@rehearsal-db/core 0.1.0-beta.11 → 0.1.0-beta.13

package/src/runtime/plan.mjs

@@ -11,6 +11,10 @@ import { join } from "node:path";
 import { pathToFileURL } from "node:url";
 import { performance } from "node:perf_hooks";
 import { verifyActiveBaseline } from "../baseline/artifact.mjs";
+import {
+  applySupabaseAuthenticationProviders,
+  inspectSupabaseAuthenticationProviderTransition,
+} from "../identity/provider_configuration.mjs";
 import {
   inspectDetectedProject,
   loadRehearsalConfig,
@@ -18,6 +22,10 @@ import {
 import { createCandidateMigrationReceipt } from "./restore.mjs";
 import { readMigrationFileInventory } from "./migration_history.mjs";
 import { REHEARSAL_VERSION } from "../shared/diagnostics.mjs";
+import {
+  inspectRehearsalNodeRuntime,
+  REHEARSAL_NODE_LABEL,
+} from "../shared/node_runtime.mjs";
 import { readRehearsalServiceEnvironment } from "./service_environment.mjs";
 import {
   readBoundRuntimeSanitizationPolicy,
@@ -233,6 +241,9 @@ export const buildRehearsalPlan = async (options = {}) => {
       hostedAccess: config.safety.hostedAccess,
       outboundNetwork: config.safety.outboundNetwork,
       authenticationProviders: config.safety.authenticationProviders,
+      authenticationCallback: config.supabase?.authentication
+        ? `http://127.0.0.1:${config.runtime.ports.api}/auth/v1/callback`
+        : null,
       barriers: [
         "versioned configuration accepts loopback hosts only",
         `runtime uses a dedicated local ${config.runtime.target === "supabase" ? "Supabase workdir" : "PostgreSQL container and volume"} and project id`,
@@ -350,17 +361,17 @@ export const runRehearsalDoctor = async (options = {}) => {
     };
   }
   const { config, paths, projectRoot } = loaded;
-  const nodeMajor = Number(process.versions.node.split(".")[0]);
+  const nodeRuntime = inspectRehearsalNodeRuntime();
   const checkDefinitions = [
     {
       id: "node",
       label: "Node.js compatibility",
       run: async () => {
-        if (nodeMajor !== 24)
+        if (!nodeRuntime.supported)
           throw new Error(`Node ${process.versions.node} is unsupported.`);
         return `Node ${process.versions.node}`;
       },
-      remediation: "Use Node.js 24.",
+      remediation: `Use ${REHEARSAL_NODE_LABEL}. Node.js 24 LTS is recommended.`,
     },
     {
       id: "operating-system",
@@ -459,6 +470,32 @@ export const runRehearsalDoctor = async (options = {}) => {
       remediation:
         "Correct the missing project path in the Rehearsal configuration.",
     },
+    ...(config.supabase?.authentication
+      ? [
+          {
+            id: "authentication-runtime-config",
+            label: "Local authentication configuration",
+            run: async () => {
+              const source = await readFile(paths.rehearsalConfig, "utf8");
+              const transition =
+                inspectSupabaseAuthenticationProviderTransition({
+                  source,
+                  authentication: config.supabase.authentication,
+                });
+              applySupabaseAuthenticationProviders({
+                source,
+                authentication: config.supabase.authentication,
+                apiPort: config.runtime.ports.api,
+              });
+              return transition.replacedProviders.length
+                ? `compatible legacy ${transition.replacedProviders.join(", ")} provider configuration will be replaced only in the disposable runtime copy`
+                : "declarative provider configuration can be generated without changing the tracked template";
+            },
+            remediation:
+              "Review the named provider section and make skipNonceCheck or emailOptional match explicitly in config.supabase.authentication; otherwise keep the documented manual provider configuration.",
+          },
+        ]
+      : []),
     {
       id: "sanitization-policy",
       label: "Reviewed sanitization policy",

