@jini-ai/cms 0.3.4 → 0.3.6

package/dist/identity/seed.js

@@ -23,6 +23,16 @@ import { normalizeUsername } from "./username.js";
  */
 /** REQ-09: the literal id the legacy Article VI actor stamp resolves to. */
 const LEGACY_USER_LOCAL_PRINCIPAL_ID = "user-local";
+/**
+ * The built-in role the seeded owner user holds, and its authority. Named constants because two
+ * call sites now depend on them agreeing exactly — the fresh seed below and `ensureOwnerRoleBinding`,
+ * which repairs an interrupted one. Drift between the two would be a silent authority bug.
+ *
+ * REQ-04/REQ-09: the owner policy holds the wildcard `*`, not an enumerated list, so it
+ * automatically covers permissions features register later.
+ */
+const OWNER_ROLE_NAME = "owner";
+const OWNER_ROLE_PERMISSIONS = ["*"];
 const BUILTIN_ADMIN_PERMISSIONS = [
     "content.read",
     "content.write",
@@ -136,22 +146,77 @@ const BUILTIN_EDITOR_PERMISSIONS = [
     "theme.set",
 ];
 const BUILTIN_VIEWER_PERMISSIONS = ["content.read", "changeset.read", "plugin.read"];
-/** Builds one built-in role + its 1:1 policy + policy_permissions rows, and saves all three. */
-async function seedBuiltinRoleWithPolicy(required) {
-    const { deps, workspaceId, name, permissions, nowIso } = required;
-    const roleId = deps.idGen.newId();
-    const policyId = deps.idGen.newId();
-    await deps.repos.roles.save({ id: roleId, workspaceId, name, isBuiltin: true });
-    await deps.repos.policies.save({
-        id: policyId,
-        workspaceId,
-        name: `${name}-builtin-policy`,
-        description: `Built-in policy for the seeded '${name}' role.`,
-        isBuiltin: true,
-        isFrozen: false,
-    });
-    await deps.repos.rolePolicies.save({ id: deps.idGen.newId(), workspaceId, roleId, policyId });
+/**
+ * Why every step below is "find, then save only what is missing" rather than a straight insert.
+ *
+ * This function's writes are NOT transactional and its caller is not awaited by its hosts (Tovu
+ * hands `seedIdentity`'s promise back as `RouteDeps.identityReady` and returns synchronously), so
+ * a process that exits before the seed finishes — a fast-failing CLI command, a Ctrl-C, a crash —
+ * leaves the workspace half-seeded. `seedIdentity`'s own early-return guard keys on the OWNER USER,
+ * which is written last, so the next boot correctly decides the seed is unfinished and replays it.
+ * A replay that blindly re-inserted would hit `UNIQUE(workspace_id, name)` on `roles`/`policies`
+ * (crashing every subsequent boot, permanently), and would silently duplicate `role_policies` /
+ * `policy_permissions` rows, which carry no unique index at all. So the replay must converge onto
+ * the rows already there instead of re-creating them.
+ *
+ * What this deliberately does NOT do: adopt a role or policy an operator created themselves. A
+ * same-named non-built-in row is a genuine conflict, not a partial seed, and silently promoting it
+ * would hand its holders the built-in policy's permissions. Those cases throw.
+ */
+/** The built-in role for `name`, reusing a prior (possibly interrupted) seed's row if present. */
+async function ensureBuiltinRole(required) {
+    const { deps, workspaceId, name } = required;
+    const existing = await deps.repos.roles.findByName({ workspaceId, name });
+    if (!existing) {
+        const roleId = deps.idGen.newId();
+        await deps.repos.roles.save({ id: roleId, workspaceId, name, isBuiltin: true });
+        return roleId;
+    }
+    if (!existing.isBuiltin) {
+        throw new Error(`seedIdentity: a non-built-in role named '${name}' already exists in workspace ${workspaceId}. ` +
+            `Refusing to adopt it as the built-in '${name}' role — rename or remove it first.`);
+    }
+    return existing.id;
+}
+/** The built-in policy for `name`, reusing a prior (possibly interrupted) seed's row if present. */
+async function ensureBuiltinPolicy(required) {
+    const { deps, workspaceId, name } = required;
+    const policyName = `${name}-builtin-policy`;
+    const existing = await deps.repos.policies.findByName({ workspaceId, name: policyName });
+    if (!existing) {
+        const policyId = deps.idGen.newId();
+        await deps.repos.policies.save({
+            id: policyId,
+            workspaceId,
+            name: policyName,
+            description: `Built-in policy for the seeded '${name}' role.`,
+            isBuiltin: true,
+            isFrozen: false,
+        });
+        return policyId;
+    }
+    if (!existing.isBuiltin) {
+        throw new Error(`seedIdentity: a non-built-in policy named '${policyName}' already exists in workspace ${workspaceId}. ` +
+            `Refusing to adopt it as the built-in '${name}' policy — rename or remove it first.`);
+    }
+    return existing.id;
+}
+/**
+ * Grant `permissions` to `policyId`, skipping any the policy already holds.
+ *
+ * Additive by design, and the reason a resumed seed still CONVERGES rather than merely staying
+ * quiet: a built-in policy whose permission rows never landed (the interrupt fell between the
+ * policy insert and this loop) gains them on the next boot. Compares only unscoped rows because
+ * that is the only shape this seed writes — a `resourceType`-scoped row of the same name is a
+ * different grant and must not satisfy an unscoped one.
+ */
+async function ensurePolicyPermissions(required) {
+    const { deps, workspaceId, policyId, permissions } = required;
+    const existing = await deps.repos.policyPermissions.listByPolicyId({ workspaceId, policyId });
+    const held = new Set(existing.filter((row) => row.resourceType === null).map((row) => row.permission));
     for (const permission of permissions) {
+        if (held.has(permission))
+            continue;
         await deps.repos.policyPermissions.save({
             id: deps.idGen.newId(),
             workspaceId,
@@ -161,12 +226,84 @@ async function seedBuiltinRoleWithPolicy(required) {
             constraintJson: null,
         });
     }
+}
+/** Builds one built-in role + its 1:1 policy + policy_permissions rows, converging on what exists. */
+async function seedBuiltinRoleWithPolicy(required) {
+    const { deps, workspaceId, name, permissions, nowIso } = required;
+    const roleId = await ensureBuiltinRole({ deps, workspaceId, name });
+    const policyId = await ensureBuiltinPolicy({ deps, workspaceId, name });
+    // `role_policies` has no unique index, so a replay would otherwise stack a second identical link.
+    const links = await deps.repos.rolePolicies.listByRoleId({ workspaceId, roleId });
+    if (!links.some((link) => link.policyId === policyId)) {
+        await deps.repos.rolePolicies.save({ id: deps.idGen.newId(), workspaceId, roleId, policyId });
+    }
+    await ensurePolicyPermissions({ deps, workspaceId, policyId, permissions });
     void nowIso; // reserved for a future createdAt column on roles/policies
     return { roleId, policyId };
 }
 /**
- * Seed first-boot identity data (idempotent — a no-op if the owner username
- * already exists in the workspace).
+ * Repair the one completion step `seedIdentity`'s owner-user guard cannot see.
+ *
+ * The guard keys on the owner USER, and the owner's `principal_roles` link is written after it. A
+ * process that exits between those two adjacent writes leaves a workspace whose owner exists, can
+ * still log in, and holds no role — and `resolveEffectivePermissions` (`authorize.ts`) starts from
+ * `principal_roles` + `principal_policies`, so with neither present EVERY permission evaluates to
+ * `no_grant`. Without this step the guard early-returns on the user it finds forever and the site
+ * stays bricked for its owner, silently. Neither host-side reconciler closes it either: Tovu's
+ * `migrateDeprecatedPermissionGrants` and `applyBuiltinRoleGrants` are handed policy and role repos
+ * only, never `principalRoles`, so neither can write a principal->role link at all.
+ *
