@endora-commerce/mod-assets-library 0.0.0-stage → 0.100.0

package/dist/backend/services/storage/s3-adapter.js

@@ -0,0 +1,110 @@
+// S3 storage adapter — feature 013 / US3 / T075.
+// Wraps @aws-sdk/client-s3 + @aws-sdk/s3-request-presigner. Storage layout
+// matches the local-FS adapter (sharded path scheme); private URLs use V4
+// pre-signed GetObject.
+import { S3Client, PutObjectCommand, GetObjectCommand, HeadBucketCommand, DeleteObjectCommand, PutObjectAclCommand, } from '@aws-sdk/client-s3';
+import { getSignedUrl } from '@aws-sdk/s3-request-presigner';
+import { computeLocator } from './locator.js';
+import { resolvePublicUrlBase } from './public-url-base.js';
+import { BackendUnavailableError, ConfigurationError, LocatorMissingError, } from './errors.js';
+export class S3StorageAdapter {
+    cfg;
+    code = 's3';
+    client;
+    /** The absolute base public object URLs are built on — decided once (D-223). */
+    publicBase;
+    constructor(cfg) {
+        this.cfg = cfg;
+        if (!cfg.bucket)
+            throw new ConfigurationError('S3StorageAdapter: bucket is required');
+        if (!cfg.region)
+            throw new ConfigurationError('S3StorageAdapter: region is required');
+        const configured = (cfg.publicBaseUrl ?? '').trim();
+        this.publicBase = resolvePublicUrlBase(configured.length > 0
+            ? configured
+            : `https://${cfg.bucket}.s3.${cfg.region}.amazonaws.com`, cfg.publicApiBaseUrl);
+        this.client = new S3Client({
+            region: cfg.region,
+            ...(cfg.endpoint ? { endpoint: cfg.endpoint, forcePathStyle: true } : {}),
+            ...(cfg.accessKeyId
+                ? {
+                    credentials: {
+                        accessKeyId: cfg.accessKeyId,
+                        secretAccessKey: cfg.secretAccessKey,
+                    },
+                }
+                : {}),
+        });
+    }
+    async selfCheck() {
+        try {
+            await this.client.send(new HeadBucketCommand({ Bucket: this.cfg.bucket }));
+            return { ok: true };
+        }
+        catch (e) {
+            const reason = e instanceof Error ? e.message : String(e);
+            return { ok: false, reason };
+        }
+    }
+    newLocator(input) {
+        const tail = computeLocator(input);
+        const prefix = (this.cfg.prefix ?? '').replace(/^\/+|\/+$/g, '');
+        return prefix.length > 0 ? `${prefix}/${tail}` : tail;
+    }
+    async put(input) {
+        if (!input.locator)
+            throw new LocatorMissingError('S3StorageAdapter.put: empty locator');
+        try {
+            await this.client.send(new PutObjectCommand({
+                Bucket: this.cfg.bucket,
+                Key: input.locator,
+                Body: input.stream,
+                ContentType: input.mimeType,
+                ContentLength: input.sizeBytes > 0 ? input.sizeBytes : undefined,
+                ACL: input.visibility === 'public' ? 'public-read' : 'private',
+            }));
+        }
+        catch (e) {
+            throw new BackendUnavailableError(`S3StorageAdapter.put: failed to persist ${input.locator}`, e);
+        }
+    }
+    async resolveUrl(input) {
+        if (input.visibility === 'public') {
+            return { url: `${this.publicBase}/${input.locator}`, expiresAt: null };
+        }
+        const ttl = input.ttlSec ?? this.cfg.privateUrlTtlSec;
+        if (!Number.isInteger(ttl) || ttl <= 0) {
+            throw new ConfigurationError(`S3StorageAdapter.resolveUrl: invalid TTL ${ttl}`);
+        }
+        const url = await getSignedUrl(this.client, new GetObjectCommand({ Bucket: this.cfg.bucket, Key: input.locator }), { expiresIn: ttl });
+        return { url, expiresAt: new Date(Date.now() + ttl * 1000) };
+    }
+    async open(input) {
+        const out = await this.client.send(new GetObjectCommand({ Bucket: this.cfg.bucket, Key: input.locator }));
+        if (!out.Body) {
+            throw new BackendUnavailableError(`S3StorageAdapter.open: no body for ${input.locator}`);
+        }
+        return out.Body;
+    }
+    async delete(input) {
+        try {
+            await this.client.send(new DeleteObjectCommand({ Bucket: this.cfg.bucket, Key: input.locator }));
+        }
+        catch (e) {
+            throw new BackendUnavailableError(`S3StorageAdapter.delete: failed to remove ${input.locator}`, e);
+        }
+    }
+    async setVisibility(input) {
+        try {
+            await this.client.send(new PutObjectAclCommand({
+                Bucket: this.cfg.bucket,
+                Key: input.locator,
+                ACL: input.visibility === 'public' ? 'public-read' : 'private',
+            }));
+        }
+        catch (e) {
+            throw new BackendUnavailableError(`S3StorageAdapter.setVisibility: failed on ${input.locator}`, e);
+        }
+    }
+}
+//# sourceMappingURL=s3-adapter.js.map

