@medialit/integration-tests 0.0.0-stage → 0.1.0

package/dist/bin.mjs

@@ -0,0 +1,1656 @@
+#!/usr/bin/env node
+
+// src/synthetic.ts
+import assert from "node:assert/strict";
+import { randomUUID } from "node:crypto";
+
+// src/utils.ts
+import { deflateSync } from "node:zlib";
+function generatePng() {
+  function chunk(type, data) {
+    const payload = Buffer.concat(
+      [Buffer.from(type), data].map((bytes) => Uint8Array.from(bytes))
+    );
+    let crc = 4294967295;
+    for (const byte of payload) {
+      crc ^= byte;
+      for (let bit = 0; bit < 8; bit++) {
+        crc = crc >>> 1 ^ (crc & 1 ? 3988292384 : 0);
+      }
+    }
+    const length = Buffer.alloc(4);
+    length.writeUInt32BE(data.length);
+    const checksum = Buffer.alloc(4);
+    checksum.writeUInt32BE((crc ^ 4294967295) >>> 0);
+    return Buffer.concat(
+      [length, payload, checksum].map((bytes) => Uint8Array.from(bytes))
+    );
+  }
+  const header = Buffer.alloc(13);
+  header.writeUInt32BE(1, 0);
+  header.writeUInt32BE(1, 4);
+  header[8] = 8;
+  header[9] = 6;
+  return Buffer.concat(
+    [
+      Buffer.from("89504e470d0a1a0a", "hex"),
+      chunk("IHDR", header),
+      chunk("IDAT", deflateSync(Uint8Array.from([0, 0, 0, 0, 0]))),
+      chunk("IEND", Buffer.alloc(0))
+    ].map((bytes) => Uint8Array.from(bytes))
+  );
+}
+
+// src/synthetic.ts
+var GROUP_PREFIX = "__synthetic_";
+var STALE_AFTER_MS = 60 * 60 * 1e3;
+async function runSyntheticCheck(options = {}) {
+  const apiKey = options.apiKey ?? process.env.MEDIALIT_APIKEY;
+  assert(
+    typeof apiKey === "string" && apiKey.trim(),
+    "MEDIALIT_APIKEY is required"
+  );
+  const server = options.server ?? process.env.MEDIALIT_SERVER ?? "localhost:8000";
+  const base = new URL(
+    /^https?:\/\//i.test(server) ? server : `http://${server}`
+  );
+  assert(
+    ["http:", "https:"].includes(base.protocol),
+    "MEDIALIT_SERVER must use HTTP or HTTPS"
+  );
+  assert(
+    !base.username && !base.password && !base.search && !base.hash,
+    "MEDIALIT_SERVER must be a base URL without credentials, query, or fragment"
+  );
+  base.pathname = `${base.pathname.replace(/\/+$/, "")}/`;
+  const heartbeatUrl = options.heartbeatUrl ?? process.env.MEDIALIT_SYNTHETIC_HEARTBEAT_URL;
+  const log = options.log ?? console.log;
+  const group = `${GROUP_PREFIX}${Date.now()}_${randomUUID()}`;
+  const png = generatePng();
+  const result = { ok: true, steps: [] };
+  let mediaId;
+  function redact(value) {
+    return value.split(apiKey).join("[redacted]");
+  }
+  async function request(path, init = {}, status = 200) {
+    const response = await fetch(new URL(path, base), {
+      ...init,
+      headers: { "x-medialit-apikey": apiKey, ...init.headers },
+      redirect: "error",
+      signal: AbortSignal.timeout(3e4)
+    });
+    if (response.status !== status) {
+      const body = redact(await response.text()).slice(0, 500);
+      throw new Error(
+        `${init.method ?? "GET"} /${path}: expected HTTP ${status}, got ${response.status}: ${body}`
+      );
+    }
+    return response;
+  }
+  async function api(path, body) {
+    const response = await request(path, {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      ...body ? { body: JSON.stringify(body) } : {}
+    });
+    return response.json();
+  }
+  async function step(name, run) {
+    const started = Date.now();
+    try {
+      await run();
+      result.steps.push({ name, ms: Date.now() - started });
+      log(`PASS ${name} (${Date.now() - started} ms)`);
+    } catch (error) {
+      const message = redact(describe(error));
+      result.steps.push({
+        name,
+        ms: Date.now() - started,
+        error: message
+      });
+      log(`FAIL ${name} (${Date.now() - started} ms): ${message}`);
+      throw error;
+    }
+  }
+  log(`MediaLit synthetic check ${group} against ${base.origin}`);
+  try {
+    await step("ready", async () => {
+      const response = await fetch(new URL("ready", base), {
+        signal: AbortSignal.timeout(3e4)
+      });
+      const report = await response.text();
+      assert.equal(
+        response.status,
+        200,
+        `/ready returned ${response.status}: ${report.slice(0, 500)}`
+      );
+    });
+    await step("upload", async () => {
+      const form = new FormData();
+      form.set(
+        "file",
+        new Blob([Uint8Array.from(png)], { type: "image/png" }),
+        "synthetic-check.png"
+      );
+      form.set("access", "public");
+      form.set("group", group);
+      const media = await (await request("media/create", { method: "POST", body: form })).json();
+      assert.equal(
+        typeof media.mediaId,
+        "string",
+        "upload returned no mediaId"
+      );
+      mediaId = media.mediaId;
+      assert.equal(media.size, png.length);
+    });
+    let fileUrl = "";
+    await step("seal", async () => {
+      const media = await api(`media/seal/${mediaId}`);
+      assert.equal(media.mediaId, mediaId);
+      assert.equal(media.access, "public");
+      fileUrl = String(media.file);
+      assert.match(fileUrl, /^https?:\/\//, "seal returned no file URL");
+    });
+    await step("download", async () => {
+      const response = await fetch(fileUrl, {
+        signal: AbortSignal.timeout(3e4)
+      });
+      assert.equal(
+        response.status,
+        200,
+        `the file URL returned ${response.status}`
+      );
+      const bytes = Buffer.from(await response.arrayBuffer());
+      assert(
+        bytes.toString("base64") === png.toString("base64"),
+        "the downloaded file differs from the upload"
+      );
+    });
+    await step("delete", async () => {
+      await request(`media/delete/${mediaId}`, { method: "DELETE" });
+      mediaId = void 0;
+    });
+  } catch {
+    result.ok = false;
+  } finally {
+    if (mediaId) {
+      await request(`media/delete/${mediaId}`, {
+        method: "DELETE"
+      }).catch(
+        () => log(`CLEANUP could not delete ${mediaId}; the next run will`)
+      );
+    }
+  }
+  if (result.ok) {
+    await sweepStaleSyntheticFiles().catch(
+      (error) => log(
+        `CLEANUP could not sweep old synthetic-check files: ${String(error)}`
+      )
+    );
+  }
+  if (heartbeatUrl) {
+    const url = result.ok ? heartbeatUrl : `${withoutTrailingSlashes(heartbeatUrl)}/fail`;
+    try {
+      await fetch(url, {
+        method: "POST",
+        body: JSON.stringify(result),
+        headers: { "content-type": "application/json" },
+        signal: AbortSignal.timeout(1e4)
+      });
+      log(`Heartbeat sent (${result.ok ? "up" : "down"})`);
+    } catch (error) {
+      log(`Heartbeat could not be sent: ${String(error)}`);
+    }
+  }
+  log(
+    result.ok ? "PASS MediaLit synthetic check" : "FAIL MediaLit synthetic check"
+  );
+  return result;
+  async function sweepStaleSyntheticFiles() {
+    const media = await api("media/get", {
