return gateLinkRedemption(context, linkInfoOf(await peeked.json()));
 }
 var download = new Hono2();
+download.use("*", contentSafety);
 download.get("/:linkId", async (context) => {
   if (context.req.method === "HEAD") return new Response(null, { status: 405, headers: { Allow: "GET" } });
   const linkId = context.req.param("linkId");
@@ -1232,6 +1332,14 @@ function inferMediaType(contentType) {
   if (contentType.startsWith("application/")) return MediaType.FILE;
   return null;
 }
+function resolveUploadMediaType(declared, contentType, isAssetRequest) {
+  const inferredType = inferMediaType(contentType);
+  if (declared && inferredType && declared !== inferredType) {
+    return failure(400, "media_type_mismatch", `mediaType "${declared}" does not match content type ${contentType}`);
+  }
+  const mediaType = declared ?? inferredType ?? (isAssetRequest ? MediaType.FILE : null);
+  return mediaType ?? failure(400, "unsupported_content_type", `Unsupported content type: ${contentType}`);
+}
 
 // src/routes/token-upload.ts
 var UPLOAD_TOKEN_TYPE = "upload";
@@ -2484,8 +2592,8 @@ function readJpeg(bytes) {
   return null;
 }
 function readPng(bytes) {
-  const isPng = bytes[0] === 137 && bytes[1] === 80 && bytes[2] === 78 && bytes[3] === 71;
-  if (!isPng || bytes.length < 24) return null;
+  const isPng2 = bytes[0] === 137 && bytes[1] === 80 && bytes[2] === 78 && bytes[3] === 71;
+  if (!isPng2 || bytes.length < 24) return null;
   return { width: uint32BE(bytes, 16), height: uint32BE(bytes, 20) };
 }
 function readWebp(bytes) {
@@ -2896,6 +3004,7 @@ function downloadDisposition(storedDisposition, key, filename) {
   return contentDispositionAttachment(key.split("/").pop() || "download");
 }
 var media = new Hono7();
+media.use("*", contentSafety);
 media.get("/:key{.+}", async (context) => {
   const key = context.req.param("key");
   const fullKey = storageKey(context, key);
@@ -3018,6 +3127,7 @@ media.get("/:key{.+}", async (context) => {
     headers.set("Content-Disposition", object.httpMetadata.contentDisposition);
   }
   if (isOwnerAccess) for (const [name, value] of await lockHeaders(context, key, object)) headers.set(name, value);
+  applyContentSafety(headers, key.split("/").pop() ?? "", !isPrivate);
   const { response, kind } = await streamObject({
     bucket: context.env.MEDIA_BUCKET,
     keysBucket: context.env.KEYS_BUCKET,
@@ -4345,6 +4455,17 @@ var DERIVED_CONTENT_TYPES = /* @__PURE__ */ new Set([
 function isDerivedAssetKey(key) {
   return DERIVED_ASSET_KEY.test(key);
 }
+var DERIVED_TYPES_BY_FOLDER = {
+  hls: /* @__PURE__ */ new Set(["application/vnd.apple.mpegurl", "video/mp2t"]),
+  mp4: /* @__PURE__ */ new Set(["video/mp4"]),
+  thumbnails: /* @__PURE__ */ new Set(["image/jpeg"]),
+  storyboard: /* @__PURE__ */ new Set(["image/jpeg", "text/vtt"])
+};
+var DERIVED_OUTPUT_KEY = /^(?:public|private)\/video\/[A-Za-z0-9-]+\/(hls|mp4|thumbnails|storyboard)\/.+$/;
+function isTrustedDerivedOutput(key, contentType) {
+  const folder = DERIVED_OUTPUT_KEY.exec(key)?.[1];
+  return folder !== void 0 && (DERIVED_TYPES_BY_FOLDER[folder]?.has(contentType) ?? false);
+}
 var RAW_LIST_LIMIT = 100;
 async function inheritedExpiresAt(context, key) {
   if (!isDerivedAssetKey(key)) return void 0;
@@ -4367,6 +4488,7 @@ async function derivedAssetPending(context, key) {
   return {
     contentType: DERIVED_CONTENT_TYPES.has(declared) ? declared : "application/octet-stream",
     storageKey: storageKey(context, key),
+    isDerived: true,
     ...security ? { security } : {},
     ...expiresAt ? { expiresAt } : {}
   };
@@ -4433,12 +4555,298 @@ async function afterUploadWrite(context, key, pending, write, writtenEnc) {
   });
 }
 
+// src/routes/upload-content-check.ts
+import { decodeEncryptionMeta as decodeEncryptionMeta9 } from "@devultur/core";
+
+// src/markup-sniff.ts
+var MARKUP_WINDOW_BYTES = 1024;
+function utf16Encoding(head) {
+  if (head[0] === 255 && head[1] === 254) return "utf-16le";
+  if (head[0] === 254 && head[1] === 255) return "utf-16be";
+  return null;
+}
+function isBinaryDataByte(byte) {
+  return byte <= 8 || byte === 11 || byte >= 14 && byte <= 26 || byte >= 28 && byte <= 31;
+}
+function decodesStrictly(head, encoding) {
+  try {
+    new TextDecoder(encoding, { fatal: true }).decode(head, { stream: true });
+    return true;
+  } catch {
+    return false;
+  }
+}
