@rpcbase/server 0.635.0 → 0.637.0

package/dist/{convertHeifToWebp-DwSrD30G.js → convertHeifToWebp-CIP6qLY7.js}

@@ -1,5 +1,5 @@
-import { queue } from "@rpcbase/worker";
 import sharp from "sharp";
+import { queue } from "@rpcbase/worker";
 //#region src/uploads/api/file-uploads/processors/convertHeifToWebp.ts
 var MAX_HEIF_BYTES = 26214400;
 var MAX_HEIF_INPUT_PIXELS = 67108864;
@@ -145,4 +145,4 @@ var convertHeifToWebpProcessor = {
 //#endregion
 export { registerConvertHeifToWebpTask as n, convertHeifToWebpProcessor as t };
 
-//# sourceMappingURL=convertHeifToWebp-DwSrD30G.js.map
+//# sourceMappingURL=convertHeifToWebp-CIP6qLY7.js.map

package/dist/{convertHeifToWebp-DwSrD30G.js.map → convertHeifToWebp-CIP6qLY7.js.map}

@@ -1 +1 @@
-{"version":3,"file":"convertHeifToWebp-DwSrD30G.js","names":[],"sources":["../src/uploads/api/file-uploads/processors/convertHeifToWebp.ts"],"sourcesContent":["import { queue, type Job } from \"@rpcbase/worker\"\nimport sharp from \"sharp\"\n\nimport type { UploadFileProcessor, UploadFileProcessorContext } from \"./index\"\n\n\nconst MAX_HEIF_BYTES = 25 * 1024 * 1024\nconst MAX_HEIF_INPUT_PIXELS = 64 * 1024 * 1024\nconst WEBP_QUALITY = 82\nconst CONVERSION_TIMEOUT_MS = 60_000\nconst POLL_INTERVAL_MS = 250\nconst HEIF_DECODE_UNSUPPORTED = \"heif_decode_unsupported\"\n\nconst heifMimeTypes = new Set([\n  \"image/heic\",\n  \"image/heif\",\n  \"image/heic-sequence\",\n  \"image/heif-sequence\",\n])\n\nconst heifExtensions = /\\.(?:heic|heif|heics|heifs)$/i\nconst hevcBrands = new Set([\"heic\", \"heix\", \"hevc\", \"hevx\", \"heim\", \"heis\", \"hevm\", \"hevs\"])\n\nexport const convertHeifToWebpTaskName = \"rb-upload-convert-heif-to-webp\"\n\nexport type ConvertHeifToWebpTaskPayload = {\n  filename: string\n  mimeType: string\n  inputBase64: string\n}\n\nexport type ConvertHeifToWebpTaskResult = {\n  dataBase64: string\n  filename: string\n  mimeType: \"image/webp\"\n  metadata: {\n    width?: number\n    height?: number\n    sourceFilename: string\n    sourceMimeType: string\n  }\n}\n\ndeclare module \"@rpcbase/worker\" {\n  interface WorkerTasksMap {\n    \"rb-upload-convert-heif-to-webp\": ConvertHeifToWebpTaskPayload\n  }\n}\n\nconst delay = async (ms: number): Promise<void> => {\n  await new Promise((resolve) => setTimeout(resolve, ms))\n}\n\nconst normalizeMimeType = (value: string): string => value.trim().toLowerCase()\n\nconst getFtypBrands = (sniff: Buffer): string[] => {\n  if (sniff.length < 12) return []\n\n  const ftypOffset = sniff.indexOf(Buffer.from(\"ftyp\"))\n  if (ftypOffset < 4 || ftypOffset > 32) return []\n\n  const brands: string[] = []\n  for (let offset = ftypOffset + 4; offset + 4 <= Math.min(sniff.length, ftypOffset + 80); offset += 4) {\n    const brand = sniff.subarray(offset, offset + 4).toString(\"ascii\")\n    if (/^[a-zA-Z0-9 ]{4}$/.test(brand)) {\n      brands.push(brand.trim())\n    }\n  }\n\n  return brands.filter(Boolean)\n}\n\nexport const hasHeifDeclaration = ({ filename, clientMimeType }: Pick<UploadFileProcessorContext, \"filename\" | \"clientMimeType\">): boolean =>\n  heifMimeTypes.has(normalizeMimeType(clientMimeType)) || heifExtensions.test(filename)\n\nexport const looksLikeHevcHeif = (sniff: Buffer): boolean => getFtypBrands(sniff).some((brand) => hevcBrands.has(brand))\n\nexport const isHeifUpload = ({ filename, clientMimeType, sniff }: UploadFileProcessorContext): boolean =>\n  hasHeifDeclaration({ filename, clientMimeType }) || looksLikeHevcHeif(sniff)\n\nexport const toWebpFilename = (filename: string): string => {\n  const trimmed = filename.trim()\n  if (!trimmed) return \"image.webp\"\n  if (heifExtensions.test(trimmed)) return trimmed.replace(heifExtensions, \".webp\")\n  return `${trimmed}.webp`\n}\n\nconst isHeifDecodeUnsupportedError = (error: unknown): boolean => {\n  const message = error instanceof Error ? error.message : String(error ?? \"unknown\")\n  const normalized = message.toLowerCase()\n  return (\n    message.startsWith(HEIF_DECODE_UNSUPPORTED) ||\n    normalized.includes(\"support for this compression format has not been built in\") ||\n    normalized.includes(\"heif: error while loading plugin\") ||\n    normalized.includes(\"unsupported feature: unsupported codec\") ||\n    normalized.includes(\"no decoding plugin installed\")\n  )\n}\n\nexport const getSharpHeifSupportDiagnostic = (): string => {\n  const suffixes = sharp.format.heif.input.fileSuffix ?? []\n  const advertisedSuffixes = suffixes.length ? suffixes.join(\", \") : \"none\"\n  const sharpVersion = sharp.versions.sharp ?? \"unknown\"\n  const vipsVersion = sharp.versions.vips ?? \"unknown\"\n  const heifVersion = sharp.versions.heif ?? \"not reported\"\n\n  return `Sharp ${sharpVersion} / libvips ${vipsVersion} / libheif ${heifVersion} advertises HEIF input suffixes: ${advertisedSuffixes}. iPhone HEIC/HEVC requires a libvips build with libheif, libde265 and x265/HEVC support. Install a compatible global libvips and reinstall sharp so it links against it.`\n}\n\nconst createHeifDecodeUnsupportedError = (): Error => new Error(`${HEIF_DECODE_UNSUPPORTED}: ${getSharpHeifSupportDiagnostic()}`)\n\nconst normalizeConversionError = (error: unknown): Error => {\n  const message = error instanceof Error ? error.message : String(error ?? \"unknown\")\n  if (message === \"heif_too_large\") {\n    return new Error(message)\n  }\n  if (message.startsWith(HEIF_DECODE_UNSUPPORTED)) {\n    return new Error(message)\n  }\n  if (isHeifDecodeUnsupportedError(error)) {\n    return createHeifDecodeUnsupportedError()\n  }\n  return new Error(\"heif_conversion_failed\")\n}\n\nexport const convertHeifToWebp = async (\n  input: Buffer,\n  payload: Pick<ConvertHeifToWebpTaskPayload, \"filename\" | \"mimeType\">,\n): Promise<ConvertHeifToWebpTaskResult> => {\n  try {\n    const output = await sharp(input, { limitInputPixels: MAX_HEIF_INPUT_PIXELS })\n      .rotate()\n      .webp({ quality: WEBP_QUALITY, effort: 4 })\n      .toBuffer({ resolveWithObject: true })\n\n    return {\n      dataBase64: output.data.toString(\"base64\"),\n      filename: toWebpFilename(payload.filename),\n      mimeType: \"image/webp\",\n      metadata: {\n        sourceFilename: payload.filename,\n        sourceMimeType: payload.mimeType,\n        ...(typeof output.info.width === \"number\" ? { width: output.info.width } : {}),\n        ...(typeof output.info.height === \"number\" ? { height: output.info.height } : {}),\n      },\n    }\n  } catch (error) {\n    throw normalizeConversionError(error)\n  }\n}\n\nconst convertHeifToWebpTask = async (payload: ConvertHeifToWebpTaskPayload, job: Job): Promise<ConvertHeifToWebpTaskResult> => {\n  const input = Buffer.from(payload.inputBase64, \"base64\")\n  await job.log(`convert ${payload.filename} (${input.length} bytes) to webp`)\n  return convertHeifToWebp(input, payload)\n}\n\nlet isConvertHeifToWebpTaskRegistered = false\n\nexport const registerConvertHeifToWebpTask = (): void => {\n  if (isConvertHeifToWebpTaskRegistered) return\n\n  queue.registerTask(convertHeifToWebpTaskName, convertHeifToWebpTask)\n  isConvertHeifToWebpTaskRegistered = true\n}\n\nconst waitForConversionResult = async (job: Job): Promise<ConvertHeifToWebpTaskResult> => {\n  const startedAt = Date.now()\n\n  while (Date.now() - startedAt < CONVERSION_TIMEOUT_MS) {\n    const currentJob = job.id ? await queue.getJob(String(job.id)) : job\n    if (!currentJob) {\n      throw new Error(\"heif_conversion_failed\")\n    }\n\n    const state = await currentJob.getState()\n    if (state === \"completed\") {\n      return currentJob.returnvalue as ConvertHeifToWebpTaskResult\n    }\n    if (state === \"failed\") {\n      throw new Error(currentJob.failedReason || \"heif_conversion_failed\")\n    }\n    await delay(POLL_INTERVAL_MS)\n  }\n\n  throw new Error(\"heif_conversion_timeout\")\n}\n\nconst runConversionTask = async (\n  input: Buffer,\n  payload: Pick<ConvertHeifToWebpTaskPayload, \"filename\" | \"mimeType\">,\n): Promise<ConvertHeifToWebpTaskResult> => {\n  const job = await queue.add(\n    convertHeifToWebpTaskName,\n    {\n      ...payload,\n      inputBase64: input.toString(\"base64\"),\n    },\n    {\n      attempts: 1,\n      removeOnComplete: 128,\n      removeOnFail: 128,\n    },\n  )\n\n  return waitForConversionResult(job)\n}\n\nexport const convertHeifToWebpProcessor: UploadFileProcessor = {\n  id: \"convert-heif-to-webp\",\n  maxBytes: MAX_HEIF_BYTES,\n  match: isHeifUpload,\n  process: async (data, ctx) => {\n    if (data.length > MAX_HEIF_BYTES) {\n      throw new Error(\"heif_too_large\")\n    }\n\n    const result = await runConversionTask(data, {\n      filename: ctx.filename,\n      mimeType: ctx.clientMimeType,\n    })\n\n    return {\n      data: Buffer.from(result.dataBase64, \"base64\"),\n      filename: result.filename,\n      mimeType: result.mimeType,\n      metadata: result.metadata,\n    }\n  },\n}\n"],"mappings":";;;AAMA,IAAM,iBAAiB;AACvB,IAAM,wBAAwB;AAC9B,IAAM,eAAe;AACrB,IAAM,wBAAwB;AAC9B,IAAM,mBAAmB;AACzB,IAAM,0BAA0B;AAEhC,IAAM,gCAAgB,IAAI,IAAI;CAC5B;CACA;CACA;CACA;AACF,CAAC;AAED,IAAM,iBAAiB;AACvB,IAAM,6BAAa,IAAI,IAAI;CAAC;CAAQ;CAAQ;CAAQ;CAAQ;CAAQ;CAAQ;CAAQ;AAAM,CAAC;AAE3F,IAAa,4BAA4B;AA0BzC,IAAM,QAAQ,OAAO,OAA8B;CACjD,MAAM,IAAI,SAAS,YAAY,WAAW,SAAS,EAAE,CAAC;AACxD;AAEA,IAAM,qBAAqB,UAA0B,MAAM,KAAK,CAAC,CAAC,YAAY;AAE9E,IAAM,iBAAiB,UAA4B;CACjD,IAAI,MAAM,SAAS,IAAI,OAAO,CAAC;CAE/B,MAAM,aAAa,MAAM,QAAQ,OAAO,KAAK,MAAM,CAAC;CACpD,IAAI,aAAa,KAAK,aAAa,IAAI,OAAO,CAAC;CAE/C,MAAM,SAAmB,CAAC;CAC1B,KAAK,IAAI,SAAS,aAAa,GAAG,SAAS,KAAK,KAAK,IAAI,MAAM,QAAQ,aAAa,EAAE,GAAG,UAAU,GAAG;EACpG,MAAM,QAAQ,MAAM,SAAS,QAAQ,SAAS,CAAC,CAAC,CAAC,SAAS,OAAO;EACjE,IAAI,oBAAoB,KAAK,KAAK,GAChC,OAAO,KAAK,MAAM,KAAK,CAAC;CAE5B;CAEA,OAAO,OAAO,OAAO,OAAO;AAC9B;AAEA,IAAa,sBAAsB,EAAE,UAAU,qBAC7C,cAAc,IAAI,kBAAkB,cAAc,CAAC,KAAK,eAAe,KAAK,QAAQ;AAEtF,IAAa,qBAAqB,UAA2B,cAAc,KAAK,CAAC,CAAC,MAAM,UAAU,WAAW,IAAI,KAAK,CAAC;AAEvH,IAAa,gBAAgB,EAAE,UAAU,gBAAgB,YACvD,mBAAmB;CAAE;CAAU;AAAe,CAAC,KAAK,kBAAkB,KAAK;AAE7E,IAAa,kBAAkB,aAA6B;CAC1D,MAAM,UAAU,SAAS,KAAK;CAC9B,IAAI,CAAC,SAAS,OAAO;CACrB,IAAI,eAAe,KAAK,OAAO,GAAG,OAAO,QAAQ,QAAQ,gBAAgB,OAAO;CAChF,OAAO,GAAG,QAAQ;AACpB;AAEA,IAAM,gCAAgC,UAA4B;CAChE,MAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU,OAAO,SAAS,SAAS;CAClF,MAAM,aAAa,QAAQ,YAAY;CACvC,OACE,QAAQ,WAAW,uBAAuB,KAC1C,WAAW,SAAS,2DAA2D,KAC/E,WAAW,SAAS,kCAAkC,KACtD,WAAW,SAAS,wCAAwC,KAC5D,WAAW,SAAS,8BAA8B;AAEtD;AAEA,IAAa,sCAA8C;CACzD,MAAM,WAAW,MAAM,OAAO,KAAK,MAAM,cAAc,CAAC;CACxD,MAAM,qBAAqB,SAAS,SAAS,SAAS,KAAK,IAAI,IAAI;CAKnE,OAAO,SAJc,MAAM,SAAS,SAAS,UAIhB,aAHT,MAAM,SAAS,QAAQ,UAGW,aAFlC,MAAM,SAAS,QAAQ,eAEoC,mCAAmC,mBAAmB;AACvI;AAEA,IAAM,yDAAgD,IAAI,MAAM,GAAG,wBAAwB,IAAI,8BAA8B,GAAG;AAEhI,IAAM,4BAA4B,UAA0B;CAC1D,MAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU,OAAO,SAAS,SAAS;CAClF,IAAI,YAAY,kBACd,OAAO,IAAI,MAAM,OAAO;CAE1B,IAAI,QAAQ,WAAW,uBAAuB,GAC5C,OAAO,IAAI,MAAM,OAAO;CAE1B,IAAI,6BAA6B,KAAK,GACpC,OAAO,iCAAiC;CAE1C,uBAAO,IAAI,MAAM,wBAAwB;AAC3C;AAEA,IAAa,oBAAoB,OAC/B,OACA,YACyC;CACzC,IAAI;EACF,MAAM,SAAS,MAAM,MAAM,OAAO,EAAE,kBAAkB,sBAAsB,CAAC,CAAC,CAC3E,OAAO,CAAC,CACR,KAAK;GAAE,SAAS;GAAc,QAAQ;EAAE,CAAC,CAAC,CAC1C,SAAS,EAAE,mBAAmB,KAAK,CAAC;EAEvC,OAAO;GACL,YAAY,OAAO,KAAK,SAAS,QAAQ;GACzC,UAAU,eAAe,QAAQ,QAAQ;GACzC,UAAU;GACV,UAAU;IACR,gBAAgB,QAAQ;IACxB,gBAAgB,QAAQ;IACxB,GAAI,OAAO,OAAO,KAAK,UAAU,WAAW,EAAE,OAAO,OAAO,KAAK,MAAM,IAAI,CAAC;IAC5E,GAAI,OAAO,OAAO,KAAK,WAAW,WAAW,EAAE,QAAQ,OAAO,KAAK,OAAO,IAAI,CAAC;GACjF;EACF;CACF,SAAS,OAAO;EACd,MAAM,yBAAyB,KAAK;CACtC;AACF;AAEA,IAAM,wBAAwB,OAAO,SAAuC,QAAmD;CAC7H,MAAM,QAAQ,OAAO,KAAK,QAAQ,aAAa,QAAQ;CACvD,MAAM,IAAI,IAAI,WAAW,QAAQ,SAAS,IAAI,MAAM,OAAO,gBAAgB;CAC3E,OAAO,kBAAkB,OAAO,OAAO;AACzC;AAEA,IAAI,oCAAoC;AAExC,IAAa,sCAA4C;CACvD,IAAI,mCAAmC;CAEvC,MAAM,aAAa,2BAA2B,qBAAqB;CACnE,oCAAoC;AACtC;AAEA,IAAM,0BAA0B,OAAO,QAAmD;CACxF,MAAM,YAAY,KAAK,IAAI;CAE3B,OAAO,KAAK,IAAI,IAAI,YAAY,uBAAuB;EACrD,MAAM,aAAa,IAAI,KAAK,MAAM,MAAM,OAAO,OAAO,IAAI,EAAE,CAAC,IAAI;EACjE,IAAI,CAAC,YACH,MAAM,IAAI,MAAM,wBAAwB;EAG1C,MAAM,QAAQ,MAAM,WAAW,SAAS;EACxC,IAAI,UAAU,aACZ,OAAO,WAAW;EAEpB,IAAI,UAAU,UACZ,MAAM,IAAI,MAAM,WAAW,gBAAgB,wBAAwB;EAErE,MAAM,MAAM,gBAAgB;CAC9B;CAEA,MAAM,IAAI,MAAM,yBAAyB;AAC3C;AAEA,IAAM,oBAAoB,OACxB,OACA,YACyC;CAczC,OAAO,wBAAwB,MAbb,MAAM,IACtB,2BACA;EACE,GAAG;EACH,aAAa,MAAM,SAAS,QAAQ;CACtC,GACA;EACE,UAAU;EACV,kBAAkB;EAClB,cAAc;CAChB,CACF,CAEkC;AACpC;AAEA,IAAa,6BAAkD;CAC7D,IAAI;CACJ,UAAU;CACV,OAAO;CACP,SAAS,OAAO,MAAM,QAAQ;EAC5B,IAAI,KAAK,SAAS,gBAChB,MAAM,IAAI,MAAM,gBAAgB;EAGlC,MAAM,SAAS,MAAM,kBAAkB,MAAM;GAC3C,UAAU,IAAI;GACd,UAAU,IAAI;EAChB,CAAC;EAED,OAAO;GACL,MAAM,OAAO,KAAK,OAAO,YAAY,QAAQ;GAC7C,UAAU,OAAO;GACjB,UAAU,OAAO;GACjB,UAAU,OAAO;EACnB;CACF;AACF"}
+{"version":3,"file":"convertHeifToWebp-CIP6qLY7.js","names":[],"sources":["../src/uploads/api/file-uploads/processors/convertHeifToWebp.ts"],"sourcesContent":["import { queue, type Job } from \"@rpcbase/worker\"\nimport sharp from \"sharp\"\n\nimport type { UploadFileProcessor, UploadFileProcessorContext } from \"./index\"\n\n\nconst MAX_HEIF_BYTES = 25 * 1024 * 1024\nconst MAX_HEIF_INPUT_PIXELS = 64 * 1024 * 1024\nconst WEBP_QUALITY = 82\nconst CONVERSION_TIMEOUT_MS = 60_000\nconst POLL_INTERVAL_MS = 250\nconst HEIF_DECODE_UNSUPPORTED = \"heif_decode_unsupported\"\n\nconst heifMimeTypes = new Set([\n  \"image/heic\",\n  \"image/heif\",\n  \"image/heic-sequence\",\n  \"image/heif-sequence\",\n])\n\nconst heifExtensions = /\\.(?:heic|heif|heics|heifs)$/i\nconst hevcBrands = new Set([\"heic\", \"heix\", \"hevc\", \"hevx\", \"heim\", \"heis\", \"hevm\", \"hevs\"])\n\nexport const convertHeifToWebpTaskName = \"rb-upload-convert-heif-to-webp\"\n\nexport type ConvertHeifToWebpTaskPayload = {\n  filename: string\n  mimeType: string\n  inputBase64: string\n}\n\nexport type ConvertHeifToWebpTaskResult = {\n  dataBase64: string\n  filename: string\n  mimeType: \"image/webp\"\n  metadata: {\n    width?: number\n    height?: number\n    sourceFilename: string\n    sourceMimeType: string\n  }\n}\n\ndeclare module \"@rpcbase/worker\" {\n  interface WorkerTasksMap {\n    \"rb-upload-convert-heif-to-webp\": ConvertHeifToWebpTaskPayload\n  }\n}\n\nconst delay = async (ms: number): Promise<void> => {\n  await new Promise((resolve) => setTimeout(resolve, ms))\n}\n\nconst normalizeMimeType = (value: string): string => value.trim().toLowerCase()\n\nconst getFtypBrands = (sniff: Buffer): string[] => {\n  if (sniff.length < 12) return []\n\n  const ftypOffset = sniff.indexOf(Buffer.from(\"ftyp\"))\n  if (ftypOffset < 4 || ftypOffset > 32) return []\n\n  const brands: string[] = []\n  for (let offset = ftypOffset + 4; offset + 4 <= Math.min(sniff.length, ftypOffset + 80); offset += 4) {\n    const brand = sniff.subarray(offset, offset + 4).toString(\"ascii\")\n    if (/^[a-zA-Z0-9 ]{4}$/.test(brand)) {\n      brands.push(brand.trim())\n    }\n  }\n\n  return brands.filter(Boolean)\n}\n\nexport const hasHeifDeclaration = ({ filename, clientMimeType }: Pick<UploadFileProcessorContext, \"filename\" | \"clientMimeType\">): boolean =>\n  heifMimeTypes.has(normalizeMimeType(clientMimeType)) || heifExtensions.test(filename)\n\nexport const looksLikeHevcHeif = (sniff: Buffer): boolean => getFtypBrands(sniff).some((brand) => hevcBrands.has(brand))\n\nexport const isHeifUpload = ({ filename, clientMimeType, sniff }: UploadFileProcessorContext): boolean =>\n  hasHeifDeclaration({ filename, clientMimeType }) || looksLikeHevcHeif(sniff)\n\nexport const toWebpFilename = (filename: string): string => {\n  const trimmed = filename.trim()\n  if (!trimmed) return \"image.webp\"\n  if (heifExtensions.test(trimmed)) return trimmed.replace(heifExtensions, \".webp\")\n  return `${trimmed}.webp`\n}\n\nconst isHeifDecodeUnsupportedError = (error: unknown): boolean => {\n  const message = error instanceof Error ? error.message : String(error ?? \"unknown\")\n  const normalized = message.toLowerCase()\n  return (\n    message.startsWith(HEIF_DECODE_UNSUPPORTED) ||\n    normalized.includes(\"support for this compression format has not been built in\") ||\n    normalized.includes(\"heif: error while loading plugin\") ||\n    normalized.includes(\"unsupported feature: unsupported codec\") ||\n    normalized.includes(\"no decoding plugin installed\")\n  )\n}\n\nexport const getSharpHeifSupportDiagnostic = (): string => {\n  const suffixes = sharp.format.heif.input.fileSuffix ?? []\n  const advertisedSuffixes = suffixes.length ? suffixes.join(\", \") : \"none\"\n  const sharpVersion = sharp.versions.sharp ?? \"unknown\"\n  const vipsVersion = sharp.versions.vips ?? \"unknown\"\n  const heifVersion = sharp.versions.heif ?? \"not reported\"\n\n  return `Sharp ${sharpVersion} / libvips ${vipsVersion} / libheif ${heifVersion} advertises HEIF input suffixes: ${advertisedSuffixes}. iPhone HEIC/HEVC requires a libvips build with libheif, libde265 and x265/HEVC support. Install a compatible global libvips and reinstall sharp so it links against it.`\n}\n\nconst createHeifDecodeUnsupportedError = (): Error => new Error(`${HEIF_DECODE_UNSUPPORTED}: ${getSharpHeifSupportDiagnostic()}`)\n\nconst normalizeConversionError = (error: unknown): Error => {\n  const message = error instanceof Error ? error.message : String(error ?? \"unknown\")\n  if (message === \"heif_too_large\") {\n    return new Error(message)\n  }\n  if (message.startsWith(HEIF_DECODE_UNSUPPORTED)) {\n    return new Error(message)\n  }\n  if (isHeifDecodeUnsupportedError(error)) {\n    return createHeifDecodeUnsupportedError()\n  }\n  return new Error(\"heif_conversion_failed\")\n}\n\nexport const convertHeifToWebp = async (\n  input: Buffer,\n  payload: Pick<ConvertHeifToWebpTaskPayload, \"filename\" | \"mimeType\">,\n): Promise<ConvertHeifToWebpTaskResult> => {\n  try {\n    const output = await sharp(input, { limitInputPixels: MAX_HEIF_INPUT_PIXELS })\n      .rotate()\n      .webp({ quality: WEBP_QUALITY, effort: 4 })\n      .toBuffer({ resolveWithObject: true })\n\n    return {\n      dataBase64: output.data.toString(\"base64\"),\n      filename: toWebpFilename(payload.filename),\n      mimeType: \"image/webp\",\n      metadata: {\n        sourceFilename: payload.filename,\n        sourceMimeType: payload.mimeType,\n        ...(typeof output.info.width === \"number\" ? { width: output.info.width } : {}),\n        ...(typeof output.info.height === \"number\" ? { height: output.info.height } : {}),\n      },\n    }\n  } catch (error) {\n    throw normalizeConversionError(error)\n  }\n}\n\nconst convertHeifToWebpTask = async (payload: ConvertHeifToWebpTaskPayload, job: Job): Promise<ConvertHeifToWebpTaskResult> => {\n  const input = Buffer.from(payload.inputBase64, \"base64\")\n  await job.log(`convert ${payload.filename} (${input.length} bytes) to webp`)\n  return convertHeifToWebp(input, payload)\n}\n\nlet isConvertHeifToWebpTaskRegistered = false\n\nexport const registerConvertHeifToWebpTask = (): void => {\n  if (isConvertHeifToWebpTaskRegistered) return\n\n  queue.registerTask(convertHeifToWebpTaskName, convertHeifToWebpTask)\n  isConvertHeifToWebpTaskRegistered = true\n}\n\nconst waitForConversionResult = async (job: Job): Promise<ConvertHeifToWebpTaskResult> => {\n  const startedAt = Date.now()\n\n  while (Date.now() - startedAt < CONVERSION_TIMEOUT_MS) {\n    const currentJob = job.id ? await queue.getJob(String(job.id)) : job\n    if (!currentJob) {\n      throw new Error(\"heif_conversion_failed\")\n    }\n\n    const state = await currentJob.getState()\n    if (state === \"completed\") {\n      return currentJob.returnvalue as ConvertHeifToWebpTaskResult\n    }\n    if (state === \"failed\") {\n      throw new Error(currentJob.failedReason || \"heif_conversion_failed\")\n    }\n    await delay(POLL_INTERVAL_MS)\n  }\n\n  throw new Error(\"heif_conversion_timeout\")\n}\n\nconst runConversionTask = async (\n  input: Buffer,\n  payload: Pick<ConvertHeifToWebpTaskPayload, \"filename\" | \"mimeType\">,\n): Promise<ConvertHeifToWebpTaskResult> => {\n  const job = await queue.add(\n    convertHeifToWebpTaskName,\n    {\n      ...payload,\n      inputBase64: input.toString(\"base64\"),\n    },\n    {\n      attempts: 1,\n      removeOnComplete: 128,\n      removeOnFail: 128,\n    },\n  )\n\n  return waitForConversionResult(job)\n}\n\nexport const convertHeifToWebpProcessor: UploadFileProcessor = {\n  id: \"convert-heif-to-webp\",\n  maxBytes: MAX_HEIF_BYTES,\n  match: isHeifUpload,\n  process: async (data, ctx) => {\n    if (data.length > MAX_HEIF_BYTES) {\n      throw new Error(\"heif_too_large\")\n    }\n\n    const result = await runConversionTask(data, {\n      filename: ctx.filename,\n      mimeType: ctx.clientMimeType,\n    })\n\n    return {\n      data: Buffer.from(result.dataBase64, \"base64\"),\n      filename: result.filename,\n      mimeType: result.mimeType,\n      metadata: result.metadata,\n    }\n  },\n}\n"],"mappings":";;;AAMA,IAAM,iBAAiB;AACvB,IAAM,wBAAwB;AAC9B,IAAM,eAAe;AACrB,IAAM,wBAAwB;AAC9B,IAAM,mBAAmB;AACzB,IAAM,0BAA0B;AAEhC,IAAM,gCAAgB,IAAI,IAAI;CAC5B;CACA;CACA;CACA;AACF,CAAC;AAED,IAAM,iBAAiB;AACvB,IAAM,6BAAa,IAAI,IAAI;CAAC;CAAQ;CAAQ;CAAQ;CAAQ;CAAQ;CAAQ;CAAQ;AAAM,CAAC;AAE3F,IAAa,4BAA4B;AA0BzC,IAAM,QAAQ,OAAO,OAA8B;CACjD,MAAM,IAAI,SAAS,YAAY,WAAW,SAAS,EAAE,CAAC;AACxD;AAEA,IAAM,qBAAqB,UAA0B,MAAM,KAAK,CAAC,CAAC,YAAY;AAE9E,IAAM,iBAAiB,UAA4B;CACjD,IAAI,MAAM,SAAS,IAAI,OAAO,CAAC;CAE/B,MAAM,aAAa,MAAM,QAAQ,OAAO,KAAK,MAAM,CAAC;CACpD,IAAI,aAAa,KAAK,aAAa,IAAI,OAAO,CAAC;CAE/C,MAAM,SAAmB,CAAC;CAC1B,KAAK,IAAI,SAAS,aAAa,GAAG,SAAS,KAAK,KAAK,IAAI,MAAM,QAAQ,aAAa,EAAE,GAAG,UAAU,GAAG;EACpG,MAAM,QAAQ,MAAM,SAAS,QAAQ,SAAS,CAAC,CAAC,CAAC,SAAS,OAAO;EACjE,IAAI,oBAAoB,KAAK,KAAK,GAChC,OAAO,KAAK,MAAM,KAAK,CAAC;CAE5B;CAEA,OAAO,OAAO,OAAO,OAAO;AAC9B;AAEA,IAAa,sBAAsB,EAAE,UAAU,qBAC7C,cAAc,IAAI,kBAAkB,cAAc,CAAC,KAAK,eAAe,KAAK,QAAQ;AAEtF,IAAa,qBAAqB,UAA2B,cAAc,KAAK,CAAC,CAAC,MAAM,UAAU,WAAW,IAAI,KAAK,CAAC;AAEvH,IAAa,gBAAgB,EAAE,UAAU,gBAAgB,YACvD,mBAAmB;CAAE;CAAU;AAAe,CAAC,KAAK,kBAAkB,KAAK;AAE7E,IAAa,kBAAkB,aAA6B;CAC1D,MAAM,UAAU,SAAS,KAAK;CAC9B,IAAI,CAAC,SAAS,OAAO;CACrB,IAAI,eAAe,KAAK,OAAO,GAAG,OAAO,QAAQ,QAAQ,gBAAgB,OAAO;CAChF,OAAO,GAAG,QAAQ;AACpB;AAEA,IAAM,gCAAgC,UAA4B;CAChE,MAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU,OAAO,SAAS,SAAS;CAClF,MAAM,aAAa,QAAQ,YAAY;CACvC,OACE,QAAQ,WAAW,uBAAuB,KAC1C,WAAW,SAAS,2DAA2D,KAC/E,WAAW,SAAS,kCAAkC,KACtD,WAAW,SAAS,wCAAwC,KAC5D,WAAW,SAAS,8BAA8B;AAEtD;AAEA,IAAa,sCAA8C;CACzD,MAAM,WAAW,MAAM,OAAO,KAAK,MAAM,cAAc,CAAC;CACxD,MAAM,qBAAqB,SAAS,SAAS,SAAS,KAAK,IAAI,IAAI;CAKnE,OAAO,SAJc,MAAM,SAAS,SAAS,UAIhB,aAHT,MAAM,SAAS,QAAQ,UAGW,aAFlC,MAAM,SAAS,QAAQ,eAEoC,mCAAmC,mBAAmB;AACvI;AAEA,IAAM,yDAAgD,IAAI,MAAM,GAAG,wBAAwB,IAAI,8BAA8B,GAAG;AAEhI,IAAM,4BAA4B,UAA0B;CAC1D,MAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU,OAAO,SAAS,SAAS;CAClF,IAAI,YAAY,kBACd,OAAO,IAAI,MAAM,OAAO;CAE1B,IAAI,QAAQ,WAAW,uBAAuB,GAC5C,OAAO,IAAI,MAAM,OAAO;CAE1B,IAAI,6BAA6B,KAAK,GACpC,OAAO,iCAAiC;CAE1C,uBAAO,IAAI,MAAM,wBAAwB;AAC3C;AAEA,IAAa,oBAAoB,OAC/B,OACA,YACyC;CACzC,IAAI;EACF,MAAM,SAAS,MAAM,MAAM,OAAO,EAAE,kBAAkB,sBAAsB,CAAC,CAAC,CAC3E,OAAO,CAAC,CACR,KAAK;GAAE,SAAS;GAAc,QAAQ;EAAE,CAAC,CAAC,CAC1C,SAAS,EAAE,mBAAmB,KAAK,CAAC;EAEvC,OAAO;GACL,YAAY,OAAO,KAAK,SAAS,QAAQ;GACzC,UAAU,eAAe,QAAQ,QAAQ;GACzC,UAAU;GACV,UAAU;IACR,gBAAgB,QAAQ;IACxB,gBAAgB,QAAQ;IACxB,GAAI,OAAO,OAAO,KAAK,UAAU,WAAW,EAAE,OAAO,OAAO,KAAK,MAAM,IAAI,CAAC;IAC5E,GAAI,OAAO,OAAO,KAAK,WAAW,WAAW,EAAE,QAAQ,OAAO,KAAK,OAAO,IAAI,CAAC;GACjF;EACF;CACF,SAAS,OAAO;EACd,MAAM,yBAAyB,KAAK;CACtC;AACF;AAEA,IAAM,wBAAwB,OAAO,SAAuC,QAAmD;CAC7H,MAAM,QAAQ,OAAO,KAAK,QAAQ,aAAa,QAAQ;CACvD,MAAM,IAAI,IAAI,WAAW,QAAQ,SAAS,IAAI,MAAM,OAAO,gBAAgB;CAC3E,OAAO,kBAAkB,OAAO,OAAO;AACzC;AAEA,IAAI,oCAAoC;AAExC,IAAa,sCAA4C;CACvD,IAAI,mCAAmC;CAEvC,MAAM,aAAa,2BAA2B,qBAAqB;CACnE,oCAAoC;AACtC;AAEA,IAAM,0BAA0B,OAAO,QAAmD;CACxF,MAAM,YAAY,KAAK,IAAI;CAE3B,OAAO,KAAK,IAAI,IAAI,YAAY,uBAAuB;EACrD,MAAM,aAAa,IAAI,KAAK,MAAM,MAAM,OAAO,OAAO,IAAI,EAAE,CAAC,IAAI;EACjE,IAAI,CAAC,YACH,MAAM,IAAI,MAAM,wBAAwB;EAG1C,MAAM,QAAQ,MAAM,WAAW,SAAS;EACxC,IAAI,UAAU,aACZ,OAAO,WAAW;EAEpB,IAAI,UAAU,UACZ,MAAM,IAAI,MAAM,WAAW,gBAAgB,wBAAwB;EAErE,MAAM,MAAM,gBAAgB;CAC9B;CAEA,MAAM,IAAI,MAAM,yBAAyB;AAC3C;AAEA,IAAM,oBAAoB,OACxB,OACA,YACyC;CAczC,OAAO,wBAAwB,MAbb,MAAM,IACtB,2BACA;EACE,GAAG;EACH,aAAa,MAAM,SAAS,QAAQ;CACtC,GACA;EACE,UAAU;EACV,kBAAkB;EAClB,cAAc;CAChB,CACF,CAEkC;AACpC;AAEA,IAAa,6BAAkD;CAC7D,IAAI;CACJ,UAAU;CACV,OAAO;CACP,SAAS,OAAO,MAAM,QAAQ;EAC5B,IAAI,KAAK,SAAS,gBAChB,MAAM,IAAI,MAAM,gBAAgB;EAGlC,MAAM,SAAS,MAAM,kBAAkB,MAAM;GAC3C,UAAU,IAAI;GACd,UAAU,IAAI;EAChB,CAAC;EAED,OAAO;GACL,MAAM,OAAO,KAAK,OAAO,YAAY,QAAQ;GAC7C,UAAU,OAAO;GACjB,UAAU,OAAO;GACjB,UAAU,OAAO;EACnB;CACF;AACF"}

