@cedarjs/uploads 7.0.1-next.333 → 7.0.1-next.467

package/dist/index.js

@@ -8,11 +8,30 @@ import {
   isMimeTypeAllowed,
   resolveProfile
 } from "./profiles.js";
+import {
+  acceptedContentType,
+  DETECT_CONTENT_TYPE_BYTES,
+  DETECT_CONTENT_TYPE_TAIL_BYTES,
+  DETECTABLE_CONTENT_TYPES,
+  detectContentType,
+  findZipCentralDirectory,
+  isClaimedContentTypeAllowed,
+  MAX_ZIP_DIRECTORY_BYTES
+} from "./detectContentType.js";
+import {
+  canonicalContentType,
+  CONTENT_TYPE_ALIASES,
+  isExplicitOnlyContentType,
+  isScriptableContentType,
+  MACRO_CONTENT_TYPES,
+  SCRIPTABLE_CONTENT_TYPES
+} from "./contentTypes.js";
 import { createFsProvider } from "./providers/fs.js";
 import { createDbProvider } from "./providers/db.js";
 import { generateStorageKey } from "./keys.js";
 import { storeFile } from "./storeFile.js";
 import { deleteFile } from "./deleteFile.js";
+import { defineUploadVariants, deleteVariants } from "./variants.js";
 import { cleanupStaleUploads } from "./cleanupStaleUploads.js";
 import {
   createUploadToken,
@@ -46,13 +65,22 @@ import { cedarUploadsPlugin } from "./fastify/plugin.js";
 import { handleS3Webhook, processS3EventRecord } from "./webhooks/s3.js";
 import { verifySnsMessage } from "./webhooks/sns.js";
 export {
+  CONTENT_TYPE_ALIASES,
   DB_MAX_FILE_SIZE,
   DEFAULT_UPLOAD_TOKEN_EXPIRES_IN,
+  DETECTABLE_CONTENT_TYPES,
+  DETECT_CONTENT_TYPE_BYTES,
+  DETECT_CONTENT_TYPE_TAIL_BYTES,
+  MACRO_CONTENT_TYPES,
+  MAX_ZIP_DIRECTORY_BYTES,
+  SCRIPTABLE_CONTENT_TYPES,
   SERVE_TOKEN_PURPOSE,
   UPLOAD_TOKEN_CONTEXT_KEY,
   UPLOAD_TOKEN_HEADER,
   UPLOAD_TOKEN_PURPOSE,
   UploadError,
+  acceptedContentType,
+  canonicalContentType,
   cedarUploadsPlugin,
   cleanupStaleUploads,
   confirmUpload,
@@ -67,11 +95,18 @@ export {
   createWithSignedUrlDirective,
   defineStorageTargets,
   defineUploadProfiles,
+  defineUploadVariants,
   deleteFile,
+  deleteVariants,
+  detectContentType,
+  findZipCentralDirectory,
   generateStorageKey,
   getUploadTokenPayload,
   handleS3Webhook,
+  isClaimedContentTypeAllowed,
+  isExplicitOnlyContentType,
   isMimeTypeAllowed,
+  isScriptableContentType,
   issueUploadToken,
   processS3EventRecord,
   requireUploadTokenSchema,

package/dist/keys.d.ts

@@ -1,7 +1,9 @@
 /**
  * A fresh storage key: a random id plus the extension that matches
  * `mimeType`, when one is known. Keys never derive from the client's
- * filename.
+ * filename. Aliased types are looked up under every spelling, so the
+ * registered `video/matroska` gets the `.mkv` the database only knows for
+ * `video/x-matroska`.
  */
 export declare function generateStorageKey(mimeType: string): string;
 /**

package/dist/keys.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"keys.d.ts","sourceRoot":"","sources":["../src/keys.ts"],"names":[],"mappings":"AAMA;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAI3D;AAID;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,QAIxC;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAQzD"}
+{"version":3,"file":"keys.d.ts","sourceRoot":"","sources":["../src/keys.ts"],"names":[],"mappings":"AAOA;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAM3D;AAID;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,QAIxC;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAQzD"}

package/dist/keys.js

@@ -1,8 +1,9 @@
 import { randomUUID } from "node:crypto";
 import mime from "mime-types";
+import { canonicalContentType, contentTypeSpellings } from "./contentTypes.js";
 import { UploadError } from "./errors.js";
 function generateStorageKey(mimeType) {
-  const ext = mime.extension(mimeType.split(";")[0].trim());
+  const ext = contentTypeSpellings(canonicalContentType(mimeType)).map((type) => mime.extension(type)).find(Boolean);
   return ext ? `${randomUUID()}.${ext}` : randomUUID();
 }
 const SAFE_KEY = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;

package/dist/profiles.d.ts

@@ -15,7 +15,11 @@ export interface UploadProfile {
     target: string;
     /**
      * MIME types the profile accepts. Exact types (`image/png`) and wildcard
-     * subtypes (`image/*`) are supported.
+     * subtypes (`image/*`) are supported, and either spelling of an aliased
+     * type (`image/jpeg` or `image/jpg`) matches both. When files are checked
+     * by their bytes (`verifyContentType`, on by default), types that can carry
+     * script, such as `image/svg+xml` or `text/html`, are only accepted when
+     * listed exactly; see `SCRIPTABLE_CONTENT_TYPES`.
      */
     allowedMimeTypes: string[];
     /** Largest file the profile accepts, in bytes. */
@@ -43,7 +47,9 @@ export declare function resolveProfile(profiles: UploadProfiles, name: string):
 /**
  * Whether `mimeType` matches one of `allowed`. Matching is case-insensitive
  * and ignores parameters such as `; charset=utf-8`. An entry of `image/*`
- * matches every `image/` subtype.
+ * matches every `image/` subtype. Aliases in `CONTENT_TYPE_ALIASES` are the
+ * same type, so `image/jpg` matches an entry of `image/jpeg` and the other
+ * way round.
  */
 export declare function isMimeTypeAllowed(allowed: string[], mimeType: string): boolean;
 //# sourceMappingURL=profiles.d.ts.map

