@murumets-ee/media 0.65.0 → 0.66.0

package/dist/admin.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"admin.d.mts","names":[],"sources":["../src/admin/routes.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;iBA4mBgB,WAAA,CAAA,GAAe,UAAU"}
+{"version":3,"file":"admin.d.mts","names":[],"sources":["../src/admin/routes.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;iBAsnBgB,WAAA,CAAA,GAAe,UAAU"}

package/dist/admin.mjs

@@ -1 +1 @@
-import{t as e}from"./routes-C_LZXK6k.mjs";export{e as mediaRoutes};
+import{t as e}from"./routes-B38Mz1FZ.mjs";export{e as mediaRoutes};

package/dist/{client-nPu7G7hY.mjs → client-CplTUsk3.mjs}

@@ -1,2 +1,2 @@
-import"./entity-Caba_NFw.mjs";import{n as e,r as t,t as n}from"./variant-key-CLlac3_1.mjs";import"server-only";var r=class{admin;storage;imageStyles;constructor(e){this.admin=e.admin,this.storage=e.storage,this.imageStyles=e.imageStyles??null}async resolveImageStyles(){if(this.imageStyles)return this.imageStyles;let{getApp:e}=await import(`@murumets-ee/core`),{resolveImageStyles:t}=await import(`./resolve-image-styles-qf5MpFll.mjs`),n=e();return this.imageStyles=await t(n,n.logger),this.imageStyles}invalidateImageStylesCache(){this.imageStyles=null}async upload(r,o){let s=await this.storage.upload(r,{filename:o.filename,mimeType:o.mimeType,size:o.size,visibility:o.visibility,uploadedBy:o.uploadedBy}),c=o.width??null,l=o.height??null,u={};if(r instanceof Buffer&&e(o.mimeType))try{let e=await t(r,await this.resolveImageStyles());c=e.width,l=e.height;let i=s.visibility;await Promise.all([...e.variants.entries()].map(async([e,t])=>{let r=n(s.key,e,t.format);try{await this.storage.upload(t.buffer,{key:r,filename:`${e}_${o.filename}`,mimeType:t.mimeType,size:t.buffer.byteLength,visibility:i,metadata:{variantOf:s.key,style:e},uploadedBy:o.uploadedBy}),u[e]=r}catch{}})),Object.keys(u).length>0&&await this.storage.updateMetadata(s.key,{metadata:{...s.metadata??{},variants:u}}).catch(()=>{})}catch{}let d=i(o.mimeType);try{return{media:await this.admin.create({title:o.title??a(o.filename),alt:o.alt??null,description:o.description??null,fileKey:s.key,filename:o.filename,mimeType:o.mimeType,size:o.size,width:c,height:l,mediaType:d}),url:await this.storage.getUrl(s.key)}}catch(e){for(let e of Object.values(u))await this.storage.delete(e).catch(()=>{});throw await this.storage.delete(s.key).catch(()=>{}),e}}async findById(e,t){return this.admin.findById(e,t)}async findMany(e){let{schemaRegistry:t}=await import(`@murumets-ee/db`),{and:n,asc:r,desc:i,eq:a,ilike:o,or:s,sql:c}=await import(`drizzle-orm`),l=t.get(`media`);if(!l)throw Error(`Media schema not registered. Is the media() plugin loaded?`);let u=[];if(e?.mediaType&&u.push(a(l.mediaType,e.mediaType)),e?.mimeTypePrefix){let t=e.mimeTypePrefix.replace(/[\\%_]/g,`\\$&`);u.push(o(l.mimeType,`${t}%`))}if(e?.search){let t=`%${e.search.replace(/[\\%_]/g,`\\$&`)}%`;u.push(s(o(l.filename,t),c`${l.fields} ->> 'title' ILIKE ${t}`))}let d=e?.limit??50,f=e?.offset??0,p=u.length>0?n(...u):void 0,m=await this.admin.count({where:p}),h=e?.orderBy===`filename`?l.filename:l.createdAt,g=(e?.orderDirection??`desc`)===`asc`?r:i;return{items:await this.admin.findMany({where:p,limit:d,offset:f,orderBy:g(h)}),total:m,limit:d,offset:f}}async update(e,t){return this.admin.update(e,t)}async delete(e){let t=await this.admin.findById(e);if(!t)throw Error(`Media not found: ${e}`);let n=t.fileKey;await this.admin.delete(e);let r=(await this.storage.getMetadata(n))?.metadata?.variants;if(r)for(let e of Object.values(r))await this.storage.delete(e).catch(()=>{});await this.storage.delete(n).catch(()=>{})}async getUrl(e){let t=await this.admin.findById(e);if(!t)throw Error(`Media not found: ${e}`);return this.storage.getUrl(t.fileKey)}async getUrls(e){if(e.length===0)return new Map;let{schemaRegistry:t}=await import(`@murumets-ee/db`),{inArray:n}=await import(`drizzle-orm`),r=t.get(`media`);if(!r)return new Map;let i=await this.admin.findMany({where:n(r.id,e),limit:e.length}),a=new Map;return await Promise.all(i.map(async e=>{let t=await this.storage.getUrl(e.fileKey);a.set(e.id,t)})),a}async getVariantUrl(e,t){let r=await this.admin.findById(e);if(!r)return null;let i=r.fileKey,a=(await this.resolveImageStyles())[t];if(a){let e=n(i,t,a.format??`webp`);try{return await this.storage.getUrl(e)}catch{}}try{return await this.storage.getUrl(i)}catch{return null}}async getVariantUrls(e,t){if(e.length===0)return new Map;let{schemaRegistry:r}=await import(`@murumets-ee/db`),{inArray:i}=await import(`drizzle-orm`),a=r.get(`media`);if(!a)return new Map;let o=await this.admin.findMany({where:i(a.id,e),limit:e.length}),s=(await this.resolveImageStyles())[t],c=new Map;return await Promise.all(o.map(async e=>{if(s){let r=n(e.fileKey,t,s.format??`webp`);try{let t=await this.storage.getUrl(r);c.set(e.id,t);return}catch{}}try{let t=await this.storage.getUrl(e.fileKey);c.set(e.id,t)}catch{}})),c}};function i(e){return e.startsWith(`image/`)?`image`:e.startsWith(`video/`)?`video`:e.startsWith(`audio/`)?`audio`:e===`application/pdf`||e.startsWith(`application/msword`)||e.startsWith(`application/vnd.`)?`document`:`other`}function a(e){return e.replace(/\.[^.]+$/,``).replace(/[-_]/g,` `)}export{r as MediaClient};
-//# sourceMappingURL=client-nPu7G7hY.mjs.map
+import"./entity-Caba_NFw.mjs";import{n as e,r as t,t as n}from"./variant-key-CLlac3_1.mjs";import"server-only";var r=class{admin;storage;imageStyles;constructor(e){this.admin=e.admin,this.storage=e.storage,this.imageStyles=e.imageStyles??null}async resolveImageStyles(){if(this.imageStyles)return this.imageStyles;let{getApp:e}=await import(`@murumets-ee/core`),{resolveImageStyles:t}=await import(`./resolve-image-styles-DlHP19gI.mjs`),n=e();return this.imageStyles=await t(n,n.logger),this.imageStyles}invalidateImageStylesCache(){this.imageStyles=null}async upload(r,o){let s=await this.storage.upload(r,{filename:o.filename,mimeType:o.mimeType,size:o.size,visibility:o.visibility,uploadedBy:o.uploadedBy}),c=o.width??null,l=o.height??null,u={};if(r instanceof Buffer&&e(o.mimeType))try{let e=await t(r,await this.resolveImageStyles());c=e.width,l=e.height;let i=s.visibility;await Promise.all([...e.variants.entries()].map(async([e,t])=>{let r=n(s.key,e,t.format);try{await this.storage.upload(t.buffer,{key:r,filename:`${e}_${o.filename}`,mimeType:t.mimeType,size:t.buffer.byteLength,visibility:i,metadata:{variantOf:s.key,style:e},uploadedBy:o.uploadedBy}),u[e]=r}catch{}})),Object.keys(u).length>0&&await this.storage.updateMetadata(s.key,{metadata:{...s.metadata??{},variants:u}}).catch(()=>{})}catch{}let d=i(o.mimeType);try{return{media:await this.admin.create({title:o.title??a(o.filename),alt:o.alt??null,description:o.description??null,fileKey:s.key,filename:o.filename,mimeType:o.mimeType,size:o.size,width:c,height:l,mediaType:d}),url:await this.storage.getUrl(s.key)}}catch(e){for(let e of Object.values(u))await this.storage.delete(e).catch(()=>{});throw await this.storage.delete(s.key).catch(()=>{}),e}}async findById(e,t){return this.admin.findById(e,t)}async findMany(e){let{schemaRegistry:t}=await import(`@murumets-ee/db`),{and:n,asc:r,desc:i,eq:a,ilike:o,or:s,sql:c}=await import(`drizzle-orm`),l=t.get(`media`);if(!l)throw Error(`Media schema not registered. Is the media() plugin loaded?`);let u=[];if(e?.mediaType&&u.push(a(l.mediaType,e.mediaType)),e?.mimeTypePrefix){let t=e.mimeTypePrefix.replace(/[\\%_]/g,`\\$&`);u.push(o(l.mimeType,`${t}%`))}if(e?.search){let t=`%${e.search.replace(/[\\%_]/g,`\\$&`)}%`;u.push(s(o(l.filename,t),c`${l.fields} ->> 'title' ILIKE ${t}`))}let d=e?.limit??50,f=e?.offset??0,p=u.length>0?n(...u):void 0,m=await this.admin.count({where:p}),h=e?.orderBy===`filename`?l.filename:l.createdAt,g=(e?.orderDirection??`desc`)===`asc`?r:i;return{items:await this.admin.findMany({where:p,limit:d,offset:f,orderBy:g(h)}),total:m,limit:d,offset:f}}async update(e,t){return this.admin.update(e,t)}async delete(e){let t=await this.admin.findById(e);if(!t)throw Error(`Media not found: ${e}`);let n=t.fileKey;await this.admin.delete(e);let r=(await this.storage.getMetadata(n))?.metadata?.variants;if(r)for(let e of Object.values(r))await this.storage.delete(e).catch(()=>{});await this.storage.delete(n).catch(()=>{})}async getUrl(e){let t=await this.admin.findById(e);if(!t)throw Error(`Media not found: ${e}`);return this.storage.getUrl(t.fileKey)}async getUrls(e){if(e.length===0)return new Map;let{schemaRegistry:t}=await import(`@murumets-ee/db`),{inArray:n}=await import(`drizzle-orm`),r=t.get(`media`);if(!r)return new Map;let i=await this.admin.findMany({where:n(r.id,e),limit:e.length}),a=new Map;return await Promise.all(i.map(async e=>{let t=await this.storage.getUrl(e.fileKey);a.set(e.id,t)})),a}async getVariantUrl(e,t){let r=await this.admin.findById(e);if(!r)return null;let i=r.fileKey,a=(await this.resolveImageStyles())[t];if(a){let e=n(i,t,a.format??`webp`);try{return await this.storage.getUrl(e)}catch{}}try{return await this.storage.getUrl(i)}catch{return null}}async getVariantUrls(e,t){if(e.length===0)return new Map;let{schemaRegistry:r}=await import(`@murumets-ee/db`),{inArray:i}=await import(`drizzle-orm`),a=r.get(`media`);if(!a)return new Map;let o=await this.admin.findMany({where:i(a.id,e),limit:e.length}),s=(await this.resolveImageStyles())[t],c=new Map;return await Promise.all(o.map(async e=>{if(s){let r=n(e.fileKey,t,s.format??`webp`);try{let t=await this.storage.getUrl(r);c.set(e.id,t);return}catch{}}try{let t=await this.storage.getUrl(e.fileKey);c.set(e.id,t)}catch{}})),c}};function i(e){return e.startsWith(`image/`)?`image`:e.startsWith(`video/`)?`video`:e.startsWith(`audio/`)?`audio`:e===`application/pdf`||e.startsWith(`application/msword`)||e.startsWith(`application/vnd.`)?`document`:`other`}function a(e){return e.replace(/\.[^.]+$/,``).replace(/[-_]/g,` `)}export{r as MediaClient};
+//# sourceMappingURL=client-CplTUsk3.mjs.map

package/dist/{client-nPu7G7hY.mjs.map → client-CplTUsk3.mjs.map}

@@ -1 +1 @@
-{"version":3,"file":"client-nPu7G7hY.mjs","names":[],"sources":["../src/async-cache.ts","../src/client.ts"],"sourcesContent":["/**\n * Small async caching primitives shared by the media read paths.\n *\n * A LEAF module on purpose: `client.ts` needs\n * {@link cacheOnceUnlessRejected} and `public-resolver.ts` dynamically imports\n * `client.ts`, so keeping the helper in either would put a static edge across a\n * dynamic one. Both import this instead.\n *\n * Both helpers share one rule — **a rejection is never pinned**. A cached\n * failure turns one transient blip into a permanent outage that only a restart\n * clears, which is tolerable behind an admin action and is not behind the\n * anonymous request path these now serve.\n */\n\n/**\n * Cache a one-shot async initialisation — but NEVER a rejection.\n *\n * A bare `promise ??= load()` singleton pins a rejected promise for the life of\n * the process: one transient failure during initialisation and every later\n * caller replays that same rejection until restart. That is tolerable when the\n * singleton serves an admin operation someone will retry by hand; it is not\n * when it serves the anonymous request path, where the symptom is every image\n * on the site failing permanently with no way to recover short of a redeploy.\n *\n * Same rule as {@link memoiseWithTtl}, without the TTL — a success here is\n * process-lifetime by design (the value is configuration, not data).\n */\nexport function cacheOnceUnlessRejected<T>(load: () => Promise<T>): () => Promise<T> {\n  let cached: Promise<T> | null = null\n  return () => {\n    if (cached) return cached\n    const pending = load()\n    cached = pending\n    pending.catch(() => {\n      // Only clear OUR entry — a later call may already have replaced it.\n      if (cached === pending) cached = null\n    })\n    return pending\n  }\n}\n","/**\n * MediaClient — wraps AdminClient + StorageClient for media management.\n *\n * Usage:\n *   import { createMediaClient } from '@murumets-ee/media/client'\n *   const media = await createMediaClient(storageClient)\n *   const result = await media.upload(buffer, { filename: 'photo.jpg', mimeType: 'image/jpeg', size: 12345 })\n */\n\nimport 'server-only'\n\nimport type { AdminClient } from '@murumets-ee/entity/admin'\nimport type { StorageClient } from '@murumets-ee/storage'\nimport { cacheOnceUnlessRejected } from './async-cache.js'\nimport { Media } from './entity.js'\nimport { isProcessableImage, processImage } from './process-image.js'\nimport type {\n  ImageStyle,\n  MediaListOptions,\n  MediaListResult,\n  MediaRecord,\n  MediaType,\n  MediaUploadOptions,\n  MediaUploadResult,\n} from './types.js'\nimport { deriveVariantKey } from './variant-key.js'\n\ntype MediaFields = typeof Media.allFields\n\nexport interface MediaClientConfig {\n  admin: AdminClient<MediaFields>\n  storage: StorageClient\n  /** Image styles to generate on upload. Loaded from plugin config if not provided. */\n  imageStyles?: Record<string, ImageStyle>\n}\n\nexport class MediaClient {\n  private admin: AdminClient<MediaFields>\n  private storage: StorageClient\n  private imageStyles: Record<string, ImageStyle> | null\n\n  constructor(config: MediaClientConfig) {\n    this.admin = config.admin\n    this.storage = config.storage\n    this.imageStyles = config.imageStyles ?? null\n  }\n\n  /**\n   * Resolve image styles via the shared waterfall (settings DB → plugin\n   * config → hardcoded defaults) and cache the result on this instance.\n   * Call `invalidateImageStylesCache()` after a settings update.\n   */\n  private async resolveImageStyles(): Promise<Record<string, ImageStyle>> {\n    if (this.imageStyles) return this.imageStyles\n    const { getApp } = await import('@murumets-ee/core')\n    const { resolveImageStyles } = await import('./resolve-image-styles.js')\n    const app = getApp()\n    this.imageStyles = await resolveImageStyles(app, app.logger)\n    return this.imageStyles\n  }\n\n  /** Clear cached styles so next access re-reads from settings DB. */\n  invalidateImageStylesCache(): void {\n    this.imageStyles = null\n  }\n\n  // ---------------------------------------------------------------\n  // Upload — the key convenience method\n  // ---------------------------------------------------------------\n\n  /**\n   * Upload a file and create a media entity record in one step.\n   * 1. Uploads original to storage (StorageClient)\n   * 2. If image: extracts dimensions via Sharp + generates variants\n   * 3. Creates media entity record (AdminClient)\n   * 4. Returns the media record + URL\n   *\n   * Rolls back storage upload if entity creation fails.\n   * Variant generation failures are logged but don't fail the upload.\n   */\n  async upload(\n    data: Buffer | ReadableStream<Uint8Array>,\n    options: MediaUploadOptions,\n  ): Promise<MediaUploadResult> {\n    // 1. Upload original file to storage\n    const fileRecord = await this.storage.upload(data, {\n      filename: options.filename,\n      mimeType: options.mimeType,\n      size: options.size,\n      visibility: options.visibility,\n      uploadedBy: options.uploadedBy,\n    })\n\n    // 2. Image processing — extract dimensions + generate variants\n    let width = options.width ?? null\n    let height = options.height ?? null\n    const variantKeys: Record<string, string> = {}\n\n    if (data instanceof Buffer && isProcessableImage(options.mimeType)) {\n      try {\n        const styles = await this.resolveImageStyles()\n        const processed = await processImage(data, styles)\n\n        // Set dimensions from Sharp metadata\n        width = processed.width\n        height = processed.height\n\n        // Upload each variant to storage\n        const visibility = fileRecord.visibility\n        await Promise.all(\n          [...processed.variants.entries()].map(async ([styleName, variant]) => {\n            const vKey = deriveVariantKey(fileRecord.key, styleName, variant.format)\n            try {\n              await this.storage.upload(variant.buffer, {\n                key: vKey,\n                filename: `${styleName}_${options.filename}`,\n                mimeType: variant.mimeType,\n                size: variant.buffer.byteLength,\n                visibility,\n                metadata: { variantOf: fileRecord.key, style: styleName },\n                uploadedBy: options.uploadedBy,\n              })\n              variantKeys[styleName] = vKey\n            } catch {\n              // Variant upload failure is non-fatal — original is saved\n            }\n          }),\n        )\n\n        // Store variant keys in original file's metadata\n        if (Object.keys(variantKeys).length > 0) {\n          await this.storage\n            .updateMetadata(fileRecord.key, {\n              metadata: {\n                ...(fileRecord.metadata ?? {}),\n                variants: variantKeys,\n              },\n            })\n            .catch(() => {\n              // Metadata update failure is non-fatal\n            })\n        }\n      } catch {\n        // Image processing failure is non-fatal — original is saved\n      }\n    }\n\n    // 3. Create media entity record\n    const mediaType = deriveMediaType(options.mimeType)\n\n    try {\n      const entityRecord = await this.admin.create({\n        title: options.title ?? deriveTitle(options.filename),\n        alt: options.alt ?? null,\n        description: options.description ?? null,\n        fileKey: fileRecord.key,\n        filename: options.filename,\n        mimeType: options.mimeType,\n        size: options.size,\n        width,\n        height,\n        mediaType,\n      })\n\n      // 4. Get URL\n      const url = await this.storage.getUrl(fileRecord.key)\n\n      return {\n        media: entityRecord,\n        url,\n      }\n    } catch (error) {\n      // Rollback: delete variants + original if entity creation fails\n\n      // Delete variants first (best-effort)\n      for (const vKey of Object.values(variantKeys)) {\n        await this.storage.delete(vKey).catch(() => {})\n      }\n\n      // Delete original\n      await this.storage.delete(fileRecord.key).catch(() => {\n        // Storage rollback failure is already being handled — propagate original error\n      })\n      throw error\n    }\n  }\n\n  // ---------------------------------------------------------------\n  // CRUD delegation\n  // ---------------------------------------------------------------\n\n  async findById(id: string, options?: { locale?: string }): Promise<MediaRecord | null> {\n    return this.admin.findById(id, options)\n  }\n\n  async findMany(options?: MediaListOptions): Promise<MediaListResult> {\n    const { schemaRegistry } = await import('@murumets-ee/db')\n    const { and, asc, desc, eq, ilike, or, sql } = await import('drizzle-orm')\n\n    const table = schemaRegistry.get('media')\n    if (!table) throw new Error('Media schema not registered. Is the media() plugin loaded?')\n\n    // Build where conditions\n    const conditions = []\n\n    if (options?.mediaType) {\n      conditions.push(eq(table.mediaType, options.mediaType))\n    }\n    if (options?.mimeTypePrefix) {\n      // Escape ILIKE wildcards (%, _) in user input to prevent pattern injection\n      const escaped = options.mimeTypePrefix.replace(/[\\\\%_]/g, '\\\\$&')\n      conditions.push(ilike(table.mimeType, `${escaped}%`))\n    }\n    if (options?.search) {\n      // Escape ILIKE wildcards in user input, then wrap with %...%\n      const escaped = options.search.replace(/[\\\\%_]/g, '\\\\$&')\n      const pattern = `%${escaped}%`\n      conditions.push(\n        or(\n          ilike(table.filename, pattern),\n          sql`${table.fields} ->> 'title' ILIKE ${pattern}`,\n        )!,\n      )\n    }\n\n    const limit = options?.limit ?? 50\n    const offset = options?.offset ?? 0\n    const whereClause = conditions.length > 0 ? and(...conditions) : undefined\n\n    // Count total via AdminClient\n    const total = await this.admin.count({ where: whereClause })\n\n    // Fetch items via AdminClient for proper DTO shaping\n    const orderField = options?.orderBy === 'filename' ? table.filename : table.createdAt\n    const orderFn = (options?.orderDirection ?? 'desc') === 'asc' ? asc : desc\n\n    const items = await this.admin.findMany({\n      where: whereClause,\n      limit,\n      offset,\n      orderBy: orderFn(orderField),\n    })\n\n    return {\n      items,\n      total,\n      limit,\n      offset,\n    }\n  }\n\n  async update(\n    id: string,\n    data: { title?: string; alt?: string; description?: string },\n  ): Promise<MediaRecord> {\n    return this.admin.update(id, data)\n  }\n\n  /**\n   * Delete a media entity, its variants, and its original file in storage.\n   */\n  async delete(id: string): Promise<void> {\n    const record = await this.admin.findById(id)\n    if (!record) throw new Error(`Media not found: ${id}`)\n\n    const fileKey = record.fileKey\n\n    // 1. Delete entity first (ref checking via entity_refs happens here)\n    await this.admin.delete(id)\n\n    // 2. Look up original file record for variant metadata\n    const fileRecord = await this.storage.getMetadata(fileKey)\n    const variants = (fileRecord?.metadata as Record<string, unknown> | null)?.variants as\n      | Record<string, string>\n      | undefined\n\n    // 3. Delete variants (best-effort)\n    if (variants) {\n      for (const vKey of Object.values(variants)) {\n        await this.storage.delete(vKey).catch(() => {\n          // Variant deletion failure is non-fatal\n        })\n      }\n    }\n\n    // 4. Delete original file (best-effort)\n    await this.storage.delete(fileKey).catch(() => {\n      // Storage deletion failure is non-fatal — entity is already deleted\n    })\n  }\n\n  // ---------------------------------------------------------------\n  // URL resolution\n  // ---------------------------------------------------------------\n\n  /**\n   * Get URL for a media entity by its ID.\n   * Resolves entity -> fileKey -> storage URL.\n   */\n  async getUrl(id: string): Promise<string> {\n    const record = await this.admin.findById(id)\n    if (!record) throw new Error(`Media not found: ${id}`)\n\n    return this.storage.getUrl(record.fileKey)\n  }\n\n  /**\n   * Get URLs for multiple media entities (batch).\n   * Returns a Map of mediaId -> url.\n   */\n  async getUrls(ids: string[]): Promise<Map<string, string>> {\n    if (ids.length === 0) return new Map()\n\n    const { schemaRegistry } = await import('@murumets-ee/db')\n    const { inArray } = await import('drizzle-orm')\n\n    const table = schemaRegistry.get('media')\n    if (!table) return new Map()\n\n    const records = await this.admin.findMany({\n      where: inArray(table.id, ids),\n      limit: ids.length,\n    })\n\n    const urlMap = new Map<string, string>()\n\n    await Promise.all(\n      records.map(async (record) => {\n        const url = await this.storage.getUrl(record.fileKey)\n        urlMap.set(record.id, url)\n      }),\n    )\n\n    return urlMap\n  }\n\n  /**\n   * Get variant URL for a specific image style.\n   * Falls back to original URL if the variant doesn't exist.\n   *\n   * @param id - Media entity ID\n   * @param styleName - Image style name (e.g., 'thumbnail')\n   * @returns The variant URL, or original URL as fallback, or null if media not found\n   */\n  async getVariantUrl(id: string, styleName: string): Promise<string | null> {\n    const record = await this.admin.findById(id)\n    if (!record) return null\n\n    const fileKey = record.fileKey\n\n    // Try variant key first\n    const styles = await this.resolveImageStyles()\n    const style = styles[styleName]\n    if (style) {\n      const vKey = deriveVariantKey(fileKey, styleName, style.format ?? 'webp')\n      try {\n        return await this.storage.getUrl(vKey)\n      } catch {\n        // Variant doesn't exist — fall back to original\n      }\n    }\n\n    // Fallback to original\n    try {\n      return await this.storage.getUrl(fileKey)\n    } catch {\n      return null\n    }\n  }\n\n  /**\n   * Get variant URLs for multiple media entities (batch).\n   * Falls back to original URL per item if the variant doesn't exist.\n   *\n   * @param ids - Media entity IDs\n   * @param styleName - Image style name (e.g., 'thumbnail')\n   * @returns Map of mediaId -> variant URL (or original URL as fallback)\n   */\n  async getVariantUrls(ids: string[], styleName: string): Promise<Map<string, string>> {\n    if (ids.length === 0) return new Map()\n\n    const { schemaRegistry } = await import('@murumets-ee/db')\n    const { inArray } = await import('drizzle-orm')\n\n    const table = schemaRegistry.get('media')\n    if (!table) return new Map()\n\n    const records = await this.admin.findMany({\n      where: inArray(table.id, ids),\n      limit: ids.length,\n    })\n\n    const styles = await this.resolveImageStyles()\n    const style = styles[styleName]\n    const urlMap = new Map<string, string>()\n\n    await Promise.all(\n      records.map(async (record) => {\n        // Try variant URL\n        if (style) {\n          const vKey = deriveVariantKey(record.fileKey, styleName, style.format ?? 'webp')\n          try {\n            const url = await this.storage.getUrl(vKey)\n            urlMap.set(record.id, url)\n            return\n          } catch {\n            // Variant doesn't exist — fall back to original\n          }\n        }\n\n        // Fallback to original\n        try {\n          const url = await this.storage.getUrl(record.fileKey)\n          urlMap.set(record.id, url)\n        } catch {\n          // Skip — no URL available\n        }\n      }),\n    )\n\n    return urlMap\n  }\n}\n\n// ---------------------------------------------------------------\n// Helpers\n// ---------------------------------------------------------------\n\nfunction deriveMediaType(mimeType: string): MediaType {\n  if (mimeType.startsWith('image/')) return 'image'\n  if (mimeType.startsWith('video/')) return 'video'\n  if (mimeType.startsWith('audio/')) return 'audio'\n  if (\n    mimeType === 'application/pdf' ||\n    mimeType.startsWith('application/msword') ||\n    mimeType.startsWith('application/vnd.')\n  ) {\n    return 'document'\n  }\n  return 'other'\n}\n\nfunction deriveTitle(filename: string): string {\n  const withoutExt = filename.replace(/\\.[^.]+$/, '')\n  return withoutExt.replace(/[-_]/g, ' ')\n}\n\n/**\n * Factory — creates a MediaClient with an explicit StorageClient.\n * Must be called after createApp().\n */\nexport async function createMediaClient(storage: StorageClient): Promise<MediaClient> {\n  const { createAdminClient } = await import('@murumets-ee/core/clients')\n  const admin = createAdminClient(Media)\n  return new MediaClient({ admin, storage })\n}\n\n// ---------------------------------------------------------------------------\n// Per-request MediaClient factory\n// ---------------------------------------------------------------------------\n//\n// NOTE: Storage config is process-global and safe to cache.\n// MediaClient / AdminClient must be built per-request — they carry a\n// context resolver tied to the calling request's user + permissions.\n// A singleton would leak one request's security context across others.\n\n/**\n * The storage singleton, which does NOT pin a failed initialisation.\n *\n * `_storagePromise ??= (...)()` used to cache the rejected promise too, so a\n * transient failure during storage init (config not yet loaded, a DB blip)\n * broke every subsequent caller until the process restarted. That mattered\n * little while this served admin operations; `plan/api` PR 5 puts it on the\n * ANONYMOUS request path via `getSharedStorageClient`, where the symptom\n * becomes every image on the site failing permanently with no recovery short of\n * a redeploy. See `cacheOnceUnlessRejected`, which is unit-tested.\n */\nconst _storageOnce = cacheOnceUnlessRejected<StorageClient>(async () => {\n  const { getApp } = await import('@murumets-ee/core')\n  const { createStorageClient } = await import('@murumets-ee/storage')\n  const { getStorageConfig } = await import('@murumets-ee/storage/plugin')\n  const app = getApp()\n  return createStorageClient(getStorageConfig(), { app })\n})\n\n/**\n * The process-wide `StorageClient`, built once from the storage plugin config.\n *\n * Exported so the PUBLIC media resolver (`./public-resolver.ts`) reaches the\n * same instance rather than constructing a second one from a copy of these two\n * lines. Safe to share, and unlike `MediaClient`/`AdminClient` it MUST NOT be\n * rebuilt per request: it carries no security context — the read-side gate\n * lives in whichever client resolves the media rows, not here.\n */\nexport async function getSharedStorageClient(): Promise<StorageClient> {\n  return getStorageSingleton()\n}\n\nasync function getStorageSingleton(): Promise<StorageClient> {\n  return _storageOnce()\n}\n\n/**\n * Returns a fresh MediaClient wired to the current request's context.\n * Must be called after createApp(), inside a request context\n * (withAdminContext, runAsCli, etc.).\n *\n * Despite the name, this is NOT cached — the storage config is cached\n * internally but the MediaClient and its AdminClient are rebuilt per call\n * so the security context resolver attaches to the correct request.\n */\nexport async function getMediaClient(): Promise<MediaClient> {\n  const { createAdminClient } = await import('@murumets-ee/core/clients')\n  const storage = await getStorageSingleton()\n  const admin = createAdminClient(Media)\n  return new MediaClient({ admin, storage })\n}\n"],"mappings":"+GCoCA,IAAa,EAAb,KAAyB,CACvB,MACA,QACA,YAEA,YAAY,EAA2B,CACrC,KAAK,MAAQ,EAAO,MACpB,KAAK,QAAU,EAAO,QACtB,KAAK,YAAc,EAAO,aAAe,IAC3C,CAOA,MAAc,oBAA0D,CACtE,GAAI,KAAK,YAAa,OAAO,KAAK,YAClC,GAAM,CAAE,UAAW,MAAM,OAAO,qBAC1B,CAAE,sBAAuB,MAAM,OAAO,uCACtC,EAAM,EAAO,EAEnB,MADA,MAAK,YAAc,MAAM,EAAmB,EAAK,EAAI,MAAM,EACpD,KAAK,WACd,CAGA,4BAAmC,CACjC,KAAK,YAAc,IACrB,CAgBA,MAAM,OACJ,EACA,EAC4B,CAE5B,IAAM,EAAa,MAAM,KAAK,QAAQ,OAAO,EAAM,CACjD,SAAU,EAAQ,SAClB,SAAU,EAAQ,SAClB,KAAM,EAAQ,KACd,WAAY,EAAQ,WACpB,WAAY,EAAQ,UACtB,CAAC,EAGG,EAAQ,EAAQ,OAAS,KACzB,EAAS,EAAQ,QAAU,KACzB,EAAsC,CAAC,EAE7C,GAAI,aAAgB,QAAU,EAAmB,EAAQ,QAAQ,EAC/D,GAAI,CAEF,IAAM,EAAY,MAAM,EAAa,EAAM,MADtB,KAAK,mBAAmB,CACI,EAGjD,EAAQ,EAAU,MAClB,EAAS,EAAU,OAGnB,IAAM,EAAa,EAAW,WAC9B,MAAM,QAAQ,IACZ,CAAC,GAAG,EAAU,SAAS,QAAQ,CAAC,CAAC,CAAC,IAAI,MAAO,CAAC,EAAW,KAAa,CACpE,IAAM,EAAO,EAAiB,EAAW,IAAK,EAAW,EAAQ,MAAM,EACvE,GAAI,CACF,MAAM,KAAK,QAAQ,OAAO,EAAQ,OAAQ,CACxC,IAAK,EACL,SAAU,GAAG,EAAU,GAAG,EAAQ,WAClC,SAAU,EAAQ,SAClB,KAAM,EAAQ,OAAO,WACrB,aACA,SAAU,CAAE,UAAW,EAAW,IAAK,MAAO,CAAU,EACxD,WAAY,EAAQ,UACtB,CAAC,EACD,EAAY,GAAa,CAC3B,MAAQ,CAER,CACF,CAAC,CACH,EAGI,OAAO,KAAK,CAAW,CAAC,CAAC,OAAS,GACpC,MAAM,KAAK,QACR,eAAe,EAAW,IAAK,CAC9B,SAAU,CACR,GAAI,EAAW,UAAY,CAAC,EAC5B,SAAU,CACZ,CACF,CAAC,CAAC,CACD,UAAY,CAEb,CAAC,CAEP,MAAQ,CAER,CAIF,IAAM,EAAY,EAAgB,EAAQ,QAAQ,EAElD,GAAI,CAiBF,MAAO,CACL,MAAO,MAjBkB,KAAK,MAAM,OAAO,CAC3C,MAAO,EAAQ,OAAS,EAAY,EAAQ,QAAQ,EACpD,IAAK,EAAQ,KAAO,KACpB,YAAa,EAAQ,aAAe,KACpC,QAAS,EAAW,IACpB,SAAU,EAAQ,SAClB,SAAU,EAAQ,SAClB,KAAM,EAAQ,KACd,QACA,SACA,WACF,CAAC,EAOC,IAAA,MAJgB,KAAK,QAAQ,OAAO,EAAW,GAAG,CAKpD,CACF,OAAS,EAAO,CAId,IAAK,IAAM,KAAQ,OAAO,OAAO,CAAW,EAC1C,MAAM,KAAK,QAAQ,OAAO,CAAI,CAAC,CAAC,UAAY,CAAC,CAAC,EAOhD,MAHA,MAAM,KAAK,QAAQ,OAAO,EAAW,GAAG,CAAC,CAAC,UAAY,CAEtD,CAAC,EACK,CACR,CACF,CAMA,MAAM,SAAS,EAAY,EAA4D,CACrF,OAAO,KAAK,MAAM,SAAS,EAAI,CAAO,CACxC,CAEA,MAAM,SAAS,EAAsD,CACnE,GAAM,CAAE,kBAAmB,MAAM,OAAO,mBAClC,CAAE,MAAK,MAAK,OAAM,KAAI,QAAO,KAAI,OAAQ,MAAM,OAAO,eAEtD,EAAQ,EAAe,IAAI,OAAO,EACxC,GAAI,CAAC,EAAO,MAAU,MAAM,4DAA4D,EAGxF,IAAM,EAAa,CAAC,EAKpB,GAHI,GAAS,WACX,EAAW,KAAK,EAAG,EAAM,UAAW,EAAQ,SAAS,CAAC,EAEpD,GAAS,eAAgB,CAE3B,IAAM,EAAU,EAAQ,eAAe,QAAQ,UAAW,MAAM,EAChE,EAAW,KAAK,EAAM,EAAM,SAAU,GAAG,EAAQ,EAAE,CAAC,CACtD,CACA,GAAI,GAAS,OAAQ,CAGnB,IAAM,EAAU,IADA,EAAQ,OAAO,QAAQ,UAAW,MACxB,EAAE,GAC5B,EAAW,KACT,EACE,EAAM,EAAM,SAAU,CAAO,EAC7B,CAAG,GAAG,EAAM,OAAO,qBAAqB,GAC1C,CACF,CACF,CAEA,IAAM,EAAQ,GAAS,OAAS,GAC1B,EAAS,GAAS,QAAU,EAC5B,EAAc,EAAW,OAAS,EAAI,EAAI,GAAG,CAAU,EAAI,IAAA,GAG3D,EAAQ,MAAM,KAAK,MAAM,MAAM,CAAE,MAAO,CAAY,CAAC,EAGrD,EAAa,GAAS,UAAY,WAAa,EAAM,SAAW,EAAM,UACtE,GAAW,GAAS,gBAAkB,UAAY,MAAQ,EAAM,EAStE,MAAO,CACL,MAAA,MARkB,KAAK,MAAM,SAAS,CACtC,MAAO,EACP,QACA,SACA,QAAS,EAAQ,CAAU,CAC7B,CAAC,EAIC,QACA,QACA,QACF,CACF,CAEA,MAAM,OACJ,EACA,EACsB,CACtB,OAAO,KAAK,MAAM,OAAO,EAAI,CAAI,CACnC,CAKA,MAAM,OAAO,EAA2B,CACtC,IAAM,EAAS,MAAM,KAAK,MAAM,SAAS,CAAE,EAC3C,GAAI,CAAC,EAAQ,MAAU,MAAM,oBAAoB,GAAI,EAErD,IAAM,EAAU,EAAO,QAGvB,MAAM,KAAK,MAAM,OAAO,CAAE,EAI1B,IAAM,GAAY,MADO,KAAK,QAAQ,YAAY,CAAO,EAAA,EAC3B,UAA6C,SAK3E,GAAI,EACF,IAAK,IAAM,KAAQ,OAAO,OAAO,CAAQ,EACvC,MAAM,KAAK,QAAQ,OAAO,CAAI,CAAC,CAAC,UAAY,CAE5C,CAAC,EAKL,MAAM,KAAK,QAAQ,OAAO,CAAO,CAAC,CAAC,UAAY,CAE/C,CAAC,CACH,CAUA,MAAM,OAAO,EAA6B,CACxC,IAAM,EAAS,MAAM,KAAK,MAAM,SAAS,CAAE,EAC3C,GAAI,CAAC,EAAQ,MAAU,MAAM,oBAAoB,GAAI,EAErD,OAAO,KAAK,QAAQ,OAAO,EAAO,OAAO,CAC3C,CAMA,MAAM,QAAQ,EAA6C,CACzD,GAAI,EAAI,SAAW,EAAG,OAAO,IAAI,IAEjC,GAAM,CAAE,kBAAmB,MAAM,OAAO,mBAClC,CAAE,WAAY,MAAM,OAAO,eAE3B,EAAQ,EAAe,IAAI,OAAO,EACxC,GAAI,CAAC,EAAO,OAAO,IAAI,IAEvB,IAAM,EAAU,MAAM,KAAK,MAAM,SAAS,CACxC,MAAO,EAAQ,EAAM,GAAI,CAAG,EAC5B,MAAO,EAAI,MACb,CAAC,EAEK,EAAS,IAAI,IASnB,OAPA,MAAM,QAAQ,IACZ,EAAQ,IAAI,KAAO,IAAW,CAC5B,IAAM,EAAM,MAAM,KAAK,QAAQ,OAAO,EAAO,OAAO,EACpD,EAAO,IAAI,EAAO,GAAI,CAAG,CAC3B,CAAC,CACH,EAEO,CACT,CAUA,MAAM,cAAc,EAAY,EAA2C,CACzE,IAAM,EAAS,MAAM,KAAK,MAAM,SAAS,CAAE,EAC3C,GAAI,CAAC,EAAQ,OAAO,KAEpB,IAAM,EAAU,EAAO,QAIjB,GAAQ,MADO,KAAK,mBAAmB,EAAA,CACxB,GACrB,GAAI,EAAO,CACT,IAAM,EAAO,EAAiB,EAAS,EAAW,EAAM,QAAU,MAAM,EACxE,GAAI,CACF,OAAO,MAAM,KAAK,QAAQ,OAAO,CAAI,CACvC,MAAQ,CAER,CACF,CAGA,GAAI,CACF,OAAO,MAAM,KAAK,QAAQ,OAAO,CAAO,CAC1C,MAAQ,CACN,OAAO,IACT,CACF,CAUA,MAAM,eAAe,EAAe,EAAiD,CACnF,GAAI,EAAI,SAAW,EAAG,OAAO,IAAI,IAEjC,GAAM,CAAE,kBAAmB,MAAM,OAAO,mBAClC,CAAE,WAAY,MAAM,OAAO,eAE3B,EAAQ,EAAe,IAAI,OAAO,EACxC,GAAI,CAAC,EAAO,OAAO,IAAI,IAEvB,IAAM,EAAU,MAAM,KAAK,MAAM,SAAS,CACxC,MAAO,EAAQ,EAAM,GAAI,CAAG,EAC5B,MAAO,EAAI,MACb,CAAC,EAGK,GAAQ,MADO,KAAK,mBAAmB,EAAA,CACxB,GACf,EAAS,IAAI,IA0BnB,OAxBA,MAAM,QAAQ,IACZ,EAAQ,IAAI,KAAO,IAAW,CAE5B,GAAI,EAAO,CACT,IAAM,EAAO,EAAiB,EAAO,QAAS,EAAW,EAAM,QAAU,MAAM,EAC/E,GAAI,CACF,IAAM,EAAM,MAAM,KAAK,QAAQ,OAAO,CAAI,EAC1C,EAAO,IAAI,EAAO,GAAI,CAAG,EACzB,MACF,MAAQ,CAER,CACF,CAGA,GAAI,CACF,IAAM,EAAM,MAAM,KAAK,QAAQ,OAAO,EAAO,OAAO,EACpD,EAAO,IAAI,EAAO,GAAI,CAAG,CAC3B,MAAQ,CAER,CACF,CAAC,CACH,EAEO,CACT,CACF,EAMA,SAAS,EAAgB,EAA6B,CAWpD,OAVI,EAAS,WAAW,QAAQ,EAAU,QACtC,EAAS,WAAW,QAAQ,EAAU,QACtC,EAAS,WAAW,QAAQ,EAAU,QAExC,IAAa,mBACb,EAAS,WAAW,oBAAoB,GACxC,EAAS,WAAW,kBAAkB,EAE/B,WAEF,OACT,CAEA,SAAS,EAAY,EAA0B,CAE7C,OADmB,EAAS,QAAQ,WAAY,EAChC,CAAC,CAAC,QAAQ,QAAS,GAAG,CACxC"}
+{"version":3,"file":"client-CplTUsk3.mjs","names":[],"sources":["../src/async-cache.ts","../src/client.ts"],"sourcesContent":["/**\n * Small async caching primitives shared by the media read paths.\n *\n * A LEAF module on purpose: `client.ts` needs\n * {@link cacheOnceUnlessRejected} and `public-resolver.ts` dynamically imports\n * `client.ts`, so keeping the helper in either would put a static edge across a\n * dynamic one. Both import this instead.\n *\n * Both helpers share one rule — **a rejection is never pinned**. A cached\n * failure turns one transient blip into a permanent outage that only a restart\n * clears, which is tolerable behind an admin action and is not behind the\n * anonymous request path these now serve.\n */\n\n/**\n * Cache a one-shot async initialisation — but NEVER a rejection.\n *\n * A bare `promise ??= load()` singleton pins a rejected promise for the life of\n * the process: one transient failure during initialisation and every later\n * caller replays that same rejection until restart. That is tolerable when the\n * singleton serves an admin operation someone will retry by hand; it is not\n * when it serves the anonymous request path, where the symptom is every image\n * on the site failing permanently with no way to recover short of a redeploy.\n *\n * Same rule as {@link memoiseWithTtl}, without the TTL — a success here is\n * process-lifetime by design (the value is configuration, not data).\n */\nexport function cacheOnceUnlessRejected<T>(load: () => Promise<T>): () => Promise<T> {\n  let cached: Promise<T> | null = null\n  return () => {\n    if (cached) return cached\n    const pending = load()\n    cached = pending\n    pending.catch(() => {\n      // Only clear OUR entry — a later call may already have replaced it.\n      if (cached === pending) cached = null\n    })\n    return pending\n  }\n}\n","/**\n * MediaClient — wraps AdminClient + StorageClient for media management.\n *\n * Usage:\n *   import { createMediaClient } from '@murumets-ee/media/client'\n *   const media = await createMediaClient(storageClient)\n *   const result = await media.upload(buffer, { filename: 'photo.jpg', mimeType: 'image/jpeg', size: 12345 })\n */\n\nimport 'server-only'\n\nimport type { AdminClient } from '@murumets-ee/entity/admin'\nimport type { StorageClient } from '@murumets-ee/storage'\nimport { cacheOnceUnlessRejected } from './async-cache.js'\nimport { Media } from './entity.js'\nimport { isProcessableImage, processImage } from './process-image.js'\nimport type {\n  ImageStyle,\n  MediaListOptions,\n  MediaListResult,\n  MediaRecord,\n  MediaType,\n  MediaUploadOptions,\n  MediaUploadResult,\n} from './types.js'\nimport { deriveVariantKey } from './variant-key.js'\n\ntype MediaFields = typeof Media.allFields\n\nexport interface MediaClientConfig {\n  admin: AdminClient<MediaFields>\n  storage: StorageClient\n  /** Image styles to generate on upload. Loaded from plugin config if not provided. */\n  imageStyles?: Record<string, ImageStyle>\n}\n\nexport class MediaClient {\n  private admin: AdminClient<MediaFields>\n  private storage: StorageClient\n  private imageStyles: Record<string, ImageStyle> | null\n\n  constructor(config: MediaClientConfig) {\n    this.admin = config.admin\n    this.storage = config.storage\n    this.imageStyles = config.imageStyles ?? null\n  }\n\n  /**\n   * Resolve image styles via the shared waterfall (settings DB → plugin\n   * config → hardcoded defaults) and cache the result on this instance.\n   * Call `invalidateImageStylesCache()` after a settings update.\n   */\n  private async resolveImageStyles(): Promise<Record<string, ImageStyle>> {\n    if (this.imageStyles) return this.imageStyles\n    const { getApp } = await import('@murumets-ee/core')\n    const { resolveImageStyles } = await import('./resolve-image-styles.js')\n    const app = getApp()\n    this.imageStyles = await resolveImageStyles(app, app.logger)\n    return this.imageStyles\n  }\n\n  /** Clear cached styles so next access re-reads from settings DB. */\n  invalidateImageStylesCache(): void {\n    this.imageStyles = null\n  }\n\n  // ---------------------------------------------------------------\n  // Upload — the key convenience method\n  // ---------------------------------------------------------------\n\n  /**\n   * Upload a file and create a media entity record in one step.\n   * 1. Uploads original to storage (StorageClient)\n   * 2. If image: extracts dimensions via Sharp + generates variants\n   * 3. Creates media entity record (AdminClient)\n   * 4. Returns the media record + URL\n   *\n   * Rolls back storage upload if entity creation fails.\n   * Variant generation failures are logged but don't fail the upload.\n   */\n  async upload(\n    data: Buffer | ReadableStream<Uint8Array>,\n    options: MediaUploadOptions,\n  ): Promise<MediaUploadResult> {\n    // 1. Upload original file to storage\n    const fileRecord = await this.storage.upload(data, {\n      filename: options.filename,\n      mimeType: options.mimeType,\n      size: options.size,\n      visibility: options.visibility,\n      uploadedBy: options.uploadedBy,\n    })\n\n    // 2. Image processing — extract dimensions + generate variants\n    let width = options.width ?? null\n    let height = options.height ?? null\n    const variantKeys: Record<string, string> = {}\n\n    if (data instanceof Buffer && isProcessableImage(options.mimeType)) {\n      try {\n        const styles = await this.resolveImageStyles()\n        const processed = await processImage(data, styles)\n\n        // Set dimensions from Sharp metadata\n        width = processed.width\n        height = processed.height\n\n        // Upload each variant to storage\n        const visibility = fileRecord.visibility\n        await Promise.all(\n          [...processed.variants.entries()].map(async ([styleName, variant]) => {\n            const vKey = deriveVariantKey(fileRecord.key, styleName, variant.format)\n            try {\n              await this.storage.upload(variant.buffer, {\n                key: vKey,\n                filename: `${styleName}_${options.filename}`,\n                mimeType: variant.mimeType,\n                size: variant.buffer.byteLength,\n                visibility,\n                metadata: { variantOf: fileRecord.key, style: styleName },\n                uploadedBy: options.uploadedBy,\n              })\n              variantKeys[styleName] = vKey\n            } catch {\n              // Variant upload failure is non-fatal — original is saved\n            }\n          }),\n        )\n\n        // Store variant keys in original file's metadata\n        if (Object.keys(variantKeys).length > 0) {\n          await this.storage\n            .updateMetadata(fileRecord.key, {\n              metadata: {\n                ...(fileRecord.metadata ?? {}),\n                variants: variantKeys,\n              },\n            })\n            .catch(() => {\n              // Metadata update failure is non-fatal\n            })\n        }\n      } catch {\n        // Image processing failure is non-fatal — original is saved\n      }\n    }\n\n    // 3. Create media entity record\n    const mediaType = deriveMediaType(options.mimeType)\n\n    try {\n      const entityRecord = await this.admin.create({\n        title: options.title ?? deriveTitle(options.filename),\n        alt: options.alt ?? null,\n        description: options.description ?? null,\n        fileKey: fileRecord.key,\n        filename: options.filename,\n        mimeType: options.mimeType,\n        size: options.size,\n        width,\n        height,\n        mediaType,\n      })\n\n      // 4. Get URL\n      const url = await this.storage.getUrl(fileRecord.key)\n\n      return {\n        media: entityRecord,\n        url,\n      }\n    } catch (error) {\n      // Rollback: delete variants + original if entity creation fails\n\n      // Delete variants first (best-effort)\n      for (const vKey of Object.values(variantKeys)) {\n        await this.storage.delete(vKey).catch(() => {})\n      }\n\n      // Delete original\n      await this.storage.delete(fileRecord.key).catch(() => {\n        // Storage rollback failure is already being handled — propagate original error\n      })\n      throw error\n    }\n  }\n\n  // ---------------------------------------------------------------\n  // CRUD delegation\n  // ---------------------------------------------------------------\n\n  async findById(id: string, options?: { locale?: string }): Promise<MediaRecord | null> {\n    return this.admin.findById(id, options)\n  }\n\n  async findMany(options?: MediaListOptions): Promise<MediaListResult> {\n    const { schemaRegistry } = await import('@murumets-ee/db')\n    const { and, asc, desc, eq, ilike, or, sql } = await import('drizzle-orm')\n\n    const table = schemaRegistry.get('media')\n    if (!table) throw new Error('Media schema not registered. Is the media() plugin loaded?')\n\n    // Build where conditions\n    const conditions = []\n\n    if (options?.mediaType) {\n      conditions.push(eq(table.mediaType, options.mediaType))\n    }\n    if (options?.mimeTypePrefix) {\n      // Escape ILIKE wildcards (%, _) in user input to prevent pattern injection\n      const escaped = options.mimeTypePrefix.replace(/[\\\\%_]/g, '\\\\$&')\n      conditions.push(ilike(table.mimeType, `${escaped}%`))\n    }\n    if (options?.search) {\n      // Escape ILIKE wildcards in user input, then wrap with %...%\n      const escaped = options.search.replace(/[\\\\%_]/g, '\\\\$&')\n      const pattern = `%${escaped}%`\n      conditions.push(\n        or(\n          ilike(table.filename, pattern),\n          sql`${table.fields} ->> 'title' ILIKE ${pattern}`,\n        )!,\n      )\n    }\n\n    const limit = options?.limit ?? 50\n    const offset = options?.offset ?? 0\n    const whereClause = conditions.length > 0 ? and(...conditions) : undefined\n\n    // Count total via AdminClient\n    const total = await this.admin.count({ where: whereClause })\n\n    // Fetch items via AdminClient for proper DTO shaping\n    const orderField = options?.orderBy === 'filename' ? table.filename : table.createdAt\n    const orderFn = (options?.orderDirection ?? 'desc') === 'asc' ? asc : desc\n\n    const items = await this.admin.findMany({\n      where: whereClause,\n      limit,\n      offset,\n      orderBy: orderFn(orderField),\n    })\n\n    return {\n      items,\n      total,\n      limit,\n      offset,\n    }\n  }\n\n  async update(\n    id: string,\n    data: { title?: string; alt?: string; description?: string },\n  ): Promise<MediaRecord> {\n    return this.admin.update(id, data)\n  }\n\n  /**\n   * Delete a media entity, its variants, and its original file in storage.\n   */\n  async delete(id: string): Promise<void> {\n    const record = await this.admin.findById(id)\n    if (!record) throw new Error(`Media not found: ${id}`)\n\n    const fileKey = record.fileKey\n\n    // 1. Delete entity first (ref checking via entity_refs happens here)\n    await this.admin.delete(id)\n\n    // 2. Look up original file record for variant metadata\n    const fileRecord = await this.storage.getMetadata(fileKey)\n    const variants = (fileRecord?.metadata as Record<string, unknown> | null)?.variants as\n      | Record<string, string>\n      | undefined\n\n    // 3. Delete variants (best-effort)\n    if (variants) {\n      for (const vKey of Object.values(variants)) {\n        await this.storage.delete(vKey).catch(() => {\n          // Variant deletion failure is non-fatal\n        })\n      }\n    }\n\n    // 4. Delete original file (best-effort)\n    await this.storage.delete(fileKey).catch(() => {\n      // Storage deletion failure is non-fatal — entity is already deleted\n    })\n  }\n\n  // ---------------------------------------------------------------\n  // URL resolution\n  // ---------------------------------------------------------------\n\n  /**\n   * Get URL for a media entity by its ID.\n   * Resolves entity -> fileKey -> storage URL.\n   */\n  async getUrl(id: string): Promise<string> {\n    const record = await this.admin.findById(id)\n    if (!record) throw new Error(`Media not found: ${id}`)\n\n    return this.storage.getUrl(record.fileKey)\n  }\n\n  /**\n   * Get URLs for multiple media entities (batch).\n   * Returns a Map of mediaId -> url.\n   */\n  async getUrls(ids: string[]): Promise<Map<string, string>> {\n    if (ids.length === 0) return new Map()\n\n    const { schemaRegistry } = await import('@murumets-ee/db')\n    const { inArray } = await import('drizzle-orm')\n\n    const table = schemaRegistry.get('media')\n    if (!table) return new Map()\n\n    const records = await this.admin.findMany({\n      where: inArray(table.id, ids),\n      limit: ids.length,\n    })\n\n    const urlMap = new Map<string, string>()\n\n    await Promise.all(\n      records.map(async (record) => {\n        const url = await this.storage.getUrl(record.fileKey)\n        urlMap.set(record.id, url)\n      }),\n    )\n\n    return urlMap\n  }\n\n  /**\n   * Get variant URL for a specific image style.\n   * Falls back to original URL if the variant doesn't exist.\n   *\n   * @param id - Media entity ID\n   * @param styleName - Image style name (e.g., 'thumbnail')\n   * @returns The variant URL, or original URL as fallback, or null if media not found\n   */\n  async getVariantUrl(id: string, styleName: string): Promise<string | null> {\n    const record = await this.admin.findById(id)\n    if (!record) return null\n\n    const fileKey = record.fileKey\n\n    // Try variant key first\n    const styles = await this.resolveImageStyles()\n    const style = styles[styleName]\n    if (style) {\n      const vKey = deriveVariantKey(fileKey, styleName, style.format ?? 'webp')\n      try {\n        return await this.storage.getUrl(vKey)\n      } catch {\n        // Variant doesn't exist — fall back to original\n      }\n    }\n\n    // Fallback to original\n    try {\n      return await this.storage.getUrl(fileKey)\n    } catch {\n      return null\n    }\n  }\n\n  /**\n   * Get variant URLs for multiple media entities (batch).\n   * Falls back to original URL per item if the variant doesn't exist.\n   *\n   * @param ids - Media entity IDs\n   * @param styleName - Image style name (e.g., 'thumbnail')\n   * @returns Map of mediaId -> variant URL (or original URL as fallback)\n   */\n  async getVariantUrls(ids: string[], styleName: string): Promise<Map<string, string>> {\n    if (ids.length === 0) return new Map()\n\n    const { schemaRegistry } = await import('@murumets-ee/db')\n    const { inArray } = await import('drizzle-orm')\n\n    const table = schemaRegistry.get('media')\n    if (!table) return new Map()\n\n    const records = await this.admin.findMany({\n      where: inArray(table.id, ids),\n      limit: ids.length,\n    })\n\n    const styles = await this.resolveImageStyles()\n    const style = styles[styleName]\n    const urlMap = new Map<string, string>()\n\n    await Promise.all(\n      records.map(async (record) => {\n        // Try variant URL\n        if (style) {\n          const vKey = deriveVariantKey(record.fileKey, styleName, style.format ?? 'webp')\n          try {\n            const url = await this.storage.getUrl(vKey)\n            urlMap.set(record.id, url)\n            return\n          } catch {\n            // Variant doesn't exist — fall back to original\n          }\n        }\n\n        // Fallback to original\n        try {\n          const url = await this.storage.getUrl(record.fileKey)\n          urlMap.set(record.id, url)\n        } catch {\n          // Skip — no URL available\n        }\n      }),\n    )\n\n    return urlMap\n  }\n}\n\n// ---------------------------------------------------------------\n// Helpers\n// ---------------------------------------------------------------\n\nfunction deriveMediaType(mimeType: string): MediaType {\n  if (mimeType.startsWith('image/')) return 'image'\n  if (mimeType.startsWith('video/')) return 'video'\n  if (mimeType.startsWith('audio/')) return 'audio'\n  if (\n    mimeType === 'application/pdf' ||\n    mimeType.startsWith('application/msword') ||\n    mimeType.startsWith('application/vnd.')\n  ) {\n    return 'document'\n  }\n  return 'other'\n}\n\nfunction deriveTitle(filename: string): string {\n  const withoutExt = filename.replace(/\\.[^.]+$/, '')\n  return withoutExt.replace(/[-_]/g, ' ')\n}\n\n/**\n * Factory — creates a MediaClient with an explicit StorageClient.\n * Must be called after createApp().\n */\nexport async function createMediaClient(storage: StorageClient): Promise<MediaClient> {\n  const { createAdminClient } = await import('@murumets-ee/core/clients')\n  const admin = createAdminClient(Media)\n  return new MediaClient({ admin, storage })\n}\n\n// ---------------------------------------------------------------------------\n// Per-request MediaClient factory\n// ---------------------------------------------------------------------------\n//\n// NOTE: Storage config is process-global and safe to cache.\n// MediaClient / AdminClient must be built per-request — they carry a\n// context resolver tied to the calling request's user + permissions.\n// A singleton would leak one request's security context across others.\n\n/**\n * The storage singleton, which does NOT pin a failed initialisation.\n *\n * `_storagePromise ??= (...)()` used to cache the rejected promise too, so a\n * transient failure during storage init (config not yet loaded, a DB blip)\n * broke every subsequent caller until the process restarted. That mattered\n * little while this served admin operations; `plan/api` PR 5 puts it on the\n * ANONYMOUS request path via `getSharedStorageClient`, where the symptom\n * becomes every image on the site failing permanently with no recovery short of\n * a redeploy. See `cacheOnceUnlessRejected`, which is unit-tested.\n */\nconst _storageOnce = cacheOnceUnlessRejected<StorageClient>(async () => {\n  const { getApp } = await import('@murumets-ee/core')\n  const { createStorageClient } = await import('@murumets-ee/storage')\n  const { getStorageConfig } = await import('@murumets-ee/storage/plugin')\n  const app = getApp()\n  return createStorageClient(getStorageConfig(), { app })\n})\n\n/**\n * The process-wide `StorageClient`, built once from the storage plugin config.\n *\n * Exported so the PUBLIC media resolver (`./public-resolver.ts`) reaches the\n * same instance rather than constructing a second one from a copy of these two\n * lines. Safe to share, and unlike `MediaClient`/`AdminClient` it MUST NOT be\n * rebuilt per request: it carries no security context — the read-side gate\n * lives in whichever client resolves the media rows, not here.\n */\nexport async function getSharedStorageClient(): Promise<StorageClient> {\n  return getStorageSingleton()\n}\n\nasync function getStorageSingleton(): Promise<StorageClient> {\n  return _storageOnce()\n}\n\n/**\n * Returns a fresh MediaClient wired to the current request's context.\n * Must be called after createApp(), inside a request context\n * (withAdminContext, runAsCli, etc.).\n *\n * Despite the name, this is NOT cached — the storage config is cached\n * internally but the MediaClient and its AdminClient are rebuilt per call\n * so the security context resolver attaches to the correct request.\n */\nexport async function getMediaClient(): Promise<MediaClient> {\n  const { createAdminClient } = await import('@murumets-ee/core/clients')\n  const storage = await getStorageSingleton()\n  const admin = createAdminClient(Media)\n  return new MediaClient({ admin, storage })\n}\n"],"mappings":"+GCoCA,IAAa,EAAb,KAAyB,CACvB,MACA,QACA,YAEA,YAAY,EAA2B,CACrC,KAAK,MAAQ,EAAO,MACpB,KAAK,QAAU,EAAO,QACtB,KAAK,YAAc,EAAO,aAAe,IAC3C,CAOA,MAAc,oBAA0D,CACtE,GAAI,KAAK,YAAa,OAAO,KAAK,YAClC,GAAM,CAAE,UAAW,MAAM,OAAO,qBAC1B,CAAE,sBAAuB,MAAM,OAAO,uCACtC,EAAM,EAAO,EAEnB,MADA,MAAK,YAAc,MAAM,EAAmB,EAAK,EAAI,MAAM,EACpD,KAAK,WACd,CAGA,4BAAmC,CACjC,KAAK,YAAc,IACrB,CAgBA,MAAM,OACJ,EACA,EAC4B,CAE5B,IAAM,EAAa,MAAM,KAAK,QAAQ,OAAO,EAAM,CACjD,SAAU,EAAQ,SAClB,SAAU,EAAQ,SAClB,KAAM,EAAQ,KACd,WAAY,EAAQ,WACpB,WAAY,EAAQ,UACtB,CAAC,EAGG,EAAQ,EAAQ,OAAS,KACzB,EAAS,EAAQ,QAAU,KACzB,EAAsC,CAAC,EAE7C,GAAI,aAAgB,QAAU,EAAmB,EAAQ,QAAQ,EAC/D,GAAI,CAEF,IAAM,EAAY,MAAM,EAAa,EAAM,MADtB,KAAK,mBAAmB,CACI,EAGjD,EAAQ,EAAU,MAClB,EAAS,EAAU,OAGnB,IAAM,EAAa,EAAW,WAC9B,MAAM,QAAQ,IACZ,CAAC,GAAG,EAAU,SAAS,QAAQ,CAAC,CAAC,CAAC,IAAI,MAAO,CAAC,EAAW,KAAa,CACpE,IAAM,EAAO,EAAiB,EAAW,IAAK,EAAW,EAAQ,MAAM,EACvE,GAAI,CACF,MAAM,KAAK,QAAQ,OAAO,EAAQ,OAAQ,CACxC,IAAK,EACL,SAAU,GAAG,EAAU,GAAG,EAAQ,WAClC,SAAU,EAAQ,SAClB,KAAM,EAAQ,OAAO,WACrB,aACA,SAAU,CAAE,UAAW,EAAW,IAAK,MAAO,CAAU,EACxD,WAAY,EAAQ,UACtB,CAAC,EACD,EAAY,GAAa,CAC3B,MAAQ,CAER,CACF,CAAC,CACH,EAGI,OAAO,KAAK,CAAW,CAAC,CAAC,OAAS,GACpC,MAAM,KAAK,QACR,eAAe,EAAW,IAAK,CAC9B,SAAU,CACR,GAAI,EAAW,UAAY,CAAC,EAC5B,SAAU,CACZ,CACF,CAAC,CAAC,CACD,UAAY,CAEb,CAAC,CAEP,MAAQ,CAER,CAIF,IAAM,EAAY,EAAgB,EAAQ,QAAQ,EAElD,GAAI,CAiBF,MAAO,CACL,MAAO,MAjBkB,KAAK,MAAM,OAAO,CAC3C,MAAO,EAAQ,OAAS,EAAY,EAAQ,QAAQ,EACpD,IAAK,EAAQ,KAAO,KACpB,YAAa,EAAQ,aAAe,KACpC,QAAS,EAAW,IACpB,SAAU,EAAQ,SAClB,SAAU,EAAQ,SAClB,KAAM,EAAQ,KACd,QACA,SACA,WACF,CAAC,EAOC,IAAA,MAJgB,KAAK,QAAQ,OAAO,EAAW,GAAG,CAKpD,CACF,OAAS,EAAO,CAId,IAAK,IAAM,KAAQ,OAAO,OAAO,CAAW,EAC1C,MAAM,KAAK,QAAQ,OAAO,CAAI,CAAC,CAAC,UAAY,CAAC,CAAC,EAOhD,MAHA,MAAM,KAAK,QAAQ,OAAO,EAAW,GAAG,CAAC,CAAC,UAAY,CAEtD,CAAC,EACK,CACR,CACF,CAMA,MAAM,SAAS,EAAY,EAA4D,CACrF,OAAO,KAAK,MAAM,SAAS,EAAI,CAAO,CACxC,CAEA,MAAM,SAAS,EAAsD,CACnE,GAAM,CAAE,kBAAmB,MAAM,OAAO,mBAClC,CAAE,MAAK,MAAK,OAAM,KAAI,QAAO,KAAI,OAAQ,MAAM,OAAO,eAEtD,EAAQ,EAAe,IAAI,OAAO,EACxC,GAAI,CAAC,EAAO,MAAU,MAAM,4DAA4D,EAGxF,IAAM,EAAa,CAAC,EAKpB,GAHI,GAAS,WACX,EAAW,KAAK,EAAG,EAAM,UAAW,EAAQ,SAAS,CAAC,EAEpD,GAAS,eAAgB,CAE3B,IAAM,EAAU,EAAQ,eAAe,QAAQ,UAAW,MAAM,EAChE,EAAW,KAAK,EAAM,EAAM,SAAU,GAAG,EAAQ,EAAE,CAAC,CACtD,CACA,GAAI,GAAS,OAAQ,CAGnB,IAAM,EAAU,IADA,EAAQ,OAAO,QAAQ,UAAW,MACxB,EAAE,GAC5B,EAAW,KACT,EACE,EAAM,EAAM,SAAU,CAAO,EAC7B,CAAG,GAAG,EAAM,OAAO,qBAAqB,GAC1C,CACF,CACF,CAEA,IAAM,EAAQ,GAAS,OAAS,GAC1B,EAAS,GAAS,QAAU,EAC5B,EAAc,EAAW,OAAS,EAAI,EAAI,GAAG,CAAU,EAAI,IAAA,GAG3D,EAAQ,MAAM,KAAK,MAAM,MAAM,CAAE,MAAO,CAAY,CAAC,EAGrD,EAAa,GAAS,UAAY,WAAa,EAAM,SAAW,EAAM,UACtE,GAAW,GAAS,gBAAkB,UAAY,MAAQ,EAAM,EAStE,MAAO,CACL,MAAA,MARkB,KAAK,MAAM,SAAS,CACtC,MAAO,EACP,QACA,SACA,QAAS,EAAQ,CAAU,CAC7B,CAAC,EAIC,QACA,QACA,QACF,CACF,CAEA,MAAM,OACJ,EACA,EACsB,CACtB,OAAO,KAAK,MAAM,OAAO,EAAI,CAAI,CACnC,CAKA,MAAM,OAAO,EAA2B,CACtC,IAAM,EAAS,MAAM,KAAK,MAAM,SAAS,CAAE,EAC3C,GAAI,CAAC,EAAQ,MAAU,MAAM,oBAAoB,GAAI,EAErD,IAAM,EAAU,EAAO,QAGvB,MAAM,KAAK,MAAM,OAAO,CAAE,EAI1B,IAAM,GAAY,MADO,KAAK,QAAQ,YAAY,CAAO,EAAA,EAC3B,UAA6C,SAK3E,GAAI,EACF,IAAK,IAAM,KAAQ,OAAO,OAAO,CAAQ,EACvC,MAAM,KAAK,QAAQ,OAAO,CAAI,CAAC,CAAC,UAAY,CAE5C,CAAC,EAKL,MAAM,KAAK,QAAQ,OAAO,CAAO,CAAC,CAAC,UAAY,CAE/C,CAAC,CACH,CAUA,MAAM,OAAO,EAA6B,CACxC,IAAM,EAAS,MAAM,KAAK,MAAM,SAAS,CAAE,EAC3C,GAAI,CAAC,EAAQ,MAAU,MAAM,oBAAoB,GAAI,EAErD,OAAO,KAAK,QAAQ,OAAO,EAAO,OAAO,CAC3C,CAMA,MAAM,QAAQ,EAA6C,CACzD,GAAI,EAAI,SAAW,EAAG,OAAO,IAAI,IAEjC,GAAM,CAAE,kBAAmB,MAAM,OAAO,mBAClC,CAAE,WAAY,MAAM,OAAO,eAE3B,EAAQ,EAAe,IAAI,OAAO,EACxC,GAAI,CAAC,EAAO,OAAO,IAAI,IAEvB,IAAM,EAAU,MAAM,KAAK,MAAM,SAAS,CACxC,MAAO,EAAQ,EAAM,GAAI,CAAG,EAC5B,MAAO,EAAI,MACb,CAAC,EAEK,EAAS,IAAI,IASnB,OAPA,MAAM,QAAQ,IACZ,EAAQ,IAAI,KAAO,IAAW,CAC5B,IAAM,EAAM,MAAM,KAAK,QAAQ,OAAO,EAAO,OAAO,EACpD,EAAO,IAAI,EAAO,GAAI,CAAG,CAC3B,CAAC,CACH,EAEO,CACT,CAUA,MAAM,cAAc,EAAY,EAA2C,CACzE,IAAM,EAAS,MAAM,KAAK,MAAM,SAAS,CAAE,EAC3C,GAAI,CAAC,EAAQ,OAAO,KAEpB,IAAM,EAAU,EAAO,QAIjB,GAAQ,MADO,KAAK,mBAAmB,EAAA,CACxB,GACrB,GAAI,EAAO,CACT,IAAM,EAAO,EAAiB,EAAS,EAAW,EAAM,QAAU,MAAM,EACxE,GAAI,CACF,OAAO,MAAM,KAAK,QAAQ,OAAO,CAAI,CACvC,MAAQ,CAER,CACF,CAGA,GAAI,CACF,OAAO,MAAM,KAAK,QAAQ,OAAO,CAAO,CAC1C,MAAQ,CACN,OAAO,IACT,CACF,CAUA,MAAM,eAAe,EAAe,EAAiD,CACnF,GAAI,EAAI,SAAW,EAAG,OAAO,IAAI,IAEjC,GAAM,CAAE,kBAAmB,MAAM,OAAO,mBAClC,CAAE,WAAY,MAAM,OAAO,eAE3B,EAAQ,EAAe,IAAI,OAAO,EACxC,GAAI,CAAC,EAAO,OAAO,IAAI,IAEvB,IAAM,EAAU,MAAM,KAAK,MAAM,SAAS,CACxC,MAAO,EAAQ,EAAM,GAAI,CAAG,EAC5B,MAAO,EAAI,MACb,CAAC,EAGK,GAAQ,MADO,KAAK,mBAAmB,EAAA,CACxB,GACf,EAAS,IAAI,IA0BnB,OAxBA,MAAM,QAAQ,IACZ,EAAQ,IAAI,KAAO,IAAW,CAE5B,GAAI,EAAO,CACT,IAAM,EAAO,EAAiB,EAAO,QAAS,EAAW,EAAM,QAAU,MAAM,EAC/E,GAAI,CACF,IAAM,EAAM,MAAM,KAAK,QAAQ,OAAO,CAAI,EAC1C,EAAO,IAAI,EAAO,GAAI,CAAG,EACzB,MACF,MAAQ,CAER,CACF,CAGA,GAAI,CACF,IAAM,EAAM,MAAM,KAAK,QAAQ,OAAO,EAAO,OAAO,EACpD,EAAO,IAAI,EAAO,GAAI,CAAG,CAC3B,MAAQ,CAER,CACF,CAAC,CACH,EAEO,CACT,CACF,EAMA,SAAS,EAAgB,EAA6B,CAWpD,OAVI,EAAS,WAAW,QAAQ,EAAU,QACtC,EAAS,WAAW,QAAQ,EAAU,QACtC,EAAS,WAAW,QAAQ,EAAU,QAExC,IAAa,mBACb,EAAS,WAAW,oBAAoB,GACxC,EAAS,WAAW,kBAAkB,EAE/B,WAEF,OACT,CAEA,SAAS,EAAY,EAA0B,CAE7C,OADmB,EAAS,QAAQ,WAAY,EAChC,CAAC,CAAC,QAAQ,QAAS,GAAG,CACxC"}