+function leadingText(head) {
+  const window = head.subarray(0, MARKUP_WINDOW_BYTES);
+  const decoded = new TextDecoder(utf16Encoding(head) ?? "utf-8").decode(window, { stream: true });
+  return decoded.replace(/^/, "").trimStart();
+}
+var HTML_TAGS = ["html", "head", "script", "iframe", "h1", "div", "font", "table", "a", "style", "title", "b"];
+var MORE_HTML_TAGS = ["body", "br", "p"];
+var DISTINCT_TAGS = ["html", "head", "script", "iframe", "div", "font", "table", "style", "title", "body"];
+var tagSource = (tags) => `<(?:${tags.join("|")})[\\s>]`;
+var ANY_HTML_TAG = new RegExp(tagSource([...HTML_TAGS, ...MORE_HTML_TAGS]));
+var DISTINCT_HTML_TAG = new RegExp(tagSource(DISTINCT_TAGS));
+var SVG_TAG = /<svg[\s>/]/;
+var LEADING_HTML = new RegExp(`^(?:<!doctype html|<!--|${tagSource([...HTML_TAGS, ...MORE_HTML_TAGS])})`);
+function detectScriptable(head) {
+  const start = leadingText(head).slice(0, 512).toLowerCase();
+  if (start.startsWith("<?xml")) return SVG_TAG.test(start) ? "svg" : "xml";
+  if (/^<svg[\s>/]/.test(start)) return "svg";
+  if (LEADING_HTML.test(start)) return "html";
+  return null;
+}
+function windowText(head, end) {
+  const window = head.subarray(0, Math.min(end, MARKUP_WINDOW_BYTES));
+  const utf16 = utf16Encoding(head);
+  const text = utf16 ? new TextDecoder(utf16).decode(window, { stream: true }) : String.fromCharCode(...window);
+  return text.toLowerCase();
+}
+function markupIn(text, htmlTag) {
+  if (SVG_TAG.test(text)) return "svg";
+  if (text.includes("<!doctype html") || htmlTag.test(text)) return "html";
+  return null;
+}
+function detectEmbeddedMarkup(head) {
+  return markupIn(windowText(head, MARKUP_WINDOW_BYTES), DISTINCT_HTML_TAG);
+}
+function detectMarkupBefore(head, end) {
+  const text = windowText(head, end);
+  if (text.includes("<!--")) return "html";
+  return markupIn(text, ANY_HTML_TAG);
+}
+
+// src/content-sniff.ts
+var SNIFF_HEAD_BYTES = 4096;
+var ascii = (text) => Array.from(text, (char) => char.charCodeAt(0));
+function hasBytesAt(head, offset, bytes) {
+  if (head.length < offset + bytes.length) return false;
+  return bytes.every((byte, index) => head[offset + index] === byte);
+}
+function readAscii(head, start, end) {
+  return String.fromCharCode(...head.subarray(start, Math.min(end, head.length)));
+}
+var startsWith = (...bytes) => (head) => hasBytesAt(head, 0, bytes);
+var riff = (form) => (head) => hasBytesAt(head, 0, ascii("RIFF")) && hasBytesAt(head, 8, ascii(form));
+var PDF_HEADER = ascii("%PDF-");
+function pdfHeaderOffset(head) {
+  const searchEnd = Math.min(head.length, MARKUP_WINDOW_BYTES) - PDF_HEADER.length;
+  for (let offset = 0; offset <= searchEnd; offset++) {
+    if (hasBytesAt(head, offset, PDF_HEADER)) return offset;
+  }
+  return -1;
+}
+var isPdf = (head) => pdfHeaderOffset(head) >= 0;
+function ftypBrands(head) {
+  if (!hasBytesAt(head, 4, ascii("ftyp"))) return null;
+  const boxSize = (head[0] ?? 0) << 24 | (head[1] ?? 0) << 16 | (head[2] ?? 0) << 8 | (head[3] ?? 0);
+  const boxEnd = Math.min(boxSize >= 16 ? boxSize : 16, head.length);
+  const brands = [readAscii(head, 8, 12)];
+  for (let offset = 16; offset + 4 <= boxEnd; offset += 4) brands.push(readAscii(head, offset, offset + 4));
+  return brands;
+}
+var AVIF_BRANDS = /* @__PURE__ */ new Set(["avif", "avis"]);
+var HEIF_BRANDS = /* @__PURE__ */ new Set(["heic", "heix", "heim", "heis", "hevc", "hevx", "mif1", "msf1"]);
+var LEGACY_MOV_ATOMS = ["moov", "mdat", "wide", "free", "skip", "pnot"];
+var hasBrand = (brands) => (head) => ftypBrands(head)?.some((brand) => brands.has(brand)) ?? false;
+var isIsoMedia = (head) => {
+  const brands = ftypBrands(head);
+  if (!brands) return LEGACY_MOV_ATOMS.some((atom) => hasBytesAt(head, 4, ascii(atom)));
+  const majorBrand = brands[0] ?? "";
+  return !AVIF_BRANDS.has(majorBrand) && !HEIF_BRANDS.has(majorBrand);
+};
+var EBML_MAGIC = [26, 69, 223, 163];
+var ebmlDocType = (...docTypes) => (head) => {
+  if (!hasBytesAt(head, 0, EBML_MAGIC)) return false;
+  const header = readAscii(head, 4, 64);
+  return docTypes.some((docType) => header.includes(docType));
+};
+var isPng = startsWith(137, 80, 78, 71, 13, 10, 26, 10);
+var isJpeg = startsWith(255, 216, 255);
+var isGif = (head) => hasBytesAt(head, 0, ascii("GIF87a")) || hasBytesAt(head, 0, ascii("GIF89a"));
+var isWebp = riff("WEBP");
+var isWav = riff("WAVE");
