@mieweb/pulsevault 0.5.0 → 0.6.0

package/CHANGELOG.md

@@ -7,6 +7,130 @@ breaking changes, called out explicitly below.
 
 ## [Unreleased]
 
+## [0.6.0] - 2026-10-12
+
+Protocol 2.5 (`PROTOCOL.md` §7.4): 2.4 adds the https pairing link form (#83), 2.5 the conform
+step's `webReady` result. `webReady` becomes a **conform** step: whatever video a
+person uploads, PulseVault serves it in the one format the Pulse app records, and a Pulse upload
+is left untouched (#84).
+
+### Added
+
+- **https pairing links** (#83): `buildUploadLink({ …, form: 'https' })`
+  returns `https://mieweb.github.io/pulse/open#v=1&artifactId=…&server=…&token=…`,
+  the same parameters as the `pulsecam://` form, in the fragment. It is a
+  Universal Link / App Link: a phone camera opens it, Pulse opens straight
+  from it when installed, and the page sends the person to the store when it
+  isn't. Browsers never send the fragment, so the link host never receives the
+  token. `PULSE_OPEN_URL` is exported. Without `form` the output is
+  unchanged, `pulsecam://`, because Pulse releases from before the link host
+  was claimed open the https form only through the page's button.
+- **Conform target** (`CONFORM_TARGET`): faststart MP4, H.264 8-bit `yuv420p` (limited range)
+  with even dimensions, SDR (HDR tone-mapped to BT.709; SDR colour tags kept), the longest edge at most `webReady.maxEdge` (default 1920; aspect ratio and
+  orientation kept), rotation applied, AAC or no audio. `ensureWebReady` leaves a file already
+  in it byte-for-byte (`none`), remuxes losslessly when only the container or `moov` position is
+  off, and otherwise runs ffmpeg once, re-encoding only the off-target streams: HEVC and other
+  codecs to H.264, 10-bit HDR (PQ/HLG) tone-mapped to SDR (FFmpeg 8's `scale`, or `zscale` on
+  older builds), full-range video (iPhone screen recordings) to limited range, oversized video
+  scaled down, Opus/PCM and other audio to AAC.
+- **Container change**: a `.mov`, `.m4v`, `.webm`, `.mkv`, `.3gp` or `.avi` becomes a new
+  `<id>.mp4` (`WebReadyAction` `conformed`). The artifact's stored file, `ext` and served
+  `Content-Type` follow it; the artifact id and its URLs don't change. The sidecar switches
+  first, then the original is deleted (`sourceExt` remembers it so `remove` cleans up after a
+  crash). New patch fields `ext` and `webReady` (local adapter; the S3 adapter refuses them).
+  `describeArtifact` reports the uploaded extension as `sourceExt` once it differs, and
+  `uploadIdOf(meta)` names tus's upload by it, so a replayed hook's `ext` and `uploadId` still
+  match `filename`.
+- `webReady.timeoutSeconds` (default `60 + 10 ×` the duration in 1080p30 seconds, so 4K or high
+  frame rates get proportionally longer, at most an hour since it comes from the upload's own
+  metadata; set it explicitly for longer runs): a longer run is killed, the original
+  kept, and `skipped` recorded with the reason.
+- The conversion's result is recorded on the artifact: `GET /artifacts/:id/status` and
+  `getStatus` report `webReady: { action, reason }` (protocol 2.5), and `describeArtifact`
+  returns it.
+- `core.conformAvailable()` (also on `fastify.pulseVaultCore`): `false` when `webReady` is off or
+  ffmpeg/ffprobe are missing, for a host's health check.
+- `createVideoValidator({ maxDurationSeconds? })`: a `validatePayload` hook that checks a video
+  by its content with ffprobe (a video stream with a duration above zero, including a browser
+  WebM without one in its header; a picture — PNG, JPEG, GIF, HEIC, a one-frame clip, counted
+  from the first two packets when the container has no frame count — is not a video), refusing with `422 That file isn't a video.` or `That video is
+  longer than the limit of …` (the configured limit exactly: "1 minute 1 second"); falls back to `sniffVideo` (`ftyp`, EBML or RIFF AVI) without
+  ffprobe. Also exported: `probeVideo`, `webReadyAvailable`, `CONFORM_VIDEO_EXTENSIONS`.
+- An upload over `maxUploadSize` is refused with `413 That file is larger than 500 MB.` instead
+  of tus's "Maximum size exceeded".
+- `webReady.probeTimeoutSeconds` and `createVideoValidator({ probeTimeoutSeconds })` (default 60):
+  every ffprobe run over an upload is bounded; the validator refuses with `422 That video
+  couldn't be checked in time.`
+- Content types for `.webm`, `.mkv`, `.3gp` and `.avi`.
+- While a video is being converted, `GET /artifacts/:id` is served with `max-age=0` instead of
+  the configured `cache` (which may be `immutable`), so no client keeps the original bytes once
+  the converted file replaces them.
+
+### Changed
+
+- The default video `allowedExtensions` are `.mp4`, `.mov`, `.m4v`, `.webm`, `.mkv`, `.3gp` and
+  `.avi` (was `.mp4`). A host's own `allowedExtensions` still overrides them.
+- A failed conversion is now recorded (`webReady: { action: "skipped", reason }`) as well as
+  logged, and still not retried; a conversion that never recorded a result is resumed by the
+  replay, as before.
+- The local adapter's `remove` reads the sidecar itself (not its cache) and deletes the
+  converted `<id>.mp4` and the uploaded file as well as the stored one. A converted video's bytes
+  are always at `<id>.mp4`, and `resolve`/`getLocalPath` fall back to it when the sidecar's `ext`
+  file is gone: across instances sharing a workspace, where the last sidecar write wins (as
+  before; there is no cross-instance lock), a write from a copy older than a conversion still
+  serves the converted file.
+- A client that re-sends the final `PATCH` of a finished upload whose file a conversion replaced
+  (a `.webm` conformed to `<id>.mp4`) gets `204`, as without a conversion: the local adapter's tus
+  store reads such an upload as complete and takes its empty tail without a write.
+- A `webReady` conversion needs the adapter's `generation`: an adapter with `getLocalPath` but no
+  generation has its videos recorded `skipped` (`the storage adapter keeps no generation for this
+  upload`). The local adapter gives one at `markReady` to an upload reserved before this release.
+- Reservations run under the in-process sidecar lock, and `remove` deletes the sidecar last, so a new upload
+  of a removed id never has its bytes deleted by the old removal. Each reservation gets a
+  `generation` (`describeArtifact`), new every time the id is reserved.
+- A conversion is installed in one patch under the sidecar lock: the runner converts into a temporary
+  `.mp4` (`ensureWebReady(…, { install: false })`), then `patchArtifact` with `file` renames it
+  onto the stored file, switches `ext`, records the result and deletes the original — only for
+  the reservation the conversion began on (`generation`) and only while no other pass has
+  recorded one (`unlessConverted`). When a condition doesn't hold, `patchArtifact` resolves
+  `false`, changing nothing, and the runner drops its file.
+- Completion work belongs to one reservation: a queued conversion checks, when its turn comes,
+  that the id still names the upload it was queued for (and that it's finished); the
+  acknowledgement is recorded only on that reservation; and a new upload of a removed id is never
+  joined to the old one's work in progress.
+- `GET /artifacts/:id` opens the file before sending headers, checks it's the file `send`
+  described (inode, size, mtime), and resolves once more when it's gone or another file was
+  renamed onto the path (a conversion just replaced it), instead of a 404, a cut-off response or
+  headers that don't match the bytes; bytes this
+  instance resolved under an extension storage no longer names are served with `max-age=0`.
+- A failed run's recorded reason is `ffmpeg exited with code N`, never ffmpeg's output (which
+  names server paths); an HDR video on an ffmpeg without tone mapping is left as uploaded
+  (`skipped`, saying what's missing) rather than converted with wrong colours.
+- The local adapter's `remove` decides from the sidecar alone, never its cache: an artifact
+  another reader had cached is reported removed once, not twice.
+- `webReady` needs an adapter with `describeArtifact` too (both built-in adapters have it).
+- The local adapter's `getLocalPath` reads the sidecar, not its cache, so it names the current
+  file after another instance removed the id and reserved it again.
+- ffmpeg's capability queries (`-version`, `-h filter=scale`, `-filters`) are bounded (30 s).
+- An `onArtifactEvent` observer that throws on `processed` is logged as its own failure; the
+  recorded result still reaches `completeAfter`'s hook as `ctx.webReady`.
+- A replayed `onUploadComplete` (the hook threw, or the process stopped) gets the recorded
+  conversion result as `ctx.webReady` too, so a host naming the file from it (an `.mp4` once a
+  WebM was conformed) gets it right on the retry.
+- `web-ready-migrate.mjs` rerun after an interruption deletes an original the sidecar no longer
+  names.
+- `scripts/web-ready-migrate.mjs` conforms existing artifacts the same way, recording the result
+  on each sidecar and switching a changed container to its `.mp4`. Run it with the server
+  stopped.
+- `transcode: false` records a file it leaves off-target (HEVC, oversized, non-AAC audio) as
+  `skipped`, not `none`: `none` now means only that the file already conforms. (Was `none`.)
+- A browser WebM's missing duration is found by streaming ffprobe's packet list and keeping
+  only the latest end, never buffering it.
+- An upload of deferred length that grows past `maxUploadSize` (a chunk with a length, or a
+  chunked body cut off mid-stream) gets the same `413 That file is larger than …` message.
+- An MP4-family `.mov`/`.m4v` that already conformed used to be served as is (`video/quicktime`,
+  a type not every browser takes); it is now remuxed into an `.mp4`.
+
 ## [0.5.0] - 2026-10-05
 