+ * Why the gate is "holds NO role" rather than "lacks the owner role". Those two conditions differ
+ * on exactly one workspace shape, and it matters: an operator who moves the seeded owner principal
+ * to a lesser role leaves it lacking the owner link on purpose. Repairing on that broader signal
+ * would re-escalate the principal to wildcard authority on the next restart — a privilege
+ * escalation shipped as a bug fix. A principal holding no role at all is never a deliberate state;
+ * it is only ever the interrupted seed, so that is what this repairs.
+ *
+ * Converges rather than assuming: it goes through `seedBuiltinRoleWithPolicy`, so a workspace whose
+ * owner ROLE or wildcard grant also never landed gains those here instead of being linked to a role
+ * that grants nothing. `principal_roles` carries no unique index, hence the read-before-write.
+ *
+ * @complexity O(1) — a handful of point reads on a healthy boot (one `listByPrincipalId`, which
+ * returns early), plus the fixed converge pass for the owner role only when the repair fires.
+ */
+async function ensureOwnerRoleBinding(required) {
+    const { deps, workspaceId, ownerPrincipalId, nowIso } = required;
+    const heldRoles = await deps.repos.principalRoles.listByPrincipalId({
+        workspaceId,
+        principalId: ownerPrincipalId,
+    });
+    if (heldRoles.length > 0)
+        return;
+    const { roleId } = await seedBuiltinRoleWithPolicy({
+        deps,
+        workspaceId,
+        name: OWNER_ROLE_NAME,
+        permissions: OWNER_ROLE_PERMISSIONS,
+        nowIso,
+    });
+    await deps.repos.principalRoles.save({
+        id: deps.idGen.newId(),
+        workspaceId,
+        principalId: ownerPrincipalId,
+        roleId,
+    });
+}
+/**
+ * Seed first-boot identity data.
+ *
+ * Idempotent in two distinct senses, and both are load-bearing:
+ * - A seed that RAN TO COMPLETION is a no-op — the owner-username lookup below early-returns after
+ *   a single confirming read (`ensureOwnerRoleBinding`) and writes nothing. (This path does not
+ *   reconcile a built-in policy whose permission list has since grown; that is the host's job — see
+ *   Tovu's `applyBuiltinRoleGrants` / `migrateDeprecatedPermissionGrants`, chained onto
+ *   `identityReady`.)
+ * - "Ran to completion" is judged on the owner user AND its role link, not the user alone. The link
+ *   is the seed's last write, so the user is not on its own evidence the seed finished — see
+ *   `ensureOwnerRoleBinding` for what an interrupt between those two writes costs.
+ * - A seed that was INTERRUPTED is resumed, not replayed: every step converges onto the rows a
+ *   previous attempt already wrote and fills in only what is missing. See the block comment above
+ *   `ensureBuiltinRole` for why this function must survive being killed halfway.
  *
  * @complexity O(1) — fixed small number of inserts (4 roles/policies, ~2
  * dozen policy_permissions, 3 principals, 1 user, 1 role assignment).
@@ -183,21 +320,35 @@ export async function seedIdentity(required) {
         username: ownerUsername,
     });
     if (existingOwnerUser) {
+        // The owner user alone is NOT proof the seed finished — its role link is written after it. See
+        // `ensureOwnerRoleBinding`: on a healthy workspace this is one read and no write.
+        await ensureOwnerRoleBinding({
+            deps,
+            workspaceId,
+            ownerPrincipalId: existingOwnerUser.principalId,
+            nowIso,
+        });
         const existingSystem = (await deps.repos.principals.list({ workspaceId })).find((row) => row.kind === "system" && row.id !== LEGACY_USER_LOCAL_PRINCIPAL_ID);
         return {
             ownerPrincipalId: existingOwnerUser.principalId,
             systemPrincipalId: existingSystem?.id ?? LEGACY_USER_LOCAL_PRINCIPAL_ID,
         };
     }
-    const systemPrincipalId = deps.idGen.newId();
-    await deps.repos.principals.save({
-        id: systemPrincipalId,
-        workspaceId,
-        kind: "system",
-        displayName: "System",
-        status: "active",
-        createdAt: nowIso,
-    });
+    // Reuse the system principal a prior interrupted seed may already have written: `principals` has
+    // no unique index on kind, so a blind re-insert would leave TWO non-legacy system principals and
+    // the early-return branch above picking between them by list order.
+    const existingSystem = (await deps.repos.principals.list({ workspaceId })).find((row) => row.kind === "system" && row.id !== LEGACY_USER_LOCAL_PRINCIPAL_ID);
+    const systemPrincipalId = existingSystem?.id ?? deps.idGen.newId();
+    if (!existingSystem) {
+        await deps.repos.principals.save({
+            id: systemPrincipalId,
+            workspaceId,
+            kind: "system",
+            displayName: "System",
+            status: "active",
+            createdAt: nowIso,
+        });
+    }
     // REQ-09/EC-09: disabled legacy actor so historical `actorId='user-local'`
     // change-sets resolve without rewriting history.
     await deps.repos.principals.save({
@@ -212,23 +363,10 @@ export async function seedIdentity(required) {
     const { roleId: ownerRoleId } = await seedBuiltinRoleWithPolicy({
         deps,
         workspaceId,
-        name: "owner",
-        permissions: [],
+        name: OWNER_ROLE_NAME,
+        permissions: OWNER_ROLE_PERMISSIONS,
         nowIso,
     });
-    // REQ-04/REQ-09: the owner policy holds the wildcard `*`, not an enumerated
-    // list, so it automatically covers permissions features register later.
-    const ownerPolicy = (await deps.repos.policies.list({ workspaceId })).find((row) => row.name === "owner-builtin-policy");
-    if (!ownerPolicy)
-        throw new Error("seedIdentity: owner policy was not created");
-    await deps.repos.policyPermissions.save({
-        id: deps.idGen.newId(),
-        workspaceId,
-        policyId: ownerPolicy.id,
-        permission: "*",
-        resourceType: null,
-        constraintJson: null,
-    });
     await seedBuiltinRoleWithPolicy({
         deps,
         workspaceId,
@@ -250,6 +388,12 @@ export async function seedIdentity(required) {
         permissions: BUILTIN_VIEWER_PERMISSIONS,
         nowIso,
     });
+    // Hashed BEFORE the owner principal row is written, not inline in the `users.save` below.
+    // argon2id is deliberately slow, which made it by far the widest window in this un-awaited,
+    // non-transactional sequence for a process to exit between the principal insert and the user
+    // insert that gives it meaning — leaving an orphan `kind: "user"` principal behind on every
+    // interrupted boot. Hashing first shrinks that window to a single adjacent await.
+    const ownerPasswordHash = await deps.hasher.hash(ownerPassword);
     const ownerPrincipalId = deps.idGen.newId();
     await deps.repos.principals.save({
         id: ownerPrincipalId,
@@ -264,14 +408,22 @@ export async function seedIdentity(required) {
         workspaceId,
         username: ownerUsername,
         email: input.ownerEmail,
-        passwordHash: await deps.hasher.hash(ownerPassword),
+        passwordHash: ownerPasswordHash,
     });
-    await deps.repos.principalRoles.save({
-        id: deps.idGen.newId(),
+    // `principal_roles` carries no unique index either — same converge-don't-duplicate rule as the
+    // `role_policies` link in `seedBuiltinRoleWithPolicy`.
+    const ownerRoleLinks = await deps.repos.principalRoles.listByPrincipalId({
         workspaceId,
         principalId: ownerPrincipalId,
-        roleId: ownerRoleId,
     });
+    if (!ownerRoleLinks.some((link) => link.roleId === ownerRoleId)) {
+        await deps.repos.principalRoles.save({
+            id: deps.idGen.newId(),
+            workspaceId,
+            principalId: ownerPrincipalId,
+            roleId: ownerRoleId,
+        });
+    }
     return { ownerPrincipalId, systemPrincipalId };
 }
 //# sourceMappingURL=seed.js.map

