@mano8/astro-media-m8 2.2.0 → 2.3.1

package/CHANGELOG.md

@@ -0,0 +1,383 @@
+# Changelog
+
+All notable changes to `@mano8/astro-media-m8` are documented here.
+
+This project follows [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+The major version tracks the supported `media-service-m8` **service-version
+line**, not just this package's own surface: a backend repoint is always a
+major. Note that this is the *service* version, not the contract version — the
+compatibility helper admits several contracts (`1.0` and `1.1`) against one
+service line, so the contract can move without moving the major.
+
+## [Unreleased]
+
+## [2.3.1] - 2026-09-26 · tracks media-service 3.0.2
+
+**Patch.** Tracks the published `@mano8/astro-ui-m8` `1.5.2` and
+`@mano8/astro-auth-m8` `2.7.1` (`B39-astro-ui-changelog-release`, finding
+`G38`). The only shipped change is `package.json`'s floors, with the README
+that states them. The contract stays `media-service-m8@1.1`, range
+`>=2.0.0 <4.0.0`, and the tested service version stays `3.0.2`.
+
+### Added
+
+- **A lock that does not pin every package fails the build**
+  (`B34-npm-lock-integrity-guard`, finding `G34`(b)).
+  `scripts/verify-lock-integrity.mjs` (`npm run verify:lock-integrity`)
+  refuses a `package-lock.json` below `lockfileVersion` 3, or one with any
+  entry that lacks `integrity` or `resolved`, carries a non-`sha512` hash,
+  resolves outside `https://registry.npmjs.org/`, or is a link or `file:`
+  source, and names every offending key. `npm ci` installs an entry with no
+  `integrity` without checking a hash and says nothing, which is how `G33`
+  went unseen. CI runs it before `npm ci` in every job that installs.
+  `tests/lock-integrity.test.ts` proves each refusal against a fixture lock
+  and asserts this repository's own lock passes. The script is
+  dependency-free and byte-identical in the fleet's six npm repositories.
+  This lock already passed; the fixtures prove the red path. Only
+  `package.json`'s `scripts` gains an entry, so no release is owed.
+
+### Changed
+
+- `@mano8/astro-ui-m8` floor `^1.5.1` → `^1.5.2` (`dependencies`) and
+  `@mano8/astro-auth-m8` `^2.7.0` → `^2.7.1` (`peerDependencies` and
+  `devDependencies`, still equal), the newest published releases (§0.5's
+  explicit-pin rule). The lock moves those two entries, each with its
+  registry `resolved` and `sha512` `integrity`. The README states the new
+  floors.
+
+### Security
+
+- **The publish job verifies the lock before it installs**
+  (`B37-publish-lock-guard`, finding `G36`). `B34` guarded every `CI.yaml`
+  job but not the one that holds `id-token: write` and builds the tarball,
+  and the environment's `tag:v*` rule matches a tag by name, not by where it
+  points. `npm-publish.yml` now runs `npm run verify:lock-integrity` before
+  `npm ci`, and `tests/publish-workflow.test.ts` holds the order.
+
+## [2.3.0] - 2026-09-26 · tracks media-service 3.0.2
+
+**Minor bump.** Tracks the published `media-service-m8` `3.0.2` patch release
+(`B31-plugin-tracking-tail`, finding `G32`). The supported contract stays
+`media-service-m8@1.1`, range `>=2.0.0 <4.0.0` — no contract repoint, so this
+is not a major; a minor rather than a patch on the same reasoning as `2.2.0`
+(an exported compatibility constant changes value).
+
+### Changed
+
+- `MEDIA_SERVICE_M8_TESTED_SERVICE_VERSION` and `package.json`'s
+  `mediaServiceM8.testedServiceVersion` move `3.0.1` → `3.0.2`. Read from
+  `v3.0.1` to `v3.0.2` on the service, nothing this plugin models moved:
+  `3.0.2` is the fleet's Debian patch layer, a UTC PostgreSQL session clock,
+  and typing fixes — the upload reject `reason` is hoisted into a named
+  `UploadRejectReason` alias carrying the same five values. Dashboard activity
+  bounds now always carry a UTC offset; this package types them as strings,
+  so both forms parse.
+- `README.md` names `3.0.2` as the tested service version.
+- Raised the `@mano8/astro-auth-m8` floor from `^2.6.0` to `^2.7.0` in both
+  `peerDependencies` and `devDependencies` (`B31-plugin-tracking-tail` leg 2).
+  `2.7.0` is the auth tracking release for `fa-auth-m8` `2.2.3`, published
+  before this one, and `package-lock.json` resolves its tarball. `README.md`
+  names the new peer floor, and corrects the `@mano8/astro-ui-m8` floor it
+  quoted (`^1.5.0`) to the declared `^1.5.1`.
+
+### Unchanged, deliberately
+
+- `MEDIA_SERVICE_M8_MIN_SERVICE_VERSION` stays `2.0.0` and
+  `MEDIA_SERVICE_M8_MAX_SERVICE_VERSION_EXCLUSIVE` stays `4.0.0`, and the
+  contract stays `1.1`: the range already admits `3.0.2`, and no served shape
+  changed.
+
+### Security
+
+- **npm is reached only from a published release**
+  (`B30-pre-publish-hardening` leg 5, finding `G25`). `npm-publish.yml` ran
+  `npm publish` on any `workflow_dispatch`, from any branch, into an `npm`
+  environment with no protection. A dispatch now
+  runs `npm publish --dry-run`; a release fails unless its tag, with the `v`
+  stripped, is `package.json`'s `version`; and the tarball ships
+  `CHANGELOG.md` from the next release (`G31`(b)).
+  `tests/publish-workflow.test.ts` locks each rule. The operator's `v*` tag
+  policy on the `npm` environment is the platform half of the same rule.
+
+## [2.2.0] - 2026-09-16 · tracks media-service 3.0.1
+
+**Minor bump.** Tracks the `media-service-m8` `3.0.1` patch release. The
+supported contract stays `media-service-m8@1.1`, range `>=2.0.0 <4.0.0` — no
+contract repoint, so this is not a major; a minor rather than a patch on the
+same reasoning the fleet's auth client uses for its tracking releases (an
+exported compatibility constant changes value).
