@jini-ai/cms 0.1.0

package/dist/media/media-service.d.ts

@@ -0,0 +1,244 @@
+import type { ClockPort, IdGeneratorPort, UUID } from "../core/ports.js";
+import { MediaConflictError, MediaNotFoundError, MediaSourceImmutableError, MediaStillReferencedError, MediaValidationError, type MediaRecord, type MediaSource } from "./types.js";
+import type { AssetBlobRepoPort, AssetRenditionRepoPort, BlobStorePort, MediaRepoPort } from "./ports.js";
+export { MediaConflictError, MediaNotFoundError, MediaSourceImmutableError, MediaStillReferencedError, MediaValidationError, };
+/** Default byte-size cap (this pass's stand-in for the real ingress policy's streaming cap). */
+export declare const DEFAULT_MAX_UPLOAD_BYTES: number;
+/**
+ * Advisory MIME allowlist. SVG is deliberately EXCLUDED (not "TODO, forgot") —
+ * SVG must be sanitized at ingest before it's safe to store;
+ * that sanitizer is not built in this pass, so SVG upload is rejected rather
+ * than accepted unsanitized.
+ *
+ * `video/mp4`/`video/webm` (owner-directed, 2026-08-24): the two formats
+ * `content-type-sniffer.ts` already recognizes by magic bytes. Unlike the four
+ * image types above, an accepted video is never re-encoded — there is no
+ * `TransformFormat` for video (`transform-types.ts`'s union is image-only), so
+ * a video asset's public URL bypasses the transform/rendition pipeline
+ * entirely and serves the original bytes as-is (host concern; see Tovu's
+ * `routes/site/media-rendition.ts`). This widens the SAME advisory,
+ * client-declared-string check item 4 above already discloses as untrusted —
+ * no new ingress hardening was added for video.
+ */
+export declare const DEFAULT_ALLOWED_MIME_TYPES: ReadonlySet<string>;
+/**
+ * Enforces the "settable-once-from-absent" write-once rule for
+ * `source.sha256`: absent -> set exactly once, then immutable.
+ *
+ * Not currently reachable through any exposed write path — `uploadMedia` only
+ * ever calls it with `existing = undefined` (a brand-new row), and
+ * `UpdateMediaMetadataInput` has no `sha256` field at all, so
+ * `updateMediaMetadata` can't trigger the rejection branch even by accident.
+ * Kept as an explicit, directly-testable invariant (see
+ * `__tests__/media-service.test.ts`) rather than an implicit one enforced only
+ * by "the type doesn't have the field" — and it's the seam any future
+ * "replace source" operation would have to go through.
+ *
+ * @complexity O(1).
+ * @overallScore 100
+ */
+export declare function resolveWriteOnceSource(required: {
+    existing: MediaSource | undefined;
+    requestedSha256: string;
+}, _optional?: Record<string, never>): MediaSource;
+export interface UploadMediaInput {
+    workspaceId: UUID;
+    bytes: Uint8Array;
+    filename: string;
+    contentType: string;
+    alt?: string | undefined;
+    caption?: string | undefined;
+    credit?: string | undefined;
+    /** Attributed on the `asset_blobs` row (required attribution). */
+    createdByPrincipal: string;
+}
+export interface UploadMediaDeps {
+    clock: ClockPort;
+    idGen: IdGeneratorPort;
+    mediaRepo: MediaRepoPort;
+    blobRepo: AssetBlobRepoPort;
+    renditionRepo: AssetRenditionRepoPort;
+    blobStore: BlobStorePort;
+}
+export interface UploadMediaRequired {
+    deps: UploadMediaDeps;
+    input: UploadMediaInput;
+}
+export interface UploadMediaOptional {
+    maxUploadBytes?: number | undefined;
+    allowedMimeTypes?: ReadonlySet<string> | undefined;
+}
+/**
+ * Validates, hashes, dedups by `(workspaceId, sha256)`, and writes a new media
+ * asset. Ordering (INV-1a): bytes are written (or found already
+ * present via dedup) BEFORE the media row is saved — a media row never exists
+ * without corresponding bytes.
+ *
+ * Blob dedup is per-hash, not per-upload: uploading the same bytes twice
+ * always creates two `MediaRecord`s (two distinct library entries, matching
+ * common CMS behavior) but writes the blob bytes only once. The dedup
+ * check-then-act sequence runs inside {@link withSha256Lock} (`blob-gc-lock.ts`)
+ * so it can't interleave with a concurrent `blob-gc.ts` delete-pass on the
+ * same sha256 (the "Serialization" invariant). If the existing blob row
+ * is `tombstoned` (a pending GC candidate), this resurrects it back to
+ * `active` in the same locked section instead of writing a duplicate blob —
+ * the dedup rule's explicit resurrect case.
+ *
+ * @complexity O(1) — one hash, one blob lookup, at most one blob write, one
+ * media write, one rendition write (the lock itself adds O(1) scheduling
+ * overhead, not a scan).
+ * @overallScore 100
+ */
+export declare function uploadMedia(required: UploadMediaRequired, optional?: UploadMediaOptional): Promise<{
+    media: MediaRecord;
+}>;
+export interface ListMediaRequired {
+    deps: {
+        mediaRepo: MediaRepoPort;
+    };
+    input: {
+        workspaceId: UUID;
+    };
+}
+/**
+ * Lists all media in a workspace (all statuses — active + trashed; admin sees
+ * everything, mirrors an admin post listing). Purged assets are absent by
+ * construction (`purgeMedia` removes the row), not filtered here.
+ *
+ * @complexity O(1) repo call; the returned array is bounded by the
+ * workspace's media row count (repo-dependent — no pagination cap added in
+ * this pass, acceptable at walking-skeleton scale).