package/dist/identity/seed.js.map

@@ -1 +1 @@
-{"version":3,"file":"seed.js","sourceRoot":"","sources":["../../src/identity/seed.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAElD;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,4EAA4E;AAC5E,MAAM,8BAA8B,GAAG,YAAY,CAAC;AAEpD,MAAM,yBAAyB,GAAsB;IACnD,cAAc;IACd,eAAe;IACf,iBAAiB;IACjB,gBAAgB;IAChB,WAAW;IACX,4FAA4F;IAC5F,6FAA6F;IAC7F,iGAAiG;IACjG,sCAAsC;IACtC,YAAY;IACZ,aAAa;IACb,eAAe;IACf,gBAAgB;IAChB,gBAAgB;IAChB,kBAAkB;IAClB,eAAe;IACf,gBAAgB;IAChB,eAAe;IACf,wEAAwE;IACxE,kGAAkG;IAClG,6FAA6F;IAC7F,2FAA2F;IAC3F,4FAA4F;IAC5F,sDAAsD;IACtD,YAAY;IACZ,cAAc;IACd,cAAc;IACd,cAAc;IACd,oBAAoB;IACpB,yBAAyB;IACzB,kBAAkB;IAClB,2DAA2D;IAC3D,uFAAuF;IACvF,uFAAuF;IACvF,2FAA2F;IAC3F,gGAAgG;IAChG,8FAA8F;IAC9F,2FAA2F;IAC3F,+FAA+F;IAC/F,4BAA4B;IAC5B,kBAAkB;IAClB,oBAAoB;IACpB,oBAAoB;IACpB,oBAAoB;IACpB,0BAA0B;IAC1B,oBAAoB;IACpB,oEAAoE;IACpE,8FAA8F;IAC9F,+FAA+F;IAC/F,yFAAyF;IACzF,2BAA2B;IAC3B,qDAAqD;IACrD,iEAAiE;IACjE,0EAA0E;IAC1E,yEAAyE;IACzE,yEAAyE;IACzE,yEAAyE;IACzE,6BAA6B;IAC7B,uBAAuB;IACvB,0BAA0B;IAC1B,0BAA0B;IAC1B,qBAAqB;IACrB,wFAAwF;IACxF,0FAA0F;IAC1F,+FAA+F;IAC/F,6FAA6F;IAC7F,wFAAwF;IACxF,wDAAwD;IACxD,oBAAoB;IACpB,uBAAuB;IACvB,0BAA0B;IAC1B,qBAAqB;IACrB,eAAe;IACf,mBAAmB;IACnB,yBAAyB;IACzB,2BAA2B;IAC3B,uDAAuD;IACvD,8FAA8F;IAC9F,kBAAkB;IAClB,4FAA4F;IAC5F,iGAAiG;IACjG,kGAAkG;IAClG,kFAAkF;IAClF,uFAAuF;IACvF,wBAAwB;IACxB,wDAAwD;IACxD,+FAA+F;IAC/F,sBAAsB;IACtB,kBAAkB;IAClB,+EAA+E;CAChF,CAAC;AAEF,MAAM,0BAA0B,GAAsB;IACpD,cAAc;IACd,eAAe;IACf,iBAAiB;IACjB,gBAAgB;IAChB,mEAAmE;IACnE,0FAA0F;IAC1F,qFAAqF;IACrF,yFAAyF;IACzF,4EAA4E;IAC5E,gGAAgG;IAChG,iFAAiF;IACjF,gGAAgG;IAChG,2BAA2B;IAC3B,YAAY;IACZ,cAAc;IACd,cAAc;IACd,cAAc;IACd,WAAW;CACZ,CAAC;AAEF,MAAM,0BAA0B,GAAsB,CAAC,cAAc,EAAE,gBAAgB,EAAE,aAAa,CAAC,CAAC;AAgCxG,gGAAgG;AAChG,KAAK,UAAU,yBAAyB,CAAC,QAMxC;IACC,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,GAAG,QAAQ,CAAC;IAClE,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;IAClC,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;IAEpC,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAChF,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;QAC7B,EAAE,EAAE,QAAQ;QACZ,WAAW;QACX,IAAI,EAAE,GAAG,IAAI,iBAAiB;QAC9B,WAAW,EAAE,mCAAmC,IAAI,SAAS;QAC7D,SAAS,EAAE,IAAI;QACf,QAAQ,EAAE,KAAK;KAChB,CAAC,CAAC;IACH,MAAM,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;IAE9F,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;QACrC,MAAM,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC,IAAI,CAAC;YACtC,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE;YACtB,WAAW;YACX,QAAQ;YACR,UAAU;YACV,YAAY,EAAE,IAAI;YAClB,cAAc,EAAE,IAAI;SACrB,CAAC,CAAC;IACL,CAAC;IAED,KAAK,MAAM,CAAC,CAAC,2DAA2D;IACxE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;AAC9B,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,QAGlC;IACC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,QAAQ,CAAC;IACjC,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,CAAC;IACtC,MAAM,aAAa,GAAG,iBAAiB,CAAC,KAAK,CAAC,aAAa,IAAI,OAAO,CAAC,CAAC;IACxE,MAAM,aAAa,GAAG,KAAK,CAAC,aAAa,CAAC;IAC1C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;IAEnC,MAAM,iBAAiB,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,cAAc,CAAC;QAC9D,WAAW;QACX,QAAQ,EAAE,aAAa;KACxB,CAAC,CAAC;IACH,IAAI,iBAAiB,EAAE,CAAC;QACtB,MAAM,cAAc,GAAG,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI,CAC7E,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,KAAK,QAAQ,IAAI,GAAG,CAAC,EAAE,KAAK,8BAA8B,CAC5E,CAAC;QACF,OAAO;YACL,gBAAgB,EAAE,iBAAiB,CAAC,WAAW;YAC/C,iBAAiB,EAAE,cAAc,EAAE,EAAE,IAAI,8BAA8B;SACxE,CAAC;IACJ,CAAC;IAED,MAAM,iBAAiB,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;IAC7C,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC;QAC/B,EAAE,EAAE,iBAAiB;QACrB,WAAW;QACX,IAAI,EAAE,QAAQ;QACd,WAAW,EAAE,QAAQ;QACrB,MAAM,EAAE,QAAQ;QAChB,SAAS,EAAE,MAAM;KAClB,CAAC,CAAC;IAEH,2EAA2E;IAC3E,iDAAiD;IACjD,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC;QAC/B,EAAE,EAAE,8BAA8B;QAClC,WAAW;QACX,IAAI,EAAE,QAAQ;QACd,WAAW,EAAE,6BAA6B;QAC1C,MAAM,EAAE,UAAU;QAClB,UAAU,EAAE,MAAM;QAClB,SAAS,EAAE,MAAM;KAClB,CAAC,CAAC;IAEH,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,MAAM,yBAAyB,CAAC;QAC9D,IAAI;QACJ,WAAW;QACX,IAAI,EAAE,OAAO;QACb,WAAW,EAAE,EAAE;QACf,MAAM;KACP,CAAC,CAAC;IACH,4EAA4E;IAC5E,wEAAwE;IACxE,MAAM,WAAW,GAAG,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI,CACxE,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,KAAK,sBAAsB,CAC7C,CAAC;IACF,IAAI,CAAC,WAAW;QAAE,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAChF,MAAM,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC,IAAI,CAAC;QACtC,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE;QACtB,WAAW;QACX,QAAQ,EAAE,WAAW,CAAC,EAAE;QACxB,UAAU,EAAE,GAAG;QACf,YAAY,EAAE,IAAI;QAClB,cAAc,EAAE,IAAI;KACrB,CAAC,CAAC;IAEH,MAAM,yBAAyB,CAAC;QAC9B,IAAI;QACJ,WAAW;QACX,IAAI,EAAE,OAAO;QACb,WAAW,EAAE,yBAAyB;QACtC,MAAM;KACP,CAAC,CAAC;IACH,MAAM,yBAAyB,CAAC;QAC9B,IAAI;QACJ,WAAW;QACX,IAAI,EAAE,QAAQ;QACd,WAAW,EAAE,0BAA0B;QACvC,MAAM;KACP,CAAC,CAAC;IACH,MAAM,yBAAyB,CAAC;QAC9B,IAAI;QACJ,WAAW;QACX,IAAI,EAAE,QAAQ;QACd,WAAW,EAAE,0BAA0B;QACvC,MAAM;KACP,CAAC,CAAC;IAEH,MAAM,gBAAgB,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;IAC5C,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC;QAC/B,EAAE,EAAE,gBAAgB;QACpB,WAAW;QACX,IAAI,EAAE,MAAM;QACZ,WAAW,EAAE,OAAO;QACpB,MAAM,EAAE,QAAQ;QAChB,SAAS,EAAE,MAAM;KAClB,CAAC,CAAC;IACH,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC;QAC1B,WAAW,EAAE,gBAAgB;QAC7B,WAAW;QACX,QAAQ,EAAE,aAAa;QACvB,KAAK,EAAE,KAAK,CAAC,UAAU;QACvB,YAAY,EAAE,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC;KACpD,CAAC,CAAC;IACH,MAAM,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,IAAI,CAAC;QACnC,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE;QACtB,WAAW;QACX,WAAW,EAAE,gBAAgB;QAC7B,MAAM,EAAE,WAAW;KACpB,CAAC,CAAC;IAEH,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,CAAC;AACjD,CAAC"}
+{"version":3,"file":"seed.js","sourceRoot":"","sources":["../../src/identity/seed.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAElD;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,4EAA4E;AAC5E,MAAM,8BAA8B,GAAG,YAAY,CAAC;AAEpD;;;;;;;GAOG;AACH,MAAM,eAAe,GAAG,OAAO,CAAC;AAChC,MAAM,sBAAsB,GAAsB,CAAC,GAAG,CAAC,CAAC;AAExD,MAAM,yBAAyB,GAAsB;IACnD,cAAc;IACd,eAAe;IACf,iBAAiB;IACjB,gBAAgB;IAChB,WAAW;IACX,4FAA4F;IAC5F,6FAA6F;IAC7F,iGAAiG;IACjG,sCAAsC;IACtC,YAAY;IACZ,aAAa;IACb,eAAe;IACf,gBAAgB;IAChB,gBAAgB;IAChB,kBAAkB;IAClB,eAAe;IACf,gBAAgB;IAChB,eAAe;IACf,wEAAwE;IACxE,kGAAkG;IAClG,6FAA6F;IAC7F,2FAA2F;IAC3F,4FAA4F;IAC5F,sDAAsD;IACtD,YAAY;IACZ,cAAc;IACd,cAAc;IACd,cAAc;IACd,oBAAoB;IACpB,yBAAyB;IACzB,kBAAkB;IAClB,2DAA2D;IAC3D,uFAAuF;IACvF,uFAAuF;IACvF,2FAA2F;IAC3F,gGAAgG;IAChG,8FAA8F;IAC9F,2FAA2F;IAC3F,+FAA+F;IAC/F,4BAA4B;IAC5B,kBAAkB;IAClB,oBAAoB;IACpB,oBAAoB;IACpB,oBAAoB;IACpB,0BAA0B;IAC1B,oBAAoB;IACpB,oEAAoE;IACpE,8FAA8F;IAC9F,+FAA+F;IAC/F,yFAAyF;IACzF,2BAA2B;IAC3B,qDAAqD;IACrD,iEAAiE;IACjE,0EAA0E;IAC1E,yEAAyE;IACzE,yEAAyE;IACzE,yEAAyE;IACzE,6BAA6B;IAC7B,uBAAuB;IACvB,0BAA0B;IAC1B,0BAA0B;IAC1B,qBAAqB;IACrB,wFAAwF;IACxF,0FAA0F;IAC1F,+FAA+F;IAC/F,6FAA6F;IAC7F,wFAAwF;IACxF,wDAAwD;IACxD,oBAAoB;IACpB,uBAAuB;IACvB,0BAA0B;IAC1B,qBAAqB;IACrB,eAAe;IACf,mBAAmB;IACnB,yBAAyB;IACzB,2BAA2B;IAC3B,uDAAuD;IACvD,8FAA8F;IAC9F