package/src/runtime/restore.mjs

@@ -194,11 +194,19 @@ const buildIdentitySequenceSql = (table) =>
       const schema = tableSchema(table);
       const relation = qualifiedRelation(table);
       const columnName = quoteIdentifier(column.name);
-      return `select setval(
-	pg_get_serial_sequence(${quoteLiteral(`${schema}.${table.name}`)}, ${quoteLiteral(column.name)}),
-	coalesce((select max(${columnName}) from ${relation}), 1),
-	exists(select 1 from ${relation})
-);`;
+      const sequenceValueQuery = `select max(${columnName})::bigint, exists(select 1 from ${relation}) from ${relation}`;
+      return `do $rehearsal_sequence$
+declare
+	sequence_name text := pg_get_serial_sequence(${quoteLiteral(`${schema}.${table.name}`)}, ${quoteLiteral(column.name)});
+	maximum_value bigint;
+	has_rows boolean;
+begin
+	if sequence_name is not null then
+		execute ${quoteLiteral(sequenceValueQuery)} into maximum_value, has_rows;
+		perform setval(sequence_name, coalesce(maximum_value, 1), has_rows);
+	end if;
+end
+$rehearsal_sequence$;`;
     })
     .join("\n");
 

package/src/shared/diagnostics.mjs

@@ -94,6 +94,13 @@ export class RehearsalError extends Error {
 const inferCategory = (error) => {
   const message = String(error?.message ?? error);
   if (/checksum/iu.test(message)) return "baseline_checksum_mismatch";
+  if (
+    /container\b.*\b(?:is not ready|starting|unhealthy)|health(?:check)?\b.*\b(?:failed|starting|unhealthy)|out of memory|\boom\b|no space left|resource temporarily unavailable/iu.test(
+      message,
+    )
+  ) {
+    return "runtime_dependency_failure";
+  }
   if (/candidate|migration history diverges/iu.test(message)) {
     return "migration_candidate_failure";
   }

package/src/shared/node_runtime.mjs

@@ -0,0 +1,31 @@
+/**
+ * Supported Node.js release lines. Keep this aligned with package.json and the
+ * verification matrix.
+ */
+
+export const REHEARSAL_NODE_MAJORS = Object.freeze([22, 24, 26]);
+export const REHEARSAL_NODE_LABEL = "Node.js 22, 24, or 26";
+export const REHEARSAL_RECOMMENDED_NODE_MAJOR = 24;
+
+export const inspectRehearsalNodeRuntime = (
+  version = process.versions.node,
+) => {
+  const major = Number.parseInt(String(version).split(".")[0], 10);
+  return {
+    version: String(version),
+    major,
+    supported: REHEARSAL_NODE_MAJORS.includes(major),
+  };
+};
+
+export const assertSupportedRehearsalNodeRuntime = (
+  version = process.versions.node,
+) => {
+  const runtime = inspectRehearsalNodeRuntime(version);
+  if (!runtime.supported) {
+    throw new Error(
+      `Rehearsal requires ${REHEARSAL_NODE_LABEL}; this shell is using Node.js ${runtime.version}. Switch to a supported release, then rerun setup. With nvm: nvm install --lts && nvm use --lts.`,
+    );
+  }
+  return runtime;
+};

package/src/source/access.mjs

@@ -50,6 +50,13 @@ const positiveInteger = (value, label) => {
 const canonicalJson = (value) => `${JSON.stringify(value, null, "\t")}\n`;
 const sha256 = (value) => createHash("sha256").update(value).digest("hex");
 
