@rpcbase/server 0.608.0 → 0.610.0

package/dist/handler-BgcIWWMc.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"handler-BgcIWWMc.js","names":["Ctx","NotificationSessionUser","id","currentTenantId","getSessionUser","ctx","rawSessionUser","req","session","user","userId","trim","tenantId","res","status","z","ListRoute","CreateRoute","MarkReadRoute","MarkReadByUrlRoute","ArchiveRoute","MarkAllReadRoute","SettingsRoute","DigestRunRoute","listRequestSchema","object","includeArchived","boolean","optional","unreadOnly","limit","number","int","min","max","markSeen","ListRequestPayload","infer","notificationDataSchema","record","string","notificationPlatformPayloadSchema","webpush","unknown","fcmOptions","android","apns","passthrough","NotificationPlatformPayload","createRequestStringSchema","trim","notificationUrlModeSchema","enum","notificationContentFieldsSchema","title","body","image","createRequestSchema","topic","tag","url","urlMode","metadata","data","platform","CreateRequestPayload","normalizeNotificationActionUrl","origin","raw","base","URL","parsed","pathname","search","normalizeNotificationActionLink","hash","notificationSchema","id","deliveryId","shape","createdAt","seenAt","readAt","archivedAt","NotificationPayload","listResponseSchema","ok","error","notifications","array","unreadCount","unseenCount","ListResponsePayload","createResponseSchema","CreateResponsePayload","markReadResponseSchema","MarkReadResponsePayload","markReadByUrlRequestSchema","MarkReadByUrlRequestPayload","markReadByUrlResponseSchema","matchedCount","modifiedCount","MarkReadByUrlResponsePayload","archiveResponseSchema","ArchiveResponsePayload","markAllReadResponseSchema","MarkAllReadResponsePayload","digestFrequencySchema","DigestFrequency","topicPreferenceSchema","inApp","emailDigest","push","TopicPreferencePayload","settingsSchema","digestFrequency","topicPreferences","lastDigestSentAt","SettingsPayload","settingsResponseSchema","settings","SettingsResponsePayload","updateSettingsRequestSchema","UpdateSettingsRequestPayload","updateSettingsResponseSchema","UpdateSettingsResponsePayload","digestRunRequestSchema","force","DigestRunRequestPayload","digestRunResponseSchema","sent","skippedReason","DigestRunResponsePayload","Api","ApiHandler","Ctx","models","IRBNotification","IRBNotificationSettings","buildAbilityFromSession","getAccessibleByQuery","createNotification","sendNotificationsDigestForUser","getSessionUser","Notifications","NotificationDoc","_id","NotificationActionDoc","Pick","SettingsDoc","NotificationActionLink","link","urlMode","toIso","value","Date","toISOString","undefined","isRecord","Record","Boolean","Array","isArray","toStringMap","entries","Object","filter","entry","length","fromEntries","getForwardedHeaderValue","raw","split","trim","getRequestOrigin","ctx","protocol","req","headers","host","get","getNotificationActionLinks","notification","links","data","push","linkMode","platformWebpush","platform","webpush","fcmOptions","actionSearchParamsMatchTargetUrl","actionUrl","targetUrl","origin","base","URL","action","target","key","searchParams","from","keys","notificationActionLinkMatchesUrl","normalizeNotificationActionUrl","buildDisabledTopics","settings","topicPreferences","map","pref","topic","enabled","listNotifications","ListRequestPayload","ListResponsePayload","payload","session","ok","error","ability","tenantId","can","res","status","parsed","listRequestSchema","safeParse","success","userId","includeArchived","unreadOnly","limit","markSeen","SettingsModel","findOne","lean","disabledTopics","NotificationModel","queryFilters","archivedAt","$exists","readAt","$nin","query","$and","notifications","find","sort","createdAt","unseenQueryFilters","seenAt","unseenQuery","unreadQueryFilters","unreadQuery","unreadCount","unseenCount","Promise","all","countDocuments","now","updateMany","$set","listResponseSchema","parse","n","id","String","tag","deliveryId","title","body","image","createNotificationForCurrentUser","CreateRequestPayload","CreateResponsePayload","createRequestSchema","actionLink","url","normalizeNotificationActionLink","created","metadata","createResponseSchema","markRead","MarkReadResponsePayload","_payload","notificationId","params","updateOne","markReadByUrl","MarkReadByUrlRequestPayload","MarkReadByUrlResponsePayload","markReadByUrlRequestSchema","$or","$type","candidates","select","matchingIds","some","markReadByUrlResponseSchema","matchedCount","modifiedCount","result","$in","markAllRead","MarkAllReadResponsePayload","archiveNotification","ArchiveResponsePayload","drawerActive","getSettings","SettingsResponsePayload","digestFrequencyRaw","digestFrequency","DigestFrequency","inApp","emailDigest","settingsResponseSchema","lastDigestSentAt","updateSettings","UpdateSettingsRequestPayload","UpdateSettingsResponsePayload","updateSettingsRequestSchema","nextValues","seen","Set","next","has","add","ops","$setOnInsert","findOneAndUpdate","upsert","returnDocument","setDefaultsOnInsert","updateSettingsResponseSchema","runDigest","DigestRunRequestPayload","DigestRunResponsePayload","digestRunRequestSchema","force","sent","skippedReason","api","post","ListRoute","CreateRoute","MarkReadRoute","MarkReadByUrlRoute","MarkAllReadRoute","ArchiveRoute","SettingsRoute","put","DigestRunRoute"],"sources":["../src/notifications/api/notifications/shared.ts","../src/notifications/api/notifications/index.ts","../src/notifications/api/notifications/handler.ts"],"sourcesContent":["import type { Ctx } from \"@rpcbase/api\"\n\n\ntype NotificationSessionUser = {\n  id?: unknown\n  currentTenantId?: unknown\n}\n\nexport const getSessionUser = (ctx: Ctx) => {\n  const rawSessionUser = (ctx.req.session as { user?: NotificationSessionUser } | null | undefined)?.user\n  const userId = typeof rawSessionUser?.id === \"string\" ? rawSessionUser.id.trim() : \"\"\n  const tenantId = typeof rawSessionUser?.currentTenantId === \"string\" ? rawSessionUser.currentTenantId.trim() : \"\"\n\n  if (!userId) {\n    ctx.res.status(401)\n    return null\n  }\n\n  if (!tenantId) {\n    ctx.res.status(400)\n    return null\n  }\n\n  return { userId, tenantId }\n}\n\n","import { z } from \"zod\"\n\n\nexport const ListRoute = \"/api/rb/notifications\"\nexport const CreateRoute = \"/api/rb/notifications/create\"\nexport const MarkReadRoute = \"/api/rb/notifications/:notificationId/read\"\nexport const MarkReadByUrlRoute = \"/api/rb/notifications/mark-read-by-url\"\nexport const ArchiveRoute = \"/api/rb/notifications/:notificationId/archive\"\nexport const MarkAllReadRoute = \"/api/rb/notifications/mark-all-read\"\nexport const SettingsRoute = \"/api/rb/notifications/settings\"\nexport const DigestRunRoute = \"/api/rb/notifications/digest/run\"\n\nexport const listRequestSchema = z.object({\n  includeArchived: z.boolean().optional(),\n  unreadOnly: z.boolean().optional(),\n  limit: z.number().int().min(1).max(200).optional(),\n  markSeen: z.boolean().optional(),\n})\n\nexport type ListRequestPayload = z.infer<typeof listRequestSchema>\n\nexport const notificationDataSchema = z.record(z.string(), z.string())\n\nexport const notificationPlatformPayloadSchema = z.object({\n  webpush: z.record(z.string(), z.unknown()).optional(),\n  fcmOptions: z.record(z.string(), z.unknown()).optional(),\n  android: z.record(z.string(), z.unknown()).optional(),\n  apns: z.record(z.string(), z.unknown()).optional(),\n}).passthrough()\n\nexport type NotificationPlatformPayload = z.infer<typeof notificationPlatformPayloadSchema>\n\nconst createRequestStringSchema = z.string().trim()\nconst notificationUrlModeSchema = z.enum([\"navigate\", \"merge_current_search\"])\n\nexport const notificationContentFieldsSchema = z.object({\n  title: z.string().min(1),\n  body: z.string().optional(),\n  image: z.string().optional(),\n})\n\nexport const createRequestSchema = z.object({\n  topic: createRequestStringSchema.min(1).optional(),\n  tag: createRequestStringSchema.min(1).optional(),\n  title: createRequestStringSchema.min(1),\n  body: createRequestStringSchema.optional(),\n  image: createRequestStringSchema.optional(),\n  url: createRequestStringSchema.min(1).optional(),\n  urlMode: notificationUrlModeSchema.optional(),\n  metadata: z.record(z.string(), z.unknown()).optional(),\n  data: notificationDataSchema.optional(),\n  platform: notificationPlatformPayloadSchema.optional(),\n})\n\nexport type CreateRequestPayload = z.infer<typeof createRequestSchema>\n\nexport const normalizeNotificationActionUrl = (url: string, origin: string): string | null => {\n  const raw = url.trim()\n  if (!raw) return null\n\n  try {\n    const base = new URL(origin)\n    const parsed = new URL(raw, base)\n    if (parsed.origin !== base.origin) return null\n    return `${parsed.pathname}${parsed.search}`\n  } catch {\n    return null\n  }\n}\n\nexport const normalizeNotificationActionLink = (\n  url: string,\n  origin: string,\n  urlMode: z.infer<typeof notificationUrlModeSchema> = \"navigate\",\n): string | null => {\n  const raw = url.trim()\n  if (!raw) return null\n\n  try {\n    const base = new URL(origin)\n    const parsed = new URL(raw, base)\n    if (parsed.origin !== base.origin) return null\n    if (urlMode === \"navigate\") return `${parsed.pathname}${parsed.search}${parsed.hash}`\n    return `${parsed.search}${parsed.hash}` || null\n  } catch {\n    return null\n  }\n}\n\nexport const notificationSchema = z.object({\n  id: z.string(),\n  topic: z.string().optional(),\n  tag: z.string().optional(),\n  deliveryId: z.string().optional(),\n  title: notificationContentFieldsSchema.shape.title,\n  body: notificationContentFieldsSchema.shape.body,\n  image: notificationContentFieldsSchema.shape.image,\n  data: notificationDataSchema.optional(),\n  platform: notificationPlatformPayloadSchema.optional(),\n  createdAt: z.string(),\n  seenAt: z.string().optional(),\n  readAt: z.string().optional(),\n  archivedAt: z.string().optional(),\n})\n\nexport type NotificationPayload = z.infer<typeof notificationSchema>\n\nexport const listResponseSchema = z.object({\n  ok: z.boolean(),\n  error: z.string().optional(),\n  notifications: z.array(notificationSchema).optional(),\n  unreadCount: z.number().int().min(0).optional(),\n  unseenCount: z.number().int().min(0).optional(),\n})\n\nexport type ListResponsePayload = z.infer<typeof listResponseSchema>\n\nexport const createResponseSchema = z.object({\n  ok: z.boolean(),\n  error: z.string().optional(),\n  id: z.string().optional(),\n})\n\nexport type CreateResponsePayload = z.infer<typeof createResponseSchema>\n\nexport const markReadResponseSchema = z.object({\n  ok: z.boolean(),\n  error: z.string().optional(),\n})\n\nexport type MarkReadResponsePayload = z.infer<typeof markReadResponseSchema>\n\nexport const markReadByUrlRequestSchema = z.object({\n  url: z.string().trim().min(1),\n})\n\nexport type MarkReadByUrlRequestPayload = z.infer<typeof markReadByUrlRequestSchema>\n\nexport const markReadByUrlResponseSchema = z.object({\n  ok: z.boolean(),\n  error: z.string().optional(),\n  matchedCount: z.number().int().min(0).optional(),\n  modifiedCount: z.number().int().min(0).optional(),\n})\n\nexport type MarkReadByUrlResponsePayload = z.infer<typeof markReadByUrlResponseSchema>\n\nexport const archiveResponseSchema = z.object({\n  ok: z.boolean(),\n  error: z.string().optional(),\n})\n\nexport type ArchiveResponsePayload = z.infer<typeof archiveResponseSchema>\n\nexport const markAllReadResponseSchema = z.object({\n  ok: z.boolean(),\n  error: z.string().optional(),\n})\n\nexport type MarkAllReadResponsePayload = z.infer<typeof markAllReadResponseSchema>\n\nexport const digestFrequencySchema = z.enum([\"off\", \"daily\", \"weekly\"])\n\nexport type DigestFrequency = z.infer<typeof digestFrequencySchema>\n\nexport const topicPreferenceSchema = z.object({\n  topic: z.string(),\n  inApp: z.boolean(),\n  emailDigest: z.boolean(),\n  push: z.boolean(),\n})\n\nexport type TopicPreferencePayload = z.infer<typeof topicPreferenceSchema>\n\nexport const settingsSchema = z.object({\n  digestFrequency: digestFrequencySchema,\n  topicPreferences: z.array(topicPreferenceSchema),\n  lastDigestSentAt: z.string().optional(),\n})\n\nexport type SettingsPayload = z.infer<typeof settingsSchema>\n\nexport const settingsResponseSchema = z.object({\n  ok: z.boolean(),\n  error: z.string().optional(),\n  settings: settingsSchema.optional(),\n})\n\nexport type SettingsResponsePayload = z.infer<typeof settingsResponseSchema>\n\nexport const updateSettingsRequestSchema = z.object({\n  digestFrequency: digestFrequencySchema.optional(),\n  topicPreferences: z.array(topicPreferenceSchema).optional(),\n})\n\nexport type UpdateSettingsRequestPayload = z.infer<typeof updateSettingsRequestSchema>\n\nexport const updateSettingsResponseSchema = z.object({\n  ok: z.boolean(),\n  error: z.string().optional(),\n  settings: settingsSchema.optional(),\n})\n\nexport type UpdateSettingsResponsePayload = z.infer<typeof updateSettingsResponseSchema>\n\nexport const digestRunRequestSchema = z.object({\n  force: z.boolean().optional(),\n})\n\nexport type DigestRunRequestPayload = z.infer<typeof digestRunRequestSchema>\n\nexport const digestRunResponseSchema = z.object({\n  ok: z.boolean(),\n  error: z.string().optional(),\n  sent: z.boolean().optional(),\n  skippedReason: z.string().optional(),\n})\n\nexport type DigestRunResponsePayload = z.infer<typeof digestRunResponseSchema>\n","import { Api, type ApiHandler, type Ctx } from \"@rpcbase/api\"\nimport { models, type IRBNotification, type IRBNotificationSettings } from \"@rpcbase/db\"\nimport { buildAbilityFromSession, getAccessibleByQuery } from \"@rpcbase/db/acl\"\n\nimport { createNotification } from \"../../createNotification\"\nimport { sendNotificationsDigestForUser } from \"../../digest\"\nimport { getSessionUser } from \"./shared\"\n\nimport * as Notifications from \"./index\"\n\n\ntype NotificationDoc = IRBNotification & { _id: unknown }\ntype NotificationActionDoc = Pick<NotificationDoc, \"_id\" | \"data\" | \"platform\">\ntype SettingsDoc = IRBNotificationSettings & { _id: unknown }\ntype NotificationActionLink = {\n  link: string\n  urlMode: \"navigate\" | \"merge_current_search\"\n}\n\nconst toIso = (value: unknown): string | undefined => (value instanceof Date ? value.toISOString() : undefined)\nconst isRecord = (value: unknown): value is Record<string, unknown> => Boolean(value) && typeof value === \"object\" && !Array.isArray(value)\n\nconst toStringMap = (value: unknown): Record<string, string> | undefined => {\n  if (!isRecord(value)) return undefined\n  const entries = Object.entries(value)\n    .filter((entry): entry is [string, string] => typeof entry[1] === \"string\")\n  return entries.length > 0 ? Object.fromEntries(entries) : undefined\n}\n\nconst getForwardedHeaderValue = (value: unknown): string | undefined => {\n  const raw = Array.isArray(value) ? value[0] : value\n  if (typeof raw !== \"string\") return undefined\n  return raw.split(\",\")[0]?.trim() || undefined\n}\n\nconst getRequestOrigin = (ctx: Ctx): string => {\n  const protocol = getForwardedHeaderValue(ctx.req.headers[\"x-forwarded-proto\"]) ?? ctx.req.protocol\n  const host = getForwardedHeaderValue(ctx.req.headers[\"x-forwarded-host\"]) ?? ctx.req.get(\"host\")\n\n  return protocol && host ? `${protocol}://${host}` : \"\"\n}\n\nconst getNotificationActionLinks = (notification: NotificationActionDoc): NotificationActionLink[] => {\n  const links: NotificationActionLink[] = []\n\n  if (typeof notification.data?.link === \"string\") {\n    links.push({\n      link: notification.data.link,\n      urlMode: notification.data.linkMode === \"merge_current_search\" ? \"merge_current_search\" : \"navigate\",\n    })\n  }\n\n  const platformWebpush = notification.platform?.webpush\n  if (platformWebpush && typeof platformWebpush === \"object\" && !Array.isArray(platformWebpush)) {\n    const fcmOptions = (platformWebpush as { fcmOptions?: unknown }).fcmOptions\n    if (fcmOptions && typeof fcmOptions === \"object\" && !Array.isArray(fcmOptions)) {\n      const link = (fcmOptions as { link?: unknown }).link\n      if (typeof link === \"string\") {\n        links.push({ link, urlMode: \"navigate\" })\n      }\n    }\n  }\n\n  return links\n}\n\nconst actionSearchParamsMatchTargetUrl = (actionUrl: string, targetUrl: string, origin: string): boolean => {\n  try {\n    const base = new URL(origin)\n    const action = new URL(actionUrl, base)\n    const target = new URL(targetUrl, base)\n    for (const [key, value] of action.searchParams) {\n      if (target.searchParams.get(key) !== value) return false\n    }\n    return Array.from(action.searchParams.keys()).length > 0\n  } catch {\n    return false\n  }\n}\n\nconst notificationActionLinkMatchesUrl = (\n  action: NotificationActionLink,\n  targetUrl: string,\n  origin: string,\n): boolean => {\n  if (action.urlMode === \"merge_current_search\") {\n    return actionSearchParamsMatchTargetUrl(action.link, targetUrl, origin)\n  }\n\n  return Notifications.normalizeNotificationActionUrl(action.link, origin) === targetUrl\n}\n\nconst buildDisabledTopics = (\n  settings: SettingsDoc | null,\n  key: \"inApp\" | \"emailDigest\",\n): string[] => {\n  const raw = settings?.topicPreferences\n  if (!Array.isArray(raw) || raw.length === 0) return []\n\n  return raw\n    .map((pref) => {\n      if (!pref || typeof pref !== \"object\") return null\n      const topic = typeof (pref as { topic?: unknown }).topic === \"string\" ? (pref as { topic: string }).topic.trim() : \"\"\n      if (!topic) return null\n      const enabled = (pref as Record<string, unknown>)[key] === true\n      return enabled ? null : topic\n    })\n    .filter((topic): topic is string => Boolean(topic))\n}\n\nconst listNotifications: ApiHandler<Notifications.ListRequestPayload, Notifications.ListResponsePayload> = async(\n  payload,\n  ctx,\n) => {\n  const session = getSessionUser(ctx)\n  if (!session) {\n    return { ok: false, error: \"unauthorized\" }\n  }\n\n  const ability = buildAbilityFromSession({ tenantId: session.tenantId, session: ctx.req.session })\n  if (!ability.can(\"read\", \"RBNotification\")) {\n    ctx.res.status(403)\n    return { ok: false, error: \"forbidden\" }\n  }\n\n  const parsed = Notifications.listRequestSchema.safeParse(payload)\n  if (!parsed.success) {\n    ctx.res.status(400)\n    return { ok: false, error: \"invalid_payload\" }\n  }\n\n  const { userId } = session\n  const includeArchived = parsed.data.includeArchived === true\n  const unreadOnly = parsed.data.unreadOnly === true\n  const limit = parsed.data.limit ?? 50\n  const markSeen = parsed.data.markSeen === true\n\n  const SettingsModel = await models.get(\"RBNotificationSettings\", { req: ctx.req, ability })\n  const settings = (await SettingsModel.findOne({ userId }).lean()) as SettingsDoc | null\n  const disabledTopics = buildDisabledTopics(settings, \"inApp\")\n\n  const NotificationModel = await models.get(\"RBNotification\", { req: ctx.req, ability })\n\n  const queryFilters: Record<string, unknown>[] = [\n    { userId },\n    getAccessibleByQuery(ability, \"read\", \"RBNotification\"),\n  ]\n  if (!includeArchived) queryFilters.push({ archivedAt: { $exists: false } })\n  if (unreadOnly) queryFilters.push({ readAt: { $exists: false } })\n  if (disabledTopics.length > 0) queryFilters.push({ topic: { $nin: disabledTopics } })\n  const query: Record<string, unknown> = { $and: queryFilters }\n\n  const notifications = (await NotificationModel.find(query)\n    .sort({ createdAt: -1 })\n    .limit(limit)\n    .lean()) as NotificationDoc[]\n\n  const unseenQueryFilters: Record<string, unknown>[] = [\n    { userId },\n    { archivedAt: { $exists: false } },\n    { seenAt: { $exists: false } },\n    getAccessibleByQuery(ability, \"read\", \"RBNotification\"),\n  ]\n  if (disabledTopics.length > 0) unseenQueryFilters.push({ topic: { $nin: disabledTopics } })\n  const unseenQuery: Record<string, unknown> = { $and: unseenQueryFilters }\n\n  const unreadQueryFilters: Record<string, unknown>[] = [\n    { userId },\n    { archivedAt: { $exists: false } },\n    { readAt: { $exists: false } },\n    getAccessibleByQuery(ability, \"read\", \"RBNotification\"),\n  ]\n  if (disabledTopics.length > 0) unreadQueryFilters.push({ topic: { $nin: disabledTopics } })\n  const unreadQuery: Record<string, unknown> = { $and: unreadQueryFilters }\n\n  const [unreadCount, unseenCount] = await Promise.all([\n    NotificationModel.countDocuments(unreadQuery),\n    NotificationModel.countDocuments(unseenQuery),\n  ])\n\n  const now = markSeen ? new Date() : null\n  if (now && unseenCount > 0) {\n    await NotificationModel.updateMany(unseenQuery, { $set: { seenAt: now } })\n  }\n\n  return Notifications.listResponseSchema.parse({\n    ok: true,\n    notifications: notifications.map((n) => ({\n      id: String(n._id),\n      topic: typeof n.topic === \"string\" ? n.topic : undefined,\n      tag: typeof n.tag === \"string\" ? n.tag : undefined,\n      deliveryId: typeof n.deliveryId === \"string\" ? n.deliveryId : undefined,\n      title: typeof n.title === \"string\" ? n.title : \"\",\n      body: typeof n.body === \"string\" ? n.body : undefined,\n      image: typeof n.image === \"string\" ? n.image : undefined,\n      data: toStringMap(n.data),\n      platform: isRecord(n.platform) ? n.platform : undefined,\n      createdAt: toIso(n.createdAt) ?? new Date().toISOString(),\n      seenAt: toIso(n.seenAt) ?? (now && !n.archivedAt && !n.seenAt ? now.toISOString() : undefined),\n      readAt: toIso(n.readAt),\n      archivedAt: toIso(n.archivedAt),\n    })),\n    unreadCount,\n    unseenCount: now ? 