,kBAAkB;IAClB,4FAA4F;IAC5F,iGAAiG;IACjG,kGAAkG;IAClG,kFAAkF;IAClF,uFAAuF;IACvF,wBAAwB;IACxB,wDAAwD;IACxD,+FAA+F;IAC/F,sBAAsB;IACtB,kBAAkB;IAClB,+EAA+E;CAChF,CAAC;AAEF,MAAM,0BAA0B,GAAsB;IACpD,cAAc;IACd,eAAe;IACf,iBAAiB;IACjB,gBAAgB;IAChB,mEAAmE;IACnE,0FAA0F;IAC1F,qFAAqF;IACrF,yFAAyF;IACzF,4EAA4E;IAC5E,gGAAgG;IAChG,iFAAiF;IACjF,gGAAgG;IAChG,2BAA2B;IAC3B,YAAY;IACZ,cAAc;IACd,cAAc;IACd,cAAc;IACd,WAAW;CACZ,CAAC;AAEF,MAAM,0BAA0B,GAAsB,CAAC,cAAc,EAAE,gBAAgB,EAAE,aAAa,CAAC,CAAC;AAgCxG;;;;;;;;;;;;;;;;GAgBG;AAEH,kGAAkG;AAClG,KAAK,UAAU,iBAAiB,CAAC,QAIhC;IACC,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,GAAG,QAAQ,CAAC;IAC7C,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1E,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QAClC,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAChF,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CACb,4CAA4C,IAAI,iCAAiC,WAAW,IAAI;YAC9F,yCAAyC,IAAI,qCAAqC,CACrF,CAAC;IACJ,CAAC;IACD,OAAO,QAAQ,CAAC,EAAE,CAAC;AACrB,CAAC;AAED,oGAAoG;AACpG,KAAK,UAAU,mBAAmB,CAAC,QAIlC;IACC,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,GAAG,QAAQ,CAAC;IAC7C,MAAM,UAAU,GAAG,GAAG,IAAI,iBAAiB,CAAC;IAC5C,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;IACzF,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QACpC,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;YAC7B,EAAE,EAAE,QAAQ;YACZ,WAAW;YACX,IAAI,EAAE,UAAU;YAChB,WAAW,EAAE,mCAAmC,IAAI,SAAS;YAC7D,SAAS,EAAE,IAAI;YACf,QAAQ,EAAE,KAAK;SAChB,CAAC,CAAC;QACH,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CACb,8CAA8C,UAAU,iCAAiC,WAAW,IAAI;YACtG,yCAAyC,IAAI,uCAAuC,CACvF,CAAC;IACJ,CAAC;IACD,OAAO,QAAQ,CAAC,EAAE,CAAC;AACrB,CAAC;AAED;;;;;;;;GAQG;AACH,KAAK,UAAU,uBAAuB,CAAC,QAKtC;IACC,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,WAAW,EAAE,GAAG,QAAQ,CAAC;IAC9D,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC,cAAc,CAAC,EAAE,WAAW,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC9F,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,YAAY,KAAK,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC;IAEvG,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;QACrC,IAAI,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC;YAAE,SAAS;QACnC,MAAM,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC,IAAI,CAAC;YACtC,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE;YACtB,WAAW;YACX,QAAQ;YACR,UAAU;YACV,YAAY,EAAE,IAAI;YAClB,cAAc,EAAE,IAAI;SACrB,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,sGAAsG;AACtG,KAAK,UAAU,yBAAyB,CAAC,QAMxC;IACC,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,GAAG,QAAQ,CAAC;IAElE,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;IACpE,MAAM,QAAQ,GAAG,MAAM,mBAAmB,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;IAExE,kGAAkG;IAClG,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,YAAY,CAAC,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC,CAAC;IAClF,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,KAAK,QAAQ,CAAC,EAAE,CAAC;QACtD,MAAM,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;IAChG,CAAC;IAED,MAAM,uBAAuB,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC,CAAC;IAE5E,KAAK,MAAM,CAAC,CAAC,2DAA2D;IACxE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;AAC9B,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,KAAK,UAAU,sBAAsB,CAAC,QAKrC;IACC,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,EAAE,GAAG,QAAQ,CAAC;IAEjE,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,iBAAiB,CAAC;QAClE,WAAW;QACX,WAAW,EAAE,gBAAgB;KAC9B,CAAC,CAAC;IACH,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO;IAEjC,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,yBAAyB,CAAC;QACjD,IAAI;QACJ,WAAW;QACX,IAAI,EAAE,eAAe;QACrB,WAAW,EAAE,sBAAsB;QACnC,MAAM;KACP,CAAC,CAAC;IACH,MAAM,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,IAAI,CAAC;QACnC,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE;QACtB,WAAW;QACX,WAAW,EAAE,gBAAgB;QAC7B,MAAM;KACP,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,QAGlC;IACC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,QAAQ,CAAC;IACjC,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,CAAC;IACtC,MAAM,aAAa,GAAG,iBAAiB,CAAC,KAAK,CAAC,aAAa,IAAI,OAAO,CAAC,CAAC;IACxE,MAAM,aAAa,GAAG,KAAK,CAAC,aAAa,CAAC;IAC1C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;IAEnC,MAAM,iBAAiB,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,cAAc,CAAC;QAC9D,WAAW;QACX,QAAQ,EAAE,aAAa;KACxB,CAAC,CAAC;IACH,IAAI,iBAAiB,EAAE,CAAC;QACtB,+FAA+F;QAC/F,kFAAkF;QAClF,MAAM,sBAAsB,CAAC;YAC3B,IAAI;YACJ,WAAW;YACX,gBAAgB,EAAE,iBAAiB,CAAC,WAAW;YAC/C,MAAM;SACP,CAAC,CAAC;QACH,MAAM,cAAc,GAAG,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI,CAC7E,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,KAAK,QAAQ,IAAI,GAAG,CAAC,EAAE,KAAK,8BAA8B,CAC5E,CAAC;QACF,OAAO;YACL,gBAAgB,EAAE,iBAAiB,CAAC,WAAW;YAC/C,iBAAiB,EAAE,cAAc,EAAE,EAAE,IAAI,8BAA8B;SACxE,CAAC;IACJ,CAAC;IAED,iGAAiG;IACjG,iGAAiG;IACjG,oEAAoE;IACpE,MAAM,cAAc,GAAG,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI,CAC7E,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,KAAK,QAAQ,IAAI,GAAG,CAAC,EAAE,KAAK,8BAA8B,CAC5E,CAAC;IACF,MAAM,iBAAiB,GAAG,cAAc,EAAE,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;IACnE,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC;YAC/B,EAAE,EAAE,iBAAiB;YACrB,WAAW;YACX,IAAI,EAAE,QAAQ;YACd,WAAW,EAAE,QAAQ;YACrB,MAAM,EAAE,QAAQ;YAChB,SAAS,EAAE,MAAM;SAClB,CAAC,CAAC;IACL,CAAC;IAED,2EAA2E;IAC3E,iDAAiD;IACjD,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC;QAC/B,EAAE,EAAE,8BAA8B;QAClC,WAAW;QACX,IAAI,EAAE,QAAQ;QACd,WAAW,EAAE,6BAA6B;QAC1C,MAAM,EAAE,UAAU;QAClB,UAAU,EAAE,MAAM;QAClB,SAAS,EAAE,MAAM;KAClB,CAAC,CAAC;IAEH,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,MAAM,yBAAyB,CAAC;QAC9D,IAAI;QACJ,WAAW;QACX,IAAI,EAAE,eAAe;QACrB,WAAW,EAAE,sBAAsB;QACnC,MAAM;KACP,CAAC,CAAC;IAEH,MAAM,yBAAyB,CAAC;QAC9B,IAAI;QACJ,WAAW;QACX,IAAI,EAAE,OAAO;QACb,WAAW,EAAE,yBAAyB;QACtC,MAAM;KACP,CAAC,CAAC;IACH,MAAM,yBAAyB,CAAC;QAC9B,IAAI;QACJ,WAAW;QACX,IAAI,EAAE,QAAQ;QACd,WAAW,EAAE,0BAA0B;QACvC,MAAM;KACP,CAAC,CAAC;IACH,MAAM,yBAAyB,CAAC;QAC9B,IAAI;QACJ,WAAW;QACX,IAAI,EAAE,QAAQ;QACd,WAAW,EAAE,0BAA0B;QACvC,MAAM;KACP,CAAC,CAAC;IAEH,0FAA0F;IAC1F,4FAA4F;IAC5F,6FAA6F;IAC7F,4FAA4F;IAC5F,kFAAkF;IAClF,MAAM,iBAAiB,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IAEhE,MAAM,gBAAgB,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;IAC5C,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC;QAC/B,EAAE,EAAE,gBAAgB;QACpB,WAAW;QACX,IAAI,EAAE,MAAM;QACZ,WAAW,EAAE,OAAO;QACpB,MAAM,EAAE,QAAQ;QAChB,SAAS,EAAE,MAAM;KAClB,CAAC,CAAC;IACH,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC;QAC1B,WAAW,EAAE,gBAAgB;QAC7B,WAAW;QACX,QAAQ,EAAE,aAAa;QACvB,KAAK,EAAE,KAAK,CAAC,UAAU;QACvB,YAAY,EAAE,iBAAiB;KAChC,CAAC,CAAC;IACH,+FAA+F;IAC/F,uDAAuD;IACvD,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,iBAAiB,CAAC;QACvE,WAAW;QACX,WAAW,EAAE,gBAAgB;KAC9B,CAAC,CAAC;IACH,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,KAAK,WAAW,CAAC,EAAE,CAAC;QAChE,MAAM,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,IAAI,CAAC;YACnC,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE;YACtB,WAAW;YACX,WAAW,EAAE,gBAAgB;YAC7B,MAAM,EAAE,WAAW;SACpB,CAAC,CAAC;IACL,CAAC;IAED,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,CAAC;AACjD,CAAC"}

