@stigmer/runner 3.15.0 → 3.15.2-dev.20260913223433

package/dist/shared/attachment-resolver.js

@@ -14,31 +14,53 @@
  *   the backend's create pipeline requires a storage key on every attachment
  *   it accepts, and in local mode the storage reads directly off disk.
  *
- * Placement is always `inputs/{filename}` — the platform namespace this
- * harness can surface in the workspace. An attachment's `mountPath` is
- * honored by convention, not mechanism: the standard mounts (e.g. the
- * approved plan at `.stigmer/inputs/<slug>_<id>.plan.md`) resolve to exactly this
- * placement, and the prompt's `<input_files>` section plus any path-derived
- * directives are built from the RESOLVED paths, so prompt and filesystem can
- * never disagree.
+ * Placement is the `inputs/` namespace — the platform directory every
+ * harness surfaces in the workspace through the `.stigmer` link, and the
+ * only place an attachment may land. An attachment names its place INSIDE
+ * that namespace with `mountPath` (`inputs/<name>`, `inputs/<dir>/`,
+ * `.stigmer/inputs/<name>`; a leading slash is stripped), or takes the
+ * default `inputs/{filename}`. A `mountPath` outside the namespace is
+ * refused with an actionable error, never relocated silently: a file
+ * written into the user's own tree would be committed to the session's
+ * write-back branch on completion (`git add -A`), and every real producer —
+ * the CLI's directory attachments, the approved plan the console mounts —
+ * already stays inside `inputs/` (S3 M1, Q-M1-2; the proto's `/workspace/…`
+ * example is a doc issue). The prompt's `<input_files>` section and every
+ * path-derived directive are built from the RESOLVED paths, so prompt and
+ * filesystem can never disagree.
  *
- * Duplicate filenames are renamed, never overwritten (issue #364): because
- * placement keys purely on the filename, two attachments with the same name
- * contend for one path — the later one takes the platform's `stem-2.ext`
- * rename (shared/attachment-naming.ts, same semantics as the deep-agent
- * injector and the React composer) and the rename is disclosed in the
- * prompt's `<input_files>` section via {@link ResolvedAttachment.renamedFrom}.
+ * Archives: an attachment marked `extract` is a ZIP whose entries land under
+ * its mount as a DIRECTORY (`inputs/<mount>/<entry>`), validated and
+ * decompressed by `attachment-zip.ts` (the #567 guards). Each entry is its
+ * own {@link ResolvedAttachment} with no vision, no `renamedFrom` and no
+ * `downloadUrl`: an image inside a ZIP has no attachment-level bytes, a
+ * renamed mount directory is visible through every entry path, and the
+ * stored object is the ZIP, not any listed file.
  *
- * Error model: fail-hard, matching the native harness's attachment injector.
- * Attachments are explicit user inputs — an execution that silently runs
- * without one produces silently incorrect results (the "plan file wasn't
- * found" class of failure). Any attachment that cannot be materialized aborts
- * the execution with an actionable error.
+ * Duplicate names are renamed, never overwritten (issue #364), in two passes:
+ * explicit mount paths claim their exact targets first — two attachments
+ * pinning the SAME path is a user contradiction no rename can honestly
+ * resolve, so that alone still refuses — and default-derived names then
+ * uniquify around everything already taken with the platform's `stem-2.ext`
+ * rename (shared/attachment-naming.ts, the React composer's semantics),
+ * disclosed in the prompt via {@link ResolvedAttachment.renamedFrom}.
+ *
+ * Error model: fail-hard. Attachments are explicit user inputs — an
+ * execution that silently runs without one produces silently incorrect
+ * results (the "plan file wasn't found" class of failure). Any attachment
+ * that cannot be materialized aborts the execution with an actionable
+ * {@link AttachmentResolutionError}; an archive that fails its guards
+ * aborts with the guard's own `AttachmentValidationError`.
+ *
+ * Until S3 M1 this resolver ignored `mountPath` and could not extract; the
+ * native harness's `attachment-injector.ts` did both and was retired at S3
+ * M2b for this one pipeline (Q-S3-14).
  */
 import { mkdir, copyFile, readFile, stat, writeFile } from "node:fs/promises";
-import { join, basename } from "node:path";
+import { join, basename, dirname, posix } from "node:path";
 import { mintAttachmentDownloadUrl } from "./attachment-download-urls.js";
 import { allocateUniqueName } from "./attachment-naming.js";
+import { decompressEntry, parseAndValidateZip } from "./attachment-zip.js";
 import { isVisionCandidate, } from "./attachment-vision.js";
 import { getPlatformDir } from "./workspace/platform-dir.js";
 import { ensureStigmerSymlink, STIGMER_LOCAL_STATE_DIR } from "./workspace/stigmer-link.js";
@@ -69,25 +91,36 @@ export async function resolveAttachments(attachments, options) {
     // every resolved path below would dangle (the skill resolver also ensures
     // it, but only when the agent has skills).
     await ensureStigmerSymlink(options.primaryWorkspaceDir, platformDir);
-    // Placement keys purely on the filename, so this set is the whole
-    // collision domain — sequential resolution means each attachment sees
-    // every name claimed before it (see module doc on duplicate handling).
-    const takenNames = new Set();
+    // Every place is decided before any bytes move: an explicit-path
+    // contradiction refuses up front, and a default name never lands on a path
+    // an explicit one claims (see module doc on duplicate handling).
+    const places = resolvePlacements(attachments);
     const results = [];
     for (const attachment of attachments) {
-        results.push(await resolveAttachment(attachment, inputsDir, takenNames, options));
+        const place = places.get(attachment);
+        if (attachment.extract) {
+            results.push(...(await extractArchive(attachment, place, inputsDir, options)));
+        }
+        else {
+            results.push(await resolveAttachment(attachment, place, inputsDir, options));
+        }
     }
     console.log(`[attachment-resolver] resolved ${results.length} attachment(s): ` +
         results.map((r) => r.relativePath).join(", "));
     return results;
 }
-async function resolveAttachment(attachment, inputsDir, takenNames, options) {
+async function resolveAttachment(attachment, place, inputsDir, options) {
+    const { relative, renamedFrom } = place;
+    // The final basename is the canonical filename: after a duplicate rename
+    // the original attachment.filename no longer names the file on disk, and
+    // the vision label must match what the prompt lists.
+    const filename = posix.basename(relative);
+    await mkdir(dirname(join(inputsDir, relative)), { recursive: true });
     // Local-mode fast path: the file is already on this machine's disk.
     if (options.mode === "local" && attachment.localPath) {
-        const { name: filename, renamedFrom } = allocateUniqueName(safeInputName(attachment.filename || attachment.localPath), takenNames);
         let vision;
         try {
-            vision = await materializeLocalFile(attachment, filename, inputsDir, options.visionBudget);
+            vision = await materializeLocalFile(attachment, filename, join(inputsDir, relative), options.visionBudget);
         }
         catch (err) {
             throw new AttachmentResolutionError(attachment.filename, `failed to copy local file '${attachment.localPath}': ` +
@@ -99,13 +132,70 @@ async function resolveAttachment(attachment, inputsDir, takenNames, options) {
         const downloadUrl = await mintAttachmentDownloadUrl(options.storage, attachment.storageKey, filename);
         return {
             filename,
-            relativePath: join(STIGMER_LOCAL_STATE_DIR, INPUTS_SUBDIR, filename),
+            relativePath: join(STIGMER_LOCAL_STATE_DIR, INPUTS_SUBDIR, relative),
+            sizeBytes: (await stat(join(inputsDir, relative))).size,
             ...(renamedFrom !== undefined ? { renamedFrom } : {}),
             ...visionOutcomeFields(vision),
             ...(downloadUrl !== undefined ? { downloadUrl } : {}),
         };
     }
     // Universal path: download the uploaded content by storage key.
