@o-a/cms-agent 0.3.1 → 0.5.0

package/dist/create-site/template/AGENTS.md

@@ -21,7 +21,7 @@ theme/
   sections/   *.liquid, flat, one per section type - markup + embedded settings schema
   blocks/     *.liquid, flat, one per block type - markup + embedded settings schema
   snippets/   *.liquid, flat, no schema - small reusable partials, invoked with {% render %}
-  assets/     static files (CSS, JS, images) - served as-is at /assets/<path>
+  assets/     design assets only (CSS, JS, icons, sprites) - served as-is at /assets/<path>. NOT content images: photographs and any image an editor would ever replace belong in media/, see "Images" below
   root/       static files served at the bare site root (robots.txt, favicon.ico, etc.)
   templates/  *.json, flat, optional - prebuilt starting pages an editor can pick from
 ```
@@ -38,7 +38,8 @@ This scaffold already ships real, working examples worth reading before writing
 **Only these keywords are supported**: `type`, `properties`, `required`, `additionalProperties`, `default`, `minLength`, `maxLength`, `minimum`, `maximum`, `pattern`, `enum`, `items`, `minItems`, `maxItems`, plus the custom `format`/`title`/`description`/`allowedBlocks`/`api`/`swatches`/`step`/`unit` keywords documented below. **Never `$ref`, `$defs`, `definitions`, `allOf`, `anyOf`, `oneOf`, `not`, or `if`/`then`/`else`** - every property's schema must be fully self-contained, written out in full where it's used. If the same shape (e.g. an image object) repeats across several properties or several component files, write it out each time rather than trying to share/reference a definition - there is no cross-referencing mechanism here, in a single schema block or across files, regardless of what standard JSON Schema itself supports elsewhere.
 3. Once the theme components exist, compose an actual page by writing a file under `content/pages/` whose `sections` array references those types by filename, with a `settings` object matching each one's schema (see "Content JSON model" below).
 4. **For any page type the site will have more than one of** - a project, an article, a case study, a team member - also write a starting point for it under `theme/templates/<name>.json`. This is easy to skip and worth not skipping: without a template, every new page an editor creates starts completely blank, and they have to rebuild the same section stack by hand every time. A template is just a real page file kept in a different folder - the same shape as anything under `content/pages/` (`schemaVersion`, `name`, `title`, `type`, `layout`, `published`, `sections`), validated identically, using the section types this theme already defines. Its `"title"` is the label an editor picks from, so name it for the page type (`"Project"`, `"Article"`), never `"Untitled"`. **Set its `"type"` to that kind too** (`"project"`, `"article"`) - not `"page"`. Every page an editor creates from a template inherits the template's own `type`, and that value is what listings filter on, so an Article template left at `"type": "page"` silently produces articles no blog index can find. This is easy to get wrong because the template still validates and previews perfectly either way; nothing fails, the listing is simply always empty. Fill each section's settings with short placeholder copy rather than leaving them empty - a template is a starting point to edit, not a blank form. A template that fails validation is skipped silently at boot, so preview a page built from it.
-5. Preview the result before considering the task done - see "Previewing your work".
+5. **Put every image through `seed-media` before referencing it - never copy image files into the repo by hand.** Photographs and other content images do not belong in the site root, in `theme/root/`, or in `theme/assets/`; they belong in `media/`, under a content-addressed filename the CMS generates. Run `npx seed-media . <file>...` from the site directory and use the `/media/...` URL it prints, as the `url` of a `format: "image"` setting rendered through the `responsive-media` snippet - never a hand-written `<img>`. See "Images" below for the detail and for how this changes once a server is running. Getting this wrong is quiet rather than loud: the page still renders, the image is simply missing.
+6. Preview the result, then run `npm run check` before considering the task done - it renders every page for real and fails on any image or link pointing at a file that does not exist, which is the fastest way to catch a misplaced image. See "Previewing your work".
 
 ### Worked example - a section
 
@@ -46,6 +47,14 @@ This scaffold already ships real, working examples worth reading before writing
 <section class="hero" data-section-id="{{ section.id }}">
   <h1>{{ section.settings.heading }}</h1>
   {% if section.settings.subheading %}<p>{{ section.settings.subheading }}</p>{% endif %}
+  {% if section.settings.image.url %}
+    {% render 'responsive-media',
+         media: section.settings.image,
+         kind: 'image',
+         field: 'image',
+         alt: section.settings.heading,
+         ratio: '16 / 9' %}
+  {% endif %}
   <div class="hero__blocks">{% for html in blocksHtml %}{{ html | raw }}{% endfor %}</div>
 </section>
 {% schema %}