0 : unseenCount,\n  })\n}\n\nconst createNotificationForCurrentUser: ApiHandler<Notifications.CreateRequestPayload, Notifications.CreateResponsePayload> = async(\n  payload,\n  ctx,\n) => {\n  const session = getSessionUser(ctx)\n  if (!session) {\n    return { ok: false, error: \"unauthorized\" }\n  }\n\n  const ability = buildAbilityFromSession({ tenantId: session.tenantId, session: ctx.req.session })\n  if (!ability.can(\"create\", \"RBNotification\")) {\n    ctx.res.status(403)\n    return { ok: false, error: \"forbidden\" }\n  }\n\n  const parsed = Notifications.createRequestSchema.safeParse(payload)\n  if (!parsed.success) {\n    ctx.res.status(400)\n    return { ok: false, error: \"invalid_payload\" }\n  }\n\n  const origin = getRequestOrigin(ctx)\n  const actionLink = parsed.data.url\n    ? Notifications.normalizeNotificationActionLink(parsed.data.url, origin, parsed.data.urlMode) ?? undefined\n    : undefined\n  if (parsed.data.url && !actionLink) {\n    ctx.res.status(400)\n    return { ok: false, error: \"invalid_payload\" }\n  }\n\n  const created = await createNotification(ctx, {\n    userId: session.userId,\n    topic: parsed.data.topic,\n    tag: parsed.data.tag,\n    title: parsed.data.title,\n    body: parsed.data.body,\n    image: parsed.data.image,\n    url: actionLink,\n    urlMode: parsed.data.urlMode,\n    metadata: parsed.data.metadata,\n    data: parsed.data.data,\n    platform: parsed.data.platform,\n  }, ability)\n\n  return Notifications.createResponseSchema.parse({ ok: true, id: created.id })\n}\n\nconst markRead: ApiHandler<unknown, Notifications.MarkReadResponsePayload> = async(\n  _payload,\n  ctx,\n) => {\n  const session = getSessionUser(ctx)\n  if (!session) {\n    return { ok: false, error: \"unauthorized\" }\n  }\n\n  const ability = buildAbilityFromSession({ tenantId: session.tenantId, session: ctx.req.session })\n  if (!ability.can(\"update\", \"RBNotification\")) {\n    ctx.res.status(403)\n    return { ok: false, error: \"forbidden\" }\n  }\n\n  const notificationId = typeof ctx.req.params.notificationId === \"string\" ? ctx.req.params.notificationId.trim() : \"\"\n  if (!notificationId) {\n    ctx.res.status(400)\n    return { ok: false, error: \"missing_notification_id\" }\n  }\n\n  const NotificationModel = await models.get(\"RBNotification\", { req: ctx.req, ability })\n  const now = new Date()\n\n  try {\n    await NotificationModel.updateOne(\n      { $and: [{ _id: notificationId }, { archivedAt: { $exists: false } }, getAccessibleByQuery(ability, \"update\", \"RBNotification\")] },\n      { $set: { readAt: now, seenAt: now } },\n    )\n  } catch {\n    ctx.res.status(400)\n    return { ok: false, error: \"invalid_notification_id\" }\n  }\n\n  return { ok: true }\n}\n\nconst markReadByUrl: ApiHandler<Notifications.MarkReadByUrlRequestPayload, Notifications.MarkReadByUrlResponsePayload> = async(\n  payload,\n  ctx,\n) => {\n  const session = getSessionUser(ctx)\n  if (!session) {\n    return { ok: false, error: \"unauthorized\" }\n  }\n\n  const ability = buildAbilityFromSession({ tenantId: session.tenantId, session: ctx.req.session })\n  if (!ability.can(\"update\", \"RBNotification\")) {\n    ctx.res.status(403)\n    return { ok: false, error: \"forbidden\" }\n  }\n\n  const parsed = Notifications.markReadByUrlRequestSchema.safeParse(payload)\n  if (!parsed.success) {\n    ctx.res.status(400)\n    return { ok: false, error: \"invalid_payload\" }\n  }\n\n  const origin = getRequestOrigin(ctx)\n  const targetUrl = Notifications.normalizeNotificationActionUrl(parsed.data.url, origin)\n  if (!targetUrl) {\n    ctx.res.status(400)\n    return { ok: false, error: \"invalid_payload\" }\n  }\n\n  const NotificationModel = await models.get(\"RBNotification\", { req: ctx.req, ability })\n  const query: Record<string, unknown> = {\n    $and: [\n      { userId: session.userId },\n      { archivedAt: { $exists: false } },\n      { readAt: { $exists: false } },\n      {\n        $or: [\n          { \"data.link\": { $type: \"string\" } },\n          { \"platform.webpush.fcmOptions.link\": { $type: \"string\" } },\n        ],\n      },\n      getAccessibleByQuery(ability, \"update\", \"RBNotification\"),\n    ],\n  }\n\n  const candidates = (await NotificationModel.find(query)\n    .select({ _id: 1, data: 1, platform: 1 })\n    .lean()) as NotificationActionDoc[]\n\n  const matchingIds = candidates\n    .filter((notification) =>\n      getNotificationActionLinks(notification).some((action) =>\n        notificationActionLinkMatchesUrl(action, targetUrl, origin),\n      ),\n    )\n    .map((notification) => notification._id)\n\n  if (matchingIds.length === 0) {\n    return Notifications.markReadByUrlResponseSchema.parse({\n      ok: true,\n      matchedCount: 0,\n      modifiedCount: 0,\n    })\n  }\n\n  const now = new Date()\n  const result = await NotificationModel.updateMany(\n    {\n      $and: [\n        { _id: { $in: matchingIds } },\n        { userId: session.userId },\n        { archivedAt: { $exists: false } },\n        { readAt: { $exists: false } },\n        getAccessibleByQuery(ability, \"update\", \"RBNotification\"),\n      ],\n    },\n    { $set: { readAt: now, seenAt: now } },\n  )\n\n  const modifiedCount = typeof result.modifiedCount === \"number\" ? result.modifiedCount : matchingIds.length\n\n  return Notifications.markReadByUrlResponseSchema.parse({\n    ok: true,\n    matchedCount: matchingIds.length,\n    modifiedCount,\n  })\n}\n\nconst markAllRead: ApiHandler<unknown, Notifications.MarkAllReadResponsePayload> = async(\n  _payload,\n  ctx,\n) => {\n  const session = getSessionUser(ctx)\n  if (!session) {\n    return { ok: false, error: \"unauthorized\" }\n  }\n\n  const ability = buildAbilityFromSession({ tenantId: session.tenantId, session: ctx.req.session })\n  if (!ability.can(\"update\", \"RBNotification\")) {\n    ctx.res.status(403)\n    return { ok: false, error: \"forbidden\" }\n  }\n\n  const SettingsModel = await models.get(\"RBNotificationSettings\", { req: ctx.req, ability })\n  const settings = (await SettingsModel.findOne({ userId: session.userId }).lean()) as SettingsDoc | null\n  const disabledTopics = buildDisabledTopics(settings, \"inApp\")\n\n  const NotificationModel = await models.get(\"RBNotification\", { req: ctx.req, ability })\n\n  const queryFilters: Record<string, unknown>[] = [\n    { userId: session.userId },\n    { archivedAt: { $exists: false } },\n    { readAt: { $exists: false } },\n    getAccessibleByQuery(ability, \"update\", \"RBNotification\"),\n  ]\n  if (disabledTopics.length > 0) queryFilters.push({ topic: { $nin: disabledTopics } })\n  const query: Record<string, unknown> = { $and: queryFilters }\n\n  const now = new Date()\n  await NotificationModel.updateMany(query, { $set: { readAt: now, seenAt: now } })\n\n  return { ok: true }\n}\n\nconst archiveNotification: ApiHandler<unknown, Notifications.ArchiveResponsePayload> = async(\n  _payload,\n  ctx,\n) => {\n  const session = getSessionUser(ctx)\n  if (!session) {\n    return { ok: false, error: \"unauthorized\" }\n  }\n\n  const ability = buildAbilityFromSession({ tenantId: session.tenantId, session: ctx.req.session })\n  if (!ability.can(\"update\", \"RBNotification\")) {\n    ctx.res.status(403)\n    return { ok: false, error: \"forbidden\" }\n  }\n\n  const notificationId = typeof ctx.req.params.notificationId === \"string\" ? ctx.req.params.notificationId.trim() : \"\"\n  if (!notificationId) {\n    ctx.res.status(400)\n    return { ok: false, error: \"missing_notification_id\" }\n  }\n\n  const NotificationModel = await models.get(\"RBNotification\", { req: ctx.req, ability })\n\n  try {\n    await NotificationModel.updateOne(\n      { $and: [{ _id: notificationId }, { archivedAt: { $exists: false } }, getAccessibleByQuery(ability, \"update\", \"RBNotification\")] },\n      { $set: { archivedAt: new Date(), drawerActive: false } },\n    )\n  } catch {\n    ctx.res.status(400)\n    return { ok: false, error: \"invalid_notification_id\" }\n  }\n\n  return { ok: true }\n}\n\nconst getSettings: ApiHandler<unknown, Notifications.SettingsResponsePayload> = async(\n  _payload,\n  ctx,\n) => {\n  const session = getSessionUser(ctx)\n  if (!session) {\n    return { ok: false, error: \"unauthorized\" }\n  }\n\n  const ability = buildAbilityFromSession({ tenantId: session.tenantId, session: ctx.req.session })\n  if (!ability.can(\"read\", \"RBNotificationSettings\")) {\n    ctx.res.status(403)\n    return { ok: false, error: \"forbidden\" }\n  }\n\n  const SettingsModel = await models.get(\"RBNotificationSettings\", { req: ctx.req, ability })\n  const settings = (await SettingsModel.findOne(\n    { $and: [{ userId: session.userId }, getAccessibleByQuery(ability, \"read\", \"RBNotificationSettings\")] },\n  ).lean()) as SettingsDoc | null\n\n  const digestFrequencyRaw = typeof settings?.digestFrequency === \"string\" ? settings.digestFrequency : \"weekly\"\n  const digestFrequency: Notifications.DigestFrequency =\n    digestFrequencyRaw === \"off\" || digestFrequencyRaw === \"daily\" || digestFrequencyRaw === \"weekly\"\n      ? digestFrequencyRaw\n      : \"weekly\"\n\n  const topicPreferences = Array.isArray(settings?.topicPreferences)\n    ? settings!.topicPreferences.map((pref) => ({\n      topic: typeof pref.topic === \"string\" ? pref.topic : \"\",\n      inApp: pref.inApp === true,\n      emailDigest: pref.emailDigest === true,\n      push: pref.push === true,\n    })).filter((pref) => pref.topic.length > 0)\n    : []\n\n  return Notifications.settingsResponseSchema.parse({\n    ok: true,\n    settings: {\n      digestFrequency,\n      topicPreferences,\n      lastDigestSentAt: toIso(settings?.lastDigestSentAt),\n    },\n  })\n}\n\nconst updateSettings: ApiHandler<Notifications.UpdateSettingsRequestPayload, Notifications.UpdateSettingsResponsePayload> = async(\n  payload,\n  ctx,\n) => {\n  const session = getSessionUser(ctx)\n  if (!session) {\n    return { ok: false, error: \"unauthorized\" }\n  }\n\n  const ability = buildAbilityFromSession({ tenantId: session.tenantId, session: ctx.req.session })\n  if (!ability.can(\"update\", \"RBNotificationSettings\")) {\n    ctx.res.status(403)\n    return { ok: false, error: \"forbidden\" }\n  }\n\n  const parsed = Notifications.updateSettingsRequestSchema.safeParse(payload)\n  if (!parsed.success) {\n    ctx.res.status(400)\n    return { ok: false, error: \"invalid_payload\" }\n  }\n\n  const SettingsModel = await models.get(\"RBNotificationSettings\", { req: ctx.req, ability })\n  const nextValues: Record<string, unknown> = {}\n\n  if (parsed.data.digestFrequency) {\n    nextValues.digestFrequency = parsed.data.digestFrequency\n  }\n\n  if (parsed.data.topicPreferences) {\n    const seen = new Set<string>()\n    const next = parsed.data.topicPreferences\n      .map((pref) => ({\n        topic: pref.topic.trim(),\n        inApp: pref.inApp,\n        emailDigest: pref.emailDigest,\n        push: pref.push,\n      }))\n      .filter((pref) => pref.topic.length > 0)\n      .filter((pref) => {\n        if (seen.has(pref.topic)) return false\n        seen.add(pref.topic)\n        return true\n      })\n\n    nextValues.topicPreferences = next\n  }\n\n  const ops: Record<string, unknown> = {\n    $setOnInsert: { userId: session.userId },\n  }\n\n  if (Object.keys(nextValues).length > 0) {\n    ops.$set = nextValues\n  }\n\n  const settings = (await SettingsModel.findOneAndUpdate(\n    { $and: [{ userId: session.userId }, getAccessibleByQuery(ability, \"update\", \"RBNotificationSettings\")] },\n    ops,\n    { upsert: true, returnDocument: \"after\", setDefaultsOnInsert: true },\n  ).lean()) as SettingsDoc | null\n\n  const digestFrequencyRaw = typeof settings?.digestFrequency === \"string\" ? settings.digestFrequency : \"weekly\"\n  const digestFrequency: Notifications.DigestFrequency =\n    digestFrequencyRaw === \"off\" || digestFrequencyRaw === \"daily\" || digestFrequencyRaw === \"weekly\"\n      ? digestFrequencyRaw\n      : \"weekly\"\n\n  const topicPreferences = Array.isArray(settings?.topicPreferences)\n    ? settings!.topicPreferences.map((pref) => ({\n      topic: typeof pref.topic === \"string\" ? pref.topic : \"\",\n      inApp: pref.inApp === true,\n      emailDigest: pref.emailDigest === true,\n      push: pref.push === true,\n    })).filter((pref) => pref.topic.length > 0)\n    : []\n\n  return Notifications.updateSettingsResponseSchema.parse({\n    ok: true,\n    settings: {\n      digestFrequency,\n      topicPreferences,\n      lastDigestSentAt: toIso(settings?.lastDigestSentAt),\n    },\n  })\n}\n\nconst runDigest: ApiHandler<Notifications.DigestRunRequestPayload, Notifications.DigestRunResponsePayload> = async(\n  payload,\n  ctx,\n) => {\n  const session = getSessionUser(ctx)\n  if (!session) {\n    return { ok: false, error: \"unauthorized\" }\n  }\n\n  const ability = buildAbilityFromSession({ tenantId: session.tenantId, session: ctx.req.session })\n  if (!ability.can(\"read\", \"RBNotification\")) {\n    ctx.res.status(403)\n    return { ok: false, error: \"forbidden\" }\n  }\n\n  const parsed = Notifications.digestRunRequestSchema.safeParse(payload)\n  if (!parsed.success) {\n    ctx.res.status(400)\n    return { ok: false, error: \"invalid_payload\" }\n  }\n\n  const result = await sendNotificationsDigestForUser(ctx, {\n    userId: session.userId,\n    ability,\n    force: parsed.data.force === true,\n  })\n\n  if (!result.ok) {\n    ctx.res.status(500)\n    return { ok: false, error: result.error }\n  }\n\n  return {\n    ok: true,\n    sent: result.sent,\n    ...(result.skippedReason ? { skippedReason: result.skippedReason } : {}),\n  }\n}\n\nexport default (api: Api) => {\n  api.post(Notifications.ListRoute, listNotifications)\n  api.post(Notifications.CreateRoute, createNotificationForCurrentUser)\n  api.post(Notifications.MarkReadRoute, markRead)\n  api.post(Notifications.MarkReadByUrlRoute, markReadByUrl)\n  api.post(Notifications.MarkAllReadRoute, markAllRead)\n  api.post(Notifications.ArchiveRoute, archiveNotification)\n  api.get(Notifications.SettingsRoute, getSettings)\n  api.put(Notifications.SettingsRoute, updateSettings)\n  api.post(Notifications.DigestRunRoute, runDigest)\n}\n"],"mappings":";;;;;AAQA,IAAaI,kBAAkBC,QAAa;CAC1C,MAAMC,iBAAkBD,IAAIE,IAAIC,SAAmEC;CACnG,MAAMC,SAAS,OAAOJ,gBAAgBJ,OAAO,WAAWI,eAAeJ,GAAGS,KAAK,IAAI;CACnF,MAAMC,WAAW,OAAON,gBAAgBH,oBAAoB,WAAWG,eAAeH,gBAAgBQ,KAAK,IAAI;CAE/G,IAAI,CAACD,QAAQ;EACXL,IAAIQ,IAAIC,OAAO,GAAG;EAClB,OAAO;CACT;CAEA,IAAI,CAACF,UAAU;EACbP,IAAIQ,IAAIC,OAAO,GAAG;EAClB,OAAO;CACT;CAEA,OAAO;EAAEJ;EAAQE;CAAS;AAC5B;;;ACrBA,IAAaI,YAAY;AACzB,IAAaC,cAAc;AAC3B,IAAaC,gBAAgB;AAC7B,IAAaC,qBAAqB;AAClC,IAAaC,eAAe;AAC5B,IAAaC,mBAAmB;AAChC,IAAaC,gBAAgB;AAC7B,IAAaC,iBAAiB;AAE9B,IAAaC,oBAAoBT,OAAS;CACxCW,iBAAiBX,QAAU,CAAC,CAACa,SAAS;CACtCC,YAAYd,QAAU,CAAC,CAACa,SAAS;CACjCE,OAAOf,OAAS,CAAC,CAACiB,IAAI,CAAC,CAACC,IAAI,CAAC,CAAC,CAACC,IAAI,GAAG,CAAC,CAACN,SAAS;CACjDO,UAAUpB,QAAU,CAAC,CAACa,SAAS;AACjC,CAAC;AAID,IAAaU,yBAAyBvB,OAASA,OAAS,GAAGA,OAAS,CAAC;AAErE,IAAa0B,oCAAoC1B,OAAS;CACxD2B,SAAS3B,OAASA,OAAS,GAAGA,QAAU,CAAC,CAAC,CAACa,SAAS;CACpDgB,YAAY7B,OAASA,OAAS,GAAGA,QAAU,CAAC,CAAC,CAACa,SAAS;CACvDiB,SAAS9B,OAASA,OAAS,GAAGA,QAAU,CAAC,CAAC,CAACa,SAAS;CACpDkB,MAAM/B,OAASA,OAAS,GAAGA,QAAU,CAAC,CAAC,CAACa,SAAS;AACnD,CAAC,CAAC,CAACmB,YAAY;AAIf,IAAME,4BAA4BlC,OAAS,CAAC,CAACmC,KAAK;AAClD,IAAMC,4BAA4BpC,MAAO,CAAC,YAAY,sBAAsB,CAAC;AAE7E,IAAasC,kCAAkCtC,OAAS;CACtDuC,OAAOvC,OAAS,CAAC,CAACkB,IAAI,CAAC;CACvBsB,MAAMxC,OAAS,CAAC,CAACa,SAAS;CAC1B4B,OAAOzC,OAAS,CAAC,CAACa,SAAS;AAC7B,CAAC;AAED,IAAa6B,sBAAsB1C,OAAS;CAC1C2C,OAAOT,0BAA0BhB,IAAI,CAAC,CAAC,CAACL,SAAS;CACjD+B,KAAKV,0BAA0BhB,IAAI,CAAC,CAAC,CAACL,SAAS;CAC/C0B,OAAOL,0BAA0BhB,IAAI,CAAC;CACtCsB,MAAMN,0BAA0BrB,SAAS;CACzC4B,OAAOP,0BAA0BrB,SAAS;CAC1CgC,KAAKX,0BAA0BhB,IAAI,CAAC,CAAC,CAACL,SAAS;CAC/CiC,SAASV,0BAA0BvB,SAAS;CAC5CkC,UAAU/C,OAASA,OAAS,GAAGA,QAAU,CAAC,CAAC,CAACa,SAAS;CACrDmC,MAAMzB,uBAAuBV,SAAS;CACtCoC,UAAUvB,kCAAkCb,SAAS;AACvD,CAAC;AAID,IAAasC,kCAAkCN,KAAaO,WAAkC;CAC5F,MAAMC,MAAMR,IAAIV,KAAK;CACrB,IAAI,CAACkB,KAAK,OAAO;CAEjB,IAAI;EACF,MAAMC,OAAO,IAAIC,IAAIH,MAAM;EAC3B,MAAMI,SAAS,IAAID,IAAIF,KAAKC,IAAI;EAChC,IAAIE,OAAOJ,WAAWE,KAAKF,QAAQ,OAAO;EAC1C,OAAO,GAAGI,OAAOC,WAAWD,OAAOE;CACrC,QAAQ;EACN,OAAO;CACT;AACF;AAEA,IAAaC,mCACXd,KACAO,QACAN,UAAqD,eACnC;CAClB,MAAMO,MAAMR,IAAIV,KAAK;CACrB,IAAI,CAACkB,KAAK,OAAO;CAEjB,IAAI;EACF,MAAMC,OAAO,IAAIC,IAAIH,MAAM;EAC3B,MAAMI,SAAS,IAAID,IAAIF,KAAKC,IAAI;EAChC,IAAIE,OAAOJ,WAAWE,KAAKF,QAAQ,OAAO;EAC1C,IAAIN,YAAY,YAAY,OAAO,GAAGU,OAAOC,WAAWD,OAAOE,SAASF,OAAOI;EAC/E,OAAO,GAAGJ,OAAOE,SAASF,OAAOI,UAAU;CAC7C,QAAQ;EACN,OAAO;CACT;AACF;AAEA,IAAaC,qBAAqB7D,OAAS;CACzC8D,IAAI9D,OAAS;CACb2C,OAAO3C,OAAS,CAAC,CAACa,SAAS;CAC3B+B,KAAK5C,OAAS,CAAC,CAACa,SAAS;CACzBkD,YAAY/D,OAAS,CAAC,CAACa,SAAS;CAChC0B,OAAOD,gCAAgC0B,MAAMzB;CAC7CC,MAAMF,gCAAgC0B,MAAMxB;CAC5CC,OAAOH,gCAAgC0B,MAAMvB;CAC7CO,MAAMzB,uBAAuBV,SAAS;CACtCoC,UAAUvB,kCAAkCb,SAAS;CACrDoD,WAAWjE,OAAS;CACpBkE,QAAQlE,OAAS,CAAC,CAACa,SAAS;CAC5BsD,QAAQnE,OAAS,CAAC,CAACa,SAAS;CAC5BuD,YAAYpE,OAAS,CAAC,CAACa,SAAS;AAClC,CAAC;AAID,IAAayD,qBAAqBtE,OAAS;CACzCuE,IAAIvE,QAAU;CACdwE,OAAOxE,OAAS,CAAC,CAACa,SAAS;CAC3B4D,eAAezE,MAAQ6D,kBAAkB,CAAC,CAAChD,SAAS;CACpD8D,aAAa3E,OAAS,CAAC,CAACiB,IAAI,CAAC,CAACC,IAAI,CAAC,CAAC,CAACL,SAAS;CAC9C+D,aAAa5E,OAAS,CAAC,CAACiB,IAAI,CAAC,CAACC,IAAI,CAAC,CAAC,CAACL,SAAS;AAChD,CAAC;AAID,IAAaiE,uBAAuB9E,OAAS;CAC3CuE,IAAIvE,QAAU;CACdwE,OAAOxE,OAAS,CAAC,CAACa,SAAS;CAC3BiD,IAAI9D,OAAS,CAAC,CAACa,SAAS;AAC1B,CAAC;AAIqCb,OAAS;CAC7CuE,IAAIvE,QAAU;CACdwE,OAAOxE,OAAS,CAAC,CAACa,SAAS;AAC7B,CAAC;AAID,IAAaqE,6BAA6BlF,OAAS,EACjD6C,KAAK7C,OAAS,CAAC,CAACmC,KAAK,CAAC,CAACjB,IAAI,CAAC,EAC9B,CAAC;AAID,IAAakE,8BAA8BpF,OAAS;CAClDuE,IAAIvE,QAAU;CACdwE,OAAOxE,OAAS,CAAC,CAACa,SAAS;CAC3BwE,cAAcrF,OAAS,CAAC,CAACiB,IAAI,CAAC,CAACC,IAAI,CAAC,CAAC,CAACL,SAAS;CAC/CyE,eAAetF,OAAS,CAAC,CAACiB,IAAI,CAAC,CAACC,IAAI,CAAC,CAAC,CAACL,SAAS;AAClD,CAAC;AAIoCb,OAAS;CAC5CuE,IAAIvE,QAAU;CACdwE,OAAOxE,OAAS,CAAC,CAACa,SAAS;AAC7B,CAAC;AAIwCb,OAAS;CAChDuE,IAAIvE,QAAU;CACdwE,OAAOxE,OAAS,CAAC,CAACa,SAAS;AAC7B,CAAC;AAID,IAAa+E,wBAAwB5F,MAAO;CAAC;CAAO;CAAS;AAAQ,CAAC;AAItE,IAAa8F,wBAAwB9F,OAAS;CAC5C2C,OAAO3C,OAAS;CAChB+F,OAAO/F,QAAU;CACjBgG,aAAahG,QAAU;CACvBiG,MAAMjG,QAAU;AAClB,CAAC;AAID,IAAamG,iBAAiBnG,OAAS;CACrCoG,iBAAiBR;CACjBS,kBAAkBrG,MAAQ8F,qBAAqB;CAC/CQ,kBAAkBtG,OAAS,CAAC,CAACa,SAAS;AACxC,CAAC;AAID,IAAa2F,yBAAyBxG,OAAS;CAC7CuE,IAAIvE,QAAU;CACdwE,OAAOxE,OAAS,CAAC,CAACa,SAAS;CAC3B4F,UAAUN,eAAetF,SAAS;AACpC,CAAC;AAID,IAAa8F,8BAA8B3G,OAAS;CAClDoG,iBAAiBR,sBAAsB/E,SAAS;CAChDwF,kBAAkBrG,MAAQ8F,qBAAqB,CAAC,CAACjF,SAAS;AAC5D,CAAC;AAID,IAAagG,+BAA+B7G,OAAS;CACnDuE,IAAIvE,QAAU;CACdwE,OAAOxE,OAAS,CAAC,CAACa,SAAS;CAC3B4F,UAAUN,eAAetF,SAAS;AACpC,CAAC;AAID,IAAakG,yBAAyB/G,OAAS,EAC7CgH,OAAOhH,QAAU,CAAC,CAACa,SAAS,EAC9B,CAAC;AAIsCb,OAAS;CAC9CuE,IAAIvE,QAAU;CACdwE,OAAOxE,OAAS,CAAC,CAACa,SAAS;CAC3BsG,MAAMnH,QAAU,CAAC,CAACa,SAAS;CAC3BuG,eAAepH,OAAS,CAAC,CAACa,SAAS;AACrC,CAAC;;;ACrMD,IAAM6H,SAASC,UAAwCA,iBAAiBC,OAAOD,MAAME,YAAY,IAAIC,KAAAA;AACrG,IAAMC,YAAYJ,UAAqDM,QAAQN,KAAK,KAAK,OAAOA,UAAU,YAAY,CAACO,MAAMC,QAAQR,KAAK;AAE1I,IAAMS,eAAeT,UAAuD;CAC1E,IAAI,CAACI,SAASJ,KAAK,GAAG,OAAOG,KAAAA;CAC7B,MAAMO,UAAUC,OAAOD,QAAQV,KAAK,CAAC,CAClCY,QAAQC,UAAqC,OAAOA,MAAM,OAAO,QAAQ;CAC5E,OAAOH,QAAQI,SAAS,IAAIH,OAAOI,YAAYL,OAAO,IAAIP,KAAAA;AAC5D;AAEA,IAAMa,2BAA2BhB,UAAuC;CACtE,MAAMiB,MAAMV,MAAMC,QAAQR,KAAK,IAAIA,MAAM,KAAKA;CAC9C,IAAI,OAAOiB,QAAQ,UAAU,OAAOd,KAAAA;CACpC,OAAOc,IAAIC,MAAM,GAAG,CAAC,CAAC,EAAE,EAAEC,KAAK,KAAKhB,KAAAA;AACtC;AAEA,IAAMiB,oBAAoBC,QAAqB;CAC7C,MAAMC,WAAWN,wBAAwBK,IAAIE,IAAIC,QAAQ,oBAAoB,KAAKH,IAAIE,IAAID;CAC1F,MAAMG,OAAOT,wBAAwBK,IAAIE,IAAIC,QAAQ,mBAAmB,KAAKH,IAAIE,IAAIG,IAAI,MAAM;CAE/F,OAAOJ,YAAYG,OAAO,GAAGH,SAAQ,KAAMG,SAAS;AACtD;AAEA,IAAME,8BAA8BC,iBAAkE;CACpG,MAAMC,QAAkC,CAAA;CAExC,IAAI,OAAOD,aAAaE,MAAMjC,SAAS,UACrCgC,MAAME,KAAK;EACTlC,MAAM+B,aAAaE,KAAKjC;EACxBC,SAAS8B,aAAaE,KAAKE,aAAa,yBAAyB,yBAAyB;CAC5F,CAAC;CAGH,MAAMC,kBAAkBL,aAAaM,UAAUC;CAC/C,IAAIF,mBAAmB,OAAOA,oBAAoB,YAAY,CAAC1B,MAAMC,QAAQyB,eAAe,GAAG;EAC7F,MAAMG,aAAcH,gBAA6CG;EACjE,IAAIA,cAAc,OAAOA,eAAe,YAAY,CAAC7B,MAAMC,QAAQ4B,UAAU,GAAG;GAC9E,MAAMvC,OAAQuC,WAAkCvC;GAChD,IAAI,OAAOA,SAAS,UAClBgC,MAAME,KAAK;IAAElC;IAAMC,SAAS;GAAW,CAAC;EAE5C;CACF;CAEA,OAAO+B;AACT;AAEA,IAAMQ,oCAAoCC,WAAmBC,WAAmBC,WAA4B;CAC1G,IAAI;EACF,MAAMC,OAAO,IAAIC,IAAIF,MAAM;EAC3B,MAAMG,SAAS,IAAID,IAAIJ,WAAWG,IAAI;EACtC,MAAMG,SAAS,IAAIF,IAAIH,WAAWE,IAAI;EACtC,KAAK,MAAM,CAACI,KAAK7C,UAAU2C,OAAOG,cAChC,IAAIF,OAAOE,aAAapB,IAAImB,GAAG,MAAM7C,OAAO,OAAO;EAErD,OAAOO,MAAMwC,KAAKJ,OAAOG,aAAaE,KAAK,CAAC,CAAC,CAAClC,SAAS;CACzD,QAAQ;EACN,OAAO;CACT;AACF;AAEA,IAAMmC,oCACJN,QACAJ,WACAC,WACY;CACZ,IAAIG,OAAO7C,YAAY,wBACrB,OAAOuC,iCAAiCM,OAAO9C,MAAM0C,WAAWC,MAAM;CAGxE,OAAOlD,+BAA6CqD,OAAO9C,MAAM2C,MAAM,MAAMD;AAC/E;AAEA,IAAMY,uBACJC,UACAP,QACa;CACb,MAAM5B,MAAMmC,UAAUC;CACtB,IAAI,CAAC9C,MAAMC,QAAQS,GAAG,KAAKA,IAAIH,WAAW,GAAG,OAAO,CAAA;CAEpD,OAAOG,IACJqC,KAAKC,SAAS;EACb,IAAI,CAACA,QAAQ,OAAOA,SAAS,UAAU,OAAO;EAC9C,MAAMC,QAAQ,OAAQD,KAA6BC,UAAU,WAAYD,KAA2BC,MAAMrC,KAAK,IAAI;EACnH,IAAI,CAACqC,OAAO,OAAO;EAEnB,OADiBD,KAAiCV,SAAS,OAC1C,OAAOW;CAC1B,CAAC,CAAC,CACD5C,QAAQ4C,UAA2BlD,QAAQkD,KAAK,CAAC;AACtD;AAEA,IAAME,oBAAqG,OACzGG,SACAxC,QACG;CACH,MAAMyC,UAAUzE,eAAegC,GAAG;CAClC,IAAI,CAACyC,SACH,OAAO;EAAEC,IAAI;EAAOC,OAAO;CAAe;CAG5C,MAAMC,UAAUhF,wBAAwB;EAAEiF,UAAUJ,QAAQI;EAAUJ,SAASzC,IAAIE,IAAIuC;CAAQ,CAAC;CAChG,IAAI,CAACG,QAAQE,IAAI,QAAQ,gBAAgB,GAAG;EAC1C9C,IAAI+C,IAAIC,OAAO,GAAG;EAClB,OAAO;GAAEN,IAAI;GAAOC,OAAO;EAAY;CACzC;CAEA,MAAMM,SAAAA,kBAAyCE,UAAUX,OAAO;CAChE,IAAI,CAACS,OAAOG,SAAS;EACnBpD,IAAI+C,IAAIC,OAAO,GAAG;EAClB,OAAO;GAAEN,IAAI;GAAOC,OAAO;EAAkB;CAC/C;CAEA,MAAM,EAAEU,WAAWZ;CACnB,MAAMa,kBAAkBL,OAAOxC,KAAK6C,oBAAoB;CACxD,MAAMC,aAAaN,OAAOxC,KAAK8C,eAAe;CAC9C,MAAMC,QAAQP,OAAOxC,KAAK+C,SAAS;CACnC,MAAMC,WAAWR,OAAOxC,KAAKgD,aAAa;CAI1C,MAAMI,iBAAiB/B,oBAAoBC,OADnB2B,MADIjG,OAAO4C,IAAI,0BAA0B;EAAEH,KAAKF,IAAIE;EAAK0C;CAAQ,CAAC,EAAA,CACpDe,QAAQ,EAAEN,OAAO,CAAC,CAAC,CAACO,KAAK,GACV,OAAO;CAE5D,MAAME,oBAAoB,MAAMrG,OAAO4C,IAAI,kBAAkB;EAAEH,KAAKF,IAAIE;EAAK0C;CAAQ,CAAC;CAEtF,MAAMmB,eAA0C,CAC9C,EAAEV,OAAO,GACTxF,qBAAqB+E,SAAS,QAAQ,gBAAgB,CAAC;CAEzD,IAAI,CAACU,iBAAiBS,aAAarD,KAAK,EAAEsD,YAAY,EAAEC,SAAS,MAAM,EAAE,CAAC;CAC1E,IAAIV,YAAYQ,aAAarD,KAAK,EAAEwD,QAAQ,EAAED,SAAS,MAAM,EAAE,CAAC;CAChE,IAAIJ,eAAepE,SAAS,GAAGsE,aAAarD,KAAK,EAAEyB,OAAO,EAAEgC,MAAMN,eAAe,EAAE,CAAC;CACpF,MAAMO,QAAiC,EAAEC,MAAMN,aAAa;CAE5D,MAAMO,gBAAiB,MAAMR,kBAAkBS,KAAKH,KAAK,CAAC,CACvDI,KAAK,EAAEC,WAAW,GAAG,CAAC,CAAC,CACvBjB,MAAMA,KAAK,CAAC,CACZI,KAAK;CAER,MAAMc,qBAAgD;EACpD,EAAErB,OAAO;EACT,EAAEW,YAAY,EAAEC,SAAS,MAAM,EAAE;EACjC,EAAEU,QAAQ,EAAEV,SAAS,MAAM,EAAE;EAC7BpG,qBAAqB+E,SAAS,QAAQ,gBAAgB;CAAC;CAEzD,IAAIiB,eAAepE,SAAS,GAAGiF,mBAAmBhE,KAAK,EAAEyB,OAAO,EAAEgC,MAAMN,eAAe,EAAE,CAAC;CAC1F,MAAMe,cAAuC,EAAEP,MAAMK,mBAAmB;CAExE,MAAMG,qBAAgD;EACpD,EAAExB,OAAO;EACT,EAAEW,YAAY,EAAEC,SAAS,MAAM,EAAE;EACjC,EAAEC,QAAQ,EAAED,SAAS,MAAM,EAAE;EAC7BpG,qBAAqB+E,SAAS,QAAQ,gBAAgB;CAAC;CAEzD,IAAIiB,eAAepE,SAAS,GAAGoF,mBAAmBnE,KAAK,EAAEyB,OAAO,EAAEgC,MAAMN,eAAe,EAAE,CAAC;CAC1F,MAAMiB,cAAuC,EAAET,MAAMQ,mBAAmB;CAExE,MAAM,CAACE,aAAaC,eAAe,MAAMC,QAAQC,IAAI,CACnDpB,kBAAkBqB,eAAeL,WAAW,GAC5ChB,kBAAkBqB,eAAeP,WAAW,CAAC,CAC9C;CAED,MAAMQ,MAAM3B,2BAAW,IAAI7E,KAAK,IAAI;CACpC,IAAIwG,OAAOJ,cAAc,GACvB,MAAMlB,kBAAkBuB,WAAWT,aAAa,EAAEU,MAAM,EAAEX,QAAQS,IAAI,EAAE,CAAC;CAG3E,OAAA,mBAAwCI,MAAM;EAC5C9C,IAAI;EACJ4B,eAAeA,cAAcrC,KAAKwD,OAAO;GACvCC,IAAIC,OAAOF,EAAEtH,GAAG;GAChBgE,OAAO,OAAOsD,EAAEtD,UAAU,WAAWsD,EAAEtD,QAAQrD,KAAAA;GAC/C8G,KAAK,OAAOH,EAAEG,QAAQ,WAAWH,EAAEG,MAAM9G,KAAAA;GACzC+G,YAAY,OAAOJ,EAAEI,eAAe,WAAWJ,EAAEI,aAAa/G,KAAAA;GAC9DgH,OAAO,OAAOL,EAAEK,UAAU,WAAWL,EAAEK,QAAQ;GAC/CC,MAAM,OAAON,EAAEM,SAAS,WAAWN,EAAEM,OAAOjH,KAAAA;GAC5CkH,OAAO,OAAOP,EAAEO,UAAU,WAAWP,EAAEO,QAAQlH,KAAAA;GAC/C2B,MAAMrB,YAAYqG,EAAEhF,IAAI;GACxBI,UAAU9B,SAAS0G,EAAE5E,QAAQ,IAAI4E,EAAE5E,WAAW/B,KAAAA;GAC9C2F,WAAW/F,MAAM+G,EAAEhB,SAAS,sBAAK,IAAI7F,KAAK,EAAA,CAAEC,YAAY;GACxD8F,QAAQjG,MAAM+G,EAAEd,MAAM,MAAMS,OAAO,CAACK,EAAEzB,cAAc,CAACyB,EAAEd,SAASS,IAAIvG,YAAY,IAAIC,KAAAA;GACpFoF,QAAQxF,MAAM+G,EAAEvB,MAAM;GACtBF,YAAYtF,MAAM+G,EAAEzB,UAAU;EAChC,EAAE;EACFe;EACAC,aAAaI,MAAM,IAAIJ;CACzB,CAAC;AACH;AAEA,IAAMiB,mCAAwH,OAC5HzD,SACAxC,QACG;CACH,MAAMyC,UAAUzE,eAAegC,GAAG;CAClC,IAAI,CAACyC,SACH,OAAO;EAAEC,IAAI;EAAOC,OAAO;CAAe;CAG5C,MAAMC,UAAUhF,wBAAwB;EAAEiF,UAAUJ,QAAQI;EAAUJ,SAASzC,IAAIE,IAAIuC;CAAQ,CAAC;CAChG,IAAI,CAACG,QAAQE,IAAI,UAAU,gBAAgB,GAAG;EAC5C9C,IAAI+C,IAAIC,OAAO,GAAG;EAClB,OAAO;GAAEN,IAAI;GAAOC,OAAO;EAAY;CACzC;CAEA,MAAMM,SAAAA,oBAA2CE,UAAUX,OAAO;CAClE,IAAI,CAACS,OAAOG,SAAS;EACnBpD,IAAI+C,IAAIC,OAAO,GAAG;EAClB,OAAO;GAAEN,IAAI;GAAOC,OAAO;EAAkB;CAC/C;CAEA,MAAMxB,SAASpB,iBAAiBC,GAAG;CACnC,MAAMqG,aAAapD,OAAOxC,KAAK6F,MAC3BrI,gCAA8CgF,OAAOxC,KAAK6F,KAAKnF,QAAQ8B,OAAOxC,KAAKhC,OAAO,KAAKK,KAAAA,IAC/FA,KAAAA;CACJ,IAAImE,OAAOxC,KAAK6F,OAAO,CAACD,YAAY;EAClCrG,IAAI+C,IAAIC,OAAO,GAAG;EAClB,OAAO;GAAEN,IAAI;GAAOC,OAAO;EAAkB;CAC/C;CAEA,MAAM6D,UAAU,MAAM1I,mBAAmBkC,KAAK;EAC5CqD,QAAQZ,QAAQY;EAChBlB,OAAOc,OAAOxC,KAAK0B;EACnByD,KAAK3C,OAAOxC,KAAKmF;EACjBE,OAAO7C,OAAOxC,KAAKqF;EACnBC,MAAM9C,OAAOxC,KAAKsF;EAClBC,OAAO/C,OAAOxC,KAAKuF;EACnBM,KAAKD;EACL5H,SAASwE,OAAOxC,KAAKhC;EACrBgI,UAAUxD,OAAOxC,KAAKgG;EACtBhG,MAAMwC,OAAOxC,KAAKA;EAClBI,UAAUoC,OAAOxC,KAAKI;CACxB,GAAG+B,OAAO;CAEV,OAAA,qBAA0C4C,MAAM;EAAE9C,IAAI;EAAMgD,IAAIc,QAAQd;CAAG,CAAC;AAC9E;AAEA,IAAMiB,WAAuE,OAC3EE,UACA7G,QACG;CACH,MAAMyC,UAAUzE,eAAegC,GAAG;CAClC,IAAI,CAACyC,SACH,OAAO;EAAEC,IAAI;EAAOC,OAAO;CAAe;CAG5C,MAAMC,UAAUhF,wBAAwB;EAAEiF,UAAUJ,QAAQI;EAAUJ,SAASzC,IAAIE,IAAIuC;CAAQ,CAAC;CAChG,IAAI,CAACG,QAAQE,IAAI,UAAU,gBAAgB,GAAG;EAC5C9C,IAAI+C,IAAIC,OAAO,GAAG;EAClB,OAAO;GAAEN,IAAI;GAAOC,OAAO;EAAY;CACzC;CAEA,MAAMmE,iBAAiB,OAAO9G,IAAIE,IAAI6G,OAAOD,mBAAmB,WAAW9G,IAAIE,IAAI6G,OAAOD,eAAehH,KAAK,IAAI;CAClH,IAAI,CAACgH,gBAAgB;EACnB9G,IAAI+C,IAAIC,OAAO,GAAG;EAClB,OAAO;GAAEN,IAAI;GAAOC,OAAO;EAA0B;CACvD;CAEA,MAAMmB,oBAAoB,MAAMrG,OAAO4C,IAAI,kBAAkB;EAAEH,KAAKF,IAAIE;EAAK0C;CAAQ,CAAC;CACtF,MAAMwC,sBAAM,IAAIxG,KAAK;CAErB,IAAI;EACF,MAAMkF,kBAAkBkD,UACtB,EAAE3C,MAAM;GAAC,EAAElG,KAAK2I,eAAe;GAAG,EAAE9C,YAAY,EAAEC,SAAS,MAAM,EAAE;GAAGpG,qBAAqB+E,SAAS,UAAU,gBAAgB;EAAC,EAAE,GACjI,EAAE0C,MAAM;GAAEpB,QAAQkB;GAAKT,QAAQS;EAAI,EAAE,CACvC;CACF,QAAQ;EACNpF,IAAI+C,IAAIC,OAAO,GAAG;EAClB,OAAO;GAAEN,IAAI;GAAOC,OAAO;EAA0B;CACvD;CAEA,OAAO,EAAED,IAAI,KAAK;AACpB;AAEA,IAAMuE,gBAAmH,OACvHzE,SACAxC,QACG;CACH,MAAMyC,UAAUzE,eAAegC,GAAG;CAClC,IAAI,CAACyC,SACH,OAAO;EAAEC,IAAI;EAAOC,OAAO;CAAe;CAG5C,MAAMC,UAAUhF,wBAAwB;EAAEiF,UAAUJ,QAAQI;EAAUJ,SAASzC,IAAIE,IAAIuC;CAAQ,CAAC;CAChG,IAAI,CAACG,QAAQE,IAAI,UAAU,gBAAgB,GAAG;EAC5C9C,IAAI+C,IAAIC,OAAO,GAAG;EAClB,OAAO;GAAEN,IAAI;GAAOC,OAAO;EAAY;CACzC;CAEA,MAAMM,SAAAA,2BAAkDE,UAAUX,OAAO;CACzE,IAAI,CAACS,OAAOG,SAAS;EACnBpD,IAAI+C,IAAIC,OAAO,GAAG;EAClB,OAAO;GAAEN,IAAI;GAAOC,OAAO;EAAkB;CAC/C;CAEA,MAAMxB,SAASpB,iBAAiBC,GAAG;CACnC,MAAMkB,YAAYjD,+BAA6CgF,OAAOxC,KAAK6F,KAAKnF,MAAM;CACtF,IAAI,CAACD,WAAW;EACdlB,IAAI+C,IAAIC,OAAO,GAAG;EAClB,OAAO;GAAEN,IAAI;GAAOC,OAAO;EAAkB;CAC/C;CAEA,MAAMmB,oBAAoB,MAAMrG,OAAO4C,IAAI,kBAAkB;EAAEH,KAAKF,IAAIE;EAAK0C;CAAQ,CAAC;CACtF,MAAMwB,QAAiC,EACrCC,MAAM;EACJ,EAAEhB,QAAQZ,QAAQY,OAAO;EACzB,EAAEW,YAAY,EAAEC,SAAS,MAAM,EAAE;EACjC,EAAEC,QAAQ,EAAED,SAAS,MAAM,EAAE;EAC7B,EACEoD,KAAK,CACH,EAAE,aAAa,EAAEC,OAAO,SAAS,EAAE,GACnC,EAAE,oCAAoC,EAAEA,OAAO,SAAS,EAAE,CAAC,EAE/D;EACAzJ,qBAAqB+E,SAAS,UAAU,gBAAgB;CAAC,EAE7D;CAMA,MAAM6E,eAAcF,MAJMzD,kBAAkBS,KAAKH,KAAK,CAAC,CACpDoD,OAAO;EAAErJ,KAAK;EAAGsC,MAAM;EAAGI,UAAU;CAAE,CAAC,CAAC,CACxC+C,KAAK,EAAA,CAGLrE,QAAQgB,iBACPD,2BAA2BC,YAAY,CAAC,CAACmH,MAAMpG,WAC7CM,iCAAiCN,QAAQJ,WAAWC,MAAM,CAC5D,CACF,CAAC,CACAc,KAAK1B,iBAAiBA,aAAapC,GAAG;CAEzC,IAAIsJ,YAAYhI,WAAW,GACzB,OAAA,4BAAiD+F,MAAM;EACrD9C,IAAI;EACJkF,cAAc;EACdC,eAAe;CACjB,CAAC;CAGH,MAAMzC,sBAAM,IAAIxG,KAAK;CACrB,MAAMkJ,SAAS,MAAMhE,kBAAkBuB,WACrC,EACEhB,MAAM;EACJ,EAAElG,KAAK,EAAE4J,KAAKN,YAAY,EAAE;EAC5B,EAAEpE,QAAQZ,QAAQY,OAAO;EACzB,EAAEW,YAAY,EAAEC,SAAS,MAAM,EAAE;EACjC,EAAEC,QAAQ,EAAED,SAAS,MAAM,EAAE;EAC7BpG,qBAAqB+E,SAAS,UAAU,gBAAgB;CAAC,EAE7D,GACA,EAAE0C,MAAM;EAAEpB,QAAQkB;EAAKT,QAAQS;CAAI,EAAE,CACvC;CAEA,MAAMyC,gBAAgB,OAAOC,OAAOD,kBAAkB,WAAWC,OAAOD,gBAAgBJ,YAAYhI;CAEpG,OAAA,4BAAiD+F,MAAM;EACrD9C,IAAI;EACJkF,cAAcH,YAAYhI;EAC1BoI;CACF,CAAC;AACH;AAEA,IAAMG,cAA6E,OACjFnB,UACA7G,QACG;CACH,MAAMyC,UAAUzE,eAAegC,GAAG;CAClC,IAAI,CAACyC,SACH,OAAO;EAAEC,IAAI;EAAOC,OAAO;CAAe;CAG5C,MAAMC,UAAUhF,wBAAwB;EAAEiF,UAAUJ,QAAQI;EAAUJ,SAASzC,IAAIE,IAAIuC;CAAQ,CAAC;CAChG,IAAI,CAACG,QAAQE,IAAI,UAAU,gBAAgB,GAAG;EAC5C9C,IAAI+C,IAAIC,OAAO,GAAG;EAClB,OAAO;GAAEN,IAAI;GAAOC,OAAO;EAAY;CACzC;CAIA,MAAMkB,iBAAiB/B,oBAAoBC,OADnB2B,MADIjG,OAAO4C,IAAI,0BAA0B;EAAEH,KAAKF,IAAIE;EAAK0C;CAAQ,CAAC,EAAA,CACpDe,QAAQ,EAAEN,QAAQZ,QAAQY,OAAO,CAAC,CAAC,CAACO,KAAK,GAC1B,OAAO;CAE5D,MAAME,oBAAoB,MAAMrG,OAAO4C,IAAI,kBAAkB;EAAEH,KAAKF,IAAIE;EAAK0C;CAAQ,CAAC;CAEtF,MAAMmB,eAA0C;EAC9C,EAAEV,QAAQZ,QAAQY,OAAO;EACzB,EAAEW,YAAY,EAAEC,SAAS,MAAM,EAAE;EACjC,EAAEC,QAAQ,EAAED,SAAS,MAAM,EAAE;EAC7BpG,qBAAqB+E,SAAS,UAAU,gBAAgB;CAAC;CAE3D,IAAIiB,eAAepE,SAAS,GAAGsE,aAAarD,KAAK,EAAEyB,OAAO,EAAEgC,MAAMN,eAAe,EAAE,CAAC;CACpF,MAAMO,QAAiC,EAAEC,MAAMN,aAAa;CAE5D,MAAMqB,sBAAM,IAAIxG,KAAK;CACrB,MAAMkF,kBAAkBuB,WAAWjB,OAAO,EAAEkB,MAAM;EAAEpB,QAAQkB;EAAKT,QAAQS;CAAI,EAAE,CAAC;CAEhF,OAAO,EAAE1C,IAAI,KAAK;AACpB;AAEA,IAAMwF,sBAAiF,OACrFrB,UACA7G,QACG;CACH,MAAMyC,UAAUzE,eAAegC,GAAG;CAClC,IAAI,CAACyC,SACH,OAAO;EAAEC,IAAI;EAAOC,OAAO;CAAe;CAG5C,MAAMC,UAAUhF,wBAAwB;EAAEiF,UAAUJ,QAAQI;EAAUJ,SAASzC,IAAIE,IAAIuC;CAAQ,CAAC;CAChG,IAAI,CAACG,QAAQE,IAAI,UAAU,gBAAgB,GAAG;EAC5C9C,IAAI+C,IAAIC,OAAO,GAAG;EAClB,OAAO;GAAEN,IAAI;GAAOC,OAAO;EAAY;CACzC;CAEA,MAAMmE,iBAAiB,OAAO9G,IAAIE,IAAI6G,OAAOD,mBAAmB,WAAW9G,IAAIE,IAAI6G,OAAOD,eAAehH,KAAK,IAAI;CAClH,IAAI,CAACgH,gBAAgB;EACnB9G,IAAI+C,IAAIC,OAAO,GAAG;EAClB,OAAO;GAAEN,IAAI;GAAOC,OAAO;EAA0B;CACvD;CAEA,MAAMmB,oBAAoB,MAAMrG,OAAO4C,IAAI,kBAAkB;EAAEH,KAAKF,IAAIE;EAAK0C;CAAQ,CAAC;CAEtF,IAAI;EACF,MAAMkB,kBAAkBkD,UACtB,EAAE3C,MAAM;GAAC,EAAElG,KAAK2I,eAAe;GAAG,EAAE9C,YAAY,EAAEC,SAAS,MAAM,EAAE;GAAGpG,qBAAqB+E,SAAS,UAAU,gBAAgB;EAAC,EAAE,GACjI,EAAE0C,MAAM;GAAEtB,4BAAY,IAAIpF,KAAK;GAAGwJ,cAAc;EAAM,EAAE,CAC1D;CACF,QAAQ;EACNpI,IAAI+C,IAAIC,OAAO,GAAG;EAClB,OAAO;GAAEN,IAAI;GAAOC,OAAO;EAA0B;CACvD;CAEA,OAAO,EAAED,IAAI,KAAK;AACpB;AAEA,IAAM2F,cAA0E,OAC9ExB,UACA7G,QACG;CACH,MAAMyC,UAAUzE,eAAegC,GAAG;CAClC,IAAI,CAACyC,SACH,OAAO;EAAEC,IAAI;EAAOC,OAAO;CAAe;CAG5C,MAAMC,UAAUhF,wBAAwB;EAAEiF,UAAUJ,QAAQI;EAAUJ,SAASzC,IAAIE,IAAIuC;CAAQ,CAAC;CAChG,IAAI,CAACG,QAAQE,IAAI,QAAQ,wBAAwB,GAAG;EAClD9C,IAAI+C,IAAIC,OAAO,GAAG;EAClB,OAAO;GAAEN,IAAI;GAAOC,OAAO;EAAY;CACzC;CAGA,MAAMZ,WAAY,OAAM2B,MADIjG,OAAO4C,IAAI,0BAA0B;EAAEH,KAAKF,IAAIE;EAAK0C;CAAQ,CAAC,EAAA,CACpDe,QACpC,EAAEU,MAAM,CAAC,EAAEhB,QAAQZ,QAAQY,OAAO,GAAGxF,qBAAqB+E,SAAS,QAAQ,wBAAwB,CAAC,EAAE,CACxG,CAAC,CAACgB,KAAK;CAEP,MAAM2E,qBAAqB,OAAOxG,UAAUyG,oBAAoB,WAAWzG,SAASyG,kBAAkB;CACtG,MAAMA,kBACJD,uBAAuB,SAASA,uBAAuB,WAAWA,uBAAuB,WACrFA,qBACA;CAEN,MAAMvG,mBAAmB9C,MAAMC,QAAQ4C,UAAUC,gBAAgB,IAC7DD,SAAUC,iBAAiBC,KAAKC,UAAU;EAC1CC,OAAO,OAAOD,KAAKC,UAAU,WAAWD,KAAKC,QAAQ;EACrDuG,OAAOxG,KAAKwG,UAAU;EACtBC,aAAazG,KAAKyG,gBAAgB;EAClCjI,MAAMwB,KAAKxB,SAAS;CACtB,EAAE,CAAC,CAACnB,QAAQ2C,SAASA,KAAKC,MAAM1C,SAAS,CAAC,IACxC,CAAA;CAEJ,OAAA,uBAA4C+F,MAAM;EAChD9C,IAAI;EACJX,UAAU;GACRyG;GACAxG;GACA6G,kBAAkBnK,MAAMqD,UAAU8G,gBAAgB;EACpD;CACF,CAAC;AACH;AAEA,IAAMC,iBAAsH,OAC1HtG,SACAxC,QACG;CACH,MAAMyC,UAAUzE,eAAegC,GAAG;CAClC,IAAI,CAACyC,SACH,OAAO;EAAEC,IAAI;EAAOC,OAAO;CAAe;CAG5C,MAAMC,UAAUhF,wBAAwB;EAAEiF,UAAUJ,QAAQI;EAAUJ,SAASzC,IAAIE,IAAIuC;CAAQ,CAAC;CAChG,IAAI,CAACG,QAAQE,IAAI,UAAU,wBAAwB,GAAG;EACpD9C,IAAI+C,IAAIC,OAAO,GAAG;EAClB,OAAO;GAAEN,IAAI;GAAOC,OAAO;EAAY;CACzC;CAEA,MAAMM,SAAAA,4BAAmDE,UAAUX,OAAO;CAC1E,IAAI,CAACS,OAAOG,SAAS;EACnBpD,IAAI+C,IAAIC,OAAO,GAAG;EAClB,OAAO;GAAEN,IAAI;GAAOC,OAAO;EAAkB;CAC/C;CAEA,MAAMe,gBAAgB,MAAMjG,OAAO4C,IAAI,0BAA0B;EAAEH,KAAKF,IAAIE;EAAK0C;CAAQ,CAAC;CAC1F,MAAMsG,aAAsC,CAAC;CAE7C,IAAIjG,OAAOxC,KAAK+H,iBACdU,WAAWV,kBAAkBvF,OAAOxC,KAAK+H;CAG3C,IAAIvF,OAAOxC,KAAKuB,kBAAkB;EAChC,MAAMmH,uBAAO,IAAIC,IAAY;EAe7BF,WAAWlH,mBAdEiB,OAAOxC,KAAKuB,iBACtBC,KAAKC,UAAU;GACdC,OAAOD,KAAKC,MAAMrC,KAAK;GACvB4I,OAAOxG,KAAKwG;GACZC,aAAazG,KAAKyG;GAClBjI,MAAMwB,KAAKxB;EACb,EAAE,CAAC,CACFnB,QAAQ2C,SAASA,KAAKC,MAAM1C,SAAS,CAAC,CAAC,CACvCF,QAAQ2C,SAAS;GAChB,IAAIiH,KAAKG,IAAIpH,KAAKC,KAAK,GAAG,OAAO;GACjCgH,KAAKI,IAAIrH,KAAKC,KAAK;GACnB,OAAO;EACT,CAE4BkH;CAChC;CAEA,MAAMG,MAA+B,EACnCC,cAAc,EAAEpG,QAAQZ,QAAQY,OAAO,EACzC;CAEA,IAAI/D,OAAOqC,KAAKuH,UAAU,CAAC,CAACzJ,SAAS,GACnC+J,IAAIlE,OAAO4D;CAGb,MAAMnH,WAAY,MAAM2B,cAAcgG,iBACpC,EAAErF,MAAM,CAAC,EAAEhB,QAAQZ,QAAQY,OAAO,GAAGxF,qBAAqB+E,SAAS,UAAU,wBAAwB,CAAC,EAAE,GACxG4G,KACA;EAAEG,QAAQ;EAAMC,gBAAgB;EAASC,qBAAqB;CAAK,CACrE,CAAC,CAACjG,KAAK;CAEP,MAAM2E,qBAAqB,OAAOxG,UAAUyG,oBAAoB,WAAWzG,SAASyG,kBAAkB;CACtG,MAAMA,kBACJD,uBAAuB,SAASA,uBAAuB,WAAWA,uBAAuB,WACrFA,qBACA;CAEN,MAAMvG,mBAAmB9C,MAAMC,QAAQ4C,UAAUC,gBAAgB,IAC7DD,SAAUC,iBAAiBC,KAAKC,UAAU;EAC1CC,OAAO,OAAOD,KAAKC,UAAU,WAAWD,KAAKC,QAAQ;EACrDuG,OAAOxG,KAAKwG,UAAU;EACtBC,aAAazG,KAAKyG,gBAAgB;EAClCjI,MAAMwB,KAAKxB,SAAS;CACtB,EAAE,CAAC,CAACnB,QAAQ2C,SAASA,KAAKC,MAAM1C,SAAS,CAAC,IACxC,CAAA;CAEJ,OAAA,6BAAkD+F,MAAM;EACtD9C,IAAI;EACJX,UAAU;GACRyG;GACAxG;GACA6G,kBAAkBnK,MAAMqD,UAAU8G,gBAAgB;EACpD;CACF,CAAC;AACH;AAEA,IAAMkB,YAAuG,OAC3GvH,SACAxC,QACG;CACH,MAAMyC,UAAUzE,eAAegC,GAAG;CAClC,IAAI,CAACyC,SACH,OAAO;EAAEC,IAAI;EAAOC,OAAO;CAAe;CAG5C,MAAMC,UAAUhF,wBAAwB;EAAEiF,UAAUJ,QAAQI;EAAUJ,SAASzC,IAAIE,IAAIuC;CAAQ,CAAC;CAChG,IAAI,CAACG,QAAQE,IAAI,QAAQ,gBAAgB,GAAG;EAC1C9C,IAAI+C,IAAIC,OAAO,GAAG;EAClB,OAAO;GAAEN,IAAI;GAAOC,OAAO;EAAY;CACzC;CAEA,MAAMM,SAAAA,uBAA8CE,UAAUX,OAAO;CACrE,IAAI,CAACS,OAAOG,SAAS;EACnBpD,IAAI+C,IAAIC,OAAO,GAAG;EAClB,OAAO;GAAEN,IAAI;GAAOC,OAAO;EAAkB;CAC/C;CAEA,MAAMmF,SAAS,MAAM/J,+BAA+BiC,KAAK;EACvDqD,QAAQZ,QAAQY;EAChBT;EACAuH,OAAOlH,OAAOxC,KAAK0J,UAAU;CAC/B,CAAC;CAED,IAAI,CAACrC,OAAOpF,IAAI;EACd1C,IAAI+C,IAAIC,OAAO,GAAG;EAClB,OAAO;GAAEN,IAAI;GAAOC,OAAOmF,OAAOnF;EAAM;CAC1C;CAEA,OAAO;EACLD,IAAI;EACJ0H,MAAMtC,OAAOsC;EACb,GAAItC,OAAOuC,gBAAgB,EAAEA,eAAevC,OAAOuC,cAAc,IAAI,CAAC;CACxE;AACF;AAEA,IAAA,mBAAgBC,QAAa;CAC3BA,IAAIC,KAAKtM,WAAyBoE,iBAAiB;CACnDiI,IAAIC,KAAKtM,aAA2BgI,gCAAgC;CACpEqE,IAAIC,KAAKtM,eAA6B0I,QAAQ;CAC9C2D,IAAIC,KAAKtM,oBAAkCgJ,aAAa;CACxDqD,IAAIC,KAAKtM,kBAAgC+J,WAAW;CACpDsC,IAAIC,KAAKtM,cAA4BiK,mBAAmB;CACxDoC,IAAIjK,IAAIpC,eAA6BoK,WAAW;CAChDiC,IAAIS,IAAI9M,eAA6B6K,cAAc;CACnDwB,IAAIC,KAAKtM,gBAA8B8L,SAAS;AAClD"}

package/dist/handler-CqSlSCdd.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"handler-CqSlSCdd.js","names":["JSDOM","createDOMPurify","UploadFileProcessor","MAX_SVG_BYTES","window","DOMPurify","normalizeForSniff","raw","replace","trimStart","looksLikeSvgText","text","normalized","startsWith","test","looksLikeSvg","sniff","Buffer","toString","sanitizeSvg","svg","sanitize","USE_PROFILES","svgFilters","sanitizeSvgProcessor","id","maxBytes","match","process","data","mimeType","length","Error","svgText","sanitized","trim","sanitizedBuffer","from","convertHeifToWebpProcessor","sanitizeSvgProcessor","UploadFileProcessorContext","filename","clientMimeType","totalSize","sniff","Buffer","UploadFileProcessorResult","data","mimeType","metadata","Record","UploadFileProcessor","id","maxBytes","match","ctx","process","Promise","uploadProcessors","Object","freeze","getMaxUploadProcessorBytes","reduce","max","processor","Math","selectUploadProcessors","filter","applyUploadProcessors","Omit","applied","currentData","currentFilename","currentMimeType","processorCtx","length","Error","result","trim","assign","push","createHash","ApiHandler","getTenantFilesystemDb","models","GridFSBucket","ObjectId","Model","Uploads","claimUploadFileReference","createUploadFileReference","enqueueUploadPostProcessors","applyUploadProcessors","getMaxUploadProcessorBytes","selectUploadProcessors","SessionUser","UploadChunkDoc","UploadSessionDoc","buildUploadAccessMetadata","buildUploadsAbility","ensureFilesystemUploadIndexes","ensureUploadIndexes","getBucketName","getModelCtx","getUploadSessionAccessQuery","getTenantId","resolveUploadAccessScope","waitForStreamFinished","stream","NodeJS","WritableStream","Promise","resolve","reject","once","writeToStream","chunk","Buffer","ok","write","onDrain","cleanup","onError","error","off","on","abortUploadStream","abort","destroy","isDuplicateKeyError","code","completeUpload","Record","CompleteResponsePayload","_payload","ctx","tenantId","res","status","uploadId","String","req","params","trim","ability","modelCtx","UploadSession","UploadChunk","all","get","can","existing","findOne","$and","_id","lean","fileId","deduplicated","locked","findOneAndUpdate","$set","$unset","returnDocument","fsDb","nativeDb","db","updateOne","bucketName","bucket","deduplication","lockedUserId","userId","undefined","accessMetadata","unclaimedDeduplication","namespace","algorithm","hash","pipelineVersion","createFileMetadata","storedMimeType","storedSize","additional","mimeType","totalSize","maxProcessorBytes","shouldBufferForProcessing","declaredMimeType","toLowerCase","declaredSvg","filename","endsWith","uploadStream","finalFilename","finalMimeType","finalSize","inlineProcessors","finalMetadata","Error","cursor","find","sort","index","AsyncIterable","close","expectedIndex","sourceBytes","sourceHasher","chunks","bufferedBytes","pendingChunks","sniffParts","sniffBytes","chunkDoc","data","length","update","push","slice","subarray","Math","min","sniff","concat","processors","clientMimeType","some","processor","id","openUploadStream","metadata","pending","chunksTotal","digest","assembled","processed","processedFilename","processedMimeType","applied","processedMetadata","sourceTotalSize","finished","end","uploadedBlobId","resolvedBlobId","returnedFileId","filesCollection","collection","uploadedBlobObjectId","referenceOptions","accessScope","isPublic","ownerKeyHash","lastDuplicateKeyError","attempt","blobId","canonicalFile","key","projection","canonicalReferenceId","deduplicationKey","delete","toHexString","catch","console","deleteMany","message","startsWith","ApiHandler","models","Model","Uploads","SessionUser","UploadChunkDoc","UploadSessionDoc","buildUploadsAbility","getModelCtx","getUploadSessionAccessQuery","getTenantId","getStatus","Record","StatusResponsePayload","_payload","ctx","Promise","tenantId","res","status","ok","error","uploadId","String","req","params","trim","ability","modelCtx","UploadSession","UploadChunk","all","get","can","session","findOne","$and","_id","lean","receivedDocs","find","index","sort","received","Array","map","doc","filter","n","Number","isInteger","chunkSize","chunksTotal","fileId","z","InitRoute","ChunkRoute","StatusRoute","CompleteRoute","uploadAccessScopeSchema","enum","uploadDeduplicationSchema","object","namespace","string","trim","min","max","regex","algorithm","literal","hash","initRequestSchema","filename","mimeType","isPublic","boolean","optional","accessScope","deduplication","totalSize","number","int","superRefine","value","ctx","undefined","addIssue","code","message","path","InitRequestPayload","infer","initResponseSchema","ok","error","uploadId","uploadKey","chunkSize","chunksTotal","fileId","deduplicated","InitResponsePayload","statusResponseSchema","status","received","array","StatusResponsePayload","completeResponseSchema","CompleteResponsePayload","randomBytes","ApiHandler","getTenantFilesystemDb","models","ObjectId","Model","Uploads","createUploadFileReference","SessionUser","UploadChunkDoc","UploadSessionDoc","buildUploadDeduplication","buildUploadsAbility","computeSha256Hex","ensureFilesystemUploadIndexes","ensureUploadIndexes","getBucketName","getChunkSizeBytes","getModelCtx","getSessionTtlMs","getTenantId","getUserId","resolveUploadAccessScope","initUpload","InitRequestPayload","InitResponsePayload","payload","ctx","Promise","tenantId","res","status","ok","error","userId","parsed","initRequestSchema","safeParse","success","filename","mimeType","totalSize","isPublic","deduplication","requestedDeduplication","data","accessScope","uploadKey","toString","ownerKeyHash","Buffer","from","undefined","namespace","hash","fsDb","nativeDb","db","bucketName","existingFile","collection","findOne","key","projection","_id","length","metadata","existingMetadata","Record","existingMimeType","existingSize","fileId","blobId","deduplicationKey","deduplicated","chunkSize","chunksTotal","Math","ceil","ability","modelCtx","UploadSession","UploadChunk","all","get","uploadId","now","Date","expiresAt","create","createdAt","ApiHandler","models","Model","SessionUser","UploadChunkDoc","UploadSessionDoc","buildUploadsAbility","computeSha256Hex","ensureUploadIndexes","getModelCtx","getUploadSessionAccessQuery","getTenantId","normalizeSha256Hex","toBufferPayload","ChunkResponsePayload","ok","error","uploadChunk","Buffer","payload","ctx","Promise","tenantId","res","status","uploadId","String","req","params","trim","indexRaw","index","Number","isInteger","ability","modelCtx","UploadSession","UploadChunk","all","get","can","session","findOne","$and","_id","lean","chunksTotal","data","expectedSize","totalSize","chunkSize","length","checksumHeader","sha256","undefined","expectedSha256","updateOne","$set","size","expiresAt","$setOnInsert","createdAt","Date","upsert","rawBodyParser","limitBytes","maxClientBytesPerSecond","req","res","next","contentType","headers","String","includes","total","chunks","Buffer","done","paused","throttleTimeout","ReturnType","setTimeout","rateBytesPerSecond","cleanup","off","onData","onEnd","onError","onAborted","clearTimeout","finish","error","body","concat","chunk","buffer","isBuffer","from","length","destroy","status","json","ok","push","now","Date","clientKey","getClientKey","state","getClientRateState","waitMs","consumeRateBudget","pause","resume","err","Error","on","ClientRateState","tokens","lastRefillMs","lastSeenMs","MAX_BURST_SECONDS","STALE_CLIENT_MS","clientRateStates","Map","lastCleanupMs","rawClientIp","clientIp","trim","rawIp","ip","maybeCleanupStates","size","key","delete","capacity","existing","get","Math","min","set","bytes","elapsedMs","max","ceil","Api","completeUpload","getStatus","initUpload","uploadChunk","rawBodyParser","getChunkSizeBytes","getMaxClientUploadBytesPerSecond","getRawBodyLimitBytes","SessionUser","Uploads","api","chunkSizeBytes","use","InitRoute","limitBytes","maxClientBytesPerSecond","post","put","ChunkRoute","get","StatusRoute","CompleteRoute"],"sources":["../src/uploads/api/file-uploads/processors/sanitizeSvg.ts","../src/uploads/api/file-uploads/processors/index.ts","../src/uploads/api/file-uploads/handlers/completeUpload.ts","../src/uploads/api/file-uploads/handlers/getStatus.ts","../src/uploads/api/file-uploads/index.ts","../src/uploads/api/file-uploads/handlers/initUpload.ts","../src/uploads/api/file-uploads/handlers/uploadChunk.ts","../src/uploads/api/file-uploads/middleware/rawBodyParser.ts","../src/uploads/api/file-uploads/handler.ts"],"sourcesContent":["import { JSDOM } from \"jsdom\"\nimport createDOMPurify from \"dompurify\"\n\nimport type { UploadFileProcessor } from \"./index\"\n\n\nconst MAX_SVG_BYTES = 128 * 1024\n\nconst window = new JSDOM(\"\").window\nconst DOMPurify = createDOMPurify(window)\n\nconst normalizeForSniff = (raw: string): string => raw.replace(/^\\uFEFF/, \"\").trimStart()\n\nconst looksLikeSvgText = (text: string): boolean => {\n  const normalized = normalizeForSniff(text)\n  if (!normalized.startsWith(\"<\")) return false\n  return /<svg(?:\\s|>)/i.test(normalized)\n}\n\nexport const looksLikeSvg = (sniff: Buffer): boolean => looksLikeSvgText(sniff.toString(\"utf8\"))\n\nexport const sanitizeSvg = (svg: string): string =>\n  DOMPurify.sanitize(svg, {\n    USE_PROFILES: { svg: true, svgFilters: true },\n  })\n\nexport const sanitizeSvgProcessor: UploadFileProcessor = {\n  id: \"sanitize-svg\",\n  maxBytes: MAX_SVG_BYTES,\n  match: ({ sniff }) => looksLikeSvg(sniff),\n  process: (data): { data: Buffer; mimeType: string } => {\n    if (data.length > MAX_SVG_BYTES) {\n      throw new Error(\"svg_too_large\")\n    }\n\n    const svgText = data.toString(\"utf8\")\n    if (!looksLikeSvgText(svgText)) {\n      throw new Error(\"svg_invalid\")\n    }\n\n    const sanitized = sanitizeSvg(svgText)\n    if (!sanitized.trim() || !looksLikeSvgText(sanitized)) {\n      throw new Error(\"svg_sanitize_failed\")\n    }\n\n    const sanitizedBuffer = Buffer.from(sanitized, \"utf8\")\n    if (sanitizedBuffer.length > MAX_SVG_BYTES) {\n      throw new Error(\"svg_too_large\")\n    }\n\n    return { data: sanitizedBuffer, mimeType: \"image/svg+xml\" }\n  },\n}\n\n","import { convertHeifToWebpProcessor } from \"./convertHeifToWebp\"\nimport { sanitizeSvgProcessor } from \"./sanitizeSvg\"\n\n\nexport type UploadFileProcessorContext = {\n  filename: string\n  clientMimeType: string\n  totalSize: number\n  sniff: Buffer\n}\n\nexport type UploadFileProcessorResult = {\n  data: Buffer\n  filename?: string\n  mimeType?: string\n  metadata?: Record<string, unknown>\n}\n\nexport type UploadFileProcessor = {\n  id: string\n  maxBytes: number\n  match: (ctx: UploadFileProcessorContext) => boolean\n  process: (data: Buffer, ctx: UploadFileProcessorContext) => Promise<UploadFileProcessorResult> | UploadFileProcessorResult\n}\n\nexport const uploadProcessors = Object.freeze([sanitizeSvgProcessor, convertHeifToWebpProcessor] satisfies UploadFileProcessor[])\n\nexport const getMaxUploadProcessorBytes = (): number =>\n  uploadProcessors.reduce((max, processor) => Math.max(max, processor.maxBytes), 0)\n\nexport const selectUploadProcessors = (ctx: UploadFileProcessorContext): UploadFileProcessor[] =>\n  uploadProcessors.filter((processor) => processor.match(ctx))\n\nexport const applyUploadProcessors = async (\n  data: Buffer,\n  ctx: Omit<UploadFileProcessorContext, \"sniff\" | \"totalSize\">,\n): Promise<{ data: Buffer; filename: string; mimeType: string; applied: string[]; metadata: Record<string, unknown> }> => {\n  let currentData = data\n  let currentFilename = ctx.filename\n  let currentMimeType = ctx.clientMimeType\n  const applied: string[] = []\n  const metadata: Record<string, unknown> = {}\n\n  for (const processor of uploadProcessors) {\n    const processorCtx: UploadFileProcessorContext = {\n      filename: currentFilename,\n      clientMimeType: currentMimeType,\n      totalSize: currentData.length,\n      sniff: currentData,\n    }\n\n    if (!processor.match(processorCtx)) continue\n\n    if (currentData.length > processor.maxBytes) {\n      throw new Error(\"processor_input_too_large\")\n    }\n\n    const result = await processor.process(currentData, processorCtx)\n    currentData = result.data\n    if (typeof result.filename === \"string\" && result.filename.trim()) {\n      currentFilename = result.filename.trim()\n    }\n    if (typeof result.mimeType === \"string\" && result.mimeType.trim()) {\n      currentMimeType = result.mimeType.trim()\n    }\n    if (result.metadata && typeof result.metadata === \"object\") {\n      Object.assign(metadata, result.metadata)\n    }\n    applied.push(processor.id)\n  }\n\n  return {\n    data: currentData,\n    filename: currentFilename,\n    mimeType: currentMimeType,\n    applied,\n    metadata,\n  }\n}\n","import { createHash } from \"node:crypto\"\n\nimport { ApiHandler } from \"@rpcbase/api\"\nimport { getTenantFilesystemDb, models } from \"@rpcbase/db\"\nimport { GridFSBucket, ObjectId } from \"mongodb\"\nimport type { Model } from \"mongoose\"\n\nimport * as Uploads from \"../index\"\nimport {\n  claimUploadFileReference,\n  createUploadFileReference,\n} from \"../fileReferences\"\nimport { enqueueUploadPostProcessors } from \"../postProcessors\"\nimport { applyUploadProcessors, getMaxUploadProcessorBytes, selectUploadProcessors } from \"../processors\"\nimport {\n  type SessionUser,\n  type UploadChunkDoc,\n  type UploadSessionDoc,\n  buildUploadAccessMetadata,\n  buildUploadsAbility,\n  ensureFilesystemUploadIndexes,\n  ensureUploadIndexes,\n  getBucketName,\n  getModelCtx,\n  getUploadSessionAccessQuery,\n  getTenantId,\n  resolveUploadAccessScope,\n} from \"../shared\"\n\n\nconst waitForStreamFinished = async (stream: NodeJS.WritableStream): Promise<void> => new Promise((resolve, reject) => {\n  stream.once(\"finish\", resolve)\n  stream.once(\"error\", reject)\n})\n\nconst writeToStream = async (stream: NodeJS.WritableStream, chunk: Buffer): Promise<void> => {\n  const ok = stream.write(chunk)\n  if (ok) return\n  await new Promise<void>((resolve, reject) => {\n    const onDrain = () => {\n      cleanup()\n      resolve()\n    }\n\n    const onError = (error: unknown) => {\n      cleanup()\n      reject(error)\n    }\n\n    const cleanup = () => {\n      stream.off(\"drain\", onDrain)\n      stream.off(\"error\", onError)\n    }\n\n    stream.on(\"drain\", onDrain)\n    stream.on(\"error\", onError)\n  })\n}\n\nconst abortUploadStream = async (stream: unknown): Promise<void> => {\n  if (!stream) return\n  if (typeof (stream as { abort?: unknown }).abort === \"function\") {\n    try {\n      await (stream as { abort: () => Promise<void> | void }).abort()\n      return\n    } catch {\n      //\n    }\n  }\n  try {\n    ;(stream as { destroy?: () => void }).destroy?.()\n  } catch {\n    //\n  }\n}\n\nconst isDuplicateKeyError = (error: unknown): boolean => (\n  error !== null &&\n  typeof error === \"object\" &&\n  \"code\" in error &&\n  (error as { code?: unknown }).code === 11000\n)\n\nexport const completeUpload: ApiHandler<Record<string, never>, Uploads.CompleteResponsePayload, SessionUser> = async (\n  _payload,\n  ctx,\n): Promise<Uploads.CompleteResponsePayload> => {\n  const tenantId = getTenantId(ctx)\n  if (!tenantId) {\n    ctx.res.status(400)\n    return { ok: false, error: \"tenant_missing\" }\n  }\n\n  const uploadId = String(ctx.req.params?.uploadId ?? \"\").trim()\n  if (!uploadId) {\n    ctx.res.status(400)\n    return { ok: false, error: \"invalid_upload_id\" }\n  }\n\n  const ability = buildUploadsAbility(ctx, tenantId)\n  const modelCtx = getModelCtx(ctx, tenantId, ability)\n\n  const [UploadSession, UploadChunk] = await Promise.all([\n    models.get(\"RBUploadSession\", modelCtx) as Promise<Model<UploadSessionDoc>>,\n    models.get(\"RBUploadChunk\", modelCtx) as Promise<Model<UploadChunkDoc>>,\n  ])\n\n  if (!ability.can(\"update\", \"RBUploadSession\")) {\n    ctx.res.status(401)\n    return { ok: false, error: \"unauthorized\" }\n  }\n\n  const existing = await UploadSession.findOne({ $and: [{ _id: uploadId }, getUploadSessionAccessQuery(ability, \"read\")] }).lean()\n  if (!existing) {\n    ctx.res.status(404)\n    return { ok: false, error: \"not_found\" }\n  }\n\n  if (existing.status === \"done\" && existing.fileId) {\n    return {\n      ok: true,\n      fileId: existing.fileId,\n      ...(existing.deduplicated ? { deduplicated: true } : {}),\n    }\n  }\n\n  const locked = await UploadSession.findOneAndUpdate(\n    { $and: [{ _id: uploadId }, { status: \"uploading\" }, getUploadSessionAccessQuery(ability, \"update\")] },\n    { $set: { status: \"assembling\" }, $unset: { error: \"\" } },\n    { returnDocument: \"after\" },\n  ).lean()\n\n  if (!locked) {\n    ctx.res.status(409)\n    return { ok: false, error: \"not_uploading\" }\n  }\n\n  await ensureUploadIndexes(UploadSession, UploadChunk)\n\n  const fsDb = await getTenantFilesystemDb(tenantId)\n  const nativeDb = fsDb.db\n  if (!nativeDb) {\n    await UploadSession.updateOne(\n      { $and: [{ _id: uploadId }, getUploadSessionAccessQuery(ability, \"update\")] },\n      { $set: { status: \"error\", error: \"filesystem_db_unavailable\" } },\n    )\n    ctx.res.status(500)\n    return { ok: false, error: \"assembly_failed\" }\n  }\n  const bucketName = getBucketName()\n  const bucket = new GridFSBucket(nativeDb, { bucketName })\n  if (locked.deduplication) {\n    await ensureFilesystemUploadIndexes(nativeDb, bucketName)\n  }\n\n  const lockedUserId = typeof locked.userId === \"string\" ? locked.userId : undefined\n  const accessMetadata = buildUploadAccessMetadata(locked)\n  const unclaimedDeduplication = locked.deduplication\n    ? {\n      deduplication: {\n        namespace: locked.deduplication.namespace,\n        algorithm: locked.deduplication.algorithm,\n        hash: locked.deduplication.hash,\n        pipelineVersion: locked.deduplication.pipelineVersion,\n      },\n    }\n    : {}\n  const createFileMetadata = (\n    storedMimeType: string,\n    storedSize: number,\n    additional: Record<string, unknown> = {},\n  ): Record<string, unknown> => ({\n    uploadId,\n    tenantId,\n    mimeType: storedMimeType,\n    totalSize: storedSize,\n    ...additional,\n    ...accessMetadata,\n    ...unclaimedDeduplication,\n  })\n  const maxProcessorBytes = getMaxUploadProcessorBytes()\n  const shouldBufferForProcessing = locked.totalSize <= maxProcessorBytes\n  const declaredMimeType = locked.mimeType.trim().toLowerCase()\n  const declaredSvg = declaredMimeType === \"image/svg+xml\" || locked.filename.trim().toLowerCase().endsWith(\".svg\")\n\n  let uploadStream: NodeJS.WritableStream | null = null\n  let finalFilename = locked.filename\n  let finalMimeType = locked.mimeType\n  let finalSize = locked.totalSize\n  let inlineProcessors: string[] = []\n  let finalMetadata = createFileMetadata(locked.mimeType, locked.totalSize)\n\n  try {\n    if (!shouldBufferForProcessing && declaredSvg) {\n      throw new Error(\"svg_too_large\")\n    }\n\n    const cursor = UploadChunk.find({ uploadId }).sort({ index: 1 }).cursor() as unknown as AsyncIterable<UploadChunkDoc> & {\n      close: () => Promise<void>\n    }\n\n    let expectedIndex = 0\n    let sourceBytes = 0\n    const sourceHasher = locked.deduplication ? createHash(\"sha256\") : null\n    const chunks: Buffer[] = []\n    let bufferedBytes = 0\n\n    const pendingChunks: Buffer[] = []\n    const sniffParts: Buffer[] = []\n    let sniffBytes = 0\n\n    try {\n      for await (const chunkDoc of cursor) {\n        if (chunkDoc.index !