+    const content = await downloadFromStorage(attachment, options);
+    await writeFile(join(inputsDir, relative), content);
+    // The bytes are already in hand for the file write — offer them to the
+    // vision budget before they go out of scope (the sniff decides eligibility;
+    // no pre-filter needed on this branch).
+    const vision = options.visionBudget?.offer(filename, attachment.contentType, content);
+    const downloadUrl = await mintAttachmentDownloadUrl(options.storage, attachment.storageKey, filename);
+    return {
+        filename,
+        relativePath: join(STIGMER_LOCAL_STATE_DIR, INPUTS_SUBDIR, relative),
+        sizeBytes: content.byteLength,
+        ...(renamedFrom !== undefined ? { renamedFrom } : {}),
+        ...visionOutcomeFields(vision),
+        ...(downloadUrl !== undefined ? { downloadUrl } : {}),
+    };
+}
+/**
+ * Extract an `extract` attachment's archive under its mount directory. The
+ * bytes are read whole (an archive is never a vision candidate, so the local
+ * fast path's lazy read has nothing to save), validated and decompressed by
+ * the shared guards, and written entry by entry; the entries are the
+ * resolved attachments (see the module doc for what they do not carry).
+ */
+async function extractArchive(attachment, place, inputsDir, options) {
+    const content = await bytesOf(attachment, options);
+    const entries = parseAndValidateZip(content, attachment.filename);
+    const mountDir = place.relative.replace(/\/+$/, "");
+    const results = [];
+    for (const entry of entries) {
+        const bytes = await decompressEntry(entry, attachment.filename);
+        const relative = posix.join(mountDir, entry.relativePath);
+        const dest = join(inputsDir, relative);
+        await mkdir(dirname(dest), { recursive: true });
+        await writeFile(dest, bytes);
+        results.push({
+            filename: posix.basename(entry.relativePath),
+            relativePath: join(STIGMER_LOCAL_STATE_DIR, INPUTS_SUBDIR, relative),
+            sizeBytes: bytes.byteLength,
+        });
+    }
+    return results;
+}
+/** The attachment's bytes, from the local fast path or from storage. */
+async function bytesOf(attachment, options) {
+    if (options.mode === "local" && attachment.localPath) {
+        try {
+            return await readFile(attachment.localPath);
+        }
+        catch (err) {
+            throw new AttachmentResolutionError(attachment.filename, `failed to read local file '${attachment.localPath}': ` +
+                `${err instanceof Error ? err.message : String(err)}`);
+        }
+    }
+    return downloadFromStorage(attachment, options);
+}
+async function downloadFromStorage(attachment, options) {
     if (!attachment.storageKey) {
         throw new AttachmentResolutionError(attachment.filename, "missing storageKey — cannot download attachment from storage");
     }
@@ -113,28 +203,71 @@ async function resolveAttachment(attachment, inputsDir, takenNames, options) {
         throw new AttachmentResolutionError(attachment.filename, `artifact storage is unavailable, so this attachment ` +
             `(key: ${attachment.storageKey}) cannot be downloaded`);
     }
-    const { name: filename, renamedFrom } = allocateUniqueName(safeInputName(attachment.filename || attachment.storageKey), takenNames);
-    let content;
     try {
-        content = await options.storage.download(attachment.storageKey);
+        return await options.storage.download(attachment.storageKey);
     }
     catch (err) {
         throw new AttachmentResolutionError(attachment.filename, `failed to download from storage (key: ${attachment.storageKey}): ` +
             `${err instanceof Error ? err.message : String(err)}`);
     }
-    await writeFile(join(inputsDir, filename), content);
-    // The bytes are already in hand for the file write — offer them to the
-    // vision budget before they go out of scope (the sniff decides eligibility;
-    // no pre-filter needed on this branch).
-    const vision = options.visionBudget?.offer(filename, attachment.contentType, content);
-    const downloadUrl = await mintAttachmentDownloadUrl(options.storage, attachment.storageKey, filename);
-    return {
-        filename,
-        relativePath: join(STIGMER_LOCAL_STATE_DIR, INPUTS_SUBDIR, filename),
-        ...(renamedFrom !== undefined ? { renamedFrom } : {}),
-        ...visionOutcomeFields(vision),
-        ...(downloadUrl !== undefined ? { downloadUrl } : {}),
-    };
+}
+/**
+ * The two-pass placement (see module doc): explicit mount paths first, each
+ * resolved into the namespace and refused on a contradiction; then the
+ * default-derived names, uniquified around every name already taken directly
+ * under `inputs/`.
+ */
+function resolvePlacements(attachments) {
+    const places = new Map();
+    const claimed = new Map();
+    for (const attachment of attachments) {
+        if (!attachment.mountPath)
+            continue;
+        const relative = explicitPlacement(attachment);
+        const existing = claimed.get(relative);
+        if (existing) {
+            throw new AttachmentResolutionError(attachment.filename, `mount path '${attachment.mountPath}' collides with attachment '${existing.filename}'. ` +
+                "Set distinct mountPath values on the attachments to resolve this conflict.");
+        }
+        claimed.set(relative, attachment);
+        places.set(attachment, { relative });
+    }
+    const takenNames = new Set();
+    for (const relative of claimed.keys()) {
+        if (!relative.includes("/"))
+            takenNames.add(relative);
+    }
+    for (const attachment of attachments) {
+        if (attachment.mountPath)
+            continue;
+        const { name, renamedFrom } = allocateUniqueName(safeInputName(attachment.filename || attachment.localPath || attachment.storageKey), takenNames);
+        places.set(attachment, renamedFrom !== undefined ? { relative: name, renamedFrom } : { relative: name });
+    }
+    return places;
+}
+/** The namespace prefixes an explicit `mountPath` may name, longest first. */
+const INPUTS_NAMESPACE_PREFIXES = [`${STIGMER_LOCAL_STATE_DIR}/${INPUTS_SUBDIR}`, INPUTS_SUBDIR];
+/**
+ * Resolve an explicit `mountPath` into a path relative to `inputs/`, or
+ * refuse: empty after cleaning, outside the namespace, or climbing out of it.
+ * A caller-supplied path is untrusted, so `..` is judged after normalization.