package/dist/backend/services/storage/s3-adapter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"s3-adapter.js","sourceRoot":"","sources":["../../../../src/backend/services/storage/s3-adapter.ts"],"names":[],"mappings":"AAAA,iDAAiD;AACjD,2EAA2E;AAC3E,0EAA0E;AAC1E,wBAAwB;AAExB,OAAO,EACL,QAAQ,EACR,gBAAgB,EAChB,gBAAgB,EAChB,iBAAiB,EACjB,mBAAmB,EACnB,mBAAmB,GACpB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAS7D,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,EACL,uBAAuB,EACvB,kBAAkB,EAClB,mBAAmB,GACpB,MAAM,aAAa,CAAC;AA6BrB,MAAM,OAAO,gBAAgB;IAME;IALpB,IAAI,GAAG,IAAa,CAAC;IACb,MAAM,CAAW;IAClC,gFAAgF;IAC/D,UAAU,CAAS;IAEpC,YAA6B,GAAoB;QAApB,QAAG,GAAH,GAAG,CAAiB;QAC/C,IAAI,CAAC,GAAG,CAAC,MAAM;YAAE,MAAM,IAAI,kBAAkB,CAAC,sCAAsC,CAAC,CAAC;QACtF,IAAI,CAAC,GAAG,CAAC,MAAM;YAAE,MAAM,IAAI,kBAAkB,CAAC,sCAAsC,CAAC,CAAC;QACtF,MAAM,UAAU,GAAG,CAAC,GAAG,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACpD,IAAI,CAAC,UAAU,GAAG,oBAAoB,CACpC,UAAU,CAAC,MAAM,GAAG,CAAC;YACnB,CAAC,CAAC,UAAU;YACZ,CAAC,CAAC,WAAW,GAAG,CAAC,MAAM,OAAO,GAAG,CAAC,MAAM,gBAAgB,EAC1D,GAAG,CAAC,gBAAgB,CACrB,CAAC;QACF,IAAI,CAAC,MAAM,GAAG,IAAI,QAAQ,CAAC;YACzB,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACzE,GAAG,CAAC,GAAG,CAAC,WAAW;gBACjB,CAAC,CAAC;oBACE,WAAW,EAAE;wBACX,WAAW,EAAE,GAAG,CAAC,WAAW;wBAC5B,eAAe,EAAE,GAAG,CAAC,eAAe;qBACrC;iBACF;gBACH,CAAC,CAAC,EAAE,CAAC;SACR,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,SAAS;QACb,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,iBAAiB,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;YAC3E,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;QACtB,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,MAAM,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YAC1D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;QAC/B,CAAC;IACH,CAAC;IAED,UAAU,CAAC,KAA6B;QACtC,MAAM,IAAI,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;QACnC,MAAM,MAAM,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;QACjE,OAAO,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACxD,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,KAAsB;QAC9B,IAAI,CAAC,KAAK,CAAC,OAAO;YAAE,MAAM,IAAI,mBAAmB,CAAC,qCAAqC,CAAC,CAAC;QACzF,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CACpB,IAAI,gBAAgB,CAAC;gBACnB,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,MAAM;gBACvB,GAAG,EAAE,KAAK,CAAC,OAAO;gBAClB,IAAI,EAAE,KAAK,CAAC,MAAe;gBAC3B,WAAW,EAAE,KAAK,CAAC,QAAQ;gBAC3B,aAAa,EAAE,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;gBAChE,GAAG,EAAE,KAAK,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS;aAC/D,CAAC,CACH,CAAC;QACJ,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,IAAI,uBAAuB,CAC/B,2CAA2C,KAAK,CAAC,OAAO,EAAE,EAC1D,CAAC,CACF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,KAA6B;QAC5C,IAAI,KAAK,CAAC,UAAU,KAAK,QAAQ,EAAE,CAAC;YAClC,OAAO,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,UAAU,IAAI,KAAK,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;QACzE,CAAC;QACD,MAAM,GAAG,GAAG,KAAK,CAAC,MAAM,IAAI,IAAI,CAAC,GAAG,CAAC,gBAAgB,CAAC;QACtD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC;YACvC,MAAM,IAAI,kBAAkB,CAAC,4CAA4C,GAAG,EAAE,CAAC,CAAC;QAClF,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,YAAY,CAC5B,IAAI,CAAC,MAAM,EACX,IAAI,gBAAgB,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,EACrE,EAAE,SAAS,EAAE,GAAG,EAAE,CACnB,CAAC;QACF,OAAO,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,GAAG,GAAG,IAAI,CAAC,EAAE,CAAC;IAC/D,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,KAA0B;QACnC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAChC,IAAI,gBAAgB,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CACtE,CAAC;QACF,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;YACd,MAAM,IAAI,uBAAuB,CAAC,sCAAsC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QAC3F,CAAC;QACD,OAAO,GAAG,CAAC,IAA6B,CAAC;IAC3C,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,KAA0B;QACrC,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CACpB,IAAI,mBAAmB,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CACzE,CAAC;QACJ,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,IAAI,uBAAuB,CAC/B,6CAA6C,KAAK,CAAC,OAAO,EAAE,EAC5D,CAAC,CACF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,KAGnB;QACC,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CACpB,IAAI,mBAAmB,CAAC;gBACtB,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,MAAM;gBACvB,GAAG,EAAE,KAAK,CAAC,OAAO;gBAClB,GAAG,EAAE,KAAK,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS;aAC/D,CAAC,CACH,CAAC;QACJ,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,IAAI,uBAAuB,CAC/B,6CAA6C,KAAK,CAAC,OAAO,EAAE,EAC5D,CAAC,CACF,CAAC;QACJ,CAAC;IACH,CAAC;CACF"}

package/dist/backend/services/storage/settings-view.d.ts

@@ -0,0 +1,4 @@
+import type { EntityManager } from '@mikro-orm/postgresql';
+import type { AdapterSettingsView } from './adapter-registry.js';
+export declare function createSettingsView(emFactory: () => EntityManager): AdapterSettingsView;
+//# sourceMappingURL=settings-view.d.ts.map

package/dist/backend/services/storage/settings-view.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"settings-view.d.ts","sourceRoot":"","sources":["../../../../src/backend/services/storage/settings-view.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAG3D,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAIjE,wBAAgB,kBAAkB,CAChC,SAAS,EAAE,MAAM,aAAa,GAC7B,mBAAmB,CA6DrB"}