@@ -55,7 +64,8 @@ This scaffold already ships real, working examples worth reading before writing
   "required": ["heading"],
   "properties": {
     "heading": { "type": "string", "minLength": 1, "default": "New section" },
-    "subheading": { "type": "string" }
+    "subheading": { "type": "string" },
+    "image": { "type": "object", "format": "image" }
   }
 }
 {% endschema %}
@@ -101,6 +111,8 @@ Write the description as one short sentence about what the section **is**, not w
 
 Flat `.liquid` files in `snippets/`, invoked with `{% render 'name', param1: value %}` - never `{% include %}`. A snippet only sees parameters explicitly passed to it; the calling scope never leaks in.
 
+This scaffold ships one you must use: **`snippets/responsive-media.liquid`, through which every content image and video is rendered.** It emits the attribute that lets an editor drag a file from the media library straight onto the picture in the live preview. See "Making an image or video droppable" below, and `theme/sections/hero.liquid` / `theme/sections/cta-banner.liquid` for real call sites.
+
 ## Field format hints
 
 Every setting is plain JSON Schema (`string`, `integer`, `number`, `boolean`, `array`, with `minLength`/`minimum`/`enum`/etc. for real validation). One extra keyword, `"format"`, is a UI hint only (never validated server-side) that the admin reads to choose a richer input widget:
@@ -108,7 +120,8 @@ Every setting is plain JSON Schema (`string`, `integer`, `number`, `boolean`, `a
 | `format` | On type | Effect |
 |---|---|---|
 | `richtext` | `string` | Rich-text editor; render with `{{ ... | raw }}`, not plain `{{ }}` |
-| `image` | `object` | Image picker with focal point; object shape is exactly `{ "url": "...", "focalX": 0.5, "focalY": 0.5 }` - render `{{ section.settings.<field>.url }}` |
+| `image` | `object` | Image picker with focal point; object shape is exactly `{ "url": "...", "focalX": 0.5, "focalY": 0.5 }`. **Render it with `{% render 'responsive-media' %}`, never a hand-written `<img>`** - see "Making an image or video droppable" below |
+| `video` | `object` | Video picker for a short, silent background loop; object shape is exactly `{ "url": "...", "poster": "..." }`. **Render it with `{% render 'responsive-media' %}`, never a hand-written `<video>`** - see "Making an image or video droppable" below. The snippet sets the poster for you, which matters because the poster is what shows before the clip loads and whenever it cannot play. Only `.mp4`/`.webm` can be uploaded, under the same 10MB media cap - long-form video belongs on YouTube/Vimeo as an embed, not here. No focal point: a loop is played as a background rather than cropped around a subject |
 | `textarea` | `string` | Multi-line `<textarea>` |
 | `uri` | `string` | `<input type="url">` |
 | `date` | `string` | `<input type="date">`, value as `YYYY-MM-DD` |
@@ -186,6 +199,11 @@ Every type/format combination above needs nothing beyond what triggers it - no `
   "format": "image"
 }
 
+"backgroundLoop": {
+  "type": "object",
+  "format": "video"
+}
+
 "tags": {
   "type": "array",
   "items": { "type": "string" }
@@ -308,13 +326,61 @@ Each entry in `sections` requires `id` (any non-empty string, unique within the
 
 ## Images
 
-Uploads go through `POST /v1/media` (multipart, requires a token with `media` scope) or the admin's own media library UI - never write directly into `media/` from an agent, since the CMS names files by content hash. A successful upload returns `{ "url": "/media/<name>" }`. In theme content, an image is just a plain string setting holding that URL:
+**Every content image lives in `media/`, named by the CMS itself - never placed there, or anywhere else in the repo, by hand.** If you are generating a site and have image files to use, `seed-media` (below) is the way to get them in; it is step 5 of the workflow above. Images do not go in the site root, in `theme/root/`, or in `theme/assets/` (that folder is for design assets - CSS, JS, icons).
+
+**One image is one file and one URL. The CMS does not generate resized variants, and you must not hand-build them.** Do not produce fixed-width copies of a photo, do not write a `srcset` listing several generated files, and do not add a build step that emits them. Server-side resizing is a deliberately deferred feature - there is no image processing in the CMS at all - so hand-made variants are files nothing manages: the media library cannot show them as one image, and an editor replacing the picture gets the original swapped while every variant silently keeps the old photo. Reference the single `/media/` URL and let the browser scale it, with CSS (`max-width: 100%`, `object-fit`) doing the responsive work. `width`/`height` attributes and `loading="lazy"` are worth setting; multiple sources are not available.
+
+Once a server is running, uploads go through `POST /v1/media` (multipart, requires a token with `media` scope) or the admin's own media library UI - never write directly into `media/` from an agent, since the CMS names files by content hash. A successful upload returns `{ "url": "/media/<name>" }`. In theme content, **an image is a `format: "image"` object setting, never a plain string** - and a short silent loop is a `format: "video"` one:
 