package/dist/{handler-Z6wToZhb.js → handler-BkGfOJ1l.js}

@@ -1,7 +1,7 @@
 import { _ as getUserId, a as ensureFilesystemUploadIndexes, b as resolveUploadAccessScope, c as getChunkSizeBytes, d as getModelCtx, f as getRawBodyLimitBytes, g as getUploadSessionAccessQuery, i as computeSha256Hex, m as getTenantId, n as buildUploadDeduplication, o as ensureUploadIndexes, p as getSessionTtlMs, r as buildUploadsAbility, s as getBucketName, t as buildUploadAccessMetadata, u as getMaxClientUploadBytesPerSecond, v as normalizeSha256Hex, x as toBufferPayload } from "./shared-B1VLaHsk.js";
 import { n as createUploadFileReference, t as claimUploadFileReference } from "./fileReferences-Dcv9PTqD.js";
 import { r as enqueueUploadPostProcessors } from "./postProcessors-iffHvje4.js";
-import { t as convertHeifToWebpProcessor } from "./convertHeifToWebp-DwSrD30G.js";
+import { t as convertHeifToWebpProcessor } from "./convertHeifToWebp-CIP6qLY7.js";
 import { a as number, c as string, i as literal, n as array, o as object, r as boolean, t as _enum } from "./schemas-LLeSMkcz.js";
 import { GridFSBucket, ObjectId } from "mongodb";
 import { getTenantFilesystemDb, models } from "@rpcbase/db";
@@ -951,4 +951,4 @@ var handler_default = (api) => {
 //#endregion
 export { handler_default as default };
 
-//# sourceMappingURL=handler-Z6wToZhb.js.map
+//# sourceMappingURL=handler-BkGfOJ1l.js.map