+ * @overallScore 100
+ */
+export declare function listMedia(required: ListMediaRequired, _optional?: Record<string, never>): Promise<{
+    media: MediaRecord[];
+}>;
+export interface GetMediaByIdRequired {
+    deps: {
+        mediaRepo: MediaRepoPort;
+    };
+    input: {
+        workspaceId: UUID;
+        id: UUID;
+    };
+}
+/**
+ * Fetches one media asset by id, scoped to its workspace.
+ *
+ * @complexity O(1).
+ * @overallScore 100
+ */
+export declare function getMediaById(required: GetMediaByIdRequired, _optional?: Record<string, never>): Promise<{
+    media: MediaRecord;
+}>;
+export interface UpdateMediaMetadataInput {
+    workspaceId: UUID;
+    id: UUID;
+    title?: string | undefined;
+    alt?: string | undefined;
+    caption?: string | undefined;
+    credit?: string | undefined;
+    /**
+     * Quick-and-dirty sizing override fields (see `MediaRecord.width`/`height`/`cssClass` doc).
+     * `undefined` (the key omitted, or explicitly `undefined`) leaves the stored value unchanged —
+     * same optional-field/partial-patch contract every other field on this input already has.
+     * `null` explicitly CLEARS a previously-set override back to "not set". A provided number must be
+     * a positive integer (rejected with `MediaValidationError` otherwise) — this is public HTML output
+     * sizing, not a field worth silently coercing.
+     */
+    width?: number | null | undefined;
+    height?: number | null | undefined;
+    /** Same undefined/null/value contract as `width`/`height` above. A non-empty string is trimmed;
+     *  a string that trims to empty is stored as `null` (equivalent to clearing it), matching the
+     *  "empty means unset" convention `title`/`alt`/etc. already follow via `.trim()`. */
+    cssClass?: string | null | undefined;
+}
+export interface UpdateMediaMetadataDeps {
+    clock: ClockPort;
+    mediaRepo: MediaRepoPort;
+}
+export interface UpdateMediaMetadataRequired {
+    deps: UpdateMediaMetadataDeps;
+    input: UpdateMediaMetadataInput;
+}
+export declare function updateMediaMetadata(required: UpdateMediaMetadataRequired, _optional?: Record<string, never>): Promise<{
+    media: MediaRecord;
+}>;
+export interface TrashMediaDeps {
+    clock: ClockPort;
+    mediaRepo: MediaRepoPort;
+}
+export interface TrashMediaRequired {
+    deps: TrashMediaDeps;
+    input: {
+        workspaceId: UUID;
+        id: UUID;
+    };
+}
+/**
+ * Soft delete. Idempotent — trashing an already-trashed asset is a no-op
+ * (mirrors `disableMember`'s idempotency), not an error.
+ *
+ * @complexity O(1).
+ * @overallScore 100
+ */
+export declare function trashMedia(required: TrashMediaRequired, _optional?: Record<string, never>): Promise<{
+    media: MediaRecord;
+}>;
+export interface PurgeMediaDeps {
+    mediaRepo: MediaRepoPort;
+    blobRepo: AssetBlobRepoPort;
+    renditionRepo: AssetRenditionRepoPort;
+    blobStore: BlobStorePort;
+    /**
+     * Optional — only used to timestamp the blob-GC tombstone-pass this
+     * function triggers after the media row is removed (`tombstoneBlobIfUnreferenced`,
+     * `blob-gc.ts`). Falls back to the system clock when omitted so a caller
+     * that doesn't wire a clock into `PurgeMediaDeps` keeps compiling and
+     * behaving correctly unchanged.
+     */
+    clock?: ClockPort | undefined;
+}
+export interface PurgeMediaRequired {
+    deps: PurgeMediaDeps;
+    input: {
+        workspaceId: UUID;
+        id: UUID;
+    };
+}
+/**
+ * Hard delete. Deletion ladder (mirrors `deleteMenu`): purge is
+ * rejected with `MediaStillReferencedError` (409-style) unless the asset has
+ * already been trashed first.
+ *
+ * SIMPLIFICATION (disclosed): the real design's guard checks the derived
+ * `entry_refs` where-used index (any live reference from published content).
+ * That index doesn't exist — posts don't reference media by id in `bodyJson`
+ * yet — so this build uses "not yet trashed" as the stand-in referenced-check.
+ * This is strictly weaker than the real invariant: a media asset that IS
+ * trashed but still referenced by a post would purge here without complaint,
+ * whereas the real system would keep blocking it. Do not read this function's
+ * 409 as evidence the where-used index exists.
+ *
+ * Once past the guard: rendition rows are removed, then the media row is
+ * removed. After that removal commits, the blob-GC tombstone-pass
+ * (`tombstoneBlobIfUnreferenced`, `blob-gc.ts`) runs for the asset's sha256 —
+ * it marks the blob `tombstoned` if-and-only-if the real "unreferenced"
+ * predicate holds (no other non-purged media row shares the hash, plus the
+ * disclosed `entry_refs`/retained-snapshot stubs). This function does **not**
+ * delete blob bytes itself anymore: the delete-pass (`runBlobGcDeletePass`)
+ * is grace-period-gated (`gc_grace`, default 30 days) and the unlink-pass
+ * (`runBlobGcUnlinkPass`) that actually removes bytes runs as a separate,
+ * explicit step — nothing schedules either automatically yet (see
+ * `blob-gc.ts`'s file header). This is a real behavior change from this
+ * function's prior "delete row, best-effort unlink immediately" shortcut,
+ * which is exactly the gap this task closes.
+ *
+ * @complexity O(n) in the workspace's media row count, inherited from the
+ * tombstone-pass's `isBlobUnreferenced` scan (see `blob-gc.ts`).