+      page: 1,
+      limit: 50,
+      group: GROUP_PREFIX
+    });
+    assert(Array.isArray(media), "media/get must return an array");
+    for (const item of media) {
+      if (!String(item.group ?? "").startsWith(GROUP_PREFIX)) continue;
+      const started = Number(
+        String(item.group).slice(GROUP_PREFIX.length).split("_")[0]
+      );
+      if (!(Date.now() - started > STALE_AFTER_MS)) continue;
+      const id = String(item.mediaId);
+      await request(`media/delete/${id}`, { method: "DELETE" });
+      log(`CLEANUP deleted old synthetic-check file ${id}`);
+    }
+  }
+}
+function describe(error) {
+  if (!(error instanceof Error)) return String(error);
+  const cause = error.cause;
+  const reason = cause?.code ?? cause?.message;
+  return reason ? `${error.message} (${reason})` : error.message;
+}
+function withoutTrailingSlashes(url) {
+  let end = url.length;
+  while (end > 0 && url[end - 1] === "/") end--;
+  return url.slice(0, end);
+}
+
+// src/cli.ts
+import assert2 from "node:assert/strict";
+import { spawn } from "node:child_process";
+import { randomUUID as randomUUID2 } from "node:crypto";
+import { existsSync } from "node:fs";
+import { mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { fileURLToPath } from "node:url";
+var EXPECTED_CLI_COMMANDS = [
+  "get",
+  "login",
+  "logout",
+  "ls",
+  "rm",
+  "seal",
+  "upload",
+  "whoami"
+].sort();
+var CLI_PACKAGE = fileURLToPath(new URL("../../cli/", import.meta.url));
+function object(value, label = "value") {
+  assert2(
+    value && typeof value === "object" && !Array.isArray(value),
+    `Expected ${label} to be a JSON object`
+  );
+  return value;
+}
+function nonemptyText(value, label) {
+  assert2(
+    typeof value === "string" && value.length > 0,
+    `${label} must be a nonempty string`
+  );
+  return value;
+}
+function integer(value, label) {
+  assert2(
+    typeof value === "number" && Number.isSafeInteger(value) && value >= 0,
+    `${label} must be a nonnegative integer`
+  );
+  return value;
+}
+async function runCliIntegrationTests(options = {}) {
+  const apiKey = options.apiKey ?? process.env.MEDIALIT_APIKEY;
+  assert2(
+    typeof apiKey === "string" && apiKey.trim(),
+    "MEDIALIT_APIKEY is required"
+  );
+  const server = options.server ?? process.env.MEDIALIT_SERVER ?? "localhost:8000";
+  const base = new URL(
+    /^https?:\/\//i.test(server) ? server : `http://${server}`
+  );
+  assert2(
+    ["http:", "https:"].includes(base.protocol),
+    "MEDIALIT_SERVER must use HTTP or HTTPS"
+  );
+  assert2(
+    !base.username && !base.password && !base.search && !base.hash,
+    "MEDIALIT_SERVER must be a base URL without credentials, query, or fragment"
+  );
+  const endpoint = `${base.origin}${base.pathname.replace(/\/+$/, "")}`;
+  const cli = options.cli ?? process.env.MEDIALIT_CLI;
+  const builtCli = join(CLI_PACKAGE, "dist", "index.mjs");
+  if (!cli) {
+    assert2(
+      existsSync(builtCli),
+      "No CLI to test. Set MEDIALIT_CLI to the medialit command, or run `bun --filter @medialit/cli build` in the MediaLit repository."
+    );
+  }
+  const testLogin = options.testLogin ?? process.env.MEDIALIT_CLI_TEST_LOGIN === "true";
+  const log = options.log ?? console.log;
+  const group = `__cli_integration_${randomUUID2()}`;
+  const png = generatePng();
+  const pending = /* @__PURE__ */ new Set();
+  const workDir = await mkdtemp(join(tmpdir(), "medialit-cli-it-"));
+  const configDir = join(workDir, "config");
+  let baseline;
+  let uploadAttempted = false;
+  let failure;
+  const cleanupErrors = [];
+  function redact(value) {
+    return value.split(apiKey).join("[redacted]");
+  }
+  function medialit(args, env = {}) {
+    const [command, commandArgs] = cli ? [cli, args] : [process.env.MEDIALIT_NODE ?? "node", [builtCli, ...args]];
+    const childEnv = {
+      ...process.env,
+      MEDIALIT_CONFIG_DIR: configDir,
+      MEDIALIT_ENDPOINT: endpoint
+    };
+    delete childEnv.MEDIALIT_API_KEY;
+    if (env.apiKey !== null) childEnv.MEDIALIT_API_KEY = apiKey;
+    return new Promise((resolve, reject) => {
+      const child = spawn(command, commandArgs, {
+        env: childEnv,
+        stdio: ["ignore", "pipe", "pipe"]
+      });
+      let stdout = "";
+      let stderr = "";
+      child.stdout.on("data", (chunk) => stdout += chunk);
+      child.stderr.on("data", (chunk) => stderr += chunk);
+      const timeout = setTimeout(() => {
+        child.kill();
+        reject(
+          new Error(`medialit ${args.join(" ")} timed out after 60s`)
+        );
+      }, 6e4);
+      child.on("error", (error) => {
+        clearTimeout(timeout);
+        reject(error);
+      });
+      child.on("close", (code) => {
+        clearTimeout(timeout);
+        resolve({ code, stdout, stderr });
+      });
+    });
+  }
+  async function ok(args) {
+    const result = await medialit(args);
+    if (result.code !== 0) {
+      throw new Error(
+        `medialit ${args.join(" ")}: exited with ${result.code}: ${redact(
+          result.stderr
+        ).slice(0, 1e3)}`
+      );
+    }
+    return result;
+  }
+  async function json(args) {
+    const result = await ok([...args, "--json"]);
+    try {
+      return JSON.parse(result.stdout);
+    } catch {
+      throw new Error(
+        `medialit ${args.join(" ")} --json printed invalid JSON`
+      );
+    }
+  }
+  async function fails(args, message, env) {
+    const result = await medialit(args, env);
+    assert2.equal(
+      result.code,
+      1,
+      `medialit ${args.join(" ")} must exit with 1`
+    );
+    assert2.match(result.stderr, /^error: /m);
+    assert2.match(result.stderr, message);
+    assert2.equal(result.stdout, "", "Errors must not print to stdout");
+  }
+  async function stats() {
+    const info = object(await json(["whoami"]), "whoami");
+    assert2.equal(info.endpoint, endpoint);
+    assert2.equal(info.auth, "api-key");
+    return {
+      files: integer(info.files, "files"),
+      storage: integer(info.storage, "storage"),
+      maxStorage: integer(info.maxStorage, "maxStorage")
+    };
+  }
+  async function list(...filters) {
+    const result = await json(["ls", "--group", group, ...filters]);
+    assert2(Array.isArray(result), "ls --json must print an array");
+    return result.map((media) => object(media, "media item"));
+  }
+  async function checkTotals(bytes, files) {
+    assert2(baseline);
+    const current = await stats();
+    assert2.equal(current.maxStorage, baseline.maxStorage);
+    assert2.equal(current.storage, baseline.storage + bytes);
+    assert2.equal(current.files, baseline.files + files);
+  }
+  async function writeImage(name) {
+    const path = join(workDir, name);
+    await writeFile(path, Uint8Array.from(png));
+    return path;
+  }
+  async function download(url) {
+    const response = await fetch(url, {