package/dist/picker.d.mts

@@ -1,4 +1,5 @@
 
+import { LucideIcon } from "lucide-react";
 import { ReactNode } from "react";
 
 //#region src/picker/types.d.ts
@@ -173,6 +174,37 @@ declare function MediaPicker({
   children
 }: MediaPickerProps): import("react/jsx-runtime").JSX.Element;
 //#endregion
+//#region src/picker/media-type-icon.d.ts
+/**
+ * The non-image members of `@murumets-ee/media`'s `MediaType`, copied rather
+ * than imported.
+ *
+ * This module ships from the `./picker` tsdown entry — a build SEPARATE from
+ * the root `index.ts` entry that already exports `MediaType` by name. Naming
+ * it here too would duplicate its declaration across two `.d.mts` files
+ * (`verify:dts`, #767): each array entry in `tsdown.config.ts` builds
+ * independently and cannot share a declaration chunk, so a type named in two
+ * entries' public APIs is emitted twice, and TypeScript can no longer treat
+ * the two copies as identical if either ever gains an invariant member.
+ *
+ * Kept honest by `media-type-icon.test.ts`, which imports the real
+ * `MediaType` (a type-only import, erased before it ever reaches a `.d.mts`)
+ * and asserts this literal still matches it exactly.
+ */
+type NonImageMediaType = 'video' | 'audio' | 'document' | 'other';
+/**
+ * The typed-icon fallback for every media type that is not `'image'`.
+ *
+ * The ONE rule three admin surfaces branch on (F115): the media list, the
+ * picker's `MediaCard` and the media edit form all show a real `<img>` for
+ * `mediaType === 'image'` and one of these icons otherwise. Extracted from
+ * `MediaCard`, which held the only copy, so a fourth surface reaches for this
+ * instead of writing a fourth `Record<MediaType, LucideIcon>`.
+ */
+declare const NON_IMAGE_MEDIA_TYPE_ICONS: Record<NonImageMediaType, LucideIcon>;
+/** The icon for a non-image media type, or `null` for `'image'` (render the asset itself). */
+declare function mediaTypeIcon(mediaType: 'image' | NonImageMediaType): LucideIcon | null;
+//#endregion
 //#region src/picker/provider.d.ts
 interface MediaPickerProviderProps extends MediaPickerCallbacks {
   children: ReactNode;
@@ -231,5 +263,5 @@ declare function UploadZone({
   classNames
 }: UploadZoneProps): import("react/jsx-runtime").JSX.Element;
 //#endregion
-export { type AdminMediaCallbacks, MediaCard, MediaGrid, MediaPicker, type MediaPickerCallbacks, type MediaPickerClassNames, type MediaPickerItem, type MediaPickerListResult, type MediaPickerMode, type MediaPickerProps, MediaPickerProvider, SearchBar, UploadZone, createAdminMediaCallbacks, useMediaPicker };
+export { type AdminMediaCallbacks, MediaCard, MediaGrid, MediaPicker, type MediaPickerCallbacks, type MediaPickerClassNames, type MediaPickerItem, type MediaPickerListResult, type MediaPickerMode, type MediaPickerProps, MediaPickerProvider, NON_IMAGE_MEDIA_TYPE_ICONS, SearchBar, UploadZone, createAdminMediaCallbacks, mediaTypeIcon, useMediaPicker };
 //# sourceMappingURL=picker.d.mts.map

package/dist/picker.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"picker.d.mts","names":[],"sources":["../src/picker/types.ts","../src/picker/admin-callbacks.ts","../src/picker/media-card.tsx","../src/picker/media-grid.tsx","../src/picker/media-picker.tsx","../src/picker/provider.tsx","../src/picker/search-bar.tsx","../src/picker/upload-zone.tsx"],"mappings":";;;;;UAGiB,eAAA;EACf,EAAA;EACA,KAAA;EACA,GAAA;EACA,QAAA;EACA,QAAA;EACA,IAAA;EACA,KAAA;EACA,MAAA;EACA,SAAA;EACA,GAAA;AAAA;;UAIe,qBAAA;EACf,KAAA,EAAO,eAAe;EACtB,KAAA;EANG;AAIL;;;;EAQE,UAAA;EAPO;EASP,MAAA;AAAA;;UAIe,oBAAA;EAJT;EAMN,UAAA,GAAa,OAAA;IACX,MAAA;IACA,SAAA;IACA,KAAA;IACA,MAAA;EAAA,MACI,OAAA,CAAQ,qBAAA;EAGuB;EAArC,WAAA,GAAc,IAAA,EAAM,IAAA,KAAS,OAAA,CAAQ,eAAA;AAAA;;KAI3B,eAAA;;UAGK,qBAAA;EACf,OAAA;EACA,OAAA;EACA,MAAA;EACA,KAAA;EACA,OAAA;EACA,WAAA;EACA,UAAA;EACA,IAAA;EACA,IAAA;EACA,YAAA;EACA,SAAA;EACA,SAAA;EACA,UAAA;EACA,gBAAA;EACA,MAAA;EACA,aAAA;EACA,YAAA;EACA,OAAA;EACA,KAAA;AAAA;;UAIe,gBAAA;EArBf;EAuBA,IAAA;EArBA;EAuBA,YAAA,GAAe,IAAA;EArBf;EAuBA,QAAA,GAAW,KAAA,EAAO,eAAA;EArBlB;EAuBA,IAAA,GAAO,eAAA;EArBP;EAuBA,MAAA;EArBA;EAuBA,SAAA;EArBA;EAuBA,SAAA;EArBA;EAuBA,WAAA;EArBA;EAuBA,KAAA;EAtBK;EAwBL,WAAA;EApBe;EAsBf,UAAA,GAAa,qBAAA;;EAEb,SAAA;EAhBO;EAkBP,QAAA,GAAW,SAAA;AAAA;;;;KCpFD,mBAAA,GAAsB,oBAAA;EAChC,WAAA,GAAc,EAAA,aAAe,OAAO;AAAA;;;;;ADDjC;AAIL;;;;;;;;;;AAUQ;AAIR;iBCGgB,yBAAA,CAA0B,WAAA,YAA6B,mBAAmB;;;UC9BhF,cAAA;EACR,IAAA,EAAM,eAAA;EACN,UAAA;EACA,QAAA;EACA,UAAA,GAAa,qBAAqB;AAAA;AAAA,iBAUpB,SAAA,CAAA;EAAY,IAAA;EAAM,UAAA;EAAY,QAAA;EAAU;AAAA,GAAc,cAAA,+BAAc,GAAA,CAAA,OAAA;;;UCd1E,cAAA;EACR,KAAA,EAAO,eAAA;EACP,QAAA,EAAU,GAAA;EACV,QAAA,GAAW,IAAA,EAAM,eAAA;EACjB,SAAA;EACA,KAAA;EACA,MAAA;EACA,KAAA;EACA,YAAA,GAAe,MAAA;EACf,UAAA,GAAa,qBAAA;AAAA;AAAA,iBAGC,SAAA,CAAA;EACd,KAAA;EACA,QAAA;EACA,QAAA;EACA,SAAA;EACA,KAAA;EACA,MAAA;EACA,KAAA;EACA,YAAA;EACA;AAAA,GACC,cAAA,+BAAc,GAAA,CAAA,OAAA;;;iBCbD,WAAA,CAAA;EACd,IAAA;EACA,YAAA;EACA,QAAA;EACA,IAAA;EACA,MAAA;EACA,SAAA;EACA,SAAA;EACA,WAAA;EACA,KAAA;EACA,WAAA;EACA,UAAA;EACA,SAAA;EACA;AAAA,GACC,gBAAA,+BAAgB,GAAA,CAAA,OAAA;;;UCtBF,wBAAA,SAAiC,oBAAoB;EACpE,QAAA,EAAU,SAAA;AAAA;;;;;;;;;;;;;;ALOP;iBKUW,mBAAA,CAAA;EACd,QAAA;EACA,UAAA;EACA;AAAA,GACC,wBAAA,+BAAwB,GAAA,CAAA,OAAA;AAAA,iBASX,cAAA,CAAA,GAAkB,oBAAoB;;;UChC5C,cAAA;EACR,KAAA;EACA,QAAA,GAAW,KAAA;EACX,SAAA;EACA,iBAAA,GAAoB,IAAA;ENLU;EMO9B,MAAA;EACA,UAAA,GAAa,qBAAqB;AAAA;AAAA,iBAWpB,SAAA,CAAA;EACd,KAAA;EACA,QAAA;EACA,SAAA;EACA,iBAAA;EACA,MAAA;EACA;AAAA,GACC,cAAA,+BAAc,GAAA,CAAA,OAAA;;;UCxBP,eAAA;EACR,QAAA,GAAW,IAAA,EAAM,IAAA,KAAS,OAAA;EAC1B,WAAA;EACA,MAAA;EACA,UAAA,GAAa,qBAAA;AAAA;AAAA,iBAGC,UAAA,CAAA;EAAa,QAAA;EAAU,WAAA;EAAa,MAAA;EAAQ;AAAA,GAAc,eAAA,+BAAe,GAAA,CAAA,OAAA"}
+{"version":3,"file":"picker.d.mts","names":[],"sources":["../src/picker/types.ts","../src/picker/admin-callbacks.ts","../src/picker/media-card.tsx","../src/picker/media-grid.tsx","../src/picker/media-picker.tsx","../src/picker/media-type-icon.ts","../src/picker/provider.tsx","../src/picker/search-bar.tsx","../src/picker/upload-zone.tsx"],"mappings":";;;;;;UAGiB,eAAA;EACf,EAAA;EACA,KAAA;EACA,GAAA;EACA,QAAA;EACA,QAAA;EACA,IAAA;EACA,KAAA;EACA,MAAA;EACA,SAAA;EACA,GAAA;AAAA;;UAIe,qBAAA;EACf,KAAA,EAAO,eAAe;EACtB,KAAA;EANG;AAAA;AAIL;;;EAQE,UAAA;EAPA;EASA,MAAA;AAAA;;UAIe,oBAAA;EAJT;EAMN,UAAA,GAAa,OAAA;IACX,MAAA;IACA,SAAA;IACA,KAAA;IACA,MAAA;EAAA,MACI,OAAA,CAAQ,qBAAA;EAGM;EAApB,WAAA,GAAc,IAAA,EAAM,IAAA,KAAS,OAAA,CAAQ,eAAA;AAAA;;KAI3B,eAAA;;UAGK,qBAAA;EACf,OAAA;EACA,OAAA;EACA,MAAA;EACA,KAAA;EACA,OAAA;EACA,WAAA;EACA,UAAA;EACA,IAAA;EACA,IAAA;EACA,YAAA;EACA,SAAA;EACA,SAAA;EACA,UAAA;EACA,gBAAA;EACA,MAAA;EACA,aAAA;EACA,YAAA;EACA,OAAA;EACA,KAAA;AAAA;;UAIe,gBAAA;EAtBf;EAwBA,IAAA;EAtBA;EAwBA,YAAA,GAAe,IAAA;EAtBf;EAwBA,QAAA,GAAW,KAAA,EAAO,eAAA;EAtBlB;EAwBA,IAAA,GAAO,eAAA;EAtBP;EAwBA,MAAA;EAtBA;EAwBA,SAAA;EAtBA;EAwBA,SAAA;EAtBA;EAwBA,WAAA;EAtBA;EAwBA,KAAA;EAtBA;EAwBA,WAAA;EAxBK;EA0BL,UAAA,GAAa,qBAAA;EAtBkB;EAwB/B,SAAA;EAlBkB;EAoBlB,QAAA,GAAW,SAAA;AAAA;;;;KCpFD,mBAAA,GAAsB,oBAAA;EAChC,WAAA,GAAc,EAAA,aAAe,OAAO;AAAA;;;;;;ADDjC;AAIL;;;;;;;;;;AAUQ;iBCOQ,yBAAA,CAA0B,WAAA,YAA6B,mBAAmB;;;UC7BhF,cAAA;EACR,IAAA,EAAM,eAAA;EACN,UAAA;EACA,QAAA;EACA,UAAA,GAAa,qBAAqB;AAAA;AAAA,iBAGpB,SAAA,CAAA;EAAY,IAAA;EAAM,UAAA;EAAY,QAAA;EAAU;AAAA,GAAc,cAAA,+BAAc,GAAA,CAAA,OAAA;;;UCR1E,cAAA;EACR,KAAA,EAAO,eAAA;EACP,QAAA,EAAU,GAAA;EACV,QAAA,GAAW,IAAA,EAAM,eAAA;EACjB,SAAA;EACA,KAAA;EACA,MAAA;EACA,KAAA;EACA,YAAA,GAAe,MAAA;EACf,UAAA,GAAa,qBAAA;AAAA;AAAA,iBAGC,SAAA,CAAA;EACd,KAAA;EACA,QAAA;EACA,QAAA;EACA,SAAA;EACA,KAAA;EACA,MAAA;EACA,KAAA;EACA,YAAA;EACA;AAAA,GACC,cAAA,+BAAc,GAAA,CAAA,OAAA;;;iBCbD,WAAA,CAAA;EACd,IAAA;EACA,YAAA;EACA,QAAA;EACA,IAAA;EACA,MAAA;EACA,SAAA;EACA,SAAA;EACA,WAAA;EACA,KAAA;EACA,WAAA;EACA,UAAA;EACA,SAAA;EACA;AAAA,GACC,gBAAA,+BAAgB,GAAA,CAAA,OAAA;;;;;;AJxBnB;;;;;;;;;;;;;KKeK,iBAAA;;ALLA;AAIL;;;;;;;cKYa,0BAAA,EAA4B,MAAA,CAAO,iBAAA,EAAmB,UAAA;;iBAQnD,aAAA,CAAc,SAAA,YAAqB,iBAAA,GAAoB,UAAU;;;UChChE,wBAAA,SAAiC,oBAAoB;EACpE,QAAA,EAAU,SAAA;AAAA;;;;;;;;;;;;;;;iBAiBI,mBAAA,CAAA;EACd,QAAA;EACA,UAAA;EACA;AAAA,GACC,wBAAA,+BAAwB,GAAA,CAAA,OAAA;AAAA,iBASX,cAAA,CAAA,GAAkB,oBAAoB;;;UChC5C,cAAA;EACR,KAAA;EACA,QAAA,GAAW,KAAA;EACX,SAAA;EACA,iBAAA,GAAoB,IAAA;;EAEpB,MAAA;EACA,UAAA,GAAa,qBAAqB;AAAA;AAAA,iBAWpB,SAAA,CAAA;EACd,KAAA;EACA,QAAA;EACA,SAAA;EACA,iBAAA;EACA,MAAA;EACA;AAAA,GACC,cAAA,+BAAc,GAAA,CAAA,OAAA;;;UCxBP,eAAA;EACR,QAAA,GAAW,IAAA,EAAM,IAAA,KAAS,OAAA;EAC1B,WAAA;EACA,MAAA;EACA,UAAA,GAAa,qBAAA;AAAA;AAAA,iBAGC,UAAA,CAAA;EAAa,QAAA;EAAU,WAAA;EAAa,MAAA;EAAQ;AAAA,GAAc,eAAA,+BAAe,GAAA,CAAA,OAAA"}

package/dist/picker.mjs

@@ -1,3 +1,3 @@
 "use client";
-import{Check as e,File as t,FileText as n,Film as r,Music as i,Search as a,Upload as o,X as s}from"lucide-react";import{clsx as c}from"clsx";import{twMerge as l}from"tailwind-merge";import{Fragment as u,jsx as d,jsxs as f}from"react/jsx-runtime";import*as p from"@radix-ui/react-dialog";import*as m from"@radix-ui/react-visually-hidden";import{createContext as h,useCallback as g,useContext as _,useEffect as v,useMemo as y,useRef as b,useState as x}from"react";function S(e=`/api/admin`){let t=`${e}/media`,n=async e=>{try{let t=await e.clone().json();if(typeof t.error==`string`&&t.error.length>0)return t.error}catch{}try{let t=await e.text();if(t)return t}catch{}return`HTTP ${String(e.status)}`};return{fetchMedia:async e=>{let r=new URLSearchParams;e.search&&r.set(`search`,e.search),e.mediaType&&r.set(`mediaType`,e.mediaType),r.set(`limit`,String(e.limit)),r.set(`offset`,String(e.offset));let i=`${t}?${r.toString()}`,a=await fetch(i);if(!a.ok)throw Error(await n(a));return a.json()},uploadMedia:async e=>{let r=new FormData;r.append(`file`,e),r.append(`visibility`,`public`);let i=await fetch(t,{method:`POST`,body:r});if(!i.ok)throw Error(await n(i));return i.json()},getMediaUrl:async e=>{try{let n=await fetch(`${t}/${e}`);return n.ok?(await n.json()).url??null:null}catch{return null}}}}function C(...e){return l(c(e))}const w={video:r,audio:i,document:n,other:t};function T({item:n,isSelected:r,onToggle:i,classNames:a}){let o=n.mediaType===`image`,s=o?null:w[n.mediaType]??t;return f(`button`,{type:`button`,onClick:i,className:C(`group relative aspect-square overflow-hidden rounded-lg border-2 transition-all`,`focus:outline-none focus:ring-2 focus:ring-blue-500 focus:ring-offset-2 dark:focus:ring-offset-zinc-950`,r?`border-blue-500 ring-2 ring-blue-500/20`:`border-zinc-200 hover:border-zinc-300 dark:border-zinc-800 dark:hover:border-zinc-700`,a?.card,r&&a?.cardSelected),children:[o?d(`img`,{src:n.url,alt:n.alt??n.filename,className:C(`h-full w-full object-cover`,a?.cardImage),loading:`lazy`}):d(`div`,{className:`flex h-full w-full items-center justify-center bg-zinc-100 dark:bg-zinc-800`,children:s&&d(s,{className:`h-8 w-8 text-zinc-400 dark:text-zinc-500`})}),r&&d(`div`,{className:`absolute right-1.5 top-1.5 flex h-5 w-5 items-center justify-center rounded-full bg-blue-500 text-white`,children:d(e,{className:`h-3 w-3`})}),d(`div`,{className:C(`absolute inset-x-0 bottom-0 bg-gradient-to-t from-black/60 to-transparent px-2 py-1.5`,`opacity-0 transition-opacity group-hover:opacity-100`,a?.cardLabel),children:d(`p`,{className:`truncate text-xs text-white`,children:n.title??n.filename})})]})}function E({items:e,selected:t,onToggle:n,isLoading:r,total:i,offset:a,limit:o,onPageChange:s,classNames:c}){if(r)return d(`div`,{className:C(`grid grid-cols-4 gap-3 sm:grid-cols-6`,c?.grid),children:Array.from({length:12}).map((e,t)=>d(`div`,{className:C(`aspect-square animate-pulse rounded-lg bg-zinc-100 dark:bg-zinc-800`,c?.loading)},`skeleton-${t.toString()}`))});if(e.length===0)return d(`div`,{className:C(`py-12 text-center text-sm text-zinc-500 dark:text-zinc-400`,c?.empty),children:`No media found. Upload a file to get started.`});let l=Math.ceil(i/o),p=Math.floor(a/o)+1;return f(u,{children:[d(`div`,{className:C(`grid grid-cols-4 gap-3 sm:grid-cols-6`,c?.grid),children:e.map(e=>d(T,{item:e,isSelected:t.has(e.id),onToggle:()=>n(e),classNames:c},e.id))}),l>1&&f(`div`,{className:`mt-4 flex items-center justify-center gap-2`,children:[d(`button`,{type:`button`,disabled:p<=1,onClick:()=>s(a-o),className:`rounded-md border border-zinc-300 px-3 py-1 text-sm disabled:opacity-50 dark:border-zinc-700`,children:`Prev`}),f(`span`,{className:`text-sm text-zinc-500 dark:text-zinc-400`,children:[p,` / `,l]}),d(`button`,{type:`button`,disabled:p>=l,onClick:()=>s(a+o),className:`rounded-md border border-zinc-300 px-3 py-1 text-sm disabled:opacity-50 dark:border-zinc-700`,children:`Next`})]})]})}const D=h(null);function O({children:e,fetchMedia:t,uploadMedia:n}){return d(D,{value:y(()=>({fetchMedia:t,uploadMedia:n}),[t,n]),children:e})}function k(){let e=_(D);if(!e)throw Error(`useMediaPicker must be used within <MediaPickerProvider>. Wrap your admin layout with <MediaPickerProvider fetchMedia={...} uploadMedia={...}>.`);return e}const A=[{value:void 0,label:`All`},{value:`image`,label:`Images`},{value:`video`,label:`Videos`},{value:`audio`,label:`Audio`},{value:`document`,label:`Docs`}];function j({value:e,onChange:t,mediaType:n,onMediaTypeChange:r,locked:i,classNames:o}){let s=!i;return f(`div`,{className:`flex items-center gap-3`,children:[f(`div`,{className:`relative flex-1`,children:[d(a,{className:`absolute left-3 top-1/2 h-4 w-4 -translate-y-1/2 text-zinc-400`}),d(`input`,{type:`text`,value:e,onChange:e=>t(e.target.value),placeholder:`Search media...`,className:C(`w-full rounded-md border border-zinc-300 bg-transparent py-2 pl-10 pr-3 text-sm`,`placeholder:text-zinc-400 focus:border-blue-500 focus:outline-none focus:ring-1 focus:ring-blue-500`,`dark:border-zinc-700 dark:placeholder:text-zinc-500`,o?.searchInput)})]}),s&&d(`div`,{className:C(`flex gap-1`,o?.filterTabs),children:A.map(e=>d(`button`,{type:`button`,onClick:()=>r(e.value),className:C(`rounded-md px-3 py-1.5 text-xs font-medium transition-colors`,n===e.value?`bg-zinc-900 text-white dark:bg-zinc-100 dark:text-zinc-900`:`text-zinc-600 hover:bg-zinc-100 dark:text-zinc-400 dark:hover:bg-zinc-800`),children:e.label},e.label))})]})}function M({onUpload:e,isUploading:t,accept:n,classNames:r}){let i=b(null),[a,s]=x(!1),c=g(async t=>{t.preventDefault(),s(!1);let n=t.dataTransfer.files[0];n&&await e(n)},[e]),l=g(async t=>{let n=t.target.files?.[0];n&&(await e(n),t.target.value=``)},[e]);return f(`button`,{type:`button`,onDragOver:e=>{e.preventDefault(),s(!0)},onDragLeave:()=>s(!1),onDrop:c,onClick:()=>i.current?.click(),className:C(`mb-4 flex cursor-pointer flex-col items-center justify-center rounded-lg border-2 border-dashed px-6 py-6 transition-colors`,a?`border-blue-500 bg-blue-50 dark:bg-blue-950/20`:`border-zinc-300 hover:border-zinc-400 dark:border-zinc-700 dark:hover:border-zinc-600`,r?.uploadZone,a&&r?.uploadZoneActive),children:[d(o,{className:`mb-2 h-6 w-6 text-zinc-400 dark:text-zinc-500`}),d(`p`,{className:`text-sm text-zinc-600 dark:text-zinc-400`,children:t?`Uploading...`:`Drop a file here or click to upload`}),d(`input`,{ref:i,type:`file`,accept:n?.join(`,`),onChange:l,className:`hidden`})]})}function N({open:e,onOpenChange:t,onSelect:n,mode:r=`single`,accept:i,mediaType:a,maxSelect:o,selectedIds:c=[],title:l=`Select Media`,description:h,classNames:_,className:y,children:S}){let{fetchMedia:w,uploadMedia:T}=k(),[D,O]=x([]),[A,N]=x(0),[P,F]=x(()=>new Set(c)),[I,L]=x(``),[R,z]=x(a),[B,V]=x(!1),[H,U]=x(!1),[W,G]=x(0),[K,q]=x(null),[J,Y]=x(null),X=g(async()=>{V(!0),q(null);try{let e=await w({search:I||void 0,mediaType:R,limit:24,offset:W});e.configured===!1?(Y(e.reason??`Media storage is not configured on this server.`),O([]),N(0)):(Y(null),O(e.items),N(e.total))}catch(e){q(e instanceof Error&&e.message?`Failed to load media: ${e.message}`:`Failed to load media.`)}finally{V(!1)}},[w,I,R,W]);v(()=>{e&&X()},[e,X]);let Z=b(e),Q=b(c);Q.current=c,v(()=>{Z.current&&!e&&(L(``),G(0),F(new Set(Q.current))),Z.current=e},[e]);let $=g(e=>{if(r===`single`){n([e]),t(!1);return}F(t=>{let n=new Set(t);if(n.has(e.id))n.delete(e.id);else{if(o&&n.size>=o)return t;n.add(e.id)}return n})},[r,o,n,t]),ee=g(()=>{n(D.filter(e=>P.has(e.id))),t(!1)},[D,P,n,t]),te=g(async e=>{U(!0),q(null);try{let i=await T(e);if(r===`single`){n([i]),t(!1);return}O(e=>[i,...e]),N(e=>e+1),F(e=>new Set([...e,i.id]))}catch(e){q(e instanceof Error&&e.message?`Upload failed: ${e.message}`:`Upload failed. Please try again.`)}finally{U(!1)}},[T,r,n,t]);return d(p.Root,{open:e,onOpenChange:t,children:f(p.Portal,{children:[d(p.Overlay,{className:C(`fixed inset-0 z-50 bg-black/50 data-[state=open]:animate-in data-[state=closed]:animate-out data-[state=closed]:fade-out-0 data-[state=open]:fade-in-0`,_?.overlay)}),f(p.Content,{...!h&&{"aria-describedby":void 0},className:C(`fixed left-1/2 top-1/2 z-50 -translate-x-1/2 -translate-y-1/2`,`flex max-h-[85vh] w-[90vw] max-w-4xl flex-col`,`rounded-xl border border-zinc-200 bg-white shadow-2xl dark:border-zinc-800 dark:bg-zinc-950`,_?.content,y),children:[f(`div`,{className:C(`flex items-center justify-between border-b border-zinc-200 px-6 py-4 dark:border-zinc-800`,_?.header),children:[d(p.Title,{className:C(`text-lg font-semibold text-zinc-900 dark:text-zinc-50`,_?.title),children:l}),h&&d(m.Root,{asChild:!0,children:d(p.Description,{children:h})}),f(p.Close,{className:`rounded-sm opacity-70 transition-opacity hover:opacity-100 focus:outline-none focus:ring-2 focus:ring-zinc-400 dark:focus:ring-zinc-600`,children:[d(s,{className:`h-4 w-4`}),d(m.Root,{children:`Close`})]})]}),d(`div`,{className:C(`border-b border-zinc-200 px-6 py-3 dark:border-zinc-800`,_?.toolbar),children:d(j,{value:I,onChange:L,mediaType:R,onMediaTypeChange:z,locked:!!a,classNames:_})}),f(`div`,{className:`flex-1 overflow-y-auto px-6 py-4`,children:[K&&d(`div`,{role:`alert`,className:`mb-4 rounded-lg border border-red-200 bg-red-50 px-4 py-3 text-sm text-red-700 dark:border-red-900 dark:bg-red-950/50 dark:text-red-400`,children:K}),J?f(`div`,{role:`alert`,className:`rounded-lg border border-amber-200 bg-amber-50 px-4 py-6 text-center dark:border-amber-900 dark:bg-amber-950/30`,children:[d(`p`,{className:`text-sm font-medium text-amber-900 dark:text-amber-200`,children:`Media storage is not configured`}),d(`p`,{className:`mt-1 text-xs text-amber-800 dark:text-amber-300`,children:J}),d(`p`,{className:`mt-3 text-xs text-amber-700 dark:text-amber-400`,children:`Set the required environment variables and restart the app to enable uploads.`})]}):f(u,{children:[d(M,{onUpload:te,isUploading:H,accept:i,classNames:_}),d(E,{items:D,selected:P,onToggle:$,isLoading:B,total:A,offset:W,limit:24,onPageChange:G,classNames:_})]})]}),f(`div`,{className:C(`flex items-center justify-between border-t border-zinc-200 px-6 py-4 dark:border-zinc-800`,_?.footer),children:[d(`span`,{className:`text-sm text-zinc-500 dark:text-zinc-400`,children:r===`single`?`${A.toString()} item${A===1?``:`s`} — click to select`:P.size>0?`${P.size.toString()} selected`:`${A.toString()} item${A===1?``:`s`}`}),f(`div`,{className:`flex gap-2`,children:[S,d(p.Close,{asChild:!0,children:d(`button`,{type:`button`,className:C(`rounded-md border border-zinc-300 px-4 py-2 text-sm font-medium text-zinc-700 hover:bg-zinc-50`,`dark:border-zinc-700 dark:text-zinc-300 dark:hover:bg-zinc-900`,_?.cancelButton),children:`Cancel`})}),r!==`single`&&d(`button`,{type:`button`,onClick:ee,disabled:P.size===0,className:C(`rounded-md bg-blue-600 px-4 py-2 text-sm font-medium text-white hover:bg-blue-500`,`disabled:cursor-not-allowed disabled:opacity-50`,_?.confirmButton),children:`Select (${P.size.toString()})`})]})]})]})]})})}export{T as MediaCard,E as MediaGrid,N as MediaPicker,O as MediaPickerProvider,j as SearchBar,M as UploadZone,S as createAdminMediaCallbacks,k as useMediaPicker};
+import{Check as e,File as t,FileText as n,Film as r,Music as i,Search as a,Upload as o,X as s}from"lucide-react";import{clsx as c}from"clsx";import{twMerge as l}from"tailwind-merge";import{Fragment as u,jsx as d,jsxs as f}from"react/jsx-runtime";import*as p from"@radix-ui/react-dialog";import*as m from"@radix-ui/react-visually-hidden";import{createContext as h,useCallback as g,useContext as _,useEffect as v,useMemo as y,useRef as b,useState as x}from"react";function S(e=`/api/admin`){let t=`${e}/media`,n=async e=>{try{let t=await e.clone().json();if(typeof t.error==`string`&&t.error.length>0)return t.error}catch{}try{let t=await e.text();if(t)return t}catch{}return`HTTP ${String(e.status)}`};return{fetchMedia:async e=>{let r=new URLSearchParams;e.search&&r.set(`search`,e.search),e.mediaType&&r.set(`mediaType`,e.mediaType),r.set(`limit`,String(e.limit)),r.set(`offset`,String(e.offset));let i=`${t}?${r.toString()}`,a=await fetch(i);if(!a.ok)throw Error(await n(a));return a.json()},uploadMedia:async e=>{let r=new FormData;r.append(`file`,e),r.append(`visibility`,`public`);let i=await fetch(t,{method:`POST`,body:r});if(!i.ok)throw Error(await n(i));return i.json()},getMediaUrl:async e=>{try{let n=await fetch(`${t}/${e}`);return n.ok?(await n.json()).url??null:null}catch{return null}}}}function C(...e){return l(c(e))}const w={video:r,audio:i,document:n,other:t};function T(e){return e===`image`?null:w[e]}function E({item:t,isSelected:n,onToggle:r,classNames:i}){let a=t.mediaType===`image`,o=T(t.mediaType);return f(`button`,{type:`button`,onClick:r,className:C(`group relative aspect-square overflow-hidden rounded-lg border-2 transition-all`,`focus:outline-none focus:ring-2 focus:ring-blue-500 focus:ring-offset-2 dark:focus:ring-offset-zinc-950`,n?`border-blue-500 ring-2 ring-blue-500/20`:`border-zinc-200 hover:border-zinc-300 dark:border-zinc-800 dark:hover:border-zinc-700`,i?.card,n&&i?.cardSelected),children:[a?d(`img`,{src:t.url,alt:t.alt??t.filename,className:C(`h-full w-full object-cover`,i?.cardImage),loading:`lazy`}):d(`div`,{className:`flex h-full w-full items-center justify-center bg-zinc-100 dark:bg-zinc-800`,children:o&&d(o,{className:`h-8 w-8 text-zinc-400 dark:text-zinc-500`})}),n&&d(`div`,{className:`absolute right-1.5 top-1.5 flex h-5 w-5 items-center justify-center rounded-full bg-blue-500 text-white`,children:d(e,{className:`h-3 w-3`})}),d(`div`,{className:C(`absolute inset-x-0 bottom-0 bg-gradient-to-t from-black/60 to-transparent px-2 py-1.5`,`opacity-0 transition-opacity group-hover:opacity-100`,i?.cardLabel),children:d(`p`,{className:`truncate text-xs text-white`,children:t.title??t.filename})})]})}function D({items:e,selected:t,onToggle:n,isLoading:r,total:i,offset:a,limit:o,onPageChange:s,classNames:c}){if(r)return d(`div`,{className:C(`grid grid-cols-4 gap-3 sm:grid-cols-6`,c?.grid),children:Array.from({length:12}).map((e,t)=>d(`div`,{className:C(`aspect-square animate-pulse rounded-lg bg-zinc-100 dark:bg-zinc-800`,c?.loading)},`skeleton-${t.toString()}`))});if(e.length===0)return d(`div`,{className:C(`py-12 text-center text-sm text-zinc-500 dark:text-zinc-400`,c?.empty),children:`No media found. Upload a file to get started.`});let l=Math.ceil(i/o),p=Math.floor(a/o)+1;return f(u,{children:[d(`div`,{className:C(`grid grid-cols-4 gap-3 sm:grid-cols-6`,c?.grid),children:e.map(e=>d(E,{item:e,isSelected:t.has(e.id),onToggle:()=>n(e),classNames:c},e.id))}),l>1&&f(`div`,{className:`mt-4 flex items-center justify-center gap-2`,children:[d(`button`,{type:`button`,disabled:p<=1,onClick:()=>s(a-o),className:`rounded-md border border-zinc-300 px-3 py-1 text-sm disabled:opacity-50 dark:border-zinc-700`,children:`Prev`}),f(`span`,{className:`text-sm text-zinc-500 dark:text-zinc-400`,children:[p,` / `,l]}),d(`button`,{type:`button`,disabled:p>=l,onClick:()=>s(a+o),className:`rounded-md border border-zinc-300 px-3 py-1 text-sm disabled:opacity-50 dark:border-zinc-700`,children:`Next`})]})]})}const O=h(null);function k({children:e,fetchMedia:t,uploadMedia:n}){return d(O,{value:y(()=>({fetchMedia:t,uploadMedia:n}),[t,n]),children:e})}function A(){let e=_(O);if(!e)throw Error(`useMediaPicker must be used within <MediaPickerProvider>. Wrap your admin layout with <MediaPickerProvider fetchMedia={...} uploadMedia={...}>.`);return e}const j=[{value:void 0,label:`All`},{value:`image`,label:`Images`},{value:`video`,label:`Videos`},{value:`audio`,label:`Audio`},{value:`document`,label:`Docs`}];function M({value:e,onChange:t,mediaType:n,onMediaTypeChange:r,locked:i,classNames:o}){let s=!i;return f(`div`,{className:`flex items-center gap-3`,children:[f(`div`,{className:`relative flex-1`,children:[d(a,{className:`absolute left-3 top-1/2 h-4 w-4 -translate-y-1/2 text-zinc-400`}),d(`input`,{type:`text`,value:e,onChange:e=>t(e.target.value),placeholder:`Search media...`,className:C(`w-full rounded-md border border-zinc-300 bg-transparent py-2 pl-10 pr-3 text-sm`,`placeholder:text-zinc-400 focus:border-blue-500 focus:outline-none focus:ring-1 focus:ring-blue-500`,`dark:border-zinc-700 dark:placeholder:text-zinc-500`,o?.searchInput)})]}),s&&d(`div`,{className:C(`flex gap-1`,o?.filterTabs),children:j.map(e=>d(`button`,{type:`button`,onClick:()=>r(e.value),className:C(`rounded-md px-3 py-1.5 text-xs font-medium transition-colors`,n===e.value?`bg-zinc-900 text-white dark:bg-zinc-100 dark:text-zinc-900`:`text-zinc-600 hover:bg-zinc-100 dark:text-zinc-400 dark:hover:bg-zinc-800`),children:e.label},e.label))})]})}function N({onUpload:e,isUploading:t,accept:n,classNames:r}){let i=b(null),[a,s]=x(!1),c=g(async t=>{t.preventDefault(),s(!1);let n=t.dataTransfer.files[0];n&&await e(n)},[e]),l=g(async t=>{let n=t.target.files?.[0];n&&(await e(n),t.target.value=``)},[e]);return f(`button`,{type:`button`,onDragOver:e=>{e.preventDefault(),s(!0)},onDragLeave:()=>s(!1),onDrop:c,onClick:()=>i.current?.click(),className:C(`mb-4 flex cursor-pointer flex-col items-center justify-center rounded-lg border-2 border-dashed px-6 py-6 transition-colors`,a?`border-blue-500 bg-blue-50 dark:bg-blue-950/20`:`border-zinc-300 hover:border-zinc-400 dark:border-zinc-700 dark:hover:border-zinc-600`,r?.uploadZone,a&&r?.uploadZoneActive),children:[d(o,{className:`mb-2 h-6 w-6 text-zinc-400 dark:text-zinc-500`}),d(`p`,{className:`text-sm text-zinc-600 dark:text-zinc-400`,children:t?`Uploading...`:`Drop a file here or click to upload`}),d(`input`,{ref:i,type:`file`,accept:n?.join(`,`),onChange:l,className:`hidden`})]})}function P({open:e,onOpenChange:t,onSelect:n,mode:r=`single`,accept:i,mediaType:a,maxSelect:o,selectedIds:c=[],title:l=`Select Media`,description:h,classNames:_,className:y,children:S}){let{fetchMedia:w,uploadMedia:T}=A(),[E,O]=x([]),[k,j]=x(0),[P,F]=x(()=>new Set(c)),[I,L]=x(``),[R,z]=x(a),[B,V]=x(!1),[H,U]=x(!1),[W,G]=x(0),[K,q]=x(null),[J,Y]=x(null),X=g(async()=>{V(!0),q(null);try{let e=await w({search:I||void 0,mediaType:R,limit:24,offset:W});e.configured===!1?(Y(e.reason??`Media storage is not configured on this server.`),O([]),j(0)):(Y(null),O(e.items),j(e.total))}catch(e){q(e instanceof Error&&e.message?`Failed to load media: ${e.message}`:`Failed to load media.`)}finally{V(!1)}},[w,I,R,W]);v(()=>{e&&X()},[e,X]);let Z=b(e),Q=b(c);Q.current=c,v(()=>{Z.current&&!e&&(L(``),G(0),F(new Set(Q.current))),Z.current=e},[e]);let $=g(e=>{if(r===`single`){n([e]),t(!1);return}F(t=>{let n=new Set(t);if(n.has(e.id))n.delete(e.id);else{if(o&&n.size>=o)return t;n.add(e.id)}return n})},[r,o,n,t]),ee=g(()=>{n(E.filter(e=>P.has(e.id))),t(!1)},[E,P,n,t]),te=g(async e=>{U(!0),q(null);try{let i=await T(e);if(r===`single`){n([i]),t(!1);return}O(e=>[i,...e]),j(e=>e+1),F(e=>new Set([...e,i.id]))}catch(e){q(e instanceof Error&&e.message?`Upload failed: ${e.message}`:`Upload failed. Please try again.`)}finally{U(!1)}},[T,r,n,t]);return d(p.Root,{open:e,onOpenChange:t,children:f(p.Portal,{children:[d(p.Overlay,{className:C(`fixed inset-0 z-50 bg-black/50 data-[state=open]:animate-in data-[state=closed]:animate-out data-[state=closed]:fade-out-0 data-[state=open]:fade-in-0`,_?.overlay)}),f(p.Content,{...!h&&{"aria-describedby":void 0},className:C(`fixed left-1/2 top-1/2 z-50 -translate-x-1/2 -translate-y-1/2`,`flex max-h-[85vh] w-[90vw] max-w-4xl flex-col`,`rounded-xl border border-zinc-200 bg-white shadow-2xl dark:border-zinc-800 dark:bg-zinc-950`,_?.content,y),children:[f(`div`,{className:C(`flex items-center justify-between border-b border-zinc-200 px-6 py-4 dark:border-zinc-800`,_?.header),children:[d(p.Title,{className:C(`text-lg font-semibold text-zinc-900 dark:text-zinc-50`,_?.title),children:l}),h&&d(m.Root,{asChild:!0,children:d(p.Description,{children:h})}),f(p.Close,{className:`rounded-sm opacity-70 transition-opacity hover:opacity-100 focus:outline-none focus:ring-2 focus:ring-zinc-400 dark:focus:ring-zinc-600`,children:[d(s,{className:`h-4 w-4`}),d(m.Root,{children:`Close`})]})]}),d(`div`,{className:C(`border-b border-zinc-200 px-6 py-3 dark:border-zinc-800`,_?.toolbar),children:d(M,{value:I,onChange:L,mediaType:R,onMediaTypeChange:z,locked:!!a,classNames:_})}),f(`div`,{className:`flex-1 overflow-y-auto px-6 py-4`,children:[K&&d(`div`,{role:`alert`,className:`mb-4 rounded-lg border border-red-200 bg-red-50 px-4 py-3 text-sm text-red-700 dark:border-red-900 dark:bg-red-950/50 dark:text-red-400`,children:K}),J?f(`div`,{role:`alert`,className:`rounded-lg border border-amber-200 bg-amber-50 px-4 py-6 text-center dark:border-amber-900 dark:bg-amber-950/30`,children:[d(`p`,{className:`text-sm font-medium text-amber-900 dark:text-amber-200`,children:`Media storage is not configured`}),d(`p`,{className:`mt-1 text-xs text-amber-800 dark:text-amber-300`,children:J}),d(`p`,{className:`mt-3 text-xs text-amber-700 dark:text-amber-400`,children:`Set the required environment variables and restart the app to enable uploads.`})]}):f(u,{children:[d(N,{onUpload:te,isUploading:H,accept:i,classNames:_}),d(D,{items:E,selected:P,onToggle:$,isLoading:B,total:k,offset:W,limit:24,onPageChange:G,classNames:_})]})]}),f(`div`,{className:C(`flex items-center justify-between border-t border-zinc-200 px-6 py-4 dark:border-zinc-800`,_?.footer),children:[d(`span`,{className:`text-sm text-zinc-500 dark:text-zinc-400`,children:r===`single`?`${k.toString()} item${k===1?``:`s`} — click to select`:P.size>0?`${P.size.toString()} selected`:`${k.toString()} item${k===1?``:`s`}`}),f(`div`,{className:`flex gap-2`,children:[S,d(p.Close,{asChild:!0,children:d(`button`,{type:`button`,className:C(`rounded-md border border-zinc-300 px-4 py-2 text-sm font-medium text-zinc-700 hover:bg-zinc-50`,`dark:border-zinc-700 dark:text-zinc-300 dark:hover:bg-zinc-900`,_?.cancelButton),children:`Cancel`})}),r!==`single`&&d(`button`,{type:`button`,onClick:ee,disabled:P.size===0,className:C(`rounded-md bg-blue-600 px-4 py-2 text-sm font-medium text-white hover:bg-blue-500`,`disabled:cursor-not-allowed disabled:opacity-50`,_?.confirmButton),children:`Select (${P.size.toString()})`})]})]})]})]})})}export{E as MediaCard,D as MediaGrid,P as MediaPicker,k as MediaPickerProvider,w as NON_IMAGE_MEDIA_TYPE_ICONS,M as SearchBar,N as UploadZone,S as createAdminMediaCallbacks,T as mediaTypeIcon,A as useMediaPicker};
 //# sourceMappingURL=picker.mjs.map