 Protocol 2.3 (`PROTOCOL.md` §7.4). What every host rebuilt around PulseVault
@@ -500,7 +624,9 @@ if you've evaluated against an intermediate build.
   lock, so this is now at least surfaced: a one-time `console.warn` fires
   per process the first time a deployment falls into this degraded mode.
 
-[Unreleased]: https://github.com/mieweb/pulsevault/compare/v0.4.2...HEAD
+[Unreleased]: https://github.com/mieweb/pulsevault/compare/v0.6.0...HEAD
+[0.6.0]: https://github.com/mieweb/pulsevault/compare/v0.5.0...v0.6.0
+[0.5.0]: https://github.com/mieweb/pulsevault/compare/v0.4.2...v0.5.0
 [0.4.2]: https://github.com/mieweb/pulsevault/compare/v0.4.1...v0.4.2
 [0.4.1]: https://github.com/mieweb/pulsevault/compare/v0.4.0...v0.4.1
 [0.4.0]: https://github.com/mieweb/pulsevault/compare/v0.3.0...v0.4.0

package/OPERATIONS.md

@@ -54,7 +54,15 @@ Two ways to actually support multiple instances:
 2. **Shared filesystem**: point every instance's `workspaceDir` at the same
    NFS/EFS mount. Verify your mount's durability/consistency guarantees
    under concurrent writes from multiple instances before relying on this in
-   production.
+   production. Each instance changes an artifact's metadata (`.pulsevault/
+   <id>.json`) one write at a time, but no lock spans instances: when two
+   write the same artifact's metadata at once, the last write wins. The
+   completion bookkeeping recovers: the replay redoes a lost acknowledgement
+   or conversion record, and a converted video's bytes are always at
+   `<id>.mp4`, which is served even when the metadata that won still names
+   the uploaded file. A host's `recordOutcome` lost that way is not redone. A
+   removal racing another instance's write to the same artifact can leave its
+   metadata behind; for strict guarantees across instances, use S3.
 
 **The S3/R2 adapter (`createS3Storage`) has no such requirement** — every
 instance talks to the same bucket, so it scales horizontally with zero
@@ -160,56 +168,124 @@ backup time will resume correctly via the normal TUS `HEAD`-then-resume path
 once the client retries, or will sit as abandoned partial uploads until
 `retention` removes them (see "Retention" below) if the client never retries.
 