package/dist/{handler-Z6wToZhb.js.map → handler-BkGfOJ1l.js.map}

@@ -1 +1 @@
-{"version":3,"file":"handler-Z6wToZhb.js","names":[],"sources":["../src/uploads/api/file-uploads/processors/sanitizeSvg.ts","../src/uploads/api/file-uploads/processors/index.ts","../src/uploads/api/file-uploads/handlers/completeUpload.ts","../src/uploads/api/file-uploads/handlers/getStatus.ts","../src/uploads/api/file-uploads/index.ts","../src/uploads/api/file-uploads/handlers/initUpload.ts","../src/uploads/api/file-uploads/handlers/uploadChunk.ts","../src/uploads/api/file-uploads/middleware/rawBodyParser.ts","../src/uploads/api/file-uploads/handler.ts"],"sourcesContent":["import { JSDOM } from \"jsdom\"\nimport createDOMPurify from \"dompurify\"\n\nimport type { UploadFileProcessor } from \"./index\"\n\n\nconst MAX_SVG_BYTES = 128 * 1024\n\nconst window = new JSDOM(\"\").window\nconst DOMPurify = createDOMPurify(window)\n\nconst normalizeForSniff = (raw: string): string => raw.replace(/^\\uFEFF/, \"\").trimStart()\n\nconst looksLikeSvgText = (text: string): boolean => {\n  const normalized = normalizeForSniff(text)\n  if (!normalized.startsWith(\"<\")) return false\n  return /<svg(?:\\s|>)/i.test(normalized)\n}\n\nexport const looksLikeSvg = (sniff: Buffer): boolean => looksLikeSvgText(sniff.toString(\"utf8\"))\n\nexport const sanitizeSvg = (svg: string): string =>\n  DOMPurify.sanitize(svg, {\n    USE_PROFILES: { svg: true, svgFilters: true },\n  })\n\nexport const sanitizeSvgProcessor: UploadFileProcessor = {\n  id: \"sanitize-svg\",\n  maxBytes: MAX_SVG_BYTES,\n  match: ({ sniff }) => looksLikeSvg(sniff),\n  process: (data): { data: Buffer; mimeType: string } => {\n    if (data.length > MAX_SVG_BYTES) {\n      throw new Error(\"svg_too_large\")\n    }\n\n    const svgText = data.toString(\"utf8\")\n    if (!looksLikeSvgText(svgText)) {\n      throw new Error(\"svg_invalid\")\n    }\n\n    const sanitized = sanitizeSvg(svgText)\n    if (!sanitized.trim() || !looksLikeSvgText(sanitized)) {\n      throw new Error(\"svg_sanitize_failed\")\n    }\n\n    const sanitizedBuffer = Buffer.from(sanitized, \"utf8\")\n    if (sanitizedBuffer.length > MAX_SVG_BYTES) {\n      throw new Error(\"svg_too_large\")\n    }\n\n    return { data: sanitizedBuffer, mimeType: \"image/svg+xml\" }\n  },\n}\n\n","import { convertHeifToWebpProcessor } from \"./convertHeifToWebp\"\nimport { sanitizeSvgProcessor } from \"./sanitizeSvg\"\n\n\nexport type UploadFileProcessorContext = {\n  filename: string\n  clientMimeType: string\n  totalSize: number\n  sniff: Buffer\n}\n\nexport type UploadFileProcessorResult = {\n  data: Buffer\n  filename?: string\n  mimeType?: string\n  metadata?: Record<string, unknown>\n}\n\nexport type UploadFileProcessor = {\n  id: string\n  maxBytes: number\n  match: (ctx: UploadFileProcessorContext) => boolean\n  process: (data: Buffer, ctx: UploadFileProcessorContext) => Promise<UploadFileProcessorResult> | UploadFileProcessorResult\n}\n\nexport const uploadProcessors = Object.freeze([sanitizeSvgProcessor, convertHeifToWebpProcessor] satisfies UploadFileProcessor[])\n\nexport const getMaxUploadProcessorBytes = (): number =>\n  uploadProcessors.reduce((max, processor) => Math.max(max, processor.maxBytes), 0)\n\nexport const selectUploadProcessors = (ctx: UploadFileProcessorContext): UploadFileProcessor[] =>\n  uploadProcessors.filter((processor) => processor.match(ctx))\n\nexport const applyUploadProcessors = async (\n  data: Buffer,\n  ctx: Omit<UploadFileProcessorContext, \"sniff\" | \"totalSize\">,\n): Promise<{ data: Buffer; filename: string; mimeType: string; applied: string[]; metadata: Record<string, unknown> }> => {\n  let currentData = data\n  let currentFilename = ctx.filename\n  let currentMimeType = ctx.clientMimeType\n  const applied: string[] = []\n  const metadata: Record<string, unknown> = {}\n\n  for (const processor of uploadProcessors) {\n    const processorCtx: UploadFileProcessorContext = {\n      filename: currentFilename,\n      clientMimeType: currentMimeType,\n      totalSize: currentData.length,\n      sniff: currentData,\n    }\n\n    if (!processor.match(processorCtx)) continue\n\n    if (currentData.length > processor.maxBytes) {\n      throw new Error(\"processor_input_too_large\")\n    }\n\n    const result = await processor.process(currentData, processorCtx)\n    currentData = result.data\n    if (typeof result.filename === \"string\" && result.filename.trim()) {\n      currentFilename = result.filename.trim()\n    }\n    if (typeof result.mimeType === \"string\" && result.mimeType.trim()) {\n      currentMimeType = result.mimeType.trim()\n    }\n    if (result.metadata && typeof result.metadata === \"object\") {\n      Object.assign(metadata, result.metadata)\n    }\n    applied.push(processor.id)\n  }\n\n  return {\n    data: currentData,\n    filename: currentFilename,\n    mimeType: currentMimeType,\n    applied,\n    metadata,\n  }\n}\n","import { createHash } from \"node:crypto\"\n\nimport { ApiHandler } from \"@rpcbase/api\"\nimport { getTenantFilesystemDb, models } from \"@rpcbase/db\"\nimport { GridFSBucket, ObjectId } from \"mongodb\"\nimport type { Model } from \"mongoose\"\n\nimport * as Uploads from \"../index\"\nimport {\n  claimUploadFileReference,\n  createUploadFileReference,\n} from \"../fileReferences\"\nimport { enqueueUploadPostProcessors } from \"../postProcessors\"\nimport { applyUploadProcessors, getMaxUploadProcessorBytes, selectUploadProcessors } from \"../processors\"\nimport {\n  type SessionUser,\n  type UploadChunkDoc,\n  type UploadSessionDoc,\n  buildUploadAccessMetadata,\n  buildUploadsAbility,\n  ensureFilesystemUploadIndexes,\n  ensureUploadIndexes,\n  getBucketName,\n  getModelCtx,\n  getUploadSessionAccessQuery,\n  getTenantId,\n  resolveUploadAccessScope,\n} from \"../shared\"\n\n\nconst waitForStreamFinished = async (stream: NodeJS.WritableStream): Promise<void> => new Promise((resolve, reject) => {\n  stream.once(\"finish\", resolve)\n  stream.once(\"error\", reject)\n})\n\nconst writeToStream = async (stream: NodeJS.WritableStream, chunk: Buffer): Promise<void> => {\n  const ok = stream.write(chunk)\n  if (ok) return\n  await new Promise<void>((resolve, reject) => {\n    const onDrain = () => {\n      cleanup()\n      resolve()\n    }\n\n    const onError = (error: unknown) => {\n      cleanup()\n      reject(error)\n    }\n\n    const cleanup = () => {\n      stream.off(\"drain\", onDrain)\n      stream.off(\"error\", onError)\n    }\n\n    stream.on(\"drain\", onDrain)\n    stream.on(\"error\", onError)\n  })\n}\n\nconst abortUploadStream = async (stream: unknown): Promise<void> => {\n  if (!stream) return\n  if (typeof (stream as { abort?: unknown }).abort === \"function\") {\n    try {\n      await (stream as { abort: () => Promise<void> | void }).abort()\n      return\n    } catch {\n      //\n    }\n  }\n  try {\n    ;(stream as { destroy?: () => void }).destroy?.()\n  } catch {\n    //\n  }\n}\n\nconst isDuplicateKeyError = (error: unknown): boolean => (\n  error !== null &&\n  typeof error === \"object\" &&\n  \"code\" in error &&\n  (error as { code?: unknown }).code === 11000\n)\n\nexport const completeUpload: ApiHandler<Record<string, never>, Uploads.CompleteResponsePayload, SessionUser> = async (\n  _payload,\n  ctx,\n): Promise<Uploads.CompleteResponsePayload> => {\n  const tenantId = getTenantId(ctx)\n  if (!tenantId) {\n    ctx.res.status(400)\n    return { ok: false, error: \"tenant_missing\" }\n  }\n\n  const uploadId = String(ctx.req.params?.uploadId ?? \"\").trim()\n  if (!uploadId) {\n    ctx.res.status(400)\n    return { ok: false, error: \"invalid_upload_id\" }\n  }\n\n  const ability = buildUploadsAbility(ctx, tenantId)\n  const modelCtx = getModelCtx(ctx, tenantId, ability)\n\n  const [UploadSession, UploadChunk] = await Promise.all([\n    models.get(\"RBUploadSession\", modelCtx) as Promise<Model<UploadSessionDoc>>,\n    models.get(\"RBUploadChunk\", modelCtx) as Promise<Model<UploadChunkDoc>>,\n  ])\n\n  if (!ability.can(\"update\", \"RBUploadSession\")) {\n    ctx.res.status(401)\n    return { ok: false, error: \"unauthorized\" }\n  }\n\n  const existing = await UploadSession.findOne({ $and: [{ _id: uploadId }, getUploadSessionAccessQuery(ability, \"read\")] }).lean()\n  if (!existing) {\n    ctx.res.status(404)\n    return { ok: false, error: \"not_found\" }\n  }\n\n  if (existing.status === \"done\" && existing.fileId) {\n    return {\n      ok: true,\n      fileId: existing.fileId,\n      ...(existing.deduplicated ? { deduplicated: true } : {}),\n    }\n  }\n\n  const locked = await UploadSession.findOneAndUpdate(\n    { $and: [{ _id: uploadId }, { status: \"uploading\" }, getUploadSessionAccessQuery(ability, \"update\")] },\n    { $set: { status: \"assembling\" }, $unset: { error: \"\" } },\n    { returnDocument: \"after\" },\n  ).lean()\n\n  if (!locked) {\n    ctx.res.status(409)\n    return { ok: false, error: \"not_uploading\" }\n  }\n\n  await ensureUploadIndexes(modelCtx)\n\n  const fsDb = await getTenantFilesystemDb(tenantId)\n  const nativeDb = fsDb.db\n  if (!nativeDb) {\n    await UploadSession.updateOne(\n      { $and: [{ _id: uploadId }, getUploadSessionAccessQuery(ability, \"update\")] },\n      { $set: { status: \"error\", error: \"filesystem_db_unavailable\" } },\n    )\n    ctx.res.status(500)\n    return { ok: false, error: \"assembly_failed\" }\n  }\n  const bucketName = getBucketName()\n  const bucket = new GridFSBucket(nativeDb, { bucketName })\n  if (locked.deduplication) {\n    await ensureFilesystemUploadIndexes(nativeDb, bucketName)\n  }\n\n  const lockedUserId = typeof locked.userId === \"string\" ? locked.userId : undefined\n  const accessMetadata = buildUploadAccessMetadata(locked)\n  const unclaimedDeduplication = locked.deduplication\n    ? {\n      deduplication: {\n        namespace: locked.deduplication.namespace,\n        algorithm: locked.deduplication.algorithm,\n        hash: locked.deduplication.hash,\n        pipelineVersion: locked.deduplication.pipelineVersion,\n      },\n    }\n    : {}\n  const createFileMetadata = (\n    storedMimeType: string,\n    storedSize: number,\n    additional: Record<string, unknown> = {},\n  ): Record<string, unknown> => ({\n    uploadId,\n    tenantId,\n    mimeType: storedMimeType,\n    totalSize: storedSize,\n    ...additional,\n    ...accessMetadata,\n    ...unclaimedDeduplication,\n  })\n  const maxProcessorBytes = getMaxUploadProcessorBytes()\n  const shouldBufferForProcessing = locked.totalSize <= maxProcessorBytes\n  const declaredMimeType = locked.mimeType.trim().toLowerCase()\n  const declaredSvg = declaredMimeType === \"image/svg+xml\" || locked.filename.trim().toLowerCase().endsWith(\".svg\")\n\n  let uploadStream: NodeJS.WritableStream | null = null\n  let finalFilename = locked.filename\n  let finalMimeType = locked.mimeType\n  let finalSize = locked.totalSize\n  let inlineProcessors: string[] = []\n  let finalMetadata = createFileMetadata(locked.mimeType, locked.totalSize)\n\n  try {\n    if (!shouldBufferForProcessing && declaredSvg) {\n      throw new Error(\"svg_too_large\")\n    }\n\n    const cursor = UploadChunk.find({ uploadId }).sort({ index: 1 }).cursor() as unknown as AsyncIterable<UploadChunkDoc> & {\n      close: () => Promise<void>\n    }\n\n    let expectedIndex = 0\n    let sourceBytes = 0\n    const sourceHasher = locked.deduplication ? createHash(\"sha256\") : null\n    const chunks: Buffer[] = []\n    let bufferedBytes = 0\n\n    const pendingChunks: Buffer[] = []\n    const sniffParts: Buffer[] = []\n    let sniffBytes = 0\n\n    try {\n      for await (const chunkDoc of cursor) {\n        if (chunkDoc.index !== expectedIndex) {\n          throw new Error(\"missing_chunks\")\n        }\n\n        const chunk = chunkDoc.data\n        sourceBytes += chunk.length\n        sourceHasher?.update(chunk)\n\n        if (shouldBufferForProcessing) {\n          chunks.push(chunk)\n          bufferedBytes += chunk.length\n        } else if (!uploadStream) {\n          pendingChunks.push(chunk)\n\n          if (sniffBytes < maxProcessorBytes) {\n            const slice = chunk.subarray(0, Math.min(chunk.length, maxProcessorBytes - sniffBytes))\n            if (slice.length) {\n              sniffParts.push(slice)\n              sniffBytes += slice.length\n            }\n          }\n\n          if (sniffBytes >= maxProcessorBytes) {\n            const sniff = Buffer.concat(sniffParts, sniffBytes)\n            const processors = selectUploadProcessors({\n              filename: locked.filename,\n              clientMimeType: locked.mimeType,\n              totalSize: locked.totalSize,\n              sniff,\n            })\n\n            if (processors.length) {\n              throw new Error(processors.some((processor) => processor.id === \"sanitize-svg\") ? \"svg_too_large\" : \"processor_input_too_large\")\n            }\n\n            finalMetadata = createFileMetadata(locked.mimeType, locked.totalSize)\n            uploadStream = bucket.openUploadStream(locked.filename, {\n              metadata: finalMetadata,\n            })\n\n            for (const pending of pendingChunks) {\n              await writeToStream(uploadStream, pending)\n            }\n            pendingChunks.length = 0\n          }\n        } else {\n          await writeToStream(uploadStream, chunk)\n        }\n\n        expectedIndex += 1\n      }\n    } finally {\n      try {\n        await cursor.close()\n      } catch {\n        //\n      }\n    }\n\n    if (expectedIndex !== locked.chunksTotal) {\n      throw new Error(\"missing_chunks\")\n    }\n\n    if (sourceBytes !== locked.totalSize) {\n      throw new Error(\"invalid_source_size\")\n    }\n\n    if (sourceHasher && sourceHasher.digest(\"hex\") !== locked.deduplication?.hash) {\n      throw new Error(\"content_hash_mismatch\")\n    }\n\n    if (shouldBufferForProcessing) {\n      const assembled = Buffer.concat(chunks, bufferedBytes)\n      const {\n        data: processed,\n        filename: processedFilename,\n        mimeType: processedMimeType,\n        applied,\n        metadata: processedMetadata,\n      } = await applyUploadProcessors(assembled, {\n        filename: locked.filename,\n        clientMimeType: locked.mimeType,\n      })\n\n      finalFilename = processedFilename\n      finalMimeType = processedMimeType\n      finalSize = processed.length\n      inlineProcessors = applied\n      finalMetadata = createFileMetadata(processedMimeType, processed.length, {\n        ...(applied.length ? { processors: applied, sourceTotalSize: locked.totalSize } : {}),\n        ...processedMetadata,\n      })\n      uploadStream = bucket.openUploadStream(finalFilename, {\n        metadata: finalMetadata,\n      })\n\n      const finished = waitForStreamFinished(uploadStream)\n      uploadStream.end(processed)\n      await finished\n    } else {\n      if (!uploadStream) {\n        const sniff = Buffer.concat(sniffParts, sniffBytes)\n        const processors = selectUploadProcessors({\n          filename: locked.filename,\n          clientMimeType: locked.mimeType,\n          totalSize: locked.totalSize,\n          sniff,\n        })\n\n        if (processors.length) {\n          throw new Error(processors.some((processor) => processor.id === \"sanitize-svg\") ? \"svg_too_large\" : \"processor_input_too_large\")\n        }\n\n        finalMetadata = createFileMetadata(locked.mimeType, locked.totalSize)\n        uploadStream = bucket.openUploadStream(locked.filename, {\n          metadata: finalMetadata,\n        })\n\n        for (const pending of pendingChunks) {\n          await writeToStream(uploadStream, pending)\n        }\n        pendingChunks.length = 0\n      }\n\n      const finished = waitForStreamFinished(uploadStream)\n      uploadStream.end()\n      await finished\n    }\n\n    const uploadedBlobId = String((uploadStream as unknown as { id?: unknown }).id ?? \"\")\n    if (!uploadedBlobId) {\n      throw new Error(\"missing_file_id\")\n    }\n\n    let resolvedBlobId = uploadedBlobId\n    let deduplicated = false\n    let returnedFileId: string | null = locked.deduplication ? null : uploadedBlobId\n\n    if (locked.deduplication) {\n      const filesCollection = nativeDb.collection(`${bucketName}.files`)\n      const uploadedBlobObjectId = new ObjectId(uploadedBlobId)\n      const referenceOptions = {\n        tenantId,\n        bucketName,\n        filename: finalFilename,\n        mimeType: finalMimeType,\n        totalSize: finalSize,\n        accessScope: resolveUploadAccessScope({\n          accessScope: locked.accessScope,\n          isPublic: locked.isPublic,\n        }),\n        ...(lockedUserId ? { userId: lockedUserId } : {}),\n        ...(typeof locked.ownerKeyHash === \"string\" ? { ownerKeyHash: locked.ownerKeyHash } : {}),\n      }\n      let lastDuplicateKeyError: unknown = null\n\n      for (let attempt = 0; attempt < 3 && !returnedFileId; attempt += 1) {\n        try {\n          returnedFileId = await claimUploadFileReference({\n            ...referenceOptions,\n            blobId: uploadedBlobObjectId,\n            deduplication: locked.deduplication,\n          })\n          if (!returnedFileId) throw new Error(\"missing_file_id\")\n          finalMetadata = {\n            ...finalMetadata,\n            deduplication: locked.deduplication,\n          }\n          break\n        } catch (error) {\n          if (!isDuplicateKeyError(error)) throw error\n          lastDuplicateKeyError = error\n        }\n\n        const canonicalFile = await filesCollection.findOne(\n          { \"metadata.deduplication.key\": locked.deduplication.key },\n          { projection: { _id: 1 } },\n        )\n        if (!(canonicalFile?._id instanceof ObjectId)) continue\n\n        const canonicalReferenceId = await createUploadFileReference({\n          ...referenceOptions,\n          blobId: canonicalFile._id,\n          deduplicationKey: locked.deduplication.key,\n        })\n        if (!canonicalReferenceId) continue\n\n        await bucket.delete(uploadedBlobObjectId)\n        resolvedBlobId = canonicalFile._id.toHexString()\n        returnedFileId = canonicalReferenceId\n        deduplicated = true\n      }\n\n      if (!returnedFileId) {\n        await bucket.delete(uploadedBlobObjectId)\n        if (lastDuplicateKeyError) throw lastDuplicateKeyError\n      }\n    }\n    if (!returnedFileId) {\n      throw new Error(\"canonical_file_missing\")\n    }\n\n    await UploadSession.updateOne(\n      { $and: [{ _id: uploadId }, getUploadSessionAccessQuery(ability, \"update\")] },\n      {\n        $set: {\n          status: \"done\",\n          fileId: returnedFileId,\n          filename: finalFilename,\n          mimeType: finalMimeType,\n          totalSize: finalSize,\n          ...(deduplicated ? { deduplicated: true } : {}),\n        },\n        $unset: { error: \"\" },\n      },\n    )\n\n    if (!deduplicated) {\n      await enqueueUploadPostProcessors({\n        tenantId,\n        uploadId,\n        fileId: resolvedBlobId,\n        filename: finalFilename,\n        mimeType: finalMimeType,\n        clientMimeType: locked.mimeType,\n        totalSize: finalSize,\n        ...(typeof locked.isPublic === \"boolean\" ? { isPublic: locked.isPublic } : {}),\n        ...(locked.accessScope ? { accessScope: locked.accessScope } : {}),\n        ...(typeof locked.ownerKeyHash === \"string\" ? { ownerKeyHash: locked.ownerKeyHash } : {}),\n        ...(lockedUserId ? { userId: lockedUserId } : {}),\n        inlineProcessors,\n        metadata: finalMetadata,\n      }).catch((error) => {\n        console.error(\"Upload post processor enqueue failed\", {\n          tenantId,\n          uploadId,\n          fileId: resolvedBlobId,\n          error,\n        })\n      })\n    }\n\n    try {\n      await UploadChunk.deleteMany({ uploadId })\n    } catch {\n      //\n    }\n\n    return {\n      ok: true,\n      fileId: returnedFileId,\n      ...(deduplicated ? { deduplicated: true } : {}),\n    }\n  } catch (error) {\n    const message = error instanceof Error ? error.message : String(error)\n\n    await abortUploadStream(uploadStream)\n\n    if (message === \"missing_chunks\") {\n      await UploadSession.updateOne(\n        { $and: [{ _id: uploadId }, getUploadSessionAccessQuery(ability, \"update\")] },\n        { $set: { status: \"uploading\" } },\n      )\n      ctx.res.status(409)\n      return { ok: false, error: \"missing_chunks\" }\n    }\n\n    if (message === \"content_hash_mismatch\") {\n      await UploadSession.updateOne(\n        { $and: [{ _id: uploadId }, getUploadSessionAccessQuery(ability, \"update\")] },\n        { $set: { status: \"error\", error: message } },\n      )\n      ctx.res.status(400)\n      return { ok: false, error: message }\n    }\n\n    if (message === \"svg_too_large\") {\n      await UploadSession.updateOne(\n        { $and: [{ _id: uploadId }, getUploadSessionAccessQuery(ability, \"update\")] },\n        { $set: { status: \"error\", error: message } },\n      )\n      ctx.res.status(413)\n      return { ok: false, error: message }\n    }\n\n    if (message === \"heif_too_large\" || message === \"processor_input_too_large\") {\n      await UploadSession.updateOne(\n        { $and: [{ _id: uploadId }, getUploadSessionAccessQuery(ability, \"update\")] },\n        { $set: { status: \"error\", error: message } },\n      )\n      ctx.res.status(413)\n      return { ok: false, error: message }\n    }\n\n    if (message.startsWith(\"heif_decode_unsupported\")) {\n      await UploadSession.updateOne(\n        { $and: [{ _id: uploadId }, getUploadSessionAccessQuery(ability, \"update\")] },\n        { $set: { status: \"error\", error: message } },\n      )\n      ctx.res.status(415)\n      return { ok: false, error: message }\n    }\n\n    if (message === \"svg_invalid\" || message === \"svg_sanitize_failed\") {\n      await UploadSession.updateOne(\n        { $and: [{ _id: uploadId }, getUploadSessionAccessQuery(ability, \"update\")] },\n        { $set: { status: \"error\", error: message } },\n      )\n      ctx.res.status(400)\n      return { ok: false, error: message }\n    }\n\n    await UploadSession.updateOne(\n      { $and: [{ _id: uploadId }, getUploadSessionAccessQuery(ability, \"update\")] },\n      { $set: { status: \"error\", error: message } },\n    )\n\n    ctx.res.status(500)\n    return { ok: false, error: \"assembly_failed\" }\n  }\n}\n","import { ApiHandler } from \"@rpcbase/api\"\nimport { models } from \"@rpcbase/db\"\nimport type { Model } from \"mongoose\"\n\nimport * as Uploads from \"../index\"\nimport {\n  type SessionUser,\n  type UploadChunkDoc,\n  type UploadSessionDoc,\n  buildUploadsAbility,\n  getModelCtx,\n  getUploadSessionAccessQuery,\n  getTenantId,\n} from \"../shared\"\n\n\nexport const getStatus: ApiHandler<Record<string, never>, Uploads.StatusResponsePayload, SessionUser> = async (\n  _payload,\n  ctx,\n): Promise<Uploads.StatusResponsePayload> => {\n  const tenantId = getTenantId(ctx)\n  if (!tenantId) {\n    ctx.res.status(400)\n    return { ok: false, error: \"tenant_missing\" }\n  }\n\n  const uploadId = String(ctx.req.params?.uploadId ?? \"\").trim()\n  if (!uploadId) {\n    ctx.res.status(400)\n    return { ok: false, error: \"invalid_upload_id\" }\n  }\n\n  const ability = buildUploadsAbility(ctx, tenantId)\n  const modelCtx = getModelCtx(ctx, tenantId, ability)\n\n  const [UploadSession, UploadChunk] = await Promise.all([\n    models.get(\"RBUploadSession\", modelCtx) as Promise<Model<UploadSessionDoc>>,\n    models.get(\"RBUploadChunk\", modelCtx) as Promise<Model<UploadChunkDoc>>,\n  ])\n\n  if (!ability.can(\"read\", \"RBUploadSession\")) {\n    ctx.res.status(401)\n    return { ok: false, error: \"unauthorized\" }\n  }\n\n  const session = await UploadSession.findOne({ $and: [{ _id: uploadId }, getUploadSessionAccessQuery(ability, \"read\")] }).lean()\n  if (!session) {\n    ctx.res.status(404)\n    return { ok: false, error: \"not_found\" }\n  }\n\n  const receivedDocs = await UploadChunk.find(\n    { uploadId },\n    { index: 1, _id: 0 },\n  ).sort({ index: 1 }).lean()\n\n  const received = (receivedDocs as unknown as Array<{ index?: unknown }>)\n    .map((doc) => (typeof doc.index === \"number\" ? doc.index : -1))\n    .filter((n) => Number.isInteger(n) && n >= 0)\n\n  return {\n    ok: true,\n    status: session.status,\n    chunkSize: session.chunkSize,\n    chunksTotal: session.chunksTotal,\n    received,\n    ...(session.fileId ? { fileId: session.fileId } : {}),\n  }\n}\n","import { z } from \"zod\"\n\n\nexport const InitRoute = \"/api/rb/file-uploads\"\nexport const ChunkRoute = \"/api/rb/file-uploads/:uploadId/chunks/:index\"\nexport const StatusRoute = \"/api/rb/file-uploads/:uploadId/status\"\nexport const CompleteRoute = \"/api/rb/file-uploads/:uploadId/complete\"\n\nexport const uploadAccessScopeSchema = z.enum([\"owner\", \"tenant\", \"public\"])\n\nexport const uploadDeduplicationSchema = z.object({\n  namespace: z.string().trim().min(1).max(128).regex(/^[a-z0-9][a-z0-9._:-]*$/i),\n  algorithm: z.literal(\"sha256\"),\n  hash: z.string().trim().regex(/^[a-f0-9]{64}$/i),\n})\n\nexport const initRequestSchema = z.object({\n  filename: z.string().min(1),\n  mimeType: z.string().min(1),\n  isPublic: z.boolean().optional(),\n  accessScope: uploadAccessScopeSchema.optional(),\n  deduplication: uploadDeduplicationSchema.optional(),\n  totalSize: z.number().int().min(1),\n}).superRefine((value, ctx) => {\n  if (value.accessScope !== undefined && value.isPublic !== undefined) {\n    ctx.addIssue({\n      code: \"custom\",\n      message: \"accessScope and isPublic are mutually exclusive\",\n      path: [\"accessScope\"],\n    })\n  }\n})\n\nexport type InitRequestPayload = z.infer<typeof initRequestSchema>\n\nexport const initResponseSchema = z.object({\n  ok: z.boolean(),\n  error: z.string().optional(),\n  uploadId: z.string().optional(),\n  uploadKey: z.string().optional(),\n  chunkSize: z.number().int().optional(),\n  chunksTotal: z.number().int().optional(),\n  fileId: z.string().optional(),\n  deduplicated: z.boolean().optional(),\n})\n\nexport type InitResponsePayload = z.infer<typeof initResponseSchema>\n\nexport const statusResponseSchema = z.object({\n  ok: z.boolean(),\n  error: z.string().optional(),\n  status: z.enum([\"uploading\", \"assembling\", \"done\", \"error\"]).optional(),\n  chunkSize: z.number().int().optional(),\n  chunksTotal: z.number().int().optional(),\n  received: z.array(z.number().int().min(0)).optional(),\n  fileId: z.string().optional(),\n})\n\nexport type StatusResponsePayload = z.infer<typeof statusResponseSchema>\n\nexport const completeResponseSchema = z.object({\n  ok: z.boolean(),\n  error: z.string().optional(),\n  fileId: z.string().optional(),\n  deduplicated: z.boolean().optional(),\n})\n\nexport type CompleteResponsePayload = z.infer<typeof completeResponseSchema>\n","import { randomBytes } from \"node:crypto\"\n\nimport { ApiHandler } from \"@rpcbase/api\"\nimport { getTenantFilesystemDb, models } from \"@rpcbase/db\"\nimport { ObjectId } from \"mongodb\"\nimport type { Model } from \"mongoose\"\n\nimport * as Uploads from \"../index\"\nimport { createUploadFileReference } from \"../fileReferences\"\nimport {\n  type SessionUser,\n  type UploadSessionDoc,\n  buildUploadDeduplication,\n  buildUploadsAbility,\n  computeSha256Hex,\n  ensureFilesystemUploadIndexes,\n  ensureUploadIndexes,\n  getBucketName,\n  getChunkSizeBytes,\n  getModelCtx,\n  getSessionTtlMs,\n  getTenantId,\n  getUserId,\n  resolveUploadAccessScope,\n} from \"../shared\"\n\n\nexport const initUpload: ApiHandler<Uploads.InitRequestPayload, Uploads.InitResponsePayload, SessionUser> = async (\n  payload,\n  ctx,\n): Promise<Uploads.InitResponsePayload> => {\n  const tenantId = getTenantId(ctx)\n  if (!tenantId) {\n    ctx.res.status(400)\n    return { ok: false, error: \"tenant_missing\" }\n  }\n\n  const userId = getUserId(ctx)\n\n  const parsed = Uploads.initRequestSchema.safeParse(payload ?? {})\n  if (!parsed.success) {\n    ctx.res.status(400)\n    return { ok: false, error: \"invalid_payload\" }\n  }\n\n  const { filename, mimeType, totalSize, isPublic, deduplication: requestedDeduplication } = parsed.data\n  const accessScope = resolveUploadAccessScope({ accessScope: parsed.data.accessScope, isPublic })\n  if (accessScope === \"tenant\" && !userId) {\n    ctx.res.status(401)\n    return { ok: false, error: \"authentication_required\" }\n  }\n\n  const uploadKey = userId ? null : randomBytes(32).toString(\"base64url\")\n  const ownerKeyHash = uploadKey ? computeSha256Hex(Buffer.from(uploadKey)) : undefined\n  const deduplication = requestedDeduplication\n    ? buildUploadDeduplication({\n      namespace: requestedDeduplication.namespace,\n      hash: requestedDeduplication.hash,\n      filename,\n      mimeType,\n      totalSize,\n      accessScope,\n      ...(userId ? { userId } : {}),\n      ...(ownerKeyHash ? { ownerKeyHash } : {}),\n    })\n    : null\n\n  if (requestedDeduplication && !deduplication) {\n    ctx.res.status(400)\n    return { ok: false, error: \"deduplication_unavailable\" }\n  }\n\n  if (deduplication) {\n    const fsDb = await getTenantFilesystemDb(tenantId)\n    const nativeDb = fsDb.db\n    if (!nativeDb) {\n      ctx.res.status(500)\n      return { ok: false, error: \"filesystem_db_unavailable\" }\n    }\n\n    const bucketName = getBucketName()\n    await ensureFilesystemUploadIndexes(nativeDb, bucketName)\n    const existingFile = await nativeDb.collection(`${bucketName}.files`).findOne(\n      { \"metadata.deduplication.key\": deduplication.key },\n      { projection: { _id: 1, filename: 1, length: 1, metadata: 1 } },\n    )\n    if (existingFile?._id instanceof ObjectId) {\n      const existingMetadata = existingFile.metadata && typeof existingFile.metadata === \"object\"\n        ? existingFile.metadata as Record<string, unknown>\n        : {}\n      const existingMimeType = typeof existingMetadata.mimeType === \"string\"\n        ? existingMetadata.mimeType\n        : mimeType\n      const existingSize = typeof existingFile.length === \"number\"\n        ? existingFile.length\n        : totalSize\n      const fileId = await createUploadFileReference({\n        tenantId,\n        bucketName,\n        blobId: existingFile._id,\n        filename,\n        mimeType: existingMimeType,\n        totalSize: existingSize,\n        accessScope,\n        ...(userId ? { userId } : {}),\n        ...