package/dist/picker.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"picker.mjs","names":[],"sources":["../src/picker/admin-callbacks.ts","../src/lib/cn.ts","../src/picker/media-card.tsx","../src/picker/media-grid.tsx","../src/picker/provider.tsx","../src/picker/search-bar.tsx","../src/picker/upload-zone.tsx","../src/picker/media-picker.tsx"],"sourcesContent":["/**\n * Pre-built media callbacks that talk to the admin API.\n *\n * Eliminates boilerplate in every project — just call:\n *   const media = createAdminMediaCallbacks('/api/admin')\n *\n * Returns callbacks compatible with both MediaPickerProvider and\n * BlockEditor's `media` prop (with getMediaUrl for thumbnail previews).\n */\n\nimport type { MediaPickerCallbacks, MediaPickerItem, MediaPickerListResult } from './types'\n\n/** Extended callbacks with getMediaUrl (for editor thumbnail previews) */\nexport type AdminMediaCallbacks = MediaPickerCallbacks & {\n  getMediaUrl: (id: string) => Promise<string | null>\n}\n\n/**\n * Create media callbacks that talk to the admin API.\n *\n * @param apiBasePath - Base path for admin API (default: '/api/admin')\n * @returns Callbacks for MediaPickerProvider + BlockEditor media prop\n *\n * @example\n * ```tsx\n * import { createAdminMediaCallbacks } from '@murumets-ee/media/picker'\n *\n * const media = createAdminMediaCallbacks()\n * // Use with BlockEditor:\n * <BlockEditor media={media} ... />\n * // Use with MediaPickerProvider:\n * <MediaPickerProvider fetchMedia={media.fetchMedia} uploadMedia={media.uploadMedia}>\n * ```\n */\nexport function createAdminMediaCallbacks(apiBasePath = '/api/admin'): AdminMediaCallbacks {\n  const baseUrl = `${apiBasePath}/media`\n\n  // Admin API error responses are `{ error: string }`. Parse the body so\n  // the real cause (e.g. \"Missing required environment variable:\n  // STORAGE_ENDPOINT\") reaches the UI instead of just the status code.\n  const readErrorMessage = async (res: Response): Promise<string> => {\n    try {\n      const body = (await res.clone().json()) as { error?: unknown }\n      if (typeof body.error === 'string' && body.error.length > 0) return body.error\n    } catch {\n      // fall through — response wasn't JSON\n    }\n    try {\n      const text = await res.text()\n      if (text) return text\n    } catch {\n      // ignore\n    }\n    return `HTTP ${String(res.status)}`\n  }\n\n  return {\n    fetchMedia: async (options: {\n      search?: string | undefined\n      mediaType?: string | undefined\n      limit: number\n      offset: number\n    }): Promise<MediaPickerListResult> => {\n      const params = new URLSearchParams()\n      if (options.search) params.set('search', options.search)\n      if (options.mediaType) params.set('mediaType', options.mediaType)\n      params.set('limit', String(options.limit))\n      params.set('offset', String(options.offset))\n\n      const url = `${baseUrl}?${params.toString()}`\n      const res = await fetch(url)\n      if (!res.ok) throw new Error(await readErrorMessage(res))\n      return res.json() as Promise<MediaPickerListResult>\n    },\n\n    uploadMedia: async (file: File): Promise<MediaPickerItem> => {\n      const formData = new FormData()\n      formData.append('file', file)\n      // The media LIBRARY is publishable web assets, so it opts in explicitly.\n      // Without this the upload route's deny-by-default leaves the asset\n      // private, `getPublicUrls` returns nothing for it, and every image on the\n      // public site resolves to `null` behind a 200 and one warn log (F030).\n      // Sent per-upload rather than by flipping a global default, because the\n      // same route also receives rent's inspection photos, which must not be\n      // world-readable.\n      formData.append('visibility', 'public')\n\n      const res = await fetch(baseUrl, { method: 'POST', body: formData })\n      if (!res.ok) throw new Error(await readErrorMessage(res))\n      return res.json() as Promise<MediaPickerItem>\n    },\n\n    getMediaUrl: async (id: string): Promise<string | null> => {\n      try {\n        const res = await fetch(`${baseUrl}/${id}`)\n        if (!res.ok) return null\n        const item = (await res.json()) as MediaPickerItem\n        return item.url ?? null\n      } catch {\n        return null\n      }\n    },\n  }\n}\n","import { type ClassValue, clsx } from 'clsx'\nimport { twMerge } from 'tailwind-merge'\n\nexport function cn(...inputs: ClassValue[]) {\n  return twMerge(clsx(inputs))\n}\n","import { Check, File, FileText, Film, Music } from 'lucide-react'\nimport { cn } from '../lib/cn'\nimport type { MediaPickerClassNames, MediaPickerItem } from './types'\n\ninterface MediaCardProps {\n  item: MediaPickerItem\n  isSelected: boolean\n  onToggle: () => void\n  classNames?: MediaPickerClassNames | undefined\n}\n\nconst typeIcons = {\n  video: Film,\n  audio: Music,\n  document: FileText,\n  other: File,\n} as const\n\nexport function MediaCard({ item, isSelected, onToggle, classNames }: MediaCardProps) {\n  const isImage = item.mediaType === 'image'\n  const Icon = !isImage ? (typeIcons[item.mediaType as keyof typeof typeIcons] ?? File) : null\n\n  return (\n    <button\n      type=\"button\"\n      onClick={onToggle}\n      className={cn(\n        'group relative aspect-square overflow-hidden rounded-lg border-2 transition-all',\n        'focus:outline-none focus:ring-2 focus:ring-blue-500 focus:ring-offset-2 dark:focus:ring-offset-zinc-950',\n        isSelected\n          ? 'border-blue-500 ring-2 ring-blue-500/20'\n          : 'border-zinc-200 hover:border-zinc-300 dark:border-zinc-800 dark:hover:border-zinc-700',\n        classNames?.card,\n        isSelected && classNames?.cardSelected,\n      )}\n    >\n      {/* Thumbnail */}\n      {isImage ? (\n        <img\n          src={item.url}\n          alt={item.alt ?? item.filename}\n          className={cn('h-full w-full object-cover', classNames?.cardImage)}\n          loading=\"lazy\"\n        />\n      ) : (\n        <div className=\"flex h-full w-full items-center justify-center bg-zinc-100 dark:bg-zinc-800\">\n          {Icon && <Icon className=\"h-8 w-8 text-zinc-400 dark:text-zinc-500\" />}\n        </div>\n      )}\n\n      {/* Selection checkmark */}\n      {isSelected && (\n        <div className=\"absolute right-1.5 top-1.5 flex h-5 w-5 items-center justify-center rounded-full bg-blue-500 text-white\">\n          <Check className=\"h-3 w-3\" />\n        </div>\n      )}\n\n      {/* Filename on hover */}\n      <div\n        className={cn(\n          'absolute inset-x-0 bottom-0 bg-gradient-to-t from-black/60 to-transparent px-2 py-1.5',\n          'opacity-0 transition-opacity group-hover:opacity-100',\n          classNames?.cardLabel,\n        )}\n      >\n        <p className=\"truncate text-xs text-white\">{item.title ?? item.filename}</p>\n      </div>\n    </button>\n  )\n}\n","import { cn } from '../lib/cn'\nimport { MediaCard } from './media-card'\nimport type { MediaPickerClassNames, MediaPickerItem } from './types'\n\ninterface MediaGridProps {\n  items: MediaPickerItem[]\n  selected: Set<string>\n  onToggle: (item: MediaPickerItem) => void\n  isLoading: boolean\n  total: number\n  offset: number\n  limit: number\n  onPageChange: (offset: number) => void\n  classNames?: MediaPickerClassNames | undefined\n}\n\nexport function MediaGrid({\n  items,\n  selected,\n  onToggle,\n  isLoading,\n  total,\n  offset,\n  limit,\n  onPageChange,\n  classNames,\n}: MediaGridProps) {\n  if (isLoading) {\n    return (\n      <div className={cn('grid grid-cols-4 gap-3 sm:grid-cols-6', classNames?.grid)}>\n        {Array.from({ length: 12 }).map((_, i) => (\n          <div\n            key={`skeleton-${i.toString()}`}\n            className={cn(\n              'aspect-square animate-pulse rounded-lg bg-zinc-100 dark:bg-zinc-800',\n              classNames?.loading,\n            )}\n          />\n        ))}\n      </div>\n    )\n  }\n\n  if (items.length === 0) {\n    return (\n      <div\n        className={cn(\n          'py-12 text-center text-sm text-zinc-500 dark:text-zinc-400',\n          classNames?.empty,\n        )}\n      >\n        No media found. Upload a file to get started.\n      </div>\n    )\n  }\n\n  const totalPages = Math.ceil(total / limit)\n  const currentPage = Math.floor(offset / limit) + 1\n\n  return (\n    <>\n      <div className={cn('grid grid-cols-4 gap-3 sm:grid-cols-6', classNames?.grid)}>\n        {items.map((item) => (\n          <MediaCard\n            key={item.id}\n            item={item}\n            isSelected={selected.has(item.id)}\n            onToggle={() => onToggle(item)}\n            classNames={classNames}\n          />\n        ))}\n      </div>\n      {totalPages > 1 && (\n        <div className=\"mt-4 flex items-center justify-center gap-2\">\n          <button\n            type=\"button\"\n            disabled={currentPage <= 1}\n            onClick={() => onPageChange(offset - limit)}\n            className=\"rounded-md border border-zinc-300 px-3 py-1 text-sm disabled:opacity-50 dark:border-zinc-700\"\n          >\n            Prev\n          </button>\n          <span className=\"text-sm text-zinc-500 dark:text-zinc-400\">\n            {currentPage} / {totalPages}\n          </span>\n          <button\n            type=\"button\"\n            disabled={currentPage >= totalPages}\n            onClick={() => onPageChange(offset + limit)}\n            className=\"rounded-md border border-zinc-300 px-3 py-1 text-sm disabled:opacity-50 dark:border-zinc-700\"\n          >\n            Next\n          </button>\n        </div>\n      )}\n    </>\n  )\n}\n","import { createContext, type ReactNode, useContext, useMemo } from 'react'\nimport type { MediaPickerCallbacks } from './types'\n\nconst MediaPickerContext = createContext<MediaPickerCallbacks | null>(null)\n\nexport interface MediaPickerProviderProps extends MediaPickerCallbacks {\n  children: ReactNode\n}\n\n/**\n * Provides media picker callbacks to all picker instances below.\n * Wrap your admin layout with this provider.\n *\n * @example\n * ```tsx\n * <MediaPickerProvider\n *   fetchMedia={fetchMediaAction}\n *   uploadMedia={uploadMediaAction}\n * >\n *   <AdminShell>...</AdminShell>\n * </MediaPickerProvider>\n * ```\n */\nexport function MediaPickerProvider({\n  children,\n  fetchMedia,\n  uploadMedia,\n}: MediaPickerProviderProps) {\n  const value = useMemo<MediaPickerCallbacks>(\n    () => ({ fetchMedia, uploadMedia }),\n    [fetchMedia, uploadMedia],\n  )\n\n  return <MediaPickerContext value={value}>{children}</MediaPickerContext>\n}\n\nexport function useMediaPicker(): MediaPickerCallbacks {\n  const ctx = useContext(MediaPickerContext)\n  if (!ctx) {\n    throw new Error(\n      'useMediaPicker must be used within <MediaPickerProvider>. ' +\n        'Wrap your admin layout with <MediaPickerProvider fetchMedia={...} uploadMedia={...}>.',\n    )\n  }\n  return ctx\n}\n","import { Search } from 'lucide-react'\nimport { cn } from '../lib/cn'\nimport type { MediaPickerClassNames } from './types'\n\ninterface SearchBarProps {\n  value: string\n  onChange: (value: string) => void\n  mediaType: string | undefined\n  onMediaTypeChange: (type: string | undefined) => void\n  /** When true, the media type filter is locked (no tabs shown) */\n  locked?: boolean | undefined\n  classNames?: MediaPickerClassNames | undefined\n}\n\nconst FILTER_OPTIONS = [\n  { value: undefined, label: 'All' },\n  { value: 'image', label: 'Images' },\n  { value: 'video', label: 'Videos' },\n  { value: 'audio', label: 'Audio' },\n  { value: 'document', label: 'Docs' },\n] as const\n\nexport function SearchBar({\n  value,\n  onChange,\n  mediaType,\n  onMediaTypeChange,\n  locked,\n  classNames,\n}: SearchBarProps) {\n  // If locked (caller pre-set the mediaType), hide filter tabs\n  const showFilters = !locked\n\n  return (\n    <div className=\"flex items-center gap-3\">\n      <div className=\"relative flex-1\">\n        <Search className=\"absolute left-3 top-1/2 h-4 w-4 -translate-y-1/2 text-zinc-400\" />\n        <input\n          type=\"text\"\n          value={value}\n          onChange={(e) => onChange(e.target.value)}\n          placeholder=\"Search media...\"\n          className={cn(\n            'w-full rounded-md border border-zinc-300 bg-transparent py-2 pl-10 pr-3 text-sm',\n            'placeholder:text-zinc-400 focus:border-blue-500 focus:outline-none focus:ring-1 focus:ring-blue-500',\n            'dark:border-zinc-700 dark:placeholder:text-zinc-500',\n            classNames?.searchInput,\n          )}\n        />\n      </div>\n      {showFilters && (\n        <div className={cn('flex gap-1', classNames?.filterTabs)}>\n          {FILTER_OPTIONS.map((opt) => (\n            <button\n              key={opt.label}\n              type=\"button\"\n              onClick={() => onMediaTypeChange(opt.value)}\n              className={cn(\n                'rounded-md px-3 py-1.5 text-xs font-medium transition-colors',\n                mediaType === opt.value\n                  ? 'bg-zinc-900 text-white dark:bg-zinc-100 dark:text-zinc-900'\n                  : 'text-zinc-600 hover:bg-zinc-100 dark:text-zinc-400 dark:hover:bg-zinc-800',\n              )}\n            >\n              {opt.label}\n            </button>\n          ))}\n        </div>\n      )}\n    </div>\n  )\n}\n","import { Upload } from 'lucide-react'\nimport { type DragEvent, useCallback, useRef, useState } from 'react'\nimport { cn } from '../lib/cn'\nimport type { MediaPickerClassNames } from './types'\n\ninterface UploadZoneProps {\n  onUpload: (file: File) => Promise<void>\n  isUploading: boolean\n  accept?: string[] | undefined\n  classNames?: MediaPickerClassNames | undefined\n}\n\nexport function UploadZone({ onUpload, isUploading, accept, classNames }: UploadZoneProps) {\n  const inputRef = useRef<HTMLInputElement>(null)\n  const [isDragging, setIsDragging] = useState(false)\n\n  const handleDrop = useCallback(\n    async (e: DragEvent) => {\n      e.preventDefault()\n      setIsDragging(false)\n      const file = e.dataTransfer.files[0]\n      if (file) {\n        await onUpload(file)\n      }\n    },\n    [onUpload],\n  )\n\n  const handleFileSelect = useCallback(\n    async (e: React.ChangeEvent<HTMLInputElement>) => {\n      const file = e.target.files?.[0]\n      if (file) {\n        await onUpload(file)\n        e.target.value = ''\n      }\n    },\n    [onUpload],\n  )\n\n  return (\n    <button\n      type=\"button\"\n      onDragOver={(e) => {\n        e.preventDefault()\n        setIsDragging(true)\n      }}\n      onDragLeave={() => setIsDragging(false)}\n      onDrop={handleDrop}\n      onClick={() => inputRef.current?.click()}\n      className={cn(\n        'mb-4 flex cursor-pointer flex-col items-center justify-center rounded-lg border-2 border-dashed px-6 py-6 transition-colors',\n        isDragging\n          ? 'border-blue-500 bg-blue-50 dark:bg-blue-950/20'\n          : 'border-zinc-300 hover:border-zinc-400 dark:border-zinc-700 dark:hover:border-zinc-600',\n        classNames?.uploadZone,\n        isDragging && classNames?.uploadZoneActive,\n      )}\n    >\n      <Upload className=\"mb-2 h-6 w-6 text-zinc-400 dark:text-zinc-500\" />\n      <p className=\"text-sm text-zinc-600 dark:text-zinc-400\">\n        {isUploading ? 'Uploading...' : 'Drop a file here or click to upload'}\n      </p>\n      <input\n        ref={inputRef}\n        type=\"file\"\n        accept={accept?.join(',')}\n        onChange={handleFileSelect}\n        className=\"hidden\"\n      />\n    </button>\n  )\n}\n","import * as DialogPrimitive from '@radix-ui/react-dialog'\nimport * as VisuallyHidden from '@radix-ui/react-visually-hidden'\nimport { X } from 'lucide-react'\nimport { useCallback, useEffect, useRef, useState } from 'react'\nimport { cn } from '../lib/cn'\nimport { MediaGrid } from './media-grid'\nimport { useMediaPicker } from './provider'\nimport { SearchBar } from './search-bar'\nimport type { MediaPickerItem, MediaPickerProps } from './types'\nimport { UploadZone } from './upload-zone'\n\nconst ITEMS_PER_PAGE = 24\n\nexport function MediaPicker({\n  open,\n  onOpenChange,\n  onSelect,\n  mode = 'single',\n  accept,\n  mediaType,\n  maxSelect,\n  selectedIds = [],\n  title = 'Select Media',\n  description,\n  classNames,\n  className,\n  children,\n}: MediaPickerProps) {\n  const { fetchMedia, uploadMedia } = useMediaPicker()\n\n  // State\n  const [items, setItems] = useState<MediaPickerItem[]>([])\n  const [total, setTotal] = useState(0)\n  const [selected, setSelected] = useState<Set<string>>(() => new Set(selectedIds))\n  const [search, setSearch] = useState('')\n  const [mediaTypeFilter, setMediaTypeFilter] = useState<string | undefined>(mediaType)\n  const [isLoading, setIsLoading] = useState(false)\n  const [isUploading, setIsUploading] = useState(false)\n  const [offset, setOffset] = useState(0)\n  const [error, setError] = useState<string | null>(null)\n  // When the server reports storage isn't configured, we render a\n  // banner and hide the upload zone + grid instead of failing silently\n  // or showing an empty state the admin can't act on.\n  const [storageDisabled, setStorageDisabled] = useState<string | null>(null)\n\n  // Fetch media on open / filter change\n  const loadMedia = useCallback(async () => {\n    setIsLoading(true)\n    setError(null)\n    try {\n      const result = await fetchMedia({\n        search: search || undefined,\n        mediaType: mediaTypeFilter,\n        limit: ITEMS_PER_PAGE,\n        offset,\n      })\n      if (result.configured === false) {\n        setStorageDisabled(result.reason ?? 'Media storage is not configured on this server.')\n        setItems([])\n        setTotal(0)\n      } else {\n        setStorageDisabled(null)\n        setItems(result.items)\n        setTotal(result.total)\n      }\n    } catch (err) {\n      setError(\n        err instanceof Error && err.message\n          ? `Failed to load media: ${err.message}`\n          : 'Failed to load media.',\n      )\n    } finally {\n      setIsLoading(false)\n    }\n  }, [fetchMedia, search, mediaTypeFilter, offset])\n\n  useEffect(() => {\n    if (open) {\n      loadMedia()\n    }\n  }, [open, loadMedia])\n\n  // Reset state when dialog closes (open transitions true → false)\n  const prevOpen = useRef(open)\n  const selectedIdsRef = useRef(selectedIds)\n  selectedIdsRef.current = selectedIds\n  useEffect(() => {\n    if (prevOpen.current && !open) {\n      setSearch('')\n      setOffset(0)\n      setSelected(new Set(selectedIdsRef.current))\n    }\n    prevOpen.current = open\n  }, [open])\n\n  // Selection\n  const handleToggle = useCallback(\n    (item: MediaPickerItem) => {\n      // Single mode: auto-confirm on click — no separate \"Select\" step needed\n      if (mode === 'single') {\n        onSelect([item])\n        onOpenChange(false)\n        return\n      }\n\n      // Multi mode: toggle selection in the set\n      setSelected((prev) => {\n        const next = new Set(prev)\n        if (next.has(item.id)) {\n          next.delete(item.id)\n        } else {\n          if (maxSelect && next.size >= maxSelect) return prev\n          next.add(item.id)\n        }\n        return next\n      })\n    },\n    [mode, maxSelect, onSelect, onOpenChange],\n  )\n\n  const handleConfirm = useCallback(() => {\n    const selectedItems = items.filter((item) => selected.has(item.id))\n    onSelect(selectedItems)\n    onOpenChange(false)\n  }, [items, selected, onSelect, onOpenChange])\n\n  // Upload\n  const handleUpload = useCallback(\n    async (file: File) => {\n      setIsUploading(true)\n      setError(null)\n      try {\n        const uploaded = await uploadMedia(file)\n\n        // Single mode: auto-confirm the just-uploaded file\n        if (mode === 'single') {\n          onSelect([uploaded])\n          onOpenChange(false)\n          return\n        }\n\n        // Multi mode: add to grid and select\n        setItems((prev) => [uploaded, ...prev])\n        setTotal((prev) => prev + 1)\n        setSelected((prev) => new Set([...prev, uploaded.id]))\n      } catch (err) {\n        setError(\n          err instanceof Error && err.message\n            ? `Upload failed: ${err.message}`\n            : 'Upload failed. Please try again.',\n        )\n      } finally {\n        setIsUploading(false)\n      }\n    },\n    [uploadMedia, mode, onSelect, onOpenChange],\n  )\n\n  return (\n    <DialogPrimitive.Root open={open} onOpenChange={onOpenChange}>\n      <DialogPrimitive.Portal>\n        <DialogPrimitive.Overlay\n          className={cn(\n            'fixed inset-0 z-50 bg-black/50 data-[state=open]:animate-in data-[state=closed]:animate-out data-[state=closed]:fade-out-0 data-[state=open]:fade-in-0',\n            classNames?.overlay,\n          )}\n        />\n        <DialogPrimitive.Content\n          {...(!description && { 'aria-describedby': undefined })}\n          className={cn(\n            'fixed left-1/2 top-1/2 z-50 -translate-x-1/2 -translate-y-1/2',\n            'flex max-h-[85vh] w-[90vw] max-w-4xl flex-col',\n            'rounded-xl border border-zinc-200 bg-white shadow-2xl dark:border-zinc-800 dark:bg-zinc-950',\n            classNames?.content,\n            className,\n          )}\n        >\n          {/* Header */}\n          <div\n            className={cn(\n              'flex items-center justify-between border-b border-zinc-200 px-6 py-4 dark:border-zinc-800',\n              classNames?.header,\n            )}\n          >\n            <DialogPrimitive.Title\n              className={cn(\n                'text-lg font-semibold text-zinc-900 dark:text-zinc-50',\n                classNames?.title,\n              )}\n            >\n              {title}\n            </DialogPrimitive.Title>\n            {description && (\n              <VisuallyHidden.Root asChild>\n                <DialogPrimitive.Description>{description}</DialogPrimitive.Description>\n              </VisuallyHidden.Root>\n            )}\n            <DialogPrimitive.Close className=\"rounded-sm opacity-70 transition-opacity hover:opacity-100 focus:outline-none focus:ring-2 focus:ring-zinc-400 dark:focus:ring-zinc-600\">\n              <X className=\"h-4 w-4\" />\n              <VisuallyHidden.Root>Close</VisuallyHidden.Root>\n            </DialogPrimitive.Close>\n          </div>\n\n          {/* Toolbar */}\n          <div\n            className={cn(\n              'border-b border-zinc-200 px-6 py-3 dark:border-zinc-800',\n              classNames?.toolbar,\n            )}\n          >\n            <SearchBar\n              value={search}\n              onChange={setSearch}\n              mediaType={mediaTypeFilter}\n              onMediaTypeChange={setMediaTypeFilter}\n              locked={!!mediaType}\n              classNames={classNames}\n            />\n          </div>\n\n          {/* Content */}\n          <div className=\"flex-1 overflow-y-auto px-6 py-4\">\n            {error && (\n              <div\n                role=\"alert\"\n                className=\"mb-4 rounded-lg border border-red-200 bg-red-50 px-4 py-3 text-sm text-red-700 dark:border-red-900 dark:bg-red-950/50 dark:text-red-400\"\n              >\n                {error}\n              </div>\n            )}\n            {storageDisabled ? (\n              <div\n                role=\"alert\"\n                className=\"rounded-lg border border-amber-200 bg-amber-50 px-4 py-6 text-center dark:border-amber-900 dark:bg-amber-950/30\"\n              >\n                <p className=\"text-sm font-medium text-amber-900 dark:text-amber-200\">\n                  Media storage is not configured\n                </p>\n                <p className=\"mt-1 text-xs text-amber-800 dark:text-amber-300\">\n                  {storageDisabled}\n                </p>\n                <p className=\"mt-3 text-xs text-amber-700 dark:text-amber-400\">\n                  Set the required environment variables and restart the app to enable\n                  uploads.\n                </p>\n              </div>\n            ) : (\n              <>\n                <UploadZone\n                  onUpload={handleUpload}\n                  isUploading={isUploading}\n                  accept={accept}\n                  classNames={classNames}\n                />\n                <MediaGrid\n                  items={items}\n                  selected={selected}\n                  onToggle={handleToggle}\n                  isLoading={isLoading}\n                  total={total}\n                  offset={offset}\n                  limit={ITEMS_PER_PAGE}\n                  onPageChange={setOffset}\n                  classNames={classNames}\n                />\n              </>\n            )}\n          </div>\n\n          {/* Footer — multi mode shows confirm/cancel, single mode shows item count only */}\n          <div\n            className={cn(\n              'flex items-center justify-between border-t border-zinc-200 px-6 py-4 dark:border-zinc-800',\n              classNames?.footer,\n            )}\n          >\n            <span className=\"text-sm text-zinc-500 dark:text-zinc-400\">\n              {mode === 'single'\n                ? `${total.toString()} item${total !== 1 ? 's' : ''} — click to select`\n                : selected.size > 0\n                  ? `${selected.size.toString()} selected`\n                  : `${total.toString()} item${total !== 1 ? 's' : ''}`}\n            </span>\n            <div className=\"flex gap-2\">\n              {children}\n              <DialogPrimitive.Close asChild>\n                <button\n                  type=\"button\"\n                  className={cn(\n                    'rounded-md border border-zinc-300 px-4 py-2 text-sm font-medium text-zinc-700 hover:bg-zinc-50',\n                    'dark:border-zinc-700 dark:text-zinc-300 dark:hover:bg-zinc-900',\n                    classNames?.cancelButton,\n                  )}\n                >\n                  Cancel\n                </button>\n              </DialogPrimitive.Close>\n              {mode !== 'single' && (\n                <button\n                  type=\"button\"\n                  onClick={handleConfirm}\n                  disabled={selected.size === 0}\n                  className={cn(\n                    'rounded-md bg-blue-600 px-4 py-2 text-sm font-medium text-white hover:bg-blue-500',\n                    'disabled:cursor-not-allowed disabled:opacity-50',\n                    classNames?.confirmButton,\n                  )}\n                >\n                  {`Select (${selected.size.toString()})`}\n                </button>\n              )}\n            </div>\n          </div>\n        </DialogPrimitive.Content>\n      </DialogPrimitive.Portal>\n    </DialogPrimitive.Root>\n  )\n}\n"],"mappings":";8cAkCA,SAAgB,EAA0B,EAAc,aAAmC,CACzF,IAAM,EAAU,GAAG,EAAY,QAKzB,EAAmB,KAAO,IAAmC,CACjE,GAAI,CACF,IAAM,EAAQ,MAAM,EAAI,MAAM,CAAC,CAAC,KAAK,EACrC,GAAI,OAAO,EAAK,OAAU,UAAY,EAAK,MAAM,OAAS,EAAG,OAAO,EAAK,KAC3E,MAAQ,CAER,CACA,GAAI,CACF,IAAM,EAAO,MAAM,EAAI,KAAK,EAC5B,GAAI,EAAM,OAAO,CACnB,MAAQ,CAER,CACA,MAAO,QAAQ,OAAO,EAAI,MAAM,GAClC,EAEA,MAAO,CACL,WAAY,KAAO,IAKmB,CACpC,IAAM,EAAS,IAAI,gBACf,EAAQ,QAAQ,EAAO,IAAI,SAAU,EAAQ,MAAM,EACnD,EAAQ,WAAW,EAAO,IAAI,YAAa,EAAQ,SAAS,EAChE,EAAO,IAAI,QAAS,OAAO,EAAQ,KAAK,CAAC,EACzC,EAAO,IAAI,SAAU,OAAO,EAAQ,MAAM,CAAC,EAE3C,IAAM,EAAM,GAAG,EAAQ,GAAG,EAAO,SAAS,IACpC,EAAM,MAAM,MAAM,CAAG,EAC3B,GAAI,CAAC,EAAI,GAAI,MAAU,MAAM,MAAM,EAAiB,CAAG,CAAC,EACxD,OAAO,EAAI,KAAK,CAClB,EAEA,YAAa,KAAO,IAAyC,CAC3D,IAAM,EAAW,IAAI,SACrB,EAAS,OAAO,OAAQ,CAAI,EAQ5B,EAAS,OAAO,aAAc,QAAQ,EAEtC,IAAM,EAAM,MAAM,MAAM,EAAS,CAAE,OAAQ,OAAQ,KAAM,CAAS,CAAC,EACnE,GAAI,CAAC,EAAI,GAAI,MAAU,MAAM,MAAM,EAAiB,CAAG,CAAC,EACxD,OAAO,EAAI,KAAK,CAClB,EAEA,YAAa,KAAO,IAAuC,CACzD,GAAI,CACF,IAAM,EAAM,MAAM,MAAM,GAAG,EAAQ,GAAG,GAAI,EAG1C,OAFK,EAAI,IAEF,MADa,EAAI,KAAK,EAAA,CACjB,KAAO,KAFC,IAGtB,MAAQ,CACN,OAAO,IACT,CACF,CACF,CACF,CCpGA,SAAgB,EAAG,GAAG,EAAsB,CAC1C,OAAO,EAAQ,EAAK,CAAM,CAAC,CAC7B,CCMA,MAAM,EAAY,CAChB,MAAO,EACP,MAAO,EACP,SAAU,EACV,MAAO,CACT,EAEA,SAAgB,EAAU,CAAE,OAAM,aAAY,WAAU,cAA8B,CACpF,IAAM,EAAU,EAAK,YAAc,QAC7B,EAAQ,EAA0E,KAA/D,EAAU,EAAK,YAAwC,EAEhF,OACE,EAAC,SAAD,CACE,KAAK,SACL,QAAS,EACT,UAAW,EACT,kFACA,0GACA,EACI,0CACA,wFACJ,GAAY,KACZ,GAAc,GAAY,YAC5B,WAXF,CAcG,EACC,EAAC,MAAD,CACE,IAAK,EAAK,IACV,IAAK,EAAK,KAAO,EAAK,SACtB,UAAW,EAAG,6BAA8B,GAAY,SAAS,EACjE,QAAQ,MACT,CAAA,EAED,EAAC,MAAD,CAAK,UAAU,uFACZ,GAAQ,EAAC,EAAD,CAAM,UAAU,0CAA4C,CAAA,CAClE,CAAA,EAIN,GACC,EAAC,MAAD,CAAK,UAAU,mHACb,EAAC,EAAD,CAAO,UAAU,SAAW,CAAA,CACzB,CAAA,EAIP,EAAC,MAAD,CACE,UAAW,EACT,wFACA,uDACA,GAAY,SACd,WAEA,EAAC,IAAD,CAAG,UAAU,uCAA+B,EAAK,OAAS,EAAK,QAAY,CAAA,CACxE,CAAA,CACC,GAEZ,CCrDA,SAAgB,EAAU,CACxB,QACA,WACA,WACA,YACA,QACA,SACA,QACA,eACA,cACiB,CACjB,GAAI,EACF,OACE,EAAC,MAAD,CAAK,UAAW,EAAG,wCAAyC,GAAY,IAAI,WACzE,MAAM,KAAK,CAAE,OAAQ,EAAG,CAAC,CAAC,CAAC,KAAK,EAAG,IAClC,EAAC,MAAD,CAEE,UAAW,EACT,sEACA,GAAY,OACd,CACD,EALM,YAAY,EAAE,SAAS,GAK7B,CACF,CACE,CAAA,EAIT,GAAI,EAAM,SAAW,EACnB,OACE,EAAC,MAAD,CACE,UAAW,EACT,6DACA,GAAY,KACd,WACD,+CAEI,CAAA,EAIT,IAAM,EAAa,KAAK,KAAK,EAAQ,CAAK,EACpC,EAAc,KAAK,MAAM,EAAS,CAAK,EAAI,EAEjD,OACE,EAAA,EAAA,CAAA,SAAA,CACE,EAAC,MAAD,CAAK,UAAW,EAAG,wCAAyC,GAAY,IAAI,WACzE,EAAM,IAAK,GACV,EAAC,EAAD,CAEQ,OACN,WAAY,EAAS,IAAI,EAAK,EAAE,EAChC,aAAgB,EAAS,CAAI,EACjB,YACb,EALM,EAAK,EAKX,CACF,CACE,CAAA,EACJ,EAAa,GACZ,EAAC,MAAD,CAAK,UAAU,uDAAf,CACE,EAAC,SAAD,CACE,KAAK,SACL,SAAU,GAAe,EACzB,YAAe,EAAa,EAAS,CAAK,EAC1C,UAAU,wGACX,MAEO,CAAA,EACR,EAAC,OAAD,CAAM,UAAU,oDAAhB,CACG,EAAY,MAAI,CACb,IACN,EAAC,SAAD,CACE,KAAK,SACL,SAAU,GAAe,EACzB,YAAe,EAAa,EAAS,CAAK,EAC1C,UAAU,wGACX,MAEO,CAAA,CACL,GAEP,CAAA,CAAA,CAEN,CC9FA,MAAM,EAAqB,EAA2C,IAAI,EAoB1E,SAAgB,EAAoB,CAClC,WACA,aACA,eAC2B,CAM3B,OAAO,EAAC,EAAD,CAAoB,MALb,OACL,CAAE,aAAY,aAAY,GACjC,CAAC,EAAY,CAAW,CAGY,EAAI,UAA6B,CAAA,CACzE,CAEA,SAAgB,GAAuC,CACrD,IAAM,EAAM,EAAW,CAAkB,EACzC,GAAI,CAAC,EACH,MAAU,MACR,iJAEF,EAEF,OAAO,CACT,CC/BA,MAAM,EAAiB,CACrB,CAAE,MAAO,IAAA,GAAW,MAAO,KAAM,EACjC,CAAE,MAAO,QAAS,MAAO,QAAS,EAClC,CAAE,MAAO,QAAS,MAAO,QAAS,EAClC,CAAE,MAAO,QAAS,MAAO,OAAQ,EACjC,CAAE,MAAO,WAAY,MAAO,MAAO,CACrC,EAEA,SAAgB,EAAU,CACxB,QACA,WACA,YACA,oBACA,SACA,cACiB,CAEjB,IAAM,EAAc,CAAC,EAErB,OACE,EAAC,MAAD,CAAK,UAAU,mCAAf,CACE,EAAC,MAAD,CAAK,UAAU,2BAAf,CACE,EAAC,EAAD,CAAQ,UAAU,gEAAkE,CAAA,EACpF,EAAC,QAAD,CACE,KAAK,OACE,QACP,SAAW,GAAM,EAAS,EAAE,OAAO,KAAK,EACxC,YAAY,kBACZ,UAAW,EACT,kFACA,sGACA,sDACA,GAAY,WACd,CACD,CAAA,CACE,IACJ,GACC,EAAC,MAAD,CAAK,UAAW,EAAG,aAAc,GAAY,UAAU,WACpD,EAAe,IAAK,GACnB,EAAC,SAAD,CAEE,KAAK,SACL,YAAe,EAAkB,EAAI,KAAK,EAC1C,UAAW,EACT,+DACA,IAAc,EAAI,MACd,6DACA,2EACN,WAEC,EAAI,KACC,EAXD,EAAI,KAWH,CACT,CACE,CAAA,CAEJ,GAET,CC3DA,SAAgB,EAAW,CAAE,WAAU,cAAa,SAAQ,cAA+B,CACzF,IAAM,EAAW,EAAyB,IAAI,EACxC,CAAC,EAAY,GAAiB,EAAS,EAAK,EAE5C,EAAa,EACjB,KAAO,IAAiB,CACtB,EAAE,eAAe,EACjB,EAAc,EAAK,EACnB,IAAM,EAAO,EAAE,aAAa,MAAM,GAC9B,GACF,MAAM,EAAS,CAAI,CAEvB,EACA,CAAC,CAAQ,CACX,EAEM,EAAmB,EACvB,KAAO,IAA2C,CAChD,IAAM,EAAO,EAAE,OAAO,QAAQ,GAC1B,IACF,MAAM,EAAS,CAAI,EACnB,EAAE,OAAO,MAAQ,GAErB,EACA,CAAC,CAAQ,CACX,EAEA,OACE,EAAC,SAAD,CACE,KAAK,SACL,WAAa,GAAM,CACjB,EAAE,eAAe,EACjB,EAAc,EAAI,CACpB,EACA,gBAAmB,EAAc,EAAK,EACtC,OAAQ,EACR,YAAe,EAAS,SAAS,MAAM,EACvC,UAAW,EACT,8HACA,EACI,iDACA,wFACJ,GAAY,WACZ,GAAc,GAAY,gBAC5B,WAhBF,CAkBE,EAAC,EAAD,CAAQ,UAAU,+CAAiD,CAAA,EACnE,EAAC,IAAD,CAAG,UAAU,oDACV,EAAc,eAAiB,qCAC/B,CAAA,EACH,EAAC,QAAD,CACE,IAAK,EACL,KAAK,OACL,OAAQ,GAAQ,KAAK,GAAG,EACxB,SAAU,EACV,UAAU,QACX,CAAA,CACK,GAEZ,CC1DA,SAAgB,EAAY,CAC1B,OACA,eACA,WACA,OAAO,SACP,SACA,YACA,YACA,cAAc,CAAC,EACf,QAAQ,eACR,cACA,aACA,YACA,YACmB,CACnB,GAAM,CAAE,aAAY,eAAgB,EAAe,EAG7C,CAAC,EAAO,GAAY,EAA4B,CAAC,CAAC,EAClD,CAAC,EAAO,GAAY,EAAS,CAAC,EAC9B,CAAC,EAAU,GAAe,MAA4B,IAAI,IAAI,CAAW,CAAC,EAC1E,CAAC,EAAQ,GAAa,EAAS,EAAE,EACjC,CAAC,EAAiB,GAAsB,EAA6B,CAAS,EAC9E,CAAC,EAAW,GAAgB,EAAS,EAAK,EAC1C,CAAC,EAAa,GAAkB,EAAS,EAAK,EAC9C,CAAC,EAAQ,GAAa,EAAS,CAAC,EAChC,CAAC,EAAO,GAAY,EAAwB,IAAI,EAIhD,CAAC,EAAiB,GAAsB,EAAwB,IAAI,EAGpE,EAAY,EAAY,SAAY,CACxC,EAAa,EAAI,EACjB,EAAS,IAAI,EACb,GAAI,CACF,IAAM,EAAS,MAAM,EAAW,CAC9B,OAAQ,GAAU,IAAA,GAClB,UAAW,EACX,MAAO,GACP,QACF,CAAC,EACG,EAAO,aAAe,IACxB,EAAmB,EAAO,QAAU,iDAAiD,EACrF,EAAS,CAAC,CAAC,EACX,EAAS,CAAC,IAEV,EAAmB,IAAI,EACvB,EAAS,EAAO,KAAK,EACrB,EAAS,EAAO,KAAK,EAEzB,OAAS,EAAK,CACZ,EACE,aAAe,OAAS,EAAI,QACxB,yBAAyB,EAAI,UAC7B,uBACN,CACF,QAAU,CACR,EAAa,EAAK,CACpB,CACF,EAAG,CAAC,EAAY,EAAQ,EAAiB,CAAM,CAAC,EAEhD,MAAgB,CACV,GACF,EAAU,CAEd,EAAG,CAAC,EAAM,CAAS,CAAC,EAGpB,IAAM,EAAW,EAAO,CAAI,EACtB,EAAiB,EAAO,CAAW,EACzC,EAAe,QAAU,EACzB,MAAgB,CACV,EAAS,SAAW,CAAC,IACvB,EAAU,EAAE,EACZ,EAAU,CAAC,EACX,EAAY,IAAI,IAAI,EAAe,OAAO,CAAC,GAE7C,EAAS,QAAU,CACrB,EAAG,CAAC,CAAI,CAAC,EAGT,IAAM,EAAe,EAClB,GAA0B,CAEzB,GAAI,IAAS,SAAU,CACrB,EAAS,CAAC,CAAI,CAAC,EACf,EAAa,EAAK,EAClB,MACF,CAGA,EAAa,GAAS,CACpB,IAAM,EAAO,IAAI,IAAI,CAAI,EACzB,GAAI,EAAK,IAAI,EAAK,EAAE,EAClB,EAAK,OAAO,EAAK,EAAE,MACd,CACL,GAAI,GAAa,EAAK,MAAQ,EAAW,OAAO,EAChD,EAAK,IAAI,EAAK,EAAE,CAClB,CACA,OAAO,CACT,CAAC,CACH,EACA,CAAC,EAAM,EAAW,EAAU,CAAY,CAC1C,EAEM,GAAgB,MAAkB,CAEtC,EADsB,EAAM,OAAQ,GAAS,EAAS,IAAI,EAAK,EAAE,CAC5C,CAAC,EACtB,EAAa,EAAK,CACpB,EAAG,CAAC,EAAO,EAAU,EAAU,CAAY,CAAC,EAGtC,GAAe,EACnB,KAAO,IAAe,CACpB,EAAe,EAAI,EACnB,EAAS,IAAI,EACb,GAAI,CACF,IAAM,EAAW,MAAM,EAAY,CAAI,EAGvC,GAAI,IAAS,SAAU,CACrB,EAAS,CAAC,CAAQ,CAAC,EACnB,EAAa,EAAK,EAClB,MACF,CAGA,EAAU,GAAS,CAAC,EAAU,GAAG,CAAI,CAAC,EACtC,EAAU,GAAS,EAAO,CAAC,EAC3B,EAAa,GAAS,IAAI,IAAI,CAAC,GAAG,EAAM,EAAS,EAAE,CAAC,CAAC,CACvD,OAAS,EAAK,CACZ,EACE,aAAe,OAAS,EAAI,QACxB,kBAAkB,EAAI,UACtB,kCACN,CACF,QAAU,CACR,EAAe,EAAK,CACtB,CACF,EACA,CAAC,EAAa,EAAM,EAAU,CAAY,CAC5C,EAEA,OACE,EAAC,EAAgB,KAAjB,CAA4B,OAAoB,wBAC9C,EAAC,EAAgB,OAAjB,CAAA,SAAA,CACE,EAAC,EAAgB,QAAjB,CACE,UAAW,EACT,yJACA,GAAY,OACd,CACD,CAAA,EACD,EAAC,EAAgB,QAAjB,CACE,GAAK,CAAC,GAAe,CAAE,mBAAoB,IAAA,EAAU,EACrD,UAAW,EACT,gEACA,gDACA,8FACA,GAAY,QACZ,CACF,WARF,CAWE,EAAC,MAAD,CACE,UAAW,EACT,4FACA,GAAY,MACd,WAJF,CAME,EAAC,EAAgB,MAAjB,CACE,UAAW,EACT,wDACA,GAAY,KACd,WAEC,CACoB,CAAA,EACtB,GACC,EAAC,EAAe,KAAhB,CAAqB,QAAA,YACnB,EAAC,EAAgB,YAAjB,CAAA,SAA8B,CAAyC,CAAA,CACpD,CAAA,EAEvB,EAAC,EAAgB,MAAjB,CAAuB,UAAU,mJAAjC,CACE,EAAC,EAAD,CAAG,UAAU,SAAW,CAAA,EACxB,EAAC,EAAe,KAAhB,CAAA,SAAqB,OAA0B,CAAA,CAC1B,GACpB,IAGL,EAAC,MAAD,CACE,UAAW,EACT,0DACA,GAAY,OACd,WAEA,EAAC,EAAD,CACE,MAAO,EACP,SAAU,EACV,UAAW,EACX,kBAAmB,EACnB,OAAQ,CAAC,CAAC,EACE,YACb,CAAA,CACE,CAAA,EAGL,EAAC,MAAD,CAAK,UAAU,4CAAf,CACG,GACC,EAAC,MAAD,CACE,KAAK,QACL,UAAU,mJAET,CACE,CAAA,EAEN,EACC,EAAC,MAAD,CACE,KAAK,QACL,UAAU,2HAFZ,CAIE,EAAC,IAAD,CAAG,UAAU,kEAAyD,iCAEnE,CAAA,EACH,EAAC,IAAD,CAAG,UAAU,2DACV,CACA,CAAA,EACH,EAAC,IAAD,CAAG,UAAU,2DAAkD,+EAG5D,CAAA,CACA,IAEL,EAAA,EAAA,CAAA,SAAA,CACE,EAAC,EAAD,CACE,SAAU,GACG,cACL,SACI,YACb,CAAA,EACD,EAAC,EAAD,CACS,QACG,WACV,SAAU,EACC,YACJ,QACC,SACR,MAAO,GACP,aAAc,EACF,YACb,CAAA,CACD,CAAA,CAAA,CAED,IAGL,EAAC,MAAD,CACE,UAAW,EACT,4FACA,GAAY,MACd,WAJF,CAME,EAAC,OAAD,CAAM,UAAU,oDACb,IAAS,SACN,GAAG,EAAM,SAAS,EAAE,OAAO,IAAU,EAAU,GAAN,IAAS,oBAClD,EAAS,KAAO,EACd,GAAG,EAAS,KAAK,SAAS,EAAE,WAC5B,GAAG,EAAM,SAAS,EAAE,OAAO,IAAU,EAAU,GAAN,KAC3C,CAAA,EACN,EAAC,MAAD,CAAK,UAAU,sBAAf,CACG,EACD,EAAC,EAAgB,MAAjB,CAAuB,QAAA,YACrB,EAAC,SAAD,CACE,KAAK,SACL,UAAW,EACT,iGACA,iEACA,GAAY,YACd,WACD,QAEO,CAAA,CACa,CAAA,EACtB,IAAS,UACR,EAAC,SAAD,CACE,KAAK,SACL,QAAS,GACT,SAAU,EAAS,OAAS,EAC5B,UAAW,EACT,oFACA,kDACA,GAAY,aACd,WAEC,WAAW,EAAS,KAAK,SAAS,EAAE,EAC/B,CAAA,CAEP,GACF,GACkB,GACH,CAAA,CAAA,CACJ,CAAA,CAE1B"}
+{"version":3,"file":"picker.mjs","names":[],"sources":["../src/picker/admin-callbacks.ts","../src/lib/cn.ts","../src/picker/media-type-icon.ts","../src/picker/media-card.tsx","../src/picker/media-grid.tsx","../src/picker/provider.tsx","../src/picker/search-bar.tsx","../src/picker/upload-zone.tsx","../src/picker/media-picker.tsx"],"sourcesContent":["/**\n * Pre-built media callbacks that talk to the admin API.\n *\n * Eliminates boilerplate in every project — just call:\n *   const media = createAdminMediaCallbacks('/api/admin')\n *\n * Returns callbacks compatible with both MediaPickerProvider and\n * BlockEditor's `media` prop (with getMediaUrl for thumbnail previews).\n */\n\nimport type { MediaPickerCallbacks, MediaPickerItem, MediaPickerListResult } from './types'\n\n/** Extended callbacks with getMediaUrl (for editor thumbnail previews) */\nexport type AdminMediaCallbacks = MediaPickerCallbacks & {\n  getMediaUrl: (id: string) => Promise<string | null>\n}\n\n/**\n * Create media callbacks that talk to the admin API.\n *\n * @param apiBasePath - Base path for admin API (default: '/api/admin')\n * @returns Callbacks for MediaPickerProvider + BlockEditor media prop\n *\n * @example\n * ```tsx\n * import { createAdminMediaCallbacks } from '@murumets-ee/media/picker'\n *\n * const media = createAdminMediaCallbacks()\n * // Use with BlockEditor:\n * <BlockEditor media={media} ... />\n * // Use with MediaPickerProvider:\n * <MediaPickerProvider fetchMedia={media.fetchMedia} uploadMedia={media.uploadMedia}>\n * ```\n */\nexport function createAdminMediaCallbacks(apiBasePath = '/api/admin'): AdminMediaCallbacks {\n  const baseUrl = `${apiBasePath}/media`\n\n  // Admin API error responses are `{ error: string }`. Parse the body so\n  // the real cause (e.g. \"Missing required environment variable:\n  // STORAGE_ENDPOINT\") reaches the UI instead of just the status code.\n  const readErrorMessage = async (res: Response): Promise<string> => {\n    try {\n      const body = (await res.clone().json()) as { error?: unknown }\n      if (typeof body.error === 'string' && body.error.length > 0) return body.error\n    } catch {\n      // fall through — response wasn't JSON\n    }\n    try {\n      const text = await res.text()\n      if (text) return text\n    } catch {\n      // ignore\n    }\n    return `HTTP ${String(res.status)}`\n  }\n\n  return {\n    fetchMedia: async (options: {\n      search?: string | undefined\n      mediaType?: string | undefined\n      limit: number\n      offset: number\n    }): Promise<MediaPickerListResult> => {\n      const params = new URLSearchParams()\n      if (options.search) params.set('search', options.search)\n      if (options.mediaType) params.set('mediaType', options.mediaType)\n      params.set('limit', String(options.limit))\n      params.set('offset', String(options.offset))\n\n      const url = `${baseUrl}?${params.toString()}`\n      const res = await fetch(url)\n      if (!res.ok) throw new Error(await readErrorMessage(res))\n      return res.json() as Promise<MediaPickerListResult>\n    },\n\n    uploadMedia: async (file: File): Promise<MediaPickerItem> => {\n      const formData = new FormData()\n      formData.append('file', file)\n      // The media LIBRARY is publishable web assets, so it opts in explicitly.\n      // Without this the upload route's deny-by-default leaves the asset\n      // private, `getPublicUrls` returns nothing for it, and every image on the\n      // public site resolves to `null` behind a 200 and one warn log (F030).\n      // Sent per-upload rather than by flipping a global default, because the\n      // same route also receives rent's inspection photos, which must not be\n      // world-readable.\n      formData.append('visibility', 'public')\n\n      const res = await fetch(baseUrl, { method: 'POST', body: formData })\n      if (!res.ok) throw new Error(await readErrorMessage(res))\n      return res.json() as Promise<MediaPickerItem>\n    },\n\n    getMediaUrl: async (id: string): Promise<string | null> => {\n      try {\n        const res = await fetch(`${baseUrl}/${id}`)\n        if (!res.ok) return null\n        const item = (await res.json()) as MediaPickerItem\n        return item.url ?? null\n      } catch {\n        return null\n      }\n    },\n  }\n}\n","import { type ClassValue, clsx } from 'clsx'\nimport { twMerge } from 'tailwind-merge'\n\nexport function cn(...inputs: ClassValue[]) {\n  return twMerge(clsx(inputs))\n}\n","import { File, FileText, Film, type LucideIcon, Music } from 'lucide-react'\n\n/**\n * The non-image members of `@murumets-ee/media`'s `MediaType`, copied rather\n * than imported.\n *\n * This module ships from the `./picker` tsdown entry — a build SEPARATE from\n * the root `index.ts` entry that already exports `MediaType` by name. Naming\n * it here too would duplicate its declaration across two `.d.mts` files\n * (`verify:dts`, #767): each array entry in `tsdown.config.ts` builds\n * independently and cannot share a declaration chunk, so a type named in two\n * entries' public APIs is emitted twice, and TypeScript can no longer treat\n * the two copies as identical if either ever gains an invariant member.\n *\n * Kept honest by `media-type-icon.test.ts`, which imports the real\n * `MediaType` (a type-only import, erased before it ever reaches a `.d.mts`)\n * and asserts this literal still matches it exactly.\n */\ntype NonImageMediaType = 'video' | 'audio' | 'document' | 'other'\n\n/**\n * The typed-icon fallback for every media type that is not `'image'`.\n *\n * The ONE rule three admin surfaces branch on (F115): the media list, the\n * picker's `MediaCard` and the media edit form all show a real `<img>` for\n * `mediaType === 'image'` and one of these icons otherwise. Extracted from\n * `MediaCard`, which held the only copy, so a fourth surface reaches for this\n * instead of writing a fourth `Record<MediaType, LucideIcon>`.\n */\nexport const NON_IMAGE_MEDIA_TYPE_ICONS: Record<NonImageMediaType, LucideIcon> = {\n  video: Film,\n  audio: Music,\n  document: FileText,\n  other: File,\n}\n\n/** The icon for a non-image media type, or `null` for `'image'` (render the asset itself). */\nexport function mediaTypeIcon(mediaType: 'image' | NonImageMediaType): LucideIcon | null {\n  return mediaType === 'image' ? null : NON_IMAGE_MEDIA_TYPE_ICONS[mediaType]\n}\n","import { Check } from 'lucide-react'\nimport { cn } from '../lib/cn'\nimport { mediaTypeIcon } from './media-type-icon'\nimport type { MediaPickerClassNames, MediaPickerItem } from './types'\n\ninterface MediaCardProps {\n  item: MediaPickerItem\n  isSelected: boolean\n  onToggle: () => void\n  classNames?: MediaPickerClassNames | undefined\n}\n\nexport function MediaCard({ item, isSelected, onToggle, classNames }: MediaCardProps) {\n  const isImage = item.mediaType === 'image'\n  const Icon = mediaTypeIcon(item.mediaType)\n\n  return (\n    <button\n      type=\"button\"\n      onClick={onToggle}\n      className={cn(\n        'group relative aspect-square overflow-hidden rounded-lg border-2 transition-all',\n        'focus:outline-none focus:ring-2 focus:ring-blue-500 focus:ring-offset-2 dark:focus:ring-offset-zinc-950',\n        isSelected\n          ? 'border-blue-500 ring-2 ring-blue-500/20'\n          : 'border-zinc-200 hover:border-zinc-300 dark:border-zinc-800 dark:hover:border-zinc-700',\n        classNames?.card,\n        isSelected && classNames?.cardSelected,\n      )}\n    >\n      {/* Thumbnail */}\n      {isImage ? (\n        <img\n          src={item.url}\n          alt={item.alt ?? item.filename}\n          className={cn('h-full w-full object-cover', classNames?.cardImage)}\n          loading=\"lazy\"\n        />\n      ) : (\n        <div className=\"flex h-full w-full items-center justify-center bg-zinc-100 dark:bg-zinc-800\">\n          {Icon && <Icon className=\"h-8 w-8 text-zinc-400 dark:text-zinc-500\" />}\n        </div>\n      )}\n\n      {/* Selection checkmark */}\n      {isSelected && (\n        <div className=\"absolute right-1.5 top-1.5 flex h-5 w-5 items-center justify-center rounded-full bg-blue-500 text-white\">\n          <Check className=\"h-3 w-3\" />\n        </div>\n      )}\n\n      {/* Filename on hover */}\n      <div\n        className={cn(\n          'absolute inset-x-0 bottom-0 bg-gradient-to-t from-black/60 to-transparent px-2 py-1.5',\n          'opacity-0 transition-opacity group-hover:opacity-100',\n          classNames?.cardLabel,\n        )}\n      >\n        <p className=\"truncate text-xs text-white\">{item.title ?? item.filename}</p>\n      </div>\n    </button>\n  )\n}\n","import { cn } from '../lib/cn'\nimport { MediaCard } from './media-card'\nimport type { MediaPickerClassNames, MediaPickerItem } from './types'\n\ninterface MediaGridProps {\n  items: MediaPickerItem[]\n  selected: Set<string>\n  onToggle: (item: MediaPickerItem) => void\n  isLoading: boolean\n  total: number\n  offset: number\n  limit: number\n  onPageChange: (offset: number) => void\n  classNames?: MediaPickerClassNames | undefined\n}\n\nexport function MediaGrid({\n  items,\n  selected,\n  onToggle,\n  isLoading,\n  total,\n  offset,\n  limit,\n  onPageChange,\n  classNames,\n}: MediaGridProps) {\n  if (isLoading) {\n    return (\n      <div className={cn('grid grid-cols-4 gap-3 sm:grid-cols-6', classNames?.grid)}>\n        {Array.from({ length: 12 }).map((_, i) => (\n          <div\n            key={`skeleton-${i.toString()}`}\n            className={cn(\n              'aspect-square animate-pulse rounded-lg bg-zinc-100 dark:bg-zinc-800',\n              classNames?.loading,\n            )}\n          />\n        ))}\n      </div>\n    )\n  }\n\n  if (items.length === 0) {\n    return (\n      <div\n        className={cn(\n          'py-12 text-center text-sm text-zinc-500 dark:text-zinc-400',\n          classNames?.empty,\n        )}\n      >\n        No media found. Upload a file to get started.\n      </div>\n    )\n  }\n\n  const totalPages = Math.ceil(total / limit)\n  const currentPage = Math.floor(offset / limit) + 1\n\n  return (\n    <>\n      <div className={cn('grid grid-cols-4 gap-3 sm:grid-cols-6', classNames?.grid)}>\n        {items.map((item) => (\n          <MediaCard\n            key={item.id}\n            item={item}\n            isSelected={selected.has(item.id)}\n            onToggle={() => onToggle(item)}\n            classNames={classNames}\n          />\n        ))}\n      </div>\n      {totalPages > 1 && (\n        <div className=\"mt-4 flex items-center justify-center gap-2\">\n          <button\n            type=\"button\"\n            disabled={currentPage <= 1}\n            onClick={() => onPageChange(offset - limit)}\n            className=\"rounded-md border border-zinc-300 px-3 py-1 text-sm disabled:opacity-50 dark:border-zinc-700\"\n          >\n            Prev\n          </button>\n          <span className=\"text-sm text-zinc-500 dark:text-zinc-400\">\n            {currentPage} / {totalPages}\n          </span>\n          <button\n            type=\"button\"\n            disabled={currentPage >= totalPages}\n            onClick={() => onPageChange(offset + limit)}\n            className=\"rounded-md border border-zinc-300 px-3 py-1 text-sm disabled:opacity-50 dark:border-zinc-700\"\n          >\n            Next\n          </button>\n        </div>\n      )}\n    </>\n  )\n}\n","import { createContext, type ReactNode, useContext, useMemo } from 'react'\nimport type { MediaPickerCallbacks } from './types'\n\nconst MediaPickerContext = createContext<MediaPickerCallbacks | null>(null)\n\nexport interface MediaPickerProviderProps extends MediaPickerCallbacks {\n  children: ReactNode\n}\n\n/**\n * Provides media picker callbacks to all picker instances below.\n * Wrap your admin layout with this provider.\n *\n * @example\n * ```tsx\n * <MediaPickerProvider\n *   fetchMedia={fetchMediaAction}\n *   uploadMedia={uploadMediaAction}\n * >\n *   <AdminShell>...</AdminShell>\n * </MediaPickerProvider>\n * ```\n */\nexport function MediaPickerProvider({\n  children,\n  fetchMedia,\n  uploadMedia,\n}: MediaPickerProviderProps) {\n  const value = useMemo<MediaPickerCallbacks>(\n    () => ({ fetchMedia, uploadMedia }),\n    [fetchMedia, uploadMedia],\n  )\n\n  return <MediaPickerContext value={value}>{children}</MediaPickerContext>\n}\n\nexport function useMediaPicker(): MediaPickerCallbacks {\n  const ctx = useContext(MediaPickerContext)\n  if (!ctx) {\n    throw new Error(\n      'useMediaPicker must be used within <MediaPickerProvider>. ' +\n        'Wrap your admin layout with <MediaPickerProvider fetchMedia={...} uploadMedia={...}>.',\n    )\n  }\n  return ctx\n}\n","import { Search } from 'lucide-react'\nimport { cn } from '../lib/cn'\nimport type { MediaPickerClassNames } from './types'\n\ninterface SearchBarProps {\n  value: string\n  onChange: (value: string) => void\n  mediaType: string | undefined\n  onMediaTypeChange: (type: string | undefined) => void\n  /** When true, the media type filter is locked (no tabs shown) */\n  locked?: boolean | undefined\n  classNames?: MediaPickerClassNames | undefined\n}\n\nconst FILTER_OPTIONS = [\n  { value: undefined, label: 'All' },\n  { value: 'image', label: 'Images' },\n  { value: 'video', label: 'Videos' },\n  { value: 'audio', label: 'Audio' },\n  { value: 'document', label: 'Docs' },\n] as const\n\nexport function SearchBar({\n  value,\n  onChange,\n  mediaType,\n  onMediaTypeChange,\n  locked,\n  classNames,\n}: SearchBarProps) {\n  // If locked (caller pre-set the mediaType), hide filter tabs\n  const showFilters = !locked\n\n  return (\n    <div className=\"flex items-center gap-3\">\n      <div className=\"relative flex-1\">\n        <Search className=\"absolute left-3 top-1/2 h-4 w-4 -translate-y-1/2 text-zinc-400\" />\n        <input\n          type=\"text\"\n          value={value}\n          onChange={(e) => onChange(e.target.value)}\n          placeholder=\"Search media...\"\n          className={cn(\n            'w-full rounded-md border border-zinc-300 bg-transparent py-2 pl-10 pr-3 text-sm',\n            'placeholder:text-zinc-400 focus:border-blue-500 focus:outline-none focus:ring-1 focus:ring-blue-500',\n            'dark:border-zinc-700 dark:placeholder:text-zinc-500',\n            classNames?.searchInput,\n          )}\n        />\n      </div>\n      {showFilters && (\n        <div className={cn('flex gap-1', classNames?.filterTabs)}>\n          {FILTER_OPTIONS.map((opt) => (\n            <button\n              key={opt.label}\n              type=\"button\"\n              onClick={() => onMediaTypeChange(opt.value)}\n              className={cn(\n                'rounded-md px-3 py-1.5 text-xs font-medium transition-colors',\n                mediaType === opt.value\n                  ? 'bg-zinc-900 text-white dark:bg-zinc-100 dark:text-zinc-900'\n                  : 'text-zinc-600 hover:bg-zinc-100 dark:text-zinc-400 dark:hover:bg-zinc-800',\n              )}\n            >\n              {opt.label}\n            </button>\n          ))}\n        </div>\n      )}\n    </div>\n  )\n}\n","import { Upload } from 'lucide-react'\nimport { type DragEvent, useCallback, useRef, useState } from 'react'\nimport { cn } from '../lib/cn'\nimport type { MediaPickerClassNames } from './types'\n\ninterface UploadZoneProps {\n  onUpload: (file: File) => Promise<void>\n  isUploading: boolean\n  accept?: string[] | undefined\n  classNames?: MediaPickerClassNames | undefined\n}\n\nexport function UploadZone({ onUpload, isUploading, accept, classNames }: UploadZoneProps) {\n  const inputRef = useRef<HTMLInputElement>(null)\n  const [isDragging, setIsDragging] = useState(false)\n\n  const handleDrop = useCallback(\n    async (e: DragEvent) => {\n      e.preventDefault()\n      setIsDragging(false)\n      const file = e.dataTransfer.files[0]\n      if (file) {\n        await onUpload(file)\n      }\n    },\n    [onUpload],\n  )\n\n  const handleFileSelect = useCallback(\n    async (e: React.ChangeEvent<HTMLInputElement>) => {\n      const file = e.target.files?.[0]\n      if (file) {\n        await onUpload(file)\n        e.target.value = ''\n      }\n    },\n    [onUpload],\n  )\n\n  return (\n    <button\n      type=\"button\"\n      onDragOver={(e) => {\n        e.preventDefault()\n        setIsDragging(true)\n      }}\n      onDragLeave={() => setIsDragging(false)}\n      onDrop={handleDrop}\n      onClick={() => inputRef.current?.click()}\n      className={cn(\n        'mb-4 flex cursor-pointer flex-col items-center justify-center rounded-lg border-2 border-dashed px-6 py-6 transition-colors',\n        isDragging\n          ? 'border-blue-500 bg-blue-50 dark:bg-blue-950/20'\n          : 'border-zinc-300 hover:border-zinc-400 dark:border-zinc-700 dark:hover:border-zinc-600',\n        classNames?.uploadZone,\n        isDragging && classNames?.uploadZoneActive,\n      )}\n    >\n      <Upload className=\"mb-2 h-6 w-6 text-zinc-400 dark:text-zinc-500\" />\n      <p className=\"text-sm text-zinc-600 dark:text-zinc-400\">\n        {isUploading ? 'Uploading...' : 'Drop a file here or click to upload'}\n      </p>\n      <input\n        ref={inputRef}\n        type=\"file\"\n        accept={accept?.join(',')}\n        onChange={handleFileSelect}\n        className=\"hidden\"\n      />\n    </button>\n  )\n}\n","import * as DialogPrimitive from '@radix-ui/react-dialog'\nimport * as VisuallyHidden from '@radix-ui/react-visually-hidden'\nimport { X } from 'lucide-react'\nimport { useCallback, useEffect, useRef, useState } from 'react'\nimport { cn } from '../lib/cn'\nimport { MediaGrid } from './media-grid'\nimport { useMediaPicker } from './provider'\nimport { SearchBar } from './search-bar'\nimport type { MediaPickerItem, MediaPickerProps } from './types'\nimport { UploadZone } from './upload-zone'\n\nconst ITEMS_PER_PAGE = 24\n\nexport function MediaPicker({\n  open,\n  onOpenChange,\n  onSelect,\n  mode = 'single',\n  accept,\n  mediaType,\n  maxSelect,\n  selectedIds = [],\n  title = 'Select Media',\n  description,\n  classNames,\n  className,\n  children,\n}: MediaPickerProps) {\n  const { fetchMedia, uploadMedia } = useMediaPicker()\n\n  // State\n  const [items, setItems] = useState<MediaPickerItem[]>([])\n  const [total, setTotal] = useState(0)\n  const [selected, setSelected] = useState<Set<string>>(() => new Set(selectedIds))\n  const [search, setSearch] = useState('')\n  const [mediaTypeFilter, setMediaTypeFilter] = useState<string | undefined>(mediaType)\n  const [isLoading, setIsLoading] = useState(false)\n  const [isUploading, setIsUploading] = useState(false)\n  const [offset, setOffset] = useState(0)\n  const [error, setError] = useState<string | null>(null)\n  // When the server reports storage isn't configured, we render a\n  // banner and hide the upload zone + grid instead of failing silently\n  // or showing an empty state the admin can't act on.\n  const [storageDisabled, setStorageDisabled] = useState<string | null>(null)\n\n  // Fetch media on open / filter change\n  const loadMedia = useCallback(async () => {\n    setIsLoading(true)\n    setError(null)\n    try {\n      const result = await fetchMedia({\n        search: search || undefined,\n        mediaType: mediaTypeFilter,\n        limit: ITEMS_PER_PAGE,\n        offset,\n      })\n      if (result.configured === false) {\n        setStorageDisabled(result.reason ?? 'Media storage is not configured on this server.')\n        setItems([])\n        setTotal(0)\n      } else {\n        setStorageDisabled(null)\n        setItems(result.items)\n        setTotal(result.total)\n      }\n    } catch (err) {\n      setError(\n        err instanceof Error && err.message\n          ? `Failed to load media: ${err.message}`\n          : 'Failed to load media.',\n      )\n    } finally {\n      setIsLoading(false)\n    }\n  }, [fetchMedia, search, mediaTypeFilter, offset])\n\n  useEffect(() => {\n    if (open) {\n      loadMedia()\n    }\n  }, [open, loadMedia])\n\n  // Reset state when dialog closes (open transitions true → false)\n  const prevOpen = useRef(open)\n  const selectedIdsRef = useRef(selectedIds)\n  selectedIdsRef.current = selectedIds\n  useEffect(() => {\n    if (prevOpen.current && !open) {\n      setSearch('')\n      setOffset(0)\n      setSelected(new Set(selectedIdsRef.current))\n    }\n    prevOpen.current = open\n  }, [open])\n\n  // Selection\n  const handleToggle = useCallback(\n    (item: MediaPickerItem) => {\n      // Single mode: auto-confirm on click — no separate \"Select\" step needed\n      if (mode === 'single') {\n        onSelect([item])\n        onOpenChange(false)\n        return\n      }\n\n      // Multi mode: toggle selection in the set\n      setSelected((prev) => {\n        const next = new Set(prev)\n        if (next.has(item.id)) {\n          next.delete(item.id)\n        } else {\n          if (maxSelect && next.size >= maxSelect) return prev\n          next.add(item.id)\n        }\n        return next\n      })\n    },\n    [mode, maxSelect, onSelect, onOpenChange],\n  )\n\n  const handleConfirm = useCallback(() => {\n    const selectedItems = items.filter((item) => selected.has(item.id))\n    onSelect(selectedItems)\n    onOpenChange(false)\n  }, [items, selected, onSelect, onOpenChange])\n\n  // Upload\n  const handleUpload = useCallback(\n    async (file: File) => {\n      setIsUploading(true)\n      setError(null)\n      try {\n        const uploaded = await uploadMedia(file)\n\n        // Single mode: auto-confirm the just-uploaded file\n        if (mode === 'single') {\n          onSelect([uploaded])\n          onOpenChange(false)\n          return\n        }\n\n        // Multi mode: add to grid and select\n        setItems((prev) => [uploaded, ...prev])\n        setTotal((prev) => prev + 1)\n        setSelected((prev) => new Set([...prev, uploaded.id]))\n      } catch (err) {\n        setError(\n          err instanceof Error && err.message\n            ? `Upload failed: ${err.message}`\n            : 'Upload failed. Please try again.',\n        )\n      } finally {\n        setIsUploading(false)\n      }\n    },\n    [uploadMedia, mode, onSelect, onOpenChange],\n  )\n\n  return (\n    <DialogPrimitive.Root open={open} onOpenChange={onOpenChange}>\n      <DialogPrimitive.Portal>\n        <DialogPrimitive.Overlay\n          className={cn(\n            'fixed inset-0 z-50 bg-black/50 data-[state=open]:animate-in data-[state=closed]:animate-out data-[state=closed]:fade-out-0 data-[state=open]:fade-in-0',\n            classNames?.overlay,\n          )}\n        />\n        <DialogPrimitive.Content\n          {...(!description && { 'aria-describedby': undefined })}\n          className={cn(\n            'fixed left-1/2 top-1/2 z-50 -translate-x-1/2 -translate-y-1/2',\n            'flex max-h-[85vh] w-[90vw] max-w-4xl flex-col',\n            'rounded-xl border border-zinc-200 bg-white shadow-2xl dark:border-zinc-800 dark:bg-zinc-950',\n            classNames?.content,\n            className,\n          )}\n        >\n          {/* Header */}\n          <div\n            className={cn(\n              'flex items-center justify-between border-b border-zinc-200 px-6 py-4 dark:border-zinc-800',\n              classNames?.header,\n            )}\n          >\n            <DialogPrimitive.Title\n              className={cn(\n                'text-lg font-semibold text-zinc-900 dark:text-zinc-50',\n                classNames?.title,\n              )}\n            >\n              {title}\n            </DialogPrimitive.Title>\n            {description && (\n              <VisuallyHidden.Root asChild>\n                <DialogPrimitive.Description>{description}</DialogPrimitive.Description>\n              </VisuallyHidden.Root>\n            )}\n            <DialogPrimitive.Close className=\"rounded-sm opacity-70 transition-opacity hover:opacity-100 focus:outline-none focus:ring-2 focus:ring-zinc-400 dark:focus:ring-zinc-600\">\n              <X className=\"h-4 w-4\" />\n              <VisuallyHidden.Root>Close</VisuallyHidden.Root>\n            </DialogPrimitive.Close>\n          </div>\n\n          {/* Toolbar */}\n          <div\n            className={cn(\n              'border-b border-zinc-200 px-6 py-3 dark:border-zinc-800',\n              classNames?.toolbar,\n            )}\n          >\n            <SearchBar\n              value={search}\n              onChange={setSearch}\n              mediaType={mediaTypeFilter}\n              onMediaTypeChange={setMediaTypeFilter}\n              locked={!!mediaType}\n              classNames={classNames}\n            />\n          </div>\n\n          {/* Content */}\n          <div className=\"flex-1 overflow-y-auto px-6 py-4\">\n            {error && (\n              <div\n                role=\"alert\"\n                className=\"mb-4 rounded-lg border border-red-200 bg-red-50 px-4 py-3 text-sm text-red-700 dark:border-red-900 dark:bg-red-950/50 dark:text-red-400\"\n              >\n                {error}\n              </div>\n            )}\n            {storageDisabled ? (\n              <div\n                role=\"alert\"\n                className=\"rounded-lg border border-amber-200 bg-amber-50 px-4 py-6 text-center dark:border-amber-900 dark:bg-amber-950/30\"\n              >\n                <p className=\"text-sm font-medium text-amber-900 dark:text-amber-200\">\n                  Media storage is not configured\n                </p>\n                <p className=\"mt-1 text-xs text-amber-800 dark:text-amber-300\">\n                  {storageDisabled}\n                </p>\n                <p className=\"mt-3 text-xs text-amber-700 dark:text-amber-400\">\n                  Set the required environment variables and restart the app to enable\n                  uploads.\n                </p>\n              </div>\n            ) : (\n              <>\n                <UploadZone\n                  onUpload={handleUpload}\n                  isUploading={isUploading}\n                  accept={accept}\n                  classNames={classNames}\n                />\n                <MediaGrid\n                  items={items}\n                  selected={selected}\n                  onToggle={handleToggle}\n                  isLoading={isLoading}\n                  total={total}\n                  offset={offset}\n                  limit={ITEMS_PER_PAGE}\n                  onPageChange={setOffset}\n                  classNames={classNames}\n                />\n              </>\n            )}\n          </div>\n\n          {/* Footer — multi mode shows confirm/cancel, single mode shows item count only */}\n          <div\n            className={cn(\n              'flex items-center justify-between border-t border-zinc-200 px-6 py-4 dark:border-zinc-800',\n              classNames?.footer,\n            )}\n          >\n            <span className=\"text-sm text-zinc-500 dark:text-zinc-400\">\n              {mode === 'single'\n                ? `${total.toString()} item${total !== 1 ? 's' : ''} — click to select`\n                : selected.size > 0\n                  ? `${selected.size.toString()} selected`\n                  : `${total.toString()} item${total !== 1 ? 's' : ''}`}\n            </span>\n            <div className=\"flex gap-2\">\n              {children}\n              <DialogPrimitive.Close asChild>\n                <button\n                  type=\"button\"\n                  className={cn(\n                    'rounded-md border border-zinc-300 px-4 py-2 text-sm font-medium text-zinc-700 hover:bg-zinc-50',\n                    'dark:border-zinc-700 dark:text-zinc-300 dark:hover:bg-zinc-900',\n                    classNames?.cancelButton,\n                  )}\n                >\n                  Cancel\n                </button>\n              </DialogPrimitive.Close>\n              {mode !== 'single' && (\n                <button\n                  type=\"button\"\n                  onClick={handleConfirm}\n                  disabled={selected.size === 0}\n                  className={cn(\n                    'rounded-md bg-blue-600 px-4 py-2 text-sm font-medium text-white hover:bg-blue-500',\n                    'disabled:cursor-not-allowed disabled:opacity-50',\n                    classNames?.confirmButton,\n                  )}\n                >\n                  {`Select (${selected.size.toString()})`}\n                </button>\n              )}\n            </div>\n          </div>\n        </DialogPrimitive.Content>\n      </DialogPrimitive.Portal>\n    </DialogPrimitive.Root>\n  )\n}\n"],"mappings":";8cAkCA,SAAgB,EAA0B,EAAc,aAAmC,CACzF,IAAM,EAAU,GAAG,EAAY,QAKzB,EAAmB,KAAO,IAAmC,CACjE,GAAI,CACF,IAAM,EAAQ,MAAM,EAAI,MAAM,CAAC,CAAC,KAAK,EACrC,GAAI,OAAO,EAAK,OAAU,UAAY,EAAK,MAAM,OAAS,EAAG,OAAO,EAAK,KAC3E,MAAQ,CAER,CACA,GAAI,CACF,IAAM,EAAO,MAAM,EAAI,KAAK,EAC5B,GAAI,EAAM,OAAO,CACnB,MAAQ,CAER,CACA,MAAO,QAAQ,OAAO,EAAI,MAAM,GAClC,EAEA,MAAO,CACL,WAAY,KAAO,IAKmB,CACpC,IAAM,EAAS,IAAI,gBACf,EAAQ,QAAQ,EAAO,IAAI,SAAU,EAAQ,MAAM,EACnD,EAAQ,WAAW,EAAO,IAAI,YAAa,EAAQ,SAAS,EAChE,EAAO,IAAI,QAAS,OAAO,EAAQ,KAAK,CAAC,EACzC,EAAO,IAAI,SAAU,OAAO,EAAQ,MAAM,CAAC,EAE3C,IAAM,EAAM,GAAG,EAAQ,GAAG,EAAO,SAAS,IACpC,EAAM,MAAM,MAAM,CAAG,EAC3B,GAAI,CAAC,EAAI,GAAI,MAAU,MAAM,MAAM,EAAiB,CAAG,CAAC,EACxD,OAAO,EAAI,KAAK,CAClB,EAEA,YAAa,KAAO,IAAyC,CAC3D,IAAM,EAAW,IAAI,SACrB,EAAS,OAAO,OAAQ,CAAI,EAQ5B,EAAS,OAAO,aAAc,QAAQ,EAEtC,IAAM,EAAM,MAAM,MAAM,EAAS,CAAE,OAAQ,OAAQ,KAAM,CAAS,CAAC,EACnE,GAAI,CAAC,EAAI,GAAI,MAAU,MAAM,MAAM,EAAiB,CAAG,CAAC,EACxD,OAAO,EAAI,KAAK,CAClB,EAEA,YAAa,KAAO,IAAuC,CACzD,GAAI,CACF,IAAM,EAAM,MAAM,MAAM,GAAG,EAAQ,GAAG,GAAI,EAG1C,OAFK,EAAI,IAEF,MADa,EAAI,KAAK,EAAA,CACjB,KAAO,KAFC,IAGtB,MAAQ,CACN,OAAO,IACT,CACF,CACF,CACF,CCpGA,SAAgB,EAAG,GAAG,EAAsB,CAC1C,OAAO,EAAQ,EAAK,CAAM,CAAC,CAC7B,CCwBA,MAAa,EAAoE,CAC/E,MAAO,EACP,MAAO,EACP,SAAU,EACV,MAAO,CACT,EAGA,SAAgB,EAAc,EAA2D,CACvF,OAAO,IAAc,QAAU,KAAO,EAA2B,EACnE,CC3BA,SAAgB,EAAU,CAAE,OAAM,aAAY,WAAU,cAA8B,CACpF,IAAM,EAAU,EAAK,YAAc,QAC7B,EAAO,EAAc,EAAK,SAAS,EAEzC,OACE,EAAC,SAAD,CACE,KAAK,SACL,QAAS,EACT,UAAW,EACT,kFACA,0GACA,EACI,0CACA,wFACJ,GAAY,KACZ,GAAc,GAAY,YAC5B,WAXF,CAcG,EACC,EAAC,MAAD,CACE,IAAK,EAAK,IACV,IAAK,EAAK,KAAO,EAAK,SACtB,UAAW,EAAG,6BAA8B,GAAY,SAAS,EACjE,QAAQ,MACT,CAAA,EAED,EAAC,MAAD,CAAK,UAAU,uFACZ,GAAQ,EAAC,EAAD,CAAM,UAAU,0CAA4C,CAAA,CAClE,CAAA,EAIN,GACC,EAAC,MAAD,CAAK,UAAU,mHACb,EAAC,EAAD,CAAO,UAAU,SAAW,CAAA,CACzB,CAAA,EAIP,EAAC,MAAD,CACE,UAAW,EACT,wFACA,uDACA,GAAY,SACd,WAEA,EAAC,IAAD,CAAG,UAAU,uCAA+B,EAAK,OAAS,EAAK,QAAY,CAAA,CACxE,CAAA,CACC,GAEZ,CC/CA,SAAgB,EAAU,CACxB,QACA,WACA,WACA,YACA,QACA,SACA,QACA,eACA,cACiB,CACjB,GAAI,EACF,OACE,EAAC,MAAD,CAAK,UAAW,EAAG,wCAAyC,GAAY,IAAI,WACzE,MAAM,KAAK,CAAE,OAAQ,EAAG,CAAC,CAAC,CAAC,KAAK,EAAG,IAClC,EAAC,MAAD,CAEE,UAAW,EACT,sEACA,GAAY,OACd,CACD,EALM,YAAY,EAAE,SAAS,GAK7B,CACF,CACE,CAAA,EAIT,GAAI,EAAM,SAAW,EACnB,OACE,EAAC,MAAD,CACE,UAAW,EACT,6DACA,GAAY,KACd,WACD,+CAEI,CAAA,EAIT,IAAM,EAAa,KAAK,KAAK,EAAQ,CAAK,EACpC,EAAc,KAAK,MAAM,EAAS,CAAK,EAAI,EAEjD,OACE,EAAA,EAAA,CAAA,SAAA,CACE,EAAC,MAAD,CAAK,UAAW,EAAG,wCAAyC,GAAY,IAAI,WACzE,EAAM,IAAK,GACV,EAAC,EAAD,CAEQ,OACN,WAAY,EAAS,IAAI,EAAK,EAAE,EAChC,aAAgB,EAAS,CAAI,EACjB,YACb,EALM,EAAK,EAKX,CACF,CACE,CAAA,EACJ,EAAa,GACZ,EAAC,MAAD,CAAK,UAAU,uDAAf,CACE,EAAC,SAAD,CACE,KAAK,SACL,SAAU,GAAe,EACzB,YAAe,EAAa,EAAS,CAAK,EAC1C,UAAU,wGACX,MAEO,CAAA,EACR,EAAC,OAAD,CAAM,UAAU,oDAAhB,CACG,EAAY,MAAI,CACb,IACN,EAAC,SAAD,CACE,KAAK,SACL,SAAU,GAAe,EACzB,YAAe,EAAa,EAAS,CAAK,EAC1C,UAAU,wGACX,MAEO,CAAA,CACL,GAEP,CAAA,CAAA,CAEN,CC9FA,MAAM,EAAqB,EAA2C,IAAI,EAoB1E,SAAgB,EAAoB,CAClC,WACA,aACA,eAC2B,CAM3B,OAAO,EAAC,EAAD,CAAoB,MALb,OACL,CAAE,aAAY,aAAY,GACjC,CAAC,EAAY,CAAW,CAGY,EAAI,UAA6B,CAAA,CACzE,CAEA,SAAgB,GAAuC,CACrD,IAAM,EAAM,EAAW,CAAkB,EACzC,GAAI,CAAC,EACH,MAAU,MACR,iJAEF,EAEF,OAAO,CACT,CC/BA,MAAM,EAAiB,CACrB,CAAE,MAAO,IAAA,GAAW,MAAO,KAAM,EACjC,CAAE,MAAO,QAAS,MAAO,QAAS,EAClC,CAAE,MAAO,QAAS,MAAO,QAAS,EAClC,CAAE,MAAO,QAAS,MAAO,OAAQ,EACjC,CAAE,MAAO,WAAY,MAAO,MAAO,CACrC,EAEA,SAAgB,EAAU,CACxB,QACA,WACA,YACA,oBACA,SACA,cACiB,CAEjB,IAAM,EAAc,CAAC,EAErB,OACE,EAAC,MAAD,CAAK,UAAU,mCAAf,CACE,EAAC,MAAD,CAAK,UAAU,2BAAf,CACE,EAAC,EAAD,CAAQ,UAAU,gEAAkE,CAAA,EACpF,EAAC,QAAD,CACE,KAAK,OACE,QACP,SAAW,GAAM,EAAS,EAAE,OAAO,KAAK,EACxC,YAAY,kBACZ,UAAW,EACT,kFACA,sGACA,sDACA,GAAY,WACd,CACD,CAAA,CACE,IACJ,GACC,EAAC,MAAD,CAAK,UAAW,EAAG,aAAc,GAAY,UAAU,WACpD,EAAe,IAAK,GACnB,EAAC,SAAD,CAEE,KAAK,SACL,YAAe,EAAkB,EAAI,KAAK,EAC1C,UAAW,EACT,+DACA,IAAc,EAAI,MACd,6DACA,2EACN,WAEC,EAAI,KACC,EAXD,EAAI,KAWH,CACT,CACE,CAAA,CAEJ,GAET,CC3DA,SAAgB,EAAW,CAAE,WAAU,cAAa,SAAQ,cAA+B,CACzF,IAAM,EAAW,EAAyB,IAAI,EACxC,CAAC,EAAY,GAAiB,EAAS,EAAK,EAE5C,EAAa,EACjB,KAAO,IAAiB,CACtB,EAAE,eAAe,EACjB,EAAc,EAAK,EACnB,IAAM,EAAO,EAAE,aAAa,MAAM,GAC9B,GACF,MAAM,EAAS,CAAI,CAEvB,EACA,CAAC,CAAQ,CACX,EAEM,EAAmB,EACvB,KAAO,IAA2C,CAChD,IAAM,EAAO,EAAE,OAAO,QAAQ,GAC1B,IACF,MAAM,EAAS,CAAI,EACnB,EAAE,OAAO,MAAQ,GAErB,EACA,CAAC,CAAQ,CACX,EAEA,OACE,EAAC,SAAD,CACE,KAAK,SACL,WAAa,GAAM,CACjB,EAAE,eAAe,EACjB,EAAc,EAAI,CACpB,EACA,gBAAmB,EAAc,EAAK,EACtC,OAAQ,EACR,YAAe,EAAS,SAAS,MAAM,EACvC,UAAW,EACT,8HACA,EACI,iDACA,wFACJ,GAAY,WACZ,GAAc,GAAY,gBAC5B,WAhBF,CAkBE,EAAC,EAAD,CAAQ,UAAU,+CAAiD,CAAA,EACnE,EAAC,IAAD,CAAG,UAAU,oDACV,EAAc,eAAiB,qCAC/B,CAAA,EACH,EAAC,QAAD,CACE,IAAK,EACL,KAAK,OACL,OAAQ,GAAQ,KAAK,GAAG,EACxB,SAAU,EACV,UAAU,QACX,CAAA,CACK,GAEZ,CC1DA,SAAgB,EAAY,CAC1B,OACA,eACA,WACA,OAAO,SACP,SACA,YACA,YACA,cAAc,CAAC,EACf,QAAQ,eACR,cACA,aACA,YACA,YACmB,CACnB,GAAM,CAAE,aAAY,eAAgB,EAAe,EAG7C,CAAC,EAAO,GAAY,EAA4B,CAAC,CAAC,EAClD,CAAC,EAAO,GAAY,EAAS,CAAC,EAC9B,CAAC,EAAU,GAAe,MAA4B,IAAI,IAAI,CAAW,CAAC,EAC1E,CAAC,EAAQ,GAAa,EAAS,EAAE,EACjC,CAAC,EAAiB,GAAsB,EAA6B,CAAS,EAC9E,CAAC,EAAW,GAAgB,EAAS,EAAK,EAC1C,CAAC,EAAa,GAAkB,EAAS,EAAK,EAC9C,CAAC,EAAQ,GAAa,EAAS,CAAC,EAChC,CAAC,EAAO,GAAY,EAAwB,IAAI,EAIhD,CAAC,EAAiB,GAAsB,EAAwB,IAAI,EAGpE,EAAY,EAAY,SAAY,CACxC,EAAa,EAAI,EACjB,EAAS,IAAI,EACb,GAAI,CACF,IAAM,EAAS,MAAM,EAAW,CAC9B,OAAQ,GAAU,IAAA,GAClB,UAAW,EACX,MAAO,GACP,QACF,CAAC,EACG,EAAO,aAAe,IACxB,EAAmB,EAAO,QAAU,iDAAiD,EACrF,EAAS,CAAC,CAAC,EACX,EAAS,CAAC,IAEV,EAAmB,IAAI,EACvB,EAAS,EAAO,KAAK,EACrB,EAAS,EAAO,KAAK,EAEzB,OAAS,EAAK,CACZ,EACE,aAAe,OAAS,EAAI,QACxB,yBAAyB,EAAI,UAC7B,uBACN,CACF,QAAU,CACR,EAAa,EAAK,CACpB,CACF,EAAG,CAAC,EAAY,EAAQ,EAAiB,CAAM,CAAC,EAEhD,MAAgB,CACV,GACF,EAAU,CAEd,EAAG,CAAC,EAAM,CAAS,CAAC,EAGpB,IAAM,EAAW,EAAO,CAAI,EACtB,EAAiB,EAAO,CAAW,EACzC,EAAe,QAAU,EACzB,MAAgB,CACV,EAAS,SAAW,CAAC,IACvB,EAAU,EAAE,EACZ,EAAU,CAAC,EACX,EAAY,IAAI,IAAI,EAAe,OAAO,CAAC,GAE7C,EAAS,QAAU,CACrB,EAAG,CAAC,CAAI,CAAC,EAGT,IAAM,EAAe,EAClB,GAA0B,CAEzB,GAAI,IAAS,SAAU,CACrB,EAAS,CAAC,CAAI,CAAC,EACf,EAAa,EAAK,EAClB,MACF,CAGA,EAAa,GAAS,CACpB,IAAM,EAAO,IAAI,IAAI,CAAI,EACzB,GAAI,EAAK,IAAI,EAAK,EAAE,EAClB,EAAK,OAAO,EAAK,EAAE,MACd,CACL,GAAI,GAAa,EAAK,MAAQ,EAAW,OAAO,EAChD,EAAK,IAAI,EAAK,EAAE,CAClB,CACA,OAAO,CACT,CAAC,CACH,EACA,CAAC,EAAM,EAAW,EAAU,CAAY,CAC1C,EAEM,GAAgB,MAAkB,CAEtC,EADsB,EAAM,OAAQ,GAAS,EAAS,IAAI,EAAK,EAAE,CAC5C,CAAC,EACtB,EAAa,EAAK,CACpB,EAAG,CAAC,EAAO,EAAU,EAAU,CAAY,CAAC,EAGtC,GAAe,EACnB,KAAO,IAAe,CACpB,EAAe,EAAI,EACnB,EAAS,IAAI,EACb,GAAI,CACF,IAAM,EAAW,MAAM,EAAY,CAAI,EAGvC,GAAI,IAAS,SAAU,CACrB,EAAS,CAAC,CAAQ,CAAC,EACnB,EAAa,EAAK,EAClB,MACF,CAGA,EAAU,GAAS,CAAC,EAAU,GAAG,CAAI,CAAC,EACtC,EAAU,GAAS,EAAO,CAAC,EAC3B,EAAa,GAAS,IAAI,IAAI,CAAC,GAAG,EAAM,EAAS,EAAE,CAAC,CAAC,CACvD,OAAS,EAAK,CACZ,EACE,aAAe,OAAS,EAAI,QACxB,kBAAkB,EAAI,UACtB,kCACN,CACF,QAAU,CACR,EAAe,EAAK,CACtB,CACF,EACA,CAAC,EAAa,EAAM,EAAU,CAAY,CAC5C,EAEA,OACE,EAAC,EAAgB,KAAjB,CAA4B,OAAoB,wBAC9C,EAAC,EAAgB,OAAjB,CAAA,SAAA,CACE,EAAC,EAAgB,QAAjB,CACE,UAAW,EACT,yJACA,GAAY,OACd,CACD,CAAA,EACD,EAAC,EAAgB,QAAjB,CACE,GAAK,CAAC,GAAe,CAAE,mBAAoB,IAAA,EAAU,EACrD,UAAW,EACT,gEACA,gDACA,8FACA,GAAY,QACZ,CACF,WARF,CAWE,EAAC,MAAD,CACE,UAAW,EACT,4FACA,GAAY,MACd,WAJF,CAME,EAAC,EAAgB,MAAjB,CACE,UAAW,EACT,wDACA,GAAY,KACd,WAEC,CACoB,CAAA,EACtB,GACC,EAAC,EAAe,KAAhB,CAAqB,QAAA,YACnB,EAAC,EAAgB,YAAjB,CAAA,SAA8B,CAAyC,CAAA,CACpD,CAAA,EAEvB,EAAC,EAAgB,MAAjB,CAAuB,UAAU,mJAAjC,CACE,EAAC,EAAD,CAAG,UAAU,SAAW,CAAA,EACxB,EAAC,EAAe,KAAhB,CAAA,SAAqB,OAA0B,CAAA,CAC1B,GACpB,IAGL,EAAC,MAAD,CACE,UAAW,EACT,0DACA,GAAY,OACd,WAEA,EAAC,EAAD,CACE,MAAO,EACP,SAAU,EACV,UAAW,EACX,kBAAmB,EACnB,OAAQ,CAAC,CAAC,EACE,YACb,CAAA,CACE,CAAA,EAGL,EAAC,MAAD,CAAK,UAAU,4CAAf,CACG,GACC,EAAC,MAAD,CACE,KAAK,QACL,UAAU,mJAET,CACE,CAAA,EAEN,EACC,EAAC,MAAD,CACE,KAAK,QACL,UAAU,2HAFZ,CAIE,EAAC,IAAD,CAAG,UAAU,kEAAyD,iCAEnE,CAAA,EACH,EAAC,IAAD,CAAG,UAAU,2DACV,CACA,CAAA,EACH,EAAC,IAAD,CAAG,UAAU,2DAAkD,+EAG5D,CAAA,CACA,IAEL,EAAA,EAAA,CAAA,SAAA,CACE,EAAC,EAAD,CACE,SAAU,GACG,cACL,SACI,YACb,CAAA,EACD,EAAC,EAAD,CACS,QACG,WACV,SAAU,EACC,YACJ,QACC,SACR,MAAO,GACP,aAAc,EACF,YACb,CAAA,CACD,CAAA,CAAA,CAED,IAGL,EAAC,MAAD,CACE,UAAW,EACT,4FACA,GAAY,MACd,WAJF,CAME,EAAC,OAAD,CAAM,UAAU,oDACb,IAAS,SACN,GAAG,EAAM,SAAS,EAAE,OAAO,IAAU,EAAU,GAAN,IAAS,oBAClD,EAAS,KAAO,EACd,GAAG,EAAS,KAAK,SAAS,EAAE,WAC5B,GAAG,EAAM,SAAS,EAAE,OAAO,IAAU,EAAU,GAAN,KAC3C,CAAA,EACN,EAAC,MAAD,CAAK,UAAU,sBAAf,CACG,EACD,EAAC,EAAgB,MAAjB,CAAuB,QAAA,YACrB,EAAC,SAAD,CACE,KAAK,SACL,UAAW,EACT,iGACA,iEACA,GAAY,YACd,WACD,QAEO,CAAA,CACa,CAAA,EACtB,IAAS,UACR,EAAC,SAAD,CACE,KAAK,SACL,QAAS,GACT,SAAU,EAAS,OAAS,EAC5B,UAAW,EACT,oFACA,kDACA,GAAY,aACd,WAEC,WAAW,EAAS,KAAK,SAAS,EAAE,EAC/B,CAAA,CAEP,GACF,GACkB,GACH,CAAA,CAAA,CACJ,CAAA,CAE1B"}