+
+### Changed
+
+- `MEDIA_SERVICE_M8_TESTED_SERVICE_VERSION` and `package.json`'s
+  `mediaServiceM8.testedServiceVersion` move `3.0.0` → `3.0.1`. `3.0.1` fixes
+  the service's hard purge, which answered `500` for any soft-deleted object
+  that had ever had a variant generated (`media_variant` / `variant_job`
+  reference `media_object` without `ON DELETE CASCADE`); it is a maintenance
+  code path — nothing served over HTTP changes, no schema here moves — so
+  this release exists only to keep the tracked version in step with the
+  fleet's compose pins (`media-service-m8` and `fa-ui-m8` stacks re-pinned
+  to `3.0.1` the same day).
+- `README.md` names `3.0.1` as the tested service version.
+
+### Unchanged, deliberately
+
+- `MEDIA_SERVICE_M8_MIN_SERVICE_VERSION` stays `2.0.0` and
+  `MEDIA_SERVICE_M8_MAX_SERVICE_VERSION_EXCLUSIVE` stays `4.0.0`: the range
+  admits `3.0.1` already, and nothing on the `2.x`/`3.x` line has touched the
+  `1.1` contract this plugin speaks.
+
+## [2.1.0] - 2026-09-14 · media-service 3.x admitted (additive)
+
+**Minor bump.** `media-service-m8` `3.0.0` ships an object-storage backend and
+env-var rename — the `MINIO_*` deprecation shim is removed in favor of the
+provider-neutral `S3_*` settings — with no change to the `1.1` HTTP contract
+this plugin models. Widening the supported range to admit it alongside the
+existing 2.x line is therefore additive, not breaking.
+
+### Changed
+
+- `MEDIA_SERVICE_M8_MAX_SERVICE_VERSION_EXCLUSIVE` `"3.0.0"` → `"4.0.0"`;
+  `MEDIA_SERVICE_M8_SERVICE_VERSION_RANGE` now `>=2.0.0 <4.0.0`.
+  `MEDIA_SERVICE_M8_MIN_SERVICE_VERSION` stays `"2.0.0"` — the published
+  `2.1.0` service remains a valid peer.
+- `MEDIA_SERVICE_M8_TESTED_SERVICE_VERSION` `"2.1.1"` → `"3.0.0"`, the
+  media-sdk-m8 `1.0.0` / media-service-m8 `3.0.0` shim-removal cut this
+  client's schemas were diffed against.
+- `package.json` `mediaServiceM8.serviceVersionRange` →
+  `">=2.0.0 <4.0.0"`, `mediaServiceM8.testedServiceVersion` → `"3.0.0"`.
+- **The required `@mano8/astro-auth-m8` peer is repointed `^2.4.1` → `^2.6.0`**
+  in both `peerDependencies` and `devDependencies`; the lockfile resolves
+  `astro-auth-m8-2.6.0.tgz`, the registry's current `latest`. `2.5.0` and
+  `2.6.0` are tracking releases — they move the auth plugin's tested
+  `fa-auth-m8` issuer version `2.0.0` → `2.2.1` (the JWKS `kid`/key-binding
+  remediation line the fleet's compose pins now run) and leave its
+  `fa-auth-m8@2.0` contract, minimum service version and peer ranges
+  unchanged, so nothing this plugin imports or adapts moves. The floor states
+  the pairing the fleet is verified against rather than one it merely
+  tolerates. `README.md`'s install section, which still read `^2.2.0`, now
+  names the same floor.
+
+### Fixed
+
+- `js-yaml` `4.3.1` → `4.3.2` in the lockfile (transitive, via `astro` /
+  `@astrojs/starlight` / `@astrojs/internal-helpers`), closing
+  [GHSA-2883-xcg3-v3hh](https://github.com/advisories/GHSA-2883-xcg3-v3hh)
+  (high: `maxTotalMergeKeys` does not bound CPU use for empty merge sources),
+  which had turned CI's `npm audit --audit-level=high` gate red on this
+  branch. No manifest range changes; the patch is inside every declaring
+  package's existing range.
+
+## [2.0.0] - 2026-08-30 · media-service 2.x repoint, auth generation jump
+
+**Major bump, for two independent breaking reasons.**
+
+1. **The supported `media-service-m8` moves from 1.x to 2.x.**
+   `MEDIA_SERVICE_M8_MIN_SERVICE_VERSION` goes `1.0.0` → `2.0.0` and the
+   exclusive maximum `2.0.0` → `3.0.0`, so a pre-tier `1.x` service is
+   deliberately **no longer admitted**: it cannot serve the role-tier
+   authorization behaviour this plugin's guards assume. A consumer pointing at a
+   1.x service is refused at preflight, which is a breaking change to what this
+   package works against.
+2. **The required `@mano8/astro-auth-m8` peer crosses a generation**, `^1.5.0` →
+   `^2.4.1`. The old range excluded every 2.x auth release, so consumers pairing
+   this plugin with a 1.x auth must upgrade auth first.
+
+No export of this package is removed or renamed; both breaking changes are to
+what it requires around it.
+
+**This section is a fold of two never-published versions.** `1.2.0` and `2.0.0`
+were both numbered in source without ever being tagged — `origin`'s newest tag
+is `v1.1.1` — so under the fleet's one-bump-per-unpublished-release rule they
+are one release, and the number is the major the work actually earns. `1.2.0`
+had been numbered a **minor** while carrying reason 1 above, which is what made
+folding it the correct call rather than a tidying one.
+
+### Added
+
+- **Every React island root is wrapped in an error boundary** (`A-C3`). A throw
+  inside `LibraryView`, `ObjectDetailView`, `UploadView`, `PresetsView` or
+  `AdminMediaView` now renders the canonical `astro-ui-m8` error state instead
+  of tearing down the island and leaving a blank region on the host page.
+- **Dev-only `/_preview` gallery** (`A-C2`). `npm run preview:dev` mounts every
+  shipped island against an in-memory stand-in for `media-service-m8`: only
+  `fetch` is replaced, so the views, hooks, API wrappers and Zod schemas
+  exercised are the shipped ones. `npm run preview:build` typechecks and builds
+  the fixture, and CI runs both. The gallery is a development fixture and is not
+  part of the published tarball.
+
+- **Category CRUD starter page.** Starter mode now ships `/media/categories`,
+  backed by the existing tenant-scoped `CategoryManager`, so consumers can
+  mount category creation, rename, reparent and delete as a real page.
