@marinoscar/platform-api 0.1.0-next.3 → 0.1.0-next.4

package/dist/storage/drivers/s3/s3-family.js

@@ -0,0 +1,208 @@
+"use strict";
+// =============================================================================
+// The S3-family storage drivers: `s3`, `r2` and `s3compatible` (PP-14.7, #925)
+// =============================================================================
+//
+// The three object stores the platform ships are ONE driver implementation
+// parameterised by an `S3FlavourSpec` (`./s3-config.ts`): what the flavour
+// requires, how it derives an endpoint, which region it falls back to. Each
+// flavour is a `StorageDriverDefinition` registered through
+// `registerStorageDriver` exactly as an app's driver is
+// (`../builtin-storage-drivers.ts`); everything S3-specific lives under
+// `drivers/s3/` and nothing else in the slice names the AWS SDK.
+//
+// SETTINGS are each flavour's own `z.object` (R2 has an `accountId` the other
+// two do not); the SECRET is `secretAccessKey`, stored at `(purpose 'storage',
+// name 'default')` as it has been since #373, so no stored credential moves.
+// =============================================================================
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.s3CompatibleStorageDriver = exports.r2StorageDriver = exports.s3StorageDriver = void 0;
+const client_s3_1 = require("@aws-sdk/client-s3");
+const zod_1 = require("zod");
+const s3_storage_provider_1 = require("../../providers/s3/s3-storage.provider");
+const storage_credential_constants_1 = require("../../storage-credential.constants");
+const storage_not_configured_error_1 = require("../../config/storage-not-configured.error");
+const s3_config_1 = require("./s3-config");
+const s3_connection_test_1 = require("./s3-connection-test");
+const s3_provision_1 = require("./s3-provision");
+const s3_purge_1 = require("./s3-purge");
+const bucketField = zod_1.z
+    .string()
+    .trim()
+    .max(255)
+    .meta({ label: 'Bucket' })
+    .describe('The bucket objects are written to and read from. There is no default; empty means storage is not configured.');
+const regionField = (help) => zod_1.z.string().trim().max(255).meta({ label: 'Region' }).describe(help);
+const endpointField = (help) => zod_1.z.string().trim().max(512).meta({ label: 'Endpoint' }).describe(help);
+const accessKeyIdField = zod_1.z
+    .string()
+    .trim()
+    .max(255)
+    .meta({ label: 'Access key ID' })
+    .describe('The identifier half of the credential. It is not a secret; the secret access key is saved separately and never shown again.');
+const forcePathStyleField = zod_1.z
+    .boolean()
+    .nullable()
+    .meta({ label: 'Force path style' })
+    .describe('Address objects as host/bucket/key instead of bucket.host/key. Leave unset to use this vendor\'s convention.');
+const s3SettingsSchema = zod_1.z.object({
+    bucket: bucketField,
+    region: regionField('The AWS region the bucket lives in. Required: there is no default.'),
+    endpoint: endpointField('Leave empty for AWS. Set it to point at a local MinIO or another S3-compatible server.'),
+    accessKeyId: accessKeyIdField,
+    forcePathStyle: forcePathStyleField,
+});
+const r2SettingsSchema = zod_1.z.object({
+    bucket: bucketField,
+    accountId: zod_1.z
+        .string()
+        .trim()
+        .max(255)
+        .meta({ label: 'Account ID' })
+        .describe('The Cloudflare account id. The endpoint is derived from it unless you type one.'),
+    region: regionField('Leave empty for R2 (it signs with "auto"); set it only for a jurisdiction-restricted bucket.'),
+    endpoint: endpointField('Leave empty to derive https://<account id>.r2.cloudflarestorage.com.'),
+    accessKeyId: accessKeyIdField,
+    forcePathStyle: forcePathStyleField,
+});
+const s3CompatibleSettingsSchema = zod_1.z.object({
+    bucket: bucketField,
+    region: regionField('Optional for most servers (MinIO, Ceph ignore it); some vendors require their own region.'),
+    endpoint: endpointField('Required: the server\'s URL, for example https://minio.internal:9000.'),
+    accessKeyId: accessKeyIdField,
+    forcePathStyle: forcePathStyleField,
+});
+const EMPTY_S3_SETTINGS = {
+    bucket: '',
+    region: '',
+    endpoint: '',
+    accountId: '',
+    accessKeyId: '',
+    forcePathStyle: null,
+};
+/** A built-in's settings as the S3 code wants them: every field present. */
+function s3SettingsOf(settings) {
+    return { ...EMPTY_S3_SETTINGS, ...settings };
+}
+/** The endpoint a client would actually be pointed at, or `null` for the SDK's own host. */
+function effectiveEndpoint(flavour, settings) {
+    return settings.endpoint || flavour.deriveEndpoint?.(settings) || null;
+}
+async function* listS3Keys(flavour, ctx, prefix) {
+    const settings = s3SettingsOf(ctx.settings);
+    const resolution = (0, s3_config_1.resolveS3Config)(flavour, settings, await ctx.secret('secretAccessKey'));
+    if (!resolution.configured) {
+        throw new Error(`Cannot list keys: the ${flavour.id} configuration is missing ${resolution.missing.join(', ')}.`);
+    }
+    const client = new client_s3_1.S3Client((0, s3_storage_provider_1.buildS3ClientConfig)(resolution.config));
+    try {
+        let token;
+        do {
+            const page = await client.send(new client_s3_1.ListObjectsV2Command({ Bucket: settings.bucket, Prefix: prefix, ContinuationToken: token }));
+            for (const object of page.Contents ?? []) {
+                if (object.Key !== undefined)
+                    yield object.Key;
+            }
+            token = page.IsTruncated === true ? page.NextContinuationToken : undefined;
+        } while (token !== undefined);
+    }
+    finally {
+        client.destroy();
+    }
+}
+/**
+ * Builds one built-in S3 flavour's driver definition.
+ *
+ * @param flavour - the flavour's rules.
+ * @param meta - its label, description and settings.
+ * @returns a definition for `registerStorageDriver`.