+ */
+function explicitPlacement(attachment) {
+    const cleaned = attachment.mountPath.replace(/^\/+/, "").replace(/\/+$/, "");
+    const prefix = INPUTS_NAMESPACE_PREFIXES.find((p) => cleaned === p || cleaned.startsWith(`${p}/`));
+    if (prefix === undefined) {
+        throw new AttachmentResolutionError(attachment.filename, `mount path '${attachment.mountPath}' is outside the attachment namespace. ` +
+            `Attachments land under '${INPUTS_SUBDIR}/' (surfaced as '${STIGMER_LOCAL_STATE_DIR}/${INPUTS_SUBDIR}/'); ` +
+            `set mountPath to '${INPUTS_SUBDIR}/<name>' or leave it empty for the default placement.`);
+    }
+    const relative = posix.normalize(cleaned.slice(prefix.length).replace(/^\/+/, ""));
+    if (relative === "" || relative === ".") {
+        throw new AttachmentResolutionError(attachment.filename, `mount path '${attachment.mountPath}' names the inputs directory itself, not a place inside it`);
+    }
+    if (relative === ".." || relative.startsWith("../") || posix.isAbsolute(relative)) {
+        throw new AttachmentResolutionError(attachment.filename, `mount path '${attachment.mountPath}' escapes the attachment namespace`);
+    }
+    return relative;
 }
 /**
  * Materialize a local-path attachment, reading the bytes only when they are
@@ -143,8 +276,7 @@ async function resolveAttachment(attachment, inputsDir, takenNames, options) {
  * enters memory. Returns the vision outcome, or `undefined` when vision is
  * disabled or the file is not a candidate.
  */
-async function materializeLocalFile(attachment, filename, inputsDir, visionBudget) {
-    const dest = join(inputsDir, filename);
+async function materializeLocalFile(attachment, filename, dest, visionBudget) {
     if (!visionBudget || !isVisionCandidate(attachment.contentType, filename)) {
         await copyFile(attachment.localPath, dest);
         return undefined;

package/dist/shared/attachment-resolver.js.map

@@ -1 +1 @@
-{"version":3,"file":"attachment-resolver.js","sourceRoot":"","sources":["../../src/shared/attachment-resolver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAEH,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC9E,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAG3C,OAAO,EAAE,yBAAyB,EAAE,MAAM,+BAA+B,CAAC;AAC1E,OAAO,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAC5D,OAAO,EACL,iBAAiB,GAKlB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAC7D,OAAO,EAAE,oBAAoB,EAAE,uBAAuB,EAAE,MAAM,6BAA6B,CAAC;AAE5F,MAAM,aAAa,GAAG,QAAQ,CAAC;AAqD/B,MAAM,OAAO,yBAA0B,SAAQ,KAAK;IACzC,kBAAkB,CAAS;IAC3B,MAAM,CAAS;IAExB,YAAY,kBAA0B,EAAE,MAAc;QACpD,KAAK,CAAC,eAAe,kBAAkB,MAAM,MAAM,EAAE,CAAC,CAAC;QACvD,IAAI,CAAC,IAAI,GAAG,2BAA2B,CAAC;QACxC,IAAI,CAAC,kBAAkB,GAAG,kBAAkB,CAAC;QAC7C,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,WAAyB,EACzB,OAAkC;IAElC,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAExC,MAAM,WAAW,GAAG,cAAc,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACtD,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;IACnD,MAAM,KAAK,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAE5C,2EAA2E;IAC3E,0EAA0E;IAC1E,2CAA2C;IAC3C,MAAM,oBAAoB,CAAC,OAAO,CAAC,mBAAmB,EAAE,WAAW,CAAC,CAAC;IAErE,kEAAkE;IAClE,sEAAsE;IACtE,uEAAuE;IACvE,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;IACrC,MAAM,OAAO,GAAyB,EAAE,CAAC;IACzC,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;QACrC,OAAO,CAAC,IAAI,CAAC,MAAM,iBAAiB,CAAC,UAAU,EAAE,SAAS,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC;IACpF,CAAC;IAED,OAAO,CAAC,GAAG,CACT,kCAAkC,OAAO,CAAC,MAAM,kBAAkB;QAClE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAC9C,CAAC;IAEF,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,KAAK,UAAU,iBAAiB,CAC9B,UAAsB,EACtB,SAAiB,EACjB,UAAuB,EACvB,OAAkC;IAElC,oEAAoE;IACpE,IAAI,OAAO,CAAC,IAAI,KAAK,OAAO,IAAI,UAAU,CAAC,SAAS,EAAE,CAAC;QACrD,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,GAAG,kBAAkB,CACxD,aAAa,CAAC,UAAU,CAAC,QAAQ,IAAI,UAAU,CAAC,SAAS,CAAC,EAC1D,UAAU,CACX,CAAC;QACF,IAAI,MAAiC,CAAC;QACtC,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,oBAAoB,CAAC,UAAU,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;QAC7F,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,yBAAyB,CACjC,UAAU,CAAC,QAAQ,EACnB,8BAA8B,UAAU,CAAC,SAAS,KAAK;gBACvD,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CACtD,CAAC;QACJ,CAAC;QACD,sEAAsE;QACtE,wEAAwE;QACxE,sDAAsD;QACtD,MAAM,WAAW,GAAG,MAAM,yBAAyB,CACjD,OAAO,CAAC,OAAO,EAAE,UAAU,CAAC,UAAU,EAAE,QAAQ,CACjD,CAAC;QACF,OAAO;YACL,QAAQ;YACR,YAAY,EAAE,IAAI,CAAC,uBAAuB,EAAE,aAAa,EAAE,QAAQ,CAAC;YACpE,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrD,GAAG,mBAAmB,CAAC,MAAM,CAAC;YAC9B,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACtD,CAAC;IACJ,CAAC;IAED,gEAAgE;IAChE,IAAI,CAAC,UAAU,CAAC,UAAU,EAAE,CAAC;QAC3B,MAAM,IAAI,yBAAyB,CACjC,UAAU,CAAC,QAAQ,EACnB,8DAA8D,CAC/D,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;QACrB,MAAM,IAAI,yBAAyB,CACjC,UAAU,CAAC,QAAQ,EACnB,sDAAsD;YACtD,SAAS,UAAU,CAAC,UAAU,wBAAwB,CACvD,CAAC;IACJ,CAAC;IAED,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,GAAG,kBAAkB,CACxD,aAAa,CAAC,UAAU,CAAC,QAAQ,IAAI,UAAU,CAAC,UAAU,CAAC,EAC3D,UAAU,CACX,CAAC;IACF,IAAI,OAAe,CAAC;IACpB,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;IAClE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,yBAAyB,CACjC,UAAU,CAAC,QAAQ,EACnB,yCAAyC,UAAU,CAAC,UAAU,KAAK;YACnE,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CACtD,CAAC;IACJ,CAAC;IACD,MAAM,SAAS,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,EAAE,OAAO,CAAC,CAAC;IAEpD,uEAAuE;IACvE,4EAA4E;IAC5E,wCAAwC;IACxC,MAAM,MAAM,GAAG,OAAO,CAAC,YAAY,EAAE,KAAK,CAAC,QAAQ,EAAE,UAAU,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IAEtF,MAAM,WAAW,GAAG,MAAM,yBAAyB,CACjD,OAAO,CAAC,OAAO,EAAE,UAAU,CAAC,UAAU,EAAE,QAAQ,CACjD,CAAC;IAEF,OAAO;QACL,QAAQ;QACR,YAAY,EAAE,IAAI,CAAC,uBAAuB,EAAE,aAAa,EAAE,QAAQ,CAAC;QACpE,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrD,GAAG,mBAAmB,