== expectedIndex) {\n          throw new Error(\"missing_chunks\")\n        }\n\n        const chunk = chunkDoc.data\n        sourceBytes += chunk.length\n        sourceHasher?.update(chunk)\n\n        if (shouldBufferForProcessing) {\n          chunks.push(chunk)\n          bufferedBytes += chunk.length\n        } else if (!uploadStream) {\n          pendingChunks.push(chunk)\n\n          if (sniffBytes < maxProcessorBytes) {\n            const slice = chunk.subarray(0, Math.min(chunk.length, maxProcessorBytes - sniffBytes))\n            if (slice.length) {\n              sniffParts.push(slice)\n              sniffBytes += slice.length\n            }\n          }\n\n          if (sniffBytes >= maxProcessorBytes) {\n            const sniff = Buffer.concat(sniffParts, sniffBytes)\n            const processors = selectUploadProcessors({\n              filename: locked.filename,\n              clientMimeType: locked.mimeType,\n              totalSize: locked.totalSize,\n              sniff,\n            })\n\n            if (processors.length) {\n              throw new Error(processors.some((processor) => processor.id === \"sanitize-svg\") ? \"svg_too_large\" : \"processor_input_too_large\")\n            }\n\n            finalMetadata = createFileMetadata(locked.mimeType, locked.totalSize)\n            uploadStream = bucket.openUploadStream(locked.filename, {\n              metadata: finalMetadata,\n            })\n\n            for (const pending of pendingChunks) {\n              await writeToStream(uploadStream, pending)\n            }\n            pendingChunks.length = 0\n          }\n        } else {\n          await writeToStream(uploadStream, chunk)\n        }\n\n        expectedIndex += 1\n      }\n    } finally {\n      try {\n        await cursor.close()\n      } catch {\n        //\n      }\n    }\n\n    if (expectedIndex !== locked.chunksTotal) {\n      throw new Error(\"missing_chunks\")\n    }\n\n    if (sourceBytes !== locked.totalSize) {\n      throw new Error(\"invalid_source_size\")\n    }\n\n    if (sourceHasher && sourceHasher.digest(\"hex\") !== locked.deduplication?.hash) {\n      throw new Error(\"content_hash_mismatch\")\n    }\n\n    if (shouldBufferForProcessing) {\n      const assembled = Buffer.concat(chunks, bufferedBytes)\n      const {\n        data: processed,\n        filename: processedFilename,\n        mimeType: processedMimeType,\n        applied,\n        metadata: processedMetadata,\n      } = await applyUploadProcessors(assembled, {\n        filename: locked.filename,\n        clientMimeType: locked.mimeType,\n      })\n\n      finalFilename = processedFilename\n      finalMimeType = processedMimeType\n      finalSize = processed.length\n      inlineProcessors = applied\n      finalMetadata = createFileMetadata(processedMimeType, processed.length, {\n        ...(applied.length ? { processors: applied, sourceTotalSize: locked.totalSize } : {}),\n        ...processedMetadata,\n      })\n      uploadStream = bucket.openUploadStream(finalFilename, {\n        metadata: finalMetadata,\n      })\n\n      const finished = waitForStreamFinished(uploadStream)\n      uploadStream.end(processed)\n      await finished\n    } else {\n      if (!uploadStream) {\n        const sniff = Buffer.concat(sniffParts, sniffBytes)\n        const processors = selectUploadProcessors({\n          filename: locked.filename,\n          clientMimeType: locked.mimeType,\n          totalSize: locked.totalSize,\n          sniff,\n        })\n\n        if (processors.length) {\n          throw new Error(processors.some((processor) => processor.id === \"sanitize-svg\") ? \"svg_too_large\" : \"processor_input_too_large\")\n        }\n\n        finalMetadata = createFileMetadata(locked.mimeType, locked.totalSize)\n        uploadStream = bucket.openUploadStream(locked.filename, {\n          metadata: finalMetadata,\n        })\n\n        for (const pending of pendingChunks) {\n          await writeToStream(uploadStream, pending)\n        }\n        pendingChunks.length = 0\n      }\n\n      const finished = waitForStreamFinished(uploadStream)\n      uploadStream.end()\n      await finished\n    }\n\n    const uploadedBlobId = String((uploadStream as unknown as { id?: unknown }).id ?? \"\")\n    if (!uploadedBlobId) {\n      throw new Error(\"missing_file_id\")\n    }\n\n    let resolvedBlobId = uploadedBlobId\n    let deduplicated = false\n    let returnedFileId: string | null = locked.deduplication ? null : uploadedBlobId\n\n    if (locked.deduplication) {\n      const filesCollection = nativeDb.collection(`${bucketName}.files`)\n      const uploadedBlobObjectId = new ObjectId(uploadedBlobId)\n      const referenceOptions = {\n        tenantId,\n        bucketName,\n        filename: finalFilename,\n        mimeType: finalMimeType,\n        totalSize: finalSize,\n        accessScope: resolveUploadAccessScope({\n          accessScope: locked.accessScope,\n          isPublic: locked.isPublic,\n        }),\n        ...(lockedUserId ? { userId: lockedUserId } : {}),\n        ...(typeof locked.ownerKeyHash === \"string\" ? { ownerKeyHash: locked.ownerKeyHash } : {}),\n      }\n      let lastDuplicateKeyError: unknown = null\n\n      for (let attempt = 0; attempt < 3 && !returnedFileId; attempt += 1) {\n        try {\n          returnedFileId = await claimUploadFileReference({\n            ...referenceOptions,\n            blobId: uploadedBlobObjectId,\n            deduplication: locked.deduplication,\n          })\n          if (!returnedFileId) throw new Error(\"missing_file_id\")\n          finalMetadata = {\n            ...finalMetadata,\n            deduplication: locked.deduplication,\n          }\n          break\n        } catch (error) {\n          if (!isDuplicateKeyError(error)) throw error\n          lastDuplicateKeyError = error\n        }\n\n        const canonicalFile = await filesCollection.findOne(\n          { \"metadata.deduplication.key\": locked.deduplication.key },\n          { projection: { _id: 1 } },\n        )\n        if (!(canonicalFile?._id instanceof ObjectId)) continue\n\n        const canonicalReferenceId = await createUploadFileReference({\n          ...referenceOptions,\n          blobId: canonicalFile._id,\n          deduplicationKey: locked.deduplication.key,\n        })\n        if (!canonicalReferenceId) continue\n\n        await bucket.delete(uploadedBlobObjectId)\n        resolvedBlobId = canonicalFile._id.toHexString()\n        returnedFileId = canonicalReferenceId\n        deduplicated = true\n      }\n\n      if (!returnedFileId) {\n        await bucket.delete(uploadedBlobObjectId)\n        if (lastDuplicateKeyError) throw lastDuplicateKeyError\n      }\n    }\n    if (!returnedFileId) {\n      throw new Error(\"canonical_file_missing\")\n    }\n\n    await UploadSession.updateOne(\n      { $and: [{ _id: uploadId }, getUploadSessionAccessQuery(ability, \"update\")] },\n      {\n        $set: {\n          status: \"done\",\n          fileId: returnedFileId,\n          filename: finalFilename,\n          mimeType: finalMimeType,\n          totalSize: finalSize,\n          ...(deduplicated ? { deduplicated: true } : {}),\n        },\n        $unset: { error: \"\" },\n      },\n    )\n\n    if (!deduplicated) {\n      await enqueueUploadPostProcessors({\n        tenantId,\n        uploadId,\n        fileId: resolvedBlobId,\n        filename: finalFilename,\n        mimeType: finalMimeType,\n        clientMimeType: locked.mimeType,\n        totalSize: finalSize,\n        ...(typeof locked.isPublic === \"boolean\" ? { isPublic: locked.isPublic } : {}),\n        ...(locked.accessScope ? { accessScope: locked.accessScope } : {}),\n        ...(typeof locked.ownerKeyHash === \"string\" ? { ownerKeyHash: locked.ownerKeyHash } : {}),\n        ...(lockedUserId ? { userId: lockedUserId } : {}),\n        inlineProcessors,\n        metadata: finalMetadata,\n      }).catch((error) => {\n        console.error(\"Upload post processor enqueue failed\", {\n          tenantId,\n          uploadId,\n          fileId: resolvedBlobId,\n          error,\n        })\n      })\n    }\n\n    try {\n      await UploadChunk.deleteMany({ uploadId })\n    } catch {\n      //\n    }\n\n    return {\n      ok: true,\n      fileId: returnedFileId,\n      ...(deduplicated ? { deduplicated: true } : {}),\n    }\n  } catch (error) {\n    const message = error instanceof Error ? error.message : String(error)\n\n    await abortUploadStream(uploadStream)\n\n    if (message === \"missing_chunks\") {\n      await UploadSession.updateOne(\n        { $and: [{ _id: uploadId }, getUploadSessionAccessQuery(ability, \"update\")] },\n        { $set: { status: \"uploading\" } },\n      )\n      ctx.res.status(409)\n      return { ok: false, error: \"missing_chunks\" }\n    }\n\n    if (message === \"content_hash_mismatch\") {\n      await UploadSession.updateOne(\n        { $and: [{ _id: uploadId }, getUploadSessionAccessQuery(ability, \"update\")] },\n        { $set: { status: \"error\", error: message } },\n      )\n      ctx.res.status(400)\n      return { ok: false, error: message }\n    }\n\n    if (message === \"svg_too_large\") {\n      await UploadSession.updateOne(\n        { $and: [{ _id: uploadId }, getUploadSessionAccessQuery(ability, \"update\")] },\n        { $set: { status: \"error\", error: message } },\n      )\n      ctx.res.status(413)\n      return { ok: false, error: message }\n    }\n\n    if (message === \"heif_too_large\" || message === \"processor_input_too_large\") {\n      await UploadSession.updateOne(\n        { $and: [{ _id: uploadId }, getUploadSessionAccessQuery(ability, \"update\")] },\n        { $set: { status: \"error\", error: message } },\n      )\n      ctx.res.status(413)\n      return { ok: false, error: message }\n    }\n\n    if (message.startsWith(\"heif_decode_unsupported\")) {\n      await UploadSession.updateOne(\n        { $and: [{ _id: uploadId }, getUploadSessionAccessQuery(ability, \"update\")] },\n        { $set: { status: \"error\", error: message } },\n      )\n      ctx.res.status(415)\n      return { ok: false, error: message }\n    }\n\n    if (message === \"svg_invalid\" || message === \"svg_sanitize_failed\") {\n      await UploadSession.updateOne(\n        { $and: [{ _id: uploadId }, getUploadSessionAccessQuery(ability, \"update\")] },\n        { $set: { status: \"error\", error: message } },\n      )\n      ctx.res.status(400)\n      return { ok: false, error: message }\n    }\n\n    await UploadSession.updateOne(\n      { $and: [{ _id: uploadId }, getUploadSessionAccessQuery(ability, \"update\")] },\n      { $set: { status: \"error\", error: message } },\n    )\n\n    ctx.res.status(500)\n    return { ok: false, error: \"assembly_failed\" }\n  }\n}\n","import { ApiHandler } from \"@rpcbase/api\"\nimport { models } from \"@rpcbase/db\"\nimport type { Model } from \"mongoose\"\n\nimport * as Uploads from \"../index\"\nimport {\n  type SessionUser,\n  type UploadChunkDoc,\n  type UploadSessionDoc,\n  buildUploadsAbility,\n  getModelCtx,\n  getUploadSessionAccessQuery,\n  getTenantId,\n} from \"../shared\"\n\n\nexport const getStatus: ApiHandler<Record<string, never>, Uploads.StatusResponsePayload, SessionUser> = async (\n  _payload,\n  ctx,\n): Promise<Uploads.StatusResponsePayload> => {\n  const tenantId = getTenantId(ctx)\n  if (!tenantId) {\n    ctx.res.status(400)\n    return { ok: false, error: \"tenant_missing\" }\n  }\n\n  const uploadId = String(ctx.req.params?.uploadId ?? \"\").trim()\n  if (!uploadId) {\n    ctx.res.status(400)\n    return { ok: false, error: \"invalid_upload_id\" }\n  }\n\n  const ability = buildUploadsAbility(ctx, tenantId)\n  const modelCtx = getModelCtx(ctx, tenantId, ability)\n\n  const [UploadSession, UploadChunk] = await Promise.all([\n    models.get(\"RBUploadSession\", modelCtx) as Promise<Model<UploadSessionDoc>>,\n    models.get(\"RBUploadChunk\", modelCtx) as Promise<Model<UploadChunkDoc>>,\n  ])\n\n  if (!ability.can(\"read\", \"RBUploadSession\")) {\n    ctx.res.status(401)\n    return { ok: false, error: \"unauthorized\" }\n  }\n\n  const session = await UploadSession.findOne({ $and: [{ _id: uploadId }, getUploadSessionAccessQuery(ability, \"read\")] }).lean()\n  if (!session) {\n    ctx.res.status(404)\n    return { ok: false, error: \"not_found\" }\n  }\n\n  const receivedDocs = await UploadChunk.find(\n    { uploadId },\n    { index: 1, _id: 0 },\n  ).sort({ index: 1 }).lean()\n\n  const received = (receivedDocs as unknown as Array<{ index?: unknown }>)\n    .map((doc) => (typeof doc.index === \"number\" ? doc.index : -1))\n    .filter((n) => Number.isInteger(n) && n >= 0)\n\n  return {\n    ok: true,\n    status: session.status,\n    chunkSize: session.chunkSize,\n    chunksTotal: session.chunksTotal,\n    received,\n    ...(session.fileId ? { fileId: session.fileId } : {}),\n  }\n}\n","import { z } from \"zod\"\n\n\nexport const InitRoute = \"/api/rb/file-uploads\"\nexport const ChunkRoute = \"/api/rb/file-uploads/:uploadId/chunks/:index\"\nexport const StatusRoute = \"/api/rb/file-uploads/:uploadId/status\"\nexport const CompleteRoute = \"/api/rb/file-uploads/:uploadId/complete\"\n\nexport const uploadAccessScopeSchema = z.enum([\"owner\", \"tenant\", \"public\"])\n\nexport const uploadDeduplicationSchema = z.object({\n  namespace: z.string().trim().min(1).max(128).regex(/^[a-z0-9][a-z0-9._:-]*$/i),\n  algorithm: z.literal(\"sha256\"),\n  hash: z.string().trim().regex(/^[a-f0-9]{64}$/i),\n})\n\nexport const initRequestSchema = z.object({\n  filename: z.string().min(1),\n  mimeType: z.string().min(1),\n  isPublic: z.boolean().optional(),\n  accessScope: uploadAccessScopeSchema.optional(),\n  deduplication: uploadDeduplicationSchema.optional(),\n  totalSize: z.number().int().min(1),\n}).superRefine((value, ctx) => {\n  if (value.accessScope !== undefined && value.isPublic !== undefined) {\n    ctx.addIssue({\n      code: \"custom\",\n      message: \"accessScope and isPublic are mutually exclusive\",\n      path: [\"accessScope\"],\n    })\n  }\n})\n\nexport type InitRequestPayload = z.infer<typeof initRequestSchema>\n\nexport const initResponseSchema = z.object({\n  ok: z.boolean(),\n  error: z.string().optional(),\n  uploadId: z.string().optional(),\n  uploadKey: z.string().optional(),\n  chunkSize: z.number().int().optional(),\n  chunksTotal: z.number().int().optional(),\n  fileId: z.string().optional(),\n  deduplicated: z.boolean().optional(),\n})\n\nexport type InitResponsePayload = z.infer<typeof initResponseSchema>\n\nexport const statusResponseSchema = z.object({\n  ok: z.boolean(),\n  error: z.string().optional(),\n  status: z.enum([\"uploading\", \"assembling\", \"done\", \"error\"]).optional(),\n  chunkSize: z.number().int().optional(),\n  chunksTotal: z.number().int().optional(),\n  received: z.array(z.number().int().min(0)).optional(),\n  fileId: z.string().optional(),\n})\n\nexport type StatusResponsePayload = z.infer<typeof statusResponseSchema>\n\nexport const completeResponseSchema = z.object({\n  ok: z.boolean(),\n  error: z.string().optional(),\n  fileId: z.string().optional(),\n  deduplicated: z.boolean().optional(),\n})\n\nexport type CompleteResponsePayload = z.infer<typeof completeResponseSchema>\n","import { randomBytes } from \"node:crypto\"\n\nimport { ApiHandler } from \"@rpcbase/api\"\nimport { getTenantFilesystemDb, models } from \"@rpcbase/db\"\nimport { ObjectId } from \"mongodb\"\nimport type { Model } from \"mongoose\"\n\nimport * as Uploads from \"../index\"\nimport { createUploadFileReference } from \"../fileReferences\"\nimport {\n  type SessionUser,\n  type UploadChunkDoc,\n  type UploadSessionDoc,\n  buildUploadDeduplication,\n  buildUploadsAbility,\n  computeSha256Hex,\n  ensureFilesystemUploadIndexes,\n  ensureUploadIndexes,\n  getBucketName,\n  getChunkSizeBytes,\n  getModelCtx,\n  getSessionTtlMs,\n  getTenantId,\n  getUserId,\n  resolveUploadAccessScope,\n} from \"../shared\"\n\n\nexport const initUpload: ApiHandler<Uploads.InitRequestPayload, Uploads.InitResponsePayload, SessionUser> = async (\n  payload,\n  ctx,\n): Promise<Uploads.InitResponsePayload> => {\n  const tenantId = getTenantId(ctx)\n  if (!tenantId) {\n    ctx.res.status(400)\n    return { ok: false, error: \"tenant_missing\" }\n  }\n\n  const userId = getUserId(ctx)\n\n  const parsed = Uploads.initRequestSchema.safeParse(payload ?? {})\n  if (!parsed.success) {\n    ctx.res.status(400)\n    return { ok: false, error: \"invalid_payload\" }\n  }\n\n  const { filename, mimeType, totalSize, isPublic, deduplication: requestedDeduplication } = parsed.data\n  const accessScope = resolveUploadAccessScope({ accessScope: parsed.data.accessScope, isPublic })\n  if (accessScope === \"tenant\" && !userId) {\n    ctx.res.status(401)\n    return { ok: false, error: \"authentication_required\" }\n  }\n\n  const uploadKey = userId ? null : randomBytes(32).toString(\"base64url\")\n  const ownerKeyHash = uploadKey ? computeSha256Hex(Buffer.from(uploadKey)) : undefined\n  const deduplication = requestedDeduplication\n    ? buildUploadDeduplication({\n      namespace: requestedDeduplication.namespace,\n      hash: requestedDeduplication.hash,\n      filename,\n      mimeType,\n      totalSize,\n      accessScope,\n      ...(userId ? { userId } : {}),\n      ...(ownerKeyHash ? { ownerKeyHash } : {}),\n    })\n    : null\n\n  if (requestedDeduplication && !deduplication) {\n    ctx.res.status(400)\n    return { ok: false, error: \"deduplication_unavailable\" }\n  }\n\n  if (deduplication) {\n    const fsDb = await getTenantFilesystemDb(tenantId)\n    const nativeDb = fsDb.db\n    if (!nativeDb) {\n      ctx.res.status(500)\n      return { ok: false, error: \"filesystem_db_unavailable\" }\n    }\n\n    const bucketName = getBucketName()\n    await ensureFilesystemUploadIndexes(nativeDb, bucketName)\n    const existingFile = await nativeDb.collection(`${bucketName}.files`).findOne(\n      { \"metadata.deduplication.key\": deduplication.key },\n      { projection: { _id: 1, filename: 1, length: 1, metadata: 1 } },\n    )\n    if (existingFile?._id instanceof ObjectId) {\n      const existingMetadata = existingFile.metadata && typeof existingFile.metadata === \"object\"\n        ? existingFile.metadata as Record<string, unknown>\n        : {}\n      const existingMimeType = typeof existingMetadata.mimeType === \"string\"\n        ? existingMetadata.mimeType\n        : mimeType\n      const existingSize = typeof existingFile.length === \"number\"\n        ? existingFile.length\n        : totalSize\n      const fileId = await createUploadFileReference({\n        tenantId,\n        bucketName,\n        blobId: existingFile._id,\n        filename,\n        mimeType: existingMimeType,\n        totalSize: existingSize,\n        accessScope,\n        ...(userId ? { userId } : {}),\n        ...(ownerKeyHash ? { ownerKeyHash } : {}),\n        deduplicationKey: deduplication.key,\n      })\n      if (fileId) {\n        return {\n          ok: true,\n          fileId,\n          deduplicated: true,\n          ...(uploadKey ? { uploadKey } : {}),\n        }\n      }\n    }\n  }\n\n  const chunkSize = getChunkSizeBytes()\n  const chunksTotal = Math.ceil(totalSize / chunkSize)\n\n  const ability = buildUploadsAbility(ctx, tenantId)\n  const modelCtx = getModelCtx(ctx, tenantId, ability)\n\n  const [UploadSession, UploadChunk] = await Promise.all([\n    models.get(\"RBUploadSession\", modelCtx) as Promise<Model<UploadSessionDoc>>,\n    models.get(\"RBUploadChunk\", modelCtx) as Promise<Model<UploadChunkDoc>>,\n  ])\n\n  await ensureUploadIndexes(UploadSession, UploadChunk)\n\n  const uploadId = new ObjectId().toString()\n  const now = Date.now()\n  const expiresAt = new Date(now + getSessionTtlMs())\n\n  await UploadSession.create({\n    _id: uploadId,\n    ...(userId ? { userId } : {}),\n    ...(ownerKeyHash ? { ownerKeyHash } : {}),\n    filename,\n    mimeType,\n    isPublic: accessScope === \"public\",\n    accessScope,\n    ...(deduplication ? { deduplication } : {}),\n    totalSize,\n    chunkSize,\n    chunksTotal,\n    status: \"uploading\",\n    createdAt: new Date(now),\n    expiresAt,\n  })\n\n  return {\n    ok: true,\n    uploadId,\n    chunkSize,\n    chunksTotal,\n    ...(uploadKey ? { uploadKey } : {}),\n  }\n}\n","import { ApiHandler } from \"@rpcbase/api\"\nimport { models } from \"@rpcbase/db\"\nimport type { Model } from \"mongoose\"\n\nimport {\n  type SessionUser,\n  type UploadChunkDoc,\n  type UploadSessionDoc,\n  buildUploadsAbility,\n  computeSha256Hex,\n  ensureUploadIndexes,\n  getModelCtx,\n  getUploadSessionAccessQuery,\n  getTenantId,\n  normalizeSha256Hex,\n  toBufferPayload,\n} from \"../shared\"\n\n\ntype ChunkResponsePayload = {\n  ok: boolean\n  error?: string\n}\n\nexport const uploadChunk: ApiHandler<Buffer, ChunkResponsePayload, SessionUser> = async (\n  payload,\n  ctx,\n): Promise<ChunkResponsePayload> => {\n  const tenantId = getTenantId(ctx)\n  if (!tenantId) {\n    ctx.res.status(400)\n    return { ok: false, error: \"tenant_missing\" }\n  }\n\n  const uploadId = String(ctx.req.params?.uploadId ?? \"\").trim()\n  const indexRaw = String(ctx.req.params?.index ?? \"\").trim()\n  const index = Number(indexRaw)\n\n  if (!uploadId || !Number.isInteger(index) || index < 0) {\n    ctx.res.status(400)\n    return { ok: false, error: \"invalid_chunk_ref\" }\n  }\n\n  const ability = buildUploadsAbility(ctx, tenantId)\n  const modelCtx = getModelCtx(ctx, tenantId, ability)\n\n  const [UploadSession, UploadChunk] = await Promise.all([\n    models.get(\"RBUploadSession\", modelCtx) as Promise<Model<UploadSessionDoc>>,\n    models.get(\"RBUploadChunk\", modelCtx) as Promise<Model<UploadChunkDoc>>,\n  ])\n\n  if (!ability.can(\"update\", \"RBUploadSession\")) {\n    ctx.res.status(401)\n    return { ok: false, error: \"unauthorized\" }\n  }\n\n  const session = await UploadSession.findOne({ $and: [{ _id: uploadId }, getUploadSessionAccessQuery(ability, \"update\")] }).lean()\n  if (!session) {\n    ctx.res.status(404)\n    return { ok: false, error: \"not_found\" }\n  }\n\n  if (session.status !== \"uploading\") {\n    ctx.res.status(409)\n    return { ok: false, error: \"not_uploading\" }\n  }\n\n  if (index >= session.chunksTotal) {\n    ctx.res.status(400)\n    return { ok: false, error: \"index_out_of_range\" }\n  }\n\n  const data = toBufferPayload(payload)\n  if (!data) {\n    ctx.res.status(400)\n    return { ok: false, error: \"invalid_body\" }\n  }\n\n  const expectedSize = index === session.chunksTotal - 1\n    ? session.totalSize - session.chunkSize * (session.chunksTotal - 1)\n    : session.chunkSize\n\n  if (data.length > expectedSize) {\n    ctx.res.status(413)\n    return { ok: false, error: \"chunk_too_large\" }\n  }\n\n  if (data.length !