+ *
+ * @stability experimental
+ */
+function defineS3FamilyDriver(flavour, meta) {
+    const defaults = meta.settingsSchema.parse(Object.fromEntries(Object.keys(meta.settingsSchema.shape).map((key) => [key, EMPTY_S3_SETTINGS[key]])));
+    return {
+        id: flavour.id,
+        label: meta.label,
+        description: meta.description,
+        settingsSchema: meta.settingsSchema,
+        defaults,
+        secrets: [
+            {
+                name: 'secretAccessKey',
+                label: 'Secret access key',
+                required: true,
+                help: 'Write-only: saved encrypted, never shown again. Leave blank to keep the stored one.',
+            },
+        ],
+        // The secret access key has lived at `(storage, default)` since #373; the
+        // purpose is registered by the storage slice's own credential manifest.
+        credentialAddress: () => ({ purpose: storage_credential_constants_1.STORAGE_CREDENTIAL_PURPOSE, name: storage_credential_constants_1.STORAGE_CREDENTIAL_NAME, label: storage_credential_constants_1.STORAGE_CREDENTIAL_LABEL }),
+        defaultRegion: flavour.fallbackRegion || undefined,
+        async build(ctx) {
+            const settings = s3SettingsOf(ctx.settings);
+            const resolution = (0, s3_config_1.resolveS3Config)(flavour, settings, await ctx.secret('secretAccessKey'));
+            if (!resolution.configured)
+                throw storage_not_configured_error_1.StorageNotConfiguredError.missing(flavour.id, resolution.missing);
+            const { config } = resolution;
+            return new s3_storage_provider_1.S3StorageProvider({
+                provider: config.provider,
+                bucket: config.bucket,
+                region: config.region,
+                ...(config.endpoint ? { endpoint: config.endpoint } : {}),
+                accessKeyId: config.accessKeyId,
+                secretAccessKey: config.secretAccessKey,
+                forcePathStyle: config.forcePathStyle,
+                partSize: ctx.partSize,
+            });
+        },
+        testConnection: (ctx) => (0, s3_connection_test_1.testS3Connection)({ ...ctx, settings: s3SettingsOf(ctx.settings) }, flavour),
+        provision: (ctx) => (0, s3_provision_1.provisionS3Bucket)({ ...ctx, settings: s3SettingsOf(ctx.settings) }, flavour),
+        listKeys: (ctx, prefix) => listS3Keys(flavour, ctx, prefix),
+        purge: (ctx, input) => (0, s3_purge_1.purgeS3)({ ...ctx, settings: s3SettingsOf(ctx.settings) }, flavour, input),
+        location(settings) {
+            const s3 = s3SettingsOf(settings);
+            return { bucket: s3.bucket, endpoint: effectiveEndpoint(flavour, s3), region: s3.region || flavour.fallbackRegion };
+        },
+        missing(settings, secrets) {
+            const resolution = (0, s3_config_1.resolveS3Config)(flavour, s3SettingsOf(settings), secrets.secretAccessKey === true ? 'stored' : null);
+            return resolution.configured ? [] : resolution.missing;
+        },
+        egressHosts(settings) {
+            const s3 = s3SettingsOf(settings);
+            return [effectiveEndpoint(flavour, s3) || (s3.region ? `s3.${s3.region}.amazonaws.com` : 's3.amazonaws.com')];
+        },
+    };
+}
+/**
+ * The `s3` driver: Amazon S3.
+ *
+ * @stability experimental
+ */
+exports.s3StorageDriver = defineS3FamilyDriver(s3_config_1.S3_FLAVOURS.s3, {
+    label: 'Amazon S3',
+    description: 'AWS S3. The region is required; the endpoint is left empty and the SDK derives it.',
+    settingsSchema: s3SettingsSchema,
+});
+/**
+ * The `r2` driver: Cloudflare R2.
+ *
+ * @stability experimental
+ */
+exports.r2StorageDriver = defineS3FamilyDriver(s3_config_1.S3_FLAVOURS.r2, {
+    label: 'Cloudflare R2',
+    description: 'Cloudflare R2. The endpoint is derived from the account id; the region is "auto".',
+    settingsSchema: r2SettingsSchema,
+});
+/**
+ * The `s3compatible` driver: MinIO, Backblaze B2, Wasabi, Ceph RGW and anything else speaking S3 at an endpoint you supply.
+ *
+ * @stability experimental
+ */
+exports.s3CompatibleStorageDriver = defineS3FamilyDriver(s3_config_1.S3_FLAVOURS.s3compatible, {
+    // The label the admin page has always shown for this radio (the page now takes it from the descriptor).