CAAC,MAAM,CAAC;QAC9B,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACtD,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,oBAAoB,CACjC,UAAsB,EACtB,QAAgB,EAChB,SAAiB,EACjB,YAAsC;IAEtC,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IACvC,IAAI,CAAC,YAAY,IAAI,CAAC,iBAAiB,CAAC,UAAU,CAAC,WAAW,EAAE,QAAQ,CAAC,EAAE,CAAC;QAC1E,MAAM,QAAQ,CAAC,UAAU,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QAC3C,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,2EAA2E;IAC3E,2EAA2E;IAC3E,gEAAgE;IAChE,IAAI,YAAY,CAAC,cAAc,EAAE,EAAE,CAAC;QAClC,MAAM,QAAQ,CAAC,UAAU,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QAC3C,OAAO,YAAY,CAAC,UAAU,EAAE,CAAC;IACnC,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;IAC9C,IAAI,YAAY,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5C,MAAM,QAAQ,CAAC,UAAU,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QAC3C,OAAO,YAAY,CAAC,cAAc,EAAE,CAAC;IACvC,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;IACrD,MAAM,SAAS,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC/B,OAAO,YAAY,CAAC,KAAK,CAAC,QAAQ,EAAE,UAAU,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;AACvE,CAAC;AAED,SAAS,mBAAmB,CAC1B,OAAkC;IAElC,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IACnE,OAAO,OAAO,CAAC,IAAI,KAAK,UAAU;QAChC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,KAAK,EAAE;QAC3B,CAAC,CAAC,EAAE,cAAc,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;AACzC,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,aAAa,CAAC,GAAW;IAChC,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;IAC3B,IAAI,IAAI,KAAK,EAAE,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QACjD,MAAM,IAAI,yBAAyB,CACjC,GAAG,EACH,IAAI,GAAG,wDAAwD,CAChE,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}
+{"version":3,"file":"attachment-resolver.js","sourceRoot":"","sources":["../../src/shared/attachment-resolver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyDG;AAEH,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC9E,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,WAAW,CAAC;AAG3D,OAAO,EAAE,yBAAyB,EAAE,MAAM,+BAA+B,CAAC;AAC1E,OAAO,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAC5D,OAAO,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC3E,OAAO,EACL,iBAAiB,GAKlB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAC7D,OAAO,EAAE,oBAAoB,EAAE,uBAAuB,EAAE,MAAM,6BAA6B,CAAC;AAE5F,MAAM,aAAa,GAAG,QAAQ,CAAC;AAuD/B,MAAM,OAAO,yBAA0B,SAAQ,KAAK;IACzC,kBAAkB,CAAS;IAC3B,MAAM,CAAS;IAExB,YAAY,kBAA0B,EAAE,MAAc;QACpD,KAAK,CAAC,eAAe,kBAAkB,MAAM,MAAM,EAAE,CAAC,CAAC;QACvD,IAAI,CAAC,IAAI,GAAG,2BAA2B,CAAC;QACxC,IAAI,CAAC,kBAAkB,GAAG,kBAAkB,CAAC;QAC7C,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,WAAyB,EACzB,OAAkC;IAElC,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAExC,MAAM,WAAW,GAAG,cAAc,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACtD,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;IACnD,MAAM,KAAK,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAE5C,2EAA2E;IAC3E,0EAA0E;IAC1E,2CAA2C;IAC3C,MAAM,oBAAoB,CAAC,OAAO,CAAC,mBAAmB,EAAE,WAAW,CAAC,CAAC;IAErE,iEAAiE;IACjE,2EAA2E;IAC3E,iEAAiE;IACjE,MAAM,MAAM,GAAG,iBAAiB,CAAC,WAAW,CAAC,CAAC;IAC9C,MAAM,OAAO,GAAyB,EAAE,CAAC;IACzC,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;QACrC,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,UAAU,CAAE,CAAC;QACtC,IAAI,UAAU,CAAC,OAAO,EAAE,CAAC;YACvB,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,cAAc,CAAC,UAAU,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;QACjF,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,IAAI,CAAC,MAAM,iBAAiB,CAAC,UAAU,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC;QAC/E,CAAC;IACH,CAAC;IAED,OAAO,CAAC,GAAG,CACT,kCAAkC,OAAO,CAAC,MAAM,kBAAkB;QAClE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAC9C,CAAC;IAEF,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,KAAK,UAAU,iBAAiB,CAC9B,UAAsB,EACtB,KAAgB,EAChB,SAAiB,EACjB,OAAkC;IAElC,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,GAAG,KAAK,CAAC;IACxC,yEAAyE;IACzE,yEAAyE;IACzE,qDAAqD;IACrD,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC1C,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAErE,oEAAoE;IACpE,IAAI,OAAO,CAAC,IAAI,KAAK,OAAO,IAAI,UAAU,CAAC,SAAS,EAAE,CAAC;QACrD,IAAI,MAAiC,CAAC;QACtC,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,oBAAoB,CAAC,UAAU,EAAE,QAAQ,EAAE,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;QAC7G,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,yBAAyB,CACjC,UAAU,CAAC,QAAQ,EACnB,8BAA8B,UAAU,CAAC,SAAS,KAAK;gBACvD,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CACtD,CAAC;QACJ,CAAC;QACD,sEAAsE;QACtE,wEAAwE;QACxE,sDAAsD;QACtD,MAAM,WAAW,GAAG,MAAM,yBAAyB,CACjD,OAAO,CAAC,OAAO,EAAE,UAAU,CAAC,UAAU,EAAE,QAAQ,CACjD,CAAC;QACF,OAAO;YACL,QAAQ;YACR,YAAY,EAAE,IAAI,CAAC,uBAAuB,EAAE,aAAa,EAAE,QAAQ,CAAC;YACpE,SAAS,EAAE,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI;YACvD,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrD,GAAG,mBAAmB,CAAC,MAAM,CAAC;YAC9B,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACtD,CAAC;IACJ,CAAC;IAED,gEAAgE;IAChE,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IAC/D,MAAM,SAAS,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,EAAE,OAAO,CAAC,CAAC;IAEpD,uEAAuE;IACvE,4EAA4E;IAC5E,wCAAwC;IACxC,MAAM,MAAM,GAAG,OAAO,CAAC,YAAY,EAAE,KAAK,CAAC,QAAQ,EAAE,UAAU,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IAEtF,MAAM,WAAW,GAAG,MAAM,yBAAyB,CACjD,OAAO,CAAC,OAAO,EAAE,UAAU,CAAC,UAAU,EAAE,QAAQ,CACjD,CAAC;IAEF,OAAO;QACL,QAAQ;QACR,YAAY,EAAE,IAAI,CAAC,uBAAuB,EAAE,aAAa,EAAE,QAAQ,CAAC;QACpE,SAAS,EAAE,OAAO,CAAC,UAAU;QAC7B,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrD,GAAG,mBAAmB,CAAC,MAAM,CAAC;QAC9B,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACtD,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,cAAc,CAC3B,UAAsB,EACtB,KAAgB,EAChB,SAAiB,EACjB,OAAkC;IAElC,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IACnD,MAAM,OAAO,GAAG,mBAAmB,CAAC,OAAO,