package/dist/profiles.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"profiles.d.ts","sourceRoot":"","sources":["../src/profiles.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAA;AAIxD;;;GAGG;AACH,eAAO,MAAM,gBAAgB,QAAc,CAAA;AAE3C,2CAA2C;AAC3C,eAAO,MAAM,+BAA+B,EAAE,oBAA2B,CAAA;AAEzE;;;GAGG;AACH,MAAM,WAAW,aAAa;IAC5B,4EAA4E;IAC5E,MAAM,EAAE,MAAM,CAAA;IACd;;;OAGG;IACH,gBAAgB,EAAE,MAAM,EAAE,CAAA;IAC1B,kDAAkD;IAClD,WAAW,EAAE,MAAM,CAAA;IACnB,0EAA0E;IAC1E,QAAQ,EAAE,MAAM,CAAA;IAChB,4EAA4E;IAC5E,SAAS,CAAC,EAAE,oBAAoB,CAAA;CACjC;AAED,MAAM,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAA;AAE1D,MAAM,WAAW,qBAAsB,SAAQ,aAAa;IAC1D,IAAI,EAAE,MAAM,CAAA;CACb;AAiCD;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,CAAC,SAAS,cAAc,EAAE,QAAQ,EAAE,CAAC,GAAG,CAAC,CAM7E;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAC5B,QAAQ,EAAE,cAAc,EACxB,IAAI,EAAE,MAAM,GACX,qBAAqB,CAavB;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,QAAQ,EAAE,MAAM,WAoBpE"}
+{"version":3,"file":"profiles.d.ts","sourceRoot":"","sources":["../src/profiles.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAA;AAKxD;;;GAGG;AACH,eAAO,MAAM,gBAAgB,QAAc,CAAA;AAE3C,2CAA2C;AAC3C,eAAO,MAAM,+BAA+B,EAAE,oBAA2B,CAAA;AAEzE;;;GAGG;AACH,MAAM,WAAW,aAAa;IAC5B,4EAA4E;IAC5E,MAAM,EAAE,MAAM,CAAA;IACd;;;;;;;OAOG;IACH,gBAAgB,EAAE,MAAM,EAAE,CAAA;IAC1B,kDAAkD;IAClD,WAAW,EAAE,MAAM,CAAA;IACnB,0EAA0E;IAC1E,QAAQ,EAAE,MAAM,CAAA;IAChB,4EAA4E;IAC5E,SAAS,CAAC,EAAE,oBAAoB,CAAA;CACjC;AAED,MAAM,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAA;AAE1D,MAAM,WAAW,qBAAsB,SAAQ,aAAa;IAC1D,IAAI,EAAE,MAAM,CAAA;CACb;AAiCD;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,CAAC,SAAS,cAAc,EAAE,QAAQ,EAAE,CAAC,GAAG,CAAC,CAM7E;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAC5B,QAAQ,EAAE,cAAc,EACxB,IAAI,EAAE,MAAM,GACX,qBAAqB,CAavB;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,QAAQ,EAAE,MAAM,WAoBpE"}

package/dist/profiles.js

@@ -1,3 +1,4 @@
+import { canonicalContentType } from "./contentTypes.js";
 import { UploadError } from "./errors.js";
 const DB_MAX_FILE_SIZE = 1024 * 1024;
 const DEFAULT_UPLOAD_TOKEN_EXPIRES_IN = "5m";
@@ -44,8 +45,8 @@ function resolveProfile(profiles, name) {
   return { ...profile, name };
 }
 function isMimeTypeAllowed(allowed, mimeType) {
-  const normalized = mimeType.split(";")[0].trim().toLowerCase();
-  if (!normalized) {
+  const type = canonicalContentType(mimeType);
+  if (!type) {
     return false;
   }
   return allowed.some((entry) => {
@@ -54,9 +55,9 @@ function isMimeTypeAllowed(allowed, mimeType) {
       return true;
     }
     if (pattern.endsWith("/*")) {
-      return normalized.startsWith(pattern.slice(0, -1));
+      return type.startsWith(pattern.slice(0, -1));
     }
-    return pattern === normalized;
+    return canonicalContentType(pattern) === type;
   });
 }
 export {

package/dist/providers/s3.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"s3.d.ts","sourceRoot":"","sources":["../../src/providers/s3.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAGlD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AAElD,MAAM,WAAW,iBAAiB;IAChC,8EAA8E;IAC9E,MAAM,EAAE,QAAQ,CAAA;IAChB,MAAM,EAAE,MAAM,CAAA;IACd;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,sDAAsD;IACtD,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,sEAAsE;IACtE,kBAAkB,CAAC,EAAE,MAAM,CAAA;IAC3B,kEAAkE;IAClE,gBAAgB,CAAC,EAAE,MAAM,CAAA;CAC1B;AAmBD;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,iBAAiB,GAAG,eAAe,CAwHzE"}
+{"version":3,"file":"s3.d.ts","sourceRoot":"","sources":["../../src/providers/s3.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAGlD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AAElD,MAAM,WAAW,iBAAiB;IAChC,8EAA8E;IAC9E,MAAM,EAAE,QAAQ,CAAA;IAChB,MAAM,EAAE,MAAM,CAAA;IACd;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,sDAAsD;IACtD,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,sEAAsE;IACtE,kBAAkB,CAAC,EAAE,MAAM,CAAA;IAC3B,kEAAkE;IAClE,gBAAgB,CAAC,EAAE,MAAM,CAAA;CAC1B;AAmBD;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,iBAAiB,GAAG,eAAe,CA4IzE"}