+    label: 'S3-compatible (MinIO, Wasabi, Backblaze B2…)',
+    description: 'MinIO, Backblaze B2, Wasabi, Ceph and other S3-compatible servers at an endpoint you supply.',
+    settingsSchema: s3CompatibleSettingsSchema,
+});
+//# sourceMappingURL=s3-family.js.map

package/dist/storage/drivers/s3/s3-family.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"s3-family.js","sourceRoot":"","sources":["../../../../src/storage/drivers/s3/s3-family.ts"],"names":[],"mappings":";AAAA,gFAAgF;AAChF,+EAA+E;AAC/E,gFAAgF;AAChF,EAAE;AACF,2EAA2E;AAC3E,2EAA2E;AAC3E,4EAA4E;AAC5E,4DAA4D;AAC5D,wDAAwD;AACxD,wEAAwE;AACxE,iEAAiE;AACjE,EAAE;AACF,8EAA8E;AAC9E,+EAA+E;AAC/E,6EAA6E;AAC7E,gFAAgF;;;AAEhF,kDAAqG;AACrG,6BAAwB;AAExB,gFAAgG;AAChG,qFAAmI;AACnI,4FAAsF;AAEtF,2CAAsG;AACtG,6DAAwD;AACxD,iDAAmD;AACnD,yCAAqC;AAErC,MAAM,WAAW,GAAG,OAAC;KAClB,MAAM,EAAE;KACR,IAAI,EAAE;KACN,GAAG,CAAC,GAAG,CAAC;KACR,IAAI,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;KACzB,QAAQ,CAAC,8GAA8G,CAAC,CAAC;AAC5H,MAAM,WAAW,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;AAC1G,MAAM,aAAa,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;AAC9G,MAAM,gBAAgB,GAAG,OAAC;KACvB,MAAM,EAAE;KACR,IAAI,EAAE;KACN,GAAG,CAAC,GAAG,CAAC;KACR,IAAI,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC;KAChC,QAAQ,CAAC,6HAA6H,CAAC,CAAC;AAC3I,MAAM,mBAAmB,GAAG,OAAC;KAC1B,OAAO,EAAE;KACT,QAAQ,EAAE;KACV,IAAI,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC;KACnC,QAAQ,CAAC,8GAA8G,CAAC,CAAC;AAE5H,MAAM,gBAAgB,GAAG,OAAC,CAAC,MAAM,CAAC;IAChC,MAAM,EAAE,WAAW;IACnB,MAAM,EAAE,WAAW,CAAC,oEAAoE,CAAC;IACzF,QAAQ,EAAE,aAAa,CAAC,wFAAwF,CAAC;IACjH,WAAW,EAAE,gBAAgB;IAC7B,cAAc,EAAE,mBAAmB;CACpC,CAAC,CAAC;AAEH,MAAM,gBAAgB,GAAG,OAAC,CAAC,MAAM,CAAC;IAChC,MAAM,EAAE,WAAW;IACnB,SAAS,EAAE,OAAC;SACT,MAAM,EAAE;SACR,IAAI,EAAE;SACN,GAAG,CAAC,GAAG,CAAC;SACR,IAAI,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC;SAC7B,QAAQ,CAAC,iFAAiF,CAAC;IAC9F,MAAM,EAAE,WAAW,CAAC,8FAA8F,CAAC;IACnH,QAAQ,EAAE,aAAa,CAAC,sEAAsE,CAAC;IAC/F,WAAW,EAAE,gBAAgB;IAC7B,cAAc,EAAE,mBAAmB;CACpC,CAAC,CAAC;AAEH,MAAM,0BAA0B,GAAG,OAAC,CAAC,MAAM,CAAC;IAC1C,MAAM,EAAE,WAAW;IACnB,MAAM,EAAE,WAAW,CAAC,2FAA2F,CAAC;IAChH,QAAQ,EAAE,aAAa,CAAC,uEAAuE,CAAC;IAChG,WAAW,EAAE,gBAAgB;IAC7B,cAAc,EAAE,mBAAmB;CACpC,CAAC,CAAC;AAEH,MAAM,iBAAiB,GAAqB;IAC1C,MAAM,EAAE,EAAE;IACV,MAAM,EAAE,EAAE;IACV,QAAQ,EAAE,EAAE;IACZ,SAAS,EAAE,EAAE;IACb,WAAW,EAAE,EAAE;IACf,cAAc,EAAE,IAAI;CACrB,CAAC;AAEF,4EAA4E;AAC5E,SAAS,YAAY,CAAC,QAAiC;IACrD,OAAO,EAAE,GAAG,iBAAiB,EAAE,GAAG,QAAQ,EAAsB,CAAC;AACnE,CAAC;AAED,4FAA4F;AAC5F,SAAS,iBAAiB,CAAC,OAAsB,EAAE,QAA0B;IAC3E,OAAO,QAAQ,CAAC,QAAQ,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC;AACzE,CAAC;AAED,KAAK,SAAS,CAAC,CAAC,UAAU,CAAC,OAAsB,EAAE,GAAkD,EAAE,MAAc;IACnH,MAAM,QAAQ,GAAG,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC5C,MAAM,UAAU,GAAG,IAAA,2BAAe,EAAC,OAAO,EAAE,QAAQ,EAAE,MAAM,GAAG,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC,CAAC;IAC3F,IAAI,CAAC,UAAU,CAAC,UAAU,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CAAC,yBAAyB,OAAO,CAAC,EAAE,6BAA6B,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACpH,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,oBAAQ,CAAC,IAAA,yCAAmB,EAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;IACpE,IAAI,CAAC;QACH,IAAI,KAAyB,CAAC;QAC9B,GAAG,CAAC;YACF,MAAM,IAAI,GAA+B,MAAM,MAAM,CAAC,IAAI,CACxD,IAAI,gCAAoB,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,iBAAiB,EAAE,KAAK,EAAE,CAAC,CAChG,CAAC;YACF,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,QAAQ,IAAI,EAAE,EAAE,CAAC;gBACzC,IAAI,MAAM,CAAC,GAAG,KAAK,SAAS;oBAAE,MAAM,MAAM,CAAC,GAAG,CAAC;YACjD,CAAC;YACD,KAAK,GAAG,IAAI,CAAC,WAAW,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,CAAC,SAAS,CAAC;QAC7E,CAAC,QAAQ,KAAK,KAAK,SAAS,EAAE;IAChC,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,OAAO,EAAE,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,oBAAoB,CAC3B,OAAsB,EACtB,IAAwF;IAExF,MAAM,QAAQ,GAAG,IAAI,CAAC,cAAc,CAAC,KAAK,CACxC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,iBAAiB,CAAC,GAA6B,CAAC,CAAC,CAAC,CAAC,CACtG,CAAC;IAE7B,OAAO;QACL,EAAE,EAAE,OAAO,CAAC,EAAE;QACd,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,cAAc,EAAE,IAAI,CAAC,cAAc;QACnC,QAAQ;QACR,OAAO,EAAE;YACP;gBACE,IAAI,EAAE,iBAAiB;gBACvB,KAAK,EAAE,mBAAmB;gBAC1B,QAAQ,EAAE,IAAI;gBACd,IAAI,EAAE,qFAAqF;aAC5F;SACF;QACD,0EAA0E;QAC1E,wEAAwE;QACxE,iBAAiB,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,yDAA0B,EAAE,IAAI,EAAE,sDAAuB,EAAE,KAAK,EAAE,uDAAwB,EAAE,CAAC;QAClI,aAAa,EAAE,OAAO,CAAC,cAAc,IAAI,SAAS;QAClD,KAAK,CAAC,KAAK,CAAC,GAAG;YACb,MAAM,QAAQ,GAAG,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YAC5C,MAAM,UAAU,GAAG,IAAA,2BAAe,EAAC,OAAO,EAAE,QAAQ,EAAE,MAAM,GAAG,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC,CAAC;YAC3F,IAAI,CAAC,UAAU,CAAC,UAAU;gBAAE,MAAM,wDAAyB,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC;YAEpG,MAAM,EAAE,MAAM,EAAE,GAAG,UAAU,CAAC;YAC9B,OAAO,IAAI,uCAAiB,CAAC;gBAC3B,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACzD,WAAW,EAAE,MAAM,CAAC,WAAW;gBAC/B,eAAe,EAAE,MAAM,CAAC,eAAe;gBACvC,cAAc,EAAE,MAAM,CAAC,cAAc;gBACrC,QAAQ,EAAE,GAAG,CAAC,QAAQ;aACvB,CAAC,CAAC;QACL,CAAC;QACD,cAAc,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,IAAA,qCAAgB,EAAC,EAAE,GAAG,GAAG,EAAE,QAAQ,EAAE,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;QACpG,SAAS,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,IAAA,gCAAiB,EAAC,EAAE,GAAG,GAAG,EAAE,QAAQ,EAAE,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;QAChG,QAAQ,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,GAAG,EAAE,MAAM,CAAC;QAC3D,KAAK,EAAE,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC,IAAA,kBAAO,EAAC,EAAE,GAAG,GAAG,EAAE,QAAQ,EAAE,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC;QAChG,QAAQ,CAAC,QAAQ;YACf,MAAM,EAAE,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;YAClC,OAAO,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,iBAAiB,CAAC,OAAO,EAAE,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC;QACtH,CAAC;QACD,OAAO,CAAC,QAAQ,EAAE,OAAO;YACvB,MAAM,UAAU,GAAG,IAAA,2BAAe,EAAC,OAAO,EAAE,YAAY,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC,eAAe,KAAK,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YACxH,OAAO,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC;QACzD,CAAC;QACD,WAAW,CAAC,QAAQ;YAClB,MAAM,EAAE,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;YAClC,OAAO,CAAC,iBAAiB,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,gBAAgB,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC;QAChH,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACU,QAAA,eAAe,GAAG,oBAAoB,CAAC,uBAAW,CAAC,EAAE,EAAE;IAClE,KAAK,EAAE,WAAW;IAClB,WAAW,EAAE,oFAAoF;IACjG,cAAc,EAAE,gBAAgB;CACjC,CAAC,CAAC;AAEH;;;;GAIG;AACU,QAAA,eAAe,GAAG,oBAAoB,CAAC,uBAAW,CAAC,EAAE,EAAE;IAClE,KAAK,EAAE,eAAe;IACtB,WAAW,EAAE,mFAAmF;IAChG,cAAc,EAAE,gBAAgB;CACjC,CAAC,CAAC;AAEH;;;;GAIG;AACU,QAAA,yBAAyB,GAAG,oBAAoB,CAAC,uBAAW,CAAC,YAAY,EAAE;IACtF,wGAAwG;IACxG,KAAK,EAAE,8CAA8C;IACrD,WAAW,EAAE,8FAA8F;IAC3G,cAAc,EAAE,0BAA0B;CAC3C,CAAC,CAAC"}

package/dist/storage/drivers/s3/s3-probe.support.d.ts

@@ -0,0 +1,153 @@
+import { type S3ConfigResolution, type S3StoragePolicy } from './s3-config';
+/**
+ * The flat settings a probe request carries for a built-in driver: its id and
+ * the S3 family's settings. Declared under its own name: the DTOs are what the
+ * wire carries, and tying the signature to the stored settings would make a
+ * future settings-only field look like something a probe accepts.
+ *
+ * @stability experimental
+ */
+export type SubmittedStoragePolicy = S3StoragePolicy;
+/**
+ * Resolve a submitted configuration against a secret.
+ *
+ * A one-line pass-through to `resolveStorageConfig`, and named so that the
+ * probes read as testing a SUBMITTED configuration rather than the saved one.
+ * There is exactly one definition of "configured" for the S3 family (`s3-config.ts`).
+ *
+ * @stability experimental
+ */
+export declare function resolveSubmittedStorageConfig(policy: SubmittedStoragePolicy, secretAccessKey: string | null): S3ConfigResolution;
+/**
+ * The origin a client would be pointed at, for DISPLAY, including for a
+ * configuration too incomplete to resolve.
+ *
+ * ⚠ USE `resolution.config.endpoint` WHEN THERE IS A RESOLUTION. This exists
+ * only for the case `resolveStorageConfig` deliberately refuses to answer: a
+ * half-filled form on a settings page, which still has to render "this is the
+ * host you are about to talk to" while the admin is typing. It mirrors two of
+ * that function's rules and no more - an explicit endpoint always wins, and R2's
+ * host is derived from the account id - and it returns `null` rather than
+ * inventing anything for the two cases that genuinely have no answer yet
+ * (`s3` uses the SDK's own regional host; `s3compatible` has no endpoint until
+ * one is typed).
+ *
+ * @stability experimental
+ */
+export declare function displayEndpoint(policy: Pick<SubmittedStoragePolicy, 'provider' | 'endpoint' | 'accountId'>): string | null;
+/**
+ * Scrub the secret access key out of a message that is about to be shown to an
+ * administrator.
+ *
+ * ⚠ CALLED ON EVERY PATH THAT PRODUCES AN `error` STRING, without exception.
+ * We do not author most of these messages: the AWS SDK builds its own text, an
+ * S3-compatible server's rejection is echoed back verbatim, and a server that
+ * quotes the offending `Authorization` header would put the signing key into a
+ * string this API then hands to an admin screen. Scrubbing at the single exit
+ * point means the guarantee holds even for errors from code we do not own.
+ *
+ * A secret too short to replace safely costs the caller the whole message
+ * instead. An unreadable error is a bad outcome; a leaked credential is a worse
+ * one, and the choice is not close.
+ *
+ * @stability experimental
+ */
+export declare function redactStorageSecret(text: string, secret: string | null): string;
+/**
+ * What an object store said, reduced to the three facts a verdict needs.
