@stigmer/server 3.14.0-dev.20260910084630

package/dist/artifactstorage/artifact-storage.js

@@ -0,0 +1,298 @@
+/**
+ * Artifact storage — ports pkg/domain/artifact/storage/{storage.go,
+ * local_storage.go,disposition.go}: the execution-output/attachment blob
+ * store SHARED (D1) by agentexecution attachments (#17), the artifact
+ * domain + its port+1 file server (#13), and skill's
+ * pushFromExecutionArtifact (#8). Cross-cutting home, like
+ * src/encryption/ (the ratified sub-project DD).
+ *
+ * The LOCAL backend is the OSS default: the configured base path IS the
+ * artifact root — a key K stores at <basePath>/<K> with no implicit
+ * segment, so the server and the runner (LOCAL_ARTIFACT_PATH) share one
+ * store by construction (#285).
+ *
+ * The R2 backend (S3-compatible, AWS SDK) lives in r2-storage.ts — it
+ * arrived with the artifact domain (#13) per the ratified deferral, closing
+ * the temporary ARTIFACT_STORAGE_TYPE=r2 boot-fail divergence #17 shipped.
+ *
+ * Since O5 (20260827.02, blueprint 03 §6b) this is the ONE blob-driver
+ * seam of the convergence program: it gained the presigned-PUT capability,
+ * `size`, a typed not-found error, and registry-driven driver registration
+ * (extensions/drivers.ts). Domain semantics — content-addressed keys,
+ * staging lanes, write-once postures — deliberately live ABOVE this
+ * interface in their owning domains: the driver stores blobs; the domain
+ * owns keys and lanes.
+ */
+import { mkdirSync } from "node:fs";
+import { mkdir, readFile, rm, rmdir, stat, writeFile, } from "node:fs/promises";
+import path from "node:path";
+import { goQueryEscape } from "../gocompat/query-escape.js";
+import { R2ArtifactStorage } from "./r2-storage.js";
+/** Query key carrying the desired download filename on local URLs; the
+ * artifact file server (#13) reads it to set Content-Disposition. */
+export const LOCAL_DOWNLOAD_QUERY_PARAM = "download";
+/**
+ * A storage key that addresses no stored blob. Consumers that must map
+ * "missing" onto their own domain vocabulary (skill's ArtifactNotFoundError,
+ * a NotFound wire code) branch on this class per the ratified store-fault
+ * instanceof idiom; every OTHER driver failure is an infrastructure fault
+ * to rethrow or wrap, never a not-found.
+ */
+export class ArtifactStorageNotFoundError extends Error {
+    constructor(key) {
+        // The local backend's historical copy, kept verbatim — this class adds
+        // a type to the existing message, not a new message.
+        super(`artifact not found: ${key}`);
+        this.name = "ArtifactStorageNotFoundError";
+    }
+}
+/**
+ * The built-in driver names. Registered drivers may not shadow them —
+ * resolveExtensions enforces that at boot (a shadowed built-in would be
+ * silently unreachable, the §2b loud-fail rules forbid exactly that).
+ */
+export const BUILT_IN_STORAGE_TYPES = ["local", "r2"];
+/**
+ * Factory mirroring Go NewArtifactStorage, opened to registered drivers
+ * with O5 (§6b): built-ins first, then the composition's registered driver
+ * map — the cloud substitutes its per-domain R2 drivers without this
+ * switch ever growing a case.