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC;IAClE,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACpD,MAAM,OAAO,GAAyB,EAAE,CAAC;IACzC,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,KAAK,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC;QAChE,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;QAC1D,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;QACvC,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAChD,MAAM,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAC7B,OAAO,CAAC,IAAI,CAAC;YACX,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,YAAY,CAAC;YAC5C,YAAY,EAAE,IAAI,CAAC,uBAAuB,EAAE,aAAa,EAAE,QAAQ,CAAC;YACpE,SAAS,EAAE,KAAK,CAAC,UAAU;SAC5B,CAAC,CAAC;IACL,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,wEAAwE;AACxE,KAAK,UAAU,OAAO,CAAC,UAAsB,EAAE,OAAkC;IAC/E,IAAI,OAAO,CAAC,IAAI,KAAK,OAAO,IAAI,UAAU,CAAC,SAAS,EAAE,CAAC;QACrD,IAAI,CAAC;YACH,OAAO,MAAM,QAAQ,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QAC9C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,yBAAyB,CACjC,UAAU,CAAC,QAAQ,EACnB,8BAA8B,UAAU,CAAC,SAAS,KAAK;gBACvD,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CACtD,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,mBAAmB,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;AAClD,CAAC;AAED,KAAK,UAAU,mBAAmB,CAAC,UAAsB,EAAE,OAAkC;IAC3F,IAAI,CAAC,UAAU,CAAC,UAAU,EAAE,CAAC;QAC3B,MAAM,IAAI,yBAAyB,CACjC,UAAU,CAAC,QAAQ,EACnB,8DAA8D,CAC/D,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;QACrB,MAAM,IAAI,yBAAyB,CACjC,UAAU,CAAC,QAAQ,EACnB,sDAAsD;YACtD,SAAS,UAAU,CAAC,UAAU,wBAAwB,CACvD,CAAC;IACJ,CAAC;IACD,IAAI,CAAC;QACH,OAAO,MAAM,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;IAC/D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,yBAAyB,CACjC,UAAU,CAAC,QAAQ,EACnB,yCAAyC,UAAU,CAAC,UAAU,KAAK;YACnE,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CACtD,CAAC;IACJ,CAAC;AACH,CAAC;AAWD;;;;;GAKG;AACH,SAAS,iBAAiB,CAAC,WAAkC;IAC3D,MAAM,MAAM,GAAG,IAAI,GAAG,EAAyB,CAAC;IAChD,MAAM,OAAO,GAAG,IAAI,GAAG,EAAsB,CAAC;IAE9C,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;QACrC,IAAI,CAAC,UAAU,CAAC,SAAS;YAAE,SAAS;QACpC,MAAM,QAAQ,GAAG,iBAAiB,CAAC,UAAU,CAAC,CAAC;QAC/C,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACvC,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,IAAI,yBAAyB,CACjC,UAAU,CAAC,QAAQ,EACnB,eAAe,UAAU,CAAC,SAAS,+BAA+B,QAAQ,CAAC,QAAQ,KAAK;gBACxF,4EAA4E,CAC7E,CAAC;QACJ,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QAClC,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;IACvC,CAAC;IAED,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;IACrC,KAAK,MAAM,QAAQ,IAAI,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC;QACtC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACxD,CAAC;IACD,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;QACrC,IAAI,UAAU,CAAC,SAAS;YAAE,SAAS;QACnC,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,kBAAkB,CAC9C,aAAa,CAAC,UAAU,CAAC,QAAQ,IAAI,UAAU,CAAC,SAAS,IAAI,UAAU,CAAC,UAAU,CAAC,EACnF,UAAU,CACX,CAAC;QACF,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;IAC3G,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,8EAA8E;AAC9E,MAAM,yBAAyB,GAAG,CAAC,GAAG,uBAAuB,IAAI,aAAa,EAAE,EAAE,aAAa,CAAU,CAAC;AAE1G;;;;GAIG;AACH,SAAS,iBAAiB,CAAC,UAAsB;IAC/C,MAAM,OAAO,GAAG,UAAU,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC7E,MAAM,MAAM,GAAG,yBAAyB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,KAAK,CAAC,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IACnG,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,MAAM,IAAI,yBAAyB,CACjC,UAAU,CAAC,QAAQ,EACnB,eAAe,UAAU,CAAC,SAAS,yCAAyC;YAC5E,2BAA2B,aAAa,oBAAoB,uBAAuB,IAAI,aAAa,OAAO;YAC3G,qBAAqB,aAAa,uDAAuD,CAC1F,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,KAAK,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC;IACnF,IAAI,QAAQ,KAAK,EAAE,IAAI,QAAQ,KAAK,GAAG,EAAE,CAAC;QACxC,MAAM,IAAI,yBAAyB,CACjC,UAAU,CAAC,QAAQ,EACnB,eAAe,UAAU,CAAC,SAAS,4DAA4D,CAChG,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,KAAK,IAAI,IAAI,QAAQ,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAClF,MAAM,IAAI,yBAAyB,CACjC,UAAU,CAAC,QAAQ,EACnB,eAAe,UAAU,CAAC,SAAS,oCAAoC,CACxE,CAAC;IACJ,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,oBAAoB,CACjC,UAAsB,EACtB,QAAgB,EAChB,IAAY,EACZ,YAAsC;IAEtC,IAAI,CAAC,YAAY,IAAI,CAAC,iBAAiB,CAAC,UAAU,CAAC,WAAW,EAAE,QAAQ,CAAC,EAAE,CAAC;QAC1E,MAAM,QAAQ,CAAC,UAAU,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QAC3C,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,2EAA2E;IAC3E,2EAA2E;IAC3E,gEAAgE;IAChE,IAAI,YAAY,CAAC,cAAc,EAAE,EAAE,CAAC;QAClC,MAAM,QAAQ,CAAC,UAAU,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QAC3C,OAAO,YAAY,CAAC,UAAU,EAAE,CAAC;IACnC,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;IAC9C,IAAI,YAAY,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5C,MAAM,QAAQ,CAAC,UAAU,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QAC3C,OAAO,YAAY,CAAC,cAAc,EAAE,CAAC;IACvC,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;IACrD,MAAM,SAAS,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC/B,OAAO,YAAY,CAAC,KAAK,CAAC,QAAQ,EAAE,UAAU,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;AACvE,CAAC;AAED,SAAS,mBAAmB,CAC1B,OAAkC;IAElC,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IACnE,OAAO,OAAO,CAAC,IAAI,KAAK,UAAU;QAChC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,KAAK,EAAE;QAC3B,CAAC,CAAC,EAAE,cAAc,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;AACzC,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,aAAa,CAAC,GAAW;IAChC,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;IAC3B,IAAI,IAAI,KAAK,EAAE,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QACjD,MAAM,IAAI,yBAAyB,CACjC,GAAG,EACH,IAAI,GAAG,wDAAwD,CAChE,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/shared/attachment-zip.d.ts

@@ -0,0 +1,85 @@
+/**
+ * ZIP validation and decompression for attachment archives — the byte-level
+ * half of an `extract` attachment, shared by every writer of one.