 ```json
-{ "type": "string", "default": "" }
+"image": { "type": "object", "format": "image" }
 ```
 
-unless the design needs a focal point for a cropped image, in which case use `"format": "image"` (see the table above) instead of a plain string.
+This is not a stylistic preference. The admin's picker, the focal point, and drag-and-drop replacement all work on that object shape (`{ "url", "focalX", "focalY" }`; a video stores `{ "url", "poster" }`). A plain string setting gets a bare text box and nothing else - and since dropping an image writes the object shape, dragging onto a field declared as a string fails validation outright. Use a plain string only for a path that is never editable content, such as a theme asset bundled under `theme/assets/`.
+
+### Making an image or video droppable
+
+Render every content image and video through the `responsive-media` snippet the scaffold ships in `theme/snippets/` - see `hero.liquid` and `cta-banner.liquid` for working call sites:
+
+```liquid
+{% if section.settings.image.url %}
+  {% render 'responsive-media',
+       media: section.settings.image,
+       kind: 'image',
+       field: 'image',
+       alt: 'What is actually in the picture',
+       ratio: '16 / 9' %}
+{% endif %}
+```
+
+A video is the same call with `kind: 'video'` and the video setting - the snippet handles the `<video>`, the poster and the autoplay/muted/loop attributes itself:
+
+```liquid
+{% if section.settings.backgroundLoop.url %}
+  {% render 'responsive-media',
+       media: section.settings.backgroundLoop,
+       kind: 'video',
+       field: 'backgroundLoop',
+       ratio: '21 / 9' %}
+{% endif %}
+```
+
+Parameters:
+
+| Parameter | Effect |
+|---|---|
+| `media` | **Required.** The whole setting object, not its `.url` - the snippet reads `url`, and `focalX`/`focalY` or `poster` from it |
+| `field` | **Required.** The schema property name this renders. A drop writes the new URL back to exactly this key, so a wrong value silently writes to the wrong setting |
+| `kind` | `'image'` (the default) or `'video'` |
+| `alt` | Real alt text describing what is in the picture. On a video it becomes an `aria-label`; omit it for a purely decorative loop and the clip is marked `aria-hidden` instead |
+| `ratio` | Any CSS `aspect-ratio` value, e.g. `'16 / 9'`. Defaults to `'3 / 2'` |
+| `loading` | `'eager'` for anything above the fold, otherwise omit - it defaults to `lazy`. Lazy-loading a hero image delays the largest thing on the page |
+| `priority` | `true` adds `fetchpriority="high"`. The hero image only, never more than one per page |
+| `class` | Extra classes on the wrapper element |
+
+The snippet puts `data-cms-media="<field>"` on the element it renders (plus `data-cms-image` for images). **That attribute is the whole contract.** The admin finds a drop target by searching the previewed page for it, and uses its value to know which setting to write the new URL into, so `field` must match the schema property name exactly. A hand-written `<img>` without it renders perfectly and is simply never droppable - a silent gap, because nothing about the page looks wrong, which is exactly how a real generated site shipped with every image un-editable.
+
+Guard the call on the url, as above. An unset image renders nothing at all rather than a placeholder: a theme cannot tell whether it is rendering for the admin preview or the public site, so an editor-only affordance would show to real visitors. The first image is set through the Fields panel's own picker; drag-and-drop replaces it from then on.
 
 If you're writing starter content before a server is even running - so `POST /v1/media` isn't reachable yet - use the `seed-media` CLI instead of placing images under `theme/root/`. It computes the exact same content-addressed filename a real upload would, so the result is indistinguishable from one:
 
@@ -324,10 +390,14 @@ npx seed-media <site-directory> photo.jpg another.png
 # another.png -> /media/another-91cd4a08f2b1.png
 ```
 
