@memberjunction/server 5.42.0 → 5.44.0

package/dist/rest/MediaStreamHandler.js

@@ -0,0 +1,192 @@
+/**
+ * @fileoverview Authenticated HTTP-Range media streaming route (`GET /media/:fileId`).
+ *
+ * Streams an `MJ: Files` object's bytes (optionally a byte range) to the browser so
+ * `<audio>`/`<video>` elements get native progressive playback + seek-before-download
+ * for large media — instead of the whole file being base64'd over GraphQL.
+ *
+ * Auth model: the request carries a short-lived signed token (`?token=`) minted by
+ * `CreateMediaAccessToken` AFTER a per-user permission check. The token IS the
+ * capability: this route re-verifies its signature/expiry/`typ` and that it matches
+ * the `:fileId`, then loads the file under a SYSTEM context (it only needs
+ * `ProviderKey`/`ProviderID` to locate the bytes — no row-level re-check, since
+ * access was already authorized at mint).
+ *
+ * Mount unauthenticated, BEFORE the unified auth middleware:
+ *   `app.use('/media', cors<cors.CorsRequest>(), createMediaStreamRouter())`
+ *
+ * @module @memberjunction/server/rest/MediaStreamHandler
+ */
+import express from 'express';
+import { LogError, Metadata } from '@memberjunction/core';
+import { FileStorageEngine } from '@memberjunction/storage';
+import { getSystemUser } from '../auth/index.js';
+import { MediaAccessKeyManager } from './MediaAccessKeys.js';
+import { parseRange, parseRangeHeaderLoose } from './mediaRange.js';
+/**
+ * Builds the Express router exposing `GET /media/:fileId`. Stateless — verification
+ * and byte-source resolution happen per request.
+ */
+export function createMediaStreamRouter() {
+    const router = express.Router();
+    router.get('/:fileId', async (req, res) => {
+        await handleMediaRequest(req, res);
+    });
+    return router;
+}
+/** Top-level request handler: verify token → resolve bytes → stream/buffer with Range support. */
+async function handleMediaRequest(req, res) {
+    const fileId = req.params.fileId;
+    const token = typeof req.query.token === 'string' ? req.query.token : '';
+    const claims = verifyMediaToken(token, fileId);
+    if (!claims) {
+        // No body leak — a bad/expired/mismatched token is indistinguishable from "forbidden".
+        res.status(403).end();
+        return;
+    }
+    // Never let CDNs or shared caches retain authorized media bytes.
+    res.setHeader('Cache-Control', 'private, no-store');
+    try {
+        const source = await resolveFileBytesSource(fileId);
+        if (!source) {
+            res.status(404).end();
+            return;
+        }
+        await streamOrBuffer(req, res, source);
+    }
+    catch (error) {
+        LogError(`[MediaStream] Failed to serve file ${fileId}: ${error instanceof Error ? error.message : String(error)}`);
+        if (!res.headersSent) {
+            res.status(500).end();
+        }
+        else {
+            res.destroy();
+        }
+    }
+}
+/**
+ * Verifies the token and that it grants access to THIS file. Returns null on any failure
+ * (signature, expiry, `typ`, or fileId mismatch) so the caller can 403 uniformly.
+ */
+function verifyMediaToken(token, fileId) {
+    if (!token) {
+        return null;
+    }
+    const result = MediaAccessKeyManager.Instance.Verify(token);
+    if (!result.Valid) {
+        return null;
+    }
+    // The token's fileId must match the path — a token minted for file A cannot stream file B.
+    if (result.Claims.fileId !== fileId) {
+        return null;
+    }
+    return { fileId: result.Claims.fileId, userId: result.Claims.userId };
+}
+/**
+ * Loads the file under a SYSTEM context and resolves its storage driver + provider key.
+ * Returns null when the file row, its account, or its provider key can't be resolved
+ * (→ 404). Mirrors `readRealtimeRecordingFile`'s account-resolution (engine config with
+ * force-refresh fallback for newly-provisioned accounts).
+ */
+async function resolveFileBytesSource(fileId) {
+    const systemUser = await getSystemUser();
+    // The /media route runs pre-auth on the server's own provider; access was already authorized
+    // at token-mint time, so this load only locates the bytes.
+    const md = new Metadata(); // global-provider-ok: pre-auth system-context route, no per-request provider
+    const file = await md.GetEntityObject('MJ: Files', systemUser);
+    if (!await file.Load(fileId) || !file.ProviderKey) {
+        return null;
+    }
+    // Resolve the storage account for the file's provider; force-refresh once if a
+    // newly-provisioned account isn't in the cache yet.
