@ttt-productions/media-processing-core 0.8.4 → 0.8.6

package/dist/inspection/inspect-media.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"inspect-media.js","sourceRoot":"","sources":["../../src/inspection/inspect-media.ts"],"names":[],"mappings":"AAAA,gFAAgF;AAChF,+EAA+E;AAC/E,gFAAgF;AAChF,EAAE;AACF,2EAA2E;AAC3E,0EAA0E;AAC1E,6EAA6E;AAC7E,2EAA2E;AAC3E,2EAA2E;AAC3E,yEAAyE;AACzE,8EAA8E;AAC9E,aAAa;AACb,EAAE;AACF,uDAAuD;AACvD,2DAA2D;AAC3D,yEAAyE;AACzE,0EAA0E;AAC1E,0EAA0E;AAC1E,6EAA6E;AAC7E,+EAA+E;AAC/E,+DAA+D;AAC/D,+EAA+E;AAC/E,8EAA8E;AAC9E,2EAA2E;AAC3E,iDAAiD;AACjD,iEAAiE;AACjE,4EAA4E;AAE5E,OAAO,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AACxC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,2BAA2B,GAK5B,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAE5C,2EAA2E;AAC3E,MAAM,CAAC,MAAM,iBAAiB,GAAG,eAAe,CAAC;AAEjD,MAAM,oBAAoB,GAAG,EAAE,GAAG,IAAI,CAAC;AACvC,MAAM,wBAAwB,GAAG,MAAM,CAAC;AACxC,MAAM,gBAAgB,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC,qCAAqC;AAC/E,MAAM,mBAAmB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAE7C,uEAAuE;AAEvE,MAAM,iBAAiB,GAAG,CAAC;KACxB,MAAM,CAAC;IACN,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;IACzC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;IACzC,WAAW,EAAE,CAAC;SACX,MAAM,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC;SACnE,KAAK,EAAE;SACP,QAAQ,EAAE;IACb,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;IACxC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;CACxC,CAAC;KACD,KAAK,EAAE,CAAC;AAEX,MAAM,eAAe,GAAG,CAAC;KACtB,MAAM,CAAC;IACN,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE;IACpF,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;CACxD,CAAC;KACD,KAAK,EAAE,CAAC;AAEX,qEAAqE;AAErE,MAAM,SAAS,GAAsC;IACnD,IAAI,EAAE,MAAM;IACZ,IAAI,EAAE,MAAM;IACZ,GAAG,EAAE,KAAK;IACV,GAAG,EAAE,KAAK;IACV,GAAG,EAAE,KAAK;IACV,MAAM,EAAE,QAAQ;IAChB,KAAK,EAAE,OAAO;IACd,KAAK,EAAE,OAAO;IACd,GAAG,EAAE,KAAK;IACV,IAAI,EAAE,MAAM;IACZ,IAAI,EAAE,MAAM;IACZ,MAAM,EAAE,QAAQ;IAChB,GAAG,EAAE,KAAK;IACV,IAAI,EAAE,MAAM;CACb,CAAC;AAEF,SAAS,cAAc,CAAC,IAAwB;IAC9C,IAAI,CAAC,IAAI;QAAE,OAAO,OAAO,CAAC;IAC1B,MAAM,CAAC,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IAC7B,IAAI,SAAS,CAAC,CAAC,CAAC;QAAE,OAAO,SAAS,CAAC,CAAC,CAAC,CAAC;IACtC,IAAI,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC;QAAE,OAAO,KAAK,CAAC;IACvC,IAAI,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACtC,OAAO,OAAO,CAAC;AACjB,CAAC;AAgBD;2EAC2E;AAC3E,MAAM,oBAAoB,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;AAEvH,SAAS,KAAK,CAAC,CAAa,EAAE,GAAW,EAAE,CAAS;IAClD,IAAI,GAAG,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC5C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,IAAI,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;IACpF,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,CAAa;IACjD,IAAI,CAAC,CAAC,MAAM,GAAG,EAAE;QAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IAChD,oCAAoC;IACpC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI;QAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;IACrH,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,KAAK,CAAC,CAAC,EAAE,CAAC,EAAE,KAAK,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IACvG,IAAI,KAAK,CAAC,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IACvF,IAAI,KAAK,CAAC,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC,IAAI,KAAK,CAAC,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;IAChH,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI;QAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IAClG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,EAAE,CAAC;QAC3G,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;IAClE,CAAC;IACD,8EAA8E;IAC9E,CAAC;QACC,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC;aAC7D,QAAQ,CAAC,QAAQ,CAAC;aAClB,WAAW,EAAE,CAAC;QACjB,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC,EAAE,CAAC;YACrJ,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;QAC3B,CAAC;IACH,CAAC;IACD,aAAa;IACb,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI;QAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IAChG,IAAI,KAAK,CAAC,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC,EAAE,CAAC;QACxB,MAAM,KAAK,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACjF,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IACtC,CAAC;IACD,IAAI,KAAK,CAAC,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IAClD,IAAI,KAAK,CAAC,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC,IAAI,KAAK,CAAC,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IACzE,IAAI,KAAK,CAAC,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC,IAAI,KAAK,CAAC,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IACzE,IAAI,KAAK,CAAC,CAAC,EAAE,CAAC,EAAE,KAAK,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IACjD,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,IAAI;QAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IACtE,IAAI,KAAK,CAAC,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IACnD,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;AAC/B,CAAC;AAiBD,IAAI,oBAA+C,CAAC;AAEpD,KAAK,UAAU,iBAAiB;IAC9B,IAAI,oBAAoB,KAAK,SAAS;QAAE,OAAO,oBAAoB,IAAI,SAAS,CAAC;IACjF,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,MAAM,MAAM,CAAC,SAAS,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;QACtE,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;QACrE,oBAAoB,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC5D,CAAC;IAAC,MAAM,CAAC;QACP,oBAAoB,GAAG,IAAI,CAAC;IAC9B,CAAC;IACD,OAAO,oBAAoB,IAAI,SAAS,CAAC;AAC3C,CAAC;AAED,KAAK,UAAU,YAAY,CACzB,SAAiB,EACjB,IAAiD;IAEjD,IAAI,CAAC,CAAC;IACN,IAAI,CAAC;QACH,CAAC,GAAG,MAAM,MAAM,CACd,SAAS,EACT;YACE,IAAI;YACJ,OAAO;YACP,eAAe;YACf,MAAM;YACN,cAAc;YACd,eAAe;YACf,YAAY;YACZ,MAAM,CAAC,gBAAgB,CAAC;YACxB,kBAAkB;YAClB,MAAM,CAAC,mBAAmB,CAAC;YAC3B,SAAS;SACV,EACD,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CACnD,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC,gDAAgD;IAC1F,CAAC;IACD,IAAI,CAAC,CAAC,QAAQ;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IACxD,IAAI,CAAC,CAAC,SAAS;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IAC3D,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;IACzD,IAAI,CAAC;QACH,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,IAAI,IAAI,CAAC,EAAE,CAAC;IAC1D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;IAC3C,CAAC;AACH,CAAC;AAED,KAAK,UAAU,kBAAkB,CAAC,SAAiB;IACjD,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,CAAC,MAAM,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC;QAC9C,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,SAAS,EAAE,EAAE,gBAAgB,EAAE,SAAS,CAAC,8BAA8B,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;QAC/G,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QAC7C,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,EAAE,CAAC;IAClD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,4BAA4B;AAE5B,SAAS,UAAU,CACjB,OAC4D,EAC5D,cAAkC;IAElC,MAAM,MAAM,GAA0B;QACpC,gBAAgB,EAAE,iBAAiB;QACnC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7C,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,gBAAgB,EAAE,CAAC,EAAE,WAAW,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE;QAC1G,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;QAClD,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1E,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC5D,CAAC;IACF,OAAO,2BAA2B,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;AACnD,CAAC;AAED,SAAS,aAAa,CACpB,SAAiB,EACjB,UAAkB,EAClB,cAAkC,EAClC,QAAwB;IAExB,OAAO,UAAU,CACf;QACE,MAAM,EAAE,eAAe;QACvB,SAAS;QACT,UAAU,EAAE,uBAAuB;QACnC,UAAU;QACV,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAClC,EACD,cAAc,CACf,CAAC;AACJ,CAAC;AAWD,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,IAAsB;IACvD,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,wBAAwB,CAAC;IAC7D,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,KAAK,IAAI,YAAY,CAAC;IAC/C,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,EAAE,WAAW,IAAI,kBAAkB,CAAC;IACjE,MAAM,cAAc,GAAG,IAAI,CAAC,IAAI,EAAE,cAAc,IAAI,CAAC,MAAM,iBAAiB,EAAE,CAAC,CAAC;IAEhF,0CAA0C;IAC1C,IAAI,IAAgB,CAAC;IACrB,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;QAC3C,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC;YAC/C,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,EAAE,oBAAoB,EAAE,CAAC,CAAC,CAAC;YACrE,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;QACpC,CAAC;gBAAS,CAAC;YACT,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC;QACnB,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,aAAa,CAAC,SAAS,EAAE,aAAa,EAAE,cAAc,CAAC,CAAC;IACjE,CAAC;IAED,MAAM,GAAG,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC;IAExC,oBAAoB;IACpB,QAAQ,GAAG,CAAC,MAAM,EAAE,CAAC;QACnB,KAAK,SAAS;YACZ,OAAO,aAAa,CAAC,SAAS,EAAE,wBAAwB,EAAE,cAAc,CAAC,CAAC;QAE5E,KAAK,KAAK;YACR,uEAAuE;YACvE,sEAAsE;YACtE,oEAAoE;YACpE,OAAO,UAAU,CACf;gBACE,MAAM,EAAE,aAAa;gBACrB,SAAS,EAAE,KAAK;gBAChB,QAAQ,EAAE,KAAK;gBACf,UAAU,EAAE,uBAAuB;gBACnC,UAAU,EAAE,wBAAwB;aACrC,EACD,cAAc,CACf,CAAC;QAEJ,KAAK,OAAO,CAAC,CAAC,CAAC;YACb,yEAAyE;YACzE,qCAAqC;YACrC,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YAClD,IAAI,CAAC,OAAO;gBAAE,OAAO,UAAU,CAC7B,EAAE,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,UAAU,EAAE,uBAAuB,EAAE,UAAU,EAAE,qBAAqB,EAAE,EACjJ,cAAc,CACf,CAAC;YACF,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;YAC9B,OAAO,UAAU,CACf;gBACE,MAAM,EAAE,YAAY;gBACpB,aAAa,EAAE,OAAO;gBACtB,SAAS,EAAE,GAAG,CAAC,SAAS;gBACxB,QAAQ,EAAE,GAAG,CAAC,QAAQ;gBACtB,OAAO,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,gBAAgB,EAAE,CAAC,EAAE,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,EAAE;gBAC5F,UAAU,EAAE,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,aAAa;gBAChE,UAAU,EAAE,IAAI;aACjB,EACD,cAAc,CACf,CAAC;QACJ,CAAC;QAED,KAAK,SAAS;YACZ,IAAI,oBAAoB,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;gBACxC,sEAAsE;gBACtE,uEAAuE;gBACvE,kEAAkE;gBAClE,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;gBAC/E,MAAM,MAAM,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,eAAe,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;gBACzE,MAAM,OAAO,GAAG,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;gBACnE,MAAM,QAAQ,GAAG,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,yBAAyB;gBAC1G,MAAM,QAAQ,GAA8B,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC;gBAC1F,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;gBAClD,IAAI,CAAC,OAAO,IAAI,QAAQ,EAAE,CAAC;oBACzB,IAAI,QAAQ,KAAK,MAAM,IAAI,CAAC,OAAO,IAAI,CAAC,QAAQ,EAAE,CAAC;wBACjD,kEAAkE;wBAClE,6DAA6D;wBAC7D,OAAO,UAAU,CACf,EAAE,MAAM,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,uBAAuB,EAAE,UAAU,EAAE,yBAAyB,EAAE,EAClI,cAAc,CACf,CAAC;oBACJ,CAAC;oBACD,mEAAmE;oBACnE,mEAAmE;oBACnE,wBAAwB;oBACxB,OAAO,aAAa,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,qBAAqB,EAAE,cAAc,EAAE,QAAQ,CAAC,CAAC;gBACrH,CAAC;gBACD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;gBAC9B,OAAO,UAAU,CACf;oBACE,MAAM,EAAE,YAAY;oBACpB,aAAa,EAAE,OAAO;oBACtB,SAAS,EAAE,MAAM;oBACjB,QAAQ;oBACR,OAAO,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,gBAAgB,EAAE,CAAC,EAAE,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,EAAE;oBAC5F,UAAU,EAAE,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,aAAa;oBAChE,UAAU,EAAE,IAAI;iBACjB,EACD,cAAc,CACf,CAAC;YACJ,CAAC;YACD,OAAO,mBAAmB,CAAC,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,cAAc,CAAC,CAAC;QAE3F,KAAK,MAAM;YACT,OAAO,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,cAAc,CAAC,CAAC;QACrF,KAAK,KAAK;YACR,OAAO,mBAAmB,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,cAAc,CAAC,CAAC;QACnF,KAAK,KAAK;YACR,yEAAyE;YACzE,2EAA2E;YAC3E,OAAO,mBAAmB,CAAC,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,cAAc,CAAC,CAAC;QACvF,KAAK,KAAK;YACR,OAAO,mBAAmB,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,cAAc,CAAC,CAAC;QACnF,KAAK,KAAK;YACR,OAAO,mBAAmB,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,cAAc,CAAC,CAAC;QACnF,KAAK,MAAM;YACT,OAAO,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,cAAc,CAAC,CAAC;IACvF,CAAC;AACH,CAAC;AAED,KAAK,UAAU,mBAAmB,CAChC,IAAsB,EACtB,SAAiB,EACjB,QAAmC,EACnC,KAA6C,EAC7C,SAAiB,EACjB,cAAkC;IAElC,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IAC/E,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,OAAO,aAAa,CAAC,SAAS,EAAE,SAAS,MAAM,CAAC,MAAM,EAAE,EAAE,cAAc,EAAE,QAAQ,CAAC,CAAC;IACtF,CAAC;IACD,MAAM,MAAM,GAAG,eAAe,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACtD,IAAI,CAAC,MAAM,CAAC,OAAO;QAAE,OAAO,aAAa,CAAC,SAAS,EAAE,sBAAsB,EAAE,cAAc,EAAE,QAAQ,CAAC,CAAC;IAEvG,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC;IAC7C,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,aAAa,CAAC,SAAS,EAAE,YAAY,EAAE,cAAc,EAAE,QAAQ,CAAC,CAAC;IAErG,MAAM,MAAM,GAA2B,EAAE,KAAK,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,gBAAgB,EAAE,CAAC,EAAE,WAAW,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC;IACtH,MAAM,WAAW,GAAG,IAAI,GAAG,EAAqB,CAAC;IACjD,MAAM,WAAW,GAAG,IAAI,GAAG,EAAqB,CAAC;IACjD,IAAI,cAAc,GAAG,KAAK,CAAC;IAE3B,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;QAC3B,MAAM,IAAI,GAAG,CAAC,CAAC,UAAU,IAAI,EAAE,CAAC;QAChC,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;YACrB,MAAM,CAAC,KAAK,EAAE,CAAC;YACf,WAAW,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC;QAChD,CAAC;aAAM,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;YAC5B,wEAAwE;YACxE,yEAAyE;YACzE,oEAAoE;YACpE,2CAA2C;YAC3C,IAAI,CAAC,CAAC,WAAW,EAAE,YAAY,KAAK,CAAC,EAAE,CAAC;gBACtC,MAAM,CAAC,gBAAgB,EAAE,CAAC;YAC5B,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,UAAU,EAAE,CAAC;gBACpB,WAAW,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC;YAChD,CAAC;QACH,CAAC;aAAM,IAAI,IAAI,KAAK,UAAU,IAAI,IAAI,KAAK,MAAM,IAAI,IAAI,KAAK,YAAY,EAAE,CAAC;YAC3E,MAAM,CAAC,SAAS,EAAE,CAAC;QACrB,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,SAAS,EAAE,CAAC;YACnB,cAAc,GAAG,IAAI,CAAC;QACxB,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAG,EAAE,KAAK,EAAE,CAAC,GAAG,WAAW,CAAC,EAAE,KAAK,EAAE,CAAC,GAAG,WAAW,CAAC,EAAE,CAAC;IAEpE,qCAAqC;IACrC,IAAI,MAAM,CAAC,UAAU,GAAG,CAAC,EAAE,CAAC;QAC1B,OAAO,UAAU,CACf;YACE,MAAM,EAAE,YAAY;YACpB,aAAa,EAAE,OAAO;YACtB,SAAS;YACT,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACjC,OAAO,EAAE,MAAM;YACf,MAAM;YACN,UAAU,EAAE,cAAc;YAC1B,UAAU,EAAE,IAAI;SACjB,EACD,cAAc,CACf,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,KAAK,GAAG,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;QACxC,OAAO,UAAU,CACf;YACE,MAAM,EAAE,YAAY;YACpB,aAAa,EAAE,OAAO;YACtB,SAAS;YACT,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACjC,OAAO,EAAE,MAAM;YACf,MAAM;YACN,UAAU,EAAE,MAAM,CAAC,gBAAgB,GAAG,CAAC,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,YAAY;YAC7E,UAAU,EAAE,IAAI;SACjB,EACD,cAAc,CACf,CAAC;IACJ,CAAC;IACD,2EAA2E;IAC3E,oDAAoD;IACpD,OAAO,UAAU,CACf;QACE,MAAM,EAAE,eAAe;QACvB,SAAS;QACT,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjC,OAAO,EAAE,MAAM;QACf,MAAM;QACN,UAAU,EAAE,uBAAuB;QACnC,UAAU,EAAE,cAAc,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,gBAAgB;KACtE,EACD,cAAc,CACf,CAAC;AACJ,CAAC","sourcesContent":["// =============================================================================\n// Canonical media content inspection (canonical-upload-content-classification)\n// =============================================================================\n//\n// The ONE server-side classification authority. Consumes a LOCAL file (the\n// pipeline's generation-pinned temp download), establishes what the bytes\n// actually contain, and returns the bounded `MediaInspectionResult` contract\n// from @ttt-productions/media-schemas. Everything downstream — origin/kind\n// validation, processing-spec selection, the persisted asset kind, and the\n// safety (PhotoDNA) routing — derives from this one result. Client MIME,\n// filename, extension, container brand, and payload-byte heuristics are never\n// consulted.\n//\n// Design (reviewed 2026-07-31; see the consuming app's\n// CODE_CHANGE_canonical_upload_content_classification.md):\n//   - family selection by a bounded 64 KiB SIGNATURE read (header only —\n//     semantic elements are NEVER searched for in arbitrary payload; that\n//     flat-scan heuristic caused the WebM audio misclassification twice);\n//   - shared A/V containers (EBML/ISO-BMFF/Ogg/AVI) classified by a hardened\n//     `ffprobe` stream table (libavformat's structural parsers), with timeout,\n//     kill-on-abort, output cap, and strict schema validation;\n//   - image-family proof by DECODER (sharp) — a signature or `ftyp` brand is a\n//     candidate, not proof, and image-family ISO-BMFF (AVIF/HEIC) is resolved\n//     BEFORE the ordinary \"any timed video stream wins\" rule (a valid AVIF\n//     probes as a one-frame AV1 `video` stream);\n//   - FAIL-CLOSED: anything unproven is `indeterminate` with the\n//     `strict-video-fallback` safety plan — never audio, never publishable.