+ *
+ * @stability experimental
+ */
+export interface DescribedStorageError {
+    /**
+     * The provider's own message, redacted. Never a category and never a
+     * rewritten sentence — see `StorageConnectionCheck.error`.
+     */
+    message: string;
+    /**
+     * The HTTP status the object store answered with, or `null` when there was no
+     * response at all (DNS, TLS, a refused connection, a timeout).
+     *
+     * `null` IS THE SIGNAL FOR "unreachable", and it is why this is nullable
+     * rather than defaulting to 0 or 500: "the endpoint did not answer" and "the
+     * endpoint answered 500" are different problems with different fixes.
+     */
+    status: number | null;
+    /**
+     * The S3 error code, e.g. `NoSuchBucket`, `AccessDenied`,
+     * `InvalidAccessKeyId`, `BucketAlreadyOwnedByYou` — or the exception's class
+     * name when the body carried no code, which is the ORDINARY case for
+     * `HeadBucket` (a HEAD response has no body to put a code in, so the SDK
+     * yields the bare `NotFound`/`Forbidden`). Empty string when neither exists.
+     *
+     * ⚠ CLASSIFY ON THIS, NOT ON `status`, WHEREVER IT IS PRESENT. A `403` is
+     * `AccessDenied` (the key is real and not permitted) or `InvalidAccessKeyId` /
+     * `SignatureDoesNotMatch` (the key is wrong) — the same status for two
+     * problems whose fixes have nothing in common.
+     */
+    code: string;
+    /** No response was received at all. Equivalent to `status === null`. */
+    unreachable: boolean;
+}
+/**
+ * Reduce anything thrown by the AWS SDK (or by `fetch`) to
+ * {@link DescribedStorageError}.
+ *
+ * NEVER THROWS, and never assumes a shape: it is handed values produced by code
+ * this repository does not own, including plain strings and objects that are not
+ * `Error`s at all. A diagnostic endpoint that crashed while describing a failure
+ * would be the one failure mode it must not have.
+ *
+ * @stability experimental
+ */
+export declare function describeStorageError(error: unknown, secret: string | null): DescribedStorageError;
+/**
+ * S3 error codes that mean THE CREDENTIAL ITSELF was refused, as opposed to a
+ * real credential being denied a particular action.
+ *
+ * ⚠ THE DISTINCTION THE `credentials` CHECK IS BUILT ON, and the reason it is a
+ * list of codes rather than `status === 403`. `AccessDenied` and
+ * `InvalidAccessKeyId` are both `403`, and they are the difference between
+ * "widen this key's policy" and "this key does not exist" — two fixes with
+ * nothing in common, on a page whose entire job is to tell them apart.
+ *
+ * @stability experimental
+ */
+export declare const CREDENTIAL_REJECTION_CODES: Set<string>;
+/**
+ * Codes meaning "this bucket does not exist at this endpoint".
+ *
+ * @stability experimental
+ */
+export declare const BUCKET_MISSING_CODES: Set<string>;
+/**
+ * Codes meaning "a bucket by that name exists; this key may not inspect it".
+ *
+ * @stability experimental
+ */
+export declare const BUCKET_FORBIDDEN_CODES: Set<string>;
+/**
+ * Codes meaning "the bucket is real, but not in the region this configuration
+ * names".
+ *
+ * Its own outcome rather than a flavour of "forbidden" because the fix is a
+ * one-word edit to the `region` field, and because S3 answers this with a `301`
+ * that reads as a redirect rather than as an error to anyone skimming a status
+ * code.
+ *
+ * @stability experimental
+ */
+export declare const BUCKET_REGION_CODES: Set<string>;
+/**
+ * Codes meaning "a bucket with this name already exists, and it is yours".
+ *
+ * @stability experimental
+ */
+export declare const BUCKET_ALREADY_OWNED_CODES: Set<string>;
+/**
+ * Codes meaning "a bucket with this name exists and belongs to somebody else".
+ *
+ * @stability experimental
+ */
+export declare const BUCKET_NAME_TAKEN_CODES: Set<string>;
+//# sourceMappingURL=s3-probe.support.d.ts.map

package/dist/storage/drivers/s3/s3-probe.support.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"s3-probe.support.d.ts","sourceRoot":"","sources":["../../../../src/storage/drivers/s3/s3-probe.support.ts"],"names":[],"mappings":"AAmBA,OAAO,EAGL,KAAK,kBAAkB,EACvB,KAAK,eAAe,EACrB,MAAM,aAAa,CAAC;AAErB;;;;;;;GAOG;AACH,MAAM,MAAM,sBAAsB,GAAG,eAAe,CAAC;AAErD;;;;;;;;GAQG;AACH,wBAAgB,6BAA6B,CAC3C,MAAM,EAAE,sBAAsB,EAC9B,eAAe,EAAE,MAAM,GAAG,IAAI,GAC7B,kBAAkB,CAEpB;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,IAAI,CAAC,sBAAsB,EAAE,UAAU,GAAG,UAAU,GAAG,WAAW,CAAC,GAAG,MAAM,GAAG,IAAI,CAM1H;AAqBD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,CAQ/E;AAED;;;;GAIG;AACH,MAAM,WAAW,qBAAqB;IACpC;;;OAGG;IACH,OAAO,EAAE,MAAM,CAAC;IAEhB;;;;;;;OAOG;IACH,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IAEtB;;;;;;;;;;;OAWG;IACH,IAAI,EAAE,MAAM,CAAC;IAEb,wEAAwE;IACxE,WAAW,EAAE,OAAO,CAAC;CACtB;AAkCD;;;;;;;;;;GAUG;AACH,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,OAAO,EACd,MAAM,EAAE,MAAM,GAAG,IAAI,GACpB,qBAAqB,CA+CvB;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,0BAA0B,aAUrC,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,oBAAoB,aAAwC,CAAC;AAE1E;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,aAIjC,CAAC;AAEH;;;;;;;;;;GAUG;AACH,eAAO,MAAM,mBAAmB,aAU9B,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,0BAA0B,aAAuC,CAAC;AAE/E;;;;GAIG;AACH,eAAO,MAAM,uBAAuB,aAAmC,CAAC"}

package/dist/storage/drivers/s3/s3-probe.support.js

@@ -0,0 +1,250 @@
+"use strict";
+// =============================================================================
+// Shared machinery for the two probing endpoints (issue #375, epic #372)
+// =============================================================================
+//
+// `POST /test` and `POST /bucket` both take an UNSAVED configuration, resolve
+// it exactly as the running application would, build a client from it, and
+// report what an object store said. Everything both of them need to do that —
+// and nothing either of them does with the answer — lives here, pure and
+// Nest-free, for the same reason `s3-config.ts` is pure: the rules can then
+// be exercised with a literal and a string.