package/dist/backend/services/storage/settings-view.js

@@ -0,0 +1,73 @@
+// AdapterSettingsView impl that reads platform-global Library settings
+// directly from the `settings` table (no per-channel scope, no cache). The
+// reads are infrequent (once per upload / once per resolveUrl miss), so a
+// direct DB hit is fine.
+//
+// AdapterRegistry consumes this view; we keep it separate to make the
+// adapter side trivially mockable in tests.
+import { Setting } from '@endora-commerce/platform/kernel';
+import { SettingValue } from '@endora-commerce/platform/kernel';
+const ADAPTER_CODES = ['local', 's3', 'gcs'];
+export function createSettingsView(emFactory) {
+    async function readString(code) {
+        const em = emFactory();
+        const setting = await em.findOne(Setting, { code });
+        if (!setting) {
+            throw new Error(`Assets Library settings: missing setting "${code}".`);
+        }
+        // Platform-global settings have no per-channel override in v1; the
+        // setting_values table is empty for these codes. Returning defaultValue
+        // is the correct behaviour.
+        const override = await em.findOne(SettingValue, { setting: setting });
+        const raw = override ? override.value : setting.defaultValue;
+        return typeof raw === 'string' ? raw : String(raw ?? '');
+    }
+    async function readNumber(code, fallback) {
+        const em = emFactory();
+        const setting = await em.findOne(Setting, { code });
+        if (!setting)
+            return fallback;
+        const override = await em.findOne(SettingValue, { setting: setting });
+        const raw = override ? override.value : setting.defaultValue;
+        const n = typeof raw === 'number' ? raw : Number(raw);
+        return Number.isFinite(n) ? n : fallback;
+    }
+    return {
+        async activeAdapter() {
+            const v = (await readString('assets.storage.adapter')).trim();
+            if (ADAPTER_CODES.includes(v)) {
+                return v;
+            }
+            return 'local';
+        },
+        localBaseDir() {
+            return readString('assets.local.base_dir');
+        },
+        localPublicUrlBase() {
+            return readString('assets.local.public_url_base');
+        },
+        privateUrlTtlSec() {
+            return readNumber('assets.private_url_ttl_sec', 300);
+        },
+        async s3Config() {
+            return {
+                bucket: await readString('assets.s3.bucket'),
+                region: await readString('assets.s3.region'),
+                accessKeyId: await readString('assets.s3.access_key_id'),
+                secretAccessKey: await readString('assets.s3.secret_access_key'),
+                endpoint: await readString('assets.s3.endpoint'),
+                prefix: await readString('assets.s3.prefix'),
+                publicBaseUrl: await readString('assets.s3.public_base_url'),
+            };
+        },
+        async gcsConfig() {
+            return {
+                bucket: await readString('assets.gcs.bucket'),
+                serviceAccountJson: await readString('assets.gcs.service_account_json'),
+                prefix: await readString('assets.gcs.prefix'),
+                publicBaseUrl: await readString('assets.gcs.public_base_url'),
+            };
+        },
+    };
+}
+//# sourceMappingURL=settings-view.js.map

package/dist/backend/services/storage/settings-view.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"settings-view.js","sourceRoot":"","sources":["../../../../src/backend/services/storage/settings-view.ts"],"names":[],"mappings":"AAAA,uEAAuE;AACvE,2EAA2E;AAC3E,0EAA0E;AAC1E,yBAAyB;AACzB,EAAE;AACF,sEAAsE;AACtE,4CAA4C;AAG5C,OAAO,EAAE,OAAO,EAAE,MAAM,kCAAkC,CAAC;AAC3D,OAAO,EAAE,YAAY,EAAE,MAAM,kCAAkC,CAAC;AAGhE,MAAM,aAAa,GAAG,CAAC,OAAO,EAAE,IAAI,EAAE,KAAK,CAAU,CAAC;AAEtD,MAAM,UAAU,kBAAkB,CAChC,SAA8B;IAE9B,KAAK,UAAU,UAAU,CAAC,IAAY;QACpC,MAAM,EAAE,GAAG,SAAS,EAAE,CAAC;QACvB,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QACpD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,6CAA6C,IAAI,IAAI,CAAC,CAAC;QACzE,CAAC;QACD,mEAAmE;QACnE,wEAAwE;QACxE,4BAA4B;QAC5B,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;QACtE,MAAM,GAAG,GAAG,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC;QAC7D,OAAO,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC;IAC3D,CAAC;IACD,KAAK,UAAU,UAAU,CAAC,IAAY,EAAE,QAAgB;QACtD,MAAM,EAAE,GAAG,SAAS,EAAE,CAAC;QACvB,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QACpD,IAAI,CAAC,OAAO;YAAE,OAAO,QAAQ,CAAC;QAC9B,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;QACtE,MAAM,GAAG,GAAG,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC;QAC7D,MAAM,CAAC,GAAG,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACtD,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;IAC3C,CAAC;IAED,OAAO;QACL,KAAK,CAAC,aAAa;YACjB,MAAM,CAAC,GAAG,CAAC,MAAM,UAAU,CAAC,wBAAwB,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAC9D,IAAK,aAAmC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;gBACrD,OAAO,CAA2B,CAAC;YACrC,CAAC;YACD,OAAO,OAAO,CAAC;QACjB,CAAC;QACD,YAAY;YACV,OAAO,UAAU,CAAC,uBAAuB,CAAC,CAAC;QAC7C,CAAC;QACD,kBAAkB;YAChB,OAAO,UAAU,CAAC,8BAA8B,CAAC,CAAC;QACpD,CAAC;QACD,gBAAgB;YACd,OAAO,UAAU,CAAC,4BAA4B,EAAE,GAAG,CAAC,CAAC;QACvD,CAAC;QACD,KAAK,CAAC,QAAQ;YACZ,OAAO;gBACL,MAAM,EAAE,MAAM,UAAU,CAAC,kBAAkB,CAAC;gBAC5C,MAAM,EAAE,MAAM,UAAU,CAAC,kBAAkB,CAAC;gBAC5C,WAAW,EAAE,MAAM,UAAU,CAAC,yBAAyB,CAAC;gBACxD,eAAe,EAAE,MAAM,UAAU,CAAC,6BAA6B,CAAC;gBAChE,QAAQ,EAAE,MAAM,UAAU,CAAC,oBAAoB,CAAC;gBAChD,MAAM,EAAE,MAAM,UAAU,CAAC,kBAAkB,CAAC;gBAC5C,aAAa,EAAE,MAAM,UAAU,CAAC,2BAA2B,CAAC;aAC7D,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,SAAS;YACb,OAAO;gBACL,MAAM,EAAE,MAAM,UAAU,CAAC,mBAAmB,CAAC;gBAC7C,kBAAkB,EAAE,MAAM,UAAU,CAAC,iCAAiC,CAAC;gBACvE,MAAM,EAAE,MAAM,UAAU,CAAC,mBAAmB,CAAC;gBAC7C,aAAa,EAAE,MAAM,UAAU,CAAC,4BAA4B,CAAC;aAC9D,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/backend/services/storage/storage-adapter.d.ts