(ownerKeyHash ? { ownerKeyHash } : {}),\n        deduplicationKey: deduplication.key,\n      })\n      if (fileId) {\n        return {\n          ok: true,\n          fileId,\n          deduplicated: true,\n          ...(uploadKey ? { uploadKey } : {}),\n        }\n      }\n    }\n  }\n\n  const chunkSize = getChunkSizeBytes()\n  const chunksTotal = Math.ceil(totalSize / chunkSize)\n\n  const ability = buildUploadsAbility(ctx, tenantId)\n  const modelCtx = getModelCtx(ctx, tenantId, ability)\n\n  const UploadSession = await models.get(\n    \"RBUploadSession\",\n    modelCtx,\n  ) as Model<UploadSessionDoc>\n\n  await ensureUploadIndexes(modelCtx)\n\n  const uploadId = new ObjectId().toString()\n  const now = Date.now()\n  const expiresAt = new Date(now + getSessionTtlMs())\n\n  await UploadSession.create({\n    _id: uploadId,\n    ...(userId ? { userId } : {}),\n    ...(ownerKeyHash ? { ownerKeyHash } : {}),\n    filename,\n    mimeType,\n    isPublic: accessScope === \"public\",\n    accessScope,\n    ...(deduplication ? { deduplication } : {}),\n    totalSize,\n    chunkSize,\n    chunksTotal,\n    status: \"uploading\",\n    createdAt: new Date(now),\n    expiresAt,\n  })\n\n  return {\n    ok: true,\n    uploadId,\n    chunkSize,\n    chunksTotal,\n    ...(uploadKey ? { uploadKey } : {}),\n  }\n}\n","import { ApiHandler } from \"@rpcbase/api\"\nimport { models } from \"@rpcbase/db\"\nimport type { Model } from \"mongoose\"\n\nimport {\n  type SessionUser,\n  type UploadChunkDoc,\n  type UploadSessionDoc,\n  buildUploadsAbility,\n  computeSha256Hex,\n  ensureUploadIndexes,\n  getModelCtx,\n  getUploadSessionAccessQuery,\n  getTenantId,\n  normalizeSha256Hex,\n  toBufferPayload,\n} from \"../shared\"\n\n\ntype ChunkResponsePayload = {\n  ok: boolean\n  error?: string\n}\n\nexport const uploadChunk: ApiHandler<Buffer, ChunkResponsePayload, SessionUser> = async (\n  payload,\n  ctx,\n): Promise<ChunkResponsePayload> => {\n  const tenantId = getTenantId(ctx)\n  if (!tenantId) {\n    ctx.res.status(400)\n    return { ok: false, error: \"tenant_missing\" }\n  }\n\n  const uploadId = String(ctx.req.params?.uploadId ?? \"\").trim()\n  const indexRaw = String(ctx.req.params?.index ?? \"\").trim()\n  const index = Number(indexRaw)\n\n  if (!uploadId || !Number.isInteger(index) || index < 0) {\n    ctx.res.status(400)\n    return { ok: false, error: \"invalid_chunk_ref\" }\n  }\n\n  const ability = buildUploadsAbility(ctx, tenantId)\n  const modelCtx = getModelCtx(ctx, tenantId, ability)\n\n  const [UploadSession, UploadChunk] = await Promise.all([\n    models.get(\"RBUploadSession\", modelCtx) as Promise<Model<UploadSessionDoc>>,\n    models.get(\"RBUploadChunk\", modelCtx) as Promise<Model<UploadChunkDoc>>,\n  ])\n\n  if (!ability.can(\"update\", \"RBUploadSession\")) {\n    ctx.res.status(401)\n    return { ok: false, error: \"unauthorized\" }\n  }\n\n  const session = await UploadSession.findOne({ $and: [{ _id: uploadId }, getUploadSessionAccessQuery(ability, \"update\")] }).lean()\n  if (!session) {\n    ctx.res.status(404)\n    return { ok: false, error: \"not_found\" }\n  }\n\n  if (session.status !== \"uploading\") {\n    ctx.res.status(409)\n    return { ok: false, error: \"not_uploading\" }\n  }\n\n  if (index >= session.chunksTotal) {\n    ctx.res.status(400)\n    return { ok: false, error: \"index_out_of_range\" }\n  }\n\n  const data = toBufferPayload(payload)\n  if (!data) {\n    ctx.res.status(400)\n    return { ok: false, error: \"invalid_body\" }\n  }\n\n  const expectedSize = index === session.chunksTotal - 1\n    ? session.totalSize - session.chunkSize * (session.chunksTotal - 1)\n    : session.chunkSize\n\n  if (data.length > expectedSize) {\n    ctx.res.status(413)\n    return { ok: false, error: \"chunk_too_large\" }\n  }\n\n  if (data.length !== expectedSize) {\n    ctx.res.status(400)\n    return { ok: false, error: \"invalid_chunk_size\" }\n  }\n\n  const checksumHeader = ctx.req.get(\"X-Chunk-SHA256\")\n  const sha256 = checksumHeader ? computeSha256Hex(data) : undefined\n\n  if (checksumHeader) {\n    const expectedSha256 = normalizeSha256Hex(checksumHeader)\n    if (sha256 !== expectedSha256) {\n      ctx.res.status(400)\n      return { ok: false, error: \"checksum_mismatch\" }\n    }\n  }\n\n  await ensureUploadIndexes(modelCtx)\n\n  await UploadChunk.updateOne(\n    { uploadId, index },\n    {\n      $set: {\n        uploadId,\n        index,\n        data,\n        size: data.length,\n        sha256,\n        expiresAt: session.expiresAt,\n      },\n      $setOnInsert: {\n        createdAt: new Date(),\n      },\n    },\n    { upsert: true },\n  )\n\n  ctx.res.status(204)\n  return { ok: true }\n}\n","export const rawBodyParser = ({\n  limitBytes,\n  maxClientBytesPerSecond,\n}: {\n  limitBytes: number\n  maxClientBytesPerSecond?: number | null\n}) => {\n  return (req: any, res: any, next: any) => {\n    const contentType = typeof req?.headers?.[\"content-type\"] === \"string\"\n      ? String(req.headers[\"content-type\"])\n      : \"\"\n\n    if (!contentType.includes(\"application/octet-stream\")) {\n      next()\n      return\n    }\n\n    let total = 0\n    const chunks: Buffer[] = []\n    let done = false\n    let paused = false\n    let throttleTimeout: ReturnType<typeof setTimeout> | null = null\n\n    const rateBytesPerSecond = typeof maxClientBytesPerSecond === \"number\" && maxClientBytesPerSecond > 0\n      ? maxClientBytesPerSecond\n      : null\n\n    const cleanup = () => {\n      req.off(\"data\", onData)\n      req.off(\"end\", onEnd)\n      req.off(\"error\", onError)\n      req.off(\"aborted\", onAborted)\n      if (throttleTimeout) {\n        clearTimeout(throttleTimeout)\n        throttleTimeout = null\n      }\n    }\n\n    const finish = (error?: unknown) => {\n      if (done) return\n      done = true\n\n      cleanup()\n\n      if (error) {\n        next(error)\n        return\n      }\n\n      req.body = Buffer.concat(chunks, total)\n      next()\n    }\n\n    const onData = (chunk: any) => {\n      if (done) return\n      const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk)\n      total += buffer.length\n\n      if (total > limitBytes) {\n        done = true\n        cleanup()\n        req.destroy()\n        res.status(413).json({ ok: false, error: \"chunk_too_large\" })\n        return\n      }\n\n      chunks.push(buffer)\n\n      if (!rateBytesPerSecond) return\n\n      const now = Date.now()\n      const clientKey = getClientKey(req)\n      const state = getClientRateState(clientKey, rateBytesPerSecond, now)\n      const waitMs = consumeRateBudget(state, buffer.length, rateBytesPerSecond, now)\n\n      if (waitMs > 0 && !paused) {\n        paused = true\n        req.pause()\n        throttleTimeout = setTimeout(() => {\n          throttleTimeout = null\n          paused = false\n          if (done) return\n          try {\n            req.resume()\n          } catch {\n            //\n          }\n        }, waitMs)\n      }\n    }\n\n    const onEnd = () => finish()\n    const onError = (err: unknown) => finish(err)\n    const onAborted = () => finish(new Error(\"request_aborted\"))\n\n    req.on(\"data\", onData)\n    req.on(\"end\", onEnd)\n    req.on(\"error\", onError)\n    req.on(\"aborted\", onAborted)\n  }\n}\n\ntype ClientRateState = {\n  tokens: number\n  lastRefillMs: number\n  lastSeenMs: number\n}\n\nconst MAX_BURST_SECONDS = 1\nconst STALE_CLIENT_MS = 15 * 60 * 1000\n\nconst clientRateStates = new Map<string, ClientRateState>()\nlet lastCleanupMs = 0\n\nconst getClientKey = (req: any): string => {\n  const rawClientIp = typeof req?.clientIp === \"string\" ? req.clientIp : \"\"\n  if (rawClientIp.trim()) return rawClientIp.trim()\n  const rawIp = typeof req?.ip === \"string\" ? req.ip : \"\"\n  return rawIp.trim() || \"unknown\"\n}\n\nconst maybeCleanupStates = (now: number) => {\n  if (now - lastCleanupMs < 60_000) return\n  lastCleanupMs = now\n\n  if (clientRateStates.size < 2000) return\n\n  for (const [key, state] of clientRateStates) {\n    if (now - state.lastSeenMs > STALE_CLIENT_MS) {\n      clientRateStates.delete(key)\n    }\n  }\n}\n\nconst getClientRateState = (key: string, rateBytesPerSecond: number, now: number): ClientRateState => {\n  maybeCleanupStates(now)\n\n  const capacity = rateBytesPerSecond * MAX_BURST_SECONDS\n  const existing = clientRateStates.get(key)\n  if (existing) {\n    existing.lastSeenMs = now\n    existing.tokens = Math.min(capacity, existing.tokens)\n    return existing\n  }\n\n  const next: ClientRateState = {\n    tokens: capacity,\n    lastRefillMs: now,\n    lastSeenMs: now,\n  }\n  clientRateStates.set(key, next)\n  return next\n}\n\nconst consumeRateBudget = (\n  state: ClientRateState,\n  bytes: number,\n  rateBytesPerSecond: number,\n  now: number,\n): number => {\n  const capacity = rateBytesPerSecond * MAX_BURST_SECONDS\n  const elapsedMs = Math.max(0, now - state.lastRefillMs)\n\n  if (elapsedMs > 0) {\n    state.tokens = Math.min(capacity, state.tokens + (elapsedMs * rateBytesPerSecond) / 1000)\n    state.lastRefillMs = now\n  }\n\n  state.tokens -= bytes\n\n  if (state.tokens >= 0) return 0\n  return Math.ceil((-state.tokens / rateBytesPerSecond) * 1000)\n}\n","import { Api } from \"@rpcbase/api\"\n\nimport { completeUpload } from \"./handlers/completeUpload\"\nimport { getStatus } from \"./handlers/getStatus\"\nimport { initUpload } from \"./handlers/initUpload\"\nimport { uploadChunk } from \"./handlers/uploadChunk\"\nimport { rawBodyParser } from \"./middleware/rawBodyParser\"\nimport { getChunkSizeBytes, getMaxClientUploadBytesPerSecond, getRawBodyLimitBytes, type SessionUser } from \"./shared\"\n\nimport * as Uploads from \"./index\"\n\n\nexport default (api: Api<SessionUser>) => {\n  const chunkSizeBytes = getChunkSizeBytes()\n  api.use(\n    Uploads.InitRoute,\n    rawBodyParser({\n      limitBytes: getRawBodyLimitBytes(chunkSizeBytes),\n      maxClientBytesPerSecond: getMaxClientUploadBytesPerSecond(),\n    }),\n  )\n\n  api.post(Uploads.InitRoute, initUpload)\n  api.put(Uploads.ChunkRoute, uploadChunk)\n  api.get(Uploads.StatusRoute, getStatus)\n  api.post(Uploads.CompleteRoute, completeUpload)\n}\n"],"mappings":";;;;;;;;;;;AAMA,IAAM,gBAAgB;AAEtB,IAAM,SAAS,IAAI,MAAM,EAAE,CAAC,CAAC;AAC7B,IAAM,YAAY,gBAAgB,MAAM;AAExC,IAAM,qBAAqB,QAAwB,IAAI,QAAQ,WAAW,EAAE,CAAC,CAAC,UAAU;AAExF,IAAM,oBAAoB,SAA0B;CAClD,MAAM,aAAa,kBAAkB,IAAI;CACzC,IAAI,CAAC,WAAW,WAAW,GAAG,GAAG,OAAO;CACxC,OAAO,gBAAgB,KAAK,UAAU;AACxC;AAEA,IAAa,gBAAgB,UAA2B,iBAAiB,MAAM,SAAS,MAAM,CAAC;AAE/F,IAAa,eAAe,QAC1B,UAAU,SAAS,KAAK,EACtB,cAAc;CAAE,KAAK;CAAM,YAAY;AAAK,EAC9C,CAAC;;;ACCH,IAAa,mBAAmB,OAAO,OAAO,CAAC;CDE7C,IAAI;CACJ,UAAU;CACV,QAAQ,EAAE,YAAY,aAAa,KAAK;CACxC,UAAU,SAA6C;EACrD,IAAI,KAAK,SAAS,eAChB,MAAM,IAAI,MAAM,eAAe;EAGjC,MAAM,UAAU,KAAK,SAAS,MAAM;EACpC,IAAI,CAAC,iBAAiB,OAAO,GAC3B,MAAM,IAAI,MAAM,aAAa;EAG/B,MAAM,YAAY,YAAY,OAAO;EACrC,IAAI,CAAC,UAAU,KAAK,KAAK,CAAC,iBAAiB,SAAS,GAClD,MAAM,IAAI,MAAM,qBAAqB;EAGvC,MAAM,kBAAkB,OAAO,KAAK,WAAW,MAAM;EACrD,IAAI,gBAAgB,SAAS,eAC3B,MAAM,IAAI,MAAM,eAAe;EAGjC,OAAO;GAAE,MAAM;GAAiB,UAAU;EAAgB;CAC5D;AC1B6C,GAAsB,0BAA0B,CAAiC;AAEhI,IAAa,mCACX,iBAAiB,QAAQ,KAAK,cAAc,KAAK,IAAI,KAAK,UAAU,QAAQ,GAAG,CAAC;AAElF,IAAa,0BAA0B,QACrC,iBAAiB,QAAQ,cAAc,UAAU,MAAM,GAAG,CAAC;AAE7D,IAAa,wBAAwB,OACnC,MACA,QACwH;CACxH,IAAI,cAAc;CAClB,IAAI,kBAAkB,IAAI;CAC1B,IAAI,kBAAkB,IAAI;CAC1B,MAAM,UAAoB,CAAC;CAC3B,MAAM,WAAoC,CAAC;CAE3C,KAAK,MAAM,aAAa,kBAAkB;EACxC,MAAM,eAA2C;GAC/C,UAAU;GACV,gBAAgB;GAChB,WAAW,YAAY;GACvB,OAAO;EACT;EAEA,IAAI,CAAC,UAAU,MAAM,YAAY,GAAG;EAEpC,IAAI,YAAY,SAAS,UAAU,UACjC,MAAM,IAAI,MAAM,2BAA2B;EAG7C,MAAM,SAAS,MAAM,UAAU,QAAQ,aAAa,YAAY;EAChE,cAAc,OAAO;EACrB,IAAI,OAAO,OAAO,aAAa,YAAY,OAAO,SAAS,KAAK,GAC9D,kBAAkB,OAAO,SAAS,KAAK;EAEzC,IAAI,OAAO,OAAO,aAAa,YAAY,OAAO,SAAS,KAAK,GAC9D,kBAAkB,OAAO,SAAS,KAAK;EAEzC,IAAI,OAAO,YAAY,OAAO,OAAO,aAAa,UAChD,OAAO,OAAO,UAAU,OAAO,QAAQ;EAEzC,QAAQ,KAAK,UAAU,EAAE;CAC3B;CAEA,OAAO;EACL,MAAM;EACN,UAAU;EACV,UAAU;EACV;EACA;CACF;AACF;;;AChDA,IAAM,wBAAwB,OAAO,WAAiD,IAAI,SAAS,SAAS,WAAW;CACrH,OAAO,KAAK,UAAU,OAAO;CAC7B,OAAO,KAAK,SAAS,MAAM;AAC7B,CAAC;AAED,IAAM,gBAAgB,OAAO,QAA+B,UAAiC;CAE3F,IADW,OAAO,MAAM,KACpB,GAAI;CACR,MAAM,IAAI,SAAe,SAAS,WAAW;EAC3C,MAAM,gBAAgB;GACpB,QAAQ;GACR,QAAQ;EACV;EAEA,MAAM,WAAW,UAAmB;GAClC,QAAQ;GACR,OAAO,KAAK;EACd;EAEA,MAAM,gBAAgB;GACpB,OAAO,IAAI,SAAS,OAAO;GAC3B,OAAO,IAAI,SAAS,OAAO;EAC7B;EAEA,OAAO,GAAG,SAAS,OAAO;EAC1B,OAAO,GAAG,SAAS,OAAO;CAC5B,CAAC;AACH;AAEA,IAAM,oBAAoB,OAAO,WAAmC;CAClE,IAAI,CAAC,QAAQ;CACb,IAAI,OAAQ,OAA+B,UAAU,YACnD,IAAI;EACF,MAAO,OAAiD,MAAM;EAC9D;CACF,QAAQ,CAER;CAEF,IAAI;EACD,OAAqC,UAAU;CAClD,QAAQ,CAER;AACF;AAEA,IAAM,uBAAuB,UAC3B,UAAU,QACV,OAAO,UAAU,YACjB,UAAU,SACT,MAA6B,SAAS;AAGzC,IAAa,iBAAkG,OAC7G,UACA,QAC6C;CAC7C,MAAM,WAAW,YAAY,GAAG;CAChC,IAAI,CAAC,UAAU;EACb,IAAI,IAAI,OAAO,GAAG;EAClB,OAAO;GAAE,IAAI;GAAO,OAAO;EAAiB;CAC9C;CAEA,MAAM,WAAW,OAAO,IAAI,IAAI,QAAQ,YAAY,EAAE,CAAC,CAAC,KAAK;CAC7D,IAAI,CAAC,UAAU;EACb,IAAI,IAAI,OAAO,GAAG;EAClB,OAAO;GAAE,IAAI;GAAO,OAAO;EAAoB;CACjD;CAEA,MAAM,UAAU,oBAAoB,KAAK,QAAQ;CACjD,MAAM,WAAW,YAAY,KAAK,UAAU,OAAO;CAEnD,MAAM,CAAC,eAAe,eAAe,MAAM,QAAQ,IAAI,CACrD,OAAO,IAAI,mBAAmB,QAAQ,GACtC,OAAO,IAAI,iBAAiB,QAAQ,CACtC,CAAC;CAED,IAAI,CAAC,QAAQ,IAAI,UAAU,iBAAiB,GAAG;EAC7C,IAAI,IAAI,OAAO,GAAG;EAClB,OAAO;GAAE,IAAI;GAAO,OAAO;EAAe;CAC5C;CAEA,MAAM,WAAW,MAAM,cAAc,QAAQ,EAAE,MAAM,CAAC,EAAE,KAAK,SAAS,GAAG,4BAA4B,SAAS,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK;CAC/H,IAAI,CAAC,UAAU;EACb,IAAI,IAAI,OAAO,GAAG;EAClB,OAAO;GAAE,IAAI;GAAO,OAAO;EAAY;CACzC;CAEA,IAAI,SAAS,WAAW,UAAU,SAAS,QACzC,OAAO;EACL,IAAI;EACJ,QAAQ,SAAS;EACjB,GAAI,SAAS,eAAe,EAAE,cAAc,KAAK,IAAI,CAAC;CACxD;CAGF,MAAM,SAAS,MAAM,cAAc,iBACjC,EAAE,MAAM;EAAC,EAAE,KAAK,SAAS;EAAG,EAAE,QAAQ,YAAY;EAAG,4BAA4B,SAAS,QAAQ;CAAC,EAAE,GACrG;EAAE,MAAM,EAAE,QAAQ,aAAa;EAAG,QAAQ,EAAE,OAAO,GAAG;CAAE,GACxD,EAAE,gBAAgB,QAAQ,CAC5B,CAAC,CAAC,KAAK;CAEP,IAAI,CAAC,QAAQ;EACX,IAAI,IAAI,OAAO,GAAG;EAClB,OAAO;GAAE,IAAI;GAAO,OAAO;EAAgB;CAC7C;CAEA,MAAM,oBAAoB,QAAQ;CAGlC,MAAM,YAAW,MADE,sBAAsB,QAAQ,EAAA,CAC3B;CACtB,IAAI,CAAC,UAAU;EACb,MAAM,cAAc,UAClB,EAAE,MAAM,CAAC,EAAE,KAAK,SAAS,GAAG,4BAA4B,SAAS,QAAQ,CAAC,EAAE,GAC5E,EAAE,MAAM;GAAE,QAAQ;GAAS,OAAO;EAA4B,EAAE,CAClE;EACA,IAAI,IAAI,OAAO,GAAG;EAClB,OAAO;GAAE,IAAI;GAAO,OAAO;EAAkB;CAC/C;CACA,MAAM,aAAa,cAAc;CACjC,MAAM,SAAS,IAAI,aAAa,UAAU,EAAE,WAAW,CAAC;CACxD,IAAI,OAAO,eACT,MAAM,8BAA8B,UAAU,UAAU;CAG1D,MAAM,eAAe,OAAO,OAAO,WAAW,WAAW,OAAO,SAAS,KAAA;CACzE,MAAM,iBAAiB,0BAA0B,MAAM;CACvD,MAAM,yBAAyB,OAAO,gBAClC,EACA,eAAe;EACb,WAAW,OAAO,cAAc;EAChC,WAAW,OAAO,cAAc;EAChC,MAAM,OAAO,cAAc;EAC3B,iBAAiB,OAAO,cAAc;CACxC,EACF,IACE,CAAC;CACL,MAAM,sBACJ,gBACA,YACA,aAAsC,CAAC,OACV;EAC7B;EACA;EACA,UAAU;EACV,WAAW;EACX,GAAG;EACH,GAAG;EACH,GAAG;CACL;CACA,MAAM,oBAAoB,2BAA2B;CACrD,MAAM,4BAA4B,OAAO,aAAa;CAEtD,MAAM,cADmB,OAAO,SAAS,KAAK,CAAC,CAAC,YAC5B,MAAqB,mBAAmB,OAAO,SAAS,KAAK,CAAC,CAAC,YAAY,CAAC,CAAC,SAAS,MAAM;CAEhH,IAAI,eAA6C;CACjD,IAAI,gBAAgB,OAAO;CAC3B,IAAI,gBAAgB,OAAO;CAC3B,IAAI,YAAY,OAAO;CACvB,IAAI,mBAA6B,CAAC;CAClC,IAAI,gBAAgB,mBAAmB,OAAO,UAAU,OAAO,SAAS;CAExE,IAAI;EACF,IAAI,CAAC,6BAA6B,aAChC,MAAM,IAAI,MAAM,eAAe;EAGjC,MAAM,SAAS,YAAY,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,OAAO;EAIxE,IAAI,gBAAgB;EACpB,IAAI,cAAc;EAClB,MAAM,eAAe,OAAO,gBAAgB,WAAW,QAAQ,IAAI;EACnE,MAAM,SAAmB,CAAC;EAC1B,IAAI,gBAAgB;EAEpB,MAAM,gBAA0B,CAAC;EACjC,MAAM,aAAuB,CAAC;EAC9B,IAAI,aAAa;EAEjB,IAAI;GACF,WAAW,MAAM,YAAY,QAAQ;IACnC,IAAI,SAAS,UAAU,eACrB,MAAM,IAAI,MAAM,gBAAgB;IAGlC,MAAM,QAAQ,SAAS;IACvB,eAAe,MAAM;IACrB,cAAc,OAAO,KAAK;IAE1B,IAAI,2BAA2B;KAC7B,OAAO,KAAK,KAAK;KACjB,iBAAiB,MAAM;IACzB,OAAO,IAAI,CAAC,cAAc;KACxB,cAAc,KAAK,KAAK;KAExB,IAAI,aAAa,mBAAmB;MAClC,MAAM,QAAQ,MAAM,SAAS,GAAG,KAAK,IAAI,MAAM,QAAQ,oBAAoB,UAAU,CAAC;MACtF,IAAI,MAAM,QAAQ;OAChB,WAAW,KAAK,KAAK;OACrB,cAAc,MAAM;MACtB;KACF;KAEA,IAAI,cAAc,mBAAmB;MACnC,MAAM,QAAQ,OAAO,OAAO,YAAY,UAAU;MAClD,MAAM,aAAa,uBAAuB;OACxC,UAAU,OAAO;OACjB,gBAAgB,OAAO;OACvB,WAAW,OAAO;OAClB;MACF,CAAC;MAED,IAAI,WAAW,QACb,MAAM,IAAI,MAAM,WAAW,MAAM,cAAc,UAAU,OAAO,cAAc,IAAI,kBAAkB,2BAA2B;MAGjI,gBAAgB,mBAAmB,OAAO,UAAU,OAAO,SAAS;MACpE,eAAe,OAAO,iBAAiB,OAAO,UAAU,EACtD,UAAU,cACZ,CAAC;MAED,KAAK,MAAM,WAAW,eACpB,MAAM,cAAc,cAAc,OAAO;MAE3C,cAAc,SAAS;KACzB;IACF,OACE,MAAM,cAAc,cAAc,KAAK;IAGzC,iBAAiB;GACnB;EACF,UAAU;GACR,IAAI;IACF,MAAM,OAAO,MAAM;GACrB,QAAQ,CAER;EACF;EAEA,IAAI,kBAAkB,OAAO,aAC3B,MAAM,IAAI,MAAM,gBAAgB;EAGlC,IAAI,gBAAgB,OAAO,WACzB,MAAM,IAAI,MAAM,qBAAqB;EAGvC,IAAI,gBAAgB,aAAa,OAAO,KAAK,MAAM,OAAO,eAAe,MACvE,MAAM,IAAI,MAAM,uBAAuB;EAGzC,IAAI,2BAA2B;GAE7B,MAAM,EACJ,MAAM,WACN,UAAU,mBACV,UAAU,mBACV,SACA,UAAU,sBACR,MAAM,sBAPQ,OAAO,OAAO,QAAQ,aAOR,GAAW;IACzC,UAAU,OAAO;IACjB,gBAAgB,OAAO;GACzB,CAAC;GAED,gBAAgB;GAChB,gBAAgB;GAChB,YAAY,UAAU;GACtB,mBAAmB;GACnB,gBAAgB,mBAAmB,mBAAmB,UAAU,QAAQ;IACtE,GAAI,QAAQ,SAAS;KAAE,YAAY;KAAS,iBAAiB,OAAO;IAAU,IAAI,CAAC;IACnF,GAAG;GACL,CAAC;GACD,eAAe,OAAO,iBAAiB,eAAe,EACpD,UAAU,cACZ,CAAC;GAED,MAAM,WAAW,sBAAsB,YAAY;GACnD,aAAa,IAAI,SAAS;GAC1B,MAAM;EACR,OAAO;GACL,IAAI,CAAC,cAAc;IACjB,MAAM,QAAQ,OAAO,OAAO,YAAY,UAAU;IAClD,MAAM,aAAa,uBAAuB;KACxC,UAAU,OAAO;KACjB,gBAAgB,OAAO;KACvB,WAAW,OAAO;KAClB;IACF,CAAC;IAED,IAAI,WAAW,QACb,MAAM,IAAI,MAAM,WAAW,MAAM,cAAc,UAAU,OAAO,cAAc,IAAI,kBAAkB,2BAA2B;IAGjI,gBAAgB,mBAAmB,OAAO,UAAU,OAAO,SAAS;IACpE,eAAe,OAAO,iBAAiB,OAAO,UAAU,EACtD,UAAU,cACZ,CAAC;IAED,KAAK,MAAM,WAAW,eACpB,MAAM,cAAc,cAAc,OAAO;IAE3C,cAAc,SAAS;GACzB;GAEA,MAAM,WAAW,sBAAsB,YAAY;GACnD,aAAa,IAAI;GACjB,MAAM;EACR;EAEA,MAAM,iBAAiB,OAAQ,aAA6C,MAAM,EAAE;EACpF,IAAI,CAAC,gBACH,MAAM,IAAI,MAAM,iBAAiB;EAGnC,IAAI,iBAAiB;EACrB,IAAI,eAAe;EACnB,IAAI,iBAAgC,OAAO,gBAAgB,OAAO;EAElE,IAAI,OAAO,eAAe;GACxB,MAAM,kBAAkB,SAAS,WAAW,GAAG,WAAW,OAAO;GACjE,MAAM,uBAAuB,IAAI,SAAS,cAAc;GACxD,MAAM,mBAAmB;IACvB;IACA;IACA,UAAU;IACV,UAAU;IACV,WAAW;IACX,aAAa,yBAAyB;KACpC,aAAa,OAAO;KACpB,UAAU,OAAO;IACnB,CAAC;IACD,GAAI,eAAe,EAAE,QAAQ,aAAa,IAAI,CAAC;IAC/C,GAAI,OAAO,OAAO,iBAAiB,WAAW,EAAE,cAAc,OAAO,aAAa,IAAI,CAAC;GACzF;GACA,IAAI,wBAAiC;GAErC,KAAK,IAAI,UAAU,GAAG,UAAU,KAAK,CAAC,gBAAgB,WAAW,GAAG;IAClE,IAAI;KACF,iBAAiB,MAAM,yBAAyB;MAC9C,GAAG;MACH,QAAQ;MACR,eAAe,OAAO;KACxB,CAAC;KACD,IAAI,CAAC,gBAAgB,MAAM,IAAI,MAAM,iBAAiB;KACtD,gBAAgB;MACd,GAAG;MACH,eAAe,OAAO;KACxB;KACA;IACF,SAAS,OAAO;KACd,IAAI,CAAC,oBAAoB,KAAK,GAAG,MAAM;KACvC,wBAAwB;IAC1B;IAEA,MAAM,gBAAgB,MAAM,gBAAgB,QAC1C,EAAE,8BAA8B,OAAO,cAAc,IAAI,GACzD,EAAE,YAAY,EAAE,KAAK,EAAE,EAAE,CAC3B;IACA,IAAI,EAAE,eAAe,eAAe,WAAW;IAE/C,MAAM,uBAAuB,MAAM,0BAA0B;KAC3D,GAAG;KACH,QAAQ,cAAc;KACtB,kBAAkB,OAAO,cAAc;IACzC,CAAC;IACD,IAAI,CAAC,sBAAsB;IAE3B,MAAM,OAAO,OAAO,oBAAoB;IACxC,iBAAiB,cAAc,IAAI,YAAY;IAC/C,iBAAiB;IACjB,eAAe;GACjB;GAEA,IAAI,CAAC,gBAAgB;IACnB,MAAM,OAAO,OAAO,oBAAoB;IACxC,IAAI,uBAAuB,MAAM;GACnC;EACF;EACA,IAAI,CAAC,gBACH,MAAM,IAAI,MAAM,wBAAwB;EAG1C,MAAM,cAAc,UAClB,EAAE,MAAM,CAAC,EAAE,KAAK,SAAS,GAAG,4BAA4B,SAAS,QAAQ,CAAC,EAAE,GAC5E;GACE,MAAM;IACJ,QAAQ;IACR,QAAQ;IACR,UAAU;IACV,UAAU;IACV,WAAW;IACX,GAAI,eAAe,EAAE,cAAc,KAAK,IAAI,CAAC;GAC/C;GACA,QAAQ,EAAE,OAAO,GAAG;EACtB,CACF;EAEA,IAAI,CAAC,cACH,MAAM,4BAA4B;GAChC;GACA;GACA,QAAQ;GACR,UAAU;GACV,UAAU;GACV,gBAAgB,OAAO;GACvB,WAAW;GACX,GAAI,OAAO,OAAO,aAAa,YAAY,EAAE,UAAU,OAAO,SAAS,IAAI,CAAC;GAC5E,GAAI,OAAO,cAAc,EAAE,aAAa,OAAO,YAAY,IAAI,CAAC;GAChE,GAAI,OAAO,OAAO,iBAAiB,WAAW,EAAE,cAAc,OAAO,aAAa,IAAI,CAAC;GACvF,GAAI,eAAe,EAAE,QAAQ,aAAa,IAAI,CAAC;GAC/C;GACA,UAAU;EACZ,CAAC,CAAC,CAAC,OAAO,UAAU;GAClB,QAAQ,MAAM,wCAAwC;IACpD;IACA;IACA,QAAQ;IACR;GACF,CAAC;EACH,CAAC;EAGH,IAAI;GACF,MAAM,YAAY,WAAW,EAAE,SAAS,CAAC;EAC3C,QAAQ,CAER;EAEA,OAAO;GACL,IAAI;GACJ,QAAQ;GACR,GAAI,eAAe,EAAE,cAAc,KAAK,IAAI,CAAC;EAC/C;CACF,SAAS,OAAO;EACd,MAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;EAErE,MAAM,kBAAkB,YAAY;EAEpC,IAAI,YAAY,kBAAkB;GAChC,MAAM,cAAc,UAClB,EAAE,MAAM,CAAC,EAAE,KAAK,SAAS,GAAG,4BAA4B,SAAS,QAAQ,CAAC,EAAE,GAC5E,EAAE,MAAM,EAAE,QAAQ,YAAY,EAAE,CAClC;GACA,IAAI,IAAI,OAAO,GAAG;GAClB,OAAO;IAAE,IAAI;IAAO,OAAO;GAAiB;EAC9C;EAEA,IAAI,YAAY,yBAAyB;GACvC,MAAM,cAAc,UAClB,EAAE,MAAM,CAAC,EAAE,KAAK,SAAS,GAAG,4BAA4B,SAAS,QAAQ,CAAC,EAAE,GAC5E,EAAE,MAAM;IAAE,QAAQ;IAAS,OAAO;GAAQ,EAAE,CAC9C;GACA,IAAI,IAAI,OAAO,GAAG;GAClB,OAAO;IAAE,IAAI;IAAO,OAAO;GAAQ;EACrC;EAEA,IAAI,YAAY,iBAAiB;GAC/B,MAAM,cAAc,UAClB,EAAE,MAAM,CAAC,EAAE,KAAK,SAAS,GAAG,4BAA4B,SAAS,QAAQ,CAAC,EAAE,GAC5E,EAAE,MAAM;IAAE,QAAQ;IAAS,OAAO;GAAQ,EAAE,CAC9C;GACA,IAAI,IAAI,OAAO,GAAG;GAClB,OAAO;IAAE,IAAI;IAAO,OAAO;GAAQ;EACrC;EAEA,IAAI,YAAY,oBAAoB,YAAY,6BAA6B;GAC3E,MAAM,cAAc,UAClB,EAAE,MAAM,CAAC,EAAE,KAAK,SAAS,GAAG,4BAA4B,SAAS,QAAQ,CAAC,EAAE,GAC5E,EAAE,MAAM;IAAE,QAAQ;IAAS,OAAO;GAAQ,EAAE,CAC9C;GACA,IAAI,IAAI,OAAO,GAAG;GAClB,OAAO;IAAE,IAAI;IAAO,OAAO;GAAQ;EACrC;EAEA,IAAI,QAAQ,WAAW,yBAAyB,GAAG;GACjD,MAAM,cAAc,UAClB,EAAE,MAAM,CAAC,EAAE,KAAK,SAAS,GAAG,4BAA4B,SAAS,QAAQ,CAAC,EAAE,GAC5E,EAAE,MAAM;IAAE,QAAQ;IAAS,OAAO;GAAQ,EAAE,CAC9C;GACA,IAAI,IAAI,OAAO,GAAG;GAClB,OAAO;IAAE,IAAI;IAAO,OAAO;GAAQ;EACrC;EAEA,IAAI,YAAY,iBAAiB,YAAY,uBAAuB;GAClE,MAAM,cAAc,UAClB,EAAE,MAAM,CAAC,EAAE,KAAK,SAAS,GAAG,4BAA4B,SAAS,QAAQ,CAAC,EAAE,GAC5E,EAAE,MAAM;IAAE,QAAQ;IAAS,OAAO;GAAQ,EAAE,CAC9C;GACA,IAAI,IAAI,OAAO,GAAG;GAClB,OAAO;IAAE,IAAI;IAAO,OAAO;GAAQ;EACrC;EAEA,MAAM,cAAc,UAClB,EAAE,MAAM,CAAC,EAAE,KAAK,SAAS,GAAG,4BAA4B,SAAS,QAAQ,CAAC,EAAE,GAC5E,EAAE,MAAM;GAAE,QAAQ;GAAS,OAAO;EAAQ,EAAE,CAC9C;EAEA,IAAI,IAAI,OAAO,GAAG;EAClB,OAAO;GAAE,IAAI;GAAO,OAAO;EAAkB;CAC/C;AACF;;;ACrgBA,IAAa,YAA2F,OACtG,UACA,QAC2C;CAC3C,MAAM,WAAW,YAAY,GAAG;CAChC,IAAI,CAAC,UAAU;EACb,IAAI,IAAI,OAAO,GAAG;EAClB,OAAO;GAAE,IAAI;GAAO,OAAO;EAAiB;CAC9C;CAEA,MAAM,WAAW,OAAO,IAAI,IAAI,QAAQ,YAAY,EAAE,CAAC,CAAC,KAAK;CAC7D,IAAI,CAAC,UAAU;EACb,IAAI,IAAI,OAAO,GAAG;EAClB,OAAO;GAAE,IAAI;GAAO,OAAO;EAAoB;CACjD;CAEA,MAAM,UAAU,oBAAoB,KAAK,QAAQ;CACjD,MAAM,WAAW,YAAY,KAAK,UAAU,OAAO;CAEnD,MAAM,CAAC,eAAe,eAAe,MAAM,QAAQ,IAAI,CACrD,OAAO,IAAI,mBAAmB,QAAQ,GACtC,OAAO,IAAI,iBAAiB,QAAQ,CACtC,CAAC;CAED,IAAI,CAAC,QAAQ,IAAI,QAAQ,iBAAiB,GAAG;EAC3C,IAAI,IAAI,OAAO,GAAG;EAClB,OAAO;GAAE,IAAI;GAAO,OAAO;EAAe;CAC5C;CAEA,MAAM,UAAU,MAAM,cAAc,QAAQ,EAAE,MAAM,CAAC,EAAE,KAAK,SAAS,GAAG,4BAA4B,SAAS,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK;CAC9H,IAAI,CAAC,SAAS;EACZ,IAAI,IAAI,OAAO,GAAG;EAClB,OAAO;GAAE,IAAI;GAAO,OAAO;EAAY;CACzC;CAOA,MAAM,YAAY,MALS,YAAY,KACrC,EAAE,SAAS,GACX;EAAE,OAAO;EAAG,KAAK;CAAE,CACrB,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,KAAK,EAAA,CAGvB,KAAK,QAAS,OAAO,IAAI,UAAU,WAAW,IAAI,QAAQ,EAAG,CAAC,CAC9D,QAAQ,MAAM,OAAO,UAAU,CAAC,KAAK,KAAK,CAAC;CAE9C,OAAO;EACL,IAAI;EACJ,QAAQ,QAAQ;EAChB,WAAW,QAAQ;EACnB,aAAa,QAAQ;EACrB;EACA,GAAI,QAAQ,SAAS,EAAE,QAAQ,QAAQ,OAAO,IAAI,CAAC;CACrD;AACF;;;ACjEA,IAAa,YAAY;AACzB,IAAa,aAAa;AAC1B,IAAa,cAAc;AAC3B,IAAa,gBAAgB;AAE7B,IAAa,0BAA0B,MAAO;CAAC;CAAS;CAAU;AAAQ,CAAC;AAE3E,IAAa,4BAA4B,OAAS;CAChD,WAAW,OAAS,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,MAAM,0BAA0B;CAC7E,WAAW,QAAU,QAAQ;CAC7B,MAAM,OAAS,CAAC,CAAC,KAAK,CAAC,CAAC,MAAM,iBAAiB;AACjD,CAAC;AAED,IAAa,oBAAoB,OAAS;CACxC,UAAU,OAAS,CAAC,CAAC,IAAI,CAAC;CAC1B,UAAU,OAAS,CAAC,CAAC,IAAI,CAAC;CAC1B,UAAU,QAAU,CAAC,CAAC,SAAS;CAC/B,aAAa,wBAAwB,SAAS;CAC9C,eAAe,0BAA0B,SAAS;CAClD,WAAW,OAAS,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC;AACnC,CAAC,CAAC,CAAC,aAAa,OAAO,QAAQ;CAC7B,IAAI,MAAM,gBAAgB,KAAA,KAAa,MAAM,aAAa,KAAA,GACxD,IAAI,SAAS;EACX,MAAM;EACN,SAAS;EACT,MAAM,CAAC,aAAa;CACtB,CAAC;AAEL,CAAC;AAIiC,OAAS;CACzC,IAAI,QAAU;CACd,OAAO,OAAS,CAAC,CAAC,SAAS;CAC3B,UAAU,OAAS,CAAC,CAAC,SAAS;CAC9B,WAAW,OAAS,CAAC,CAAC,SAAS;CAC/B,WAAW,OAAS,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS;CACrC,aAAa,OAAS,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS;CACvC,QAAQ,OAAS,CAAC,CAAC,SAAS;CAC5B,cAAc,QAAU,CAAC,CAAC,SAAS;AACrC,CAAC;AAImC,OAAS;CAC3C,IAAI,QAAU;CACd,OAAO,OAAS,CAAC,CAAC,SAAS;CAC3B,QAAQ,MAAO;EAAC;EAAa;EAAc;EAAQ;CAAO,CAAC,CAAC,CAAC,SAAS;CACtE,WAAW,OAAS,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS;CACrC,aAAa,OAAS,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS;CACvC,UAAU,MAAQ,OAAS,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS;CACpD,QAAQ,OAAS,CAAC,CAAC,SAAS;AAC9B,CAAC;AAIqC,OAAS;CAC7C,IAAI,QAAU;CACd,OAAO,OAAS,CAAC,CAAC,SAAS;CAC3B,QAAQ,OAAS,CAAC,CAAC,SAAS;CAC5B,cAAc,QAAU,CAAC,CAAC,SAAS;AACrC,CAAC;;;ACtCD,IAAa,aAA+F,OAC1G,SACA,QACyC;CACzC,MAAM,WAAW,YAAY,GAAG;CAChC,IAAI,CAAC,UAAU;EACb,IAAI,IAAI,OAAO,GAAG;EAClB,OAAO;GAAE,IAAI;GAAO,OAAO;EAAiB;CAC9C;CAEA,MAAM,SAAS,UAAU,GAAG;CAE5B,MAAM,SAAA,kBAAmC,UAAU,WAAW,CAAC,CAAC;CAChE,IAAI,CAAC,OAAO,SAAS;EACnB,IAAI,IAAI,OAAO,GAAG;EAClB,OAAO;GAAE,IAAI;GAAO,OAAO;EAAkB;CAC/C;CAEA,MAAM,EAAE,UAAU,UAAU,WAAW,UAAU,eAAe,2BAA2B,OAAO;CAClG,MAAM,cAAc,yBAAyB;EAAE,aAAa,OAAO,KAAK;EAAa;CAAS,CAAC;CAC/F,IAAI,gBAAgB,YAAY,CAAC,QAAQ;EACvC,IAAI,IAAI,OAAO,GAAG;EAClB,OAAO;GAAE,IAAI;GAAO,OAAO;EAA0B;CACvD;CAEA,MAAM,YAAY,SAAS,OAAO,YAAY,EAAE,CAAC,CAAC,SAAS,WAAW;CACtE,MAAM,eAAe,YAAY,iBAAiB,OAAO,KAAK,SAAS,CAAC,IAAI,KAAA;CAC5E,MAAM,gBAAgB,yBAClB,yBAAyB;EACzB,WAAW,uBAAuB;EAClC,MAAM,uBAAuB;EAC7B;EACA;EACA;EACA;EACA,GAAI,SAAS,EAAE,OAAO,IAAI,CAAC;EAC3B,GAAI,eAAe,EAAE,aAAa,IAAI,CAAC;CACzC,CAAC,IACC;CAEJ,IAAI,0BAA0B,CAAC,eAAe;EAC5C,IAAI,IAAI,OAAO,GAAG;EAClB,OAAO;GAAE,IAAI;GAAO,OAAO;EAA4B;CACzD;CAEA,IAAI,eAAe;EAEjB,MAAM,YAAW,MADE,sBAAsB,QAAQ,EAAA,CAC3B;EACtB,IAAI,CAAC,UAAU;GACb,IAAI,IAAI,OAAO,GAAG;GAClB,OAAO;IAAE,IAAI;IAAO,OAAO;GAA4B;EACzD;EAEA,MAAM,aAAa,cAAc;EACjC,MAAM,8BAA8B,UAAU,UAAU;EACxD,MAAM,eAAe,MAAM,SAAS,WAAW,GAAG,WAAW,OAAO,CAAC,CAAC,QACpE,EAAE,8BAA8B,cAAc,IAAI,GAClD,EAAE,YAAY;GAAE,KAAK;GAAG,UAAU;GAAG,QAAQ;GAAG,UAAU;EAAE,EAAE,CAChE;EACA,IAAI,cAAc,eAAe,UAAU;GACzC,MAAM,mBAAmB,aAAa,YAAY,OAAO,aAAa,aAAa,WAC/E,aAAa,WACb,CAAC;GACL,MAAM,mBAAmB,OAAO,iBAAiB,aAAa,WAC1D,iBAAiB,WACjB;GACJ,MAAM,eAAe,OAAO,aAAa,WAAW,WAChD,aAAa,SACb;GACJ,MAAM,SAAS,MAAM,0BAA0B;IAC7C;IACA;IACA,QAAQ,aAAa;IACrB;IACA,UAAU;IACV,WAAW;IACX;IACA,GAAI,SAAS,EAAE,OAAO,IAAI,CAAC;IAC3B,GAAI,eAAe,EAAE,aAAa,IAAI,CAAC;IACvC,kBAAkB,cAAc;GAClC,CAAC;GACD,IAAI,QACF,OAAO;IACL,IAAI;IACJ;IACA,cAAc;IACd,GAAI,YAAY,EAAE,UAAU,IAAI,CAAC;GACnC;EAEJ;CACF;CAEA,MAAM,YAAY,kBAAkB;CACpC,MAAM,cAAc,KAAK,KAAK,YAAY,SAAS;CAEnD,MAAM,UAAU,oBAAoB,KAAK,QAAQ;CACjD,MAAM,WAAW,YAAY,KAAK,UAAU,OAAO;CAEnD,MAAM,gBAAgB,MAAM,OAAO,IACjC,mBACA,QACF;CAEA,MAAM,oBAAoB,QAAQ;CAElC,MAAM,WAAW,IAAI,SAAS,CAAC,CAAC,SAAS;CACzC,MAAM,MAAM,KAAK,IAAI;CACrB,MAAM,YAAY,IAAI,KAAK,MAAM,gBAAgB,CAAC;CAElD,MAAM,cAAc,OAAO;EACzB,KAAK;EACL,GAAI,SAAS,EAAE,OAAO,IAAI,CAAC;EAC3B,GAAI,eAAe,EAAE,aAAa,IAAI,CAAC;EACvC;EACA;EACA,UAAU,gBAAgB;EAC1B;EACA,GAAI,gBAAgB,EAAE,cAAc,IAAI,CAAC;EACzC;EACA;EACA;EACA,QAAQ;EACR,WAAW,IAAI,KAAK,GAAG;EACvB;CACF,CAAC;CAED,OAAO;EACL,IAAI;EACJ;EACA;EACA;EACA,GAAI,YAAY,EAAE,UAAU,IAAI,CAAC;CACnC;AACF;;;ACxIA,IAAa,cAAqE,OAChF,SACA,QACkC;CAClC,MAAM,WAAW,YAAY,GAAG;CAChC,IAAI,CAAC,UAAU;EACb,IAAI,IAAI,OAAO,GAAG;EAClB,OAAO;GAAE,IAAI;GAAO,OAAO;EAAiB;CAC9C;CAEA,MAAM,WAAW,OAAO,IAAI,IAAI,QAAQ,YAAY,EAAE,CAAC,CAAC,KAAK;CAC7D,MAAM,WAAW,OAAO,IAAI,IAAI,QAAQ,SAAS,EAAE,CAAC,CAAC,KAAK;CAC1D,MAAM,QAAQ,OAAO,QAAQ;CAE7B,IAAI,CAAC,YAAY,CAAC,OAAO,UAAU,KAAK,KAAK,QAAQ,GAAG;EACtD,IAAI,IAAI,OAAO,GAAG;EAClB,OAAO;GAAE,IAAI;GAAO,OAAO;EAAoB;CACjD;CAEA,MAAM,UAAU,oBAAoB,KAAK,QAAQ;CACjD,MAAM,WAAW,YAAY,KAAK,UAAU,OAAO;CAEnD,MAAM,CAAC,eAAe,eAAe,MAAM,QAAQ,IAAI,CACrD,OAAO,IAAI,mBAAmB,QAAQ,GACtC,OAAO,IAAI,iBAAiB,QAAQ,CACtC,CAAC;CAED,IAAI,CAAC,QAAQ,IAAI,UAAU,iBAAiB,GAAG;EAC7C,IAAI,IAAI,OAAO,GAAG;EAClB,OAAO;GAAE,IAAI;GAAO,OAAO;EAAe;CAC5C;CAEA,MAAM,UAAU,MAAM,cAAc,QAAQ,EAAE,MAAM,CAAC,EAAE,KAAK,SAAS,GAAG,4BAA4B,SAAS,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK;CAChI,IAAI,CAAC,SAAS;EACZ,IAAI,IAAI,OAAO,GAAG;EAClB,OAAO;GAAE,IAAI;GAAO,OAAO;EAAY;CACzC;CAEA,IAAI,QAAQ,WAAW,aAAa;EAClC,IAAI,IAAI,OAAO,GAAG;EAClB,OAAO;GAAE,IAAI;GAAO,OAAO;EAAgB;CAC7C;CAEA,IAAI,SAAS,QAAQ,aAAa;EAChC,IAAI,IAAI,OAAO,GAAG;EAClB,OAAO;GAAE,IAAI;GAAO,OAAO;EAAqB;CAClD;CAEA,MAAM,OAAO,gBAAgB,OAAO;CACpC,IAAI,CAAC,MAAM;EACT,IAAI,IAAI,OAAO,GAAG;EAClB,OAAO;GAAE,IAAI;GAAO,OAAO;EAAe;CAC5C;CAEA,MAAM,eAAe,UAAU,QAAQ,cAAc,IACjD,QAAQ,YAAY,QAAQ,aAAa,QAAQ,cAAc,KAC/D,QAAQ;CAEZ,IAAI,KAAK,SAAS,cAAc;EAC9B,IAAI,IAAI,OAAO,GAAG;EAClB,OAAO;GAAE,IAAI;GAAO,OAAO;EAAkB;CAC/C;CAEA,IAAI,KAAK,WAAW,cAAc;EAChC,IAAI,IAAI,OAAO,GAAG;EAClB,OAAO;GAAE,IAAI;GAAO,OAAO;EAAqB;CAClD;CAEA,MAAM,iBAAiB,IAAI,IAAI,IAAI,gBAAgB;CACnD,MAAM,SAAS,iBAAiB,iBAAiB,IAAI,IAAI,KAAA;CAEzD,IAAI,gBAEE;MAAA,WADmB,mBAAmB,cAC3B,GAAgB;GAC7B,IAAI,IAAI,OAAO,GAAG;GAClB,OAAO;IAAE,IAAI;IAAO,OAAO;GAAoB;EACjD;;CAGF,MAAM,oBAAoB,QAAQ;CAElC,MAAM,YAAY,UAChB;EAAE;EAAU;CAAM,GAClB;EACE,MAAM;GACJ;GACA;GACA;GACA,MAAM,KAAK;GACX;GACA,WAAW,QAAQ;EACrB;EACA,cAAc,EACZ,2BAAW,IAAI,KAAK,EACtB;CACF,GACA,EAAE,QAAQ,KAAK,CACjB;CAEA,IAAI,IAAI,OAAO,GAAG;CAClB,OAAO,EAAE,IAAI,KAAK;AACpB;;;AC7HA,IAAa,iBAAiB,EAC5B,YACA,8BAII;CACJ,QAAQ,KAAU,KAAU,SAAc;EAKxC,IAAI,EAJgB,OAAO,KAAK,UAAU,oBAAoB,WAC1D,OAAO,IAAI,QAAQ,eAAe,IAClC,GAAA,CAEa,SAAS,0BAA0B,GAAG;GACrD,KAAK;GACL;EACF;EAEA,IAAI,QAAQ;EACZ,MAAM,SAAmB,CAAC;EAC1B,IAAI,OAAO;EACX,IAAI,SAAS;EACb,IAAI,kBAAwD;EAE5D,MAAM,qBAAqB,OAAO,4BAA4B,YAAY,0BAA0B,IAChG,0BACA;EAEJ,MAAM,gBAAgB;GACpB,IAAI,IAAI,QAAQ,MAAM;GACtB,IAAI,IAAI,OAAO,KAAK;GACpB,IAAI,IAAI,SAAS,OAAO;GACxB,IAAI,IAAI,WAAW,SAAS;GAC5B,IAAI,iBAAiB;IACnB,aAAa,eAAe;IAC5B,kBAAkB;GACpB;EACF;EAEA,MAAM,UAAU,UAAoB;GAClC,IAAI,MAAM;GACV,OAAO;GAEP,QAAQ;GAER,IAAI,OAAO;IACT,KAAK,KAAK;IACV;GACF;GAEA,IAAI,OAAO,OAAO,OAAO,QAAQ,KAAK;GACtC,KAAK;EACP;EAEA,MAAM,UAAU,UAAe;GAC7B,IAAI,MAAM;GACV,MAAM,SAAS,OAAO,SAAS,KAAK,IAAI,QAAQ,OAAO,KAAK,KAAK;GACjE,SAAS,OAAO;GAEhB,IAAI,QAAQ,YAAY;IACtB,OAAO;IACP,QAAQ;IACR,IAAI,QAAQ;IACZ,IAAI,OAAO,GAAG,CAAC,CAAC,KAAK;KAAE,IAAI;KAAO,OAAO;IAAkB,CAAC;IAC5D;GACF;GAEA,OAAO,KAAK,MAAM;GAElB,IAAI,CAAC,oBAAoB;GAEzB,MAAM,MAAM,KAAK,IAAI;GAGrB,MAAM,SAAS,kBADD,mBADI,aAAa,GACE,GAAW,oBAAoB,GAC/B,GAAO,OAAO,QAAQ,oBAAoB,GAAG;GAE9E,IAAI,SAAS,KAAK,CAAC,QAAQ;IACzB,SAAS;IACT,IAAI,MAAM;IACV,kBAAkB,iBAAiB;KACjC,kBAAkB;KAClB,SAAS;KACT,IAAI,MAAM;KACV,IAAI;MACF,IAAI,OAAO;KACb,QAAQ,CAER;IACF,GAAG,MAAM;GACX;EACF;EAEA,MAAM,cAAc,OAAO;EAC3B,MAAM,WAAW,QAAiB,OAAO,GAAG;EAC5C,MAAM,kBAAkB,uBAAO,IAAI,MAAM,iBAAiB,CAAC;EAE3D,IAAI,GAAG,QAAQ,MAAM;EACrB,IAAI,GAAG,OAAO,KAAK;EACnB,IAAI,GAAG,SAAS,OAAO;EACvB,IAAI,GAAG,WAAW,SAAS;CAC7B;AACF;AAQA,IAAM,oBAAoB;AAC1B,IAAM,kBAAkB;AAExB,IAAM,mCAAmB,IAAI,IAA6B;AAC1D,IAAI,gBAAgB;AAEpB,IAAM,gBAAgB,QAAqB;CACzC,MAAM,cAAc,OAAO,KAAK,aAAa,WAAW,IAAI,WAAW;CACvE,IAAI,YAAY,KAAK,GAAG,OAAO,YAAY,KAAK;CAEhD,QADc,OAAO,KAAK,OAAO,WAAW,IAAI,KAAK,GAAA,CACxC,KAAK,KAAK;AACzB;AAEA,IAAM,sBAAsB,QAAgB;CAC1C,IAAI,MAAM,gBAAgB,KAAQ;CAClC,gBAAgB;CAEhB,IAAI,iBAAiB,OAAO,KAAM;CAElC,KAAK,MAAM,CAAC,KAAK,UAAU,kBACzB,IAAI,MAAM,MAAM,aAAa,iBAC3B,iBAAiB,OAAO,GAAG;AAGjC;AAEA,IAAM,sBAAsB,KAAa,oBAA4B,QAAiC;CACpG,mBAAmB,GAAG;CAEtB,MAAM,WAAW,qBAAqB;CACtC,MAAM,WAAW,iBAAiB,IAAI,GAAG;CACzC,IAAI,UAAU;EACZ,SAAS,aAAa;EACtB,SAAS,SAAS,KAAK,IAAI,UAAU,SAAS,MAAM;EACpD,OAAO;CACT;CAEA,MAAM,OAAwB;EAC5B,QAAQ;EACR,cAAc;EACd,YAAY;CACd;CACA,iBAAiB,IAAI,KAAK,IAAI;CAC9B,OAAO;AACT;AAEA,IAAM,qBACJ,OACA,OACA,oBACA,QACW;CACX,MAAM,WAAW,qBAAqB;CACtC,MAAM,YAAY,KAAK,IAAI,GAAG,MAAM,MAAM,YAAY;CAEtD,IAAI,YAAY,GAAG;EACjB,MAAM,SAAS,KAAK,IAAI,UAAU,MAAM,SAAU,YAAY,qBAAsB,GAAI;EACxF,MAAM,eAAe;CACvB;CAEA,MAAM,UAAU;CAEhB,IAAI,MAAM,UAAU,GAAG,OAAO;CAC9B,OAAO,KAAK,KAAM,CAAC,MAAM,SAAS,qBAAsB,GAAI;AAC9D;;;AChKA,IAAA,mBAAgB,QAA0B;CACxC,MAAM,iBAAiB,kBAAkB;CACzC,IAAI,IACF,WACA,cAAc;EACZ,YAAY,qBAAqB,cAAc;EAC/C,yBAAyB,iCAAiC;CAC5D,CAAC,CACH;CAEA,IAAI,KAAK,WAAmB,UAAU;CACtC,IAAI,IAAI,YAAoB,WAAW;CACvC,IAAI,IAAI,aAAqB,SAAS;CACtC,IAAI,KAAK,eAAuB,cAAc;AAChD"}