+ *
+ * Security model: attachments are untrusted user uploads. Archives are parsed
+ * from the central directory — the format's authoritative index — via the
+ * shared structural layer (@stigmer/zip-structure; issue #567, which killed
+ * the earlier local-header walk: it silently truncated stored streaming
+ * entries and rejected Go-default archives outright). Every entry is
+ * validated for path traversal, zip bombs, and format integrity BEFORE any
+ * extraction occurs, and because the central directory's sizes are
+ * declarations an attacker controls, decompression re-enforces them: an
+ * entry whose actual output disagrees with its declared size aborts the
+ * extraction.
+ *
+ * Error model: fail-hard through {@link AttachmentValidationError}. An
+ * archive that fails any check aborts the whole attachment resolution and
+ * propagates a descriptive, user-fixable message. This is deliberately the
+ * OPPOSITE policy from the skill-artifact reader (`zip-extract.ts`,
+ * non-fatal empty return): skill artifacts were structurally vouched for by
+ * the push gates, attachments never are.
+ *
+ * Validation and decompression share one record ({@link ValidatedZipEntry},
+ * still carrying its payload slice), so parsing happens exactly once and
+ * "the manifest promised a file extraction cannot find" is unrepresentable.
+ * The WRITE of an extracted entry is the caller's: the attachment resolver
+ * writes under the session's platform dir (`attachment-resolver.ts`), the
+ * one caller since S3 M2b retired the native injector. Moved here from that
+ * injector at S3 M1 (Q-S3-14) so the guards have one home.
+ */
+export declare const MAX_ZIP_FILES = 1000;
+export declare const MAX_ZIP_EXTRACTED_SIZE: number;
+export interface ZipEntryInfo {
+    readonly relativePath: string;
+    readonly uncompressedSize: number;
+}
+/**
+ * A validated file entry, still carrying its payload slice. Validation and
+ * extraction share these records — parsing happens exactly once, so "the
+ * manifest promised a file extraction cannot find" is unrepresentable
+ * (the old two-walker design silently skipped such entries).
+ */
+export interface ValidatedZipEntry extends ZipEntryInfo {
+    readonly compressionMethod: number;
+    readonly compressedData: Uint8Array;
+}
+/** An archive the user handed us cannot be safely extracted; the reason is theirs to fix. */
+export declare class AttachmentValidationError extends Error {
+    readonly attachmentFilename: string;
+    readonly reason: string;
+    constructor(attachmentFilename: string, reason: string);
+}
+/**
+ * Validate a ZIP archive for safe extraction. Returns the manifest of
+ * file entries (directories excluded) if the archive passes all checks.
+ *
+ * Security checks enforced:
+ * 1. Valid ZIP format (readable central directory; fail-hard, see module doc)
+ * 2. No absolute paths (entries starting with / or \)
+ * 3. No path traversal (.. components)
+ * 4. No null bytes in filenames
+ * 5. No duplicate entry paths (a contradictory manifest)
+ * 6. Only supported compression methods (stored, deflate) — checked here
+ *    so an unsupported entry can never abort extraction after earlier
+ *    entries were already written
+ * 7. Non-empty archive (at least one file entry)
+ * 8. File count within limits (max 1000)
+ * 9. Total declared uncompressed size within limits (max 100 MB) —
+ *    declarations are re-enforced against actual output at decompression
+ */
+export declare function validateZipForExtraction(zipData: Buffer, sourceFilename: string): ZipEntryInfo[];
+/** The same checks as {@link validateZipForExtraction}, keeping each entry's payload for the extraction that follows. */
+export declare function parseAndValidateZip(zipData: Buffer, sourceFilename: string): ValidatedZipEntry[];
+/**
+ * Decompress a validated entry, enforcing its declared uncompressed size.
+ *
+ * The size cap in parseAndValidateZip budgets *declared* sizes, which the
+ * archive author controls — a crafted archive can declare 1 KB and inflate
+ * to gigabytes. Enforcement is therefore two-sided and fail-hard: inflation
+ * aborts the moment output exceeds the declaration, and an undershoot (or a
+ * stored payload whose length disagrees) fails too, because a manifest that
+ * misdescribes its own contents is exactly the corrupt-input class this
+ * module must never extract from.
+ */
+export declare function decompressEntry(entry: ValidatedZipEntry, sourceFilename: string): Promise<Buffer>;

package/dist/shared/attachment-zip.js

@@ -0,0 +1,185 @@
+/**
+ * ZIP validation and decompression for attachment archives — the byte-level
+ * half of an `extract` attachment, shared by every writer of one.
+ *
+ * Security model: attachments are untrusted user uploads. Archives are parsed
+ * from the central directory — the format's authoritative index — via the
+ * shared structural layer (@stigmer/zip-structure; issue #567, which killed
+ * the earlier local-header walk: it silently truncated stored streaming
+ * entries and rejected Go-default archives outright). Every entry is
+ * validated for path traversal, zip bombs, and format integrity BEFORE any
+ * extraction occurs, and because the central directory's sizes are
+ * declarations an attacker controls, decompression re-enforces them: an
+ * entry whose actual output disagrees with its declared size aborts the
+ * extraction.
+ *
+ * Error model: fail-hard through {@link AttachmentValidationError}. An
+ * archive that fails any check aborts the whole attachment resolution and
+ * propagates a descriptive, user-fixable message. This is deliberately the
+ * OPPOSITE policy from the skill-artifact reader (`zip-extract.ts`,
+ * non-fatal empty return): skill artifacts were structurally vouched for by
+ * the push gates, attachments never are.
+ *
+ * Validation and decompression share one record ({@link ValidatedZipEntry},
+ * still carrying its payload slice), so parsing happens exactly once and
+ * "the manifest promised a file extraction cannot find" is unrepresentable.
+ * The WRITE of an extracted entry is the caller's: the attachment resolver
+ * writes under the session's platform dir (`attachment-resolver.ts`), the
+ * one caller since S3 M2b retired the native injector. Moved here from that
+ * injector at S3 M1 (Q-S3-14) so the guards have one home.
+ */
+import { createInflateRaw } from "node:zlib";
+import { posix } from "node:path";
+import { EOCD_MIN_SIZE, parseZipStructure, } from "@stigmer/zip-structure";
+// ── Constants ────────────────────────────────────────────────────────
+export const MAX_ZIP_FILES = 1000;
+export const MAX_ZIP_EXTRACTED_SIZE = 100 * 1024 * 1024; // 100 MB
+// ── Errors ───────────────────────────────────────────────────────────
+/** An archive the user handed us cannot be safely extracted; the reason is theirs to fix. */
+export class AttachmentValidationError extends Error {
+    attachmentFilename;
+    reason;
+    constructor(attachmentFilename, reason) {
+        super(`Attachment '${attachmentFilename}': ${reason}`);
+        this.name = "AttachmentValidationError";
+        this.attachmentFilename = attachmentFilename;
+        this.reason = reason;
+    }
+}
+// ── ZIP Validation (pure functions) ──────────────────────────────────
+/**
+ * Validate a ZIP archive for safe extraction. Returns the manifest of
+ * file entries (directories excluded) if the archive passes all checks.