@@ -0,0 +1,62 @@
+import type { AssetVisibility, StorageBackendCode } from '@endora-commerce/contracts';
+export type { AssetVisibility, StorageBackendCode };
+export interface StorageAdapterSelfCheck {
+    ok: boolean;
+    /** Admin-displayable when ok=false; left undefined on ok=true. */
+    reason?: string;
+}
+export interface StoragePutInput {
+    /** Locator the adapter must use; produced by the adapter via `newLocator(...)`. */
+    locator: string;
+    mimeType: string;
+    visibility: AssetVisibility;
+    /** Streaming source — must be consumed exactly once. */
+    stream: NodeJS.ReadableStream;
+    sizeBytes: number;
+}
+export interface StorageResolveUrlInput {
+    locator: string;
+    visibility: AssetVisibility;
+    /** TTL for private signed URLs. Ignored for public assets. */
+    ttlSec?: number;
+}
+export interface StorageResolveUrlOutput {
+    url: string;
+    /** Absolute expiry for signed URLs; null when the URL is stable (public). */
+    expiresAt: Date | null;
+}
+export interface StorageNewLocatorInput {
+    assetId: string;
+    originalFilename: string;
+}
+export interface StorageAdapter {
+    readonly code: StorageBackendCode;
+    /** Cheap probe (HEAD bucket / stat dir / ListBuckets). Returns ok+reason. */
+    selfCheck(): Promise<StorageAdapterSelfCheck>;
+    /** Compute a fresh, never-colliding locator for an upload of the given asset. */
+    newLocator(input: StorageNewLocatorInput): string;
+    /** Atomically persist the byte stream at `locator`. Throws on any failure. */
+    put(input: StoragePutInput): Promise<void>;
+    /** Resolve a URL for serving. See research R6 for per-backend semantics. */
+    resolveUrl(input: StorageResolveUrlInput): Promise<StorageResolveUrlOutput>;
+    /** Stream the bytes for backend-proxied private serving (used by local-FS public route). */
+    open(input: {
+        locator: string;
+    }): Promise<NodeJS.ReadableStream>;
+    /**
+     * Remove the underlying object. MUST throw if the backend cannot confirm
+     * removal — the worker relies on this for FR-031 block-then-retry.
+     */
+    delete(input: {
+        locator: string;
+    }): Promise<void>;
+    /**
+     * Optional. Adapters whose visibility is enforced by per-request URL
+     * resolution (local FS) MAY no-op; cloud adapters update the object ACL.
+     */
+    setVisibility?(input: {
+        locator: string;
+        visibility: AssetVisibility;
+    }): Promise<void>;
+}
+//# sourceMappingURL=storage-adapter.d.ts.map

package/dist/backend/services/storage/storage-adapter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"storage-adapter.d.ts","sourceRoot":"","sources":["../../../../src/backend/services/storage/storage-adapter.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AACtF,YAAY,EAAE,eAAe,EAAE,kBAAkB,EAAE,CAAC;AAEpD,MAAM,WAAW,uBAAuB;IACtC,EAAE,EAAE,OAAO,CAAC;IACZ,kEAAkE;IAClE,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,eAAe;IAC9B,mFAAmF;IACnF,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,eAAe,CAAC;IAC5B,wDAAwD;IACxD,MAAM,EAAE,MAAM,CAAC,cAAc,CAAC;IAC9B,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,sBAAsB;IACrC,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,eAAe,CAAC;IAC5B,8DAA8D;IAC9D,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,uBAAuB;IACtC,GAAG,EAAE,MAAM,CAAC;IACZ,6EAA6E;IAC7E,SAAS,EAAE,IAAI,GAAG,IAAI,CAAC;CACxB;AAED,MAAM,WAAW,sBAAsB;IACrC,OAAO,EAAE,MAAM,CAAC;IAChB,gBAAgB,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC;IAElC,6EAA6E;IAC7E,SAAS,IAAI,OAAO,CAAC,uBAAuB,CAAC,CAAC;IAE9C,iFAAiF;IACjF,UAAU,CAAC,KAAK,EAAE,sBAAsB,GAAG,MAAM,CAAC;IAElD,8EAA8E;IAC9E,GAAG,CAAC,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE3C,4EAA4E;IAC5E,UAAU,CAAC,KAAK,EAAE,sBAAsB,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAAC;IAE5E,4FAA4F;IAC5F,IAAI,CAAC,KAAK,EAAE;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;IAEjE;;;OAGG;IACH,MAAM,CAAC,KAAK,EAAE;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAElD;;;OAGG;IACH,aAAa,CAAC,CAAC,KAAK,EAAE;QACpB,OAAO,EAAE,MAAM,CAAC;QAChB,UAAU,EAAE,eAAe,CAAC;KAC7B,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACnB"}

package/dist/backend/services/storage/storage-adapter.js

@@ -0,0 +1,10 @@
+// In-process Storage Adapter SPI — feature 013 / research.md R1.
+// Each backend (local FS, S3, GCS) implements this exactly once. Consumers of
+// the Library never know which backend is active; they go through
+// AdapterRegistry.getActive() (or the per-asset dispatch in AssetsLibraryService
+// which routes to the backend that originally stored the bytes).
+//
+// This is a TypeScript-only contract — the interface is never serialized over
+// the wire, so it lives here rather than in @endora-commerce/contracts.
+export {};
+//# sourceMappingURL=storage-adapter.js.map