-Then use the printed URL exactly like a real upload's:
+Then use the printed URL as the `url` of a `format: "image"` setting, exactly like a real upload's - not as a plain string:
 
 ```json
-{ "type": "string", "default": "/media/photo-3f9a2b7c1e04.jpg" }
+"image": {
+  "type": "object",
+  "format": "image",
+  "default": { "url": "/media/photo-3f9a2b7c1e04.jpg", "focalX": 0.5, "focalY": 0.5 }
+}
 ```
 
 This is only for seeding starter content offline - once a server is running, a later image change from an editor still goes through `POST /v1/media` or the admin's media library as normal.

package/dist/create-site/template/theme/assets/style.css

@@ -1000,6 +1000,74 @@ section {
 }
 
 /* ----- CTA banner ----- */
+/* responsive-media snippet -------------------------------------------
+   One wrapper for both an image and a video, so a section does not care
+   which it was given. The aspect ratio comes in as a custom property
+   from the snippet's own `ratio` parameter. */
+.media {
+  position: relative;
+  overflow: hidden;
+  aspect-ratio: var(--media-ratio, 3 / 2);
+  border-radius: 12px;
+  background: rgba(255, 255, 255, 0.04);
+}
+
+.media img,
+.media video {
+  display: block;
+  width: 100%;
+  height: 100%;
+  object-fit: cover;
+}
+
+/* The empty slot. Visibly a placeholder rather than a broken image, and
+   still a drop target - dragging a file onto it is how it gets filled. */
+.media--empty {
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  padding: 1rem;
+  border: 1px dashed rgba(255, 255, 255, 0.25);
+  background: rgba(255, 255, 255, 0.02);
+}
+
+.media__hint {
+  max-width: 22ch;
+  text-align: center;
+  font-size: 0.8rem;
+  line-height: 1.4;
+  opacity: 0.6;
+}
+
+/* An autoplaying loop is motion the viewer did not ask for, and no
+   amount of CSS can stop a video element autoplaying - but hiding it
+   and painting its own poster in its place gets the same result, so a
+   reduced-motion viewer sees the still rather than the movement. */
+@media (prefers-reduced-motion: reduce) {
+  .media--has-poster {
+    background-image: var(--media-poster);
+    background-size: cover;
+    background-position: center;
+  }
+
+  .media--has-poster video {
+    display: none;
+  }
+}
+
+.hero__media {
+  width: 100%;
+}
+
+/* Sits behind the banner's own copy rather than beside it. */
+.cta-banner__media {
+  position: absolute;
+  inset: 0;
+  z-index: 0;
+  border-radius: inherit;
+  opacity: 0.35;
+}
+
 .cta-banner {
   background: var(--color-dark);
   color: var(--color-dark-ink);
@@ -1019,6 +1087,8 @@ section {
 }
 