\n\nimport { open } from \"node:fs/promises\";\nimport { z } from \"zod\";\nimport {\n  MediaInspectionResultSchema,\n  type MediaInspectionResult,\n  type MediaInspectionStreams,\n  type NormalizedCodecId,\n  type MediaFormatId,\n} from \"@ttt-productions/media-schemas\";\nimport { runCmd } from \"../video/ffmpeg.js\";\n\n/** Bump on any classification-rule change (rides every decision event). */\nexport const INSPECTOR_VERSION = \"mpc-inspect-1\";\n\nconst SIGNATURE_READ_BYTES = 64 * 1024;\nconst DEFAULT_PROBE_TIMEOUT_MS = 20_000;\nconst PROBE_SIZE_BYTES = 4 * 1024 * 1024; // -probesize: metadata, not playback\nconst ANALYZE_DURATION_US = 10 * 1000 * 1000;\n\n// ---- ffprobe JSON boundary (strict; anything else is malformed) ----\n\nconst ProbeStreamSchema = z\n  .object({\n    codec_type: z.string().max(32).optional(),\n    codec_name: z.string().max(64).optional(),\n    disposition: z\n      .object({ attached_pic: z.number().int().min(0).max(1).optional() })\n      .loose()\n      .optional(),\n    nb_frames: z.string().max(20).optional(),\n    duration: z.string().max(32).optional(),\n  })\n  .loose();\n\nconst ProbeJsonSchema = z\n  .object({\n    format: z.object({ format_name: z.string().max(200).optional() }).loose().optional(),\n    streams: z.array(ProbeStreamSchema).max(256).optional(),\n  })\n  .loose();\n\n// ---- codec normalization (bounded — raw strings never escape) ----\n\nconst CODEC_MAP: Record<string, NormalizedCodecId> = {\n  h264: \"h264\",\n  hevc: \"hevc\",\n  vp8: \"vp8\",\n  vp9: \"vp9\",\n  av1: \"av1\",\n  theora: \"theora\",\n  mpeg4: \"mpeg4\",\n  mjpeg: \"mjpeg\",\n  aac: \"aac\",\n  alac: \"alac\",\n  opus: \"opus\",\n  vorbis: \"vorbis\",\n  mp3: \"mp3\",\n  flac: \"flac\",\n};\n\nfunction normalizeCodec(name: string | undefined): NormalizedCodecId {\n  if (!name) return \"other\";\n  const n = name.toLowerCase();\n  if (CODEC_MAP[n]) return CODEC_MAP[n];\n  if (n.startsWith(\"pcm_\")) return \"pcm\";\n  if (n.startsWith(\"amr\")) return \"amr\";\n  return \"other\";\n}\n\n// ---- signature families ----\n\ntype SignatureFamily =\n  | { family: \"image\"; formatId: MediaFormatId; container: string }\n  | { family: \"svg\" }\n  | { family: \"ebml\" }\n  | { family: \"isobmff\"; brand: string }\n  | { family: \"ogg\" }\n  | { family: \"avi\" }\n  | { family: \"wav\" }\n  | { family: \"mp3\" }\n  | { family: \"flac\" }\n  | { family: \"unknown\" };\n\n/** ISO-BMFF brands that declare an IMAGE-item file (HEIF family). Resolved via\n *  decoder proof BEFORE the timed-video rule — see the AVIF note above. */\nconst ISOBMFF_IMAGE_BRANDS = new Set([\"avif\", \"avis\", \"heic\", \"heix\", \"heim\", \"heis\", \"hevc\", \"hevx\", \"mif1\", \"msf1\"]);\n\nfunction ascii(b: Uint8Array, off: number, s: string): boolean {\n  if (off + s.length > b.length) return false;\n  for (let i = 0; i < s.length; i++) if (b[off + i] !== s.charCodeAt(i)) return false;\n  return true;\n}\n\nexport function detectSignatureFamily(b: Uint8Array): SignatureFamily {\n  if (b.length < 12) return { family: \"unknown\" };\n  // images (single-format signatures)\n  if (b[0] === 0xff && b[1] === 0xd8 && b[2] === 0xff) return { family: \"image\", formatId: \"jpeg\", container: \"jpeg\" };\n  if (b[0] === 0x89 && ascii(b, 1, \"PNG\")) return { family: \"image\", formatId: \"png\", container: \"png\" };\n  if (ascii(b, 0, \"GIF8\")) return { family: \"image\", formatId: \"gif\", container: \"gif\" };\n  if (ascii(b, 0, \"RIFF\") && ascii(b, 8, \"WEBP\")) return { family: \"image\", formatId: \"webp\", container: \"webp\" };\n  if (b[0] === 0x42 && b[1] === 0x4d) return { family: \"image\", formatId: \"bmp\", container: \"bmp\" };\n  if ((b[0] === 0x49 && b[1] === 0x49 && b[2] === 0x2a) || (b[0] === 0x4d && b[1] === 0x4d && b[3] === 0x2a)) {\n    return { family: \"image\", formatId: \"tiff\", container: \"tiff\" };\n  }\n  // SVG: XML text — scan a short prefix for '<svg' (bounded; case-insensitive).\n  {\n    const prefix = Buffer.from(b.slice(0, Math.min(b.length, 4096)))\n      .toString(\"latin1\")\n      .toLowerCase();\n    if (prefix.includes(\"<svg\") && (prefix.trimStart().startsWith(\"<?xml\") || prefix.trimStart().startsWith(\"<svg\") || prefix.includes(\"<!doctype svg\"))) {\n      return { family: \"svg\" };\n    }\n  }\n  // containers\n  if (b[0] === 0x1a && b[1] === 0x45 && b[2] === 0xdf && b[3] === 0xa3) return { family: \"ebml\" };\n  if (ascii(b, 4, \"ftyp\")) {\n    const brand = String.fromCharCode(b[8], b[9], b[10], b[11]).trim().toLowerCase();\n    return { family: \"isobmff\", brand };\n  }\n  if (ascii(b, 0, \"OggS\")) return { family: \"ogg\" };\n  if (ascii(b, 0, \"RIFF\") && ascii(b, 8, \"AVI \")) return { family: \"avi\" };\n  if (ascii(b, 0, \"RIFF\") && ascii(b, 8, \"WAVE\")) return { family: \"wav\" };\n  if (ascii(b, 0, \"ID3\")) return { family: \"mp3\" };\n  if (b[0] === 0xff && (b[1] & 0xe0) === 0xe0) return { family: \"mp3\" };\n  if (ascii(b, 0, \"fLaC\")) return { family: \"flac\" };\n  return { family: \"unknown\" };\n}\n\n// ---- dependency seams (tests inject; production uses the real tools) ----\n\nexport interface InspectMediaDeps {\n  /** Probe the local file; default shells to the hardened `ffprobe`. */\n  probe?: (localPath: string, opts: { timeoutMs: number; signal?: AbortSignal }) => Promise<\n    | { ok: true; json: unknown }\n    | { ok: false; reason: \"timeout\" | \"truncated\" | \"failed\" | \"bad_json\" }\n  >;\n  /** Decode-prove an image; default uses sharp metadata. Returns frame count\n   *  (pages) on success, null on decode failure. */\n  decodeImage?: (localPath: string) => Promise<{ frames: number } | null>;\n  /** Injected ffprobe version (default: cached `ffprobe -version` first line). */\n  ffprobeVersion?: string;\n}\n\nlet cachedFfprobeVersion: string | null | undefined;\n\nasync function getFfprobeVersion(): Promise<string | undefined> {\n  if (cachedFfprobeVersion !== undefined) return cachedFfprobeVersion ?? undefined;\n  try {\n    const r = await runCmd(\"ffprobe\", [\"-version\"], { timeoutMs: 5_000 });\n    const first = (r.stdout || r.stderr).split(/\\r?\\n/)[0]?.trim() ?? \"\";\n    cachedFfprobeVersion = first ? first.slice(0, 120) : null;\n  } catch {\n    cachedFfprobeVersion = null;\n  }\n  return cachedFfprobeVersion ?? undefined;\n}\n\nasync function defaultProbe(\n  localPath: string,\n  opts: { timeoutMs: number; signal?: AbortSignal },\n): Promise<{ ok: true; json: unknown } | { ok: false; reason: \"timeout\" | \"truncated\" | \"failed\" | \"bad_json\" }> {\n  let r;\n  try {\n    r = await runCmd(\n      \"ffprobe\",\n      [\n        \"-v\",\n        \"error\",\n        \"-print_format\",\n        \"json\",\n        \"-show_format\",\n        \"-show_streams\",\n        \"-probesize\",\n        String(PROBE_SIZE_BYTES),\n        \"-analyzeduration\",\n        String(ANALYZE_DURATION_US),\n        localPath,\n      ],\n      { timeoutMs: opts.timeoutMs, signal: opts.signal },\n    );\n  } catch {\n    return { ok: false, reason: \"failed\" }; // spawn failure (ffprobe missing) — fail closed\n  }\n  if (r.timedOut) return { ok: false, reason: \"timeout\" };\n  if (r.truncated) return { ok: false, reason: \"truncated\" };\n  if (r.code !== 0) return { ok: false, reason: \"failed\" };\n  try {\n    return { ok: true, json: JSON.parse(r.stdout || \"{}\") };\n  } catch {\n    return { ok: false, reason: \"bad_json\" };\n  }\n}\n\nasync function defaultDecodeImage(localPath: string): Promise<{ frames: number } | null> {\n  try {\n    const sharp = (await import(\"sharp\")).default;\n    const meta = await sharp(localPath, { limitInputPixels: 268402689 /* sharp default ~16k x 16k */ }).metadata();\n    if (!meta.width || !meta.height) return null;\n    return { frames: Math.max(1, meta.pages ?? 1) };\n  } catch {\n    return null;\n  }\n}\n\n// ---- result builders ----\n\nfunction baseResult(\n  partial: Omit<MediaInspectionResult, \"inspectorVersion\" | \"streams\" | \"codecs\"> &\n    Partial<Pick<MediaInspectionResult, \"streams\" | \"codecs\">>,\n  ffprobeVersion: string | undefined,\n): MediaInspectionResult {\n  const result: MediaInspectionResult = {\n    inspectorVersion: INSPECTOR_VERSION,\n    ...(ffprobeVersion ? { ffprobeVersion } : {}),\n    streams: partial.streams ?? { audio: 0, timedVideo: 0, attachedPictures: 0, imageFrames: 0, auxiliary: 0 },\n    codecs: partial.codecs ?? { audio: [], video: [] },\n    status: partial.status,\n    container: partial.container,\n    safetyPlan: partial.safetyPlan,\n    reasonCode: partial.reasonCode,\n    ...(partial.canonicalKind ? { canonicalKind: partial.canonicalKind } : {}),\n    ...(partial.formatId ? { formatId: partial.formatId } : {}),\n  };\n  return MediaInspectionResultSchema.parse(result);\n}\n\nfunction indeterminate(\n  container: string,\n  reasonCode: string,\n  ffprobeVersion: string | undefined,\n  formatId?: MediaFormatId,\n): MediaInspectionResult {\n  return baseResult(\n    {\n      status: \"indeterminate\",\n      container,\n      safetyPlan: \"strict-video-fallback\",\n      reasonCode,\n      ...(formatId ? { formatId } : {}),\n    },\n    ffprobeVersion,\n  );\n}\n\n// ---- the inspector ----\n\nexport interface InspectMediaArgs {\n  localPath: string;\n  timeoutMs?: number;\n  signal?: AbortSignal;\n  deps?: InspectMediaDeps;\n}\n\nexport async function inspectMedia(args: InspectMediaArgs): Promise<MediaInspectionResult> {\n  const timeoutMs = args.timeoutMs ?? DEFAULT_PROBE_TIMEOUT_MS;\n  const probe = args.deps?.probe ?? defaultProbe;\n  const decodeImage = args.deps?.decodeImage ?? defaultDecodeImage;\n  const ffprobeVersion = args.deps?.ffprobeVersion ?? (await getFfprobeVersion());\n\n  // 1) bounded signature read (header only)\n  let head: Uint8Array;\n  try {\n    const fh = await open(args.localPath, \"r\");\n    try {\n      const buf = Buffer.alloc(SIGNATURE_READ_BYTES);\n      const { bytesRead } = await fh.read(buf, 0, SIGNATURE_READ_BYTES, 0);\n      head = buf.subarray(0, bytesRead);\n    } finally {\n      await fh.close();\n    }\n  } catch {\n    return indeterminate(\"unknown\", \"read_failed\", ffprobeVersion);\n  }\n\n  const sig = detectSignatureFamily(head);\n\n  // 2) family routing\n  switch (sig.family) {\n    case \"unknown\":\n      return indeterminate(\"unknown\", \"unrecognized_signature\", ffprobeVersion);\n\n    case \"svg\":\n      // Scriptable XML \"image\" — structurally recognized, deliberately NOT a\n      // processable format until a sanitize/rasterize design exists (launch\n      // policy 2026-07-31). Never classified by decoder capability alone.\n      return baseResult(\n        {\n          status: \"unsupported\",\n          container: \"svg\",\n          formatId: \"svg\",\n          safetyPlan: \"strict-video-fallback\",\n          reasonCode: \"unsupported_format:svg\",\n        },\n        ffprobeVersion,\n      );\n\n    case \"image\": {\n      // Single-format image signature: decoder proof required — a signature is\n      // a candidate, not a classification.\n      const decoded = await decodeImage(args.localPath);\n      if (!decoded) return baseResult(\n        { status: \"malformed\", container: sig.container, formatId: sig.formatId, safetyPlan: \"strict-video-fallback\", reasonCode: \"image_decode_failed\" },\n        ffprobeVersion,\n      );\n      const frames = decoded.frames;\n      return baseResult(\n        {\n          status: \"definitive\",\n          canonicalKind: \"image\",\n          container: sig.container,\n          formatId: sig.formatId,\n          streams: { audio: 0, timedVideo: 0, attachedPictures: 0, imageFrames: frames, auxiliary: 0 },\n          safetyPlan: frames > 1 ? \"animated-image-frames\" : \"still-image\",\n          reasonCode: \"ok\",\n        },\n        ffprobeVersion,\n      );\n    }\n\n    case \"isobmff\":\n      if (ISOBMFF_IMAGE_BRANDS.has(sig.brand)) {\n        // IMAGE-FAMILY ISO-BMFF resolves BEFORE the timed-video rule: a valid\n        // AVIF probes as a one-frame AV1 `video` stream. Proof = image brand +\n        // successful bounded decode + no ordinary timed A/V presentation.\n        const probed = await probe(args.localPath, { timeoutMs, signal: args.signal });\n        const parsed = probed.ok ? ProbeJsonSchema.safeParse(probed.json) : null;\n        const streams = parsed?.success ? parsed.data.streams ?? [] : null;\n        const hasAudio = streams ? streams.some((s) => s.codec_type === \"audio\") : true; // unknown ⇒ assume worst\n        const formatId: MediaFormatId | undefined = sig.brand.startsWith(\"avi\") ? \"avif\" : \"heic\";\n        const decoded = await decodeImage(args.localPath);\n        if (!decoded || hasAudio) {\n          if (formatId === \"heic\" && !decoded && !hasAudio) {\n            // Recognized HEIC-family that the runtime cannot decode: explicit\n            // unsupported-image (launch policy) — NEVER relabeled video.\n            return baseResult(\n              { status: \"unsupported\", container: \"heif\", formatId, safetyPlan: \"strict-video-fallback\", reasonCode: \"unsupported_format:heic\" },\n              ffprobeVersion,\n            );\n          }\n          // Undecodable/ambiguous image-brand file, or one carrying audio (a\n          // real timed presentation wearing an image brand): fail toward the\n          // stricter visual path.\n          return indeterminate(\"heif\", decoded ? \"image_brand_with_audio\" : \"image_decode_failed\", ffprobeVersion, formatId);\n        }\n        const frames = decoded.frames;\n        return baseResult(\n          {\n            status: \"definitive\",\n            canonicalKind: \"image\",\n            container: \"heif\",\n            formatId,\n            streams: { audio: 0, timedVideo: 0, attachedPictures: 0, imageFrames: frames, auxiliary: 0 },\n            safetyPlan: frames > 1 ? \"animated-image-frames\" : \"still-image\",\n            reasonCode: \"ok\",\n          },\n          ffprobeVersion,\n        );\n      }\n      return classifyAvContainer(args, \"isobmff\", \"isobmff\", probe, timeoutMs, ffprobeVersion);\n\n    case \"ebml\":\n      return classifyAvContainer(args, \"webm\", \"webm\", probe, timeoutMs, ffprobeVersion);\n    case \"ogg\":\n      return classifyAvContainer(args, \"ogg\", \"ogg\", probe, timeoutMs, ffprobeVersion);\n    case \"avi\":\n      // Real container ffprobe parses; no registry entry (no origin enables it\n      // today) — the stream truth still classifies it, policy rejects by format.\n      return classifyAvContainer(args, \"avi\", undefined, probe, timeoutMs, ffprobeVersion);\n    case \"wav\":\n      return classifyAvContainer(args, \"wav\", \"wav\", probe, timeoutMs, ffprobeVersion);\n    case \"mp3\":\n      return classifyAvContainer(args, \"mp3\", \"mp3\", probe, timeoutMs, ffprobeVersion);\n    case \"flac\":\n      return classifyAvContainer(args, \"flac\", \"flac\", probe, timeoutMs, ffprobeVersion);\n  }\n}\n\nasync function classifyAvContainer(\n  args: InspectMediaArgs,\n  container: string,\n  formatId: MediaFormatId | undefined,\n  probe: NonNullable<InspectMediaDeps[\"probe\"]>,\n  timeoutMs: number,\n  ffprobeVersion: string | undefined,\n): Promise<MediaInspectionResult> {\n  const probed = await probe(args.localPath, { timeoutMs, signal: args.signal });\n  if (!probed.ok) {\n    return indeterminate(container, `probe_${probed.reason}`, ffprobeVersion, formatId);\n  }\n  const parsed = ProbeJsonSchema.safeParse(probed.json);\n  if (!parsed.success) return indeterminate(container, \"probe_schema_invalid\", ffprobeVersion, formatId);\n\n  const rawStreams = parsed.data.streams ?? [];\n  if (rawStreams.length === 0) return indeterminate(container, \"no_streams\", ffprobeVersion, formatId);\n\n  const counts: MediaInspectionStreams = { audio: 0, timedVideo: 0, attachedPictures: 0, imageFrames: 0, auxiliary: 0 };\n  const audioCodecs = new Set<NormalizedCodecId>();\n  const videoCodecs = new Set<NormalizedCodecId>();\n  let sawUnknownType = false;\n\n  for (const s of rawStreams) {\n    const type = s.codec_type ?? \"\";\n    if (type === \"audio\") {\n      counts.audio++;\n      audioCodecs.add(normalizeCodec(s.codec_name));\n    } else if (type === \"video\") {\n      // An attached picture (cover art) is NOT a timed presentation — but the\n      // disposition flag is untrusted container data, so it is COUNTED and the\n      // safety plan forces every such picture through the image hash path\n      // before the audio guard may return clean.\n      if (s.disposition?.attached_pic === 1) {\n        counts.attachedPictures++;\n      } else {\n        counts.timedVideo++;\n        videoCodecs.add(normalizeCodec(s.codec_name));\n      }\n    } else if (type === \"subtitle\" || type === \"data\" || type === \"attachment\") {\n      counts.auxiliary++;\n    } else {\n      counts.auxiliary++;\n      sawUnknownType = true;\n    }\n  }\n\n  const codecs = { audio: [...audioCodecs], video: [...videoCodecs] };\n\n  // classification table (fail-closed)\n  if (counts.timedVideo > 0) {\n    return baseResult(\n      {\n        status: \"definitive\",\n        canonicalKind: \"video\",\n        container,\n        ...(formatId ? { formatId } : {}),\n        streams: counts,\n        codecs,\n        safetyPlan: \"video-frames\",\n        reasonCode: \"ok\",\n      },\n      ffprobeVersion,\n    );\n  }\n  if (counts.audio > 0 && !sawUnknownType) {\n    return baseResult(\n      {\n        status: \"definitive\",\n        canonicalKind: \"audio\",\n        container,\n        ...(formatId ? { formatId } : {}),\n        streams: counts,\n        codecs,\n        safetyPlan: counts.attachedPictures > 0 ? \"audio-plus-artwork\" : \"audio-only\",\n        reasonCode: \"ok\",\n      },\n      ffprobeVersion,\n    );\n  }\n  // auxiliary-only, unknown stream types alongside audio, or nothing usable:\n  // never audio — the strict visual fallback owns it.\n  return baseResult(\n    {\n      status: \"indeterminate\",\n      container,\n      ...(formatId ? { formatId } : {}),\n      streams: counts,\n      codecs,\n      safetyPlan: \"strict-video-fallback\",\n      reasonCode: sawUnknownType ? \"unknown_stream_type\" : \"auxiliary_only\",\n    },\n    ffprobeVersion,\n  );\n}\n"]}