package/dist/media/blob-store.fs.d.ts

@@ -28,6 +28,13 @@ export declare class LocalFsBlobStore implements BlobStorePort {
     get(input: {
         storageKey: string;
     }): Promise<Uint8Array>;
+    /**
+     * `ENOENT` (the path genuinely does not exist) resolves to `false`. Any other `stat()` failure
+     * (`EACCES` permission denied, `ENOTDIR`, `EIO`, ...) is rethrown raw — same "catch the one
+     * known code, rethrow everything else" shape {@link putIfAbsent}'s `EEXIST` handling above
+     * already uses — instead of collapsing into `false`: a caller branching on `exists()` must not
+     * mistake "this stat failed" for "the object was deleted".
+     */
     exists(input: {
         storageKey: string;
     }): Promise<boolean>;

package/dist/media/blob-store.fs.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"blob-store.fs.d.ts","sourceRoot":"","sources":["../../src/media/blob-store.fs.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAG9D,MAAM,WAAW,oBAAoB;IACnC,iEAAiE;IACjE,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,qBAAa,gBAAiB,YAAW,aAAa;IACpD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;gBAErB,IAAI,EAAE,oBAAoB;IAItC,OAAO,CAAC,WAAW;IAIb,GAAG,CAAC,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC;QAAE,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC;IAQ/D;;;;;;;;;;OAUG;IACG,WAAW,CAAC,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC;IAenF,GAAG,CAAC,KAAK,EAAE;QAAE,UAAU,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,UAAU,CAAC;IAIvD,MAAM,CAAC,KAAK,EAAE;QAAE,UAAU,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,OAAO,CAAC;IASvD,MAAM,CAAC,KAAK,EAAE;QAAE,UAAU,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;CAG3D"}
+{"version":3,"file":"blob-store.fs.d.ts","sourceRoot":"","sources":["../../src/media/blob-store.fs.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAG9D,MAAM,WAAW,oBAAoB;IACnC,iEAAiE;IACjE,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,qBAAa,gBAAiB,YAAW,aAAa;IACpD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;gBAErB,IAAI,EAAE,oBAAoB;IAItC,OAAO,CAAC,WAAW;IAIb,GAAG,CAAC,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC;QAAE,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC;IAQ/D;;;;;;;;;;OAUG;IACG,WAAW,CAAC,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC;IAenF,GAAG,CAAC,KAAK,EAAE;QAAE,UAAU,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,UAAU,CAAC;IAI7D;;;;;;OAMG;IACG,MAAM,CAAC,KAAK,EAAE;QAAE,UAAU,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,OAAO,CAAC;IAYvD,MAAM,CAAC,KAAK,EAAE;QAAE,UAAU,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;CAG3D"}

package/dist/media/blob-store.fs.js

@@ -58,13 +58,23 @@ export class LocalFsBlobStore {
     async get(input) {
         return readFile(this.resolvePath(input.storageKey));
     }
+    /**
+     * `ENOENT` (the path genuinely does not exist) resolves to `false`. Any other `stat()` failure
+     * (`EACCES` permission denied, `ENOTDIR`, `EIO`, ...) is rethrown raw — same "catch the one
+     * known code, rethrow everything else" shape {@link putIfAbsent}'s `EEXIST` handling above
+     * already uses — instead of collapsing into `false`: a caller branching on `exists()` must not
+     * mistake "this stat failed" for "the object was deleted".
+     */
     async exists(input) {
         try {
             await stat(this.resolvePath(input.storageKey));
             return true;
         }
-        catch {
-            return false;
+        catch (err) {
+            if (err.code === "ENOENT") {
+                return false;
+            }
+            throw err;
         }
     }
     async remove(input) {

package/dist/media/blob-store.fs.js.map

@@ -1 +1 @@
-{"version":3,"file":"blob-store.fs.js","sourceRoot":"","sources":["../../src/media/blob-store.fs.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACxE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAG1C,OAAO,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AAOtD,MAAM,OAAO,gBAAgB;IACV,OAAO,CAAS;IAEjC,YAAY,IAA0B;QACpC,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;IAC9B,CAAC;IAEO,WAAW,CAAC,UAAkB;QACpC,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IACxC,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,KAAmB;QAC3B,MAAM,UAAU,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC;QAChD,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC;QAC1C,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAChD,MAAM,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;QACnC,OAAO,EAAE,UAAU,EAAE,CAAC;IACxB,CAAC;IAED;;;;;;;;;;OAUG;IACH,KAAK,CAAC,WAAW,CAAC,KAAmB;QACnC,MAAM,UAAU,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC;QAChD,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC;QAC1C,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAChD,IAAI,CAAC;YACH,MAAM,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YACnD,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QACvC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACrD,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;YACxC,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,KAA6B;QACrC,OAAO,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC;IACtD,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,KAA6B;QACxC,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC;YAC/C,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,KAA6B;QACxC,MAAM,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAChE,CAAC;CACF"}
+{"version":3,"file":"blob-store.fs.js","sourceRoot":"","sources":["../../src/media/blob-store.fs.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACxE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAG1C,OAAO,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AAOtD,MAAM,OAAO,gBAAgB;IACV,OAAO,CAAS;IAEjC,YAAY,IAA0B;QACpC,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;IAC9B,CAAC;IAEO,WAAW,CAAC,UAAkB;QACpC,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IACxC,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,KAAmB;QAC3B,MAAM,UAAU,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC;QAChD,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC;QAC1C,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAChD,MAAM,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;QACnC,OAAO,EAAE,UAAU,EAAE,CAAC;IACxB,CAAC;IAED;;;;;;;;;;OAUG;IACH,KAAK,CAAC,WAAW,CAAC,KAAmB;QACnC,MAAM,UAAU,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC;QAChD,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC;QAC1C,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAChD,IAAI,CAAC;YACH,MAAM,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YACnD,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QACvC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACrD,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;YACxC,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,KAA6B;QACrC,OAAO,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC;IACtD,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,MAAM,CAAC,KAA6B;QACxC,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC;YAC/C,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACrD,OAAO,KAAK,CAAC;YACf,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,KAA6B;QACxC,MAAM,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAChE,CAAC;CACF"}