+    await FileStorageEngine.Instance.Config(false, systemUser);
+    let accounts = FileStorageEngine.Instance.GetAccountsByProviderID(file.ProviderID);
+    if (accounts.length === 0) {
+        await FileStorageEngine.Instance.Config(true, systemUser);
+        accounts = FileStorageEngine.Instance.GetAccountsByProviderID(file.ProviderID);
+    }
+    const account = accounts[0];
+    if (!account) {
+        return null;
+    }
+    const driver = await FileStorageEngine.Instance.GetDriver(account.ID, systemUser);
+    return {
+        driver,
+        providerKey: file.ProviderKey,
+        contentType: file.ContentType ?? 'application/octet-stream',
+    };
+}
+/**
+ * Streams the object honoring an HTTP `Range` request. Prefers true streaming
+ * (`GetObjectStream`) for streaming-capable drivers; gracefully falls back to a
+ * full buffered `GetObject` (slicing for Range) for drivers that don't.
+ */
+async function streamOrBuffer(req, res, source) {
+    const rangeHeader = typeof req.headers.range === 'string' ? req.headers.range : undefined;
+    if (source.driver.SupportsStreaming) {
+        await serveViaStream(res, source, rangeHeader);
+    }
+    else {
+        await serveViaBuffer(res, source, rangeHeader);
+    }
+}
+/** True-streaming path: `GetObjectStream` + pipe, with 206 when a Range was honored. */
+async function serveViaStream(res, source, rangeHeader) {
+    const range = rangeHeader ? parseRangeHeaderLoose(rangeHeader) : undefined;
+    // Omit End for an open-ended range so the driver streams to EOF (per ByteRange semantics).
+    const streamRange = range
+        ? (range.end == null ? { Start: range.start } : { Start: range.start, End: range.end })
+        : undefined;
+    const result = await source.driver.GetObjectStream({ fullPath: source.providerKey, Range: streamRange });
+    res.setHeader('Accept-Ranges', 'bytes');
+    res.setHeader('Content-Type', result.ContentType ?? source.contentType);
+    if (result.ContentLength != null) {
+        res.setHeader('Content-Length', String(result.ContentLength));
+    }
+    if (result.ContentRange) {
+        const { Start, End, Total } = result.ContentRange;
+        res.setHeader('Content-Range', `bytes ${Start}-${End}/${Total}`);
+        res.status(206);
+    }
+    else {
+        res.status(200);
+    }
+    // Tear down the source stream if the client aborts (closed tab, seek, etc.).
+    res.on('close', () => result.Stream.destroy());
+    result.Stream.on('error', (err) => {
+        LogError(`[MediaStream] Source stream error: ${err instanceof Error ? err.message : String(err)}`);
+        if (!res.headersSent) {
+            res.status(500).end();
+        }
+        else {
+            res.destroy();
+        }
+    });
+    result.Stream.pipe(res);
+}
+/** Fallback path: full buffered `GetObject`, slicing the buffer for Range (206) or sending whole (200). */
+async function serveViaBuffer(res, source, rangeHeader) {
+    const buffer = await source.driver.GetObject({ fullPath: source.providerKey });
+    const total = buffer.length;
+    res.setHeader('Accept-Ranges', 'bytes');
+    res.setHeader('Content-Type', source.contentType);
+    if (!rangeHeader) {
+        res.status(200);
+        res.setHeader('Content-Length', String(total));
+        res.end(buffer);
+        return;
+    }
+    const range = parseRange(rangeHeader, total);
+    if (!range) {
+        // Unsatisfiable range — per RFC 7233, 416 + Content-Range with the total size.