+ * @overallScore 100
+ */
+export declare function purgeMedia(required: PurgeMediaRequired, _optional?: Record<string, never>): Promise<{
+    purged: true;
+}>;
+//# sourceMappingURL=media-service.d.ts.map

package/dist/media/media-service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"media-service.d.ts","sourceRoot":"","sources":["../../src/media/media-service.ts"],"names":[],"mappings":"AAsDA,OAAO,KAAK,EAAE,SAAS,EAAE,eAAe,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AACzE,OAAO,EACL,kBAAkB,EAClB,kBAAkB,EAClB,yBAAyB,EACzB,yBAAyB,EACzB,oBAAoB,EACpB,KAAK,WAAW,EAChB,KAAK,WAAW,EAEjB,MAAM,YAAY,CAAC;AACpB,OAAO,KAAK,EAAE,iBAAiB,EAAE,sBAAsB,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAI1G,OAAO,EACL,kBAAkB,EAClB,kBAAkB,EAClB,yBAAyB,EACzB,yBAAyB,EACzB,oBAAoB,GACrB,CAAC;AAEF,gGAAgG;AAChG,eAAO,MAAM,wBAAwB,QAAmB,CAAC;AAEzD;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,0BAA0B,EAAE,WAAW,CAAC,MAAM,CAOzD,CAAC;AAEH;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,sBAAsB,CACpC,QAAQ,EAAE;IAAE,QAAQ,EAAE,WAAW,GAAG,SAAS,CAAC;IAAC,eAAe,EAAE,MAAM,CAAA;CAAE,EACxE,SAAS,GAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAM,GACpC,WAAW,CAQb;AAWD,MAAM,WAAW,gBAAgB;IAC/B,WAAW,EAAE,IAAI,CAAC;IAClB,KAAK,EAAE,UAAU,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzB,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7B,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5B,kEAAkE;IAClE,kBAAkB,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,SAAS,CAAC;IACjB,KAAK,EAAE,eAAe,CAAC;IACvB,SAAS,EAAE,aAAa,CAAC;IACzB,QAAQ,EAAE,iBAAiB,CAAC;IAC5B,aAAa,EAAE,sBAAsB,CAAC;IACtC,SAAS,EAAE,aAAa,CAAC;CAC1B;AAED,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,eAAe,CAAC;IACtB,KAAK,EAAE,gBAAgB,CAAC;CACzB;AAED,MAAM,WAAW,mBAAmB;IAClC,cAAc,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,gBAAgB,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,GAAG,SAAS,CAAC;CACpD;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAsB,WAAW,CAC/B,QAAQ,EAAE,mBAAmB,EAC7B,QAAQ,GAAE,mBAAwB,GACjC,OAAO,CAAC;IAAE,KAAK,EAAE,WAAW,CAAA;CAAE,CAAC,CAiFjC;AAMD,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE;QAAE,SAAS,EAAE,aAAa,CAAA;KAAE,CAAC;IACnC,KAAK,EAAE;QAAE,WAAW,EAAE,IAAI,CAAA;KAAE,CAAC;CAC9B;AAED;;;;;;;;;GASG;AACH,wBAAsB,SAAS,CAC7B,QAAQ,EAAE,iBAAiB,EAC3B,SAAS,GAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAM,GACpC,OAAO,CAAC;IAAE,KAAK,EAAE,WAAW,EAAE,CAAA;CAAE,CAAC,CAGnC;AAED,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE;QAAE,SAAS,EAAE,aAAa,CAAA;KAAE,CAAC;IACnC,KAAK,EAAE;QAAE,WAAW,EAAE,IAAI,CAAC;QAAC,EAAE,EAAE,IAAI,CAAA;KAAE,CAAC;CACxC;AAED;;;;;GAKG;AACH,wBAAsB,YAAY,CAChC,QAAQ,EAAE,oBAAoB,EAC9B,SAAS,GAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAM,GACpC,OAAO,CAAC;IAAE,KAAK,EAAE,WAAW,CAAA;CAAE,CAAC,CAKjC;AAMD,MAAM,WAAW,wBAAwB;IACvC,WAAW,EAAE,IAAI,CAAC;IAClB,EAAE,EAAE,IAAI,CAAC;IACT,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3B,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzB,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7B,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5B;;;;;;;OAOG;IACH,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;IAClC,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;IACnC;;0FAEsF;IACtF,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;CACtC;AAED,MAAM,WAAW,uBAAuB;IACtC,KAAK,EAAE,SAAS,CAAC;IACjB,SAAS,EAAE,aAAa,CAAC;CAC1B;AAED,MAAM,WAAW,2BAA2B;IAC1C,IAAI,EAAE,uBAAuB,CAAC;IAC9B,KAAK,EAAE,wBAAwB,CAAC;CACjC;AAmBD,wBAAsB,mBAAmB,CACvC,QAAQ,EAAE,2BAA2B,EACrC,SAAS,GAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAM,GACpC,OAAO,CAAC;IAAE,KAAK,EAAE,WAAW,CAAA;CAAE,CAAC,CAsBjC;AAMD,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,SAAS,CAAC;IACjB,SAAS,EAAE,aAAa,CAAC;CAC1B;AAED,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,cAAc,CAAC;IACrB,KAAK,EAAE;QAAE,WAAW,EAAE,IAAI,CAAC;QAAC,EAAE,EAAE,IAAI,CAAA;KAAE,CAAC;CACxC;AAED;;;;;;GAMG;AACH,wBAAsB,UAAU,CAC9B,QAAQ,EAAE,kBAAkB,EAC5B,SAAS,GAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAM,GACpC,OAAO,CAAC;IAAE,KAAK,EAAE,WAAW,CAAA;CAAE,CAAC,CAcjC;AAED,MAAM,WAAW,cAAc;IAC7B,SAAS,EAAE,aAAa,CAAC;IACzB,QAAQ,EAAE,iBAAiB,CAAC;IAC5B,aAAa,EAAE,sBAAsB,CAAC;IACtC,SAAS,EAAE,aAAa,CAAC;IACzB;;;;;;OAMG;IACH,KAAK,CAAC,EAAE,SAAS,GAAG,SAAS,CAAC;CAC/B;AAED,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,cAAc,CAAC;IACrB,KAAK,EAAE;QAAE,WAAW,EAAE,IAAI,CAAC;QAAC,EAAE,EAAE,IAAI,CAAA;KAAE,CAAC;CACxC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,wBAAsB,UAAU,CAC9B,QAAQ,EAAE,kBAAkB,EAC5B,SAAS,GAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAM,GACpC,OAAO,CAAC;IAAE,MAAM,EAAE,IAAI,CAAA;CAAE,CAAC,CAyB3B"}

package/dist/media/media-service.js

@@ -0,0 +1,345 @@
+/**
+ * @file `media` write/read service — walking-skeleton build.
