@marinoscar/platform-api 0.0.0-stage → 0.1.0-next.4

package/dist/storage/config/storage-config-admin.service.js

@@ -0,0 +1,355 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+var StorageConfigAdminService_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.StorageConfigAdminService = void 0;
+const common_1 = require("@nestjs/common");
+const index_1 = require("../../credentials/index");
+const index_2 = require("../../settings/index");
+const storage_driver_1 = require("../drivers/storage-driver");
+const storage_config_service_1 = require("./storage-config.service");
+const update_storage_config_dto_1 = require("./dto/update-storage-config.dto");
+const storage_system_settings_1 = require("./storage.system-settings");
+const storage_settings_compat_1 = require("./storage-settings-compat");
+const index_3 = require("../../core/index");
+const ports_1 = require("../ports");
+const storage_db_1 = require("../data/storage-db");
+/**
+ * The admin view and the save of the storage configuration (the masked secret status, never the secret), with the provider-switch gate's stranded-object count.
+ *
+ * @stability experimental
+ */
+let StorageConfigAdminService = StorageConfigAdminService_1 = class StorageConfigAdminService {
+    prisma;
+    systemSettings;
+    credentials;
+    storageConfig;
+    system;
+    logger = new common_1.Logger(StorageConfigAdminService_1.name);
+    constructor(prisma, systemSettings, 
+    // `describe` and `setSecret` ONLY. `getSecret` — the plaintext one — is
+    // never called from this file. See the class header.
+    credentials, 
+    // For `invalidateCache()` after a write, and for nothing else. This service
+    // does not resolve configurations; that is what the other one is for.
+    storageConfig, system) {
+        this.prisma = prisma;
+        this.systemSettings = systemSettings;
+        this.credentials = credentials;
+        this.storageConfig = storageConfig;
+        this.system = system;
+    }
+    // ---------------------------------------------------------------------------
+    // Read
+    // ---------------------------------------------------------------------------
+    /**
+     * Everything `GET /api/admin/storage-config` renders.
+     *
+     * DOES NOT THROW ON A DAMAGED ROW, matching
+     * `PushConfigService.describeForAdmin` and for the same reason: this is the repair path, and a
+     * 500 here would take down the one screen capable of fixing the row.
+     * `getStoragePolicy` already degrades field by field to the drivers'
+     * defaults — the unconfigured state — so a corrupt `region` still renders the
+     * bucket an operator typed.
+     */
+    async describeForAdmin() {
+        const [policy, row] = await Promise.all([
+            // `fresh` is irrelevant here — `getStoragePolicy` is the uncached
+            // accessor — but the row read below is what carries `version`, and the
+            // two must describe the same write. See `readRow`.
+            this.systemSettings.getStoragePolicy(),
+            this.readRow(),
+        ]);
+        // One masked status per declared secret of every registered driver: the
+        // descriptors say whether each is stored, the response says it for the
+        // active driver's primary secret with its hint and provenance.
+        const infos = await this.describeSecrets((0, storage_driver_1.storageDriverIds)());
+        return this.toResponse(policy, row, infos);
+    }
+    // ---------------------------------------------------------------------------
+    // Write
+    // ---------------------------------------------------------------------------
+    /**
+     * `PUT /api/admin/storage-config` — the active driver, its settings and an
+     * optional secret rotation.
+     *
+     * Order of operations, and every step is load-bearing:
+     *
+     *   1. Read the current row. One read, used for the version check, the switch
+     *      gate and nothing else — so the version that is checked and the location
+     *      that is compared can never come from two different reads.
+     *   2. `If-Match`. Refuse BEFORE anything is written. See the class header for
+     *      why this check exists here as well as inside `patchSettings`.
+     *   3. The switch gate. A `409` naming the row counts, unless the body carries
+     *      the typed confirmation.
+     *   4. The credential(s), if the body carried any. Blank preserves.
+     *   5. The settings namespace, through `patchSettings`.
+     *   6. ⚠ `invalidateCache()`, SYNCHRONOUSLY, before the audit write.
+     *   7. The audit row.
+     *
+     * Step 6's placement is the same rule `MaintenanceModeService.setMaintenance`
+     * follows, for the same reason: between the settings write committing and that
+     * call, this instance would still answer storage questions from a value it
+     * read up to five seconds ago, and an administrator who saved a corrected
+     * bucket and immediately retried an upload would watch it fail against the old
+     * one. Anything that awaits in between widens that window for no benefit.
+     *
+     * @throws BadRequestException (400) for an unregistered driver, settings the driver refuses, or a flat alias contradicting `drivers`.
+     * @throws ConflictException (409) for a stale `If-Match`, or a relocation that strands objects without the `SWITCH` confirmation.