package/dist/providers/s3.js

@@ -45,6 +45,22 @@ function createS3Provider(opts) {
       }
       return Buffer.from(await res.Body.transformToByteArray());
     },
+    async readRange(key, { offset, length }) {
+      if (length <= 0) {
+        return Buffer.alloc(0);
+      }
+      const res = await client.send(
+        new GetObjectCommand({
+          Bucket: bucket,
+          Key: fullKey(key),
+          Range: `bytes=${offset}-${offset + length - 1}`
+        })
+      );
+      if (!res.Body) {
+        return Buffer.alloc(0);
+      }
+      return Buffer.from(await res.Body.transformToByteArray());
+    },
     async readStream(key) {
       const res = await client.send(
         new GetObjectCommand({ Bucket: bucket, Key: fullKey(key) })

package/dist/services.d.ts

@@ -40,6 +40,16 @@ export interface CreatePresignedUploadOptions {
     /** The validated token, as attached to context by `@requireUploadToken`. */
     tokenPayload: UploadTokenPayload;
     input: CreatePresignedUploadInput;
+    /**
+     * Holds the declared type to the rules `acceptedContentType()` applies to
+     * a type it can't check by bytes: no wildcard types, and types that can
+     * carry script (`SCRIPTABLE_CONTENT_TYPES`) only when the profile lists
+     * them exactly. Pair it with `verifyContentType` on `confirmUpload` (and
+     * the S3 webhook), which checks the bytes against the declared type.
+     * Defaults to `true`; `false` checks the declared type with
+     * `isMimeTypeAllowed()` only.
+     */
+    verifyContentType?: boolean;
 }
 export interface PresignedUploadResponse {
     uploadId: string;
@@ -52,19 +62,27 @@ export interface PresignedUploadResponse {
  * a presigned URL the client PUTs the bytes to. This is what the generated
  * `createPresignedUploadUrl` resolver calls.
  */
-export declare function createPresignedUpload({ db, targets, tokenPayload, input, }: CreatePresignedUploadOptions): Promise<PresignedUploadResponse>;
+export declare function createPresignedUpload({ db, targets, tokenPayload, input, verifyContentType, }: CreatePresignedUploadOptions): Promise<PresignedUploadResponse>;
 export interface ConfirmUploadOptions {
     db: UploadDatabase;
     targets: StorageTargets;
     uploadId: string;
     currentUser: UploadActor | null | undefined;
+    /**
+     * Checks the object's bytes against the type the client declared for it
+     * when it asked for the upload URL, with a ranged read of its head (and of
+     * its tail for ZIPs), and records the canonical spelling of that type. A
+     * mismatch fails the row and deletes the object. Defaults to `true`.
+     */
+    verifyContentType?: boolean;
 }
 /**
  * Client-side confirmation of a direct upload. Verifies that the object
- * exists in storage and that its size matches what the token authorized,
- * then flips the row `pending` to `completed`. On a size mismatch the row is
- * claimed `failed` and the object deleted. Only the user (and organization)
- * the upload was issued to can confirm it.
+ * exists in storage, that its size matches what the token authorized, and
+ * (with `verifyContentType`, the default) that its bytes are the type the
+ * client declared, then flips the row `pending` to `completed`. On a
+ * mismatch the row is claimed `failed` and the object deleted. Only the user
+ * (and organization) the upload was issued to can confirm it.
  */
-export declare function confirmUpload({ db, targets, uploadId, currentUser, }: ConfirmUploadOptions): Promise<UploadRecord>;
+export declare function confirmUpload({ db, targets, uploadId, currentUser, verifyContentType, }: ConfirmUploadOptions): Promise<UploadRecord>;
 //# sourceMappingURL=services.d.ts.map