-## Web-ready playback (faststart remux + H.264 transcode)
-
-Browsers streaming an MP4 over progressive HTTP stall (or fail outright) on
-two things mobile capture pipelines routinely upload:
-
-- **moov atom at the end of the file** — the player must fetch the file's tail
-  before rendering frame one: seconds of startup delay behind Range requests,
-  or a full download in naive players.
-- **HEVC video** — Firefox never decodes it; Chrome usually can't without
-  hardware support.
-
-The `ensureWebReady` helper (exported from the package root) fixes both, in
-place and atomically (tmp file + rename): a lossless sub-second
-`-c copy -movflags +faststart` remux when only the moov position is wrong, and
-a one-time `libx264` transcode (audio stream-copied) when the codec is
-hostile. It is fail-open by design — without `ffmpeg`/`ffprobe` on `PATH` it
-logs one warning and the original bytes keep serving exactly as before.
-
-**Prerequisite:** install ffmpeg on the serving host — `apt install ffmpeg`
-(Debian/Ubuntu), `dnf install ffmpeg` (Fedora/EL + RPM Fusion), or
-`brew install ffmpeg` (macOS). Nothing else changes; the hook detects it at
-first use.
-
-**New uploads** — turn on the `webReady` option (the fastify-demo and the
-meteor-demo ship with it enabled). The core runs the conversion in the
-background after the final `PATCH` is answered, one video at a time by
-default, and reports the artifact as `processing` on the status route
-meanwhile:
+## Web-ready playback (conform to one format)
+
+Videos reach PulseVault from the Pulse app, which already uploads the format
+below, and from a host's own file picker: a screen recording, an iPhone HEVC
+`.mov` (often 10-bit HDR), a WebM from a browser recorder, a 4K clip. Browsers
+streaming over progressive HTTP stall on a `moov` atom at the end of the file,
+Firefox never decodes HEVC, Chrome usually can't without hardware support,
+10-bit HDR shown as SDR looks washed out, and a 4K file is far more than a
+phone needs.
+
+With the `webReady` option on, every finished video is **conformed** to one
+target (`CONFORM_TARGET`, exported from the package root):
+
+| Property | Target |
+|---|---|
+| Container | MP4, `moov` at the front (faststart) |
+| Video | H.264, 8-bit `yuv420p` (limited range), even width and height |
+| Colour | SDR: HDR (PQ or HLG) is tone-mapped to BT.709; an SDR source keeps its own colour tags (BT.709 or BT.601), which browsers honour |
+| Size | longest edge at most 1920 (`maxEdge`); aspect ratio and orientation kept — no crop, pad or stretch |
+| Rotation | applied to the pixels, so every player shows it the way it was held |
+| Audio | AAC; a video with no audio stays silent |
+
+`ensureWebReady` does the least work that gets a file there:
+
+| The upload | What happens | `action` |
+|---|---|---|
+| Already in the target (a Pulse upload) | nothing; bytes untouched | `none` |
+| MP4 with the `moov` at the end | lossless `-c copy` faststart remux | `remuxed` |
+| MP4 with an off-target stream | one ffmpeg run, in place | `transcoded` |
+| Another container (`.mov`, `.m4v`, `.webm`, `.mkv`, `.3gp`, `.avi`) | one ffmpeg run into a new `<id>.mp4`: a stream copy when the streams already conform, otherwise only the off-target streams re-encoded | `conformed` |
+| No ffmpeg, unreadable, failed or timed out | nothing; the original serves | `skipped` |
+
+A re-encode scales by the longest edge, applies the rotation, tone-maps HDR
+(PQ or HLG) to SDR, and converts non-AAC audio (Opus, PCM, …) to AAC. After a
+container change the artifact's stored file, extension and served
+`Content-Type` (`video/mp4`) follow the new file; the artifact id, and so every
+URL a host stored, stay the same. The new file is written beside the original,
+the artifact's sidecar switches to it, and only then is the original deleted:
+a crash at any point leaves either the original serving (the conversion is
+redone by the replay) or an unused original that is deleted with the
+artifact.
+
+While a video is being converted, its URL serves the original bytes with
+`max-age=0` instead of the configured `cache`, so a browser that fetched it
+early revalidates and gets the converted file (with a new ETag) afterwards.
+
+A failed run is recorded as `conversion failed: ffmpeg exited with code N`;
+ffmpeg's own output, which names server paths, goes only to the server log.
+
+The result is recorded on the artifact: the status route reports it as
+`webReady: { action, reason }` (a host can say "Your video is ready", or "We
+couldn't convert this video, so it may not play in every browser"),
+`onArtifactEvent` fires `processed` with it, and `completeAfter` hands it to
+`onUploadComplete` as `ctx.webReady`.
+
+**Prerequisite:** install ffmpeg (which includes ffprobe) on the serving host
+— `apt install ffmpeg` (Debian/Ubuntu), `dnf install ffmpeg` (Fedora/EL + RPM
+Fusion), or `brew install ffmpeg` (macOS). It is detected at first use; without
+it every upload is still accepted and served exactly as uploaded, one warning
+is logged, and `core.conformAvailable()` (also `fastify.pulseVaultCore`)
+resolves `false` for a health check. HDR tone mapping uses the `scale` filter
+on FFmpeg 8 and later, or `zscale` (libzimg, included in the Debian and Ubuntu
+packages) on older builds. A build with neither leaves an HDR video as
+uploaded and records `skipped` with what's missing: converting it without tone
+mapping would give wrong colours.
 
 ```js
 await app.register(pulseVault, {
   storage: createLocalStorage({ workspaceDir: dataDir }),
+  validatePayload: createVideoValidator({ maxDurationSeconds: 600 }),
   webReady: { concurrency: 1, completeAfter: true },
 });
 ```
 
-Options: `{ transcode: false }` restricts it to the lossless remux (no CPU
-cost beyond a file rewrite); `crf`/`preset` tune the transcode
-(defaults `23`/`veryfast`); `ffmpegPath`/`ffprobePath` point at binaries off
-`PATH`; `concurrency` runs several at once; `completeAfter: true` holds
-`onUploadComplete` until the conversion has finished, for a host that
-publishes the video from the hook. `onArtifactEvent` fires `processed` with
-what was done. A conversion a restart interrupted is resumed by the
-completion replay (`replayCompletions`). Calling `ensureWebReady` yourself
-from `onUploadComplete` still works, but holds the client's final `PATCH`
-for the whole conversion.
-
-**Existing artifacts** — uploads that landed before the hook existed are fixed
-once with the bundled migration script (idempotent; interrupt and rerun
-freely, already-fixed files are skipped for free):
+Settings:
+
+- `concurrency` (default `1`): conversions run one at a time per process; the
+  rest wait in a queue. A conversion a restart interrupted is resumed by the
+  completion replay (`replayCompletions`): an artifact isn't marked converted
+  until its result is recorded.
+- `timeoutSeconds` (default `60 + 10 ×` the video's duration counted in
+  1080p30 seconds — a second of 4K at 120 fps counts 16 — at most an hour,
+  and an hour when the duration is unknown; the default comes from the
+  upload's own metadata, so set this for longer runs): a run past it is
+  killed, the original kept, and
+  `skipped` recorded with the reason.
+- `probeTimeoutSeconds` (default `60`): the same guard for each ffprobe run
+  over the upload, so a malformed file can't hold the queue.
+- `maxEdge` (default `1920`): the longest edge of the served video.
+- `transcode: false`: never re-encode; only lossless remuxes run (a `moov`
+  moved to the front, or another container whose streams already conform copied
+  into an `.mp4`), so no CPU cost beyond a file rewrite. A file that would need
+  a re-encode is left as uploaded and recorded as `skipped` (`none` means only
+  "already conforms").
+- `crf`/`preset` (defaults `23`/`veryfast`) tune the H.264 encode;
+  `ffmpegPath`/`ffprobePath` point at binaries off `PATH`.
+
+**Accepted containers.** The default video `allowedExtensions` are `.mp4`,
+`.mov`, `.m4v`, `.webm`, `.mkv`, `.3gp` and `.avi` (`CONFORM_VIDEO_EXTENSIONS`);
+a host's own `allowedExtensions` still overrides them. The extension only
+decides what's accepted at `create`; `createVideoValidator()` checks the
+received bytes by what they are: ffprobe must find a video stream with a
+duration above zero that isn't a picture (a PNG, JPEG, GIF, HEIC photo or
+one-frame clip is refused), and, with `maxDurationSeconds`, not longer, or the
+upload is refused with `422 That file isn't a video.` / `That video is longer
+than the limit of 10 minutes.` Each ffprobe run is bounded by
+`probeTimeoutSeconds` (default `60`), so a malformed file can't hold the final
+`PATCH` open: past it the upload is refused with `422 That video couldn't be
+checked in time.` Without ffprobe it falls back to sniffing the
+container's first bytes (`ftyp`, EBML or RIFF AVI). An upload over
+`maxUploadSize` is refused at `create` with `413 That file is larger than
+500 MB.` Without `webReady`, a WebM or MKV is served as uploaded, with its own
+content type.
+
+**Existing artifacts** — uploads that landed before `webReady` was on are
+conformed once with the bundled migration script. Stop the server while it
+runs (the server caches each artifact's extension, which a container change
+rewrites). It is idempotent; interrupt and rerun freely:
 
 ```sh
 node node_modules/@mieweb/pulsevault/scripts/web-ready-migrate.mjs /path/to/workspaceDir
@@ -219,11 +295,12 @@ node node_modules/@mieweb/pulsevault/scripts/web-ready-migrate.mjs /path/to/work
 node node_modules/@mieweb/pulsevault/scripts/web-ready-migrate.mjs /path/to/workspaceDir --no-transcode
 ```
 