+     */
+    async replace(input, userId, expectedVersion) {
+        const row = await this.readRow();
+        const current = await this.systemSettings.getStoragePolicy();
+        const currentVersion = row?.version ?? 0;
+        if (expectedVersion !== undefined && currentVersion !== expectedVersion) {
+            throw new common_1.ConflictException(`Storage settings version mismatch. Expected ${expectedVersion}, found ${currentVersion}`);
+        }
+        const driver = this.requireDriver(input.provider);
+        // The same merge a PATCH of the namespace performs: it validates the driver
+        // id and every named driver's settings (400), folds the legacy flat aliases
+        // into the driver they belong to and refuses a contradiction.
+        const patch = {
+            provider: input.provider,
+            ...(input.drivers === undefined ? {} : { drivers: input.drivers }),
+            ...(input.bucket === undefined ? {} : { bucket: input.bucket }),
+            ...(input.region === undefined ? {} : { region: input.region }),
+            ...(input.endpoint === undefined ? {} : { endpoint: input.endpoint }),
+            ...(input.accountId === undefined ? {} : { accountId: input.accountId }),
+            ...(input.accessKeyId === undefined ? {} : { accessKeyId: input.accessKeyId }),
+            ...(input.forcePathStyle === undefined ? {} : { forcePathStyle: input.forcePathStyle }),
+        };
+        const next = (0, storage_system_settings_1.mergeStorageSettings)(current, patch);
+        await this.assertSwitchAcknowledged(current, next, input.confirmation);
+        // Blank preserves: only a typed, non-empty secret is written.
+        const typed = (0, storage_settings_compat_1.submittedSecretValues)(driver.id, input);
+        const rotated = Object.keys(typed);
+        for (const name of rotated) {
+            const address = (0, storage_driver_1.storageSecretAddress)(driver, name);
+            const spec = (driver.secrets ?? []).find((candidate) => candidate.name === name);
+            await this.credentials.setSecret(address.purpose, address.name, typed[name], {
+                label: address.label ?? spec?.label ?? `${driver.label} ${name}`,
+                updatedByUserId: userId,
+            });
+        }
+        await this.systemSettings.patchSettings({ storage: patch }, userId, expectedVersion);
+        // SYNCHRONOUS, and BEFORE the audit write. See step 6 above.
+        this.storageConfig.invalidateCache();
+        await this.audit(userId, 'storage_config:replace', {
+            settings: this.auditableSettings(next),
+            secretRotated: rotated.length > 0,
+            ...(rotated.length > 0 ? { secretsRotated: rotated } : {}),
+            switchConfirmed: input.confirmation === update_storage_config_dto_1.STORAGE_SWITCH_CONFIRMATION,
+        });
+        const location = this.locationOf(next);
+        this.logger.log(`Storage configuration replaced by user ${userId} ` +
+            `(provider=${next.provider} bucket=${location.bucket || '(none)'} ` +
+            `secretRotated=${rotated.length > 0})`);
+        return this.describeForAdmin();
+    }
+    // ---------------------------------------------------------------------------
+    // The switch gate
+    // ---------------------------------------------------------------------------
+    /**
+     * Refuses (409) a save that would repoint a deployment still holding objects.
+     *
+     * Compares the LOCATION the stored settings point at with the one the new
+     * settings will: the driver, its bucket (container, directory) and its
+     * endpoint. Changing a field that does not move the bytes (a region
+     * correction, a rotated key) is not a relocation. A deployment that never had
+     * a bucket has nothing to strand and sails through.
+     *
+     * ⚠ IT ACKNOWLEDGES, IT DOES NOT MIGRATE. See `STORAGE_SWITCH_CONFIRMATION`.
+     */
+    async assertSwitchAcknowledged(current, next, confirmation) {
+        if (confirmation === update_storage_config_dto_1.STORAGE_SWITCH_CONFIRMATION)
+            return;
+        const from = this.locationOf(current);
+        if (!from.bucket)
+            return;
+        const to = this.locationOf(next);
+        const relocated = from.provider !== to.provider || from.bucket !== to.bucket || from.endpoint !== to.endpoint;
+        if (!relocated)
+            return;
+        const usage = await this.countLocationUsage(current);
+        if (usage.total === 0)
+            return;
+        throw new common_1.ConflictException({
+            code: 'STORAGE_LOCATION_IN_USE',
+            message: `${usage.storageObjects} stored object(s) and ${usage.databaseBackupRuns} database ` +
+                `backup(s) still point at ${describeLocation(from)}. Changing the provider, ` +
+                `bucket or endpoint does NOT copy them — they will remain where they are and this ` +
+                `deployment will no longer be able to read them. Re-send with ` +
+                `{"confirmation":"${update_storage_config_dto_1.STORAGE_SWITCH_CONFIRMATION}"} to save anyway.`,
+            details: {
+                confirmation: update_storage_config_dto_1.STORAGE_SWITCH_CONFIRMATION,
+                from: { provider: from.provider, bucket: from.bucket, endpoint: from.endpoint },
+                to: { provider: to.provider, bucket: to.bucket, endpoint: to.endpoint },
+                storageObjects: usage.storageObjects,
+                databaseBackupRuns: usage.databaseBackupRuns,
+            },
+        });
+    }
+    /**
+     * How many rows still point at `location`.