+ *
+ * Mirrors a `post`-style feature's shape: plain async functions taking
+ * `{ deps, input }` (+ an optional second `options` object), typed domain
+ * errors from `./types`.
+ *
+ * SCOPE — what this file deliberately does NOT build (disclosed, not silently
+ * skipped; each deferred piece is named below):
+ *
+ *  1. **Blob GC** — now built for real (`blob-gc.ts`): a journaled,
+ *     `withSha256Lock`-serialized tombstone -> delete-pass -> unlink-pass
+ *     protocol with `gc_grace` retention. `purgeMedia` below no longer
+ *     deletes blob bytes itself — after removing the media row it only
+ *     triggers the tombstone-pass (`tombstoneBlobIfUnreferenced`); actual
+ *     byte removal is deferred to `runBlobGcDeletePass` +
+ *     `runBlobGcUnlinkPass` (or the `runBlobGcCycle` convenience wrapper),
+ *     which nothing schedules automatically yet (no scheduler exists — see
+ *     `blob-gc.ts`'s file header). `uploadMedia`'s dedup check is likewise
+ *     serialized per-sha256 and resurrects a tombstoned blob instead of
+ *     writing a duplicate. See `blob-gc.ts` for what's still
+ *     disclosed-stubbed within that protocol (`entry_refs`, retained
+ *     snapshots, the monthly orphan sweep).
+ *  2. **Named transform registry / real image processing** — the only
+ *     rendition this build ever creates is a trivial "original" passthrough
+ *     row that points at the source blob (created by `uploadMedia`). No
+ *     `transform_registry` table, no eager/lazy generation, no
+ *     `/m/{assetId}/{transformName}.v{version}/{slug}.{ext}` URL contract.
+ *  3. **Origin-isolated serving** — a host may add an authenticated,
+ *     workspace-scoped admin route that serves original bytes, with content
+ *     type derived at serve time by `content-type-sniffer.ts` rather than
+ *     trusted from upload, since no real content type is stored anywhere —
+ *     that route's own security model is a host concern. What is still NOT
+ *     built, per the full design: a second, cookie-less media
+ *     origin/process, and signed mint-URLs (a `media.download_original`
+ *     permission would reserve that capability for a future route).
+ *     `Content-Disposition` rules DO now exist, but only the one such a route
+ *     needs (forcing `attachment` when the sniffed bytes are HTML/SVG-shaped).
+ *  4. **`MediaIngressPolicy`** — no SSRF guards, IP pinning, redirect
+ *     handling, pixel-bomb caps, or magic-byte sniffing. Only a byte-size cap
+ *     and an advisory `contentType` allowlist (see `DEFAULT_ALLOWED_MIME_TYPES`
+ *     below) — an attacker-controlled `contentType` header is trusted, which
+ *     the real ingress policy would never do.
+ *  5. **Where-used / `entry_refs`** — no real index exists because posts don't
+ *     reference media by id in `bodyJson` yet. `purgeMedia`'s 409 guard uses
+ *     "not yet trashed" as a stand-in for "referenced" (see its doc comment).
+ *  6. Virus scanning, remote-URL upload, video pipeline, S3 adapter — all
+ *     explicitly deferred by design.
+ *
+ * See `types.ts`'s file header for the other disclosed scope adjustment: the
+ * bespoke `MediaRecord` table in place of a generic-entries model.
+ */
+import { createHash } from "node:crypto";
+import { MediaConflictError, MediaNotFoundError, MediaSourceImmutableError, MediaStillReferencedError, MediaValidationError, } from "./types.js";
+import { withSha256Lock } from "./blob-gc-lock.js";
+import { tombstoneBlobIfUnreferenced } from "./blob-gc.js";
+export { MediaConflictError, MediaNotFoundError, MediaSourceImmutableError, MediaStillReferencedError, MediaValidationError, };
+/** Default byte-size cap (this pass's stand-in for the real ingress policy's streaming cap). */
+export const DEFAULT_MAX_UPLOAD_BYTES = 10 * 1024 * 1024; // 10 MiB
+/**
+ * Advisory MIME allowlist. SVG is deliberately EXCLUDED (not "TODO, forgot") —
+ * SVG must be sanitized at ingest before it's safe to store;
+ * that sanitizer is not built in this pass, so SVG upload is rejected rather
+ * than accepted unsanitized.