+        res.setHeader('Content-Range', `bytes */${total}`);
+        res.status(416).end();
+        return;
+    }
+    const slice = buffer.subarray(range.start, range.end + 1);
+    res.status(206);
+    res.setHeader('Content-Range', `bytes ${range.start}-${range.end}/${total}`);
+    res.setHeader('Content-Length', String(slice.length));
+    res.end(slice);
+}
+//# sourceMappingURL=MediaStreamHandler.js.map

package/dist/rest/MediaStreamHandler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"MediaStreamHandler.js","sourceRoot":"","sources":["../../src/rest/MediaStreamHandler.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,OAAqD,MAAM,SAAS,CAAC;AAC5E,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAY,MAAM,sBAAsB,CAAC;AAEpE,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAE5D,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,OAAO,EAAE,UAAU,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AAUpE;;;GAGG;AACH,MAAM,UAAU,uBAAuB;IACrC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAChC,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;QAC3D,MAAM,kBAAkB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IACrC,CAAC,CAAC,CAAC;IACH,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,kGAAkG;AAClG,KAAK,UAAU,kBAAkB,CAAC,GAAY,EAAE,GAAa;IAC3D,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC;IACjC,MAAM,KAAK,GAAG,OAAO,GAAG,CAAC,KAAK,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;IAEzE,MAAM,MAAM,GAAG,gBAAgB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAC/C,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,uFAAuF;QACvF,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;QACtB,OAAO;IACT,CAAC;IAED,iEAAiE;IACjE,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,mBAAmB,CAAC,CAAC;IAEpD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,sBAAsB,CAAC,MAAM,CAAC,CAAC;QACpD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;YACtB,OAAO;QACT,CAAC;QACD,MAAM,cAAc,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;IACzC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,QAAQ,CAAC,sCAAsC,MAAM,KAAK,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACpH,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;YACrB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;QACxB,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,OAAO,EAAE,CAAC;QAChB,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAS,gBAAgB,CAAC,KAAa,EAAE,MAAc;IACrD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,MAAM,GAAG,qBAAqB,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC5D,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QAClB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,2FAA2F;IAC3F,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QACpC,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;AACxE,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,sBAAsB,CAAC,MAAc;IAClD,MAAM,UAAU,GAAa,MAAM,aAAa,EAAE,CAAC;IAEnD,6FAA6F;IAC7F,2DAA2D;IAC3D,MAAM,EAAE,GAAG,IAAI,QAAQ,EAAE,CAAC,CAAC,6EAA6E;IACxG,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,eAAe,CAAe,WAAW,EAAE,UAAU,CAAC,CAAC;IAC7E,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;QAClD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,+EAA+E;IAC/E,oDAAoD;IACpD,MAAM,iBAAiB,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;IAC3D,IAAI,QAAQ,GAAG,iBAAiB,CAAC,QAAQ,CAAC,uBAAuB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACnF,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,iBAAiB,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;QAC1D,QAAQ,GAAG,iBAAiB,CAAC,QAAQ,CAAC,uBAAuB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACjF,CAAC;IACD,MAAM,OAAO,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;IAC5B,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,QAAQ,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC;IAClF,OAAO;QACL,MAAM;QACN,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,WAAW,EAAE,IAAI,CAAC,WAAW,IAAI,0BAA0B;KAC5D,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,cAAc,CAAC,GAAY,EAAE,GAAa,EAAE,MAAuB;IAChF,MAAM,WAAW,GAAG,OAAO,GAAG,CAAC,OAAO,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;IAE1F,IAAI,MAAM,CAAC,MAAM,CAAC,iBAAiB,EAAE,CAAC;QACpC,MAAM,cAAc,CAAC,GAAG,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC;IACjD,CAAC;SAAM,CAAC;QACN,MAAM,cAAc,CAAC,GAAG,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC;IACjD,CAAC;AACH,CAAC;AAED,wFAAwF;AACxF,KAAK,UAAU,cAAc,CAAC,GAAa,EAAE,MAAuB,EAAE,WAA+B;IACnG,MAAM,KAAK,GAAG,WAAW,CAAC,CAAC,CAAC,qBAAqB,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC3E,2FAA2F;IAC3F,MAAM,WAAW,GAA0B,KAAK;QAC9C,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC;QACvF,CAAC,CAAC,SAAS,CAAC;IAEd,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,WAAW,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;IAEzG,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC;IACxC,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC,WAAW,CAAC,CAAC;IACxE,IAAI,MAAM,CAAC,aAAa,IAAI,IAAI,EAAE,CAAC;QACjC,GAAG,CAAC,SAAS,CAAC,gBAAgB,EAAE,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC;IAChE,CAAC;IACD,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;QACxB,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,MAAM,CAAC,YAAY,CAAC;QAClD,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,SAAS,KAAK,IAAI,GAAG,IAAI,KAAK,EAAE,CAAC,CAAC;QACjE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAClB,CAAC;SAAM,CAAC;QACN,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAClB,CAAC;IAED,6EAA6E;IAC7E,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;IAC/C,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;QAChC,QAAQ,CAAC,sCAAsC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACnG,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;YACrB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;QACxB,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,OAAO,EAAE,CAAC;QAChB,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC1B,CAAC;AAED,2GAA2G;AAC3G,KAAK,UAAU,cAAc,CAAC,GAAa,EAAE,MAAuB,EAAE,WAA+B;IACnG,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC;IAC/E,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC;IAE5B,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC;IACxC,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC;IAElD,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAChB,GAAG,CAAC,SAAS,CAAC,gBAAgB,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QAC/C,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAChB,OAAO;IACT,CAAC;IAED,MAAM,KAAK,GAAG,UAAU,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;IAC7C,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,+EAA+E;QAC/E,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,WAAW,KAAK,EAAE,CAAC,CAAC;QACnD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;QACtB,OAAO;IACT,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;IAC1D,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAChB,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,SAAS,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,GAAG,IAAI,KAAK,EAAE,CAAC,CAAC;IAC7E,GAAG,CAAC,SAAS,CAAC,gBAAgB,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;IACtD,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;AACjB,CAAC"}

package/dist/rest/mediaRange.d.ts

@@ -0,0 +1,41 @@
+/**
+ * @fileoverview Pure HTTP `Range` header parsing for the `/media/:fileId` stream route.