+var isAvif = hasBrand(AVIF_BRANDS);
+var isHeif = hasBrand(HEIF_BRANDS);
+var isWebm = ebmlDocType("webm");
+var isMatroskaOrWebm = ebmlDocType("matroska", "webm");
+var isOgg = startsWith(...ascii("OggS"), 0);
+var isFlac = startsWith(...ascii("fLaC"));
+var isMp3 = (head) => hasBytesAt(head, 0, ascii("ID3")) || head[0] === 255 && ((head[1] ?? 0) & 224) === 224;
+var isZip = (head) => hasBytesAt(head, 0, [80, 75, 3, 4]) || hasBytesAt(head, 0, [80, 75, 5, 6]);
+var isText = (head) => {
+  const utf16 = utf16Encoding(head);
+  if (utf16) return decodesStrictly(head.subarray(2), utf16);
+  return !head.some(isBinaryDataByte);
+};
+var isJson = (head) => !head.some(isBinaryDataByte) && decodesStrictly(head, "utf-8") && /^[{[]/.test(leadingText(head));
+var FAMILIES = [
+  ["pdf", startsWith(...PDF_HEADER)],
+  ["png", isPng],
+  ["jpeg", isJpeg],
+  ["gif", isGif],
+  ["webp", isWebp],
+  ["wav", isWav],
+  ["avif", isAvif],
+  ["heif", isHeif],
+  ["mp4", isIsoMedia],
+  ["webm", isWebm],
+  ["matroska", isMatroskaOrWebm],
+  ["ogg", isOgg],
+  ["flac", isFlac],
+  ["zip", isZip],
+  ["mp3", isMp3],
+  ["json", isJson],
+  ["text", isText],
+  ["pdf", isPdf]
+];
+function detectFamily(head) {
+  if (head.length === 0) return "empty";
+  const scriptable = detectScriptable(head);
+  if (scriptable) return scriptable;
+  return FAMILIES.find(([, signature]) => signature(head))?.[0] ?? "binary";
+}
+var OFFICE_ZIP_TYPES = ["wordprocessingml.document", "spreadsheetml.sheet", "presentationml.presentation"].map(
+  (subtype) => `application/vnd.openxmlformats-officedocument.${subtype}`
+);
+var typesWith = (types, signature) => types.map((type) => [type, signature]);
+var SIGNATURES = new Map([
+  ["application/pdf", isPdf],
+  ["image/png", isPng],
+  ["image/jpeg", isJpeg],
+  ["image/gif", isGif],
+  ["image/webp", isWebp],
+  ["image/avif", isAvif],
+  ...typesWith(["image/heic", "image/heif"], isHeif),
+  ...typesWith(["video/mp4", "video/quicktime", "video/x-m4v", "video/3gpp", "audio/mp4", "audio/x-m4a"], isIsoMedia),
+  ...typesWith(["video/webm", "audio/webm"], isWebm),
+  ...typesWith(["video/x-matroska", "audio/x-matroska"], isMatroskaOrWebm),
+  ...typesWith(["audio/mpeg", "audio/mp3"], isMp3),
+  ...typesWith(["audio/ogg", "video/ogg", "application/ogg", "audio/opus"], isOgg),
+  ...typesWith(["audio/wav", "audio/x-wav", "audio/wave", "audio/vnd.wave"], isWav),
+  ...typesWith(["audio/flac", "audio/x-flac"], isFlac),
+  ...typesWith(["application/zip", "application/x-zip-compressed", ...OFFICE_ZIP_TYPES], isZip),
+  ...typesWith(["text/plain", "text/csv", "text/markdown", "text/tab-separated-values"], isText),
+  ["application/json", isJson]
+]);
+function essenceOf(contentType) {
+  return contentType.split(";")[0]?.trim().toLowerCase() ?? "";
+}
+var TEXT_TYPES = /* @__PURE__ */ new Set([
+  "text/plain",
+  "text/csv",
+  "text/markdown",
+  "text/tab-separated-values",
+  "application/json"
+]);
+function embeddedMarkup(essence, head) {
+  if (essence === "application/pdf") {
+    const headerOffset = pdfHeaderOffset(head);
+    const before = detectMarkupBefore(head, headerOffset < 0 ? MARKUP_WINDOW_BYTES : headerOffset);
+    return before ?? detectEmbeddedMarkup(head);
+  }
+  return TEXT_TYPES.has(essence) ? detectEmbeddedMarkup(head) : null;
+}
+var SCRIPTABLE_FAMILIES = /* @__PURE__ */ new Set(["html", "svg", "xml"]);
+var mismatch = (detected) => ({
+  verdict: "mismatch",
+  detected,
+  isScriptable: SCRIPTABLE_FAMILIES.has(detected)
+});
+function sniffContent(declaredType, head) {
+  const essence = essenceOf(declaredType);
+  const signature = SIGNATURES.get(essence);
+  if (!signature) return { verdict: "unverifiable" };
+  const sample = head.subarray(0, SNIFF_HEAD_BYTES);
+  const scriptable = detectScriptable(sample) ?? embeddedMarkup(essence, sample);
+  if (scriptable) return mismatch(scriptable);
+  if (signature(sample)) return { verdict: "match" };
+  return mismatch(detectFamily(sample));
+}
+
+// src/routes/upload-content-check.ts
+var OCTET_STREAM = "application/octet-stream";
+var MULTIPART_PENDING_TTL_SECONDS = 24 * 60 * 60;
+function sniffingModeOf(context, pending) {
+  return pending?.contentSniffing ?? getRequestState(context).config?.contentSniffing ?? "scriptable";
+}
+function shouldSniffUpload(context, key, pending, contentType) {
+  const isRunnerWrite = pending ? Boolean(pending.isDerived) : true;