+{"version":3,"file":"handler-BkGfOJ1l.js","names":[],"sources":["../src/uploads/api/file-uploads/processors/sanitizeSvg.ts","../src/uploads/api/file-uploads/processors/index.ts","../src/uploads/api/file-uploads/handlers/completeUpload.ts","../src/uploads/api/file-uploads/handlers/getStatus.ts","../src/uploads/api/file-uploads/index.ts","../src/uploads/api/file-uploads/handlers/initUpload.ts","../src/uploads/api/file-uploads/handlers/uploadChunk.ts","../src/uploads/api/file-uploads/middleware/rawBodyParser.ts","../src/uploads/api/file-uploads/handler.ts"],"sourcesContent":["import { JSDOM } from \"jsdom\"\nimport createDOMPurify from \"dompurify\"\n\nimport type { UploadFileProcessor } from \"./index\"\n\n\nconst MAX_SVG_BYTES = 128 * 1024\n\nconst window = new JSDOM(\"\").window\nconst DOMPurify = createDOMPurify(window)\n\nconst normalizeForSniff = (raw: string): string => raw.replace(/^\\uFEFF/, \"\").trimStart()\n\nconst looksLikeSvgText = (text: string): boolean => {\n  const normalized = normalizeForSniff(text)\n  if (!normalized.startsWith(\"<\")) return false\n  return /<svg(?:\\s|>)/i.test(normalized)\n}\n\nexport const looksLikeSvg = (sniff: Buffer): boolean => looksLikeSvgText(sniff.toString(\"utf8\"))\n\nexport const sanitizeSvg = (svg: string): string =>\n  DOMPurify.sanitize(svg, {\n    USE_PROFILES: { svg: true, svgFilters: true },\n  })\n\nexport const sanitizeSvgProcessor: UploadFileProcessor = {\n  id: \"sanitize-svg\",\n  maxBytes: MAX_SVG_BYTES,\n  match: ({ sniff }) => looksLikeSvg(sniff),\n  process: (data): { data: Buffer; mimeType: string } => {\n    if (data.length > MAX_SVG_BYTES) {\n      throw new Error(\"svg_too_large\")\n    }\n\n    const svgText = data.toString(\"utf8\")\n    if (!looksLikeSvgText(svgText)) {\n      throw new Error(\"svg_invalid\")\n    }\n\n    const sanitized = sanitizeSvg(svgText)\n    if (!sanitized.trim() || !looksLikeSvgText(sanitized)) {\n      throw new Error(\"svg_sanitize_failed\")\n    }\n\n    const sanitizedBuffer = Buffer.from(sanitized, \"utf8\")\n    if (sanitizedBuffer.length > MAX_SVG_BYTES) {\n      throw new Error(\"svg_too_large\")\n    }\n\n    return { data: sanitizedBuffer, mimeType: \"image/svg+xml\" }\n  },\n}\n\n","import { convertHeifToWebpProcessor } from \"./convertHeifToWebp\"\nimport { sanitizeSvgProcessor } from \"./sanitizeSvg\"\n\n\nexport type UploadFileProcessorContext = {\n  filename: string\n  clientMimeType: string\n  totalSize: number\n  sniff: Buffer\n}\n\nexport type UploadFileProcessorResult = {\n  data: Buffer\n  filename?: string\n  mimeType?: string\n  metadata?: Record<string, unknown>\n}\n\nexport type UploadFileProcessor = {\n  id: string\n  maxBytes: number\n  match: (ctx: UploadFileProcessorContext) => boolean\n  process: (data: Buffer, ctx: UploadFileProcessorContext) => Promise<UploadFileProcessorResult> | UploadFileProcessorResult\n}\n\nexport const uploadProcessors = Object.freeze([sanitizeSvgProcessor, convertHeifToWebpProcessor] satisfies UploadFileProcessor[])\n\nexport const getMaxUploadProcessorBytes = (): number =>\n  uploadProcessors.reduce((max, processor) => Math.max(max, processor.maxBytes), 0)\n\nexport const selectUploadProcessors = (ctx: UploadFileProcessorContext): UploadFileProcessor[] =>\n  uploadProcessors.filter((processor) => processor.match(ctx))\n\nexport const applyUploadProcessors = async (\n  data: Buffer,\n  ctx: Omit<UploadFileProcessorContext, \"sniff\" | \"totalSize\">,\n): Promise<{ data: Buffer; filename: string; mimeType: string; applied: string[]; metadata: Record<string, unknown> }> => {\n  let currentData = data\n  let currentFilename = ctx.filename\n  let currentMimeType = ctx.clientMimeType\n  const applied: string[] = []\n  const metadata: Record<string, unknown> = {}\n\n  for (const processor of uploadProcessors) {\n    const processorCtx: UploadFileProcessorContext = {\n      filename: currentFilename,\n      clientMimeType: currentMimeType,\n      totalSize: currentData.length,\n      sniff: currentData,\n    }\n\n    if (!processor.match(processorCtx)) continue\n\n    if (currentData.length > processor.maxBytes) {\n      throw new Error(\"processor_input_too_large\")\n    }\n\n    const result = await processor.process(currentData, processorCtx)\n    currentData = result.data\n    if (typeof result.filename === \"string\" && result.filename.trim()) {\n      currentFilename = result.filename.trim()\n    }\n    if (typeof result.mimeType === \"string\" && result.mimeType.trim()) {\n      currentMimeType = result.mimeType.trim()\n    }\n    if (result.metadata && typeof result.metadata === \"object\") {\n      Object.assign(metadata, result.metadata)\n    }\n    applied.push(processor.id)\n  }\n\n  return {\n    data: currentData,\n    filename: currentFilename,\n    mimeType: currentMimeType,\n    applied,\n    metadata,\n  }\n}\n","import { createHash } from \"node:crypto\"\n\nimport { ApiHandler } from \"@rpcbase/api\"\nimport { getTenantFilesystemDb, models } from \"@rpcbase/db\"\nimport { GridFSBucket, ObjectId } from \"mongodb\"\nimport type { Model } from \"mongoose\"\n\nimport * as Uploads from \"../index\"\nimport {\n  claimUploadFileReference,\n  createUploadFileReference,\n} from \"../fileReferences\"\nimport { enqueueUploadPostProcessors } from \"../postProcessors\"\nimport { applyUploadProcessors, getMaxUploadProcessorBytes, selectUploadProcessors } from \"../processors\"\nimport {\n  type SessionUser,\n  type UploadChunkDoc,\n  type UploadSessionDoc,\n  buildUploadAccessMetadata,\n  buildUploadsAbility,\n  ensureFilesystemUploadIndexes,\n  ensureUploadIndexes,\n  getBucketName,\n  getModelCtx,\n  getUploadSessionAccessQuery,\n  getTenantId,\n  resolveUploadAccessScope,\n} from \"../shared\"\n\n\nconst waitForStreamFinished = async (stream: NodeJS.WritableStream): Promise<void> => new Promise((resolve, reject) => {\n  stream.once(\"finish\", resolve)\n  stream.once(\"error\", reject)\n})\n\nconst writeToStream = async (stream: NodeJS.WritableStream, chunk: Buffer): Promise<void> => {\n  const ok = stream.write(chunk)\n  if (ok) return\n  await new Promise<void>((resolve, reject) => {\n    const onDrain = () => {\n      cleanup()\n      resolve()\n    }\n\n    const onError = (error: unknown) => {\n      cleanup()\n      reject(error)\n    }\n\n    const cleanup = () => {\n      stream.off(\"drain\", onDrain)\n      stream.off(\"error\", onError)\n    }\n\n    stream.on(\"drain\", onDrain)\n    stream.on(\"error\", onError)\n  })\n}\n\nconst abortUploadStream = async (stream: unknown): Promise<void> => {\n  if (!stream) return\n  if (typeof (stream as { abort?: unknown }).abort === \"function\") {\n    try {\n      await (stream as { abort: () => Promise<void> | void }).abort()\n      return\n    } catch {\n      //\n    }\n  }\n  try {\n    ;(stream as { destroy?: () => void }).destroy?.()\n  } catch {\n    //\n  }\n}\n\nconst isDuplicateKeyError = (error: unknown): boolean => (\n  error !== null &&\n  typeof error === \"object\" &&\n  \"code\" in error &&\n  (error as { code?: unknown }).code === 11000\n)\n\nexport const completeUpload: ApiHandler<Record<string, never>, Uploads.CompleteResponsePayload, SessionUser> = async (\n  _payload,\n  ctx,\n): Promise<Uploads.CompleteResponsePayload> => {\n  const tenantId = getTenantId(ctx)\n  if (!tenantId) {\n    ctx.res.status(400)\n    return { ok: false, error: \"tenant_missing\" }\n  }\n\n  const uploadId = String(ctx.req.params?.uploadId ?? \"\").trim()\n  if (!uploadId) {\n    ctx.res.status(400)\n    return { ok: false, error: \"invalid_upload_id\" }\n  }\n\n  const ability = buildUploadsAbility(ctx, tenantId)\n  const modelCtx = getModelCtx(ctx, tenantId, ability)\n\n  const [UploadSession, UploadChunk] = await Promise.all([\n    models.get(\"RBUploadSession\", modelCtx) as Promise<Model<UploadSessionDoc>>,\n    models.get(\"RBUploadChunk\", modelCtx) as Promise<Model<UploadChunkDoc>>,\n  ])\n\n  if (!ability.can(\"update\", \"RBUploadSession\")) {\n    ctx.res.status(401)\n    return { ok: false, error: \"unauthorized\" }\n  }\n\n  const existing = await UploadSession.findOne({ $and: [{ _id: uploadId }, getUploadSessionAccessQuery(ability, \"read\")] }).lean()\n  if (!existing) {\n    ctx.res.status(404)\n    return { ok: false, error: \"not_found\" }\n  }\n\n  if (existing.status === \"done\" && existing.fileId) {\n    return {\n      ok: true,\n      fileId: existing.fileId,\n      ...(existing.deduplicated ? { deduplicated: true } : {}),\n    }\n  }\n\n  const locked = await UploadSession.findOneAndUpdate(\n    { $and: [{ _id: uploadId }, { status: \"uploading\" }, getUploadSessionAccessQuery(ability, \"update\")] },\n    { $set: { status: \"assembling\" }, $unset: { error: \"\" } },\n    { returnDocument: \"after\" },\n  ).lean()\n\n  if (!locked) {\n    ctx.res.status(409)\n    return { ok: false, error: \"not_uploading\" }\n  }\n\n  await ensureUploadIndexes(modelCtx)\n\n  const fsDb = await getTenantFilesystemDb(tenantId)\n  const nativeDb = fsDb.db\n  if (!nativeDb) {\n    await UploadSession.updateOne(\n      { $and: [{ _id: uploadId }, getUploadSessionAccessQuery(ability, \"update\")] },\n      { $set: { status: \"error\", error: \"filesystem_db_unavailable\" } },\n    )\n    ctx.res.status(500)\n    return { ok: false, error: \"assembly_failed\" }\n  }\n  const bucketName = getBucketName()\n  const bucket = new GridFSBucket(nativeDb, { bucketName })\n  if (locked.deduplication) {\n    await ensureFilesystemUploadIndexes(nativeDb, bucketName)\n  }\n\n  const lockedUserId = typeof locked.userId === \"string\" ? locked.userId : undefined\n  const accessMetadata = buildUploadAccessMetadata(locked)\n  const unclaimedDeduplication = locked.deduplication\n    ? {\n      deduplication: {\n        namespace: locked.deduplication.namespace,\n        algorithm: locked.deduplication.algorithm,\n        hash: locked.deduplication.hash,\n        pipelineVersion: locked.deduplication.pipelineVersion,\n      },\n    }\n    : {}\n  const createFileMetadata = (\n    storedMimeType: string,\n    storedSize: number,\n    additional: Record<string, unknown> = {},\n  ): Record<string, unknown> => ({\n    uploadId,\n    tenantId,\n    mimeType: storedMimeType,\n    totalSize: storedSize,\n    ...additional,\n    ...accessMetadata,\n    ...unclaimedDeduplication,\n  })\n  const maxProcessorBytes = getMaxUploadProcessorBytes()\n  const shouldBufferForProcessing = locked.totalSize <= maxProcessorBytes\n  const declaredMimeType = locked.mimeType.trim().toLowerCase()\n  const declaredSvg = declaredMimeType === \"image/svg+xml\" || locked.filename.trim().toLowerCase().endsWith(\".svg\")\n\n  let uploadStream: NodeJS.WritableStream | null = null\n  let finalFilename = locked.filename\n  let finalMimeType = locked.mimeType\n  let finalSize = locked.totalSize\n  let inlineProcessors: string[] = []\n  let finalMetadata = createFileMetadata(locked.mimeType, locked.totalSize)\n\n  try {\n    if (!shouldBufferForProcessing && declaredSvg) {\n      throw new Error(\"svg_too_large\")\n    }\n\n    const cursor = UploadChunk.find({ uploadId }).sort({ index: 1 }).cursor() as unknown as AsyncIterable<UploadChunkDoc> & {\n      close: () => Promise<void>\n    }\n\n    let expectedIndex = 0\n    let sourceBytes = 0\n    const sourceHasher = locked.deduplication ? createHash(\"sha256\") : null\n    const chunks: Buffer[] = []\n    let bufferedBytes = 0\n\n    const pendingChunks: Buffer[] = []\n    const sniffParts: Buffer[] = []\n    let sniffBytes = 0\n\n    try {\n      for await (const chunkDoc of cursor) {\n        if (chunkDoc.index !== expectedIndex) {\n          throw new Error(\"missing_chunks\")\n        }\n\n        const chunk = chunkDoc.data\n        sourceBytes += chunk.length\n        sourceHasher?.update(chunk)\n\n        if (shouldBufferForProcessing) {\n          chunks.push(chunk)\n          bufferedBytes += chunk.length\n        } else if (!uploadStream) {\n          pendingChunks.push(chunk)\n\n          if (sniffBytes < maxProcessorBytes) {\n            const slice = chunk.subarray(0, Math.min(chunk.length, maxProcessorBytes - sniffBytes))\n            if (slice.length) {\n              sniffParts.push(slice)\n              sniffBytes += slice.length\n            }\n          }\n\n          if (sniffBytes >= maxProcessorBytes) {\n            const sniff = Buffer.concat(sniffParts, sniffBytes)\n            const processors = selectUploadProcessors({\n              filename: locked.filename,\n              clientMimeType: locked.mimeType,\n              totalSize: locked.totalSize,\n              sniff,\n            })\n\n            if (processors.length) {\n              throw new Error(processors.some((processor) => processor.id === \"sanitize-svg\") ? \"svg_too_large\" : \"processor_input_too_large\")\n            }\n\n            finalMetadata = createFileMetadata(locked.mimeType, locked.totalSize)\n            uploadStream = bucket.openUploadStream(locked.filename, {\n              metadata: finalMetadata,\n            })\n\n            for (const pending of pendingChunks) {\n              await writeToStream(uploadStream, pending)\n            }\n            pendingChunks.length = 0\n          }\n        } else {\n          await writeToStream(uploadStream, chunk)\n        }\n\n        expectedIndex += 1\n      }\n    } finally {\n      try {\n        await cursor.close()\n      } catch {\n        //\n      }\n    }\n\n    if (expectedIndex !== locked.chunksTotal) {\n      throw new Error(\"missing_chunks\")\n    }\n\n    if (sourceBytes !== locked.totalSize) {\n      throw new Error(\"invalid_source_size\")\n    }\n\n    if (sourceHasher && sourceHasher.digest(\"hex\") !== locked.deduplication?.hash) {\n      throw new Error(\"content_hash_mismatch\")\n    }\n\n    if (shouldBufferForProcessing) {\n      const assembled = Buffer.concat(chunks, bufferedBytes)\n      const {\n        data: processed,\n        filename: processedFilename,\n        mimeType: processedMimeType,\n        applied,\n        metadata: processedMetadata,\n      } = await applyUploadProcessors(assembled, {\n        filename: locked.filename,\n        clientMimeType: locked.mimeType,\n      })\n\n      finalFilename = processedFilename\n      finalMimeType = processedMimeType\n      finalSize = processed.length\n      inlineProcessors = applied\n      finalMetadata = createFileMetadata(processedMimeType, processed.length, {\n        ...(applied.length ? { processors: applied, sourceTotalSize: locked.totalSize } : {}),\n        ...processedMetadata,\n      })\n      uploadStream = bucket.openUploadStream(finalFilename, {\n        metadata: finalMetadata,\n      })\n\n      const finished = waitForStreamFinished(uploadStream)\n      uploadStream.end(processed)\n      await finished\n    } else {\n      if (!uploadStream) {\n        const sniff = Buffer.concat(sniffParts, sniffBytes)\n        const processors = selectUploadProcessors({\n          filename: locked.filename,\n          clientMimeType: locked.mimeType,\n          totalSize: locked.totalSize,\n          sniff,\n        })\n\n        if (processors.length) {\n          throw new Error(processors.some((processor) => processor.id === \"sanitize-svg\") ? \"svg_too_large\" : \"processor_input_too_large\")\n        }\n\n        finalMetadata = createFileMetadata(locked.mimeType, locked.totalSize)\n        uploadStream = bucket.openUploadStream(locked.filename, {\n          metadata: finalMetadata,\n        })\n\n        for (const pending of pendingChunks) {\n          await writeToStream(uploadStream, pending)\n        }\n        pendingChunks.length = 0\n      }\n\n      const finished = waitForStreamFinished(uploadStream)\n      uploadStream.end()\n      await finished\n    }\n\n    const uploadedBlobId = String((uploadStream as unknown as { id?: unknown }).id ?? \"\")\n    if (!uploadedBlobId) {\n      throw new Error(\"missing_file_id\")\n    }\n\n    let resolvedBlobId = uploadedBlobId\n    let deduplicated = false\n    let returnedFileId: string | null = locked.deduplication ? null : uploadedBlobId\n\n    if (locked.deduplication) {\n      const filesCollection = nativeDb.collection(`${bucketName}.files`)\n      const uploadedBlobObjectId = new ObjectId(uploadedBlobId)\n      const referenceOptions = {\n        tenantId,\n        bucketName,\n        filename: finalFilename,\n        mimeType: finalMimeType,\n        totalSize: finalSize,\n        accessScope: resolveUploadAccessScope({\n          accessScope: locked.accessScope,\n          isPublic: locked.isPublic,\n        }),\n        ...(lockedUserId ? { userId: lockedUserId } : {}),\n        ...(typeof locked.ownerKeyHash === \"string\" ? { ownerKeyHash: locked.ownerKeyHash } : {}),\n      }\n      let lastDuplicateKeyError: unknown = null\n\n      for (let attempt = 0; attempt < 3 && !returnedFileId; attempt += 1) {\n        try {\n          returnedFileId = await claimUploadFileReference({\n            ...referenceOptions,\n            blobId: uploadedBlobObjectId,\n            deduplication: locked.deduplication,\n          })\n          if (!returnedFileId) throw new Error(\"missing_file_id\")\n          finalMetadata = {\n            ...finalMetadata,\n            deduplication: locked.deduplication,\n          }\n          break\n        } catch (error) {\n          if (!isDuplicateKeyError(error)) throw error\n          lastDuplicateKeyError = error\n        }\n\n        const canonicalFile = await filesCollection.findOne(\n          { \"metadata.deduplication.key\": locked.deduplication.key },\n          { projection: { _id: 1 } },\n        )\n        if (!(canonicalFile?._id instanceof ObjectId)) continue\n\n        const canonicalReferenceId = await createUploadFileReference({\n          ...referenceOptions,\n          blobId: canonicalFile._id,\n          deduplicationKey: locked.deduplication.key,\n        })\n        if (!canonicalReferenceId) continue\n\n        await bucket.delete(uploadedBlobObjectId)\n        resolvedBlobId = canonicalFile._id.toHexString()\n        returnedFileId = canonicalReferenceId\n        deduplicated = true\n      }\n\n      if (!returnedFileId) {\n        await bucket.delete(uploadedBlobObjectId)\n        if (lastDuplicateKeyError) throw lastDuplicateKeyError\n      }\n    }\n    if (!returnedFileId) {\n      throw new Error(\"canonical_file_missing\")\n    }\n\n    await UploadSession.updateOne(\n      { $and: [{ _id: uploadId }, getUploadSessionAccessQuery(ability, \"update\")] },\n      {\n        $set: {\n          status: \"done\",\n          fileId: returnedFileId,\n          filename: finalFilename,\n          mimeType: finalMimeType,\n          totalSize: finalSize,\n          ...(deduplicated ? { deduplicated: true } : {}),\n        },\n        $unset: { error: \"\" },\n      },\n    )\n\n    if (!deduplicated) {\n      await enqueueUploadPostProcessors({\n        tenantId,\n        uploadId,\n        fileId: resolvedBlobId,\n        filename: finalFilename,\n        mimeType: finalMimeType,\n        clientMimeType: locked.mimeType,\n        totalSize: finalSize,\n        ...(typeof locked.isPublic === \"boolean\" ? { isPublic: locked.isPublic } : {}),\n        ...(locked.accessScope ? { accessScope: locked.accessScope } : {}),\n        ...(typeof locked.ownerKeyHash === \"string\" ? { ownerKeyHash: locked.ownerKeyHash } : {}),\n        ...(lockedUserId ? { userId: lockedUserId } : {}),\n        inlineProcessors,\n        metadata: finalMetadata,\n      }).catch((error) => {\n        console.error(\"Upload post processor enqueue failed\", {\n          tenantId,\n          uploadId,\n          fileId: resolvedBlobId,\n          error,\n        })\n      })\n    }\n\n    try {\n      await UploadChunk.deleteMany({ uploadId })\n    } catch {\n      //\n    }\n\n    return {\n      ok: true,\n      fileId: returnedFileId,\n      ...(deduplicated ? { deduplicated: true } : {}),\n    }\n  } catch (error) {\n    const message = error instanceof Error ? error.message : String(error)\n\n    await abortUploadStream(uploadStream)\n\n    if (message === \"missing_chunks\") {\n      await UploadSession.updateOne(\n        { $and: [{ _id: uploadId }, getUploadSessionAccessQuery(ability, \"update\")] },\n        { $set: { status: \"uploading\" } },\n      )\n      ctx.res.status(409)\n      return { ok: false, error: \"missing_chunks\" }\n    }\n\n    if (message === \"content_hash_mismatch\") {\n      await UploadSession.updateOne(\n        { $and: [{ _id: uploadId }, getUploadSessionAccessQuery(ability, \"update\")] },\n        { $set: { status: \"error\", error: message } },\n      )\n      ctx.res.status(400)\n      return { ok: false, error: message }\n    }\n\n    if (message === \"svg_too_large\") {\n      await UploadSession.updateOne(\n        { $and: [{ _id: uploadId }, getUploadSessionAccessQuery(ability, \"update\")] },\n        { $set: { status: \"error\", error: message } },\n      )\n      ctx.res.status(413)\n      return { ok: false, error: message }\n    }\n\n    if (message === \"heif_too_large\" || message === \"processor_input_too_large\") {\n      await UploadSession.updateOne(\n        { $and: [{ _id: uploadId }, getUploadSessionAccessQuery(ability, \"update\")] },\n        { $set: { status: \"error\", error: message } },\n      )\n      ctx.res.status(413)\n      return { ok: false, error: message }\n    }\n\n    if (message.startsWith(\"heif_decode_unsupported\")) {\n      await UploadSession.updateOne(\n        { $and: [{ _id: uploadId }, getUploadSessionAccessQuery(ability, \"update\")] },\n        { $set: { status: \"error\", error: message } },\n      )\n      ctx.res.status(415)\n      return { ok: false, error: message }\n    }\n\n    if (message === \"svg_invalid\" || message === \"svg_sanitize_failed\") {\n      await UploadSession.updateOne(\n        { $and: [{ _id: uploadId }, getUploadSessionAccessQuery(ability, \"update\")] },\n        { $set: { status: \"error\", error: message } },\n      )\n      ctx.res.status(400)\n      return { ok: false, error: message }\n    }\n\n    await UploadSession.updateOne(\n      { $and: [{ _id: uploadId }, getUploadSessionAccessQuery(ability, \"update\")] },\n      { $set: { status: \"error\", error: message } },\n    )\n\n    ctx.res.status(500)\n    return { ok: false, error: \"assembly_failed\" }\n  }\n}\n","import { ApiHandler } from \"@rpcbase/api\"\nimport { models } from \"@rpcbase/db\"\nimport type { Model } from \"mongoose\"\n\nimport * as Uploads from \"../index\"\nimport {\n  type SessionUser,\n  type UploadChunkDoc,\n  type UploadSessionDoc,\n  buildUploadsAbility,\n  getModelCtx,\n  getUploadSessionAccessQuery,\n  getTenantId,\n} from \"../shared\"\n\n\nexport const getStatus: ApiHandler<Record<string, never>, Uploads.StatusResponsePayload, SessionUser> = async (\n  _payload,\n  ctx,\n): Promise<Uploads.StatusResponsePayload> => {\n  const tenantId = getTenantId(ctx)\n  if (!tenantId) {\n    ctx.res.status(400)\n    return { ok: false, error: \"tenant_missing\" }\n  }\n\n  const uploadId = String(ctx.req.params?.uploadId ?? \"\").trim()\n  if (!uploadId) {\n    ctx.res.status(400)\n    return { ok: false, error: \"invalid_upload_id\" }\n  }\n\n  const ability = buildUploadsAbility(ctx, tenantId)\n  const modelCtx = getModelCtx(ctx, tenantId, ability)\n\n  const [UploadSession, UploadChunk] = await Promise.all([\n    models.get(\"RBUploadSession\", modelCtx) as Promise<Model<UploadSessionDoc>>,\n    models.get(\"RBUploadChunk\", modelCtx) as Promise<Model<UploadChunkDoc>>,\n  ])\n\n  if (!ability.can(\"read\", \"RBUploadSession\")) {\n    ctx.res.status(401)\n    return { ok: false, error: \"unauthorized\" }\n  }\n\n  const session = await UploadSession.findOne({ $and: [{ _id: uploadId }, getUploadSessionAccessQuery(ability, \"read\")] }).lean()\n  if (!session) {\n    ctx.res.status(404)\n    return { ok: false, error: \"not_found\" }\n  }\n\n  const receivedDocs = await UploadChunk.find(\n    { uploadId },\n    { index: 1, _id: 0 },\n  ).sort({ index: 1 }).lean()\n\n  const received = (receivedDocs as unknown as Array<{ index?: unknown }>)\n    .map((doc) => (typeof doc.index === \"number\" ? doc.index : -1))\n    .filter((n) => Number.isInteger(n) && n >= 0)\n\n  return {\n    ok: true,\n    status: session.status,\n    chunkSize: session.chunkSize,\n    chunksTotal: session.chunksTotal,\n    received,\n    ...(session.fileId ? { fileId: session.fileId } : {}),\n  }\n}\n","import { z } from \"zod\"\n\n\nexport const InitRoute = \"/api/rb/file-uploads\"\nexport const ChunkRoute = \"/api/rb/file-uploads/:uploadId/chunks/:index\"\nexport const StatusRoute = \"/api/rb/file-uploads/:uploadId/status\"\nexport const CompleteRoute = \"/api/rb/file-uploads/:uploadId/complete\"\n\nexport const uploadAccessScopeSchema = z.enum([\"owner\", \"tenant\", \"public\"])\n\nexport const uploadDeduplicationSchema = z.object({\n  namespace: z.string().trim().min(1).max(128).regex(/^[a-z0-9][a-z0-9._:-]*$/i),\n  algorithm: z.literal(\"sha256\"),\n  hash: z.string().trim().regex(/^[a-f0-9]{64}$/i),\n})\n\nexport const initRequestSchema = z.object({\n  filename: z.string().min(1),\n  mimeType: z.string().min(1),\n  isPublic: z.boolean().optional(),\n  accessScope: uploadAccessScopeSchema.optional(),\n  deduplication: uploadDeduplicationSchema.optional(),\n  totalSize: z.number().int().min(1),\n}).superRefine((value, ctx) => {\n  if (value.accessScope !== undefined && value.isPublic !== undefined) {\n    ctx.addIssue({\n      code: \"custom\",\n      message: \"accessScope and isPublic are mutually exclusive\",\n      path: [\"accessScope\"],\n    })\n  }\n})\n\nexport type InitRequestPayload = z.infer<typeof initRequestSchema>\n\nexport const initResponseSchema = z.object({\n  ok: z.boolean(),\n  error: z.string().optional(),\n  uploadId: z.string().optional(),\n  uploadKey: z.string().optional(),\n  chunkSize: z.number().int().optional(),\n  chunksTotal: z.number().int().optional(),\n  fileId: z.string().optional(),\n  deduplicated: z.boolean().optional(),\n})\n\nexport type InitResponsePayload = z.infer<typeof initResponseSchema>\n\nexport const statusResponseSchema = z.object({\n  ok: z.boolean(),\n  error: z.string().optional(),\n  status: z.enum([\"uploading\", \"assembling\", \"done\", \"error\"]).optional(),\n  chunkSize: z.number().int().optional(),\n  chunksTotal: z.number().int().optional(),\n  received: z.array(z.number().int().min(0)).optional(),\n  fileId: z.string().optional(),\n})\n\nexport type StatusResponsePayload = z.infer<typeof statusResponseSchema>\n\nexport const completeResponseSchema = z.object({\n  ok: z.boolean(),\n  error: z.string().optional(),\n  fileId: z.string().optional(),\n  deduplicated: z.boolean().optional(),\n})\n\nexport type CompleteResponsePayload = z.infer<typeof completeResponseSchema>\n","import { randomBytes } from \"node:crypto\"\n\nimport { ApiHandler } from \"@rpcbase/api\"\nimport { getTenantFilesystemDb, models } from \"@rpcbase/db\"\nimport { ObjectId } from \"mongodb\"\nimport type { Model } from \"mongoose\"\n\nimport * as Uploads from \"../index\"\nimport { createUploadFileReference } from \"../fileReferences\"\nimport {\n  type SessionUser,\n  type UploadSessionDoc,\n  buildUploadDeduplication,\n  buildUploadsAbility,\n  computeSha256Hex,\n  ensureFilesystemUploadIndexes,\n  ensureUploadIndexes,\n  getBucketName,\n  getChunkSizeBytes,\n  getModelCtx,\n  getSessionTtlMs,\n  getTenantId,\n  getUserId,\n  resolveUploadAccessScope,\n} from \"../shared\"\n\n\nexport const initUpload: ApiHandler<Uploads.InitRequestPayload, Uploads.InitResponsePayload, SessionUser> = async (\n  payload,\n  ctx,\n): Promise<Uploads.InitResponsePayload> => {\n  const tenantId = getTenantId(ctx)\n  if (!tenantId) {\n    ctx.res.status(400)\n    return { ok: false, error: \"tenant_missing\" }\n  }\n\n  const userId = getUserId(ctx)\n\n  const parsed = Uploads.initRequestSchema.safeParse(payload ?? {})\n  if (!parsed.success) {\n    ctx.res.status(400)\n    return { ok: false, error: \"invalid_payload\" }\n  }\n\n  const { filename, mimeType, totalSize, isPublic, deduplication: requestedDeduplication } = parsed.data\n  const accessScope = resolveUploadAccessScope({ accessScope: parsed.data.accessScope, isPublic })\n  if (accessScope === \"tenant\" && !userId) {\n    ctx.res.status(401)\n    return { ok: false, error: \"authentication_required\" }\n  }\n\n  const uploadKey = userId ? null : randomBytes(32).toString(\"base64url\")\n  const ownerKeyHash = uploadKey ? computeSha256Hex(Buffer.from(uploadKey)) : undefined\n  const deduplication = requestedDeduplication\n    ? buildUploadDeduplication({\n      namespace: requestedDeduplication.namespace,\n      hash: requestedDeduplication.hash,\n      filename,\n      mimeType,\n      totalSize,\n      accessScope,\n      ...(userId ? { userId } : {}),\n      ...(ownerKeyHash ? { ownerKeyHash } : {}),\n    })\n    : null\n\n  if (requestedDeduplication && !deduplication) {\n    ctx.res.status(400)\n    return { ok: false, error: \"deduplication_unavailable\" }\n  }\n\n  if (deduplication) {\n    const fsDb = await getTenantFilesystemDb(tenantId)\n    const nativeDb = fsDb.db\n    if (!nativeDb) {\n      ctx.res.status(500)\n      return { ok: false, error: \"filesystem_db_unavailable\" }\n    }\n\n    const bucketName = getBucketName()\n    await ensureFilesystemUploadIndexes(nativeDb, bucketName)\n    const existingFile = await nativeDb.collection(`${bucketName}.files`).findOne(\n      { \"metadata.deduplication.key\": deduplication.key },\n      { projection: { _id: 1, filename: 1, length: 1, metadata: 1 } },\n    )\n    if (existingFile?._id instanceof ObjectId) {\n      const existingMetadata = existingFile.metadata && typeof existingFile.metadata === \"object\"\n        ? existingFile.metadata as Record<string, unknown>\n        : {}\n      const existingMimeType = typeof existingMetadata.mimeType === \"string\"\n        ? existingMetadata.mimeType\n        : mimeType\n      const existingSize = typeof existingFile.length === \"number\"\n        ? existingFile.length\n        : totalSize\n      const fileId = await createUploadFileReference({\n        tenantId,\n        bucketName,\n        blobId: existingFile._id,\n        filename,\n        mimeType: existingMimeType,\n        totalSize: existingSize,\n        accessScope,\n        ...(userId ? { userId } : {}),\n        ...