package/dist/services.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"services.d.ts","sourceRoot":"","sources":["../src/services.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAA;AAEnD,OAAO,KAAK,EAEV,cAAc,EACd,cAAc,EACd,YAAY,EACb,MAAM,YAAY,CAAA;AAEnB,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAA;AAE1D,yCAAyC;AACzC,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,GAAG,MAAM,CAAA;IACnB,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAC/B;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,EAAE,cAAc,CAAA;IACxB,gDAAgD;IAChD,OAAO,EAAE,MAAM,CAAA;IACf,MAAM,EAAE,MAAM,CAAA;IACd,8DAA8D;IAC9D,WAAW,EAAE,WAAW,GAAG,IAAI,GAAG,SAAS,CAAA;IAC3C,mEAAmE;IACnE,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAC/B;AAED,MAAM,WAAW,mBAAmB;IAClC,KAAK,EAAE,MAAM,CAAA;IACb,gBAAgB,EAAE,MAAM,EAAE,CAAA;IAC1B,WAAW,EAAE,MAAM,CAAA;IACnB,QAAQ,EAAE,MAAM,CAAA;CACjB;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,EAC/B,QAAQ,EACR,OAAO,EAAE,WAAW,EACpB,MAAM,EACN,WAAW,EACX,cAAc,GACf,EAAE,uBAAuB,GAAG,mBAAmB,CA+B/C;AAED,MAAM,WAAW,0BAA0B;IACzC,QAAQ,EAAE,MAAM,CAAA;IAChB,WAAW,EAAE,MAAM,CAAA;IACnB,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,CAAA;CAC/B;AAED,MAAM,WAAW,4BAA4B;IAC3C,EAAE,EAAE,cAAc,CAAA;IAClB,OAAO,EAAE,cAAc,CAAA;IACvB,4EAA4E;IAC5E,YAAY,EAAE,kBAAkB,CAAA;IAChC,KAAK,EAAE,0BAA0B,CAAA;CAClC;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,EAAE,MAAM,CAAA;IAChB,GAAG,EAAE,MAAM,CAAA;IACX,MAAM,EAAE,MAAM,CAAA;IACd,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAChC;AAUD;;;;GAIG;AACH,wBAAsB,qBAAqB,CAAC,EAC1C,EAAE,EACF,OAAO,EACP,YAAY,EACZ,KAAK,GACN,EAAE,4BAA4B,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAkCjE;AAED,MAAM,WAAW,oBAAoB;IACnC,EAAE,EAAE,cAAc,CAAA;IAClB,OAAO,EAAE,cAAc,CAAA;IACvB,QAAQ,EAAE,MAAM,CAAA;IAChB,WAAW,EAAE,WAAW,GAAG,IAAI,GAAG,SAAS,CAAA;CAC5C;AAED;;;;;;GAMG;AACH,wBAAsB,aAAa,CAAC,EAClC,EAAE,EACF,OAAO,EACP,QAAQ,EACR,WAAW,GACZ,EAAE,oBAAoB,GAAG,OAAO,CAAC,YAAY,CAAC,CAoE9C"}
+{"version":3,"file":"services.d.ts","sourceRoot":"","sources":["../src/services.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAA;AAEnD,OAAO,KAAK,EAGV,cAAc,EACd,cAAc,EACd,YAAY,EACb,MAAM,YAAY,CAAA;AAEnB,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAA;AAG1D,yCAAyC;AACzC,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,GAAG,MAAM,CAAA;IACnB,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAC/B;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,EAAE,cAAc,CAAA;IACxB,gDAAgD;IAChD,OAAO,EAAE,MAAM,CAAA;IACf,MAAM,EAAE,MAAM,CAAA;IACd,8DAA8D;IAC9D,WAAW,EAAE,WAAW,GAAG,IAAI,GAAG,SAAS,CAAA;IAC3C,mEAAmE;IACnE,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAC/B;AAED,MAAM,WAAW,mBAAmB;IAClC,KAAK,EAAE,MAAM,CAAA;IACb,gBAAgB,EAAE,MAAM,EAAE,CAAA;IAC1B,WAAW,EAAE,MAAM,CAAA;IACnB,QAAQ,EAAE,MAAM,CAAA;CACjB;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,EAC/B,QAAQ,EACR,OAAO,EAAE,WAAW,EACpB,MAAM,EACN,WAAW,EACX,cAAc,GACf,EAAE,uBAAuB,GAAG,mBAAmB,CA+B/C;AAED,MAAM,WAAW,0BAA0B;IACzC,QAAQ,EAAE,MAAM,CAAA;IAChB,WAAW,EAAE,MAAM,CAAA;IACnB,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,CAAA;CAC/B;AAED,MAAM,WAAW,4BAA4B;IAC3C,EAAE,EAAE,cAAc,CAAA;IAClB,OAAO,EAAE,cAAc,CAAA;IACvB,4EAA4E;IAC5E,YAAY,EAAE,kBAAkB,CAAA;IAChC,KAAK,EAAE,0BAA0B,CAAA;IACjC;;;;;;;;OAQG;IACH,iBAAiB,CAAC,EAAE,OAAO,CAAA;CAC5B;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,EAAE,MAAM,CAAA;IAChB,GAAG,EAAE,MAAM,CAAA;IACX,MAAM,EAAE,MAAM,CAAA;IACd,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAChC;AAUD;;;;GAIG;AACH,wBAAsB,qBAAqB,CAAC,EAC1C,EAAE,EACF,OAAO,EACP,YAAY,EACZ,KAAK,EACL,iBAAwB,GACzB,EAAE,4BAA4B,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAiDjE;AAED,MAAM,WAAW,oBAAoB;IACnC,EAAE,EAAE,cAAc,CAAA;IAClB,OAAO,EAAE,cAAc,CAAA;IACvB,QAAQ,EAAE,MAAM,CAAA;IAChB,WAAW,EAAE,WAAW,GAAG,IAAI,GAAG,SAAS,CAAA;IAC3C;;;;;OAKG;IACH,iBAAiB,CAAC,EAAE,OAAO,CAAA;CAC5B;AAqBD;;;;;;;GAOG;AACH,wBAAsB,aAAa,CAAC,EAClC,EAAE,EACF,OAAO,EACP,QAAQ,EACR,WAAW,EACX,iBAAwB,GACzB,EAAE,oBAAoB,GAAG,OAAO,CAAC,YAAY,CAAC,CA4F9C"}