 .cta-banner__inner {
+  position: relative;
+  z-index: 1;
   position: relative;
   z-index: 1;
   max-width: 560px;

package/dist/create-site/template/theme/sections/cta-banner.liquid

@@ -1,6 +1,14 @@
 <section data-section-id="{{ section.id }}">
   <div class="container">
     <div class="cta-banner reveal">
+      {% if section.settings.backgroundLoop.url %}
+        {% render 'responsive-media',
+             media: section.settings.backgroundLoop,
+             kind: 'video',
+             field: 'backgroundLoop',
+             ratio: '21 / 9',
+             class: 'cta-banner__media' %}
+      {% endif %}
       <div class="cta-banner__inner">
         <h2>{{ section.settings.heading }}</h2>
         {% if section.settings.subheading %}<p>{{ section.settings.subheading }}</p>{% endif %}
@@ -20,7 +28,8 @@
   "required": ["heading"],
   "properties": {
     "heading": { "type": "string", "minLength": 1, "default": "Ready to get started?" },
-    "subheading": { "type": "string" }
+    "subheading": { "type": "string" },
+    "backgroundLoop": { "type": "object", "format": "video" }
   },
   "allowedBlocks": ["button"]
 }

package/dist/create-site/template/theme/sections/hero.liquid

@@ -6,7 +6,18 @@
       {% if section.settings.subheading %}<p>{{ section.settings.subheading }}</p>{% endif %}
       <div class="hero__actions">{% for html in blocksHtml %}{{ html | raw }}{% endfor %}</div>
     </div>
-    {% if section.settings.codeSnippet %}
+    {% if section.settings.image.url %}
+      {% render 'responsive-media',
+           media: section.settings.image,
+           kind: 'image',
+           field: 'image',
+           alt: section.settings.heading,
+           ratio: '4 / 3',
+           loading: 'eager',
+           priority: true,
+           need: 'The main hero image',
+           class: 'hero__media reveal' %}
+    {% elsif section.settings.codeSnippet %}
       <div class="code-panel reveal">
         <div class="code-panel__bar">
           <span></span><span></span><span></span>
@@ -28,6 +39,7 @@
     "eyebrow": { "type": "string" },
     "heading": { "type": "string", "minLength": 1, "default": "New Section" },
     "subheading": { "type": "string" },
+    "image": { "type": "object", "format": "image" },
     "codeTitle": { "type": "string" },
     "codeSnippet": { "type": "string" }
   },