+ *
+ * Split out of {@link module:@memberjunction/server/rest/MediaStreamHandler} (which pulls in
+ * auth/config/storage at module load) so this load-bearing parsing logic is unit-testable in
+ * isolation — same pattern as `peaksSidecar.ts`. These functions decide whether a request gets
+ * a 206 partial body (and over which byte window) vs. a full 200 / a 416.
+ *
+ * Both helpers are deliberately strict single-range parsers: anything malformed, multi-range,
+ * or suffix-only (`bytes=-N`) yields `undefined`, letting the caller fall back to a full read
+ * (streaming path) or a 416 (buffer path).
+ *
+ * @module @memberjunction/server/rest/mediaRange
+ */
+/** A parsed, validated `Range` request against a known total size. */
+export interface ParsedRange {
+    start: number;
+    end: number;
+}
+/**
+ * A parsed `Range` request WITHOUT a known total (streaming path). `end` is undefined
+ * for an open-ended `bytes=start-` request, matching `ByteRange`'s "omit End = EOF".
+ */
+export interface ParsedOpenRange {
+    start: number;
+    end?: number;
+}
+/**
+ * Parses a single-range `bytes=start-end` header WITHOUT a known total (streaming path).
+ * Returns the inclusive offsets, or undefined when the header is malformed/multi-range/
+ * suffix-only (those we leave to the driver as a full read). `end` is left undefined when
+ * open-ended (`bytes=start-`) so the driver streams to EOF.
+ */
+export declare function parseRangeHeaderLoose(rangeHeader: string): ParsedOpenRange | undefined;
+/**
+ * Parses a single-range `bytes=start-end` header against a known total (buffer path),
+ * clamping `end` to the last byte. Returns undefined when unsatisfiable (→ 416) or
+ * malformed/multi-range.
+ */
+export declare function parseRange(rangeHeader: string, total: number): ParsedRange | undefined;
+//# sourceMappingURL=mediaRange.d.ts.map

package/dist/rest/mediaRange.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mediaRange.d.ts","sourceRoot":"","sources":["../../src/rest/mediaRange.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,sEAAsE;AACtE,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;CACb;AAED;;;GAGG;AACH,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,WAAW,EAAE,MAAM,GAAG,eAAe,GAAG,SAAS,CAiBtF;AAED;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,WAAW,GAAG,SAAS,CAetF"}

package/dist/rest/mediaRange.js

@@ -0,0 +1,60 @@
+/**
+ * @fileoverview Pure HTTP `Range` header parsing for the `/media/:fileId` stream route.
+ *
+ * Split out of {@link module:@memberjunction/server/rest/MediaStreamHandler} (which pulls in
+ * auth/config/storage at module load) so this load-bearing parsing logic is unit-testable in
+ * isolation — same pattern as `peaksSidecar.ts`. These functions decide whether a request gets
+ * a 206 partial body (and over which byte window) vs. a full 200 / a 416.
+ *
+ * Both helpers are deliberately strict single-range parsers: anything malformed, multi-range,
+ * or suffix-only (`bytes=-N`) yields `undefined`, letting the caller fall back to a full read
+ * (streaming path) or a 416 (buffer path).
+ *
+ * @module @memberjunction/server/rest/mediaRange
+ */
+/**
+ * Parses a single-range `bytes=start-end` header WITHOUT a known total (streaming path).
+ * Returns the inclusive offsets, or undefined when the header is malformed/multi-range/
+ * suffix-only (those we leave to the driver as a full read). `end` is left undefined when
+ * open-ended (`bytes=start-`) so the driver streams to EOF.
+ */
+export function parseRangeHeaderLoose(rangeHeader) {
+    const match = /^bytes=(\d+)-(\d*)$/.exec(rangeHeader.trim());
+    if (!match) {
+        return undefined;
+    }
+    const start = Number(match[1]);
+    if (!Number.isFinite(start)) {
+        return undefined;
+    }
+    if (match[2] === '') {
+        return { start };
+    }
+    const end = Number(match[2]);
+    if (!Number.isFinite(end) || end < start) {
+        return undefined;
+    }
+    return { start, end };
+}
+/**
+ * Parses a single-range `bytes=start-end` header against a known total (buffer path),
+ * clamping `end` to the last byte. Returns undefined when unsatisfiable (→ 416) or
+ * malformed/multi-range.