+export const externalViewDefinitionFingerprint = (definition) => {
+  if (typeof definition !== "string" || !definition.trim()) {
+    throw new Error("External view definition must be a non-empty string.");
+  }
+  return sha256(definition.trim());
+};
+
 export const sourceTargetFingerprint = (connectionString) => {
   let target;
   try {
@@ -95,24 +102,74 @@ export const validateSourceAccessPolicy = (policy) => {
     throw new Error("Source access policy must use accessVersion 1.");
   }
   fingerprint(policy.targetFingerprint, "sourcePolicy.targetFingerprint");
-  envKey(
-    policy.administratorEnvironmentVariable,
-    "sourcePolicy.administratorEnvironmentVariable",
-  );
   if (!isObject(policy.reader))
     throw new Error("sourcePolicy.reader must be an object.");
+  const readerMode = policy.reader.mode ?? "managed";
+  if (!["managed", "external"].includes(readerMode)) {
+    throw new Error("sourcePolicy.reader.mode must be managed or external.");
+  }
   knownKeys(
     policy.reader,
-    ["role", "ownerRole", "credentialFile", "validForMinutes"],
+    readerMode === "managed"
+      ? ["mode", "role", "ownerRole", "credentialFile", "validForMinutes"]
+      : [
+          "mode",
+          "role",
+          "connectionEnvironmentVariable",
+          "credentialFile",
+          "maximumValidForMinutes",
+        ],
     "sourcePolicy.reader",
   );
+  let administratorEnvironmentVariable;
+  if (readerMode === "managed") {
+    administratorEnvironmentVariable = envKey(
+      policy.administratorEnvironmentVariable,
+      "sourcePolicy.administratorEnvironmentVariable",
+    );
+  } else if (policy.administratorEnvironmentVariable !== undefined) {
+    throw new Error(
+      "sourcePolicy.administratorEnvironmentVariable is not allowed for an external reader.",
+    );
+  }
   const role = identifier(policy.reader.role, "sourcePolicy.reader.role");
-  const ownerRole = identifier(
-    policy.reader.ownerRole,
-    "sourcePolicy.reader.ownerRole",
-  );
-  if (role === ownerRole)
-    throw new Error("Source reader and owner roles must differ.");
+  let ownerRole;
+  let validForMinutes;
+  let connectionEnvironmentVariable;
+  let maximumValidForMinutes;
+  if (readerMode === "managed") {
+    ownerRole = identifier(
+      policy.reader.ownerRole,
+      "sourcePolicy.reader.ownerRole",
+    );
+    if (role === ownerRole)
+      throw new Error("Source reader and owner roles must differ.");
+    if (
+      !Number.isSafeInteger(policy.reader.validForMinutes) ||
+      policy.reader.validForMinutes < 5 ||
+      policy.reader.validForMinutes > 240
+    ) {
+      throw new Error(
+        "sourcePolicy.reader.validForMinutes must be from 5 through 240.",
+      );
+    }
+    validForMinutes = policy.reader.validForMinutes;
+  } else {
+    connectionEnvironmentVariable = envKey(
+      policy.reader.connectionEnvironmentVariable,
+      "sourcePolicy.reader.connectionEnvironmentVariable",
+    );
+    if (
+      !Number.isSafeInteger(policy.reader.maximumValidForMinutes) ||
+      policy.reader.maximumValidForMinutes < 5 ||
+      policy.reader.maximumValidForMinutes > 240
+    ) {
+      throw new Error(
+        "sourcePolicy.reader.maximumValidForMinutes must be from 5 through 240.",
+      );
+    }
+    maximumValidForMinutes = policy.reader.maximumValidForMinutes;
+  }
   if (
     typeof policy.reader.credentialFile !== "string" ||
     !policy.reader.credentialFile.startsWith(".rehearsal/") ||
@@ -122,15 +179,6 @@ export const validateSourceAccessPolicy = (policy) => {
       "sourcePolicy.reader.credentialFile must stay under .rehearsal/.",
     );
   }
-  if (
-    !Number.isSafeInteger(policy.reader.validForMinutes) ||
-    policy.reader.validForMinutes < 5 ||
-    policy.reader.validForMinutes > 240
-  ) {
-    throw new Error(
-      "sourcePolicy.reader.validForMinutes must be from 5 through 240.",
-    );
-  }
   const exportSchema = identifier(
     policy.exportSchema,
     "sourcePolicy.exportSchema",
@@ -185,6 +233,7 @@ export const validateSourceAccessPolicy = (policy) => {
         "columns",
         "orderBy",
         "rowScope",
+        "viewDefinitionSha256",
       ],
       label,
     );
@@ -235,6 +284,17 @@ export const validateSourceAccessPolicy = (policy) => {
       throw new Error(`${label}.orderBy must name unique exported columns.`);
     }
     const orderBy = Object.freeze([...relation.orderBy]);
+    let viewDefinitionSha256;
+    if (readerMode === "external") {
+      viewDefinitionSha256 = fingerprint(
+        relation.viewDefinitionSha256,
+        `${label}.viewDefinitionSha256`,
+      );
+    } else if (relation.viewDefinitionSha256 !== undefined) {
+      throw new Error(
+        `${label}.viewDefinitionSha256 is supported only for an external reader.`,
+      );
+    }
     if (!isObject(relation.rowScope))
       throw new Error(`${label}.rowScope must be an object.`);
     knownKeys(
@@ -282,6 +342,7 @@ export const validateSourceAccessPolicy = (policy) => {
       columns,
       orderBy,
       rowScope,
+      ...(viewDefinitionSha256 ? { viewDefinitionSha256 } : {}),
     });
   });
   const assets = policy.assets ?? [];
@@ -290,29 +351,79 @@ export const validateSourceAccessPolicy = (policy) => {
   const normalizedAssets = assets.map((asset, index) => {
     const label = `sourcePolicy.assets[${index}]`;
     if (!isObject(asset)) throw new Error(`${label} must be an object.`);
-    knownKeys(asset, ["bucket", "prefix", "rights"], label);
+    knownKeys(
+      asset,
+      [
+        "bucket",
+        "prefix",
+        "prefixEnvironmentVariable",
+        "rights",
+        "pathMapping",
+      ],
+      label,
+    );
     if (!/^[a-z0-9][a-z0-9.-]{0,99}$/u.test(asset.bucket ?? "")) {
       throw new Error(`${label}.bucket is invalid.`);
     }
-    const prefixParts =
-      typeof asset.prefix === "string"
-        ? asset.prefix.replace(/\/$/u, "").split("/")
-        : [];
-    if (
-      typeof asset.prefix !== "string" ||
-      !asset.prefix ||
-      asset.prefix.startsWith("/") ||
-      prefixParts.some((part) => !part || part === "." || part === "..")
-    ) {
-      throw new Error(`${label}.prefix is unsafe.`);
+    const hasFixedPrefix = asset.prefix !== undefined;
+    const hasPrivatePrefix = asset.prefixEnvironmentVariable !== undefined;
+    if (hasFixedPrefix === hasPrivatePrefix) {
+      throw new Error(
+        `${label} must declare exactly one of prefix or prefixEnvironmentVariable.`,
+      );
+    }
+    if (hasFixedPrefix) {
+      const prefixParts =
+        typeof asset.prefix === "string"
+          ? asset.prefix.replace(/\/$/u, "").split("/")
+          : [];
+      if (
+        typeof asset.prefix !== "string" ||
+        !asset.prefix ||
+        asset.prefix.startsWith("/") ||
+        prefixParts.some((part) => !part || part === "." || part === "..")
+      ) {