package/dist/create-site/template/theme/snippets/responsive-media.liquid

@@ -0,0 +1,107 @@
+{%- comment -%}
+  responsive-media - the only way a content image or video should reach a page.
+
+  Renders a `format: "image"` or `format: "video"` setting, and marks the
+  result as a drag-and-drop target so an editor can drag a file from the
+  admin's media library straight onto it in the live preview.
+
+    {% render 'responsive-media',
+         media: section.settings.image,   the whole setting object, not .url
+         kind: 'image',                   'image' or 'video'
+         field: 'image',                  REQUIRED - the settings key this
+                                          renders, which is what a drop writes
+                                          back to
+         alt: 'What is actually in the picture',
+         ratio: '16 / 9',                 any CSS aspect-ratio value
+         loading: 'eager',                'eager' above the fold, else lazy
+         priority: true,                  adds fetchpriority=high
+         need: 'Wide shot of the still house',   shown in the empty slot
+         class: 'extra-class' %}
+
+  Why `field` matters
+  -------------------
+  The admin finds a drop target by looking for data-cms-media, and uses its
+  value to know which setting to write the new URL into. Get it wrong and the
+  drop silently writes to the wrong field; omit it and the image simply is not
+  droppable. It must match the schema property name exactly.
+
+  An empty slot is NOT a drop target (decided directly). A theme has no way to
+  tell whether it is rendering for the admin preview or for the public site -
+  the renderer does not expose that - so an editor-only affordance would leak
+  onto the live site as a dashed box in front of real visitors. Guard the call
+  instead, exactly as hero.liquid and cta-banner.liquid do:
+
+    {% if section.settings.image.url %}{% render 'responsive-media', ... %}{% endif %}
+
+  so a section with nothing set renders nothing at all. Set the first image
+  through the Fields panel's own picker; drag-and-drop then replaces it.
+
+  No srcset, on purpose
+  ---------------------
+  The CMS names uploaded files by a hash of their own bytes, so a resized
+  variant gets a completely different name - "photo-480w.webp" is not
+  derivable from "photo-3f9a2b7c1e04.jpg". Hand-built variant URLs therefore
+  point at files that do not exist, which renders a page that looks perfectly
+  fine except at one breakpoint. Do not add a srcset here. One image is one
+  file and one URL; let CSS do the responsive work.
+{%- endcomment -%}
+{%- assign media_kind = kind | default: 'image' -%}
+{%- assign media_field = field | default: 'image' -%}
+{%- assign media_url = media.url -%}
+{%- capture ratio_style -%}--media-ratio: {{ ratio | default: '3 / 2' }};{%- endcapture -%}
+
+{%- if media_url == nil or media_url == '' -%}
+  {%- comment -%}
+    Reached only if a caller renders this without guarding on a url - the
+    scaffold's own call sites guard, so this never appears on a real page.
+    Kept as a graceful fallback for a theme that genuinely wants a visible
+    placeholder, and deliberately carrying NO drag attributes: see above.
+  {%- endcomment -%}
+  <div class="media media--empty {{ class }}"
+       style="{{ ratio_style }}"
+       role="img"
+       aria-label="Placeholder. {{ need | default: alt }}">
+    <span class="media__hint">{{ need | default: alt | default: 'Drag a file here' }}</span>
+  </div>
+{%- elsif media_kind == 'video' -%}
+  {%- comment -%}
+    No data-cms-image on a video: an older admin understands only that
+    attribute and would write an image-shaped value ({url, focalX, focalY})
+    over this field's own {url, poster}. Better it ignores the slot entirely
+    than corrupts it.
+
+    A background loop is muted and looping by definition, so it may autoplay.
+    The poster is what shows before the clip loads and wherever it will not
+    play at all, which is why it is worth setting rather than optional.
+  {%- endcomment -%}
+  <div class="media {{ class }}{% if media.poster and media.poster != '' %} media--has-poster{% endif %}"
+       style="{{ ratio_style }}{% if media.poster and media.poster != '' %} --media-poster: url('{{ media.poster }}');{% endif %}"
+       data-cms-media="{{ media_field }}"
+       data-cms-media-kind="video">
+    <video
+      src="{{ media_url }}"
+      {% if media.poster and media.poster != '' %}poster="{{ media.poster }}"{% endif %}
+      autoplay
+      muted
+      loop
+      playsinline
+      preload="metadata"
+      {% if alt and alt != '' %}aria-label="{{ alt }}"{% else %}aria-hidden="true"{% endif %}></video>
+  </div>
+{%- else -%}
+  {%- assign fx = media.focalX | default: 0.5 | times: 100 | round: 1 -%}
+  {%- assign fy = media.focalY | default: 0.5 | times: 100 | round: 1 -%}
+  <div class="media {{ class }}"
+       style="{{ ratio_style }}"
+       data-cms-media="{{ media_field }}"
+       data-cms-media-kind="image"
+       data-cms-image="{{ media_field }}">
+    <img
+      src="{{ media_url }}"
+      alt="{{ alt }}"
+      loading="{{ loading | default: 'lazy' }}"
+      decoding="async"
+      {% if priority %}fetchpriority="high"{% endif %}
+      style="object-position: {{ fx }}% {{ fy }}%;">
+  </div>
+{%- endif -%}

package/dist/media/filename.js

@@ -21,8 +21,15 @@ import { basename, extname } from 'node:path';
 // lowercase, non [a-z0-9-] runs collapsed to a single "-", trimmed -
 // not a second, independently-invented convention.
 const HASH_LENGTH = 12;
-// Images only - confirmed with the user, not a general document
-// library. .svg is rejected regardless of this list even though it's
+// Images and short videos - not a general document library. Video was
+// added deliberately (confirmed with the user) for silent looping
+// clips used where a hero image would otherwise go; long-form video
+// belongs on YouTube/Vimeo and needs nothing from here. The upload cap
+// (site.config.json's media.maxUploadBytes, 10MB by default) is what
+// keeps that distinction honest - it comfortably fits a well-compressed
+// 10-15s loop and comfortably rejects a real film.
+//
+// .svg is rejected regardless of this list even though it's
 // technically an image format - docs/cms-build-plan.md's own "SVG
 // rejected outright, not sanitised" decision (a real stored-XSS path
 // otherwise: mime-types.ts maps .svg to a real image/svg+xml content
@@ -33,7 +40,7 @@ const HASH_LENGTH = 12;
 // constant, specifically so seed-media.ts (an offline tool with no
 // HTTP request to validate) enforces the exact same rule rather than
 // a second, independently-maintained copy of it.
-export const ALLOWED_UPLOAD_EXTENSIONS = new Set(['.jpg', '.jpeg', '.png', '.gif', '.webp']);
+export const ALLOWED_UPLOAD_EXTENSIONS = new Set(['.jpg', '.jpeg', '.png', '.gif', '.webp', '.mp4', '.webm']);
 export function buildMediaFilename(originalFilename, bytes) {
     const hash = createHash('sha256').update(bytes).digest('hex').slice(0, HASH_LENGTH);
     const base = basename(originalFilename, extname(originalFilename));