+     *
+     * `storage_objects` rows with no recorded bucket (`null`) count: they predate
+     * the column and can only have been written to the then-only location. Failed
+     * uploads do not: nothing was stored. Backups count only while they are real
+     * (`pending`, `running`, `completed`).
+     */
+    async countLocationUsage(location) {
+        const where = this.locationOf(location);
+        const [storageObjects, databaseBackupRuns] = await Promise.all([
+            this.system.asSystem('admin-aggregate').storageObject.count({
+                where: {
+                    storageProvider: where.provider,
+                    OR: [{ bucket: where.bucket }, { bucket: null }],
+                    status: { not: storage_db_1.StorageObjectStatus.failed },
+                },
+            }),
+            this.prisma.databaseBackupRun.count({
+                where: {
+                    storageProvider: where.provider,
+                    bucket: where.bucket,
+                    status: { in: ['pending', 'running', 'completed'] },
+                },
+            }),
+        ]);
+        return {
+            storageObjects,
+            databaseBackupRuns,
+            total: storageObjects + databaseBackupRuns,
+        };
+    }
+    // ---------------------------------------------------------------------------
+    // Plumbing
+    // ---------------------------------------------------------------------------
+    /** The driver, or a 400 naming the registered ids. */
+    requireDriver(id) {
+        const driver = (0, storage_driver_1.getStorageDriver)(id);
+        return driver ?? (0, storage_settings_compat_1.unknownDriverRejection)(id);
+    }
+    /** Where the settings point: the driver, its bucket and its endpoint (`null` for the SDK's own host). */
+    locationOf(policy) {
+        const driver = (0, storage_driver_1.getStorageDriver)(policy.provider);
+        if (!driver)
+            return { provider: policy.provider, bucket: '', endpoint: null };
+        const location = (0, storage_driver_1.storageLocationOf)(driver, policy.drivers[policy.provider] ?? {});
+        return { provider: policy.provider, bucket: location.bucket, endpoint: location.endpoint ?? null };
+    }
+    /**
+     * The masked status of every declared secret of the given drivers.
+     *
+     * `describe` only: it returns `CredentialInfo`, a type with no field capable
+     * of carrying secret material. The plaintext is never read here.
+     */
+    async describeSecrets(ids) {
+        const result = new Map();
+        await Promise.all(ids.map(async (id) => {
+            const driver = (0, storage_driver_1.getStorageDriver)(id);
+            const byName = new Map();
+            for (const spec of driver?.secrets ?? []) {
+                const address = (0, storage_driver_1.storageSecretAddress)(driver, spec.name);
+                const info = await this.credentials.describe(address.purpose, address.name);
+                if (info)
+                    byName.set(spec.name, info);
+            }
+            result.set(id, byName);
+        }));
+        return result;
+    }
+    /** The settings for the audit row: every driver's, which hold no secret by construction. */
+    auditableSettings(next) {
+        return { provider: next.provider, drivers: next.drivers };
+    }
+    /**
+     * The `system_settings.global` row's provenance, for `version`/`updatedAt`/`updatedBy`.
+     *
+     * A direct, narrow read: `SystemSettingsService.getSettings()` would CREATE
+     * the row as a side effect of rendering a form, and this read must never
+     * write.
+     */
+    async readRow() {
+        return this.prisma.systemSettings.findUnique({
+            where: { key: 'global' },
+            select: {
+                version: true,
+                updatedAt: true,
+                updatedByUser: { select: { id: true, email: true } },
+            },
+        });
+    }
+    toResponse(policy, row, infos) {
+        const driver = (0, storage_driver_1.getStorageDriver)(policy.provider);
+        const settings = policy.drivers[policy.provider] ?? {};
+        const declared = driver?.secrets ?? [];
+        const present = Object.fromEntries(declared.map((secret) => [secret.name, infos.get(policy.provider)?.has(secret.name) === true]));
+        // The driver's own verdict, from presence flags: this path never decrypts.
+        const missing = driver ? (0, storage_driver_1.missingStorageFields)(driver, settings, present) : ['driver'];
+        const location = driver ? (0, storage_driver_1.storageLocationOf)(driver, settings) : { bucket: '', endpoint: null };
+        const primary = declared.length > 0 ? infos.get(policy.provider)?.get(declared[0].name) : undefined;
+        return {
+            provider: policy.provider,
+            drivers: policy.drivers,
+            // The deprecated flat view of the active built-in (`getStoragePolicy`
+            // publishes it); empty when the active driver declares none of the fields.