+
+### Fixed
+
+- **The tree view's category pane scrolls horizontally instead of clipping**
+  (`U7`). The pane's width is fixed from `md` up (`md:w-64`) while a nested
+  branch's is not, so a tree several levels deep ran off the pane edge with no
+  way to reach the rest of it — every row was ellipsed at the same point and
+  the indentation kept pushing the labels further right. Three changes make the
+  pane show its content rather than hide it, and they only work together:
+  `overflow-y-auto` becomes `overflow-auto`; the `role="tree"` list takes
+  `min-w-max` so it states the width of its widest row; and
+  `.fa-media-tree-name` drops `truncate` for plain `whitespace-nowrap`. A
+  truncating label can never widen its list, so with the old rule the new
+  horizontal bar would have had nothing to reveal. The bar is `auto`, so a
+  shallow tree renders exactly as before. Carried in both the Tailwind token
+  classes and the framework-neutral `media.css` fallback (`D11`).
+- **The tree view's two panes are the same height, and the pane is no longer a
+  fixed 16rem.** The row was `md:items-start`, so the category pane hugged its
+  own content and sat as a short box beside a long results table; it is
+  `items-stretch` at both widths now, so the pane takes the results column's
+  height and the `max-h` only bites when the tree is the taller of the two —
+  then it scrolls at the cap rather than growing the page. `min-h-0` is required
+  for that scroll to engage at all, since a stretched flex item will not shrink
+  below its content. The width moves from a flat `w-64` to
+  `clamp(16rem, 24vw, 26rem)`: 16rem was the same pane on a 13" laptop and a 27"
+  monitor and too narrow for a nested tree on both.
+- **The tree pane is now complete under Tailwind alone.** The list reset and
+  the child indent were the only tree geometry with no Tailwind twin — they
+  existed solely in the scaffold stylesheet. A consumer that maps its own theme
+  instead of loading that stylesheet (which is the documented way to use this
+  package with a design system) therefore lost the indentation and the branch
+  guide line entirely, and the tree read as a flat list. Both are stated as
+  utilities on the elements now (`m-0 list-none p-0` on the tree list,
+  `ml-1 border-l border-border pl-3` on each child group), with the scaffold
+  rules kept unchanged for consumers without Tailwind.
+- **The two-pane split waits for `lg`, not `md`.** At 48rem a category pane and
+  a six-column table shared 768px and both were cramped, so the stacked layout
+  now carries the tablet range where it reads better.
+- **The results table scrolls instead of squashing.** Six columns have no
+  readable narrow form, so the table sits in its own `overflow-x-auto` box with
+  `min-w-[34rem]` — the `min-width` is what gives the bar something to reveal,
+  since `width: 100%` alone can never exceed its wrapper. Applies to the list
+  view as well as the tree view, since both render the same table.
+- **The import dropzone stops borrowing the tree pane's class.** It reused
+  `treePaneClassName` outright for its card look, which quietly handed it the
+  pane's width and scroll behaviour too — so sizing the pane for a category tree
+  would have resized a file dropzone with it. It carries
+  `fa-media-transfer-dropzone` now, and with it a framework-neutral fallback it
+  never had: `--active` was referenced by the runtime with no rule behind it
+  (`D11`).
+- **The child indent is trimmed** — `.fa-media-tree-children` `padding-left`
+  `1.25rem` → `0.75rem` and `margin-left` `0.4rem` → `0.25rem`. Each level pays
+  for indent *and* a `1.25rem` toggle column, so on a four-deep tree the indent
+  was the largest single contributor to the width that pushed rows out of the
+  pane. `0.75rem` still clears the toggle glyph, so the branch guide rule stays
+  legible against the row it belongs to.
+
+### Changed
+
+- **`MediaLibrary.tsx` is split into modules, and the largest components are
+  decomposed.** The file had grown to 1224 non-comment lines and carried the
+  library, its tree pane, its transfer panel, the whole label contract and every
+  Tailwind token class in one place; it is now `mediaLibraryLabels`,
+  `mediaLibraryStyles`, `categoryBranch`, `MediaCategoryTreePane`,
+  `MediaTransferPanel` and a 507-line `MediaLibrary`. The same pass extracts
+  subcomponents and hooks from `CategoryMultiSelectView`, `CategoryManagerRow`,
+  `CategoryManager`, `MediaObjectPreview` and the three library registry skins,
+  and splits the two oversized tree-pane tests into focused cases. **No export,
+  prop, class name or rendered markup changes** — `MediaLibraryLabels` is still
+  exported from `MediaLibrary.js`, and all 237 tests pass unchanged apart from
+  the ones deliberately split. It is a Codacy complexity gate the fleet keeps
+  green, not a redesign.
+- **The category tree pane opens with every branch collapsed.** It used to
+  render the whole tree expanded, which on a deep hierarchy filled the pane
+  with descendants before the user had chosen a branch and made the pane its
+  widest at the moment it was least useful. The pane now tracks `expandedIds`
+  rather than the inverted `collapsed` set — an empty set is the honest seed
+  for "all shut", where the old set could only ever mean "all open" on first
+  render because the ids it would have to hold are not known until the tree
+  resolves. Nothing else about the pane's keyboard contract moves:
+  ArrowRight/ArrowLeft still open and close, and `aria-expanded` still reports
+  the real state. The `media-category-tree` registry skin drops its
+  `defaultExpandedIds={collectExpandableIds(nodes)}` for the same reason, so
+  the skin and the runtime pane stay non-divergent.
+- **`UploadCompleteRequestSchema` carries `category_ids`.** The served
+  `POST /media/v1/uploads/{id}/complete` has always accepted an optional
+  `category_ids` that *replaces* the filing staged at initiate (`[]` completes
+  the object filed into nothing), and this schema is `.strict()` — so a caller
+  meaning to override the filing at complete time was rejected client-side
+  before the request was ever made. Purely additive: omitting the key still
+  means "keep what initiate staged", which is what this package's own upload
+  controller relies on, so no existing caller changes.
+- **The `media-service-m8` pairing is re-measured.**
+  `MEDIA_SERVICE_M8_TESTED_SERVICE_VERSION` and `mediaServiceM8.testedServiceVersion`
+  move `2.0.0` → `2.1.1` — the service this client was actually exercised
+  against, whose OpenAPI every schema here was diffed against in the same pass.
+  Written ahead of the `2.1.1` tag and recorded as such, the same ordering
+  inversion the workspace matrix documents for the `2.1.0` image pins; it is
+  safe here in a way a pin is not, because the constant resolves nothing and
+  installs nothing.