package/dist/routes/media-public.d.ts

@@ -1,5 +1,11 @@
 import type { FastifyPluginAsync } from 'fastify';
 import type { SiteConfig } from '../config.ts';
+type ResolvedRange = {
+    start: number;
+    end: number;
+} | null | 'unsatisfiable';
+export declare function resolveRange(header: string | undefined, size: number): ResolvedRange;
 export declare const mediaPublicRoutes: FastifyPluginAsync<{
     config: SiteConfig;
 }>;
+export {};

package/dist/routes/media-public.js

@@ -1,5 +1,40 @@
 import { openLocalFsMediaDriver } from "../media/drivers/local-fs-driver.js";
 import { mimeTypeFor } from "../services/mime-types.js";
+export function resolveRange(header, size) {
+    if (header === undefined) {
+        return null;
+    }
+    const match = /^bytes=(\d*)-(\d*)$/.exec(header.trim());
+    if (!match) {
+        return null;
+    }
+    const [, rawStart, rawEnd] = match;
+    if (rawStart === '' && rawEnd === '') {
+        return null;
+    }
+    // "bytes=-500" means the LAST 500 bytes, not "from 0 to 500" - a
+    // classic misreading, and one that silently serves the wrong part of
+    // a file rather than failing.
+    if (rawStart === '') {
+        const suffixLength = Number(rawEnd);
+        if (suffixLength === 0) {
+            return 'unsatisfiable';
+        }
+        return { start: Math.max(0, size - suffixLength), end: size - 1 };
+    }
+    const start = Number(rawStart);
+    if (start >= size) {
+        return 'unsatisfiable';
+    }
+    // An end past the last byte is clamped, not rejected: browsers
+    // routinely ask for more than exists (e.g. bytes=0-999999 on a small
+    // file) and expect the server to simply return what it has.
+    const end = rawEnd === '' ? size - 1 : Math.min(Number(rawEnd), size - 1);
+    if (end < start) {
+        return 'unsatisfiable';
+    }
+    return { start, end };
+}
 async function handleMediaRequest(request, reply, config) {
     const relativePath = request.params['*'];
     // Never read: Fastify doesn't require query params to be declared or
@@ -30,12 +65,48 @@ async function handleMediaRequest(request, reply, config) {
     // because filenames are content-addressed (a hash of the file's own
     // bytes, see media/filename.ts): a given URL's content can never
     // change, so there is no invalidation case to ever design for here.
+    // Accept-Ranges on every media response, not just ranged ones - it is
+    // how a client learns ranges are available at all before asking.
+    //
+    // This matters far beyond scrubbing: Safari and iOS open a <video>
+    // with "Range: bytes=0-1" and will refuse to play at all if answered
+    // with a plain 200, so range support is what makes video work in
+    // those browsers rather than an optimisation. It also lets
+    // preload="metadata" fetch just the header instead of pulling the
+    // whole file down to read a duration.
+    //
+    // Sliced from the already-buffered read rather than streamed: the
+    // driver's own get() contract returns a whole Buffer (drivers/
+    // driver.ts) and assets.ts documents reply.send(stream) returning an
+    // empty body in this Fastify version, verified there with a minimal
+    // repro. With uploads capped (10MB by default) the memory held per
+    // request is bounded and no worse than this route's existing
+    // behaviour, so slicing buys correct semantics without taking on
+    // that risk or widening the driver interface a future object-storage
+    // driver would have to satisfy.
     reply
         .header('X-Content-Type-Options', 'nosniff')
         .header('Access-Control-Allow-Origin', '*')
         .header('Cache-Control', 'public, max-age=31536000, immutable')
-        .type(mimeTypeFor(relativePath))
-        .send(bytes);
+        .header('Accept-Ranges', 'bytes')
+        .type(mimeTypeFor(relativePath));
+    const range = resolveRange(request.headers.range, bytes.length);
+    if (range === 'unsatisfiable') {
+        // 416 carries its own required Content-Range naming the real size,
+        // which is how a client corrects itself rather than retrying blind.
+        reply.code(416).header('Content-Range', `bytes */${bytes.length}`).send();
+        return;
+    }
+    if (range !== null) {
+        const slice = bytes.subarray(range.start, range.end + 1);
+        reply
+            .code(206)
+            .header('Content-Range', `bytes ${range.start}-${range.end}/${bytes.length}`)
+            .header('Content-Length', slice.length)
+            .send(slice);
+        return;
+    }
+    reply.send(bytes);
 }
 // Deliberately and permanently unauthenticated, same reasoning as
 // assets.ts: uploaded media must be fetchable by any visitor's browser