package/dist/media/content-type-sniffer.d.ts

@@ -31,7 +31,7 @@
  */
 /** Recognized outputs. Anything not covered here falls back to the network's
  * default-safe unknown-binary label — see {@link sniffContentType}'s doc. */
-export type SniffedContentType = "image/png" | "image/jpeg" | "image/gif" | "image/webp" | "video/mp4" | "video/webm" | "text/html" | "image/svg+xml" | "application/octet-stream";
+export type SniffedContentType = "image/png" | "image/jpeg" | "image/gif" | "image/webp" | "image/avif" | "video/mp4" | "video/webm" | "text/html" | "image/svg+xml" | "application/octet-stream";
 /**
  * Identifies a media type from `bytes`' leading magic bytes. Allowlist-shaped: only the formats
  * named in {@link SniffedContentType} are ever returned as something other than

package/dist/media/content-type-sniffer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"content-type-sniffer.d.ts","sourceRoot":"","sources":["../../src/media/content-type-sniffer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH;6EAC6E;AAC7E,MAAM,MAAM,kBAAkB,GAC1B,WAAW,GACX,YAAY,GACZ,WAAW,GACX,YAAY,GACZ,WAAW,GACX,YAAY,GACZ,WAAW,GACX,eAAe,GACf,0BAA0B,CAAC;AA2F/B;;;;;;;;;;;;GAYG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,UAAU,GAAG,kBAAkB,CAatE"}
+{"version":3,"file":"content-type-sniffer.d.ts","sourceRoot":"","sources":["../../src/media/content-type-sniffer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH;6EAC6E;AAC7E,MAAM,MAAM,kBAAkB,GAC1B,WAAW,GACX,YAAY,GACZ,WAAW,GACX,YAAY,GACZ,YAAY,GACZ,WAAW,GACX,YAAY,GACZ,WAAW,GACX,eAAe,GACf,0BAA0B,CAAC;AAwI/B;;;;;;;;;;;;GAYG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,UAAU,GAAG,kBAAkB,CAgBtE"}

package/dist/media/content-type-sniffer.js

@@ -64,11 +64,55 @@ function isGif(bytes) {
 function isWebp(bytes) {
     return asciiEqualAt(bytes, 0, "RIFF") && asciiEqualAt(bytes, 8, "WEBP");
 }
-/** ISO-BMFF (MP4 and its siblings): a leading box whose 4-byte type tag at offset 4 is `ftyp`. The
- * box's own size field (offset 0-3) is deliberately not checked — it varies by file. */
-function isIsoBmffMp4(bytes) {
+/** ISO-BMFF: a leading box whose 4-byte type tag at offset 4 is `ftyp`. The box's own size field
+ * (offset 0-3) is deliberately not checked here — it varies by file. This says only "some member
+ * of the ISO-BMFF family", NOT "MP4": AVIF, HEIC and MP4 all match it, which is why
+ * {@link isAvif} must run first and why {@link sniffContentType} treats this as the family's
+ * last-resort fallback rather than a positive MP4 identification. */
+function isIsoBmffFtyp(bytes) {
     return asciiEqualAt(bytes, 4, "ftyp");
 }
+/** ISO-BMFF brands that identify AVIF: a still image (`avif`) or an image sequence (`avis`). */
+const AVIF_BRANDS = ["avif", "avis"];
+const FTYP_MAJOR_BRAND_OFFSET = 8;
+/** Compatible brands follow the major brand (offset 8) and 4-byte minor version (offset 12). */
+const FTYP_COMPATIBLE_BRANDS_OFFSET = 16;
+/** Bound on the compatible-brand list scan — real `ftyp` boxes carry a handful, never dozens. */
+const MAX_SCANNED_COMPATIBLE_BRANDS = 16;
+/** The `ftyp` box's declared end offset (big-endian size at bytes 0-3), clamped to the bytes
+ * actually present so a truncated or size-inflating file can never push the brand scan past the
+ * buffer or into unrelated trailing boxes. */
+function ftypBoxEnd(bytes) {
+    if (bytes.length < FTYP_MAJOR_BRAND_OFFSET)
+        return 0;
+    const declared = ((bytes[0] << 24) | (bytes[1] << 16) | (bytes[2] << 8) | bytes[3]) >>> 0;
+    return Math.min(declared, bytes.length);
+}
+function hasAvifBrandAt(bytes, offset) {
+    return AVIF_BRANDS.some((brand) => asciiEqualAt(bytes, offset, brand));
+}
+/**
+ * AVIF, distinguished from its ISO-BMFF siblings by brand rather than by the shared `ftyp` tag.
+ * The major brand alone is not sufficient: a great many real AVIF files declare the generic
+ * `mif1` (HEIF image) major brand and name `avif` only in the compatible-brand list, so both are
+ * checked. HEIC declares neither and is therefore never matched here — deliberate, since the
+ * installed libvips decodes AVIF but not HEIC.
+ */
+function isAvif(bytes) {
+    if (!isIsoBmffFtyp(bytes))
+        return false;
+    if (hasAvifBrandAt(bytes, FTYP_MAJOR_BRAND_OFFSET))
+        return true;
+    const boxEnd = ftypBoxEnd(bytes);
+    for (let index = 0; index < MAX_SCANNED_COMPATIBLE_BRANDS; index++) {
+        const offset = FTYP_COMPATIBLE_BRANDS_OFFSET + index * 4;
+        if (offset + 4 > boxEnd)
+            return false;
+        if (hasAvifBrandAt(bytes, offset))
+            return true;
+    }
+    return false;
+}
 function isWebm(bytes) {
     return bytesEqualAt(bytes, 0, EBML_SIGNATURE);
 }
@@ -127,7 +171,11 @@ export function sniffContentType(bytes) {
         return "image/gif";
     if (isWebp(bytes))
         return "image/webp";
-    if (isIsoBmffMp4(bytes))
+    // MUST precede the MP4 check: AVIF is ISO-BMFF too, so the brand-blind `ftyp` test below would
+    // otherwise claim every AVIF as video/mp4 (the 2026-09-06 regression).
+    if (isAvif(bytes))
+        return "image/avif";
+    if (isIsoBmffFtyp(bytes))
         return "video/mp4";
     if (isWebm(bytes))
         return "video/webm";