-A transcode re-encodes the video stream (one-time, quality-preserving at the
-default CRF but not bit-identical). Take a backup first if that matters to
+A re-encode is one-time, quality-preserving at the default CRF but not
+bit-identical, and a conformed file replaces the upload (the original is not
+kept). Take a backup first if that matters to
 your deployment (see "Backup and restore" above).
 
-Note on checksums: a remux or transcode changes the artifact's bytes, so an
+Note on checksums: a conversion changes the artifact's bytes, so an
 upload-time checksum recorded for it (the sidecar `checksum` from
 `Upload-Metadata`) describes the original upload, not the rewritten file.
 Treat `getChecksum` as upload-time provenance rather than current-file

package/PROTOCOL.md

@@ -3,7 +3,7 @@
 <!-- BEGIN GENERATED: protocol-version (from package.json pulseProtocol — edit that, then run `npm run protocol`) -->
 | | |
 |---|---|
-| Spec revision | `2.3` |
+| Spec revision | `2.5` |
 | Protocol majors accepted | 2 |
 <!-- END GENERATED: protocol-version -->
 
@@ -69,12 +69,30 @@ the integer from `protocolVersion`.
 
 ## 3. Pairing (deep link)
 
-A server presents a pairing link or QR code of the form:
+A server presents a pairing link or QR code in one of two equivalent forms
+(since 2.4), carrying the same parameters:
 
 ```
 pulsecam://?v=1&artifactId=<uuid>&server=<origin>&token=<opaque>
+https://mieweb.github.io/pulse/open#v=1&artifactId=<uuid>&server=<origin>&token=<opaque>
 ```
 
+- **`pulsecam://`**: the parameters are the query string. Every Pulse release
+  opens it, but phone cameras and browsers don't open custom schemes reliably.
+- **`https://`**: a Universal Link (iOS) / App Link (Android) on the link host
+  the Pulse app claims. When Pulse is installed the OS opens it straight from
+  the link; when it isn't, the link opens a static page that sends the person
+  to the store and offers a `pulsecam://` fallback. The parameters are the
+  **fragment**, which is never sent in an HTTP request, so the link host never
+  receives the token. The link host is fixed (an app can only claim domains it
+  was built with); `server` still points at the deployment's own server, so
+  uploads never touch the link host.
+
+A client that accepts the `https://` form MUST treat it exactly like the
+`pulsecam://` form with the same parameters. A server that wants every Pulse
+release to open its links directly keeps the `pulsecam://` form until the
+releases that claim the link host are installed.
+
 - `v` (REQUIRED): the deep-link schema version. A client MUST refuse and
   explain (not silently misparse) a `v` it doesn't recognize.
 - `artifactId` (REQUIRED): a UUID minted by the server. The client uses this
@@ -95,7 +113,7 @@ pulsecam://?v=1&artifactId=<uuid>&server=<origin>&token=<opaque>
   credential — see §5.4 for the recommended (but not required) capability-
   token shape.
 
-A client SHOULD ignore query params it does not recognize, so links minted by
+A client SHOULD ignore parameters it does not recognize, so links minted by
 an older or newer server stay valid. The parameters are defined by
 [`protocol/schemas/deep-link.schema.json`](protocol/schemas/deep-link.schema.json).
 
@@ -334,7 +352,9 @@ body is defined by
 `state` is `unknown`, `uploading`, `processing` (the server is converting the
 bytes for the web) or `ready`, with the bytes received against the declared
 length while uploading, and whatever outcome the host recorded once finished.
-The response MUST NOT be cached.
+A server that converts videos for the web also reports what the conversion did
+(`webReady`, protocol 2.5): nothing, a remux, a transcode, a new container, or
+why it was skipped (the original then serves). The response MUST NOT be cached.
 
 A server MAY also expose `GET {prefix}/artifacts/<videoId>/poster`: the finished
 thumbnail `relatedTo` the video (§8), served exactly as §6.2 serves an artifact
@@ -410,7 +430,7 @@ a server it paired with earlier: a server can be upgraded in between.
 | [`beat-manifest.schema.json`](protocol/schemas/beat-manifest.schema.json) | Beat manifest |
 | [`capabilities.schema.json`](protocol/schemas/capabilities.schema.json) | GET /capabilities response |
 | [`capability-token.schema.json`](protocol/schemas/capability-token.schema.json) | Capability token claims |
-| [`deep-link.schema.json`](protocol/schemas/deep-link.schema.json) | Pairing link query parameters |
+| [`deep-link.schema.json`](protocol/schemas/deep-link.schema.json) | Pairing link parameters |
 | [`pulse-client.schema.json`](protocol/schemas/pulse-client.schema.json) | Pulse-Client request header |
 | [`upload-metadata.schema.json`](protocol/schemas/upload-metadata.schema.json) | TUS Upload-Metadata keys |
 | [`view-link.schema.json`](protocol/schemas/view-link.schema.json) | POST /artifacts/<id>/view-link response |
@@ -425,6 +445,8 @@ a server it paired with earlier: a server can be upgraded in between.
 | 2.1 | Added `protocolRevision` to `/capabilities`, the `Pulse-Client` header with `426 Upgrade Required` (§7.2), and `Upload-Metadata.appVersion` (§4.1). |
 | 2.2 | Added read-only view links: `viewLinks` in `/capabilities`, `POST {prefix}/artifacts/<id>/view-link` (§6.4), and the view token's `use` claim (§5.5). |
 | 2.3 | Added `GET {prefix}/artifacts/<id>/status` and `GET {prefix}/artifacts/<id>/poster` (§6.5), the capability token's `ctx` claim (§5.4), and the pulse-shape rule for creates (§5.4). |
+| 2.4 | Added the `https://mieweb.github.io/pulse/open#…` pairing link form (§3), with the parameters in the fragment. |
+| 2.5 | Added `webReady` to the status response (§6.5): what the server's conversion did. |
 