+ */
+export function parseRange(rangeHeader, total) {
+    const match = /^bytes=(\d+)-(\d*)$/.exec(rangeHeader.trim());
+    if (!match) {
+        return undefined;
+    }
+    const start = Number(match[1]);
+    if (!Number.isFinite(start) || start >= total) {
+        return undefined; // start past EOF → unsatisfiable
+    }
+    const requestedEnd = match[2] === '' ? total - 1 : Number(match[2]);
+    const end = Math.min(requestedEnd, total - 1);
+    if (end < start) {
+        return undefined;
+    }
+    return { start, end };
+}
+//# sourceMappingURL=mediaRange.js.map

package/dist/rest/mediaRange.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mediaRange.js","sourceRoot":"","sources":["../../src/rest/mediaRange.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAiBH;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CAAC,WAAmB;IACvD,MAAM,KAAK,GAAG,qBAAqB,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC;IAC7D,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5B,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC;QACpB,OAAO,EAAE,KAAK,EAAE,CAAC;IACnB,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,KAAK,EAAE,CAAC;QACzC,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;AACxB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,UAAU,CAAC,WAAmB,EAAE,KAAa;IAC3D,MAAM,KAAK,GAAG,qBAAqB,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC;IAC7D,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,KAAK,EAAE,CAAC;QAC9C,OAAO,SAAS,CAAC,CAAC,iCAAiC;IACrD,CAAC;IACD,MAAM,YAAY,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACpE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;IAC9C,IAAI,GAAG,GAAG,KAAK,EAAE,CAAC;QAChB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;AACxB,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@memberjunction/server",
-  "version": "5.42.0",
+  "version": "5.44.0",
   "description": "MemberJunction: This project provides API access via GraphQL to the common data store.",
   "main": "./dist/index.js",
   "types": "./src/index.ts",
@@ -27,87 +27,88 @@
     "@as-integrations/express5": "^1.0.0",
     "@graphql-tools/schema": "latest",
     "@graphql-tools/utils": "^11.0.0",
-    "@memberjunction/actions": "5.42.0",
-    "@memberjunction/actions-apollo": "5.42.0",
-    "@memberjunction/actions-base": "5.42.0",
-    "@memberjunction/actions-bizapps-accounting": "5.42.0",
-    "@memberjunction/actions-bizapps-crm": "5.42.0",
-    "@memberjunction/actions-bizapps-formbuilders": "5.42.0",
-    "@memberjunction/actions-bizapps-lms": "5.42.0",
-    "@memberjunction/actions-bizapps-social": "5.42.0",
-    "@memberjunction/ai": "5.42.0",
-    "@memberjunction/ai-agent-manager": "5.42.0",
-    "@memberjunction/ai-agent-manager-actions": "5.42.0",
-    "@memberjunction/ai-agents": "5.42.0",
-    "@memberjunction/ai-bridge-server": "5.42.0",
-    "@memberjunction/ai-core-plus": "5.42.0",
-    "@memberjunction/ai-engine-base": "5.42.0",
-    "@memberjunction/ai-mcp-client": "5.42.0",
-    "@memberjunction/ai-prompts": "5.42.0",
-    "@memberjunction/ai-provider-bundle": "5.42.0",
-    "@memberjunction/ai-vector-sync": "5.42.0",
-    "@memberjunction/ai-vectordb": "5.42.0",
-    "@memberjunction/ai-vectors-pinecone": "5.42.0",
-    "@memberjunction/aiengine": "5.42.0",
-    "@memberjunction/api-keys": "5.42.0",
-    "@memberjunction/auth-providers": "5.42.0",
-    "@memberjunction/clustering-engine": "5.42.0",
-    "@memberjunction/codegen-lib": "5.42.0",
-    "@memberjunction/communication-engine": "5.42.0",
-    "@memberjunction/communication-ms-graph": "5.42.0",
-    "@memberjunction/notifications": "5.42.0",
-    "@memberjunction/communication-sendgrid": "5.42.0",
-    "@memberjunction/communication-types": "5.42.0",
-    "@memberjunction/component-registry-client-sdk": "5.42.0",
-    "@memberjunction/computer-use": "5.42.0",
-    "@memberjunction/computer-use-engine": "5.42.0",
-    "@memberjunction/config": "5.42.0",
-    "@memberjunction/core": "5.42.0",
-    "@memberjunction/core-actions": "5.42.0",
-    "@memberjunction/core-entities": "5.42.0",
-    "@memberjunction/core-entities-server": "5.42.0",
-    "@memberjunction/data-context": "5.42.0",
-    "@memberjunction/data-context-server": "5.42.0",
-    "@memberjunction/doc-utils": "5.42.0",
-    "@memberjunction/encryption": "5.42.0",
-    "@memberjunction/entity-communications-base": "5.42.0",