+  **Neither gate moves.** `MEDIA_SERVICE_M8_CONTRACT_VERSION` stays `1.1`
+  because the *contract* did not move: the service fix populates a field that
+  was already declared, already documented and already populated by the list and
+  write paths, so no served shape changed. `media_service`'s own
+  `CONTRACT_VERSION` is still `1.1` and `tests/test_meta.py` asserts it as a
+  literal — advancing this client past it would make every preflight demand a
+  contract the service does not serve. The service-version range likewise stays
+  `>=2.0.0 <3.0.0`, which admits the whole 2.x line, so a host on the published
+  `2.1.0` passes preflight unchanged. `REPOSITORY_CONTEXT.md` additionally carried
+  `>=1.0.0 <2.0.0` for that range, wrong twice over — it is a *service*-version
+  range, not a range of contract versions, and the value had been left behind by
+  the 2.x repoint, so it excluded every service this package admits.
+  `compatibility.ts` and the `mediaServiceM8` block have been right since that
+  repoint; the doc line was the outlier and is corrected in place.
+- **Required auth peer raised to `@mano8/astro-auth-m8` `^2.2.0`**, in both
+  `peerDependencies` and `devDependencies`. The previous `^1.5.0` range excluded
+  every 2.x auth release, so this package declared it needed an auth generation
+  the fleet had already left behind; the conflict was only ever suppressed by
+  installing with `--legacy-peer-deps`. Consumers pairing this plugin with a 1.x
+  auth must upgrade auth first. `@mano8/astro-ui-m8` stays at `^1.5.0`.
+- **Category-tree responses are depth-bounded.** The Zod tree schema accepts up
+  to 10 levels, matching the service default, and rejects deeper untrusted
+  responses before recursive UI rendering.
+- **Contract `media-service-m8@1.1`** (`P2 U12`). The compatibility helper,
+  package metadata and documentation now agree on the additive media UX
+  contract. The contract axis itself is additive — the client admits both
+  `1.0` and `1.1` — so it is **not** what makes this release a major; the
+  service-version gate above is.
+
+- **The fleet gate exempts one authorization specifier** (remediation `W7.7`,
+  decision 4). `scripts/verify-fleet-gates.mjs` is carried byte-identically by
+  all four plugins, so a fleet-wide rule change lands in all four or in none.
+  `no-cross-plugin-import` now permits exactly
+  `@mano8/astro-auth-m8/authorization` — the pure, framework-neutral mirror of
+  `auth_sdk_m8/authorization.py` — so a plugin can meet `RBAC-06`, one role
+  hierarchy, by importing it rather than re-implementing it. Every other
+  subpath of the auth peer stays refused. A new `authorization-purity` gate
+  makes that exemption conditional: in a package that uses it, it walks the
+  module's import closure and fails on React, on any bare dependency other than
+  `zod`, or on any read of a runtime global. This package imports no
+  authorization module today, so the second gate is inert here and nothing in
+  its behaviour, surface or dependencies changes; it carries the rule so the
+  fleet stays one rule.
+
+- **Upload is a library action.** `MediaLibrary` now places an `Upload media`
+  action at the right of its top toolbar and opens the upload form as an
+  accessible modal. The dialog includes the existing nested user-category
+  selector, closes on Escape/backdrop/completion and refreshes the library
+  after a successful upload. The legacy `/media/upload` starter route opens
+  this same library dialog for direct-link compatibility.
+- **The required auth peer is raised to `@mano8/astro-auth-m8` `^2.4.1`** in
+  both `peerDependencies` and `devDependencies`. Two separate reasons stack, and
+  the floor is the higher of them. `2.3.0` coordinates the two token-refresh
+  paths behind one single-flight guard; below it, a page mounting both paths
+  against one expired token can issue two rotations, which `fa-auth-m8` reads as
+  token reuse and answers by revoking every session for the account. This plugin
+  reaches that path through `installFaAuthBrowserAdapter`, so it is behaviour
+  this package depends on rather than one it merely tolerates. `2.4.0` then
+  makes `@mano8/astro-auth-m8/authorization` a **supported** cross-plugin import
+  surface rather than an internal module siblings happen to be able to reach —
+  the guarantee the fleet's widened `no-cross-plugin-import` gate (`C12`) and
+  its `authorization-purity` companion are written against. This package carries
+  both gates, so it takes the floor that makes them meaningful even though its
+  own adapter does not yet import the module. The previous `^2.2.0` range
+  already resolved these on a fresh install; the floor states the requirement.
+  The floor landed as `^2.4.0` and was repointed to `^2.4.1` once that
+  tooling-alignment release was published; the lockfile resolves
+  `astro-auth-m8-2.4.1.tgz`.
+
+- **`@mano8/astro-ui-m8` is repointed `^1.5.0` → `^1.5.1`**, the published
+  tooling-alignment release, so the manifest no longer names a range ahead of
+  the registry. The lockfile resolves `astro-ui-m8-1.5.1.tgz`.

package/README.md

@@ -30,7 +30,7 @@ Pinned to `media-service-m8@1.1` (supported service-version range
 ## Backend contract
 
 This package targets the additive `media-service-m8@1.1` API contract and was
-tested against `media-service-m8` service version `3.0.1`. Supported backend
+tested against `media-service-m8` service version `3.0.2`. Supported backend
 service versions are `>=2.0.0 <4.0.0`.
 
 The contract axis and the service axis move independently, and only the range
@@ -65,12 +65,12 @@ elsewhere.
 npm i @mano8/astro-media-m8 @mano8/astro-auth-m8 zod
 ```
 
-`@mano8/astro-auth-m8` is a required peer at **`^2.6.0` or newer**:
+`@mano8/astro-auth-m8` is a required peer at **`^2.7.1` or newer**:
 `media-service-m8` only accepts `fa-auth-m8`-issued tokens, so the plugin's auth
 adapter must be backed by `fa-auth-m8` (the official plugin, or a custom adapter
 that obtains those tokens). A 1.x auth is not supported — upgrade auth first, or
 the install resolves nothing that satisfies the peer.
-`@mano8/astro-ui-m8` (`^1.5.0`) is a normal dependency because the media registry
+`@mano8/astro-ui-m8` (`^1.5.2`) is a normal dependency because the media registry
 skins compose the canonical shared table from its packaged registry output.