package/dist/{plugin-B8tYWi8Q.mjs → plugin-DMFiH96i.mjs}

@@ -1,2 +1,2 @@
-import"./routes-C_LZXK6k.mjs";import"./entity-Caba_NFw.mjs";import"./image-styles-settings-ClIA2MJI.mjs";import"@murumets-ee/core";import"@murumets-ee/media/image-styles";function e(){throw Error(`@murumets-ee/media plugin not initialized. Add media() to your plugins array.`)}export{e as getMediaConfig};
-//# sourceMappingURL=plugin-B8tYWi8Q.mjs.map
+import"./routes-B38Mz1FZ.mjs";import"./entity-Caba_NFw.mjs";import"./image-styles-settings-ClIA2MJI.mjs";import"@murumets-ee/core";import"@murumets-ee/media/image-styles";function e(){throw Error(`@murumets-ee/media plugin not initialized. Add media() to your plugins array.`)}export{e as getMediaConfig};
+//# sourceMappingURL=plugin-DMFiH96i.mjs.map

package/dist/{plugin-B8tYWi8Q.mjs.map → plugin-DMFiH96i.mjs.map}

@@ -1 +1 @@
-{"version":3,"file":"plugin-B8tYWi8Q.mjs","names":[],"sources":["../src/plugin.ts"],"sourcesContent":["/**\n * Media plugin — auto-registers the Media entity, mounts admin routes, and\n * contributes sidebar + default-route scaffolding for the admin shell.\n *\n * @example\n * ```typescript\n * import { media } from '@murumets-ee/media/plugin'\n *\n * export default defineLumiConfig({\n *   plugins: [\n *     storage(),\n *     media({ maxUploadSize: 10 * 1024 * 1024 }),\n *   ],\n * })\n * ```\n */\n\nimport { definePlugin } from '@murumets-ee/core'\n// Self-reference the `./image-styles` subpath (not the internal source\n// files) so the plugin bundle externalizes the React components instead\n// of inlining them — the subpath is built separately with a `'use client'`\n// banner, and Next.js needs to see that boundary preserved.\nimport { ImageStylesManager, RegenerateVariantsAction } from '@murumets-ee/media/image-styles'\nimport { mediaRoutes } from './admin/routes.js'\nimport { Media } from './entity.js'\nimport { imageStylesSettings } from './image-styles-settings.js'\n// Relative: `src/i18n.ts` is a sibling entry of this one in the same tsdown\n// config, so the loader lands in a shared chunk rather than being\n// duplicated, and its `import('./messages/et.json')` resolves against\n// `dist/`, which this package's build script populates.\nimport { getMediaMessages } from './i18n.js'\nimport type { MediaPluginConfig } from './types.js'\n\nlet _mediaConfig: Required<MediaPluginConfig> | null = null\n\n/**\n * Get the resolved media plugin configuration.\n * Throws if plugin not initialized.\n */\nexport function getMediaConfig(): Required<MediaPluginConfig> {\n  if (!_mediaConfig) {\n    throw new Error('@murumets-ee/media plugin not initialized. Add media() to your plugins array.')\n  }\n  return _mediaConfig\n}\n\n/**\n * Media plugin factory.\n *\n * - Registers the Media entity\n * - Mounts the media admin API routes\n * - Contributes sidebar + default-route metadata\n * - Declares @murumets-ee/storage + @murumets-ee/settings as required deps\n *   (framework-validated before any plugin init runs — see `requires` field below)\n * - Captures resolved configuration for `getMediaConfig()`\n */\nexport function media(config?: MediaPluginConfig) {\n  const resolvedConfig: Required<MediaPluginConfig> = {\n    acceptedTypes: config?.acceptedTypes ?? ['image/*', 'video/*', 'audio/*', 'application/pdf'],\n    maxUploadSize: config?.maxUploadSize ?? 50 * 1024 * 1024,\n    defaultVisibility: config?.defaultVisibility ?? 'public',\n    imageStyles: config?.imageStyles ?? {\n      thumbnail: { width: 200, height: 200, fit: 'cover', format: 'webp', quality: 80 },\n    },\n  }\n\n  return definePlugin({\n    name: '@murumets-ee/media',\n    // Declarative dep validation — replaces the per-plugin\n    // `if (!app.plugins.has(...)) throw` loop that used to live in\n    // `init`. The framework validates BEFORE any init runs, so a\n    // missing dep surfaces immediately with the full punchlist\n    // instead of throwing partway through boot.\n    requires: ['@murumets-ee/storage', '@murumets-ee/settings'],\n    shared: {\n      // The interface-message catalogue, declared rather than left for each\n      // app to remember (commerce-launch F148/F155). The framework gathers\n      // it at the merge step; nothing loads a locale until one is asked for.\n      messages: getMediaMessages,\n      // Self-contributes the media.imageStyles namespace. The merge engine\n      // auto-derives the permission resource (`settings_media.imageStyles`)\n      // and the sidebar entry under the \"Settings\" group. The app's\n      // admin-api-handler call site aggregates plugin-contributed\n      // namespaces into `settingsRoutes(...)` (see apps/admin's\n      // `getAllSettings()` for the canonical pattern); apps that follow\n      // the scaffold pattern get this for free.\n      // Drop the `as PluginSettingsDefinition` cast — it would widen the\n      // namespace literal (e.g. `'media.imageStyles'`) to `string`,\n      // leaking `settings_${string}:view|update` into the resolved\n      // permission union via `<const N>` capture loss.\n      // `imageStylesSettings` is structurally a superset of\n      // `PluginSettingsDefinition` (full vs. narrow `SettingsDefinition`),\n      // which TS accepts directly. The `readonly` outer tuple comes from\n      // the parent definePlugin's `<const S>` capture.\n      settings: [imageStylesSettings],\n    },\n    server: {\n      entities: [Media],\n      routes: [...mediaRoutes()],\n      init: async (app) => {\n        _mediaConfig = resolvedConfig\n\n        // Image style defaults live in the plugin config and are exposed via\n        // `getMediaConfig()`. Persistent overrides go to the settings DB\n        // through the generic settings API at `/api/admin/settings/media.imageStyles`\n        // — see `image-styles-settings.ts`. `resolveImageStyles` reads\n        // DB-first, config-fallback.\n        //\n        // We deliberately do NOT seed the DB here. Init must stay lightweight:\n        // it runs in every context (Next.js server, Next.js build, CLI commands).\n        // The prior eager-seed path pulled in `@murumets-ee/settings`'s main entry —\n        // which carries `import 'server-only'` — and crashed non-RSC Node bootstrap.\n\n        app.logger.info(\n          {\n            acceptedTypes: resolvedConfig.acceptedTypes,\n            maxUploadSize: resolvedConfig.maxUploadSize,\n            defaultVisibility: resolvedConfig.defaultVisibility,\n          },\n          'Media plugin initialized',\n        )\n      },\n    },\n    adminUi: {\n      sidebar: [\n        {\n          id: 'media',\n          group: 'Library',\n          label: 'Media',\n          href: '/admin/media',\n          iconName: 'image',\n        },\n      ],\n      defaultRoutes: [\n        // Routing only — sidebar nav comes from `adminUi.sidebar` above\n        // (admin-page-routing SD003).\n        {\n          path: 'media',\n          factory: 'MediaListPage',\n        },\n        {\n          path: 'media/[id]',\n          factory: 'MediaEditPage',\n        },\n      ],\n      // Self-contributes the rich image-styles editor and the\n      // \"Regenerate All Variants\" action. Apps don't have to wire either\n      // — they appear automatically on /admin/settings/media.imageStyles\n      // (route + sidebar entry auto-derived from `shared.settings`).\n      settingRenderers: {\n        'media.imageStyles': ImageStylesManager,\n      },\n      settingsActions: {\n        'media.imageStyles': RegenerateVariantsAction,\n      },\n    },\n  })\n}\n"],"mappings":"2KAuCA,SAAgB,GAA8C,CAE1D,MAAU,MAAM,+EAA+E,CAGnG"}
+{"version":3,"file":"plugin-DMFiH96i.mjs","names":[],"sources":["../src/plugin.ts"],"sourcesContent":["/**\n * Media plugin — auto-registers the Media entity, mounts admin routes, and\n * contributes sidebar + default-route scaffolding for the admin shell.\n *\n * @example\n * ```typescript\n * import { media } from '@murumets-ee/media/plugin'\n *\n * export default defineLumiConfig({\n *   plugins: [\n *     storage(),\n *     media({ maxUploadSize: 10 * 1024 * 1024 }),\n *   ],\n * })\n * ```\n */\n\nimport { definePlugin } from '@murumets-ee/core'\n// Self-reference the `./image-styles` subpath (not the internal source\n// files) so the plugin bundle externalizes the React components instead\n// of inlining them — the subpath is built separately with a `'use client'`\n// banner, and Next.js needs to see that boundary preserved.\nimport { ImageStylesManager, RegenerateVariantsAction } from '@murumets-ee/media/image-styles'\nimport { mediaRoutes } from './admin/routes.js'\nimport { Media } from './entity.js'\nimport { imageStylesSettings } from './image-styles-settings.js'\n// Relative: `src/i18n.ts` is a sibling entry of this one in the same tsdown\n// config, so the loader lands in a shared chunk rather than being\n// duplicated, and its `import('./messages/et.json')` resolves against\n// `dist/`, which this package's build script populates.\nimport { getMediaMessages } from './i18n.js'\nimport type { MediaPluginConfig } from './types.js'\n\nlet _mediaConfig: Required<MediaPluginConfig> | null = null\n\n/**\n * Get the resolved media plugin configuration.\n * Throws if plugin not initialized.\n */\nexport function getMediaConfig(): Required<MediaPluginConfig> {\n  if (!_mediaConfig) {\n    throw new Error('@murumets-ee/media plugin not initialized. Add media() to your plugins array.')\n  }\n  return _mediaConfig\n}\n\n/**\n * Media plugin factory.\n *\n * - Registers the Media entity\n * - Mounts the media admin API routes\n * - Contributes sidebar + default-route metadata\n * - Declares @murumets-ee/storage + @murumets-ee/settings as required deps\n *   (framework-validated before any plugin init runs — see `requires` field below)\n * - Captures resolved configuration for `getMediaConfig()`\n */\nexport function media(config?: MediaPluginConfig) {\n  const resolvedConfig: Required<MediaPluginConfig> = {\n    acceptedTypes: config?.acceptedTypes ?? ['image/*', 'video/*', 'audio/*', 'application/pdf'],\n    maxUploadSize: config?.maxUploadSize ?? 50 * 1024 * 1024,\n    defaultVisibility: config?.defaultVisibility ?? 'public',\n    imageStyles: config?.imageStyles ?? {\n      thumbnail: { width: 200, height: 200, fit: 'cover', format: 'webp', quality: 80 },\n    },\n  }\n\n  return definePlugin({\n    name: '@murumets-ee/media',\n    // Declarative dep validation — replaces the per-plugin\n    // `if (!app.plugins.has(...)) throw` loop that used to live in\n    // `init`. The framework validates BEFORE any init runs, so a\n    // missing dep surfaces immediately with the full punchlist\n    // instead of throwing partway through boot.\n    requires: ['@murumets-ee/storage', '@murumets-ee/settings'],\n    shared: {\n      // The interface-message catalogue, declared rather than left for each\n      // app to remember (commerce-launch F148/F155). The framework gathers\n      // it at the merge step; nothing loads a locale until one is asked for.\n      messages: getMediaMessages,\n      // Self-contributes the media.imageStyles namespace. The merge engine\n      // auto-derives the permission resource (`settings_media.imageStyles`)\n      // and the sidebar entry under the \"Settings\" group. The app's\n      // admin-api-handler call site aggregates plugin-contributed\n      // namespaces into `settingsRoutes(...)` (see apps/admin's\n      // `getAllSettings()` for the canonical pattern); apps that follow\n      // the scaffold pattern get this for free.\n      // Drop the `as PluginSettingsDefinition` cast — it would widen the\n      // namespace literal (e.g. `'media.imageStyles'`) to `string`,\n      // leaking `settings_${string}:view|update` into the resolved\n      // permission union via `<const N>` capture loss.\n      // `imageStylesSettings` is structurally a superset of\n      // `PluginSettingsDefinition` (full vs. narrow `SettingsDefinition`),\n      // which TS accepts directly. The `readonly` outer tuple comes from\n      // the parent definePlugin's `<const S>` capture.\n      settings: [imageStylesSettings],\n    },\n    server: {\n      entities: [Media],\n      routes: [...mediaRoutes()],\n      init: async (app) => {\n        _mediaConfig = resolvedConfig\n\n        // Image style defaults live in the plugin config and are exposed via\n        // `getMediaConfig()`. Persistent overrides go to the settings DB\n        // through the generic settings API at `/api/admin/settings/media.imageStyles`\n        // — see `image-styles-settings.ts`. `resolveImageStyles` reads\n        // DB-first, config-fallback.\n        //\n        // We deliberately do NOT seed the DB here. Init must stay lightweight:\n        // it runs in every context (Next.js server, Next.js build, CLI commands).\n        // The prior eager-seed path pulled in `@murumets-ee/settings`'s main entry —\n        // which carries `import 'server-only'` — and crashed non-RSC Node bootstrap.\n\n        app.logger.info(\n          {\n            acceptedTypes: resolvedConfig.acceptedTypes,\n            maxUploadSize: resolvedConfig.maxUploadSize,\n            defaultVisibility: resolvedConfig.defaultVisibility,\n          },\n          'Media plugin initialized',\n        )\n      },\n    },\n    adminUi: {\n      sidebar: [\n        {\n          id: 'media',\n          group: 'Library',\n          label: 'Media',\n          href: '/admin/media',\n          iconName: 'image',\n        },\n      ],\n      defaultRoutes: [\n        // Routing only — sidebar nav comes from `adminUi.sidebar` above\n        // (admin-page-routing SD003).\n        {\n          path: 'media',\n          factory: 'MediaListPage',\n        },\n        {\n          path: 'media/[id]',\n          factory: 'MediaEditPage',\n        },\n      ],\n      // Self-contributes the rich image-styles editor and the\n      // \"Regenerate All Variants\" action. Apps don't have to wire either\n      // — they appear automatically on /admin/settings/media.imageStyles\n      // (route + sidebar entry auto-derived from `shared.settings`).\n      settingRenderers: {\n        'media.imageStyles': ImageStylesManager,\n      },\n      settingsActions: {\n        'media.imageStyles': RegenerateVariantsAction,\n      },\n    },\n  })\n}\n"],"mappings":"2KAuCA,SAAgB,GAA8C,CAE1D,MAAU,MAAM,+EAA+E,CAGnG"}