package/dist/backend/services/storage/storage-adapter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"storage-adapter.js","sourceRoot":"","sources":["../../../../src/backend/services/storage/storage-adapter.ts"],"names":[],"mappings":"AAAA,iEAAiE;AACjE,8EAA8E;AAC9E,kEAAkE;AAClE,iFAAiF;AACjF,iEAAiE;AACjE,EAAE;AACF,8EAA8E;AAC9E,wEAAwE"}

package/dist/backend/services/upload-pipeline.d.ts

@@ -0,0 +1,41 @@
+import type { EntityManager } from '@mikro-orm/postgresql';
+import { Asset } from '../entities/asset.entity.js';
+import type { AuditPort } from '@endora-commerce/platform/kernel';
+import type { AdapterRegistry } from './storage/adapter-registry.js';
+import type { AssetVisibility } from './storage/storage-adapter.js';
+export interface UploadPolicy {
+    /** From `assets.allowed_file_types` setting; `['*']` ⇒ unrestricted. */
+    allowedTypes: string[];
+    /** From `assets.max_file_size_mb` setting; `0` ⇒ no cap. */
+    maxFileSizeMb: number;
+}
+export interface UploadInput {
+    /** Original filename from the multipart part. Used for extension + display. */
+    filename: string;
+    /** MIME from the multipart Content-Type header (may be wrong; sniffed below). */
+    declaredMime: string;
+    /** Streaming source — must be consumed exactly once. */
+    stream: NodeJS.ReadableStream;
+    /** Best-effort byte count from headers; `0` when unknown. */
+    declaredSize: number;
+    /** Folder id chosen by the admin, or null for "Unsorted". */
+    folderId: string | null;
+    /** Optional storefront-visible label. */
+    label: string | null;
+    /** Visibility on creation; defaults to `public`. */
+    visibility: AssetVisibility;
+}
+export interface UploadPipelineDeps {
+    emFactory: () => EntityManager;
+    adapters: AdapterRegistry;
+    /** Loader called once per upload; lets routes pre-resolve from settings. */
+    loadPolicy: () => Promise<UploadPolicy>;
+    /** Feature 054 — audits the asset insert co-transactionally when provided. */
+    auditLog?: AuditPort;
+}
+export declare class UploadPipeline {
+    private readonly deps;
+    constructor(deps: UploadPipelineDeps);
+    run(input: UploadInput): Promise<Asset>;
+}
+//# sourceMappingURL=upload-pipeline.d.ts.map

package/dist/backend/services/upload-pipeline.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"upload-pipeline.d.ts","sourceRoot":"","sources":["../../../src/backend/services/upload-pipeline.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAM3D,OAAO,EAAE,KAAK,EAAE,MAAM,6BAA6B,CAAC;AAGpD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,kCAAkC,CAAC;AAClE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AACrE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AAEpE,MAAM,WAAW,YAAY;IAC3B,wEAAwE;IACxE,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,4DAA4D;IAC5D,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,WAAW;IAC1B,+EAA+E;IAC/E,QAAQ,EAAE,MAAM,CAAC;IACjB,iFAAiF;IACjF,YAAY,EAAE,MAAM,CAAC;IACrB,wDAAwD;IACxD,MAAM,EAAE,MAAM,CAAC,cAAc,CAAC;IAC9B,6DAA6D;IAC7D,YAAY,EAAE,MAAM,CAAC;IACrB,6DAA6D;IAC7D,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,yCAAyC;IACzC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,oDAAoD;IACpD,UAAU,EAAE,eAAe,CAAC;CAC7B;AAED,MAAM,WAAW,kBAAkB;IACjC,SAAS,EAAE,MAAM,aAAa,CAAC;IAC/B,QAAQ,EAAE,eAAe,CAAC;IAC1B,4EAA4E;IAC5E,UAAU,EAAE,MAAM,OAAO,CAAC,YAAY,CAAC,CAAC;IACxC,8EAA8E;IAC9E,QAAQ,CAAC,EAAE,SAAS,CAAC;CACtB;AAqCD,qBAAa,cAAc;IACb,OAAO,CAAC,QAAQ,CAAC,IAAI;gBAAJ,IAAI,EAAE,kBAAkB;IAE/C,GAAG,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC,KAAK,CAAC;CAyI9C"}