+            bucket: policy.bucket ?? '',
+            region: policy.region ?? '',
+            endpoint: policy.endpoint ?? '',
+            accountId: policy.accountId ?? '',
+            accessKeyId: policy.accessKeyId ?? '',
+            forcePathStyle: policy.forcePathStyle ?? null,
+            descriptors: (0, storage_driver_1.describeStorageDrivers)((id) => ({
+                secrets: Object.fromEntries(((0, storage_driver_1.getStorageDriver)(id)?.secrets ?? []).map((secret) => [secret.name, infos.get(id)?.has(secret.name) === true])),
+            })),
+            effectiveEndpoint: location.endpoint ?? null,
+            configured: missing.length === 0,
+            missing,
+            secretStatus: {
+                configured: primary !== undefined,
+                hint: primary?.hint ?? null,
+                updatedAt: primary?.updatedAt.toISOString() ?? null,
+                updatedByUserId: primary?.updatedByUserId ?? null,
+            },
+            version: row?.version ?? 0,
+            updatedAt: row?.updatedAt.toISOString() ?? null,
+            updatedBy: row?.updatedByUser ?? null,
+        };
+    }
+    async audit(userId, action, meta) {
+        await this.prisma.auditEvent.create({
+            data: {
+                actorUserId: userId,
+                action,
+                targetType: 'system_settings',
+                targetId: 'storage',
+                meta: meta,
+            },
+        });
+    }
+};
+exports.StorageConfigAdminService = StorageConfigAdminService;
+exports.StorageConfigAdminService = StorageConfigAdminService = StorageConfigAdminService_1 = __decorate([
+    (0, common_1.Injectable)(),
+    __param(0, (0, common_1.Inject)(index_3.PLATFORM_PRISMA)),
+    __param(4, (0, common_1.Inject)(ports_1.STORAGE_SYSTEM_DATA)),
+    __metadata("design:paramtypes", [Object, index_2.SystemSettingsService,
+        index_1.CredentialsService,
+        storage_config_service_1.StorageConfigService, Object])
+], StorageConfigAdminService);
+function describeLocation(location) {
+    return (`${location.provider} bucket "${location.bucket}"` +
+        (location.endpoint ? ` (${location.endpoint})` : ''));
+}
+//# sourceMappingURL=storage-config-admin.service.js.map

package/dist/storage/config/storage-config-admin.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"storage-config-admin.service.js","sourceRoot":"","sources":["../../../src/storage/config/storage-config-admin.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,2CAA+E;AAE/E,mDAA6D;AAC7D,gDAA6D;AAE7D,8DAQmC;AACnC,qEAAgE;AAEhE,+EAGyC;AACzC,uEAAiE;AACjE,uEAA0F;AAC1F,4CAAmD;AACnD,oCAAuE;AACvE,mDAAyD;AAuFzD;;;;GAIG;AAEI,IAAM,yBAAyB,iCAA/B,MAAM,yBAAyB;IAIQ;IACzB;IAGA;IAGA;IAI6B;IAd/B,MAAM,GAAG,IAAI,eAAM,CAAC,2BAAyB,CAAC,IAAI,CAAC,CAAC;IAErE,YAC4C,MAAqB,EAC9C,cAAqC;IACtD,wEAAwE;IACxE,qDAAqD;IACpC,WAA+B;IAChD,4EAA4E;IAC5E,sEAAsE;IACrD,aAAmC,EAIN,MAAyB;QAX7B,WAAM,GAAN,MAAM,CAAe;QAC9C,mBAAc,GAAd,cAAc,CAAuB;QAGrC,gBAAW,GAAX,WAAW,CAAoB;QAG/B,kBAAa,GAAb,aAAa,CAAsB;QAIN,WAAM,GAAN,MAAM,CAAmB;IACtE,CAAC;IAEJ,8EAA8E;IAC9E,OAAO;IACP,8EAA8E;IAE9E;;;;;;;;;OASG;IACH,KAAK,CAAC,gBAAgB;QACpB,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YACtC,kEAAkE;YAClE,uEAAuE;YACvE,mDAAmD;YACnD,IAAI,CAAC,cAAc,CAAC,gBAAgB,EAAE;YACtC,IAAI,CAAC,OAAO,EAAE;SACf,CAAC,CAAC;QAEH,wEAAwE;QACxE,uEAAuE;QACvE,+DAA+D;QAC/D,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,IAAA,iCAAgB,GAAE,CAAC,CAAC;QAE7D,OAAO,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;IAC7C,CAAC;IAED,8EAA8E;IAC9E,QAAQ;IACR,8EAA8E;IAE9E;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACH,KAAK,CAAC,OAAO,CACX,KAA+B,EAC/B,MAAc,EACd,eAAwB;QAExB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;QACjC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,gBAAgB,EAAE,CAAC;QAC7D,MAAM,cAAc,GAAG,GAAG,EAAE,OAAO,IAAI,CAAC,CAAC;QAEzC,IAAI,eAAe,KAAK,SAAS,IAAI,cAAc,KAAK,eAAe,EAAE,CAAC;YACxE,MAAM,IAAI,0BAAiB,CACzB,+CAA+C,eAAe,WAAW,cAAc,EAAE,CAC1F,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAElD,4EAA4E;QAC5E,4EAA4E;QAC5E,8DAA8D;QAC9D,MAAM,KAAK,GAAG;YACZ,