package/dist/io/local-input.d.ts

@@ -0,0 +1,39 @@
+import type { Readable } from "node:stream";
+/** Thrown by {@link streamToTempFile} when the source exceeds `maxBytes`. */
+export declare class ByteLimitExceededError extends Error {
+    readonly maxBytes: number;
+    constructor(maxBytes: number);
+}
+export interface TempFileInput {
+    /** Absolute path of the fully-written temp file. */
+    localPath: string;
+    /** Total bytes written (always <= maxBytes). */
+    bytesWritten: number;
+    /** Removes the temp file and its private directory. Idempotent; never throws. */
+    cleanup: () => Promise<void>;
+}
+export interface StreamToTempFileOptions {
+    /** HARD cap: the stream is destroyed and the temp file removed the moment the
+     *  cap is crossed, so an oversized source never fully lands on disk. */
+    maxBytes: number;
+    /** Temp-dir prefix (default "media-input-"). */
+    prefix?: string;
+}
+/**
+ * Streams a Readable into a private temp file with a hard byte cap and
+ * constant memory. On success the caller MUST invoke `cleanup()` in a
+ * `finally`. On any failure (cap exceeded, stream error) the temp file is
+ * removed before the error propagates.
+ */
+export declare function streamToTempFile(source: Readable, options: StreamToTempFileOptions): Promise<TempFileInput>;
+/** Streams a file through SHA-256 (constant memory) and returns the lowercase hex digest. */
+export declare function hashFileSha256(localPath: string): Promise<string>;
+/** Default header window for signature-family checks (matches the inspector's sniff window). */
+export declare const FILE_HEADER_BYTES: number;
+/**
+ * Reads at most `maxBytes` (default 64 KiB) from the start of a file — the
+ * bounded input for {@link detectSignatureFamily}-style checks without loading
+ * the whole source.
+ */
+export declare function readFileHeader(localPath: string, maxBytes?: number): Promise<Uint8Array>;
+//# sourceMappingURL=local-input.d.ts.map