package/dist/media/content-type-sniffer.js.map

@@ -1 +1 @@
-{"version":3,"file":"content-type-sniffer.js","sourceRoot":"","sources":["../../src/media/content-type-sniffer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAeH,4FAA4F;AAC5F,MAAM,iBAAiB,GAAG,GAAG,CAAC;AAE9B;;gEAEgE;AAChE,SAAS,YAAY,CAAC,KAAiB,EAAE,MAAc,EAAE,QAA2B;IAClF,IAAI,KAAK,CAAC,MAAM,GAAG,MAAM,GAAG,QAAQ,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1D,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACzC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;IACtD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,YAAY,CAAC,KAAiB,EAAE,MAAc,EAAE,QAAgB;IACvE,OAAO,YAAY,CACjB,KAAK,EACL,MAAM,EACN,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAC/C,CAAC;AACJ,CAAC;AAED,MAAM,aAAa,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;AACvE,MAAM,cAAc,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;AAC1C;iGACiG;AACjG,MAAM,cAAc,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;AAEhD,SAAS,KAAK,CAAC,KAAiB;IAC9B,OAAO,YAAY,CAAC,KAAK,EAAE,CAAC,EAAE,aAAa,CAAC,CAAC;AAC/C,CAAC;AAED,SAAS,MAAM,CAAC,KAAiB;IAC/B,OAAO,YAAY,CAAC,KAAK,EAAE,CAAC,EAAE,cAAc,CAAC,CAAC;AAChD,CAAC;AAED,SAAS,KAAK,CAAC,KAAiB;IAC9B,OAAO,YAAY,CAAC,KAAK,EAAE,CAAC,EAAE,QAAQ,CAAC,IAAI,YAAY,CAAC,KAAK,EAAE,CAAC,EAAE,QAAQ,CAAC,CAAC;AAC9E,CAAC;AAED,mGAAmG;AACnG,SAAS,MAAM,CAAC,KAAiB;IAC/B,OAAO,YAAY,CAAC,KAAK,EAAE,CAAC,EAAE,MAAM,CAAC,IAAI,YAAY,CAAC,KAAK,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC;AAC1E,CAAC;AAED;wFACwF;AACxF,SAAS,YAAY,CAAC,KAAiB;IACrC,OAAO,YAAY,CAAC,KAAK,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC;AACxC,CAAC;AAED,SAAS,MAAM,CAAC,KAAiB;IAC/B,OAAO,YAAY,CAAC,KAAK,EAAE,CAAC,EAAE,cAAc,CAAC,CAAC;AAChD,CAAC;AAED,MAAM,QAAQ,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;AAEpC;;;oDAGoD;AACpD,SAAS,WAAW,CAAC,KAAiB;IACpC,MAAM,MAAM,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC,CAAC;IAC5E,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACvD,MAAM,UAAU,GAAG,YAAY,CAAC,MAAM,EAAE,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;IAChG,OAAO,UAAU,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;AACtD,CAAC;AAED,MAAM,aAAa,GAAG,CAAC,gBAAgB,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAC;AAEjH;;;;+DAI+D;AAC/D,SAAS,UAAU,CAAC,IAAY;IAC9B,IAAI,aAAa,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACzE,IAAI,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC5D,OAAO,KAAK,CAAC;AACf,CAAC;AAED;sFACsF;AACtF,SAAS,SAAS,CAAC,IAAY;IAC7B,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IACzC,IAAI,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC3D,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAiB;IAChD,IAAI,KAAK,CAAC,KAAK,CAAC;QAAE,OAAO,WAAW,CAAC;IACrC,IAAI,MAAM,CAAC,KAAK,CAAC;QAAE,OAAO,YAAY,CAAC;IACvC,IAAI,KAAK,CAAC,KAAK,CAAC;QAAE,OAAO,WAAW,CAAC;IACrC,IAAI,MAAM,CAAC,KAAK,CAAC;QAAE,OAAO,YAAY,CAAC;IACvC,IAAI,YAAY,CAAC,KAAK,CAAC;QAAE,OAAO,WAAW,CAAC;IAC5C,IAAI,MAAM,CAAC,KAAK,CAAC;QAAE,OAAO,YAAY,CAAC;IAEvC,MAAM,IAAI,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;IAChC,IAAI,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,WAAW,CAAC;IACzC,IAAI,SAAS,CAAC,IAAI,CAAC;QAAE,OAAO,eAAe,CAAC;IAE5C,OAAO,0BAA0B,CAAC;AACpC,CAAC"}
+{"version":3,"file":"content-type-sniffer.js","sourceRoot":"","sources":["../../src/media/content-type-sniffer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAgBH,4FAA4F;AAC5F,MAAM,iBAAiB,GAAG,GAAG,CAAC;AAE9B;;gEAEgE;AAChE,SAAS,YAAY,CAAC,KAAiB,EAAE,MAAc,EAAE,QAA2B;IAClF,IAAI,KAAK,CAAC,MAAM,GAAG,MAAM,GAAG,QAAQ,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1D,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACzC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;IACtD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,YAAY,CAAC,KAAiB,EAAE,MAAc,EAAE,QAAgB;IACvE,OAAO,YAAY,CACjB,KAAK,EACL,MAAM,EACN,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAC/C,CAAC;AACJ,CAAC;AAED,MAAM,aAAa,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;AACvE,MAAM,cAAc,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;AAC1C;iGACiG;AACjG,MAAM,cAAc,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;AAEhD,SAAS,KAAK,CAAC,KAAiB;IAC9B,OAAO,YAAY,CAAC,KAAK,EAAE,CAAC,EAAE,aAAa,CAAC,CAAC;AAC/C,CAAC;AAED,SAAS,MAAM,CAAC,KAAiB;IAC/B,OAAO,YAAY,CAAC,KAAK,EAAE,CAAC,EAAE,cAAc,CAAC,CAAC;AAChD,CAAC;AAED,SAAS,KAAK,CAAC,KAAiB;IAC9B,OAAO,YAAY,CAAC,KAAK,EAAE,CAAC,EAAE,QAAQ,CAAC,IAAI,YAAY,CAAC,KAAK,EAAE,CAAC,EAAE,QAAQ,CAAC,CAAC;AAC9E,CAAC;AAED,mGAAmG;AACnG,SAAS,MAAM,CAAC,KAAiB;IAC/B,OAAO,YAAY,CAAC,KAAK,EAAE,CAAC,EAAE,MAAM,CAAC,IAAI,YAAY,CAAC,KAAK,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC;AAC1E,CAAC;AAED;;;;qEAIqE;AACrE,SAAS,aAAa,CAAC,KAAiB;IACtC,OAAO,YAAY,CAAC,KAAK,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC;AACxC,CAAC;AAED,gGAAgG;AAChG,MAAM,WAAW,GAAG,CAAC,MAAM,EAAE,MAAM,CAAU,CAAC;AAE9C,MAAM,uBAAuB,GAAG,CAAC,CAAC;AAClC,gGAAgG;AAChG,MAAM,6BAA6B,GAAG,EAAE,CAAC;AACzC,iGAAiG;AACjG,MAAM,6BAA6B,GAAG,EAAE,CAAC;AAEzC;;8CAE8C;AAC9C,SAAS,UAAU,CAAC,KAAiB;IACnC,IAAI,KAAK,CAAC,MAAM,GAAG,uBAAuB;QAAE,OAAO,CAAC,CAAC;IACrD,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAE,IAAI,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAE,IAAI,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAE,IAAI,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC,KAAK,CAAC,CAAC;IAC9F,OAAO,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;AAC1C,CAAC;AAED,SAAS,cAAc,CAAC,KAAiB,EAAE,MAAc;IACvD,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;AACzE,CAAC;AAED;;;;;;GAMG;AACH,SAAS,MAAM,CAAC,KAAiB;IAC/B,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACxC,IAAI,cAAc,CAAC,KAAK,EAAE,uBAAuB,CAAC;QAAE,OAAO,IAAI,CAAC;IAEhE,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;IACjC,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,6BAA6B,EAAE,KAAK,EAAE,EAAE,CAAC;QACnE,MAAM,MAAM,GAAG,6BAA6B,GAAG,KAAK,GAAG,CAAC,CAAC;QACzD,IAAI,MAAM,GAAG,CAAC,GAAG,MAAM;YAAE,OAAO,KAAK,CAAC;QACtC,IAAI,cAAc,CAAC,KAAK,EAAE,MAAM,CAAC;YAAE,OAAO,IAAI,CAAC;IACjD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,MAAM,CAAC,KAAiB;IAC/B,OAAO,YAAY,CAAC,KAAK,EAAE,CAAC,EAAE,cAAc,CAAC,CAAC;AAChD,CAAC;AAED,MAAM,QAAQ,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;AAEpC;;;oDAGoD;AACpD,SAAS,WAAW,CAAC,KAAiB;IACpC,MAAM,MAAM,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC,CAAC;IAC5E,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACvD,MAAM,UAAU,GAAG,YAAY,CAAC,MAAM,EAAE,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;IAChG,OAAO,UAAU,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;AACtD,CAAC;AAED,MAAM,aAAa,GAAG,CAAC,gBAAgB,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAC;AAEjH;;;;+DAI+D;AAC/D,SAAS,UAAU,CAAC,IAAY;IAC9B,IAAI,aAAa,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACzE,IAAI,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC5D,OAAO,KAAK,CAAC;AACf,CAAC;AAED;sFACsF;AACtF,SAAS,SAAS,CAAC,IAAY;IAC7B,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IACzC,IAAI,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC3D,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAiB;IAChD,IAAI,KAAK,CAAC,KAAK,CAAC;QAAE,OAAO,WAAW,CAAC;IACrC,IAAI,MAAM,CAAC,KAAK,CAAC;QAAE,OAAO,YAAY,CAAC;IACvC,IAAI,KAAK,CAAC,KAAK,CAAC;QAAE,OAAO,WAAW,CAAC;IACrC,IAAI,MAAM,CAAC,KAAK,CAAC;QAAE,OAAO,YAAY,CAAC;IACvC,+FAA+F;IAC/F,uEAAuE;IACvE,IAAI,MAAM,CAAC,KAAK,CAAC;QAAE,OAAO,YAAY,CAAC;IACvC,IAAI,aAAa,CAAC,KAAK,CAAC;QAAE,OAAO,WAAW,CAAC;IAC7C,IAAI,MAAM,CAAC,KAAK,CAAC;QAAE,OAAO,YAAY,CAAC;IAEvC,MAAM,IAAI,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;IAChC,IAAI,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,WAAW,CAAC;IACzC,IAAI,SAAS,CAAC,IAAI,CAAC;QAAE,OAAO,eAAe,CAAC;IAE5C,OAAO,0BAA0B,CAAC;AACpC,CAAC"}