 ## 8. Artifact relationships (`relatedTo`)
 

package/README.md

@@ -269,7 +269,7 @@ type PulseVaultPluginOptions = {
   lockWhenReady?: boolean;                              // default false: a finished pulse can't be deleted through the routes
   webReady?: PulseVaultWebReadyOptions | boolean;       // default off: background faststart remux / H.264 transcode
   replayCompletions?: { intervalSeconds?: number } | false; // default every 300 s: re-fire unacknowledged completions
-  coreDecoratorName?: string;                           // default "pulseVaultCore": getStatus, getPulse, recordOutcome, replayCompletions
+  coreDecoratorName?: string;                           // default "pulseVaultCore": getStatus, getPulse, recordOutcome, replayCompletions, conformAvailable
   /** @deprecated use validatePayload + ctx.kind === "project" */
   validateProjectPayload?: PulseVaultValidatePayload;
   /** @deprecated use onUploadComplete + ctx.kind === "project" */
@@ -306,8 +306,9 @@ import "@mieweb/pulsevault/augment";
 File extensions accepted per artifact kind. Three accepted forms:
 
 ```ts
-// 1. Omit entirely — uses all three defaults:
-//    video: [".mp4"]   project: [".pulse", ".zip"]   captions: [".vtt"]
+// 1. Omit entirely — uses the defaults:
+//    video: [".mp4", ".mov", ".m4v", ".webm", ".mkv", ".3gp", ".avi"]   project: [".pulse", ".zip"]
+//    captions: [".vtt"]   thumbnail: [".jpg", ".jpeg", ".png"]
 
 // 2. Flat array (legacy) — video-only; project/captions keep their defaults:
 allowedExtensions: [".mp4"]
@@ -316,7 +317,7 @@ allowedExtensions: [".mp4"]
 allowedExtensions: { video: [".mp4"], project: [".pulse"], captions: [".vtt"] }
 ```
 
-All extensions must include the leading dot and are matched case-insensitively. The `kind` field in `Upload-Metadata` determines which list is checked.
+All extensions must include the leading dot and are matched case-insensitively. The `kind` field in `Upload-Metadata` determines which list is checked. The default video list is the containers [`webReady`](#webready) conforms to MP4 (`CONFORM_VIDEO_EXTENSIONS`); the extension only decides what's accepted at `create`, so pair it with `createVideoValidator()` to check the bytes themselves.
 
 ### `cache`
 
@@ -416,6 +417,8 @@ await app.register(pulseVault, {
 });
 ```
 
+For videos from anywhere (a WebM from a browser recorder, an MKV, an AVI), check them by what they are with **`createVideoValidator({ maxDurationSeconds?, probeTimeoutSeconds? })`**: ffprobe must find a video stream with a duration above zero that isn't a picture (PNG, JPEG, GIF, HEIC, a one-frame clip), or the upload is refused with `422` and a message a host can show as it is (`That file isn't a video.`, `That video is longer than the limit of 10 minutes.`, or `That video couldn't be checked in time.` when ffprobe runs past `probeTimeoutSeconds`, default 60). It checks `kind: "video"` only and lets other kinds through; without ffprobe it falls back to `sniffVideo(path)` (the container's first bytes: `ftyp`, EBML or RIFF AVI) and logs once. Local storage only.
+
 `createMp4Sniffer` reads the first 12 bytes and verifies the ISOBMFF `ftyp` header (MP4, MOV, M4V, 3GP). Uploads that pass the extension check but contain non-video bytes are rejected with 422 and the disk is cleaned up. The lower-level `sniffMp4(path)` is also exported if you want to drive your own validator.
 
 `createChecksumValidator`/`createS3ChecksumValidator` parse `ctx.checksum` with the also-exported `parseChecksumMetadata(raw)`, which returns `{ algorithm, digest }` or `null` for a missing/malformed value — use it directly if you're writing your own checksum check instead of the ship-ready validators.
@@ -542,11 +545,14 @@ Off by default. `true`, or `ensureWebReady`'s options plus:
 webReady: {
   concurrency: 1,        // conversions at once; a transcode is CPU-bound
   completeAfter: false,  // true: run onUploadComplete only once the conversion has finished
+  maxEdge: 1920,         // longest edge of the served video
+  timeoutSeconds: undefined, // default 60 + 10 × duration in 1080p30 seconds (4K120 counts 16×), at most 1 h: a hang guard
+  probeTimeoutSeconds: 60,   // the same guard for each ffprobe run over the upload
   transcode: true, crf: 23, preset: "veryfast", ffmpegPath: "ffmpeg", ffprobePath: "ffprobe",
 },
 ```
 