package/dist/io/local-input.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"local-input.d.ts","sourceRoot":"","sources":["../../src/io/local-input.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAE5C,6EAA6E;AAC7E,qBAAa,sBAAuB,SAAQ,KAAK;IAC/C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;gBACd,QAAQ,EAAE,MAAM;CAK7B;AAED,MAAM,WAAW,aAAa;IAC5B,oDAAoD;IACpD,SAAS,EAAE,MAAM,CAAC;IAClB,gDAAgD;IAChD,YAAY,EAAE,MAAM,CAAC;IACrB,iFAAiF;IACjF,OAAO,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC9B;AAED,MAAM,WAAW,uBAAuB;IACtC;4EACwE;IACxE,QAAQ,EAAE,MAAM,CAAC;IACjB,gDAAgD;IAChD,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;;GAKG;AACH,wBAAsB,gBAAgB,CACpC,MAAM,EAAE,QAAQ,EAChB,OAAO,EAAE,uBAAuB,GAC/B,OAAO,CAAC,aAAa,CAAC,CA2BxB;AAED,6FAA6F;AAC7F,wBAAsB,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAMvE;AAED,gGAAgG;AAChG,eAAO,MAAM,iBAAiB,QAAY,CAAC;AAE3C;;;;GAIG;AACH,wBAAsB,cAAc,CAClC,SAAS,EAAE,MAAM,EACjB,QAAQ,GAAE,MAA0B,GACnC,OAAO,CAAC,UAAU,CAAC,CASrB"}

package/dist/io/local-input.js

@@ -0,0 +1,84 @@
+// Bounded-memory local-input primitives (canonical-upload-content-classification,
+// bounded-memory unit). Safety scanning and hashing must never hold a full media
+// source in JS memory: sources stream to a generation-pinned temp file with a
+// hard byte cap, hashes stream from disk, and signature checks read only a
+// bounded header. These primitives are generic (no storage/vendor deps) — the
+// caller supplies the Readable and owns generation pinning.
+import { createHash } from "node:crypto";
+import { createReadStream, createWriteStream } from "node:fs";
+import { mkdtemp, open, rm } from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import { pipeline } from "node:stream/promises";
+/** Thrown by {@link streamToTempFile} when the source exceeds `maxBytes`. */
+export class ByteLimitExceededError extends Error {
+    maxBytes;
+    constructor(maxBytes) {
+        super(`source exceeded the ${maxBytes}-byte limit`);
+        this.name = "ByteLimitExceededError";
+        this.maxBytes = maxBytes;
+    }
+}
+/**
+ * Streams a Readable into a private temp file with a hard byte cap and
+ * constant memory. On success the caller MUST invoke `cleanup()` in a
+ * `finally`. On any failure (cap exceeded, stream error) the temp file is
+ * removed before the error propagates.
+ */
+export async function streamToTempFile(source, options) {
+    const { maxBytes, prefix = "media-input-" } = options;
+    if (!Number.isFinite(maxBytes) || maxBytes <= 0) {
+        throw new Error("streamToTempFile requires a positive finite maxBytes");
+    }
+    const dir = await mkdtemp(path.join(os.tmpdir(), prefix));
+    const localPath = path.join(dir, "input");
+    const cleanup = async () => {
+        await rm(dir, { recursive: true, force: true }).catch(() => { });
+    };
+    let bytesWritten = 0;
+    try {
+        const sink = createWriteStream(localPath, { flags: "wx" });
+        await pipeline(source, async function* (chunks) {
+            for await (const chunk of chunks) {
+                const buf = typeof chunk === "string" ? Buffer.from(chunk) : chunk;
+                bytesWritten += buf.byteLength;
+                if (bytesWritten > maxBytes)
+                    throw new ByteLimitExceededError(maxBytes);
+                yield buf;
+            }
+        }, sink);
+    }
+    catch (err) {
+        await cleanup();
+        throw err;
+    }
+    return { localPath, bytesWritten, cleanup };
+}
+/** Streams a file through SHA-256 (constant memory) and returns the lowercase hex digest. */
+export async function hashFileSha256(localPath) {
+    const hash = createHash("sha256");
+    await pipeline(createReadStream(localPath), async (chunks) => {
+        for await (const chunk of chunks)
+            hash.update(chunk);
+    });
+    return hash.digest("hex");
+}
+/** Default header window for signature-family checks (matches the inspector's sniff window). */
+export const FILE_HEADER_BYTES = 64 * 1024;
+/**
+ * Reads at most `maxBytes` (default 64 KiB) from the start of a file — the
+ * bounded input for {@link detectSignatureFamily}-style checks without loading
+ * the whole source.
+ */
+export async function readFileHeader(localPath, maxBytes = FILE_HEADER_BYTES) {
+    const handle = await open(localPath, "r");
+    try {
+        const buf = Buffer.alloc(maxBytes);
+        const { bytesRead } = await handle.read(buf, 0, maxBytes, 0);
+        return buf.subarray(0, bytesRead);
+    }
+    finally {
+        await handle.close();
+    }
+}
+//# sourceMappingURL=local-input.js.map

package/dist/io/local-input.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"local-input.js","sourceRoot":"","sources":["../../src/io/local-input.ts"],"names":[],"mappings":"AAAA,kFAAkF;AAClF,iFAAiF;AACjF,8EAA8E;AAC9E,2EAA2E;AAC3E,8EAA8E;AAC9E,4DAA4D;AAE5D,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,SAAS,CAAC;AAC9D,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAGhD,6EAA6E;AAC7E,MAAM,OAAO,sBAAuB,SAAQ,KAAK;IACtC,QAAQ,CAAS;IAC1B,YAAY,QAAgB;QAC1B,KAAK,CAAC,uBAAuB,QAAQ,aAAa,CAAC,CAAC;QACpD,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAC;QACrC,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAC3B,CAAC;CACF;AAmBD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,MAAgB,EAChB,OAAgC;IAEhC,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,cAAc,EAAE,GAAG,OAAO,CAAC;IACtD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,QAAQ,IAAI,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAC1E,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC;IAC1D,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAC1C,MAAM,OAAO,GAAG,KAAK,IAAI,EAAE;QACzB,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IAClE,CAAC,CAAC;IAEF,IAAI,YAAY,GAAG,CAAC,CAAC;IACrB,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,iBAAiB,CAAC,SAAS,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3D,MAAM,QAAQ,CAAC,MAAM,EAAE,KAAK,SAAS,CAAC,EAAE,MAAsC;YAC5E,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;gBACjC,MAAM,GAAG,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;gBACnE,YAAY,IAAI,GAAG,CAAC,UAAU,CAAC;gBAC/B,IAAI,YAAY,GAAG,QAAQ;oBAAE,MAAM,IAAI,sBAAsB,CAAC,QAAQ,CAAC,CAAC;gBACxE,MAAM,GAAG,CAAC;YACZ,CAAC;QACH,CAAC,EAAE,IAAI,CAAC,CAAC;IACX,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,OAAO,EAAE,CAAC;QAChB,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC;AAC9C,CAAC;AAED,6FAA6F;AAC7F,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,SAAiB;IACpD,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;IAClC,MAAM,QAAQ,CAAC,gBAAgB,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,MAA6B,EAAE,EAAE;QAClF,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,MAAM;YAAE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACvD,CAAC,CAAC,CAAC;IACH,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC5B,CAAC;AAED,gGAAgG;AAChG,MAAM,CAAC,MAAM,iBAAiB,GAAG,EAAE,GAAG,IAAI,CAAC;AAE3C;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,SAAiB,EACjB,WAAmB,iBAAiB;IAEpC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;IAC1C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACnC,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC;QAC7D,OAAO,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;IACpC,CAAC;YAAS,CAAC;QACT,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;AACH,CAAC","sourcesContent":["// Bounded-memory local-input primitives (canonical-upload-content-classification,\n// bounded-memory unit). Safety scanning and hashing must never hold a full media\n// source in JS memory: sources stream to a generation-pinned temp file with a\n// hard byte cap, hashes stream from disk, and signature checks read only a\n// bounded header. These primitives are generic (no storage/vendor deps) — the\n// caller supplies the Readable and owns generation pinning.\n\nimport { createHash } from \"node:crypto\";\nimport { createReadStream, createWriteStream } from \"node:fs\";\nimport { mkdtemp, open, rm } from \"node:fs/promises\";\nimport os from \"node:os\";\nimport path from \"node:path\";\nimport { pipeline } from \"node:stream/promises\";\nimport type { Readable } from \"node:stream\";\n\n/** Thrown by {@link streamToTempFile} when the source exceeds `maxBytes`. */\nexport class ByteLimitExceededError extends Error {\n  readonly maxBytes: number;\n  constructor(maxBytes: number) {\n    super(`source exceeded the ${maxBytes}-byte limit`);\n    this.name = \"ByteLimitExceededError\";\n    this.maxBytes = maxBytes;\n  }\n}\n\nexport interface TempFileInput {\n  /** Absolute path of the fully-written temp file. */\n  localPath: string;\n  /** Total bytes written (always <= maxBytes). */\n  bytesWritten: number;\n  /** Removes the temp file and its private directory. Idempotent; never throws. */\n  cleanup: () => Promise<void>;\n}\n\nexport interface StreamToTempFileOptions {\n  /** HARD cap: the stream is destroyed and the temp file removed the moment the\n   *  cap is crossed, so an oversized source never fully lands on disk. */\n  maxBytes: number;\n  /** Temp-dir prefix (default \"media-input-\"). */\n  prefix?: string;\n}\n\n/**\n * Streams a Readable into a private temp file with a hard byte cap and\n * constant memory. On success the caller MUST invoke `cleanup()` in a\n * `finally`. On any failure (cap exceeded, stream error) the temp file is\n * removed before the error propagates.\n */\nexport async function streamToTempFile(\n  source: Readable,\n  options: StreamToTempFileOptions,\n): Promise<TempFileInput> {\n  const { maxBytes, prefix = \"media-input-\" } = options;\n  if (!Number.isFinite(maxBytes) || maxBytes <= 0) {\n    throw new Error(\"streamToTempFile requires a positive finite maxBytes\");\n  }\n  const dir = await mkdtemp(path.join(os.tmpdir(), prefix));\n  const localPath = path.join(dir, \"input\");\n  const cleanup = async () => {\n    await rm(dir, { recursive: true, force: true }).catch(() => {});\n  };\n\n  let bytesWritten = 0;\n  try {\n    const sink = createWriteStream(localPath, { flags: \"wx\" });\n    await pipeline(source, async function* (chunks: AsyncIterable<Buffer | string>) {\n      for await (const chunk of chunks) {\n        const buf = typeof chunk === \"string\" ? Buffer.from(chunk) : chunk;\n        bytesWritten += buf.byteLength;\n        if (bytesWritten > maxBytes) throw new ByteLimitExceededError(maxBytes);\n        yield buf;\n      }\n    }, sink);\n  } catch (err) {\n    await cleanup();\n    throw err;\n  }\n  return { localPath, bytesWritten, cleanup };\n}\n\n/** Streams a file through SHA-256 (constant memory) and returns the lowercase hex digest. */\nexport async function hashFileSha256(localPath: string): Promise<string> {\n  const hash = createHash(\"sha256\");\n  await pipeline(createReadStream(localPath), async (chunks: AsyncIterable<Buffer>) => {\n    for await (const chunk of chunks) hash.update(chunk);\n  });\n  return hash.digest(\"hex\");\n}\n\n/** Default header window for signature-family checks (matches the inspector's sniff window). */\nexport const FILE_HEADER_BYTES = 64 * 1024;\n\n/**\n * Reads at most `maxBytes` (default 64 KiB) from the start of a file — the\n * bounded input for {@link detectSignatureFamily}-style checks without loading\n * the whole source.\n */\nexport async function readFileHeader(\n  localPath: string,\n  maxBytes: number = FILE_HEADER_BYTES,\n): Promise<Uint8Array> {\n  const handle = await open(localPath, \"r\");\n  try {\n    const buf = Buffer.alloc(maxBytes);\n    const { bytesRead } = await handle.read(buf, 0, maxBytes, 0);\n    return buf.subarray(0, bytesRead);\n  } finally {\n    await handle.close();\n  }\n}\n"]}

package/dist/run-pipeline.d.ts

@@ -1,4 +1,5 @@
-import type { MediaProcessingResult, MediaProcessingSpec } from "@ttt-productions/media-schemas";
+import type { MediaProcessingResult, MediaProcessingSpec, MediaInspectionResult, MediaProcessingError } from "@ttt-productions/media-schemas";
+import { type InspectMediaDeps } from "./inspection/inspect-media.js";
 import type { MediaIO } from "./io/types.js";
 import type { ModerationAdapter } from "./moderation/types.js";
 export interface RunPipelineArgs {
@@ -8,6 +9,33 @@ export interface RunPipelineArgs {
     moderation?: ModerationAdapter;
     signal?: AbortSignal;
     onProgress?: (p: import("./types.js").MediaPipelineProgress) => void;
+    /**
+     * CANONICAL INSPECTION SEAM (canonical-upload-content-classification).
+     * When present, the pipeline runs `inspectMedia` on the just-downloaded temp
+     * input — BEFORE moderation and processing — and calls this policy hook with
+     * the bounded result. The hook either:
+     *   - returns `{ spec }` — the caller's policy adapter selected the
+     *     processing spec FROM the inspection (the byte-derived kind, never the
+     *     client MIME); the pipeline continues with that spec; or
+     *   - returns `{ reject }` — a typed terminal (`kind_mismatch`,
+     *     `unsupported_format`, `unsupported_codec`, …); the pipeline stops
+     *     before any transcode/moderation work.
+     * The inspection result rides the returned `MediaProcessingResult.inspection`
+     * either way, so the finalizer hands the SAME object to the safety gate —
+     * one authority, no re-detection. Callers that omit the hook get the
+     * pre-existing behavior unchanged.
+     */
+    resolveAfterInspection?: (inspection: MediaInspectionResult) => Promise<{
+        spec: MediaProcessingSpec;
+    } | {
+        reject: MediaProcessingError;
+    }> | ({
+        spec: MediaProcessingSpec;
+    } | {
+        reject: MediaProcessingError;
+    });
+    /** Inspection tool overrides (tests). */
+    inspectionDeps?: InspectMediaDeps;
 }
 export declare function runMediaPipeline(args: RunPipelineArgs): Promise<MediaProcessingResult>;
 //# sourceMappingURL=run-pipeline.d.ts.map