package/dist/routes/media.js

@@ -30,7 +30,7 @@ async function handleUploadMedia(request, reply, config) {
         reply.code(415).send({
             statusCode: 415,
             error: 'Unsupported Media Type',
-            message: `"${extension}" is not an accepted image type`,
+            message: `"${extension}" is not an accepted media type`,
         });
         return;
     }

package/dist/services/mime-types.js

@@ -22,6 +22,13 @@ export const MIME_TYPES = {
     '.gif': 'image/gif',
     '.svg': 'image/svg+xml',
     '.webp': 'image/webp',
+    // Video: without these an uploaded .mp4 serves as the
+    // DEFAULT_MIME_TYPE below (application/octet-stream), which every
+    // browser treats as "download this" rather than playing it - and
+    // media-public.ts sets X-Content-Type-Options: nosniff, so nothing
+    // rescues it by sniffing. Same failure robots.txt already hit.
+    '.mp4': 'video/mp4',
+    '.webm': 'video/webm',
     '.ico': 'image/x-icon',
     '.woff': 'font/woff',
     '.woff2': 'font/woff2',

package/dist/services/validation.js

@@ -5,18 +5,18 @@ import { Ajv } from 'ajv';
 // authors, not agent code, and are validated the same lenient way
 // everywhere (see theme-schemas.ts).
 const ajv = new Ajv({ allErrors: true, strict: false });
-// The six format values guide-theme-authoring.md/AGENTS.md actually
-// document (richtext/image/textarea/uri/date/color/range/toggle - uri
-// and date are real standard JSON Schema formats already understood
+// The nine format values guide-theme-authoring.md/AGENTS.md actually
+// document (richtext/image/video/textarea/uri/date/color/range/toggle -
+// uri and date are real standard JSON Schema formats already understood
 // without this) are still, correctly, UI hints only: registering them
 // as a literal no-op format (the `true` here, not a real validator
 // function) doesn't make Ajv enforce anything about them, it only
 // stops it printing "unknown format \"x\" ignored" for values that are
 // completely expected. A theme author's genuine typo (e.g. "iamge")
 // still isn't in this list, so it still warns - this only silences the
-// six we ourselves tell theme authors to use, not unknown-format
+// ones we ourselves tell theme authors to use, not unknown-format
 // warnings in general.
-for (const format of ['richtext', 'image', 'textarea', 'color', 'range', 'toggle']) {
+for (const format of ['richtext', 'image', 'textarea', 'color', 'range', 'toggle', 'video']) {
     ajv.addFormat(format, true);
 }
 const schemasDir = join(import.meta.dirname, '..', 'schemas');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@o-a/cms-agent",
-  "version": "0.3.1",
+  "version": "0.5.0",
   "type": "module",
   "publishConfig": {
     "access": "public"