+        throw new Error(`${label}.prefix is unsafe.`);
+      }
+    } else {
+      envKey(
+        asset.prefixEnvironmentVariable,
+        `${label}.prefixEnvironmentVariable`,
+      );
     }
     if (!["approved-public", "approved-owner"].includes(asset.rights)) {
       throw new Error(`${label}.rights must be explicitly approved.`);
     }
+    if (
+      asset.pathMapping !== undefined &&
+      !/^[a-z][a-z0-9-]{0,62}$/u.test(asset.pathMapping)
+    ) {
+      throw new Error(`${label}.pathMapping is invalid.`);
+    }
+    if (hasPrivatePrefix && asset.rights !== "approved-owner") {
+      throw new Error(
+        `${label}.prefixEnvironmentVariable requires approved-owner rights.`,
+      );
+    }
+    if (hasPrivatePrefix && asset.pathMapping === undefined) {
+      throw new Error(
+        `${label}.prefixEnvironmentVariable requires pathMapping.`,
+      );
+    }
+    if (hasFixedPrefix && asset.pathMapping !== undefined) {
+      throw new Error(
+        `${label}.pathMapping requires prefixEnvironmentVariable so the raw identity stays out of tracked policy.`,
+      );
+    }
     return Object.freeze({
       bucket: asset.bucket,
-      prefix: asset.prefix,
+      ...(hasFixedPrefix
+        ? { prefix: asset.prefix }
+        : { prefixEnvironmentVariable: asset.prefixEnvironmentVariable }),
       rights: asset.rights,
+      ...(asset.pathMapping === undefined
+        ? {}
+        : { pathMapping: asset.pathMapping }),
     });
   });
   let assetReader = null;
@@ -368,12 +479,16 @@ export const validateSourceAccessPolicy = (policy) => {
   return Object.freeze({
     accessVersion: 1,
     targetFingerprint: policy.targetFingerprint,
-    administratorEnvironmentVariable: policy.administratorEnvironmentVariable,
+    ...(administratorEnvironmentVariable
+      ? { administratorEnvironmentVariable }
+      : {}),
     reader: Object.freeze({
+      mode: readerMode,
       role,
-      ownerRole,
       credentialFile: policy.reader.credentialFile,
-      validForMinutes: policy.reader.validForMinutes,
+      ...(readerMode === "managed"
+        ? { ownerRole, validForMinutes }
+        : { connectionEnvironmentVariable, maximumValidForMinutes }),
     }),
     exportSchema,
     migrationLedger,
@@ -389,10 +504,18 @@ export const createSourceAccessPlan = ({
 }) => {
   const normalized = validateSourceAccessPolicy(policy);
   const sourceCredential =
-    environment[normalized.administratorEnvironmentVariable];
+    environment[
+      normalized.reader.mode === "managed"
+        ? normalized.administratorEnvironmentVariable
+        : normalized.reader.connectionEnvironmentVariable
+    ];
   if (!sourceCredential) {
     throw new Error(
-      `Source preparation requires ${normalized.administratorEnvironmentVariable}; the value is read from the environment and never printed.`,
+      `Source preparation requires ${
+        normalized.reader.mode === "managed"
+          ? normalized.administratorEnvironmentVariable
+          : normalized.reader.connectionEnvironmentVariable
+      }; the value is read from the environment and never printed.`,
     );
   }
   const actualTarget = sourceTargetFingerprint(sourceCredential);
@@ -411,6 +534,16 @@ export const createSourceAccessPlan = ({
         return [relation.view, sha256(value)];
       }),
   );
+  const assetPrefixReceipts = Object.fromEntries(
+    normalized.assets
+      .filter((asset) => asset.prefixEnvironmentVariable)
+      .map((asset) => {
+        const key = asset.prefixEnvironmentVariable;
+        const value = environment[key];
+        if (!value) throw new Error(`Source preparation requires ${key}.`);
+        return [`${asset.bucket}:${asset.pathMapping}`, sha256(value)];
+      }),
+  );
   if (normalized.assetReader) {
     const baseUrl =
       environment[normalized.assetReader.baseUrlEnvironmentVariable];
@@ -435,10 +568,21 @@ export const createSourceAccessPlan = ({
     targetFingerprint: normalized.targetFingerprint,
     exportSchema: normalized.exportSchema,
     reader: {
+      mode: normalized.reader.mode,
       role: normalized.reader.role,
-      ownerRole: normalized.reader.ownerRole,
-      validForMinutes: normalized.reader.validForMinutes,
       credentialFile: normalized.reader.credentialFile,
+      ...(normalized.reader.mode === "managed"
+        ? {
+            ownerRole: normalized.reader.ownerRole,
+            validForMinutes: normalized.reader.validForMinutes,
+            sourceChanges: true,
+          }
+        : {
+            connectionEnvironmentVariable:
+              normalized.reader.connectionEnvironmentVariable,
+            maximumValidForMinutes: normalized.reader.maximumValidForMinutes,
+            sourceChanges: false,
+          }),
     },
     relations: normalized.relations.map((relation) => ({
       source: relation.source,
@@ -446,6 +590,9 @@ export const createSourceAccessPlan = ({
       targetTable: relation.targetTable,
       columns: relation.columns,
       orderBy: relation.orderBy,
+      ...(relation.viewDefinitionSha256
+        ? { viewDefinitionSha256: relation.viewDefinitionSha256 }
+        : {}),
       rowScope: {
         kind: relation.rowScope.kind,
         ...(relation.rowScope.kind === "approved-owner"
@@ -456,7 +603,15 @@ export const createSourceAccessPlan = ({
           : {}),
       },
     })),
-    assets: normalized.assets,
+    assets: normalized.assets.map((asset) =>
+      asset.prefixEnvironmentVariable
+        ? {
+            ...asset,
+            prefixValueSha256:
+              assetPrefixReceipts[`${asset.bucket}:${asset.pathMapping}`],
+          }
+        : asset,
+    ),
     assetReader: normalized.assetReader
       ? {
           endpointFingerprint: normalized.assetReader.endpointFingerprint,
@@ -465,13 +620,23 @@ export const createSourceAccessPlan = ({
           maximumTotalBytes: normalized.assetReader.maximumTotalBytes,
         }
       : null,
-    denyChecks: [
-      "raw relation reads",
-      "writes",
-      "role creation and escalation",
-      "network functions",
-      "unrelated private assets",
-    ],
+    denyChecks:
+      normalized.reader.mode === "managed"
+        ? [
+            "raw relation reads",
+            "writes",
+            "role creation and escalation",
+            "network functions",
+            "unrelated private assets",
+          ]
+        : [
+            "all non-system readable columns match the approved views and migration ledger",
+            "no relation, column, schema, or database writes",
+            "no inherited roles or privileged role attributes",
+            "no executable non-system security-definer functions",
+            "database-enforced credential expiration",
+            "unrelated private assets",
+          ],
   };
   return Object.freeze({
     policy: normalized,
@@ -480,6 +645,9 @@ export const createSourceAccessPlan = ({
   });
 };
 