 `react`/`react-dom` are optional — only `./react`, `./hooks` and the starter
 views need them; `@tanstack/react-query` is a required peer once you use

package/dist/src/runtime/compatibility.d.ts

@@ -1,7 +1,7 @@
 export declare const MEDIA_SERVICE_M8_CONTRACT_ID = "media-service-m8";
 export declare const MEDIA_SERVICE_M8_CONTRACT_VERSION = "1.1";
 export declare const MEDIA_SERVICE_M8_CONTRACT: "media-service-m8@1.1";
-export declare const MEDIA_SERVICE_M8_TESTED_SERVICE_VERSION = "3.0.1";
+export declare const MEDIA_SERVICE_M8_TESTED_SERVICE_VERSION = "3.0.2";
 export declare const MEDIA_SERVICE_M8_MIN_SERVICE_VERSION = "2.0.0";
 export declare const MEDIA_SERVICE_M8_MAX_SERVICE_VERSION_EXCLUSIVE = "4.0.0";
 export declare const MEDIA_SERVICE_M8_SERVICE_VERSION_RANGE = ">=2.0.0 <4.0.0";

package/dist/src/runtime/compatibility.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"compatibility.d.ts","sourceRoot":"","sources":["../../../src/runtime/compatibility.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,4BAA4B,qBAAqB,CAAC;AAC/D,eAAO,MAAM,iCAAiC,QAAQ,CAAC;AACvD,eAAO,MAAM,yBAAyB,wBAAkF,CAAC;AA0BzH,eAAO,MAAM,uCAAuC,UAAU,CAAC;AAC/D,eAAO,MAAM,oCAAoC,UAAU,CAAC;AAC5D,eAAO,MAAM,8CAA8C,UAAU,CAAC;AACtE,eAAO,MAAM,sCAAsC,mBAAiG,CAAC;AAErJ,MAAM,MAAM,iCAAiC,GAAG,YAAY,GAAG,cAAc,GAAG,SAAS,CAAC;AAE1F,MAAM,MAAM,6BAA6B,GAAG;IAG1C,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,sBAAsB,CAAC,EAAE,OAAO,CAAC;IACjC,yBAAyB,CAAC,EAAE,OAAO,CAAC;IACpC,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,wBAAwB,CAAC,EAAE,OAAO,CAAC;IAEnC,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,2BAA2B,GAAG;IACxC,MAAM,EAAE,iCAAiC,CAAC;IAC1C,gBAAgB,EAAE,OAAO,yBAAyB,CAAC;IACnD,2BAA2B,EAAE,OAAO,sCAAsC,CAAC;IAC3E,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,CAAC;AAqDF,wBAAgB,wCAAwC,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAIjF;AAED,wBAAgB,8BAA8B,CAC5C,QAAQ,GAAE,6BAAkC,GAC3C,2BAA2B,CAmE7B;AAED,wBAAgB,iCAAiC,CAC/C,QAAQ,EAAE,6BAA6B,EACvC,YAAY,UAAO,GAClB,2BAA2B,CAM7B"}
+{"version":3,"file":"compatibility.d.ts","sourceRoot":"","sources":["../../../src/runtime/compatibility.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,4BAA4B,qBAAqB,CAAC;AAC/D,eAAO,MAAM,iCAAiC,QAAQ,CAAC;AACvD,eAAO,MAAM,yBAAyB,wBAAkF,CAAC;AA4BzH,eAAO,MAAM,uCAAuC,UAAU,CAAC;AAC/D,eAAO,MAAM,oCAAoC,UAAU,CAAC;AAC5D,eAAO,MAAM,8CAA8C,UAAU,CAAC;AACtE,eAAO,MAAM,sCAAsC,mBAAiG,CAAC;AAErJ,MAAM,MAAM,iCAAiC,GAAG,YAAY,GAAG,cAAc,GAAG,SAAS,CAAC;AAE1F,MAAM,MAAM,6BAA6B,GAAG;IAG1C,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,sBAAsB,CAAC,EAAE,OAAO,CAAC;IACjC,yBAAyB,CAAC,EAAE,OAAO,CAAC;IACpC,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,wBAAwB,CAAC,EAAE,OAAO,CAAC;IAEnC,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,2BAA2B,GAAG;IACxC,MAAM,EAAE,iCAAiC,CAAC;IAC1C,gBAAgB,EAAE,OAAO,yBAAyB,CAAC;IACnD,2BAA2B,EAAE,OAAO,sCAAsC,CAAC;IAC3E,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,CAAC;AAqDF,wBAAgB,wCAAwC,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAIjF;AAED,wBAAgB,8BAA8B,CAC5C,QAAQ,GAAE,6BAAkC,GAC3C,2BAA2B,CAmE7B;AAED,wBAAgB,iCAAiC,CAC/C,QAAQ,EAAE,6BAA6B,EACvC,YAAY,UAAO,GAClB,2BAA2B,CAM7B"}

package/dist/src/runtime/compatibility.js

@@ -17,16 +17,18 @@ const MEDIA_SERVICE_M8_COMPATIBLE_CONTRACTS = new Set([
 // move is additive (a minor here), not a major. A pre-tier 1.x service is
 // still refused: it cannot serve the authorization behavior this plugin's
 // guards assume.
-// The service version this client was actually exercised against: 3.0.1, the
-// hard-purge foreign-key patch on the media-sdk-m8 1.0.0 / media-service-m8
-// 3.0.0 shim-removal cut whose tree every schema here was diffed against. The
-// patch touches a maintenance code path only — nothing served changes — so
-// this value tracks the fleet's compose pins and gates nothing.
+// The service version this client was actually exercised against: 3.0.2, on
+// the media-sdk-m8 1.0.0 / media-service-m8 3.0.0 shim-removal cut whose tree
+// every schema here was diffed against. 3.0.1 fixed the hard purge; 3.0.2 is
+// the Debian patch layer, the UTC session clock and typing fixes (the upload
+// reject reason hoisted into a named alias with the same five values).
+// Nothing served changes, so this value tracks the fleet's compose pins and
+// gates nothing.
 //
 // The gate is MEDIA_SERVICE_M8_SERVICE_VERSION_RANGE below, which admits the
 // whole 2.x line plus 3.x, so a host pointed at the published 2.1.0 passes
 // preflight unchanged and this value never refuses it.