+//
+// ⚠ NOTHING HERE READS `process.env`. A probe reports on THE CONFIGURATION IT
+// IS BEING ASKED TO TEST — the one in the request body — and there is nowhere
+// else a value could be quietly supplied from: `resolveStorageConfig` takes the
+// submitted policy and the submitted (or stored) secret, and nothing else.
+// =============================================================================
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.BUCKET_NAME_TAKEN_CODES = exports.BUCKET_ALREADY_OWNED_CODES = exports.BUCKET_REGION_CODES = exports.BUCKET_FORBIDDEN_CODES = exports.BUCKET_MISSING_CODES = exports.CREDENTIAL_REJECTION_CODES = void 0;
+exports.resolveSubmittedStorageConfig = resolveSubmittedStorageConfig;
+exports.displayEndpoint = displayEndpoint;
+exports.redactStorageSecret = redactStorageSecret;
+exports.describeStorageError = describeStorageError;
+const s3_config_1 = require("./s3-config");
+/**
+ * Resolve a submitted configuration against a secret.
+ *
+ * A one-line pass-through to `resolveStorageConfig`, and named so that the
+ * probes read as testing a SUBMITTED configuration rather than the saved one.
+ * There is exactly one definition of "configured" for the S3 family (`s3-config.ts`).
+ *
+ * @stability experimental
+ */
+function resolveSubmittedStorageConfig(policy, secretAccessKey) {
+    return (0, s3_config_1.resolveStorageConfig)(policy, secretAccessKey);
+}
+/**
+ * The origin a client would be pointed at, for DISPLAY, including for a
+ * configuration too incomplete to resolve.
+ *
+ * ⚠ USE `resolution.config.endpoint` WHEN THERE IS A RESOLUTION. This exists
+ * only for the case `resolveStorageConfig` deliberately refuses to answer: a
+ * half-filled form on a settings page, which still has to render "this is the
+ * host you are about to talk to" while the admin is typing. It mirrors two of
+ * that function's rules and no more - an explicit endpoint always wins, and R2's
+ * host is derived from the account id - and it returns `null` rather than
+ * inventing anything for the two cases that genuinely have no answer yet
+ * (`s3` uses the SDK's own regional host; `s3compatible` has no endpoint until
+ * one is typed).
+ *
+ * @stability experimental
+ */
+function displayEndpoint(policy) {
+    if (policy.endpoint)
+        return policy.endpoint;
+    if (policy.provider === 'r2' && policy.accountId) {
+        return (0, s3_config_1.deriveR2Endpoint)(policy.accountId);
+    }
+    return null;
+}
+// -----------------------------------------------------------------------------
+// Error description
+// -----------------------------------------------------------------------------
+/**
+ * Below this length a secret is indistinguishable from ordinary words in an
+ * error message, and blanket-replacing it would corrupt the message into
+ * uselessness while still not proving the secret is gone.
+ *
+ * The constant, the threshold and the fallback below are a DELIBERATE SECOND
+ * IMPLEMENTATION of `email/base-email.provider.ts`'s `SecretRedactor`, not an
+ * oversight. Importing that class would make the storage module depend on the
+ * email module's provider file to obtain a four-line string utility — a module
+ * edge that exists for no reason and that a reader has to chase. The same
+ * argument is already made, in this repository, by `push-config.service.ts`'s
+ * own copy of `describeInvalidPaths`.
+ */
+const MIN_REDACTABLE_SECRET_LENGTH = 4;
+/**
+ * Scrub the secret access key out of a message that is about to be shown to an
+ * administrator.
+ *
+ * ⚠ CALLED ON EVERY PATH THAT PRODUCES AN `error` STRING, without exception.
+ * We do not author most of these messages: the AWS SDK builds its own text, an
+ * S3-compatible server's rejection is echoed back verbatim, and a server that
+ * quotes the offending `Authorization` header would put the signing key into a
+ * string this API then hands to an admin screen. Scrubbing at the single exit
+ * point means the guarantee holds even for errors from code we do not own.
+ *
+ * A secret too short to replace safely costs the caller the whole message
+ * instead. An unreadable error is a bad outcome; a leaked credential is a worse
+ * one, and the choice is not close.
+ *
+ * @stability experimental
+ */
+function redactStorageSecret(text, secret) {
+    if (!secret || !text.includes(secret))
+        return text;
+    if (secret.length < MIN_REDACTABLE_SECRET_LENGTH) {
+        return '[error withheld: it contained the configured secret access key]';
+    }
+    return text.split(secret).join('[redacted]');
+}
+/**
+ * Node/undici transport failure codes: the endpoint never answered.
+ *
+ * Listed explicitly rather than matched by a pattern so that a new SDK error
+ * whose `code` happens to start with `E` is not silently reported as an
+ * unreachable host, which would send an operator to their firewall over a
+ * permissions problem.
+ */
+const TRANSPORT_ERROR_CODES = new Set([
+    'ECONNREFUSED',
+    'ECONNRESET',
+    'ENOTFOUND',
+    'EAI_AGAIN',
+    'EHOSTUNREACH',
+    'ENETUNREACH',
+    'EPIPE',
+    'ETIMEDOUT',
+    'EPROTO',
+    'CERT_HAS_EXPIRED',
+    'DEPTH_ZERO_SELF_SIGNED_CERT',
+    'UNABLE_TO_VERIFY_LEAF_SIGNATURE',
+    'SELF_SIGNED_CERT_IN_CHAIN',
+]);
+/** Abort/timeout shapes the SDK and `fetch` raise when nothing answered in time. */
+const TIMEOUT_ERROR_NAMES = new Set([
+    'TimeoutError',
+    'AbortError',
+    'RequestAbortedError',
+    'ConnectTimeoutError',
+]);
+/**
+ * Reduce anything thrown by the AWS SDK (or by `fetch`) to
+ * {@link DescribedStorageError}.