-    "@memberjunction/entity-communications-server": "5.42.0",
-    "@memberjunction/esignature": "5.42.0",
-    "@memberjunction/external-change-detection": "5.42.0",
-    "@memberjunction/generic-database-provider": "5.42.0",
-    "@memberjunction/global": "5.42.0",
-    "@memberjunction/graphql-dataprovider": "5.42.0",
-    "@memberjunction/integration-engine": "5.42.0",
-    "@memberjunction/integration-progress-artifacts": "5.42.0",
-    "@memberjunction/integration-schema-builder": "5.42.0",
-    "@memberjunction/interactive-component-types": "5.42.0",
-    "@memberjunction/lists": "5.42.0",
-    "@memberjunction/lists-base": "5.42.0",
-    "@memberjunction/livekit-room-server": "5.42.0",
-    "@memberjunction/postgresql-dataprovider": "5.42.0",
-    "@memberjunction/queue": "5.42.0",
-    "@memberjunction/redis-provider": "5.42.0",
-    "@memberjunction/remote-browser-base": "5.42.0",
-    "@memberjunction/remote-browser-cdp": "5.42.0",
-    "@memberjunction/remote-browser-selfhost": "5.42.0",
-    "@memberjunction/remote-browser-server": "5.42.0",
-    "@memberjunction/scheduling-actions": "5.42.0",
-    "@memberjunction/scheduling-base-types": "5.42.0",
-    "@memberjunction/scheduling-engine": "5.42.0",
-    "@memberjunction/scheduling-engine-base": "5.42.0",
-    "@memberjunction/schema-engine": "5.42.0",
-    "@memberjunction/search-engine": "5.42.0",
-    "@memberjunction/server-extensions-core": "5.42.0",
-    "@memberjunction/skip-types": "5.42.0",
-    "@memberjunction/sql-dialect": "5.42.0",
-    "@memberjunction/sqlserver-dataprovider": "5.42.0",
-    "@memberjunction/storage": "5.42.0",
-    "@memberjunction/tag-engine": "5.42.0",
-    "@memberjunction/tag-engine-base": "5.42.0",
-    "@memberjunction/templates": "5.42.0",
-    "@memberjunction/testing-engine": "5.42.0",
-    "@memberjunction/testing-engine-base": "5.42.0",
-    "@memberjunction/version-history": "5.42.0",
+    "@memberjunction/actions": "5.44.0",
+    "@memberjunction/actions-apollo": "5.44.0",
+    "@memberjunction/actions-base": "5.44.0",
+    "@memberjunction/actions-bizapps-accounting": "5.44.0",
+    "@memberjunction/actions-bizapps-crm": "5.44.0",
+    "@memberjunction/actions-bizapps-formbuilders": "5.44.0",
+    "@memberjunction/actions-bizapps-lms": "5.44.0",
+    "@memberjunction/actions-bizapps-social": "5.44.0",
+    "@memberjunction/ai": "5.44.0",
+    "@memberjunction/ai-agent-manager": "5.44.0",
+    "@memberjunction/ai-agent-manager-actions": "5.44.0",
+    "@memberjunction/ai-agents": "5.44.0",
+    "@memberjunction/ai-bridge-server": "5.44.0",
+    "@memberjunction/ai-core-plus": "5.44.0",
+    "@memberjunction/ai-engine-base": "5.44.0",
+    "@memberjunction/ai-mcp-client": "5.44.0",
+    "@memberjunction/ai-prompts": "5.44.0",
+    "@memberjunction/ai-provider-bundle": "5.44.0",
+    "@memberjunction/ai-vector-sync": "5.44.0",
+    "@memberjunction/ai-vectordb": "5.44.0",
+    "@memberjunction/ai-vectors-pinecone": "5.44.0",
+    "@memberjunction/aiengine": "5.44.0",
+    "@memberjunction/api-keys": "5.44.0",
+    "@memberjunction/auth-providers": "5.44.0",
+    "@memberjunction/clustering-engine": "5.44.0",
+    "@memberjunction/codegen-lib": "5.44.0",
+    "@memberjunction/communication-engine": "5.44.0",
+    "@memberjunction/communication-ms-graph": "5.44.0",
+    "@memberjunction/notifications": "5.44.0",
+    "@memberjunction/communication-sendgrid": "5.44.0",
+    "@memberjunction/communication-types": "5.44.0",
+    "@memberjunction/component-registry-client-sdk": "5.44.0",
+    "@memberjunction/computer-use": "5.44.0",
+    "@memberjunction/computer-use-engine": "5.44.0",
+    "@memberjunction/config": "5.44.0",
+    "@memberjunction/core": "5.44.0",
+    "@memberjunction/core-actions": "5.44.0",
+    "@memberjunction/core-entities": "5.44.0",
+    "@memberjunction/core-entities-server": "5.44.0",
+    "@memberjunction/data-context": "5.44.0",
+    "@memberjunction/data-context-server": "5.44.0",
+    "@memberjunction/doc-utils": "5.44.0",
+    "@memberjunction/encryption": "5.44.0",
+    "@memberjunction/entity-communications-base": "5.44.0",
+    "@memberjunction/entity-communications-server": "5.44.0",
+    "@memberjunction/esignature": "5.44.0",
+    "@memberjunction/external-change-detection": "5.44.0",
+    "@memberjunction/generic-database-provider": "5.44.0",
+    "@memberjunction/global": "5.44.0",