package/dist/plugin.mjs

@@ -1,2 +1,2 @@
-import{t as e}from"./entity-fxw-Qywj.mjs";import{imageStylesSettings as t}from"./image-styles-settings.mjs";import{getMediaMessages as n}from"./i18n.mjs";import{combineAdminRoutes as r,defineAdminRoute as i,definePlugin as a,safeAudit as o}from"@murumets-ee/core";import{ImageStylesManager as s,RegenerateVariantsAction as c}from"@murumets-ee/media/image-styles";const l=/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;function u(e){return e!==void 0&&l.test(e)}const d=[`image`,`video`,`audio`,`document`,`other`];function f(e){return d.includes(e)}function p(e,t){if(e===null||!/^\d+$/.test(e))return t;let n=Number(e);return Number.isSafeInteger(n)?n:t}function m(e,t=200){return new Response(JSON.stringify(e),{status:t,headers:{"Content-Type":`application/json`}})}function h(e,t){return m({error:e},t)}const g={clientPromise:null};async function _(){if(!g.clientPromise){let e=(async()=>{let{getApp:e}=await import(`@murumets-ee/core`),{createStorageClient:t}=await import(`@murumets-ee/storage`),{getStorageConfig:n}=await import(`@murumets-ee/storage/plugin`),r=e();return t(n(),{app:r})})();e.catch(()=>{g.clientPromise===e&&(g.clientPromise=null)}),g.clientPromise=e}return g.clientPromise}async function v(){let{createAdminClient:e}=await import(`@murumets-ee/core/clients`),{MediaClient:t}=await import(`./client.mjs`),{Media:n}=await import(`./entity-fxw-Qywj.mjs`).then(e=>e.n),r=await _();return new t({admin:e(n),storage:r})}const y=async(e,t)=>{let{isStorageConfigured:n,getStorageConfigReason:r}=await import(`@murumets-ee/storage`),i=t.segments;if(i.length===2&&i[1]===`usage`){let e=i[0];if(!u(e))return h(`Invalid media ID format`,400);let{findMediaUsages:t}=await import(`./usage.mjs`),{getApp:n}=await import(`@murumets-ee/core`);return m({usages:await t(e,n())})}if(i.length>=2)return h(`Not found`,404);let a=i.length>0?i[0]:void 0;if(a!==void 0&&!u(a))return h(`Invalid media ID format`,400);if(!n()){let e=r()??`Storage not configured`;return i.length>0?m({error:e,configured:!1,reason:e},503):m({items:[],total:0,configured:!1,reason:e})}let o=await v();if(a!==void 0){let e=await o.findById(a);if(!e)return h(`Media not found`,404);let t=await o.getUrl(a);return m({...e,url:t})}let s=new URL(e.url),c=s.searchParams.get(`search`)??void 0,l=s.searchParams.get(`mediaType`),d=l!==null&&f(l)?l:void 0,g=Math.min(Math.max(p(s.searchParams.get(`limit`),24),1),100),_=Math.min(p(s.searchParams.get(`offset`),0),1e5),y=await o.findMany({...c!==void 0&&{search:c},...d!==void 0&&{mediaType:d},limit:g,offset:_}),b=y.items.map(e=>e.id),[x,S]=await Promise.all([o.getUrls(b),o.getVariantUrls(b,`thumbnail`)]);return m({items:y.items.map(e=>{let t=S.get(e.id);return{id:e.id,title:e.title??null,alt:e.alt??null,filename:e.filename,mimeType:e.mimeType,size:e.size,mediaType:e.mediaType,url:x.get(e.id)??``,...t!==void 0&&{thumbnailUrl:t},width:e.width??null,height:e.height??null}}),total:y.total})},b=async(e,t)=>{let{isStorageConfigured:n,getStorageConfigReason:r,detectMimeType:i}=await import(`@murumets-ee/storage`);if(t.segments.length>0)return h(`Not found`,404);if(!n())return h(r()??`Storage not configured`,503);let a=await v(),s=await e.formData(),c=s.get(`file`);if(!(c instanceof File)||c.size===0)return h(`No file provided`,400);if(c.size>50*1024*1024)return h(`File too large: ${(c.size/1024/1024).toFixed(1)} MB exceeds 50 MB limit`,400);let l=Buffer.from(await c.arrayBuffer()),{mimeType:u,mismatch:d}=await i(l,c.type||`application/octet-stream`);if(d)return h(`File content doesn't match declared type: claimed ${c.type}, detected ${u}`,400);let f=s.get(`visibility`);if(f!==null&&f!==`public`&&f!==`private`)return h(`Field 'visibility' must be 'public' or 'private'`,400);let p=await a.upload(l,{filename:c.name,mimeType:u,size:c.size,uploadedBy:t.user.id,...f!==null&&{visibility:f}}),g={id:p.media.id,title:p.media.title??null,alt:p.media.alt??null,filename:p.media.filename,mimeType:p.media.mimeType,size:p.media.size,mediaType:p.media.mediaType,url:p.url,width:p.media.width??null,height:p.media.height??null};return o(t,{action:`media.upload`,entityType:`media`,entityId:p.media.id,userId:t.user.id,...t.user.name!==void 0&&{userName:t.user.name},changes:{filename:p.media.filename,mimeType:p.media.mimeType,size:p.media.size,mediaType:p.media.mediaType}}),m(g,201)},x=async(e,t)=>{let{isStorageConfigured:n,getStorageConfigReason:r}=await import(`@murumets-ee/storage`);if(t.segments.length!==1)return h(`Not found`,404);if(!n())return h(r()??`Storage not configured`,503);let{regenerateAllVariants:i}=await import(`./regenerate-variants-sit6LbUo.mjs`),{getApp:a,getContext:s}=await import(`@murumets-ee/core`),{resolveImageStyles:c}=await import(`./resolve-image-styles-iN9JbZYf.mjs`),{createStorageClient:l}=await import(`@murumets-ee/storage`),{getStorageConfig:u}=await import(`@murumets-ee/storage/plugin`),d=a(),f=await c(d,d.logger);if(!f||Object.keys(f).length===0)return h(`No image styles configured`,400);let p=await i({app:d,storage:l(u(),{app:d}),logger:d.logger.child({media:!0}),styles:f,contextResolver:()=>{let e=s();if(!(!e?.user||!e?.checker))return{user:e.user,checker:e.checker,...e.scope!==void 0&&{scope:e.scope}}}});return o(t,{action:`media.regenerate_variants`,userId:t.user.id,...t.user.name!==void 0&&{userName:t.user.name},metadata:{total:p.total,processed:p.processed,errors:p.errors}}),m(p)},S=async(e,t)=>{let n=t.segments;if(n.length===0)return h(`Media ID required`,400);if(n.length>1)return h(`Not found`,404);let r=n[0];if(!u(r))return h(`Invalid media ID format`,400);let{isStorageConfigured:i,getStorageConfigReason:a}=await import(`@murumets-ee/storage`);return i()?(await(await v()).delete(r),o(t,{action:`media.delete`,entityType:`media`,entityId:r,userId:t.user.id,...t.user.name!==void 0&&{userName:t.user.name}}),m({deleted:1})):h(a()??`Storage not configured`,503)},C=[`admin`,`editor`,`agent`,`viewer`],w=[`admin`,`editor`];function T(){return r([i({prefix:`media`,path:``,method:`GET`,permission:`media:view`,defaultRoles:C,matchAnyPath:!0,description:`Read media — list, single item, or referencing-entity usage report.`,handler:y}),i({prefix:`media`,path:``,method:`POST`,permission:`media:create`,defaultRoles:w,description:"Upload a media file (multipart FormData with `file` field).",handler:b}),i({prefix:`media`,path:`regenerate-variants`,method:`POST`,permission:`media:create`,defaultRoles:w,description:`Regenerate every image-style variant for every media row.`,handler:x}),i({prefix:`media`,path:``,method:`DELETE`,permission:`media:delete`,defaultRoles:w,matchAnyPath:!0,description:`Delete a media record + its storage object.`,handler:S})])}let E=null;function D(){if(!E)throw Error(`@murumets-ee/media plugin not initialized. Add media() to your plugins array.`);return E}function O(r){let i={acceptedTypes:r?.acceptedTypes??[`image/*`,`video/*`,`audio/*`,`application/pdf`],maxUploadSize:r?.maxUploadSize??50*1024*1024,defaultVisibility:r?.defaultVisibility??`public`,imageStyles:r?.imageStyles??{thumbnail:{width:200,height:200,fit:`cover`,format:`webp`,quality:80}}};return a({name:`@murumets-ee/media`,requires:[`@murumets-ee/storage`,`@murumets-ee/settings`],shared:{messages:n,settings:[t]},server:{entities:[e],routes:[...T()],init:async e=>{E=i,e.logger.info({acceptedTypes:i.acceptedTypes,maxUploadSize:i.maxUploadSize,defaultVisibility:i.defaultVisibility},`Media plugin initialized`)}},adminUi:{sidebar:[{id:`media`,group:`Library`,label:`Media`,href:`/admin/media`,iconName:`image`}],defaultRoutes:[{path:`media`,factory:`MediaListPage`},{path:`media/[id]`,factory:`MediaEditPage`}],settingRenderers:{"media.imageStyles":s},settingsActions:{"media.imageStyles":c}}})}export{D as getMediaConfig,O as media};
+import{t as e}from"./entity-fxw-Qywj.mjs";import{imageStylesSettings as t}from"./image-styles-settings.mjs";import{getMediaMessages as n}from"./i18n.mjs";import{combineAdminRoutes as r,defineAdminRoute as i,definePlugin as a,safeAudit as o}from"@murumets-ee/core";import{ImageStylesManager as s,RegenerateVariantsAction as c}from"@murumets-ee/media/image-styles";const l=/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;function u(e){return e!==void 0&&l.test(e)}const d=[`image`,`video`,`audio`,`document`,`other`];function f(e){return d.includes(e)}function p(e,t){if(e===null||!/^\d+$/.test(e))return t;let n=Number(e);return Number.isSafeInteger(n)?n:t}function m(e,t=200){return new Response(JSON.stringify(e),{status:t,headers:{"Content-Type":`application/json`}})}function h(e,t){return m({error:e},t)}const g={clientPromise:null};async function _(){if(!g.clientPromise){let e=(async()=>{let{getApp:e}=await import(`@murumets-ee/core`),{createStorageClient:t}=await import(`@murumets-ee/storage`),{getStorageConfig:n}=await import(`@murumets-ee/storage/plugin`),r=e();return t(n(),{app:r})})();e.catch(()=>{g.clientPromise===e&&(g.clientPromise=null)}),g.clientPromise=e}return g.clientPromise}async function v(){let{createAdminClient:e}=await import(`@murumets-ee/core/clients`),{MediaClient:t}=await import(`./client.mjs`),{Media:n}=await import(`./entity-fxw-Qywj.mjs`).then(e=>e.n),r=await _();return new t({admin:e(n),storage:r})}const y=async(e,t)=>{let{isStorageConfigured:n,getStorageConfigReason:r}=await import(`@murumets-ee/storage`),i=t.segments;if(i.length===2&&i[1]===`usage`){let e=i[0];if(!u(e))return h(`Invalid media ID format`,400);let{findMediaUsages:t}=await import(`./usage.mjs`),{getApp:n}=await import(`@murumets-ee/core`);return m({usages:await t(e,n())})}if(i.length>=2)return h(`Not found`,404);let a=i.length>0?i[0]:void 0;if(a!==void 0&&!u(a))return h(`Invalid media ID format`,400);if(!n()){let e=r()??`Storage not configured`;return i.length>0?m({error:e,configured:!1,reason:e},503):m({items:[],total:0,configured:!1,reason:e})}let o=await v();if(a!==void 0){let e=await o.findById(a);if(!e)return h(`Media not found`,404);let t=await o.getUrl(a);return m({...e,url:t})}let s=new URL(e.url),c=s.searchParams.get(`search`)??void 0,l=s.searchParams.get(`mediaType`),d=l!==null&&f(l)?l:void 0,g=Math.min(Math.max(p(s.searchParams.get(`limit`),24),1),100),_=Math.min(p(s.searchParams.get(`offset`),0),1e5),y=await o.findMany({...c!==void 0&&{search:c},...d!==void 0&&{mediaType:d},limit:g,offset:_}),b=y.items.map(e=>e.id),x=y.items.filter(e=>e.mediaType===`image`).map(e=>e.id),[S,C]=await Promise.all([o.getUrls(b),o.getVariantUrls(x,`thumbnail`)]);return m({items:y.items.map(e=>{let t=e.mediaType===`image`?C.get(e.id):void 0;return{id:e.id,title:e.title??null,alt:e.alt??null,filename:e.filename,mimeType:e.mimeType,size:e.size,mediaType:e.mediaType,url:S.get(e.id)??``,...t!==void 0&&{thumbnailUrl:t},width:e.width??null,height:e.height??null}}),total:y.total})},b=async(e,t)=>{let{isStorageConfigured:n,getStorageConfigReason:r,detectMimeType:i}=await import(`@murumets-ee/storage`);if(t.segments.length>0)return h(`Not found`,404);if(!n())return h(r()??`Storage not configured`,503);let a=await v(),s=await e.formData(),c=s.get(`file`);if(!(c instanceof File)||c.size===0)return h(`No file provided`,400);if(c.size>50*1024*1024)return h(`File too large: ${(c.size/1024/1024).toFixed(1)} MB exceeds 50 MB limit`,400);let l=Buffer.from(await c.arrayBuffer()),{mimeType:u,mismatch:d}=await i(l,c.type||`application/octet-stream`);if(d)return h(`File content doesn't match declared type: claimed ${c.type}, detected ${u}`,400);let f=s.get(`visibility`);if(f!==null&&f!==`public`&&f!==`private`)return h(`Field 'visibility' must be 'public' or 'private'`,400);let p=await a.upload(l,{filename:c.name,mimeType:u,size:c.size,uploadedBy:t.user.id,...f!==null&&{visibility:f}}),g={id:p.media.id,title:p.media.title??null,alt:p.media.alt??null,filename:p.media.filename,mimeType:p.media.mimeType,size:p.media.size,mediaType:p.media.mediaType,url:p.url,width:p.media.width??null,height:p.media.height??null};return o(t,{action:`media.upload`,entityType:`media`,entityId:p.media.id,userId:t.user.id,...t.user.name!==void 0&&{userName:t.user.name},changes:{filename:p.media.filename,mimeType:p.media.mimeType,size:p.media.size,mediaType:p.media.mediaType}}),m(g,201)},x=async(e,t)=>{let{isStorageConfigured:n,getStorageConfigReason:r}=await import(`@murumets-ee/storage`);if(t.segments.length!==1)return h(`Not found`,404);if(!n())return h(r()??`Storage not configured`,503);let{regenerateAllVariants:i}=await import(`./regenerate-variants-sit6LbUo.mjs`),{getApp:a,getContext:s}=await import(`@murumets-ee/core`),{resolveImageStyles:c}=await import(`./resolve-image-styles-iN9JbZYf.mjs`),{createStorageClient:l}=await import(`@murumets-ee/storage`),{getStorageConfig:u}=await import(`@murumets-ee/storage/plugin`),d=a(),f=await c(d,d.logger);if(!f||Object.keys(f).length===0)return h(`No image styles configured`,400);let p=await i({app:d,storage:l(u(),{app:d}),logger:d.logger.child({media:!0}),styles:f,contextResolver:()=>{let e=s();if(!(!e?.user||!e?.checker))return{user:e.user,checker:e.checker,...e.scope!==void 0&&{scope:e.scope}}}});return o(t,{action:`media.regenerate_variants`,userId:t.user.id,...t.user.name!==void 0&&{userName:t.user.name},metadata:{total:p.total,processed:p.processed,errors:p.errors}}),m(p)},S=async(e,t)=>{let n=t.segments;if(n.length===0)return h(`Media ID required`,400);if(n.length>1)return h(`Not found`,404);let r=n[0];if(!u(r))return h(`Invalid media ID format`,400);let{isStorageConfigured:i,getStorageConfigReason:a}=await import(`@murumets-ee/storage`);return i()?(await(await v()).delete(r),o(t,{action:`media.delete`,entityType:`media`,entityId:r,userId:t.user.id,...t.user.name!==void 0&&{userName:t.user.name}}),m({deleted:1})):h(a()??`Storage not configured`,503)},C=[`admin`,`editor`,`agent`,`viewer`],w=[`admin`,`editor`];function T(){return r([i({prefix:`media`,path:``,method:`GET`,permission:`media:view`,defaultRoles:C,matchAnyPath:!0,description:`Read media — list, single item, or referencing-entity usage report.`,handler:y}),i({prefix:`media`,path:``,method:`POST`,permission:`media:create`,defaultRoles:w,description:"Upload a media file (multipart FormData with `file` field).",handler:b}),i({prefix:`media`,path:`regenerate-variants`,method:`POST`,permission:`media:create`,defaultRoles:w,description:`Regenerate every image-style variant for every media row.`,handler:x}),i({prefix:`media`,path:``,method:`DELETE`,permission:`media:delete`,defaultRoles:w,matchAnyPath:!0,description:`Delete a media record + its storage object.`,handler:S})])}let E=null;function D(){if(!E)throw Error(`@murumets-ee/media plugin not initialized. Add media() to your plugins array.`);return E}function O(r){let i={acceptedTypes:r?.acceptedTypes??[`image/*`,`video/*`,`audio/*`,`application/pdf`],maxUploadSize:r?.maxUploadSize??50*1024*1024,defaultVisibility:r?.defaultVisibility??`public`,imageStyles:r?.imageStyles??{thumbnail:{width:200,height:200,fit:`cover`,format:`webp`,quality:80}}};return a({name:`@murumets-ee/media`,requires:[`@murumets-ee/storage`,`@murumets-ee/settings`],shared:{messages:n,settings:[t]},server:{entities:[e],routes:[...T()],init:async e=>{E=i,e.logger.info({acceptedTypes:i.acceptedTypes,maxUploadSize:i.maxUploadSize,defaultVisibility:i.defaultVisibility},`Media plugin initialized`)}},adminUi:{sidebar:[{id:`media`,group:`Library`,label:`Media`,href:`/admin/media`,iconName:`image`}],defaultRoutes:[{path:`media`,factory:`MediaListPage`},{path:`media/[id]`,factory:`MediaEditPage`}],settingRenderers:{"media.imageStyles":s},settingsActions:{"media.imageStyles":c}}})}export{D as getMediaConfig,O as media};
 //# sourceMappingURL=plugin.mjs.map