== expectedSize) {\n    ctx.res.status(400)\n    return { ok: false, error: \"invalid_chunk_size\" }\n  }\n\n  const checksumHeader = ctx.req.get(\"X-Chunk-SHA256\")\n  const sha256 = checksumHeader ? computeSha256Hex(data) : undefined\n\n  if (checksumHeader) {\n    const expectedSha256 = normalizeSha256Hex(checksumHeader)\n    if (sha256 !== expectedSha256) {\n      ctx.res.status(400)\n      return { ok: false, error: \"checksum_mismatch\" }\n    }\n  }\n\n  await ensureUploadIndexes(UploadSession, UploadChunk)\n\n  await UploadChunk.updateOne(\n    { uploadId, index },\n    {\n      $set: {\n        uploadId,\n        index,\n        data,\n        size: data.length,\n        sha256,\n        expiresAt: session.expiresAt,\n      },\n      $setOnInsert: {\n        createdAt: new Date(),\n      },\n    },\n    { upsert: true },\n  )\n\n  ctx.res.status(204)\n  return { ok: true }\n}\n","export const rawBodyParser = ({\n  limitBytes,\n  maxClientBytesPerSecond,\n}: {\n  limitBytes: number\n  maxClientBytesPerSecond?: number | null\n}) => {\n  return (req: any, res: any, next: any) => {\n    const contentType = typeof req?.headers?.[\"content-type\"] === \"string\"\n      ? String(req.headers[\"content-type\"])\n      : \"\"\n\n    if (!contentType.includes(\"application/octet-stream\")) {\n      next()\n      return\n    }\n\n    let total = 0\n    const chunks: Buffer[] = []\n    let done = false\n    let paused = false\n    let throttleTimeout: ReturnType<typeof setTimeout> | null = null\n\n    const rateBytesPerSecond = typeof maxClientBytesPerSecond === \"number\" && maxClientBytesPerSecond > 0\n      ? maxClientBytesPerSecond\n      : null\n\n    const cleanup = () => {\n      req.off(\"data\", onData)\n      req.off(\"end\", onEnd)\n      req.off(\"error\", onError)\n      req.off(\"aborted\", onAborted)\n      if (throttleTimeout) {\n        clearTimeout(throttleTimeout)\n        throttleTimeout = null\n      }\n    }\n\n    const finish = (error?: unknown) => {\n      if (done) return\n      done = true\n\n      cleanup()\n\n      if (error) {\n        next(error)\n        return\n      }\n\n      req.body = Buffer.concat(chunks, total)\n      next()\n    }\n\n    const onData = (chunk: any) => {\n      if (done) return\n      const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk)\n      total += buffer.length\n\n      if (total > limitBytes) {\n        done = true\n        cleanup()\n        req.destroy()\n        res.status(413).json({ ok: false, error: \"chunk_too_large\" })\n        return\n      }\n\n      chunks.push(buffer)\n\n      if (!rateBytesPerSecond) return\n\n      const now = Date.now()\n      const clientKey = getClientKey(req)\n      const state = getClientRateState(clientKey, rateBytesPerSecond, now)\n      const waitMs = consumeRateBudget(state, buffer.length, rateBytesPerSecond, now)\n\n      if (waitMs > 0 && !paused) {\n        paused = true\n        req.pause()\n        throttleTimeout = setTimeout(() => {\n          throttleTimeout = null\n          paused = false\n          if (done) return\n          try {\n            req.resume()\n          } catch {\n            //\n          }\n        }, waitMs)\n      }\n    }\n\n    const onEnd = () => finish()\n    const onError = (err: unknown) => finish(err)\n    const onAborted = () => finish(new Error(\"request_aborted\"))\n\n    req.on(\"data\", onData)\n    req.on(\"end\", onEnd)\n    req.on(\"error\", onError)\n    req.on(\"aborted\", onAborted)\n  }\n}\n\ntype ClientRateState = {\n  tokens: number\n  lastRefillMs: number\n  lastSeenMs: number\n}\n\nconst MAX_BURST_SECONDS = 1\nconst STALE_CLIENT_MS = 15 * 60 * 1000\n\nconst clientRateStates = new Map<string, ClientRateState>()\nlet lastCleanupMs = 0\n\nconst getClientKey = (req: any): string => {\n  const rawClientIp = typeof req?.clientIp === \"string\" ? req.clientIp : \"\"\n  if (rawClientIp.trim()) return rawClientIp.trim()\n  const rawIp = typeof req?.ip === \"string\" ? req.ip : \"\"\n  return rawIp.trim() || \"unknown\"\n}\n\nconst maybeCleanupStates = (now: number) => {\n  if (now - lastCleanupMs < 60_000) return\n  lastCleanupMs = now\n\n  if (clientRateStates.size < 2000) return\n\n  for (const [key, state] of clientRateStates) {\n    if (now - state.lastSeenMs > STALE_CLIENT_MS) {\n      clientRateStates.delete(key)\n    }\n  }\n}\n\nconst getClientRateState = (key: string, rateBytesPerSecond: number, now: number): ClientRateState => {\n  maybeCleanupStates(now)\n\n  const capacity = rateBytesPerSecond * MAX_BURST_SECONDS\n  const existing = clientRateStates.get(key)\n  if (existing) {\n    existing.lastSeenMs = now\n    existing.tokens = Math.min(capacity, existing.tokens)\n    return existing\n  }\n\n  const next: ClientRateState = {\n    tokens: capacity,\n    lastRefillMs: now,\n    lastSeenMs: now,\n  }\n  clientRateStates.set(key, next)\n  return next\n}\n\nconst consumeRateBudget = (\n  state: ClientRateState,\n  bytes: number,\n  rateBytesPerSecond: number,\n  now: number,\n): number => {\n  const capacity = rateBytesPerSecond * MAX_BURST_SECONDS\n  const elapsedMs = Math.max(0, now - state.lastRefillMs)\n\n  if (elapsedMs > 0) {\n    state.tokens = Math.min(capacity, state.tokens + (elapsedMs * rateBytesPerSecond) / 1000)\n    state.lastRefillMs = now\n  }\n\n  state.tokens -= bytes\n\n  if (state.tokens >= 0) return 0\n  return Math.ceil((-state.tokens / rateBytesPerSecond) * 1000)\n}\n","import { Api } from \"@rpcbase/api\"\n\nimport { completeUpload } from \"./handlers/completeUpload\"\nimport { getStatus } from \"./handlers/getStatus\"\nimport { initUpload } from \"./handlers/initUpload\"\nimport { uploadChunk } from \"./handlers/uploadChunk\"\nimport { rawBodyParser } from \"./middleware/rawBodyParser\"\nimport { getChunkSizeBytes, getMaxClientUploadBytesPerSecond, getRawBodyLimitBytes, type SessionUser } from \"./shared\"\n\nimport * as Uploads from \"./index\"\n\n\nexport default (api: Api<SessionUser>) => {\n  const chunkSizeBytes = getChunkSizeBytes()\n  api.use(\n    Uploads.InitRoute,\n    rawBodyParser({\n      limitBytes: getRawBodyLimitBytes(chunkSizeBytes),\n      maxClientBytesPerSecond: getMaxClientUploadBytesPerSecond(),\n    }),\n  )\n\n  api.post(Uploads.InitRoute, initUpload)\n  api.put(Uploads.ChunkRoute, uploadChunk)\n  api.get(Uploads.StatusRoute, getStatus)\n  api.post(Uploads.CompleteRoute, completeUpload)\n}\n"],"mappings":";;;;;;;;;;;AAMA,IAAMG,gBAAgB,MAAM;AAE5B,IAAMC,SAAS,IAAIJ,MAAM,EAAE,CAAC,CAACI;AAC7B,IAAMC,YAAYJ,gBAAgBG,MAAM;AAExC,IAAME,qBAAqBC,QAAwBA,IAAIC,QAAQ,WAAW,EAAE,CAAC,CAACC,UAAU;AAExF,IAAMC,oBAAoBC,SAA0B;CAClD,MAAMC,aAAaN,kBAAkBK,IAAI;CACzC,IAAI,CAACC,WAAWC,WAAW,GAAG,GAAG,OAAO;CACxC,OAAO,gBAAgBC,KAAKF,UAAU;AACxC;AAEA,IAAaG,gBAAgBC,UAA2BN,iBAAiBM,MAAME,SAAS,MAAM,CAAC;AAE/F,IAAaC,eAAeC,QAC1Bf,UAAUgB,SAASD,KAAK,EACtBE,cAAc;CAAEF,KAAK;CAAMG,YAAY;AAAK,EAC9C,CAAC;;;ACCH,IAAamC,mBAAmBC,OAAOC,OAAO,CAACrB;CDE7Cd,IAAI;CACJC,UAAUvB;CACVwB,QAAQ,EAAEX,YAAYD,aAAaC,KAAK;CACxCY,UAAUC,SAA6C;EACrD,IAAIA,KAAKE,SAAS5B,eAChB,MAAM,IAAI6B,MAAM,eAAe;EAGjC,MAAMC,UAAUJ,KAAKX,SAAS,MAAM;EACpC,IAAI,CAACR,iBAAiBuB,OAAO,GAC3B,MAAM,IAAID,MAAM,aAAa;EAG/B,MAAME,YAAYf,YAAYc,OAAO;EACrC,IAAI,CAACC,UAAUC,KAAK,KAAK,CAACzB,iBAAiBwB,SAAS,GAClD,MAAM,IAAIF,MAAM,qBAAqB;EAGvC,MAAMI,kBAAkBnB,OAAOoB,KAAKH,WAAW,MAAM;EACrD,IAAIE,gBAAgBL,SAAS5B,eAC3B,MAAM,IAAI6B,MAAM,eAAe;EAGjC,OAAO;GAAEH,MAAMO;GAAiBN,UAAU;EAAgB;CAC5D;AC1B6CS,GAAsBD,0BAA0B,CAAiC;AAEhI,IAAauB,mCACXH,iBAAiBI,QAAQC,KAAKC,cAAcC,KAAKF,IAAIA,KAAKC,UAAUX,QAAQ,GAAG,CAAC;AAElF,IAAaa,0BAA0BX,QACrCG,iBAAiBS,QAAQH,cAAcA,UAAUV,MAAMC,GAAG,CAAC;AAE7D,IAAaa,wBAAwB,OACnCrB,MACAQ,QACwH;CACxH,IAAIgB,cAAcxB;CAClB,IAAIyB,kBAAkBjB,IAAId;CAC1B,IAAIgC,kBAAkBlB,IAAIb;CAC1B,MAAM4B,UAAoB,CAAA;CAC1B,MAAMrB,WAAoC,CAAC;CAE3C,KAAK,MAAMe,aAAaN,kBAAkB;EACxC,MAAMgB,eAA2C;GAC/CjC,UAAU+B;GACV9B,gBAAgB+B;GAChB9B,WAAW4B,YAAYI;GACvB/B,OAAO2B;EACT;EAEA,IAAI,CAACP,UAAUV,MAAMoB,YAAY,GAAG;EAEpC,IAAIH,YAAYI,SAASX,UAAUX,UACjC,MAAM,IAAIuB,MAAM,2BAA2B;EAG7C,MAAMC,SAAS,MAAMb,UAAUR,QAAQe,aAAaG,YAAY;EAChEH,cAAcM,OAAO9B;EACrB,IAAI,OAAO8B,OAAOpC,aAAa,YAAYoC,OAAOpC,SAASqC,KAAK,GAC9DN,kBAAkBK,OAAOpC,SAASqC,KAAK;EAEzC,IAAI,OAAOD,OAAO7B,aAAa,YAAY6B,OAAO7B,SAAS8B,KAAK,GAC9DL,kBAAkBI,OAAO7B,SAAS8B,KAAK;EAEzC,IAAID,OAAO5B,YAAY,OAAO4B,OAAO5B,aAAa,UAChDU,OAAOoB,OAAO9B,UAAU4B,OAAO5B,QAAQ;EAEzCqB,QAAQU,KAAKhB,UAAUZ,EAAE;CAC3B;CAEA,OAAO;EACLL,MAAMwB;EACN9B,UAAU+B;EACVxB,UAAUyB;EACVH;EACArB;CACF;AACF;;;AChDA,IAAM0D,wBAAwB,OAAOC,WAAiD,IAAIG,SAASC,SAASC,WAAW;CACrHL,OAAOM,KAAK,UAAUF,OAAO;CAC7BJ,OAAOM,KAAK,SAASD,MAAM;AAC7B,CAAC;AAED,IAAME,gBAAgB,OAAOP,QAA+BQ,UAAiC;CAE3F,IADWR,OAAOW,MAAMH,KACpBE,GAAI;CACR,MAAM,IAAIP,SAAeC,SAASC,WAAW;EAC3C,MAAMO,gBAAgB;GACpBC,QAAQ;GACRT,QAAQ;EACV;EAEA,MAAMU,WAAWC,UAAmB;GAClCF,QAAQ;GACRR,OAAOU,KAAK;EACd;EAEA,MAAMF,gBAAgB;GACpBb,OAAOgB,IAAI,SAASJ,OAAO;GAC3BZ,OAAOgB,IAAI,SAASF,OAAO;EAC7B;EAEAd,OAAOiB,GAAG,SAASL,OAAO;EAC1BZ,OAAOiB,GAAG,SAASH,OAAO;CAC5B,CAAC;AACH;AAEA,IAAMI,oBAAoB,OAAOlB,WAAmC;CAClE,IAAI,CAACA,QAAQ;CACb,IAAI,OAAQA,OAA+BmB,UAAU,YACnD,IAAI;EACF,MAAOnB,OAAiDmB,MAAM;EAC9D;CACF,QAAQ,CACN;CAGJ,IAAI;EACD,OAAqCC,UAAU;CAClD,QAAQ,CACN;AAEJ;AAEA,IAAMC,uBAAuBN,UAC3BA,UAAU,QACV,OAAOA,UAAU,YACjB,UAAUA,SACTA,MAA6BO,SAAS;AAGzC,IAAaC,iBAAkG,OAC7GG,UACAC,QAC6C;CAC7C,MAAMC,WAAW/B,YAAY8B,GAAG;CAChC,IAAI,CAACC,UAAU;EACbD,IAAIE,IAAIC,OAAO,GAAG;EAClB,OAAO;GAAEpB,IAAI;GAAOK,OAAO;EAAiB;CAC9C;CAEA,MAAMgB,WAAWC,OAAOL,IAAIM,IAAIC,QAAQH,YAAY,EAAE,CAAC,CAACI,KAAK;CAC7D,IAAI,CAACJ,UAAU;EACbJ,IAAIE,IAAIC,OAAO,GAAG;EAClB,OAAO;GAAEpB,IAAI;GAAOK,OAAO;EAAoB;CACjD;CAEA,MAAMqB,UAAU7C,oBAAoBoC,KAAKC,QAAQ;CACjD,MAAMS,WAAW1C,YAAYgC,KAAKC,UAAUQ,OAAO;CAEnD,MAAM,CAACE,eAAeC,eAAe,MAAMpC,QAAQqC,IAAI,CACrDhE,OAAOiE,IAAI,mBAAmBJ,QAAQ,GACtC7D,OAAOiE,IAAI,iBAAiBJ,QAAQ,CAAmC,CACxE;CAED,IAAI,CAACD,QAAQM,IAAI,UAAU,iBAAiB,GAAG;EAC7Cf,IAAIE,IAAIC,OAAO,GAAG;EAClB,OAAO;GAAEpB,IAAI;GAAOK,OAAO;EAAe;CAC5C;CAEA,MAAM4B,WAAW,MAAML,cAAcM,QAAQ,EAAEC,MAAM,CAAC,EAAEC,KAAKf,SAAS,GAAGnC,4BAA4BwC,SAAS,MAAM,CAAC,EAAE,CAAC,CAAC,CAACW,KAAK;CAC/H,IAAI,CAACJ,UAAU;EACbhB,IAAIE,IAAIC,OAAO,GAAG;EAClB,OAAO;GAAEpB,IAAI;GAAOK,OAAO;EAAY;CACzC;CAEA,IAAI4B,SAASb,WAAW,UAAUa,SAASK,QACzC,OAAO;EACLtC,IAAI;EACJsC,QAAQL,SAASK;EACjB,GAAIL,SAASM,eAAe,EAAEA,cAAc,KAAK,IAAI,CAAC;CACxD;CAGF,MAAMC,SAAS,MAAMZ,cAAca,iBACjC,EAAEN,MAAM;EAAC,EAAEC,KAAKf,SAAS;EAAG,EAAED,QAAQ,YAAY;EAAGlC,4BAA4BwC,SAAS,QAAQ;CAAC,EAAE,GACrG;EAAEgB,MAAM,EAAEtB,QAAQ,aAAa;EAAGuB,QAAQ,EAAEtC,OAAO,GAAG;CAAE,GACxD,EAAEuC,gBAAgB,QAAQ,CAC5B,CAAC,CAACP,KAAK;CAEP,IAAI,CAACG,QAAQ;EACXvB,IAAIE,IAAIC,OAAO,GAAG;EAClB,OAAO;GAAEpB,IAAI;GAAOK,OAAO;EAAgB;CAC7C;CAEA,MAAMtB,oBAAoB6C,eAAeC,WAAW;CAGpD,MAAMiB,YAAWD,MADEhF,sBAAsBqD,QAAQ,EAAA,CAC3B6B;CACtB,IAAI,CAACD,UAAU;EACb,MAAMlB,cAAcoB,UAClB,EAAEb,MAAM,CAAC,EAAEC,KAAKf,SAAS,GAAGnC,4BAA4BwC,SAAS,QAAQ,CAAC,EAAE,GAC5E,EAAEgB,MAAM;GAAEtB,QAAQ;GAASf,OAAO;EAA4B,EAAE,CAClE;EACAY,IAAIE,IAAIC,OAAO,GAAG;EAClB,OAAO;GAAEpB,IAAI;GAAOK,OAAO;EAAkB;CAC/C;CACA,MAAM4C,aAAajE,cAAc;CACjC,MAAMkE,SAAS,IAAInF,aAAa+E,UAAU,EAAEG,WAAW,CAAC;CACxD,IAAIT,OAAOW,eACT,MAAMrE,8BAA8BgE,UAAUG,UAAU;CAG1D,MAAMG,eAAe,OAAOZ,OAAOa,WAAW,WAAWb,OAAOa,SAASC,KAAAA;CACzE,MAAMC,iBAAiB3E,0BAA0B4D,MAAM;CACvD,MAAMgB,yBAAyBhB,OAAOW,gBAClC,EACAA,eAAe;EACbM,WAAWjB,OAAOW,cAAcM;EAChCC,WAAWlB,OAAOW,cAAcO;EAChCC,MAAMnB,OAAOW,cAAcQ;EAC3BC,iBAAiBpB,OAAOW,cAAcS;CACxC,EACF,IACE,CAAC;CACL,MAAMC,sBACJC,gBACAC,YACAC,aAAsC,CAAC,OACV;EAC7B3C;EACAH;EACA+C,UAAUH;EACVI,WAAWH;EACX,GAAGC;EACH,GAAGT;EACH,GAAGC;CACL;CACA,MAAMW,oBAAoB5F,2BAA2B;CACrD,MAAM6F,4BAA4B5B,OAAO0B,aAAaC;CAEtD,MAAMI,cADmB/B,OAAOyB,SAASxC,KAAK,CAAC,CAAC6C,YAC5BD,MAAqB,mBAAmB7B,OAAOgC,SAAS/C,KAAK,CAAC,CAAC6C,YAAY,CAAC,CAACG,SAAS,MAAM;CAEhH,IAAIC,eAA6C;CACjD,IAAIC,gBAAgBnC,OAAOgC;CAC3B,IAAII,gBAAgBpC,OAAOyB;CAC3B,IAAIY,YAAYrC,OAAO0B;CACvB,IAAIY,mBAA6B,CAAA;CACjC,IAAIC,gBAAgBlB,mBAAmBrB,OAAOyB,UAAUzB,OAAO0B,SAAS;CAExE,IAAI;EACF,IAAI,CAACE,6BAA6BG,aAChC,MAAM,IAAIS,MAAM,eAAe;EAGjC,MAAMC,SAASpD,YAAYqD,KAAK,EAAE7D,SAAS,CAAC,CAAC,CAAC8D,KAAK,EAAEC,OAAO,EAAE,CAAC,CAAC,CAACH,OAAO;EAIxE,IAAIM,gBAAgB;EACpB,IAAIC,cAAc;EAClB,MAAMC,eAAejD,OAAOW,gBAAgBxF,WAAW,QAAQ,IAAI;EACnE,MAAM+H,SAAmB,CAAA;EACzB,IAAIC,gBAAgB;EAEpB,MAAMC,gBAA0B,CAAA;EAChC,MAAMC,aAAuB,CAAA;EAC7B,IAAIC,aAAa;EAEjB,IAAI;GACF,WAAW,MAAMC,YAAYd,QAAQ;IACnC,IAAIc,SAASX,UAAUG,eACrB,MAAM,IAAIP,MAAM,gBAAgB;IAGlC,MAAMlF,QAAQiG,SAASC;IACvBR,eAAe1F,MAAMmG;IACrBR,cAAcS,OAAOpG,KAAK;IAE1B,IAAIsE,2BAA2B;KAC7BsB,OAAOS,KAAKrG,KAAK;KACjB6F,iBAAiB7F,MAAMmG;IACzB,OAAO,IAAI,CAACvB,cAAc;KACxBkB,cAAcO,KAAKrG,KAAK;KAExB,IAAIgG,aAAa3B,mBAAmB;MAClC,MAAMiC,QAAQtG,MAAMuG,SAAS,GAAGC,KAAKC,IAAIzG,MAAMmG,QAAQ9B,oBAAoB2B,UAAU,CAAC;MACtF,IAAIM,MAAMH,QAAQ;OAChBJ,WAAWM,KAAKC,KAAK;OACrBN,cAAcM,MAAMH;MACtB;KACF;KAEA,IAAIH,cAAc3B,mBAAmB;MACnC,MAAMqC,QAAQzG,OAAO0G,OAAOZ,YAAYC,UAAU;MAClD,MAAMY,aAAalI,uBAAuB;OACxCgG,UAAUhC,OAAOgC;OACjBmC,gBAAgBnE,OAAOyB;OACvBC,WAAW1B,OAAO0B;OAClBsC;MACF,CAAC;MAED,IAAIE,WAAWT,QACb,MAAM,IAAIjB,MAAM0B,WAAWE,MAAMC,cAAcA,UAAUC,OAAO,cAAc,IAAI,kBAAkB,2BAA2B;MAGjI/B,gBAAgBlB,mBAAmBrB,OAAOyB,UAAUzB,OAAO0B,SAAS;MACpEQ,eAAexB,OAAO6D,iBAAiBvE,OAAOgC,UAAU,EACtDwC,UAAUjC,cACZ,CAAC;MAED,KAAK,MAAMkC,WAAWrB,eACpB,MAAM/F,cAAc6E,cAAcuC,OAAO;MAE3CrB,cAAcK,SAAS;KACzB;IACF,OACE,MAAMpG,cAAc6E,cAAc5E,KAAK;IAGzCyF,iBAAiB;GACnB;EACF,UAAU;GACR,IAAI;IACF,MAAMN,OAAOK,MAAM;GACrB,QAAQ,CACN;EAEJ;EAEA,IAAIC,kBAAkB/C,OAAO0E,aAC3B,MAAM,IAAIlC,MAAM,gBAAgB;EAGlC,IAAIQ,gBAAgBhD,OAAO0B,WACzB,MAAM,IAAIc,MAAM,qBAAqB;EAGvC,IAAIS,gBAAgBA,aAAa0B,OAAO,KAAK,MAAM3E,OAAOW,eAAeQ,MACvE,MAAM,IAAIqB,MAAM,uBAAuB;EAGzC,IAAIZ,2BAA2B;GAE7B,MAAM,EACJ4B,MAAMqB,WACN7C,UAAU8C,mBACVrD,UAAUsD,mBACVC,SACAR,UAAUS,sBACR,MAAMnJ,sBAPQyB,OAAO0G,OAAOf,QAAQC,aAORyB,GAAW;IACzC5C,UAAUhC,OAAOgC;IACjBmC,gBAAgBnE,OAAOyB;GACzB,CAAC;GAEDU,gBAAgB2C;GAChB1C,gBAAgB2C;GAChB1C,YAAYwC,UAAUpB;GACtBnB,mBAAmB0C;GACnBzC,gBAAgBlB,mBAAmB0D,mBAAmBF,UAAUpB,QAAQ;IACtE,GAAIuB,QAAQvB,SAAS;KAAES,YAAYc;KAASE,iBAAiBlF,OAAO0B;IAAU,IAAI,CAAC;IACnF,GAAGuD;GACL,CAAC;GACD/C,eAAexB,OAAO6D,iBAAiBpC,eAAe,EACpDqC,UAAUjC,cACZ,CAAC;GAED,MAAM4C,WAAWtI,sBAAsBqF,YAAY;GACnDA,aAAakD,IAAIP,SAAS;GAC1B,MAAMM;EACR,OAAO;GACL,IAAI,CAACjD,cAAc;IACjB,MAAM8B,QAAQzG,OAAO0G,OAAOZ,YAAYC,UAAU;IAClD,MAAMY,aAAalI,uBAAuB;KACxCgG,UAAUhC,OAAOgC;KACjBmC,gBAAgBnE,OAAOyB;KACvBC,WAAW1B,OAAO0B;KAClBsC;IACF,CAAC;IAED,IAAIE,WAAWT,QACb,MAAM,IAAIjB,MAAM0B,WAAWE,MAAMC,cAAcA,UAAUC,OAAO,cAAc,IAAI,kBAAkB,2BAA2B;IAGjI/B,gBAAgBlB,mBAAmBrB,OAAOyB,UAAUzB,OAAO0B,SAAS;IACpEQ,eAAexB,OAAO6D,iBAAiBvE,OAAOgC,UAAU,EACtDwC,UAAUjC,cACZ,CAAC;IAED,KAAK,MAAMkC,WAAWrB,eACpB,MAAM/F,cAAc6E,cAAcuC,OAAO;IAE3CrB,cAAcK,SAAS;GACzB;GAEA,MAAM0B,WAAWtI,sBAAsBqF,YAAY;GACnDA,aAAakD,IAAI;GACjB,MAAMD;EACR;EAEA,MAAME,iBAAiBvG,OAAQoD,aAA6CoC,MAAM,EAAE;EACpF,IAAI,CAACe,gBACH,MAAM,IAAI7C,MAAM,iBAAiB;EAGnC,IAAI8C,iBAAiBD;EACrB,IAAItF,eAAe;EACnB,IAAIwF,iBAAgCvF,OAAOW,gBAAgB,OAAO0E;EAElE,IAAIrF,OAAOW,eAAe;GACxB,MAAM6E,kBAAkBlF,SAASmF,WAAW,GAAGhF,WAAU,OAAQ;GACjE,MAAMiF,uBAAuB,IAAIlK,SAAS6J,cAAc;GACxD,MAAMM,mBAAmB;IACvBjH;IACA+B;IACAuB,UAAUG;IACVV,UAAUW;IACVV,WAAWW;IACXuD,aAAahJ,yBAAyB;KACpCgJ,aAAa5F,OAAO4F;KACpBC,UAAU7F,OAAO6F;IACnB,CAAC;IACD,GAAIjF,eAAe,EAAEC,QAAQD,aAAa,IAAI,CAAC;IAC/C,GAAI,OAAOZ,OAAO8F,iBAAiB,WAAW,EAAEA,cAAc9F,OAAO8F,aAAa,IAAI,CAAC;GACzF;GACA,IAAIC,wBAAiC;GAErC,KAAK,IAAIC,UAAU,GAAGA,UAAU,KAAK,CAACT,gBAAgBS,WAAW,GAAG;IAClE,IAAI;KACFT,iBAAiB,MAAM5J,yBAAyB;MAC9C,GAAGgK;MACHM,QAAQP;MACR/E,eAAeX,OAAOW;KACxB,CAAC;KACD,IAAI,CAAC4E,gBAAgB,MAAM,IAAI/C,MAAM,iBAAiB;KACtDD,gBAAgB;MACd,GAAGA;MACH5B,eAAeX,OAAOW;KACxB;KACA;IACF,SAAS9C,OAAO;KACd,IAAI,CAACM,oBAAoBN,KAAK,GAAG,MAAMA;KACvCkI,wBAAwBlI;IAC1B;IAEA,MAAMqI,gBAAgB,MAAMV,gBAAgB9F,QAC1C,EAAE,8BAA8BM,OAAOW,cAAcwF,IAAI,GACzD,EAAEC,YAAY,EAAExG,KAAK,EAAE,EAAE,CAC3B;IACA,IAAI,EAAEsG,eAAetG,eAAepE,WAAW;IAE/C,MAAM6K,uBAAuB,MAAMzK,0BAA0B;KAC3D,GAAG+J;KACHM,QAAQC,cAActG;KACtB0G,kBAAkBtG,OAAOW,cAAcwF;IACzC,CAAC;IACD,IAAI,CAACE,sBAAsB;IAE3B,MAAM3F,OAAO6F,OAAOb,oBAAoB;IACxCJ,iBAAiBY,cAActG,IAAI4G,YAAY;IAC/CjB,iBAAiBc;IACjBtG,eAAe;GACjB;GAEA,IAAI,CAACwF,gBAAgB;IACnB,MAAM7E,OAAO6F,OAAOb,oBAAoB;IACxC,IAAIK,uBAAuB,MAAMA;GACnC;EACF;EACA,IAAI,CAACR,gBACH,MAAM,IAAI/C,MAAM,wBAAwB;EAG1C,MAAMpD,cAAcoB,UAClB,EAAEb,MAAM,CAAC,EAAEC,KAAKf,SAAS,GAAGnC,4BAA4BwC,SAAS,QAAQ,CAAC,EAAE,GAC5E;GACEgB,MAAM;IACJtB,QAAQ;IACRkB,QAAQyF;IACRvD,UAAUG;IACVV,UAAUW;IACVV,WAAWW;IACX,GAAItC,eAAe,EAAEA,cAAc,KAAK,IAAI,CAAC;GAC/C;GACAI,QAAQ,EAAEtC,OAAO,GAAG;EACtB,CACF;EAEA,IAAI,CAACkC,cACH,MAAMlE,4BAA4B;GAChC6C;GACAG;GACAiB,QAAQwF;GACRtD,UAAUG;GACVV,UAAUW;GACV+B,gBAAgBnE,OAAOyB;GACvBC,WAAWW;GACX,GAAI,OAAOrC,OAAO6F,aAAa,YAAY,EAAEA,UAAU7F,OAAO6F,SAAS,IAAI,CAAC;GAC5E,GAAI7F,OAAO4F,cAAc,EAAEA,aAAa5F,OAAO4F,YAAY,IAAI,CAAC;GAChE,GAAI,OAAO5F,OAAO8F,iBAAiB,WAAW,EAAEA,cAAc9F,OAAO8F,aAAa,IAAI,CAAC;GACvF,GAAIlF,eAAe,EAAEC,QAAQD,aAAa,IAAI,CAAC;GAC/C0B;GACAkC,UAAUjC;EACZ,CAAC,CAAC,CAACkE,OAAO5I,UAAU;GAClB6I,QAAQ7I,MAAM,wCAAwC;IACpDa;IACAG;IACAiB,QAAQwF;IACRzH;GACF,CAAC;EACH,CAAC;EAGH,IAAI;GACF,MAAMwB,YAAYsH,WAAW,EAAE9H,SAAS,CAAC;EAC3C,QAAQ,CACN;EAGF,OAAO;GACLrB,IAAI;GACJsC,QAAQyF;GACR,GAAIxF,eAAe,EAAEA,cAAc,KAAK,IAAI,CAAC;EAC/C;CACF,SAASlC,OAAO;EACd,MAAM+I,UAAU/I,iBAAiB2E,QAAQ3E,MAAM+I,UAAU9H,OAAOjB,KAAK;EAErE,MAAMG,kBAAkBkE,YAAY;EAEpC,IAAI0E,YAAY,kBAAkB;GAChC,MAAMxH,cAAcoB,UAClB,EAAEb,MAAM,CAAC,EAAEC,KAAKf,SAAS,GAAGnC,4BAA4BwC,SAAS,QAAQ,CAAC,EAAE,GAC5E,EAAEgB,MAAM,EAAEtB,QAAQ,YAAY,EAAE,CAClC;GACAH,IAAIE,IAAIC,OAAO,GAAG;GAClB,OAAO;IAAEpB,IAAI;IAAOK,OAAO;GAAiB;EAC9C;EAEA,IAAI+I,YAAY,yBAAyB;GACvC,MAAMxH,cAAcoB,UAClB,EAAEb,MAAM,CAAC,EAAEC,KAAKf,SAAS,GAAGnC,4BAA4BwC,SAAS,QAAQ,CAAC,EAAE,GAC5E,EAAEgB,MAAM;IAAEtB,QAAQ;IAASf,OAAO+I;GAAQ,EAAE,CAC9C;GACAnI,IAAIE,IAAIC,OAAO,GAAG;GAClB,OAAO;IAAEpB,IAAI;IAAOK,OAAO+I;GAAQ;EACrC;EAEA,IAAIA,YAAY,iBAAiB;GAC/B,MAAMxH,cAAcoB,UAClB,EAAEb,MAAM,CAAC,EAAEC,KAAKf,SAAS,GAAGnC,4BAA4BwC,SAAS,QAAQ,CAAC,EAAE,GAC5E,EAAEgB,MAAM;IAAEtB,QAAQ;IAASf,OAAO+I;GAAQ,EAAE,CAC9C;GACAnI,IAAIE,IAAIC,OAAO,GAAG;GAClB,OAAO;IAAEpB,IAAI;IAAOK,OAAO+I;GAAQ;EACrC;EAEA,IAAIA,YAAY,oBAAoBA,YAAY,6BAA6B;GAC3E,MAAMxH,cAAcoB,UAClB,EAAEb,MAAM,CAAC,EAAEC,KAAKf,SAAS,GAAGnC,4BAA4BwC,SAAS,QAAQ,CAAC,EAAE,GAC5E,EAAEgB,MAAM;IAAEtB,QAAQ;IAASf,OAAO+I;GAAQ,EAAE,CAC9C;GACAnI,IAAIE,IAAIC,OAAO,GAAG;GAClB,OAAO;IAAEpB,IAAI;IAAOK,OAAO+I;GAAQ;EACrC;EAEA,IAAIA,QAAQC,WAAW,yBAAyB,GAAG;GACjD,MAAMzH,cAAcoB,UAClB,EAAEb,MAAM,CAAC,EAAEC,KAAKf,SAAS,GAAGnC,4BAA4BwC,SAAS,QAAQ,CAAC,EAAE,GAC5E,EAAEgB,MAAM;IAAEtB,QAAQ;IAASf,OAAO+I;GAAQ,EAAE,CAC9C;GACAnI,IAAIE,IAAIC,OAAO,GAAG;GAClB,OAAO;IAAEpB,IAAI;IAAOK,OAAO+I;GAAQ;EACrC;EAEA,IAAIA,YAAY,iBAAiBA,YAAY,uBAAuB;GAClE,MAAMxH,cAAcoB,UAClB,EAAEb,MAAM,CAAC,EAAEC,KAAKf,SAAS,GAAGnC,4BAA4BwC,SAAS,QAAQ,CAAC,EAAE,GAC5E,EAAEgB,MAAM;IAAEtB,QAAQ;IAASf,OAAO+I;GAAQ,EAAE,CAC9C;GACAnI,IAAIE,IAAIC,OAAO,GAAG;GAClB,OAAO;IAAEpB,IAAI;IAAOK,OAAO+I;GAAQ;EACrC;EAEA,MAAMxH,cAAcoB,UAClB,EAAEb,MAAM,CAAC,EAAEC,KAAKf,SAAS,GAAGnC,4BAA4BwC,SAAS,QAAQ,CAAC,EAAE,GAC5E,EAAEgB,MAAM;GAAEtB,QAAQ;GAASf,OAAO+I;EAAQ,EAAE,CAC9C;EAEAnI,IAAIE,IAAIC,OAAO,GAAG;EAClB,OAAO;GAAEpB,IAAI;GAAOK,OAAO;EAAkB;CAC/C;AACF;;;ACrgBA,IAAa4J,YAA2F,OACtGG,UACAC,QAC2C;CAC3C,MAAME,WAAWP,YAAYK,GAAG;CAChC,IAAI,CAACE,UAAU;EACbF,IAAIG,IAAIC,OAAO,GAAG;EAClB,OAAO;GAAEC,IAAI;GAAOC,OAAO;EAAiB;CAC9C;CAEA,MAAMC,WAAWC,OAAOR,IAAIS,IAAIC,QAAQH,YAAY,EAAE,CAAC,CAACI,KAAK;CAC7D,IAAI,CAACJ,UAAU;EACbP,IAAIG,IAAIC,OAAO,GAAG;EAClB,OAAO;GAAEC,IAAI;GAAOC,OAAO;EAAoB;CACjD;CAEA,MAAMM,UAAUpB,oBAAoBQ,KAAKE,QAAQ;CACjD,MAAMW,WAAWpB,YAAYO,KAAKE,UAAUU,OAAO;CAEnD,MAAM,CAACE,eAAeC,eAAe,MAAMd,QAAQe,IAAI,CACrD9B,OAAO+B,IAAI,mBAAmBJ,QAAQ,GACtC3B,OAAO+B,IAAI,iBAAiBJ,QAAQ,CAAmC,CACxE;CAED,IAAI,CAACD,QAAQM,IAAI,QAAQ,iBAAiB,GAAG;EAC3ClB,IAAIG,IAAIC,OAAO,GAAG;EAClB,OAAO;GAAEC,IAAI;GAAOC,OAAO;EAAe;CAC5C;CAEA,MAAMa,UAAU,MAAML,cAAcM,QAAQ,EAAEC,MAAM,CAAC,EAAEC,KAAKf,SAAS,GAAGb,4BAA4BkB,SAAS,MAAM,CAAC,EAAE,CAAC,CAAC,CAACW,KAAK;CAC9H,IAAI,CAACJ,SAAS;EACZnB,IAAIG,IAAIC,OAAO,GAAG;EAClB,OAAO;GAAEC,IAAI;GAAOC,OAAO;EAAY;CACzC;CAOA,MAAMsB,YAAYJ,MALST,YAAYU,KACrC,EAAElB,SAAS,GACX;EAAEmB,OAAO;EAAGJ,KAAK;CAAE,CACrB,CAAC,CAACK,KAAK,EAAED,OAAO,EAAE,CAAC,CAAC,CAACH,KAAK,EAAA,CAGvBO,KAAKC,QAAS,OAAOA,IAAIL,UAAU,WAAWK,IAAIL,QAAQ,EAAG,CAAC,CAC9DM,QAAQC,MAAMC,OAAOC,UAAUF,CAAC,KAAKA,KAAK,CAAC;CAE9C,OAAO;EACL5B,IAAI;EACJD,QAAQe,QAAQf;EAChBgC,WAAWjB,QAAQiB;EACnBC,aAAalB,QAAQkB;EACrBT;EACA,GAAIT,QAAQmB,SAAS,EAAEA,QAAQnB,QAAQmB,OAAO,IAAI,CAAC;CACrD;AACF;;;ACjEA,IAAaE,YAAY;AACzB,IAAaC,aAAa;AAC1B,IAAaC,cAAc;AAC3B,IAAaC,gBAAgB;AAE7B,IAAaC,0BAA0BL,MAAO;CAAC;CAAS;CAAU;AAAQ,CAAC;AAE3E,IAAaO,4BAA4BP,OAAS;CAChDS,WAAWT,OAAS,CAAC,CAACW,KAAK,CAAC,CAACC,IAAI,CAAC,CAAC,CAACC,IAAI,GAAG,CAAC,CAACC,MAAM,0BAA0B;CAC7EC,WAAWf,QAAU,QAAQ;CAC7BiB,MAAMjB,OAAS,CAAC,CAACW,KAAK,CAAC,CAACG,MAAM,iBAAiB;AACjD,CAAC;AAED,IAAaI,oBAAoBlB,OAAS;CACxCmB,UAAUnB,OAAS,CAAC,CAACY,IAAI,CAAC;CAC1BQ,UAAUpB,OAAS,CAAC,CAACY,IAAI,CAAC;CAC1BS,UAAUrB,QAAU,CAAC,CAACuB,SAAS;CAC/BC,aAAanB,wBAAwBkB,SAAS;CAC9CE,eAAelB,0BAA0BgB,SAAS;CAClDG,WAAW1B,OAAS,CAAC,CAAC4B,IAAI,CAAC,CAAChB,IAAI,CAAC;AACnC,CAAC,CAAC,CAACiB,aAAaC,OAAOC,QAAQ;CAC7B,IAAID,MAAMN,gBAAgBQ,KAAAA,KAAaF,MAAMT,aAAaW,KAAAA,GACxDD,IAAIE,SAAS;EACXC,MAAM;EACNC,SAAS;EACTC,MAAM,CAAC,aAAa;CACtB,CAAC;AAEL,CAAC;AAIiCpC,OAAS;CACzCwC,IAAIxC,QAAU;CACdyC,OAAOzC,OAAS,CAAC,CAACuB,SAAS;CAC3BmB,UAAU1C,OAAS,CAAC,CAACuB,SAAS;CAC9BoB,WAAW3C,OAAS,CAAC,CAACuB,SAAS;CAC/BqB,WAAW5C,OAAS,CAAC,CAAC4B,IAAI,CAAC,CAACL,SAAS;CACrCsB,aAAa7C,OAAS,CAAC,CAAC4B,IAAI,CAAC,CAACL,SAAS;CACvCuB,QAAQ9C,OAAS,CAAC,CAACuB,SAAS;CAC5BwB,cAAc/C,QAAU,CAAC,CAACuB,SAAS;AACrC,CAAC;AAImCvB,OAAS;CAC3CwC,IAAIxC,QAAU;CACdyC,OAAOzC,OAAS,CAAC,CAACuB,SAAS;CAC3B2B,QAAQlD,MAAO;EAAC;EAAa;EAAc;EAAQ;CAAO,CAAC,CAAC,CAACuB,SAAS;CACtEqB,WAAW5C,OAAS,CAAC,CAAC4B,IAAI,CAAC,CAACL,SAAS;CACrCsB,aAAa7C,OAAS,CAAC,CAAC4B,IAAI,CAAC,CAACL,SAAS;CACvC4B,UAAUnD,MAAQA,OAAS,CAAC,CAAC4B,IAAI,CAAC,CAAChB,IAAI,CAAC,CAAC,CAAC,CAACW,SAAS;CACpDuB,QAAQ9C,OAAS,CAAC,CAACuB,SAAS;AAC9B,CAAC;AAIqCvB,OAAS;CAC7CwC,IAAIxC,QAAU;CACdyC,OAAOzC,OAAS,CAAC,CAACuB,SAAS;CAC3BuB,QAAQ9C,OAAS,CAAC,CAACuB,SAAS;CAC5BwB,cAAc/C,QAAU,CAAC,CAACuB,SAAS;AACrC,CAAC;;;ACrCD,IAAawD,aAA+F,OAC1GG,SACAC,QACyC;CACzC,MAAME,WAAWT,YAAYO,GAAG;CAChC,IAAI,CAACE,UAAU;EACbF,IAAIG,IAAIC,OAAO,GAAG;EAClB,OAAO;GAAEC,IAAI;GAAOC,OAAO;EAAiB;CAC9C;CAEA,MAAMC,SAASb,UAAUM,GAAG;CAE5B,MAAMQ,SAAAA,kBAAmCE,UAAUX,WAAW,CAAC,CAAC;CAChE,IAAI,CAACS,OAAOG,SAAS;EACnBX,IAAIG,IAAIC,OAAO,GAAG;EAClB,OAAO;GAAEC,IAAI;GAAOC,OAAO;EAAkB;CAC/C;CAEA,MAAM,EAAEM,UAAUC,UAAUC,WAAWC,UAAUC,eAAeC,2BAA2BT,OAAOU;CAClG,MAAMC,cAAcxB,yBAAyB;EAAEwB,aAAaX,OAAOU,KAAKC;EAAaJ;CAAS,CAAC;CAC/F,IAAII,gBAAgB,YAAY,CAACZ,QAAQ;EACvCP,IAAIG,IAAIC,OAAO,GAAG;EAClB,OAAO;GAAEC,IAAI;GAAOC,OAAO;EAA0B;CACvD;CAEA,MAAMc,YAAYb,SAAS,OAAOlC,YAAY,EAAE,CAAC,CAACgD,SAAS,WAAW;CACtE,MAAMC,eAAeF,YAAYlC,iBAAiBqC,OAAOC,KAAKJ,SAAS,CAAC,IAAIK,KAAAA;CAC5E,MAAMT,gBAAgBC,yBAClBjC,yBAAyB;EACzB0C,WAAWT,uBAAuBS;EAClCC,MAAMV,uBAAuBU;EAC7Bf;EACAC;EACAC;EACAK;EACA,GAAIZ,SAAS,EAAEA,OAAO,IAAI,CAAC;EAC3B,GAAIe,eAAe,EAAEA,aAAa,IAAI,CAAC;CACzC,CAAC,IACC;CAEJ,IAAIL,0BAA0B,CAACD,eAAe;EAC5ChB,IAAIG,IAAIC,OAAO,GAAG;EAClB,OAAO;GAAEC,IAAI;GAAOC,OAAO;EAA4B;CACzD;CAEA,IAAIU,eAAe;EAEjB,MAAMa,YAAWD,MADErD,sBAAsB2B,QAAQ,EAAA,CAC3B4B;EACtB,IAAI,CAACD,UAAU;GACb7B,IAAIG,IAAIC,OAAO,GAAG;GAClB,OAAO;IAAEC,IAAI;IAAOC,OAAO;GAA4B;EACzD;EAEA,MAAMyB,aAAa1C,cAAc;EACjC,MAAMF,8BAA8B0C,UAAUE,UAAU;EACxD,MAAMC,eAAe,MAAMH,SAASI,WAAW,GAAGF,WAAU,OAAQ,CAAC,CAACG,QACpE,EAAE,8BAA8BlB,cAAcmB,IAAI,GAClD,EAAEC,YAAY;GAAEC,KAAK;GAAGzB,UAAU;GAAG0B,QAAQ;GAAGC,UAAU;EAAE,EAAE,CAChE;EACA,IAAIP,cAAcK,eAAe5D,UAAU;GACzC,MAAM+D,mBAAmBR,aAAaO,YAAY,OAAOP,aAAaO,aAAa,WAC/EP,aAAaO,WACb,CAAC;GACL,MAAMG,mBAAmB,OAAOF,iBAAiB3B,aAAa,WAC1D2B,iBAAiB3B,WACjBA;GACJ,MAAM8B,eAAe,OAAOX,aAAaM,WAAW,WAChDN,aAAaM,SACbxB;GACJ,MAAM8B,SAAS,MAAMhE,0BAA0B;IAC7CsB;IACA6B;IACAc,QAAQb,aAAaK;IACrBzB;IACAC,UAAU6B;IACV5B,WAAW6B;IACXxB;IACA,GAAIZ,SAAS,EAAEA,OAAO,IAAI,CAAC;IAC3B,GAAIe,eAAe,EAAEA,aAAa,IAAI,CAAC;IACvCwB,kBAAkB9B,cAAcmB;GAClC,CAAC;GACD,IAAIS,QACF,OAAO;IACLvC,IAAI;IACJuC;IACAG,cAAc;IACd,GAAI3B,YAAY,EAAEA,UAAU,IAAI,CAAC;GACnC;EAEJ;CACF;CAEA,MAAM4B,YAAY1D,kBAAkB;CACpC,MAAM2D,cAAcC,KAAKC,KAAKrC,YAAYkC,SAAS;CAGnD,MAAMK,WAAW9D,YAAYS,KAAKE,UADlBjB,oBAAoBe,KAAKE,QACGkD,CAAO;CAEnD,MAAM,CAACE,eAAeC,eAAe,MAAMtD,QAAQuD,IAAI,CACrDhF,OAAOiF,IAAI,mBAAmBJ,QAAQ,GACtC7E,OAAOiF,IAAI,iBAAiBJ,QAAQ,CAAmC,CACxE;CAED,MAAMjE,oBAAoBkE,eAAeC,WAAW;CAEpD,MAAMG,WAAW,IAAIjF,SAAS,CAAC,CAAC4C,SAAS;CACzC,MAAMsC,MAAMC,KAAKD,IAAI;CACrB,MAAME,YAAY,IAAID,KAAKD,MAAMnE,gBAAgB,CAAC;CAElD,MAAM8D,cAAcQ,OAAO;EACzBzB,KAAKqB;EACL,GAAInD,SAAS,EAAEA,OAAO,IAAI,CAAC;EAC3B,GAAIe,eAAe,EAAEA,aAAa,IAAI,CAAC;EACvCV;EACAC;EACAE,UAAUI,gBAAgB;EAC1BA;EACA,GAAIH,gBAAgB,EAAEA,cAAc,IAAI,CAAC;EACzCF;EACAkC;EACAC;EACA7C,QAAQ;EACR2D,WAAW,IAAIH,KAAKD,GAAG;EACvBE;CACF,CAAC;CAED,OAAO;EACLxD,IAAI;EACJqD;EACAV;EACAC;EACA,GAAI7B,YAAY,EAAEA,UAAU,IAAI,CAAC;CACnC;AACF;;;ACzIA,IAAa6D,cAAqE,OAChFE,SACAC,QACkC;CAClC,MAAME,WAAWX,YAAYS,GAAG;CAChC,IAAI,CAACE,UAAU;EACbF,IAAIG,IAAIC,OAAO,GAAG;EAClB,OAAO;GAAET,IAAI;GAAOC,OAAO;EAAiB;CAC9C;CAEA,MAAMS,WAAWC,OAAON,IAAIO,IAAIC,QAAQH,YAAY,EAAE,CAAC,CAACI,KAAK;CAC7D,MAAMC,WAAWJ,OAAON,IAAIO,IAAIC,QAAQG,SAAS,EAAE,CAAC,CAACF,KAAK;CAC1D,MAAME,QAAQC,OAAOF,QAAQ;CAE7B,IAAI,CAACL,YAAY