(ownerKeyHash ? { ownerKeyHash } : {}),\n        deduplicationKey: deduplication.key,\n      })\n      if (fileId) {\n        return {\n          ok: true,\n          fileId,\n          deduplicated: true,\n          ...(uploadKey ? { uploadKey } : {}),\n        }\n      }\n    }\n  }\n\n  const chunkSize = getChunkSizeBytes()\n  const chunksTotal = Math.ceil(totalSize / chunkSize)\n\n  const ability = buildUploadsAbility(ctx, tenantId)\n  const modelCtx = getModelCtx(ctx, tenantId, ability)\n\n  const UploadSession = await models.get(\n    \"RBUploadSession\",\n    modelCtx,\n  ) as Model<UploadSessionDoc>\n\n  await ensureUploadIndexes(modelCtx)\n\n  const uploadId = new ObjectId().toString()\n  const now = Date.now()\n  const expiresAt = new Date(now + getSessionTtlMs())\n\n  await UploadSession.create({\n    _id: uploadId,\n    ...(userId ? { userId } : {}),\n    ...(ownerKeyHash ? { ownerKeyHash } : {}),\n    filename,\n    mimeType,\n    isPublic: accessScope === \"public\",\n    accessScope,\n    ...(deduplication ? { deduplication } : {}),\n    totalSize,\n    chunkSize,\n    chunksTotal,\n    status: \"uploading\",\n    createdAt: new Date(now),\n    expiresAt,\n  })\n\n  return {\n    ok: true,\n    uploadId,\n    chunkSize,\n    chunksTotal,\n    ...(uploadKey ? { uploadKey } : {}),\n  }\n}\n","import { ApiHandler } from \"@rpcbase/api\"\nimport { models } from \"@rpcbase/db\"\nimport type { Model } from \"mongoose\"\n\nimport {\n  type SessionUser,\n  type UploadChunkDoc,\n  type UploadSessionDoc,\n  buildUploadsAbility,\n  computeSha256Hex,\n  ensureUploadIndexes,\n  getModelCtx,\n  getUploadSessionAccessQuery,\n  getTenantId,\n  normalizeSha256Hex,\n  toBufferPayload,\n} from \"../shared\"\n\n\ntype ChunkResponsePayload = {\n  ok: boolean\n  error?: string\n}\n\nexport const uploadChunk: ApiHandler<Buffer, ChunkResponsePayload, SessionUser> = async (\n  payload,\n  ctx,\n): Promise<ChunkResponsePayload> => {\n  const tenantId = getTenantId(ctx)\n  if (!tenantId) {\n    ctx.res.status(400)\n    return { ok: false, error: \"tenant_missing\" }\n  }\n\n  const uploadId = String(ctx.req.params?.uploadId ?? \"\").trim()\n  const indexRaw = String(ctx.req.params?.index ?? \"\").trim()\n  const index = Number(indexRaw)\n\n  if (!uploadId || !Number.isInteger(index) || index < 0) {\n    ctx.res.status(400)\n    return { ok: false, error: \"invalid_chunk_ref\" }\n  }\n\n  const ability = buildUploadsAbility(ctx, tenantId)\n  const modelCtx = getModelCtx(ctx, tenantId, ability)\n\n  const [UploadSession, UploadChunk] = await Promise.all([\n    models.get(\"RBUploadSession\", modelCtx) as Promise<Model<UploadSessionDoc>>,\n    models.get(\"RBUploadChunk\", modelCtx) as Promise<Model<UploadChunkDoc>>,\n  ])\n\n  if (!ability.can(\"update\", \"RBUploadSession\")) {\n    ctx.res.status(401)\n    return { ok: false, error: \"unauthorized\" }\n  }\n\n  const session = await UploadSession.findOne({ $and: [{ _id: uploadId }, getUploadSessionAccessQuery(ability, \"update\")] }).lean()\n  if (!session) {\n    ctx.res.status(404)\n    return { ok: false, error: \"not_found\" }\n  }\n\n  if (session.status !== \"uploading\") {\n    ctx.res.status(409)\n    return { ok: false, error: \"not_uploading\" }\n  }\n\n  if (index >= session.chunksTotal) {\n    ctx.res.status(400)\n    return { ok: false, error: \"index_out_of_range\" }\n  }\n\n  const data = toBufferPayload(payload)\n  if (!data) {\n    ctx.res.status(400)\n    return { ok: false, error: \"invalid_body\" }\n  }\n\n  const expectedSize = index === session.chunksTotal - 1\n    ? session.totalSize - session.chunkSize * (session.chunksTotal - 1)\n    : session.chunkSize\n\n  if (data.length > expectedSize) {\n    ctx.res.status(413)\n    return { ok: false, error: \"chunk_too_large\" }\n  }\n\n  if (data.length !== expectedSize) {\n    ctx.res.status(400)\n    return { ok: false, error: \"invalid_chunk_size\" }\n  }\n\n  const checksumHeader = ctx.req.get(\"X-Chunk-SHA256\")\n  const sha256 = checksumHeader ? computeSha256Hex(data) : undefined\n\n  if (checksumHeader) {\n    const expectedSha256 = normalizeSha256Hex(checksumHeader)\n    if (sha256 !== expectedSha256) {\n      ctx.res.status(400)\n      return { ok: false, error: \"checksum_mismatch\" }\n    }\n  }\n\n  await ensureUploadIndexes(modelCtx)\n\n  await UploadChunk.updateOne(\n    { uploadId, index },\n    {\n      $set: {\n        uploadId,\n        index,\n        data,\n        size: data.length,\n        sha256,\n        expiresAt: session.expiresAt,\n      },\n      $setOnInsert: {\n        createdAt: new Date(),\n      },\n    },\n    { upsert: true },\n  )\n\n  ctx.res.status(204)\n  return { ok: true }\n}\n","export const rawBodyParser = ({\n  limitBytes,\n  maxClientBytesPerSecond,\n}: {\n  limitBytes: number\n  maxClientBytesPerSecond?: number | null\n}) => {\n  return (req: any, res: any, next: any) => {\n    const contentType = typeof req?.headers?.[\"content-type\"] === \"string\"\n      ? String(req.headers[\"content-type\"])\n      : \"\"\n\n    if (!contentType.includes(\"application/octet-stream\")) {\n      next()\n      return\n    }\n\n    let total = 0\n    const chunks: Buffer[] = []\n    let done = false\n    let paused = false\n    let throttleTimeout: ReturnType<typeof setTimeout> | null = null\n\n    const rateBytesPerSecond = typeof maxClientBytesPerSecond === \"number\" && maxClientBytesPerSecond > 0\n      ? maxClientBytesPerSecond\n      : null\n\n    const cleanup = () => {\n      req.off(\"data\", onData)\n      req.off(\"end\", onEnd)\n      req.off(\"error\", onError)\n      req.off(\"aborted\", onAborted)\n      if (throttleTimeout) {\n        clearTimeout(throttleTimeout)\n        throttleTimeout = null\n      }\n    }\n\n    const finish = (error?: unknown) => {\n      if (done) return\n      done = true\n\n      cleanup()\n\n      if (error) {\n        next(error)\n        return\n      }\n\n      req.body = Buffer.concat(chunks, total)\n      next()\n    }\n\n    const onData = (chunk: any) => {\n      if (done) return\n      const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk)\n      total += buffer.length\n\n      if (total > limitBytes) {\n        done = true\n        cleanup()\n        req.destroy()\n        res.status(413).json({ ok: false, error: \"chunk_too_large\" })\n        return\n      }\n\n      chunks.push(buffer)\n\n      if (!rateBytesPerSecond) return\n\n      const now = Date.now()\n      const clientKey = getClientKey(req)\n      const state = getClientRateState(clientKey, rateBytesPerSecond, now)\n      const waitMs = consumeRateBudget(state, buffer.length, rateBytesPerSecond, now)\n\n      if (waitMs > 0 && !paused) {\n        paused = true\n        req.pause()\n        throttleTimeout = setTimeout(() => {\n          throttleTimeout = null\n          paused = false\n          if (done) return\n          try {\n            req.resume()\n          } catch {\n            //\n          }\n        }, waitMs)\n      }\n    }\n\n    const onEnd = () => finish()\n    const onError = (err: unknown) => finish(err)\n    const onAborted = () => finish(new Error(\"request_aborted\"))\n\n    req.on(\"data\", onData)\n    req.on(\"end\", onEnd)\n    req.on(\"error\", onError)\n    req.on(\"aborted\", onAborted)\n  }\n}\n\ntype ClientRateState = {\n  tokens: number\n  lastRefillMs: number\n  lastSeenMs: number\n}\n\nconst MAX_BURST_SECONDS = 1\nconst STALE_CLIENT_MS = 15 * 60 * 1000\n\nconst clientRateStates = new Map<string, ClientRateState>()\nlet lastCleanupMs = 0\n\nconst getClientKey = (req: any): string => {\n  const rawClientIp = typeof req?.clientIp === \"string\" ? req.clientIp : \"\"\n  if (rawClientIp.trim()) return rawClientIp.trim()\n  const rawIp = typeof req?.ip === \"string\" ? req.ip : \"\"\n  return rawIp.trim() || \"unknown\"\n}\n\nconst maybeCleanupStates = (now: number) => {\n  if (now - lastCleanupMs < 60_000) return\n  lastCleanupMs = now\n\n  if (clientRateStates.size < 2000) return\n\n  for (const [key, state] of clientRateStates) {\n    if (now - state.lastSeenMs > STALE_CLIENT_MS) {\n      clientRateStates.delete(key)\n    }\n  }\n}\n\nconst getClientRateState = (key: string, rateBytesPerSecond: number, now: number): ClientRateState => {\n  maybeCleanupStates(now)\n\n  const capacity = rateBytesPerSecond * MAX_BURST_SECONDS\n  const existing = clientRateStates.get(key)\n  if (existing) {\n    existing.lastSeenMs = now\n    existing.tokens = Math.min(capacity, existing.tokens)\n    return existing\n  }\n\n  const next: ClientRateState = {\n    tokens: capacity,\n    lastRefillMs: now,\n    lastSeenMs: now,\n  }\n  clientRateStates.set(key, next)\n  return next\n}\n\nconst consumeRateBudget = (\n  state: ClientRateState,\n  bytes: number,\n  rateBytesPerSecond: number,\n  now: number,\n): number => {\n  const capacity = rateBytesPerSecond * MAX_BURST_SECONDS\n  const elapsedMs = Math.max(0, now - state.lastRefillMs)\n\n  if (elapsedMs > 0) {\n    state.tokens = Math.min(capacity, state.tokens + (elapsedMs * rateBytesPerSecond) / 1000)\n    state.lastRefillMs = now\n  }\n\n  state.tokens -= bytes\n\n  if (state.tokens >= 0) return 0\n  return Math.ceil((-state.tokens / rateBytesPerSecond) * 1000)\n}\n","import { Api } from \"@rpcbase/api\"\n\nimport { completeUpload } from \"./handlers/completeUpload\"\nimport { getStatus } from \"./handlers/getStatus\"\nimport { initUpload } from \"./handlers/initUpload\"\nimport { uploadChunk } from \"./handlers/uploadChunk\"\nimport { rawBodyParser } from \"./middleware/rawBodyParser\"\nimport { getChunkSizeBytes, getMaxClientUploadBytesPerSecond, getRawBodyLimitBytes, type SessionUser } from \"./shared\"\n\nimport * as Uploads from \"./index\"\n\n\nexport default (api: Api<SessionUser>) => {\n  const chunkSizeBytes = getChunkSizeBytes()\n  api.use(\n    Uploads.InitRoute,\n    rawBodyParser({\n      limitBytes: getRawBodyLimitBytes(chunkSizeBytes),\n      maxClientBytesPerSecond: getMaxClientUploadBytesPerSecond(),\n    }),\n  )\n\n  api.post(Uploads.InitRoute, initUpload)\n  api.put(Uploads.ChunkRoute, uploadChunk)\n  api.get(Uploads.StatusRoute, getStatus)\n  api.post(Uploads.CompleteRoute, completeUpload)\n}\n"],"mappings":";;;;;;;;;;;AAMA,IAAM,gBAAgB;AAEtB,IAAM,SAAS,IAAI,MAAM,EAAE,CAAC,CAAC;AAC7B,IAAM,YAAY,gBAAgB,MAAM;AAExC,IAAM,qBAAqB,QAAwB,IAAI,QAAQ,WAAW,EAAE,CAAC,CAAC,UAAU;AAExF,IAAM,oBAAoB,SAA0B;CAClD,MAAM,aAAa,kBAAkB,IAAI;CACzC,IAAI,CAAC,WAAW,WAAW,GAAG,GAAG,OAAO;CACxC,OAAO,gBAAgB,KAAK,UAAU;AACxC;AAEA,IAAa,gBAAgB,UAA2B,iBAAiB,MAAM,SAAS,MAAM,CAAC;AAE/F,IAAa,eAAe,QAC1B,UAAU,SAAS,KAAK,EACtB,cAAc;CAAE,KAAK;CAAM,YAAY;AAAK,EAC9C,CAAC;;;ACCH,IAAa,mBAAmB,OAAO,OAAO,CAAC;CDE7C,IAAI;CACJ,UAAU;CACV,QAAQ,EAAE,YAAY,aAAa,KAAK;CACxC,UAAU,SAA6C;EACrD,IAAI,KAAK,SAAS,eAChB,MAAM,IAAI,MAAM,eAAe;EAGjC,MAAM,UAAU,KAAK,SAAS,MAAM;EACpC,IAAI,CAAC,iBAAiB,OAAO,GAC3B,MAAM,IAAI,MAAM,aAAa;EAG/B,MAAM,YAAY,YAAY,OAAO;EACrC,IAAI,CAAC,UAAU,KAAK,KAAK,CAAC,iBAAiB,SAAS,GAClD,MAAM,IAAI,MAAM,qBAAqB;EAGvC,MAAM,kBAAkB,OAAO,KAAK,WAAW,MAAM;EACrD,IAAI,gBAAgB,SAAS,eAC3B,MAAM,IAAI,MAAM,eAAe;EAGjC,OAAO;GAAE,MAAM;GAAiB,UAAU;EAAgB;CAC5D;AC1B6C,GAAsB,0BAA0B,CAAiC;AAEhI,IAAa,mCACX,iBAAiB,QAAQ,KAAK,cAAc,KAAK,IAAI,KAAK,UAAU,QAAQ,GAAG,CAAC;AAElF,IAAa,0BAA0B,QACrC,iBAAiB,QAAQ,cAAc,UAAU,MAAM,GAAG,CAAC;AAE7D,IAAa,wBAAwB,OACnC,MACA,QACwH;CACxH,IAAI,cAAc;CAClB,IAAI,kBAAkB,IAAI;CAC1B,IAAI,kBAAkB,IAAI;CAC1B,MAAM,UAAoB,CAAC;CAC3B,MAAM,WAAoC,CAAC;CAE3C,KAAK,MAAM,aAAa,kBAAkB;EACxC,MAAM,eAA2C;GAC/C,UAAU;GACV,gBAAgB;GAChB,WAAW,YAAY;GACvB,OAAO;EACT;EAEA,IAAI,CAAC,UAAU,MAAM,YAAY,GAAG;EAEpC,IAAI,YAAY,SAAS,UAAU,UACjC,MAAM,IAAI,MAAM,2BAA2B;EAG7C,MAAM,SAAS,MAAM,UAAU,QAAQ,aAAa,YAAY;EAChE,cAAc,OAAO;EACrB,IAAI,OAAO,OAAO,aAAa,YAAY,OAAO,SAAS,KAAK,GAC9D,kBAAkB,OAAO,SAAS,KAAK;EAEzC,IAAI,OAAO,OAAO,aAAa,YAAY,OAAO,SAAS,KAAK,GAC9D,kBAAkB,OAAO,SAAS,KAAK;EAEzC,IAAI,OAAO,YAAY,OAAO,OAAO,aAAa,UAChD,OAAO,OAAO,UAAU,OAAO,QAAQ;EAEzC,QAAQ,KAAK,UAAU,EAAE;CAC3B;CAEA,OAAO;EACL,MAAM;EACN,UAAU;EACV,UAAU;EACV;EACA;CACF;AACF;;;AChDA,IAAM,wBAAwB,OAAO,WAAiD,IAAI,SAAS,SAAS,WAAW;CACrH,OAAO,KAAK,UAAU,OAAO;CAC7B,OAAO,KAAK,SAAS,MAAM;AAC7B,CAAC;AAED,IAAM,gBAAgB,OAAO,QAA+B,UAAiC;CAE3F,IADW,OAAO,MAAM,KACpB,GAAI;CACR,MAAM,IAAI,SAAe,SAAS,WAAW;EAC3C,MAAM,gBAAgB;GACpB,QAAQ;GACR,QAAQ;EACV;EAEA,MAAM,WAAW,UAAmB;GAClC,QAAQ;GACR,OAAO,KAAK;EACd;EAEA,MAAM,gBAAgB;GACpB,OAAO,IAAI,SAAS,OAAO;GAC3B,OAAO,IAAI,SAAS,OAAO;EAC7B;EAEA,OAAO,GAAG,SAAS,OAAO;EAC1B,OAAO,GAAG,SAAS,OAAO;CAC5B,CAAC;AACH;AAEA,IAAM,oBAAoB,OAAO,WAAmC;CAClE,IAAI,CAAC,QAAQ;CACb,IAAI,OAAQ,OAA+B,UAAU,YACnD,IAAI;EACF,MAAO,OAAiD,MAAM;EAC9D;CACF,QAAQ,CAER;CAEF,IAAI;EACD,OAAqC,UAAU;CAClD,QAAQ,CAER;AACF;AAEA,IAAM,uBAAuB,UAC3B,UAAU,QACV,OAAO,UAAU,YACjB,UAAU,SACT,MAA6B,SAAS;AAGzC,IAAa,iBAAkG,OAC7G,UACA,QAC6C;CAC7C,MAAM,WAAW,YAAY,GAAG;CAChC,IAAI,CAAC,UAAU;EACb,IAAI,IAAI,OAAO,GAAG;EAClB,OAAO;GAAE,IAAI;GAAO,OAAO;EAAiB;CAC9C;CAEA,MAAM,WAAW,OAAO,IAAI,IAAI,QAAQ,YAAY,EAAE,CAAC,CAAC,KAAK;CAC7D,IAAI,CAAC,UAAU;EACb,IAAI,IAAI,OAAO,GAAG;EAClB,OAAO;GAAE,IAAI;GAAO,OAAO;EAAoB;CACjD;CAEA,MAAM,UAAU,oBAAoB,KAAK,QAAQ;CACjD,MAAM,WAAW,YAAY,KAAK,UAAU,OAAO;CAEnD,MAAM,CAAC,eAAe,eAAe,MAAM,QAAQ,IAAI,CACrD,OAAO,IAAI,mBAAmB,QAAQ,GACtC,OAAO,IAAI,iBAAiB,QAAQ,CACtC,CAAC;CAED,IAAI,CAAC,QAAQ,IAAI,UAAU,iBAAiB,GAAG;EAC7C,IAAI,IAAI,OAAO,GAAG;EAClB,OAAO;GAAE,IAAI;GAAO,OAAO;EAAe;CAC5C;CAEA,MAAM,WAAW,MAAM,cAAc,QAAQ,EAAE,MAAM,CAAC,EAAE,KAAK,SAAS,GAAG,4BAA4B,SAAS,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK;CAC/H,IAAI,CAAC,UAAU;EACb,IAAI,IAAI,OAAO,GAAG;EAClB,OAAO;GAAE,IAAI;GAAO,OAAO;EAAY;CACzC;CAEA,IAAI,SAAS,WAAW,UAAU,SAAS,QACzC,OAAO;EACL,IAAI;EACJ,QAAQ,SAAS;EACjB,GAAI,SAAS,eAAe,EAAE,cAAc,KAAK,IAAI,CAAC;CACxD;CAGF,MAAM,SAAS,MAAM,cAAc,iBACjC,EAAE,MAAM;EAAC,EAAE,KAAK,SAAS;EAAG,EAAE,QAAQ,YAAY;EAAG,4BAA4B,SAAS,QAAQ;CAAC,EAAE,GACrG;EAAE,MAAM,EAAE,QAAQ,aAAa;EAAG,QAAQ,EAAE,OAAO,GAAG;CAAE,GACxD,EAAE,gBAAgB,QAAQ,CAC5B,CAAC,CAAC,KAAK;CAEP,IAAI,CAAC,QAAQ;EACX,IAAI,IAAI,OAAO,GAAG;EAClB,OAAO;GAAE,IAAI;GAAO,OAAO;EAAgB;CAC7C;CAEA,MAAM,oBAAoB,QAAQ;CAGlC,MAAM,YAAW,MADE,sBAAsB,QAAQ,EAAA,CAC3B;CACtB,IAAI,CAAC,UAAU;EACb,MAAM,cAAc,UAClB,EAAE,MAAM,CAAC,EAAE,KAAK,SAAS,GAAG,4BAA4B,SAAS,QAAQ,CAAC,EAAE,GAC5E,EAAE,MAAM;GAAE,QAAQ;GAAS,OAAO;EAA4B,EAAE,CAClE;EACA,IAAI,IAAI,OAAO,GAAG;EAClB,OAAO;GAAE,IAAI;GAAO,OAAO;EAAkB;CAC/C;CACA,MAAM,aAAa,cAAc;CACjC,MAAM,SAAS,IAAI,aAAa,UAAU,EAAE,WAAW,CAAC;CACxD,IAAI,OAAO,eACT,MAAM,8BAA8B,UAAU,UAAU;CAG1D,MAAM,eAAe,OAAO,OAAO,WAAW,WAAW,OAAO,SAAS,KAAA;CACzE,MAAM,iBAAiB,0BAA0B,MAAM;CACvD,MAAM,yBAAyB,OAAO,gBAClC,EACA,eAAe;EACb,WAAW,OAAO,cAAc;EAChC,WAAW,OAAO,cAAc;EAChC,MAAM,OAAO,cAAc;EAC3B,iBAAiB,OAAO,cAAc;CACxC,EACF,IACE,CAAC;CACL,MAAM,sBACJ,gBACA,YACA,aAAsC,CAAC,OACV;EAC7B;EACA;EACA,UAAU;EACV,WAAW;EACX,GAAG;EACH,GAAG;EACH,GAAG;CACL;CACA,MAAM,oBAAoB,2BAA2B;CACrD,MAAM,4BAA4B,OAAO,aAAa;CAEtD,MAAM,cADmB,OAAO,SAAS,KAAK,CAAC,CAAC,YAC5B,MAAqB,mBAAmB,OAAO,SAAS,KAAK,CAAC,CAAC,YAAY,CAAC,CAAC,SAAS,MAAM;CAEhH,IAAI,eAA6C;CACjD,IAAI,gBAAgB,OAAO;CAC3B,IAAI,gBAAgB,OAAO;CAC3B,IAAI,YAAY,OAAO;CACvB,IAAI,mBAA6B,CAAC;CAClC,IAAI,gBAAgB,mBAAmB,OAAO,UAAU,OAAO,SAAS;CAExE,IAAI;EACF,IAAI,CAAC,6BAA6B,aAChC,MAAM,IAAI,MAAM,eAAe;EAGjC,MAAM,SAAS,YAAY,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,OAAO;EAIxE,IAAI,gBAAgB;EACpB,IAAI,cAAc;EAClB,MAAM,eAAe,OAAO,gBAAgB,WAAW,QAAQ,IAAI;EACnE,MAAM,SAAmB,CAAC;EAC1B,IAAI,gBAAgB;EAEpB,MAAM,gBAA0B,CAAC;EACjC,MAAM,aAAuB,CAAC;EAC9B,IAAI,aAAa;EAEjB,IAAI;GACF,WAAW,MAAM,YAAY,QAAQ;IACnC,IAAI,SAAS,UAAU,eACrB,MAAM,IAAI,MAAM,gBAAgB;IAGlC,MAAM,QAAQ,SAAS;IACvB,eAAe,MAAM;IACrB,cAAc,OAAO,KAAK;IAE1B,IAAI,2BAA2B;KAC7B,OAAO,KAAK,KAAK;KACjB,iBAAiB,MAAM;IACzB,OAAO,IAAI,CAAC,cAAc;KACxB,cAAc,KAAK,KAAK;KAExB,IAAI,aAAa,mBAAmB;MAClC,MAAM,QAAQ,MAAM,SAAS,GAAG,KAAK,IAAI,MAAM,QAAQ,oBAAoB,UAAU,CAAC;MACtF,IAAI,MAAM,QAAQ;OAChB,WAAW,KAAK,KAAK;OACrB,cAAc,MAAM;MACtB;KACF;KAEA,IAAI,cAAc,mBAAmB;MACnC,MAAM,QAAQ,OAAO,OAAO,YAAY,UAAU;MAClD,MAAM,aAAa,uBAAuB;OACxC,UAAU,OAAO;OACjB,gBAAgB,OAAO;OACvB,WAAW,OAAO;OAClB;MACF,CAAC;MAED,IAAI,WAAW,QACb,MAAM,IAAI,MAAM,WAAW,MAAM,cAAc,UAAU,OAAO,cAAc,IAAI,kBAAkB,2BAA2B;MAGjI,gBAAgB,mBAAmB,OAAO,UAAU,OAAO,SAAS;MACpE,eAAe,OAAO,iBAAiB,OAAO,UAAU,EACtD,UAAU,cACZ,CAAC;MAED,KAAK,MAAM,WAAW,eACpB,MAAM,cAAc,cAAc,OAAO;MAE3C,cAAc,SAAS;KACzB;IACF,OACE,MAAM,cAAc,cAAc,KAAK;IAGzC,iBAAiB;GACnB;EACF,UAAU;GACR,IAAI;IACF,MAAM,OAAO,MAAM;GACrB,QAAQ,CAER;EACF;EAEA,IAAI,kBAAkB,OAAO,aAC3B,MAAM,IAAI,MAAM,gBAAgB;EAGlC,IAAI,gBAAgB,OAAO,WACzB,MAAM,IAAI,MAAM,qBAAqB;EAGvC,IAAI,gBAAgB,aAAa,OAAO,KAAK,MAAM,OAAO,eAAe,MACvE,MAAM,IAAI,MAAM,uBAAuB;EAGzC,IAAI,2BAA2B;GAE7B,MAAM,EACJ,MAAM,WACN,UAAU,mBACV,UAAU,mBACV,SACA,UAAU,sBACR,MAAM,sBAPQ,OAAO,OAAO,QAAQ,aAOR,GAAW;IACzC,UAAU,OAAO;IACjB,gBAAgB,OAAO;GACzB,CAAC;GAED,gBAAgB;GAChB,gBAAgB;GAChB,YAAY,UAAU;GACtB,mBAAmB;GACnB,gBAAgB,mBAAmB,mBAAmB,UAAU,QAAQ;IACtE,GAAI,QAAQ,SAAS;KAAE,YAAY;KAAS,iBAAiB,OAAO;IAAU,IAAI,CAAC;IACnF,GAAG;GACL,CAAC;GACD,eAAe,OAAO,iBAAiB,eAAe,EACpD,UAAU,cACZ,CAAC;GAED,MAAM,WAAW,sBAAsB,YAAY;GACnD,aAAa,IAAI,SAAS;GAC1B,MAAM;EACR,OAAO;GACL,IAAI,CAAC,cAAc;IACjB,MAAM,QAAQ,OAAO,OAAO,YAAY,UAAU;IAClD,MAAM,aAAa,uBAAuB;KACxC,UAAU,OAAO;KACjB,gBAAgB,OAAO;KACvB,WAAW,OAAO;KAClB;IACF,CAAC;IAED,IAAI,WAAW,QACb,MAAM,IAAI,MAAM,WAAW,MAAM,cAAc,UAAU,OAAO,cAAc,IAAI,kBAAkB,2BAA2B;IAGjI,gBAAgB,mBAAmB,OAAO,UAAU,OAAO,SAAS;IACpE,eAAe,OAAO,iBAAiB,OAAO,UAAU,EACtD,UAAU,cACZ,CAAC;IAED,KAAK,MAAM,WAAW,eACpB,MAAM,cAAc,cAAc,OAAO;IAE3C,cAAc,SAAS;GACzB;GAEA,MAAM,WAAW,sBAAsB,YAAY;GACnD,aAAa,IAAI;GACjB,MAAM;EACR;EAEA,MAAM,iBAAiB,OAAQ,aAA6C,MAAM,EAAE;EACpF,IAAI,CAAC,gBACH,MAAM,IAAI,MAAM,iBAAiB;EAGnC,IAAI,iBAAiB;EACrB,IAAI,eAAe;EACnB,IAAI,iBAAgC,OAAO,gBAAgB,OAAO;EAElE,IAAI,OAAO,eAAe;GACxB,MAAM,kBAAkB,SAAS,WAAW,GAAG,WAAW,OAAO;GACjE,MAAM,uBAAuB,IAAI,SAAS,cAAc;GACxD,MAAM,mBAAmB;IACvB;IACA;IACA,UAAU;IACV,UAAU;IACV,WAAW;IACX,aAAa,yBAAyB;KACpC,aAAa,OAAO;KACpB,UAAU,OAAO;IACnB,CAAC;IACD,GAAI,eAAe,EAAE,QAAQ,aAAa,IAAI,CAAC;IAC/C,GAAI,OAAO,OAAO,iBAAiB,WAAW,EAAE,cAAc,OAAO,aAAa,IAAI,CAAC;GACzF;GACA,IAAI,wBAAiC;GAErC,KAAK,IAAI,UAAU,GAAG,UAAU,KAAK,CAAC,gBAAgB,WAAW,GAAG;IAClE,IAAI;KACF,iBAAiB,MAAM,yBAAyB;MAC9C,GAAG;MACH,QAAQ;MACR,eAAe,OAAO;KACxB,CAAC;KACD,IAAI,CAAC,gBAAgB,MAAM,IAAI,MAAM,iBAAiB;KACtD,gBAAgB;MACd,GAAG;MACH,eAAe,OAAO;KACxB;KACA;IACF,SAAS,OAAO;KACd,IAAI,CAAC,oBAAoB,KAAK,GAAG,MAAM;KACvC,wBAAwB;IAC1B;IAEA,MAAM,gBAAgB,MAAM,gBAAgB,QAC1C,EAAE,8BAA8B,OAAO,cAAc,IAAI,GACzD,EAAE,YAAY,EAAE,KAAK,EAAE,EAAE,CAC3B;IACA,IAAI,EAAE,eAAe,eAAe,WAAW;IAE/C,MAAM,uBAAuB,MAAM,0BAA0B;KAC3D,GAAG;KACH,QAAQ,cAAc;KACtB,kBAAkB,OAAO,cAAc;IACzC,CAAC;IACD,IAAI,CAAC,sBAAsB;IAE3B,MAAM,OAAO,OAAO,oBAAoB;IACxC,iBAAiB,cAAc,IAAI,YAAY;IAC/C,iBAAiB;IACjB,eAAe;GACjB;GAEA,IAAI,CAAC,gBAAgB;IACnB,MAAM,OAAO,OAAO,oBAAoB;IACxC,IAAI,uBAAuB,MAAM;GACnC;EACF;EACA,IAAI,CAAC,gBACH,MAAM,IAAI,MAAM,wBAAwB;EAG1C,MAAM,cAAc,UAClB,EAAE,MAAM,CAAC,EAAE,KAAK,SAAS,GAAG,4BAA4B,SAAS,QAAQ,CAAC,EAAE,GAC5E;GACE,MAAM;IACJ,QAAQ;IACR,QAAQ;IACR,UAAU;IACV,UAAU;IACV,WAAW;IACX,GAAI,eAAe,EAAE,cAAc,KAAK,IAAI,CAAC;GAC/C;GACA,QAAQ,EAAE,OAAO,GAAG;EACtB,CACF;EAEA,IAAI,CAAC,cACH,MAAM,4BAA4B;GAChC;GACA;GACA,QAAQ;GACR,UAAU;GACV,UAAU;GACV,gBAAgB,OAAO;GACvB,WAAW;GACX,GAAI,OAAO,OAAO,aAAa,YAAY,EAAE,UAAU,OAAO,SAAS,IAAI,CAAC;GAC5E,GAAI,OAAO,cAAc,EAAE,aAAa,OAAO,YAAY,IAAI,CAAC;GAChE,GAAI,OAAO,OAAO,iBAAiB,WAAW,EAAE,cAAc,OAAO,aAAa,IAAI,CAAC;GACvF,GAAI,eAAe,EAAE,QAAQ,aAAa,IAAI,CAAC;GAC/C;GACA,UAAU;EACZ,CAAC,CAAC,CAAC,OAAO,UAAU;GAClB,QAAQ,MAAM,wCAAwC;IACpD;IACA;IACA,QAAQ;IACR;GACF,CAAC;EACH,CAAC;EAGH,IAAI;GACF,MAAM,YAAY,WAAW,EAAE,SAAS,CAAC;EAC3C,QAAQ,CAER;EAEA,OAAO;GACL,IAAI;GACJ,QAAQ;GACR,GAAI,eAAe,EAAE,cAAc,KAAK,IAAI,CAAC;EAC/C;CACF,SAAS,OAAO;EACd,MAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;EAErE,MAAM,kBAAkB,YAAY;EAEpC,IAAI,YAAY,kBAAkB;GAChC,MAAM,cAAc,UAClB,EAAE,MAAM,CAAC,EAAE,KAAK,SAAS,GAAG,4BAA4B,SAAS,QAAQ,CAAC,EAAE,GAC5E,EAAE,MAAM,EAAE,QAAQ,YAAY,EAAE,CAClC;GACA,IAAI,IAAI,OAAO,GAAG;GAClB,OAAO;IAAE,IAAI;IAAO,OAAO;GAAiB;EAC9C;EAEA,IAAI,YAAY,yBAAyB;GACvC,MAAM,cAAc,UAClB,EAAE,MAAM,CAAC,EAAE,KAAK,SAAS,GAAG,4BAA4B,SAAS,QAAQ,CAAC,EAAE,GAC5E,EAAE,MAAM;IAAE,QAAQ;IAAS,OAAO;GAAQ,EAAE,CAC9C;GACA,IAAI,IAAI,OAAO,GAAG;GAClB,OAAO;IAAE,IAAI;IAAO,OAAO;GAAQ;EACrC;EAEA,IAAI,YAAY,iBAAiB;GAC/B,MAAM,cAAc,UAClB,EAAE,MAAM,CAAC,EAAE,KAAK,SAAS,GAAG,4BAA4B,SAAS,QAAQ,CAAC,EAAE,GAC5E,EAAE,MAAM;IAAE,QAAQ;IAAS,OAAO;GAAQ,EAAE,CAC9C;GACA,IAAI,IAAI,OAAO,GAAG;GAClB,OAAO;IAAE,IAAI;IAAO,OAAO;GAAQ;EACrC;EAEA,IAAI,YAAY,oBAAoB,YAAY,6BAA6B;GAC3E,MAAM,cAAc,UAClB,EAAE,MAAM,CAAC,EAAE,KAAK,SAAS,GAAG,4BAA4B,SAAS,QAAQ,CAAC,EAAE,GAC5E,EAAE,MAAM;IAAE,QAAQ;IAAS,OAAO;GAAQ,EAAE,CAC9C;GACA,IAAI,IAAI,OAAO,GAAG;GAClB,OAAO;IAAE,IAAI;IAAO,OAAO;GAAQ;EACrC;EAEA,IAAI,QAAQ,WAAW,yBAAyB,GAAG;GACjD,MAAM,cAAc,UAClB,EAAE,MAAM,CAAC,EAAE,KAAK,SAAS,GAAG,4BAA4B,SAAS,QAAQ,CAAC,EAAE,GAC5E,EAAE,MAAM;IAAE,QAAQ;IAAS,OAAO;GAAQ,EAAE,CAC9C;GACA,IAAI,IAAI,OAAO,GAAG;GAClB,OAAO;IAAE,IAAI;IAAO,OAAO;GAAQ;EACrC;EAEA,IAAI,YAAY,iBAAiB,YAAY,uBAAuB;GAClE,MAAM,cAAc,UAClB,EAAE,MAAM,CAAC,EAAE,KAAK,SAAS,GAAG,4BAA4B,SAAS,QAAQ,CAAC,EAAE,GAC5E,EAAE,MAAM;IAAE,QAAQ;IAAS,OAAO;GAAQ,EAAE,CAC9C;GACA,IAAI,IAAI,OAAO,GAAG;GAClB,OAAO;IAAE,IAAI;IAAO,OAAO;GAAQ;EACrC;EAEA,MAAM,cAAc,UAClB,EAAE,MAAM,CAAC,EAAE,KAAK,SAAS,GAAG,4BAA4B,SAAS,QAAQ,CAAC,EAAE,GAC5E,EAAE,MAAM;GAAE,QAAQ;GAAS,OAAO;EAAQ,EAAE,CAC9C;EAEA,IAAI,IAAI,OAAO,GAAG;EAClB,OAAO;GAAE,IAAI;GAAO,OAAO;EAAkB;CAC/C;AACF;;;ACrgBA,IAAa,YAA2F,OACtG,UACA,QAC2C;CAC3C,MAAM,WAAW,YAAY,GAAG;CAChC,IAAI,CAAC,UAAU;EACb,IAAI,IAAI,OAAO,GAAG;EAClB,OAAO;GAAE,IAAI;GAAO,OAAO;EAAiB;CAC9C;CAEA,MAAM,WAAW,OAAO,IAAI,IAAI,QAAQ,YAAY,EAAE,CAAC,CAAC,KAAK;CAC7D,IAAI,CAAC,UAAU;EACb,IAAI,IAAI,OAAO,GAAG;EAClB,OAAO;GAAE,IAAI;GAAO,OAAO;EAAoB;CACjD;CAEA,MAAM,UAAU,oBAAoB,KAAK,QAAQ;CACjD,MAAM,WAAW,YAAY,KAAK,UAAU,OAAO;CAEnD,MAAM,CAAC,eAAe,eAAe,MAAM,QAAQ,IAAI,CACrD,OAAO,IAAI,mBAAmB,QAAQ,GACtC,OAAO,IAAI,iBAAiB,QAAQ,CACtC,CAAC;CAED,IAAI,CAAC,QAAQ,IAAI,QAAQ,iBAAiB,GAAG;EAC3C,IAAI,IAAI,OAAO,GAAG;EAClB,OAAO;GAAE,IAAI;GAAO,OAAO;EAAe;CAC5C;CAEA,MAAM,UAAU,MAAM,cAAc,QAAQ,EAAE,MAAM,CAAC,EAAE,KAAK,SAAS,GAAG,4BAA4B,SAAS,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK;CAC9H,IAAI,CAAC,SAAS;EACZ,IAAI,IAAI,OAAO,GAAG;EAClB,OAAO;GAAE,IAAI;GAAO,OAAO;EAAY;CACzC;CAOA,MAAM,YAAY,MALS,YAAY,KACrC,EAAE,SAAS,GACX;EAAE,OAAO;EAAG,KAAK;CAAE,CACrB,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,KAAK,EAAA,CAGvB,KAAK,QAAS,OAAO,IAAI,UAAU,WAAW,IAAI,QAAQ,EAAG,CAAC,CAC9D,QAAQ,MAAM,OAAO,UAAU,CAAC,KAAK,KAAK,CAAC;CAE9C,OAAO;EACL,IAAI;EACJ,QAAQ,QAAQ;EAChB,WAAW,QAAQ;EACnB,aAAa,QAAQ;EACrB;EACA,GAAI,QAAQ,SAAS,EAAE,QAAQ,QAAQ,OAAO,IAAI,CAAC;CACrD;AACF;;;ACjEA,IAAa,YAAY;AACzB,IAAa,aAAa;AAC1B,IAAa,cAAc;AAC3B,IAAa,gBAAgB;AAE7B,IAAa,0BAA0B,MAAO;CAAC;CAAS;CAAU;AAAQ,CAAC;AAE3E,IAAa,4BAA4B,OAAS;CAChD,WAAW,OAAS,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,MAAM,0BAA0B;CAC7E,WAAW,QAAU,QAAQ;CAC7B,MAAM,OAAS,CAAC,CAAC,KAAK,CAAC,CAAC,MAAM,iBAAiB;AACjD,CAAC;AAED,IAAa,oBAAoB,OAAS;CACxC,UAAU,OAAS,CAAC,CAAC,IAAI,CAAC;CAC1B,UAAU,OAAS,CAAC,CAAC,IAAI,CAAC;CAC1B,UAAU,QAAU,CAAC,CAAC,SAAS;CAC/B,aAAa,wBAAwB,SAAS;CAC9C,eAAe,0BAA0B,SAAS;CAClD,WAAW,OAAS,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC;AACnC,CAAC,CAAC,CAAC,aAAa,OAAO,QAAQ;CAC7B,IAAI,MAAM,gBAAgB,KAAA,KAAa,MAAM,aAAa,KAAA,GACxD,IAAI,SAAS;EACX,MAAM;EACN,SAAS;EACT,MAAM,CAAC,aAAa;CACtB,CAAC;AAEL,CAAC;AAIiC,OAAS;CACzC,IAAI,QAAU;CACd,OAAO,OAAS,CAAC,CAAC,SAAS;CAC3B,UAAU,OAAS,CAAC,CAAC,SAAS;CAC9B,WAAW,OAAS,CAAC,CAAC,SAAS;CAC/B,WAAW,OAAS,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS;CACrC,aAAa,OAAS,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS;CACvC,QAAQ,OAAS,CAAC,CAAC,SAAS;CAC5B,cAAc,QAAU,CAAC,CAAC,SAAS;AACrC,CAAC;AAImC,OAAS;CAC3C,IAAI,QAAU;CACd,OAAO,OAAS,CAAC,CAAC,SAAS;CAC3B,QAAQ,MAAO;EAAC;EAAa;EAAc;EAAQ;CAAO,CAAC,CAAC,CAAC,SAAS;CACtE,WAAW,OAAS,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS;CACrC,aAAa,OAAS,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS;CACvC,UAAU,MAAQ,OAAS,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS;CACpD,QAAQ,OAAS,CAAC,CAAC,SAAS;AAC9B,CAAC;AAIqC,OAAS;CAC7C,IAAI,QAAU;CACd,OAAO,OAAS,CAAC,CAAC,SAAS;CAC3B,QAAQ,OAAS,CAAC,CAAC,SAAS;CAC5B,cAAc,QAAU,CAAC,CAAC,SAAS;AACrC,CAAC;;;ACtCD,IAAa,aAA+F,OAC1G,SACA,QACyC;CACzC,MAAM,WAAW,YAAY,GAAG;CAChC,IAAI,CAAC,UAAU;EACb,IAAI,IAAI,OAAO,GAAG;EAClB,OAAO;GAAE,IAAI;GAAO,OAAO;EAAiB;CAC9C;CAEA,MAAM,SAAS,UAAU,GAAG;CAE5B,MAAM,SAAA,kBAAmC,UAAU,WAAW,CAAC,CAAC;CAChE,IAAI,CAAC,OAAO,SAAS;EACnB,IAAI,IAAI,OAAO,GAAG;EAClB,OAAO;GAAE,IAAI;GAAO,OAAO;EAAkB;CAC/C;CAEA,MAAM,EAAE,UAAU,UAAU,WAAW,UAAU,eAAe,2BAA2B,OAAO;CAClG,MAAM,cAAc,yBAAyB;EAAE,aAAa,OAAO,KAAK;EAAa;CAAS,CAAC;CAC/F,IAAI,gBAAgB,YAAY,CAAC,QAAQ;EACvC,IAAI,IAAI,OAAO,GAAG;EAClB,OAAO;GAAE,IAAI;GAAO,OAAO;EAA0B;CACvD;CAEA,MAAM,YAAY,SAAS,OAAO,YAAY,EAAE,CAAC,CAAC,SAAS,WAAW;CACtE,MAAM,eAAe,YAAY,iBAAiB,OAAO,KAAK,SAAS,CAAC,IAAI,KAAA;CAC5E,MAAM,gBAAgB,yBAClB,yBAAyB;EACzB,WAAW,uBAAuB;EAClC,MAAM,uBAAuB;EAC7B;EACA;EACA;EACA;EACA,GAAI,SAAS,EAAE,OAAO,IAAI,CAAC;EAC3B,GAAI,eAAe,EAAE,aAAa,IAAI,CAAC;CACzC,CAAC,IACC;CAEJ,IAAI,0BAA0B,CAAC,eAAe;EAC5C,IAAI,IAAI,OAAO,GAAG;EAClB,OAAO;GAAE,IAAI;GAAO,OAAO;EAA4B;CACzD;CAEA,IAAI,eAAe;EAEjB,MAAM,YAAW,MADE,sBAAsB,QAAQ,EAAA,CAC3B;EACtB,IAAI,CAAC,UAAU;GACb,IAAI,IAAI,OAAO,GAAG;GAClB,OAAO;IAAE,IAAI;IAAO,OAAO;GAA4B;EACzD;EAEA,MAAM,aAAa,cAAc;EACjC,MAAM,8BAA8B,UAAU,UAAU;EACxD,MAAM,eAAe,MAAM,SAAS,WAAW,GAAG,WAAW,OAAO,CAAC,CAAC,QACpE,EAAE,8BAA8B,cAAc,IAAI,GAClD,EAAE,YAAY;GAAE,KAAK;GAAG,UAAU;GAAG,QAAQ;GAAG,UAAU;EAAE,EAAE,CAChE;EACA,IAAI,cAAc,eAAe,UAAU;GACzC,MAAM,mBAAmB,aAAa,YAAY,OAAO,aAAa,aAAa,WAC/E,aAAa,WACb,CAAC;GACL,MAAM,mBAAmB,OAAO,iBAAiB,aAAa,WAC1D,iBAAiB,WACjB;GACJ,MAAM,eAAe,OAAO,aAAa,WAAW,WAChD,aAAa,SACb;GACJ,MAAM,SAAS,MAAM,0BAA0B;IAC7C;IACA;IACA,QAAQ,aAAa;IACrB;IACA,UAAU;IACV,WAAW;IACX;IACA,GAAI,SAAS,EAAE,OAAO,IAAI,CAAC;IAC3B,GAAI,eAAe,EAAE,aAAa,IAAI,CAAC;IACvC,kBAAkB,cAAc;GAClC,CAAC;GACD,IAAI,QACF,OAAO;IACL,IAAI;IACJ;IACA,cAAc;IACd,GAAI,YAAY,EAAE,UAAU,IAAI,CAAC;GACnC;EAEJ;CACF;CAEA,MAAM,YAAY,kBAAkB;CACpC,MAAM,cAAc,KAAK,KAAK,YAAY,SAAS;CAEnD,MAAM,UAAU,oBAAoB,KAAK,QAAQ;CACjD,MAAM,WAAW,YAAY,KAAK,UAAU,OAAO;CAEnD,MAAM,gBAAgB,MAAM,OAAO,IACjC,mBACA,QACF;CAEA,MAAM,oBAAoB,QAAQ;CAElC,MAAM,WAAW,IAAI,SAAS,CAAC,CAAC,SAAS;CACzC,MAAM,MAAM,KAAK,IAAI;CACrB,MAAM,YAAY,IAAI,KAAK,MAAM,gBAAgB,CAAC;CAElD,MAAM,cAAc,OAAO;EACzB,KAAK;EACL,GAAI,SAAS,EAAE,OAAO,IAAI,CAAC;EAC3B,GAAI,eAAe,EAAE,aAAa,IAAI,CAAC;EACvC;EACA;EACA,UAAU,gBAAgB;EAC1B;EACA,GAAI,gBAAgB,EAAE,cAAc,IAAI,CAAC;EACzC;EACA;EACA;EACA,QAAQ;EACR,WAAW,IAAI,KAAK,GAAG;EACvB;CACF,CAAC;CAED,OAAO;EACL,IAAI;EACJ;EACA;EACA;EACA,GAAI,YAAY,EAAE,UAAU,IAAI,CAAC;CACnC;AACF;;;ACxIA,IAAa,cAAqE,OAChF,SACA,QACkC;CAClC,MAAM,WAAW,YAAY,GAAG;CAChC,IAAI,CAAC,UAAU;EACb,IAAI,IAAI,OAAO,GAAG;EAClB,OAAO;GAAE,IAAI;GAAO,OAAO;EAAiB;CAC9C;CAEA,MAAM,WAAW,OAAO,IAAI,IAAI,QAAQ,YAAY,EAAE,CAAC,CAAC,KAAK;CAC7D,MAAM,WAAW,OAAO,IAAI,IAAI,QAAQ,SAAS,EAAE,CAAC,CAAC,KAAK;CAC1D,MAAM,QAAQ,OAAO,QAAQ;CAE7B,IAAI,CAAC,YAAY,CAAC,OAAO,UAAU,KAAK,KAAK,QAAQ,GAAG;EACtD,IAAI,IAAI,OAAO,GAAG;EAClB,OAAO;GAAE,IAAI;GAAO,OAAO;EAAoB;CACjD;CAEA,MAAM,UAAU,oBAAoB,KAAK,QAAQ;CACjD,MAAM,WAAW,YAAY,KAAK,UAAU,OAAO;CAEnD,MAAM,CAAC,eAAe,eAAe,MAAM,QAAQ,IAAI,CACrD,OAAO,IAAI,mBAAmB,QAAQ,GACtC,OAAO,IAAI,iBAAiB,QAAQ,CACtC,CAAC;CAED,IAAI,CAAC,QAAQ,IAAI,UAAU,iBAAiB,GAAG;EAC7C,IAAI,IAAI,OAAO,GAAG;EAClB,OAAO;GAAE,IAAI;GAAO,OAAO;EAAe;CAC5C;CAEA,MAAM,UAAU,MAAM,cAAc,QAAQ,EAAE,MAAM,CAAC,EAAE,KAAK,SAAS,GAAG,4BAA4B,SAAS,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK;CAChI,IAAI,CAAC,SAAS;EACZ,IAAI,IAAI,OAAO,GAAG;EAClB,OAAO;GAAE,IAAI;GAAO,OAAO;EAAY;CACzC;CAEA,IAAI,QAAQ,WAAW,aAAa;EAClC,IAAI,IAAI,OAAO,GAAG;EAClB,OAAO;GAAE,IAAI;GAAO,OAAO;EAAgB;CAC7C;CAEA,IAAI,SAAS,QAAQ,aAAa;EAChC,IAAI,IAAI,OAAO,GAAG;EAClB,OAAO;GAAE,IAAI;GAAO,OAAO;EAAqB;CAClD;CAEA,MAAM,OAAO,gBAAgB,OAAO;CACpC,IAAI,CAAC,MAAM;EACT,IAAI,IAAI,OAAO,GAAG;EAClB,OAAO;GAAE,IAAI;GAAO,OAAO;EAAe;CAC5C;CAEA,MAAM,eAAe,UAAU,QAAQ,cAAc,IACjD,QAAQ,YAAY,QAAQ,aAAa,QAAQ,cAAc,KAC/D,QAAQ;CAEZ,IAAI,KAAK,SAAS,cAAc;EAC9B,IAAI,IAAI,OAAO,GAAG;EAClB,OAAO;GAAE,IAAI;GAAO,OAAO;EAAkB;CAC/C;CAEA,IAAI,KAAK,WAAW,cAAc;EAChC,IAAI,IAAI,OAAO,GAAG;EAClB,OAAO;GAAE,IAAI;GAAO,OAAO;EAAqB;CAClD;CAEA,MAAM,iBAAiB,IAAI,IAAI,IAAI,gBAAgB;CACnD,MAAM,SAAS,iBAAiB,iBAAiB,IAAI,IAAI,KAAA;CAEzD,IAAI,gBAEE;MAAA,WADmB,mBAAmB,cAC3B,GAAgB;GAC7B,IAAI,IAAI,OAAO,GAAG;GAClB,OAAO;IAAE,IAAI;IAAO,OAAO;GAAoB;EACjD;;CAGF,MAAM,oBAAoB,QAAQ;CAElC,MAAM,YAAY,UAChB;EAAE;EAAU;CAAM,GAClB;EACE,MAAM;GACJ;GACA;GACA;GACA,MAAM,KAAK;GACX;GACA,WAAW,QAAQ;EACrB;EACA,cAAc,EACZ,2BAAW,IAAI,KAAK,EACtB;CACF,GACA,EAAE,QAAQ,KAAK,CACjB;CAEA,IAAI,IAAI,OAAO,GAAG;CAClB,OAAO,EAAE,IAAI,KAAK;AACpB;;;AC7HA,IAAa,iBAAiB,EAC5B,YACA,8BAII;CACJ,QAAQ,KAAU,KAAU,SAAc;EAKxC,IAAI,EAJgB,OAAO,KAAK,UAAU,oBAAoB,WAC1D,OAAO,IAAI,QAAQ,eAAe,IAClC,GAAA,CAEa,SAAS,0BAA0B,GAAG;GACrD,KAAK;GACL;EACF;EAEA,IAAI,QAAQ;EACZ,MAAM,SAAmB,CAAC;EAC1B,IAAI,OAAO;EACX,IAAI,SAAS;EACb,IAAI,kBAAwD;EAE5D,MAAM,qBAAqB,OAAO,4BAA4B,YAAY,0BAA0B,IAChG,0BACA;EAEJ,MAAM,gBAAgB;GACpB,IAAI,IAAI,QAAQ,MAAM;GACtB,IAAI,IAAI,OAAO,KAAK;GACpB,IAAI,IAAI,SAAS,OAAO;GACxB,IAAI,IAAI,WAAW,SAAS;GAC5B,IAAI,iBAAiB;IACnB,aAAa,eAAe;IAC5B,kBAAkB;GACpB;EACF;EAEA,MAAM,UAAU,UAAoB;GAClC,IAAI,MAAM;GACV,OAAO;GAEP,QAAQ;GAER,IAAI,OAAO;IACT,KAAK,KAAK;IACV;GACF;GAEA,IAAI,OAAO,OAAO,OAAO,QAAQ,KAAK;GACtC,KAAK;EACP;EAEA,MAAM,UAAU,UAAe;GAC7B,IAAI,MAAM;GACV,MAAM,SAAS,OAAO,SAAS,KAAK,IAAI,QAAQ,OAAO,KAAK,KAAK;GACjE,SAAS,OAAO;GAEhB,IAAI,QAAQ,YAAY;IACtB,OAAO;IACP,QAAQ;IACR,IAAI,QAAQ;IACZ,IAAI,OAAO,GAAG,CAAC,CAAC,KAAK;KAAE,IAAI;KAAO,OAAO;IAAkB,CAAC;IAC5D;GACF;GAEA,OAAO,KAAK,MAAM;GAElB,IAAI,CAAC,oBAAoB;GAEzB,MAAM,MAAM,KAAK,IAAI;GAGrB,MAAM,SAAS,kBADD,mBADI,aAAa,GACE,GAAW,oBAAoB,GAC/B,GAAO,OAAO,QAAQ,oBAAoB,GAAG;GAE9E,IAAI,SAAS,KAAK,CAAC,QAAQ;IACzB,SAAS;IACT,IAAI,MAAM;IACV,kBAAkB,iBAAiB;KACjC,kBAAkB;KAClB,SAAS;KACT,IAAI,MAAM;KACV,IAAI;MACF,IAAI,OAAO;KACb,QAAQ,CAER;IACF,GAAG,MAAM;GACX;EACF;EAEA,MAAM,cAAc,OAAO;EAC3B,MAAM,WAAW,QAAiB,OAAO,GAAG;EAC5C,MAAM,kBAAkB,uBAAO,IAAI,MAAM,iBAAiB,CAAC;EAE3D,IAAI,GAAG,QAAQ,MAAM;EACrB,IAAI,GAAG,OAAO,KAAK;EACnB,IAAI,GAAG,SAAS,OAAO;EACvB,IAAI,GAAG,WAAW,SAAS;CAC7B;AACF;AAQA,IAAM,oBAAoB;AAC1B,IAAM,kBAAkB;AAExB,IAAM,mCAAmB,IAAI,IAA6B;AAC1D,IAAI,gBAAgB;AAEpB,IAAM,gBAAgB,QAAqB;CACzC,MAAM,cAAc,OAAO,KAAK,aAAa,WAAW,IAAI,WAAW;CACvE,IAAI,YAAY,KAAK,GAAG,OAAO,YAAY,KAAK;CAEhD,QADc,OAAO,KAAK,OAAO,WAAW,IAAI,KAAK,GAAA,CACxC,KAAK,KAAK;AACzB;AAEA,IAAM,sBAAsB,QAAgB;CAC1C,IAAI,MAAM,gBAAgB,KAAQ;CAClC,gBAAgB;CAEhB,IAAI,iBAAiB,OAAO,KAAM;CAElC,KAAK,MAAM,CAAC,KAAK,UAAU,kBACzB,IAAI,MAAM,MAAM,aAAa,iBAC3B,iBAAiB,OAAO,GAAG;AAGjC;AAEA,IAAM,sBAAsB,KAAa,oBAA4B,QAAiC;CACpG,mBAAmB,GAAG;CAEtB,MAAM,WAAW,qBAAqB;CACtC,MAAM,WAAW,iBAAiB,IAAI,GAAG;CACzC,IAAI,UAAU;EACZ,SAAS,aAAa;EACtB,SAAS,SAAS,KAAK,IAAI,UAAU,SAAS,MAAM;EACpD,OAAO;CACT;CAEA,MAAM,OAAwB;EAC5B,QAAQ;EACR,cAAc;EACd,YAAY;CACd;CACA,iBAAiB,IAAI,KAAK,IAAI;CAC9B,OAAO;AACT;AAEA,IAAM,qBACJ,OACA,OACA,oBACA,QACW;CACX,MAAM,WAAW,qBAAqB;CACtC,MAAM,YAAY,KAAK,IAAI,GAAG,MAAM,MAAM,YAAY;CAEtD,IAAI,YAAY,GAAG;EACjB,MAAM,SAAS,KAAK,IAAI,UAAU,MAAM,SAAU,YAAY,qBAAsB,GAAI;EACxF,MAAM,eAAe;CACvB;CAEA,MAAM,UAAU;CAEhB,IAAI,MAAM,UAAU,GAAG,OAAO;CAC9B,OAAO,KAAK,KAAM,CAAC,MAAM,SAAS,qBAAsB,GAAI;AAC9D;;;AChKA,IAAA,mBAAgB,QAA0B;CACxC,MAAM,iBAAiB,kBAAkB;CACzC,IAAI,IACF,WACA,cAAc;EACZ,YAAY,qBAAqB,cAAc;EAC/C,yBAAyB,iCAAiC;CAC5D,CAAC,CACH;CAEA,IAAI,KAAK,WAAmB,UAAU;CACtC,IAAI,IAAI,YAAoB,WAAW;CACvC,IAAI,IAAI,aAAqB,SAAS;CACtC,IAAI,KAAK,eAAuB,cAAc;AAChD"}