package/dist/backend/services/upload-pipeline.js

@@ -0,0 +1,231 @@
+// Upload pipeline — feature 013 / US1 / research.md R3, R8.
+//
+// Flow:
+//   1. Pre-flight: filename / MIME / size against the configured policies.
+//   2. Allocate a UUID, ask the active adapter for a sharded locator.
+//   3. Sniff the actual MIME from the first bytes via `file-type/stream`.
+//   4. Stream into adapter.put(); throw on any failure (no Asset row yet).
+//   5. Insert the Asset row in one transaction. On insert failure, call
+//      adapter.delete() to compensate (the orphan-sweep worker is the
+//      backstop for this rare path).
+//
+// Atomicity contract per FR-010: if the function throws, neither a row nor
+// a file survives. The compensating delete in step 5 closes the only
+// race-y window (post-put, pre-commit).
+import { fileTypeFromBuffer } from 'file-type';
+import { randomUUID } from 'node:crypto';
+import { Readable, Transform } from 'node:stream';
+import { ERROR_CODES } from '@endora-commerce/contracts';
+import { Asset } from '../entities/asset.entity.js';
+import { HttpError } from '@endora-commerce/platform/http';
+import { recordAuditFromContext } from '@endora-commerce/platform/commands';
+const KIND_BY_MIME_PREFIX = [
+    ['image/', 'image'],
+    ['video/', 'video'],
+    ['application/pdf', 'pdf'],
+];
+function mimeToKind(mime) {
+    for (const [prefix, kind] of KIND_BY_MIME_PREFIX) {
+        if (mime.startsWith(prefix))
+            return kind;
+    }
+    return 'other';
+}
+function extensionOf(filename) {
+    const m = filename.toLowerCase().match(/\.([^./\\]+)$/);
+    return m ? m[1] : '';
+}
+/**
+ * Allow-list match: extension OR MIME (case-insensitive). The setting may
+ * carry either form. `'*'` anywhere in the list disables the gate.
+ */
+function isAllowed(allowed, mime, ext) {
+    if (allowed.length === 0)
+        return true;
+    for (const entry of allowed) {
+        const e = entry.trim().toLowerCase();
+        if (e === '' || e === '*')
+            return true;
+        if (e === mime.toLowerCase())
+            return true;
+        if (e === `.${ext}` || e === ext)
+            return true;
+        // Wildcard MIME like `image/*` matches any `image/...`
+        if (e.endsWith('/*') && mime.toLowerCase().startsWith(e.slice(0, -1)))
+            return true;
+    }
+    return false;
+}
+export class UploadPipeline {
+    deps;
+    constructor(deps) {
+        this.deps = deps;
+    }
+    async run(input) {
+        const policy = await this.deps.loadPolicy();
+        const ext = extensionOf(input.filename);
+        // — Pre-flight (cheap rejections before touching the adapter) —
+        if (policy.maxFileSizeMb > 0 &&
+            input.declaredSize > 0 &&
+            input.declaredSize > policy.maxFileSizeMb * 1024 * 1024) {
+            throw new HttpError(413, ERROR_CODES.ASSET_UPLOAD_TOO_LARGE, `File exceeds the configured maximum of ${policy.maxFileSizeMb} MB.`);
+        }
+        if (!isAllowed(policy.allowedTypes, input.declaredMime, ext)) {
+            throw new HttpError(415, ERROR_CODES.ASSET_UPLOAD_TYPE_NOT_ALLOWED, `File type "${input.declaredMime || ext || 'unknown'}" is not allowed by the active policy. Allowed: ${policy.allowedTypes.join(', ') || '(none)'}.`);
+        }
+        // — MIME sniff via file-type/stream —
+        // The library returns a wrapped stream we consume in place of the original;
+        // the wrapper replays the head bytes so the adapter still gets the full file.
+        const { fileType, stream: sniffedStream } = await sniffMime(input.stream);
+        const sniffedMime = fileType?.mime ?? input.declaredMime ?? 'application/octet-stream';
+        // Re-check allow-list using the *sniffed* MIME (defends against spoofed
+        // Content-Type) — the stricter check decides per spec edge case.
+        if (sniffedMime !== input.declaredMime &&
+            !isAllowed(policy.allowedTypes, sniffedMime, ext)) {
+            throw new HttpError(415, ERROR_CODES.ASSET_UPLOAD_TYPE_NOT_ALLOWED, `File content reports type "${sniffedMime}", which is not allowed by the active policy. Allowed: ${policy.allowedTypes.join(', ') || '(none)'}.`);
+        }
+        // — Allocate id, locator —
+        const assetId = randomUUID();
+        const adapter = await this.deps.adapters.getActive();
+        const locator = adapter.newLocator({
+            assetId,
+            originalFilename: input.filename,
+        });
+        // — Stream into the adapter (storage-first commit) —
+        // Multipart parts frequently carry no per-part Content-Length, so
+        // `declaredSize` is often 0. Count the bytes as they flow to the adapter so
+        // the persisted `sizeBytes` is accurate; the file-serving route sends this
+        // value as `Content-Length`, and a wrong 0 makes browsers render an empty
+        // image (broken preview in admin and missing placeholder on the storefront).
+        let observedSize = 0;
+        const countingStream = sniffedStream.pipe(new Transform({
+            transform(chunk, _enc, cb) {
+                observedSize += chunk.length;
+                cb(null, chunk);
+            },
+        }));