package/dist/run-pipeline.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"run-pipeline.d.ts","sourceRoot":"","sources":["../src/run-pipeline.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACR,qBAAqB,EACrB,mBAAmB,EAEpB,MAAM,gCAAgC,CAAC;AAIxC,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAC7C,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAK/D,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,mBAAmB,CAAC;IAC1B,EAAE,EAAE,OAAO,CAAC;IACZ,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,UAAU,CAAC,EAAE,iBAAiB,CAAC;IACjC,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,UAAU,CAAC,EAAE,CAAC,CAAC,EAAE,OAAO,YAAY,EAAE,qBAAqB,KAAK,IAAI,CAAC;CACpE;AAiBD,wBAAsB,gBAAgB,CAAC,IAAI,EAAE,eAAe,GAAG,OAAO,CAAC,qBAAqB,CAAC,CA2M5F"}
+{"version":3,"file":"run-pipeline.d.ts","sourceRoot":"","sources":["../src/run-pipeline.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACR,qBAAqB,EACrB,mBAAmB,EAEnB,qBAAqB,EACrB,oBAAoB,EACrB,MAAM,gCAAgC,CAAC;AAIxC,OAAO,EAAgB,KAAK,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AACpF,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAC7C,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAK/D,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,mBAAmB,CAAC;IAC1B,EAAE,EAAE,OAAO,CAAC;IACZ,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,UAAU,CAAC,EAAE,iBAAiB,CAAC;IACjC,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,UAAU,CAAC,EAAE,CAAC,CAAC,EAAE,OAAO,YAAY,EAAE,qBAAqB,KAAK,IAAI,CAAC;IACrE;;;;;;;;;;;;;;;OAeG;IACH,sBAAsB,CAAC,EAAE,CACvB,UAAU,EAAE,qBAAqB,KAC9B,OAAO,CAAC;QAAE,IAAI,EAAE,mBAAmB,CAAA;KAAE,GAAG;QAAE,MAAM,EAAE,oBAAoB,CAAA;KAAE,CAAC,GAAG,CAAC;QAAE,IAAI,EAAE,mBAAmB,CAAA;KAAE,GAAG;QAAE,MAAM,EAAE,oBAAoB,CAAA;KAAE,CAAC,CAAC;IACpJ,yCAAyC;IACzC,cAAc,CAAC,EAAE,gBAAgB,CAAC;CACjC;AAiBD,wBAAsB,gBAAgB,CAAC,IAAI,EAAE,eAAe,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAgP5F"}

package/dist/run-pipeline.js

@@ -1,6 +1,7 @@
 import { parseMediaProcessingSpec } from "@ttt-productions/media-schemas";
 import { createTempWorkspace } from "./workspace/temp.js";
 import { processMedia } from "./process-media.js";
+import { inspectMedia } from "./inspection/inspect-media.js";
 import { mergeModeration } from "./moderation/merge.js";
 import path from "node:path";
 import { stat } from "node:fs/promises";
@@ -20,7 +21,11 @@ function attachProvider(m, provider) {
 }
 export async function runMediaPipeline(args) {
     let { spec } = args;
-    const { io, outputBaseName = "media", moderation, signal, onProgress } = args;
+    const { io, outputBaseName = "media", moderation, signal, onProgress, resolveAfterInspection } = args;
+    // Carried onto every return path once produced — the finalizer must hand the
+    // SAME inspection object to the safety gate (one classification authority).
+    let inspection;
+    const withInspection = (r) => inspection ? { ...r, inspection } : r;
     if (signal?.aborted) {
         return {
             ok: false,
@@ -53,6 +58,38 @@ export async function runMediaPipeline(args) {
         onProgress?.({ phase: "read_input", percent: 0 });
         await io.input.readToFile(inputPath);
         onProgress?.({ phase: "read_input", percent: 1 });
+        // CANONICAL INSPECTION (before moderation and processing): classify the
+        // just-downloaded bytes structurally and let the caller's policy adapter
+        // pick the spec from the result. See RunPipelineArgs.resolveAfterInspection.
+        if (resolveAfterInspection) {
+            inspection = await inspectMedia({
+                localPath: inputPath,
+                ...(signal ? { signal } : {}),
+                ...(args.inspectionDeps ? { deps: args.inspectionDeps } : {}),
+            });
+            const resolution = await resolveAfterInspection(inspection);
+            if ("reject" in resolution) {
+                return withInspection({
+                    ok: false,
+                    mediaType: mediaTypeFromSpecKind(spec.kind),
+                    error: resolution.reject,
+                });
+            }
+            try {
+                spec = parseMediaProcessingSpec(resolution.spec);
+            }
+            catch (e) {
+                return withInspection({
+                    ok: false,
+                    mediaType: mediaTypeFromSpecKind(spec.kind),
+                    error: {
+                        code: "invalid_spec",
+                        message: "Invalid MediaProcessingSpec from resolveAfterInspection.",
+                        details: { issues: e?.issues ?? e?.message ?? String(e) },
+                    },
+                });
+            }
+        }
         // PRE moderation (original)
         let mIn;
         if (moderation?.moderateInput) {
@@ -73,7 +110,7 @@ export async function runMediaPipeline(args) {
             // "error") on the result — callers route that to their retryable
             // moderation lane and land the row failed rather than publishing it.
             if (mIn?.status === "rejected" || mIn?.status === "error") {
-                return {
+                return withInspection({
                     ok: false,
                     mediaType: mediaTypeFromSpecKind(spec.kind),
                     moderation: mIn,
@@ -88,7 +125,7 @@ export async function runMediaPipeline(args) {
                             message: "Rejected by moderation.",
                             details: { provider: mIn.provider, reasons: mIn.reasons, findings: mIn.findings },
                         },
-                };
+                });
             }
         }
         const result = await processMedia(spec, {
@@ -110,7 +147,7 @@ export async function runMediaPipeline(args) {
                 if (!o.sizeBytes)
                     o.sizeBytes = size;
                 if (size > perFileLimit) {
-                    return {
+                    return withInspection({
                         ok: false,
                         mediaType: mediaTypeFromSpecKind(spec.kind),
                         error: {
@@ -118,10 +155,10 @@ export async function runMediaPipeline(args) {
                             message: "Processed output exceeds allowed size.",
                             details: { key: o.key, sizeBytes: size, limitBytes: perFileLimit },
                         },
-                    };
+                    });
                 }
                 if (total > totalLimit) {
-                    return {
+                    return withInspection({
                         ok: false,
                         mediaType: mediaTypeFromSpecKind(spec.kind),
                         error: {
@@ -129,7 +166,7 @@ export async function runMediaPipeline(args) {
                             message: "Total processed outputs exceed allowed size.",
                             details: { totalBytes: total, limitBytes: totalLimit },
                         },
-                    };
+                    });
                 }
             }
         }
@@ -137,7 +174,7 @@ export async function runMediaPipeline(args) {
             if (mIn)
                 result.moderation = mIn;
             onProgress?.({ phase: "done", percent: result.ok ? 1 : 0 });
-            return result;
+            return withInspection(result);
         }
         // POST moderation (processed outputs) — runs on the LOCAL output paths
         // BEFORE any final persistence, so rejected output never reaches the
@@ -159,7 +196,7 @@ export async function runMediaPipeline(args) {
             // publish unscanned output. Ordering is load-bearing — see the
             // consuming app's media-serving design docs.
             if (mOut?.status === "rejected" || mOut?.status === "error") {
-                return {
+                return withInspection({
                     ok: false,
                     mediaType: result.mediaType,
                     moderation: mOut,
@@ -174,7 +211,7 @@ export async function runMediaPipeline(args) {
                             message: "Rejected by moderation.",
                             details: { provider: mOut.provider, reasons: mOut.reasons, findings: mOut.findings },
                         },
-                };
+                });
             }
         }
         // Persist outputs — only after input AND output moderation both passed.
@@ -183,7 +220,7 @@ export async function runMediaPipeline(args) {
         let outIdx = 0;
         for (const out of result.outputs) {
             if (signal?.aborted) {
-                return { ok: false, mediaType: result.mediaType, error: { code: "processing_canceled", message: "Processing canceled." } };
+                return withInspection({ ok: false, mediaType: result.mediaType, error: { code: "processing_canceled", message: "Processing canceled." } });
             }
             onProgress?.({ phase: "persist_outputs", percent: totalOut ? outIdx / totalOut : 0, detail: { key: out.key } });
             if (!out.path)
@@ -200,7 +237,7 @@ export async function runMediaPipeline(args) {
         if (merged)
             result.moderation = merged;
         onProgress?.({ phase: "done", percent: 1 });
-        return result;
+        return withInspection(result);
     }
     finally {
         await ws.cleanup();