package/dist/{handler-C34TFH28.js → handler-Dy_L6_-U.js}

@@ -125,13 +125,44 @@ var deleteFile = async (_payload, ctx) => {
 	return { ok: true };
 };
 //#endregion
+//#region src/uploads/fileContentHeaders.ts
+var inlineMimeTypes = /* @__PURE__ */ new Set([
+	"image/png",
+	"image/jpeg",
+	"image/gif",
+	"image/webp",
+	"image/avif",
+	"image/bmp",
+	"image/x-icon",
+	"image/svg+xml",
+	"text/plain",
+	"audio/mpeg",
+	"audio/ogg",
+	"audio/wav",
+	"audio/webm",
+	"audio/mp4",
+	"video/mp4",
+	"video/webm",
+	"video/ogg"
+]);
+var getFileContentHeaders = (mimeType, filename) => {
+	const normalizedMimeType = mimeType.split(";")[0].trim().toLowerCase();
+	const inline = inlineMimeTypes.has(normalizedMimeType);
+	const safeFilename = filename.replace(/[^\x20-\x7e]|[\\"]/g, "_");
+	return {
+		"Content-Type": inline ? normalizedMimeType : "application/octet-stream",
+		"Content-Disposition": `${inline ? "inline" : "attachment"}; filename="${safeFilename}"; filename*=UTF-8''${encodeURIComponent(Buffer.from(filename).toString("utf8")).replace(/['()*]/g, (character) => `%${character.charCodeAt(0).toString(16).toUpperCase()}`)}`,
+		"X-Content-Type-Options": "nosniff",
+		"Content-Security-Policy": "default-src 'none'; style-src 'unsafe-inline'; sandbox; base-uri 'none'; form-action 'none'"
+	};
+};
+//#endregion
 //#region src/uploads/api/files/handlers/getFile.ts
 var resolveHeaderString = (value) => {
 	if (typeof value !== "string") return null;
 	const normalized = value.trim();
 	return normalized ? normalized : null;
 };
-var escapeHeaderFilename = (filename) => filename.replace(/[\\"]/g, "_");
 var parseRequestedWidth = (value) => {
 	if (typeof value !== "string") return null;
 	const parsed = Number(value.trim());
@@ -234,12 +265,13 @@ var getFile = async (_payload, ctx) => {
 	const selectedFileObjectId = variantFile ? variantFileObjectId : blobObjectId;
 	const selectedFile = variantFile ?? file;
 	const mimeType = resolveHeaderString(selectedFile?.metadata?.mimeType) ?? "application/octet-stream";
-	const filenameSafe = escapeHeaderFilename(resolveHeaderString(reference?.filename ?? selectedFile?.filename) ?? fileIdRaw);
+	const filename = resolveHeaderString(reference?.filename ?? selectedFile?.filename) ?? fileIdRaw;
+	for (const [name, value] of Object.entries(getFileContentHeaders(mimeType, filename))) ctx.res.setHeader(name, value);
 	const cacheControl = "private, max-age=0, must-revalidate";
 	const md5 = resolveHeaderString(selectedFile?.md5);
 	const uploadDate = selectedFile?.uploadDate instanceof Date ? selectedFile.uploadDate : null;
 	const etagValue = md5 ?? `${selectedFileObjectId.toHexString()}-${String(selectedFile?.length ?? 0)}-${String(uploadDate?.getTime() ?? 0)}`;
-	const etag = md5 ? `"${etagValue}"` : `W/"${etagValue}"`;
+	const etag = md5 ? `"${etagValue}-safe-v1"` : `W/"${etagValue}-safe-v1"`;
 	const ifNoneMatch = resolveHeaderString(ctx.req.headers?.["if-none-match"]);
 	if (ifNoneMatch) {
 		const candidates = ifNoneMatch.split(",").map((value) => value.trim()).filter(Boolean);
@@ -252,13 +284,9 @@ var getFile = async (_payload, ctx) => {
 		}
 	}
 	ctx.res.status(200);
-	ctx.res.setHeader("Content-Type", mimeType);
 	ctx.res.setHeader("Content-Length", String(selectedFile?.length ?? 0));
-	ctx.res.setHeader("Content-Disposition", `inline; filename="${filenameSafe}"`);
 	ctx.res.setHeader("Cache-Control", cacheControl);
 	ctx.res.setHeader("ETag", etag);
-	ctx.res.setHeader("X-Content-Type-Options", "nosniff");
-	if (mimeType === "image/svg+xml") ctx.res.setHeader("Content-Security-Policy", "default-src 'none'; style-src 'unsafe-inline'; sandbox; base-uri 'none'; form-action 'none'");
 	ctx.res.flushHeaders();
 	if (ctx.req.method === "HEAD") {
 		ctx.res.end();
@@ -285,4 +313,4 @@ var handler_default = (api) => {
 //#endregion
 export { handler_default as default };
 
-//# sourceMappingURL=handler-C34TFH28.js.map
+//# sourceMappingURL=handler-Dy_L6_-U.js.map