,CAACO,OAAOC,UAAUF,KAAK,KAAKA,QAAQ,GAAG;EACtDX,IAAIG,IAAIC,OAAO,GAAG;EAClB,OAAO;GAAET,IAAI;GAAOC,OAAO;EAAoB;CACjD;CAEA,MAAMkB,UAAU5B,oBAAoBc,KAAKE,QAAQ;CACjD,MAAMa,WAAW1B,YAAYW,KAAKE,UAAUY,OAAO;CAEnD,MAAM,CAACE,eAAeC,eAAe,MAAMhB,QAAQiB,IAAI,CACrDrC,OAAOsC,IAAI,mBAAmBJ,QAAQ,GACtClC,OAAOsC,IAAI,iBAAiBJ,QAAQ,CAAmC,CACxE;CAED,IAAI,CAACD,QAAQM,IAAI,UAAU,iBAAiB,GAAG;EAC7CpB,IAAIG,IAAIC,OAAO,GAAG;EAClB,OAAO;GAAET,IAAI;GAAOC,OAAO;EAAe;CAC5C;CAEA,MAAMyB,UAAU,MAAML,cAAcM,QAAQ,EAAEC,MAAM,CAAC,EAAEC,KAAKnB,SAAS,GAAGf,4BAA4BwB,SAAS,QAAQ,CAAC,EAAE,CAAC,CAAC,CAACW,KAAK;CAChI,IAAI,CAACJ,SAAS;EACZrB,IAAIG,IAAIC,OAAO,GAAG;EAClB,OAAO;GAAET,IAAI;GAAOC,OAAO;EAAY;CACzC;CAEA,IAAIyB,QAAQjB,WAAW,aAAa;EAClCJ,IAAIG,IAAIC,OAAO,GAAG;EAClB,OAAO;GAAET,IAAI;GAAOC,OAAO;EAAgB;CAC7C;CAEA,IAAIe,SAASU,QAAQK,aAAa;EAChC1B,IAAIG,IAAIC,OAAO,GAAG;EAClB,OAAO;GAAET,IAAI;GAAOC,OAAO;EAAqB;CAClD;CAEA,MAAM+B,OAAOlC,gBAAgBM,OAAO;CACpC,IAAI,CAAC4B,MAAM;EACT3B,IAAIG,IAAIC,OAAO,GAAG;EAClB,OAAO;GAAET,IAAI;GAAOC,OAAO;EAAe;CAC5C;CAEA,MAAMgC,eAAejB,UAAUU,QAAQK,cAAc,IACjDL,QAAQQ,YAAYR,QAAQS,aAAaT,QAAQK,cAAc,KAC/DL,QAAQS;CAEZ,IAAIH,KAAKI,SAASH,cAAc;EAC9B5B,IAAIG,IAAIC,OAAO,GAAG;EAClB,OAAO;GAAET,IAAI;GAAOC,OAAO;EAAkB;CAC/C;CAEA,IAAI+B,KAAKI,WAAWH,cAAc;EAChC5B,IAAIG,IAAIC,OAAO,GAAG;EAClB,OAAO;GAAET,IAAI;GAAOC,OAAO;EAAqB;CAClD;CAEA,MAAMoC,iBAAiBhC,IAAIO,IAAIY,IAAI,gBAAgB;CACnD,MAAMc,SAASD,iBAAiB7C,iBAAiBwC,IAAI,IAAIO,KAAAA;CAEzD,IAAIF;MAEEC,WADmBzC,mBAAmBwC,cAC3BG,GAAgB;GAC7BnC,IAAIG,IAAIC,OAAO,GAAG;GAClB,OAAO;IAAET,IAAI;IAAOC,OAAO;GAAoB;EACjD;;CAGF,MAAMR,oBAAoB4B,eAAeC,WAAW;CAEpD,MAAMA,YAAYmB,UAChB;EAAE/B;EAAUM;CAAM,GAClB;EACE0B,MAAM;GACJhC;GACAM;GACAgB;GACAW,MAAMX,KAAKI;GACXE;GACAM,WAAWlB,QAAQkB;EACrB;EACAC,cAAc,EACZC,2BAAW,IAAIC,KAAK,EACtB;CACF,GACA,EAAEC,QAAQ,KAAK,CACjB;CAEA3C,IAAIG,IAAIC,OAAO,GAAG;CAClB,OAAO,EAAET,IAAI,KAAK;AACpB;;;AC7HA,IAAaiD,iBAAiB,EAC5BC,YACAC,8BAII;CACJ,QAAQC,KAAUC,KAAUC,SAAc;EAKxC,IAAI,EAJgB,OAAOF,KAAKI,UAAU,oBAAoB,WAC1DC,OAAOL,IAAII,QAAQ,eAAe,IAClC,GAAA,CAEaE,SAAS,0BAA0B,GAAG;GACrDJ,KAAK;GACL;EACF;EAEA,IAAIK,QAAQ;EACZ,MAAMC,SAAmB,CAAA;EACzB,IAAIE,OAAO;EACX,IAAIC,SAAS;EACb,IAAIC,kBAAwD;EAE5D,MAAMG,qBAAqB,OAAOhB,4BAA4B,YAAYA,0BAA0B,IAChGA,0BACA;EAEJ,MAAMiB,gBAAgB;GACpBhB,IAAIiB,IAAI,QAAQC,MAAM;GACtBlB,IAAIiB,IAAI,OAAOE,KAAK;GACpBnB,IAAIiB,IAAI,SAASG,OAAO;GACxBpB,IAAIiB,IAAI,WAAWI,SAAS;GAC5B,IAAIT,iBAAiB;IACnBU,aAAaV,eAAe;IAC5BA,kBAAkB;GACpB;EACF;EAEA,MAAMW,UAAUC,UAAoB;GAClC,IAAId,MAAM;GACVA,OAAO;GAEPM,QAAQ;GAER,IAAIQ,OAAO;IACTtB,KAAKsB,KAAK;IACV;GACF;GAEAxB,IAAIyB,OAAOhB,OAAOiB,OAAOlB,QAAQD,KAAK;GACtCL,KAAK;EACP;EAEA,MAAMgB,UAAUS,UAAe;GAC7B,IAAIjB,MAAM;GACV,MAAMkB,SAASnB,OAAOoB,SAASF,KAAK,IAAIA,QAAQlB,OAAOqB,KAAKH,KAAK;GACjEpB,SAASqB,OAAOG;GAEhB,IAAIxB,QAAQT,YAAY;IACtBY,OAAO;IACPM,QAAQ;IACRhB,IAAIgC,QAAQ;IACZ/B,IAAIgC,OAAO,GAAG,CAAC,CAACC,KAAK;KAAEC,IAAI;KAAOX,OAAO;IAAkB,CAAC;IAC5D;GACF;GAEAhB,OAAO4B,KAAKR,MAAM;GAElB,IAAI,CAACb,oBAAoB;GAEzB,MAAMsB,MAAMC,KAAKD,IAAI;GAGrB,MAAMM,SAASC,kBADDF,mBADIF,aAAaxC,GACEuC,GAAWxB,oBAAoBsB,GAC/BI,GAAOb,OAAOG,QAAQhB,oBAAoBsB,GAAG;GAE9E,IAAIM,SAAS,KAAK,CAAChC,QAAQ;IACzBA,SAAS;IACTX,IAAI6C,MAAM;IACVjC,kBAAkBE,iBAAiB;KACjCF,kBAAkB;KAClBD,SAAS;KACT,IAAID,MAAM;KACV,IAAI;MACFV,IAAI8C,OAAO;KACb,QAAQ,CACN;IAEJ,GAAGH,MAAM;GACX;EACF;EAEA,MAAMxB,cAAcI,OAAO;EAC3B,MAAMH,WAAW2B,QAAiBxB,OAAOwB,GAAG;EAC5C,MAAM1B,kBAAkBE,uBAAO,IAAIyB,MAAM,iBAAiB,CAAC;EAE3DhD,IAAIiD,GAAG,QAAQ/B,MAAM;EACrBlB,IAAIiD,GAAG,OAAO9B,KAAK;EACnBnB,IAAIiD,GAAG,SAAS7B,OAAO;EACvBpB,IAAIiD,GAAG,WAAW5B,SAAS;CAC7B;AACF;AAQA,IAAMiC,oBAAoB;AAC1B,IAAMC,kBAAkB,MAAU;AAElC,IAAMC,mCAAmB,IAAIC,IAA6B;AAC1D,IAAIC,gBAAgB;AAEpB,IAAMlB,gBAAgBxC,QAAqB;CACzC,MAAM2D,cAAc,OAAO3D,KAAK4D,aAAa,WAAW5D,IAAI4D,WAAW;CACvE,IAAID,YAAYE,KAAK,GAAG,OAAOF,YAAYE,KAAK;CAEhD,QADc,OAAO7D,KAAK+D,OAAO,WAAW/D,IAAI+D,KAAK,GAAA,CACxCF,KAAK,KAAK;AACzB;AAEA,IAAMG,sBAAsB3B,QAAgB;CAC1C,IAAIA,MAAMqB,gBAAgB,KAAQ;CAClCA,gBAAgBrB;CAEhB,IAAImB,iBAAiBS,OAAO,KAAM;CAElC,KAAK,MAAM,CAACC,KAAKzB,UAAUe,kBACzB,IAAInB,MAAMI,MAAMY,aAAaE,iBAC3BC,iBAAiBW,OAAOD,GAAG;AAGjC;AAEA,IAAMxB,sBAAsBwB,KAAanD,oBAA4BsB,QAAiC;CACpG2B,mBAAmB3B,GAAG;CAEtB,MAAM+B,WAAWrD,qBAAqBuC;CACtC,MAAMe,WAAWb,iBAAiBc,IAAIJ,GAAG;CACzC,IAAIG,UAAU;EACZA,SAAShB,aAAahB;EACtBgC,SAASlB,SAASoB,KAAKC,IAAIJ,UAAUC,SAASlB,MAAM;EACpD,OAAOkB;CACT;CAEA,MAAMnE,OAAwB;EAC5BiD,QAAQiB;EACRhB,cAAcf;EACdgB,YAAYhB;CACd;CACAmB,iBAAiBiB,IAAIP,KAAKhE,IAAI;CAC9B,OAAOA;AACT;AAEA,IAAM0C,qBACJH,OACAiC,OACA3D,oBACAsB,QACW;CACX,MAAM+B,WAAWrD,qBAAqBuC;CACtC,MAAMqB,YAAYJ,KAAKK,IAAI,GAAGvC,MAAMI,MAAMW,YAAY;CAEtD,IAAIuB,YAAY,GAAG;EACjBlC,MAAMU,SAASoB,KAAKC,IAAIJ,UAAU3B,MAAMU,SAAUwB,YAAY5D,qBAAsB,GAAI;EACxF0B,MAAMW,eAAef;CACvB;CAEAI,MAAMU,UAAUuB;CAEhB,IAAIjC,MAAMU,UAAU,GAAG,OAAO;CAC9B,OAAOoB,KAAKM,KAAM,CAACpC,MAAMU,SAASpC,qBAAsB,GAAI;AAC9D;;;AChKA,IAAA,mBAAgB0E,QAA0B;CACxC,MAAMC,iBAAiBN,kBAAkB;CACzCK,IAAIE,IACFH,WACAL,cAAc;EACZU,YAAYP,qBAAqBI,cAAc;EAC/CI,yBAAyBT,iCAAiC;CAC5D,CAAC,CACH;CAEAI,IAAIM,KAAKP,WAAmBP,UAAU;CACtCQ,IAAIO,IAAIR,YAAoBN,WAAW;CACvCO,IAAIS,IAAIV,aAAqBR,SAAS;CACtCS,IAAIM,KAAKP,eAAuBT,cAAc;AAChD"}

package/dist/queryWindow-DP8zD0lb.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"queryWindow-DP8zD0lb.js","names":["assert","hkdfSync","getDerivedKey","masterKey","info","length","salt","Buffer","from","toString","createHmac","timingSafeEqual","AUTHENTICATED_USER_ID_HEADER","AUTHENTICATED_TENANT_ID_HEADER","PROXY_AUTH_TIMESTAMP_HEADER","PROXY_AUTH_SIGNATURE_HEADER","MAX_PROXY_AUTH_AGE_MS","HeadersLike","Record","normalizeString","value","normalized","trim","getHeaderValue","headers","name","Array","isArray","getProxySharedSecret","secret","process","env","RB_PROXY_SHARED_SECRET","timingSafeEqualText","left","right","leftBuffer","Buffer","from","rightBuffer","length","buildProxyAuthSignature","userId","tenantId","timestamp","update","digest","getTrustedProxyAuth","signature","parsedTimestamp","Number","isInteger","now","Date","Math","abs","expectedSignature","RequestHandler","models","LoadModelCtx","getTrustedProxyAuth","SessionUserLike","id","currentTenantId","signedInTenants","tenantRoles","isEntryGateAuthorized","RequestLike","headers","Record","session","user","LoadedUserDoc","tenants","normalizeString","value","normalized","trim","normalizeStringArray","Array","isArray","map","entry","String","filter","Boolean","normalizeRoles","normalizeTenantRoles","undefined","Map","entries","from","tenantId","roles","normalizedTenantId","const","length","Object","fromEntries","nextRoles","isSessionAuthorizedForTenant","sessionUser","includes","loadSessionUser","userId","Promise","ctx","req","User","getGlobal","findById","lean","syncAuthenticatedSessionFromRequest","proxyAuth","sessionUserId","baseUser","nextSessionUser","syncAuthenticatedSessionMiddleware","_res","next","then","Request","PaginationPageInfo","PaginationSpec","models","LoadModelCtx","buildAbilityFromSession","getAccessibleByQuery","AclSubjectType","AppAbility","Model","getDerivedKey","JsonObject","Record","SessionUser","id","currentTenantId","RtsPopulateObject","path","model","select","match","options","sort","limit","populate","RtsPopulateOption","Array","RtsQueryOptions","projection","pagination","RtsQueryResult","data","pageInfo","totalCount","PreparedRtsExecution","finalQuery","QUERY_MAX_LIMIT","INTERNAL_MODEL_NAMES","Set","DEFAULT_APPROX_COUNT_SAMPLE_SIZE","MAX_APPROX_COUNT_SAMPLE_SIZE","UNSUPPORTED_APPROX_COUNT_OPERATORS","paginationCursorSigningSecret","getPaginationCursorSigningSecret","masterKey","process","env","MASTER_KEY","trim","Error","normalizeTenantId","value","normalized","getTenantIdFromRequest","req","session","user","resolveRtsRequestTenantId","resolveRtsRequestUserId","isRtsRequestAuthorized","tenantId","sessionUser","buildRtsAbilityFromRequest","Promise","ability","userId","sessionUserId","getTenantModel","modelName","ctx","get","normalizeLimit","Number","isFinite","Math","min","abs","normalizeNonNegativeInteger","floor","getApproxCountSampleSize","raw","RB_RTS_APPROX_COUNT_SAMPLE_SIZE","parsed","findUnsupportedApproxCountOperator","isArray","entry","unsupportedOperator","key","nestedValue","Object","entries","has","castApproxCountQuery","query","castedQuery","find","cast","normalizeString","normalizeObject","undefined","normalizePagination","prepareCursorProjection","includeCursors","addedPaths","inclusionProjection","some","nextProjection","sortFields","map","field","filter","cursorPaths","from","excludedPath","projectedPath","startsWith","push","isIncluded","_id","stripPath","target","parts","split","current","index","length","part","child","cloned","stripAddedProjectionPaths","nodes","node","toObject","call","projected","normalizePopulateSelect","normalizePopulateOptions","max","normalizePopulateObject","nestedPopulate","normalizeRtsPopulateOption","normalizeModelName","resolvePopulateRefModelName","explicitModelName","schema","schemaPath","directRef","ref","arrayRef","caster","virtualPath","virtualpath","virtualRef","mergePopulateMatchWithAcl","populateMatch","aclMatch","keys","$and","PreparedPopulateObject","PreparedPopulateOption","resolvePopulateSpecForModel","allowInternalModels","modelCache","dependencyModelNames","Map","getModelCached","targetModelName","cached","loaded","set","resolveOne","parentModel","refModelName","can","add","Exclude","nestedModel","normalizedEntry","resolved","all","filtered","normalizeRtsQueryOptions","resolveRtsQueryDependencyModelNames","runRtsQuery","paginationMaxLimit","includePaginationCursors","prepareRtsExecution","cursorProjection","paginatedQuery","paginatedResult","paginate","cursor","signingSecret","maxLimit","approximateTotalCount","runApproximateRtsCount","catch","resolvedTotalCount","queryPromise","accessQuery","estimatedTotal","estimatedDocumentCount","sampleSize","sampleResult","aggregate","$sample","size","$match","$count","count","sampleMatches","estimatedMatches","round","runRtsCount","RTS_QUERY_WINDOW_MAX_COUNT"],"sources":["../src/getDerivedKey.ts","../src/proxyAuth.ts","../src/syncAuthenticatedSession.ts","../src/rts/queryExecutor.ts","../src/rts/queryWindow.ts"],"sourcesContent":["import assert from \"assert\"\nimport { hkdfSync } from \"crypto\"\n\n\nexport const getDerivedKey = (\n  masterKey: string,\n  info: string,\n  length: number = 32, // Default to 256-bit keys\n  salt: string = \"\",\n): string => {\n  assert(masterKey?.length >= 32, \"MASTER_KEY must be 32 chars or longer.\")\n\n  return Buffer.from(hkdfSync(\n    \"sha256\",\n    masterKey,\n    Buffer.from(salt),\n    Buffer.from(info),\n    length,\n  )).toString(\"hex\")\n}\n","import { createHmac, timingSafeEqual } from \"node:crypto\"\n\n\nexport const AUTHENTICATED_USER_ID_HEADER = \"rb-authenticated-user-id\"\nexport const AUTHENTICATED_TENANT_ID_HEADER = \"rb-authenticated-tenant-id\"\nexport const PROXY_AUTH_TIMESTAMP_HEADER = \"rb-proxy-auth-timestamp\"\nexport const PROXY_AUTH_SIGNATURE_HEADER = \"rb-proxy-auth-signature\"\n\nconst MAX_PROXY_AUTH_AGE_MS = 5 * 60 * 1000\n\ntype HeadersLike = Record<string, string | string[] | undefined>\n\nconst normalizeString = (value: unknown): string | null => {\n  if (typeof value !== \"string\") return null\n  const normalized = value.trim()\n  return normalized || null\n}\n\nconst getHeaderValue = (headers: HeadersLike | undefined, name: string): string | null => {\n  const value = headers?.[name]\n  if (Array.isArray(value)) return normalizeString(value[0])\n  return normalizeString(value)\n}\n\nconst getProxySharedSecret = (): string | null => {\n  const secret = process.env.RB_PROXY_SHARED_SECRET?.trim()\n  return secret || null\n}\n\nconst timingSafeEqualText = (left: string, right: string): boolean => {\n  const leftBuffer = Buffer.from(left)\n  const rightBuffer = Buffer.from(right)\n  if (leftBuffer.length !== rightBuffer.length) return false\n  return timingSafeEqual(leftBuffer, rightBuffer)\n}\n\nexport const buildProxyAuthSignature = ({\n  userId,\n  tenantId,\n  timestamp,\n  secret,\n}: {\n  userId: string\n  tenantId: string\n  timestamp: string\n  secret: string\n}): string => {\n  return createHmac(\"sha256\", secret)\n    .update(`${timestamp}:${userId}:${tenantId}`)\n    .digest(\"hex\")\n}\n\nexport const getTrustedProxyAuth = (\n  headers: HeadersLike | undefined,\n): { userId: string; tenantId: string } | null => {\n  const userId = getHeaderValue(headers, AUTHENTICATED_USER_ID_HEADER)\n  const tenantId = getHeaderValue(headers, AUTHENTICATED_TENANT_ID_HEADER)\n  const timestamp = getHeaderValue(headers, PROXY_AUTH_TIMESTAMP_HEADER)\n  const signature = getHeaderValue(headers, PROXY_AUTH_SIGNATURE_HEADER)\n  if (!userId || !tenantId || !timestamp || !signature) return null\n\n  const parsedTimestamp = Number(timestamp)\n  if (!Number.isInteger(parsedTimestamp)) return null\n\n  const now = Date.now()\n  if (Math.abs(now - parsedTimestamp) > MAX_PROXY_AUTH_AGE_MS) return null\n\n  const secret = getProxySharedSecret()\n  if (!secret) return null\n\n  const expectedSignature = buildProxyAuthSignature({\n    userId,\n    tenantId,\n    timestamp,\n    secret,\n  })\n\n  if (!timingSafeEqualText(signature, expectedSignature)) return null\n\n  return { userId, tenantId }\n}\n","import type { RequestHandler } from \"express\"\nimport { models, type LoadModelCtx } from \"@rpcbase/db\"\n\nimport {\n  getTrustedProxyAuth,\n} from \"./proxyAuth\"\n\n\ntype SessionUserLike = {\n  id?: unknown\n  currentTenantId?: unknown\n  signedInTenants?: unknown\n  tenantRoles?: unknown\n  isEntryGateAuthorized?: unknown\n}\n\ntype RequestLike = {\n  headers?: Record<string, string | string[] | undefined>\n  session?: {\n    user?: SessionUserLike\n  }\n}\n\ntype LoadedUserDoc = {\n  tenants?: unknown\n  tenantRoles?: unknown\n}\n\nconst normalizeString = (value: unknown): string | null => {\n  if (typeof value !== \"string\") return null\n  const normalized = value.trim()\n  return normalized || null\n}\n\nconst normalizeStringArray = (value: unknown): string[] => {\n  if (!Array.isArray(value)) return []\n  return value\n    .map((entry) => normalizeString(String(entry)))\n    .filter((entry): entry is string => Boolean(entry))\n}\n\nconst normalizeRoles = (value: unknown): string[] => {\n  if (!Array.isArray(value)) return []\n  return value\n    .map((entry) => normalizeString(entry))\n    .filter((entry): entry is string => Boolean(entry))\n}\n\nconst normalizeTenantRoles = (value: unknown): Record<string, string[]> | undefined => {\n  if (!value || typeof value !== \"object\") return undefined\n\n  if (value instanceof Map) {\n    const entries = Array.from(value.entries())\n      .map(([tenantId, roles]) => {\n        const normalizedTenantId = normalizeString(String(tenantId))\n        if (!normalizedTenantId) return null\n        return [normalizedTenantId, normalizeRoles(roles)] as const\n      })\n      .filter((entry): entry is readonly [string, string[]] => Boolean(entry))\n    return entries.length ? Object.fromEntries(entries) : undefined\n  }\n\n  const nextRoles = Object.entries(value as Record<string, unknown>)\n    .map(([tenantId, roles]) => {\n      const normalizedTenantId = normalizeString(tenantId)\n      if (!normalizedTenantId) return null\n      return [normalizedTenantId, normalizeRoles(roles)] as const\n    })\n    .filter((entry): entry is readonly [string, string[]] => Boolean(entry))\n\n  return nextRoles.length ? Object.fromEntries(nextRoles) : undefined\n}\n\nconst isSessionAuthorizedForTenant = (sessionUser: SessionUserLike | undefined, tenantId: string): boolean => {\n  if (!sessionUser) return false\n\n  const signedInTenants = normalizeStringArray(sessionUser.signedInTenants)\n  if (signedInTenants.length > 0) {\n    return signedInTenants.includes(tenantId)\n  }\n\n  const currentTenantId = normalizeString(sessionUser.currentTenantId)\n  return currentTenantId === tenantId\n}\n\nconst loadSessionUser = async (userId: string, tenantId: string): Promise<Record<string, unknown> | null> => {\n  const ctx: LoadModelCtx = { req: { session: null } }\n  const User = await models.getGlobal(\"RBUser\", ctx)\n  const user = await User.findById(userId, { tenants: 1, tenantRoles: 1 }).lean() as LoadedUserDoc | null\n  if (!user) return null\n\n  const signedInTenants = normalizeStringArray(user.tenants)\n  if (!signedInTenants.includes(tenantId)) return null\n\n  const tenantRoles = normalizeTenantRoles(user.tenantRoles)\n\n  return {\n    id: userId,\n    currentTenantId: tenantId,\n    signedInTenants,\n    isEntryGateAuthorized: true,\n    ...(tenantRoles ? { tenantRoles } : {}),\n  }\n}\n\nexport const syncAuthenticatedSessionFromRequest = async (req: RequestLike): Promise<void> => {\n  const proxyAuth = getTrustedProxyAuth(req.headers)\n  if (!proxyAuth) return\n\n  const { userId, tenantId } = proxyAuth\n\n  const session = req.session\n  if (!session) return\n\n  const sessionUser = session.user\n  const sessionUserId = normalizeString(sessionUser?.id)\n\n  if (sessionUserId === userId && isSessionAuthorizedForTenant(sessionUser, tenantId)) {\n    const currentTenantId = normalizeString(sessionUser?.currentTenantId)\n    if (currentTenantId === tenantId) return\n\n    const baseUser = sessionUser && typeof sessionUser === \"object\" ? sessionUser as Record<string, unknown> : {}\n    session.user = {\n      ...baseUser,\n      id: userId,\n      currentTenantId: tenantId,\n      isEntryGateAuthorized: true,\n    }\n    return\n  }\n\n  const nextSessionUser = await loadSessionUser(userId, tenantId)\n  if (!nextSessionUser) {\n    if (session.user) {\n      delete session.user\n    }\n    return\n  }\n\n  session.user = nextSessionUser as SessionUserLike\n}\n\nexport const syncAuthenticatedSessionMiddleware: RequestHandler = (req, _res, next) => {\n  void syncAuthenticatedSessionFromRequest(req).then(() => {\n    next()\n  }, next)\n}\n","import type { Request } from \"express\"\nimport type { PaginationPageInfo, PaginationSpec } from \"@rpcbase/api\"\nimport { models, type LoadModelCtx } from \"@rpcbase/db\"\nimport { buildAbilityFromSession, getAccessibleByQuery, type AclSubjectType, type AppAbility } from \"@rpcbase/db/acl\"\nimport type { Model } from \"mongoose\"\n\nimport { getDerivedKey } from \"../getDerivedKey\"\n\n\ntype JsonObject = Record<string, unknown>\n\ntype SessionUser = {\n  id?: unknown\n  currentTenantId?: unknown\n}\n\nexport type RtsPopulateObject = {\n  path: string\n  model?: string\n  select?: string | JsonObject\n  match?: JsonObject\n  options?: {\n    sort?: Record<string, 1 | -1>\n    limit?: number\n  }\n  populate?: RtsPopulateOption\n}\n\nexport type RtsPopulateOption =\n  | string\n  | RtsPopulateObject\n  | Array<string | RtsPopulateObject>\n\nexport type RtsQueryOptions = {\n  projection?: JsonObject\n  sort?: Record<string, 1 | -1>\n  limit?: number\n  populate?: RtsPopulateOption\n  pagination?: PaginationSpec\n}\n\nexport type RtsQueryResult = {\n  data: unknown[]\n  pageInfo?: PaginationPageInfo\n  totalCount?: number\n}\n\ntype PreparedRtsExecution = {\n  model: Model<any>\n  finalQuery: JsonObject\n}\n\nconst QUERY_MAX_LIMIT = 4096\nconst INTERNAL_MODEL_NAMES = new Set([\"RBRtsChange\", \"RBRtsCounter\"])\nconst DEFAULT_APPROX_COUNT_SAMPLE_SIZE = 1000\nconst MAX_APPROX_COUNT_SAMPLE_SIZE = 10_000\nconst UNSUPPORTED_APPROX_COUNT_OPERATORS = new Set([\"$text\", \"$near\", \"$nearSphere\", \"$where\"])\nlet paginationCursorSigningSecret: string | null = null\n\nconst getPaginationCursorSigningSecret = (): string => {\n  if (paginationCursorSigningSecret) return paginationCursorSigningSecret\n  const masterKey = process.env.MASTER_KEY?.trim()\n  if (!masterKey) {\n    throw new Error(\"MASTER_KEY must be defined to derive pagination cursor signing secret\")\n  }\n  paginationCursorSigningSecret = getDerivedKey(masterKey, \"pagination_cursor_signing\")\n  return paginationCursorSigningSecret\n}\n\nconst normalizeTenantId = (value: unknown): string | null => {\n  if (typeof value !== \"string\") return null\n  const normalized = value.trim()\n  return normalized ? normalized : null\n}\n\nconst getTenantIdFromRequest = (req: Request): string | null => {\n  return normalizeTenantId((req.session?.user as SessionUser | undefined)?.currentTenantId)\n}\n\nexport const resolveRtsRequestTenantId = (req: Request): string | null => {\n  return getTenantIdFromRequest(req)\n}\n\nexport const resolveRtsRequestUserId = (req: Request): string | null => {\n  return normalizeTenantId((req.session?.user as SessionUser | undefined)?.id)\n}\n\nexport const isRtsRequestAuthorized = (req: Request, tenantId: string): boolean => {\n  const sessionUser = req.session?.user as SessionUser | undefined\n  if (!sessionUser) return false\n\n  const currentTenantId = normalizeTenantId(sessionUser.currentTenantId)\n  if (!currentTenantId) return false\n  return currentTenantId === tenantId\n}\n\nexport const buildRtsAbilityFromRequest = async (\n  req: Request,\n  tenantId: string,\n): Promise<{ ability: AppAbility; userId: string | null }> => {\n  const sessionUserId = normalizeTenantId((req.session?.user as SessionUser | undefined)?.id)\n  if (!sessionUserId) {\n    const currentTenantId = normalizeTenantId((req.session?.user as SessionUser | undefined)?.currentTenantId)\n    if (!currentTenantId || currentTenantId !== tenantId) {\n      throw new Error(\"Tenant not authorized for this session\")\n    }\n\n    return {\n      ability: buildAbilityFromSession({ tenantId, session: req.session }),\n      userId: null,\n    }\n  }\n\n  const currentTenantId = normalizeTenantId((req.session?.user as SessionUser | undefined)?.currentTenantId)\n  if (!currentTenantId || currentTenantId !== tenantId) {\n    throw new Error(\"Tenant not authorized for this session\")\n  }\n\n  return {\n    ability: buildAbilityFromSession({ tenantId, session: req.session }),\n    userId: sessionUserId,\n  }\n}\n\nconst getTenantModel = async (tenantId: string, modelName: string, ability: AppAbility): Promise<Model<any>> => {\n  const ctx: LoadModelCtx = {\n    req: {\n      session: {\n        user: {\n          currentTenantId: tenantId,\n        },\n      },\n    },\n    ability,\n  }\n\n  return models.get(modelName, ctx)\n}\n\nconst normalizeLimit = (limit?: number): number => {\n  if (typeof limit !== \"number\") return QUERY_MAX_LIMIT\n  if (!Number.isFinite(limit)) return QUERY_MAX_LIMIT\n  return Math.min(QUERY_MAX_LIMIT, Math.abs(limit))\n}\n\nconst normalizeNonNegativeInteger = (value: unknown): number => {\n  if (typeof value !== \"number\") return 0\n  if (!Number.isFinite(value) || value < 0) return 0\n  return Math.floor(value)\n}\n\nconst getApproxCountSampleSize = (): number => {\n  const raw = process.env.RB_RTS_APPROX_COUNT_SAMPLE_SIZE?.trim() ?? \"\"\n  if (!raw) return DEFAULT_APPROX_COUNT_SAMPLE_SIZE\n\n  const parsed = Number(raw)\n  if (!Number.isFinite(parsed) || parsed <= 0) return DEFAULT_APPROX_COUNT_SAMPLE_SIZE\n  return Math.min(MAX_APPROX_COUNT_SAMPLE_SIZE, Math.floor(parsed))\n}\n\nconst findUnsupportedApproxCountOperator = (value: unknown): string | null => {\n  if (!value || typeof value !== \"object\") return null\n\n  if (Array.isArray(value)) {\n    for (const entry of value) {\n      const unsupportedOperator = findUnsupportedApproxCountOperator(entry)\n      if (unsupportedOperator) return unsupportedOperator\n    }\n    return null\n  }\n\n  for (const [key, nestedValue] of Object.entries(value as Record<string, unknown>)) {\n    if (UNSUPPORTED_APPROX_COUNT_OPERATORS.has(key)) {\n      return key\n    }\n\n    const unsupportedOperator = findUnsupportedApproxCountOperator(nestedValue)\n    if (unsupportedOperator) return unsupportedOperator\n  }\n\n  return null\n}\n\nconst castApproxCountQuery = (model: Model<any>, query: JsonObject): JsonObject => {\n  const castedQuery = model.find(query).cast(model)\n  if (!castedQuery || typeof castedQuery !== \"object\" || Array.isArray(castedQuery)) {\n    return query\n  }\n\n  return castedQuery as JsonObject\n}\n\nconst normalizeString = (value: unknown): string => {\n  return typeof value === \"string\" ? value.trim() : \"\"\n}\n\nconst normalizeObject = (value: unknown): JsonObject | undefined => {\n  if (!value || typeof value !== \"object\" || Array.isArray(value)) return undefined\n  return value as JsonObject\n}\n\nconst normalizePagination = (value: unknown): PaginationSpec | undefined => {\n  if (!value || typeof value !