+  if (isRunnerWrite && isTrustedDerivedOutput(key, contentType)) return false;
+  return sniffingModeOf(context, pending) !== "off";
+}
+function mismatchAction(mode, mismatch2, isMultipart) {
+  if (mode === "scriptable") return mismatch2.isScriptable ? "rejected" : "accepted";
+  if (mode === "octet-stream" && !isMultipart) return "stored_as_octet_stream";
+  return "rejected";
+}
+function logMismatch(declared, mismatch2, key, action) {
+  console.warn(`[content-sniff] ${JSON.stringify({ declared, detected: mismatch2.detected, key, action })}`);
+}
+function contentTypeMismatch(context, declared, detected) {
+  return context.json(
+    {
+      error: `The file's content (${detected}) does not match its declared Content-Type ${declared}`,
+      code: "content_type_mismatch",
+      declared,
+      detected
+    },
+    415
+  );
+}
+function sniffHead(declared, body) {
+  return sniffContent(declared, new Uint8Array(body, 0, Math.min(body.byteLength, SNIFF_HEAD_BYTES)));
+}
+function checkSinglePutContent(context, upload2) {
+  const { contentType, key, pending } = upload2;
+  if (!shouldSniffUpload(context, key, pending, contentType)) return { contentType };
+  const result = sniffHead(contentType, upload2.body);
+  if (result.verdict !== "mismatch") return { contentType };
+  const action = mismatchAction(sniffingModeOf(context, pending), result, false);
+  logMismatch(contentType, result, key, action);
+  if (action === "accepted") return { contentType };
+  if (action === "stored_as_octet_stream") return { contentType: OCTET_STREAM };
+  return { rejected: contentTypeMismatch(context, contentType, result.detected) };
+}
+async function discardMultipart(context, active) {
+  const { pending, multipart, kvKey } = active;
+  await context.env.MEDIA_BUCKET.resumeMultipartUpload(pending.storageKey, multipart.uploadId).abort();
+  await context.env.MEDIA_KV.delete(kvKey);
+  const meta = decodeEncryptionMeta9(multipart.enc);
+  if (meta && context.env.KEYS_BUCKET) await context.env.KEYS_BUCKET.delete(`${pending.storageKey}/${meta.keyId}`);
+}
+async function checkFirstPart(context, active, key, partNumber, body) {
+  const { pending, multipart } = active;
+  if (partNumber !== 1 || !multipart.checksFirstPart) return null;
+  const result = sniffHead(pending.contentType, body);
+  if (result.verdict !== "mismatch") return null;
+  const action = mismatchAction(sniffingModeOf(context, pending), result, true);
+  logMismatch(pending.contentType, result, key, action);
+  if (action === "accepted") return null;
+  await discardMultipart(context, active);
+  return contentTypeMismatch(context, pending.contentType, result.detected);
+}
+async function recordFirstPart(context, active, partNumber, etag) {
+  const { pending, multipart, kvKey } = active;
+  if (partNumber !== 1 || !multipart.checksFirstPart) return;
+  const recorded = { ...pending, multipart: { ...multipart, firstPartEtag: etag } };
+  await context.env.MEDIA_KV.put(kvKey, JSON.stringify(recorded), { expirationTtl: MULTIPART_PENDING_TTL_SECONDS });
+}
+function unverifiedFirstPart(context, multipart, parts) {
+  if (!multipart.checksFirstPart) return null;
+  if (multipart.firstPartEtag && parts[0]?.etag === multipart.firstPartEtag) return null;
+  return context.json(
+    { error: "Part 1 of this upload has not been checked yet, or was replaced", code: "content_unverified" },
+    409
+  );
+}
+
 // src/routes/upload-multipart.ts
 import {
   AES_BLOCK_BYTES as AES_BLOCK_BYTES2,
   classifyUploadRequest,
   counterForBlock,
-  decodeEncryptionMeta as decodeEncryptionMeta9,
+  decodeEncryptionMeta as decodeEncryptionMeta10,
   encryptBytes,
   MULTIPART_PART_SIZE_BYTES,
   MULTIPART_QUERY,
@@ -4544,7 +4952,6 @@ async function cancelPendingUpload(context, uploadUrl) {
 }
 
 // src/routes/upload-multipart.ts
-var MULTIPART_PENDING_TTL_SECONDS = 24 * 60 * 60;
 var MAX_PART_COUNT = 1e4;
 async function readMultipartAt(context, kvKey) {
   const raw = await context.env.MEDIA_KV.get(kvKey);
@@ -4636,7 +5043,9 @@ async function handleMultipartCreate(context, key, target) {
     size,
     partSize,
     ...enc ? { enc } : {},
-    ...declaredSha256 ? { sha256: declaredSha256 } : {}
+    ...declaredSha256 ? { sha256: declaredSha256 } : {},
+    // The type is fixed now, before any byte: part 1 is checked against it when it arrives.