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,GAAG,CAAC,KAAK,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;YAClE,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;YAC/D,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;YAC/D,GAAG,CAAC,KAAK,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC;YACrE,GAAG,CAAC,KAAK,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC;YACxE,GAAG,CAAC,KAAK,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC;YAC9E,GAAG,CAAC,KAAK,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,KAAK,CAAC,cAAc,EAAE,CAAC;SACxF,CAAC;QACF,MAAM,IAAI,GAAG,IAAA,8CAAoB,EAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAElD,MAAM,IAAI,CAAC,wBAAwB,CAAC,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;QAEvE,8DAA8D;QAC9D,MAAM,KAAK,GAAG,IAAA,+CAAqB,EAAC,MAAM,CAAC,EAAE,EAAE,KAA2C,CAAC,CAAC;QAC5F,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAEnC,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;YAC3B,MAAM,OAAO,GAAG,IAAA,qCAAoB,EAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YACnD,MAAM,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;YAEjF,MAAM,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE;gBAC3E,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,IAAI,EAAE,KAAK,IAAI,GAAG,MAAM,CAAC,KAAK,IAAI,IAAI,EAAE;gBAChE,eAAe,EAAE,MAAM;aACxB,CAAC,CAAC;QACL,CAAC;QAED,MAAM,IAAI,CAAC,cAAc,CAAC,aAAa,CACrC,EAAE,OAAO,EAAE,KAAK,EAAE,EAClB,MAAM,EACN,eAAe,CAChB,CAAC;QAEF,6DAA6D;QAC7D,IAAI,CAAC,aAAa,CAAC,eAAe,EAAE,CAAC;QAErC,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,wBAAwB,EAAE;YACjD,QAAQ,EAAE,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC;YACtC,aAAa,EAAE,OAAO,CAAC,MAAM,GAAG,CAAC;YACjC,GAAG,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1D,eAAe,EAAE,KAAK,CAAC,YAAY,KAAK,uDAA2B;SACpE,CAAC,CAAC;QAEH,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QAEvC,IAAI,CAAC,MAAM,CAAC,GAAG,CACb,0CAA0C,MAAM,GAAG;YACjD,aAAa,IAAI,CAAC,QAAQ,WAAW,QAAQ,CAAC,MAAM,IAAI,QAAQ,GAAG;YACnE,iBAAiB,OAAO,CAAC,MAAM,GAAG,CAAC,GAAG,CACzC,CAAC;QAEF,OAAO,IAAI,CAAC,gBAAgB,EAAE,CAAC;IACjC,CAAC;IAED,8EAA8E;IAC9E,kBAAkB;IAClB,8EAA8E;IAE9E;;;;;;;;;;OAUG;IACK,KAAK,CAAC,wBAAwB,CACpC,OAA2B,EAC3B,IAAwB,EACxB,YAAgC;QAEhC,IAAI,YAAY,KAAK,uDAA2B;YAAE,OAAO;QAEzD,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;QACtC,IAAI,CAAC,IAAI,CAAC,MAAM;YAAE,OAAO;QAEzB,MAAM,EAAE,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QACjC,MAAM,SAAS,GAAG,IAAI,CAAC,QAAQ,KAAK,EAAE,CAAC,QAAQ,IAAI,IAAI,CAAC,MAAM,KAAK,EAAE,CAAC,MAAM,IAAI,IAAI,CAAC,QAAQ,KAAK,EAAE,CAAC,QAAQ,CAAC;QAE9G,IAAI,CAAC,SAAS;YAAE,OAAO;QAEvB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC;QAErD,IAAI,KAAK,CAAC,KAAK,KAAK,CAAC;YAAE,OAAO;QAE9B,MAAM,IAAI,0BAAiB,CAAC;YAC1B,IAAI,EAAE,yBAAyB;YAC/B,OAAO,EACL,GAAG,KAAK,CAAC,cAAc,yBAAyB,KAAK,CAAC,kBAAkB,YAAY;gBACpF,4BAA4B,gBAAgB,CAAC,IAAI,CAAC,2BAA2B;gBAC7E,mFAAmF;gBACnF,+DAA+D;gBAC/D,oBAAoB,uDAA2B,oBAAoB;YACrE,OAAO,EAAE;gBACP,YAAY,EAAE,uDAA2B;gBACzC,IAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE;gBAC/E,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,EAAE,CAAC,QAAQ,EAAE;gBACvE,cAAc,EAAE,KAAK,CAAC,cAAc;gBACpC,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;aAC7C;SACF,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,kBAAkB,CAAC,QAA4B;QACnD,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAExC,MAAM,CAAC,cAAc,EAAE,kBAAkB,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YAC7D,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC;gBAC1D,KAAK,EAAE;oBACL,eAAe,EAAE,KAAK,CAAC,QAAQ;oBAC/B,EAAE,EAAE,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;oBAChD,MAAM,EAAE,EAAE,GAAG,EAAE,gCAAmB,CAAC,MAAM,EAAE;iBAC5C;aACF,CAAC;YACF,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC,KAAK,CAAC;gBAClC,KAAK,EAAE;oBACL,eAAe,EAAE,KAAK,CAAC,QAAQ;oBAC/B,MAAM,EAAE,KAAK,CAAC,MAAM;oBACpB,MAAM,EAAE,EAAE,EAAE,EAAE,CAAC,SAAS,EAAE,SAAS,EAAE,WAAW,CAAC,EAAE;iBACpD;aACF,CAAC;SACH,CAAC,CAAC;QAEH,OAAO;YACL,cAAc;YACd,kBAAkB;YAClB,KAAK,EAAE,cAAc,GAAG,kBAAkB;SAC3C,CAAC;IACJ,CAAC;IAED,8EAA8E;IAC9E,WAAW;IACX,8EAA8E;IAE9E,sDAAsD;IAC9C,aAAa,CAAC,EAAU;QAC9B,MAAM,MAAM,GAAG,IAAA,iCAAgB,EAAC,EAAE,CAAC,CAAC;QAEpC,OAAO,MAAM,