+export const sourceAccessPolicyFingerprint = (policy) =>
+  sha256(canonicalJson(validateSourceAccessPolicy(policy)));
+
 export const assetEndpointFingerprint = (value) => {
   let endpoint;
   try {
@@ -525,6 +693,10 @@ export const createSourceRetirementPlan = ({
   if (!Array.isArray(receipt.views) || !Array.isArray(receipt.relations)) {
     throw new Error("Source access receipt object inventory is invalid.");
   }
+  const accessMode = receipt.accessMode ?? "managed";
+  if (!["managed", "external"].includes(accessMode)) {
+    throw new Error("Source access receipt mode is invalid.");
+  }
   const relations = receipt.relations.map((relation, index) => {
     if (!isObject(relation))
       throw new Error(`receipt.relations[${index}] is invalid.`);
@@ -560,6 +732,7 @@ export const createSourceRetirementPlan = ({
   const review = {
     planVersion: 1,
     operation: "retire-source-access",
+    accessMode,
     targetFingerprint: target,
     preparationDigest: fingerprint(receipt.planDigest, "receipt.planDigest"),
     exportSchema: identifier(receipt.exportSchema, "receipt.exportSchema"),
@@ -569,7 +742,9 @@ export const createSourceRetirementPlan = ({
     relations,
     migrationLedger: ledger,
     readerRole: identifier(receipt.readerRole, "receipt.readerRole"),
-    ownerRole: identifier(receipt.ownerRole, "receipt.ownerRole"),
+    ...(accessMode === "managed"
+      ? { ownerRole: identifier(receipt.ownerRole, "receipt.ownerRole") }
+      : {}),
   };
   return Object.freeze({
     review: Object.freeze(review),