+        try {
+            await adapter.put({
+                locator,
+                mimeType: sniffedMime,
+                visibility: input.visibility,
+                stream: countingStream,
+                sizeBytes: input.declaredSize,
+            });
+        }
+        catch (err) {
+            const reason = err instanceof Error ? err.message : String(err);
+            throw new HttpError(503, ERROR_CODES.ASSET_STORAGE_UNAVAILABLE, `Storage adapter failed to persist the upload: ${reason}`);
+        }
+        // — Resolve the *public* URL form once, for back-compat with code paths
+        // (notably storefront catalog responses) that still read `storage_url`
+        // directly. The local-FS public route ignores the URL and gates on
+        // current `visibility` per request, so storing the public form is safe
+        // even for `private` local assets. For S3/GCS this URL only works
+        // when the asset is actually public; visibility-flipped cloud assets
+        // need refresh via `assetsLibrary.resolveUrl(id)` (catalog-query
+        // rewire is a Phase 5 follow-up).
+        const publicForm = await adapter.resolveUrl({
+            locator,
+            visibility: 'public',
+        });
+        // — DB insert (compensating-delete on failure) —
+        const em = this.deps.emFactory();
+        try {
+            const asset = em.create(Asset, {
+                id: assetId,
+                kind: mimeToKind(sniffedMime),
+                filename: input.filename,
+                mimeType: sniffedMime,
+                sizeBytes: String(observedSize > 0 ? observedSize : input.declaredSize),
+                storageUrl: publicForm.url,
+                storageLocator: locator,
+                storageBackend: adapter.code,
+                visibility: input.visibility,
+                ...(input.folderId ? { folderId: input.folderId } : {}),
+                ...(input.label ? { label: input.label } : {}),
+            });
+            em.persist(asset);
+            if (this.deps.auditLog) {
+                recordAuditFromContext(this.deps.auditLog, em, {
+                    action: 'asset.upload',
+                    objectType: 'asset',
+                    objectId: asset.id,
+                    stateBefore: null,
+                    stateAfter: { filename: asset.filename, kind: asset.kind, visibility: asset.visibility },
+                });
+            }
+            await em.flush();
+            return asset;
+        }
+        catch (insertErr) {
+            // Compensating delete on storage. Best-effort; failure here is logged
+            // and surfaced via `pendingCleanup` on the next worker tick.
+            try {
+                await adapter.delete({ locator });
+            }
+            catch {
+                /* swallowed — compensating-delete is best-effort */
+            }
+            throw insertErr;
+        }
+    }
+}
+/**
+ * Read the first 4100 bytes of a Node stream into a Buffer, sniff the MIME
+ * via `fileTypeFromBuffer`, and return a new readable that yields the
+ * buffered prefix followed by the rest of the original stream. This avoids
+ * loading the whole upload into memory while still letting file-type
+ * inspect the magic bytes.
+ *
+ * The 4100-byte head matches the longest prefix file-type's heuristics need
+ * for any of its supported formats; bigger prefixes don't improve detection.
+ */
+async function sniffMime(source) {
+    const HEAD_BYTES = 4100;
+    const headChunks = [];
+    let collected = 0;
+    const onIter = source[Symbol.asyncIterator]
+        ? source
+        : Readable.from(source);
+    const iter = onIter[Symbol.asyncIterator]();
+    let leftover;
+    while (collected < HEAD_BYTES) {
+        const next = await iter.next();
+        if (next.done)
+            break;
+        const chunk = Buffer.isBuffer(next.value) ? next.value : Buffer.from(next.value);
+        if (collected + chunk.length <= HEAD_BYTES) {
+            headChunks.push(chunk);
+            collected += chunk.length;
+        }
+        else {
+            const want = HEAD_BYTES - collected;
+            headChunks.push(chunk.subarray(0, want));
+            leftover = chunk.subarray(want);
+            collected = HEAD_BYTES;
+            break;
+        }
+    }
+    const head = Buffer.concat(headChunks);
+    const sniffed = head.length > 0 ? await fileTypeFromBuffer(head) : undefined;
+    // Replay: yield the head, then the leftover (if any), then drain the rest of
+    // the iterator. We do not buffer beyond the head; the rest streams normally.
+    async function* replay() {
+        if (head.length > 0)
+            yield head;
+        if (leftover && leftover.length > 0)
+            yield leftover;
+        while (true) {
+            const next = await iter.next();
+            if (next.done)
+                return;
+            yield Buffer.isBuffer(next.value) ? next.value : Buffer.from(next.value);
+        }
+    }
+    return {
+        fileType: sniffed ? { mime: sniffed.mime, ext: sniffed.ext } : undefined,
+        stream: Readable.from(replay()),
+    };
+}
+//# sourceMappingURL=upload-pipeline.js.map