+    ...shouldSniffUpload(context, key, pending, pending.contentType) ? { checksFirstPart: true } : {}
   };
   await context.env.MEDIA_KV.put(kvKey, JSON.stringify({ ...pending, multipart }), {
     expirationTtl: MULTIPART_PENDING_TTL_SECONDS
@@ -4650,7 +5059,7 @@ async function handleMultipartCreate(context, key, target) {
 }
 async function encryptPart(context, pending, multipart, partNumber, body) {
   if (!multipart.enc) return body;
-  const meta = decodeEncryptionMeta9(multipart.enc);
+  const meta = decodeEncryptionMeta10(multipart.enc);
   const material = meta ? await loadStorageKey(context.env.KEYS_BUCKET, pending.storageKey, meta.keyId) : null;
   if (!meta || !material) return null;
   const startBlock = (partNumber - 1) * multipart.partSize / AES_BLOCK_BYTES2;
@@ -4674,10 +5083,13 @@ async function handleMultipartPart(context) {
   }
   const partChecksumFailure = await checkPartSha256(context, multipart, body);
   if (partChecksumFailure) return partChecksumFailure;
+  const contentFailure = await checkFirstPart(context, active, key, partNumber, body);
+  if (contentFailure) return contentFailure;
   const storedPart = await encryptPart(context, pending, multipart, partNumber, body);
   if (!storedPart) return context.json({ error: "Encryption key not found for this upload" }, 500);
   const multipartUpload = context.env.MEDIA_BUCKET.resumeMultipartUpload(pending.storageKey, multipart.uploadId);
   const uploaded = await multipartUpload.uploadPart(partNumber, storedPart);
+  await recordFirstPart(context, active, partNumber, uploaded.etag);
   return context.json({ partNumber: uploaded.partNumber, etag: uploaded.etag });
 }
 async function handleMultipartComplete(context, key) {
@@ -4687,6 +5099,8 @@ async function handleMultipartComplete(context, key) {
   const { pending, multipart, kvKey } = active;
   const parts = normalizeCompletedParts(multipart, body?.parts);
   if (!parts) return context.json({ error: "parts must list every part exactly once", code: "invalid_parts" }, 400);
+  const unverified = unverifiedFirstPart(context, multipart, parts);
+  if (unverified) return unverified;
   const write = await prepareUploadWrite(context, pending.key ?? key, pending, pending.storageKey);
   if ("blocked" in write) return write.blocked;
   const multipartUpload = context.env.MEDIA_BUCKET.resumeMultipartUpload(pending.storageKey, multipart.uploadId);
@@ -4701,25 +5115,6 @@ async function handleMultipartComplete(context, key) {
   const integrity = multipart.sha256 ? { sha256: multipart.sha256, sha256Verified: false } : {};
   return context.json({ key, size: object.size, ...integrity });
 }
-async function checkPartSha256(context, multipart, body) {
-  const partSha256 = headerSha256(context);
-  if (partSha256 === null) {
-    return context.json({ error: "x-devultur-sha256 must be a 64-character hex string", code: "invalid_sha256" }, 400);
-  }
-  if (multipart.sha256 && !partSha256) {
-    return context.json(
-      {
-        error: "Each part must carry its x-devultur-sha256 when the upload declares one",
-        code: "part_sha256_required"
-      },
-      400
-    );
-  }
-  if (!partSha256) return null;
-  const digest = await digestBody(body, void 0, partSha256);
-  if ("mismatch" in digest) return sha256Mismatch(context, digest.mismatch.expected, digest.mismatch.actual);
-  return null;
-}
 async function handleMultipartPost(context) {
   const key = context.req.param("key") ?? "";
   const kind = uploadRequestKindOf(context);
@@ -4753,20 +5148,8 @@ upload.post("/", async (context) => {
   if (!filename || !body.contentType) {
     return context.json({ error: "filename and contentType are required" }, 400);
   }
-  const inferredType = inferMediaType(body.contentType);
-  if (body.mediaType && inferredType && body.mediaType !== inferredType) {
-    return context.json(
-      {
-        error: `mediaType "${body.mediaType}" does not match content type ${body.contentType}`,
-        code: "media_type_mismatch"
-      },
-      400
-    );
-  }
-  const mediaType = body.mediaType ?? inferredType ?? (isAssetRequest ? MediaType2.FILE : null);
-  if (!mediaType) {
-    return context.json({ error: `Unsupported content type: ${body.contentType}` }, 400);
-  }
+  const mediaType = resolveUploadMediaType(body.mediaType, body.contentType, isAssetRequest);
+  if (isUploadTargetError(mediaType)) return targetFailure(context, mediaType);
   const scope = getRequestState(context);
   const uploadRule = scope.config?.uploadRules?.[mediaType];
   if (!isContentTypeAllowed(body.contentType, uploadRule?.accept)) {
@@ -4830,7 +5213,8 @@ upload.post("/", async (context) => {
     ...target.isAsset ? { isAsset: true, overwrite: shouldOverwrite } : {},
     ...cacheControl ? { cacheControl } : {},
     ...scope.config?.uploadMetadata ? { uploadMetadata: scope.config.uploadMetadata } : {},
-    ...lock ? { lock } : {}
+    ...lock ? { lock } : {},
+    ...scope.config?.contentSniffing ? { contentSniffing: scope.config.contentSniffing } : {}
   };
   const pendingId = newUploadPendingId();
   await context.env.MEDIA_KV.put(uploadPendingKvKey(pendingId), JSON.stringify(pending), {
@@ -4861,9 +5245,9 @@ upload.put("/:key{.+}", async (context) => {
   const maxSizeBytes = pending?.maxSizeBytes ?? null;
   const storageClass = pending?.storageClass ?? "Standard";