IAAI,IAAA,gDAAsB,EAAC,EAAE,CAAC,CAAC;IAC9C,CAAC;IAED,yGAAyG;IACjG,UAAU,CAAC,MAA0B;QAC3C,MAAM,MAAM,GAAG,IAAA,iCAAgB,EAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAEjD,IAAI,CAAC,MAAM;YAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;QAE9E,MAAM,QAAQ,GAAG,IAAA,kCAAiB,EAAC,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;QAElF,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,IAAI,IAAI,EAAE,CAAC;IACrG,CAAC;IAED;;;;;OAKG;IACK,KAAK,CAAC,eAAe,CAC3B,GAAsB;QAEtB,MAAM,MAAM,GAAG,IAAI,GAAG,EAAiG,CAAC;QAExH,MAAM,OAAO,CAAC,GAAG,CACf,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;YACnB,MAAM,MAAM,GAAG,IAAA,iCAAgB,EAAC,EAAE,CAAC,CAAC;YACpC,MAAM,MAAM,GAAG,IAAI,GAAG,EAAoF,CAAC;YAE3G,KAAK,MAAM,IAAI,IAAI,MAAM,EAAE,OAAO,IAAI,EAAE,EAAE,CAAC;gBACzC,MAAM,OAAO,GAAG,IAAA,qCAAoB,EAAC,MAAsC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;gBACxF,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;gBAC5E,IAAI,IAAI;oBAAE,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YACxC,CAAC;YAED,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QACzB,CAAC,CAAC,CACH,CAAC;QAEF,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,4FAA4F;IACpF,iBAAiB,CAAC,IAAwB;QAChD,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC;IAC5D,CAAC;IAED;;;;;;OAMG;IACK,KAAK,CAAC,OAAO;QACnB,OAAO,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,UAAU,CAAC;YAC3C,KAAK,EAAE,EAAE,GAAG,EAAE,QAAQ,EAAE;YACxB,MAAM,EAAE;gBACN,OAAO,EAAE,IAAI;gBACb,SAAS,EAAE,IAAI;gBACf,aAAa,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;aACrD;SACF,CAAC,CAAC;IACL,CAAC;IAEO,UAAU,CAChB,MAA0B,EAC1B,GAIQ,EACR,KAAyG;QAEzG,MAAM,MAAM,GAAG,IAAA,iCAAgB,EAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACjD,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QACvD,MAAM,QAAQ,GAAG,MAAM,EAAE,OAAO,IAAI,EAAE,CAAC;QACvC,MAAM,OAAO,GAAG,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC;QAEnI,2EAA2E;QAC3E,MAAM,OAAO,GAAG,MAAM,CAAC,CAAC,CAAC,IAAA,qCAAoB,EAAC,MAAM,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QACtF,MAAM,QAAQ,GAAG,MAAM,CAAC,CAAC,CAAC,IAAA,kCAAiB,EAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;QAC/F,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAEpG,OAAO;YACL,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,sEAAsE;YACtE,2EAA2E;YAC3E,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,EAAE;YAC3B,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,EAAE;YAC3B,QAAQ,EAAE,MAAM,CAAC,QAAQ,IAAI,EAAE;YAC/B,SAAS,EAAE,MAAM,CAAC,SAAS,IAAI,EAAE;YACjC,WAAW,EAAE,MAAM,CAAC,WAAW,IAAI,EAAE;YACrC,cAAc,EAAE,MAAM,CAAC,cAAc,IAAI,IAAI;YAC7C,WAAW,EAAE,IAAA,uCAAsB,EAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;gBAC3C,OAAO,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC,IAAA,iCAAgB,EAAC,EAAE,CAAC,EAAE,OAAO,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC;aAC5I,CAAC,CAAC;YACH,iBAAiB,EAAE,QAAQ,CAAC,QAAQ,IAAI,IAAI;YAC5C,UAAU,EAAE,OAAO,CAAC,MAAM,KAAK,CAAC;YAChC,OAAO;YACP,YAAY,EAAE;gBACZ,UAAU,EAAE,OAAO,KAAK,SAAS;gBACjC,IAAI,EAAE,OAAO,EAAE,IAAI,IAAI,IAAI;gBAC3B,SAAS,EAAE,OAAO,EAAE,SAAS,CAAC,WAAW,EAAE,IAAI,IAAI;gBACnD,eAAe,EAAE,OAAO,EAAE,eAAe,IAAI,IAAI;aAClD;YACD,OAAO,EAAE,GAAG,EAAE,OAAO,IAAI,CAAC;YAC1B,SAAS,EAAE,GAAG,EAAE,SAAS,CAAC,WAAW,EAAE,IAAI,IAAI;YAC/C,SAAS,EAAE,GAAG,EAAE,aAAa,IAAI,IAAI;SACtC,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,KAAK,CACjB,MAAc,EACd,MAAc,EACd,IAA6B;QAE7B,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC;YAClC,IAAI,EAAE;gBACJ,WAAW,EAAE,MAAM;gBACnB,MAAM;gBACN,UAAU,EAAE,iBAAiB;gBAC7B,QAAQ,EAAE,SAAS;gBACnB,IAAI,EAAE,IAAwC;aAC/C;SACF,CAAC,CAAC;IACL,CAAC;CACF,CAAA;AA5XY,8DAAyB;oCAAzB,yBAAyB;IADrC,IAAA,mBAAU,GAAE;IAKR,WAAA,IAAA,eAAM,EAAC,uBAAe,CAAC,CAAA;IAWvB,WAAA,IAAA,eAAM,EAAC,2BAAmB,CAAC,CAAA;6CAVK,6BAAqB;QAGxB,0BAAkB;QAGhB,6CAAoB;GAX3C,yBAAyB,CA4XrC;AAED,SAAS,gBAAgB,CAAC,QAAyB;IACjD,OAAO,CACL,GAAG,QAAQ,CAAC,QAAQ,YAAY,QAAQ,CAAC,MAAM,GAAG;QAClD,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CACrD,CAAC;AACJ,CAAC"}

package/dist/storage/config/storage-config.controller.d.ts

@@ -0,0 +1,199 @@
+import { StorageBucketProvisionService } from './storage-bucket-provision.service';