-export const MEDIA_SERVICE_M8_TESTED_SERVICE_VERSION = "3.0.1";
+export const MEDIA_SERVICE_M8_TESTED_SERVICE_VERSION = "3.0.2";
 export const MEDIA_SERVICE_M8_MIN_SERVICE_VERSION = "2.0.0";
 export const MEDIA_SERVICE_M8_MAX_SERVICE_VERSION_EXCLUSIVE = "4.0.0";
 export const MEDIA_SERVICE_M8_SERVICE_VERSION_RANGE = `>=${MEDIA_SERVICE_M8_MIN_SERVICE_VERSION} <${MEDIA_SERVICE_M8_MAX_SERVICE_VERSION_EXCLUSIVE}`;

package/dist/src/runtime/compatibility.js.map

@@ -1 +1 @@
-{"version":3,"file":"compatibility.js","sourceRoot":"","sources":["../../../src/runtime/compatibility.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,4BAA4B,GAAG,kBAAkB,CAAC;AAC/D,MAAM,CAAC,MAAM,iCAAiC,GAAG,KAAK,CAAC;AACvD,MAAM,CAAC,MAAM,yBAAyB,GAAG,GAAG,4BAA4B,IAAI,iCAAiC,EAAW,CAAC;AACzH,MAAM,qCAAqC,GAAG,IAAI,GAAG,CAAC;IACpD,KAAK;IACL,GAAG,4BAA4B,MAAM;IACrC,iCAAiC;IACjC,yBAAyB;CAC1B,CAAC,CAAC;AACH,iFAAiF;AACjF,+EAA+E;AAC/E,0EAA0E;AAC1E,iEAAiE;AACjE,yEAAyE;AACzE,8EAA8E;AAC9E,8EAA8E;AAC9E,0EAA0E;AAC1E,0EAA0E;AAC1E,iBAAiB;AACjB,6EAA6E;AAC7E,4EAA4E;AAC5E,8EAA8E;AAC9E,2EAA2E;AAC3E,gEAAgE;AAChE,EAAE;AACF,6EAA6E;AAC7E,2EAA2E;AAC3E,uDAAuD;AACvD,MAAM,CAAC,MAAM,uCAAuC,GAAG,OAAO,CAAC;AAC/D,MAAM,CAAC,MAAM,oCAAoC,GAAG,OAAO,CAAC;AAC5D,MAAM,CAAC,MAAM,8CAA8C,GAAG,OAAO,CAAC;AACtE,MAAM,CAAC,MAAM,sCAAsC,GAAG,KAAK,oCAAoC,KAAK,8CAA8C,EAAE,CAAC;AA6BrJ,SAAS,WAAW,CAAC,KAAc;IACjC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AAC9E,CAAC;AAED,uEAAuE;AACvE,SAAS,qBAAqB,CAAC,KAAc;IAC3C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QAChD,OAAO,WAAW,CAAE,KAA+B,CAAC,OAAO,CAAC,CAAC;IAC/D,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,oEAAoE;AACpE,EAAE;AACF,uFAAuF;AACvF,iFAAiF;AACjF,iFAAiF;AACjF,gFAAgF;AAChF,gFAAgF;AAChF,+EAA+E;AAC/E,iDAAiD;AACjD,SAAS,kBAAkB,CAAC,KAAc;IACxC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QAChD,OAAO,WAAW,CAAE,KAA4B,CAAC,IAAI,CAAC,CAAC;IACzD,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,WAAW,CAAC,OAAe;IAClC,MAAM,CAAC,YAAY,GAAG,EAAE,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IAClD,MAAM,CAAC,IAAI,GAAG,EAAE,CAAC,GAAG,YAAY,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IAC/C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC9B,IACE,KAAK,CAAC,MAAM,KAAK,CAAC;QAClB,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,GAAG,GAAG,IAAI,SAAS,GAAG,GAAG,CAAC,CAAC,EAC5G,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAChD,OAAO,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;AAC/B,CAAC;AAED,SAAS,aAAa,CAAC,IAAY,EAAE,KAAa;IAChD,MAAM,UAAU,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;IACrC,MAAM,WAAW,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;IACvC,IAAI,CAAC,UAAU,IAAI,CAAC,WAAW;QAAE,OAAO,SAAS,CAAC;IAClD,MAAM,CAAC,SAAS,EAAE,SAAS,EAAE,SAAS,CAAC,GAAG,UAAU,CAAC;IACrD,MAAM,CAAC,UAAU,EAAE,UAAU,EAAE,UAAU,CAAC,GAAG,WAAW,CAAC;IACzD,OAAO,SAAS,GAAG,UAAU,IAAI,SAAS,GAAG,UAAU,IAAI,SAAS,GAAG,UAAU,CAAC;AACpF,CAAC;AAED,MAAM,UAAU,wCAAwC,CAAC,OAAe;IACtE,MAAM,QAAQ,GAAG,aAAa,CAAC,OAAO,EAAE,oCAAoC,CAAC,CAAC;IAC9E,MAAM,QAAQ,GAAG,aAAa,CAAC,OAAO,EAAE,8CAA8C,CAAC,CAAC;IACxF,OAAO,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,IAAI,CAAC,IAAI,QAAQ,GAAG,CAAC,CAAC;AAC3F,CAAC;AAED,MAAM,UAAU,8BAA8B,CAC5C,WAA0C,EAAE;IAE5C,MAAM,eAAe,GACnB,WAAW,CAAC,QAAQ,CAAC,sBAAsB,CAAC;QAC5C,WAAW,CAAC,QAAQ,CAAC,gBAAgB,CAAC;QACtC,WAAW,CAAC,QAAQ,CAAC,yBAAyB,CAAC;QAC/C,WAAW,CAAC,QAAQ,CAAC,cAAc,CAAC;QACpC,qBAAqB,CAAC,QAAQ,CAAC,QAAQ,CAAC;QACxC,WAAW,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACjC,MAAM,cAAc,GAClB,WAAW,CAAC,QAAQ,CAAC,wBAAwB,CAAC;QAC9C,WAAW,CAAC,QAAQ,CAAC,eAAe,CAAC;QACrC,WAAW,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAEhC,wEAAwE;IACxE,2EAA2E;IAC3E,8EAA8E;IAC9E,mCAAmC;IACnC,MAAM,YAAY,GAAG,kBAAkB,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC3D,IAAI,YAAY,IAAI,YAAY,KAAK,4BAA4B,EAAE,CAAC;QAClE,OAAO;YACL,MAAM,EAAE,cAAc;YACtB,gBAAgB,EAAE,yBAAyB;YAC3C,2BAA2B,EAAE,sCAAsC