+      signal: AbortSignal.timeout(3e4)
+    });
+    assert2.equal(
+      response.status,
+      200,
+      `Downloading ${new URL(url).pathname} failed`
+    );
+    return Buffer.from(await response.arrayBuffer());
+  }
+  function checkMedia(media, expected) {
+    const mediaId = nonemptyText(media.mediaId, "mediaId");
+    assert2.equal(media.originalFileName, expected.name);
+    assert2.equal(media.mimeType, "image/png");
+    assert2.equal(media.size, png.length);
+    assert2.equal(media.access, expected.access);
+    assert2.equal(media.group, group);
+    if (expected.caption) assert2.equal(media.caption, expected.caption);
+    nonemptyText(media.file, "file URL");
+    return mediaId;
+  }
+  log(`MediaLit CLI integration run ${group} against ${endpoint}`);
+  try {
+    const version = (await ok(["--version"])).stdout.trim();
+    if (!cli) {
+      const pkg = JSON.parse(
+        await readFile(join(CLI_PACKAGE, "package.json"), "utf8")
+      );
+      assert2.equal(version, pkg.version);
+    }
+    const help = (await ok(["--help"])).stdout;
+    const commandsSection = help.split(/\n\s*\n/)[1] ?? "";
+    const commands = commandsSection.split("\n").slice(1).map((line) => line.trim().split(/\s+/)[0]).filter(Boolean).sort();
+    assert2.deepEqual(
+      commands,
+      EXPECTED_CLI_COMMANDS,
+      "CLI command inventory changed; update this integration test and exercise every command"
+    );
+    log(
+      `PASS medialit ${version}: --version and complete command inventory`
+    );
+    await fails(["ls"], /Not logged in to .*medialit login/, {
+      apiKey: null
+    });
+    await fails(["frobnicate"], /Unknown command "frobnicate"/);
+    await fails(["get"], /Pass one media ID/);
+    await fails(["upload"], /Pass at least one file/);
+    await fails(["upload", join(workDir, "missing.png")], /is not a file/);
+    log("PASS errors go to stderr with exit code 1");
+    baseline = await stats();
+    assert2(
+      baseline.maxStorage - baseline.storage >= png.length * 3,
+      "Insufficient available storage for the CLI uploads"
+    );
+    assert2.deepEqual(await list(), [], "Run group already contains media");
+    log("PASS whoami with MEDIALIT_API_KEY and ls baseline");
+    const tempName = `${group}-temp.png`;
+    const caption = `${group}: CLI integration upload`;
+    uploadAttempted = true;
+    const tempUploads = await json([
+      "upload",
+      await writeImage(tempName),
+      "--temp",
+      "--group",
+      group,
+      "--caption",
+      caption
+    ]);
+    assert2(Array.isArray(tempUploads) && tempUploads.length === 1);
+    const tempId = checkMedia(object(tempUploads[0]), {
+      name: tempName,
+      access: "private",
+      caption
+    });
+    pending.add(tempId);
+    assert2.deepEqual(await list(), [], "--temp uploads must stay hidden");
+    await checkTotals(0, 0);
+    log("PASS upload --temp leaves the upload temporary and hidden");
+    const sealed = object(await json(["seal", tempId]), "sealed media");
+    assert2.equal(sealed.mediaId, tempId);
+    assert2.deepEqual(
+      (await list()).map((media) => media.mediaId),
+      [tempId]
+    );
+    await checkTotals(png.length, 1);
+    const fetched = object(await json(["get", tempId]), "media");
+    checkMedia(fetched, { name: tempName, access: "private", caption });
+    const privateUrl = (await ok(["get", tempId])).stdout.trim();
+    assert2.match(privateUrl, /^https?:\/\//);
+    assert2.deepEqual(await download(privateUrl), png);
+    log("PASS seal, get --json, get URL download and storage/count totals");
+    const publicNames = [`${group}-a.png`, `${group}-b.png`];
+    const human = await ok([
+      "upload",
+      await writeImage(publicNames[0]),
+      await writeImage(publicNames[1]),
+      "--public",
+      "--group",
+      group
+    ]);
+    const urls = human.stdout.trim().split("\n");
+    assert2.equal(urls.length, 2, "upload must print one URL per file");
+    for (const url of urls) assert2.match(url, /^https?:\/\//);
+    const publicIds = publicNames.map((name) => {
+      const line = human.stderr.split("\n").find((entry) => entry.startsWith(`${name}  `));
+      return nonemptyText(line?.split(/\s+/)[1], `${name} mediaId`);
+    });
+    publicIds.forEach((id) => pending.add(id));
+    for (const url of urls) assert2.deepEqual(await download(url), png);
+    await checkTotals(png.length * 3, 3);
+    log("PASS upload of several files seals them and prints only URLs");
+    const publicListed = (await list("--public")).map((m) => m.mediaId);
+    assert2.deepEqual([...publicListed].sort(), [...publicIds].sort());
+    const privateListed = (await list("--private")).map((m) => m.mediaId);
+    assert2.deepEqual(privateListed, [tempId]);
+    const firstPage = await list("--limit", "2", "--page", "1");
+    const secondPage = await list("--limit", "2", "--page", "2");
+    assert2.equal(firstPage.length, 2);
+    assert2.equal(secondPage.length, 1);
+    assert2.deepEqual(
+      [...firstPage, ...secondPage].map((m) => m.mediaId).sort(),
+      [tempId, ...publicIds].sort()
+    );
+    const table = (await ok(["ls", "--group", group])).stdout;
+    for (const id of [tempId, ...publicIds])
+      assert2.match(table, new RegExp(id));
+    log("PASS ls filters (--public, --private, --group), paging and table");
+    for (const id of [tempId, ...publicIds]) {
+      const deleted = object(await json(["rm", id]), "rm result");
+      assert2.equal(deleted.deleted, true);
+      assert2.equal(deleted.mediaId, id);
+      pending.delete(id);
+    }
+    await fails(["get", tempId], /./);
+    assert2.deepEqual(await list(), []);
+    await checkTotals(0, 0);
+    log("PASS rm and restored storage/count totals");
+    if (testLogin) {
+      await checkLoginReachesSignIn();
+      log(
+        "PASS login discovers the server, registers and reaches sign-in"
+      );
+    } else {
+      log("SKIP login (set MEDIALIT_CLI_TEST_LOGIN=true to check it)");
+    }
+  } catch (error) {
+    failure = error;
+  } finally {
+    for (const mediaId of pending) {
+      try {
+        await ok(["rm", mediaId]);
+        pending.delete(mediaId);
+        log(`CLEANUP deleted ${mediaId}`);
+      } catch (error) {
+        cleanupErrors.push(error);
+        log(`CLEANUP FAILED for ${mediaId}: ${String(error)}`);
+      }
+    }
+    if (uploadAttempted && baseline) {
+      try {
+        assert2.deepEqual(
+          await list(),
+          [],
+          "Run media remains after cleanup"
+        );
+        await checkTotals(0, 0);
+      } catch (error) {
+        cleanupErrors.push(error);
+        log(`CLEANUP verification failed: ${String(error)}`);
+      }
+    }
+    await rm(workDir, { recursive: true, force: true }).catch(
+      (error) => cleanupErrors.push(error)
+    );
+  }
+  if (failure) throw failure;
+  if (cleanupErrors.length) {