package/dist/services.js

@@ -1,3 +1,4 @@
+import { isClaimedContentTypeAllowed } from "./detectContentType.js";
 import { UploadError } from "./errors.js";
 import { generateStorageKey } from "./keys.js";
 import {
@@ -8,6 +9,7 @@ import {
 import { resolveProfile } from "./profiles.js";
 import { resolveTarget } from "./targets.js";
 import { createUploadToken } from "./uploadToken.js";
+import { verifyStoredContentType } from "./verifyStoredContentType.js";
 function issueUploadToken({
   profiles,
   profile: profileName,
@@ -54,10 +56,20 @@ async function createPresignedUpload({
   db,
   targets,
   tokenPayload,
-  input
+  input,
+  verifyContentType = true
 }) {
   const size = toBigInt(input.size, "file size");
   assertTokenAllowsFile(tokenPayload, { contentType: input.contentType, size });
+  if (verifyContentType && !isClaimedContentTypeAllowed(
+    tokenPayload.allowedMimeTypes,
+    input.contentType
+  )) {
+    throw new UploadError(
+      "MIME_TYPE_NOT_ALLOWED",
+      `File type '${input.contentType}' is not allowed for upload profile '${tokenPayload.profile}'. Types that can carry script must be listed exactly, not through a wildcard.`
+    );
+  }
   const target = resolveTarget(targets, tokenPayload.target);
   const storageKey = generateStorageKey(input.contentType);
   const upload = await createPendingUpload({
@@ -80,11 +92,21 @@ async function createPresignedUpload({
   }
   return { uploadId: upload.id, ...presigned };
 }
+async function failUpload(db, target, upload) {
+  const { count } = await db.upload.updateMany({
+    where: { id: upload.id, status: "pending" },
+    data: { status: "failed" }
+  });
+  if (count === 1) {
+    await target.delete(upload.storageKey);
+  }
+}
 async function confirmUpload({
   db,
   targets,
   uploadId,
-  currentUser
+  currentUser,
+  verifyContentType = true
 }) {
   const upload = await db.upload.findFirst({
     where: { id: uploadId },
@@ -102,22 +124,35 @@ async function confirmUpload({
     throw new UploadError("NOT_IN_STORAGE", "Upload not found in storage.");
   }
   const actualSize = await target.getObjectSize(upload.storageKey);
+  const storedUpload = { ...upload, storageKey: upload.storageKey };
   if (actualSize === null || BigInt(actualSize) !== upload.size) {
-    const { count: count2 } = await db.upload.updateMany({
-      where: { id: uploadId, status: "pending" },
-      data: { status: "failed" }
-    });
-    if (count2 === 1) {
-      await target.delete(upload.storageKey);
-    }
+    await failUpload(db, target, storedUpload);
     throw new UploadError(
       "SIZE_MISMATCH",
       `Uploaded object is ${actualSize ?? "of unknown"} bytes but ${upload.size} bytes were authorized.`
     );
   }
+  let mimeType = upload.mimeType;
+  if (verifyContentType) {
+    const verified = await verifyStoredContentType(target, upload.storageKey, {
+      size: actualSize,
+      declaredType: upload.mimeType
+    });
+    if (!verified) {
+      await failUpload(db, target, storedUpload);
+      throw new UploadError(
+        "MIME_TYPE_NOT_ALLOWED",
+        `Uploaded file is not of the type '${upload.mimeType}' it was declared as, so it was deleted.`
+      );
+    }
+    mimeType = verified;
+  }
   const { count } = await db.upload.updateMany({
     where: { id: uploadId, status: "pending" },
-    data: { status: "completed" }
+    data: {
+      status: "completed",
+      ...mimeType !== upload.mimeType ? { mimeType } : {}
+    }
   });
   const confirmed = await db.upload.findFirst({
     where: { id: uploadId },

package/dist/types.d.ts

@@ -43,6 +43,11 @@ export interface UploadWhere {
     id?: string | {
         in: string[];
     };
+    /**
+     * Only exists when the `Upload` model has the variant columns. A query
+     * that uses it must handle the error Prisma raises without them.
+     */
+    sourceId?: string;
     target?: string;
     status?: string | {
         in: string[];
@@ -63,6 +68,7 @@ export interface UploadWhere {
 export interface UploadUpdateData {
     status?: UploadStatus;
     size?: bigint;
+    mimeType?: string;
     storageKey?: string | null;
 }
 /**
@@ -157,6 +163,15 @@ export interface StorageProvider {
     }): Promise<void>;
     /** Read the whole object into memory. */
     read(key: string): Promise<Buffer>;
+    /**
+     * Read `length` bytes starting at `offset` (fewer when the object ends
+     * first). Optional; checking a direct upload's content type falls back to
+     * `read()` when a provider does not implement it.
+     */
+    readRange?(key: string, range: {
+        offset: number;
+        length: number;
+    }): Promise<Buffer>;
     /**
      * Stream the object. Optional; the serve route falls back to `read()` when
      * a provider does not implement it.
@@ -209,4 +224,105 @@ export interface SerializedUpload {
     createdAt: string;
     updatedAt: string;
 }
+/**
+ * An `Upload` row in a schema that has the two variant columns, `sourceId`
+ * and `variant`. A derived file (a thumbnail, a preview, a video's poster
+ * frame) is an `Upload` row of its own whose `sourceId` points at the file
+ * it was made from and whose `variant` names what it is (`'thumb-164'`,
+ * `'preview'`). Original files have both set to `null`.
+ */
+export interface UploadVariantRecord extends UploadRecord {
+    sourceId: string | null;
+    variant: string | null;
+}
+export interface UploadVariantWhere {
+    id?: string | {
+        in?: string[];
+        notIn?: string[];
+    };
+    sourceId?: string | null | {
+        in: string[];
+    };
+    variant?: string | null;
+    status?: string;
+    tokenId?: string | null;
+    storageKey?: string | null;
+    createdAt?: {
+        lt?: Date;
+        lte?: Date;
+    };
+    updatedAt?: {
+        lt?: Date;
+    };
+}
+export interface UploadVariantCreateData extends UploadCreateData {
+    sourceId: string;
+    variant: string;
+}
+export interface UploadVariantUpdateData {
+    status?: UploadStatus;
+    target?: string;
+    size?: bigint;
+    storageKey?: string | null;
+    filename?: string;
+    mimeType?: string;
+    data?: Uint8Array<ArrayBuffer> | null;
+    tokenId?: string | null;
+}
+/**
+ * The subset of Prisma's generated `Upload` delegate that derived files
+ * (variants) need. A generated client satisfies it once the `Upload` model
+ * has the `sourceId` and `variant` columns described in the uploads docs.
+ */
+export interface UploadVariantDelegate {
+    create(args: {
+        data: UploadVariantCreateData;
+    }): Promise<UploadVariantRecord>;
+    findUnique(args: {
+        where: {
+            id: string;
+        };
+        omit?: {
+            data?: boolean;
+        };
+    }): Promise<UploadVariantRecord | null>;
+    findFirst(args: {
+        where: UploadVariantWhere;
+        omit?: {
+            data?: boolean;
+        };
+        orderBy?: {
+            createdAt: 'asc' | 'desc';
+        };
+    }): Promise<UploadVariantRecord | null>;
+    findMany(args: {
+        where: UploadVariantWhere;
+        omit?: {
+            data?: boolean;
+        };
+        orderBy?: {
+            createdAt: 'asc' | 'desc';
+        };
+        take?: number;
+    }): Promise<UploadVariantRecord[]>;
+    updateMany(args: {
+        where: UploadVariantWhere;
+        data: UploadVariantUpdateData;
+    }): Promise<{
+        count: number;
+    }>;
+    deleteMany(args: {
+        where: UploadVariantWhere;
+    }): Promise<{
+        count: number;
+    }>;
+}
+/**
+ * The subset of a Prisma client that derived files (variants) need. Any
+ * generated client whose `Upload` model has the `sourceId` and `variant`
+ * columns satisfies it.
+ */
+export interface UploadVariantDatabase {
+    upload: UploadVariantDelegate;
+}
 //# sourceMappingURL=types.d.ts.map