+ *
+ * `video/mp4`/`video/webm` (owner-directed, 2026-08-24): the two formats
+ * `content-type-sniffer.ts` already recognizes by magic bytes. Unlike the four
+ * image types above, an accepted video is never re-encoded — there is no
+ * `TransformFormat` for video (`transform-types.ts`'s union is image-only), so
+ * a video asset's public URL bypasses the transform/rendition pipeline
+ * entirely and serves the original bytes as-is (host concern; see Tovu's
+ * `routes/site/media-rendition.ts`). This widens the SAME advisory,
+ * client-declared-string check item 4 above already discloses as untrusted —
+ * no new ingress hardening was added for video.
+ */
+export const DEFAULT_ALLOWED_MIME_TYPES = new Set([
+    "image/jpeg",
+    "image/png",
+    "image/webp",
+    "image/gif",
+    "video/mp4",
+    "video/webm",
+]);
+/**
+ * Enforces the "settable-once-from-absent" write-once rule for
+ * `source.sha256`: absent -> set exactly once, then immutable.
+ *
+ * Not currently reachable through any exposed write path — `uploadMedia` only
+ * ever calls it with `existing = undefined` (a brand-new row), and
+ * `UpdateMediaMetadataInput` has no `sha256` field at all, so
+ * `updateMediaMetadata` can't trigger the rejection branch even by accident.
+ * Kept as an explicit, directly-testable invariant (see
+ * `__tests__/media-service.test.ts`) rather than an implicit one enforced only
+ * by "the type doesn't have the field" — and it's the seam any future
+ * "replace source" operation would have to go through.
+ *
+ * @complexity O(1).
+ * @overallScore 100
+ */
+export function resolveWriteOnceSource(required, _optional = {}) {
+    const { existing, requestedSha256 } = required;
+    if (existing && existing.sha256 !== requestedSha256) {
+        throw new MediaSourceImmutableError(`source.sha256 is write-once: cannot change '${existing.sha256}' to '${requestedSha256}'`);
+    }
+    return { sha256: requestedSha256 };
+}
+function deriveTitleFromFilename(filename) {
+    const base = filename.trim().replace(/\.[^./\\]+$/, "");
+    return base.trim() || "Untitled";
+}
+/**
+ * Validates, hashes, dedups by `(workspaceId, sha256)`, and writes a new media
+ * asset. Ordering (INV-1a): bytes are written (or found already
+ * present via dedup) BEFORE the media row is saved — a media row never exists
+ * without corresponding bytes.
+ *
+ * Blob dedup is per-hash, not per-upload: uploading the same bytes twice
+ * always creates two `MediaRecord`s (two distinct library entries, matching
+ * common CMS behavior) but writes the blob bytes only once. The dedup
+ * check-then-act sequence runs inside {@link withSha256Lock} (`blob-gc-lock.ts`)
+ * so it can't interleave with a concurrent `blob-gc.ts` delete-pass on the
+ * same sha256 (the "Serialization" invariant). If the existing blob row
+ * is `tombstoned` (a pending GC candidate), this resurrects it back to
+ * `active` in the same locked section instead of writing a duplicate blob —
+ * the dedup rule's explicit resurrect case.
+ *
+ * @complexity O(1) — one hash, one blob lookup, at most one blob write, one
+ * media write, one rendition write (the lock itself adds O(1) scheduling
+ * overhead, not a scan).
+ * @overallScore 100
+ */
+export async function uploadMedia(required, optional = {}) {
+    const { deps, input } = required;
+    const maxUploadBytes = optional.maxUploadBytes ?? DEFAULT_MAX_UPLOAD_BYTES;
+    const allowedMimeTypes = optional.allowedMimeTypes ?? DEFAULT_ALLOWED_MIME_TYPES;
+    if (!allowedMimeTypes.has(input.contentType)) {
+        throw new MediaValidationError(`content type '${input.contentType}' is not allowed for upload`);
+    }
+    if (input.bytes.byteLength === 0) {
+        throw new MediaValidationError("uploaded file is empty");
+    }
+    if (input.bytes.byteLength > maxUploadBytes) {
+        throw new MediaValidationError(`uploaded file exceeds the ${maxUploadBytes}-byte size cap`);
+    }
+    const sha256 = createHash("sha256").update(input.bytes).digest("hex");
+    const nowIso = deps.clock.nowIso();
+    const storageKey = await withSha256Lock(sha256, async () => {
+        const existingBlob = await deps.blobRepo.findByHash({ workspaceId: input.workspaceId, sha256 });
+        if (existingBlob) {
+            if (existingBlob.status === "tombstoned") {
+                // Resurrect: cancel the pending GC in the same locked section rather
+                // than writing a duplicate blob (INV-1 dedup rule).
+                await deps.blobRepo.save({ ...existingBlob, status: "active", tombstonedAt: undefined });
+            }
+            return existingBlob.storageKey;
+        }
+        const written = await deps.blobStore.put({
+            workspaceId: input.workspaceId,
+            sha256,
+            bytes: input.bytes,
+        });
+        await deps.blobRepo.save({
+            id: deps.idGen.newId(),
+            workspaceId: input.workspaceId,
+            sha256,
+            storageKey: written.storageKey,
+            status: "active",
+            createdByPrincipal: input.createdByPrincipal,
+            createdAt: nowIso,
+        });
+        return written.storageKey;
+    });
+    const media = {
+        id: deps.idGen.newId(),
+        workspaceId: input.workspaceId,
+        title: deriveTitleFromFilename(input.filename),
+        alt: input.alt?.trim() ?? "",
+        caption: input.caption?.trim() ?? "",
+        credit: input.credit?.trim() ?? "",
+        source: resolveWriteOnceSource({ existing: undefined, requestedSha256: sha256 }),
+        status: "active",
+        createdAt: nowIso,
+        updatedAt: nowIso,
+        version: 1,
+        // No sizing UI on upload yet (only the edit panel got one — see `UpdateMediaMetadataInput`
+        // below) — every freshly uploaded asset starts with no override, set via a follow-up PATCH.