-Every finished video is made web-playable in the background, after the final `PATCH` is answered: a lossless faststart remux when the `moov` atom is at the end, or a one-time H.264 transcode when the codec is one browsers can't play (see `OPERATIONS.md`). While it runs the artifact's status is `processing` (the original bytes serve meanwhile; the rewrite is atomic), and when it's done `onArtifactEvent` fires `processed` with what it did. With `completeAfter: true`, `onUploadComplete` waits for the conversion and receives `ctx.webReady`, so a host that publishes from the hook never publishes a video that's still being rewritten. A conversion a restart interrupted is resumed by the replay below. Needs the local storage adapter and ffmpeg on the host; without ffmpeg it logs once and serves the original bytes.
+Every finished video is conformed in the background, after the final `PATCH` is answered, to the one format the Pulse app records (`CONFORM_TARGET`: faststart MP4, H.264 8-bit SDR, longest edge at most `maxEdge`, rotation applied, AAC or silent; orientation kept). A file already in it — every Pulse upload — keeps its bytes (`none`); a `moov` at the end is a lossless remux (`remuxed`); an off-target stream is re-encoded (`transcoded`: HEVC, 10-bit HDR tone-mapped to SDR, 4K scaled, Opus/PCM to AAC); another container (`.mov`, `.webm`, `.mkv`, …) becomes a new `.mp4` served as `video/mp4` at the same artifact URL (`conformed`). See `OPERATIONS.md` for the table. While it runs the artifact's status is `processing` (the original bytes serve meanwhile, revalidated on every request instead of the configured `cache`; every rewrite is atomic), and when it's done the status reports `webReady: { action, reason }` — `skipped` with the reason when ffmpeg is missing, a run failed or timed out, and the original keeps serving — and `onArtifactEvent` fires `processed` with the same result. With `completeAfter: true`, `onUploadComplete` waits for the conversion and receives `ctx.webReady`, so a host that publishes from the hook never publishes a video that's still being rewritten. A conversion a restart interrupted is resumed by the replay below. Needs the local storage adapter and ffmpeg on the host; without ffmpeg it logs once and serves the original bytes.
 
 ### `replayCompletions`
 
@@ -560,12 +566,15 @@ The core behind the routes is `fastify.pulseVaultCore` (rename it with `coreDeco
 // Where an upload is — what GET /artifacts/:id/status reports — for a host that polls server-side.
 await app.pulseVaultCore.getStatus(videoId);
 // → { artifactId, state: "unknown" | "uploading" | "processing" | "ready", kind, relatedTo?, name?,
-//     bytesReceived?, size?, acknowledged, outcome?, context? }
+//     bytesReceived?, size?, acknowledged, webReady?: { action, reason }, outcome?, context? }
 // `context` (the token's) is for the host — an owner check is a comparison on it; the route leaves it out.
 
 // Where it went, or why it didn't: any JSON, reported as `outcome` by the status route. `null` clears it.
 await app.pulseVaultCore.recordOutcome(videoId, { state: "done", note: "Posted to Huddle" });
 
+// Whether videos are conformed here (`webReady` on, ffmpeg and ffprobe installed) — for a health check.
+await app.pulseVaultCore.conformAvailable();
+
 // A video and the finished files relatedTo it, by kind — from the adapters' relation index, never a scan.
 const { video, thumbnail, captions, manifest } = await app.pulseVaultCore.getPulse(videoId);
 // One per kind; when a file was re-sent, the one that finished last (`readyAt`) wins.
@@ -598,7 +607,7 @@ When the final PATCH lands the plugin runs the following steps in order, for eve
   "minSupportedVersion": 2,
   "maxSupportedVersion": 2,
   "kinds": ["video", "project", "captions", "thumbnail"],
-  "allowedExtensions": { "video": [".mp4"], "project": [".pulse", ".zip"], "captions": [".vtt"], "thumbnail": [".jpg", ".jpeg", ".png"] },
+  "allowedExtensions": { "video": [".mp4", ".mov", ".m4v", ".webm", ".mkv", ".3gp", ".avi"], "project": [".pulse", ".zip"], "captions": [".vtt"], "thumbnail": [".jpg", ".jpeg", ".png"] },
   "maxUploadSize": 5368709120,
   "checksum": { "algorithms": ["sha256", "sha1", "md5"] }
 }
@@ -937,7 +946,7 @@ const storage: PulseVaultStorage = {
 
 ## Deep link helper
 
-Use this to generate a `pulsecam://` deep link for pairing the Pulse mobile app with your server. Typically encoded as a QR code on a pairing page.
+Use this to generate a pairing link for the Pulse mobile app and your server. Typically encoded as a QR code on a pairing page.
 
 ```ts
 import { buildUploadLink } from "@mieweb/pulsevault";
@@ -952,8 +961,19 @@ const uploadLink = buildUploadLink({
   token: "secret", // optional — forwarded to your authorize hook; see Capability tokens
 });
 // pulsecam://?v=1&artifactId=...&server=https%3A%2F%2Fexample.com%2Fpulsevault&token=secret
+
+// The https form, a Universal Link / App Link (PROTOCOL.md §3):
+const httpsLink = buildUploadLink({
+  server: "https://example.com/pulsevault",
+  artifactId: randomUUID(),
+  token: "secret",
+  form: "https",
+});
+// https://mieweb.github.io/pulse/open#v=1&artifactId=...&server=https%3A%2F%2Fexample.com%2Fpulsevault&token=secret
 ```
 
+The `https` form is what a phone camera opens: Pulse opens straight from it when installed, and its page sends the person to the store when not. The parameters are after `#`, which browsers never send, so the link host never sees the token. Pulse releases from before the link host was claimed land on the page instead and open Pulse from its button, so `pulsecam://` stays the default.
+
 ## Pulse logo and store badges
 
 The package ships the Pulse logo for the button that opens Pulse

package/dist/app.d.ts

@@ -157,7 +157,7 @@ export type PulseVaultPluginOptions = {
     replayCompletions?: PulseVaultReplayOptions | false;
     /**
      * Name of the decorator that exposes the core (`fastify.<name>.getStatus`, `.getPulse`,
-     * `.recordOutcome`, `.replayCompletions`). Defaults to `"pulseVaultCore"`.
+     * `.recordOutcome`, `.replayCompletions`, `.conformAvailable`). Defaults to `"pulseVaultCore"`.
      */
     coreDecoratorName?: string;
     /**
@@ -180,17 +180,18 @@ export type PulseVaultPluginOptions = {
 declare const _default: FastifyPluginAsync<PulseVaultPluginOptions>;
 export default _default;
 export { createLocalStorage } from './storage/local.js';
+export { uploadIdOf } from './storage/types.js';
 export type { LocalStorage, LocalStorageOptions } from './storage/local.js';
 export { createS3Storage } from './storage/s3.js';
 export type { S3Storage, S3StorageOptions } from './storage/s3.js';
 export type { PulseVaultArtifactRecord, PulseVaultResolution, PulseVaultStorage, ReserveUploadParams, UploadKind, } from './storage/types.js';
 export type { PulseVaultAuthorize, PulseVaultAuthorizeContext, PulseVaultAuthorizePhase, } from './routes/pulsevault.js';
 export type { PulseVaultOnUploadComplete, PulseVaultOnArtifactEvent, PulseVaultArtifactEvent, } from './lib/pulsevaultTus.js';
-export { sniffMp4, createMp4Sniffer, createS3Mp4Sniffer } from './lib/magic.js';
-export type { PulseVaultValidatePayload } from './lib/magic.js';
-export { ensureWebReady, scanMoovPosition } from './lib/web-ready.js';
-export type { WebReadyAction, WebReadyOptions, WebReadyResult, MoovPosition } from './lib/web-ready.js';
-export { buildUploadLink } from './lib/deeplinks.js';
+export { sniffMp4, createMp4Sniffer, createS3Mp4Sniffer, sniffVideo, createVideoValidator } from './lib/magic.js';
+export type { PulseVaultValidatePayload, VideoValidatorOptions } from './lib/magic.js';
+export { ensureWebReady, scanMoovPosition, probeVideo, webReadyAvailable, CONFORM_TARGET, CONFORM_VIDEO_EXTENSIONS, } from './lib/web-ready.js';
+export type { WebReadyAction, WebReadyOptions, WebReadyResult, MoovPosition, VideoProbe } from './lib/web-ready.js';
+export { buildUploadLink, PULSE_OPEN_URL } from './lib/deeplinks.js';
 export type { UploadLinkOptions } from './lib/deeplinks.js';
 export { issueCapabilityToken, verifyCapabilityToken, issueViewToken, verifyViewToken, createCapabilityAuthorize, } from './lib/capability-token.js';
 export type { CapabilityTokenClaims, IssueCapabilityTokenOptions, IssueViewTokenOptions, VerifyCapabilityTokenOptions, LookupSecret, } from './lib/capability-token.js';