package/dist/run-pipeline.js.map

@@ -1 +1 @@
-{"version":3,"file":"run-pipeline.js","sourceRoot":"","sources":["../src/run-pipeline.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,wBAAwB,EAAE,MAAM,gCAAgC,CAAC;AACxE,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC1D,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAGlD,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAWxC,SAAS,qBAAqB,CAAC,IAAiC;IAC9D,IAAI,IAAI,KAAK,OAAO;QAAE,OAAO,OAAO,CAAC;IACrC,IAAI,IAAI,KAAK,OAAO;QAAE,OAAO,OAAO,CAAC;IACrC,IAAI,IAAI,KAAK,OAAO;QAAE,OAAO,OAAO,CAAC;IACrC,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,cAAc,CACrB,CAA2C,EAC3C,QAAiB;IAEjB,IAAI,CAAC,CAAC;QAAE,OAAO,CAAC,CAAC;IACjB,OAAO,EAAE,GAAG,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,IAAI,QAAQ,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;AAC5F,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,IAAqB;IAC1D,IAAI,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC;IACpB,MAAM,EAAE,EAAE,EAAE,cAAc,GAAG,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,IAAI,CAAC;IAE9E,IAAI,MAAM,EAAE,OAAO,EAAE,CAAC;QACpB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,SAAS,EAAE,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC;YAC3C,KAAK,EAAE,EAAE,IAAI,EAAE,qBAAqB,EAAE,OAAO,EAAE,sBAAsB,EAAE;SACxE,CAAC;IACJ,CAAC;IAED,kEAAkE;IAClE,IAAI,CAAC;QACH,IAAI,GAAG,wBAAwB,CAAC,IAAI,CAAC,CAAC;IACxC,CAAC;IAAC,OAAO,CAAM,EAAE,CAAC;QAChB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,SAAS,EAAE,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC;YAC3C,KAAK,EAAE;gBACL,IAAI,EAAE,cAAc;gBACpB,OAAO,EAAE,8BAA8B;gBACvC,OAAO,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,IAAI,CAAC,EAAE,OAAO,IAAI,MAAM,CAAC,CAAC,CAAC,EAAE;aAC1D;SACF,CAAC;IACJ,CAAC;IAED,MAAM,EAAE,GAAG,MAAM,mBAAmB,EAAE,CAAC;IAEvC,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QAC7C,MAAM,cAAc,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;QAEzD,IAAI,MAAM,EAAE,OAAO,EAAE,CAAC;YACpB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,qBAAqB,EAAE,OAAO,EAAE,sBAAsB,EAAE,EAAE,CAAC;QAC7I,CAAC;QACD,UAAU,EAAE,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;QAClD,MAAM,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QACrC,UAAU,EAAE,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;QAElD,4BAA4B;QAC5B,IAAI,GAA6C,CAAC;QAClD,IAAI,UAAU,EAAE,aAAa,EAAE,CAAC;YAC9B,UAAU,EAAE,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;YACxD,GAAG,GAAG,cAAc,CAClB,MAAM,UAAU,CAAC,aAAa,CAAC;gBAC7B,IAAI;gBACJ,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,SAAS,EAAE,SAAS;gBACpB,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI;aACpB,CAAC,EACF,UAAU,CAAC,QAAQ,CACpB,CAAC;YACF,UAAU,EAAE,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;YAExD,qEAAqE;YACrE,wEAAwE;YACxE,sEAAsE;YACtE,wEAAwE;YACxE,gEAAgE;YAChE,sEAAsE;YACtE,iEAAiE;YACjE,qEAAqE;YACrE,IAAI,GAAG,EAAE,MAAM,KAAK,UAAU,IAAI,GAAG,EAAE,MAAM,KAAK,OAAO,EAAE,CAAC;gBAC1D,OAAO;oBACL,EAAE,EAAE,KAAK;oBACT,SAAS,EAAE,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC;oBAC3C,UAAU,EAAE,GAAG;oBACf,KAAK,EACH,GAAG,CAAC,MAAM,KAAK,OAAO;wBACpB,CAAC,CAAC;4BACE,IAAI,EAAE,mBAAmB;4BACzB,OAAO,EAAE,oCAAoC;4BAC7C,OAAO,EAAE,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,kBAAkB,EAAE;yBAChE;wBACH,CAAC,CAAC;4BACE,IAAI,EAAE,UAAU;4BAChB,OAAO,EAAE,yBAAyB;4BAClC,OAAO,EAAE,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE;yBAClF;iBACR,CAAC;YACJ,CAAC;QACH,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,IAAI,EAAE;YACtC,SAAS;YACT,cAAc;YACd,SAAS,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI;SACzB,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;QAE3B,8CAA8C;QAC9C,IAAI,MAAM,CAAC,EAAE,IAAI,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC;YACxC,MAAM,YAAY,GAAG,IAAI,CAAC,cAAc,IAAI,IAAI,CAAC,QAAQ,IAAI,GAAG,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC,gBAAgB;YAChG,MAAM,UAAU,GAAG,IAAI,CAAC,mBAAmB,IAAI,IAAI,CAAC,cAAc,IAAI,IAAI,CAAC,QAAQ,IAAI,GAAG,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC,gBAAgB;YAE1H,IAAI,KAAK,GAAG,CAAC,CAAC;YACd,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;gBAC/B,IAAI,CAAC,CAAC,CAAC,IAAI;oBAAE,SAAS;gBACtB,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;gBAC7B,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC;gBACjC,KAAK,IAAI,IAAI,CAAC;gBACd,IAAI,CAAC,CAAC,CAAC,SAAS;oBAAE,CAAC,CAAC,SAAS,GAAG,IAAI,CAAC;gBACrC,IAAI,IAAI,GAAG,YAAY,EAAE,CAAC;oBACxB,OAAO;wBACL,EAAE,EAAE,KAAK;wBACT,SAAS,EAAE,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC;wBAC3C,KAAK,EAAE;4BACL,IAAI,EAAE,WAAW;4BACjB,OAAO,EAAE,wCAAwC;4BACjD,OAAO,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,UAAU,EAAE,YAAY,EAAE;yBACnE;qBACF,CAAC;gBACJ,CAAC;gBACD,IAAI,KAAK,GAAG,UAAU,EAAE,CAAC;oBACvB,OAAO;wBACL,EAAE,EAAE,KAAK;wBACT,SAAS,EAAE,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC;wBAC3C,KAAK,EAAE;4BACL,IAAI,EAAE,WAAW;4BACjB,OAAO,EAAE,8CAA8C;4BACvD,OAAO,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE;yBACvD;qBACF,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC;YAC1C,IAAI,GAAG;gBAAE,MAAM,CAAC,UAAU,GAAG,GAAG,CAAC;YACjC,UAAU,EAAE,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YAC5D,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,uEAAuE;QACvE,qEAAqE;QACrE,8DAA8D;QAC9D,iDAAiD;QACjD,IAAI,IAA8C,CAAC;QACnD,IAAI,UAAU,EAAE,cAAc,EAAE,CAAC;YAC/B,UAAU,EAAE,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;YACzD,IAAI,GAAG,cAAc,CACnB,MAAM,UAAU,CAAC,cAAc,CAAC;gBAC9B,IAAI;gBACJ,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,OAAO,EAAE,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC;qBAC5B,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;qBACvB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,SAAS,EAAE,CAAC,CAAC,IAAK,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;aAClE,CAAC,EACF,UAAU,CAAC,QAAQ,CACpB,CAAC;YACF,UAAU,EAAE,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;YAEzD,qEAAqE;YACrE,uEAAuE;YACvE,+DAA+D;YAC/D,6CAA6C;YAC7C,IAAI,IAAI,EAAE,MAAM,KAAK,UAAU,IAAI,IAAI,EAAE,MAAM,KAAK,OAAO,EAAE,CAAC;gBAC5D,OAAO;oBACL,EAAE,EAAE,KAAK;oBACT,SAAS,EAAE,MAAM,CAAC,SAAS;oBAC3B,UAAU,EAAE,IAAI;oBAChB,KAAK,EACH,IAAI,CAAC,MAAM,KAAK,OAAO;wBACrB,CAAC,CAAC;4BACE,IAAI,EAAE,mBAAmB;4BACzB,OAAO,EAAE,oCAAoC;4BAC7C,OAAO,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,kBAAkB,EAAE;yBACjE;wBACH,CAAC,CAAC;4BACE,IAAI,EAAE,UAAU;4BAChB,OAAO,EAAE,yBAAyB;4BAClC,OAAO,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE;yBACrF;iBACR,CAAC;YACJ,CAAC;QACH,CAAC;QAED,wEAAwE;QACxE,UAAU,EAAE,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;QACvD,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC;QACvC,IAAI,MAAM,GAAG,CAAC,CAAC;QACf,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACjC,IAAI,MAAM,EAAE,OAAO,EAAE,CAAC;gBACpB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,qBAAqB,EAAE,OAAO,EAAE,sBAAsB,EAAE,EAAE,CAAC;YAC7H,CAAC;YACD,UAAU,EAAE,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,MAAM,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YAChH,IAAI,CAAC,GAAG,CAAC,IAAI;gBAAE,SAAS;YACxB,MAAM,SAAS,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;YACnE,IAAI,SAAS,CAAC,GAAG;gBAAE,GAAG,CAAC,GAAG,GAAG,SAAS,CAAC,GAAG,CAAC;YAC3C,IAAI,SAAS,CAAC,IAAI;gBAAE,GAAG,CAAC,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC;YAC9C,MAAM,IAAI,CAAC,CAAC;QACd,CAAC;QACD,UAAU,EAAE,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;QAEvD,MAAM,MAAM,GAAG,eAAe,CAAC,GAAG,IAAI,SAAS,EAAE,IAAI,IAAI,SAAS,CAAC,CAAC;QACpE,IAAI,MAAM;YAAE,MAAM,CAAC,UAAU,GAAG,MAAM,CAAC;QAEvC,UAAU,EAAE,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;QAE5C,OAAO,MAAM,CAAC;IAChB,CAAC;YAAS,CAAC;QACT,MAAM,EAAE,CAAC,OAAO,EAAE,CAAC;IACrB,CAAC;AACH,CAAC","sourcesContent":["import type {\n    MediaProcessingResult,\n    MediaProcessingSpec,\n    MediaModerationResult,\n  } from \"@ttt-productions/media-schemas\";\nimport { parseMediaProcessingSpec } from \"@ttt-productions/media-schemas\";\n  import { createTempWorkspace } from \"./workspace/temp.js\";\n  import { processMedia } from \"./process-media.js\";\n  import type { MediaIO } from \"./io/types.js\";\n  import type { ModerationAdapter } from \"./moderation/types.js\";\n  import { mergeModeration } from \"./moderation/merge.js\";\n  import path from \"node:path\";\n  import { stat } from \"node:fs/promises\";\n  \n  export interface RunPipelineArgs {\n    spec: MediaProcessingSpec;\n    io: MediaIO;\n    outputBaseName?: string;\n    moderation?: ModerationAdapter;\n  signal?: AbortSignal;\n  onProgress?: (p: import(\"./types.js\").MediaPipelineProgress) => void;\n  }\n  \n  function mediaTypeFromSpecKind(kind: MediaProcessingSpec[\"kind\"]): \"image\" | \"video\" | \"audio\" | \"other\" {\n    if (kind === \"image\") return \"image\";\n    if (kind === \"video\") return \"video\";\n    if (kind === \"audio\") return \"audio\";\n    return \"other\";\n  }\n  \n  function attachProvider(\n    m: MediaModerationResult | null | undefined,\n    provider?: string\n  ): MediaModerationResult | null | undefined {\n    if (!m) return m;\n    return { ...m, provider: m.provider ?? provider, reviewedAt: m.reviewedAt ?? Date.now() };\n  }\n  \n  export async function runMediaPipeline(args: RunPipelineArgs): Promise<MediaProcessingResult> {\n    let { spec } = args;\n    const { io, outputBaseName = \"media\", moderation, signal, onProgress } = args;\n\n    if (signal?.aborted) {\n      return {\n        ok: false,\n        mediaType: mediaTypeFromSpecKind(spec.kind),\n        error: { code: \"processing_canceled\", message: \"Processing canceled.\" },\n      };\n    }\n\n    // Runtime contract validation (fast-fail with actionable errors).\n    try {\n      spec = parseMediaProcessingSpec(spec);\n    } catch (e: any) {\n      return {\n        ok: false,\n        mediaType: mediaTypeFromSpecKind(spec.kind),\n        error: {\n          code: \"invalid_spec\",\n          message: \"Invalid MediaProcessingSpec.\",\n          details: { issues: e?.issues ?? e?.message ?? String(e) },\n        },\n      };\n    }\n  \n    const ws = await createTempWorkspace();\n  \n    try {\n      const inputPath = path.join(ws.dir, \"input\");\n      const outputBasePath = path.join(ws.dir, outputBaseName);\n  \n      if (signal?.aborted) {\n        return { ok: false, mediaType: mediaTypeFromSpecKind(spec.kind), error: { code: \"processing_canceled\", message: \"Processing canceled.\" } };\n      }\n      onProgress?.({ phase: \"read_input\", percent: 0 });\n      await io.input.readToFile(inputPath);\n      onProgress?.({ phase: \"read_input\", percent: 1 });\n  \n      // PRE moderation (original)\n      let mIn: MediaModerationResult | null | undefined;\n      if (moderation?.moderateInput) {\n        onProgress?.({ phase: \"moderation_input\", percent: 0 });\n        mIn = attachProvider(\n          await moderation.moderateInput({\n            spec,\n            kind: spec.kind,\n            localPath: inputPath,\n            mime: io.input.mime,\n          }),\n          moderation.provider\n        );\n        onProgress?.({ phase: \"moderation_input\", percent: 1 });\n  \n        // Fail closed on both \"rejected\" (policy violation) and \"error\" (the\n        // moderation check itself did not complete — quota/outage/API failure).\n        // A non-passing check must NEVER fall through to transcode + persist:\n        // published bytes must always have been scanned. An \"error\" is a system\n        // failure, not a content rejection, so it returns the distinct,\n        // retryable `processing_failed` code AND carries `moderation` (status\n        // \"error\") on the result — callers route that to their retryable\n        // moderation lane and land the row failed rather than publishing it.\n        if (mIn?.status === \"rejected\" || mIn?.status === \"error\") {\n          return {\n            ok: false,\n            mediaType: mediaTypeFromSpecKind(spec.kind),\n            moderation: mIn,\n            error:\n              mIn.status === \"error\"\n                ? {\n                    code: \"processing_failed\",\n                    message: \"Moderation check did not complete.\",\n                    details: { provider: mIn.provider, reason: \"moderation_error\" },\n                  }\n                : {\n                    code: \"rejected\",\n                    message: \"Rejected by moderation.\",\n                    details: { provider: mIn.provider, reasons: mIn.reasons, findings: mIn.findings },\n                  },\n          };\n        }\n      }\n  \n      const result = await processMedia(spec, {\n        inputPath,\n        outputBasePath,\n        inputMime: io.input.mime,\n      }, { signal, onProgress });\n\n      // Output size enforcement (processed outputs)\n      if (result.ok && result.outputs?.length) {\n        const perFileLimit = spec.maxOutputBytes ?? spec.maxBytes ?? 200 * 1024 * 1024; // 200MB default\n        const totalLimit = spec.maxTotalOutputBytes ?? spec.maxOutputBytes ?? spec.maxBytes ?? 400 * 1024 * 1024; // 400MB default\n\n        let total = 0;\n        for (const o of result.outputs) {\n          if (!o.path) continue;\n          const s = await stat(o.path);\n          const size = Number(s.size ?? 0);\n          total += size;\n          if (!o.sizeBytes) o.sizeBytes = size;\n          if (size > perFileLimit) {\n            return {\n              ok: false,\n              mediaType: mediaTypeFromSpecKind(spec.kind),\n              error: {\n                code: \"too_large\",\n                message: \"Processed output exceeds allowed size.\",\n                details: { key: o.key, sizeBytes: size, limitBytes: perFileLimit },\n              },\n            };\n          }\n          if (total > totalLimit) {\n            return {\n              ok: false,\n              mediaType: mediaTypeFromSpecKind(spec.kind),\n              error: {\n                code: \"too_large\",\n                message: \"Total processed outputs exceed allowed size.\",\n                details: { totalBytes: total, limitBytes: totalLimit },\n              },\n            };\n          }\n        }\n      }\n  \n      if (!result.ok || !result.outputs?.length) {\n        if (mIn) result.moderation = mIn;\n        onProgress?.({ phase: \"done\", percent: result.ok ? 1 : 0 });\n        return result;\n      }\n  \n      // POST moderation (processed outputs) — runs on the LOCAL output paths\n      // BEFORE any final persistence, so rejected output never reaches the\n      // final store (R2 / emulator). Ordering is load-bearing — see\n      // the consuming app's media-serving design docs.\n      let mOut: MediaModerationResult | null | undefined;\n      if (moderation?.moderateOutput) {\n        onProgress?.({ phase: \"moderation_output\", percent: 0 });\n        mOut = attachProvider(\n          await moderation.moderateOutput({\n            spec,\n            kind: spec.kind,\n            outputs: (result.outputs ?? [])\n              .filter((o) => !!o.path)\n              .map((o) => ({ key: o.key, localPath: o.path!, mime: o.mime })),\n          }),\n          moderation.provider\n        );\n        onProgress?.({ phase: \"moderation_output\", percent: 1 });\n\n        // Same fail-closed posture as the input check: block both \"rejected\"\n        // and \"error\" before any persistence, so an incomplete check can never\n        // publish unscanned output. Ordering is load-bearing — see the\n        // consuming app's media-serving design docs.\n        if (mOut?.status === \"rejected\" || mOut?.status === \"error\") {\n          return {\n            ok: false,\n            mediaType: result.mediaType,\n            moderation: mOut,\n            error:\n              mOut.status === \"error\"\n                ? {\n                    code: \"processing_failed\",\n                    message: \"Moderation check did not complete.\",\n                    details: { provider: mOut.provider, reason: \"moderation_error\" },\n                  }\n                : {\n                    code: \"rejected\",\n                    message: \"Rejected by moderation.\",\n                    details: { provider: mOut.provider, reasons: mOut.reasons, findings: mOut.findings },\n                  },\n          };\n        }\n      }\n\n      // Persist outputs — only after input AND output moderation both passed.\n      onProgress?.({ phase: \"persist_outputs\", percent: 0 });\n      const totalOut = result.outputs.length;\n      let outIdx = 0;\n      for (const out of result.outputs) {\n        if (signal?.aborted) {\n          return { ok: false, mediaType: result.mediaType, error: { code: \"processing_canceled\", message: \"Processing canceled.\" } };\n        }\n        onProgress?.({ phase: \"persist_outputs\", percent: totalOut ? outIdx / totalOut : 0, detail: { key: out.key } });\n        if (!out.path) continue;\n        const persisted = await io.output.writeFromFile(out.path, out.key);\n        if (persisted.url) out.url = persisted.url;\n        if (persisted.path) out.path = persisted.path;\n        outIdx += 1;\n      }\n      onProgress?.({ phase: \"persist_outputs\", percent: 1 });\n\n      const merged = mergeModeration(mIn ?? undefined, mOut ?? undefined);\n      if (merged) result.moderation = merged;\n\n      onProgress?.({ phase: \"done\", percent: 1 });\n  \n      return result;\n    } finally {\n      await ws.cleanup();\n    }\n  }\n  "]}