;YACnE,eAAe;YACf,cAAc;YACd,MAAM,EAAE,YAAY,yBAAyB,kBAAkB,YAAY,iDAAiD;SAC7H,CAAC;IACJ,CAAC;IAED,IAAI,eAAe,IAAI,CAAC,qCAAqC,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,CAAC;QACnF,OAAO;YACL,MAAM,EAAE,cAAc;YACtB,gBAAgB,EAAE,yBAAyB;YAC3C,2BAA2B,EAAE,sCAAsC;YACnE,eAAe;YACf,cAAc;YACd,MAAM,EAAE,YAAY,yBAAyB,cAAc,eAAe,EAAE;SAC7E,CAAC;IACJ,CAAC;IAED,IAAI,cAAc,IAAI,CAAC,wCAAwC,CAAC,cAAc,CAAC,EAAE,CAAC;QAChF,OAAO;YACL,MAAM,EAAE,cAAc;YACtB,gBAAgB,EAAE,yBAAyB;YAC3C,2BAA2B,EAAE,sCAAsC;YACnE,eAAe;YACf,cAAc;YACd,MAAM,EAAE,6CAA6C,sCAAsC,cAAc,cAAc,EAAE;SAC1H,CAAC;IACJ,CAAC;IAED,IAAI,eAAe,IAAI,cAAc,EAAE,CAAC;QACtC,OAAO;YACL,MAAM,EAAE,YAAY;YACpB,gBAAgB,EAAE,yBAAyB;YAC3C,2BAA2B,EAAE,sCAAsC;YACnE,eAAe;YACf,cAAc;SACf,CAAC;IACJ,CAAC;IAED,OAAO;QACL,MAAM,EAAE,SAAS;QACjB,gBAAgB,EAAE,yBAAyB;QAC3C,2BAA2B,EAAE,sCAAsC;QACnE,MAAM,EAAE,uEAAuE;KAChF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,iCAAiC,CAC/C,QAAuC,EACvC,YAAY,GAAG,IAAI;IAEnB,MAAM,aAAa,GAAG,8BAA8B,CAAC,QAAQ,CAAC,CAAC;IAC/D,IAAI,aAAa,CAAC,MAAM,KAAK,cAAc,IAAI,CAAC,YAAY,IAAI,aAAa,CAAC,MAAM,KAAK,SAAS,CAAC,EAAE,CAAC;QACpG,MAAM,IAAI,KAAK,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;IACxC,CAAC;IACD,OAAO,aAAa,CAAC;AACvB,CAAC"}
+{"version":3,"file":"compatibility.js","sourceRoot":"","sources":["../../../src/runtime/compatibility.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,4BAA4B,GAAG,kBAAkB,CAAC;AAC/D,MAAM,CAAC,MAAM,iCAAiC,GAAG,KAAK,CAAC;AACvD,MAAM,CAAC,MAAM,yBAAyB,GAAG,GAAG,4BAA4B,IAAI,iCAAiC,EAAW,CAAC;AACzH,MAAM,qCAAqC,GAAG,IAAI,GAAG,CAAC;IACpD,KAAK;IACL,GAAG,4BAA4B,MAAM;IACrC,iCAAiC;IACjC,yBAAyB;CAC1B,CAAC,CAAC;AACH,iFAAiF;AACjF,+EAA+E;AAC/E,0EAA0E;AAC1E,iEAAiE;AACjE,yEAAyE;AACzE,8EAA8E;AAC9E,8EAA8E;AAC9E,0EAA0E;AAC1E,0EAA0E;AAC1E,iBAAiB;AACjB,4EAA4E;AAC5E,8EAA8E;AAC9E,6EAA6E;AAC7E,6EAA6E;AAC7E,uEAAuE;AACvE,4EAA4E;AAC5E,iBAAiB;AACjB,EAAE;AACF,6EAA6E;AAC7E,2EAA2E;AAC3E,uDAAuD;AACvD,MAAM,CAAC,MAAM,uCAAuC,GAAG,OAAO,CAAC;AAC/D,MAAM,CAAC,MAAM,oCAAoC,GAAG,OAAO,CAAC;AAC5D,MAAM,CAAC,MAAM,8CAA8C,GAAG,OAAO,CAAC;AACtE,MAAM,CAAC,MAAM,sCAAsC,GAAG,KAAK,oCAAoC,KAAK,8CAA8C,EAAE,CAAC;AA6BrJ,SAAS,WAAW,CAAC,KAAc;IACjC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AAC9E,CAAC;AAED,uEAAuE;AACvE,SAAS,qBAAqB,CAAC,KAAc;IAC3C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QAChD,OAAO,WAAW,CAAE,KAA+B,CAAC,OAAO,CAAC,CAAC;IAC/D,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,oEAAoE;AACpE,EAAE;AACF,uFAAuF;AACvF,iFAAiF;AACjF,iFAAiF;AACjF,gFAAgF;AAChF,gFAAgF;AAChF,+EAA+E;AAC/E,iDAAiD;AACjD,SAAS,kBAAkB,CAAC,KAAc;IACxC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QAChD,OAAO,WAAW,CAAE,KAA4B,CAAC,IAAI,CAAC,CAAC;IACzD,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,WAAW,CAAC,OAAe;IAClC,MAAM,CAAC,YAAY,GAAG,EAAE,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IAClD,MAAM,CAAC,IAAI,GAAG,EAAE,CAAC,GAAG,YAAY,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IAC/C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC9B,IACE,KAAK,CAAC,MAAM,KAAK,CAAC;QAClB,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,GAAG,GAAG,IAAI,SAAS,GAAG,GAAG,CAAC,CAAC,EAC5G,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAChD,OAAO,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;AAC/B,CAAC;AAED,SAAS,aAAa,CAAC,IAAY,EAAE,KAAa;IAChD,MAAM,UAAU,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;IACrC,MAAM,WAAW,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;IACvC,IAAI,CAAC,UAAU,IAAI,CAAC,WAAW;QAAE,OAAO,SAAS,CAAC;IAClD,MAAM,CAAC,SAAS,EAAE,SAAS,EAAE,SAAS,CAAC,GAAG,UAAU,CAAC;IACrD,MAAM,CAAC,UAAU,EAAE,UAAU,EAAE,UAAU,CAAC,GAAG,WAAW,CAAC;IACzD,OAAO,SAAS,GAAG,UAAU,IAAI,SAAS,GAAG,UAAU,IAAI,SAAS,GAAG,UAAU,CAAC;AACpF,CAAC;AAED,MAAM,UAAU,wCAAwC,CAAC,OAAe;IACtE,MAAM,QAAQ,GAAG,aAAa,CAAC,OAAO,EAAE,oCAAoC,CAAC,CAAC;IAC9E,MAAM,QAAQ,GAAG,aAAa,CAAC,OAAO,EAAE,8CAA8C,CAAC,CAAC;IACxF,OAAO,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,IAAI,CAAC,IAAI,QAAQ,GAAG,CAAC,CAAC;AAC3F,CAAC;AAED,MAAM,UAAU,8BAA8B,CAC5C,WAA0C,EAAE;IAE5C,MAAM,eAAe,GACnB,WAAW,CAAC,QAAQ,CAAC,sBAAsB,CAAC;QAC5C,WAAW,CAAC,QAAQ,CAAC,gBAAgB,CAAC;QACtC,WAAW,CAAC,QAAQ,CAAC,yBAAyB,CAAC;QAC/C,WAAW,CAAC,QAAQ,CAAC,cAAc,CAAC;QACpC,qBAAqB,CAAC,QAAQ,CAAC,QAAQ,CAAC;QACxC,WAAW,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACjC,MAAM,cAAc,GAClB,WAAW,CAAC,QAAQ,CAAC,wBAAwB,CAAC;QAC9C,WAAW,CAAC,QAAQ,CAAC,eAAe,CAAC;QACrC,WAAW,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAEhC,wEAAwE;IACxE,2EAA2E;IAC3E,8EAA8E;IAC9E,mCAAmC;IACnC,MAAM,YAAY,GAAG,kBAAkB,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC3D,IAAI,YAAY,IAAI,YAAY,KAAK,4BAA4B,EAAE,CAAC;QAClE,OAAO;YACL,MAAM,EAAE,cAAc;YACtB,gBAAgB,EAAE,yBAAyB;YAC3C,2BAA2B,EAAE,sCAAsC;YACnE,eAAe;YACf,cAAc;YACd,MAAM,EAAE,YAAY,yBAAyB,kBAAkB,YAAY,iDAAiD;SAC7H,CAAC;IACJ,CAAC;IAED,IAAI,eAAe,IAAI,CAAC,qCAAqC,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,CAAC;QACnF,OAAO;YACL,MAAM,EAAE,cAAc;YACtB,gBAAgB,EAAE,yBAAyB;YAC3C,2BAA2B,EAAE,sCAAsC;YACnE,eAAe;YACf,cAAc;YACd,MAAM,EAAE,YAAY,yBAAyB,cAAc,eAAe,EAAE;SAC7E,CAAC;IACJ,CAAC;IAED,IAAI,cAAc,IAAI,CAAC,wCAAwC,CAAC,cAAc,CAAC,EAAE,CAAC;QAChF,OAAO;YACL,MAAM,EAAE,cAAc;YACtB,gBAAgB,EAAE,yBAAyB;YAC3C,2BAA2B,EAAE,sCAAsC;YACnE,eAAe;YACf,cAAc;YACd,MAAM,EAAE,6CAA6C,sCAAsC,cAAc,cAAc,EAAE;SAC1H,CAAC;IACJ,CAAC;IAED,IAAI,eAAe,IAAI,cAAc,EAAE,CAAC;QACtC,OAAO;YACL,MAAM,EAAE,YAAY;YACpB,gBAAgB,EAAE,yBAAyB;YAC3C,2BAA2B,EAAE,sCAAsC;YACnE,eAAe;YACf,cAAc;SACf,CAAC;IACJ,CAAC;IAED,OAAO;QACL,MAAM,EAAE,SAAS;QACjB,gBAAgB,EAAE,yBAAyB;QAC3C,2BAA2B,EAAE,sCAAsC;QACnE,MAAM,EAAE,uEAAuE;KAChF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,iCAAiC,CAC/C,QAAuC,EACvC,YAAY,GAAG,IAAI;IAEnB,MAAM,aAAa,GAAG,8BAA8B,CAAC,QAAQ,CAAC,CAAC;IAC/D,IAAI,aAAa,CAAC,MAAM,KAAK,cAAc,IAAI,CAAC,YAAY,IAAI,aAAa,CAAC,MAAM,KAAK,SAAS,CAAC,EAAE,CAAC;QACpG,MAAM,IAAI,KAAK,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;IACxC,CAAC;IACD,OAAO,aAAa,CAAC;AACvB,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mano8/astro-media-m8",
-  "version": "2.2.0",
+  "version": "2.3.1",
   "description": "Astro integration and headless client for media-service-m8.",
   "type": "module",
   "license": "MIT",
@@ -25,6 +25,7 @@
     "registry.json",
     "registry/r",
     "README.md",
+    "CHANGELOG.md",
     "LICENSE"
   ],
   "exports": {
@@ -56,6 +57,7 @@
     "preview:dev": "vite --config fixtures/preview/vite.config.ts",
     "preview:build": "tsc -p fixtures/preview/tsconfig.json --noEmit && vite build --config fixtures/preview/vite.config.ts",
     "verify:fleet-gates": "node scripts/verify-fleet-gates.mjs",
+    "verify:lock-integrity": "node scripts/verify-lock-integrity.mjs",
     "verify:registry-consumer": "node scripts/verify-registry-consumer.mjs",
     "verify:registry-drift": "node scripts/verify-registry-drift.mjs",
     "verify:starter-routes": "node scripts/verify-starter-routes.mjs",
@@ -66,12 +68,12 @@
     "test:unit": "vitest run"
   },
   "dependencies": {
-    "@mano8/astro-ui-m8": "^1.5.1"
+    "@mano8/astro-ui-m8": "^1.5.2"
   },
   "peerDependencies": {
     "@astrojs/react": "^6.0.1",
     "@astrojs/starlight": "^0.41.3",
-    "@mano8/astro-auth-m8": "^2.6.0",
+    "@mano8/astro-auth-m8": "^2.7.1",
     "@tanstack/react-query": "^5.102.8",
     "astro": "^7.0.9",
     "react": "^18.0.0 || ^19.0.0",
@@ -91,7 +93,7 @@
     "@astrojs/starlight": "^0.41.10",
     "@eslint-react/eslint-plugin": "^5.18.6",
     "@eslint/js": "^10.0.1",
-    "@mano8/astro-auth-m8": "^2.6.0",
+    "@mano8/astro-auth-m8": "^2.7.1",
     "@tanstack/react-query": "^5.102.8",
     "@tanstack/react-table": "^8.21.3",
     "@types/node": "^26.4.0",
@@ -115,7 +117,7 @@
   },
   "mediaServiceM8": {
     "contract": "media-service-m8@1.1",
-    "testedServiceVersion": "3.0.1",
+    "testedServiceVersion": "3.0.2",
     "serviceVersionRange": ">=2.0.0 <4.0.0"
   }
 }