package/dist/media/html-attributes.d.ts

@@ -0,0 +1,90 @@
+/**
+ * @file Server-side allowlist for `MediaRecord.htmlAttributes` (2026-09-07) — the enforcement half
+ * of a validator that ALSO has a browser-side copy in Tovu's admin
+ * (`apps/admin/src/features/media/rules.ts`, `parseMediaHtmlAttributes` and friends).
+ *
+ * Deliberately duplicated, not shared via one imported module, for the same reason this codebase
+ * already hand-copies `DEFAULT_ALLOWED_MIME_TYPES` into Tovu's `FILE_HANDLER_ALLOWED_MIME_TYPES`/
+ * `IMPORTABLE_CONTENT_TYPES`: `@jini-ai/cms/media`'s barrel (`index.ts`) re-exports files that
+ * import real Node built-ins (`node:crypto` in `media-service.ts`, `node:fs` in
+ * `blob-store.fs.ts`, native `sharp` bindings in `image-transformer.sharp.ts`) — importing this
+ * subpath from a browser-bundled Vite app (Tovu's `apps/admin`) risks pulling those into the admin
+ * SPA's bundle even if only this one pure function is actually used, and this admin's own copy
+ * already exists, tested, with no such risk. This file is the copy every Node-side consumer
+ * (`media-service.ts`'s own `updateMediaMetadata`, and Tovu's `apps/website` render path, both pure
+ * backend code) can safely import from `@jini-ai/cms/media` instead of re-deriving the rules a
+ * third time.
+ *
+ * THE RULES THEMSELVES ARE NOT REDESIGNED HERE — this is a verbatim port of the admin copy's logic
+ * (allowlist membership, `on*`/`javascript:` precedence, the tokenizer, the four rejection reasons).
+ * Extend `MEDIA_HTML_ATTRIBUTE_ALLOWED_NAMES` in BOTH copies together if a new attribute is ever
+ * needed — that is the one piece of drift risk this duplication accepts, the same risk every other
+ * hand-copied list in this codebase already accepts.
+ *
+ * This is a SECURITY boundary, not a syntax convenience: media metadata is authored in Tovu's admin
+ * but rendered on the public site, so a free-text HTML-attribute passthrough is a stored-XSS vector
+ * (`onerror`, `onclick`, `style`, `href="javascript:"`, any `on*` handler) the moment it reaches a
+ * public page. A client-side-only check is not a control, since the API accepts whatever a caller
+ * sends — this file is what makes the write path (`updateMediaMetadata`) and the render path (a
+ * host's own tag-building code) actually enforce it, not just the admin form.
+ */
+/**
+ * Exact-match attribute names the allowlist accepts beyond the open-ended `data-`/`aria-` prefix
+ * families (checked separately in {@link isAllowedMediaHtmlAttributeName}). Picked for the owner's
+ * stated near-term uses (animations, custom WebMCP hooks) plus the standard `<img>`/`<video>`
+ * attributes those uses actually need; extend this list, not the parser, when a new one is needed —
+ * and keep it in sync with the identical constant in Tovu's admin copy (see this file's header).
+ */
+export declare const MEDIA_HTML_ATTRIBUTE_ALLOWED_NAMES: readonly ["loading", "decoding", "playsinline", "muted", "loop", "autoplay", "poster"];
+/** Whether `name` is on the allowlist — a well-formed attribute name
+ *  ({@link MEDIA_HTML_ATTRIBUTE_NAME_PATTERN}) that is either an exact match against
+ *  {@link MEDIA_HTML_ATTRIBUTE_ALLOWED_NAMES} or carries a `data-`/`aria-` prefix (both open-ended
+ *  families with no fixed suffix list). Case-insensitive: HTML attribute names are themselves
+ *  case-insensitive, and an operator typing `DATA-FOO` should not slip past a lowercase-only check.
+ *
+ * @complexity O(n) in the name's length (one anchored regex test), then O(1) — one prefix check,
+ * one fixed-length array lookup.
+ */
+export declare function isAllowedMediaHtmlAttributeName(name: string): boolean;
+/** Why one parsed attribute token was rejected — see {@link parseMediaHtmlAttributes}'s own doc for
+ *  why `event-handler`/`javascript-url` are checked, and reported, ahead of plain allowlist
+ *  membership. */
+export type MediaHtmlAttributeRejectionReason = "disallowed-name" | "event-handler" | "javascript-url" | "malformed";
+export interface MediaHtmlAttributeError {
+    reason: MediaHtmlAttributeRejectionReason;
+    /** The exact attribute name (or, for `malformed`, the unparsable fragment) — never a generic
+     *  "invalid input" (owner requirement: a visible, specific error naming the rejected attribute). */
+    attribute: string;
+}
+export interface ParsedMediaHtmlAttributes {
+    /** Lowercased attribute name -> value. A boolean attribute (`muted`, written with no
+     *  `="..."`) maps to `""` — recording only that it was present; how a valueless attribute gets
+     *  emitted onto the real tag is the renderer's decision, not this parser's. */
+    attributes: Record<string, string>;
+    /** `null` when every token in the input is allowed and safe; otherwise the FIRST rejection found
+     *  scanning left to right — one specific, visible reason at a time, not a batch of every problem
+     *  in the string. */
+    error: MediaHtmlAttributeError | null;
+}
+/**
+ * Parses the `htmlAttributes` field's free text (`name="value" name2="value2"`, or a bare boolean
+ * `name`) into a validated attribute map, rejecting anything not on the allowlist. Nothing here
+ * tries to sanitize or escape an otherwise-disallowed name into something safe — it is rejected
+ * outright, and the caller must show the reason (not silently drop it) so an operator can tell a
+ * typo from a hard "no".
+ *
+ * @complexity Time O(n) in `text`'s length (one regex pass over it), space O(k) for k parsed
+ *   attributes.
+ */
+export declare function parseMediaHtmlAttributes(text: string): ParsedMediaHtmlAttributes;
+/** Formats a {@link MediaHtmlAttributeError} into a plain-English message naming the rejected
+ *  attribute (owner requirement) — the server-side, non-localized counterpart to the admin's own
+ *  `describeMediaHtmlAttributeError` (which additionally runs the message through `MEDIA_DICT` for
+ *  the operator's locale). Domain errors elsewhere in this file (`MediaValidationError`'s other
+ *  messages) are likewise always plain English, so this matches that existing convention rather
+ *  than inventing a localized-error contract this service has never had.
+ *
+ * @complexity O(1).
+ */
+export declare function describeMediaHtmlAttributeError(error: MediaHtmlAttributeError): string;
+//# sourceMappingURL=html-attributes.d.ts.map

package/dist/media/html-attributes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"html-attributes.d.ts","sourceRoot":"","sources":["../../src/media/html-attributes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH;;;;;;GAMG;AACH,eAAO,MAAM,kCAAkC,wFAQrC,CAAC;AAsBX;;;;;;;;GAQG;AACH,wBAAgB,+BAA+B,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAKrE;AAED;;kBAEkB;AAClB,MAAM,MAAM,iCAAiC,GAAG,iBAAiB,GAAG,eAAe,GAAG,gBAAgB,GAAG,WAAW,CAAC;AAErH,MAAM,WAAW,uBAAuB;IACtC,MAAM,EAAE,iCAAiC,CAAC;IAC1C;wGACoG;IACpG,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,yBAAyB;IACxC;;mFAE+E;IAC/E,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnC;;yBAEqB;IACrB,KAAK,EAAE,uBAAuB,GAAG,IAAI,CAAC;CACvC;AAuBD;;;;;;;;;GASG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,MAAM,GAAG,yBAAyB,CA0BhF;AAED;;;;;;;;GAQG;AACH,wBAAgB,+BAA+B,CAAC,KAAK,EAAE,uBAAuB,GAAG,MAAM,CAKtF"}