package/dist/plugin.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"plugin.mjs","names":[],"sources":["../src/admin/routes.ts","../src/plugin.ts"],"sourcesContent":["/**\n * Media admin routes — one static `defineAdminRoute` per HTTP method.\n *\n * **URL surface served by this module:**\n *\n *   - GET    /api/admin/media                       — list with search/filter + URLs\n *   - GET    /api/admin/media/<id>                  — single record with URL\n *   - GET    /api/admin/media/<id>/usage            — entities referencing this media\n *   - POST   /api/admin/media                       — upload (multipart FormData)\n *   - POST   /api/admin/media/regenerate-variants   — bulk variant regeneration\n *   - DELETE /api/admin/media/<id>                  — delete + storage cleanup\n *\n * Standard entity CRUD (PATCH with translations) falls through to the\n * generic entity handler — add `Media` to `entities` in your handler config.\n *\n * **Why per-method `defineAdminRoute`** (vs. the previous top-level\n * `resource: 'media'` + auto-mapped permission):\n *\n *   - The wrapper (`guardedHandler` from `@murumets-ee/core`) owns the\n *     permission gate, `permission.denied` audit, and 403 body shape\n *     uniformly with every other migrated plugin. The previous shape\n *     relied on `METHOD_TO_ACTION` auto-mapping at the api-handler\n *     dispatch level which couldn't emit per-route audit metadata.\n *   - Inline `if (!checkPermission('media', 'create')) ...` defenses\n *     at the regenerate-variants / upload / delete branches are now\n *     redundant — the wrapper enforces the permission BEFORE the\n *     handler runs.\n *\n * **`matchAnyPath` rationale:** media's URL surface predates the\n * static-second-segment convention every other plugin follows\n * (`/taxonomy/<vocab>/<id>`, `/settings/<namespace>/<rest>`). The\n * second segment under `/media` is the media id itself — a runtime\n * UUID — which the dispatcher's literal `segments[0]` match would\n * miss for every request. The catch-all flag declares \"this entry\n * claims every (prefix, method) sub-path no other entry matched\" so\n * the existing URL contract works under the per-method dispatch\n * model. Static POST sub-paths (`regenerate-variants`) take\n * precedence over the catch-all entry on POST. See\n * `DefineAdminRouteSpec.matchAnyPath` in `@murumets-ee/core` for the\n * full contract.\n *\n * **Default roles:** broad for view (`['admin', 'editor', 'agent',\n * 'viewer']`), narrower for writes (`['admin', 'editor']`).\n * Conservative starting point — apps can grant more via the\n * Permissions UI.\n *\n * @example\n * ```typescript\n * import { createAdminApiHandler } from '@murumets-ee/admin-ui/server'\n * import { mediaRoutes } from '@murumets-ee/media/admin'\n * import { Media } from '@murumets-ee/media'\n *\n * const handler = createAdminApiHandler({\n *   authenticate: async (req) => { ... },\n *   entities: [Article, Media],\n *   routes: [...mediaRoutes()],\n * })\n * ```\n */\n\nimport {\n  type AdminRoute,\n  type AdminRouteHandler,\n  combineAdminRoutes,\n  defineAdminRoute,\n  safeAudit,\n} from '@murumets-ee/core'\nimport type { MediaClient } from '../client.js'\nimport type { MediaPickerItem, MediaPickerListResult } from '../picker/types.js'\n\n// ---------------------------------------------------------------------------\n// Validation\n// ---------------------------------------------------------------------------\n\nconst UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i\n\nfunction isValidUuid(value: string | undefined): value is string {\n  return value !== undefined && UUID_RE.test(value)\n}\n\n/**\n * Closed enum of allowed `mediaType` filter values, in lockstep with the\n * `mediaType` field on the Media entity. The list MUST match\n * `MediaListOptions.mediaType` (declared in `../types.js`) — TypeScript\n * doesn't link the two automatically, so the small drift risk is\n * accepted in exchange for not pulling a runtime dep on the entity\n * schema package just to read its enum.\n *\n * Used as both the runtime allowlist (`isAllowedMediaType`) and the\n * source of truth for the narrowed type the guard produces — keeping\n * `as` casts off the handler's hot path.\n */\nconst ALLOWED_MEDIA_TYPES = ['image', 'video', 'audio', 'document', 'other'] as const\ntype AllowedMediaType = (typeof ALLOWED_MEDIA_TYPES)[number]\n\nfunction isAllowedMediaType(value: string): value is AllowedMediaType {\n  // Cast to readonly string[] so the typed-tuple `includes` check works\n  // with an arbitrary string input — `Array.prototype.includes`'s\n  // signature on a typed tuple only accepts members of the tuple\n  // (TS 4.9+ literal-narrowing), which is exactly what we want to\n  // sidestep here.\n  return (ALLOWED_MEDIA_TYPES as readonly string[]).includes(value)\n}\n\n/**\n * Hard cap on the `offset` query param. The dispatcher's allowed-pages\n * model is `limit ∈ [1, 100]`; even with the max page size that's\n * 1000 pages before hitting MAX_OFFSET, which is well beyond any\n * realistic admin-UI scroll depth. Forces slow-discard offset attacks\n * (`?offset=999999999`) to revert to a sane upper bound. Cursor-based\n * pagination would let this go higher, but the media list is\n * offset-based by convention with the entity-list shell.\n */\nconst MAX_OFFSET = 100_000\n\n/**\n * Strict non-negative integer parser for query params.\n *\n * `Number(raw)` silently coerces blanks (`'' → 0`), hex (`'0x05' → 5`),\n * exponent notation (`'1e2' → 100`), and signed (`'+5'/'-5'`) values —\n * all of which pass a downstream `Number.isInteger(n) && n >= 0` check.\n * Pre-filtering with `/^\\d+$/` keeps the contract honest: \"if you don't\n * send a pure non-negative integer string, you get the default.\" Same\n * pattern as `packages/taxonomy/src/admin/routes.ts:handleGet` tree\n * branch from PR-C-taxonomy.\n */\nfunction parseUintParam(raw: string | null, fallback: number): number {\n  if (raw === null || !/^\\d+$/.test(raw)) return fallback\n  const parsed = Number(raw)\n  // The regex above stops hex / exponent / signed / whitespace / blank\n  // inputs, but a long digit-only string still slips past — `Number(...)`\n  // returns `Infinity` past ~309 digits, and precision is lost past\n  // 2^53. Both would propagate through `client.findMany`'s\n  // `offset: parsed` into a Postgres query that either crashes the\n  // driver (`Infinity` is not a valid bigint) or silently rounds (the\n  // 2^53 precision-loss boundary). Reject via `Number.isSafeInteger`\n  // so overflowing inputs revert to `fallback` like every other\n  // malformed value.\n  if (!Number.isSafeInteger(parsed)) return fallback\n  return parsed\n}\n\n// ---------------------------------------------------------------------------\n// Response helpers\n// ---------------------------------------------------------------------------\n\nfunction jsonResponse(data: unknown, status = 200): Response {\n  return new Response(JSON.stringify(data), {\n    status,\n    headers: { 'Content-Type': 'application/json' },\n  })\n}\n\nfunction jsonError(message: string, status: number): Response {\n  return jsonResponse({ error: message }, status)\n}\n\n// ---------------------------------------------------------------------------\n// Per-request MediaClient factory + cached storage client\n// ---------------------------------------------------------------------------\n//\n// MediaClient and its AdminClient MUST be built per-request — AdminClient's\n// context resolver is captured eagerly at construction (see\n// buildContextResolver in @murumets-ee/core/clients). A module-level singleton\n// would bake the first request's user + tenant scope into every subsequent\n// request's writes — a cross-request permission/scope leak.\n//\n// Storage config is process-global and safe to cache once.\n\ntype StorageClient = Awaited<ReturnType<typeof import('@murumets-ee/storage').createStorageClient>>\n\ninterface StorageState {\n  clientPromise: Promise<StorageClient> | null\n}\n\n// Module-level state. `null` once eviction fires on a rejection so the next\n// request gets a fresh resolution attempt (see `getStorage`'s `.catch`).\nconst storageState: StorageState = { clientPromise: null }\n\n/**\n * Resolve the process-wide storage client. The pending-promise slot is\n * cleared on rejection so a transient `createStorageClient` failure\n * (DB hiccup, misconfig) doesn't poison every subsequent media request\n * for the lifetime of the Node process. Same pattern as\n * `packages/taxonomy/src/admin/routes.ts:getClient` from PR-C-taxonomy.\n */\nasync function getStorage(): Promise<StorageClient> {\n  if (!storageState.clientPromise) {\n    const pending = (async () => {\n      const { getApp } = await import('@murumets-ee/core')\n      const { createStorageClient } = await import('@murumets-ee/storage')\n      const { getStorageConfig } = await import('@murumets-ee/storage/plugin')\n      const app = getApp()\n      return createStorageClient(getStorageConfig(), { app })\n    })()\n    // Clear the slot on rejection so a transient failure doesn't poison\n    // every subsequent request. `pending.catch(handler)` attaches a\n    // synchronous rejection listener that resets the cached slot — the\n    // handler returns `undefined`, NOT a re-throw — so the new\n    // `.catch`-returned promise resolves, but we never await or hold\n    // that promise. The ORIGINAL `pending` (stored in\n    // `storageState.clientPromise`) is what callers `await`, and it's\n    // still in its rejected state — so the caller observing this\n    // resolution sees the underlying error. The `.catch` also marks\n    // the rejection as \"handled\" for Node's unhandled-rejection\n    // tracker. `storageState.clientPromise` holds the original `pending`\n    // so concurrent in-flight callers share one resolution.\n    pending.catch(() => {\n      if (storageState.clientPromise === pending) storageState.clientPromise = null\n    })\n    storageState.clientPromise = pending\n  }\n  return storageState.clientPromise\n}\n\nasync function getMediaClient(): Promise<MediaClient> {\n  const { createAdminClient } = await import('@murumets-ee/core/clients')\n  const { MediaClient } = await import('../client.js')\n  const { Media } = await import('../entity.js')\n  const storage = await getStorage()\n  const admin = createAdminClient(Media)\n  return new MediaClient({ admin, storage })\n}\n\n// ---------------------------------------------------------------------------\n// Handlers\n// ---------------------------------------------------------------------------\n\nconst handleGet: AdminRouteHandler = async (req, ctx) => {\n  const { isStorageConfigured, getStorageConfigReason } = await import('@murumets-ee/storage')\n  const segments = ctx.segments\n\n  // GET /media/<id>/usage — DB-only lookup, safe even when storage is\n  // unconfigured. Validate the UUID first so a malformed id 400s\n  // uniformly with the storage-configured branch below.\n  if (segments.length === 2 && segments[1] === 'usage') {\n    const id = segments[0]\n    if (!isValidUuid(id)) return jsonError('Invalid media ID format', 400)\n\n    const { findMediaUsages } = await import('../usage.js')\n    const { getApp } = await import('@murumets-ee/core')\n    const app = getApp()\n    const usages = await findMediaUsages(id, app)\n    return jsonResponse({ usages })\n  }\n\n  // Reject unknown sub-paths explicitly. The wrapper-gate has already\n  // passed (caller has `media:view`); a handler-level 404 here matches\n  // the dispatcher's miss-shape so unknown URLs don't fall through to\n  // the single-id branch and 400/500 with a misleading reason. The\n  // only valid 2-segment URL is `<id>/usage`, which was already\n  // claimed by the early-return above — anything else with >=2\n  // segments is not a recognized media route.\n  if (segments.length >= 2) return jsonError('Not found', 404)\n\n  // GET /media/<id> — validate UUID up front so a bad request still\n  // 400s when storage happens to be unconfigured (matches DELETE).\n  const singleId = segments.length > 0 ? segments[0] : undefined\n  if (singleId !== undefined && !isValidUuid(singleId)) {\n    return jsonError('Invalid media ID format', 400)\n  }\n\n  // Everything below needs a working storage client. If env isn't\n  // wired, return a structured \"disabled\" response rather than 500 —\n  // the media list page renders a banner and new admins can finish\n  // onboarding without being blocked on a crash loop.\n  if (!isStorageConfigured()) {\n    const reason = getStorageConfigReason() ?? 'Storage not configured'\n    if (segments.length > 0) {\n      // Single item — treat as not-found-ish to avoid leaking\n      // existence; include reason so the UI can surface it.\n      return jsonResponse({ error: reason, configured: false, reason }, 503)\n    }\n    // GET /media — empty list + disabled flag for the picker's banner.\n    const response: MediaPickerListResult & { configured: false; reason: string } = {\n      items: [],\n      total: 0,\n      configured: false,\n      reason,\n    }\n    return jsonResponse(response)\n  }\n\n  const client = await getMediaClient()\n\n  // GET /media/<id> — single item with URL (full record for EntityForm + picker)\n  if (singleId !== undefined) {\n    const record = await client.findById(singleId)\n    if (!record) return jsonError('Media not found', 404)\n\n    const url = await client.getUrl(singleId)\n    return jsonResponse({ ...record, url })\n  }\n\n  // GET /media — list with search/filter + batch URL resolution\n  const url = new URL(req.url)\n  const search = url.searchParams.get('search') ?? undefined\n  // mediaType MUST be validated against the entity's closed enum before\n  // it reaches `client.findMany` — the previous shape force-cast the raw\n  // query value with `as 'image' | ...` which is a type-system lie. A\n  // bogus value like `?mediaType=bogus` would parameterize into\n  // `WHERE media_type = 'bogus'` (no SQL injection — Drizzle is\n  // parameterized — but the row count is silently zero, which is\n  // confusing). Empty string from `?mediaType=` is also passed-through\n  // by the prior `?? undefined` shape since empty string is not null.\n  // Allowlist + type guard drops bogus / empty values cleanly so the\n  // filter is omitted instead of applied with a no-match value.\n  const rawMediaType = url.searchParams.get('mediaType')\n  const mediaType =\n    rawMediaType !== null && isAllowedMediaType(rawMediaType) ? rawMediaType : undefined\n  // Strict parsing keeps the contract honest — see `parseUintParam`\n  // JSDoc. Cap limit to [1, 100] and offset to [0, MAX_OFFSET] so a\n  // request can't ask for an unboundedly large page nor force a\n  // slow-discard scan with `?offset=99999999`.\n  const limit = Math.min(Math.max(parseUintParam(url.searchParams.get('limit'), 24), 1), 100)\n  const offset = Math.min(parseUintParam(url.searchParams.get('offset'), 0), MAX_OFFSET)\n\n  const result = await client.findMany({\n    ...(search !== undefined && { search }),\n    ...(mediaType !== undefined && { mediaType }),\n    limit,\n    offset,\n  })\n\n  // Resolve original URLs + thumbnail variant URLs for all items.\n  const ids = result.items.map((item) => item.id)\n  const [urlMap, thumbMap] = await Promise.all([\n    client.getUrls(ids),\n    client.getVariantUrls(ids, 'thumbnail'),\n  ])\n\n  const items: (MediaPickerItem & { thumbnailUrl?: string })[] = result.items.map((item) => {\n    const thumbnailUrl = thumbMap.get(item.id)\n    return {\n      id: item.id,\n      title: item.title ?? null,\n      alt: item.alt ?? null,\n      filename: item.filename,\n      mimeType: item.mimeType,\n      size: item.size,\n      mediaType: item.mediaType,\n      url: urlMap.get(item.id) ?? '',\n      ...(thumbnailUrl !== undefined && { thumbnailUrl }),\n      width: item.width ?? null,\n      height: item.height ?? null,\n    }\n  })\n\n  const response: MediaPickerListResult = { items, total: result.total }\n  return jsonResponse(response)\n}\n\nconst handleUpload: AdminRouteHandler = async (req, ctx) => {\n  const { isStorageConfigured, getStorageConfigReason, detectMimeType } = await import(\n    '@murumets-ee/storage'\n  )\n\n  // Upload is registered at `path: ''` (NOT matchAnyPath) — the\n  // dispatcher only invokes this handler when segments=[]. The api-\n  // handler ALSO rejects empty/whitespace-only first segments with a\n  // 400 before any plugin dispatcher runs (see\n  // `packages/admin-ui/src/server/api-handler/index.ts` segment-\n  // validation block). So this guard is defense-in-depth — per HANDOFF\n  // §\"Defense-in-depth `&& segments[i]` guards are fine\" — protecting\n  // against a future framework invariant change that lets a non-empty\n  // segment reach a `path: ''` static entry.\n  if (ctx.segments.length > 0) return jsonError('Not found', 404)\n\n  if (!isStorageConfigured()) {\n    return jsonError(getStorageConfigReason() ?? 'Storage not configured', 503)\n  }\n\n  const client = await getMediaClient()\n\n  const formData = await req.formData()\n  const file = formData.get('file')\n  // FormData `get` returns string | File | null. Reject anything that\n  // isn't a File so the typed `file.size`/`file.arrayBuffer()` below\n  // is safe without a runtime cast.\n  if (!(file instanceof File) || file.size === 0) {\n    return jsonError('No file provided', 400)\n  }\n\n  // Guard against oversized uploads (50 MB limit). Hardcoded rather\n  // than read from getMediaConfig() to keep this handler independent\n  // of plugin-init order — the plugin's resolved config may not be\n  // populated yet under CLI / non-RSC startup paths.\n  const MAX_UPLOAD_SIZE = 50 * 1024 * 1024\n  if (file.size > MAX_UPLOAD_SIZE) {\n    return jsonError(\n      `File too large: ${(file.size / 1024 / 1024).toFixed(1)} MB exceeds 50 MB limit`,\n      400,\n    )\n  }\n\n  const buffer = Buffer.from(await file.arrayBuffer())\n\n  // Detect actual MIME type from file content (prevents spoofing).\n  const { mimeType, mismatch } = await detectMimeType(\n    buffer,\n    file.type || 'application/octet-stream',\n  )\n  if (mismatch) {\n    return jsonError(\n      `File content doesn't match declared type: claimed ${file.type}, detected ${mimeType}`,\n      400,\n    )\n  }\n\n  // Per-upload visibility, DEFAULTING TO PRIVATE — the caller opts in.\n  //\n  // This route serves two populations with opposite needs. The media picker\n  // uploads publishable web assets: a page's hero image MUST be public or the\n  // public site resolves it to `null` and renders no images at all, with a 200\n  // on every page and one warn log (F030). `packages/rent-ui`'s inspection\n  // wizard posts to this SAME route with handover and return photos — vehicle\n  // and apartment condition shots, plates, interiors, occasionally documents —\n  // which must stay behind time-limited signed urls.\n  //\n  // Deny-by-default decides the direction, and the asymmetry is the argument:\n  // forget the opt-in and an image is invisible, which is annoying, visible and\n  // fixable; default to public and forget an opt-out and those photos become\n  // permanently world-readable. A missed opt-in cannot leak. So the default is\n  // unchanged (`private` via StorageClient's own fallback) and rent's caller is\n  // untouched — it sends nothing and behaves exactly as before.\n  const visibilityRaw = formData.get('visibility')\n  if (visibilityRaw !== null && visibilityRaw !== 'public' && visibilityRaw !== 'private') {\n    return jsonError(\"Field 'visibility' must be 'public' or 'private'\", 400)\n  }\n  const result = await client.upload(buffer, {\n    filename: file.name,\n    mimeType,\n    size: file.size,\n    uploadedBy: ctx.user.id,\n    ...(visibilityRaw !== null && { visibility: visibilityRaw }),\n  })\n\n  const item: MediaPickerItem = {\n    id: result.media.id,\n    title: result.media.title ?? null,\n    alt: result.media.alt ?? null,\n    filename: result.media.filename,\n    mimeType: result.media.mimeType,\n    size: result.media.size,\n    mediaType: result.media.mediaType,\n    url: result.url,\n    width: result.media.width ?? null,\n    height: result.media.height ?? null,\n  }\n\n  safeAudit(ctx, {\n    action: 'media.upload',\n    entityType: 'media',\n    entityId: result.media.id,\n    userId: ctx.user.id,\n    ...(ctx.user.name !== undefined && { userName: ctx.user.name }),\n    changes: {\n      filename: result.media.filename,\n      mimeType: result.media.mimeType,\n      size: result.media.size,\n      mediaType: result.media.mediaType,\n    },\n  })\n\n  return jsonResponse(item, 201)\n}\n\nconst handleRegenerateVariants: AdminRouteHandler = async (_req, ctx) => {\n  const { isStorageConfigured, getStorageConfigReason } = await import('@murumets-ee/storage')\n\n  // Static POST path='regenerate-variants' — the dispatcher only invokes\n  // this handler when `segments[0] === 'regenerate-variants'`. Trailing\n  // segments (e.g. POST /media/regenerate-variants/extra) aren't a\n  // supported sub-route.\n  if (ctx.segments.length !== 1) return jsonError('Not found', 404)\n\n  if (!isStorageConfigured()) {\n    return jsonError(getStorageConfigReason() ?? 'Storage not configured', 503)\n  }\n\n  const { regenerateAllVariants } = await import('../regenerate-variants.js')\n  const { getApp, getContext } = await import('@murumets-ee/core')\n  const { resolveImageStyles } = await import('../resolve-image-styles.js')\n  const { createStorageClient } = await import('@murumets-ee/storage')\n  const { getStorageConfig } = await import('@murumets-ee/storage/plugin')\n\n  const app = getApp()\n  const styles = await resolveImageStyles(app, app.logger)\n  if (!styles || Object.keys(styles).length === 0) {\n    return jsonError('No image styles configured', 400)\n  }\n\n  const storageConfig = getStorageConfig()\n  const storage = createStorageClient(storageConfig, { app })\n\n  const result = await regenerateAllVariants({\n    app,\n    storage,\n    logger: app.logger.child({ media: true }),\n    styles,\n    contextResolver: () => {\n      const requestCtx = getContext()\n      if (!requestCtx?.user || !requestCtx?.checker) return undefined\n      return {\n        user: requestCtx.user,\n        checker: requestCtx.checker,\n        ...(requestCtx.scope !== undefined && { scope: requestCtx.scope }),\n      }\n    },\n  })\n\n  safeAudit(ctx, {\n    action: 'media.regenerate_variants',\n    userId: ctx.user.id,\n    ...(ctx.user.name !== undefined && { userName: ctx.user.name }),\n    metadata: { total: result.total, processed: result.processed, errors: result.errors },\n  })\n\n  return jsonResponse(result)\n}\n\nconst handleDelete: AdminRouteHandler = async (_req, ctx) => {\n  const segments = ctx.segments\n\n  // DELETE /media — no id supplied. Reject as 400, NOT 404, so a\n  // caller confusing \"no id\" with \"id not found\" gets a meaningful\n  // error. The wrapper-gate has already validated the caller has\n  // media:delete, so the 400 isn't an information-disclosure vector.\n  if (segments.length === 0) return jsonError('Media ID required', 400)\n\n  // Reject sub-paths beyond /<id> — DELETE /media/<id>/usage etc.\n  if (segments.length > 1) return jsonError('Not found', 404)\n\n  const id = segments[0]\n  if (!isValidUuid(id)) return jsonError('Invalid media ID format', 400)\n\n  const { isStorageConfigured, getStorageConfigReason } = await import('@murumets-ee/storage')\n  if (!isStorageConfigured()) {\n    // Can't safely delete — MediaClient needs storage to remove the\n    // actual object, and partial delete (DB row gone, object orphaned)\n    // would leak storage. Surface the reason so the UI can display it.\n    return jsonError(getStorageConfigReason() ?? 'Storage not configured', 503)\n  }\n\n  // AdminClient.delete() checks entity_refs and throws\n  // ReferencedEntityError if this media is still referenced. The\n  // error bubbles to the caller's error handler which returns 409\n  // with usage details.\n  const client = await getMediaClient()\n  await client.delete(id)\n\n  safeAudit(ctx, {\n    action: 'media.delete',\n    entityType: 'media',\n    entityId: id,\n    userId: ctx.user.id,\n    ...(ctx.user.name !== undefined && { userName: ctx.user.name }),\n  })\n\n  return jsonResponse({ deleted: 1 })\n}\n\n// ---------------------------------------------------------------------------\n// Route factory\n// ---------------------------------------------------------------------------\n\n/**\n * Default roles for view: broad reach across the admin shell.\n *\n * `BUILT_IN_ROLES` in `packages/auth/src/permissions.ts` is\n * `['admin', 'public', 'authenticated', 'agent', 'customer']` — `admin` is\n * hardcoded as an unconditional yes in `buildPermissionChecker`,\n * `agent` is the only non-admin built-in that flows through\n * `buildInitialRoleDefinitions()` + `upsertBuiltInRoles` with default\n * media access (`customer` seeds with zero permissions — see that\n * function's JSDoc). The `agent` entry in this list is what gives ops\n * agents read-only media access on first boot of a fresh install.\n *\n * `editor` and `viewer` are CONVENTIONAL app-defined roles —\n * apps that follow the scaffold pattern create them as part of\n * their own role catalog. Including them in `defaultRoles` doesn't\n * seed them (the seeder only iterates the built-ins above), but\n * the values DO flow into the process-local permission catalog\n * (see `registerPermission` in `@murumets-ee/core`), which the\n * forthcoming Permission Matrix UI (PR-D) reads to show \"this\n * route's recommended default grants\" against the app's actual\n * role set. The catalog is also the mechanism via which a future\n * upgrade of `upsertBuiltInRoles` could extend the seed surface\n * to app-defined roles without each plugin having to re-declare\n * its defaults.\n */\nconst VIEW_DEFAULT_ROLES = ['admin', 'editor', 'agent', 'viewer'] as const\n\n/** Default roles for create/delete — narrower than view. */\nconst WRITE_DEFAULT_ROLES = ['admin', 'editor'] as const\n\n/**\n * Build admin API routes for media management.\n *\n * Returns `AdminRoute[]` from `combineAdminRoutes` — one entry per\n * `(prefix, method)` after grouping. Callers spread the result into\n * their top-level routes list: `routes: [...mediaRoutes()]`.\n *\n * Four `defineAdminRoute` entries:\n *\n *   - GET    matchAnyPath with `media:view`   defaultRoles: VIEW_DEFAULT_ROLES\n *   - POST   path=''            `media:create` defaultRoles: WRITE_DEFAULT_ROLES\n *   - POST   path='regenerate-variants' `media:create` defaultRoles: WRITE_DEFAULT_ROLES\n *   - DELETE matchAnyPath with `media:delete` defaultRoles: WRITE_DEFAULT_ROLES\n *\n * Permissions are auto-registered by the entity catalog\n * (`buildResourceCatalog` in `@murumets-ee/auth`) AND by\n * `registerPermission` inside `defineAdminRoute`. Idempotent —\n * `registerPermission` unions `defaultRoles` on repeat registration,\n * so the framework's two pathways agree on the final grant set.\n *\n * Standard entity CRUD (PATCH with translations) is NOT registered\n * here — it falls through to the generic entity handler. Add `Media`\n * to the `entities` array in your handler config to enable it.\n */\nexport function mediaRoutes(): AdminRoute[] {\n  const entries = [\n    defineAdminRoute({\n      prefix: 'media',\n      path: '',\n      method: 'GET',\n      permission: 'media:view',\n      defaultRoles: VIEW_DEFAULT_ROLES,\n      matchAnyPath: true,\n      description: 'Read media — list, single item, or referencing-entity usage report.',\n      handler: handleGet,\n    }),\n    defineAdminRoute({\n      prefix: 'media',\n      path: '',\n      method: 'POST',\n      permission: 'media:create',\n      defaultRoles: WRITE_DEFAULT_ROLES,\n      description: 'Upload a media file (multipart FormData with `file` field).',\n      handler: handleUpload,\n    }),\n    defineAdminRoute({\n      prefix: 'media',\n      path: 'regenerate-variants',\n      method: 'POST',\n      permission: 'media:create',\n      defaultRoles: WRITE_DEFAULT_ROLES,\n      description: 'Regenerate every image-style variant for every media row.',\n      handler: handleRegenerateVariants,\n    }),\n    defineAdminRoute({\n      prefix: 'media',\n      path: '',\n      method: 'DELETE',\n      permission: 'media:delete',\n      defaultRoles: WRITE_DEFAULT_ROLES,\n      matchAnyPath: true,\n      description: 'Delete a media record + its storage object.',\n      handler: handleDelete,\n    }),\n  ]\n\n  return combineAdminRoutes(entries)\n}\n","/**\n * Media plugin — auto-registers the Media entity, mounts admin routes, and\n * contributes sidebar + default-route scaffolding for the admin shell.\n *\n * @example\n * ```typescript\n * import { media } from '@murumets-ee/media/plugin'\n *\n * export default defineLumiConfig({\n *   plugins: [\n *     storage(),\n *     media({ maxUploadSize: 10 * 1024 * 1024 }),\n *   ],\n * })\n * ```\n */\n\nimport { definePlugin } from '@murumets-ee/core'\n// Self-reference the `./image-styles` subpath (not the internal source\n// files) so the plugin bundle externalizes the React components instead\n// of inlining them — the subpath is built separately with a `'use client'`\n// banner, and Next.js needs to see that boundary preserved.\nimport { ImageStylesManager, RegenerateVariantsAction } from '@murumets-ee/media/image-styles'\nimport { mediaRoutes } from './admin/routes.js'\nimport { Media } from './entity.js'\nimport { imageStylesSettings } from './image-styles-settings.js'\n// Relative: `src/i18n.ts` is a sibling entry of this one in the same tsdown\n// config, so the loader lands in a shared chunk rather than being\n// duplicated, and its `import('./messages/et.json')` resolves against\n// `dist/`, which this package's build script populates.\nimport { getMediaMessages } from './i18n.js'\nimport type { MediaPluginConfig } from './types.js'\n\nlet _mediaConfig: Required<MediaPluginConfig> | null = null\n\n/**\n * Get the resolved media plugin configuration.\n * Throws if plugin not initialized.\n */\nexport function getMediaConfig(): Required<MediaPluginConfig> {\n  if (!_mediaConfig) {\n    throw new Error('@murumets-ee/media plugin not initialized. Add media() to your plugins array.')\n  }\n  return _mediaConfig\n}\n\n/**\n * Media plugin factory.\n *\n * - Registers the Media entity\n * - Mounts the media admin API routes\n * - Contributes sidebar + default-route metadata\n * - Declares @murumets-ee/storage + @murumets-ee/settings as required deps\n *   (framework-validated before any plugin init runs — see `requires` field below)\n * - Captures resolved configuration for `getMediaConfig()`\n */\nexport function media(config?: MediaPluginConfig) {\n  const resolvedConfig: Required<MediaPluginConfig> = {\n    acceptedTypes: config?.acceptedTypes ?? ['image/*', 'video/*', 'audio/*', 'application/pdf'],\n    maxUploadSize: config?.maxUploadSize ?? 50 * 1024 * 1024,\n    defaultVisibility: config?.defaultVisibility ?? 'public',\n    imageStyles: config?.imageStyles ?? {\n      thumbnail: { width: 200, height: 200, fit: 'cover', format: 'webp', quality: 80 },\n    },\n  }\n\n  return definePlugin({\n    name: '@murumets-ee/media',\n    // Declarative dep validation — replaces the per-plugin\n    // `if (!app.plugins.has(...)) throw` loop that used to live in\n    // `init`. The framework validates BEFORE any init runs, so a\n    // missing dep surfaces immediately with the full punchlist\n    // instead of throwing partway through boot.\n    requires: ['@murumets-ee/storage', '@murumets-ee/settings'],\n    shared: {\n      // The interface-message catalogue, declared rather than left for each\n      // app to remember (commerce-launch F148/F155). The framework gathers\n      // it at the merge step; nothing loads a locale until one is asked for.\n      messages: getMediaMessages,\n      // Self-contributes the media.imageStyles namespace. The merge engine\n      // auto-derives the permission resource (`settings_media.imageStyles`)\n      // and the sidebar entry under the \"Settings\" group. The app's\n      // admin-api-handler call site aggregates plugin-contributed\n      // namespaces into `settingsRoutes(...)` (see apps/admin's\n      // `getAllSettings()` for the canonical pattern); apps that follow\n      // the scaffold pattern get this for free.\n      // Drop the `as PluginSettingsDefinition` cast — it would widen the\n      // namespace literal (e.g. `'media.imageStyles'`) to `string`,\n      // leaking `settings_${string}:view|update` into the resolved\n      // permission union via `<const N>` capture loss.\n      // `imageStylesSettings` is structurally a superset of\n      // `PluginSettingsDefinition` (full vs. narrow `SettingsDefinition`),\n      // which TS accepts directly. The `readonly` outer tuple comes from\n      // the parent definePlugin's `<const S>` capture.\n      settings: [imageStylesSettings],\n    },\n    server: {\n      entities: [Media],\n      routes: [...mediaRoutes()],\n      init: async (app) => {\n        _mediaConfig = resolvedConfig\n\n        // Image style defaults live in the plugin config and are exposed via\n        // `getMediaConfig()`. Persistent overrides go to the settings DB\n        // through the generic settings API at `/api/admin/settings/media.imageStyles`\n        // — see `image-styles-settings.ts`. `resolveImageStyles` reads\n        // DB-first, config-fallback.\n        //\n        // We deliberately do NOT seed the DB here. Init must stay lightweight:\n        // it runs in every context (Next.js server, Next.js build, CLI commands).\n        // The prior eager-seed path pulled in `@murumets-ee/settings`'s main entry —\n        // which carries `import 'server-only'` — and crashed non-RSC Node bootstrap.\n\n        app.logger.info(\n          {\n            acceptedTypes: resolvedConfig.acceptedTypes,\n            maxUploadSize: resolvedConfig.maxUploadSize,\n            defaultVisibility: resolvedConfig.defaultVisibility,\n          },\n          'Media plugin initialized',\n        )\n      },\n    },\n    adminUi: {\n      sidebar: [\n        {\n          id: 'media',\n          group: 'Library',\n          label: 'Media',\n          href: '/admin/media',\n          iconName: 'image',\n        },\n      ],\n      defaultRoutes: [\n        // Routing only — sidebar nav comes from `adminUi.sidebar` above\n        // (admin-page-routing SD003).\n        {\n          path: 'media',\n          factory: 'MediaListPage',\n        },\n        {\n          path: 'media/[id]',\n          factory: 'MediaEditPage',\n        },\n      ],\n      // Self-contributes the rich image-styles editor and the\n      // \"Regenerate All Variants\" action. Apps don't have to wire either\n      // — they appear automatically on /admin/settings/media.imageStyles\n      // (route + sidebar entry auto-derived from `shared.settings`).\n      settingRenderers: {\n        'media.imageStyles': ImageStylesManager,\n      },\n      settingsActions: {\n        'media.imageStyles': RegenerateVariantsAction,\n      },\n    },\n  })\n}\n"],"mappings":"2WA0EA,MAAM,EAAU,kEAEhB,SAAS,EAAY,EAA4C,CAC/D,OAAO,IAAU,IAAA,IAAa,EAAQ,KAAK,CAAK,CAClD,CAcA,MAAM,EAAsB,CAAC,QAAS,QAAS,QAAS,WAAY,OAAO,EAG3E,SAAS,EAAmB,EAA0C,CAMpE,OAAQ,EAA0C,SAAS,CAAK,CAClE,CAwBA,SAAS,EAAe,EAAoB,EAA0B,CACpE,GAAI,IAAQ,MAAQ,CAAC,QAAQ,KAAK,CAAG,EAAG,OAAO,EAC/C,IAAM,EAAS,OAAO,CAAG,EAWzB,OADK,OAAO,cAAc,CAAM,EACzB,EADmC,CAE5C,CAMA,SAAS,EAAa,EAAe,EAAS,IAAe,CAC3D,OAAO,IAAI,SAAS,KAAK,UAAU,CAAI,EAAG,CACxC,SACA,QAAS,CAAE,eAAgB,kBAAmB,CAChD,CAAC,CACH,CAEA,SAAS,EAAU,EAAiB,EAA0B,CAC5D,OAAO,EAAa,CAAE,MAAO,CAAQ,EAAG,CAAM,CAChD,CAsBA,MAAM,EAA6B,CAAE,cAAe,IAAK,EASzD,eAAe,GAAqC,CAClD,GAAI,CAAC,EAAa,cAAe,CAC/B,IAAM,GAAW,SAAY,CAC3B,GAAM,CAAE,UAAW,MAAM,OAAO,qBAC1B,CAAE,uBAAwB,MAAM,OAAO,wBACvC,CAAE,oBAAqB,MAAM,OAAO,+BACpC,EAAM,EAAO,EACnB,OAAO,EAAoB,EAAiB,EAAG,CAAE,KAAI,CAAC,CACxD,EAAA,CAAG,EAaH,EAAQ,UAAY,CACd,EAAa,gBAAkB,IAAS,EAAa,cAAgB,KAC3E,CAAC,EACD,EAAa,cAAgB,CAC/B,CACA,OAAO,EAAa,aACtB,CAEA,eAAe,GAAuC,CACpD,GAAM,CAAE,qBAAsB,MAAM,OAAO,6BACrC,CAAE,eAAgB,MAAM,OAAO,gBAC/B,CAAE,SAAU,MAAM,OAAO,wBAAe,CAAA,KAAA,GAAA,EAAA,CAAA,EACxC,EAAU,MAAM,EAAW,EAEjC,OAAO,IAAI,EAAY,CAAE,MADX,EAAkB,CACH,EAAG,SAAQ,CAAC,CAC3C,CAMA,MAAM,EAA+B,MAAO,EAAK,IAAQ,CACvD,GAAM,CAAE,sBAAqB,0BAA2B,MAAM,OAAO,wBAC/D,EAAW,EAAI,SAKrB,GAAI,EAAS,SAAW,GAAK,EAAS,KAAO,QAAS,CACpD,IAAM,EAAK,EAAS,GACpB,GAAI,CAAC,EAAY,CAAE,EAAG,OAAO,EAAU,0BAA2B,GAAG,EAErE,GAAM,CAAE,mBAAoB,MAAM,OAAO,eACnC,CAAE,UAAW,MAAM,OAAO,qBAGhC,OAAO,EAAa,CAAE,OAAA,MADD,EAAgB,EADzB,EAC+B,CAAC,CACf,CAAC,CAChC,CASA,GAAI,EAAS,QAAU,EAAG,OAAO,EAAU,YAAa,GAAG,EAI3D,IAAM,EAAW,EAAS,OAAS,EAAI,EAAS,GAAK,IAAA,GACrD,GAAI,IAAa,IAAA,IAAa,CAAC,EAAY,CAAQ,EACjD,OAAO,EAAU,0BAA2B,GAAG,EAOjD,GAAI,CAAC,EAAoB,EAAG,CAC1B,IAAM,EAAS,EAAuB,GAAK,yBAa3C,OAZI,EAAS,OAAS,EAGb,EAAa,CAAE,MAAO,EAAQ,WAAY,GAAO,QAAO,EAAG,GAAG,EAShE,EAAa,CALlB,MAAO,CAAC,EACR,MAAO,EACP,WAAY,GACZ,QAEyB,CAAC,CAC9B,CAEA,IAAM,EAAS,MAAM,EAAe,EAGpC,GAAI,IAAa,IAAA,GAAW,CAC1B,IAAM,EAAS,MAAM,EAAO,SAAS,CAAQ,EAC7C,GAAI,CAAC,EAAQ,OAAO,EAAU,kBAAmB,GAAG,EAEpD,IAAM,EAAM,MAAM,EAAO,OAAO,CAAQ,EACxC,OAAO,EAAa,CAAE,GAAG,EAAQ,KAAI,CAAC,CACxC,CAGA,IAAM,EAAM,IAAI,IAAI,EAAI,GAAG,EACrB,EAAS,EAAI,aAAa,IAAI,QAAQ,GAAK,IAAA,GAW3C,EAAe,EAAI,aAAa,IAAI,WAAW,EAC/C,EACJ,IAAiB,MAAQ,EAAmB,CAAY,EAAI,EAAe,IAAA,GAKvE,EAAQ,KAAK,IAAI,KAAK,IAAI,EAAe,EAAI,aAAa,IAAI,OAAO,EAAG,EAAE,EAAG,CAAC,EAAG,GAAG,EACpF,EAAS,KAAK,IAAI,EAAe,EAAI,aAAa,IAAI,QAAQ,EAAG,CAAC,EAAG,GAAU,EAE/E,EAAS,MAAM,EAAO,SAAS,CACnC,GAAI,IAAW,IAAA,IAAa,CAAE,QAAO,EACrC,GAAI,IAAc,IAAA,IAAa,CAAE,WAAU,EAC3C,QACA,QACF,CAAC,EAGK,EAAM,EAAO,MAAM,IAAK,GAAS,EAAK,EAAE,EACxC,CAAC,EAAQ,GAAY,MAAM,QAAQ,IAAI,CAC3C,EAAO,QAAQ,CAAG,EAClB,EAAO,eAAe,EAAK,WAAW,CACxC,CAAC,EAoBD,OAAO,EAAa,CADsB,MAjBqB,EAAO,MAAM,IAAK,GAAS,CACxF,IAAM,EAAe,EAAS,IAAI,EAAK,EAAE,EACzC,MAAO,CACL,GAAI,EAAK,GACT,MAAO,EAAK,OAAS,KACrB,IAAK,EAAK,KAAO,KACjB,SAAU,EAAK,SACf,SAAU,EAAK,SACf,KAAM,EAAK,KACX,UAAW,EAAK,UAChB,IAAK,EAAO,IAAI,EAAK,EAAE,GAAK,GAC5B,GAAI,IAAiB,IAAA,IAAa,CAAE,cAAa,EACjD,MAAO,EAAK,OAAS,KACrB,OAAQ,EAAK,QAAU,IACzB,CACF,CAE8C,EAAG,MAAO,EAAO,KACpC,CAAC,CAC9B,EAEM,EAAkC,MAAO,EAAK,IAAQ,CAC1D,GAAM,CAAE,sBAAqB,yBAAwB,kBAAmB,MAAM,OAC5E,wBAYF,GAAI,EAAI,SAAS,OAAS,EAAG,OAAO,EAAU,YAAa,GAAG,EAE9D,GAAI,CAAC,EAAoB,EACvB,OAAO,EAAU,EAAuB,GAAK,yBAA0B,GAAG,EAG5E,IAAM,EAAS,MAAM,EAAe,EAE9B,EAAW,MAAM,EAAI,SAAS,EAC9B,EAAO,EAAS,IAAI,MAAM,EAIhC,GAAI,EAAE,aAAgB,OAAS,EAAK,OAAS,EAC3C,OAAO,EAAU,mBAAoB,GAAG,EAQ1C,GAAI,EAAK,KADe,GAAK,KAAO,KAElC,OAAO,EACL,oBAAoB,EAAK,KAAO,KAAO,KAAA,CAAM,QAAQ,CAAC,EAAE,yBACxD,GACF,EAGF,IAAM,EAAS,OAAO,KAAK,MAAM,EAAK,YAAY,CAAC,EAG7C,CAAE,WAAU,YAAa,MAAM,EACnC,EACA,EAAK,MAAQ,0BACf,EACA,GAAI,EACF,OAAO,EACL,qDAAqD,EAAK,KAAK,aAAa,IAC5E,GACF,EAmBF,IAAM,EAAgB,EAAS,IAAI,YAAY,EAC/C,GAAI,IAAkB,MAAQ,IAAkB,UAAY,IAAkB,UAC5E,OAAO,EAAU,mDAAoD,GAAG,EAE1E,IAAM,EAAS,MAAM,EAAO,OAAO,EAAQ,CACzC,SAAU,EAAK,KACf,WACA,KAAM,EAAK,KACX,WAAY,EAAI,KAAK,GACrB,GAAI,IAAkB,MAAQ,CAAE,WAAY,CAAc,CAC5D,CAAC,EAEK,EAAwB,CAC5B,GAAI,EAAO,MAAM,GACjB,MAAO,EAAO,MAAM,OAAS,KAC7B,IAAK,EAAO,MAAM,KAAO,KACzB,SAAU,EAAO,MAAM,SACvB,SAAU,EAAO,MAAM,SACvB,KAAM,EAAO,MAAM,KACnB,UAAW,EAAO,MAAM,UACxB,IAAK,EAAO,IACZ,MAAO,EAAO,MAAM,OAAS,KAC7B,OAAQ,EAAO,MAAM,QAAU,IACjC,EAgBA,OAdA,EAAU,EAAK,CACb,OAAQ,eACR,WAAY,QACZ,SAAU,EAAO,MAAM,GACvB,OAAQ,EAAI,KAAK,GACjB,GAAI,EAAI,KAAK,OAAS,IAAA,IAAa,CAAE,SAAU,EAAI,KAAK,IAAK,EAC7D,QAAS,CACP,SAAU,EAAO,MAAM,SACvB,SAAU,EAAO,MAAM,SACvB,KAAM,EAAO,MAAM,KACnB,UAAW,EAAO,MAAM,SAC1B,CACF,CAAC,EAEM,EAAa,EAAM,GAAG,CAC/B,EAEM,EAA8C,MAAO,EAAM,IAAQ,CACvE,GAAM,CAAE,sBAAqB,0BAA2B,MAAM,OAAO,wBAMrE,GAAI,EAAI,SAAS,SAAW,EAAG,OAAO,EAAU,YAAa,GAAG,EAEhE,GAAI,CAAC,EAAoB,EACvB,OAAO,EAAU,EAAuB,GAAK,yBAA0B,GAAG,EAG5E,GAAM,CAAE,yBAA0B,MAAM,OAAO,sCACzC,CAAE,SAAQ,cAAe,MAAM,OAAO,qBACtC,CAAE,sBAAuB,MAAM,OAAO,uCACtC,CAAE,uBAAwB,MAAM,OAAO,wBACvC,CAAE,oBAAqB,MAAM,OAAO,+BAEpC,EAAM,EAAO,EACb,EAAS,MAAM,EAAmB,EAAK,EAAI,MAAM,EACvD,GAAI,CAAC,GAAU,OAAO,KAAK,CAAM,CAAC,CAAC,SAAW,EAC5C,OAAO,EAAU,6BAA8B,GAAG,EAMpD,IAAM,EAAS,MAAM,EAAsB,CACzC,MACA,QAJc,EADM,EAC0B,EAAG,CAAE,KAAI,CAIjD,EACN,OAAQ,EAAI,OAAO,MAAM,CAAE,MAAO,EAAK,CAAC,EACxC,SACA,oBAAuB,CACrB,IAAM,EAAa,EAAW,EAC1B,MAAC,GAAY,MAAQ,CAAC,GAAY,SACtC,MAAO,CACL,KAAM,EAAW,KACjB,QAAS,EAAW,QACpB,GAAI,EAAW,QAAU,IAAA,IAAa,CAAE,MAAO,EAAW,KAAM,CAClE,CACF,CACF,CAAC,EASD,OAPA,EAAU,EAAK,CACb,OAAQ,4BACR,OAAQ,EAAI,KAAK,GACjB,GAAI,EAAI,KAAK,OAAS,IAAA,IAAa,CAAE,SAAU,EAAI,KAAK,IAAK,EAC7D,SAAU,CAAE,MAAO,EAAO,MAAO,UAAW,EAAO,UAAW,OAAQ,EAAO,MAAO,CACtF,CAAC,EAEM,EAAa,CAAM,CAC5B,EAEM,EAAkC,MAAO,EAAM,IAAQ,CAC3D,IAAM,EAAW,EAAI,SAMrB,GAAI,EAAS,SAAW,EAAG,OAAO,EAAU,oBAAqB,GAAG,EAGpE,GAAI,EAAS,OAAS,EAAG,OAAO,EAAU,YAAa,GAAG,EAE1D,IAAM,EAAK,EAAS,GACpB,GAAI,CAAC,EAAY,CAAE,EAAG,OAAO,EAAU,0BAA2B,GAAG,EAErE,GAAM,CAAE,sBAAqB,0BAA2B,MAAM,OAAO,wBAuBrE,OAtBK,EAAoB,GAYzB,MAAM,MADe,EAAe,EAAA,CACvB,OAAO,CAAE,EAEtB,EAAU,EAAK,CACb,OAAQ,eACR,WAAY,QACZ,SAAU,EACV,OAAQ,EAAI,KAAK,GACjB,GAAI,EAAI,KAAK,OAAS,IAAA,IAAa,CAAE,SAAU,EAAI,KAAK,IAAK,CAC/D,CAAC,EAEM,EAAa,CAAE,QAAS,CAAE,CAAC,GAlBzB,EAAU,EAAuB,GAAK,yBAA0B,GAAG,CAmB9E,EA+BM,EAAqB,CAAC,QAAS,SAAU,QAAS,QAAQ,EAG1D,EAAsB,CAAC,QAAS,QAAQ,EA0B9C,SAAgB,GAA4B,CA0C1C,OAAO,EAAmB,CAxCxB,EAAiB,CACf,OAAQ,QACR,KAAM,GACN,OAAQ,MACR,WAAY,aACZ,aAAc,EACd,aAAc,GACd,YAAa,sEACb,QAAS,CACX,CAAC,EACD,EAAiB,CACf,OAAQ,QACR,KAAM,GACN,OAAQ,OACR,WAAY,eACZ,aAAc,EACd,YAAa,8DACb,QAAS,CACX,CAAC,EACD,EAAiB,CACf,OAAQ,QACR,KAAM,sBACN,OAAQ,OACR,WAAY,eACZ,aAAc,EACd,YAAa,4DACb,QAAS,CACX,CAAC,EACD,EAAiB,CACf,OAAQ,QACR,KAAM,GACN,OAAQ,SACR,WAAY,eACZ,aAAc,EACd,aAAc,GACd,YAAa,8CACb,QAAS,CACX,CAAC,CAG6B,CAAC,CACnC,CCtnBA,IAAI,EAAmD,KAMvD,SAAgB,GAA8C,CAC5D,GAAI,CAAC,EACH,MAAU,MAAM,+EAA+E,EAEjG,OAAO,CACT,CAYA,SAAgB,EAAM,EAA4B,CAChD,IAAM,EAA8C,CAClD,cAAe,GAAQ,eAAiB,CAAC,UAAW,UAAW,UAAW,iBAAiB,EAC3F,cAAe,GAAQ,eAAiB,GAAK,KAAO,KACpD,kBAAmB,GAAQ,mBAAqB,SAChD,YAAa,GAAQ,aAAe,CAClC,UAAW,CAAE,MAAO,IAAK,OAAQ,IAAK,IAAK,QAAS,OAAQ,OAAQ,QAAS,EAAG,CAClF,CACF,EAEA,OAAO,EAAa,CAClB,KAAM,qBAMN,SAAU,CAAC,uBAAwB,uBAAuB,EAC1D,OAAQ,CAIN,SAAU,EAgBV,SAAU,CAAC,CAAmB,CAChC,EACA,OAAQ,CACN,SAAU,CAAC,CAAK,EAChB,OAAQ,CAAC,GAAG,EAAY,CAAC,EACzB,KAAM,KAAO,IAAQ,CACnB,EAAe,EAaf,EAAI,OAAO,KACT,CACE,cAAe,EAAe,cAC9B,cAAe,EAAe,cAC9B,kBAAmB,EAAe,iBACpC,EACA,0BACF,CACF,CACF,EACA,QAAS,CACP,QAAS,CACP,CACE,GAAI,QACJ,MAAO,UACP,MAAO,QACP,KAAM,eACN,SAAU,OACZ,CACF,EACA,cAAe,CAGb,CACE,KAAM,QACN,QAAS,eACX,EACA,CACE,KAAM,aACN,QAAS,eACX,CACF,EAKA,iBAAkB,CAChB,oBAAqB,CACvB,EACA,gBAAiB,CACf,oBAAqB,CACvB,CACF,CACF,CAAC,CACH"}
+{"version":3,"file":"plugin.mjs","names":[],"sources":["../src/admin/routes.ts","../src/plugin.ts"],"sourcesContent":["/**\n * Media admin routes — one static `defineAdminRoute` per HTTP method.\n *\n * **URL surface served by this module:**\n *\n *   - GET    /api/admin/media                       — list with search/filter + URLs\n *   - GET    /api/admin/media/<id>                  — single record with URL\n *   - GET    /api/admin/media/<id>/usage            — entities referencing this media\n *   - POST   /api/admin/media                       — upload (multipart FormData)\n *   - POST   /api/admin/media/regenerate-variants   — bulk variant regeneration\n *   - DELETE /api/admin/media/<id>                  — delete + storage cleanup\n *\n * Standard entity CRUD (PATCH with translations) falls through to the\n * generic entity handler — add `Media` to `entities` in your handler config.\n *\n * **Why per-method `defineAdminRoute`** (vs. the previous top-level\n * `resource: 'media'` + auto-mapped permission):\n *\n *   - The wrapper (`guardedHandler` from `@murumets-ee/core`) owns the\n *     permission gate, `permission.denied` audit, and 403 body shape\n *     uniformly with every other migrated plugin. The previous shape\n *     relied on `METHOD_TO_ACTION` auto-mapping at the api-handler\n *     dispatch level which couldn't emit per-route audit metadata.\n *   - Inline `if (!checkPermission('media', 'create')) ...` defenses\n *     at the regenerate-variants / upload / delete branches are now\n *     redundant — the wrapper enforces the permission BEFORE the\n *     handler runs.\n *\n * **`matchAnyPath` rationale:** media's URL surface predates the\n * static-second-segment convention every other plugin follows\n * (`/taxonomy/<vocab>/<id>`, `/settings/<namespace>/<rest>`). The\n * second segment under `/media` is the media id itself — a runtime\n * UUID — which the dispatcher's literal `segments[0]` match would\n * miss for every request. The catch-all flag declares \"this entry\n * claims every (prefix, method) sub-path no other entry matched\" so\n * the existing URL contract works under the per-method dispatch\n * model. Static POST sub-paths (`regenerate-variants`) take\n * precedence over the catch-all entry on POST. See\n * `DefineAdminRouteSpec.matchAnyPath` in `@murumets-ee/core` for the\n * full contract.\n *\n * **Default roles:** broad for view (`['admin', 'editor', 'agent',\n * 'viewer']`), narrower for writes (`['admin', 'editor']`).\n * Conservative starting point — apps can grant more via the\n * Permissions UI.\n *\n * @example\n * ```typescript\n * import { createAdminApiHandler } from '@murumets-ee/admin-ui/server'\n * import { mediaRoutes } from '@murumets-ee/media/admin'\n * import { Media } from '@murumets-ee/media'\n *\n * const handler = createAdminApiHandler({\n *   authenticate: async (req) => { ... },\n *   entities: [Article, Media],\n *   routes: [...mediaRoutes()],\n * })\n * ```\n */\n\nimport {\n  type AdminRoute,\n  type AdminRouteHandler,\n  combineAdminRoutes,\n  defineAdminRoute,\n  safeAudit,\n} from '@murumets-ee/core'\nimport type { MediaClient } from '../client.js'\nimport type { MediaPickerItem, MediaPickerListResult } from '../picker/types.js'\n\n// ---------------------------------------------------------------------------\n// Validation\n// ---------------------------------------------------------------------------\n\nconst UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i\n\nfunction isValidUuid(value: string | undefined): value is string {\n  return value !== undefined && UUID_RE.test(value)\n}\n\n/**\n * Closed enum of allowed `mediaType` filter values, in lockstep with the\n * `mediaType` field on the Media entity. The list MUST match\n * `MediaListOptions.mediaType` (declared in `../types.js`) — TypeScript\n * doesn't link the two automatically, so the small drift risk is\n * accepted in exchange for not pulling a runtime dep on the entity\n * schema package just to read its enum.\n *\n * Used as both the runtime allowlist (`isAllowedMediaType`) and the\n * source of truth for the narrowed type the guard produces — keeping\n * `as` casts off the handler's hot path.\n */\nconst ALLOWED_MEDIA_TYPES = ['image', 'video', 'audio', 'document', 'other'] as const\ntype AllowedMediaType = (typeof ALLOWED_MEDIA_TYPES)[number]\n\nfunction isAllowedMediaType(value: string): value is AllowedMediaType {\n  // Cast to readonly string[] so the typed-tuple `includes` check works\n  // with an arbitrary string input — `Array.prototype.includes`'s\n  // signature on a typed tuple only accepts members of the tuple\n  // (TS 4.9+ literal-narrowing), which is exactly what we want to\n  // sidestep here.\n  return (ALLOWED_MEDIA_TYPES as readonly string[]).includes(value)\n}\n\n/**\n * Hard cap on the `offset` query param. The dispatcher's allowed-pages\n * model is `limit ∈ [1, 100]`; even with the max page size that's\n * 1000 pages before hitting MAX_OFFSET, which is well beyond any\n * realistic admin-UI scroll depth. Forces slow-discard offset attacks\n * (`?offset=999999999`) to revert to a sane upper bound. Cursor-based\n * pagination would let this go higher, but the media list is\n * offset-based by convention with the entity-list shell.\n */\nconst MAX_OFFSET = 100_000\n\n/**\n * Strict non-negative integer parser for query params.\n *\n * `Number(raw)` silently coerces blanks (`'' → 0`), hex (`'0x05' → 5`),\n * exponent notation (`'1e2' → 100`), and signed (`'+5'/'-5'`) values —\n * all of which pass a downstream `Number.isInteger(n) && n >= 0` check.\n * Pre-filtering with `/^\\d+$/` keeps the contract honest: \"if you don't\n * send a pure non-negative integer string, you get the default.\" Same\n * pattern as `packages/taxonomy/src/admin/routes.ts:handleGet` tree\n * branch from PR-C-taxonomy.\n */\nfunction parseUintParam(raw: string | null, fallback: number): number {\n  if (raw === null || !/^\\d+$/.test(raw)) return fallback\n  const parsed = Number(raw)\n  // The regex above stops hex / exponent / signed / whitespace / blank\n  // inputs, but a long digit-only string still slips past — `Number(...)`\n  // returns `Infinity` past ~309 digits, and precision is lost past\n  // 2^53. Both would propagate through `client.findMany`'s\n  // `offset: parsed` into a Postgres query that either crashes the\n  // driver (`Infinity` is not a valid bigint) or silently rounds (the\n  // 2^53 precision-loss boundary). Reject via `Number.isSafeInteger`\n  // so overflowing inputs revert to `fallback` like every other\n  // malformed value.\n  if (!Number.isSafeInteger(parsed)) return fallback\n  return parsed\n}\n\n// ---------------------------------------------------------------------------\n// Response helpers\n// ---------------------------------------------------------------------------\n\nfunction jsonResponse(data: unknown, status = 200): Response {\n  return new Response(JSON.stringify(data), {\n    status,\n    headers: { 'Content-Type': 'application/json' },\n  })\n}\n\nfunction jsonError(message: string, status: number): Response {\n  return jsonResponse({ error: message }, status)\n}\n\n// ---------------------------------------------------------------------------\n// Per-request MediaClient factory + cached storage client\n// ---------------------------------------------------------------------------\n//\n// MediaClient and its AdminClient MUST be built per-request — AdminClient's\n// context resolver is captured eagerly at construction (see\n// buildContextResolver in @murumets-ee/core/clients). A module-level singleton\n// would bake the first request's user + tenant scope into every subsequent\n// request's writes — a cross-request permission/scope leak.\n//\n// Storage config is process-global and safe to cache once.\n\ntype StorageClient = Awaited<ReturnType<typeof import('@murumets-ee/storage').createStorageClient>>\n\ninterface StorageState {\n  clientPromise: Promise<StorageClient> | null\n}\n\n// Module-level state. `null` once eviction fires on a rejection so the next\n// request gets a fresh resolution attempt (see `getStorage`'s `.catch`).\nconst storageState: StorageState = { clientPromise: null }\n\n/**\n * Resolve the process-wide storage client. The pending-promise slot is\n * cleared on rejection so a transient `createStorageClient` failure\n * (DB hiccup, misconfig) doesn't poison every subsequent media request\n * for the lifetime of the Node process. Same pattern as\n * `packages/taxonomy/src/admin/routes.ts:getClient` from PR-C-taxonomy.\n */\nasync function getStorage(): Promise<StorageClient> {\n  if (!storageState.clientPromise) {\n    const pending = (async () => {\n      const { getApp } = await import('@murumets-ee/core')\n      const { createStorageClient } = await import('@murumets-ee/storage')\n      const { getStorageConfig } = await import('@murumets-ee/storage/plugin')\n      const app = getApp()\n      return createStorageClient(getStorageConfig(), { app })\n    })()\n    // Clear the slot on rejection so a transient failure doesn't poison\n    // every subsequent request. `pending.catch(handler)` attaches a\n    // synchronous rejection listener that resets the cached slot — the\n    // handler returns `undefined`, NOT a re-throw — so the new\n    // `.catch`-returned promise resolves, but we never await or hold\n    // that promise. The ORIGINAL `pending` (stored in\n    // `storageState.clientPromise`) is what callers `await`, and it's\n    // still in its rejected state — so the caller observing this\n    // resolution sees the underlying error. The `.catch` also marks\n    // the rejection as \"handled\" for Node's unhandled-rejection\n    // tracker. `storageState.clientPromise` holds the original `pending`\n    // so concurrent in-flight callers share one resolution.\n    pending.catch(() => {\n      if (storageState.clientPromise === pending) storageState.clientPromise = null\n    })\n    storageState.clientPromise = pending\n  }\n  return storageState.clientPromise\n}\n\nasync function getMediaClient(): Promise<MediaClient> {\n  const { createAdminClient } = await import('@murumets-ee/core/clients')\n  const { MediaClient } = await import('../client.js')\n  const { Media } = await import('../entity.js')\n  const storage = await getStorage()\n  const admin = createAdminClient(Media)\n  return new MediaClient({ admin, storage })\n}\n\n// ---------------------------------------------------------------------------\n// Handlers\n// ---------------------------------------------------------------------------\n\nconst handleGet: AdminRouteHandler = async (req, ctx) => {\n  const { isStorageConfigured, getStorageConfigReason } = await import('@murumets-ee/storage')\n  const segments = ctx.segments\n\n  // GET /media/<id>/usage — DB-only lookup, safe even when storage is\n  // unconfigured. Validate the UUID first so a malformed id 400s\n  // uniformly with the storage-configured branch below.\n  if (segments.length === 2 && segments[1] === 'usage') {\n    const id = segments[0]\n    if (!isValidUuid(id)) return jsonError('Invalid media ID format', 400)\n\n    const { findMediaUsages } = await import('../usage.js')\n    const { getApp } = await import('@murumets-ee/core')\n    const app = getApp()\n    const usages = await findMediaUsages(id, app)\n    return jsonResponse({ usages })\n  }\n\n  // Reject unknown sub-paths explicitly. The wrapper-gate has already\n  // passed (caller has `media:view`); a handler-level 404 here matches\n  // the dispatcher's miss-shape so unknown URLs don't fall through to\n  // the single-id branch and 400/500 with a misleading reason. The\n  // only valid 2-segment URL is `<id>/usage`, which was already\n  // claimed by the early-return above — anything else with >=2\n  // segments is not a recognized media route.\n  if (segments.length >= 2) return jsonError('Not found', 404)\n\n  // GET /media/<id> — validate UUID up front so a bad request still\n  // 400s when storage happens to be unconfigured (matches DELETE).\n  const singleId = segments.length > 0 ? segments[0] : undefined\n  if (singleId !== undefined && !isValidUuid(singleId)) {\n    return jsonError('Invalid media ID format', 400)\n  }\n\n  // Everything below needs a working storage client. If env isn't\n  // wired, return a structured \"disabled\" response rather than 500 —\n  // the media list page renders a banner and new admins can finish\n  // onboarding without being blocked on a crash loop.\n  if (!isStorageConfigured()) {\n    const reason = getStorageConfigReason() ?? 'Storage not configured'\n    if (segments.length > 0) {\n      // Single item — treat as not-found-ish to avoid leaking\n      // existence; include reason so the UI can surface it.\n      return jsonResponse({ error: reason, configured: false, reason }, 503)\n    }\n    // GET /media — empty list + disabled flag for the picker's banner.\n    const response: MediaPickerListResult & { configured: false; reason: string } = {\n      items: [],\n      total: 0,\n      configured: false,\n      reason,\n    }\n    return jsonResponse(response)\n  }\n\n  const client = await getMediaClient()\n\n  // GET /media/<id> — single item with URL (full record for EntityForm + picker)\n  if (singleId !== undefined) {\n    const record = await client.findById(singleId)\n    if (!record) return jsonError('Media not found', 404)\n\n    const url = await client.getUrl(singleId)\n    return jsonResponse({ ...record, url })\n  }\n\n  // GET /media — list with search/filter + batch URL resolution\n  const url = new URL(req.url)\n  const search = url.searchParams.get('search') ?? undefined\n  // mediaType MUST be validated against the entity's closed enum before\n  // it reaches `client.findMany` — the previous shape force-cast the raw\n  // query value with `as 'image' | ...` which is a type-system lie. A\n  // bogus value like `?mediaType=bogus` would parameterize into\n  // `WHERE media_type = 'bogus'` (no SQL injection — Drizzle is\n  // parameterized — but the row count is silently zero, which is\n  // confusing). Empty string from `?mediaType=` is also passed-through\n  // by the prior `?? undefined` shape since empty string is not null.\n  // Allowlist + type guard drops bogus / empty values cleanly so the\n  // filter is omitted instead of applied with a no-match value.\n  const rawMediaType = url.searchParams.get('mediaType')\n  const mediaType =\n    rawMediaType !== null && isAllowedMediaType(rawMediaType) ? rawMediaType : undefined\n  // Strict parsing keeps the contract honest — see `parseUintParam`\n  // JSDoc. Cap limit to [1, 100] and offset to [0, MAX_OFFSET] so a\n  // request can't ask for an unboundedly large page nor force a\n  // slow-discard scan with `?offset=99999999`.\n  const limit = Math.min(Math.max(parseUintParam(url.searchParams.get('limit'), 24), 1), 100)\n  const offset = Math.min(parseUintParam(url.searchParams.get('offset'), 0), MAX_OFFSET)\n\n  const result = await client.findMany({\n    ...(search !== undefined && { search }),\n    ...(mediaType !== undefined && { mediaType }),\n    limit,\n    offset,\n  })\n\n  // Resolve original URLs for all items, but thumbnail variants ONLY for\n  // images — a video/audio/document/other id will never have a `thumbnail`\n  // variant, so asking `getVariantUrls` to resolve one is pure waste (a\n  // storage lookup that falls through to the original, then gets discarded\n  // below anyway). `media-list-page.tsx` filters the same way.\n  const ids = result.items.map((item) => item.id)\n  const imageIds = result.items.filter((item) => item.mediaType === 'image').map((item) => item.id)\n  const [urlMap, thumbMap] = await Promise.all([\n    client.getUrls(ids),\n    client.getVariantUrls(imageIds, 'thumbnail'),\n  ])\n\n  const items: (MediaPickerItem & { thumbnailUrl?: string })[] = result.items.map((item) => {\n    // F115: `getVariantUrls` falls back to the ORIGINAL asset URL for any id\n    // with no `thumbnail` variant — correct for an image that just hasn't\n    // been processed yet, wrong for a video/audio/document/other row, which\n    // will never have one. Gating on `mediaType` keeps `thumbnailUrl` ABSENT\n    // rather than pointing a consumer's `<img src>` at a `.mp4`.\n    const thumbnailUrl = item.mediaType === 'image' ? thumbMap.get(item.id) : undefined\n    return {\n      id: item.id,\n      title: item.title ?? null,\n      alt: item.alt ?? null,\n      filename: item.filename,\n      mimeType: item.mimeType,\n      size: item.size,\n      mediaType: item.mediaType,\n      url: urlMap.get(item.id) ?? '',\n      ...(thumbnailUrl !== undefined && { thumbnailUrl }),\n      width: item.width ?? null,\n      height: item.height ?? null,\n    }\n  })\n\n  const response: MediaPickerListResult = { items, total: result.total }\n  return jsonResponse(response)\n}\n\nconst handleUpload: AdminRouteHandler = async (req, ctx) => {\n  const { isStorageConfigured, getStorageConfigReason, detectMimeType } = await import(\n    '@murumets-ee/storage'\n  )\n\n  // Upload is registered at `path: ''` (NOT matchAnyPath) — the\n  // dispatcher only invokes this handler when segments=[]. The api-\n  // handler ALSO rejects empty/whitespace-only first segments with a\n  // 400 before any plugin dispatcher runs (see\n  // `packages/admin-ui/src/server/api-handler/index.ts` segment-\n  // validation block). So this guard is defense-in-depth — per HANDOFF\n  // §\"Defense-in-depth `&& segments[i]` guards are fine\" — protecting\n  // against a future framework invariant change that lets a non-empty\n  // segment reach a `path: ''` static entry.\n  if (ctx.segments.length > 0) return jsonError('Not found', 404)\n\n  if (!isStorageConfigured()) {\n    return jsonError(getStorageConfigReason() ?? 'Storage not configured', 503)\n  }\n\n  const client = await getMediaClient()\n\n  const formData = await req.formData()\n  const file = formData.get('file')\n  // FormData `get` returns string | File | null. Reject anything that\n  // isn't a File so the typed `file.size`/`file.arrayBuffer()` below\n  // is safe without a runtime cast.\n  if (!(file instanceof File) || file.size === 0) {\n    return jsonError('No file provided', 400)\n  }\n\n  // Guard against oversized uploads (50 MB limit). Hardcoded rather\n  // than read from getMediaConfig() to keep this handler independent\n  // of plugin-init order — the plugin's resolved config may not be\n  // populated yet under CLI / non-RSC startup paths.\n  const MAX_UPLOAD_SIZE = 50 * 1024 * 1024\n  if (file.size > MAX_UPLOAD_SIZE) {\n    return jsonError(\n      `File too large: ${(file.size / 1024 / 1024).toFixed(1)} MB exceeds 50 MB limit`,\n      400,\n    )\n  }\n\n  const buffer = Buffer.from(await file.arrayBuffer())\n\n  // Detect actual MIME type from file content (prevents spoofing).\n  const { mimeType, mismatch } = await detectMimeType(\n    buffer,\n    file.type || 'application/octet-stream',\n  )\n  if (mismatch) {\n    return jsonError(\n      `File content doesn't match declared type: claimed ${file.type}, detected ${mimeType}`,\n      400,\n    )\n  }\n\n  // Per-upload visibility, DEFAULTING TO PRIVATE — the caller opts in.\n  //\n  // This route serves two populations with opposite needs. The media picker\n  // uploads publishable web assets: a page's hero image MUST be public or the\n  // public site resolves it to `null` and renders no images at all, with a 200\n  // on every page and one warn log (F030). `packages/rent-ui`'s inspection\n  // wizard posts to this SAME route with handover and return photos — vehicle\n  // and apartment condition shots, plates, interiors, occasionally documents —\n  // which must stay behind time-limited signed urls.\n  //\n  // Deny-by-default decides the direction, and the asymmetry is the argument:\n  // forget the opt-in and an image is invisible, which is annoying, visible and\n  // fixable; default to public and forget an opt-out and those photos become\n  // permanently world-readable. A missed opt-in cannot leak. So the default is\n  // unchanged (`private` via StorageClient's own fallback) and rent's caller is\n  // untouched — it sends nothing and behaves exactly as before.\n  const visibilityRaw = formData.get('visibility')\n  if (visibilityRaw !== null && visibilityRaw !== 'public' && visibilityRaw !== 'private') {\n    return jsonError(\"Field 'visibility' must be 'public' or 'private'\", 400)\n  }\n  const result = await client.upload(buffer, {\n    filename: file.name,\n    mimeType,\n    size: file.size,\n    uploadedBy: ctx.user.id,\n    ...(visibilityRaw !== null && { visibility: visibilityRaw }),\n  })\n\n  const item: MediaPickerItem = {\n    id: result.media.id,\n    title: result.media.title ?? null,\n    alt: result.media.alt ?? null,\n    filename: result.media.filename,\n    mimeType: result.media.mimeType,\n    size: result.media.size,\n    mediaType: result.media.mediaType,\n    url: result.url,\n    width: result.media.width ?? null,\n    height: result.media.height ?? null,\n  }\n\n  safeAudit(ctx, {\n    action: 'media.upload',\n    entityType: 'media',\n    entityId: result.media.id,\n    userId: ctx.user.id,\n    ...(ctx.user.name !== undefined && { userName: ctx.user.name }),\n    changes: {\n      filename: result.media.filename,\n      mimeType: result.media.mimeType,\n      size: result.media.size,\n      mediaType: result.media.mediaType,\n    },\n  })\n\n  return jsonResponse(item, 201)\n}\n\nconst handleRegenerateVariants: AdminRouteHandler = async (_req, ctx) => {\n  const { isStorageConfigured, getStorageConfigReason } = await import('@murumets-ee/storage')\n\n  // Static POST path='regenerate-variants' — the dispatcher only invokes\n  // this handler when `segments[0] === 'regenerate-variants'`. Trailing\n  // segments (e.g. POST /media/regenerate-variants/extra) aren't a\n  // supported sub-route.\n  if (ctx.segments.length !== 1) return jsonError('Not found', 404)\n\n  if (!isStorageConfigured()) {\n    return jsonError(getStorageConfigReason() ?? 'Storage not configured', 503)\n  }\n\n  const { regenerateAllVariants } = await import('../regenerate-variants.js')\n  const { getApp, getContext } = await import('@murumets-ee/core')\n  const { resolveImageStyles } = await import('../resolve-image-styles.js')\n  const { createStorageClient } = await import('@murumets-ee/storage')\n  const { getStorageConfig } = await import('@murumets-ee/storage/plugin')\n\n  const app = getApp()\n  const styles = await resolveImageStyles(app, app.logger)\n  if (!styles || Object.keys(styles).length === 0) {\n    return jsonError('No image styles configured', 400)\n  }\n\n  const storageConfig = getStorageConfig()\n  const storage = createStorageClient(storageConfig, { app })\n\n  const result = await regenerateAllVariants({\n    app,\n    storage,\n    logger: app.logger.child({ media: true }),\n    styles,\n    contextResolver: () => {\n      const requestCtx = getContext()\n      if (!requestCtx?.user || !requestCtx?.checker) return undefined\n      return {\n        user: requestCtx.user,\n        checker: requestCtx.checker,\n        ...(requestCtx.scope !== undefined && { scope: requestCtx.scope }),\n      }\n    },\n  })\n\n  safeAudit(ctx, {\n    action: 'media.regenerate_variants',\n    userId: ctx.user.id,\n    ...(ctx.user.name !== undefined && { userName: ctx.user.name }),\n    metadata: { total: result.total, processed: result.processed, errors: result.errors },\n  })\n\n  return jsonResponse(result)\n}\n\nconst handleDelete: AdminRouteHandler = async (_req, ctx) => {\n  const segments = ctx.segments\n\n  // DELETE /media — no id supplied. Reject as 400, NOT 404, so a\n  // caller confusing \"no id\" with \"id not found\" gets a meaningful\n  // error. The wrapper-gate has already validated the caller has\n  // media:delete, so the 400 isn't an information-disclosure vector.\n  if (segments.length === 0) return jsonError('Media ID required', 400)\n\n  // Reject sub-paths beyond /<id> — DELETE /media/<id>/usage etc.\n  if (segments.length > 1) return jsonError('Not found', 404)\n\n  const id = segments[0]\n  if (!isValidUuid(id)) return jsonError('Invalid media ID format', 400)\n\n  const { isStorageConfigured, getStorageConfigReason } = await import('@murumets-ee/storage')\n  if (!isStorageConfigured()) {\n    // Can't safely delete — MediaClient needs storage to remove the\n    // actual object, and partial delete (DB row gone, object orphaned)\n    // would leak storage. Surface the reason so the UI can display it.\n    return jsonError(getStorageConfigReason() ?? 'Storage not configured', 503)\n  }\n\n  // AdminClient.delete() checks entity_refs and throws\n  // ReferencedEntityError if this media is still referenced. The\n  // error bubbles to the caller's error handler which returns 409\n  // with usage details.\n  const client = await getMediaClient()\n  await client.delete(id)\n\n  safeAudit(ctx, {\n    action: 'media.delete',\n    entityType: 'media',\n    entityId: id,\n    userId: ctx.user.id,\n    ...(ctx.user.name !== undefined && { userName: ctx.user.name }),\n  })\n\n  return jsonResponse({ deleted: 1 })\n}\n\n// ---------------------------------------------------------------------------\n// Route factory\n// ---------------------------------------------------------------------------\n\n/**\n * Default roles for view: broad reach across the admin shell.\n *\n * `BUILT_IN_ROLES` in `packages/auth/src/permissions.ts` is\n * `['admin', 'public', 'authenticated', 'agent', 'customer']` — `admin` is\n * hardcoded as an unconditional yes in `buildPermissionChecker`,\n * `agent` is the only non-admin built-in that flows through\n * `buildInitialRoleDefinitions()` + `upsertBuiltInRoles` with default\n * media access (`customer` seeds with zero permissions — see that\n * function's JSDoc). The `agent` entry in this list is what gives ops\n * agents read-only media access on first boot of a fresh install.\n *\n * `editor` and `viewer` are CONVENTIONAL app-defined roles —\n * apps that follow the scaffold pattern create them as part of\n * their own role catalog. Including them in `defaultRoles` doesn't\n * seed them (the seeder only iterates the built-ins above), but\n * the values DO flow into the process-local permission catalog\n * (see `registerPermission` in `@murumets-ee/core`), which the\n * forthcoming Permission Matrix UI (PR-D) reads to show \"this\n * route's recommended default grants\" against the app's actual\n * role set. The catalog is also the mechanism via which a future\n * upgrade of `upsertBuiltInRoles` could extend the seed surface\n * to app-defined roles without each plugin having to re-declare\n * its defaults.\n */\nconst VIEW_DEFAULT_ROLES = ['admin', 'editor', 'agent', 'viewer'] as const\n\n/** Default roles for create/delete — narrower than view. */\nconst WRITE_DEFAULT_ROLES = ['admin', 'editor'] as const\n\n/**\n * Build admin API routes for media management.\n *\n * Returns `AdminRoute[]` from `combineAdminRoutes` — one entry per\n * `(prefix, method)` after grouping. Callers spread the result into\n * their top-level routes list: `routes: [...mediaRoutes()]`.\n *\n * Four `defineAdminRoute` entries:\n *\n *   - GET    matchAnyPath with `media:view`   defaultRoles: VIEW_DEFAULT_ROLES\n *   - POST   path=''            `media:create` defaultRoles: WRITE_DEFAULT_ROLES\n *   - POST   path='regenerate-variants' `media:create` defaultRoles: WRITE_DEFAULT_ROLES\n *   - DELETE matchAnyPath with `media:delete` defaultRoles: WRITE_DEFAULT_ROLES\n *\n * Permissions are auto-registered by the entity catalog\n * (`buildResourceCatalog` in `@murumets-ee/auth`) AND by\n * `registerPermission` inside `defineAdminRoute`. Idempotent —\n * `registerPermission` unions `defaultRoles` on repeat registration,\n * so the framework's two pathways agree on the final grant set.\n *\n * Standard entity CRUD (PATCH with translations) is NOT registered\n * here — it falls through to the generic entity handler. Add `Media`\n * to the `entities` array in your handler config to enable it.\n */\nexport function mediaRoutes(): AdminRoute[] {\n  const entries = [\n    defineAdminRoute({\n      prefix: 'media',\n      path: '',\n      method: 'GET',\n      permission: 'media:view',\n      defaultRoles: VIEW_DEFAULT_ROLES,\n      matchAnyPath: true,\n      description: 'Read media — list, single item, or referencing-entity usage report.',\n      handler: handleGet,\n    }),\n    defineAdminRoute({\n      prefix: 'media',\n      path: '',\n      method: 'POST',\n      permission: 'media:create',\n      defaultRoles: WRITE_DEFAULT_ROLES,\n      description: 'Upload a media file (multipart FormData with `file` field).',\n      handler: handleUpload,\n    }),\n    defineAdminRoute({\n      prefix: 'media',\n      path: 'regenerate-variants',\n      method: 'POST',\n      permission: 'media:create',\n      defaultRoles: WRITE_DEFAULT_ROLES,\n      description: 'Regenerate every image-style variant for every media row.',\n      handler: handleRegenerateVariants,\n    }),\n    defineAdminRoute({\n      prefix: 'media',\n      path: '',\n      method: 'DELETE',\n      permission: 'media:delete',\n      defaultRoles: WRITE_DEFAULT_ROLES,\n      matchAnyPath: true,\n      description: 'Delete a media record + its storage object.',\n      handler: handleDelete,\n    }),\n  ]\n\n  return combineAdminRoutes(entries)\n}\n","/**\n * Media plugin — auto-registers the Media entity, mounts admin routes, and\n * contributes sidebar + default-route scaffolding for the admin shell.\n *\n * @example\n * ```typescript\n * import { media } from '@murumets-ee/media/plugin'\n *\n * export default defineLumiConfig({\n *   plugins: [\n *     storage(),\n *     media({ maxUploadSize: 10 * 1024 * 1024 }),\n *   ],\n * })\n * ```\n */\n\nimport { definePlugin } from '@murumets-ee/core'\n// Self-reference the `./image-styles` subpath (not the internal source\n// files) so the plugin bundle externalizes the React components instead\n// of inlining them — the subpath is built separately with a `'use client'`\n// banner, and Next.js needs to see that boundary preserved.\nimport { ImageStylesManager, RegenerateVariantsAction } from '@murumets-ee/media/image-styles'\nimport { mediaRoutes } from './admin/routes.js'\nimport { Media } from './entity.js'\nimport { imageStylesSettings } from './image-styles-settings.js'\n// Relative: `src/i18n.ts` is a sibling entry of this one in the same tsdown\n// config, so the loader lands in a shared chunk rather than being\n// duplicated, and its `import('./messages/et.json')` resolves against\n// `dist/`, which this package's build script populates.\nimport { getMediaMessages } from './i18n.js'\nimport type { MediaPluginConfig } from './types.js'\n\nlet _mediaConfig: Required<MediaPluginConfig> | null = null\n\n/**\n * Get the resolved media plugin configuration.\n * Throws if plugin not initialized.\n */\nexport function getMediaConfig(): Required<MediaPluginConfig> {\n  if (!_mediaConfig) {\n    throw new Error('@murumets-ee/media plugin not initialized. Add media() to your plugins array.')\n  }\n  return _mediaConfig\n}\n\n/**\n * Media plugin factory.\n *\n * - Registers the Media entity\n * - Mounts the media admin API routes\n * - Contributes sidebar + default-route metadata\n * - Declares @murumets-ee/storage + @murumets-ee/settings as required deps\n *   (framework-validated before any plugin init runs — see `requires` field below)\n * - Captures resolved configuration for `getMediaConfig()`\n */\nexport function media(config?: MediaPluginConfig) {\n  const resolvedConfig: Required<MediaPluginConfig> = {\n    acceptedTypes: config?.acceptedTypes ?? ['image/*', 'video/*', 'audio/*', 'application/pdf'],\n    maxUploadSize: config?.maxUploadSize ?? 50 * 1024 * 1024,\n    defaultVisibility: config?.defaultVisibility ?? 'public',\n    imageStyles: config?.imageStyles ?? {\n      thumbnail: { width: 200, height: 200, fit: 'cover', format: 'webp', quality: 80 },\n    },\n  }\n\n  return definePlugin({\n    name: '@murumets-ee/media',\n    // Declarative dep validation — replaces the per-plugin\n    // `if (!app.plugins.has(...)) throw` loop that used to live in\n    // `init`. The framework validates BEFORE any init runs, so a\n    // missing dep surfaces immediately with the full punchlist\n    // instead of throwing partway through boot.\n    requires: ['@murumets-ee/storage', '@murumets-ee/settings'],\n    shared: {\n      // The interface-message catalogue, declared rather than left for each\n      // app to remember (commerce-launch F148/F155). The framework gathers\n      // it at the merge step; nothing loads a locale until one is asked for.\n      messages: getMediaMessages,\n      // Self-contributes the media.imageStyles namespace. The merge engine\n      // auto-derives the permission resource (`settings_media.imageStyles`)\n      // and the sidebar entry under the \"Settings\" group. The app's\n      // admin-api-handler call site aggregates plugin-contributed\n      // namespaces into `settingsRoutes(...)` (see apps/admin's\n      // `getAllSettings()` for the canonical pattern); apps that follow\n      // the scaffold pattern get this for free.\n      // Drop the `as PluginSettingsDefinition` cast — it would widen the\n      // namespace literal (e.g. `'media.imageStyles'`) to `string`,\n      // leaking `settings_${string}:view|update` into the resolved\n      // permission union via `<const N>` capture loss.\n      // `imageStylesSettings` is structurally a superset of\n      // `PluginSettingsDefinition` (full vs. narrow `SettingsDefinition`),\n      // which TS accepts directly. The `readonly` outer tuple comes from\n      // the parent definePlugin's `<const S>` capture.\n      settings: [imageStylesSettings],\n    },\n    server: {\n      entities: [Media],\n      routes: [...mediaRoutes()],\n      init: async (app) => {\n        _mediaConfig = resolvedConfig\n\n        // Image style defaults live in the plugin config and are exposed via\n        // `getMediaConfig()`. Persistent overrides go to the settings DB\n        // through the generic settings API at `/api/admin/settings/media.imageStyles`\n        // — see `image-styles-settings.ts`. `resolveImageStyles` reads\n        // DB-first, config-fallback.\n        //\n        // We deliberately do NOT seed the DB here. Init must stay lightweight:\n        // it runs in every context (Next.js server, Next.js build, CLI commands).\n        // The prior eager-seed path pulled in `@murumets-ee/settings`'s main entry —\n        // which carries `import 'server-only'` — and crashed non-RSC Node bootstrap.\n\n        app.logger.info(\n          {\n            acceptedTypes: resolvedConfig.acceptedTypes,\n            maxUploadSize: resolvedConfig.maxUploadSize,\n            defaultVisibility: resolvedConfig.defaultVisibility,\n          },\n          'Media plugin initialized',\n        )\n      },\n    },\n    adminUi: {\n      sidebar: [\n        {\n          id: 'media',\n          group: 'Library',\n          label: 'Media',\n          href: '/admin/media',\n          iconName: 'image',\n        },\n      ],\n      defaultRoutes: [\n        // Routing only — sidebar nav comes from `adminUi.sidebar` above\n        // (admin-page-routing SD003).\n        {\n          path: 'media',\n          factory: 'MediaListPage',\n        },\n        {\n          path: 'media/[id]',\n          factory: 'MediaEditPage',\n        },\n      ],\n      // Self-contributes the rich image-styles editor and the\n      // \"Regenerate All Variants\" action. Apps don't have to wire either\n      // — they appear automatically on /admin/settings/media.imageStyles\n      // (route + sidebar entry auto-derived from `shared.settings`).\n      settingRenderers: {\n        'media.imageStyles': ImageStylesManager,\n      },\n      settingsActions: {\n        'media.imageStyles': RegenerateVariantsAction,\n      },\n    },\n  })\n}\n"],"mappings":"2WA0EA,MAAM,EAAU,kEAEhB,SAAS,EAAY,EAA4C,CAC/D,OAAO,IAAU,IAAA,IAAa,EAAQ,KAAK,CAAK,CAClD,CAcA,MAAM,EAAsB,CAAC,QAAS,QAAS,QAAS,WAAY,OAAO,EAG3E,SAAS,EAAmB,EAA0C,CAMpE,OAAQ,EAA0C,SAAS,CAAK,CAClE,CAwBA,SAAS,EAAe,EAAoB,EAA0B,CACpE,GAAI,IAAQ,MAAQ,CAAC,QAAQ,KAAK,CAAG,EAAG,OAAO,EAC/C,IAAM,EAAS,OAAO,CAAG,EAWzB,OADK,OAAO,cAAc,CAAM,EACzB,EADmC,CAE5C,CAMA,SAAS,EAAa,EAAe,EAAS,IAAe,CAC3D,OAAO,IAAI,SAAS,KAAK,UAAU,CAAI,EAAG,CACxC,SACA,QAAS,CAAE,eAAgB,kBAAmB,CAChD,CAAC,CACH,CAEA,SAAS,EAAU,EAAiB,EAA0B,CAC5D,OAAO,EAAa,CAAE,MAAO,CAAQ,EAAG,CAAM,CAChD,CAsBA,MAAM,EAA6B,CAAE,cAAe,IAAK,EASzD,eAAe,GAAqC,CAClD,GAAI,CAAC,EAAa,cAAe,CAC/B,IAAM,GAAW,SAAY,CAC3B,GAAM,CAAE,UAAW,MAAM,OAAO,qBAC1B,CAAE,uBAAwB,MAAM,OAAO,wBACvC,CAAE,oBAAqB,MAAM,OAAO,+BACpC,EAAM,EAAO,EACnB,OAAO,EAAoB,EAAiB,EAAG,CAAE,KAAI,CAAC,CACxD,EAAA,CAAG,EAaH,EAAQ,UAAY,CACd,EAAa,gBAAkB,IAAS,EAAa,cAAgB,KAC3E,CAAC,EACD,EAAa,cAAgB,CAC/B,CACA,OAAO,EAAa,aACtB,CAEA,eAAe,GAAuC,CACpD,GAAM,CAAE,qBAAsB,MAAM,OAAO,6BACrC,CAAE,eAAgB,MAAM,OAAO,gBAC/B,CAAE,SAAU,MAAM,OAAO,wBAAe,CAAA,KAAA,GAAA,EAAA,CAAA,EACxC,EAAU,MAAM,EAAW,EAEjC,OAAO,IAAI,EAAY,CAAE,MADX,EAAkB,CACH,EAAG,SAAQ,CAAC,CAC3C,CAMA,MAAM,EAA+B,MAAO,EAAK,IAAQ,CACvD,GAAM,CAAE,sBAAqB,0BAA2B,MAAM,OAAO,wBAC/D,EAAW,EAAI,SAKrB,GAAI,EAAS,SAAW,GAAK,EAAS,KAAO,QAAS,CACpD,IAAM,EAAK,EAAS,GACpB,GAAI,CAAC,EAAY,CAAE,EAAG,OAAO,EAAU,0BAA2B,GAAG,EAErE,GAAM,CAAE,mBAAoB,MAAM,OAAO,eACnC,CAAE,UAAW,MAAM,OAAO,qBAGhC,OAAO,EAAa,CAAE,OAAA,MADD,EAAgB,EADzB,EAC+B,CAAC,CACf,CAAC,CAChC,CASA,GAAI,EAAS,QAAU,EAAG,OAAO,EAAU,YAAa,GAAG,EAI3D,IAAM,EAAW,EAAS,OAAS,EAAI,EAAS,GAAK,IAAA,GACrD,GAAI,IAAa,IAAA,IAAa,CAAC,EAAY,CAAQ,EACjD,OAAO,EAAU,0BAA2B,GAAG,EAOjD,GAAI,CAAC,EAAoB,EAAG,CAC1B,IAAM,EAAS,EAAuB,GAAK,yBAa3C,OAZI,EAAS,OAAS,EAGb,EAAa,CAAE,MAAO,EAAQ,WAAY,GAAO,QAAO,EAAG,GAAG,EAShE,EAAa,CALlB,MAAO,CAAC,EACR,MAAO,EACP,WAAY,GACZ,QAEyB,CAAC,CAC9B,CAEA,IAAM,EAAS,MAAM,EAAe,EAGpC,GAAI,IAAa,IAAA,GAAW,CAC1B,IAAM,EAAS,MAAM,EAAO,SAAS,CAAQ,EAC7C,GAAI,CAAC,EAAQ,OAAO,EAAU,kBAAmB,GAAG,EAEpD,IAAM,EAAM,MAAM,EAAO,OAAO,CAAQ,EACxC,OAAO,EAAa,CAAE,GAAG,EAAQ,KAAI,CAAC,CACxC,CAGA,IAAM,EAAM,IAAI,IAAI,EAAI,GAAG,EACrB,EAAS,EAAI,aAAa,IAAI,QAAQ,GAAK,IAAA,GAW3C,EAAe,EAAI,aAAa,IAAI,WAAW,EAC/C,EACJ,IAAiB,MAAQ,EAAmB,CAAY,EAAI,EAAe,IAAA,GAKvE,EAAQ,KAAK,IAAI,KAAK,IAAI,EAAe,EAAI,aAAa,IAAI,OAAO,EAAG,EAAE,EAAG,CAAC,EAAG,GAAG,EACpF,EAAS,KAAK,IAAI,EAAe,EAAI,aAAa,IAAI,QAAQ,EAAG,CAAC,EAAG,GAAU,EAE/E,EAAS,MAAM,EAAO,SAAS,CACnC,GAAI,IAAW,IAAA,IAAa,CAAE,QAAO,EACrC,GAAI,IAAc,IAAA,IAAa,CAAE,WAAU,EAC3C,QACA,QACF,CAAC,EAOK,EAAM,EAAO,MAAM,IAAK,GAAS,EAAK,EAAE,EACxC,EAAW,EAAO,MAAM,OAAQ,GAAS,EAAK,YAAc,OAAO,CAAC,CAAC,IAAK,GAAS,EAAK,EAAE,EAC1F,CAAC,EAAQ,GAAY,MAAM,QAAQ,IAAI,CAC3C,EAAO,QAAQ,CAAG,EAClB,EAAO,eAAe,EAAU,WAAW,CAC7C,CAAC,EAyBD,OAAO,EAAa,CADsB,MAtBqB,EAAO,MAAM,IAAK,GAAS,CAMxF,IAAM,EAAe,EAAK,YAAc,QAAU,EAAS,IAAI,EAAK,EAAE,EAAI,IAAA,GAC1E,MAAO,CACL,GAAI,EAAK,GACT,MAAO,EAAK,OAAS,KACrB,IAAK,EAAK,KAAO,KACjB,SAAU,EAAK,SACf,SAAU,EAAK,SACf,KAAM,EAAK,KACX,UAAW,EAAK,UAChB,IAAK,EAAO,IAAI,EAAK,EAAE,GAAK,GAC5B,GAAI,IAAiB,IAAA,IAAa,CAAE,cAAa,EACjD,MAAO,EAAK,OAAS,KACrB,OAAQ,EAAK,QAAU,IACzB,CACF,CAE8C,EAAG,MAAO,EAAO,KACpC,CAAC,CAC9B,EAEM,EAAkC,MAAO,EAAK,IAAQ,CAC1D,GAAM,CAAE,sBAAqB,yBAAwB,kBAAmB,MAAM,OAC5E,wBAYF,GAAI,EAAI,SAAS,OAAS,EAAG,OAAO,EAAU,YAAa,GAAG,EAE9D,GAAI,CAAC,EAAoB,EACvB,OAAO,EAAU,EAAuB,GAAK,yBAA0B,GAAG,EAG5E,IAAM,EAAS,MAAM,EAAe,EAE9B,EAAW,MAAM,EAAI,SAAS,EAC9B,EAAO,EAAS,IAAI,MAAM,EAIhC,GAAI,EAAE,aAAgB,OAAS,EAAK,OAAS,EAC3C,OAAO,EAAU,mBAAoB,GAAG,EAQ1C,GAAI,EAAK,KADe,GAAK,KAAO,KAElC,OAAO,EACL,oBAAoB,EAAK,KAAO,KAAO,KAAA,CAAM,QAAQ,CAAC,EAAE,yBACxD,GACF,EAGF,IAAM,EAAS,OAAO,KAAK,MAAM,EAAK,YAAY,CAAC,EAG7C,CAAE,WAAU,YAAa,MAAM,EACnC,EACA,EAAK,MAAQ,0BACf,EACA,GAAI,EACF,OAAO,EACL,qDAAqD,EAAK,KAAK,aAAa,IAC5E,GACF,EAmBF,IAAM,EAAgB,EAAS,IAAI,YAAY,EAC/C,GAAI,IAAkB,MAAQ,IAAkB,UAAY,IAAkB,UAC5E,OAAO,EAAU,mDAAoD,GAAG,EAE1E,IAAM,EAAS,MAAM,EAAO,OAAO,EAAQ,CACzC,SAAU,EAAK,KACf,WACA,KAAM,EAAK,KACX,WAAY,EAAI,KAAK,GACrB,GAAI,IAAkB,MAAQ,CAAE,WAAY,CAAc,CAC5D,CAAC,EAEK,EAAwB,CAC5B,GAAI,EAAO,MAAM,GACjB,MAAO,EAAO,MAAM,OAAS,KAC7B,IAAK,EAAO,MAAM,KAAO,KACzB,SAAU,EAAO,MAAM,SACvB,SAAU,EAAO,MAAM,SACvB,KAAM,EAAO,MAAM,KACnB,UAAW,EAAO,MAAM,UACxB,IAAK,EAAO,IACZ,MAAO,EAAO,MAAM,OAAS,KAC7B,OAAQ,EAAO,MAAM,QAAU,IACjC,EAgBA,OAdA,EAAU,EAAK,CACb,OAAQ,eACR,WAAY,QACZ,SAAU,EAAO,MAAM,GACvB,OAAQ,EAAI,KAAK,GACjB,GAAI,EAAI,KAAK,OAAS,IAAA,IAAa,CAAE,SAAU,EAAI,KAAK,IAAK,EAC7D,QAAS,CACP,SAAU,EAAO,MAAM,SACvB,SAAU,EAAO,MAAM,SACvB,KAAM,EAAO,MAAM,KACnB,UAAW,EAAO,MAAM,SAC1B,CACF,CAAC,EAEM,EAAa,EAAM,GAAG,CAC/B,EAEM,EAA8C,MAAO,EAAM,IAAQ,CACvE,GAAM,CAAE,sBAAqB,0BAA2B,MAAM,OAAO,wBAMrE,GAAI,EAAI,SAAS,SAAW,EAAG,OAAO,EAAU,YAAa,GAAG,EAEhE,GAAI,CAAC,EAAoB,EACvB,OAAO,EAAU,EAAuB,GAAK,yBAA0B,GAAG,EAG5E,GAAM,CAAE,yBAA0B,MAAM,OAAO,sCACzC,CAAE,SAAQ,cAAe,MAAM,OAAO,qBACtC,CAAE,sBAAuB,MAAM,OAAO,uCACtC,CAAE,uBAAwB,MAAM,OAAO,wBACvC,CAAE,oBAAqB,MAAM,OAAO,+BAEpC,EAAM,EAAO,EACb,EAAS,MAAM,EAAmB,EAAK,EAAI,MAAM,EACvD,GAAI,CAAC,GAAU,OAAO,KAAK,CAAM,CAAC,CAAC,SAAW,EAC5C,OAAO,EAAU,6BAA8B,GAAG,EAMpD,IAAM,EAAS,MAAM,EAAsB,CACzC,MACA,QAJc,EADM,EAC0B,EAAG,CAAE,KAAI,CAIjD,EACN,OAAQ,EAAI,OAAO,MAAM,CAAE,MAAO,EAAK,CAAC,EACxC,SACA,oBAAuB,CACrB,IAAM,EAAa,EAAW,EAC1B,MAAC,GAAY,MAAQ,CAAC,GAAY,SACtC,MAAO,CACL,KAAM,EAAW,KACjB,QAAS,EAAW,QACpB,GAAI,EAAW,QAAU,IAAA,IAAa,CAAE,MAAO,EAAW,KAAM,CAClE,CACF,CACF,CAAC,EASD,OAPA,EAAU,EAAK,CACb,OAAQ,4BACR,OAAQ,EAAI,KAAK,GACjB,GAAI,EAAI,KAAK,OAAS,IAAA,IAAa,CAAE,SAAU,EAAI,KAAK,IAAK,EAC7D,SAAU,CAAE,MAAO,EAAO,MAAO,UAAW,EAAO,UAAW,OAAQ,EAAO,MAAO,CACtF,CAAC,EAEM,EAAa,CAAM,CAC5B,EAEM,EAAkC,MAAO,EAAM,IAAQ,CAC3D,IAAM,EAAW,EAAI,SAMrB,GAAI,EAAS,SAAW,EAAG,OAAO,EAAU,oBAAqB,GAAG,EAGpE,GAAI,EAAS,OAAS,EAAG,OAAO,EAAU,YAAa,GAAG,EAE1D,IAAM,EAAK,EAAS,GACpB,GAAI,CAAC,EAAY,CAAE,EAAG,OAAO,EAAU,0BAA2B,GAAG,EAErE,GAAM,CAAE,sBAAqB,0BAA2B,MAAM,OAAO,wBAuBrE,OAtBK,EAAoB,GAYzB,MAAM,MADe,EAAe,EAAA,CACvB,OAAO,CAAE,EAEtB,EAAU,EAAK,CACb,OAAQ,eACR,WAAY,QACZ,SAAU,EACV,OAAQ,EAAI,KAAK,GACjB,GAAI,EAAI,KAAK,OAAS,IAAA,IAAa,CAAE,SAAU,EAAI,KAAK,IAAK,CAC/D,CAAC,EAEM,EAAa,CAAE,QAAS,CAAE,CAAC,GAlBzB,EAAU,EAAuB,GAAK,yBAA0B,GAAG,CAmB9E,EA+BM,EAAqB,CAAC,QAAS,SAAU,QAAS,QAAQ,EAG1D,EAAsB,CAAC,QAAS,QAAQ,EA0B9C,SAAgB,GAA4B,CA0C1C,OAAO,EAAmB,CAxCxB,EAAiB,CACf,OAAQ,QACR,KAAM,GACN,OAAQ,MACR,WAAY,aACZ,aAAc,EACd,aAAc,GACd,YAAa,sEACb,QAAS,CACX,CAAC,EACD,EAAiB,CACf,OAAQ,QACR,KAAM,GACN,OAAQ,OACR,WAAY,eACZ,aAAc,EACd,YAAa,8DACb,QAAS,CACX,CAAC,EACD,EAAiB,CACf,OAAQ,QACR,KAAM,sBACN,OAAQ,OACR,WAAY,eACZ,aAAc,EACd,YAAa,4DACb,QAAS,CACX,CAAC,EACD,EAAiB,CACf,OAAQ,QACR,KAAM,GACN,OAAQ,SACR,WAAY,eACZ,aAAc,EACd,aAAc,GACd,YAAa,8CACb,QAAS,CACX,CAAC,CAG6B,CAAC,CACnC,CChoBA,IAAI,EAAmD,KAMvD,SAAgB,GAA8C,CAC5D,GAAI,CAAC,EACH,MAAU,MAAM,+EAA+E,EAEjG,OAAO,CACT,CAYA,SAAgB,EAAM,EAA4B,CAChD,IAAM,EAA8C,CAClD,cAAe,GAAQ,eAAiB,CAAC,UAAW,UAAW,UAAW,iBAAiB,EAC3F,cAAe,GAAQ,eAAiB,GAAK,KAAO,KACpD,kBAAmB,GAAQ,mBAAqB,SAChD,YAAa,GAAQ,aAAe,CAClC,UAAW,CAAE,MAAO,IAAK,OAAQ,IAAK,IAAK,QAAS,OAAQ,OAAQ,QAAS,EAAG,CAClF,CACF,EAEA,OAAO,EAAa,CAClB,KAAM,qBAMN,SAAU,CAAC,uBAAwB,uBAAuB,EAC1D,OAAQ,CAIN,SAAU,EAgBV,SAAU,CAAC,CAAmB,CAChC,EACA,OAAQ,CACN,SAAU,CAAC,CAAK,EAChB,OAAQ,CAAC,GAAG,EAAY,CAAC,EACzB,KAAM,KAAO,IAAQ,CACnB,EAAe,EAaf,EAAI,OAAO,KACT,CACE,cAAe,EAAe,cAC9B,cAAe,EAAe,cAC9B,kBAAmB,EAAe,iBACpC,EACA,0BACF,CACF,CACF,EACA,QAAS,CACP,QAAS,CACP,CACE,GAAI,QACJ,MAAO,UACP,MAAO,QACP,KAAM,eACN,SAAU,OACZ,CACF,EACA,cAAe,CAGb,CACE,KAAM,QACN,QAAS,eACX,EACA,CACE,KAAM,aACN,QAAS,eACX,CACF,EAKA,iBAAkB,CAChB,oBAAqB,CACvB,EACA,gBAAiB,CACf,oBAAqB,CACvB,CACF,CACF,CAAC,CACH"}

package/dist/{resolve-image-styles-qf5MpFll.mjs → resolve-image-styles-DlHP19gI.mjs}