+        width: null,
+        height: null,
+        cssClass: null,
+    };
+    await deps.mediaRepo.save(media);
+    await deps.renditionRepo.save({
+        id: deps.idGen.newId(),
+        workspaceId: input.workspaceId,
+        assetId: media.id,
+        transformName: "original",
+        version: 1,
+        storageKey,
+        createdAt: nowIso,
+    });
+    return { media };
+}
+/**
+ * Lists all media in a workspace (all statuses — active + trashed; admin sees
+ * everything, mirrors an admin post listing). Purged assets are absent by
+ * construction (`purgeMedia` removes the row), not filtered here.
+ *
+ * @complexity O(1) repo call; the returned array is bounded by the
+ * workspace's media row count (repo-dependent — no pagination cap added in
+ * this pass, acceptable at walking-skeleton scale).
+ * @overallScore 100
+ */
+export async function listMedia(required, _optional = {}) {
+    const media = await required.deps.mediaRepo.list({ workspaceId: required.input.workspaceId });
+    return { media };
+}
+/**
+ * Fetches one media asset by id, scoped to its workspace.
+ *
+ * @complexity O(1).
+ * @overallScore 100
+ */
+export async function getMediaById(required, _optional = {}) {
+    const { workspaceId, id } = required.input;
+    const media = await required.deps.mediaRepo.findById({ workspaceId, id });
+    if (!media)
+        throw new MediaNotFoundError(`media '${id}' was not found`);
+    return { media };
+}
+/**
+ * Updates editorial-only fields (title/alt/caption/credit). `source.sha256` is
+ * write-once — this function's input type has no `sha256` field,
+ * so there is no code path here that can touch it (see `resolveWriteOnceSource`
+ * doc for the directly-tested invariant this relies on).
+ *
+ * @complexity O(1).
+ * @overallScore 100
+ */
+/** Validates a `width`/`height` override: must be a positive integer. `null` (explicit clear) and
+ *  `undefined` (leave unchanged) both bypass this — only a real provided number is checked. */
+function assertPositiveIntegerOrThrow(value, field) {
+    if (!Number.isInteger(value) || value <= 0) {
+        throw new MediaValidationError(`media.${field} must be a positive integer, got ${value}`);
+    }
+}
+export async function updateMediaMetadata(required, _optional = {}) {
+    const { deps, input } = required;
+    const existing = await deps.mediaRepo.findById({ workspaceId: input.workspaceId, id: input.id });
+    if (!existing)
+        throw new MediaNotFoundError(`media '${input.id}' was not found`);
+    if (input.width !== undefined && input.width !== null)
+        assertPositiveIntegerOrThrow(input.width, "width");
+    if (input.height !== undefined && input.height !== null)
+        assertPositiveIntegerOrThrow(input.height, "height");
+    const media = {
+        ...existing,
+        title: input.title !== undefined ? input.title.trim() || existing.title : existing.title,
+        alt: input.alt !== undefined ? input.alt.trim() : existing.alt,
+        caption: input.caption !== undefined ? input.caption.trim() : existing.caption,
+        credit: input.credit !== undefined ? input.credit.trim() : existing.credit,
+        width: input.width !== undefined ? input.width : existing.width,
+        height: input.height !== undefined ? input.height : existing.height,
+        cssClass: input.cssClass !== undefined ? (input.cssClass === null ? null : input.cssClass.trim() || null) : existing.cssClass,
+        updatedAt: deps.clock.nowIso(),
+        version: existing.version + 1,
+    };
+    await deps.mediaRepo.save(media);
+    return { media };
+}
+/**
+ * Soft delete. Idempotent — trashing an already-trashed asset is a no-op
+ * (mirrors `disableMember`'s idempotency), not an error.
+ *
+ * @complexity O(1).
+ * @overallScore 100
+ */
+export async function trashMedia(required, _optional = {}) {
+    const { deps, input } = required;
+    const existing = await deps.mediaRepo.findById(input);
+    if (!existing)
+        throw new MediaNotFoundError(`media '${input.id}' was not found`);
+    if (existing.status === "trashed")
+        return { media: existing };
+    const media = {
+        ...existing,
+        status: "trashed",
+        updatedAt: deps.clock.nowIso(),
+        version: existing.version + 1,
+    };
+    await deps.mediaRepo.save(media);
+    return { media };
+}
+/**
+ * Hard delete. Deletion ladder (mirrors `deleteMenu`): purge is
+ * rejected with `MediaStillReferencedError` (409-style) unless the asset has
+ * already been trashed first.
+ *
+ * SIMPLIFICATION (disclosed): the real design's guard checks the derived
+ * `entry_refs` where-used index (any live reference from published content).
+ * That index doesn't exist — posts don't reference media by id in `bodyJson`
+ * yet — so this build uses "not yet trashed" as the stand-in referenced-check.
+ * This is strictly weaker than the real invariant: a media asset that IS
+ * trashed but still referenced by a post would purge here without complaint,
+ * whereas the real system would keep blocking it. Do not read this function's
+ * 409 as evidence the where-used index exists.