+{"version":3,"file":"run-pipeline.js","sourceRoot":"","sources":["../src/run-pipeline.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,wBAAwB,EAAE,MAAM,gCAAgC,CAAC;AACxE,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC1D,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,YAAY,EAAyB,MAAM,+BAA+B,CAAC;AAGpF,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAgCxC,SAAS,qBAAqB,CAAC,IAAiC;IAC9D,IAAI,IAAI,KAAK,OAAO;QAAE,OAAO,OAAO,CAAC;IACrC,IAAI,IAAI,KAAK,OAAO;QAAE,OAAO,OAAO,CAAC;IACrC,IAAI,IAAI,KAAK,OAAO;QAAE,OAAO,OAAO,CAAC;IACrC,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,cAAc,CACrB,CAA2C,EAC3C,QAAiB;IAEjB,IAAI,CAAC,CAAC;QAAE,OAAO,CAAC,CAAC;IACjB,OAAO,EAAE,GAAG,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,IAAI,QAAQ,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;AAC5F,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,IAAqB;IAC1D,IAAI,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC;IACpB,MAAM,EAAE,EAAE,EAAE,cAAc,GAAG,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,sBAAsB,EAAE,GAAG,IAAI,CAAC;IACtG,6EAA6E;IAC7E,4EAA4E;IAC5E,IAAI,UAA6C,CAAC;IAClD,MAAM,cAAc,GAAG,CAAC,CAAwB,EAAyB,EAAE,CACzE,UAAU,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAExC,IAAI,MAAM,EAAE,OAAO,EAAE,CAAC;QACpB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,SAAS,EAAE,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC;YAC3C,KAAK,EAAE,EAAE,IAAI,EAAE,qBAAqB,EAAE,OAAO,EAAE,sBAAsB,EAAE;SACxE,CAAC;IACJ,CAAC;IAED,kEAAkE;IAClE,IAAI,CAAC;QACH,IAAI,GAAG,wBAAwB,CAAC,IAAI,CAAC,CAAC;IACxC,CAAC;IAAC,OAAO,CAAM,EAAE,CAAC;QAChB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,SAAS,EAAE,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC;YAC3C,KAAK,EAAE;gBACL,IAAI,EAAE,cAAc;gBACpB,OAAO,EAAE,8BAA8B;gBACvC,OAAO,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,IAAI,CAAC,EAAE,OAAO,IAAI,MAAM,CAAC,CAAC,CAAC,EAAE;aAC1D;SACF,CAAC;IACJ,CAAC;IAED,MAAM,EAAE,GAAG,MAAM,mBAAmB,EAAE,CAAC;IAEvC,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QAC7C,MAAM,cAAc,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;QAEzD,IAAI,MAAM,EAAE,OAAO,EAAE,CAAC;YACpB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,qBAAqB,EAAE,OAAO,EAAE,sBAAsB,EAAE,EAAE,CAAC;QAC7I,CAAC;QACD,UAAU,EAAE,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;QAClD,MAAM,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QACrC,UAAU,EAAE,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;QAElD,wEAAwE;QACxE,yEAAyE;QACzE,6EAA6E;QAC7E,IAAI,sBAAsB,EAAE,CAAC;YAC3B,UAAU,GAAG,MAAM,YAAY,CAAC;gBAC9B,SAAS,EAAE,SAAS;gBACpB,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC7B,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC9D,CAAC,CAAC;YACH,MAAM,UAAU,GAAG,MAAM,sBAAsB,CAAC,UAAU,CAAC,CAAC;YAC5D,IAAI,QAAQ,IAAI,UAAU,EAAE,CAAC;gBAC3B,OAAO,cAAc,CAAC;oBACpB,EAAE,EAAE,KAAK;oBACT,SAAS,EAAE,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC;oBAC3C,KAAK,EAAE,UAAU,CAAC,MAAM;iBACzB,CAAC,CAAC;YACL,CAAC;YACD,IAAI,CAAC;gBACH,IAAI,GAAG,wBAAwB,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;YACnD,CAAC;YAAC,OAAO,CAAM,EAAE,CAAC;gBAChB,OAAO,cAAc,CAAC;oBACpB,EAAE,EAAE,KAAK;oBACT,SAAS,EAAE,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC;oBAC3C,KAAK,EAAE;wBACL,IAAI,EAAE,cAAc;wBACpB,OAAO,EAAE,0DAA0D;wBACnE,OAAO,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,IAAI,CAAC,EAAE,OAAO,IAAI,MAAM,CAAC,CAAC,CAAC,EAAE;qBAC1D;iBACF,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,4BAA4B;QAC5B,IAAI,GAA6C,CAAC;QAClD,IAAI,UAAU,EAAE,aAAa,EAAE,CAAC;YAC9B,UAAU,EAAE,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;YACxD,GAAG,GAAG,cAAc,CAClB,MAAM,UAAU,CAAC,aAAa,CAAC;gBAC7B,IAAI;gBACJ,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,SAAS,EAAE,SAAS;gBACpB,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI;aACpB,CAAC,EACF,UAAU,CAAC,QAAQ,CACpB,CAAC;YACF,UAAU,EAAE,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;YAExD,qEAAqE;YACrE,wEAAwE;YACxE,sEAAsE;YACtE,wEAAwE;YACxE,gEAAgE;YAChE,sEAAsE;YACtE,iEAAiE;YACjE,qEAAqE;YACrE,IAAI,GAAG,EAAE,MAAM,KAAK,UAAU,IAAI,GAAG,EAAE,MAAM,KAAK,OAAO,EAAE,CAAC;gBAC1D,OAAO,cAAc,CAAC;oBACpB,EAAE,EAAE,KAAK;oBACT,SAAS,EAAE,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC;oBAC3C,UAAU,EAAE,GAAG;oBACf,KAAK,EACH,GAAG,CAAC,MAAM,KAAK,OAAO;wBACpB,CAAC,CAAC;4BACE,IAAI,EAAE,mBAAmB;4BACzB,OAAO,EAAE,oCAAoC;4BAC7C,OAAO,EAAE,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,kBAAkB,EAAE;yBAChE;wBACH,CAAC,CAAC;4BACE,IAAI,EAAE,UAAU;4BAChB,OAAO,EAAE,yBAAyB;4BAClC,OAAO,EAAE,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE;yBAClF;iBACR,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,IAAI,EAAE;YACtC,SAAS;YACT,cAAc;YACd,SAAS,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI;SACzB,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;QAE3B,8CAA8C;QAC9C,IAAI,MAAM,CAAC,EAAE,IAAI,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC;YACxC,MAAM,YAAY,GAAG,IAAI,CAAC,cAAc,IAAI,IAAI,CAAC,QAAQ,IAAI,GAAG,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC,gBAAgB;YAChG,MAAM,UAAU,GAAG,IAAI,CAAC,mBAAmB,IAAI,IAAI,CAAC,cAAc,IAAI,IAAI,CAAC,QAAQ,IAAI,GAAG,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC,gBAAgB;YAE1H,IAAI,KAAK,GAAG,CAAC,CAAC;YACd,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;gBAC/B,IAAI,CAAC,CAAC,CAAC,IAAI;oBAAE,SAAS;gBACtB,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;gBAC7B,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC;gBACjC,KAAK,IAAI,IAAI,CAAC;gBACd,IAAI,CAAC,CAAC,CAAC,SAAS;oBAAE,CAAC,CAAC,SAAS,GAAG,IAAI,CAAC;gBACrC,IAAI,IAAI,GAAG,YAAY,EAAE,CAAC;oBACxB,OAAO,cAAc,CAAC;wBACpB,EAAE,EAAE,KAAK;wBACT,SAAS,EAAE,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC;wBAC3C,KAAK,EAAE;4BACL,IAAI,EAAE,WAAW;4BACjB,OAAO,EAAE,wCAAwC;4BACjD,OAAO,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,UAAU,EAAE,YAAY,EAAE;yBACnE;qBACF,CAAC,CAAC;gBACL,CAAC;gBACD,IAAI,KAAK,GAAG,UAAU,EAAE,CAAC;oBACvB,OAAO,cAAc,CAAC;wBACpB,EAAE,EAAE,KAAK;wBACT,SAAS,EAAE,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC;wBAC3C,KAAK,EAAE;4BACL,IAAI,EAAE,WAAW;4BACjB,OAAO,EAAE,8CAA8C;4BACvD,OAAO,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE;yBACvD;qBACF,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC;YAC1C,IAAI,GAAG;gBAAE,MAAM,CAAC,UAAU,GAAG,GAAG,CAAC;YACjC,UAAU,EAAE,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YAC5D,OAAO,cAAc,CAAC,MAAM,CAAC,CAAC;QAChC,CAAC;QAED,uEAAuE;QACvE,qEAAqE;QACrE,8DAA8D;QAC9D,iDAAiD;QACjD,IAAI,IAA8C,CAAC;QACnD,IAAI,UAAU,EAAE,cAAc,EAAE,CAAC;YAC/B,UAAU,EAAE,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;YACzD,IAAI,GAAG,cAAc,CACnB,MAAM,UAAU,CAAC,cAAc,CAAC;gBAC9B,IAAI;gBACJ,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,OAAO,EAAE,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC;qBAC5B,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;qBACvB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,SAAS,EAAE,CAAC,CAAC,IAAK,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;aAClE,CAAC,EACF,UAAU,CAAC,QAAQ,CACpB,CAAC;YACF,UAAU,EAAE,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;YAEzD,qEAAqE;YACrE,uEAAuE;YACvE,+DAA+D;YAC/D,6CAA6C;YAC7C,IAAI,IAAI,EAAE,MAAM,KAAK,UAAU,IAAI,IAAI,EAAE,MAAM,KAAK,OAAO,EAAE,CAAC;gBAC5D,OAAO,cAAc,CAAC;oBACpB,EAAE,EAAE,KAAK;oBACT,SAAS,EAAE,MAAM,CAAC,SAAS;oBAC3B,UAAU,EAAE,IAAI;oBAChB,KAAK,EACH,IAAI,CAAC,MAAM,KAAK,OAAO;wBACrB,CAAC,CAAC;4BACE,IAAI,EAAE,mBAAmB;4BACzB,OAAO,EAAE,oCAAoC;4BAC7C,OAAO,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,kBAAkB,EAAE;yBACjE;wBACH,CAAC,CAAC;4BACE,IAAI,EAAE,UAAU;4BAChB,OAAO,EAAE,yBAAyB;4BAClC,OAAO,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE;yBACrF;iBACR,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,wEAAwE;QACxE,UAAU,EAAE,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;QACvD,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC;QACvC,IAAI,MAAM,GAAG,CAAC,CAAC;QACf,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACjC,IAAI,MAAM,EAAE,OAAO,EAAE,CAAC;gBACpB,OAAO,cAAc,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,qBAAqB,EAAE,OAAO,EAAE,sBAAsB,EAAE,EAAE,CAAC,CAAC;YAC7I,CAAC;YACD,UAAU,EAAE,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,MAAM,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YAChH,IAAI,CAAC,GAAG,CAAC,IAAI;gBAAE,SAAS;YACxB,MAAM,SAAS,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;YACnE,IAAI,SAAS,CAAC,GAAG;gBAAE,GAAG,CAAC,GAAG,GAAG,SAAS,CAAC,GAAG,CAAC;YAC3C,IAAI,SAAS,CAAC,IAAI;gBAAE,GAAG,CAAC,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC;YAC9C,MAAM,IAAI,CAAC,CAAC;QACd,CAAC;QACD,UAAU,EAAE,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;QAEvD,MAAM,MAAM,GAAG,eAAe,CAAC,GAAG,IAAI,SAAS,EAAE,IAAI,IAAI,SAAS,CAAC,CAAC;QACpE,IAAI,MAAM;YAAE,MAAM,CAAC,UAAU,GAAG,MAAM,CAAC;QAEvC,UAAU,EAAE,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;QAE5C,OAAO,cAAc,CAAC,MAAM,CAAC,CAAC;IAChC,CAAC;YAAS,CAAC;QACT,MAAM,EAAE,CAAC,OAAO,EAAE,CAAC;IACrB,CAAC;AACH,CAAC","sourcesContent":["import type {\n    MediaProcessingResult,\n    MediaProcessingSpec,\n    MediaModerationResult,\n    MediaInspectionResult,\n    MediaProcessingError,\n  } from \"@ttt-productions/media-schemas\";\nimport { parseMediaProcessingSpec } from \"@ttt-productions/media-schemas\";\n  import { createTempWorkspace } from \"./workspace/temp.js\";\n  import { processMedia } from \"./process-media.js\";\n  import { inspectMedia, type InspectMediaDeps } from \"./inspection/inspect-media.js\";\n  import type { MediaIO } from \"./io/types.js\";\n  import type { ModerationAdapter } from \"./moderation/types.js\";\n  import { mergeModeration } from \"./moderation/merge.js\";\n  import path from \"node:path\";\n  import { stat } from \"node:fs/promises\";\n\n  export interface RunPipelineArgs {\n    spec: MediaProcessingSpec;\n    io: MediaIO;\n    outputBaseName?: string;\n    moderation?: ModerationAdapter;\n  signal?: AbortSignal;\n  onProgress?: (p: import(\"./types.js\").MediaPipelineProgress) => void;\n  /**\n   * CANONICAL INSPECTION SEAM (canonical-upload-content-classification).\n   * When present, the pipeline runs `inspectMedia` on the just-downloaded temp\n   * input — BEFORE moderation and processing — and calls this policy hook with\n   * the bounded result. The hook either:\n   *   - returns `{ spec }` — the caller's policy adapter selected the\n   *     processing spec FROM the inspection (the byte-derived kind, never the\n   *     client MIME); the pipeline continues with that spec; or\n   *   - returns `{ reject }` — a typed terminal (`kind_mismatch`,\n   *     `unsupported_format`, `unsupported_codec`, …); the pipeline stops\n   *     before any transcode/moderation work.\n   * The inspection result rides the returned `MediaProcessingResult.inspection`\n   * either way, so the finalizer hands the SAME object to the safety gate —\n   * one authority, no re-detection. Callers that omit the hook get the\n   * pre-existing behavior unchanged.\n   */\n  resolveAfterInspection?: (\n    inspection: MediaInspectionResult,\n  ) => Promise<{ spec: MediaProcessingSpec } | { reject: MediaProcessingError }> | ({ spec: MediaProcessingSpec } | { reject: MediaProcessingError });\n  /** Inspection tool overrides (tests). */\n  inspectionDeps?: InspectMediaDeps;\n  }\n  \n  function mediaTypeFromSpecKind(kind: MediaProcessingSpec[\"kind\"]): \"image\" | \"video\" | \"audio\" | \"other\" {\n    if (kind === \"image\") return \"image\";\n    if (kind === \"video\") return \"video\";\n    if (kind === \"audio\") return \"audio\";\n    return \"other\";\n  }\n  \n  function attachProvider(\n    m: MediaModerationResult | null | undefined,\n    provider?: string\n  ): MediaModerationResult | null | undefined {\n    if (!m) return m;\n    return { ...m, provider: m.provider ?? provider, reviewedAt: m.reviewedAt ?? Date.now() };\n  }\n  \n  export async function runMediaPipeline(args: RunPipelineArgs): Promise<MediaProcessingResult> {\n    let { spec } = args;\n    const { io, outputBaseName = \"media\", moderation, signal, onProgress, resolveAfterInspection } = args;\n    // Carried onto every return path once produced — the finalizer must hand the\n    // SAME inspection object to the safety gate (one classification authority).\n    let inspection: MediaInspectionResult | undefined;\n    const withInspection = (r: MediaProcessingResult): MediaProcessingResult =>\n      inspection ? { ...r, inspection } : r;\n\n    if (signal?.aborted) {\n      return {\n        ok: false,\n        mediaType: mediaTypeFromSpecKind(spec.kind),\n        error: { code: \"processing_canceled\", message: \"Processing canceled.\" },\n      };\n    }\n\n    // Runtime contract validation (fast-fail with actionable errors).\n    try {\n      spec = parseMediaProcessingSpec(spec);\n    } catch (e: any) {\n      return {\n        ok: false,\n        mediaType: mediaTypeFromSpecKind(spec.kind),\n        error: {\n          code: \"invalid_spec\",\n          message: \"Invalid MediaProcessingSpec.\",\n          details: { issues: e?.issues ?? e?.message ?? String(e) },\n        },\n      };\n    }\n  \n    const ws = await createTempWorkspace();\n  \n    try {\n      const inputPath = path.join(ws.dir, \"input\");\n      const outputBasePath = path.join(ws.dir, outputBaseName);\n  \n      if (signal?.aborted) {\n        return { ok: false, mediaType: mediaTypeFromSpecKind(spec.kind), error: { code: \"processing_canceled\", message: \"Processing canceled.\" } };\n      }\n      onProgress?.({ phase: \"read_input\", percent: 0 });\n      await io.input.readToFile(inputPath);\n      onProgress?.({ phase: \"read_input\", percent: 1 });\n\n      // CANONICAL INSPECTION (before moderation and processing): classify the\n      // just-downloaded bytes structurally and let the caller's policy adapter\n      // pick the spec from the result. See RunPipelineArgs.resolveAfterInspection.\n      if (resolveAfterInspection) {\n        inspection = await inspectMedia({\n          localPath: inputPath,\n          ...(signal ? { signal } : {}),\n          ...(args.inspectionDeps ? { deps: args.inspectionDeps } : {}),\n        });\n        const resolution = await resolveAfterInspection(inspection);\n        if (\"reject\" in resolution) {\n          return withInspection({\n            ok: false,\n            mediaType: mediaTypeFromSpecKind(spec.kind),\n            error: resolution.reject,\n          });\n        }\n        try {\n          spec = parseMediaProcessingSpec(resolution.spec);\n        } catch (e: any) {\n          return withInspection({\n            ok: false,\n            mediaType: mediaTypeFromSpecKind(spec.kind),\n            error: {\n              code: \"invalid_spec\",\n              message: \"Invalid MediaProcessingSpec from resolveAfterInspection.\",\n              details: { issues: e?.issues ?? e?.message ?? String(e) },\n            },\n          });\n        }\n      }\n\n      // PRE moderation (original)\n      let mIn: MediaModerationResult | null | undefined;\n      if (moderation?.moderateInput) {\n        onProgress?.({ phase: \"moderation_input\", percent: 0 });\n        mIn = attachProvider(\n          await moderation.moderateInput({\n            spec,\n            kind: spec.kind,\n            localPath: inputPath,\n            mime: io.input.mime,\n          }),\n          moderation.provider\n        );\n        onProgress?.({ phase: \"moderation_input\", percent: 1 });\n  \n        // Fail closed on both \"rejected\" (policy violation) and \"error\" (the\n        // moderation check itself did not complete — quota/outage/API failure).\n        // A non-passing check must NEVER fall through to transcode + persist:\n        // published bytes must always have been scanned. An \"error\" is a system\n        // failure, not a content rejection, so it returns the distinct,\n        // retryable `processing_failed` code AND carries `moderation` (status\n        // \"error\") on the result — callers route that to their retryable\n        // moderation lane and land the row failed rather than publishing it.\n        if (mIn?.status === \"rejected\" || mIn?.status === \"error\") {\n          return withInspection({\n            ok: false,\n            mediaType: mediaTypeFromSpecKind(spec.kind),\n            moderation: mIn,\n            error:\n              mIn.status === \"error\"\n                ? {\n                    code: \"processing_failed\",\n                    message: \"Moderation check did not complete.\",\n                    details: { provider: mIn.provider, reason: \"moderation_error\" },\n                  }\n                : {\n                    code: \"rejected\",\n                    message: \"Rejected by moderation.\",\n                    details: { provider: mIn.provider, reasons: mIn.reasons, findings: mIn.findings },\n                  },\n          });\n        }\n      }\n  \n      const result = await processMedia(spec, {\n        inputPath,\n        outputBasePath,\n        inputMime: io.input.mime,\n      }, { signal, onProgress });\n\n      // Output size enforcement (processed outputs)\n      if (result.ok && result.outputs?.length) {\n        const perFileLimit = spec.maxOutputBytes ?? spec.maxBytes ?? 200 * 1024 * 1024; // 200MB default\n        const totalLimit = spec.maxTotalOutputBytes ?? spec.maxOutputBytes ?? spec.maxBytes ?? 400 * 1024 * 1024; // 400MB default\n\n        let total = 0;\n        for (const o of result.outputs) {\n          if (!o.path) continue;\n          const s = await stat(o.path);\n          const size = Number(s.size ?? 0);\n          total += size;\n          if (!o.sizeBytes) o.sizeBytes = size;\n          if (size > perFileLimit) {\n            return withInspection({\n              ok: false,\n              mediaType: mediaTypeFromSpecKind(spec.kind),\n              error: {\n                code: \"too_large\",\n                message: \"Processed output exceeds allowed size.\",\n                details: { key: o.key, sizeBytes: size, limitBytes: perFileLimit },\n              },\n            });\n          }\n          if (total > totalLimit) {\n            return withInspection({\n              ok: false,\n              mediaType: mediaTypeFromSpecKind(spec.kind),\n              error: {\n                code: \"too_large\",\n                message: \"Total processed outputs exceed allowed size.\",\n                details: { totalBytes: total, limitBytes: totalLimit },\n              },\n            });\n          }\n        }\n      }\n  \n      if (!result.ok || !result.outputs?.length) {\n        if (mIn) result.moderation = mIn;\n        onProgress?.({ phase: \"done\", percent: result.ok ? 1 : 0 });\n        return withInspection(result);\n      }\n  \n      // POST moderation (processed outputs) — runs on the LOCAL output paths\n      // BEFORE any final persistence, so rejected output never reaches the\n      // final store (R2 / emulator). Ordering is load-bearing — see\n      // the consuming app's media-serving design docs.\n      let mOut: MediaModerationResult | null | undefined;\n      if (moderation?.moderateOutput) {\n        onProgress?.({ phase: \"moderation_output\", percent: 0 });\n        mOut = attachProvider(\n          await moderation.moderateOutput({\n            spec,\n            kind: spec.kind,\n            outputs: (result.outputs ?? [])\n              .filter((o) => !!o.path)\n              .map((o) => ({ key: o.key, localPath: o.path!, mime: o.mime })),\n          }),\n          moderation.provider\n        );\n        onProgress?.({ phase: \"moderation_output\", percent: 1 });\n\n        // Same fail-closed posture as the input check: block both \"rejected\"\n        // and \"error\" before any persistence, so an incomplete check can never\n        // publish unscanned output. Ordering is load-bearing — see the\n        // consuming app's media-serving design docs.\n        if (mOut?.status === \"rejected\" || mOut?.status === \"error\") {\n          return withInspection({\n            ok: false,\n            mediaType: result.mediaType,\n            moderation: mOut,\n            error:\n              mOut.status === \"error\"\n                ? {\n                    code: \"processing_failed\",\n                    message: \"Moderation check did not complete.\",\n                    details: { provider: mOut.provider, reason: \"moderation_error\" },\n                  }\n                : {\n                    code: \"rejected\",\n                    message: \"Rejected by moderation.\",\n                    details: { provider: mOut.provider, reasons: mOut.reasons, findings: mOut.findings },\n                  },\n          });\n        }\n      }\n\n      // Persist outputs — only after input AND output moderation both passed.\n      onProgress?.({ phase: \"persist_outputs\", percent: 0 });\n      const totalOut = result.outputs.length;\n      let outIdx = 0;\n      for (const out of result.outputs) {\n        if (signal?.aborted) {\n          return withInspection({ ok: false, mediaType: result.mediaType, error: { code: \"processing_canceled\", message: \"Processing canceled.\" } });\n        }\n        onProgress?.({ phase: \"persist_outputs\", percent: totalOut ? outIdx / totalOut : 0, detail: { key: out.key } });\n        if (!out.path) continue;\n        const persisted = await io.output.writeFromFile(out.path, out.key);\n        if (persisted.url) out.url = persisted.url;\n        if (persisted.path) out.path = persisted.path;\n        outIdx += 1;\n      }\n      onProgress?.({ phase: \"persist_outputs\", percent: 1 });\n\n      const merged = mergeModeration(mIn ?? undefined, mOut ?? undefined);\n      if (merged) result.moderation = merged;\n\n      onProgress?.({ phase: \"done\", percent: 1 });\n  \n      return withInspection(result);\n    } finally {\n      await ws.cleanup();\n    }\n  }\n  "]}