package/dist/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAA;AAE3C,0CAA0C;AAC1C,MAAM,MAAM,YAAY,GAAG,SAAS,GAAG,WAAW,GAAG,QAAQ,CAAA;AAE7D;;;;GAIG;AACH,MAAM,MAAM,kBAAkB,GAAG,YAAY,GAAG,QAAQ,CAAA;AAExD;;;;GAIG;AACH,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAA;IACV,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,MAAM,CAAA;IACd,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,EAAE,MAAM,CAAA;IAChB,IAAI,EAAE,MAAM,CAAA;IACZ,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;IACzB,IAAI,CAAC,EAAE,UAAU,GAAG,IAAI,CAAA;IACxB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;IACrB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;IACtB,cAAc,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B,SAAS,EAAE,IAAI,CAAA;IACf,SAAS,EAAE,IAAI,CAAA;CAChB;AAED,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,YAAY,CAAA;IACpB,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,EAAE,MAAM,CAAA;IAChB,IAAI,EAAE,MAAM,CAAA;IACZ,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAG1B,IAAI,CAAC,EAAE,UAAU,CAAC,WAAW,CAAC,GAAG,IAAI,CAAA;IACrC,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACtB,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACvB,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAC/B;AAED,MAAM,WAAW,WAAW;IAC1B,EAAE,CAAC,EAAE,MAAM,GAAG;QAAE,EAAE,EAAE,MAAM,EAAE,CAAA;KAAE,CAAA;IAC9B,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,MAAM,CAAC,EAAE,MAAM,GAAG;QAAE,EAAE,EAAE,MAAM,EAAE,CAAA;KAAE,CAAA;IAClC,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG;QAAE,GAAG,EAAE,IAAI,CAAA;KAAE,CAAA;IAC1C,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,SAAS,CAAC,EAAE;QAAE,EAAE,CAAC,EAAE,IAAI,CAAC;QAAC,GAAG,CAAC,EAAE,IAAI,CAAA;KAAE,CAAA;IACrC,SAAS,CAAC,EAAE;QAAE,EAAE,CAAC,EAAE,IAAI,CAAC;QAAC,GAAG,CAAC,EAAE,IAAI,CAAA;KAAE,CAAA;CACtC;AAED,MAAM,WAAW,gBAAgB;IAC/B,MAAM,CAAC,EAAE,YAAY,CAAA;IACrB,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAC3B;AAED;;;GAGG;AACH,MAAM,WAAW,cAAc;IAC7B,MAAM,CAAC,IAAI,EAAE;QAAE,IAAI,EAAE,gBAAgB,CAAA;KAAE,GAAG,OAAO,CAAC,YAAY,CAAC,CAAA;IAC/D,UAAU,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE;YAAE,EAAE,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAAA;IACzE,iBAAiB,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE;YAAE,EAAE,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE,GAAG,OAAO,CAAC,YAAY,CAAC,CAAA;IACzE,SAAS,CAAC,IAAI,EAAE;QACd,KAAK,EAAE,WAAW,CAAA;QAClB,IAAI,CAAC,EAAE;YAAE,IAAI,CAAC,EAAE,OAAO,CAAA;SAAE,CAAA;KAC1B,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAAA;IAChC,QAAQ,CAAC,IAAI,EAAE;QACb,KAAK,EAAE,WAAW,CAAA;QAClB,IAAI,CAAC,EAAE;YAAE,IAAI,CAAC,EAAE,OAAO,CAAA;SAAE,CAAA;QACzB,OAAO,CAAC,EAAE;YAAE,SAAS,EAAE,KAAK,GAAG,MAAM,CAAA;SAAE,CAAA;QACvC,IAAI,CAAC,EAAE,MAAM,CAAA;KACd,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,CAAA;IAC3B,UAAU,CAAC,IAAI,EAAE;QACf,KAAK,EAAE,WAAW,CAAA;QAClB,IAAI,EAAE,gBAAgB,CAAA;KACvB,GAAG,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IAC9B,MAAM,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE;YAAE,EAAE,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE,GAAG,OAAO,CAAC,YAAY,CAAC,CAAA;IAC9D,KAAK,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,WAAW,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;CACrD;AAED,mEAAmE;AACnE,MAAM,WAAW,uBAAuB;IACtC,MAAM,EAAE,cAAc,CAAA;CACvB;AAED;;;;GAIG;AACH,MAAM,WAAW,cAAe,SAAQ,uBAAuB;IAC7D,YAAY,CAAC,CAAC,EACZ,EAAE,EAAE,CAAC,EAAE,EAAE,uBAAuB,KAAK,OAAO,CAAC,CAAC,CAAC,EAC/C,OAAO,CAAC,EAAE;QAAE,cAAc,CAAC,EAAE,cAAc,CAAA;KAAE,GAC5C,OAAO,CAAC,CAAC,CAAC,CAAA;CACd;AAED;;;GAGG;AACH,MAAM,WAAW,kBAAkB;IACjC,GAAG,EAAE,MAAM,CAAA;IACX,MAAM,EAAE,MAAM,CAAA;IACd,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAChC;AAED;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAC9B,4EAA4E;IAC5E,IAAI,EAAE,MAAM,CAAA;IAEZ;;;;OAIG;IACH,YAAY,EAAE,IAAI,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAA;IAElC,+BAA+B;IAC/B,KAAK,CACH,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,UAAU,EAChB,IAAI,EAAE;QAAE,WAAW,EAAE,MAAM,CAAA;KAAE,GAC5B,OAAO,CAAC,IAAI,CAAC,CAAA;IAEhB,yCAAyC;IACzC,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;IAElC;;;OAGG;IACH,UAAU,CAAC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAA;IAE3C,2DAA2D;IAC3D,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAElC,iCAAiC;IACjC,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IAErC;;;OAGG;IACH,