+    "@memberjunction/graphql-dataprovider": "5.44.0",
+    "@memberjunction/integration-engine": "5.44.0",
+    "@memberjunction/integration-progress-artifacts": "5.44.0",
+    "@memberjunction/integration-schema-builder": "5.44.0",
+    "@memberjunction/interactive-component-types": "5.44.0",
+    "@memberjunction/lists": "5.44.0",
+    "@memberjunction/lists-base": "5.44.0",
+    "@memberjunction/livekit-room-server": "5.44.0",
+    "@memberjunction/postgresql-dataprovider": "5.44.0",
+    "@memberjunction/queue": "5.44.0",
+    "@memberjunction/record-comparison": "5.44.0",
+    "@memberjunction/redis-provider": "5.44.0",
+    "@memberjunction/remote-browser-base": "5.44.0",
+    "@memberjunction/remote-browser-cdp": "5.44.0",
+    "@memberjunction/remote-browser-selfhost": "5.44.0",
+    "@memberjunction/remote-browser-server": "5.44.0",
+    "@memberjunction/scheduling-actions": "5.44.0",
+    "@memberjunction/scheduling-base-types": "5.44.0",
+    "@memberjunction/scheduling-engine": "5.44.0",
+    "@memberjunction/scheduling-engine-base": "5.44.0",
+    "@memberjunction/schema-engine": "5.44.0",
+    "@memberjunction/search-engine": "5.44.0",
+    "@memberjunction/server-extensions-core": "5.44.0",
+    "@memberjunction/skip-types": "5.44.0",
+    "@memberjunction/sql-dialect": "5.44.0",
+    "@memberjunction/sqlserver-dataprovider": "5.44.0",
+    "@memberjunction/storage": "5.44.0",
+    "@memberjunction/tag-engine": "5.44.0",
+    "@memberjunction/tag-engine-base": "5.44.0",
+    "@memberjunction/templates": "5.44.0",
+    "@memberjunction/testing-engine": "5.44.0",
+    "@memberjunction/testing-engine-base": "5.44.0",
+    "@memberjunction/version-history": "5.44.0",
     "@octokit/auth-app": "^7.1.5",
     "@octokit/rest": "^21.1.1",
     "@types/compression": "^1.8.1",

package/src/__tests__/FileResolverPeaks.test.ts

@@ -0,0 +1,64 @@
+import { describe, it, expect } from 'vitest';
+import { deriveSidecarPath, parsePeaksSidecar, MAX_PEAKS } from '../resolvers/peaksSidecar.js';
+
+/**
+ * Tests for the pure `peaks.json` sidecar helpers that back FileResolver.CreateMediaAccessToken's
+ * peaks pass-through. These cover the load-bearing behavior the mutation depends on:
+ *  - deriving the sidecar path that sits in the SAME folder as the recording, and
+ *  - parsing + sanitizing the sidecar so valid peaks come back and garbage / wrong-shape / missing
+ *    payloads gracefully yield `undefined` (the resolver treats that as "omit Peaks, never fail").
+ *
+ * The resolver wires these to a storage driver behind a try/catch; the helpers themselves never
+ * throw, which is what guarantees a sidecar problem can't block token minting.
+ */
+
+describe('deriveSidecarPath', () => {
+  it('replaces the final path segment with peaks.json (recording in a session folder)', () => {
+    expect(deriveSidecarPath('realtime-recordings/sess-1/recording.wav')).toBe('realtime-recordings/sess-1/peaks.json');
+  });
+
+  it('uses a bare peaks.json when the key has no folder', () => {
+    expect(deriveSidecarPath('recording.wav')).toBe('peaks.json');
+  });
+
+  it('returns null when there is no ProviderKey (cannot derive a folder)', () => {
+    expect(deriveSidecarPath(null)).toBeNull();
+    expect(deriveSidecarPath(undefined)).toBeNull();
+    expect(deriveSidecarPath('')).toBeNull();
+  });
+});
+
+describe('parsePeaksSidecar', () => {
+  it('returns sanitized peaks from a valid JSON array (clamped to 0..1)', () => {
+    const bytes = Buffer.from(JSON.stringify([0, 0.5, 1, 1.7, -0.3]), 'utf8');
+    expect(parsePeaksSidecar(bytes)).toEqual([0, 0.5, 1, 1, 0]);
+  });
+
+  it('returns undefined for non-JSON garbage (never throws)', () => {
+    expect(parsePeaksSidecar(Buffer.from('this is not json', 'utf8'))).toBeUndefined();
+  });
+
+  it('returns undefined when the JSON is not an array', () => {
+    expect(parsePeaksSidecar(Buffer.from(JSON.stringify({ not: 'an array' }), 'utf8'))).toBeUndefined();
+  });
+
+  it('returns undefined for an empty array', () => {
+    expect(parsePeaksSidecar(Buffer.from('[]', 'utf8'))).toBeUndefined();
+  });
+
+  it('drops non-finite / non-number entries, keeping the finite numbers', () => {
+    const bytes = Buffer.from(JSON.stringify([0.2, 'x', null, NaN, 0.8]), 'utf8');
+    // NaN serializes to null in JSON; both 'x' and the nulls are dropped, leaving the two numbers.