+    throw new AggregateError(
+      cleanupErrors,
+      "CLI integration cleanup failed"
+    );
+  }
+  log("PASS MediaLit CLI lifecycle; media and config cleaned up");
+  async function checkLoginReachesSignIn() {
+    const [command, args] = cli ? [cli, ["login", "--no-browser"]] : [
+      process.env.MEDIALIT_NODE ?? "node",
+      [builtCli, "login", "--no-browser"]
+    ];
+    const childEnv = {
+      ...process.env,
+      MEDIALIT_CONFIG_DIR: join(workDir, "login-config"),
+      MEDIALIT_ENDPOINT: endpoint
+    };
+    delete childEnv.MEDIALIT_API_KEY;
+    const child = spawn(command, args, {
+      env: childEnv,
+      stdio: ["ignore", "pipe", "pipe"]
+    });
+    try {
+      const authorizeUrl = await new Promise(
+        (resolve, reject) => {
+          let stderr = "";
+          const timeout = setTimeout(
+            () => reject(new Error("login did not print a URL")),
+            3e4
+          );
+          child.stderr.on("data", (chunk) => {
+            stderr += chunk;
+            const match = stderr.match(
+              /https?:\/\/\S+authorize\?\S+/
+            );
+            if (match) {
+              clearTimeout(timeout);
+              resolve(match[0]);
+            }
+          });
+          child.on("close", (code) => {
+            clearTimeout(timeout);
+            reject(
+              new Error(
+                `login exited with ${code} before printing a URL: ${stderr.slice(0, 1e3)}`
+              )
+            );
+          });
+        }
+      );
+      const url = new URL(authorizeUrl);
+      assert2.equal(url.searchParams.get("code_challenge_method"), "S256");
+      assert2.match(
+        url.searchParams.get("redirect_uri") ?? "",
+        /^http:\/\/127\.0\.0\.1:\d+\/callback$/
+      );
+      nonemptyText(url.searchParams.get("client_id"), "client_id");
+      const response = await fetch(url, {
+        redirect: "manual",
+        signal: AbortSignal.timeout(3e4)
+      });
+      assert2(
+        response.status >= 300 && response.status < 400,
+        `The authorize URL must redirect to sign-in, got ${response.status}`
+      );
+      const location = new URL(
+        nonemptyText(response.headers.get("location"), "Location"),
+        url
+      );
+      assert2.doesNotMatch(
+        location.search,
+        /[?&]error=/,
+        `The server rejected the login request: ${location.search}`
+      );
+      const signIn = await fetch(location, {
+        signal: AbortSignal.timeout(3e4)
+      });
+      assert2.equal(signIn.status, 200);
+      assert2.match(await signIn.text(), /Sign in/i);
+    } finally {
+      child.kill();
+    }
+  }
+}
+
+// src/mcp.ts
+import assert3 from "node:assert/strict";
+import { randomUUID as randomUUID3 } from "node:crypto";
+var EXPECTED_MCP_TOOLS = [
+  "create_upload_signature",
+  "delete_media",
+  "get_media",
+  "get_media_count",
+  "get_media_settings",
+  "get_total_storage",
+  "list_media",
+  "seal_media",
+  "update_media_settings",
+  "upload_media",
+  "whoami"
+].sort();
+function object2(value, label = "value") {
+  assert3(
+    value && typeof value === "object" && !Array.isArray(value),
+    `Expected ${label} to be a JSON object`
+  );
+  return value;
+}
+function nonemptyText2(value, label) {
+  assert3(
+    typeof value === "string" && value.length > 0,
+    `${label} must be a nonempty string`
+  );
+  return value;
+}
+function integer2(value, label) {
+  assert3(
+    typeof value === "number" && Number.isSafeInteger(value) && value >= 0,
+    `${label} must be a nonnegative integer`
+  );
+  return value;
+}
+function mediaSettings(value) {
+  const settings = object2(value, "media settings");
+  assert3.equal(typeof settings.useWebP, "boolean");
+  return {
+    useWebP: settings.useWebP,
+    webpOutputQuality: integer2(
+      settings.webpOutputQuality,
+      "webpOutputQuality"
+    ),
+    thumbnailWidth: integer2(settings.thumbnailWidth, "thumbnailWidth"),
+    thumbnailHeight: integer2(settings.thumbnailHeight, "thumbnailHeight")
+  };
+}
+var McpSession = class {
+  constructor(endpoint, apiKey) {
+    this.endpoint = endpoint;
+    this.apiKey = apiKey;
+  }
+  sessionId;
+  protocolVersion;
+  lastSessionId;
+  nextId = 1;
+  async send(message, expectedStatus) {
+    const headers = new Headers({
+      accept: "application/json, text/event-stream",
+      "content-type": "application/json",
+      "x-medialit-apikey": this.apiKey
+    });
+    if (this.sessionId) headers.set("mcp-session-id", this.sessionId);
+    if (this.protocolVersion) {
+      headers.set("mcp-protocol-version", this.protocolVersion);
+    }
+    const response = await fetch(this.endpoint, {
+      method: "POST",
+      headers,
+      body: JSON.stringify(message),
+      redirect: "error",
+      signal: AbortSignal.timeout(3e4)
+    });
+    this.lastSessionId = response.headers.get("mcp-session-id") ?? this.lastSessionId;
+    const body = await response.text();
+    if (response.status !== expectedStatus) {
+      throw new Error(
+        `MCP ${String(message.method)}: expected HTTP ${expectedStatus}, got ${response.status}: ${body.split(this.apiKey).join("[redacted]").slice(0, 1e3)}`
+      );
+    }
+    if (expectedStatus === 202) return void 0;
+    let parsed;
+    try {
+      parsed = JSON.parse(body);
+    } catch {
+      throw new Error(
+        `MCP ${String(message.method)} returned invalid JSON`
+      );
+    }
+    return object2(parsed, "JSON-RPC response");
+  }
+  async connect() {
+    const response = await this.send(
+      {
+        jsonrpc: "2.0",
+        id: this.nextId++,
+        method: "initialize",
+        params: {
+          protocolVersion: "2025-11-25",
+          capabilities: {},
+          clientInfo: {
+            name: "medialit-integration-test",
+            version: "1.0.0"
+          }
+        }
+      },
+      200
+    );
+    assert3(response);
+    assert3.equal(
+      response.error,
+      void 0,
+      "MCP initialize returned an error"
+    );
+    const result = object2(response.result, "initialize result");
+    this.sessionId = nonemptyText2(this.lastSessionId, "MCP session ID");
+    this.protocolVersion = nonemptyText2(
+      result.protocolVersion,
+      "MCP protocol version"
+    );
+    await this.notify("notifications/initialized");
+  }
+  async notify(method) {
+    await this.send({ jsonrpc: "2.0", method }, 202);
+  }
+  async request(method, params = {}) {
+    const id = this.nextId++;
+    const response = await this.send(
+      { jsonrpc: "2.0", id, method, params },
+      200
+    );
+    assert3(response);
+    assert3.equal(
+      response.id,
+      id,
+      `MCP ${method} returned an unexpected ID`
+    );
+    if (response.error) {
+      const error = object2(response.error, "JSON-RPC error");
+      throw new Error(`MCP ${method} failed: ${String(error.message)}`);