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAA;IAElD;;;OAGG;IACH,gBAAgB,CACd,GAAG,EAAE,MAAM,EACX,IAAI,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,kBAAkB,CAAA;KAAE,GAC9D,OAAO,CAAC,MAAM,CAAC,CAAA;IAElB;;;OAGG;IACH,qBAAqB,CACnB,GAAG,EAAE,MAAM,EACX,IAAI,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,GAC/D,OAAO,CAAC,kBAAkB,CAAC,CAAA;IAE9B;;;OAGG;IACH,SAAS,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CACrC;AAED,MAAM,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAA;AAE5D,0EAA0E;AAC1E,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,MAAM,CAAA;IACV,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,MAAM,CAAA;IACd,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,EAAE,MAAM,CAAA;IAChB,IAAI,EAAE,MAAM,CAAA;IACZ,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;IACzB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;IACrB,cAAc,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,EAAE,MAAM,CAAA;CAClB"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAA;AAE3C,0CAA0C;AAC1C,MAAM,MAAM,YAAY,GAAG,SAAS,GAAG,WAAW,GAAG,QAAQ,CAAA;AAE7D;;;;GAIG;AACH,MAAM,MAAM,kBAAkB,GAAG,YAAY,GAAG,QAAQ,CAAA;AAExD;;;;GAIG;AACH,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAA;IACV,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,MAAM,CAAA;IACd,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,EAAE,MAAM,CAAA;IAChB,IAAI,EAAE,MAAM,CAAA;IACZ,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;IACzB,IAAI,CAAC,EAAE,UAAU,GAAG,IAAI,CAAA;IACxB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;IACrB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;IACtB,cAAc,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B,SAAS,EAAE,IAAI,CAAA;IACf,SAAS,EAAE,IAAI,CAAA;CAChB;AAED,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,YAAY,CAAA;IACpB,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,EAAE,MAAM,CAAA;IAChB,IAAI,EAAE,MAAM,CAAA;IACZ,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAG1B,IAAI,CAAC,EAAE,UAAU,CAAC,WAAW,CAAC,GAAG,IAAI,CAAA;IACrC,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACtB,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACvB,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAC/B;AAED,MAAM,WAAW,WAAW;IAC1B,EAAE,CAAC,EAAE,MAAM,GAAG;QAAE,EAAE,EAAE,MAAM,EAAE,CAAA;KAAE,CAAA;IAC9B;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,MAAM,CAAC,EAAE,MAAM,GAAG;QAAE,EAAE,EAAE,MAAM,EAAE,CAAA;KAAE,CAAA;IAClC,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG;QAAE,GAAG,EAAE,IAAI,CAAA;KAAE,CAAA;IAC1C,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,SAAS,CAAC,EAAE;QAAE,EAAE,CAAC,EAAE,IAAI,CAAC;QAAC,GAAG,CAAC,EAAE,IAAI,CAAA;KAAE,CAAA;IACrC,SAAS,CAAC,EAAE;QAAE,EAAE,CAAC,EAAE,IAAI,CAAC;QAAC,GAAG,CAAC,EAAE,IAAI,CAAA;KAAE,CAAA;CACtC;AAED,MAAM,WAAW,gBAAgB;IAC/B,MAAM,CAAC,EAAE,YAAY,CAAA;IACrB,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAC3B;AAED;;;GAGG;AACH,MAAM,WAAW,cAAc;IAC7B,MAAM,CAAC,IAAI,EAAE;QAAE,IAAI,EAAE,gBAAgB,CAAA;KAAE,GAAG,OAAO,CAAC,YAAY,CAAC,CAAA;IAC/D,UAAU,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE;YAAE,EAAE,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAAA;IACzE,iBAAiB,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE;YAAE,EAAE,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE,GAAG,OAAO,CAAC,YAAY,CAAC,CAAA;IACzE,SAAS,CAAC,IAAI,EAAE;QACd,KAAK,EAAE,WAAW,CAAA;QAClB,IAAI,CAAC,EAAE;YAAE,IAAI,CAAC,EAAE,OAAO,CAAA;SAAE,CAAA;KAC1B,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAAA;IAChC,QAAQ,CAAC,IAAI,EAAE;QACb,KAAK,EAAE,WAAW,CAAA;QAClB,IAAI,CAAC,EAAE;YAAE,IAAI,CAAC,EAAE,OAAO,CAAA;SAAE,CAAA;QACzB,OAAO,CAAC,EAAE;YAAE,SAAS,EAAE,KAAK,GAAG,MAAM,CAAA;SAAE,CAAA;QACvC,IAAI,CAAC,EAAE,MAAM,CAAA;KACd,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,CAAA;IAC3B,UAAU,CAAC,IAAI,EAAE;QACf,KAAK,EAAE,WAAW,CAAA;QAClB,IAAI,EAAE,gBAAgB,CAAA;KACvB,GAAG,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IAC9B,MAAM,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE;YAAE,EAAE,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE,GAAG,OAAO,CAAC,YAAY,CAAC,CAAA;IAC9D,KAAK,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,WAAW,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;CACrD;AAED,mEAAmE;AACnE,MAAM,WAAW,uBAAuB;IACtC,MAAM,EAAE,cAAc,CAAA;CACvB;AAED;;;;GAIG;AACH,MAAM,WAAW,cAAe,SAAQ,uBAAuB;IAC7D,YAAY,CAAC,CAAC,EACZ,EAAE,EAAE,CAAC,EAAE,EAAE,uBAAuB,KAAK,OAAO,CAAC,CAAC,CAAC,EAC/C,OAAO,CAAC,EAAE;QAAE,cAAc,CAAC,EAAE,cAAc,CAAA;KAAE,GAC5C,OAAO,CAAC,CAAC,CAAC,CAAA;CACd;AAED;;;GAGG;AACH,MAAM,WAAW,kBAAkB;IACjC,GAAG,EAAE,MAAM,CAAA;IACX,MAAM,EAAE,MAAM,CAAA;IACd,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAChC;AAED;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAC9B,4EAA4E;IAC5E,IAAI,EAAE,MAAM,CAAA;IAEZ;;;;OAIG;IACH,YAAY,EAAE,IAAI,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAA;IAElC,+BAA+B;IAC/B,KAAK,CACH,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,UAAU,EAChB,IAAI,EAAE;QAAE,WAAW,EAAE,MAAM,CAAA;KAAE,GAC5B,OAAO,CAAC,IAAI,CAAC,CAAA;IAEhB,yCAAyC;IACzC,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;IAElC;;;;OAIG;IACH,SAAS,CAAC,CACR,GAAG,EAAE,MAAM,EACX,KAAK,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,GACxC,OAAO,CAAC,MAAM,CAAC,CAAA;IAElB;;;OAGG;IACH,UAAU,CAAC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAA;IAE3C,2DAA2D;IAC3D,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAElC,iCAAiC;IACjC,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IAErC;;;OAGG;IACH,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAA;IAElD;;;OAGG;IACH,gBAAgB,CACd,GAAG,EAAE,MAAM,EACX,IAAI,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,kBAAkB,CAAA;KAAE,GAC9D,OAAO,CAAC,MAAM,CAAC,CAAA;IAElB;;;OAGG;IACH,qBAAqB,CACnB,GAAG,EAAE,MAAM,EACX,IAAI,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,GAC/D,OAAO,CAAC,kBAAkB,CAAC,CAAA;IAE9B;;;OAGG;IACH,SAAS,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CACrC;AAED,MAAM,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAA;AAE5D,0EAA0E;AAC1E,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,MAAM,CAAA;IACV,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,MAAM,CAAA;IACd,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,EAAE,MAAM,CAAA;IAChB,IAAI,EAAE,MAAM,CAAA;IACZ,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;IACzB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;IACrB,cAAc,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,EAAE,MAAM,CAAA;CAClB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,mBAAoB,SAAQ,YAAY;IACvD,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;IACvB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;CACvB;AAED,MAAM,WAAW,kBAAkB;IACjC,EAAE,CAAC,EAAE,MAAM,GAAG;QAAE,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,CAAA;IACjD,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG;QAAE,EAAE,EAAE,MAAM,EAAE,CAAA;KAAE,CAAA;IAC3C,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACvB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACvB,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1B,SAAS,CAAC,EAAE;QAAE,EAAE,CAAC,EAAE,IAAI,CAAC;QAAC,GAAG,CAAC,EAAE,IAAI,CAAA;KAAE,CAAA;IACrC,SAAS,CAAC,EAAE;QAAE,EAAE,CAAC,EAAE,IAAI,CAAA;KAAE,CAAA;CAC1B;AAED,MAAM,WAAW,uBAAwB,SAAQ,gBAAgB;IAC/D,QAAQ,EAAE,MAAM,CAAA;IAChB,OAAO,EAAE,MAAM,CAAA;CAChB;AAED,MAAM,WAAW,uBAAuB;IACtC,MAAM,CAAC,EAAE,YAAY,CAAA;IACrB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAA;IAEjB,IAAI,CAAC,EAAE,UAAU,CAAC,WAAW,CAAC,GAAG,IAAI,CAAA;IACrC,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CACxB;AAED;;;;GAIG;AACH,MAAM,WAAW,qBAAqB;IACpC,MAAM,CAAC,IAAI,EAAE;QAAE,IAAI,EAAE,uBAAuB,CAAA;KAAE,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAA;IAC7E,UAAU,CAAC,IAAI,EAAE;QACf,KAAK,EAAE;YAAE,EAAE,EAAE,MAAM,CAAA;SAAE,CAAA;QACrB,IAAI,CAAC,EAAE;YAAE,IAAI,CAAC,EAAE,OAAO,CAAA;SAAE,CAAA;KAC1B,GAAG,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC,CAAA;IACvC,SAAS,CAAC,IAAI,EAAE;QACd,KAAK,EAAE,kBAAkB,CAAA;QACzB,IAAI,CAAC,EAAE;YAAE,IAAI,CAAC,EAAE,OAAO,CAAA;SAAE,CAAA;QACzB,OAAO,CAAC,EAAE;YAAE,SAAS,EAAE,KAAK,GAAG,MAAM,CAAA;SAAE,CAAA;KACxC,GAAG,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC,CAAA;IACvC,QAAQ,CAAC,IAAI,EAAE;QACb,KAAK,EAAE,kBAAkB,CAAA;QACzB,IAAI,CAAC,EAAE;YAAE,IAAI,CAAC,EAAE,OAAO,CAAA;SAAE,CAAA;QACzB,OAAO,CAAC,EAAE;YAAE,SAAS,EAAE,KAAK,GAAG,MAAM,CAAA;SAAE,CAAA;QACvC,IAAI,CAAC,EAAE,MAAM,CAAA;KACd,GAAG,OAAO,CAAC,mBAAmB,EAAE,CAAC,CAAA;IAClC,UAAU,CAAC,IAAI,EAAE;QACf,KAAK,EAAE,kBAAkB,CAAA;QACzB,IAAI,EAAE,uBAAuB,CAAA;KAC9B,GAAG,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IAC9B,UAAU,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,kBAAkB,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CAC5E;AAED;;;;GAIG;AACH,MAAM,WAAW,qBAAqB;IACpC,MAAM,EAAE,qBAAqB,CAAA;CAC9B"}