+ *
+ * Once past the guard: rendition rows are removed, then the media row is
+ * removed. After that removal commits, the blob-GC tombstone-pass
+ * (`tombstoneBlobIfUnreferenced`, `blob-gc.ts`) runs for the asset's sha256 —
+ * it marks the blob `tombstoned` if-and-only-if the real "unreferenced"
+ * predicate holds (no other non-purged media row shares the hash, plus the
+ * disclosed `entry_refs`/retained-snapshot stubs). This function does **not**
+ * delete blob bytes itself anymore: the delete-pass (`runBlobGcDeletePass`)
+ * is grace-period-gated (`gc_grace`, default 30 days) and the unlink-pass
+ * (`runBlobGcUnlinkPass`) that actually removes bytes runs as a separate,
+ * explicit step — nothing schedules either automatically yet (see
+ * `blob-gc.ts`'s file header). This is a real behavior change from this
+ * function's prior "delete row, best-effort unlink immediately" shortcut,
+ * which is exactly the gap this task closes.
+ *
+ * @complexity O(n) in the workspace's media row count, inherited from the
+ * tombstone-pass's `isBlobUnreferenced` scan (see `blob-gc.ts`).
+ * @overallScore 100
+ */
+export async function purgeMedia(required, _optional = {}) {
+    const { deps, input } = required;
+    const existing = await deps.mediaRepo.findById(input);
+    if (!existing)
+        throw new MediaNotFoundError(`media '${input.id}' was not found`);
+    if (existing.status !== "trashed") {
+        throw new MediaStillReferencedError(`media '${input.id}' must be trashed before it can be purged`, [
+            `media '${input.id}' is still active (stand-in for the real entry_refs ` +
+                `where-used index, which is not implemented — see purgeMedia's doc comment)`,
+        ]);
+    }
+    await deps.renditionRepo.removeByAsset({ workspaceId: input.workspaceId, assetId: input.id });
+    await deps.mediaRepo.remove({ workspaceId: input.workspaceId, id: input.id });
+    const clock = deps.clock ?? { nowIso: () => new Date().toISOString() };
+    await tombstoneBlobIfUnreferenced({
+        deps: { mediaRepo: deps.mediaRepo, blobRepo: deps.blobRepo, clock },
+        input: { workspaceId: input.workspaceId, sha256: existing.source.sha256 },
+    });
+    return { purged: true };
+}
+//# sourceMappingURL=media-service.js.map

package/dist/media/media-service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"media-service.js","sourceRoot":"","sources":["../../src/media/media-service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmDG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAGzC,OAAO,EACL,kBAAkB,EAClB,kBAAkB,EAClB,yBAAyB,EACzB,yBAAyB,EACzB,oBAAoB,GAIrB,MAAM,YAAY,CAAC;AAEpB,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,OAAO,EAAE,2BAA2B,EAAE,MAAM,cAAc,CAAC;AAE3D,OAAO,EACL,kBAAkB,EAClB,kBAAkB,EAClB,yBAAyB,EACzB,yBAAyB,EACzB,oBAAoB,GACrB,CAAC;AAEF,gGAAgG;AAChG,MAAM,CAAC,MAAM,wBAAwB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC,SAAS;AAEnE;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAwB,IAAI,GAAG,CAAC;IACrE,YAAY;IACZ,WAAW;IACX,YAAY;IACZ,WAAW;IACX,WAAW;IACX,YAAY;CACb,CAAC,CAAC;AAEH;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,sBAAsB,CACpC,QAAwE,EACxE,YAAmC,EAAE;IAErC,MAAM,EAAE,QAAQ,EAAE,eAAe,EAAE,GAAG,QAAQ,CAAC;IAC/C,IAAI,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,eAAe,EAAE,CAAC;QACpD,MAAM,IAAI,yBAAyB,CACjC,+CAA+C,QAAQ,CAAC,MAAM,SAAS,eAAe,GAAG,CAC1F,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;AACrC,CAAC;AAED,SAAS,uBAAuB,CAAC,QAAgB;IAC/C,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC;IACxD,OAAO,IAAI,CAAC,IAAI,EAAE,IAAI,UAAU,CAAC;AACnC,CAAC;AAqCD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,QAA6B,EAC7B,WAAgC,EAAE;IAElC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,QAAQ,CAAC;IACjC,MAAM,cAAc,GAAG,QAAQ,CAAC,cAAc,IAAI,wBAAwB,CAAC;IAC3E,MAAM,gBAAgB,GAAG,QAAQ,CAAC,gBAAgB,IAAI,0BAA0B,CAAC;IAEjF,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC;QAC7C,MAAM,IAAI,oBAAoB,CAC5B,iBAAiB,KAAK,CAAC,WAAW,6BAA6B,CAChE,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,KAAK,CAAC,UAAU,KAAK,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,oBAAoB,CAAC,wBAAwB,CAAC,CAAC;IAC3D,CAAC;IACD,IAAI,KAAK,CAAC,KAAK,CAAC,UAAU,GAAG,cAAc,EAAE,CAAC;QAC5C,MAAM,IAAI,oBAAoB,CAC5B,6BAA6B,cAAc,gBAAgB,CAC5D,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACtE,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;IAEnC,MAAM,UAAU,GAAG,MAAM,cAAc,CAAC,MAAM,EAAE,KAAK,IAAI,EAAE;QACzD,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,MAAM,EAAE,CAAC,CAAC;QAChG,IAAI,YAAY,EAAE,CAAC;YACjB,IAAI,YAAY,CAAC,MAAM,KAAK,YAAY,EAAE,CAAC;gBACzC,qEAAqE;gBACrE,oDAAoD;gBACpD,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,GAAG,YAAY,EAAE,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,SAAS,EAAE,CAAC,CAAC;YAC3F,CAAC;YACD,OAAO,YAAY,CAAC,UAAU,CAAC;QACjC,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC;YACvC,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,MAAM;YACN,KAAK,EAAE,KAAK,CAAC,KAAK;SACnB,CAAC,CAAC;QACH,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;YACvB,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE;YACtB,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,MAAM;YACN,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,MAAM,EAAE,QAAQ;YAChB,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;YAC5C,SAAS,EAAE,MAAM;SAClB,CAAC,CAAC;QACH,OAAO,OAAO,CAAC,UAAU,CAAC;IAC5B,CAAC,CAAC,CAAC;IAEH,MAAM,KAAK,GAAgB;QACzB,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE;QACtB,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,KAAK,EAAE,uBAAuB,CAAC,KAAK,CAAC,QAAQ,CAAC;QAC9C,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE;QAC5B,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE;QACpC,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE;QAClC,MAAM,EAAE,sBAAsB,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,EAAE,CAAC;QAChF,MAAM,EAAE,QAAQ;QAChB,SAAS,EAAE,MAAM;QACjB,SAAS,EAAE,MAAM;QACjB,OAAO,EAAE,CAAC;QACV,2FAA2F;QAC3F,4FAA4F;QAC5F,KAAK,EAAE,IAAI;QACX,MAAM,EAAE,IAAI;QACZ,QAAQ,EAAE,IAAI;KACf,CAAC;IACF,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAEjC,MAAM,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC;QAC5B,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE;QACtB,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,OAAO,EAAE,KAAK,CAAC,EAAE;QACjB,aAAa,EAAE,UAAU;QACzB,OAAO,EAAE,CAAC;QACV,UAAU;QACV,SAAS,EAAE,MAAM;KAClB,CAAC,CAAC;IAEH,OAAO,EAAE,KAAK,EAAE,CAAC;AACnB,CAAC;AAWD;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,QAA2B,EAC3B,YAAmC,EAAE;IAErC,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,QAAQ,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC;IAC9F,OAAO,EAAE,KAAK,EAAE,CAAC;AACnB,CAAC;AAOD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,QAA8B,EAC9B,YAAmC,EAAE;IAErC,MAAM,EAAE,WAAW,EAAE,EAAE,EAAE,GAAG,QAAQ,CAAC,KAAK,CAAC;IAC3C,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC,CAAC;IAC1E,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,kBAAkB,CAAC,UAAU,EAAE,iBAAiB,CAAC,CAAC;IACxE,OAAO,EAAE,KAAK,EAAE,CAAC;AACnB,CAAC;AAuCD;;;;;;;;GAQG;AACH;+FAC+F;AAC/F,SAAS,4BAA4B,CAAC,KAAa,EAAE,KAAyB;IAC5E,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,EAAE,CAAC;QAC3C,MAAM,IAAI,oBAAoB,CAAC,SAAS,KAAK,oCAAoC,KAAK,EAAE,CAAC,CAAC;IAC5F,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,QAAqC,EACrC,YAAmC,EAAE;IAErC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,QAAQ,CAAC;IACjC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;IACjG,IAAI,CAAC,QAAQ;QAAE,MAAM,IAAI,kBAAkB,CAAC,UAAU,KAAK,CAAC,EAAE,iBAAiB,CAAC,CAAC;IAEjF,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,KAAK,KAAK,IAAI;QAAE,4BAA4B,CAAC,KAAK,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAC1G,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,KAAK,IAAI;QAAE,4BAA4B,CAAC,KAAK,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAE9G,MAAM,KAAK,GAAgB;QACzB,GAAG,QAAQ;QACX,KAAK,EAAE,KAAK,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK;QACxF,GAAG,EAAE,KAAK,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG;QAC9D,OAAO,EAAE,KAAK,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO;QAC9E,MAAM,EAAE,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM;QAC1E,KAAK,EAAE,KAAK,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK;QAC/D,MAAM,EAAE,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM;QACnE,QAAQ,EAAE,KAAK,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ;QAC7H,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE;QAC9B,OAAO,EAAE,QAAQ,CAAC,OAAO,GAAG,CAAC;KAC9B,CAAC;IACF,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACjC,OAAO,EAAE,KAAK,EAAE,CAAC;AACnB,CAAC;AAgBD;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,QAA4B,EAC5B,YAAmC,EAAE;IAErC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,QAAQ,CAAC;IACjC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACtD,IAAI,CAAC,QAAQ;QAAE,MAAM,IAAI,kBAAkB,CAAC,UAAU,KAAK,CAAC,EAAE,iBAAiB,CAAC,CAAC;IACjF,IAAI,QAAQ,CAAC,MAAM,KAAK,SAAS;QAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;IAE9D,MAAM,KAAK,GAAgB;QACzB,GAAG,QAAQ;QACX,MAAM,EAAE,SAAwB;QAChC,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE;QAC9B,OAAO,EAAE,QAAQ,CAAC,OAAO,GAAG,CAAC;KAC9B,CAAC;IACF,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACjC,OAAO,EAAE,KAAK,EAAE,CAAC;AACnB,CAAC;AAsBD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,QAA4B,EAC5B,YAAmC,EAAE;IAErC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,QAAQ,CAAC;IACjC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACtD,IAAI,CAAC,QAAQ;QAAE,MAAM,IAAI,kBAAkB,CAAC,UAAU,KAAK,CAAC,EAAE,iBAAiB,CAAC,CAAC;IAEjF,IAAI,QAAQ,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAClC,MAAM,IAAI,yBAAyB,CACjC,UAAU,KAAK,CAAC,EAAE,2CAA2C,EAC7D;YACE,UAAU,KAAK,CAAC,EAAE,sDAAsD;gBACtE,4EAA4E;SAC/E,CACF,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,CAAC,aAAa,CAAC,aAAa,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;IAC9F,MAAM,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;IAE9E,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;IACvE,MAAM,2BAA2B,CAAC;QAChC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE;QACnE,KAAK,EAAE,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE;KAC1E,CAAC,CAAC;IAEH,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AAC1B,CAAC"}