package/dist/handler-Dy_L6_-U.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"handler-Dy_L6_-U.js","names":[],"sources":["../src/uploads/api/files/handlers/deleteFile.ts","../src/uploads/fileContentHeaders.ts","../src/uploads/api/files/handlers/getFile.ts","../src/uploads/api/files/index.ts","../src/uploads/api/files/handler.ts"],"sourcesContent":["import { ApiHandler } from \"@rpcbase/api\"\nimport { getTenantFilesystemDb } from \"@rpcbase/db\"\nimport { GridFSBucket, ObjectId } from \"mongodb\"\n\nimport {\n  deleteUploadFileReference,\n  findUploadFileReference,\n} from \"../../file-uploads/fileReferences\"\nimport {\n  getBucketName,\n  getTenantId,\n  getUploadKeyHash,\n  getUserId,\n  resolveStoredUploadAccessScope,\n  type SessionUser,\n} from \"../../file-uploads/shared\"\n\n\ntype DeleteResponsePayload = {\n  ok: boolean\n  error?: string\n}\n\nconst resolveHeaderString = (value: unknown): string | null => {\n  if (typeof value !== \"string\") return null\n  const normalized = value.trim()\n  return normalized ? normalized : null\n}\n\nconst isFileNotFoundError = (error: unknown): boolean => {\n  const message = error instanceof Error ? error.message : String(error)\n  return message.includes(\"FileNotFound\")\n}\n\nconst deleteGridFsFile = async (bucket: GridFSBucket, fileId: ObjectId): Promise<void> => {\n  try {\n    await bucket.delete(fileId)\n  } catch (error) {\n    if (!isFileNotFoundError(error)) throw error\n  }\n}\n\nexport const deleteFile: ApiHandler<Record<string, never>, DeleteResponsePayload, SessionUser> = async (\n  _payload,\n  ctx,\n): Promise<DeleteResponsePayload> => {\n  const tenantId = getTenantId(ctx)\n  if (!tenantId) {\n    ctx.res.status(400)\n    return { ok: false, error: \"tenant_missing\" }\n  }\n\n  const fileIdRaw = String(ctx.req.params?.fileId ?? \"\").trim()\n  let fileObjectId: ObjectId\n  try {\n    fileObjectId = new ObjectId(fileIdRaw)\n  } catch {\n    ctx.res.status(400)\n    return { ok: false, error: \"invalid_file_id\" }\n  }\n\n  const fsDb = await getTenantFilesystemDb(tenantId)\n  const nativeDb = fsDb.db\n  if (!nativeDb) {\n    ctx.res.status(500)\n    return { ok: false, error: \"filesystem_db_unavailable\" }\n  }\n\n  const bucketName = getBucketName()\n  const bucket = new GridFSBucket(nativeDb, { bucketName })\n\n  const userId = getUserId(ctx)\n  const uploadKeyHash = getUploadKeyHash(ctx)\n  if (!userId && !uploadKeyHash) {\n    ctx.res.status(401)\n    return { ok: false, error: \"unauthorized\" }\n  }\n\n  const reference = await findUploadFileReference(nativeDb, bucketName, fileObjectId)\n  if (reference) {\n    const referenceMetadata = reference as unknown as Record<string, unknown>\n    const metadataUserId = resolveHeaderString(reference.userId)\n    const ownerKeyHash = resolveHeaderString(reference.ownerKeyHash)\n    const accessScope = resolveStoredUploadAccessScope(referenceMetadata)\n\n    const authorizedByUser = Boolean(userId && metadataUserId && userId === metadataUserId)\n    const authorizedByKey = Boolean(uploadKeyHash && ownerKeyHash && uploadKeyHash === ownerKeyHash)\n    const authorizedByTenant = accessScope === \"tenant\" && Boolean(userId)\n\n    if (!authorizedByUser && !authorizedByKey && !authorizedByTenant) {\n      ctx.res.status(401)\n      return { ok: false, error: \"unauthorized\" }\n    }\n\n    try {\n      await deleteUploadFileReference({\n        tenantId,\n        bucketName,\n        referenceId: fileObjectId,\n      })\n    } catch {\n      ctx.res.status(500)\n      return { ok: false, error: \"delete_failed\" }\n    }\n\n    ctx.res.status(204)\n    return { ok: true }\n  }\n\n  const [file] = await bucket.find({ _id: fileObjectId }).limit(1).toArray()\n  if (!file) {\n    ctx.res.status(204)\n    return { ok: true }\n  }\n\n  const metadataUserId = resolveHeaderString((file as any)?.metadata?.userId)\n  const ownerKeyHash = resolveHeaderString((file as any)?.metadata?.ownerKeyHash)\n  const rawMetadata = (file as any)?.metadata\n  const fileMetadata = rawMetadata && typeof rawMetadata === \"object\"\n    ? rawMetadata as Record<string, unknown>\n    : {}\n  const accessScope = resolveStoredUploadAccessScope(fileMetadata)\n\n  const authorizedByUser = Boolean(userId && metadataUserId && userId === metadataUserId)\n  const authorizedByKey = Boolean(uploadKeyHash && ownerKeyHash && uploadKeyHash === ownerKeyHash)\n  const authorizedByTenant = accessScope === \"tenant\" && Boolean(userId)\n\n  if (!authorizedByUser && !authorizedByKey && !authorizedByTenant) {\n    ctx.res.status(401)\n    return { ok: false, error: \"unauthorized\" }\n  }\n\n  if (fileMetadata.deduplication && typeof fileMetadata.deduplication === \"object\") {\n    ctx.res.status(409)\n    return { ok: false, error: \"file_reference_required\" }\n  }\n\n  try {\n    const variants = await bucket.find({ \"metadata.variantOf\": fileObjectId.toHexString() }).toArray()\n    const variantIds = variants\n      .map((variant) => (variant as any)?._id)\n      .filter((id): id is ObjectId => id instanceof ObjectId)\n\n    await deleteGridFsFile(bucket, fileObjectId)\n    for (const variantId of variantIds) {\n      await deleteGridFsFile(bucket, variantId)\n    }\n  } catch {\n    ctx.res.status(500)\n    return { ok: false, error: \"delete_failed\" }\n  }\n\n  ctx.res.status(204)\n  return { ok: true }\n}\n","const inlineMimeTypes = new Set([\n  \"image/png\", \"image/jpeg\", \"image/gif\", \"image/webp\", \"image/avif\", \"image/bmp\", \"image/x-icon\",\n  \"image/svg+xml\", \"text/plain\",\n  \"audio/mpeg\", \"audio/ogg\", \"audio/wav\", \"audio/webm\", \"audio/mp4\",\n  \"video/mp4\", \"video/webm\", \"video/ogg\",\n])\n\nexport const getFileContentHeaders = (mimeType: string, filename: string): Record<string, string> => {\n  const normalizedMimeType = mimeType.split(\";\")[0].trim().toLowerCase()\n  const inline = inlineMimeTypes.has(normalizedMimeType)\n  const safeFilename = filename.replace(/[^\\x20-\\x7e]|[\\\\\"]/g, \"_\")\n\n  return {\n    \"Content-Type\": inline ? normalizedMimeType : \"application/octet-stream\",\n    \"Content-Disposition\": `${inline ? \"inline\" : \"attachment\"}; filename=\"${safeFilename}\"; filename*=UTF-8''${encodeURIComponent(Buffer.from(filename).toString(\"utf8\")).replace(/['()*]/g, (character) => `%${character.charCodeAt(0).toString(16).toUpperCase()}`)}`,\n    \"X-Content-Type-Options\": \"nosniff\",\n    \"Content-Security-Policy\": \"default-src 'none'; style-src 'unsafe-inline'; sandbox; base-uri 'none'; form-action 'none'\",\n  }\n}\n","import { ApiHandler } from \"@rpcbase/api\"\nimport { getTenantFilesystemDb } from \"@rpcbase/db\"\nimport { GridFSBucket, ObjectId } from \"mongodb\"\n\nimport { getFileContentHeaders } from \"../../../fileContentHeaders\"\nimport { findUploadFileReference } from \"../../file-uploads/fileReferences\"\nimport {\n  getBucketName,\n  getTenantId,\n  getUploadKeyHash,\n  getUserId,\n  resolveStoredUploadAccessScope,\n  type SessionUser,\n} from \"../../file-uploads/shared\"\n\n\nconst resolveHeaderString = (value: unknown): string | null => {\n  if (typeof value !== \"string\") return null\n  const normalized = value.trim()\n  return normalized ? normalized : null\n}\n\nconst parseRequestedWidth = (value: unknown): number | null => {\n  if (typeof value !== \"string\") return null\n  const parsed = Number(value.trim())\n  if (!Number.isFinite(parsed) || parsed <= 0) return null\n  return Math.floor(parsed)\n}\n\nconst resolveImageVariants = (file: unknown): Record<string, unknown> | null => {\n  const metadata = (file as any)?.metadata\n  if (!metadata || typeof metadata !== \"object\") return null\n  const image = (metadata as Record<string, unknown>).image\n  if (!image || typeof image !== \"object\") return null\n  const variants = (image as Record<string, unknown>).variants\n  if (!variants || typeof variants !== \"object\") return null\n  return variants as Record<string, unknown>\n}\n\nconst resolveVariantFileId = (variant: unknown): ObjectId | null => {\n  if (!variant || typeof variant !== \"object\") return null\n  const fileId = (variant as Record<string, unknown>).fileId\n  if (typeof fileId !== \"string\") return null\n  try {\n    return new ObjectId(fileId)\n  } catch {\n    return null\n  }\n}\n\nconst selectVariantFileId = (file: unknown, requestedWidth: number | null, requestedVariant: unknown): ObjectId | null => {\n  const variants = resolveImageVariants(file)\n  if (!variants) return null\n\n  let aliasWidth: number | null = null\n  if (typeof requestedVariant === \"string\") {\n    const normalized = requestedVariant.trim().toLowerCase()\n    aliasWidth = normalized === \"thumb\" ? 320 : normalized === \"small\" ? 640 : normalized === \"medium\" ? 960 : normalized === \"large\" ? 1600 : null\n    if (aliasWidth) {\n      const variantFileId = resolveVariantFileId(variants[String(aliasWidth)])\n      if (variantFileId) return variantFileId\n    }\n  }\n\n  const targetWidth = aliasWidth ?? requestedWidth\n  if (!targetWidth) return null\n\n  const widths = Object.keys(variants)\n    .map((width) => Number(width))\n    .filter((width) => Number.isInteger(width) && width > 0)\n    .sort((a, b) => a - b)\n\n  const selectedWidth = widths.reduce<number | null>((selected, width) => {\n    if (selected === null) return width\n\n    const selectedDistance = Math.abs(selected - targetWidth)\n    const distance = Math.abs(width - targetWidth)\n    if (distance < selectedDistance) return width\n    if (distance === selectedDistance && width > selected) return width\n    return selected\n  }, null)\n  return selectedWidth ? resolveVariantFileId(variants[String(selectedWidth)]) : null\n}\n\nexport const getFile: ApiHandler<Record<string, never>, Record<string, never>, SessionUser> = async (\n  _payload,\n  ctx,\n): Promise<Record<string, never>> => {\n  const tenantId = getTenantId(ctx)\n  if (!tenantId) {\n    ctx.res.status(400).end()\n    return {}\n  }\n\n  const fileIdRaw = String(ctx.req.params?.fileId ?? \"\").trim()\n  let fileObjectId: ObjectId\n  try {\n    fileObjectId = new ObjectId(fileIdRaw)\n  } catch {\n    ctx.res.status(400).end()\n    return {}\n  }\n\n  const fsDb = await getTenantFilesystemDb(tenantId)\n  const nativeDb = fsDb.db\n  if (!nativeDb) {\n    ctx.res.status(500).end()\n    return {}\n  }\n\n  const bucketName = getBucketName()\n  const bucket = new GridFSBucket(nativeDb, { bucketName })\n  const reference = await findUploadFileReference(nativeDb, bucketName, fileObjectId)\n  const blobObjectId = reference?.blobId ?? fileObjectId\n\n  const [file] = await bucket.find({ _id: blobObjectId }).limit(1).toArray()\n  if (!file) {\n    ctx.res.status(404).end()\n    return {}\n  }\n\n  const rawMetadata = reference ?? (file as any)?.metadata\n  const fileMetadata = rawMetadata && typeof rawMetadata === \"object\"\n    ? rawMetadata as Record<string, unknown>\n    : {}\n  const accessScope = resolveStoredUploadAccessScope(fileMetadata)\n  if (accessScope !== \"public\") {\n    const userId = getUserId(ctx)\n    if (accessScope === \"tenant\") {\n      if (!userId) {\n        ctx.res.status(401).end()\n        return {}\n      }\n    } else {\n      const uploadKeyHash = getUploadKeyHash(ctx)\n      const metadataUserId = resolveHeaderString(fileMetadata.userId)\n      const ownerKeyHash = resolveHeaderString(fileMetadata.ownerKeyHash)\n\n      const authorizedByUser = Boolean(userId && metadataUserId && userId === metadataUserId)\n      const authorizedByKey = Boolean(uploadKeyHash && ownerKeyHash && uploadKeyHash === ownerKeyHash)\n\n      if (!authorizedByUser && !authorizedByKey) {\n        ctx.res.status(401).end()\n        return {}\n      }\n    }\n  }\n\n  const requestedWidth = parseRequestedWidth((ctx.req.query as any)?.w)\n  const variantFileObjectId = selectVariantFileId(file, requestedWidth, (ctx.req.query as any)?.variant)\n  const [variantFile] = variantFileObjectId\n    ? await bucket.find({ _id: variantFileObjectId }).limit(1).toArray()\n    : []\n  const selectedFileObjectId = variantFile ? variantFileObjectId as ObjectId : blobObjectId\n  const selectedFile = variantFile ?? file\n\n  const mimeTypeFromMetadata = resolveHeaderString((selectedFile as any)?.metadata?.mimeType)\n  const mimeType = mimeTypeFromMetadata ?? \"application/octet-stream\"\n  const filenameFromDb = resolveHeaderString(reference?.filename ?? (selectedFile as any)?.filename)\n  const filename = filenameFromDb ?? fileIdRaw\n  for (const [name, value] of Object.entries(getFileContentHeaders(mimeType, filename))) {\n    ctx.res.setHeader(name, value)\n  }\n\n  const cacheControl = \"private, max-age=0, must-revalidate\"\n  const md5 = resolveHeaderString((selectedFile as any)?.md5)\n  const uploadDate = (selectedFile as any)?.uploadDate instanceof Date ? (selectedFile as any).uploadDate : null\n  const etagValue = md5 ?? `${selectedFileObjectId.toHexString()}-${String((selectedFile as any)?.length ?? 0)}-${String(uploadDate?.getTime() ?? 0)}`\n  const etag = md5 ? `\"${etagValue}-safe-v1\"` : `W/\"${etagValue}-safe-v1\"`\n  const ifNoneMatch = resolveHeaderString((ctx.req.headers as any)?.[\"if-none-match\"])\n  if (ifNoneMatch) {\n    const candidates = ifNoneMatch.split(\",\").map((value) => value.trim()).filter(Boolean)\n    if (candidates.includes(\"*\") || candidates.includes(etag)) {\n      ctx.res.status(304)\n      ctx.res.setHeader(\"Cache-Control\", cacheControl)\n      ctx.res.setHeader(\"ETag\", etag)\n      ctx.res.end()\n      return {}\n    }\n  }\n\n  ctx.res.status(200)\n  ctx.res.setHeader(\"Content-Length\", String((selectedFile as any)?.length ?? 0))\n  ctx.res.setHeader(\"Cache-Control\", cacheControl)\n  ctx.res.setHeader(\"ETag\", etag)\n  ctx.res.flushHeaders()\n\n  if (ctx.req.method === \"HEAD\") {\n    ctx.res.end()\n    return {}\n  }\n\n  const stream = bucket.openDownloadStream(selectedFileObjectId)\n\n  stream.on(\"error\", () => {\n    try {\n      ctx.res.destroy()\n    } catch {\n      //\n    }\n  })\n\n  stream.pipe(ctx.res)\n  return {}\n}\n","export const ROUTE = \"/api/rb/files/:fileId\"\n","import { Api } from \"@rpcbase/api\"\n\nimport { deleteFile } from \"./handlers/deleteFile\"\nimport { getFile } from \"./handlers/getFile\"\n\nimport * as Files from \"./index\"\n\n\nexport default (api: Api) => {\n  api.get(Files.ROUTE, getFile)\n  api.delete(Files.ROUTE, deleteFile)\n}\n"],"mappings":";;;;;AAuBA,IAAM,yBAAuB,UAAkC;CAC7D,IAAI,OAAO,UAAU,UAAU,OAAO;CACtC,MAAM,aAAa,MAAM,KAAK;CAC9B,OAAO,aAAa,aAAa;AACnC;AAEA,IAAM,uBAAuB,UAA4B;CAEvD,QADgB,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAAA,CACtD,SAAS,cAAc;AACxC;AAEA,IAAM,mBAAmB,OAAO,QAAsB,WAAoC;CACxF,IAAI;EACF,MAAM,OAAO,OAAO,MAAM;CAC5B,SAAS,OAAO;EACd,IAAI,CAAC,oBAAoB,KAAK,GAAG,MAAM;CACzC;AACF;AAEA,IAAa,aAAoF,OAC/F,UACA,QACmC;CACnC,MAAM,WAAW,YAAY,GAAG;CAChC,IAAI,CAAC,UAAU;EACb,IAAI,IAAI,OAAO,GAAG;EAClB,OAAO;GAAE,IAAI;GAAO,OAAO;EAAiB;CAC9C;CAEA,MAAM,YAAY,OAAO,IAAI,IAAI,QAAQ,UAAU,EAAE,CAAC,CAAC,KAAK;CAC5D,IAAI;CACJ,IAAI;EACF,eAAe,IAAI,SAAS,SAAS;CACvC,QAAQ;EACN,IAAI,IAAI,OAAO,GAAG;EAClB,OAAO;GAAE,IAAI;GAAO,OAAO;EAAkB;CAC/C;CAGA,MAAM,YAAW,MADE,sBAAsB,QAAQ,EAAA,CAC3B;CACtB,IAAI,CAAC,UAAU;EACb,IAAI,IAAI,OAAO,GAAG;EAClB,OAAO;GAAE,IAAI;GAAO,OAAO;EAA4B;CACzD;CAEA,MAAM,aAAa,cAAc;CACjC,MAAM,SAAS,IAAI,aAAa,UAAU,EAAE,WAAW,CAAC;CAExD,MAAM,SAAS,UAAU,GAAG;CAC5B,MAAM,gBAAgB,iBAAiB,GAAG;CAC1C,IAAI,CAAC,UAAU,CAAC,eAAe;EAC7B,IAAI,IAAI,OAAO,GAAG;EAClB,OAAO;GAAE,IAAI;GAAO,OAAO;EAAe;CAC5C;CAEA,MAAM,YAAY,MAAM,wBAAwB,UAAU,YAAY,YAAY;CAClF,IAAI,WAAW;EACb,MAAM,oBAAoB;EAC1B,MAAM,iBAAiB,sBAAoB,UAAU,MAAM;EAC3D,MAAM,eAAe,sBAAoB,UAAU,YAAY;EAC/D,MAAM,cAAc,+BAA+B,iBAAiB;EAMpE,IAAI,CAJqB,QAAQ,UAAU,kBAAkB,WAAW,cAInE,KAAoB,CAHD,QAAQ,iBAAiB,gBAAgB,kBAAkB,YAGzD,KAAmB,EAFlB,gBAAgB,YAAY,QAAQ,MAAM,IAEH;GAChE,IAAI,IAAI,OAAO,GAAG;GAClB,OAAO;IAAE,IAAI;IAAO,OAAO;GAAe;EAC5C;EAEA,IAAI;GACF,MAAM,0BAA0B;IAC9B;IACA;IACA,aAAa;GACf,CAAC;EACH,QAAQ;GACN,IAAI,IAAI,OAAO,GAAG;GAClB,OAAO;IAAE,IAAI;IAAO,OAAO;GAAgB;EAC7C;EAEA,IAAI,IAAI,OAAO,GAAG;EAClB,OAAO,EAAE,IAAI,KAAK;CACpB;CAEA,MAAM,CAAC,QAAQ,MAAM,OAAO,KAAK,EAAE,KAAK,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ;CACzE,IAAI,CAAC,MAAM;EACT,IAAI,IAAI,OAAO,GAAG;EAClB,OAAO,EAAE,IAAI,KAAK;CACpB;CAEA,MAAM,iBAAiB,sBAAqB,MAAc,UAAU,MAAM;CAC1E,MAAM,eAAe,sBAAqB,MAAc,UAAU,YAAY;CAC9E,MAAM,cAAe,MAAc;CACnC,MAAM,eAAe,eAAe,OAAO,gBAAgB,WACvD,cACA,CAAC;CACL,MAAM,cAAc,+BAA+B,YAAY;CAM/D,IAAI,CAJqB,QAAQ,UAAU,kBAAkB,WAAW,cAInE,KAAoB,CAHD,QAAQ,iBAAiB,gBAAgB,kBAAkB,YAGzD,KAAmB,EAFlB,gBAAgB,YAAY,QAAQ,MAAM,IAEH;EAChE,IAAI,IAAI,OAAO,GAAG;EAClB,OAAO;GAAE,IAAI;GAAO,OAAO;EAAe;CAC5C;CAEA,IAAI,aAAa,iBAAiB,OAAO,aAAa,kBAAkB,UAAU;EAChF,IAAI,IAAI,OAAO,GAAG;EAClB,OAAO;GAAE,IAAI;GAAO,OAAO;EAA0B;CACvD;CAEA,IAAI;EAEF,MAAM,cAAa,MADI,OAAO,KAAK,EAAE,sBAAsB,aAAa,YAAY,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAA,CAE9F,KAAK,YAAa,SAAiB,GAAG,CAAC,CACvC,QAAQ,OAAuB,cAAc,QAAQ;EAExD,MAAM,iBAAiB,QAAQ,YAAY;EAC3C,KAAK,MAAM,aAAa,YACtB,MAAM,iBAAiB,QAAQ,SAAS;CAE5C,QAAQ;EACN,IAAI,IAAI,OAAO,GAAG;EAClB,OAAO;GAAE,IAAI;GAAO,OAAO;EAAgB;CAC7C;CAEA,IAAI,IAAI,OAAO,GAAG;CAClB,OAAO,EAAE,IAAI,KAAK;AACpB;;;AC1JA,IAAM,kCAAkB,IAAI,IAAI;CAC9B;CAAa;CAAc;CAAa;CAAc;CAAc;CAAa;CACjF;CAAiB;CACjB;CAAc;CAAa;CAAa;CAAc;CACtD;CAAa;CAAc;AAC7B,CAAC;AAED,IAAa,yBAAyB,UAAkB,aAA6C;CACnG,MAAM,qBAAqB,SAAS,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,YAAY;CACrE,MAAM,SAAS,gBAAgB,IAAI,kBAAkB;CACrD,MAAM,eAAe,SAAS,QAAQ,uBAAuB,GAAG;CAEhE,OAAO;EACL,gBAAgB,SAAS,qBAAqB;EAC9C,uBAAuB,GAAG,SAAS,WAAW,aAAa,cAAc,aAAa,sBAAsB,mBAAmB,OAAO,KAAK,QAAQ,CAAC,CAAC,SAAS,MAAM,CAAC,CAAC,CAAC,QAAQ,YAAY,cAAc,IAAI,UAAU,WAAW,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,YAAY,GAAG;EACjQ,0BAA0B;EAC1B,2BAA2B;CAC7B;AACF;;;ACFA,IAAM,uBAAuB,UAAkC;CAC7D,IAAI,OAAO,UAAU,UAAU,OAAO;CACtC,MAAM,aAAa,MAAM,KAAK;CAC9B,OAAO,aAAa,aAAa;AACnC;AAEA,IAAM,uBAAuB,UAAkC;CAC7D,IAAI,OAAO,UAAU,UAAU,OAAO;CACtC,MAAM,SAAS,OAAO,MAAM,KAAK,CAAC;CAClC,IAAI,CAAC,OAAO,SAAS,MAAM,KAAK,UAAU,GAAG,OAAO;CACpD,OAAO,KAAK,MAAM,MAAM;AAC1B;AAEA,IAAM,wBAAwB,SAAkD;CAC9E,MAAM,WAAY,MAAc;CAChC,IAAI,CAAC,YAAY,OAAO,aAAa,UAAU,OAAO;CACtD,MAAM,QAAS,SAAqC;CACpD,IAAI,CAAC,SAAS,OAAO,UAAU,UAAU,OAAO;CAChD,MAAM,WAAY,MAAkC;CACpD,IAAI,CAAC,YAAY,OAAO,aAAa,UAAU,OAAO;CACtD,OAAO;AACT;AAEA,IAAM,wBAAwB,YAAsC;CAClE,IAAI,CAAC,WAAW,OAAO,YAAY,UAAU,OAAO;CACpD,MAAM,SAAU,QAAoC;CACpD,IAAI,OAAO,WAAW,UAAU,OAAO;CACvC,IAAI;EACF,OAAO,IAAI,SAAS,MAAM;CAC5B,QAAQ;EACN,OAAO;CACT;AACF;AAEA,IAAM,uBAAuB,MAAe,gBAA+B,qBAA+C;CACxH,MAAM,WAAW,qBAAqB,IAAI;CAC1C,IAAI,CAAC,UAAU,OAAO;CAEtB,IAAI,aAA4B;CAChC,IAAI,OAAO,qBAAqB,UAAU;EACxC,MAAM,aAAa,iBAAiB,KAAK,CAAC,CAAC,YAAY;EACvD,aAAa,eAAe,UAAU,MAAM,eAAe,UAAU,MAAM,eAAe,WAAW,MAAM,eAAe,UAAU,OAAO;EAC3I,IAAI,YAAY;GACd,MAAM,gBAAgB,qBAAqB,SAAS,OAAO,UAAU,EAAE;GACvE,IAAI,eAAe,OAAO;EAC5B;CACF;CAEA,MAAM,cAAc,cAAc;CAClC,IAAI,CAAC,aAAa,OAAO;CAOzB,MAAM,gBALS,OAAO,KAAK,QAAQ,CAAC,CACjC,KAAK,UAAU,OAAO,KAAK,CAAC,CAAC,CAC7B,QAAQ,UAAU,OAAO,UAAU,KAAK,KAAK,QAAQ,CAAC,CAAC,CACvD,MAAM,GAAG,MAAM,IAAI,CAEA,CAAA,CAAO,QAAuB,UAAU,UAAU;EACtE,IAAI,aAAa,MAAM,OAAO;EAE9B,MAAM,mBAAmB,KAAK,IAAI,WAAW,WAAW;EACxD,MAAM,WAAW,KAAK,IAAI,QAAQ,WAAW;EAC7C,IAAI,WAAW,kBAAkB,OAAO;EACxC,IAAI,aAAa,oBAAoB,QAAQ,UAAU,OAAO;EAC9D,OAAO;CACT,GAAG,IAAI;CACP,OAAO,gBAAgB,qBAAqB,SAAS,OAAO,aAAa,EAAE,IAAI;AACjF;AAEA,IAAa,UAAiF,OAC5F,UACA,QACmC;CACnC,MAAM,WAAW,YAAY,GAAG;CAChC,IAAI,CAAC,UAAU;EACb,IAAI,IAAI,OAAO,GAAG,CAAC,CAAC,IAAI;EACxB,OAAO,CAAC;CACV;CAEA,MAAM,YAAY,OAAO,IAAI,IAAI,QAAQ,UAAU,EAAE,CAAC,CAAC,KAAK;CAC5D,IAAI;CACJ,IAAI;EACF,eAAe,IAAI,SAAS,SAAS;CACvC,QAAQ;EACN,IAAI,IAAI,OAAO,GAAG,CAAC,CAAC,IAAI;EACxB,OAAO,CAAC;CACV;CAGA,MAAM,YAAW,MADE,sBAAsB,QAAQ,EAAA,CAC3B;CACtB,IAAI,CAAC,UAAU;EACb,IAAI,IAAI,OAAO,GAAG,CAAC,CAAC,IAAI;EACxB,OAAO,CAAC;CACV;CAEA,MAAM,aAAa,cAAc;CACjC,MAAM,SAAS,IAAI,aAAa,UAAU,EAAE,WAAW,CAAC;CACxD,MAAM,YAAY,MAAM,wBAAwB,UAAU,YAAY,YAAY;CAClF,MAAM,eAAe,WAAW,UAAU;CAE1C,MAAM,CAAC,QAAQ,MAAM,OAAO,KAAK,EAAE,KAAK,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ;CACzE,IAAI,CAAC,MAAM;EACT,IAAI,IAAI,OAAO,GAAG,CAAC,CAAC,IAAI;EACxB,OAAO,CAAC;CACV;CAEA,MAAM,cAAc,aAAc,MAAc;CAChD,MAAM,eAAe,eAAe,OAAO,gBAAgB,WACvD,cACA,CAAC;CACL,MAAM,cAAc,+BAA+B,YAAY;CAC/D,IAAI,gBAAgB,UAAU;EAC5B,MAAM,SAAS,UAAU,GAAG;EAC5B,IAAI,gBAAgB,UACd;OAAA,CAAC,QAAQ;IACX,IAAI,IAAI,OAAO,GAAG,CAAC,CAAC,IAAI;IACxB,OAAO,CAAC;GACV;SACK;GACL,MAAM,gBAAgB,iBAAiB,GAAG;GAC1C,MAAM,iBAAiB,oBAAoB,aAAa,MAAM;GAC9D,MAAM,eAAe,oBAAoB,aAAa,YAAY;GAKlE,IAAI,CAHqB,QAAQ,UAAU,kBAAkB,WAAW,cAGnE,KAAoB,CAFD,QAAQ,iBAAiB,gBAAgB,kBAAkB,YAEzD,GAAiB;IACzC,IAAI,IAAI,OAAO,GAAG,CAAC,CAAC,IAAI;IACxB,OAAO,CAAC;GACV;EACF;CACF;CAGA,MAAM,sBAAsB,oBAAoB,MADzB,oBAAqB,IAAI,IAAI,OAAe,CACb,GAAiB,IAAI,IAAI,OAAe,OAAO;CACrG,MAAM,CAAC,eAAe,sBAClB,MAAM,OAAO,KAAK,EAAE,KAAK,oBAAoB,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,IACjE,CAAC;CACL,MAAM,uBAAuB,cAAc,sBAAkC;CAC7E,MAAM,eAAe,eAAe;CAGpC,MAAM,WADuB,oBAAqB,cAAsB,UAAU,QACjE,KAAwB;CAEzC,MAAM,WADiB,oBAAoB,WAAW,YAAa,cAAsB,QACxE,KAAkB;CACnC,KAAK,MAAM,CAAC,MAAM,UAAU,OAAO,QAAQ,sBAAsB,UAAU,QAAQ,CAAC,GAClF,IAAI,IAAI,UAAU,MAAM,KAAK;CAG/B,MAAM,eAAe;CACrB,MAAM,MAAM,oBAAqB,cAAsB,GAAG;CAC1D,MAAM,aAAc,cAAsB,sBAAsB,OAAQ,aAAqB,aAAa;CAC1G,MAAM,YAAY,OAAO,GAAG,qBAAqB,YAAY,EAAE,GAAG,OAAQ,cAAsB,UAAU,CAAC,EAAE,GAAG,OAAO,YAAY,QAAQ,KAAK,CAAC;CACjJ,MAAM,OAAO,MAAM,IAAI,UAAU,aAAa,MAAM,UAAU;CAC9D,MAAM,cAAc,oBAAqB,IAAI,IAAI,UAAkB,gBAAgB;CACnF,IAAI,aAAa;EACf,MAAM,aAAa,YAAY,MAAM,GAAG,CAAC,CAAC,KAAK,UAAU,MAAM,KAAK,CAAC,CAAC,CAAC,OAAO,OAAO;EACrF,IAAI,WAAW,SAAS,GAAG,KAAK,WAAW,SAAS,IAAI,GAAG;GACzD,IAAI,IAAI,OAAO,GAAG;GAClB,IAAI,IAAI,UAAU,iBAAiB,YAAY;GAC/C,IAAI,IAAI,UAAU,QAAQ,IAAI;GAC9B,IAAI,IAAI,IAAI;GACZ,OAAO,CAAC;EACV;CACF;CAEA,IAAI,IAAI,OAAO,GAAG;CAClB,IAAI,IAAI,UAAU,kBAAkB,OAAQ,cAAsB,UAAU,CAAC,CAAC;CAC9E,IAAI,IAAI,UAAU,iBAAiB,YAAY;CAC/C,IAAI,IAAI,UAAU,QAAQ,IAAI;CAC9B,IAAI,IAAI,aAAa;CAErB,IAAI,IAAI,IAAI,WAAW,QAAQ;EAC7B,IAAI,IAAI,IAAI;EACZ,OAAO,CAAC;CACV;CAEA,MAAM,SAAS,OAAO,mBAAmB,oBAAoB;CAE7D,OAAO,GAAG,eAAe;EACvB,IAAI;GACF,IAAI,IAAI,QAAQ;EAClB,QAAQ,CAER;CACF,CAAC;CAED,OAAO,KAAK,IAAI,GAAG;CACnB,OAAO,CAAC;AACV;;;AC5MA,IAAa,QAAQ;;;ACQrB,IAAA,mBAAgB,QAAa;CAC3B,IAAI,IAAI,OAAa,OAAO;CAC5B,IAAI,OAAO,OAAa,UAAU;AACpC"}

package/dist/index.js

@@ -1,5 +1,5 @@
 import { n as __toESM, t as __commonJSMin } from "./rolldown-runtime-BPOCksWG.js";
-import { c as runRtsQuery, d as getDerivedKey, i as normalizeRtsQueryOptions, n as buildRtsAbilityFromRequest, o as resolveRtsRequestTenantId, r as isRtsRequestAuthorized, s as runRtsCount, t as RTS_QUERY_WINDOW_MAX_COUNT, u as syncAuthenticatedSessionMiddleware } from "./queryWindow-NCe5vJHt.js";
+import { c as runRtsQuery, d as syncAuthenticatedSessionMiddleware, i as normalizeRtsQueryOptions, n as buildRtsAbilityFromRequest, o as resolveRtsRequestTenantId, p as getDerivedKey, r as isRtsRequestAuthorized, s as runRtsCount, t as RTS_QUERY_WINDOW_MAX_COUNT } from "./queryWindow-RHVy3D0L.js";
 import { i as sendEmail, n as configureEmailTransport, r as createResendEmailTransport, t as EmailDeliveryError } from "./email-6gJ8ibKp.js";
 import { DISPOSABLE_EMAIL_ERROR_CODE, INVALID_EMAIL_DOMAIN_ERROR_CODE, clearEmailDomainValidationCache, getEmailAddressDomain, getEmailAddressValidationErrorCode, isEmailAddressValid, validateEmailDomain } from "./email-validation/index.js";
 import { l as getFileReferencesCollectionName, s as getBucketName, y as resolveStoredUploadAccessScope } from "./shared-B1VLaHsk.js";

package/dist/proxyAuth.d.ts

@@ -1,17 +1,20 @@
 export declare const AUTHENTICATED_USER_ID_HEADER = "rb-authenticated-user-id";
 export declare const AUTHENTICATED_TENANT_ID_HEADER = "rb-authenticated-tenant-id";
+export declare const AUTH_VERSION_HEADER = "rb-auth-version";
 export declare const PROXY_AUTH_TIMESTAMP_HEADER = "rb-proxy-auth-timestamp";
 export declare const PROXY_AUTH_SIGNATURE_HEADER = "rb-proxy-auth-signature";
 type HeadersLike = Record<string, string | string[] | undefined>;
-export declare const buildProxyAuthSignature: ({ userId, tenantId, timestamp, secret, }: {
+export declare const buildProxyAuthSignature: ({ userId, tenantId, timestamp, secret, authVersion, }: {
     userId: string;
     tenantId: string;
     timestamp: string;
     secret: string;
+    authVersion?: number;
 }) => string;
 export declare const getTrustedProxyAuth: (headers: HeadersLike | undefined) => {
     userId: string;
     tenantId: string;
+    authVersion: number;
 } | null;
 export {};
 //# sourceMappingURL=proxyAuth.d.ts.map

package/dist/proxyAuth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"proxyAuth.d.ts","sourceRoot":"","sources":["../src/proxyAuth.ts"],"names":[],"mappings":"AAGA,eAAO,MAAM,4BAA4B,6BAA6B,CAAA;AACtE,eAAO,MAAM,8BAA8B,+BAA+B,CAAA;AAC1E,eAAO,MAAM,2BAA2B,4BAA4B,CAAA;AACpE,eAAO,MAAM,2BAA2B,4BAA4B,CAAA;AAIpE,KAAK,WAAW,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,CAAA;AA0BhE,eAAO,MAAM,uBAAuB,GAAI,0CAKrC;IACD,MAAM,EAAE,MAAM,CAAA;IACd,QAAQ,EAAE,MAAM,CAAA;IAChB,SAAS,EAAE,MAAM,CAAA;IACjB,MAAM,EAAE,MAAM,CAAA;CACf,KAAG,MAIH,CAAA;AAED,eAAO,MAAM,mBAAmB,GAC9B,SAAS,WAAW,GAAG,SAAS,KAC/B;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAAG,IA0BzC,CAAA"}
+{"version":3,"file":"proxyAuth.d.ts","sourceRoot":"","sources":["../src/proxyAuth.ts"],"names":[],"mappings":"AAGA,eAAO,MAAM,4BAA4B,6BAA6B,CAAA;AACtE,eAAO,MAAM,8BAA8B,+BAA+B,CAAA;AAC1E,eAAO,MAAM,mBAAmB,oBAAoB,CAAA;AACpD,eAAO,MAAM,2BAA2B,4BAA4B,CAAA;AACpE,eAAO,MAAM,2BAA2B,4BAA4B,CAAA;AAIpE,KAAK,WAAW,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,CAAA;AA0BhE,eAAO,MAAM,uBAAuB,GAAI,uDAMrC;IACD,MAAM,EAAE,MAAM,CAAA;IACd,QAAQ,EAAE,MAAM,CAAA;IAChB,SAAS,EAAE,MAAM,CAAA;IACjB,MAAM,EAAE,MAAM,CAAA;IACd,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB,KAAG,MAIH,CAAA;AAED,eAAO,MAAM,mBAAmB,GAC9B,SAAS,WAAW,GAAG,SAAS,KAC/B;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GAAG,IA8B9D,CAAA"}