+import { StorageConfigAdminService } from './storage-config-admin.service';
+import { StorageConnectionTestService } from './storage-connection-test.service';
+import { ProvisionStorageBucketDto } from './dto/storage-bucket-provision.dto';
+import { TestStorageConfigDto } from './dto/storage-connection-test.dto';
+import { UpdateStorageConfigDto } from './dto/update-storage-config.dto';
+/**
+ * The `/api/admin/storage-config` routes (`storage_config:read|write`): read, save, connection test, bucket provisioning.
+ *
+ * @internal
+ *
+ * @stability experimental
+ */
+export declare class StorageConfigController {
+    private readonly storageConfig;
+    private readonly connectionTest;
+    private readonly bucketProvision;
+    constructor(storageConfig: StorageConfigAdminService, connectionTest: StorageConnectionTestService, bucketProvision: StorageBucketProvisionService);
+    getConfig(): Promise<{
+        provider: string;
+        drivers: Record<string, Record<string, unknown>>;
+        bucket: string;
+        region: string;
+        endpoint: string;
+        accountId: string;
+        accessKeyId: string;
+        forcePathStyle: boolean | null;
+        descriptors: {
+            kind: string;
+            id: string;
+            label: string;
+            fields: ({
+                kind: "boolean";
+                name: string;
+                label: string;
+                help?: string | undefined;
+            } | {
+                kind: "enum";
+                options: string[];
+                name: string;
+                label: string;
+                help?: string | undefined;
+            } | {
+                kind: "number";
+                name: string;
+                label: string;
+                min?: number | undefined;
+                max?: number | undefined;
+                integer?: boolean | undefined;
+                help?: string | undefined;
+            } | {
+                kind: "string";
+                name: string;
+                label: string;
+                maxLength?: number | undefined;
+                help?: string | undefined;
+            } | {
+                kind: "other";
+                name: string;
+                label: string;
+                help?: string | undefined;
+            } | {
+                kind: "secret";
+                hasValue: boolean;
+                required: boolean;
+                name: string;
+                label: string;
+                help?: string | undefined;
+            })[];
+            description?: string | undefined;
+        }[];
+        effectiveEndpoint: string | null;
+        configured: boolean;
+        missing: string[];
+        secretStatus: {
+            configured: boolean;
+            hint: string | null;
+            updatedAt: string | null;
+            updatedByUserId: string | null;
+        };
+        version: number;
+        updatedAt: string | null;
+        updatedBy: {
+            id: string;
+            email: string;
+        } | null;
+    }>;
+    replaceConfig(dto: UpdateStorageConfigDto, userId: string, ifMatch?: string): Promise<{
+        provider: string;
+        drivers: Record<string, Record<string, unknown>>;
+        bucket: string;
+        region: string;
+        endpoint: string;
+        accountId: string;
+        accessKeyId: string;
+        forcePathStyle: boolean | null;
+        descriptors: {
+            kind: string;
+            id: string;
+            label: string;
+            fields: ({
+                kind: "boolean";
+                name: string;
+                label: string;
+                help?: string | undefined;
+            } | {
+                kind: "enum";
+                options: string[];
+                name: string;
+                label: string;
+                help?: string | undefined;
+            } | {
+                kind: "number";
+                name: string;
+                label: string;
+                min?: number | undefined;
+                max?: number | undefined;
+                integer?: boolean | undefined;