+    }
+    return object2(response.result, `MCP ${method} result`);
+  }
+  async callToolResult(name, args) {
+    return this.request("tools/call", {
+      name,
+      ...args ? { arguments: args } : {}
+    });
+  }
+  async callTool(name, args) {
+    const result = await this.callToolResult(name, args);
+    if (result.isError === true) {
+      const content = Array.isArray(result.content) ? result.content : [];
+      const detail = content.map((item) => object2(item).text).filter((item) => typeof item === "string").join("; ");
+      throw new Error(`MCP tool ${name} failed: ${detail}`);
+    }
+    return object2(result.structuredContent, `${name} structuredContent`);
+  }
+  async close() {
+    if (!this.sessionId) return;
+    const headers = new Headers({ "x-medialit-apikey": this.apiKey });
+    headers.set("mcp-session-id", this.sessionId);
+    if (this.protocolVersion) {
+      headers.set("mcp-protocol-version", this.protocolVersion);
+    }
+    const response = await fetch(this.endpoint, {
+      method: "DELETE",
+      headers,
+      redirect: "error",
+      signal: AbortSignal.timeout(3e4)
+    });
+    if (response.status !== 200) {
+      const body = (await response.text()).split(this.apiKey).join("[redacted]");
+      throw new Error(
+        `MCP session close: expected HTTP 200, got ${response.status}: ${body.slice(0, 1e3)}`
+      );
+    }
+    this.sessionId = void 0;
+  }
+};
+async function runMcpIntegrationTests(options = {}) {
+  const apiKey = options.apiKey ?? process.env.MEDIALIT_APIKEY;
+  assert3(
+    typeof apiKey === "string" && apiKey.trim(),
+    "MEDIALIT_APIKEY is required"
+  );
+  const server = options.server ?? process.env.MEDIALIT_SERVER ?? "localhost:8000";
+  const base = new URL(
+    /^https?:\/\//i.test(server) ? server : `http://${server}`
+  );
+  assert3(
+    ["http:", "https:"].includes(base.protocol),
+    "MEDIALIT_SERVER must use HTTP or HTTPS"
+  );
+  assert3(
+    !base.username && !base.password && !base.search && !base.hash,
+    "MEDIALIT_SERVER must be a base URL without credentials, query, or fragment"
+  );
+  base.pathname = `${base.pathname.replace(/\/+$/, "")}/`;
+  const endpoint = new URL("mcp", base);
+  const log = options.log ?? console.log;
+  const group = `__mcp_integration_${randomUUID3()}`;
+  const png = generatePng();
+  const pending = /* @__PURE__ */ new Set();
+  let baseline;
+  let baselineCount;
+  let uploadAttempted = false;
+  let settingsToRestore;
+  let failure;
+  const cleanupErrors = [];
+  const client = new McpSession(endpoint, apiKey);
+  async function storage() {
+    const result = await client.callTool("get_total_storage");
+    return {
+      storage: integer2(result.storage, "storage"),
+      maxStorage: integer2(result.maxStorage, "maxStorage")
+    };
+  }
+  async function count() {
+    return integer2(
+      (await client.callTool("get_media_count")).count,
+      "count"
+    );
+  }
+  async function list(groupFilter) {
+    const result = await client.callTool("list_media", {
+      page: 1,
+      limit: 100,
+      group: groupFilter
+    });
+    assert3(Array.isArray(result.mediaItems), "mediaItems must be an array");
+    return result.mediaItems.map((media) => object2(media, "media item"));
+  }
+  async function getMediaSettings() {
+    return mediaSettings(await client.callTool("get_media_settings"));
+  }
+  async function updateMediaSettings(settings) {
+    const result = await client.callTool("update_media_settings", settings);
+    assert3.equal(result.message, "success");
+  }
+  async function restoreMediaSettings() {
+    if (!settingsToRestore) return;
+    const original = settingsToRestore;
+    await updateMediaSettings(original);
+    assert3.deepEqual(await getMediaSettings(), original);
+    settingsToRestore = void 0;
+  }
+  async function uploadWithSignature(signature, filename, caption) {
+    const form = new FormData();
+    form.set(
+      "file",
+      new Blob([Uint8Array.from(png)], { type: "image/png" }),
+      filename
+    );
+    form.set("access", "private");
+    form.set("caption", caption);
+    const response = await fetch(new URL("media/create", base), {
+      method: "POST",
+      headers: { "x-medialit-signature": signature },
+      body: form,
+      redirect: "error",
+      signal: AbortSignal.timeout(3e4)
+    });
+    const body = await response.text();
+    if (response.status !== 200) {
+      throw new Error(
+        `Signed upload: expected HTTP 200, got ${response.status}: ${body.split(signature).join("[redacted]").slice(0, 1e3)}`
+      );
+    }
+    return object2(JSON.parse(body), "signed upload response");
+  }
+  async function checkWhoami(expected) {
+    const result = await client.callTool("whoami");
+    assert3.equal(result.auth, "apikey");
+    nonemptyText2(result.email, "whoami email");
+    const app = object2(result.app, "whoami app");
+    nonemptyText2(app.id, "whoami app id");
+    nonemptyText2(app.name, "whoami app name");
+    assert3.equal(typeof app.default, "boolean");
+    assert3.equal(
+      JSON.stringify(result).includes(apiKey),
+      false,
+      "whoami must not return the API key"
+    );
+    assert3.equal(result.files, expected.files);
+    assert3.equal(result.storage, expected.storage);
+    assert3.equal(result.maxStorage, expected.maxStorage);
+  }
+  async function checkTotals(bytes, files) {
+    assert3(baseline && baselineCount !== void 0);
+    const current = await storage();
+    assert3.equal(current.maxStorage, baseline.maxStorage);
+    assert3.equal(current.storage, baseline.storage + bytes);
+    assert3.equal(
+      current.maxStorage - current.storage,
+      baseline.maxStorage - baseline.storage - bytes
+    );
+    assert3.equal(await count(), baselineCount + files);
+    await checkWhoami({ ...current, files: baselineCount + files });
+  }
+  log(`MediaLit MCP integration run ${group} against ${endpoint.origin}`);
+  try {
+    await client.connect();
+    const listedTools = await client.request("tools/list");
+    assert3(
+      Array.isArray(listedTools.tools),
+      "tools/list must return tools"
+    );
+    const toolNames = new Set(
+      listedTools.tools.map(
+        (tool) => nonemptyText2(object2(tool).name, "tool name")
+      )
+    );
+    assert3.deepEqual(
+      [...toolNames].sort(),
+      EXPECTED_MCP_TOOLS,
+      "MCP tool inventory changed; update this integration test and exercise every tool"
+    );
+    log("PASS MCP initialize and complete tool inventory");
+    const originalSettings = await getMediaSettings();
+    settingsToRestore = originalSettings;
+    const changedSettings = {
+      ...originalSettings,
+      useWebP: !originalSettings.useWebP
+    };
+    await updateMediaSettings(changedSettings);
+    assert3.deepEqual(await getMediaSettings(), changedSettings);
+    await restoreMediaSettings();