== \"object\" || Array.isArray(value)) return undefined\n  return value as PaginationSpec\n}\n\nconst prepareCursorProjection = (\n  projection: JsonObject | undefined,\n  pagination: PaginationSpec,\n  includeCursors: boolean,\n): { projection: JsonObject | undefined; addedPaths: string[] } => {\n  if (!projection || !includeCursors) return { projection, addedPaths: [] }\n\n  const inclusionProjection = Object.entries(projection).some(([, value]) => value === 1)\n  const nextProjection = { ...projection }\n  const addedPaths: string[] = []\n  const sortFields = Array.isArray(pagination.sort)\n    ? pagination.sort\n      .map((entry) => entry?.field)\n      .filter((field): field is string => typeof field === \"string\")\n    : []\n  const cursorPaths = Array.from(new Set([...sortFields, \"_id\"]))\n\n  if (!inclusionProjection) {\n    for (const path of cursorPaths) {\n      const excludedPath = Object.entries(projection).find(([projectedPath, value]) =>\n        value === 0 && (projectedPath === path || path.startsWith(`${projectedPath}.`)),\n      )?.[0]\n      if (!excludedPath) continue\n      if (excludedPath !== path) {\n        throw new Error(`Pagination projection cannot exclude cursor path: ${path}`)\n      }\n      delete nextProjection[path]\n      addedPaths.push(path)\n    }\n    return { projection: nextProjection, addedPaths }\n  }\n\n  for (const path of cursorPaths) {\n    const isIncluded = path === \"_id\"\n      ? projection._id !== 0\n      : Object.entries(projection).some(([projectedPath, value]) =>\n        value === 1 && (projectedPath === path || path.startsWith(`${projectedPath}.`)),\n      )\n    if (isIncluded) continue\n    nextProjection[path] = 1\n    addedPaths.push(path)\n  }\n\n  return { projection: nextProjection, addedPaths }\n}\n\nconst stripPath = (target: JsonObject, path: string): void => {\n  const parts = path.split(\".\")\n  let current = target\n\n  for (let index = 0; index < parts.length - 1; index += 1) {\n    const part = parts[index]!\n    const child = current[part]\n    if (!child || typeof child !== \"object\" || Array.isArray(child)) return\n    const cloned = { ...(child as JsonObject) }\n    current[part] = cloned\n    current = cloned\n  }\n\n  delete current[parts[parts.length - 1]!]\n}\n\nconst stripAddedProjectionPaths = (nodes: unknown[], addedPaths: string[]): unknown[] => {\n  if (!addedPaths.length) return nodes\n\n  return nodes.map((node) => {\n    if (!node || typeof node !== \"object\" || Array.isArray(node)) return node\n    const toObject = (node as { toObject?: unknown }).toObject\n    const raw = typeof toObject === \"function\"\n      ? toObject.call(node)\n      : node\n    if (!raw || typeof raw !== \"object\" || Array.isArray(raw)) return raw\n    const projected = { ...(raw as JsonObject) }\n    for (const path of addedPaths) stripPath(projected, path)\n    return projected\n  })\n}\n\nconst normalizePopulateSelect = (value: unknown): string | JsonObject | undefined => {\n  if (typeof value === \"string\") {\n    const normalized = value.trim()\n    return normalized || undefined\n  }\n  return normalizeObject(value)\n}\n\nconst normalizePopulateOptions = (value: unknown): RtsPopulateObject[\"options\"] | undefined => {\n  if (!value || typeof value !== \"object\" || Array.isArray(value)) return undefined\n  const raw = value as { sort?: unknown; limit?: unknown }\n  const normalized: RtsPopulateObject[\"options\"] = {}\n\n  if (raw.sort && typeof raw.sort === \"object\" && !Array.isArray(raw.sort)) {\n    normalized.sort = raw.sort as Record<string, 1 | -1>\n  }\n\n  if (typeof raw.limit === \"number\" && Number.isFinite(raw.limit)) {\n    normalized.limit = Math.max(0, Math.floor(Math.abs(raw.limit)))\n  }\n\n  if (!normalized.sort && normalized.limit === undefined) return undefined\n  return normalized\n}\n\nconst normalizePopulateObject = (value: unknown): RtsPopulateObject | undefined => {\n  if (!value || typeof value !== \"object\" || Array.isArray(value)) return undefined\n  const raw = value as Record<string, unknown>\n  const path = normalizeString(raw.path)\n  if (!path) return undefined\n\n  const normalized: RtsPopulateObject = { path }\n\n  const model = normalizeString(raw.model)\n  if (model) normalized.model = model\n\n  const select = normalizePopulateSelect(raw.select)\n  if (select !== undefined) normalized.select = select\n\n  const match = normalizeObject(raw.match)\n  if (match) normalized.match = match\n\n  const nestedPopulate = normalizeRtsPopulateOption(raw.populate)\n  if (nestedPopulate !== undefined) normalized.populate = nestedPopulate\n\n  const options = normalizePopulateOptions(raw.options)\n  if (options) normalized.options = options\n\n  return normalized\n}\n\nconst normalizeRtsPopulateOption = (value: unknown): RtsPopulateOption | undefined => {\n  if (typeof value === \"string\") {\n    const normalized = value.trim()\n    return normalized || undefined\n  }\n\n  if (Array.isArray(value)) {\n    const normalized = value\n      .map((entry) => {\n        if (typeof entry === \"string\") {\n          const path = entry.trim()\n          return path || null\n        }\n        return normalizePopulateObject(entry) ?? null\n      })\n      .filter((entry): entry is string | RtsPopulateObject => entry !== null)\n\n    return normalized.length > 0 ? normalized : undefined\n  }\n\n  return normalizePopulateObject(value)\n}\n\nconst normalizeModelName = (value: unknown): string | null => {\n  if (typeof value !== \"string\") return null\n  const normalized = value.trim()\n  return normalized || null\n}\n\nconst resolvePopulateRefModelName = (\n  model: Model<any>,\n  path: string,\n  explicitModelName: string | null,\n): string | null => {\n  if (explicitModelName) return explicitModelName\n\n  const schema = model.schema as any\n  const schemaPath = typeof schema.path === \"function\" ? schema.path(path) : null\n  const directRef = normalizeModelName(schemaPath?.options?.ref)\n  if (directRef) return directRef\n\n  const arrayRef = normalizeModelName(schemaPath?.caster?.options?.ref)\n  if (arrayRef) return arrayRef\n\n  const virtualPath = typeof schema.virtualpath === \"function\" ? schema.virtualpath(path) : null\n  const virtualRef = normalizeModelName(virtualPath?.options?.ref)\n  if (virtualRef) return virtualRef\n\n  return null\n}\n\nconst mergePopulateMatchWithAcl = (\n  populateMatch: JsonObject | undefined,\n  aclMatch: JsonObject,\n): JsonObject => {\n  if (!populateMatch || Object.keys(populateMatch).length === 0) return aclMatch\n  return { $and: [populateMatch, aclMatch] }\n}\n\ntype PreparedPopulateObject = {\n  path: string\n  model?: string\n  select?: string | JsonObject\n  match?: JsonObject\n  options?: {\n    sort?: Record<string, 1 | -1>\n    limit?: number\n  }\n  populate?: PreparedPopulateOption\n}\n\ntype PreparedPopulateOption =\n  | string\n  | PreparedPopulateObject\n  | Array<string | PreparedPopulateObject>\n\nconst resolvePopulateSpecForModel = async ({\n  tenantId,\n  model,\n  ability,\n  populate,\n  allowInternalModels,\n  modelCache,\n  dependencyModelNames,\n}: {\n  tenantId: string\n  model: Model<any>\n  ability: AppAbility\n  populate: RtsPopulateOption | undefined\n  allowInternalModels: boolean\n  modelCache: Map<string, Model<any>>\n  dependencyModelNames: Set<string>\n}): Promise<PreparedPopulateOption | undefined> => {\n  if (!populate) return undefined\n\n  const getModelCached = async (targetModelName: string): Promise<Model<any>> => {\n    const cached = modelCache.get(targetModelName)\n    if (cached) return cached\n    const loaded = await getTenantModel(tenantId, targetModelName, ability)\n    modelCache.set(targetModelName, loaded)\n    return loaded\n  }\n\n  const resolveOne = async (\n    entry: string | RtsPopulateObject,\n    parentModel: Model<any>,\n  ): Promise<string | PreparedPopulateObject | null> => {\n    if (typeof entry === \"string\") {\n      const path = entry.trim()\n      if (!path) return null\n\n      const refModelName = resolvePopulateRefModelName(parentModel, path, null)\n      if (!refModelName) return path\n      if (!allowInternalModels && INTERNAL_MODEL_NAMES.has(refModelName)) {\n        throw new Error(\"Model not allowed\")\n      }\n      if (!ability.can(\"read\", refModelName as AclSubjectType)) {\n        throw new Error(\"forbidden\")\n      }\n\n      dependencyModelNames.add(refModelName)\n\n      const aclMatch = getAccessibleByQuery(\n        ability,\n        \"read\",\n        refModelName as Exclude<AclSubjectType, \"all\">,\n      )\n      return {\n        path,\n        match: aclMatch as JsonObject,\n      }\n    }\n\n    const path = entry.path.trim()\n    if (!path) return null\n\n    const explicitModelName = normalizeModelName(entry.model)\n    const refModelName = resolvePopulateRefModelName(parentModel, path, explicitModelName)\n    let nestedModel = parentModel\n\n    const normalizedEntry: PreparedPopulateObject = {\n      path,\n    }\n\n    if (entry.select !== undefined) normalizedEntry.select = entry.select\n    if (entry.options !== undefined) normalizedEntry.options = entry.options\n    if (explicitModelName) normalizedEntry.model = explicitModelName\n    if (entry.match !== undefined) normalizedEntry.match = entry.match\n\n    if (refModelName) {\n      if (!allowInternalModels && INTERNAL_MODEL_NAMES.has(refModelName)) {\n        throw new Error(\"Model not allowed\")\n      }\n      if (!ability.can(\"read\", refModelName as AclSubjectType)) {\n        throw new Error(\"forbidden\")\n      }\n\n      dependencyModelNames.add(refModelName)\n      nestedModel = await getModelCached(refModelName)\n\n      const aclMatch = getAccessibleByQuery(\n        ability,\n        \"read\",\n        refModelName as Exclude<AclSubjectType, \"all\">,\n      ) as JsonObject\n      normalizedEntry.match = mergePopulateMatchWithAcl(\n        normalizedEntry.match,\n        aclMatch,\n      )\n    } else if (entry.populate !== undefined) {\n      throw new Error(\"Populate path must reference a model when nested populate is used\")\n    }\n\n    const nestedPopulate = await resolvePopulateSpecForModel({\n      tenantId,\n      model: nestedModel,\n      ability,\n      populate: entry.populate,\n      allowInternalModels,\n      modelCache,\n      dependencyModelNames,\n    })\n    if (nestedPopulate !== undefined) normalizedEntry.populate = nestedPopulate\n\n    return normalizedEntry\n  }\n\n  if (Array.isArray(populate)) {\n    const resolved = await Promise.all(populate.map((entry) => resolveOne(entry, model)))\n    const filtered = resolved.filter((entry): entry is string | PreparedPopulateObject => entry !== null)\n    return filtered.length > 0 ? filtered : undefined\n  }\n\n  const resolved = await resolveOne(populate, model)\n  return resolved ?? undefined\n}\n\nexport const normalizeRtsQueryOptions = (options: RtsQueryOptions | undefined): RtsQueryOptions => {\n  if (!options || typeof options !== \"object\") return {}\n  const normalized: RtsQueryOptions = {}\n\n  if (options.projection && typeof options.projection === \"object\" && !Array.isArray(options.projection)) {\n    normalized.projection = options.projection\n  }\n\n  if (options.sort && typeof options.sort === \"object\" && !Array.isArray(options.sort)) {\n    normalized.sort = options.sort\n  }\n\n  normalized.limit = normalizeLimit(options.limit)\n  normalized.populate = normalizeRtsPopulateOption(options.populate)\n  normalized.pagination = normalizePagination(options.pagination)\n\n  return normalized\n}\n\nexport const resolveRtsQueryDependencyModelNames = async ({\n  tenantId,\n  ability,\n  modelName,\n  options,\n  allowInternalModels = false,\n}: {\n  tenantId: string\n  ability: AppAbility\n  modelName: string\n  options: RtsQueryOptions\n  allowInternalModels?: boolean\n}): Promise<string[]> => {\n  const model = await getTenantModel(tenantId, modelName, ability)\n  const modelCache = new Map<string, Model<any>>()\n  modelCache.set(modelName, model)\n\n  const dependencyModelNames = new Set<string>()\n  await resolvePopulateSpecForModel({\n    tenantId,\n    model,\n    ability,\n    populate: options.populate,\n    allowInternalModels,\n    modelCache,\n    dependencyModelNames,\n  })\n\n  return Array.from(dependencyModelNames)\n}\n\nexport const runRtsQuery = async ({\n  tenantId,\n  ability,\n  modelName,\n  query,\n  options,\n  allowInternalModels = false,\n  paginationMaxLimit,\n  includePaginationCursors = true,\n}: {\n  tenantId: string\n  ability: AppAbility\n  modelName: string\n  query: JsonObject\n  options: RtsQueryOptions\n  allowInternalModels?: boolean\n  paginationMaxLimit?: number\n  includePaginationCursors?: boolean\n}): Promise<RtsQueryResult> => {\n  const { model, finalQuery } = await prepareRtsExecution({\n    tenantId,\n    ability,\n    modelName,\n    query,\n    allowInternalModels,\n  })\n  const projection = options.projection ?? undefined\n  const sort = options.sort\n  const limit = normalizeLimit(options.limit)\n  const modelCache = new Map<string, Model<any>>()\n  modelCache.set(modelName, model)\n\n  const populate = await resolvePopulateSpecForModel({\n    tenantId,\n    model,\n    ability,\n    populate: options.populate,\n    allowInternalModels,\n    modelCache,\n    dependencyModelNames: new Set<string>(),\n  })\n\n  if (options.pagination) {\n    const cursorProjection = prepareCursorProjection(\n      projection,\n      options.pagination,\n      includePaginationCursors,\n    )\n    const paginatedQuery = model.find(finalQuery, cursorProjection.projection)\n    if (populate !== undefined) {\n      paginatedQuery.populate(populate as any)\n    }\n\n    const paginatedResult = await paginatedQuery.paginate(options.pagination, {\n      cursor: {\n        signingSecret: getPaginationCursorSigningSecret(),\n        ...(paginationMaxLimit !== undefined ? { maxLimit: paginationMaxLimit } : {}),\n      },\n      includeCursors: includePaginationCursors,\n    })\n    const totalCount = typeof paginatedResult.totalCount === \"number\"\n      && Number.isFinite(paginatedResult.totalCount)\n      && paginatedResult.totalCount >= 0\n      ? Math.floor(paginatedResult.totalCount)\n      : undefined\n    const approximateTotalCount = totalCount === undefined\n      ? await runApproximateRtsCount(model, finalQuery).catch(() => undefined)\n      : undefined\n    const resolvedTotalCount = totalCount ?? approximateTotalCount\n\n    return {\n      data: Array.isArray(paginatedResult.nodes)\n        ? stripAddedProjectionPaths(paginatedResult.nodes, cursorProjection.addedPaths)\n        : [],\n      pageInfo: paginatedResult.pageInfo,\n      ...(resolvedTotalCount !== undefined ? { totalCount: resolvedTotalCount } : {}),\n    }\n  }\n\n  const queryPromise = model.find(finalQuery, projection)\n  if (populate !== undefined) {\n    queryPromise.populate(populate as any)\n  }\n  if (sort && Object.keys(sort).length) {\n    queryPromise.sort(sort)\n  }\n  queryPromise.limit(limit)\n\n  const data = await queryPromise\n  return { data: Array.isArray(data) ? data : [] }\n}\n\nconst prepareRtsExecution = async ({\n  tenantId,\n  ability,\n  modelName,\n  query,\n  allowInternalModels = false,\n}: {\n  tenantId: string\n  ability: AppAbility\n  modelName: string\n  query: JsonObject\n  allowInternalModels?: boolean\n}): Promise<PreparedRtsExecution> => {\n  if (!allowInternalModels && INTERNAL_MODEL_NAMES.has(modelName)) {\n    throw new Error(\"Model not allowed\")\n  }\n\n  if (!ability.can(\"read\", modelName as AclSubjectType)) {\n    throw new Error(\"forbidden\")\n  }\n\n  const model = await getTenantModel(tenantId, modelName, ability)\n  const accessQuery = getAccessibleByQuery(ability, \"read\", modelName as Exclude<AclSubjectType, \"all\">)\n  const finalQuery: JsonObject = { $and: [query, accessQuery] }\n\n  return { model, finalQuery }\n}\n\nconst runApproximateRtsCount = async (model: Model<any>, query: JsonObject): Promise<number> => {\n  const unsupportedOperator = findUnsupportedApproxCountOperator(query)\n  if (unsupportedOperator) {\n    throw new Error(`Approximate RTS count does not support ${unsupportedOperator} queries`)\n  }\n\n  const castedQuery = castApproxCountQuery(model, query)\n  const estimatedTotal = normalizeNonNegativeInteger(await model.estimatedDocumentCount())\n  if (estimatedTotal === 0) return 0\n\n  const sampleSize = Math.min(getApproxCountSampleSize(), estimatedTotal)\n  const sampleResult = await model.aggregate([\n    { $sample: { size: sampleSize } },\n    { $match: castedQuery },\n    { $count: \"count\" },\n  ]) as Array<{ count?: unknown }>\n  const sampleMatches = normalizeNonNegativeInteger(sampleResult[0]?.count)\n\n  if (sampleSize >= estimatedTotal) {\n    return Math.min(sampleMatches, estimatedTotal)\n  }\n\n  const estimatedMatches = Math.round((estimatedTotal * sampleMatches) / sampleSize)\n  return Math.max(0, Math.min(estimatedTotal, estimatedMatches))\n}\n\nexport const runRtsCount = async ({\n  tenantId,\n  ability,\n  modelName,\n  query,\n  allowInternalModels = false,\n}: {\n  tenantId: string\n  ability: AppAbility\n  modelName: string\n  query: JsonObject\n  allowInternalModels?: boolean\n}): Promise<number> => {\n  const { model, finalQuery } = await prepareRtsExecution({\n    tenantId,\n    ability,\n    modelName,\n    query,\n    allowInternalModels,\n  })\n\n  return await runApproximateRtsCount(model, finalQuery)\n}\n","export const RTS_QUERY_WINDOW_MAX_COUNT = 4096\n"],"mappings":";;;;;;AAIA,IAAaE,iBACXC,WACAC,MACAC,SAAiB,IACjBC,OAAe,OACJ;CACXN,OAAOG,WAAWE,UAAU,IAAI,wCAAwC;CAExE,OAAOE,OAAOC,KAAKP,SACjB,UACAE,WACAI,OAAOC,KAAKF,IAAI,GAChBC,OAAOC,KAAKJ,IAAI,GAChBC,MACF,CAAC,CAAC,CAACI,SAAS,KAAK;AACnB;;;AChBA,IAAaG,+BAA+B;AAC5C,IAAaC,iCAAiC;AAC9C,IAAaC,8BAA8B;AAC3C,IAAaC,8BAA8B;AAE3C,IAAMC,wBAAwB,MAAS;AAIvC,IAAMG,qBAAmBC,UAAkC;CACzD,IAAI,OAAOA,UAAU,UAAU,OAAO;CAEtC,OADmBA,MAAME,KAClBD,KAAc;AACvB;AAEA,IAAME,kBAAkBC,SAAkCC,SAAgC;CACxF,MAAML,QAAQI,UAAUC;CACxB,IAAIC,MAAMC,QAAQP,KAAK,GAAG,OAAOD,kBAAgBC,MAAM,EAAE;CACzD,OAAOD,kBAAgBC,KAAK;AAC9B;AAEA,IAAMQ,6BAA4C;CAEhD,OADeE,QAAQC,IAAIC,wBAAwBV,KAAK,KACvC;AACnB;AAEA,IAAMW,uBAAuBC,MAAcC,UAA2B;CACpE,MAAMC,aAAaC,OAAOC,KAAKJ,IAAI;CACnC,MAAMK,cAAcF,OAAOC,KAAKH,KAAK;CACrC,IAAIC,WAAWI,WAAWD,YAAYC,QAAQ,OAAO;CACrD,OAAO7B,gBAAgByB,YAAYG,WAAW;AAChD;AAEA,IAAaE,2BAA2B,EACtCC,QACAC,UACAC,WACAf,aAMY;CACZ,OAAOnB,WAAW,UAAUmB,MAAM,CAAC,CAChCgB,OAAO,GAAGD,UAAS,GAAIF,OAAM,GAAIC,UAAU,CAAC,CAC5CG,OAAO,KAAK;AACjB;AAEA,IAAaC,uBACXvB,YACgD;CAChD,MAAMkB,SAASnB,eAAeC,SAASZ,4BAA4B;CACnE,MAAM+B,WAAWpB,eAAeC,SAASX,8BAA8B;CACvE,MAAM+B,YAAYrB,eAAeC,SAASV,2BAA2B;CACrE,MAAMkC,YAAYzB,eAAeC,SAAST,2BAA2B;CACrE,IAAI,CAAC2B,UAAU,CAACC,YAAY,CAACC,aAAa,CAACI,WAAW,OAAO;CAE7D,MAAMC,kBAAkBC,OAAON,SAAS;CACxC,IAAI,CAACM,OAAOC,UAAUF,eAAe,GAAG,OAAO;CAG/C,IAAIK,KAAKC,IADGF,KAAKD,IACJA,IAAMH,eAAe,IAAIjC,uBAAuB,OAAO;CAEpE,MAAMa,SAASD,qBAAqB;CACpC,IAAI,CAACC,QAAQ,OAAO;CASpB,IAAI,CAACI,oBAAoBe,WAPCP,wBAAwB;EAChDC;EACAC;EACAC;EACAf;CACF,CAEoC2B,CAAiB,GAAG,OAAO;CAE/D,OAAO;EAAEd;EAAQC;CAAS;AAC5B;;;ACpDA,IAAM+B,qBAAmBC,UAAkC;CACzD,IAAI,OAAOA,UAAU,UAAU,OAAO;CAEtC,OADmBA,MAAME,KAClBD,KAAc;AACvB;AAEA,IAAME,wBAAwBH,UAA6B;CACzD,IAAI,CAACI,MAAMC,QAAQL,KAAK,GAAG,OAAO,CAAA;CAClC,OAAOA,MACJM,KAAKC,UAAUR,kBAAgBS,OAAOD,KAAK,CAAC,CAAC,CAAC,CAC9CE,QAAQF,UAA2BG,QAAQH,KAAK,CAAC;AACtD;AAEA,IAAMI,kBAAkBX,UAA6B;CACnD,IAAI,CAACI,MAAMC,QAAQL,KAAK,GAAG,OAAO,CAAA;CAClC,OAAOA,MACJM,KAAKC,UAAUR,kBAAgBQ,KAAK,CAAC,CAAC,CACtCE,QAAQF,UAA2BG,QAAQH,KAAK,CAAC;AACtD;AAEA,IAAMK,wBAAwBZ,UAAyD;CACrF,IAAI,CAACA,SAAS,OAAOA,UAAU,UAAU,OAAOa,KAAAA;CAEhD,IAAIb,iBAAiBc,KAAK;EACxB,MAAMC,UAAUX,MAAMY,KAAKhB,MAAMe,QAAQ,CAAC,CAAC,CACxCT,KAAK,CAACW,UAAUC,WAAW;GAC1B,MAAMC,qBAAqBpB,kBAAgBS,OAAOS,QAAQ,CAAC;GAC3D,IAAI,CAACE,oBAAoB,OAAO;GAChC,OAAO,CAACA,oBAAoBR,eAAeO,KAAK,CAAC;EACnD,CAAC,CAAC,CACDT,QAAQF,UAAgDG,QAAQH,KAAK,CAAC;EACzE,OAAOQ,QAAQM,SAASC,OAAOC,YAAYR,OAAO,IAAIF,KAAAA;CACxD;CAEA,MAAMW,YAAYF,OAAOP,QAAQf,KAAgC,CAAC,CAC/DM,KAAK,CAACW,UAAUC,WAAW;EAC1B,MAAMC,qBAAqBpB,kBAAgBkB,QAAQ;EACnD,IAAI,CAACE,oBAAoB,OAAO;EAChC,OAAO,CAACA,oBAAoBR,eAAeO,KAAK,CAAC;CACnD,CAAC,CAAC,CACDT,QAAQF,UAAgDG,QAAQH,KAAK,CAAC;CAEzE,OAAOiB,UAAUH,SAASC,OAAOC,YAAYC,SAAS,IAAIX,KAAAA;AAC5D;AAEA,IAAMY,gCAAgCC,aAA0CT,aAA8B;CAC5G,IAAI,CAACS,aAAa,OAAO;CAEzB,MAAMrC,kBAAkBc,qBAAqBuB,YAAYrC,eAAe;CACxE,IAAIA,gBAAgBgC,SAAS,GAC3B,OAAOhC,gBAAgBsC,SAASV,QAAQ;CAI1C,OADwBlB,kBAAgB2B,YAAYtC,eAC7CA,MAAoB6B;AAC7B;AAEA,IAAMW,kBAAkB,OAAOC,QAAgBZ,aAA8D;CAG3G,MAAMrB,OAAO,OAAMqC,MADAlD,OAAOmD,UAAU,UAAUH,EADlBC,KAAK,EAAErC,SAAS,KAAK,EACHoC,CAAG,EAAA,CACzBI,SAASN,QAAQ;EAAE/B,SAAS;EAAGR,aAAa;CAAE,CAAC,CAAC,CAAC8C,KAAK;CAC9E,IAAI,CAACxC,MAAM,OAAO;CAElB,MAAMP,kBAAkBc,qBAAqBP,KAAKE,OAAO;CACzD,IAAI,CAACT,gBAAgBsC,SAASV,QAAQ,GAAG,OAAO;CAEhD,MAAM3B,cAAcsB,qBAAqBhB,KAAKN,WAAW;CAEzD,OAAO;EACLH,IAAI0C;EACJzC,iBAAiB6B;EACjB5B;EACAE,uBAAuB;EACvB,GAAID,cAAc,EAAEA,YAAY,IAAI,CAAC;CACvC;AACF;AAEA,IAAa+C,sCAAsC,OAAOL,QAAoC;CAC5F,MAAMM,YAAYrD,oBAAoB+C,IAAIvC,OAAO;CACjD,IAAI,CAAC6C,WAAW;CAEhB,MAAM,EAAET,QAAQZ,aAAaqB;CAE7B,MAAM3C,UAAUqC,IAAIrC;CACpB,IAAI,CAACA,SAAS;CAEd,MAAM+B,cAAc/B,QAAQC;CAG5B,IAFsBG,kBAAgB2B,aAAavC,EAE/CoD,MAAkBV,UAAUJ,6BAA6BC,aAAaT,QAAQ,GAAG;EAEnF,IADwBlB,kBAAgB2B,aAAatC,eACjDA,MAAoB6B,UAAU;EAGlCtB,QAAQC,OAAO;GACb,GAFe8B,eAAe,OAAOA,gBAAgB,WAAWA,cAAyC,CAAC;GAG1GvC,IAAI0C;GACJzC,iBAAiB6B;GACjB1B,uBAAuB;EACzB;EACA;CACF;CAEA,MAAMkD,kBAAkB,MAAMb,gBAAgBC,QAAQZ,QAAQ;CAC9D,IAAI,CAACwB,iBAAiB;EACpB,IAAI9C,QAAQC,MACV,OAAOD,QAAQC;EAEjB;CACF;CAEAD,QAAQC,OAAO6C;AACjB;AAEA,IAAaC,sCAAsDV,KAAKW,MAAMC,SAAS;CACrF,oCAAyCZ,GAAG,CAAC,CAACa,WAAW;EACvDD,KAAK;CACP,GAAGA,IAAI;AACT;;;AC9FA,IAAMsC,kBAAkB;AACxB,IAAMC,uCAAuB,IAAIC,IAAI,CAAC,eAAe,cAAc,CAAC;AACpE,IAAMC,mCAAmC;AACzC,IAAMC,+BAA+B;AACrC,IAAMC,qDAAqC,IAAIH,IAAI;CAAC;CAAS;CAAS;CAAe;AAAQ,CAAC;AAC9F,IAAII,gCAA+C;AAEnD,IAAMC,yCAAiD;CACrD,IAAID,+BAA+B,OAAOA;CAC1C,MAAME,YAAYC,QAAQC,IAAIC,YAAYC,KAAK;CAC/C,IAAI,CAACJ,WACH,MAAM,IAAIK,MAAM,uEAAuE;CAEzFP,gCAAgChC,cAAckC,WAAW,2BAA2B;CACpF,OAAOF;AACT;AAEA,IAAMQ,qBAAqBC,UAAkC;CAC3D,IAAI,OAAOA,UAAU,UAAU,OAAO;CACtC,MAAMC,aAAaD,MAAMH,KAAK;CAC9B,OAAOI,aAAaA,aAAa;AACnC;AAEA,IAAMC,0BAA0BC,QAAgC;CAC9D,OAAOJ,mBAAmBI,IAAIC,SAASC,KAAAA,EAAkCzC,eAAe;AAC1F;AAEA,IAAa0C,6BAA6BH,QAAgC;CACxE,OAAOD,uBAAuBC,GAAG;AACnC;AAMA,IAAaK,0BAA0BL,KAAcM,aAA8B;CACjF,MAAMC,cAAcP,IAAIC,SAASC;CACjC,IAAI,CAACK,aAAa,OAAO;CAEzB,MAAM9C,kBAAkBmC,kBAAkBW,YAAY9C,eAAe;CACrE,IAAI,CAACA,iBAAiB,OAAO;CAC7B,OAAOA,oBAAoB6C;AAC7B;AAEA,IAAaE,6BAA6B,OACxCR,KACAM,aAC4D;CAC5D,MAAMM,gBAAgBhB,mBAAmBI,IAAIC,SAASC,KAAAA,EAAkC1C,EAAE;CAC1F,IAAI,CAACoD,eAAe;EAClB,MAAMnD,kBAAkBmC,mBAAmBI,IAAIC,SAASC,KAAAA,EAAkCzC,eAAe;EACzG,IAAI,CAACA,mBAAmBA,oBAAoB6C,UAC1C,MAAM,IAAIX,MAAM,wCAAwC;EAG1D,OAAO;GACLe,SAAS3D,wBAAwB;IAAEuD;IAAUL,SAASD,IAAIC;GAAQ,CAAC;GACnEU,QAAQ;EACV;CACF;CAEA,MAAMlD,kBAAkBmC,mBAAmBI,IAAIC,SAASC,KAAAA,EAAkCzC,eAAe;CACzG,IAAI,CAACA,mBAAmBA,oBAAoB6C,UAC1C,MAAM,IAAIX,MAAM,wCAAwC;CAG1D,OAAO;EACLe,SAAS3D,wBAAwB;GAAEuD;GAAUL,SAASD,IAAIC;EAAQ,CAAC;EACnEU,QAAQC;CACV;AACF;AAEA,IAAMC,iBAAiB,OAAOP,UAAkBQ,WAAmBJ,YAA6C;CAC9G,MAAMK,MAAoB;EACxBf,KAAK,EACHC,SAAS,EACPC,MAAM,EACJzC,iBAAiB6C,SACnB,EACF,EACF;EACAI;CACF;CAEA,OAAO7D,OAAOmE,IAAIF,WAAWC,GAAG;AAClC;AAEA,IAAME,kBAAkBhD,UAA2B;CACjD,IAAI,OAAOA,UAAU,UAAU,OAAOa;CACtC,IAAI,CAACoC,OAAOC,SAASlD,KAAK,GAAG,OAAOa;CACpC,OAAOsC,KAAKC,IAAIvC,iBAAiBsC,KAAKE,IAAIrD,KAAK,CAAC;AAClD;AAEA,IAAMsD,+BAA+B1B,UAA2B;CAC9D,IAAI,OAAOA,UAAU,UAAU,OAAO;CACtC,IAAI,CAACqB,OAAOC,SAAStB,KAAK,KAAKA,QAAQ,GAAG,OAAO;CACjD,OAAOuB,KAAKI,MAAM3B,KAAK;AACzB;AAEA,IAAM4B,iCAAyC;CAC7C,MAAMC,MAAMnC,QAAQC,IAAImC,iCAAiCjC,KAAK,KAAK;CACnE,IAAI,CAACgC,KAAK,OAAOzC;CAEjB,MAAM2C,SAASV,OAAOQ,GAAG;CACzB,IAAI,CAACR,OAAOC,SAASS,MAAM,KAAKA,UAAU,GAAG,OAAO3C;CACpD,OAAOmC,KAAKC,IAAInC,8BAA8BkC,KAAKI,MAAMI,MAAM,CAAC;AAClE;AAEA,IAAMC,sCAAsChC,UAAkC;CAC5E,IAAI,CAACA,SAAS,OAAOA,UAAU,UAAU,OAAO;CAEhD,IAAIzB,MAAM0D,QAAQjC,KAAK,GAAG;EACxB,KAAK,MAAMkC,SAASlC,OAAO;GACzB,MAAMmC,sBAAsBH,mCAAmCE,KAAK;GACpE,IAAIC,qBAAqB,OAAOA;EAClC;EACA,OAAO;CACT;CAEA,KAAK,MAAM,CAACC,KAAKC,gBAAgBC,OAAOC,QAAQvC,KAAgC,GAAG;EACjF,IAAIV,mCAAmCkD,IAAIJ,GAAG,GAC5C,OAAOA;EAGT,MAAMD,sBAAsBH,mCAAmCK,WAAW;EAC1E,IAAIF,qBAAqB,OAAOA;CAClC;CAEA,OAAO;AACT;AAEA,IAAMM,wBAAwB1E,OAAmB2E,UAAkC;CACjF,MAAMC,cAAc5E,MAAM6E,KAAKF,KAAK,CAAC,CAACG,KAAK9E,KAAK;CAChD,IAAI,CAAC4E,eAAe,OAAOA,gBAAgB,YAAYpE,MAAM0D,QAAQU,WAAW,GAC9E,OAAOD;CAGT,OAAOC;AACT;AAEA,IAAMG,mBAAmB9C,UAA2B;CAClD,OAAO,OAAOA,UAAU,WAAWA,MAAMH,KAAK,IAAI;AACpD;AAEA,IAAMkD,mBAAmB/C,UAA2C;CAClE,IAAI,CAACA,SAAS,OAAOA,UAAU,YAAYzB,MAAM0D,QAAQjC,KAAK,GAAG,OAAOgD,KAAAA;CACxE,OAAOhD;AACT;AAEA,IAAMiD,uBAAuBjD,UAA+C;CAC1E,IAAI,CAACA,SAAS,OAAOA,UAAU,YAAYzB,MAAM0D,QAAQjC,KAAK,GAAG,OAAOgD,KAAAA;CACxE,OAAOhD;AACT;AAEA,IAAMkD,2BACJzE,YACAC,YACAyE,mBACiE;CACjE,IAAI,CAAC1E,cAAc,CAAC0E,gBAAgB,OAAO;EAAE1E;EAAY2E,YAAY,CAAA;CAAG;CAExE,MAAMC,sBAAsBf,OAAOC,QAAQ9D,UAAU,CAAC,CAAC6E,MAAM,GAAGtD,WAAWA,UAAU,CAAC;CACtF,MAAMuD,iBAAiB,EAAE,GAAG9E,WAAW;CACvC,MAAM2E,aAAuB,CAAA;CAC7B,MAAMI,aAAajF,MAAM0D,QAAQvD,WAAWP,IAAI,IAC5CO,WAAWP,KACVsF,KAAKvB,UAAUA,OAAOwB,KAAK,CAAC,CAC5BC,QAAQD,UAA2B,OAAOA,UAAU,QAAQ,IAC7D,CAAA;CACJ,MAAME,cAAcrF,MAAMsF,qBAAK,IAAI1E,IAAI,CAAC,GAAGqE,YAAY,KAAK,CAAC,CAAC;CAE9D,IAAI,CAACH,qBAAqB;EACxB,KAAK,MAAMvF,QAAQ8F,aAAa;GAC9B,MAAME,eAAexB,OAAOC,QAAQ9D,UAAU,CAAC,CAACmE,MAAM,CAACmB,eAAe/D,WACpEA,UAAU,MAAM+D,kBAAkBjG,QAAQA,KAAKkG,WAAW,GAAGD,cAAa,EAAG,EAC/E,CAAC,GAAG;GACJ,IAAI,CAACD,cAAc;GACnB,IAAIA,iBAAiBhG,MACnB,MAAM,IAAIgC,MAAM,qDAAqDhC,MAAM;GAE7E,OAAOyF,eAAezF;GACtBsF,WAAWa,KAAKnG,IAAI;EACtB;EACA,OAAO;GAAEW,YAAY8E;GAAgBH;EAAW;CAClD;CAEA,KAAK,MAAMtF,QAAQ8F,aAAa;EAM9B,IALmB9F,SAAS,QACxBW,WAAW0F,QAAQ,IACnB7B,OAAOC,QAAQ9D,UAAU,CAAC,CAAC6E,MAAM,CAACS,eAAe/D,WACjDA,UAAU,MAAM+D,kBAAkBjG,QAAQA,KAAKkG,WAAW,GAAGD,cAAa,EAAG,EAC/E,GACc;EAChBR,eAAezF,QAAQ;EACvBsF,WAAWa,KAAKnG,IAAI;CACtB;CAEA,OAAO;EAAEW,YAAY8E;EAAgBH;CAAW;AAClD;AAEA,IAAMgB,aAAaC,QAAoBvG,SAAuB;CAC5D,MAAMwG,QAAQxG,KAAKyG,MAAM,GAAG;CAC5B,IAAIC,UAAUH;CAEd,KAAK,IAAII,QAAQ,GAAGA,QAAQH,MAAMI,SAAS,GAAGD,SAAS,GAAG;EACxD,MAAME,OAAOL,MAAMG;EACnB,MAAMG,QAAQJ,QAAQG;EACtB,IAAI,CAACC,SAAS,OAAOA,UAAU,YAAYrG,MAAM0D,QAAQ2C,KAAK,GAAG;EACjE,MAAMC,SAAS,EAAE,GAAID,MAAqB;EAC1CJ,QAAQG,QAAQE;EAChBL,UAAUK;CACZ;CAEA,OAAOL,QAAQF,MAAMA,MAAMI,SAAS;AACtC;AAEA,IAAMI,6BAA6BC,OAAkB3B,eAAoC;CACvF,IAAI,CAACA,WAAWsB,QAAQ,OAAOK;CAE/B,OAAOA,MAAMtB,KAAKuB,SAAS;EACzB,IAAI,CAACA,QAAQ,OAAOA,SAAS,YAAYzG,MAAM0D,QAAQ+C,IAAI,GAAG,OAAOA;EACrE,MAAMC,WAAYD,KAAgCC;EAClD,MAAMpD,MAAM,OAAOoD,aAAa,aAC5BA,SAASC,KAAKF,IAAI,IAClBA;EACJ,IAAI,CAACnD,OAAO,OAAOA,QAAQ,YAAYtD,MAAM0D,QAAQJ,GAAG,GAAG,OAAOA;EAClE,MAAMsD,YAAY,EAAE,GAAItD,IAAmB;EAC3C,KAAK,MAAM/D,QAAQsF,YAAYgB,UAAUe,WAAWrH,IAAI;EACxD,OAAOqH;CACT,CAAC;AACH;AAEA,IAAMC,2BAA2BpF,UAAoD;CACnF,IAAI,OAAOA,UAAU,UAEnB,OADmBA,MAAMH,KAClBI,KAAc+C,KAAAA;CAEvB,OAAOD,gBAAgB/C,KAAK;AAC9B;AAEA,IAAMqF,4BAA4BrF,UAA6D;CAC7F,IAAI,CAACA,SAAS,OAAOA,UAAU,YAAYzB,MAAM0D,QAAQjC,KAAK,GAAG,OAAOgD,KAAAA;CACxE,MAAMnB,MAAM7B;CACZ,MAAMC,aAA2C,CAAC;CAElD,IAAI4B,IAAI1D,QAAQ,OAAO0D,IAAI1D,SAAS,YAAY,CAACI,MAAM0D,QAAQJ,IAAI1D,IAAI,GACrE8B,WAAW9B,OAAO0D,IAAI1D;CAGxB,IAAI,OAAO0D,IAAIzD,UAAU,YAAYiD,OAAOC,SAASO,IAAIzD,KAAK,GAC5D6B,WAAW7B,QAAQmD,KAAK+D,IAAI,GAAG/D,KAAKI,MAAMJ,KAAKE,IAAII,IAAIzD,KAAK,CAAC,CAAC;CAGhE,IAAI,CAAC6B,WAAW9B,QAAQ8B,WAAW7B,UAAU4E,KAAAA,GAAW,OAAOA,KAAAA;CAC/D,OAAO/C;AACT;AAEA,IAAMsF,2BAA2BvF,UAAkD;CACjF,IAAI,CAACA,SAAS,OAAOA,UAAU,YAAYzB,MAAM0D,QAAQjC,KAAK,GAAG,OAAOgD,KAAAA;CACxE,MAAMnB,MAAM7B;CACZ,MAAMlC,OAAOgF,gBAAgBjB,IAAI/D,IAAI;CACrC,IAAI,CAACA,MAAM,OAAOkF,KAAAA;CAElB,MAAM/C,aAAgC,EAAEnC,KAAK;CAE7C,MAAMC,QAAQ+E,gBAAgBjB,IAAI9D,KAAK;CACvC,IAAIA,OAAOkC,WAAWlC,QAAQA;CAE9B,MAAMC,SAASoH,wBAAwBvD,IAAI7D,MAAM;CACjD,IAAIA,WAAWgF,KAAAA,GAAW/C,WAAWjC,SAASA;CAE9C,MAAMC,QAAQ8E,gBAAgBlB,IAAI5D,KAAK;CACvC,IAAIA,OAAOgC,WAAWhC,QAAQA;CAE9B,MAAMuH,iBAAiBC,2BAA2B5D,IAAIxD,QAAQ;CAC9D,IAAImH,mBAAmBxC,KAAAA,GAAW/C,WAAW5B,WAAWmH;CAExD,MAAMtH,UAAUmH,yBAAyBxD,IAAI3D,OAAO;CACpD,IAAIA,SAAS+B,WAAW/B,UAAUA;CAElC,OAAO+B;AACT;AAEA,IAAMwF,8BAA8BzF,UAAkD;CACpF,IAAI,OAAOA,UAAU,UAEnB,OADmBA,MAAMH,KAClBI,KAAc+C,KAAAA;CAGvB,IAAIzE,MAAM0D,QAAQjC,KAAK,GAAG;EACxB,MAAMC,aAAaD,MAChByD,KAAKvB,UAAU;GACd,IAAI,OAAOA,UAAU,UAEnB,OADaA,MAAMrC,KACZ/B,KAAQ;GAEjB,OAAOyH,wBAAwBrD,KAAK,KAAK;EAC3C,CAAC,CAAC,CACDyB,QAAQzB,UAA+CA,UAAU,IAAI;EAExE,OAAOjC,WAAWyE,SAAS,IAAIzE,aAAa+C,KAAAA;CAC9C;CAEA,OAAOuC,wBAAwBvF,KAAK;AACtC;AAEA,IAAM0F,sBAAsB1F,UAAkC;CAC5D,IAAI,OAAOA,UAAU,UAAU,OAAO;CAEtC,OADmBA,MAAMH,KAClBI,KAAc;AACvB;AAEA,IAAM0F,+BACJ5H,OACAD,MACA8H,sBACkB;CAClB,IAAIA,mBAAmB,OAAOA;CAE9B,MAAMC,SAAS9H,MAAM8H;CACrB,MAAMC,aAAa,OAAOD,OAAO/H,SAAS,aAAa+H,OAAO/H,KAAKA,IAAI,IAAI;CAC3E,MAAMiI,YAAYL,mBAAmBI,YAAY5H,SAAS8H,GAAG;CAC7D,IAAID,WAAW,OAAOA;CAEtB,MAAME,WAAWP,mBAAmBI,YAAYI,QAAQhI,SAAS8H,GAAG;CACpE,IAAIC,UAAU,OAAOA;CAGrB,MAAMI,aAAaX,oBADC,OAAOG,OAAOO,gBAAgB,aAAaP,OAAOO,YAAYtI,IAAI,IAAI,KACpDqI,EAAajI,SAAS8H,GAAG;CAC/D,IAAIK,YAAY,OAAOA;CAEvB,OAAO;AACT;AAEA,IAAMC,6BACJC,eACAC,aACe;CACf,IAAI,CAACD,iBAAiBjE,OAAOmE,KAAKF,aAAa,CAAC,CAAC7B,WAAW,GAAG,OAAO8B;CACtE,OAAO,EAAEE,MAAM,CAACH,eAAeC,QAAQ,EAAE;AAC3C;AAmBA,IAAMK,8BAA8B,OAAO,EACzCpG,UACA1C,OACA8C,SACAxC,UACAyI,qBACAC,YACAC,2BASiD;CACjD,IAAI,CAAC3I,UAAU,OAAO2E,KAAAA;CAEtB,MAAMkE,iBAAiB,OAAOC,oBAAiD;EAC7E,MAAMC,SAASL,WAAW5F,IAAIgG,eAAe;EAC7C,IAAIC,QAAQ,OAAOA;EACnB,MAAMC,SAAS,MAAMrG,eAAeP,UAAU0G,iBAAiBtG,OAAO;EACtEkG,WAAWO,IAAIH,iBAAiBE,MAAM;EACtC,OAAOA;CACT;CAEA,MAAME,aAAa,OACjBrF,OACAsF,gBACoD;EACpD,IAAI,OAAOtF,UAAU,UAAU;GAC7B,MAAMpE,OAAOoE,MAAMrC,KAAK;GACxB,IAAI,CAAC/B,MAAM,OAAO;GAElB,MAAM2J,eAAe9B,4BAA4B6B,aAAa1J,MAAM,IAAI;GACxE,IAAI,CAAC2J,cAAc,OAAO3J;GAC1B,IAAI,CAACgJ,uBAAuB5H,qBAAqBsD,IAAIiF,YAAY,GAC/D,MAAM,IAAI3H,MAAM,mBAAmB;GAErC,IAAI,CAACe,QAAQ6G,IAAI,QAAQD,YAA8B,GACrD,MAAM,IAAI3H,MAAM,WAAW;GAG7BkH,qBAAqBW,IAAIF,YAAY;GAOrC,OAAO;IACL3J;IACAG,OAPed,qBACf0D,SACA,QACA4G,YAIOjB;GACT;EACF;EAEA,MAAM1I,OAAOoE,MAAMpE,KAAK+B,KAAK;EAC7B,IAAI,CAAC/B,MAAM,OAAO;EAElB,MAAM8H,oBAAoBF,mBAAmBxD,MAAMnE,KAAK;EACxD,MAAM0J,eAAe9B,4BAA4B6B,aAAa1J,MAAM8H,iBAAiB;EACrF,IAAIiC,cAAcL;EAElB,MAAMM,kBAA0C,EAC9ChK,KACF;EAEA,IAAIoE,MAAMlE,WAAWgF,KAAAA,GAAW8E,gBAAgB9J,SAASkE,MAAMlE;EAC/D,IAAIkE,MAAMhE,YAAY8E,KAAAA,GAAW8E,gBAAgB5J,UAAUgE,MAAMhE;EACjE,IAAI0H,mBAAmBkC,gBAAgB/J,QAAQ6H;EAC/C,IAAI1D,MAAMjE,UAAU+E,KAAAA,GAAW8E,gBAAgB7J,QAAQiE,MAAMjE;EAE7D,IAAIwJ,cAAc;GAChB,IAAI,CAACX,uBAAuB5H,qBAAqBsD,IAAIiF,YAAY,GAC/D,MAAM,IAAI3H,MAAM,mBAAmB;GAErC,IAAI,CAACe,QAAQ6G,IAAI,QAAQD,YAA8B,GACrD,MAAM,IAAI3H,MAAM,WAAW;GAG7BkH,qBAAqBW,IAAIF,YAAY;GACrCI,cAAc,MAAMX,eAAeO,YAAY;GAE/C,MAAMjB,WAAWrJ,qBACf0D,SACA,QACA4G,YACF;GACAK,gBAAgB7J,QAAQqI,0BACtBwB,gBAAgB7J,OAChBuI,QACF;EACF,OAAO,IAAItE,MAAM7D,aAAa2E,KAAAA,GAC5B,MAAM,IAAIlD,MAAM,mEAAmE;EAGrF,MAAM0F,iBAAiB,MAAMqB,4BAA4B;GACvDpG;GACA1C,OAAO8J;GACPhH;GACAxC,UAAU6D,MAAM7D;GAChByI;GACAC;GACAC;EACF,CAAC;EACD,IAAIxB,mBAAmBxC,KAAAA,GAAW8E,gBAAgBzJ,WAAWmH;EAE7D,OAAOsC;CACT;CAEA,IAAIvJ,MAAM0D,QAAQ5D,QAAQ,GAAG;EAE3B,MAAM4J,YAAWF,MADMnH,QAAQoH,IAAI3J,SAASoF,KAAKvB,UAAUqF,WAAWrF,OAAOnE,KAAK,CAAC,CAAC,EAAA,CAC1D4F,QAAQzB,UAAoDA,UAAU,IAAI;EACpG,OAAO+F,SAASvD,SAAS,IAAIuD,WAAWjF,KAAAA;CAC1C;CAGA,OAAO+E,MADgBR,WAAWlJ,UAAUN,KAAK,KAC9BiF,KAAAA;AACrB;AAEA,IAAakF,4BAA4BhK,YAA0D;CACjG,IAAI,CAACA,WAAW,OAAOA,YAAY,UAAU,OAAO,CAAC;CACrD,MAAM+B,aAA8B,CAAC;CAErC,IAAI/B,QAAQO,cAAc,OAAOP,QAAQO,eAAe,YAAY,CAACF,MAAM0D,QAAQ/D,QAAQO,UAAU,GACnGwB,WAAWxB,aAAaP,QAAQO;CAGlC,IAAIP,QAAQC,QAAQ,OAAOD,QAAQC,SAAS,YAAY,CAACI,MAAM0D,QAAQ/D,QAAQC,IAAI,GACjF8B,WAAW9B,OAAOD,QAAQC;CAG5B8B,WAAW7B,QAAQgD,eAAelD,QAAQE,KAAK;CAC/C6B,WAAW5B,WAAWoH,2BAA2BvH,QAAQG,QAAQ;CACjE4B,WAAWvB,aAAauE,oBAAoB/E,QAAQQ,UAAU;CAE9D,OAAOuB;AACT;AAEA,IAAakI,sCAAsC,OAAO,EACxD1H,UACAI,SACAI,WACA/C,SACA4I,sBAAsB,YAOC;CACvB,MAAM/I,QAAQ,MAAMiD,eAAeP,UAAUQ,WAAWJ,OAAO;CAC/D,MAAMkG,6BAAa,IAAIE,IAAwB;CAC/CF,WAAWO,IAAIrG,WAAWlD,KAAK;CAE/B,MAAMiJ,uCAAuB,IAAI7H,IAAY;CAC7C,MAAM0H,4BAA4B;EAChCpG;EACA1C;EACA8C;EACAxC,UAAUH,QAAQG;EAClByI;EACAC;EACAC;CACF,CAAC;CAED,OAAOzI,MAAMsF,KAAKmD,oBAAoB;AACxC;AAEA,IAAaoB,cAAc,OAAO,EAChC3H,UACAI,SACAI,WACAyB,OACAxE,SACA4I,sBAAsB,OACtBuB,oBACAC,2BAA2B,WAUE;CAC7B,MAAM,EAAEvK,OAAOiB,eAAe,MAAMuJ,oBAAoB;EACtD9H;EACAI;EACAI;EACAyB;EACAoE;CACF,CAAC;CACD,MAAMrI,aAAaP,QAAQO,cAAcuE,KAAAA;CACzC,MAAM7E,OAAOD,QAAQC;CACrB,MAAMC,QAAQgD,eAAelD,QAAQE,KAAK;CAC1C,MAAM2I,6BAAa,IAAIE,IAAwB;CAC/CF,WAAWO,IAAIrG,WAAWlD,KAAK;CAE/B,MAAMM,WAAW,MAAMwI,4BAA4B;EACjDpG;EACA1C;EACA8C;EACAxC,UAAUH,QAAQG;EAClByI;EACAC;EACAC,sCAAsB,IAAI7H,IAAY;CACxC,CAAC;CAED,IAAIjB,QAAQQ,YAAY;EACtB,MAAM8J,mBAAmBtF,wBACvBzE,YACAP,QAAQQ,YACR4J,wBACF;EACA,MAAMG,iBAAiB1K,MAAM6E,KAAK5D,YAAYwJ,iBAAiB/J,UAAU;EACzE,IAAIJ,aAAa2E,KAAAA,GACfyF,eAAepK,SAASA,QAAe;EAGzC,MAAMqK,kBAAkB,MAAMD,eAAeE,SAASzK,QAAQQ,YAAY;GACxEkK,QAAQ;IACNC,eAAerJ,iCAAiC;IAChD,GAAI6I,uBAAuBrF,KAAAA,IAAY,EAAE8F,UAAUT,mBAAmB,IAAI,CAAC;GAC7E;GACAlF,gBAAgBmF;EAClB,CAAC;EACD,MAAMxJ,aAAa,OAAO4J,gBAAgB5J,eAAe,YACpDuC,OAAOC,SAASoH,gBAAgB5J,UAAU,KAC1C4J,gBAAgB5J,cAAc,IAC/ByC,KAAKI,MAAM+G,gBAAgB5J,UAAU,IACrCkE,KAAAA;EACJ,MAAM+F,wBAAwBjK,eAAekE,KAAAA,IACzC,MAAMgG,uBAAuBjL,OAAOiB,UAAU,CAAC,CAACiK,YAAYjG,KAAAA,CAAS,IACrEA,KAAAA;EACJ,MAAMkG,qBAAqBpK,cAAciK;EAEzC,OAAO;GACLnK,MAAML,MAAM0D,QAAQyG,gBAAgB3D,KAAK,IACrCD,0BAA0B4D,gBAAgB3D,OAAOyD,iBAAiBpF,UAAU,IAC5E,CAAA;GACJvE,UAAU6J,gBAAgB7J;GAC1B,GAAIqK,uBAAuBlG,KAAAA,IAAY,EAAElE,YAAYoK,mBAAmB,IAAI,CAAC;EAC/E;CACF;CAEA,MAAMC,eAAepL,MAAM6E,KAAK5D,YAAYP,UAAU;CACtD,IAAIJ,aAAa2E,KAAAA,GACfmG,aAAa9K,SAASA,QAAe;CAEvC,IAAIF,QAAQmE,OAAOmE,KAAKtI,IAAI,CAAC,CAACuG,QAC5ByE,aAAahL,KAAKA,IAAI;CAExBgL,aAAa/K,MAAMA,KAAK;CAExB,MAAMQ,OAAO,MAAMuK;CACnB,OAAO,EAAEvK,MAAML,MAAM0D,QAAQrD,IAAI,IAAIA,OAAO,CAAA,EAAG;AACjD;AAEA,IAAM2J,sBAAsB,OAAO,EACjC9H,UACAI,SACAI,WACAyB,OACAoE,sBAAsB,YAOa;CACnC,IAAI,CAACA,uBAAuB5H,qBAAqBsD,IAAIvB,SAAS,GAC5D,MAAM,IAAInB,MAAM,mBAAmB;CAGrC,IAAI,CAACe,QAAQ6G,IAAI,QAAQzG,SAA2B,GAClD,MAAM,IAAInB,MAAM,WAAW;CAO7B,OAAO;EAAE/B,OAAAA,MAJWiD,eAAeP,UAAUQ,WAAWJ,OAAO;EAI/C7B,YAAAA,EAFiB0H,MAAM,CAAChE,OADpBvF,qBAAqB0D,SAAS,QAAQI,SACXmI,CAAW,EAE1CpK;CAAW;AAC7B;AAEA,IAAMgK,yBAAyB,OAAOjL,OAAmB2E,UAAuC;CAC9F,MAAMP,sBAAsBH,mCAAmCU,KAAK;CACpE,IAAIP,qBACF,MAAM,IAAIrC,MAAM,0CAA0CqC,oBAAmB,SAAU;CAGzF,MAAMQ,cAAcF,qBAAqB1E,OAAO2E,KAAK;CACrD,MAAM2G,iBAAiB3H,4BAA4B,MAAM3D,MAAMuL,uBAAuB,CAAC;CACvF,IAAID,mBAAmB,GAAG,OAAO;CAEjC,MAAME,aAAahI,KAAKC,IAAII,yBAAyB,GAAGyH,cAAc;CAMtE,MAAMU,gBAAgBrI,6BAA4B8H,MALvBzL,MAAM0L,UAAU;EACzC,EAAEC,SAAS,EAAEC,MAAMJ,WAAW,EAAE;EAChC,EAAEK,QAAQjH,YAAY;EACtB,EAAEkH,QAAQ,QAAQ;CAAC,CACpB,EACiDL,CAAa,EAAE,EAAEM,KAAK;CAExE,IAAIP,cAAcF,gBAChB,OAAO9H,KAAKC,IAAIuI,eAAeV,cAAc;CAG/C,MAAMW,mBAAmBzI,KAAK0I,MAAOZ,iBAAiBU,gBAAiBR,UAAU;CACjF,OAAOhI,KAAK+D,IAAI,GAAG/D,KAAKC,IAAI6H,gBAAgBW,gBAAgB,CAAC;AAC/D;AAEA,IAAaE,cAAc,OAAO,EAChCzJ,UACAI,SACAI,WACAyB,OACAoE,sBAAsB,YAOD;CACrB,MAAM,EAAE/I,OAAOiB,eAAe,MAAMuJ,oBAAoB;EACtD9H;EACAI;EACAI;EACAyB;EACAoE;CACF,CAAC;CAED,OAAO,MAAMkC,uBAAuBjL,OAAOiB,UAAU;AACvD;;;AC9uBA,IAAamL,6BAA6B"}

package/dist/shared-Zt17vuAT.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"shared-Zt17vuAT.js","names":["createHash","timingSafeEqual","extname","Ctx","IRBUploadChunk","IRBUploadSession","LoadModelCtx","buildAbilityFromSession","getAccessibleByQuery","AppAbility","Db","Model","SessionUser","id","currentTenantId","UploadSessionDoc","UploadChunkDoc","Omit","data","Buffer","DEFAULT_CHUNK_SIZE_BYTES","MAX_CHUNK_SIZE_BYTES","DEFAULT_MAX_CLIENT_BYTES_PER_SECOND","DEFAULT_SESSION_TTL_S","ensuredIndexDbNames","Set","UploadAccessScope","UploadDeduplication","NonNullable","UPLOAD_DEDUPLICATION_PIPELINE_VERSION","parseOptionalPositiveInt","rawValue","normalized","trim","parsed","Number","isFinite","Math","floor","getChunkSizeBytes","configured","process","env","RB_UPLOAD_CHUNK_SIZE_BYTES","resolved","min","getMaxClientUploadBytesPerSecond","RB_UPLOAD_MAX_CLIENT_BYTES_PER_SECOND","getSessionTtlMs","ttlSeconds","RB_UPLOAD_SESSION_TTL_S","getRawBodyLimitBytes","chunkSizeBytes","getBucketName","RB_FILESYSTEM_BUCKET_NAME","getFileReferencesCollectionName","bucketName","getUserId","ctx","raw","req","session","user","getTenantId","rawSession","sessionTenantId","computeSha256Hex","update","digest","normalizeSha256Hex","value","toLowerCase","getModelCtx","_ctx","tenantId","ability","toBufferPayload","payload","isBuffer","Uint8Array","from","ensureUploadIndexes","UploadSession","UploadChunk","Promise","dbName","String","db","name","has","all","createIndexes","add","ensureFilesystemUploadIndexes","collection","createIndex","unique","partialFilterExpression","$type","blobId","resolveUploadAccessScope","accessScope","isPublic","resolveStoredUploadAccessScope","metadata","Record","buildUploadDeduplication","namespace","hash","filename","mimeType","totalSize","userId","ownerKeyHash","ownerPartition","normalizedNamespace","normalizedHash","normalizedMimeType","normalizedExtension","key","JSON","stringify","algorithm","pipelineVersion","buildUploadAccessMetadata","Pick","normalizeUploadKey","getUploadKeyHash","uploadKey","get","buildUploadsAbility","uploadKeyHash","claims","undefined","getUploadSessionAccessQuery","action","timingSafeEqualHex","left","right","length","getOwnershipSelector"],"sources":["../src/uploads/api/file-uploads/shared.ts"],"sourcesContent":["import { createHash, timingSafeEqual } from \"node:crypto\"\nimport { extname } from \"node:path\"\n\nimport { Ctx } from \"@rpcbase/api\"\nimport {\n  type IRBUploadChunk,\n  type IRBUploadSession,\n  type LoadModelCtx,\n} from \"@rpcbase/db\"\nimport { buildAbilityFromSession, getAccessibleByQuery, type AppAbility } from \"@rpcbase/db/acl\"\nimport type { Db } from \"mongodb\"\nimport type { Model } from \"mongoose\"\n\n\nexport type SessionUser = {\n  id?: string\n  currentTenantId?: string\n}\n\nexport type UploadSessionDoc = IRBUploadSession\nexport type UploadChunkDoc = Omit<IRBUploadChunk, \"data\"> & { data: Buffer }\n\nconst DEFAULT_CHUNK_SIZE_BYTES = 5 * 1024 * 1024\nconst MAX_CHUNK_SIZE_BYTES = 15 * 1024 * 1024\n\nconst DEFAULT_MAX_CLIENT_BYTES_PER_SECOND = 10 * 1024 * 1024\n\nconst DEFAULT_SESSION_TTL_S = 60 * 60 * 24\n\nconst ensuredIndexDbNames = new Set<string>()\n\nexport type UploadAccessScope = \"owner\" | \"tenant\" | \"public\"\nexport type UploadDeduplication = NonNullable<IRBUploadSession[\"deduplication\"]>\n\nconst UPLOAD_DEDUPLICATION_PIPELINE_VERSION = 1\n\nconst parseOptionalPositiveInt = (rawValue: unknown): number | null => {\n  if (typeof rawValue !== \"string\") return null\n  const normalized = rawValue.trim()\n  if (!normalized) return null\n  const parsed = Number(normalized)\n  if (!Number.isFinite(parsed) || parsed <= 0) return null\n  return Math.floor(parsed)\n}\n\nexport const getChunkSizeBytes = (): number => {\n  const configured = parseOptionalPositiveInt(process.env.RB_UPLOAD_CHUNK_SIZE_BYTES)\n  const resolved = configured ?? DEFAULT_CHUNK_SIZE_BYTES\n  return Math.min(MAX_CHUNK_SIZE_BYTES, resolved)\n}\n\nexport const getMaxClientUploadBytesPerSecond = (): number | null => {\n  const configured = parseOptionalPositiveInt(process.env.RB_UPLOAD_MAX_CLIENT_BYTES_PER_SECOND)\n  return configured ?? DEFAULT_MAX_CLIENT_BYTES_PER_SECOND\n}\n\nexport const getSessionTtlMs = (): number => {\n  const ttlSeconds = parseOptionalPositiveInt(process.env.RB_UPLOAD_SESSION_TTL_S) ?? DEFAULT_SESSION_TTL_S\n  return ttlSeconds * 1000\n}\n\nexport const getRawBodyLimitBytes = (chunkSizeBytes: number): number => chunkSizeBytes + 1024 * 1024\n\nexport const getBucketName = (): string => (process.env.RB_FILESYSTEM_BUCKET_NAME ?? \"\").trim() || \"fs\"\n\nexport const getFileReferencesCollectionName = (bucketName: string): string => `${bucketName}.references`\n\nexport const getUserId = (ctx: Ctx<SessionUser>): string | null => {\n  const raw = ctx.req.session?.user?.id\n  if (typeof raw !== \"string\") return null\n  const normalized = raw.trim()\n  return normalized ? normalized : null\n}\n\nexport const getTenantId = (ctx: Ctx<SessionUser>): string | null => {\n  const rawSession = ctx.req.session?.user?.currentTenantId\n  const sessionTenantId = typeof rawSession === \"string\" ? rawSession.trim() : \"\"\n  return sessionTenantId || null\n}\n\nexport const computeSha256Hex = (data: Buffer): string => createHash(\"sha256\").update(data).digest(\"hex\")\n\nexport const normalizeSha256Hex = (value: string): string => value.trim().toLowerCase()\n\nexport const getModelCtx = (_ctx: Ctx<SessionUser>, tenantId: string, ability?: AppAbility): LoadModelCtx => ({\n  req: {\n    session: {\n      user: {\n        currentTenantId: tenantId,\n      },\n    },\n  },\n  ability,\n})\n\nexport const toBufferPayload = (payload: unknown): Buffer | null => {\n  if (Buffer.isBuffer(payload)) return payload\n  if (payload instanceof Uint8Array) return Buffer.from(payload)\n  return null\n}\n\nexport const ensureUploadIndexes = async (\n  UploadSession: Model<UploadSessionDoc>,\n  UploadChunk: Model<UploadChunkDoc>,\n): Promise<void> => {\n  const dbName = String((UploadSession as unknown as { db?: { name?: unknown } })?.db?.name ?? \"\")\n  if (dbName && ensuredIndexDbNames.has(dbName)) return\n\n  await Promise.all([\n    UploadSession.createIndexes(),\n    UploadChunk.createIndexes(),\n  ])\n\n  if (dbName) ensuredIndexDbNames.add(dbName)\n}\n\nexport const ensureFilesystemUploadIndexes = async (db: Db, bucketName: string): Promise<void> => {\n  await Promise.all([\n    db.collection(`${bucketName}.files`).createIndex(\n      { \"metadata.deduplication.key\": 1 },\n      {\n        name: \"rb_upload_deduplication_key_unique\",\n        unique: true,\n        partialFilterExpression: { \"metadata.deduplication.key\": { $type: \"string\" } },\n      },\n    ),\n    db.collection(getFileReferencesCollectionName(bucketName)).createIndex(\n      { blobId: 1 },\n      { name: \"rb_upload_file_reference_blob\" },\n    ),\n  ])\n}\n\nexport const resolveUploadAccessScope = ({\n  accessScope,\n  isPublic,\n}: {\n  accessScope?: UploadAccessScope\n  isPublic?: boolean\n}): UploadAccessScope => accessScope ?? (isPublic ? \"public\" : \"owner\")\n\nexport const resolveStoredUploadAccessScope = (metadata: Record<string, unknown>): UploadAccessScope => {\n  const accessScope = metadata.accessScope\n  if (accessScope === \"owner\" || accessScope === \"tenant\" || accessScope === \"public\") {\n    return accessScope\n  }\n  return metadata.isPublic === true || String(metadata.isPublic).trim().toLowerCase() === \"true\" ? \"public\" : \"owner\"\n}\n\nexport const buildUploadDeduplication = ({\n  namespace,\n  hash,\n  filename,\n  mimeType,\n  totalSize,\n  accessScope,\n  userId,\n  ownerKeyHash,\n}: {\n  namespace: string\n  hash: string\n  filename: string\n  mimeType: string\n  totalSize: number\n  accessScope: UploadAccessScope\n  userId?: string\n  ownerKeyHash?: string\n}): UploadDeduplication | null => {\n  const ownerPartition = accessScope === \"owner\"\n    ? userId\n      ? `user:${userId}`\n      : ownerKeyHash\n        ? `key:${ownerKeyHash}`\n        : null\n    : accessScope\n  if (!ownerPartition) return null\n\n  const normalizedNamespace = namespace.trim()\n  const normalizedHash = normalizeSha256Hex(hash)\n  const normalizedMimeType = mimeType.trim().toLowerCase()\n  const normalizedExtension = extname(filename.trim()).toLowerCase()\n  const key = computeSha256Hex(Buffer.from(JSON.stringify([\n    UPLOAD_DEDUPLICATION_PIPELINE_VERSION,\n    normalizedNamespace,\n    normalizedHash,\n    totalSize,\n    normalizedMimeType,\n    normalizedExtension,\n    accessScope,\n    ownerPartition,\n  ])))\n\n  return {\n    namespace: normalizedNamespace,\n    algorithm: \"sha256\",\n    hash: normalizedHash,\n    key,\n    pipelineVersion: UPLOAD_DEDUPLICATION_PIPELINE_VERSION,\n  }\n}\n\nexport const buildUploadAccessMetadata = (\n  session: Pick<UploadSessionDoc, \"accessScope\" | \"isPublic\" | \"userId\" | \"ownerKeyHash\">,\n): Record<string, unknown> => {\n  const accessScope = resolveUploadAccessScope({\n    accessScope: session.accessScope,\n    isPublic: session.isPublic,\n  })\n\n  return {\n    accessScope,\n    isPublic: accessScope === \"public\",\n    ...(typeof session.ownerKeyHash === \"string\" ? { ownerKeyHash: session.ownerKeyHash } : {}),\n    ...(typeof session.userId === \"string\" ? { userId: session.userId } : {}),\n  }\n}\n\nconst normalizeUploadKey = (raw: unknown): string | null => {\n  if (typeof raw !== \"string\") return null\n  const normalized = raw.trim()\n  return normalized ? normalized : null\n}\n\nexport const getUploadKeyHash = (ctx: Ctx<SessionUser>): string | null => {\n  const uploadKey = normalizeUploadKey(ctx.req.get(\"X-Upload-Key\"))\n  if (!uploadKey) return null\n  return computeSha256Hex(Buffer.from(uploadKey))\n}\n\nexport const buildUploadsAbility = (ctx: Ctx<SessionUser>, tenantId: string): AppAbility => {\n  const uploadKeyHash = getUploadKeyHash(ctx)\n  const claims = uploadKeyHash ? { uploadKeyHash } : undefined\n  return buildAbilityFromSession({ tenantId, session: ctx.req.session, claims })\n}\n\nexport const getUploadSessionAccessQuery = (\n  ability: AppAbility,\n  action: \"read\" | \"update\" | \"delete\",\n): Record<string, unknown> => getAccessibleByQuery(ability, action, \"RBUploadSession\")\n\nconst timingSafeEqualHex = (left: string, right: string): boolean => {\n  if (left.length !== right.length) return false\n  try {\n    return timingSafeEqual(Buffer.from(left, \"hex\"), Buffer.from(right, \"hex\"))\n  } catch {\n    return false\n  }\n}\n\nexport const getOwnershipSelector = (\n  ctx: Ctx<SessionUser>,\n  session: Pick<UploadSessionDoc, \"userId\" | \"ownerKeyHash\">,\n): { userId?: string; ownerKeyHash?: string } | null => {\n  if (session.userId) {\n    const userId = getUserId(ctx)\n    if (!userId || userId !== session.userId) return null\n    return { userId: session.userId }\n  }\n\n  if (session.ownerKeyHash) {\n    const uploadKeyHash = getUploadKeyHash(ctx)\n    if (!uploadKeyHash) return null\n    if (!timingSafeEqualHex(session.ownerKeyHash, uploadKeyHash)) return null\n    return { ownerKeyHash: session.ownerKeyHash }\n  }\n\n  return null\n}\n"],"mappings":";;;;AAsBA,IAAMoB,2BAA2B,IAAI,OAAO;AAC5C,IAAMC,uBAAuB,KAAK,OAAO;AAEzC,IAAMC,sCAAsC,KAAK,OAAO;AAExD,IAAMC,wBAAwB,OAAU;AAExC,IAAMC,sCAAsB,IAAIC,IAAY;AAK5C,IAAMI,wCAAwC;AAE9C,IAAMC,4BAA4BC,aAAqC;CACrE,IAAI,OAAOA,aAAa,UAAU,OAAO;CACzC,MAAMC,aAAaD,SAASE,KAAK;CACjC,IAAI,CAACD,YAAY,OAAO;CACxB,MAAME,SAASC,OAAOH,UAAU;CAChC,IAAI,CAACG,OAAOC,SAASF,MAAM,KAAKA,UAAU,GAAG,OAAO;CACpD,OAAOG,KAAKC,MAAMJ,MAAM;AAC1B;AAEA,IAAaK,0BAAkC;CAE7C,MAAMK,WADad,yBAAyBW,QAAQC,IAAIC,0BACvCH,KAAcpB;CAC/B,OAAOiB,KAAKQ,IAAIxB,sBAAsBuB,QAAQ;AAChD;AAEA,IAAaE,yCAAwD;CAEnE,OADmBhB,yBAAyBW,QAAQC,IAAIK,qCACjDP,KAAclB;AACvB;AAEA,IAAa0B,wBAAgC;CAE3C,QADmBlB,yBAAyBW,QAAQC,IAAIQ,uBAAuB,KAAK3B,yBAChE;AACtB;AAEA,IAAa4B,wBAAwBC,mBAAmCA,iBAAiB,OAAO;AAEhG,IAAaC,uBAA+BZ,QAAQC,IAAIY,6BAA6B,GAAA,CAAIrB,KAAK,KAAK;AAEnG,IAAasB,mCAAmCC,eAA+B,GAAGA,WAAU;AAE5F,IAAaC,aAAaC,QAAyC;CACjE,MAAMC,MAAMD,IAAIE,IAAIC,SAASC,MAAMjD;CACnC,IAAI,OAAO8C,QAAQ,UAAU,OAAO;CACpC,MAAM3B,aAAa2B,IAAI1B,KAAK;CAC5B,OAAOD,aAAaA,aAAa;AACnC;AAEA,IAAa+B,eAAeL,QAAyC;CACnE,MAAMM,aAAaN,IAAIE,IAAIC,SAASC,MAAMhD;CAE1C,QADwB,OAAOkD,eAAe,WAAWA,WAAW/B,KAAK,IAAI,OACnD;AAC5B;AAEA,IAAaiC,oBAAoBhD,SAAyBlB,WAAW,QAAQ,CAAC,CAACmE,OAAOjD,IAAI,CAAC,CAACkD,OAAO,KAAK;AAExG,IAAaC,sBAAsBC,UAA0BA,MAAMrC,KAAK,CAAC,CAACsC,YAAY;AAEtF,IAAaC,eAAeC,MAAwBC,UAAkBC,aAAwC;CAC5Gf,KAAK,EACHC,SAAS,EACPC,MAAM,EACJhD,iBAAiB4D,SACnB,EACF,EACF;CACAC;AACF;AAEA,IAAaC,mBAAmBC,YAAoC;CAClE,IAAI1D,OAAO2D,SAASD,OAAO,GAAG,OAAOA;CACrC,IAAIA,mBAAmBE,YAAY,OAAO5D,OAAO6D,KAAKH,OAAO;CAC7D,OAAO;AACT;AAEA,IAAaI,sBAAsB,OACjCC,eACAC,gBACkB;CAClB,MAAME,SAASC,OAAQJ,eAA0DK,IAAIC,QAAQ,EAAE;CAC/F,IAAIH,UAAU7D,oBAAoBiE,IAAIJ,MAAM,GAAG;CAE/C,MAAMD,QAAQM,IAAI,CAChBR,cAAcS,cAAc,GAC5BR,YAAYQ,cAAc,CAAC,CAC5B;CAED,IAAIN,QAAQ7D,oBAAoBoE,IAAIP,MAAM;AAC5C;AAEA,IAAaQ,gCAAgC,OAAON,IAAQ/B,eAAsC;CAChG,MAAM4B,QAAQM,IAAI,CAChBH,GAAGO,WAAW,GAAGtC,WAAU,OAAQ,CAAC,CAACuC,YACnC,EAAE,8BAA8B,EAAE,GAClC;EACEP,MAAM;EACNQ,QAAQ;EACRC,yBAAyB,EAAE,8BAA8B,EAAEC,OAAO,SAAS,EAAE;CAC/E,CACF,GACAX,GAAGO,WAAWvC,gCAAgCC,UAAU,CAAC,CAAC,CAACuC,YACzD,EAAEI,QAAQ,EAAE,GACZ,EAAEX,MAAM,gCAAgC,CAC1C,CAAC,CACF;AACH;AAEA,IAAaY,4BAA4B,EACvCC,aACAC,eAIuBD,gBAAgBC,WAAW,WAAW;AAE/D,IAAaC,kCAAkCC,aAAyD;CACtG,MAAMH,cAAcG,SAASH;CAC7B,IAAIA,gBAAgB,WAAWA,gBAAgB,YAAYA,gBAAgB,UACzE,OAAOA;CAET,OAAOG,SAASF,aAAa,QAAQhB,OAAOkB,SAASF,QAAQ,CAAC,CAACrE,KAAK,CAAC,CAACsC,YAAY,MAAM,SAAS,WAAW;AAC9G;AAEA,IAAamC,4BAA4B,EACvCC,WACAC,MACAC,UACAC,UACAC,WACAV,aACAW,QACAC,mBAUgC;CAChC,MAAMC,iBAAiBb,gBAAgB,UACnCW,SACE,QAAQA,WACRC,eACE,OAAOA,iBACP,OACJZ;CACJ,IAAI,CAACa,gBAAgB,OAAO;CAE5B,MAAMC,sBAAsBR,UAAU1E,KAAK;CAC3C,MAAMmF,iBAAiB/C,mBAAmBuC,IAAI;CAC9C,MAAMS,qBAAqBP,SAAS7E,KAAK,CAAC,CAACsC,YAAY;CACvD,MAAM+C,sBAAsBpH,QAAQ2G,SAAS5E,KAAK,CAAC,CAAC,CAACsC,YAAY;CAYjE,OAAO;EACLoC,WAAWQ;EACXO,WAAW;EACXd,MAAMQ;EACNG,KAfUrD,iBAAiB/C,OAAO6D,KAAKwC,KAAKC,UAAU;GACtD5F;GACAsF;GACAC;GACAL;GACAM;GACAC;GACAjB;GACAa;EAAc,CACf,CAAC,CAMAK;EACAI,iBAAiB9F;CACnB;AACF;AAEA,IAAa+F,6BACX/D,YAC4B;CAC5B,MAAMwC,cAAcD,yBAAyB;EAC3CC,aAAaxC,QAAQwC;EACrBC,UAAUzC,QAAQyC;CACpB,CAAC;CAED,OAAO;EACLD;EACAC,UAAUD,gBAAgB;EAC1B,GAAI,OAAOxC,QAAQoD,iBAAiB,WAAW,EAAEA,cAAcpD,QAAQoD,aAAa,IAAI,CAAC;EACzF,GAAI,OAAOpD,QAAQmD,WAAW,WAAW,EAAEA,QAAQnD,QAAQmD,OAAO,IAAI,CAAC;CACzE;AACF;AAEA,IAAMc,sBAAsBnE,QAAgC;CAC1D,IAAI,OAAOA,QAAQ,UAAU,OAAO;CACpC,MAAM3B,aAAa2B,IAAI1B,KAAK;CAC5B,OAAOD,aAAaA,aAAa;AACnC;AAEA,IAAa+F,oBAAoBrE,QAAyC;CACxE,MAAMsE,YAAYF,mBAAmBpE,IAAIE,IAAIqE,IAAI,cAAc,CAAC;CAChE,IAAI,CAACD,WAAW,OAAO;CACvB,OAAO9D,iBAAiB/C,OAAO6D,KAAKgD,SAAS,CAAC;AAChD;AAEA,IAAaE,uBAAuBxE,KAAuBgB,aAAiC;CAC1F,MAAMyD,gBAAgBJ,iBAAiBrE,GAAG;CAC1C,MAAM0E,SAASD,gBAAgB,EAAEA,cAAc,IAAIE,KAAAA;CACnD,OAAO9H,wBAAwB;EAAEmE;EAAUb,SAASH,IAAIE,IAAIC;EAASuE;CAAO,CAAC;AAC/E;AAEA,IAAaE,+BACX3D,SACA4D,WAC4B/H,qBAAqBmE,SAAS4D,QAAQ,iBAAiB"}