+ *
+ * Security checks enforced:
+ * 1. Valid ZIP format (readable central directory; fail-hard, see module doc)
+ * 2. No absolute paths (entries starting with / or \)
+ * 3. No path traversal (.. components)
+ * 4. No null bytes in filenames
+ * 5. No duplicate entry paths (a contradictory manifest)
+ * 6. Only supported compression methods (stored, deflate) — checked here
+ *    so an unsupported entry can never abort extraction after earlier
+ *    entries were already written
+ * 7. Non-empty archive (at least one file entry)
+ * 8. File count within limits (max 1000)
+ * 9. Total declared uncompressed size within limits (max 100 MB) —
+ *    declarations are re-enforced against actual output at decompression
+ */
+export function validateZipForExtraction(zipData, sourceFilename) {
+    return parseAndValidateZip(zipData, sourceFilename).map(({ relativePath, uncompressedSize }) => ({ relativePath, uncompressedSize }));
+}
+/** The same checks as {@link validateZipForExtraction}, keeping each entry's payload for the extraction that follows. */
+export function parseAndValidateZip(zipData, sourceFilename) {
+    if (zipData.length < EOCD_MIN_SIZE) {
+        throw new AttachmentValidationError(sourceFilename, "not a valid ZIP archive (file too small)");
+    }
+    let structural;
+    try {
+        structural = parseZipStructure(zipData);
+    }
+    catch (err) {
+        throw new AttachmentValidationError(sourceFilename, `not a valid ZIP archive (${err instanceof Error ? err.message : String(err)})`);
+    }
+    const entries = [];
+    const seenPaths = new Set();
+    let totalUncompressed = 0;
+    for (const entry of structural) {
+        if (entry.name.includes("\u0000")) {
+            throw new AttachmentValidationError(sourceFilename, "contains a filename with null bytes and cannot be safely extracted");
+        }
+        if (entry.isDirectory)
+            continue;
+        if (entry.name.startsWith("/") || entry.name.startsWith("\\")) {
+            throw new AttachmentValidationError(sourceFilename, `contains an absolute path entry and cannot be safely extracted: ${entry.name}`);
+        }
+        if (hasPathTraversal(entry.name)) {
+            throw new AttachmentValidationError(sourceFilename, `contains a path traversal entry and cannot be safely extracted: ${entry.name}`);
+        }
+        if (seenPaths.has(entry.name)) {
+            throw new AttachmentValidationError(sourceFilename, `contains duplicate entry '${entry.name}' and cannot be safely extracted`);
+        }
+        seenPaths.add(entry.name);
+        if (entry.compressionMethod !== 0 && entry.compressionMethod !== 8) {
+            throw new AttachmentValidationError(sourceFilename, `entry '${entry.name}' uses unsupported compression method ${entry.compressionMethod}`);
+        }
+        entries.push({
+            relativePath: entry.name,
+            uncompressedSize: entry.uncompressedSize,
+            compressionMethod: entry.compressionMethod,
+            compressedData: entry.compressedData,
+        });
+        totalUncompressed += entry.uncompressedSize;
+    }
+    if (entries.length === 0) {
+        throw new AttachmentValidationError(sourceFilename, "is an empty ZIP archive (no file entries)");
+    }
+    if (entries.length > MAX_ZIP_FILES) {
+        throw new AttachmentValidationError(sourceFilename, `contains ${entries.length} files (limit: ${MAX_ZIP_FILES})`);
+    }
+    if (totalUncompressed > MAX_ZIP_EXTRACTED_SIZE) {
+        const sizeMb = (totalUncompressed / (1024 * 1024)).toFixed(1);
+        const limitMb = (MAX_ZIP_EXTRACTED_SIZE / (1024 * 1024)).toFixed(0);
+        throw new AttachmentValidationError(sourceFilename, `would extract to ${sizeMb} MB (limit: ${limitMb} MB)`);
+    }
+    return entries.sort((a, b) => a.relativePath.localeCompare(b.relativePath));
+}
+// ── Decompression ────────────────────────────────────────────────────
+/**
+ * Decompress a validated entry, enforcing its declared uncompressed size.
+ *
+ * The size cap in parseAndValidateZip budgets *declared* sizes, which the
+ * archive author controls — a crafted archive can declare 1 KB and inflate
+ * to gigabytes. Enforcement is therefore two-sided and fail-hard: inflation
+ * aborts the moment output exceeds the declaration, and an undershoot (or a
+ * stored payload whose length disagrees) fails too, because a manifest that
+ * misdescribes its own contents is exactly the corrupt-input class this
+ * module must never extract from.
+ */
+export async function decompressEntry(entry, sourceFilename) {
+    const declared = entry.uncompressedSize;
+    if (entry.compressionMethod === 0) {
+        if (entry.compressedData.length !== declared) {
+            throw new AttachmentValidationError(sourceFilename, `entry '${entry.relativePath}' payload is ${entry.compressedData.length} bytes ` +
+                `but the archive declares ${declared} — corrupt or crafted archive`);
+        }
+        return Buffer.from(entry.compressedData);
+    }
+    // Deflate — the only other method parseAndValidateZip admits.
+    return new Promise((resolve, reject) => {
+        const inflate = createInflateRaw();
+        const chunks = [];
+        let produced = 0;
+        inflate.on("data", (chunk) => {
+            produced += chunk.length;
+            if (produced > declared) {
+                inflate.destroy();
+                reject(new AttachmentValidationError(sourceFilename, `entry '${entry.relativePath}' decompresses past its declared size of ` +
+                    `${declared} bytes — corrupt or crafted archive`));
+                return;
+            }
+            chunks.push(chunk);
+        });
+        inflate.on("end", () => {
+            if (produced !== declared) {
+                reject(new AttachmentValidationError(sourceFilename, `entry '${entry.relativePath}' decompressed to ${produced} bytes ` +
+                    `but the archive declares ${declared} — corrupt or crafted archive`));
+                return;
+            }
+            resolve(Buffer.concat(chunks));
+        });
+        inflate.on("error", reject);
+        inflate.end(Buffer.from(entry.compressedData));
+    });
+}
+function hasPathTraversal(filePath) {
+    const normalized = posix.normalize(filePath);
+    if (normalized.startsWith("../") || normalized === "..")
+        return true;
+    const segments = filePath.split(/[/\\]/);
+    for (const seg of segments) {
+        if (seg === "..")