+    log("PASS get_media_settings and update_media_settings round trip");
+    baseline = await storage();
+    baselineCount = await count();
+    assert3(
+      baseline.maxStorage - baseline.storage >= png.length,
+      "Insufficient available storage for the MCP upload"
+    );
+    assert3.deepEqual(
+      await list(group),
+      [],
+      "Run group already contains media"
+    );
+    await checkWhoami({ ...baseline, files: baselineCount });
+    log(
+      "PASS get_total_storage, get_media_count, whoami and list_media baseline"
+    );
+    const signed = await client.callTool("create_upload_signature", {
+      group
+    });
+    const signature = nonemptyText2(signed.signature, "signature");
+    uploadAttempted = true;
+    const signedFilename = `${group}-signed.png`;
+    const signedCaption = `${group}: signed upload`;
+    const signedUpload = await uploadWithSignature(
+      signature,
+      signedFilename,
+      signedCaption
+    );
+    const signedMediaId = nonemptyText2(
+      signedUpload.mediaId,
+      "signed upload mediaId"
+    );
+    pending.add(signedMediaId);
+    assert3.equal(signedUpload.originalFileName, signedFilename);
+    assert3.equal(signedUpload.size, png.length);
+    assert3.equal(signedUpload.caption, signedCaption);
+    assert3.equal(signedUpload.group, group);
+    assert3.deepEqual(
+      await list(group),
+      [],
+      "Signed draft uploads must stay hidden"
+    );
+    const signedDelete = await client.callTool("delete_media", {
+      mediaId: signedMediaId
+    });
+    assert3.equal(signedDelete.message, "success");
+    pending.delete(signedMediaId);
+    await checkTotals(0, 0);
+    log("PASS create_upload_signature and delete_media on a signed draft");
+    uploadAttempted = true;
+    const filename = `${group}.png`;
+    const caption = `${group}: MCP integration upload`;
+    const uploaded = await client.callTool("upload_media", {
+      fileBase64: png.toString("base64"),
+      fileName: filename,
+      mimeType: "image/png",
+      caption,
+      access: "private",
+      group
+    });
+    const mediaId = nonemptyText2(uploaded.mediaId, "mediaId");
+    pending.add(mediaId);
+    assert3.equal(uploaded.originalFileName, filename);
+    assert3.equal(uploaded.size, png.length);
+    assert3.equal(uploaded.caption, caption);
+    assert3.equal(uploaded.group, group);
+    assert3.deepEqual(
+      await list(group),
+      [],
+      "Draft MCP uploads must stay hidden"
+    );
+    await checkTotals(0, 0);
+    log("PASS upload_media and draft visibility");
+    const sealed = await client.callTool("seal_media", { mediaId });
+    assert3.equal(sealed.mediaId, mediaId);
+    const retrieved = await client.callTool("get_media", { mediaId });
+    assert3.equal(retrieved.mediaId, mediaId);
+    assert3.equal(retrieved.originalFileName, filename);
+    assert3.equal(retrieved.size, png.length);
+    assert3.equal(retrieved.group, group);
+    assert3.deepEqual(
+      (await list(group)).map((item) => item.mediaId),
+      [mediaId]
+    );
+    await checkTotals(png.length, 1);
+    log("PASS seal_media, get_media, list_media and storage/count totals");
+    const deleted = await client.callTool("delete_media", { mediaId });
+    assert3.equal(deleted.message, "success");
+    pending.delete(mediaId);
+    const missing = await client.callToolResult("get_media", { mediaId });
+    assert3.equal(
+      missing.isError,
+      true,
+      "Deleted media must not be retrievable"
+    );
+    assert3.deepEqual(await list(group), []);
+    await checkTotals(0, 0);
+    log("PASS delete_media and restored storage/count totals");
+  } catch (error) {
+    failure = error;
+  } finally {
+    try {
+      await restoreMediaSettings();
+    } catch (error) {
+      cleanupErrors.push(error);
+      log(`CLEANUP failed to restore media settings: ${String(error)}`);
+    }
+    for (const mediaId of pending) {
+      try {
+        await client.callTool("delete_media", { mediaId });
+        pending.delete(mediaId);
+        log(`CLEANUP deleted ${mediaId}`);
+      } catch (error) {
+        cleanupErrors.push(error);
+        log(`CLEANUP FAILED for ${mediaId}: ${String(error)}`);
+      }
+    }
+    if (uploadAttempted && baseline && baselineCount !== void 0) {
+      try {
+        assert3.deepEqual(
+          await list(group),
+          [],
+          "Run media remains after cleanup"
+        );
+        await checkTotals(0, 0);
+      } catch (error) {
+        cleanupErrors.push(error);
+        log(`CLEANUP verification failed: ${String(error)}`);
+      }
+    }
+    try {
+      await client.close();
+    } catch (error) {
+      cleanupErrors.push(error);
+      log(`CLEANUP failed to close MCP session: ${String(error)}`);
+    }
+  }
+  if (failure) throw failure;
+  if (cleanupErrors.length) {
+    throw new AggregateError(
+      cleanupErrors,
+      "MCP integration cleanup failed"
+    );
+  }
+  log("PASS MediaLit MCP lifecycle; media and session cleaned up");
+}
+
+// src/rest.ts
+import assert4 from "node:assert/strict";
+import { randomUUID as randomUUID4 } from "node:crypto";
+function object3(value) {
+  assert4(
+    value && typeof value === "object" && !Array.isArray(value),
+    "Expected a JSON object"
+  );
+  return value;
+}
+function text(value, label) {
+  assert4(
+    typeof value === "string" && value.length > 0,
+    `${label} must be a nonempty string`
+  );
+  return value;
+}
+function integer3(value, label) {
+  assert4(
+    typeof value === "number" && Number.isSafeInteger(value) && value >= 0,
+    `${label} must be a nonnegative integer`
+  );
+  return value;
+}
+async function runIntegrationTests(options = {}) {
+  const apiKey = options.apiKey ?? process.env.MEDIALIT_APIKEY;
+  assert4(apiKey?.trim(), "MEDIALIT_APIKEY is required");
+  const server = options.server ?? process.env.MEDIALIT_SERVER ?? "localhost:8000";
+  const base = new URL(
+    /^https?:\/\//i.test(server) ? server : `http://${server}`
+  );
+  assert4(
+    ["http:", "https:"].includes(base.protocol),
+    "MEDIALIT_SERVER must use HTTP or HTTPS"
+  );
+  assert4(
+    !base.username && !base.password && !base.search && !base.hash,
+    "MEDIALIT_SERVER must be a base URL without credentials, query, or fragment"
+  );
+  base.pathname = `${base.pathname.replace(/\/+$/, "")}/`;
+  const log = options.log ?? console.log;
+  const group = `__integration_${randomUUID4()}`;
+  const png = generatePng();
+  const pending = /* @__PURE__ */ new Set();
+  const uploads = [];
+  let baseline;
+  let baselineCount;
+  let uploadsAttempted = false;
+  let failure;
+  const cleanupErrors = [];
+  function url(path) {
+    return new URL(path.replace(/^\//, ""), base);
+  }
+  async function request(target, init, status = 200) {
+    const response = await fetch(target, {
+      ...init,
+      redirect: "error",