+ *
+ * NEVER THROWS, and never assumes a shape: it is handed values produced by code
+ * this repository does not own, including plain strings and objects that are not
+ * `Error`s at all. A diagnostic endpoint that crashed while describing a failure
+ * would be the one failure mode it must not have.
+ *
+ * @stability experimental
+ */
+function describeStorageError(error, secret) {
+    const candidate = error;
+    const status = typeof candidate?.$metadata?.httpStatusCode === 'number'
+        ? candidate.$metadata.httpStatusCode
+        : null;
+    // `code` first (some SDK middlewares set it), then the exception's class name,
+    // which is what carries `NotFound`/`Forbidden` for the body-less HEAD request
+    // `HeadBucket` actually is.
+    const code = (typeof candidate?.code === 'string' && candidate.code) ||
+        (typeof candidate?.name === 'string' && candidate.name) ||
+        '';
+    const rawMessage = error instanceof Error
+        ? `${error.name}: ${error.message}`
+        : typeof error === 'string'
+            ? error
+            : 'The storage endpoint failed with an error that carried no message.';
+    // A transport failure can arrive nested one level down — `fetch` wraps its
+    // cause, and the SDK wraps a socket error in a request error — so the cause is
+    // consulted too rather than only the top-level object.
+    const nestedCode = typeof candidate?.cause?.code === 'string'
+        ? (candidate.cause.code)
+        : '';
+    const unreachable = status === null &&
+        (TRANSPORT_ERROR_CODES.has(code) ||
+            TRANSPORT_ERROR_CODES.has(nestedCode) ||
+            TIMEOUT_ERROR_NAMES.has(code));
+    return {
+        message: redactStorageSecret(rawMessage, secret),
+        status,
+        code: code || nestedCode,
+        unreachable,
+    };
+}
+/**
+ * S3 error codes that mean THE CREDENTIAL ITSELF was refused, as opposed to a
+ * real credential being denied a particular action.
+ *
+ * ⚠ THE DISTINCTION THE `credentials` CHECK IS BUILT ON, and the reason it is a
+ * list of codes rather than `status === 403`. `AccessDenied` and
+ * `InvalidAccessKeyId` are both `403`, and they are the difference between
+ * "widen this key's policy" and "this key does not exist" — two fixes with
+ * nothing in common, on a page whose entire job is to tell them apart.
+ *
+ * @stability experimental
+ */
+exports.CREDENTIAL_REJECTION_CODES = new Set([
+    'InvalidAccessKeyId',
+    'SignatureDoesNotMatch',
+    'InvalidSecurity',
+    'InvalidToken',
+    'ExpiredToken',
+    'TokenRefreshRequired',
+    'UnrecognizedClientException',
+    'InvalidClientTokenId',
+    'AccountProblem',
+]);
+/**
+ * Codes meaning "this bucket does not exist at this endpoint".
+ *
+ * @stability experimental
+ */
+exports.BUCKET_MISSING_CODES = new Set(['NoSuchBucket', 'NotFound']);
+/**
+ * Codes meaning "a bucket by that name exists; this key may not inspect it".
+ *
+ * @stability experimental
+ */
+exports.BUCKET_FORBIDDEN_CODES = new Set([
+    'Forbidden',
+    'AccessDenied',
+    'AllAccessDisabled',
+]);
+/**
+ * Codes meaning "the bucket is real, but not in the region this configuration
+ * names".
+ *
+ * Its own outcome rather than a flavour of "forbidden" because the fix is a
+ * one-word edit to the `region` field, and because S3 answers this with a `301`
+ * that reads as a redirect rather than as an error to anyone skimming a status
+ * code.
+ *
+ * @stability experimental
+ */
+exports.BUCKET_REGION_CODES = new Set([
+    'PermanentRedirect',
+    'IllegalLocationConstraintException',
+    // ⚠ DELIBERATELY HERE AND NOT IN {@link CREDENTIAL_REJECTION_CODES}, which is
+    // where the name suggests it belongs. S3 answers a signed request sent to the
+    // wrong regional host with `AuthorizationHeaderMalformed` and the message
+    // "the region 'us-east-1' is wrong; expecting 'eu-west-1'" — a REGION
+    // mismatch wearing an authorization error's name. Classifying it as a bad
+    // credential would send an operator to rotate a key that is perfectly good.
+    'AuthorizationHeaderMalformed',
+]);
+/**
+ * Codes meaning "a bucket with this name already exists, and it is yours".
+ *
+ * @stability experimental
+ */
+exports.BUCKET_ALREADY_OWNED_CODES = new Set(['BucketAlreadyOwnedByYou']);
+/**
+ * Codes meaning "a bucket with this name exists and belongs to somebody else".