   const resourceSecurity = pending?.security ?? parseSecurityHeader(context.req.header(RESOURCE_SECURITY_HEADER));
-  const contentType = context.req.header("Content-Type") ?? "application/octet-stream";
-  if (expectedContentType && contentType !== expectedContentType) {
-    return context.json({ error: `Expected Content-Type ${expectedContentType}, got ${contentType}` }, 400);
+  const declaredContentType = context.req.header("Content-Type") ?? OCTET_STREAM;
+  if (expectedContentType && declaredContentType !== expectedContentType) {
+    return context.json({ error: `Expected Content-Type ${expectedContentType}, got ${declaredContentType}` }, 400);
   }
   const declaredSize = Number(context.req.header("content-length") ?? "0");
   if (maxSizeBytes != null && Number.isFinite(declaredSize) && declaredSize > maxSizeBytes) {
@@ -4884,6 +5268,9 @@ upload.put("/:key{.+}", async (context) => {
     return context.json({ error: "x-devultur-sha256 must be a 64-character hex string", code: "invalid_sha256" }, 400);
   }
   if ("mismatch" in digest) return sha256Mismatch(context, digest.mismatch.expected, digest.mismatch.actual);
+  const content = checkSinglePutContent(context, { key, pending, contentType: declaredContentType, body });
+  if ("rejected" in content) return content.rejected;
+  const { contentType } = content;
   const policy = resolveSecurity5(resourceSecurity, getRequestState(context).config?.security);
   const shouldEncrypt = shouldEncryptAtRest(policy, key);
   if (isKeysBucketMissing(shouldEncrypt, context.env)) return keysBucketMissing(context);
@@ -4923,6 +5310,315 @@ upload.put("/:key{.+}", async (context) => {
   return context.json({ key, size: body.byteLength, sha256: digest.sha256, sha256Verified: true });
 });
 
+// src/object-lock/lock-status.ts
+var VISIBILITY_SEGMENTS = /* @__PURE__ */ new Set(["public", "private"]);
+var RESERVED_SEGMENT = /__lock(?:-audit)?$/;
+function placeOfStorageKey(storageKey2, root) {
+  const segments = storageKey2.split("/");
+  if (segments.some((segment) => RESERVED_SEGMENT.test(segment))) return { kind: "reserved" };
+  if (root !== void 0) {
+    const key = storageKey2.slice(root.length);
+    const isWorkerKey = storageKey2.startsWith(root) && VISIBILITY_SEGMENTS.has(key.split("/")[0] ?? "");
+    return isWorkerKey ? { kind: "object", root, key } : { kind: "unrecognized" };
+  }
+  const first = segments.findIndex((segment) => VISIBILITY_SEGMENTS.has(segment));
+  if (first < 0) return { kind: "unrecognized" };
+  const inferredRoot = first === 0 ? "" : `${segments.slice(0, first).join("/")}/`;
+  return { kind: "object", root: inferredRoot, key: storageKey2.slice(inferredRoot.length) };
+}
+var UNRECOGNIZED_LOCK = { locked: true, hold: false, unrecognized: true };
+var VARIANTS_SEGMENT = "/__variants/";
+function retentionSubjectOf(key) {
+  const isVariant = isVariantKey(key);
+  const original = isVariant ? key.slice(0, key.indexOf(VARIANTS_SEGMENT)) : key;
+  return { subject: lockSubjectOf(original) ?? { kind: "original", key: original }, isVariant };
+}
+function toStoredObjectLock(locked, place) {
+  if (!locked) return { locked: false, hold: false };
+  const { lock, isUnreadable } = locked.state;
+  const until = untilOf(locked.state);
+  return {
+    locked: true,
+    hold: lock.hold === true,
+    ...until ? { until } : {},
+    ...lock.retention ? { mode: lock.retention.mode } : {},
+    ...isUnreadable ? { unreadable: true } : {},
+    ...locked.key === place.key ? {} : { lockedBy: `${place.root}${locked.key}` }
+  };
+}
+var LOCK_CACHE_MAX_USES = 50;
+var LOCK_CACHE_MAX_AGE_MS = 5e3;
+function lockResolver(mediaBucket, now) {
+  const cache = /* @__PURE__ */ new Map();
+  const resolveSubject = (root, subject) => {
+    const id = `${root}\0${subject.kind === "original" ? subject.key : subject.rawPrefix}`;
+    const cached = cache.get(id);
+    const isFresh = cached && cached.uses < LOCK_CACHE_MAX_USES && Date.now() - cached.readAt < LOCK_CACHE_MAX_AGE_MS;
+    if (cached && isFresh) {
+      cached.uses += 1;
+      return cached.pending;
+    }
+    const pending = findLockedOriginal(mediaBucket, root, subject, now);
+    pending.catch(() => cache.delete(id));
+    cache.set(id, { pending, readAt: Date.now(), uses: 1 });
+    return pending;
+  };
+  return async (place, object) => {
+    const { subject, isVariant } = retentionSubjectOf(place.key);
+    if (subject.kind === "original" && subject.key === place.key) {
+      return lockedObject(mediaBucket, place.root, place.key, object, now);
+    }
+    const locked = await resolveSubject(place.root, subject);
+    if (isVariant && subject.kind === "original" && locked && !protectsDerived(locked.state)) return null;
+    return locked;
+  };
+}
+async function readObjectLock(options, storageKey2) {
+  const place = placeOfStorageKey(storageKey2, options.root);
+  if (place.kind === "reserved") return null;
+  const object = await options.mediaBucket.head(storageKey2);
+  if (!object) return null;
+  if (place.kind === "unrecognized") return UNRECOGNIZED_LOCK;
+  const locked = await lockResolver(options.mediaBucket, options.now ?? /* @__PURE__ */ new Date())(place, object);
+  return toStoredObjectLock(locked, place);
+}
+
+// src/object-lock/prefix-walk.ts
+var DEFAULT_MAX_SUBREQUESTS = 40;
+var DEFAULT_BATCH_SIZE = 100;
+var MAX_BATCH_SIZE = 1e3;
+var BudgetExhausted = class extends Error {
+  constructor() {
+    super("subrequest budget exhausted");