@@ -1,2 +1,2 @@
-const e={thumbnail:{width:200,height:200,fit:`cover`,format:`webp`,quality:80}};async function t(t,n){try{let{createSettingsClient:e}=await import(`@murumets-ee/settings`),{imageStylesSettings:n}=await import(`./image-styles-settings-ClIA2MJI.mjs`),r=await e(n,{app:t}).get(`imageStyles`);if(r&&Object.keys(r).length>0)return r}catch(e){n?.warn({err:e},`resolveImageStyles: settings DB read failed — falling back`)}try{let{getMediaConfig:e}=await import(`./plugin-B8tYWi8Q.mjs`);return e().imageStyles}catch{}return e}export{t as resolveImageStyles};
-//# sourceMappingURL=resolve-image-styles-qf5MpFll.mjs.map
+const e={thumbnail:{width:200,height:200,fit:`cover`,format:`webp`,quality:80}};async function t(t,n){try{let{createSettingsClient:e}=await import(`@murumets-ee/settings`),{imageStylesSettings:n}=await import(`./image-styles-settings-ClIA2MJI.mjs`),r=await e(n,{app:t}).get(`imageStyles`);if(r&&Object.keys(r).length>0)return r}catch(e){n?.warn({err:e},`resolveImageStyles: settings DB read failed — falling back`)}try{let{getMediaConfig:e}=await import(`./plugin-DMFiH96i.mjs`);return e().imageStyles}catch{}return e}export{t as resolveImageStyles};
+//# sourceMappingURL=resolve-image-styles-DlHP19gI.mjs.map

package/dist/{resolve-image-styles-qf5MpFll.mjs.map → resolve-image-styles-DlHP19gI.mjs.map}

@@ -1 +1 @@
-{"version":3,"file":"resolve-image-styles-qf5MpFll.mjs","names":[],"sources":["../src/resolve-image-styles.ts"],"sourcesContent":["/**\n * Image style resolution waterfall — single source of truth for the\n * \"which styles should we use?\" question.\n *\n * Priority: settings DB (user-configured) → plugin config (from `media()`\n * factory call) → hardcoded defaults (thumbnail only).\n *\n * This replaces three near-duplicate blocks (MediaClient's private\n * resolveImageStyles + two admin-route branches) that had drifted — the\n * routes didn't treat an empty stored object as \"fall back to config\"\n * while MediaClient did. Consolidating here keeps the behavior consistent\n * and logs the DB read failure so operators can diagnose issues instead\n * of silently getting defaults.\n *\n * Not cached. MediaClient wraps this with its own per-instance cache.\n */\n\nimport type { Logger, ToolkitApp } from '@murumets-ee/core'\nimport type { ImageStyle } from './types.js'\n\nconst HARDCODED_DEFAULTS: Record<string, ImageStyle> = {\n  thumbnail: { width: 200, height: 200, fit: 'cover', format: 'webp', quality: 80 },\n}\n\nexport async function resolveImageStyles(\n  app: ToolkitApp,\n  logger?: Logger,\n): Promise<Record<string, ImageStyle>> {\n  // 1. Settings DB (source of truth once the admin UI has saved anything).\n  //    An empty record counts as \"nothing configured\" — fall through. This\n  //    matches the pre-extraction behavior of MediaClient and fixes the\n  //    routes' prior behavior of showing an empty UI in that case.\n  try {\n    const { createSettingsClient } = await import('@murumets-ee/settings')\n    const { imageStylesSettings } = await import('./image-styles-settings.js')\n    const settingsClient = createSettingsClient(imageStylesSettings, { app })\n    const stored = await settingsClient.get('imageStyles')\n    if (stored && Object.keys(stored).length > 0) return stored\n  } catch (err) {\n    // Logging matters: prior silent catches masked real issues (e.g. DB\n    // unavailable) as \"no styles\" and routed admins toward config fallback\n    // when the real failure was infrastructure.\n    logger?.warn({ err }, 'resolveImageStyles: settings DB read failed — falling back')\n  }\n\n  // 2. Plugin config (from the `media()` factory call in lumi.config.ts).\n  try {\n    const { getMediaConfig } = await import('./plugin.js')\n    return getMediaConfig().imageStyles\n  } catch {\n    // Plugin not initialized (e.g. unit tests that don't call media()) —\n    // fall through to hardcoded defaults. No log: this is a valid mode.\n  }\n\n  // 3. Hardcoded baseline — a single thumbnail style so uploads don't fail\n  //    in a toolkit that never registered the plugin.\n  return HARDCODED_DEFAULTS\n}\n"],"mappings":"AAoBA,MAAM,EAAiD,CACrD,UAAW,CAAE,MAAO,IAAK,OAAQ,IAAK,IAAK,QAAS,OAAQ,OAAQ,QAAS,EAAG,CAClF,EAEA,eAAsB,EACpB,EACA,EACqC,CAKrC,GAAI,CACF,GAAM,CAAE,wBAAyB,MAAM,OAAO,yBACxC,CAAE,uBAAwB,MAAM,OAAO,wCAEvC,EAAS,MADQ,EAAqB,EAAqB,CAAE,KAAI,CACrC,CAAC,CAAC,IAAI,aAAa,EACrD,GAAI,GAAU,OAAO,KAAK,CAAM,CAAC,CAAC,OAAS,EAAG,OAAO,CACvD,OAAS,EAAK,CAIZ,GAAQ,KAAK,CAAE,KAAI,EAAG,4DAA4D,CACpF,CAGA,GAAI,CACF,GAAM,CAAE,kBAAmB,MAAM,OAAO,yBACxC,OAAO,EAAe,CAAC,CAAC,WAC1B,MAAQ,CAGR,CAIA,OAAO,CACT"}
+{"version":3,"file":"resolve-image-styles-DlHP19gI.mjs","names":[],"sources":["../src/resolve-image-styles.ts"],"sourcesContent":["/**\n * Image style resolution waterfall — single source of truth for the\n * \"which styles should we use?\" question.\n *\n * Priority: settings DB (user-configured) → plugin config (from `media()`\n * factory call) → hardcoded defaults (thumbnail only).\n *\n * This replaces three near-duplicate blocks (MediaClient's private\n * resolveImageStyles + two admin-route branches) that had drifted — the\n * routes didn't treat an empty stored object as \"fall back to config\"\n * while MediaClient did. Consolidating here keeps the behavior consistent\n * and logs the DB read failure so operators can diagnose issues instead\n * of silently getting defaults.\n *\n * Not cached. MediaClient wraps this with its own per-instance cache.\n */\n\nimport type { Logger, ToolkitApp } from '@murumets-ee/core'\nimport type { ImageStyle } from './types.js'\n\nconst HARDCODED_DEFAULTS: Record<string, ImageStyle> = {\n  thumbnail: { width: 200, height: 200, fit: 'cover', format: 'webp', quality: 80 },\n}\n\nexport async function resolveImageStyles(\n  app: ToolkitApp,\n  logger?: Logger,\n): Promise<Record<string, ImageStyle>> {\n  // 1. Settings DB (source of truth once the admin UI has saved anything).\n  //    An empty record counts as \"nothing configured\" — fall through. This\n  //    matches the pre-extraction behavior of MediaClient and fixes the\n  //    routes' prior behavior of showing an empty UI in that case.\n  try {\n    const { createSettingsClient } = await import('@murumets-ee/settings')\n    const { imageStylesSettings } = await import('./image-styles-settings.js')\n    const settingsClient = createSettingsClient(imageStylesSettings, { app })\n    const stored = await settingsClient.get('imageStyles')\n    if (stored && Object.keys(stored).length > 0) return stored\n  } catch (err) {\n    // Logging matters: prior silent catches masked real issues (e.g. DB\n    // unavailable) as \"no styles\" and routed admins toward config fallback\n    // when the real failure was infrastructure.\n    logger?.warn({ err }, 'resolveImageStyles: settings DB read failed — falling back')\n  }\n\n  // 2. Plugin config (from the `media()` factory call in lumi.config.ts).\n  try {\n    const { getMediaConfig } = await import('./plugin.js')\n    return getMediaConfig().imageStyles\n  } catch {\n    // Plugin not initialized (e.g. unit tests that don't call media()) —\n    // fall through to hardcoded defaults. No log: this is a valid mode.\n  }\n\n  // 3. Hardcoded baseline — a single thumbnail style so uploads don't fail\n  //    in a toolkit that never registered the plugin.\n  return HARDCODED_DEFAULTS\n}\n"],"mappings":"AAoBA,MAAM,EAAiD,CACrD,UAAW,CAAE,MAAO,IAAK,OAAQ,IAAK,IAAK,QAAS,OAAQ,OAAQ,QAAS,EAAG,CAClF,EAEA,eAAsB,EACpB,EACA,EACqC,CAKrC,GAAI,CACF,GAAM,CAAE,wBAAyB,MAAM,OAAO,yBACxC,CAAE,uBAAwB,MAAM,OAAO,wCAEvC,EAAS,MADQ,EAAqB,EAAqB,CAAE,KAAI,CACrC,CAAC,CAAC,IAAI,aAAa,EACrD,GAAI,GAAU,OAAO,KAAK,CAAM,CAAC,CAAC,OAAS,EAAG,OAAO,CACvD,OAAS,EAAK,CAIZ,GAAQ,KAAK,CAAE,KAAI,EAAG,4DAA4D,CACpF,CAGA,GAAI,CACF,GAAM,CAAE,kBAAmB,MAAM,OAAO,yBACxC,OAAO,EAAe,CAAC,CAAC,WAC1B,MAAQ,CAGR,CAIA,OAAO,CACT"}

package/dist/routes-B38Mz1FZ.mjs

@@ -0,0 +1,2 @@
+import{combineAdminRoutes as e,defineAdminRoute as t,safeAudit as n}from"@murumets-ee/core";const r=/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;function i(e){return e!==void 0&&r.test(e)}const a=[`image`,`video`,`audio`,`document`,`other`];function o(e){return a.includes(e)}function s(e,t){if(e===null||!/^\d+$/.test(e))return t;let n=Number(e);return Number.isSafeInteger(n)?n:t}function c(e,t=200){return new Response(JSON.stringify(e),{status:t,headers:{"Content-Type":`application/json`}})}function l(e,t){return c({error:e},t)}const u={clientPromise:null};async function d(){if(!u.clientPromise){let e=(async()=>{let{getApp:e}=await import(`@murumets-ee/core`),{createStorageClient:t}=await import(`@murumets-ee/storage`),{getStorageConfig:n}=await import(`@murumets-ee/storage/plugin`),r=e();return t(n(),{app:r})})();e.catch(()=>{u.clientPromise===e&&(u.clientPromise=null)}),u.clientPromise=e}return u.clientPromise}async function f(){let{createAdminClient:e}=await import(`@murumets-ee/core/clients`),{MediaClient:t}=await import(`./client-CplTUsk3.mjs`),{Media:n}=await import(`./entity-Caba_NFw.mjs`),r=await d();return new t({admin:e(n),storage:r})}const p=async(e,t)=>{let{isStorageConfigured:n,getStorageConfigReason:r}=await import(`@murumets-ee/storage`),a=t.segments;if(a.length===2&&a[1]===`usage`){let e=a[0];if(!i(e))return l(`Invalid media ID format`,400);let{findMediaUsages:t}=await import(`./usage-CVAqkS6h.mjs`),{getApp:n}=await import(`@murumets-ee/core`);return c({usages:await t(e,n())})}if(a.length>=2)return l(`Not found`,404);let u=a.length>0?a[0]:void 0;if(u!==void 0&&!i(u))return l(`Invalid media ID format`,400);if(!n()){let e=r()??`Storage not configured`;return a.length>0?c({error:e,configured:!1,reason:e},503):c({items:[],total:0,configured:!1,reason:e})}let d=await f();if(u!==void 0){let e=await d.findById(u);if(!e)return l(`Media not found`,404);let t=await d.getUrl(u);return c({...e,url:t})}let p=new URL(e.url),m=p.searchParams.get(`search`)??void 0,h=p.searchParams.get(`mediaType`),g=h!==null&&o(h)?h:void 0,_=Math.min(Math.max(s(p.searchParams.get(`limit`),24),1),100),v=Math.min(s(p.searchParams.get(`offset`),0),1e5),y=await d.findMany({...m!==void 0&&{search:m},...g!==void 0&&{mediaType:g},limit:_,offset:v}),b=y.items.map(e=>e.id),x=y.items.filter(e=>e.mediaType===`image`).map(e=>e.id),[S,C]=await Promise.all([d.getUrls(b),d.getVariantUrls(x,`thumbnail`)]);return c({items:y.items.map(e=>{let t=e.mediaType===`image`?C.get(e.id):void 0;return{id:e.id,title:e.title??null,alt:e.alt??null,filename:e.filename,mimeType:e.mimeType,size:e.size,mediaType:e.mediaType,url:S.get(e.id)??``,...t!==void 0&&{thumbnailUrl:t},width:e.width??null,height:e.height??null}}),total:y.total})},m=async(e,t)=>{let{isStorageConfigured:r,getStorageConfigReason:i,detectMimeType:a}=await import(`@murumets-ee/storage`);if(t.segments.length>0)return l(`Not found`,404);if(!r())return l(i()??`Storage not configured`,503);let o=await f(),s=await e.formData(),u=s.get(`file`);if(!(u instanceof File)||u.size===0)return l(`No file provided`,400);if(u.size>50*1024*1024)return l(`File too large: ${(u.size/1024/1024).toFixed(1)} MB exceeds 50 MB limit`,400);let d=Buffer.from(await u.arrayBuffer()),{mimeType:p,mismatch:m}=await a(d,u.type||`application/octet-stream`);if(m)return l(`File content doesn't match declared type: claimed ${u.type}, detected ${p}`,400);let h=s.get(`visibility`);if(h!==null&&h!==`public`&&h!==`private`)return l(`Field 'visibility' must be 'public' or 'private'`,400);let g=await o.upload(d,{filename:u.name,mimeType:p,size:u.size,uploadedBy:t.user.id,...h!==null&&{visibility:h}}),_={id:g.media.id,title:g.media.title??null,alt:g.media.alt??null,filename:g.media.filename,mimeType:g.media.mimeType,size:g.media.size,mediaType:g.media.mediaType,url:g.url,width:g.media.width??null,height:g.media.height??null};return n(t,{action:`media.upload`,entityType:`media`,entityId:g.media.id,userId:t.user.id,...t.user.name!==void 0&&{userName:t.user.name},changes:{filename:g.media.filename,mimeType:g.media.mimeType,size:g.media.size,mediaType:g.media.mediaType}}),c(_,201)},h=async(e,t)=>{let{isStorageConfigured:r,getStorageConfigReason:i}=await import(`@murumets-ee/storage`);if(t.segments.length!==1)return l(`Not found`,404);if(!r())return l(i()??`Storage not configured`,503);let{regenerateAllVariants:a}=await import(`./regenerate-variants-BysyeIoA.mjs`),{getApp:o,getContext:s}=await import(`@murumets-ee/core`),{resolveImageStyles:u}=await import(`./resolve-image-styles-DlHP19gI.mjs`),{createStorageClient:d}=await import(`@murumets-ee/storage`),{getStorageConfig:f}=await import(`@murumets-ee/storage/plugin`),p=o(),m=await u(p,p.logger);if(!m||Object.keys(m).length===0)return l(`No image styles configured`,400);let h=await a({app:p,storage:d(f(),{app:p}),logger:p.logger.child({media:!0}),styles:m,contextResolver:()=>{let e=s();if(!(!e?.user||!e?.checker))return{user:e.user,checker:e.checker,...e.scope!==void 0&&{scope:e.scope}}}});return n(t,{action:`media.regenerate_variants`,userId:t.user.id,...t.user.name!==void 0&&{userName:t.user.name},metadata:{total:h.total,processed:h.processed,errors:h.errors}}),c(h)},g=async(e,t)=>{let r=t.segments;if(r.length===0)return l(`Media ID required`,400);if(r.length>1)return l(`Not found`,404);let a=r[0];if(!i(a))return l(`Invalid media ID format`,400);let{isStorageConfigured:o,getStorageConfigReason:s}=await import(`@murumets-ee/storage`);return o()?(await(await f()).delete(a),n(t,{action:`media.delete`,entityType:`media`,entityId:a,userId:t.user.id,...t.user.name!==void 0&&{userName:t.user.name}}),c({deleted:1})):l(s()??`Storage not configured`,503)},_=[`admin`,`editor`,`agent`,`viewer`],v=[`admin`,`editor`];function y(){return e([t({prefix:`media`,path:``,method:`GET`,permission:`media:view`,defaultRoles:_,matchAnyPath:!0,description:`Read media — list, single item, or referencing-entity usage report.`,handler:p}),t({prefix:`media`,path:``,method:`POST`,permission:`media:create`,defaultRoles:v,description:"Upload a media file (multipart FormData with `file` field).",handler:m}),t({prefix:`media`,path:`regenerate-variants`,method:`POST`,permission:`media:create`,defaultRoles:v,description:`Regenerate every image-style variant for every media row.`,handler:h}),t({prefix:`media`,path:``,method:`DELETE`,permission:`media:delete`,defaultRoles:v,matchAnyPath:!0,description:`Delete a media record + its storage object.`,handler:g})])}export{y as t};
+//# sourceMappingURL=routes-B38Mz1FZ.mjs.map

package/dist/routes-B38Mz1FZ.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"routes-B38Mz1FZ.mjs","names":[],"sources":["../src/admin/routes.ts"],"sourcesContent":["/**\n * Media admin routes — one static `defineAdminRoute` per HTTP method.\n *\n * **URL surface served by this module:**\n *\n *   - GET    /api/admin/media                       — list with search/filter + URLs\n *   - GET    /api/admin/media/<id>                  — single record with URL\n *   - GET    /api/admin/media/<id>/usage            — entities referencing this media\n *   - POST   /api/admin/media                       — upload (multipart FormData)\n *   - POST   /api/admin/media/regenerate-variants   — bulk variant regeneration\n *   - DELETE /api/admin/media/<id>                  — delete + storage cleanup\n *\n * Standard entity CRUD (PATCH with translations) falls through to the\n * generic entity handler — add `Media` to `entities` in your handler config.\n *\n * **Why per-method `defineAdminRoute`** (vs. the previous top-level\n * `resource: 'media'` + auto-mapped permission):\n *\n *   - The wrapper (`guardedHandler` from `@murumets-ee/core`) owns the\n *     permission gate, `permission.denied` audit, and 403 body shape\n *     uniformly with every other migrated plugin. The previous shape\n *     relied on `METHOD_TO_ACTION` auto-mapping at the api-handler\n *     dispatch level which couldn't emit per-route audit metadata.\n *   - Inline `if (!checkPermission('media', 'create')) ...` defenses\n *     at the regenerate-variants / upload / delete branches are now\n *     redundant — the wrapper enforces the permission BEFORE the\n *     handler runs.\n *\n * **`matchAnyPath` rationale:** media's URL surface predates the\n * static-second-segment convention every other plugin follows\n * (`/taxonomy/<vocab>/<id>`, `/settings/<namespace>/<rest>`). The\n * second segment under `/media` is the media id itself — a runtime\n * UUID — which the dispatcher's literal `segments[0]` match would\n * miss for every request. The catch-all flag declares \"this entry\n * claims every (prefix, method) sub-path no other entry matched\" so\n * the existing URL contract works under the per-method dispatch\n * model. Static POST sub-paths (`regenerate-variants`) take\n * precedence over the catch-all entry on POST. See\n * `DefineAdminRouteSpec.matchAnyPath` in `@murumets-ee/core` for the\n * full contract.\n *\n * **Default roles:** broad for view (`['admin', 'editor', 'agent',\n * 'viewer']`), narrower for writes (`['admin', 'editor']`).\n * Conservative starting point — apps can grant more via the\n * Permissions UI.\n *\n * @example\n * ```typescript\n * import { createAdminApiHandler } from '@murumets-ee/admin-ui/server'\n * import { mediaRoutes } from '@murumets-ee/media/admin'\n * import { Media } from '@murumets-ee/media'\n *\n * const handler = createAdminApiHandler({\n *   authenticate: async (req) => { ... },\n *   entities: [Article, Media],\n *   routes: [...mediaRoutes()],\n * })\n * ```\n */\n\nimport {\n  type AdminRoute,\n  type AdminRouteHandler,\n  combineAdminRoutes,\n  defineAdminRoute,\n  safeAudit,\n} from '@murumets-ee/core'\nimport type { MediaClient } from '../client.js'\nimport type { MediaPickerItem, MediaPickerListResult } from '../picker/types.js'\n\n// ---------------------------------------------------------------------------\n// Validation\n// ---------------------------------------------------------------------------\n\nconst UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i\n\nfunction isValidUuid(value: string | undefined): value is string {\n  return value !== undefined && UUID_RE.test(value)\n}\n\n/**\n * Closed enum of allowed `mediaType` filter values, in lockstep with the\n * `mediaType` field on the Media entity. The list MUST match\n * `MediaListOptions.mediaType` (declared in `../types.js`) — TypeScript\n * doesn't link the two automatically, so the small drift risk is\n * accepted in exchange for not pulling a runtime dep on the entity\n * schema package just to read its enum.\n *\n * Used as both the runtime allowlist (`isAllowedMediaType`) and the\n * source of truth for the narrowed type the guard produces — keeping\n * `as` casts off the handler's hot path.\n */\nconst ALLOWED_MEDIA_TYPES = ['image', 'video', 'audio', 'document', 'other'] as const\ntype AllowedMediaType = (typeof ALLOWED_MEDIA_TYPES)[number]\n\nfunction isAllowedMediaType(value: string): value is AllowedMediaType {\n  // Cast to readonly string[] so the typed-tuple `includes` check works\n  // with an arbitrary string input — `Array.prototype.includes`'s\n  // signature on a typed tuple only accepts members of the tuple\n  // (TS 4.9+ literal-narrowing), which is exactly what we want to\n  // sidestep here.\n  return (ALLOWED_MEDIA_TYPES as readonly string[]).includes(value)\n}\n\n/**\n * Hard cap on the `offset` query param. The dispatcher's allowed-pages\n * model is `limit ∈ [1, 100]`; even with the max page size that's\n * 1000 pages before hitting MAX_OFFSET, which is well beyond any\n * realistic admin-UI scroll depth. Forces slow-discard offset attacks\n * (`?offset=999999999`) to revert to a sane upper bound. Cursor-based\n * pagination would let this go higher, but the media list is\n * offset-based by convention with the entity-list shell.\n */\nconst MAX_OFFSET = 100_000\n\n/**\n * Strict non-negative integer parser for query params.\n *\n * `Number(raw)` silently coerces blanks (`'' → 0`), hex (`'0x05' → 5`),\n * exponent notation (`'1e2' → 100`), and signed (`'+5'/'-5'`) values —\n * all of which pass a downstream `Number.isInteger(n) && n >= 0` check.\n * Pre-filtering with `/^\\d+$/` keeps the contract honest: \"if you don't\n * send a pure non-negative integer string, you get the default.\" Same\n * pattern as `packages/taxonomy/src/admin/routes.ts:handleGet` tree\n * branch from PR-C-taxonomy.\n */\nfunction parseUintParam(raw: string | null, fallback: number): number {\n  if (raw === null || !/^\\d+$/.test(raw)) return fallback\n  const parsed = Number(raw)\n  // The regex above stops hex / exponent / signed / whitespace / blank\n  // inputs, but a long digit-only string still slips past — `Number(...)`\n  // returns `Infinity` past ~309 digits, and precision is lost past\n  // 2^53. Both would propagate through `client.findMany`'s\n  // `offset: parsed` into a Postgres query that either crashes the\n  // driver (`Infinity` is not a valid bigint) or silently rounds (the\n  // 2^53 precision-loss boundary). Reject via `Number.isSafeInteger`\n  // so overflowing inputs revert to `fallback` like every other\n  // malformed value.\n  if (!Number.isSafeInteger(parsed)) return fallback\n  return parsed\n}\n\n// ---------------------------------------------------------------------------\n// Response helpers\n// ---------------------------------------------------------------------------\n\nfunction jsonResponse(data: unknown, status = 200): Response {\n  return new Response(JSON.stringify(data), {\n    status,\n    headers: { 'Content-Type': 'application/json' },\n  })\n}\n\nfunction jsonError(message: string, status: number): Response {\n  return jsonResponse({ error: message }, status)\n}\n\n// ---------------------------------------------------------------------------\n// Per-request MediaClient factory + cached storage client\n// ---------------------------------------------------------------------------\n//\n// MediaClient and its AdminClient MUST be built per-request — AdminClient's\n// context resolver is captured eagerly at construction (see\n// buildContextResolver in @murumets-ee/core/clients). A module-level singleton\n// would bake the first request's user + tenant scope into every subsequent\n// request's writes — a cross-request permission/scope leak.\n//\n// Storage config is process-global and safe to cache once.\n\ntype StorageClient = Awaited<ReturnType<typeof import('@murumets-ee/storage').createStorageClient>>\n\ninterface StorageState {\n  clientPromise: Promise<StorageClient> | null\n}\n\n// Module-level state. `null` once eviction fires on a rejection so the next\n// request gets a fresh resolution attempt (see `getStorage`'s `.catch`).\nconst storageState: StorageState = { clientPromise: null }\n\n/**\n * Resolve the process-wide storage client. The pending-promise slot is\n * cleared on rejection so a transient `createStorageClient` failure\n * (DB hiccup, misconfig) doesn't poison every subsequent media request\n * for the lifetime of the Node process. Same pattern as\n * `packages/taxonomy/src/admin/routes.ts:getClient` from PR-C-taxonomy.\n */\nasync function getStorage(): Promise<StorageClient> {\n  if (!storageState.clientPromise) {\n    const pending = (async () => {\n      const { getApp } = await import('@murumets-ee/core')\n      const { createStorageClient } = await import('@murumets-ee/storage')\n      const { getStorageConfig } = await import('@murumets-ee/storage/plugin')\n      const app = getApp()\n      return createStorageClient(getStorageConfig(), { app })\n    })()\n    // Clear the slot on rejection so a transient failure doesn't poison\n    // every subsequent request. `pending.catch(handler)` attaches a\n    // synchronous rejection listener that resets the cached slot — the\n    // handler returns `undefined`, NOT a re-throw — so the new\n    // `.catch`-returned promise resolves, but we never await or hold\n    // that promise. The ORIGINAL `pending` (stored in\n    // `storageState.clientPromise`) is what callers `await`, and it's\n    // still in its rejected state — so the caller observing this\n    // resolution sees the underlying error. The `.catch` also marks\n    // the rejection as \"handled\" for Node's unhandled-rejection\n    // tracker. `storageState.clientPromise` holds the original `pending`\n    // so concurrent in-flight callers share one resolution.\n    pending.catch(() => {\n      if (storageState.clientPromise === pending) storageState.clientPromise = null\n    })\n    storageState.clientPromise = pending\n  }\n  return storageState.clientPromise\n}\n\nasync function getMediaClient(): Promise<MediaClient> {\n  const { createAdminClient } = await import('@murumets-ee/core/clients')\n  const { MediaClient } = await import('../client.js')\n  const { Media } = await import('../entity.js')\n  const storage = await getStorage()\n  const admin = createAdminClient(Media)\n  return new MediaClient({ admin, storage })\n}\n\n// ---------------------------------------------------------------------------\n// Handlers\n// ---------------------------------------------------------------------------\n\nconst handleGet: AdminRouteHandler = async (req, ctx) => {\n  const { isStorageConfigured, getStorageConfigReason } = await import('@murumets-ee/storage')\n  const segments = ctx.segments\n\n  // GET /media/<id>/usage — DB-only lookup, safe even when storage is\n  // unconfigured. Validate the UUID first so a malformed id 400s\n  // uniformly with the storage-configured branch below.\n  if (segments.length === 2 && segments[1] === 'usage') {\n    const id = segments[0]\n    if (!isValidUuid(id)) return jsonError('Invalid media ID format', 400)\n\n    const { findMediaUsages } = await import('../usage.js')\n    const { getApp } = await import('@murumets-ee/core')\n    const app = getApp()\n    const usages = await findMediaUsages(id, app)\n    return jsonResponse({ usages })\n  }\n\n  // Reject unknown sub-paths explicitly. The wrapper-gate has already\n  // passed (caller has `media:view`); a handler-level 404 here matches\n  // the dispatcher's miss-shape so unknown URLs don't fall through to\n  // the single-id branch and 400/500 with a misleading reason. The\n  // only valid 2-segment URL is `<id>/usage`, which was already\n  // claimed by the early-return above — anything else with >=2\n  // segments is not a recognized media route.\n  if (segments.length >= 2) return jsonError('Not found', 404)\n\n  // GET /media/<id> — validate UUID up front so a bad request still\n  // 400s when storage happens to be unconfigured (matches DELETE).\n  const singleId = segments.length > 0 ? segments[0] : undefined\n  if (singleId !== undefined && !isValidUuid(singleId)) {\n    return jsonError('Invalid media ID format', 400)\n  }\n\n  // Everything below needs a working storage client. If env isn't\n  // wired, return a structured \"disabled\" response rather than 500 —\n  // the media list page renders a banner and new admins can finish\n  // onboarding without being blocked on a crash loop.\n  if (!isStorageConfigured()) {\n    const reason = getStorageConfigReason() ?? 'Storage not configured'\n    if (segments.length > 0) {\n      // Single item — treat as not-found-ish to avoid leaking\n      // existence; include reason so the UI can surface it.\n      return jsonResponse({ error: reason, configured: false, reason }, 503)\n    }\n    // GET /media — empty list + disabled flag for the picker's banner.\n    const response: MediaPickerListResult & { configured: false; reason: string } = {\n      items: [],\n      total: 0,\n      configured: false,\n      reason,\n    }\n    return jsonResponse(response)\n  }\n\n  const client = await getMediaClient()\n\n  // GET /media/<id> — single item with URL (full record for EntityForm + picker)\n  if (singleId !== undefined) {\n    const record = await client.findById(singleId)\n    if (!record) return jsonError('Media not found', 404)\n\n    const url = await client.getUrl(singleId)\n    return jsonResponse({ ...record, url })\n  }\n\n  // GET /media — list with search/filter + batch URL resolution\n  const url = new URL(req.url)\n  const search = url.searchParams.get('search') ?? undefined\n  // mediaType MUST be validated against the entity's closed enum before\n  // it reaches `client.findMany` — the previous shape force-cast the raw\n  // query value with `as 'image' | ...` which is a type-system lie. A\n  // bogus value like `?mediaType=bogus` would parameterize into\n  // `WHERE media_type = 'bogus'` (no SQL injection — Drizzle is\n  // parameterized — but the row count is silently zero, which is\n  // confusing). Empty string from `?mediaType=` is also passed-through\n  // by the prior `?? undefined` shape since empty string is not null.\n  // Allowlist + type guard drops bogus / empty values cleanly so the\n  // filter is omitted instead of applied with a no-match value.\n  const rawMediaType = url.searchParams.get('mediaType')\n  const mediaType =\n    rawMediaType !== null && isAllowedMediaType(rawMediaType) ? rawMediaType : undefined\n  // Strict parsing keeps the contract honest — see `parseUintParam`\n  // JSDoc. Cap limit to [1, 100] and offset to [0, MAX_OFFSET] so a\n  // request can't ask for an unboundedly large page nor force a\n  // slow-discard scan with `?offset=99999999`.\n  const limit = Math.min(Math.max(parseUintParam(url.searchParams.get('limit'), 24), 1), 100)\n  const offset = Math.min(parseUintParam(url.searchParams.get('offset'), 0), MAX_OFFSET)\n\n  const result = await client.findMany({\n    ...(search !== undefined && { search }),\n    ...(mediaType !== undefined && { mediaType }),\n    limit,\n    offset,\n  })\n\n  // Resolve original URLs for all items, but thumbnail variants ONLY for\n  // images — a video/audio/document/other id will never have a `thumbnail`\n  // variant, so asking `getVariantUrls` to resolve one is pure waste (a\n  // storage lookup that falls through to the original, then gets discarded\n  // below anyway). `media-list-page.tsx` filters the same way.\n  const ids = result.items.map((item) => item.id)\n  const imageIds = result.items.filter((item) => item.mediaType === 'image').map((item) => item.id)\n  const [urlMap, thumbMap] = await Promise.all([\n    client.getUrls(ids),\n    client.getVariantUrls(imageIds, 'thumbnail'),\n  ])\n\n  const items: (MediaPickerItem & { thumbnailUrl?: string })[] = result.items.map((item) => {\n    // F115: `getVariantUrls` falls back to the ORIGINAL asset URL for any id\n    // with no `thumbnail` variant — correct for an image that just hasn't\n    // been processed yet, wrong for a video/audio/document/other row, which\n    // will never have one. Gating on `mediaType` keeps `thumbnailUrl` ABSENT\n    // rather than pointing a consumer's `<img src>` at a `.mp4`.\n    const thumbnailUrl = item.mediaType === 'image' ? thumbMap.get(item.id) : undefined\n    return {\n      id: item.id,\n      title: item.title ?? null,\n      alt: item.alt ?? null,\n      filename: item.filename,\n      mimeType: item.mimeType,\n      size: item.size,\n      mediaType: item.mediaType,\n      url: urlMap.get(item.id) ?? '',\n      ...(thumbnailUrl !== undefined && { thumbnailUrl }),\n      width: item.width ?? null,\n      height: item.height ?? null,\n    }\n  })\n\n  const response: MediaPickerListResult = { items, total: result.total }\n  return jsonResponse(response)\n}\n\nconst handleUpload: AdminRouteHandler = async (req, ctx) => {\n  const { isStorageConfigured, getStorageConfigReason, detectMimeType } = await import(\n    '@murumets-ee/storage'\n  )\n\n  // Upload is registered at `path: ''` (NOT matchAnyPath) — the\n  // dispatcher only invokes this handler when segments=[]. The api-\n  // handler ALSO rejects empty/whitespace-only first segments with a\n  // 400 before any plugin dispatcher runs (see\n  // `packages/admin-ui/src/server/api-handler/index.ts` segment-\n  // validation block). So this guard is defense-in-depth — per HANDOFF\n  // §\"Defense-in-depth `&& segments[i]` guards are fine\" — protecting\n  // against a future framework invariant change that lets a non-empty\n  // segment reach a `path: ''` static entry.\n  if (ctx.segments.length > 0) return jsonError('Not found', 404)\n\n  if (!isStorageConfigured()) {\n    return jsonError(getStorageConfigReason() ?? 'Storage not configured', 503)\n  }\n\n  const client = await getMediaClient()\n\n  const formData = await req.formData()\n  const file = formData.get('file')\n  // FormData `get` returns string | File | null. Reject anything that\n  // isn't a File so the typed `file.size`/`file.arrayBuffer()` below\n  // is safe without a runtime cast.\n  if (!(file instanceof File) || file.size === 0) {\n    return jsonError('No file provided', 400)\n  }\n\n  // Guard against oversized uploads (50 MB limit). Hardcoded rather\n  // than read from getMediaConfig() to keep this handler independent\n  // of plugin-init order — the plugin's resolved config may not be\n  // populated yet under CLI / non-RSC startup paths.\n  const MAX_UPLOAD_SIZE = 50 * 1024 * 1024\n  if (file.size > MAX_UPLOAD_SIZE) {\n    return jsonError(\n      `File too large: ${(file.size / 1024 / 1024).toFixed(1)} MB exceeds 50 MB limit`,\n      400,\n    )\n  }\n\n  const buffer = Buffer.from(await file.arrayBuffer())\n\n  // Detect actual MIME type from file content (prevents spoofing).\n  const { mimeType, mismatch } = await detectMimeType(\n    buffer,\n    file.type || 'application/octet-stream',\n  )\n  if (mismatch) {\n    return jsonError(\n      `File content doesn't match declared type: claimed ${file.type}, detected ${mimeType}`,\n      400,\n    )\n  }\n\n  // Per-upload visibility, DEFAULTING TO PRIVATE — the caller opts in.\n  //\n  // This route serves two populations with opposite needs. The media picker\n  // uploads publishable web assets: a page's hero image MUST be public or the\n  // public site resolves it to `null` and renders no images at all, with a 200\n  // on every page and one warn log (F030). `packages/rent-ui`'s inspection\n  // wizard posts to this SAME route with handover and return photos — vehicle\n  // and apartment condition shots, plates, interiors, occasionally documents —\n  // which must stay behind time-limited signed urls.\n  //\n  // Deny-by-default decides the direction, and the asymmetry is the argument:\n  // forget the opt-in and an image is invisible, which is annoying, visible and\n  // fixable; default to public and forget an opt-out and those photos become\n  // permanently world-readable. A missed opt-in cannot leak. So the default is\n  // unchanged (`private` via StorageClient's own fallback) and rent's caller is\n  // untouched — it sends nothing and behaves exactly as before.\n  const visibilityRaw = formData.get('visibility')\n  if (visibilityRaw !== null && visibilityRaw !== 'public' && visibilityRaw !== 'private') {\n    return jsonError(\"Field 'visibility' must be 'public' or 'private'\", 400)\n  }\n  const result = await client.upload(buffer, {\n    filename: file.name,\n    mimeType,\n    size: file.size,\n    uploadedBy: ctx.user.id,\n    ...(visibilityRaw !== null && { visibility: visibilityRaw }),\n  })\n\n  const item: MediaPickerItem = {\n    id: result.media.id,\n    title: result.media.title ?? null,\n    alt: result.media.alt ?? null,\n    filename: result.media.filename,\n    mimeType: result.media.mimeType,\n    size: result.media.size,\n    mediaType: result.media.mediaType,\n    url: result.url,\n    width: result.media.width ?? null,\n    height: result.media.height ?? null,\n  }\n\n  safeAudit(ctx, {\n    action: 'media.upload',\n    entityType: 'media',\n    entityId: result.media.id,\n    userId: ctx.user.id,\n    ...(ctx.user.name !== undefined && { userName: ctx.user.name }),\n    changes: {\n      filename: result.media.filename,\n      mimeType: result.media.mimeType,\n      size: result.media.size,\n      mediaType: result.media.mediaType,\n    },\n  })\n\n  return jsonResponse(item, 201)\n}\n\nconst handleRegenerateVariants: AdminRouteHandler = async (_req, ctx) => {\n  const { isStorageConfigured, getStorageConfigReason } = await import('@murumets-ee/storage')\n\n  // Static POST path='regenerate-variants' — the dispatcher only invokes\n  // this handler when `segments[0] === 'regenerate-variants'`. Trailing\n  // segments (e.g. POST /media/regenerate-variants/extra) aren't a\n  // supported sub-route.\n  if (ctx.segments.length !== 1) return jsonError('Not found', 404)\n\n  if (!isStorageConfigured()) {\n    return jsonError(getStorageConfigReason() ?? 'Storage not configured', 503)\n  }\n\n  const { regenerateAllVariants } = await import('../regenerate-variants.js')\n  const { getApp, getContext } = await import('@murumets-ee/core')\n  const { resolveImageStyles } = await import('../resolve-image-styles.js')\n  const { createStorageClient } = await import('@murumets-ee/storage')\n  const { getStorageConfig } = await import('@murumets-ee/storage/plugin')\n\n  const app = getApp()\n  const styles = await resolveImageStyles(app, app.logger)\n  if (!styles || Object.keys(styles).length === 0) {\n    return jsonError('No image styles configured', 400)\n  }\n\n  const storageConfig = getStorageConfig()\n  const storage = createStorageClient(storageConfig, { app })\n\n  const result = await regenerateAllVariants({\n    app,\n    storage,\n    logger: app.logger.child({ media: true }),\n    styles,\n    contextResolver: () => {\n      const requestCtx = getContext()\n      if (!requestCtx?.user || !requestCtx?.checker) return undefined\n      return {\n        user: requestCtx.user,\n        checker: requestCtx.checker,\n        ...(requestCtx.scope !== undefined && { scope: requestCtx.scope }),\n      }\n    },\n  })\n\n  safeAudit(ctx, {\n    action: 'media.regenerate_variants',\n    userId: ctx.user.id,\n    ...(ctx.user.name !== undefined && { userName: ctx.user.name }),\n    metadata: { total: result.total, processed: result.processed, errors: result.errors },\n  })\n\n  return jsonResponse(result)\n}\n\nconst handleDelete: AdminRouteHandler = async (_req, ctx) => {\n  const segments = ctx.segments\n\n  // DELETE /media — no id supplied. Reject as 400, NOT 404, so a\n  // caller confusing \"no id\" with \"id not found\" gets a meaningful\n  // error. The wrapper-gate has already validated the caller has\n  // media:delete, so the 400 isn't an information-disclosure vector.\n  if (segments.length === 0) return jsonError('Media ID required', 400)\n\n  // Reject sub-paths beyond /<id> — DELETE /media/<id>/usage etc.\n  if (segments.length > 1) return jsonError('Not found', 404)\n\n  const id = segments[0]\n  if (!isValidUuid(id)) return jsonError('Invalid media ID format', 400)\n\n  const { isStorageConfigured, getStorageConfigReason } = await import('@murumets-ee/storage')\n  if (!isStorageConfigured()) {\n    // Can't safely delete — MediaClient needs storage to remove the\n    // actual object, and partial delete (DB row gone, object orphaned)\n    // would leak storage. Surface the reason so the UI can display it.\n    return jsonError(getStorageConfigReason() ?? 'Storage not configured', 503)\n  }\n\n  // AdminClient.delete() checks entity_refs and throws\n  // ReferencedEntityError if this media is still referenced. The\n  // error bubbles to the caller's error handler which returns 409\n  // with usage details.\n  const client = await getMediaClient()\n  await client.delete(id)\n\n  safeAudit(ctx, {\n    action: 'media.delete',\n    entityType: 'media',\n    entityId: id,\n    userId: ctx.user.id,\n    ...(ctx.user.name !== undefined && { userName: ctx.user.name }),\n  })\n\n  return jsonResponse({ deleted: 1 })\n}\n\n// ---------------------------------------------------------------------------\n// Route factory\n// ---------------------------------------------------------------------------\n\n/**\n * Default roles for view: broad reach across the admin shell.\n *\n * `BUILT_IN_ROLES` in `packages/auth/src/permissions.ts` is\n * `['admin', 'public', 'authenticated', 'agent', 'customer']` — `admin` is\n * hardcoded as an unconditional yes in `buildPermissionChecker`,\n * `agent` is the only non-admin built-in that flows through\n * `buildInitialRoleDefinitions()` + `upsertBuiltInRoles` with default\n * media access (`customer` seeds with zero permissions — see that\n * function's JSDoc). The `agent` entry in this list is what gives ops\n * agents read-only media access on first boot of a fresh install.\n *\n * `editor` and `viewer` are CONVENTIONAL app-defined roles —\n * apps that follow the scaffold pattern create them as part of\n * their own role catalog. Including them in `defaultRoles` doesn't\n * seed them (the seeder only iterates the built-ins above), but\n * the values DO flow into the process-local permission catalog\n * (see `registerPermission` in `@murumets-ee/core`), which the\n * forthcoming Permission Matrix UI (PR-D) reads to show \"this\n * route's recommended default grants\" against the app's actual\n * role set. The catalog is also the mechanism via which a future\n * upgrade of `upsertBuiltInRoles` could extend the seed surface\n * to app-defined roles without each plugin having to re-declare\n * its defaults.\n */\nconst VIEW_DEFAULT_ROLES = ['admin', 'editor', 'agent', 'viewer'] as const\n\n/** Default roles for create/delete — narrower than view. */\nconst WRITE_DEFAULT_ROLES = ['admin', 'editor'] as const\n\n/**\n * Build admin API routes for media management.\n *\n * Returns `AdminRoute[]` from `combineAdminRoutes` — one entry per\n * `(prefix, method)` after grouping. Callers spread the result into\n * their top-level routes list: `routes: [...mediaRoutes()]`.\n *\n * Four `defineAdminRoute` entries:\n *\n *   - GET    matchAnyPath with `media:view`   defaultRoles: VIEW_DEFAULT_ROLES\n *   - POST   path=''            `media:create` defaultRoles: WRITE_DEFAULT_ROLES\n *   - POST   path='regenerate-variants' `media:create` defaultRoles: WRITE_DEFAULT_ROLES\n *   - DELETE matchAnyPath with `media:delete` defaultRoles: WRITE_DEFAULT_ROLES\n *\n * Permissions are auto-registered by the entity catalog\n * (`buildResourceCatalog` in `@murumets-ee/auth`) AND by\n * `registerPermission` inside `defineAdminRoute`. Idempotent —\n * `registerPermission` unions `defaultRoles` on repeat registration,\n * so the framework's two pathways agree on the final grant set.\n *\n * Standard entity CRUD (PATCH with translations) is NOT registered\n * here — it falls through to the generic entity handler. Add `Media`\n * to the `entities` array in your handler config to enable it.\n */\nexport function mediaRoutes(): AdminRoute[] {\n  const entries = [\n    defineAdminRoute({\n      prefix: 'media',\n      path: '',\n      method: 'GET',\n      permission: 'media:view',\n      defaultRoles: VIEW_DEFAULT_ROLES,\n      matchAnyPath: true,\n      description: 'Read media — list, single item, or referencing-entity usage report.',\n      handler: handleGet,\n    }),\n    defineAdminRoute({\n      prefix: 'media',\n      path: '',\n      method: 'POST',\n      permission: 'media:create',\n      defaultRoles: WRITE_DEFAULT_ROLES,\n      description: 'Upload a media file (multipart FormData with `file` field).',\n      handler: handleUpload,\n    }),\n    defineAdminRoute({\n      prefix: 'media',\n      path: 'regenerate-variants',\n      method: 'POST',\n      permission: 'media:create',\n      defaultRoles: WRITE_DEFAULT_ROLES,\n      description: 'Regenerate every image-style variant for every media row.',\n      handler: handleRegenerateVariants,\n    }),\n    defineAdminRoute({\n      prefix: 'media',\n      path: '',\n      method: 'DELETE',\n      permission: 'media:delete',\n      defaultRoles: WRITE_DEFAULT_ROLES,\n      matchAnyPath: true,\n      description: 'Delete a media record + its storage object.',\n      handler: handleDelete,\n    }),\n  ]\n\n  return combineAdminRoutes(entries)\n}\n"],"mappings":"4FA0EA,MAAM,EAAU,kEAEhB,SAAS,EAAY,EAA4C,CAC/D,OAAO,IAAU,IAAA,IAAa,EAAQ,KAAK,CAAK,CAClD,CAcA,MAAM,EAAsB,CAAC,QAAS,QAAS,QAAS,WAAY,OAAO,EAG3E,SAAS,EAAmB,EAA0C,CAMpE,OAAQ,EAA0C,SAAS,CAAK,CAClE,CAwBA,SAAS,EAAe,EAAoB,EAA0B,CACpE,GAAI,IAAQ,MAAQ,CAAC,QAAQ,KAAK,CAAG,EAAG,OAAO,EAC/C,IAAM,EAAS,OAAO,CAAG,EAWzB,OADK,OAAO,cAAc,CAAM,EACzB,EADmC,CAE5C,CAMA,SAAS,EAAa,EAAe,EAAS,IAAe,CAC3D,OAAO,IAAI,SAAS,KAAK,UAAU,CAAI,EAAG,CACxC,SACA,QAAS,CAAE,eAAgB,kBAAmB,CAChD,CAAC,CACH,CAEA,SAAS,EAAU,EAAiB,EAA0B,CAC5D,OAAO,EAAa,CAAE,MAAO,CAAQ,EAAG,CAAM,CAChD,CAsBA,MAAM,EAA6B,CAAE,cAAe,IAAK,EASzD,eAAe,GAAqC,CAClD,GAAI,CAAC,EAAa,cAAe,CAC/B,IAAM,GAAW,SAAY,CAC3B,GAAM,CAAE,UAAW,MAAM,OAAO,qBAC1B,CAAE,uBAAwB,MAAM,OAAO,wBACvC,CAAE,oBAAqB,MAAM,OAAO,+BACpC,EAAM,EAAO,EACnB,OAAO,EAAoB,EAAiB,EAAG,CAAE,KAAI,CAAC,CACxD,EAAA,CAAG,EAaH,EAAQ,UAAY,CACd,EAAa,gBAAkB,IAAS,EAAa,cAAgB,KAC3E,CAAC,EACD,EAAa,cAAgB,CAC/B,CACA,OAAO,EAAa,aACtB,CAEA,eAAe,GAAuC,CACpD,GAAM,CAAE,qBAAsB,MAAM,OAAO,6BACrC,CAAE,eAAgB,MAAM,OAAO,yBAC/B,CAAE,SAAU,MAAM,OAAO,yBACzB,EAAU,MAAM,EAAW,EAEjC,OAAO,IAAI,EAAY,CAAE,MADX,EAAkB,CACH,EAAG,SAAQ,CAAC,CAC3C,CAMA,MAAM,EAA+B,MAAO,EAAK,IAAQ,CACvD,GAAM,CAAE,sBAAqB,0BAA2B,MAAM,OAAO,wBAC/D,EAAW,EAAI,SAKrB,GAAI,EAAS,SAAW,GAAK,EAAS,KAAO,QAAS,CACpD,IAAM,EAAK,EAAS,GACpB,GAAI,CAAC,EAAY,CAAE,EAAG,OAAO,EAAU,0BAA2B,GAAG,EAErE,GAAM,CAAE,mBAAoB,MAAM,OAAO,wBACnC,CAAE,UAAW,MAAM,OAAO,qBAGhC,OAAO,EAAa,CAAE,OAAA,MADD,EAAgB,EADzB,EAC+B,CAAC,CACf,CAAC,CAChC,CASA,GAAI,EAAS,QAAU,EAAG,OAAO,EAAU,YAAa,GAAG,EAI3D,IAAM,EAAW,EAAS,OAAS,EAAI,EAAS,GAAK,IAAA,GACrD,GAAI,IAAa,IAAA,IAAa,CAAC,EAAY,CAAQ,EACjD,OAAO,EAAU,0BAA2B,GAAG,EAOjD,GAAI,CAAC,EAAoB,EAAG,CAC1B,IAAM,EAAS,EAAuB,GAAK,yBAa3C,OAZI,EAAS,OAAS,EAGb,EAAa,CAAE,MAAO,EAAQ,WAAY,GAAO,QAAO,EAAG,GAAG,EAShE,EAAa,CALlB,MAAO,CAAC,EACR,MAAO,EACP,WAAY,GACZ,QAEyB,CAAC,CAC9B,CAEA,IAAM,EAAS,MAAM,EAAe,EAGpC,GAAI,IAAa,IAAA,GAAW,CAC1B,IAAM,EAAS,MAAM,EAAO,SAAS,CAAQ,EAC7C,GAAI,CAAC,EAAQ,OAAO,EAAU,kBAAmB,GAAG,EAEpD,IAAM,EAAM,MAAM,EAAO,OAAO,CAAQ,EACxC,OAAO,EAAa,CAAE,GAAG,EAAQ,KAAI,CAAC,CACxC,CAGA,IAAM,EAAM,IAAI,IAAI,EAAI,GAAG,EACrB,EAAS,EAAI,aAAa,IAAI,QAAQ,GAAK,IAAA,GAW3C,EAAe,EAAI,aAAa,IAAI,WAAW,EAC/C,EACJ,IAAiB,MAAQ,EAAmB,CAAY,EAAI,EAAe,IAAA,GAKvE,EAAQ,KAAK,IAAI,KAAK,IAAI,EAAe,EAAI,aAAa,IAAI,OAAO,EAAG,EAAE,EAAG,CAAC,EAAG,GAAG,EACpF,EAAS,KAAK,IAAI,EAAe,EAAI,aAAa,IAAI,QAAQ,EAAG,CAAC,EAAG,GAAU,EAE/E,EAAS,MAAM,EAAO,SAAS,CACnC,GAAI,IAAW,IAAA,IAAa,CAAE,QAAO,EACrC,GAAI,IAAc,IAAA,IAAa,CAAE,WAAU,EAC3C,QACA,QACF,CAAC,EAOK,EAAM,EAAO,MAAM,IAAK,GAAS,EAAK,EAAE,EACxC,EAAW,EAAO,MAAM,OAAQ,GAAS,EAAK,YAAc,OAAO,CAAC,CAAC,IAAK,GAAS,EAAK,EAAE,EAC1F,CAAC,EAAQ,GAAY,MAAM,QAAQ,IAAI,CAC3C,EAAO,QAAQ,CAAG,EAClB,EAAO,eAAe,EAAU,WAAW,CAC7C,CAAC,EAyBD,OAAO,EAAa,CADsB,MAtBqB,EAAO,MAAM,IAAK,GAAS,CAMxF,IAAM,EAAe,EAAK,YAAc,QAAU,EAAS,IAAI,EAAK,EAAE,EAAI,IAAA,GAC1E,MAAO,CACL,GAAI,EAAK,GACT,MAAO,EAAK,OAAS,KACrB,IAAK,EAAK,KAAO,KACjB,SAAU,EAAK,SACf,SAAU,EAAK,SACf,KAAM,EAAK,KACX,UAAW,EAAK,UAChB,IAAK,EAAO,IAAI,EAAK,EAAE,GAAK,GAC5B,GAAI,IAAiB,IAAA,IAAa,CAAE,cAAa,EACjD,MAAO,EAAK,OAAS,KACrB,OAAQ,EAAK,QAAU,IACzB,CACF,CAE8C,EAAG,MAAO,EAAO,KACpC,CAAC,CAC9B,EAEM,EAAkC,MAAO,EAAK,IAAQ,CAC1D,GAAM,CAAE,sBAAqB,yBAAwB,kBAAmB,MAAM,OAC5E,wBAYF,GAAI,EAAI,SAAS,OAAS,EAAG,OAAO,EAAU,YAAa,GAAG,EAE9D,GAAI,CAAC,EAAoB,EACvB,OAAO,EAAU,EAAuB,GAAK,yBAA0B,GAAG,EAG5E,IAAM,EAAS,MAAM,EAAe,EAE9B,EAAW,MAAM,EAAI,SAAS,EAC9B,EAAO,EAAS,IAAI,MAAM,EAIhC,GAAI,EAAE,aAAgB,OAAS,EAAK,OAAS,EAC3C,OAAO,EAAU,mBAAoB,GAAG,EAQ1C,GAAI,EAAK,KADe,GAAK,KAAO,KAElC,OAAO,EACL,oBAAoB,EAAK,KAAO,KAAO,KAAA,CAAM,QAAQ,CAAC,EAAE,yBACxD,GACF,EAGF,IAAM,EAAS,OAAO,KAAK,MAAM,EAAK,YAAY,CAAC,EAG7C,CAAE,WAAU,YAAa,MAAM,EACnC,EACA,EAAK,MAAQ,0BACf,EACA,GAAI,EACF,OAAO,EACL,qDAAqD,EAAK,KAAK,aAAa,IAC5E,GACF,EAmBF,IAAM,EAAgB,EAAS,IAAI,YAAY,EAC/C,GAAI,IAAkB,MAAQ,IAAkB,UAAY,IAAkB,UAC5E,OAAO,EAAU,mDAAoD,GAAG,EAE1E,IAAM,EAAS,MAAM,EAAO,OAAO,EAAQ,CACzC,SAAU,EAAK,KACf,WACA,KAAM,EAAK,KACX,WAAY,EAAI,KAAK,GACrB,GAAI,IAAkB,MAAQ,CAAE,WAAY,CAAc,CAC5D,CAAC,EAEK,EAAwB,CAC5B,GAAI,EAAO,MAAM,GACjB,MAAO,EAAO,MAAM,OAAS,KAC7B,IAAK,EAAO,MAAM,KAAO,KACzB,SAAU,EAAO,MAAM,SACvB,SAAU,EAAO,MAAM,SACvB,KAAM,EAAO,MAAM,KACnB,UAAW,EAAO,MAAM,UACxB,IAAK,EAAO,IACZ,MAAO,EAAO,MAAM,OAAS,KAC7B,OAAQ,EAAO,MAAM,QAAU,IACjC,EAgBA,OAdA,EAAU,EAAK,CACb,OAAQ,eACR,WAAY,QACZ,SAAU,EAAO,MAAM,GACvB,OAAQ,EAAI,KAAK,GACjB,GAAI,EAAI,KAAK,OAAS,IAAA,IAAa,CAAE,SAAU,EAAI,KAAK,IAAK,EAC7D,QAAS,CACP,SAAU,EAAO,MAAM,SACvB,SAAU,EAAO,MAAM,SACvB,KAAM,EAAO,MAAM,KACnB,UAAW,EAAO,MAAM,SAC1B,CACF,CAAC,EAEM,EAAa,EAAM,GAAG,CAC/B,EAEM,EAA8C,MAAO,EAAM,IAAQ,CACvE,GAAM,CAAE,sBAAqB,0BAA2B,MAAM,OAAO,wBAMrE,GAAI,EAAI,SAAS,SAAW,EAAG,OAAO,EAAU,YAAa,GAAG,EAEhE,GAAI,CAAC,EAAoB,EACvB,OAAO,EAAU,EAAuB,GAAK,yBAA0B,GAAG,EAG5E,GAAM,CAAE,yBAA0B,MAAM,OAAO,sCACzC,CAAE,SAAQ,cAAe,MAAM,OAAO,qBACtC,CAAE,sBAAuB,MAAM,OAAO,uCACtC,CAAE,uBAAwB,MAAM,OAAO,wBACvC,CAAE,oBAAqB,MAAM,OAAO,+BAEpC,EAAM,EAAO,EACb,EAAS,MAAM,EAAmB,EAAK,EAAI,MAAM,EACvD,GAAI,CAAC,GAAU,OAAO,KAAK,CAAM,CAAC,CAAC,SAAW,EAC5C,OAAO,EAAU,6BAA8B,GAAG,EAMpD,IAAM,EAAS,MAAM,EAAsB,CACzC,MACA,QAJc,EADM,EAC0B,EAAG,CAAE,KAAI,CAIjD,EACN,OAAQ,EAAI,OAAO,MAAM,CAAE,MAAO,EAAK,CAAC,EACxC,SACA,oBAAuB,CACrB,IAAM,EAAa,EAAW,EAC1B,MAAC,GAAY,MAAQ,CAAC,GAAY,SACtC,MAAO,CACL,KAAM,EAAW,KACjB,QAAS,EAAW,QACpB,GAAI,EAAW,QAAU,IAAA,IAAa,CAAE,MAAO,EAAW,KAAM,CAClE,CACF,CACF,CAAC,EASD,OAPA,EAAU,EAAK,CACb,OAAQ,4BACR,OAAQ,EAAI,KAAK,GACjB,GAAI,EAAI,KAAK,OAAS,IAAA,IAAa,CAAE,SAAU,EAAI,KAAK,IAAK,EAC7D,SAAU,CAAE,MAAO,EAAO,MAAO,UAAW,EAAO,UAAW,OAAQ,EAAO,MAAO,CACtF,CAAC,EAEM,EAAa,CAAM,CAC5B,EAEM,EAAkC,MAAO,EAAM,IAAQ,CAC3D,IAAM,EAAW,EAAI,SAMrB,GAAI,EAAS,SAAW,EAAG,OAAO,EAAU,oBAAqB,GAAG,EAGpE,GAAI,EAAS,OAAS,EAAG,OAAO,EAAU,YAAa,GAAG,EAE1D,IAAM,EAAK,EAAS,GACpB,GAAI,CAAC,EAAY,CAAE,EAAG,OAAO,EAAU,0BAA2B,GAAG,EAErE,GAAM,CAAE,sBAAqB,0BAA2B,MAAM,OAAO,wBAuBrE,OAtBK,EAAoB,GAYzB,MAAM,MADe,EAAe,EAAA,CACvB,OAAO,CAAE,EAEtB,EAAU,EAAK,CACb,OAAQ,eACR,WAAY,QACZ,SAAU,EACV,OAAQ,EAAI,KAAK,GACjB,GAAI,EAAI,KAAK,OAAS,IAAA,IAAa,CAAE,SAAU,EAAI,KAAK,IAAK,CAC/D,CAAC,EAEM,EAAa,CAAE,QAAS,CAAE,CAAC,GAlBzB,EAAU,EAAuB,GAAK,yBAA0B,GAAG,CAmB9E,EA+BM,EAAqB,CAAC,QAAS,SAAU,QAAS,QAAQ,EAG1D,EAAsB,CAAC,QAAS,QAAQ,EA0B9C,SAAgB,GAA4B,CA0C1C,OAAO,EAAmB,CAxCxB,EAAiB,CACf,OAAQ,QACR,KAAM,GACN,OAAQ,MACR,WAAY,aACZ,aAAc,EACd,aAAc,GACd,YAAa,sEACb,QAAS,CACX,CAAC,EACD,EAAiB,CACf,OAAQ,QACR,KAAM,GACN,OAAQ,OACR,WAAY,eACZ,aAAc,EACd,YAAa,8DACb,QAAS,CACX,CAAC,EACD,EAAiB,CACf,OAAQ,QACR,KAAM,sBACN,OAAQ,OACR,WAAY,eACZ,aAAc,EACd,YAAa,4DACb,QAAS,CACX,CAAC,EACD,EAAiB,CACf,OAAQ,QACR,KAAM,GACN,OAAQ,SACR,WAAY,eACZ,aAAc,EACd,aAAc,GACd,YAAa,8CACb,QAAS,CACX,CAAC,CAG6B,CAAC,CACnC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@murumets-ee/media",
-  "version": "0.65.0",
+  "version": "0.66.0",
   "license": "Elastic-2.0",
   "type": "module",
   "exports": {
@@ -65,13 +65,13 @@
     "sharp": "^0.34.5",
     "tailwind-merge": "^2.6.0",
     "zod": "^3.24.1",
-    "@murumets-ee/core": "0.65.0",
-    "@murumets-ee/db": "0.65.0",
-    "@murumets-ee/entity": "0.65.0",
-    "@murumets-ee/logging": "0.65.0",
-    "@murumets-ee/settings": "0.65.0",
-    "@murumets-ee/storage": "0.65.0",
-    "@murumets-ee/ui": "0.65.0"
+    "@murumets-ee/core": "0.66.0",
+    "@murumets-ee/db": "0.66.0",
+    "@murumets-ee/logging": "0.66.0",
+    "@murumets-ee/settings": "0.66.0",
+    "@murumets-ee/entity": "0.66.0",
+    "@murumets-ee/storage": "0.66.0",
+    "@murumets-ee/ui": "0.66.0"
   },
   "peerDependencies": {
     "lucide-react": ">=0.400.0 <1",