+      signal: AbortSignal.timeout(3e4)
+    });
+    if (response.status !== status) {
+      const detail = (await response.text()).split(apiKey).join("[redacted]");
+      throw new Error(
+        `${init.method ?? "GET"} ${target.pathname}: expected HTTP ${status}, got ${response.status}: ${detail.slice(0, 1e3)}`
+      );
+    }
+    return response;
+  }
+  async function api(path, body, method = "POST") {
+    const response = await request(url(path), {
+      method,
+      headers: {
+        "x-medialit-apikey": apiKey,
+        "content-type": "application/json"
+      },
+      ...body ? { body: JSON.stringify(body) } : {}
+    });
+    return response.json();
+  }
+  async function list(filters = {}) {
+    const result = await api("media/get", {
+      page: 1,
+      limit: 100,
+      ...filters
+    });
+    assert4(Array.isArray(result), "List media must return an array");
+    return result.map(object3);
+  }
+  async function stats() {
+    const result = object3(await api("media/get/size"));
+    return {
+      storage: integer3(result.storage, "storage"),
+      maxStorage: integer3(result.maxStorage, "maxStorage")
+    };
+  }
+  async function count() {
+    return integer3(object3(await api("media/get/count")).count, "count");
+  }
+  async function checkTotals(bytes, files) {
+    assert4(baseline && baselineCount !== void 0);
+    const current = await stats();
+    assert4.equal(
+      current.maxStorage,
+      baseline.maxStorage,
+      "Storage quota changed during the run"
+    );
+    assert4.equal(
+      current.storage,
+      baseline.storage + bytes,
+      "Occupied storage delta is incorrect (check for concurrent writes)"
+    );
+    assert4.equal(
+      current.maxStorage - current.storage,
+      baseline.maxStorage - baseline.storage - bytes,
+      "Available storage delta is incorrect"
+    );
+    assert4.equal(
+      await count(),
+      baselineCount + files,
+      "Media count delta is incorrect"
+    );
+  }
+  function track(value) {
+    const media = object3(value);
+    const id = text(media.mediaId, "mediaId");
+    assert4(!pending.has(id), "Upload returned a duplicate mediaId");
+    pending.add(id);
+    return media;
+  }
+  function checkMedia(media, expected) {
+    assert4.equal(media.mediaId, expected.mediaId);
+    assert4.equal(media.originalFileName, expected.filename);
+    assert4.equal(media.size, png.length);
+    assert4.equal(media.access, expected.access);
+    assert4.equal(media.group, group);
+    assert4.equal(media.caption, expected.caption);
+    assert4(
+      ["image/png", "image/webp"].includes(
+        text(media.mimeType, "mimeType")
+      ),
+      "Unexpected image MIME type"
+    );
+    const file = new URL(text(media.file, "file URL"));
+    assert4(["http:", "https:"].includes(file.protocol));
+  }
+  async function download(media) {
+    const response = await fetch(text(media.file, "file URL"), {
+      signal: AbortSignal.timeout(3e4)
+    });
+    assert4.equal(response.status, 200, "File download failed");
+    const bytes = Buffer.from(await response.arrayBuffer());
+    if (media.mimeType === "image/png") {
+      assert4.deepEqual(
+        bytes,
+        png,
+        "Downloaded PNG differs from the uploaded bytes"
+      );
+    } else {
+      assert4.equal(bytes.toString("ascii", 0, 4), "RIFF");
+      assert4.equal(bytes.toString("ascii", 8, 12), "WEBP");
+      assert4(bytes.length > 12, "Downloaded WebP is empty");
+    }
+  }
+  async function signature() {
+    return text(
+      object3(await api("media/signature/create", { group })).signature,
+      "signature"
+    );
+  }
+  async function upload(tus, signed, access) {
+    const label = `${tus ? "tus" : "multipart"}-${signed ? "signature" : "apikey"}`;
+    const filename = `${label}.png`;
+    const caption = `${group}:${label}`;
+    const headers = signed ? { "x-medialit-signature": await signature() } : { "x-medialit-apikey": apiKey };
+    uploadsAttempted = true;
+    let media;
+    if (tus) {
+      const metadata = {
+        fileName: filename,
+        mimeType: "image/png",
+        access,
+        caption,
+        group
+      };
+      const tusHeaders = { ...headers, "Tus-Resumable": "1.0.0" };
+      const created = await request(
+        url("media/create/resumable"),
+        {
+          method: "POST",
+          headers: {
+            ...tusHeaders,
+            "Upload-Length": String(png.length),
+            "Upload-Metadata": Object.entries(metadata).map(
+              ([key, value]) => `${key} ${Buffer.from(value).toString("base64")}`
+            ).join(",")
+          }
+        },
+        201
+      );
+      const location = new URL(
+        text(created.headers.get("location"), "tus Location"),
+        url("media/create/resumable")
+      );
+      assert4.equal(
+        location.origin,
+        base.origin,
+        "tus Location points to a different origin"
+      );
+      const split = Math.floor(png.length / 2);
+      await request(
+        location,
+        {
+          method: "PATCH",
+          headers: {
+            ...tusHeaders,
+            "content-type": "application/offset+octet-stream",
+            "Upload-Offset": "0"
+          },
+          body: Uint8Array.from(png.subarray(0, split))
+        },
+        204
+      );
+      const head = await request(location, {
+        method: "HEAD",
+        headers: tusHeaders
+      });
+      assert4.equal(head.headers.get("upload-offset"), String(split));
+      assert4.equal(head.headers.get("upload-length"), String(png.length));
+      const completed = await request(
+        location,
+        {
+          method: "PATCH",
+          headers: {
+            ...tusHeaders,
+            "content-type": "application/offset+octet-stream",
+            "Upload-Offset": String(split)
+          },
+          body: Uint8Array.from(png.subarray(split))
+        },
+        204
+      );
+      media = track(
+        JSON.parse(
+          text(completed.headers.get("media"), "tus media header")
+        )
+      );
+      assert4.equal(
+        completed.headers.get("upload-offset"),
+        String(png.length)
+      );
+    } else {
+      const form = new FormData();
+      form.set(
+        "file",
+        new Blob([Uint8Array.from(png)], { type: "image/png" }),
+        filename
+      );
+      form.set("access", access);
+      form.set("caption", caption);
+      if (!signed) form.set("group", group);
+      media = track(
+        await (await request(url("media/create"), {
+          method: "POST",
+          headers,
+          body: form
+        })).json()
+      );
+    }
+    const expected = {
+      mediaId: text(media.mediaId, "mediaId"),
+      filename,
+      caption,
+      access
+    };
+    uploads.push(expected);
+    checkMedia(media, expected);
+    const retrieved = object3(