+  }
+};
+function subrequestBudget(max) {
+  if (!Number.isInteger(max) || max < 1) throw new RangeError("maxSubrequests must be a positive integer");
+  let used = 0;
+  return {
+    get used() {
+      return used;
+    },
+    canAfford: (count) => used + count <= max,
+    track: (bucket) => new Proxy(bucket, {
+      get(target, property) {
+        const value = Reflect.get(target, property);
+        if (typeof value !== "function") return value;
+        return (...args) => {
+          if (used >= max) throw new BudgetExhausted();
+          used += 1;
+          return value.apply(target, args);
+        };
+      }
+    })
+  };
+}
+function encodeCursor(prefix, cursor) {
+  return btoa(JSON.stringify({ prefix, ...cursor }));
+}
+var VIDEO_FOLDER_SHAPE = /^(?:public|private)\/video\/[^/]+$/;
+function invalidCursor(reason) {
+  throw new RangeError(`cursor isn't one this function returned for this prefix: ${reason}`);
+}
+function parseCursor(cursor) {
+  try {
+    const parsed = JSON.parse(atob(cursor));
+    if (typeof parsed === "object" && parsed !== null && !Array.isArray(parsed))
+      return parsed;
+  } catch {
+  }
+  return invalidCursor("not a cursor");
+}
+var isOptionalString = (value) => value === void 0 || typeof value === "string";
+function validFolder(value, options) {
+  if (value === void 0) return void 0;
+  const { root, folder } = typeof value === "object" && value !== null ? value : {};
+  if (typeof root !== "string" || typeof folder !== "string" || !VIDEO_FOLDER_SHAPE.test(folder)) {
+    return invalidCursor("folder");
+  }
+  const folderPrefix = `${root}${folder}/`;
+  const place = placeOfStorageKey(`${folderPrefix}x`, options.root);
+  const isPlaced = place.kind === "object" && place.root === root;
+  if (!isPlaced || !folderPrefix.startsWith(options.prefix)) return invalidCursor("folder outside the prefix");
+  return { root, folder };
+}
+function decodeCursor(cursor, options) {
+  if (cursor === void 0) return {};
+  const { prefix, after, listCursor, folder } = parseCursor(cursor);
+  if (prefix !== options.prefix) return invalidCursor("another prefix");
+  if (!isOptionalString(after) || !isOptionalString(listCursor)) return invalidCursor("position");
+  if (typeof after === "string" && !after.startsWith(options.prefix))
+    return invalidCursor("position outside the prefix");
+  const pendingFolder = validFolder(folder, options);
+  return {
+    ...typeof after === "string" ? { after } : {},
+    ...typeof listCursor === "string" ? { listCursor } : {},
+    ...pendingFolder ? { folder: pendingFolder } : {}
+  };
+}
+async function walkPrefix(options, mediaBucket, start, visit) {
+  const limit = Math.min(Math.max(1, Math.floor(options.batchSize ?? DEFAULT_BATCH_SIZE)), MAX_BATCH_SIZE);
+  let position = { ...start };
+  let hasProgressed = false;
+  const stopped = () => ({ position, isDone: false, hasProgressed });
+  for (; ; ) {
+    let listing;
+    try {
+      listing = await mediaBucket.list({ prefix: options.prefix, limit, ...listFrom(position) });
+    } catch (error) {
+      if (error instanceof BudgetExhausted) return stopped();
+      throw error;
+    }
+    const stray = listing.objects.find((listed) => !listed.key.startsWith(options.prefix));
+    if (stray) throw new RangeError(`listing returned ${stray.key}, outside the prefix ${options.prefix}`);
+    for (const listed of listing.objects) {
+      try {
+        await visit({ listed, place: placeOfStorageKey(listed.key, options.root) });
+      } catch (error) {
+        if (error instanceof BudgetExhausted) return stopped();
+        throw error;
+      }
+      position = { after: listed.key };
+      hasProgressed = true;
+    }
+    if (!listing.truncated) return { position, isDone: true, hasProgressed };
+    if (listing.objects.length > 0) continue;
+    position = { ...position, listCursor: listing.cursor };
+    hasProgressed = true;
+  }
+}
+function listFrom(position) {
+  if (position.listCursor) return { cursor: position.listCursor };
+  return position.after ? { startAfter: position.after } : {};
+}
+function assertProgress(hasProgressed) {
+  if (hasProgressed) return;
+  throw new RangeError("maxSubrequests is too small to finish the next object: raise it");
+}
+
+// src/object-lock/prefix-delete.ts
+var VIDEO_FOLDER = /^((?:public|private)\/video\/[^/]+)\//;
+var isPending = (folder) => folder?.hasDeleted === true && !folder.hasRetained;
+async function deletePrefixRespectingLocks(options) {
+  const startedAt = /* @__PURE__ */ new Date();
+  const budget = subrequestBudget(options.maxSubrequests ?? DEFAULT_MAX_SUBREQUESTS);
+  const mediaBucket = budget.track(options.mediaBucket);
+  const keysBucket = options.keysBucket ? budget.track(options.keysBucket) : void 0;
+  const resolveLock3 = lockResolver(mediaBucket, startedAt);
+  const start = decodeCursor(options.cursor, options);
+  const result = {
+    deletedCount: 0,
+    deletedBytes: 0,
+    deletedKeyCount: 0,
+    retainedCount: 0,
+    retainedBytes: 0,
+    retained: [],
+    skippedCount: 0,
+    subrequests: 0
+  };
+  let openFolder = start.folder ? { ...start.folder, hasDeleted: true, hasRetained: false } : null;
+  let hasClosed = false;
+  const closeFolder = async () => {
+    if (isPending(openFolder)) {
+      const { root, folder } = openFolder;
+      const folderPrefix = `${root}${folder}/`;