package/dist/routes-C_LZXK6k.mjs

@@ -1,2 +0,0 @@
-import{combineAdminRoutes as e,defineAdminRoute as t,safeAudit as n}from"@murumets-ee/core";const r=/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;function i(e){return e!==void 0&&r.test(e)}const a=[`image`,`video`,`audio`,`document`,`other`];function o(e){return a.includes(e)}function s(e,t){if(e===null||!/^\d+$/.test(e))return t;let n=Number(e);return Number.isSafeInteger(n)?n:t}function c(e,t=200){return new Response(JSON.stringify(e),{status:t,headers:{"Content-Type":`application/json`}})}function l(e,t){return c({error:e},t)}const u={clientPromise:null};async function d(){if(!u.clientPromise){let e=(async()=>{let{getApp:e}=await import(`@murumets-ee/core`),{createStorageClient:t}=await import(`@murumets-ee/storage`),{getStorageConfig:n}=await import(`@murumets-ee/storage/plugin`),r=e();return t(n(),{app:r})})();e.catch(()=>{u.clientPromise===e&&(u.clientPromise=null)}),u.clientPromise=e}return u.clientPromise}async function f(){let{createAdminClient:e}=await import(`@murumets-ee/core/clients`),{MediaClient:t}=await import(`./client-nPu7G7hY.mjs`),{Media:n}=await import(`./entity-Caba_NFw.mjs`),r=await d();return new t({admin:e(n),storage:r})}const p=async(e,t)=>{let{isStorageConfigured:n,getStorageConfigReason:r}=await import(`@murumets-ee/storage`),a=t.segments;if(a.length===2&&a[1]===`usage`){let e=a[0];if(!i(e))return l(`Invalid media ID format`,400);let{findMediaUsages:t}=await import(`./usage-CVAqkS6h.mjs`),{getApp:n}=await import(`@murumets-ee/core`);return c({usages:await t(e,n())})}if(a.length>=2)return l(`Not found`,404);let u=a.length>0?a[0]:void 0;if(u!==void 0&&!i(u))return l(`Invalid media ID format`,400);if(!n()){let e=r()??`Storage not configured`;return a.length>0?c({error:e,configured:!1,reason:e},503):c({items:[],total:0,configured:!1,reason:e})}let d=await f();if(u!==void 0){let e=await d.findById(u);if(!e)return l(`Media not found`,404);let t=await d.getUrl(u);return c({...e,url:t})}let p=new URL(e.url),m=p.searchParams.get(`search`)??void 0,h=p.searchParams.get(`mediaType`),g=h!==null&&o(h)?h:void 0,_=Math.min(Math.max(s(p.searchParams.get(`limit`),24),1),100),v=Math.min(s(p.searchParams.get(`offset`),0),1e5),y=await d.findMany({...m!==void 0&&{search:m},...g!==void 0&&{mediaType:g},limit:_,offset:v}),b=y.items.map(e=>e.id),[x,S]=await Promise.all([d.getUrls(b),d.getVariantUrls(b,`thumbnail`)]);return c({items:y.items.map(e=>{let t=S.get(e.id);return{id:e.id,title:e.title??null,alt:e.alt??null,filename:e.filename,mimeType:e.mimeType,size:e.size,mediaType:e.mediaType,url:x.get(e.id)??``,...t!==void 0&&{thumbnailUrl:t},width:e.width??null,height:e.height??null}}),total:y.total})},m=async(e,t)=>{let{isStorageConfigured:r,getStorageConfigReason:i,detectMimeType:a}=await import(`@murumets-ee/storage`);if(t.segments.length>0)return l(`Not found`,404);if(!r())return l(i()??`Storage not configured`,503);let o=await f(),s=await e.formData(),u=s.get(`file`);if(!(u instanceof File)||u.size===0)return l(`No file provided`,400);if(u.size>50*1024*1024)return l(`File too large: ${(u.size/1024/1024).toFixed(1)} MB exceeds 50 MB limit`,400);let d=Buffer.from(await u.arrayBuffer()),{mimeType:p,mismatch:m}=await a(d,u.type||`application/octet-stream`);if(m)return l(`File content doesn't match declared type: claimed ${u.type}, detected ${p}`,400);let h=s.get(`visibility`);if(h!==null&&h!==`public`&&h!==`private`)return l(`Field 'visibility' must be 'public' or 'private'`,400);let g=await o.upload(d,{filename:u.name,mimeType:p,size:u.size,uploadedBy:t.user.id,...h!==null&&{visibility:h}}),_={id:g.media.id,title:g.media.title??null,alt:g.media.alt??null,filename:g.media.filename,mimeType:g.media.mimeType,size:g.media.size,mediaType:g.media.mediaType,url:g.url,width:g.media.width??null,height:g.media.height??null};return n(t,{action:`media.upload`,entityType:`media`,entityId:g.media.id,userId:t.user.id,...t.user.name!==void 0&&{userName:t.user.name},changes:{filename:g.media.filename,mimeType:g.media.mimeType,size:g.media.size,mediaType:g.media.mediaType}}),c(_,201)},h=async(e,t)=>{let{isStorageConfigured:r,getStorageConfigReason:i}=await import(`@murumets-ee/storage`);if(t.segments.length!==1)return l(`Not found`,404);if(!r())return l(i()??`Storage not configured`,503);let{regenerateAllVariants:a}=await import(`./regenerate-variants-BysyeIoA.mjs`),{getApp:o,getContext:s}=await import(`@murumets-ee/core`),{resolveImageStyles:u}=await import(`./resolve-image-styles-qf5MpFll.mjs`),{createStorageClient:d}=await import(`@murumets-ee/storage`),{getStorageConfig:f}=await import(`@murumets-ee/storage/plugin`),p=o(),m=await u(p,p.logger);if(!m||Object.keys(m).length===0)return l(`No image styles configured`,400);let h=await a({app:p,storage:d(f(),{app:p}),logger:p.logger.child({media:!0}),styles:m,contextResolver:()=>{let e=s();if(!(!e?.user||!e?.checker))return{user:e.user,checker:e.checker,...e.scope!==void 0&&{scope:e.scope}}}});return n(t,{action:`media.regenerate_variants`,userId:t.user.id,...t.user.name!==void 0&&{userName:t.user.name},metadata:{total:h.total,processed:h.processed,errors:h.errors}}),c(h)},g=async(e,t)=>{let r=t.segments;if(r.length===0)return l(`Media ID required`,400);if(r.length>1)return l(`Not found`,404);let a=r[0];if(!i(a))return l(`Invalid media ID format`,400);let{isStorageConfigured:o,getStorageConfigReason:s}=await import(`@murumets-ee/storage`);return o()?(await(await f()).delete(a),n(t,{action:`media.delete`,entityType:`media`,entityId:a,userId:t.user.id,...t.user.name!==void 0&&{userName:t.user.name}}),c({deleted:1})):l(s()??`Storage not configured`,503)},_=[`admin`,`editor`,`agent`,`viewer`],v=[`admin`,`editor`];function y(){return e([t({prefix:`media`,path:``,method:`GET`,permission:`media:view`,defaultRoles:_,matchAnyPath:!0,description:`Read media — list, single item, or referencing-entity usage report.`,handler:p}),t({prefix:`media`,path:``,method:`POST`,permission:`media:create`,defaultRoles:v,description:"Upload a media file (multipart FormData with `file` field).",handler:m}),t({prefix:`media`,path:`regenerate-variants`,method:`POST`,permission:`media:create`,defaultRoles:v,description:`Regenerate every image-style variant for every media row.`,handler:h}),t({prefix:`media`,path:``,method:`DELETE`,permission:`media:delete`,defaultRoles:v,matchAnyPath:!0,description:`Delete a media record + its storage object.`,handler:g})])}export{y as t};
-//# sourceMappingURL=routes-C_LZXK6k.mjs.map

package/dist/routes-C_LZXK6k.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"routes-C_LZXK6k.mjs","names":[],"sources":["../src/admin/routes.ts"],"sourcesContent":["/**\n * Media admin routes — one static `defineAdminRoute` per HTTP method.\n *\n * **URL surface served by this module:**\n *\n *   - GET    /api/admin/media                       — list with search/filter + URLs\n *   - GET    /api/admin/media/<id>                  — single record with URL\n *   - GET    /api/admin/media/<id>/usage            — entities referencing this media\n *   - POST   /api/admin/media                       — upload (multipart FormData)\n *   - POST   /api/admin/media/regenerate-variants   — bulk variant regeneration\n *   - DELETE /api/admin/media/<id>                  — delete + storage cleanup\n *\n * Standard entity CRUD (PATCH with translations) falls through to the\n * generic entity handler — add `Media` to `entities` in your handler config.\n *\n * **Why per-method `defineAdminRoute`** (vs. the previous top-level\n * `resource: 'media'` + auto-mapped permission):\n *\n *   - The wrapper (`guardedHandler` from `@murumets-ee/core`) owns the\n *     permission gate, `permission.denied` audit, and 403 body shape\n *     uniformly with every other migrated plugin. The previous shape\n *     relied on `METHOD_TO_ACTION` auto-mapping at the api-handler\n *     dispatch level which couldn't emit per-route audit metadata.\n *   - Inline `if (!checkPermission('media', 'create')) ...` defenses\n *     at the regenerate-variants / upload / delete branches are now\n *     redundant — the wrapper enforces the permission BEFORE the\n *     handler runs.\n *\n * **`matchAnyPath` rationale:** media's URL surface predates the\n * static-second-segment convention every other plugin follows\n * (`/taxonomy/<vocab>/<id>`, `/settings/<namespace>/<rest>`). The\n * second segment under `/media` is the media id itself — a runtime\n * UUID — which the dispatcher's literal `segments[0]` match would\n * miss for every request. The catch-all flag declares \"this entry\n * claims every (prefix, method) sub-path no other entry matched\" so\n * the existing URL contract works under the per-method dispatch\n * model. Static POST sub-paths (`regenerate-variants`) take\n * precedence over the catch-all entry on POST. See\n * `DefineAdminRouteSpec.matchAnyPath` in `@murumets-ee/core` for the\n * full contract.\n *\n * **Default roles:** broad for view (`['admin', 'editor', 'agent',\n * 'viewer']`), narrower for writes (`['admin', 'editor']`).\n * Conservative starting point — apps can grant more via the\n * Permissions UI.\n *\n * @example\n * ```typescript\n * import { createAdminApiHandler } from '@murumets-ee/admin-ui/server'\n * import { mediaRoutes } from '@murumets-ee/media/admin'\n * import { Media } from '@murumets-ee/media'\n *\n * const handler = createAdminApiHandler({\n *   authenticate: async (req) => { ... },\n *   entities: [Article, Media],\n *   routes: [...mediaRoutes()],\n * })\n * ```\n */\n\nimport {\n  type AdminRoute,\n  type AdminRouteHandler,\n  combineAdminRoutes,\n  defineAdminRoute,\n  safeAudit,\n} from '@murumets-ee/core'\nimport type { MediaClient } from '../client.js'\nimport type { MediaPickerItem, MediaPickerListResult } from '../picker/types.js'\n\n// ---------------------------------------------------------------------------\n// Validation\n// ---------------------------------------------------------------------------\n\nconst UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i\n\nfunction isValidUuid(value: string | undefined): value is string {\n  return value !== undefined && UUID_RE.test(value)\n}\n\n/**\n * Closed enum of allowed `mediaType` filter values, in lockstep with the\n * `mediaType` field on the Media entity. The list MUST match\n * `MediaListOptions.mediaType` (declared in `../types.js`) — TypeScript\n * doesn't link the two automatically, so the small drift risk is\n * accepted in exchange for not pulling a runtime dep on the entity\n * schema package just to read its enum.\n *\n * Used as both the runtime allowlist (`isAllowedMediaType`) and the\n * source of truth for the narrowed type the guard produces — keeping\n * `as` casts off the handler's hot path.\n */\nconst ALLOWED_MEDIA_TYPES = ['image', 'video', 'audio', 'document', 'other'] as const\ntype AllowedMediaType = (typeof ALLOWED_MEDIA_TYPES)[number]\n\nfunction isAllowedMediaType(value: string): value is AllowedMediaType {\n  // Cast to readonly string[] so the typed-tuple `includes` check works\n  // with an arbitrary string input — `Array.prototype.includes`'s\n  // signature on a typed tuple only accepts members of the tuple\n  // (TS 4.9+ literal-narrowing), which is exactly what we want to\n  // sidestep here.\n  return (ALLOWED_MEDIA_TYPES as readonly string[]).includes(value)\n}\n\n/**\n * Hard cap on the `offset` query param. The dispatcher's allowed-pages\n * model is `limit ∈ [1, 100]`; even with the max page size that's\n * 1000 pages before hitting MAX_OFFSET, which is well beyond any\n * realistic admin-UI scroll depth. Forces slow-discard offset attacks\n * (`?offset=999999999`) to revert to a sane upper bound. Cursor-based\n * pagination would let this go higher, but the media list is\n * offset-based by convention with the entity-list shell.\n */\nconst MAX_OFFSET = 100_000\n\n/**\n * Strict non-negative integer parser for query params.\n *\n * `Number(raw)` silently coerces blanks (`'' → 0`), hex (`'0x05' → 5`),\n * exponent notation (`'1e2' → 100`), and signed (`'+5'/'-5'`) values —\n * all of which pass a downstream `Number.isInteger(n) && n >= 0` check.\n * Pre-filtering with `/^\\d+$/` keeps the contract honest: \"if you don't\n * send a pure non-negative integer string, you get the default.\" Same\n * pattern as `packages/taxonomy/src/admin/routes.ts:handleGet` tree\n * branch from PR-C-taxonomy.\n */\nfunction parseUintParam(raw: string | null, fallback: number): number {\n  if (raw === null || !/^\\d+$/.test(raw)) return fallback\n  const parsed = Number(raw)\n  // The regex above stops hex / exponent / signed / whitespace / blank\n  // inputs, but a long digit-only string still slips past — `Number(...)`\n  // returns `Infinity` past ~309 digits, and precision is lost past\n  // 2^53. Both would propagate through `client.findMany`'s\n  // `offset: parsed` into a Postgres query that either crashes the\n  // driver (`Infinity` is not a valid bigint) or silently rounds (the\n  // 2^53 precision-loss boundary). Reject via `Number.isSafeInteger`\n  // so overflowing inputs revert to `fallback` like every other\n  // malformed value.\n  if (!Number.isSafeInteger(parsed)) return fallback\n  return parsed\n}\n\n// ---------------------------------------------------------------------------\n// Response helpers\n// ---------------------------------------------------------------------------\n\nfunction jsonResponse(data: unknown, status = 200): Response {\n  return new Response(JSON.stringify(data), {\n    status,\n    headers: { 'Content-Type': 'application/json' },\n  })\n}\n\nfunction jsonError(message: string, status: number): Response {\n  return jsonResponse({ error: message }, status)\n}\n\n// ---------------------------------------------------------------------------\n// Per-request MediaClient factory + cached storage client\n// ---------------------------------------------------------------------------\n//\n// MediaClient and its AdminClient MUST be built per-request — AdminClient's\n// context resolver is captured eagerly at construction (see\n// buildContextResolver in @murumets-ee/core/clients). A module-level singleton\n// would bake the first request's user + tenant scope into every subsequent\n// request's writes — a cross-request permission/scope leak.\n//\n// Storage config is process-global and safe to cache once.\n\ntype StorageClient = Awaited<ReturnType<typeof import('@murumets-ee/storage').createStorageClient>>\n\ninterface StorageState {\n  clientPromise: Promise<StorageClient> | null\n}\n\n// Module-level state. `null` once eviction fires on a rejection so the next\n// request gets a fresh resolution attempt (see `getStorage`'s `.catch`).\nconst storageState: StorageState = { clientPromise: null }\n\n/**\n * Resolve the process-wide storage client. The pending-promise slot is\n * cleared on rejection so a transient `createStorageClient` failure\n * (DB hiccup, misconfig) doesn't poison every subsequent media request\n * for the lifetime of the Node process. Same pattern as\n * `packages/taxonomy/src/admin/routes.ts:getClient` from PR-C-taxonomy.\n */\nasync function getStorage(): Promise<StorageClient> {\n  if (!storageState.clientPromise) {\n    const pending = (async () => {\n      const { getApp } = await import('@murumets-ee/core')\n      const { createStorageClient } = await import('@murumets-ee/storage')\n      const { getStorageConfig } = await import('@murumets-ee/storage/plugin')\n      const app = getApp()\n      return createStorageClient(getStorageConfig(), { app })\n    })()\n    // Clear the slot on rejection so a transient failure doesn't poison\n    // every subsequent request. `pending.catch(handler)` attaches a\n    // synchronous rejection listener that resets the cached slot — the\n    // handler returns `undefined`, NOT a re-throw — so the new\n    // `.catch`-returned promise resolves, but we never await or hold\n    // that promise. The ORIGINAL `pending` (stored in\n    // `storageState.clientPromise`) is what callers `await`, and it's\n    // still in its rejected state — so the caller observing this\n    // resolution sees the underlying error. The `.catch` also marks\n    // the rejection as \"handled\" for Node's unhandled-rejection\n    // tracker. `storageState.clientPromise` holds the original `pending`\n    // so concurrent in-flight callers share one resolution.\n    pending.catch(() => {\n      if (storageState.clientPromise === pending) storageState.clientPromise = null\n    })\n    storageState.clientPromise = pending\n  }\n  return storageState.clientPromise\n}\n\nasync function getMediaClient(): Promise<MediaClient> {\n  const { createAdminClient } = await import('@murumets-ee/core/clients')\n  const { MediaClient } = await import('../client.js')\n  const { Media } = await import('../entity.js')\n  const storage = await getStorage()\n  const admin = createAdminClient(Media)\n  return new MediaClient({ admin, storage })\n}\n\n// ---------------------------------------------------------------------------\n// Handlers\n// ---------------------------------------------------------------------------\n\nconst handleGet: AdminRouteHandler = async (req, ctx) => {\n  const { isStorageConfigured, getStorageConfigReason } = await import('@murumets-ee/storage')\n  const segments = ctx.segments\n\n  // GET /media/<id>/usage — DB-only lookup, safe even when storage is\n  // unconfigured. Validate the UUID first so a malformed id 400s\n  // uniformly with the storage-configured branch below.\n  if (segments.length === 2 && segments[1] === 'usage') {\n    const id = segments[0]\n    if (!isValidUuid(id)) return jsonError('Invalid media ID format', 400)\n\n    const { findMediaUsages } = await import('../usage.js')\n    const { getApp } = await import('@murumets-ee/core')\n    const app = getApp()\n    const usages = await findMediaUsages(id, app)\n    return jsonResponse({ usages })\n  }\n\n  // Reject unknown sub-paths explicitly. The wrapper-gate has already\n  // passed (caller has `media:view`); a handler-level 404 here matches\n  // the dispatcher's miss-shape so unknown URLs don't fall through to\n  // the single-id branch and 400/500 with a misleading reason. The\n  // only valid 2-segment URL is `<id>/usage`, which was already\n  // claimed by the early-return above — anything else with >=2\n  // segments is not a recognized media route.\n  if (segments.length >= 2) return jsonError('Not found', 404)\n\n  // GET /media/<id> — validate UUID up front so a bad request still\n  // 400s when storage happens to be unconfigured (matches DELETE).\n  const singleId = segments.length > 0 ? segments[0] : undefined\n  if (singleId !== undefined && !isValidUuid(singleId)) {\n    return jsonError('Invalid media ID format', 400)\n  }\n\n  // Everything below needs a working storage client. If env isn't\n  // wired, return a structured \"disabled\" response rather than 500 —\n  // the media list page renders a banner and new admins can finish\n  // onboarding without being blocked on a crash loop.\n  if (!isStorageConfigured()) {\n    const reason = getStorageConfigReason() ?? 'Storage not configured'\n    if (segments.length > 0) {\n      // Single item — treat as not-found-ish to avoid leaking\n      // existence; include reason so the UI can surface it.\n      return jsonResponse({ error: reason, configured: false, reason }, 503)\n    }\n    // GET /media — empty list + disabled flag for the picker's banner.\n    const response: MediaPickerListResult & { configured: false; reason: string } = {\n      items: [],\n      total: 0,\n      configured: false,\n      reason,\n    }\n    return jsonResponse(response)\n  }\n\n  const client = await getMediaClient()\n\n  // GET /media/<id> — single item with URL (full record for EntityForm + picker)\n  if (singleId !== undefined) {\n    const record = await client.findById(singleId)\n    if (!record) return jsonError('Media not found', 404)\n\n    const url = await client.getUrl(singleId)\n    return jsonResponse({ ...record, url })\n  }\n\n  // GET /media — list with search/filter + batch URL resolution\n  const url = new URL(req.url)\n  const search = url.searchParams.get('search') ?? undefined\n  // mediaType MUST be validated against the entity's closed enum before\n  // it reaches `client.findMany` — the previous shape force-cast the raw\n  // query value with `as 'image' | ...` which is a type-system lie. A\n  // bogus value like `?mediaType=bogus` would parameterize into\n  // `WHERE media_type = 'bogus'` (no SQL injection — Drizzle is\n  // parameterized — but the row count is silently zero, which is\n  // confusing). Empty string from `?mediaType=` is also passed-through\n  // by the prior `?? undefined` shape since empty string is not null.\n  // Allowlist + type guard drops bogus / empty values cleanly so the\n  // filter is omitted instead of applied with a no-match value.\n  const rawMediaType = url.searchParams.get('mediaType')\n  const mediaType =\n    rawMediaType !== null && isAllowedMediaType(rawMediaType) ? rawMediaType : undefined\n  // Strict parsing keeps the contract honest — see `parseUintParam`\n  // JSDoc. Cap limit to [1, 100] and offset to [0, MAX_OFFSET] so a\n  // request can't ask for an unboundedly large page nor force a\n  // slow-discard scan with `?offset=99999999`.\n  const limit = Math.min(Math.max(parseUintParam(url.searchParams.get('limit'), 24), 1), 100)\n  const offset = Math.min(parseUintParam(url.searchParams.get('offset'), 0), MAX_OFFSET)\n\n  const result = await client.findMany({\n    ...(search !== undefined && { search }),\n    ...(mediaType !== undefined && { mediaType }),\n    limit,\n    offset,\n  })\n\n  // Resolve original URLs + thumbnail variant URLs for all items.\n  const ids = result.items.map((item) => item.id)\n  const [urlMap, thumbMap] = await Promise.all([\n    client.getUrls(ids),\n    client.getVariantUrls(ids, 'thumbnail'),\n  ])\n\n  const items: (MediaPickerItem & { thumbnailUrl?: string })[] = result.items.map((item) => {\n    const thumbnailUrl = thumbMap.get(item.id)\n    return {\n      id: item.id,\n      title: item.title ?? null,\n      alt: item.alt ?? null,\n      filename: item.filename,\n      mimeType: item.mimeType,\n      size: item.size,\n      mediaType: item.mediaType,\n      url: urlMap.get(item.id) ?? '',\n      ...(thumbnailUrl !== undefined && { thumbnailUrl }),\n      width: item.width ?? null,\n      height: item.height ?? null,\n    }\n  })\n\n  const response: MediaPickerListResult = { items, total: result.total }\n  return jsonResponse(response)\n}\n\nconst handleUpload: AdminRouteHandler = async (req, ctx) => {\n  const { isStorageConfigured, getStorageConfigReason, detectMimeType } = await import(\n    '@murumets-ee/storage'\n  )\n\n  // Upload is registered at `path: ''` (NOT matchAnyPath) — the\n  // dispatcher only invokes this handler when segments=[]. The api-\n  // handler ALSO rejects empty/whitespace-only first segments with a\n  // 400 before any plugin dispatcher runs (see\n  // `packages/admin-ui/src/server/api-handler/index.ts` segment-\n  // validation block). So this guard is defense-in-depth — per HANDOFF\n  // §\"Defense-in-depth `&& segments[i]` guards are fine\" — protecting\n  // against a future framework invariant change that lets a non-empty\n  // segment reach a `path: ''` static entry.\n  if (ctx.segments.length > 0) return jsonError('Not found', 404)\n\n  if (!isStorageConfigured()) {\n    return jsonError(getStorageConfigReason() ?? 'Storage not configured', 503)\n  }\n\n  const client = await getMediaClient()\n\n  const formData = await req.formData()\n  const file = formData.get('file')\n  // FormData `get` returns string | File | null. Reject anything that\n  // isn't a File so the typed `file.size`/`file.arrayBuffer()` below\n  // is safe without a runtime cast.\n  if (!(file instanceof File) || file.size === 0) {\n    return jsonError('No file provided', 400)\n  }\n\n  // Guard against oversized uploads (50 MB limit). Hardcoded rather\n  // than read from getMediaConfig() to keep this handler independent\n  // of plugin-init order — the plugin's resolved config may not be\n  // populated yet under CLI / non-RSC startup paths.\n  const MAX_UPLOAD_SIZE = 50 * 1024 * 1024\n  if (file.size > MAX_UPLOAD_SIZE) {\n    return jsonError(\n      `File too large: ${(file.size / 1024 / 1024).toFixed(1)} MB exceeds 50 MB limit`,\n      400,\n    )\n  }\n\n  const buffer = Buffer.from(await file.arrayBuffer())\n\n  // Detect actual MIME type from file content (prevents spoofing).\n  const { mimeType, mismatch } = await detectMimeType(\n    buffer,\n    file.type || 'application/octet-stream',\n  )\n  if (mismatch) {\n    return jsonError(\n      `File content doesn't match declared type: claimed ${file.type}, detected ${mimeType}`,\n      400,\n    )\n  }\n\n  // Per-upload visibility, DEFAULTING TO PRIVATE — the caller opts in.\n  //\n  // This route serves two populations with opposite needs. The media picker\n  // uploads publishable web assets: a page's hero image MUST be public or the\n  // public site resolves it to `null` and renders no images at all, with a 200\n  // on every page and one warn log (F030). `packages/rent-ui`'s inspection\n  // wizard posts to this SAME route with handover and return photos — vehicle\n  // and apartment condition shots, plates, interiors, occasionally documents —\n  // which must stay behind time-limited signed urls.\n  //\n  // Deny-by-default decides the direction, and the asymmetry is the argument:\n  // forget the opt-in and an image is invisible, which is annoying, visible and\n  // fixable; default to public and forget an opt-out and those photos become\n  // permanently world-readable. A missed opt-in cannot leak. So the default is\n  // unchanged (`private` via StorageClient's own fallback) and rent's caller is\n  // untouched — it sends nothing and behaves exactly as before.\n  const visibilityRaw = formData.get('visibility')\n  if (visibilityRaw !== null && visibilityRaw !== 'public' && visibilityRaw !== 'private') {\n    return jsonError(\"Field 'visibility' must be 'public' or 'private'\", 400)\n  }\n  const result = await client.upload(buffer, {\n    filename: file.name,\n    mimeType,\n    size: file.size,\n    uploadedBy: ctx.user.id,\n    ...(visibilityRaw !== null && { visibility: visibilityRaw }),\n  })\n\n  const item: MediaPickerItem = {\n    id: result.media.id,\n    title: result.media.title ?? null,\n    alt: result.media.alt ?? null,\n    filename: result.media.filename,\n    mimeType: result.media.mimeType,\n    size: result.media.size,\n    mediaType: result.media.mediaType,\n    url: result.url,\n    width: result.media.width ?? null,\n    height: result.media.height ?? null,\n  }\n\n  safeAudit(ctx, {\n    action: 'media.upload',\n    entityType: 'media',\n    entityId: result.media.id,\n    userId: ctx.user.id,\n    ...(ctx.user.name !== undefined && { userName: ctx.user.name }),\n    changes: {\n      filename: result.media.filename,\n      mimeType: result.media.mimeType,\n      size: result.media.size,\n      mediaType: result.media.mediaType,\n    },\n  })\n\n  return jsonResponse(item, 201)\n}\n\nconst handleRegenerateVariants: AdminRouteHandler = async (_req, ctx) => {\n  const { isStorageConfigured, getStorageConfigReason } = await import('@murumets-ee/storage')\n\n  // Static POST path='regenerate-variants' — the dispatcher only invokes\n  // this handler when `segments[0] === 'regenerate-variants'`. Trailing\n  // segments (e.g. POST /media/regenerate-variants/extra) aren't a\n  // supported sub-route.\n  if (ctx.segments.length !== 1) return jsonError('Not found', 404)\n\n  if (!isStorageConfigured()) {\n    return jsonError(getStorageConfigReason() ?? 'Storage not configured', 503)\n  }\n\n  const { regenerateAllVariants } = await import('../regenerate-variants.js')\n  const { getApp, getContext } = await import('@murumets-ee/core')\n  const { resolveImageStyles } = await import('../resolve-image-styles.js')\n  const { createStorageClient } = await import('@murumets-ee/storage')\n  const { getStorageConfig } = await import('@murumets-ee/storage/plugin')\n\n  const app = getApp()\n  const styles = await resolveImageStyles(app, app.logger)\n  if (!styles || Object.keys(styles).length === 0) {\n    return jsonError('No image styles configured', 400)\n  }\n\n  const storageConfig = getStorageConfig()\n  const storage = createStorageClient(storageConfig, { app })\n\n  const result = await regenerateAllVariants({\n    app,\n    storage,\n    logger: app.logger.child({ media: true }),\n    styles,\n    contextResolver: () => {\n      const requestCtx = getContext()\n      if (!requestCtx?.user || !requestCtx?.checker) return undefined\n      return {\n        user: requestCtx.user,\n        checker: requestCtx.checker,\n        ...(requestCtx.scope !== undefined && { scope: requestCtx.scope }),\n      }\n    },\n  })\n\n  safeAudit(ctx, {\n    action: 'media.regenerate_variants',\n    userId: ctx.user.id,\n    ...(ctx.user.name !== undefined && { userName: ctx.user.name }),\n    metadata: { total: result.total, processed: result.processed, errors: result.errors },\n  })\n\n  return jsonResponse(result)\n}\n\nconst handleDelete: AdminRouteHandler = async (_req, ctx) => {\n  const segments = ctx.segments\n\n  // DELETE /media — no id supplied. Reject as 400, NOT 404, so a\n  // caller confusing \"no id\" with \"id not found\" gets a meaningful\n  // error. The wrapper-gate has already validated the caller has\n  // media:delete, so the 400 isn't an information-disclosure vector.\n  if (segments.length === 0) return jsonError('Media ID required', 400)\n\n  // Reject sub-paths beyond /<id> — DELETE /media/<id>/usage etc.\n  if (segments.length > 1) return jsonError('Not found', 404)\n\n  const id = segments[0]\n  if (!isValidUuid(id)) return jsonError('Invalid media ID format', 400)\n\n  const { isStorageConfigured, getStorageConfigReason } = await import('@murumets-ee/storage')\n  if (!isStorageConfigured()) {\n    // Can't safely delete — MediaClient needs storage to remove the\n    // actual object, and partial delete (DB row gone, object orphaned)\n    // would leak storage. Surface the reason so the UI can display it.\n    return jsonError(getStorageConfigReason() ?? 'Storage not configured', 503)\n  }\n\n  // AdminClient.delete() checks entity_refs and throws\n  // ReferencedEntityError if this media is still referenced. The\n  // error bubbles to the caller's error handler which returns 409\n  // with usage details.\n  const client = await getMediaClient()\n  await client.delete(id)\n\n  safeAudit(ctx, {\n    action: 'media.delete',\n    entityType: 'media',\n    entityId: id,\n    userId: ctx.user.id,\n    ...(ctx.user.name !== undefined && { userName: ctx.user.name }),\n  })\n\n  return jsonResponse({ deleted: 1 })\n}\n\n// ---------------------------------------------------------------------------\n// Route factory\n// ---------------------------------------------------------------------------\n\n/**\n * Default roles for view: broad reach across the admin shell.\n *\n * `BUILT_IN_ROLES` in `packages/auth/src/permissions.ts` is\n * `['admin', 'public', 'authenticated', 'agent', 'customer']` — `admin` is\n * hardcoded as an unconditional yes in `buildPermissionChecker`,\n * `agent` is the only non-admin built-in that flows through\n * `buildInitialRoleDefinitions()` + `upsertBuiltInRoles` with default\n * media access (`customer` seeds with zero permissions — see that\n * function's JSDoc). The `agent` entry in this list is what gives ops\n * agents read-only media access on first boot of a fresh install.\n *\n * `editor` and `viewer` are CONVENTIONAL app-defined roles —\n * apps that follow the scaffold pattern create them as part of\n * their own role catalog. Including them in `defaultRoles` doesn't\n * seed them (the seeder only iterates the built-ins above), but\n * the values DO flow into the process-local permission catalog\n * (see `registerPermission` in `@murumets-ee/core`), which the\n * forthcoming Permission Matrix UI (PR-D) reads to show \"this\n * route's recommended default grants\" against the app's actual\n * role set. The catalog is also the mechanism via which a future\n * upgrade of `upsertBuiltInRoles` could extend the seed surface\n * to app-defined roles without each plugin having to re-declare\n * its defaults.\n */\nconst VIEW_DEFAULT_ROLES = ['admin', 'editor', 'agent', 'viewer'] as const\n\n/** Default roles for create/delete — narrower than view. */\nconst WRITE_DEFAULT_ROLES = ['admin', 'editor'] as const\n\n/**\n * Build admin API routes for media management.\n *\n * Returns `AdminRoute[]` from `combineAdminRoutes` — one entry per\n * `(prefix, method)` after grouping. Callers spread the result into\n * their top-level routes list: `routes: [...mediaRoutes()]`.\n *\n * Four `defineAdminRoute` entries:\n *\n *   - GET    matchAnyPath with `media:view`   defaultRoles: VIEW_DEFAULT_ROLES\n *   - POST   path=''            `media:create` defaultRoles: WRITE_DEFAULT_ROLES\n *   - POST   path='regenerate-variants' `media:create` defaultRoles: WRITE_DEFAULT_ROLES\n *   - DELETE matchAnyPath with `media:delete` defaultRoles: WRITE_DEFAULT_ROLES\n *\n * Permissions are auto-registered by the entity catalog\n * (`buildResourceCatalog` in `@murumets-ee/auth`) AND by\n * `registerPermission` inside `defineAdminRoute`. Idempotent —\n * `registerPermission` unions `defaultRoles` on repeat registration,\n * so the framework's two pathways agree on the final grant set.\n *\n * Standard entity CRUD (PATCH with translations) is NOT registered\n * here — it falls through to the generic entity handler. Add `Media`\n * to the `entities` array in your handler config to enable it.\n */\nexport function mediaRoutes(): AdminRoute[] {\n  const entries = [\n    defineAdminRoute({\n      prefix: 'media',\n      path: '',\n      method: 'GET',\n      permission: 'media:view',\n      defaultRoles: VIEW_DEFAULT_ROLES,\n      matchAnyPath: true,\n      description: 'Read media — list, single item, or referencing-entity usage report.',\n      handler: handleGet,\n    }),\n    defineAdminRoute({\n      prefix: 'media',\n      path: '',\n      method: 'POST',\n      permission: 'media:create',\n      defaultRoles: WRITE_DEFAULT_ROLES,\n      description: 'Upload a media file (multipart FormData with `file` field).',\n      handler: handleUpload,\n    }),\n    defineAdminRoute({\n      prefix: 'media',\n      path: 'regenerate-variants',\n      method: 'POST',\n      permission: 'media:create',\n      defaultRoles: WRITE_DEFAULT_ROLES,\n      description: 'Regenerate every image-style variant for every media row.',\n      handler: handleRegenerateVariants,\n    }),\n    defineAdminRoute({\n      prefix: 'media',\n      path: '',\n      method: 'DELETE',\n      permission: 'media:delete',\n      defaultRoles: WRITE_DEFAULT_ROLES,\n      matchAnyPath: true,\n      description: 'Delete a media record + its storage object.',\n      handler: handleDelete,\n    }),\n  ]\n\n  return combineAdminRoutes(entries)\n}\n"],"mappings":"4FA0EA,MAAM,EAAU,kEAEhB,SAAS,EAAY,EAA4C,CAC/D,OAAO,IAAU,IAAA,IAAa,EAAQ,KAAK,CAAK,CAClD,CAcA,MAAM,EAAsB,CAAC,QAAS,QAAS,QAAS,WAAY,OAAO,EAG3E,SAAS,EAAmB,EAA0C,CAMpE,OAAQ,EAA0C,SAAS,CAAK,CAClE,CAwBA,SAAS,EAAe,EAAoB,EAA0B,CACpE,GAAI,IAAQ,MAAQ,CAAC,QAAQ,KAAK,CAAG,EAAG,OAAO,EAC/C,IAAM,EAAS,OAAO,CAAG,EAWzB,OADK,OAAO,cAAc,CAAM,EACzB,EADmC,CAE5C,CAMA,SAAS,EAAa,EAAe,EAAS,IAAe,CAC3D,OAAO,IAAI,SAAS,KAAK,UAAU,CAAI,EAAG,CACxC,SACA,QAAS,CAAE,eAAgB,kBAAmB,CAChD,CAAC,CACH,CAEA,SAAS,EAAU,EAAiB,EAA0B,CAC5D,OAAO,EAAa,CAAE,MAAO,CAAQ,EAAG,CAAM,CAChD,CAsBA,MAAM,EAA6B,CAAE,cAAe,IAAK,EASzD,eAAe,GAAqC,CAClD,GAAI,CAAC,EAAa,cAAe,CAC/B,IAAM,GAAW,SAAY,CAC3B,GAAM,CAAE,UAAW,MAAM,OAAO,qBAC1B,CAAE,uBAAwB,MAAM,OAAO,wBACvC,CAAE,oBAAqB,MAAM,OAAO,+BACpC,EAAM,EAAO,EACnB,OAAO,EAAoB,EAAiB,EAAG,CAAE,KAAI,CAAC,CACxD,EAAA,CAAG,EAaH,EAAQ,UAAY,CACd,EAAa,gBAAkB,IAAS,EAAa,cAAgB,KAC3E,CAAC,EACD,EAAa,cAAgB,CAC/B,CACA,OAAO,EAAa,aACtB,CAEA,eAAe,GAAuC,CACpD,GAAM,CAAE,qBAAsB,MAAM,OAAO,6BACrC,CAAE,eAAgB,MAAM,OAAO,yBAC/B,CAAE,SAAU,MAAM,OAAO,yBACzB,EAAU,MAAM,EAAW,EAEjC,OAAO,IAAI,EAAY,CAAE,MADX,EAAkB,CACH,EAAG,SAAQ,CAAC,CAC3C,CAMA,MAAM,EAA+B,MAAO,EAAK,IAAQ,CACvD,GAAM,CAAE,sBAAqB,0BAA2B,MAAM,OAAO,wBAC/D,EAAW,EAAI,SAKrB,GAAI,EAAS,SAAW,GAAK,EAAS,KAAO,QAAS,CACpD,IAAM,EAAK,EAAS,GACpB,GAAI,CAAC,EAAY,CAAE,EAAG,OAAO,EAAU,0BAA2B,GAAG,EAErE,GAAM,CAAE,mBAAoB,MAAM,OAAO,wBACnC,CAAE,UAAW,MAAM,OAAO,qBAGhC,OAAO,EAAa,CAAE,OAAA,MADD,EAAgB,EADzB,EAC+B,CAAC,CACf,CAAC,CAChC,CASA,GAAI,EAAS,QAAU,EAAG,OAAO,EAAU,YAAa,GAAG,EAI3D,IAAM,EAAW,EAAS,OAAS,EAAI,EAAS,GAAK,IAAA,GACrD,GAAI,IAAa,IAAA,IAAa,CAAC,EAAY,CAAQ,EACjD,OAAO,EAAU,0BAA2B,GAAG,EAOjD,GAAI,CAAC,EAAoB,EAAG,CAC1B,IAAM,EAAS,EAAuB,GAAK,yBAa3C,OAZI,EAAS,OAAS,EAGb,EAAa,CAAE,MAAO,EAAQ,WAAY,GAAO,QAAO,EAAG,GAAG,EAShE,EAAa,CALlB,MAAO,CAAC,EACR,MAAO,EACP,WAAY,GACZ,QAEyB,CAAC,CAC9B,CAEA,IAAM,EAAS,MAAM,EAAe,EAGpC,GAAI,IAAa,IAAA,GAAW,CAC1B,IAAM,EAAS,MAAM,EAAO,SAAS,CAAQ,EAC7C,GAAI,CAAC,EAAQ,OAAO,EAAU,kBAAmB,GAAG,EAEpD,IAAM,EAAM,MAAM,EAAO,OAAO,CAAQ,EACxC,OAAO,EAAa,CAAE,GAAG,EAAQ,KAAI,CAAC,CACxC,CAGA,IAAM,EAAM,IAAI,IAAI,EAAI,GAAG,EACrB,EAAS,EAAI,aAAa,IAAI,QAAQ,GAAK,IAAA,GAW3C,EAAe,EAAI,aAAa,IAAI,WAAW,EAC/C,EACJ,IAAiB,MAAQ,EAAmB,CAAY,EAAI,EAAe,IAAA,GAKvE,EAAQ,KAAK,IAAI,KAAK,IAAI,EAAe,EAAI,aAAa,IAAI,OAAO,EAAG,EAAE,EAAG,CAAC,EAAG,GAAG,EACpF,EAAS,KAAK,IAAI,EAAe,EAAI,aAAa,IAAI,QAAQ,EAAG,CAAC,EAAG,GAAU,EAE/E,EAAS,MAAM,EAAO,SAAS,CACnC,GAAI,IAAW,IAAA,IAAa,CAAE,QAAO,EACrC,GAAI,IAAc,IAAA,IAAa,CAAE,WAAU,EAC3C,QACA,QACF,CAAC,EAGK,EAAM,EAAO,MAAM,IAAK,GAAS,EAAK,EAAE,EACxC,CAAC,EAAQ,GAAY,MAAM,QAAQ,IAAI,CAC3C,EAAO,QAAQ,CAAG,EAClB,EAAO,eAAe,EAAK,WAAW,CACxC,CAAC,EAoBD,OAAO,EAAa,CADsB,MAjBqB,EAAO,MAAM,IAAK,GAAS,CACxF,IAAM,EAAe,EAAS,IAAI,EAAK,EAAE,EACzC,MAAO,CACL,GAAI,EAAK,GACT,MAAO,EAAK,OAAS,KACrB,IAAK,EAAK,KAAO,KACjB,SAAU,EAAK,SACf,SAAU,EAAK,SACf,KAAM,EAAK,KACX,UAAW,EAAK,UAChB,IAAK,EAAO,IAAI,EAAK,EAAE,GAAK,GAC5B,GAAI,IAAiB,IAAA,IAAa,CAAE,cAAa,EACjD,MAAO,EAAK,OAAS,KACrB,OAAQ,EAAK,QAAU,IACzB,CACF,CAE8C,EAAG,MAAO,EAAO,KACpC,CAAC,CAC9B,EAEM,EAAkC,MAAO,EAAK,IAAQ,CAC1D,GAAM,CAAE,sBAAqB,yBAAwB,kBAAmB,MAAM,OAC5E,wBAYF,GAAI,EAAI,SAAS,OAAS,EAAG,OAAO,EAAU,YAAa,GAAG,EAE9D,GAAI,CAAC,EAAoB,EACvB,OAAO,EAAU,EAAuB,GAAK,yBAA0B,GAAG,EAG5E,IAAM,EAAS,MAAM,EAAe,EAE9B,EAAW,MAAM,EAAI,SAAS,EAC9B,EAAO,EAAS,IAAI,MAAM,EAIhC,GAAI,EAAE,aAAgB,OAAS,EAAK,OAAS,EAC3C,OAAO,EAAU,mBAAoB,GAAG,EAQ1C,GAAI,EAAK,KADe,GAAK,KAAO,KAElC,OAAO,EACL,oBAAoB,EAAK,KAAO,KAAO,KAAA,CAAM,QAAQ,CAAC,EAAE,yBACxD,GACF,EAGF,IAAM,EAAS,OAAO,KAAK,MAAM,EAAK,YAAY,CAAC,EAG7C,CAAE,WAAU,YAAa,MAAM,EACnC,EACA,EAAK,MAAQ,0BACf,EACA,GAAI,EACF,OAAO,EACL,qDAAqD,EAAK,KAAK,aAAa,IAC5E,GACF,EAmBF,IAAM,EAAgB,EAAS,IAAI,YAAY,EAC/C,GAAI,IAAkB,MAAQ,IAAkB,UAAY,IAAkB,UAC5E,OAAO,EAAU,mDAAoD,GAAG,EAE1E,IAAM,EAAS,MAAM,EAAO,OAAO,EAAQ,CACzC,SAAU,EAAK,KACf,WACA,KAAM,EAAK,KACX,WAAY,EAAI,KAAK,GACrB,GAAI,IAAkB,MAAQ,CAAE,WAAY,CAAc,CAC5D,CAAC,EAEK,EAAwB,CAC5B,GAAI,EAAO,MAAM,GACjB,MAAO,EAAO,MAAM,OAAS,KAC7B,IAAK,EAAO,MAAM,KAAO,KACzB,SAAU,EAAO,MAAM,SACvB,SAAU,EAAO,MAAM,SACvB,KAAM,EAAO,MAAM,KACnB,UAAW,EAAO,MAAM,UACxB,IAAK,EAAO,IACZ,MAAO,EAAO,MAAM,OAAS,KAC7B,OAAQ,EAAO,MAAM,QAAU,IACjC,EAgBA,OAdA,EAAU,EAAK,CACb,OAAQ,eACR,WAAY,QACZ,SAAU,EAAO,MAAM,GACvB,OAAQ,EAAI,KAAK,GACjB,GAAI,EAAI,KAAK,OAAS,IAAA,IAAa,CAAE,SAAU,EAAI,KAAK,IAAK,EAC7D,QAAS,CACP,SAAU,EAAO,MAAM,SACvB,SAAU,EAAO,MAAM,SACvB,KAAM,EAAO,MAAM,KACnB,UAAW,EAAO,MAAM,SAC1B,CACF,CAAC,EAEM,EAAa,EAAM,GAAG,CAC/B,EAEM,EAA8C,MAAO,EAAM,IAAQ,CACvE,GAAM,CAAE,sBAAqB,0BAA2B,MAAM,OAAO,wBAMrE,GAAI,EAAI,SAAS,SAAW,EAAG,OAAO,EAAU,YAAa,GAAG,EAEhE,GAAI,CAAC,EAAoB,EACvB,OAAO,EAAU,EAAuB,GAAK,yBAA0B,GAAG,EAG5E,GAAM,CAAE,yBAA0B,MAAM,OAAO,sCACzC,CAAE,SAAQ,cAAe,MAAM,OAAO,qBACtC,CAAE,sBAAuB,MAAM,OAAO,uCACtC,CAAE,uBAAwB,MAAM,OAAO,wBACvC,CAAE,oBAAqB,MAAM,OAAO,+BAEpC,EAAM,EAAO,EACb,EAAS,MAAM,EAAmB,EAAK,EAAI,MAAM,EACvD,GAAI,CAAC,GAAU,OAAO,KAAK,CAAM,CAAC,CAAC,SAAW,EAC5C,OAAO,EAAU,6BAA8B,GAAG,EAMpD,IAAM,EAAS,MAAM,EAAsB,CACzC,MACA,QAJc,EADM,EAC0B,EAAG,CAAE,KAAI,CAIjD,EACN,OAAQ,EAAI,OAAO,MAAM,CAAE,MAAO,EAAK,CAAC,EACxC,SACA,oBAAuB,CACrB,IAAM,EAAa,EAAW,EAC1B,MAAC,GAAY,MAAQ,CAAC,GAAY,SACtC,MAAO,CACL,KAAM,EAAW,KACjB,QAAS,EAAW,QACpB,GAAI,EAAW,QAAU,IAAA,IAAa,CAAE,MAAO,EAAW,KAAM,CAClE,CACF,CACF,CAAC,EASD,OAPA,EAAU,EAAK,CACb,OAAQ,4BACR,OAAQ,EAAI,KAAK,GACjB,GAAI,EAAI,KAAK,OAAS,IAAA,IAAa,CAAE,SAAU,EAAI,KAAK,IAAK,EAC7D,SAAU,CAAE,MAAO,EAAO,MAAO,UAAW,EAAO,UAAW,OAAQ,EAAO,MAAO,CACtF,CAAC,EAEM,EAAa,CAAM,CAC5B,EAEM,EAAkC,MAAO,EAAM,IAAQ,CAC3D,IAAM,EAAW,EAAI,SAMrB,GAAI,EAAS,SAAW,EAAG,OAAO,EAAU,oBAAqB,GAAG,EAGpE,GAAI,EAAS,OAAS,EAAG,OAAO,EAAU,YAAa,GAAG,EAE1D,IAAM,EAAK,EAAS,GACpB,GAAI,CAAC,EAAY,CAAE,EAAG,OAAO,EAAU,0BAA2B,GAAG,EAErE,GAAM,CAAE,sBAAqB,0BAA2B,MAAM,OAAO,wBAuBrE,OAtBK,EAAoB,GAYzB,MAAM,MADe,EAAe,EAAA,CACvB,OAAO,CAAE,EAEtB,EAAU,EAAK,CACb,OAAQ,eACR,WAAY,QACZ,SAAU,EACV,OAAQ,EAAI,KAAK,GACjB,GAAI,EAAI,KAAK,OAAS,IAAA,IAAa,CAAE,SAAU,EAAI,KAAK,IAAK,CAC/D,CAAC,EAEM,EAAa,CAAE,QAAS,CAAE,CAAC,GAlBzB,EAAU,EAAuB,GAAK,yBAA0B,GAAG,CAmB9E,EA+BM,EAAqB,CAAC,QAAS,SAAU,QAAS,QAAQ,EAG1D,EAAsB,CAAC,QAAS,QAAQ,EA0B9C,SAAgB,GAA4B,CA0C1C,OAAO,EAAmB,CAxCxB,EAAiB,CACf,OAAQ,QACR,KAAM,GACN,OAAQ,MACR,WAAY,aACZ,aAAc,EACd,aAAc,GACd,YAAa,sEACb,QAAS,CACX,CAAC,EACD,EAAiB,CACf,OAAQ,QACR,KAAM,GACN,OAAQ,OACR,WAAY,eACZ,aAAc,EACd,YAAa,8DACb,QAAS,CACX,CAAC,EACD,EAAiB,CACf,OAAQ,QACR,KAAM,sBACN,OAAQ,OACR,WAAY,eACZ,aAAc,EACd,YAAa,4DACb,QAAS,CACX,CAAC,EACD,EAAiB,CACf,OAAQ,QACR,KAAM,GACN,OAAQ,SACR,WAAY,eACZ,aAAc,EACd,aAAc,GACd,YAAa,8CACb,QAAS,CACX,CAAC,CAG6B,CAAC,CACnC"}