package/dist/backend/services/upload-pipeline.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"upload-pipeline.js","sourceRoot":"","sources":["../../../src/backend/services/upload-pipeline.ts"],"names":[],"mappings":"AAAA,4DAA4D;AAC5D,EAAE;AACF,QAAQ;AACR,2EAA2E;AAC3E,sEAAsE;AACtE,0EAA0E;AAC1E,2EAA2E;AAC3E,wEAAwE;AACxE,sEAAsE;AACtE,qCAAqC;AACrC,EAAE;AACF,2EAA2E;AAC3E,qEAAqE;AACrE,wCAAwC;AAGxC,OAAO,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAC;AAC/C,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AAEzD,OAAO,EAAE,KAAK,EAAE,MAAM,6BAA6B,CAAC;AACpD,OAAO,EAAE,SAAS,EAAE,MAAM,gCAAgC,CAAC;AAC3D,OAAO,EAAE,sBAAsB,EAAE,MAAM,oCAAoC,CAAC;AAsC5E,MAAM,mBAAmB,GAAmC;IAC1D,CAAC,QAAQ,EAAE,OAAO,CAAC;IACnB,CAAC,QAAQ,EAAE,OAAO,CAAC;IACnB,CAAC,iBAAiB,EAAE,KAAK,CAAC;CAC3B,CAAC;AAEF,SAAS,UAAU,CAAC,IAAY;IAC9B,KAAK,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,mBAAmB,EAAE,CAAC;QACjD,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC;YAAE,OAAO,IAAI,CAAC;IAC3C,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,WAAW,CAAC,QAAgB;IACnC,MAAM,CAAC,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;IACxD,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AACxB,CAAC;AAED;;;GAGG;AACH,SAAS,SAAS,CAAC,OAAiB,EAAE,IAAY,EAAE,GAAW;IAC7D,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACtC,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,CAAC,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACrC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC;QACvC,IAAI,CAAC,KAAK,IAAI,CAAC,WAAW,EAAE;YAAE,OAAO,IAAI,CAAC;QAC1C,IAAI,CAAC,KAAK,IAAI,GAAG,EAAE,IAAI,CAAC,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC;QAC9C,uDAAuD;QACvD,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;IACrF,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,OAAO,cAAc;IACI;IAA7B,YAA6B,IAAwB;QAAxB,SAAI,GAAJ,IAAI,CAAoB;IAAG,CAAC;IAEzD,KAAK,CAAC,GAAG,CAAC,KAAkB;QAC1B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;QAC5C,MAAM,GAAG,GAAG,WAAW,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAExC,gEAAgE;QAChE,IACE,MAAM,CAAC,aAAa,GAAG,CAAC;YACxB,KAAK,CAAC,YAAY,GAAG,CAAC;YACtB,KAAK,CAAC,YAAY,GAAG,MAAM,CAAC,aAAa,GAAG,IAAI,GAAG,IAAI,EACvD,CAAC;YACD,MAAM,IAAI,SAAS,CACjB,GAAG,EACH,WAAW,CAAC,sBAAsB,EAClC,0CAA0C,MAAM,CAAC,aAAa,MAAM,CACrE,CAAC;QACJ,CAAC;QACD,IACE,CAAC,SAAS,CAAC,MAAM,CAAC,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,GAAG,CAAC,EACxD,CAAC;YACD,MAAM,IAAI,SAAS,CACjB,GAAG,EACH,WAAW,CAAC,6BAA6B,EACzC,cAAc,KAAK,CAAC,YAAY,IAAI,GAAG,IAAI,SAAS,mDAAmD,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,QAAQ,GAAG,CACrJ,CAAC;QACJ,CAAC;QAED,sCAAsC;QACtC,4EAA4E;QAC5E,8EAA8E;QAC9E,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC1E,MAAM,WAAW,GAAG,QAAQ,EAAE,IAAI,IAAI,KAAK,CAAC,YAAY,IAAI,0BAA0B,CAAC;QAEvF,wEAAwE;QACxE,iEAAiE;QACjE,IACE,WAAW,KAAK,KAAK,CAAC,YAAY;YAClC,CAAC,SAAS,CAAC,MAAM,CAAC,YAAY,EAAE,WAAW,EAAE,GAAG,CAAC,EACjD,CAAC;YACD,MAAM,IAAI,SAAS,CACjB,GAAG,EACH,WAAW,CAAC,6BAA6B,EACzC,8BAA8B,WAAW,0DAA0D,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,QAAQ,GAAG,CACjJ,CAAC;QACJ,CAAC;QAED,2BAA2B;QAC3B,MAAM,OAAO,GAAG,UAAU,EAAE,CAAC;QAC7B,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,CAAC;QACrD,MAAM,OAAO,GAAG,OAAO,CAAC,UAAU,CAAC;YACjC,OAAO;YACP,gBAAgB,EAAE,KAAK,CAAC,QAAQ;SACjC,CAAC,CAAC;QAEH,qDAAqD;QACrD,kEAAkE;QAClE,4EAA4E;QAC5E,2EAA2E;QAC3E,0EAA0E;QAC1E,6EAA6E;QAC7E,IAAI,YAAY,GAAG,CAAC,CAAC;QACrB,MAAM,cAAc,GAAG,aAAa,CAAC,IAAI,CACvC,IAAI,SAAS,CAAC;YACZ,SAAS,CAAC,KAAa,EAAE,IAAI,EAAE,EAAE;gBAC/B,YAAY,IAAI,KAAK,CAAC,MAAM,CAAC;gBAC7B,EAAE,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YAClB,CAAC;SACF,CAAC,CACH,CAAC;QACF,IAAI,CAAC;YACH,MAAM,OAAO,CAAC,GAAG,CAAC;gBAChB,OAAO;gBACP,QAAQ,EAAE,WAAW;gBACrB,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,MAAM,EAAE,cAAc;gBACtB,SAAS,EAAE,KAAK,CAAC,YAAY;aAC9B,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,MAAM,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAChE,MAAM,IAAI,SAAS,CACjB,GAAG,EACH,WAAW,CAAC,yBAAyB,EACrC,iDAAiD,MAAM,EAAE,CAC1D,CAAC;QACJ,CAAC;QAED,wEAAwE;QACxE,uEAAuE;QACvE,mEAAmE;QACnE,uEAAuE;QACvE,kEAAkE;QAClE,qEAAqE;QACrE,iEAAiE;QACjE,kCAAkC;QAClC,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC;YAC1C,OAAO;YACP,UAAU,EAAE,QAAQ;SACrB,CAAC,CAAC;QAEH,iDAAiD;QACjD,MAAM,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;QACjC,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,EAAE,CAAC,MAAM,CAAC,KAAK,EAAE;gBAC7B,EAAE,EAAE,OAAO;gBACX,IAAI,EAAE,UAAU,CAAC,WAAW,CAAC;gBAC7B,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,QAAQ,EAAE,WAAW;gBACrB,SAAS,EAAE,MAAM,CAAC,YAAY,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC;gBACvE,UAAU,EAAE,UAAU,CAAC,GAAG;gBAC1B,cAAc,EAAE,OAAO;gBACvB,cAAc,EAAE,OAAO,CAAC,IAAI;gBAC5B,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACvD,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC/C,CAAC,CAAC;YACH,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YAClB,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACvB,sBAAsB,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,EAAE;oBAC7C,MAAM,EAAE,cAAc;oBACtB,UAAU,EAAE,OAAO;oBACnB,QAAQ,EAAE,KAAK,CAAC,EAAE;oBAClB,WAAW,EAAE,IAAI;oBACjB,UAAU,EAAE,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE;iBACzF,CAAC,CAAC;YACL,CAAC;YACD,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC;YACjB,OAAO,KAAK,CAAC;QACf,CAAC;QAAC,OAAO,SAAS,EAAE,CAAC;YACnB,sEAAsE;YACtE,6DAA6D;YAC7D,IAAI,CAAC;gBACH,MAAM,OAAO,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;YACpC,CAAC;YAAC,MAAM,CAAC;gBACP,oDAAoD;YACtD,CAAC;YACD,MAAM,SAAS,CAAC;QAClB,CAAC;IACH,CAAC;CACF;AAED;;;;;;;;;GASG;AACH,KAAK,UAAU,SAAS,CACtB,MAA6B;IAE7B,MAAM,UAAU,GAAG,IAAI,CAAC;IACxB,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,IAAI,SAAS,GAAG,CAAC,CAAC;IAElB,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC;QACzC,CAAC,CAAC,MAAmD;QACrD,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,MAA+B,CAAC,CAAC;IAEnD,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,CAAC;IAC5C,IAAI,QAA4B,CAAC;IACjC,OAAO,SAAS,GAAG,UAAU,EAAE,CAAC;QAC9B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QAC/B,IAAI,IAAI,CAAC,IAAI;YAAE,MAAM;QACrB,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACjF,IAAI,SAAS,GAAG,KAAK,CAAC,MAAM,IAAI,UAAU,EAAE,CAAC;YAC3C,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACvB,SAAS,IAAI,KAAK,CAAC,MAAM,CAAC;QAC5B,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,GAAG,UAAU,GAAG,SAAS,CAAC;YACpC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;YACzC,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YAChC,SAAS,GAAG,UAAU,CAAC;YACvB,MAAM;QACR,CAAC;IACH,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IACvC,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAE7E,6EAA6E;IAC7E,6EAA6E;IAC7E,KAAK,SAAS,CAAC,CAAC,MAAM;QACpB,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;YAAE,MAAM,IAAI,CAAC;QAChC,IAAI,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;YAAE,MAAM,QAAQ,CAAC;QACpD,OAAO,IAAI,EAAE,CAAC;YACZ,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;YAC/B,IAAI,IAAI,CAAC,IAAI;gBAAE,OAAO;YACtB,MAAM,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC3E,CAAC;IACH,CAAC;IACD,OAAO;QACL,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,SAAS;QACxE,MAAM,EAAE,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;KAChC,CAAC;AACJ,CAAC"}