package/dist/app.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"app.d.ts","sourceRoot":"","sources":["../src/app.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,SAAS,CAAC;AAElD,OAAyB,EAAE,KAAK,mBAAmB,EAAuB,MAAM,wBAAwB,CAAC;AACzG,OAAO,KAAK,EAAE,0BAA0B,EAAE,yBAAyB,EAAE,MAAM,wBAAwB,CAAC;AACpG,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,gBAAgB,CAAC;AAChE,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,qBAAqB,CAAC;AACnE,OAAO,KAAK,EAAE,uBAAuB,EAAE,yBAAyB,EAAE,MAAM,qBAAqB,CAAC;AAC9F,OAAO,EACL,KAAK,0BAA0B,EAGhC,MAAM,oBAAoB,CAAC;AAC5B,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAC5D,OAAO,EASL,KAAK,gCAAgC,EACtC,MAAM,kBAAkB,CAAC;AAE1B;;;;;GAKG;AACH,MAAM,MAAM,sBAAsB,GAAG;IACnC,sEAAsE;IACtE,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACzB;;;OAGG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAAG;IACpC,wFAAwF;IACxF,OAAO,EAAE,iBAAiB,CAAC;IAC3B;;;;;;OAMG;IACH,MAAM,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,aAAa,EAAE,MAAM,CAAC;IACtB;;;;;;;;;;;OAWG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;;;;;;OAUG;IACH,iBAAiB,CAAC,EAAE,gCAAgC,CAAC;IACrD;;;;OAIG;IACH,KAAK,CAAC,EAAE,sBAAsB,CAAC;IAC/B;;;;;;;;;;;;;;;;;;OAkBG;IACH,SAAS,CAAC,EAAE,mBAAmB,CAAC;IAChC;;;;;;;;;;;OAWG;IACH,eAAe,CAAC,EAAE,yBAAyB,CAAC;IAC5C;;;;;;;;OAQG;IACH,gBAAgB,CAAC,EAAE,0BAA0B,CAAC;IAC9C;;;;;OAKG;IACH,eAAe,CAAC,EAAE,yBAAyB,CAAC;IAC5C;;;;;;;OAOG;IACH,aAAa,CAAC,EAAE,uBAAuB,CAAC;IACxC;;;;;;;;OAQG;IACH,SAAS,CAAC,EAAE,0BAA0B,CAAC;IACvC,6GAA6G;IAC7G,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,gJAAgJ;IAChJ,OAAO,CAAC,EAAE;QAAE,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,KAAK,CAAC;IAC3C,uGAAuG;IACvG,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,kGAAkG;IAClG,QAAQ,CAAC,EAAE,yBAAyB,GAAG,OAAO,CAAC;IAC/C,kHAAkH;IAClH,iBAAiB,CAAC,EAAE,uBAAuB,GAAG,KAAK,CAAC;IACpD;;;OAGG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B;;;;;;OAMG;IACH,sBAAsB,CAAC,EAAE,yBAAyB,CAAC;IACnD;;;;;;OAMG;IACH,uBAAuB,CAAC,EAAE,0BAA0B,CAAC;CACtD,CAAC;;AAmEF,wBAGG;AAEH,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACxD,YAAY,EAAE,YAAY,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAC5E,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAClD,YAAY,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnE,YAAY,EACV,wBAAwB,EACxB,oBAAoB,EACpB,iBAAiB,EACjB,mBAAmB,EACnB,UAAU,GACX,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EACV,mBAAmB,EACnB,0BAA0B,EAC1B,wBAAwB,GACzB,MAAM,wBAAwB,CAAC;AAChC,YAAY,EACV,0BAA0B,EAC1B,yBAAyB,EACzB,uBAAuB,GACxB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAChF,YAAY,EAAE,yBAAyB,EAAE,MAAM,gBAAgB,CAAC;AAChE,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACtE,YAAY,EAAE,cAAc,EAAE,eAAe,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACxG,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,YAAY,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAC5D,OAAO,EACL,oBAAoB,EACpB,qBAAqB,EACrB,cAAc,EACd,eAAe,EACf,yBAAyB,GAC1B,MAAM,2BAA2B,CAAC;AACnC,YAAY,EACV,qBAAqB,EACrB,2BAA2B,EAC3B,qBAAqB,EACrB,4BAA4B,EAC5B,YAAY,GACb,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAC3D,YAAY,EAAE,0BAA0B,EAAE,MAAM,oBAAoB,CAAC;AACrE,YAAY,EACV,uBAAuB,EACvB,kBAAkB,EAClB,yBAAyB,EACzB,qBAAqB,GACtB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,uBAAuB,EACvB,yBAAyB,EACzB,qBAAqB,GACtB,MAAM,mBAAmB,CAAC;AAC3B,YAAY,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAC3E,YAAY,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAC5E,YAAY,EACV,cAAc,EACd,wBAAwB,EACxB,eAAe,GAChB,MAAM,WAAW,CAAC;AACnB,YAAY,EACV,sBAAsB,EACtB,uBAAuB,GACxB,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EAAE,yBAAyB,EAAE,MAAM,oBAAoB,CAAC;AACpE,YAAY,EAAE,+BAA+B,EAAE,MAAM,wBAAwB,CAAC;AAC9E,YAAY,EAAE,yBAAyB,EAAE,uBAAuB,EAAE,MAAM,qBAAqB,CAAC;AAC9F,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC"}