+            return true;
+    }
+    return false;
+}
+//# sourceMappingURL=attachment-zip.js.map

package/dist/shared/attachment-zip.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"attachment-zip.js","sourceRoot":"","sources":["../../src/shared/attachment-zip.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,KAAK,EAAE,MAAM,WAAW,CAAC;AAClC,OAAO,EACL,aAAa,EACb,iBAAiB,GAElB,MAAM,wBAAwB,CAAC;AAEhC,wEAAwE;AAExE,MAAM,CAAC,MAAM,aAAa,GAAG,IAAI,CAAC;AAClC,MAAM,CAAC,MAAM,sBAAsB,GAAG,GAAG,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC,SAAS;AAoBlE,wEAAwE;AAExE,6FAA6F;AAC7F,MAAM,OAAO,yBAA0B,SAAQ,KAAK;IACzC,kBAAkB,CAAS;IAC3B,MAAM,CAAS;IAExB,YAAY,kBAA0B,EAAE,MAAc;QACpD,KAAK,CAAC,eAAe,kBAAkB,MAAM,MAAM,EAAE,CAAC,CAAC;QACvD,IAAI,CAAC,IAAI,GAAG,2BAA2B,CAAC;QACxC,IAAI,CAAC,kBAAkB,GAAG,kBAAkB,CAAC;QAC7C,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;CACF;AAED,wEAAwE;AAExE;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,wBAAwB,CACtC,OAAe,EACf,cAAsB;IAEtB,OAAO,mBAAmB,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC,GAAG,CACrD,CAAC,EAAE,YAAY,EAAE,gBAAgB,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,YAAY,EAAE,gBAAgB,EAAE,CAAC,CAC7E,CAAC;AACJ,CAAC;AAED,yHAAyH;AACzH,MAAM,UAAU,mBAAmB,CACjC,OAAe,EACf,cAAsB;IAEtB,IAAI,OAAO,CAAC,MAAM,GAAG,aAAa,EAAE,CAAC;QACnC,MAAM,IAAI,yBAAyB,CACjC,cAAc,EACd,0CAA0C,CAC3C,CAAC;IACJ,CAAC;IAED,IAAI,UAAgC,CAAC;IACrC,IAAI,CAAC;QACH,UAAU,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAC1C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,yBAAyB,CACjC,cAAc,EACd,4BAA4B,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAChF,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAwB,EAAE,CAAC;IACxC,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;IACpC,IAAI,iBAAiB,GAAG,CAAC,CAAC;IAE1B,KAAK,MAAM,KAAK,IAAI,UAAU,EAAE,CAAC;QAC/B,IAAI,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YAClC,MAAM,IAAI,yBAAyB,CACjC,cAAc,EACd,oEAAoE,CACrE,CAAC;QACJ,CAAC;QAED,IAAI,KAAK,CAAC,WAAW;YAAE,SAAS;QAEhC,IAAI,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9D,MAAM,IAAI,yBAAyB,CACjC,cAAc,EACd,mEAAmE,KAAK,CAAC,IAAI,EAAE,CAChF,CAAC;QACJ,CAAC;QAED,IAAI,gBAAgB,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YACjC,MAAM,IAAI,yBAAyB,CACjC,cAAc,EACd,mEAAmE,KAAK,CAAC,IAAI,EAAE,CAChF,CAAC;QACJ,CAAC;QAED,IAAI,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9B,MAAM,IAAI,yBAAyB,CACjC,cAAc,EACd,6BAA6B,KAAK,CAAC,IAAI,kCAAkC,CAC1E,CAAC;QACJ,CAAC;QACD,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAE1B,IAAI,KAAK,CAAC,iBAAiB,KAAK,CAAC,IAAI,KAAK,CAAC,iBAAiB,KAAK,CAAC,EAAE,CAAC;YACnE,MAAM,IAAI,yBAAyB,CACjC,cAAc,EACd,UAAU,KAAK,CAAC,IAAI,yCAAyC,KAAK,CAAC,iBAAiB,EAAE,CACvF,CAAC;QACJ,CAAC;QAED,OAAO,CAAC,IAAI,CAAC;YACX,YAAY,EAAE,KAAK,CAAC,IAAI;YACxB,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;YACxC,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;YAC1C,cAAc,EAAE,KAAK,CAAC,cAAc;SACrC,CAAC,CAAC;QACH,iBAAiB,IAAI,KAAK,CAAC,gBAAgB,CAAC;IAC9C,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,yBAAyB,CACjC,cAAc,EACd,2CAA2C,CAC5C,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,GAAG,aAAa,EAAE,CAAC;QACnC,MAAM,IAAI,yBAAyB,CACjC,cAAc,EACd,YAAY,OAAO,CAAC,MAAM,kBAAkB,aAAa,GAAG,CAC7D,CAAC;IACJ,CAAC;IAED,IAAI,iBAAiB,GAAG,sBAAsB,EAAE,CAAC;QAC/C,MAAM,MAAM,GAAG,CAAC,iBAAiB,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QAC9D,MAAM,OAAO,GAAG,CAAC,sBAAsB,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QACpE,MAAM,IAAI,yBAAyB,CACjC,cAAc,EACd,oBAAoB,MAAM,eAAe,OAAO,MAAM,CACvD,CAAC;IACJ,CAAC;IAED,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,aAAa,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC;AAC9E,CAAC;AAED,wEAAwE;AAExE;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,KAAwB,EACxB,cAAsB;IAEtB,MAAM,QAAQ,GAAG,KAAK,CAAC,gBAAgB,CAAC;IAExC,IAAI,KAAK,CAAC,iBAAiB,KAAK,CAAC,EAAE,CAAC;QAClC,IAAI,KAAK,CAAC,cAAc,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC7C,MAAM,IAAI,yBAAyB,CACjC,cAAc,EACd,UAAU,KAAK,CAAC,YAAY,gBAAgB,KAAK,CAAC,cAAc,CAAC,MAAM,SAAS;gBAChF,4BAA4B,QAAQ,+BAA+B,CACpE,CAAC;QACJ,CAAC;QACD,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;IAC3C,CAAC;IAED,8DAA8D;IAC9D,OAAO,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC7C,MAAM,OAAO,GAAG,gBAAgB,EAAE,CAAC;QACnC,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,IAAI,QAAQ,GAAG,CAAC,CAAC;QACjB,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YACnC,QAAQ,IAAI,KAAK,CAAC,MAAM,CAAC;YACzB,IAAI,QAAQ,GAAG,QAAQ,EAAE,CAAC;gBACxB,OAAO,CAAC,OAAO,EAAE,CAAC;gBAClB,MAAM,CAAC,IAAI,yBAAyB,CAClC,cAAc,EACd,UAAU,KAAK,CAAC,YAAY,2CAA2C;oBACvE,GAAG,QAAQ,qCAAqC,CACjD,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC,CAAC,CAAC;QACH,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;YACrB,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;gBAC1B,MAAM,CAAC,IAAI,yBAAyB,CAClC,cAAc,EACd,UAAU,KAAK,CAAC,YAAY,qBAAqB,QAAQ,SAAS;oBAClE,4BAA4B,QAAQ,+BAA+B,CACpE,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YACD,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;QACjC,CAAC,CAAC,CAAC;QACH,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC5B,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC;IACjD,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,gBAAgB,CAAC,QAAgB;IACxC,MAAM,UAAU,GAAG,KAAK,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;IAC7C,IAAI,UAAU,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,UAAU,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAErE,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACzC,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC3B,IAAI,GAAG,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;IAChC,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC"}