+                help?: string | undefined;
+            } | {
+                kind: "string";
+                name: string;
+                label: string;
+                maxLength?: number | undefined;
+                help?: string | undefined;
+            } | {
+                kind: "other";
+                name: string;
+                label: string;
+                help?: string | undefined;
+            } | {
+                kind: "secret";
+                hasValue: boolean;
+                required: boolean;
+                name: string;
+                label: string;
+                help?: string | undefined;
+            })[];
+            description?: string | undefined;
+        }[];
+        effectiveEndpoint: string | null;
+        configured: boolean;
+        missing: string[];
+        secretStatus: {
+            configured: boolean;
+            hint: string | null;
+            updatedAt: string | null;
+            updatedByUserId: string | null;
+        };
+        version: number;
+        updatedAt: string | null;
+        updatedBy: {
+            id: string;
+            email: string;
+        } | null;
+    }>;
+    testConfig(dto: TestStorageConfigDto, userId: string): Promise<{
+        success: boolean;
+        provider: string;
+        bucket: string;
+        region: string;
+        effectiveEndpoint: string | null;
+        usedStoredSecret: boolean;
+        checks: {
+            id: "credentials" | "bucket" | "roundTrip" | "presignedUrl";
+            label: string;
+            status: "failed" | "skipped" | "passed";
+            code: "ok" | "not_configured" | "not_attempted" | "credentials_rejected" | "endpoint_unreachable" | "bucket_missing" | "bucket_forbidden" | "bucket_region_mismatch" | "write_denied" | "read_denied" | "read_mismatch" | "delete_denied" | "presign_unreachable" | "presign_rejected" | "presign_mismatch" | "unknown_error";
+            detail: string;
+            error: string | null;
+        }[];
+        attemptedAt: string;
+        message?: string | undefined;
+        details?: Record<string, string | number | boolean> | undefined;
+    }>;
+    provisionBucket(dto: ProvisionStorageBucketDto, userId: string): Promise<{
+        outcome: "failed" | "created" | "partial" | "already_exists" | "guided";
+        provider: string;
+        bucket: string;
+        region: string;
+        effectiveEndpoint: string | null;
+        steps: {
+            id: "create" | "cors" | "publicAccessBlock" | "encryption";
+            label: string;
+            status: "failed" | "skipped" | "passed";
+            detail: string;
+            error: string | null;
+        }[];
+        guidance: {
+            reason: string;
+            commands: string;
+            runbook: string | null;
+        } | null;
+        corsOrigin: string | null;
+        attemptedAt: string;
+        message?: string | undefined;
+    }>;
+}
+//# sourceMappingURL=storage-config.controller.d.ts.map

package/dist/storage/config/storage-config.controller.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"storage-config.controller.d.ts","sourceRoot":"","sources":["../../../src/storage/config/storage-config.controller.ts"],"names":[],"mappings":"AAcA,OAAO,EAAE,6BAA6B,EAAE,MAAM,oCAAoC,CAAC;AACnF,OAAO,EAAE,yBAAyB,EAAE,MAAM,gCAAgC,CAAC;AAC3E,OAAO,EAAE,4BAA4B,EAAE,MAAM,mCAAmC,CAAC;AACjF,OAAO,EAAE,yBAAyB,EAAmC,MAAM,oCAAoC,CAAC;AAEhH,OAAO,EAEL,oBAAoB,EACrB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAE,sBAAsB,EAAE,MAAM,iCAAiC,CAAC;AAoEzE;;;;;;GAMG;AACH,qBAEa,uBAAuB;IAEhC,OAAO,CAAC,QAAQ,CAAC,aAAa;IAC9B,OAAO,CAAC,QAAQ,CAAC,cAAc;IAC/B,OAAO,CAAC,QAAQ,CAAC,eAAe;gBAFf,aAAa,EAAE,yBAAyB,EACxC,cAAc,EAAE,4BAA4B,EAC5C,eAAe,EAAE,6BAA6B;IA0B3D,SAAS;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IA0CT,aAAa,CACT,GAAG,EAAE,sBAAsB,EAChB,MAAM,EAAE,MAAM,EACZ,OAAO,CAAC,EAAE,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IA0CjC,UAAU,CACN,GAAG,EAAE,oBAAoB,EACd,MAAM,EAAE,MAAM;;;;;;;;;;;;;;;;;;;IAmC7B,eAAe,CACX,GAAG,EAAE,yBAAyB,EACnB,MAAM,EAAE,MAAM;;;;;;;;;;;;;;;;;;;;;;CAIpC"}