+      await api(`media/get/${encodeURIComponent(expected.mediaId)}`)
+    );
+    checkMedia(retrieved, expected);
+    await download(retrieved);
+    await checkTotals(0, 0);
+    log(`PASS upload and get ${label} (${access})`);
+  }
+  log(
+    `MediaLit integration run ${group} against ${base.origin}${base.pathname}`
+  );
+  try {
+    baseline = await stats();
+    baselineCount = await count();
+    assert4(
+      baseline.maxStorage - baseline.storage >= png.length * 4,
+      "Insufficient available storage for four PNGs"
+    );
+    await list();
+    assert4.deepEqual(
+      await list({ group }),
+      [],
+      "Run group already contains media"
+    );
+    log("PASS list media and baseline storage/count");
+    await upload(false, false, "public");
+    await upload(false, true, "private");
+    await upload(true, false, "private");
+    await upload(true, true, "public");
+    assert4.deepEqual(
+      await list({ group }),
+      [],
+      "Unsealed uploads should not be listed"
+    );
+    for (let index = 0; index < uploads.length; index++) {
+      const expected = uploads[index];
+      checkMedia(
+        object3(
+          await api(
+            `media/seal/${encodeURIComponent(expected.mediaId)}`
+          )
+        ),
+        expected
+      );
+      await checkTotals(png.length * (index + 1), index + 1);
+      log(`PASS seal ${expected.filename} and storage decrement`);
+    }
+    const listed = await list({ group });
+    assert4.deepEqual(
+      listed.map((media) => media.mediaId).sort(),
+      uploads.map((media) => media.mediaId).sort(),
+      "List must contain all run media"
+    );
+    for (const access of ["public", "private"]) {
+      assert4.deepEqual(
+        (await list({ group, access })).map((media) => media.mediaId).sort(),
+        uploads.filter((media) => media.access === access).map((media) => media.mediaId).sort()
+      );
+    }
+    const paginated = [];
+    for (let page = 1; page <= uploads.length + 1; page++) {
+      const items = await list({ group, page, limit: 1 });
+      assert4.equal(items.length, page <= uploads.length ? 1 : 0);
+      paginated.push(...items.map((media) => media.mediaId));
+    }
+    assert4.deepEqual(
+      paginated.sort(),
+      uploads.map((media) => media.mediaId).sort()
+    );
+    for (const expected of uploads) {
+      const media = object3(
+        await api(`media/get/${encodeURIComponent(expected.mediaId)}`)
+      );
+      checkMedia(media, expected);
+      await download(media);
+    }
+    log(
+      "PASS list, pagination, access filters, get and download all sealed media"
+    );
+    for (let index = 0; index < uploads.length; index++) {
+      const { mediaId } = uploads[index];
+      assert4.equal(
+        object3(
+          await api(
+            `media/delete/${encodeURIComponent(mediaId)}`,
+            void 0,
+            "DELETE"
+          )
+        ).message,
+        "success"
+      );
+      pending.delete(mediaId);
+      await request(
+        url(`media/get/${encodeURIComponent(mediaId)}`),
+        { method: "POST", headers: { "x-medialit-apikey": apiKey } },
+        404
+      );
+      await checkTotals(
+        png.length * (uploads.length - index - 1),
+        uploads.length - index - 1
+      );
+      log(`PASS delete ${mediaId} and storage increment`);
+    }
+    assert4.deepEqual(await list({ group }), []);
+  } catch (error) {
+    failure = error;
+  } finally {
+    for (const mediaId of pending) {
+      try {
+        await api(
+          `media/delete/${encodeURIComponent(mediaId)}`,
+          void 0,
+          "DELETE"
+        );
+        pending.delete(mediaId);
+        log(`CLEANUP deleted ${mediaId}`);
+      } catch (error) {
+        cleanupErrors.push(error);
+        log(`CLEANUP FAILED for ${mediaId}: ${String(error)}`);
+      }
+    }
+    if (uploadsAttempted && baseline && baselineCount !== void 0) {
+      try {
+        assert4.deepEqual(
+          await list({ group }),
+          [],
+          "Run media remains after cleanup"
+        );
+        await checkTotals(0, 0);
+      } catch (error) {
+        cleanupErrors.push(error);
+        log(`CLEANUP verification failed: ${String(error)}`);
+      }
+    }
+  }
+  if (failure) throw failure;
+  if (cleanupErrors.length)
+    throw new AggregateError(cleanupErrors, "Integration cleanup failed");
+  log(
+    "PASS MediaLit public API lifecycle; storage and count restored to baseline"
+  );
+}
+
+// src/index.ts
+async function runAllIntegrationTests() {
+  const suites = [
+    ["REST", runIntegrationTests],
+    ["MCP", runMcpIntegrationTests],
+    ["CLI", runCliIntegrationTests]
+  ];
+  const failed = [];
+  for (const [name, run] of suites) {
+    console.log(`
+=== ${name} ===`);
+    try {
+      await run();
+    } catch (error) {
+      failed.push(name);
+      console.error(
+        `FAIL ${name}: ${error instanceof Error ? error.message : String(error)}`
+      );
+    }
+  }
+  console.log(
+    failed.length ? `
+${failed.length} of ${suites.length} suites failed: ${failed.join(", ")}` : `
+All ${suites.length} suites passed`
+  );
+  return failed.length === 0;
+}
+
+// src/bin.ts
+var HELP = `Usage: medialit-integration-tests <command>
+
+Commands:
+  synthetic  Quick check that MediaLit is up: upload, seal, download and
+             delete one file. Safe to run against production every few
+             minutes.
+  all        Run the REST, MCP and CLI suites
+  rest       Run the REST API suite
+  mcp        Run the MCP server suite
+  cli        Run the CLI suite (set MEDIALIT_CLI to the medialit command)
+
+The suites change settings and create files, so run them against a test app.
+
+Environment:
+  MEDIALIT_APIKEY                    API key of the app to test (required)
+  MEDIALIT_SERVER                    MediaLit URL (default: localhost:8000)
+  MEDIALIT_SYNTHETIC_HEARTBEAT_URL   synthetic: heartbeat to ping after each
+                                     run, <url>/fail on failure
+`;
+async function main(command) {
+  switch (command) {
+    case "synthetic":
+      return (await runSyntheticCheck()).ok;
+    case "all":
+      return runAllIntegrationTests();
+    case "rest":
+      await runIntegrationTests();
+      return true;
+    case "mcp":
+      await runMcpIntegrationTests();
+      return true;
+    case "cli":
+      await runCliIntegrationTests();
+      return true;
+    case void 0:
+    case "help":
+    case "--help":
+    case "-h":
+      console.log(HELP);
+      return true;
+    default:
+      console.error(`Unknown command "${command}".
+
+${HELP}`);
+      return false;
+  }
+}
+main(process.argv[2]).then((ok) => {
+  if (!ok) process.exitCode = 1;
+}).catch((error) => {
+  console.error(
+    `FAIL: ${error instanceof Error ? error.message : String(error)}`
+  );
+  process.exitCode = 1;
+});