[zeeuus8]

What changed

Already processed Reel analyses need a stable local contract before a library UI or automated producer can depend on them. This adds the import-only first slice requested in #124: a versioned JSON schema, synthetic offline fixture, importer, private storage, filters, and minimal loopback import/list/read endpoints.

Collection identity derives from the lowercase creator and source collection ID; item IDs survive URL normalization and file renaming. Reimporting the same snapshot replaces one collection atomically. Conflicting duplicate IDs or unsafe inputs leave the previous snapshot intact. Transcripts retain timestamped segments, plays and views remain independently nullable, and classification confidence produces an explicit review flag alongside excluded/error rows.

Storage stays below the isolated Jev Social state directory, outside the checkout and public/. Reads validate identity and content again, bound file size, and reject symlinks. Known credential patterns are redacted; lines containing recognized local paths are omitted conservatively. Arbitrary prose is not a secret scanner, so producers must export public content only.

Refs #124. No library UI, live collection, media downloads, or provider calls are added. #125 can build against the documented contract after review. Unversioned Creator Lab exports require an explicit adapter step rather than implicit format guessing.

Evidence

• npm run check
• npm test -- --test-concurrency=1 — 252 passed on Node 24.19.0 / npm 11.19.0, including 15 importer/API tests.
• Live browser validation not required: all new behavior is offline and tested with synthetic data, temporary directories, and ephemeral loopback servers.

Coverage includes malformed schemas/classifications/timestamps, unsafe URLs, credential/path sanitization, raw and normalized size limits, duplicate identities, nullable metrics, compound filters, atomic replacement, corrupt/symlinked storage, same-origin HTTP checks, and reopening identical content after stopping and recreating the server. The package file allowlist includes the contract and license.

The host's npm 12.0.2 changes npm pack --json to a keyed object, which the existing packaging tests do not accept. Validation used the already installed npm 11.19.0; those unrelated JSON-parsing assertions were not changed. Node 22 validation is left to the repository's CI matrix.

Safety and scope

• Browser execution remains inside the socai CLI; this importer performs none.
• No secrets, browser data, personal information, downloads, or run artifacts are committed. The fixture is synthetic.
• New behavior fails visibly instead of silently substituting mock data.

[IRONICBo]

Maintainer follow-up 5e853d6 hardens the import contract before merge: RFC 3339 timestamps now require an explicit timezone and reject impossible calendar dates; transcript/anatomy segments require string text and nondecreasing known start times. Verification: npm run check passed; the complete 253-test suite passed on Node 22.23.3 and Node 24.21.0; npm pack --dry-run includes the schema, attribution, documentation, and Reel modules. Automated Codex CLI review was attempted twice but could not run because the local CLI credential returned HTTP 401, so no automated-review pass is claimed.

[IRONICBo]

Final head 958c3b6 verification: the complete 253-test suite passes on Node 22.23.3 and Node 24.21.0; local Plugin Scanner 3.8.1 passes at 97/A with 0 high and 0 critical findings. The previous GitHub run passed the Node matrix and CodeQL; its scanner failure was the synthetic api_key sanitization fixture, now represented without secret-assignment syntax while preserving the same runtime assertion.

[IRONICBo]

Reviewed the import contract, HTTP and persistence boundaries, schema consistency, privacy handling, deterministic normalization, packaging, and regression coverage. Added validation for timezone-stable dates, impossible calendar dates, ordered segment timestamps, and required segment text. Node 22/24 full suites and scanner validation pass.

[IRONICBo]

LGTM — thank you for your contribution to the community, @zeeuus8! 🙌