package/src/source/asset_transfer.mjs

@@ -42,6 +42,21 @@ const readError = (label, response) =>
     `${label} failed with HTTP ${response.status}; response content was withheld.`,
   );
 
+const canonicalContentType = (...values) => {
+  for (const value of values) {
+    if (typeof value !== "string") continue;
+    const mediaType = value.split(";", 1)[0].trim().toLowerCase();
+    if (
+      /^[a-z0-9][a-z0-9!#$&^_.+-]*\/[a-z0-9][a-z0-9!#$&^_.+-]*$/u.test(
+        mediaType,
+      )
+    ) {
+      return mediaType;
+    }
+  }
+  return "application/octet-stream";
+};
+
 const responseBody = async function* ({
   response,
   expectedBytes,
@@ -69,6 +84,7 @@ export const streamApprovedSupabaseAssets = async function* ({
   maximumObjects = 10_000,
   maximumObjectBytes = 50 * 1024 * 1024,
   maximumTotalBytes = 2 * 1024 * 1024 * 1024,
+  pathMapper,
 }) {
   const endpoint = safeBaseUrl(baseUrl);
   if (typeof token !== "string" || token.length < 16) {
@@ -156,13 +172,27 @@ export const streamApprovedSupabaseAssets = async function* ({
             );
           }
         }
+        if (declaration.pathMapping && typeof pathMapper !== "function") {
+          throw new Error(
+            "Storage path mapping requires the package-owned privacy mapper.",
+          );
+        }
+        const objectPath = declaration.pathMapping
+          ? safePath(
+              pathMapper({
+                mapping: declaration.pathMapping,
+                value: name,
+              }),
+              "Mapped Storage object path",
+            )
+          : name;
         yield {
           bucket: declaration.bucket,
-          objectPath: name,
-          contentType:
-            download.headers.get("content-type") ??
-            object.metadata?.mimetype ??
-            "application/octet-stream",
+          objectPath,
+          contentType: canonicalContentType(
+            object.metadata?.mimetype,
+            download.headers.get("content-type"),
+          ),
           content: responseBody({
             response: download,
             expectedBytes,