+    expect(parsePeaksSidecar(bytes)).toEqual([0.2, 0.8]);
+  });
+
+  it('returns undefined when nothing finite survives sanitization', () => {
+    expect(parsePeaksSidecar(Buffer.from(JSON.stringify(['a', 'b', null]), 'utf8'))).toBeUndefined();
+  });
+
+  it('caps the array length at MAX_PEAKS', () => {
+    const huge = new Array(MAX_PEAKS + 500).fill(0.5);
+    const result = parsePeaksSidecar(Buffer.from(JSON.stringify(huge), 'utf8'));
+    expect(result).toHaveLength(MAX_PEAKS);
+  });
+});

package/src/__tests__/MediaAccessKeys.test.ts

@@ -0,0 +1,68 @@
+import { describe, it, expect } from 'vitest';
+import jwt from 'jsonwebtoken';
+import { MediaAccessKeyManager, MEDIA_ACCESS_TOKEN_TYPE } from '../rest/MediaAccessKeys.js';
+
+/**
+ * The manager is a process-wide BaseSingleton whose secret is resolved lazily on first
+ * Sign/Verify. Tests share that single ephemeral secret (no MJ_BASE_ENCRYPTION_KEY in the
+ * test env), which is exactly what production does within one process.
+ */
+describe('MediaAccessKeyManager', () => {
+  it('signs a token that round-trips through Verify with the correct claims', () => {
+    const km = MediaAccessKeyManager.Instance;
+    const { Token, ExpiresAt } = km.Sign('FILE-1', 'USER-1');
+
+    expect(typeof Token).toBe('string');
+    expect(ExpiresAt.getTime()).toBeGreaterThan(Date.now());
+
+    const result = km.Verify(Token);
+    expect(result.Valid).toBe(true);
+    if (result.Valid) {
+      expect(result.Claims.fileId).toBe('FILE-1');
+      expect(result.Claims.userId).toBe('USER-1');
+      expect(result.Claims.typ).toBe(MEDIA_ACCESS_TOKEN_TYPE);
+    }
+  });
+
+  it('honors the requested TTL on ExpiresAt', () => {
+    const km = MediaAccessKeyManager.Instance;
+    const { ExpiresAt } = km.Sign('FILE-2', 'USER-2', 2); // 2 hours
+    const deltaMs = ExpiresAt.getTime() - Date.now();
+    // ~2h, allow a generous window for execution time.
+    expect(deltaMs).toBeGreaterThan(1.9 * 3600 * 1000);
+    expect(deltaMs).toBeLessThan(2.1 * 3600 * 1000);
+  });
+
+  it('rejects a tampered token', () => {
+    const km = MediaAccessKeyManager.Instance;
+    const { Token } = km.Sign('FILE-3', 'USER-3');
+    const tampered = Token.slice(0, -2) + (Token.slice(-2) === 'AA' ? 'BB' : 'AA');
+    expect(km.Verify(tampered).Valid).toBe(false);
+  });
+
+  it('rejects a malformed / empty token', () => {
+    const km = MediaAccessKeyManager.Instance;
+    expect(km.Verify('').Valid).toBe(false);
+    expect(km.Verify('not.a.jwt').Valid).toBe(false);
+  });
+
+  it('rejects an expired token', () => {
+    const km = MediaAccessKeyManager.Instance;
+    // Negative TTL → already expired when minted.
+    const { Token } = km.Sign('FILE-4', 'USER-4', -1);
+    expect(km.Verify(Token).Valid).toBe(false);
+  });
+
+  it('rejects a token with the wrong typ even if validly signed', () => {
+    const km = MediaAccessKeyManager.Instance;
+    // Mint a valid token, then read the real secret out of a known-good token by
+    // re-signing through the manager is not possible; instead assert that a token
+    // whose typ differs is rejected by signing a structurally-valid JWT with a
+    // foreign secret (signature failure also yields false, which is the safe outcome).
+    const foreign = jwt.sign({ fileId: 'FILE-5', userId: 'USER-5', typ: 'something-else' }, 'foreign-secret', {
+      algorithm: 'HS256',
+      expiresIn: 3600,
+    });
+    expect(km.Verify(foreign).Valid).toBe(false);
+  });
+});