+ *
+ * @stability experimental
+ */
+exports.BUCKET_NAME_TAKEN_CODES = new Set(['BucketAlreadyExists']);
+//# sourceMappingURL=s3-probe.support.js.map

package/dist/storage/drivers/s3/s3-probe.support.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"s3-probe.support.js","sourceRoot":"","sources":["../../../../src/storage/drivers/s3/s3-probe.support.ts"],"names":[],"mappings":";AAAA,gFAAgF;AAChF,yEAAyE;AACzE,gFAAgF;AAChF,EAAE;AACF,8EAA8E;AAC9E,2EAA2E;AAC3E,8EAA8E;AAC9E,yEAAyE;AACzE,4EAA4E;AAC5E,4CAA4C;AAC5C,EAAE;AACF,8EAA8E;AAC9E,8EAA8E;AAC9E,gFAAgF;AAChF,2EAA2E;AAC3E,gFAAgF;;;AA8BhF,sEAKC;AAkBD,0CAMC;AAsCD,kDAQC;AAqFD,oDAkDC;AA5OD,2CAKqB;AAYrB;;;;;;;;GAQG;AACH,SAAgB,6BAA6B,CAC3C,MAA8B,EAC9B,eAA8B;IAE9B,OAAO,IAAA,gCAAoB,EAAC,MAAM,EAAE,eAAe,CAAC,CAAC;AACvD,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,SAAgB,eAAe,CAAC,MAA2E;IACzG,IAAI,MAAM,CAAC,QAAQ;QAAE,OAAO,MAAM,CAAC,QAAQ,CAAC;IAC5C,IAAI,MAAM,CAAC,QAAQ,KAAK,IAAI,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;QACjD,OAAO,IAAA,4BAAgB,EAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAC5C,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,gFAAgF;AAChF,oBAAoB;AACpB,gFAAgF;AAEhF;;;;;;;;;;;;GAYG;AACH,MAAM,4BAA4B,GAAG,CAAC,CAAC;AAEvC;;;;;;;;;;;;;;;;GAgBG;AACH,SAAgB,mBAAmB,CAAC,IAAY,EAAE,MAAqB;IACrE,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IAEnD,IAAI,MAAM,CAAC,MAAM,GAAG,4BAA4B,EAAE,CAAC;QACjD,OAAO,iEAAiE,CAAC;IAC3E,CAAC;IAED,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;AAC/C,CAAC;AA0CD;;;;;;;GAOG;AACH,MAAM,qBAAqB,GAAG,IAAI,GAAG,CAAC;IACpC,cAAc;IACd,YAAY;IACZ,WAAW;IACX,WAAW;IACX,cAAc;IACd,aAAa;IACb,OAAO;IACP,WAAW;IACX,QAAQ;IACR,kBAAkB;IAClB,6BAA6B;IAC7B,iCAAiC;IACjC,2BAA2B;CAC5B,CAAC,CAAC;AAEH,oFAAoF;AACpF,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC;IAClC,cAAc;IACd,YAAY;IACZ,qBAAqB;IACrB,qBAAqB;CACtB,CAAC,CAAC;AAEH;;;;;;;;;;GAUG;AACH,SAAgB,oBAAoB,CAClC,KAAc,EACd,MAAqB;IAErB,MAAM,SAAS,GAAG,KAIjB,CAAC;IAEF,MAAM,MAAM,GACV,OAAO,SAAS,EAAE,SAAS,EAAE,cAAc,KAAK,QAAQ;QACtD,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,cAAc;QACpC,CAAC,CAAC,IAAI,CAAC;IAEX,+EAA+E;IAC/E,8EAA8E;IAC9E,4BAA4B;IAC5B,MAAM,IAAI,GACR,CAAC,OAAO,SAAS,EAAE,IAAI,KAAK,QAAQ,IAAI,SAAS,CAAC,IAAI,CAAC;QACvD,CAAC,OAAO,SAAS,EAAE,IAAI,KAAK,QAAQ,IAAI,SAAS,CAAC,IAAI,CAAC;QACvD,EAAE,CAAC;IAEL,MAAM,UAAU,GACd,KAAK,YAAY,KAAK;QACpB,CAAC,CAAC,GAAG,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,OAAO,EAAE;QACnC,CAAC,CAAC,OAAO,KAAK,KAAK,QAAQ;YACzB,CAAC,CAAC,KAAK;YACP,CAAC,CAAC,oEAAoE,CAAC;IAE7E,2EAA2E;IAC3E,+EAA+E;IAC/E,uDAAuD;IACvD,MAAM,UAAU,GACd,OAAQ,SAAS,EAAE,KAAuC,EAAE,IAAI,KAAK,QAAQ;QAC3E,CAAC,CAAC,CAAE,SAAS,CAAC,KAA0B,CAAC,IAAI,CAAC;QAC9C,CAAC,CAAC,EAAE,CAAC;IAET,MAAM,WAAW,GACf,MAAM,KAAK,IAAI;QACf,CAAC,qBAAqB,CAAC,GAAG,CAAC,IAAI,CAAC;YAC9B,qBAAqB,CAAC,GAAG,CAAC,UAAU,CAAC;YACrC,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;IAEnC,OAAO;QACL,OAAO,EAAE,mBAAmB,CAAC,UAAU,EAAE,MAAM,CAAC;QAChD,MAAM;QACN,IAAI,EAAE,IAAI,IAAI,UAAU;QACxB,WAAW;KACZ,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;GAWG;AACU,QAAA,0BAA0B,GAAG,IAAI,GAAG,CAAC;IAChD,oBAAoB;IACpB,uBAAuB;IACvB,iBAAiB;IACjB,cAAc;IACd,cAAc;IACd,sBAAsB;IACtB,6BAA6B;IAC7B,sBAAsB;IACtB,gBAAgB;CACjB,CAAC,CAAC;AAEH;;;;GAIG;AACU,QAAA,oBAAoB,GAAG,IAAI,GAAG,CAAC,CAAC,cAAc,EAAE,UAAU,CAAC,CAAC,CAAC;AAE1E;;;;GAIG;AACU,QAAA,sBAAsB,GAAG,IAAI,GAAG,CAAC;IAC5C,WAAW;IACX,cAAc;IACd,mBAAmB;CACpB,CAAC,CAAC;AAEH;;;;;;;;;;GAUG;AACU,QAAA,mBAAmB,GAAG,IAAI,GAAG,CAAC;IACzC,mBAAmB;IACnB,oCAAoC;IACpC,8EAA8E;IAC9E,8EAA8E;IAC9E,0EAA0E;IAC1E,sEAAsE;IACtE,0EAA0E;IAC1E,4EAA4E;IAC5E,8BAA8B;CAC/B,CAAC,CAAC;AAEH;;;;GAIG;AACU,QAAA,0BAA0B,GAAG,IAAI,GAAG,CAAC,CAAC,yBAAyB,CAAC,CAAC,CAAC;AAE/E;;;;GAIG;AACU,QAAA,uBAAuB,GAAG,IAAI,GAAG,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC"}