+      const remaining = await mediaBucket.list({ prefix: folderPrefix, limit: 1 });
+      if (remaining.objects.length === 0) {
+        if (keysBucket) {
+          const keys = await keysWrittenBy(keysBucket, folderPrefix, startedAt);
+          result.deletedKeyCount += await deleteKeys(keysBucket, keys);
+        }
+        await forgetTranscodeCompleted(mediaBucket, root, folder);
+      }
+      hasClosed = true;
+    }
+    openFolder = null;
+  };
+  const enterFolder = async (place) => {
+    const videoFolder = VIDEO_FOLDER.exec(place.key)?.[1];
+    const folder = videoFolder && `${place.root}${videoFolder}/`.startsWith(options.prefix) ? videoFolder : void 0;
+    if (openFolder && openFolder.root === place.root && openFolder.folder === folder) return openFolder;
+    await closeFolder();
+    openFolder = folder ? { root: place.root, folder, hasDeleted: false, hasRetained: false } : null;
+    return openFolder;
+  };
+  const retain = (key, size, lock) => {
+    result.retained.push({ key, size, ...lock });
+    result.retainedCount += 1;
+    result.retainedBytes += size;
+  };
+  const visit = async ({ listed, place }) => {
+    if (place.kind === "reserved") {
+      result.skippedCount += 1;
+      return;
+    }
+    if (place.kind === "unrecognized") return retain(listed.key, listed.size, UNRECOGNIZED_LOCK);
+    const folder = await enterFolder(place);
+    const object = await mediaBucket.head(listed.key);
+    if (!object) return;
+    const locked = await resolveLock3(place, object);
+    if (locked) {
+      if (folder) folder.hasRetained = true;
+      return retain(listed.key, object.size, toStoredObjectLock(locked, place));
+    }
+    const keys = keysBucket ? await objectKeysToDelete(keysBucket, listed.key, object) : [];
+    if (!budget.canAfford(1 + deleteCallsFor(keys))) throw new BudgetExhausted();
+    await mediaBucket.delete(listed.key);
+    result.deletedCount += 1;
+    result.deletedBytes += object.size;
+    if (folder) folder.hasDeleted = true;
+    if (keysBucket) result.deletedKeyCount += await deleteKeys(keysBucket, keys);
+  };
+  const walk = await walkPrefix(options, mediaBucket, start, visit);
+  if (walk.isDone) {
+    try {
+      await closeFolder();
+    } catch (error) {
+      if (!(error instanceof BudgetExhausted)) throw error;
+    }
+  }
+  const pendingFolder = isPending(openFolder) ? { root: openFolder.root, folder: openFolder.folder } : void 0;
+  const isFinished = walk.isDone && !pendingFolder;
+  assertProgress(walk.hasProgressed || hasClosed || isFinished);
+  const cursor = isFinished ? void 0 : encodeCursor(options.prefix, { ...walk.position, ...pendingFolder ? { folder: pendingFolder } : {} });
+  return { ...result, ...cursor ? { cursor } : {}, subrequests: budget.used };
+}
+
+// src/object-lock/retained-summary.ts
+async function retainedSummary(options) {
+  const budget = subrequestBudget(options.maxSubrequests ?? DEFAULT_MAX_SUBREQUESTS);
+  const mediaBucket = budget.track(options.mediaBucket);
+  const resolveLock3 = lockResolver(mediaBucket, options.now ?? /* @__PURE__ */ new Date());
+  const summary = {
+    scannedCount: 0,
+    retainedCount: 0,
+    retainedBytes: 0,
+    hasHold: false,
+    subrequests: 0
+  };
+  const visit = async ({ listed, place }) => {
+    if (place.kind === "reserved") return;
+    let lock = UNRECOGNIZED_LOCK;
+    let size = listed.size;
+    if (place.kind === "object") {
+      const object = await mediaBucket.head(listed.key);
+      if (!object) return;
+      lock = toStoredObjectLock(await resolveLock3(place, object), place);
+      size = object.size;
+    }
+    summary.scannedCount += 1;
+    if (!lock.locked) return;
+    summary.retainedCount += 1;
+    summary.retainedBytes += size;
+    if (lock.hold) summary.hasHold = true;
+    if (lock.until && (!summary.latestUntil || lock.until > summary.latestUntil)) summary.latestUntil = lock.until;
+  };
+  const walk = await walkPrefix(options, mediaBucket, decodeCursor(options.cursor, options), visit);
+  assertProgress(walk.hasProgressed || walk.isDone);
+  const cursor = walk.isDone ? void 0 : encodeCursor(options.prefix, walk.position);
+  return { ...summary, ...cursor ? { cursor } : {}, subrequests: budget.used };
+}
+
 // src/index.ts
 function createWorker(options) {
   const { middleware, routes, hooks } = composePlugins(options?.plugins ?? defaultPlugins());
@@ -4985,6 +5681,7 @@ export {
   credentialPolicy,
   defaultPlugins,
   deletePrefix,
+  deletePrefixRespectingLocks,
   downloadLinks,
   edgeCacheTag,
   getPendingUpload,
@@ -5003,10 +5700,12 @@ export {
   parseEncodeMetrics,
   parseTransformParams,
   readImageOriginScope,
+  readObjectLock,
   readStoryboardKey,
   readTokenScopes,
   readTranscodeOutputKeys,
   readTranscodeOutputs,
+  retainedSummary,
   servedCacheControl,
   staticConfig,
   storageKey,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@devultur/self-host",
-  "version": "1.1.0",
+  "version": "1.3.0",
   "description": "Self-hosted media Worker for Cloudflare: R2 uploads, edge-cached delivery, image transforms, HLS transcode and captions",
   "keywords": [
     "cloudflare-workers",
@@ -46,7 +46,7 @@
     "@jsquash/resize": "2.1.1",
     "@jsquash/webp": "1.5.0",
     "hono": "^4.7.0",
-    "@devultur/core": "1.1.0"
+    "@devultur/core": "1.3.0"
   },
   "devDependencies": {
     "@cf-wasm/photon": "0.4.0",