+{"version":3,"file":"app.d.ts","sourceRoot":"","sources":["../src/app.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,SAAS,CAAC;AAElD,OAAyB,EAAE,KAAK,mBAAmB,EAAuB,MAAM,wBAAwB,CAAC;AACzG,OAAO,KAAK,EAAE,0BAA0B,EAAE,yBAAyB,EAAE,MAAM,wBAAwB,CAAC;AACpG,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,gBAAgB,CAAC;AAChE,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,qBAAqB,CAAC;AACnE,OAAO,KAAK,EAAE,uBAAuB,EAAE,yBAAyB,EAAE,MAAM,qBAAqB,CAAC;AAC9F,OAAO,EACL,KAAK,0BAA0B,EAGhC,MAAM,oBAAoB,CAAC;AAC5B,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAC5D,OAAO,EASL,KAAK,gCAAgC,EACtC,MAAM,kBAAkB,CAAC;AAE1B;;;;;GAKG;AACH,MAAM,MAAM,sBAAsB,GAAG;IACnC,sEAAsE;IACtE,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACzB;;;OAGG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAAG;IACpC,wFAAwF;IACxF,OAAO,EAAE,iBAAiB,CAAC;IAC3B;;;;;;OAMG;IACH,MAAM,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,aAAa,EAAE,MAAM,CAAC;IACtB;;;;;;;;;;;OAWG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;;;;;;OAUG;IACH,iBAAiB,CAAC,EAAE,gCAAgC,CAAC;IACrD;;;;OAIG;IACH,KAAK,CAAC,EAAE,sBAAsB,CAAC;IAC/B;;;;;;;;;;;;;;;;;;OAkBG;IACH,SAAS,CAAC,EAAE,mBAAmB,CAAC;IAChC;;;;;;;;;;;OAWG;IACH,eAAe,CAAC,EAAE,yBAAyB,CAAC;IAC5C;;;;;;;;OAQG;IACH,gBAAgB,CAAC,EAAE,0BAA0B,CAAC;IAC9C;;;;;OAKG;IACH,eAAe,CAAC,EAAE,yBAAyB,CAAC;IAC5C;;;;;;;OAOG;IACH,aAAa,CAAC,EAAE,uBAAuB,CAAC;IACxC;;;;;;;;OAQG;IACH,SAAS,CAAC,EAAE,0BAA0B,CAAC;IACvC,6GAA6G;IAC7G,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,gJAAgJ;IAChJ,OAAO,CAAC,EAAE;QAAE,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,KAAK,CAAC;IAC3C,uGAAuG;IACvG,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,kGAAkG;IAClG,QAAQ,CAAC,EAAE,yBAAyB,GAAG,OAAO,CAAC;IAC/C,kHAAkH;IAClH,iBAAiB,CAAC,EAAE,uBAAuB,GAAG,KAAK,CAAC;IACpD;;;OAGG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B;;;;;;OAMG;IACH,sBAAsB,CAAC,EAAE,yBAAyB,CAAC;IACnD;;;;;;OAMG;IACH,uBAAuB,CAAC,EAAE,0BAA0B,CAAC;CACtD,CAAC;;AAmEF,wBAGG;AAEH,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAChD,YAAY,EAAE,YAAY,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAC5E,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAClD,YAAY,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnE,YAAY,EACV,wBAAwB,EACxB,oBAAoB,EACpB,iBAAiB,EACjB,mBAAmB,EACnB,UAAU,GACX,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EACV,mBAAmB,EACnB,0BAA0B,EAC1B,wBAAwB,GACzB,MAAM,wBAAwB,CAAC;AAChC,YAAY,EACV,0BAA0B,EAC1B,yBAAyB,EACzB,uBAAuB,GACxB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,UAAU,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AAClH,YAAY,EAAE,yBAAyB,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AACvF,OAAO,EACL,cAAc,EACd,gBAAgB,EAChB,UAAU,EACV,iBAAiB,EACjB,cAAc,EACd,wBAAwB,GACzB,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EAAE,cAAc,EAAE,eAAe,EAAE,cAAc,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AACpH,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACrE,YAAY,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAC5D,OAAO,EACL,oBAAoB,EACpB,qBAAqB,EACrB,cAAc,EACd,eAAe,EACf,yBAAyB,GAC1B,MAAM,2BAA2B,CAAC;AACnC,YAAY,EACV,qBAAqB,EACrB,2BAA2B,EAC3B,qBAAqB,EACrB,4BAA4B,EAC5B,YAAY,GACb,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAC3D,YAAY,EAAE,0BAA0B,EAAE,MAAM,oBAAoB,CAAC;AACrE,YAAY,EACV,uBAAuB,EACvB,kBAAkB,EAClB,yBAAyB,EACzB,qBAAqB,GACtB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,uBAAuB,EACvB,yBAAyB,EACzB,qBAAqB,GACtB,MAAM,mBAAmB,CAAC;AAC3B,YAAY,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAC3E,YAAY,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAC5E,YAAY,EACV,cAAc,EACd,wBAAwB,EACxB,eAAe,GAChB,MAAM,WAAW,CAAC;AACnB,YAAY,EACV,sBAAsB,EACtB,uBAAuB,GACxB,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EAAE,yBAAyB,EAAE,MAAM,oBAAoB,CAAC;AACpE,YAAY,EAAE,+BAA+B,EAAE,MAAM,wBAAwB,CAAC;AAC9E,YAAY,EAAE,yBAAyB,EAAE,uBAAuB,EAAE,MAAM,qBAAqB,CAAC;AAC9F,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC"}

package/dist/app.js

@@ -64,10 +64,11 @@ export default fp(app, {
     fastify: '5.x',
 });
 export { createLocalStorage } from './storage/local.js';
+export { uploadIdOf } from './storage/types.js';
 export { createS3Storage } from './storage/s3.js';
-export { sniffMp4, createMp4Sniffer, createS3Mp4Sniffer } from './lib/magic.js';
-export { ensureWebReady, scanMoovPosition } from './lib/web-ready.js';
-export { buildUploadLink } from './lib/deeplinks.js';
+export { sniffMp4, createMp4Sniffer, createS3Mp4Sniffer, sniffVideo, createVideoValidator } from './lib/magic.js';
+export { ensureWebReady, scanMoovPosition, probeVideo, webReadyAvailable, CONFORM_TARGET, CONFORM_VIDEO_EXTENSIONS, } from './lib/web-ready.js';
+export { buildUploadLink, PULSE_OPEN_URL } from './lib/deeplinks.js';
 export { issueCapabilityToken, verifyCapabilityToken, issueViewToken, verifyViewToken, createCapabilityAuthorize, } from './lib/capability-token.js';
 export { createViewLinkIssuer } from './lib/view-links.js';
 export { sweepAbandonedUploads } from './lib/retention.js';