package/dist/video/ffmpeg.d.ts

@@ -2,6 +2,13 @@ export interface RunCmdResult {
     code: number;
     stdout: string;
     stderr: string;
+    /** True when the process was killed by the wall-clock timeout (see runCmd
+     *  opts.timeoutMs). Callers must treat a timed-out result as INVALID —
+     *  never parse its partial output as an answer. */
+    timedOut?: boolean;
+    /** True when a captured stream hit the 1 MiB cap — the output is truncated
+     *  and must not be parsed as complete (e.g. incomplete probe JSON). */
+    truncated?: boolean;
 }
 export type FfmpegProgressPhase = "transcode" | "poster";
 export interface RunFfmpegOptions {
@@ -19,6 +26,13 @@ export interface RunFfmpegOptions {
 }
 export declare function runCmd(cmd: string, args: string[], opts?: {
     cwd?: string;
+    /** Hard wall-clock ceiling; on expiry the child is SIGKILLed and the
+     *  result resolves with `timedOut: true`. A malformed/adversarial input
+     *  must never be able to wedge a warm instance (canonical-upload-content-
+     *  classification hardening, 2026-07-31). */
+    timeoutMs?: number;
+    /** Abort kills the child immediately (same SIGKILL path as the timeout). */
+    signal?: AbortSignal;
 }): Promise<RunCmdResult>;
 /**
  * Runs ffmpeg with optional AbortSignal + progress reporting.

package/dist/video/ffmpeg.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ffmpeg.d.ts","sourceRoot":"","sources":["../../src/video/ffmpeg.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,MAAM,mBAAmB,GAAG,WAAW,GAAG,QAAQ,CAAC;AAEzD,MAAM,WAAW,gBAAgB;IAC/B,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,yEAAyE;IACzE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,CAAC,CAAC,EAAE;QAAE,KAAK,EAAE,mBAAmB,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,KAAK,IAAI,CAAC;IAC/F,0CAA0C;IAC1C,KAAK,CAAC,EAAE,mBAAmB,CAAC;CAC7B;AAOD,wBAAgB,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,IAAI,CAAC,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,YAAY,CAAC,CAiBlG;AA4CD;;;GAGG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,IAAI,CAAC,EAAE,gBAAgB,GAAG,OAAO,CAAC,YAAY,CAAC,CAuFxF;AAED,wBAAsB,qBAAqB,IAAI,OAAO,CACpD;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,OAAO,CAAA;CAAE,CAC/D,CAcA"}
+{"version":3,"file":"ffmpeg.d.ts","sourceRoot":"","sources":["../../src/video/ffmpeg.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf;;uDAEmD;IACnD,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB;2EACuE;IACvE,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED,MAAM,MAAM,mBAAmB,GAAG,WAAW,GAAG,QAAQ,CAAC;AAEzD,MAAM,WAAW,gBAAgB;IAC/B,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,yEAAyE;IACzE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,CAAC,CAAC,EAAE;QAAE,KAAK,EAAE,mBAAmB,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,KAAK,IAAI,CAAC;IAC/F,0CAA0C;IAC1C,KAAK,CAAC,EAAE,mBAAmB,CAAC;CAC7B;AAOD,wBAAgB,MAAM,CACpB,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,MAAM,EAAE,EACd,IAAI,CAAC,EAAE;IACL,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;;;iDAG6C;IAC7C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,4EAA4E;IAC5E,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB,GACA,OAAO,CAAC,YAAY,CAAC,CAoDvB;AA4CD;;;GAGG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,IAAI,CAAC,EAAE,gBAAgB,GAAG,OAAO,CAAC,YAAY,CAAC,CAuFxF;AAED,wBAAsB,qBAAqB,IAAI,OAAO,CACpD;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,OAAO,CAAA;CAAE,CAC/D,CAcA"}

package/dist/video/ffmpeg.js

@@ -7,16 +7,58 @@ export function runCmd(cmd, args, opts) {
         const p = spawn(cmd, args, { cwd: opts?.cwd, stdio: ["ignore", "pipe", "pipe"] });
         let stdout = "";
         let stderr = "";
+        let timedOut = false;
+        let truncated = false;
+        const kill = () => {
+            try {
+                p.kill("SIGKILL");
+            }
+            catch {
+                /* already dead */
+            }
+        };
+        const timer = opts?.timeoutMs && opts.timeoutMs > 0
+            ? setTimeout(() => {
+                timedOut = true;
+                kill();
+            }, opts.timeoutMs)
+            : null;
+        const onAbort = () => {
+            timedOut = true; // treated identically: the result is invalid
+            kill();
+        };
+        if (opts?.signal) {
+            if (opts.signal.aborted)
+                onAbort();
+            else
+                opts.signal.addEventListener("abort", onAbort, { once: true });
+        }
         p.stdout.on("data", (d) => {
             if (stdout.length < MAX_CAPTURE_BYTES)
                 stdout += String(d);
+            else
+                truncated = true;
         });
         p.stderr.on("data", (d) => {
             if (stderr.length < MAX_CAPTURE_BYTES)
                 stderr += String(d);
+            else
+                truncated = true;
+        });
+        p.on("error", (e) => {
+            if (timer)
+                clearTimeout(timer);
+            if (opts?.signal)
+                opts.signal.removeEventListener("abort", onAbort);
+            reject(e);
+        });
+        p.on("close", (code) => {
+            if (timer)
+                clearTimeout(timer);
+            if (opts?.signal)
+                opts.signal.removeEventListener("abort", onAbort);
+            resolve({ code: code ?? 0, stdout, stderr, ...(timedOut ? { timedOut } : {}), ...(truncated ? { truncated } : {}) });
         });
-        p.on("error", reject);
-        p.on("close", (code) => resolve({ code: code ?? 0, stdout, stderr }));
     });
 }
 function abortError() {