+ */
+export function newArtifactStorage(config, registeredDrivers = new Map()) {
+    const storageType = config.type === "" ? "local" : config.type;
+    switch (storageType) {
+        case "local":
+            return new LocalArtifactStorage(config.localBasePath, config.localServeUrl);
+        case "r2":
+            return new R2ArtifactStorage({
+                bucket: config.r2Bucket,
+                endpoint: config.r2Endpoint,
+                accessKeyId: config.r2AccessKeyId,
+                secretAccessKey: config.r2SecretAccessKey,
+                region: config.r2Region,
+            });
+        default: {
+            const registered = registeredDrivers.get(storageType);
+            if (registered !== undefined) {
+                return registered();
+            }
+            const known = [...BUILT_IN_STORAGE_TYPES, ...registeredDrivers.keys()]
+                .map((name) => `'${name}'`)
+                .join(" or ");
+            throw new Error(`unknown storage type: ${storageType} (must be ${known})`);
+        }
+    }
+}
+export class LocalArtifactStorage {
+    basePath;
+    serveUrl;
+    stagedUploadLane;
+    constructor(basePath, serveUrl, 
+    /**
+     * The staged-upload mechanism backing presignPut — optional because
+     * only instances whose root the lane stages into can serve it (the
+     * skill store instance today); presignPut on an unwired instance is
+     * the explicit not-configured throw, mirroring getSignedUrl's
+     * serve-URL posture.
+     */
+    stagedUploadLane) {
+        this.basePath = basePath;
+        this.serveUrl = serveUrl;
+        this.stagedUploadLane = stagedUploadLane;
+        // Ensure the artifact root exists (Go NewLocalStorage MkdirAll).
+        mkdirSync(this.root(), { recursive: true });
+    }
+    async upload(key, data, _contentType) {
+        const filePath = this.resolveWithinRoot(key);
+        await mkdir(path.dirname(filePath), { recursive: true });
+        // Restricted permissions, matching Go's 0600.
+        await writeFile(filePath, data, { mode: 0o600 });
+    }
+    async download(key) {
+        const filePath = this.resolveWithinRoot(key);
+        try {
+            return await readFile(filePath);
+        }
+        catch (error) {
+            if (error.code === "ENOENT") {
+                throw new ArtifactStorageNotFoundError(key);
+            }
+            throw error;
+        }
+    }
+    async size(key) {
+        const filePath = this.resolveWithinRoot(key);
+        try {
+            return (await stat(filePath)).size;
+        }
+        catch (error) {
+            if (error.code === "ENOENT") {
+                throw new ArtifactStorageNotFoundError(key);
+            }
+            throw error;
+        }
+    }
+    async presignPut(declaredSizeBytes, _ttlMs) {
+        if (this.stagedUploadLane === undefined) {
+            throw new Error("local presigned uploads not configured - no staged-upload lane is wired to this store instance");
+        }
+        // The lane's slot TTL governs, not the caller's ask — the slot
+        // registry sweeps on ITS clock, and a URL outliving its slot would be
+        // a credential for nothing.
+        const { ref, ttlMs } = this.stagedUploadLane.mint(declaredSizeBytes);
+        return {
+            url: this.stagedUploadLane.uploadUrl(ref),
+            stagingKey: this.stagedUploadLane.stagedKey(ref),
+            ttlMs,
+        };
+    }
+    async getSignedUrl(key, _expiresInMs, downloadFilename) {
+        if (this.serveUrl === "") {
+            throw new Error("local serve URL not configured");
+        }
+        let url = `${this.serveUrl}/${key}`;
+        if (downloadFilename !== "") {
+            url += `?${LOCAL_DOWNLOAD_QUERY_PARAM}=${goQueryEscape(downloadFilename)}`;
+        }
+        return url;
+    }
+    async delete(key) {
+        const filePath = this.resolveWithinRoot(key);
+        await rm(filePath, { force: true });
+        await this.cleanupEmptyDirs(path.dirname(filePath));
+    }
+    async exists(key) {
+        const filePath = this.resolveWithinRoot(key);
+        try {
+            await stat(filePath);
+            return true;
+        }
+        catch (error) {
+            if (error.code === "ENOENT") {
+                return false;
+            }
+            throw error;
+        }
+    }
+    async health() {
+        const info = await stat(this.root()).catch((error) => {
+            throw new Error(`artifacts directory not accessible: ${error instanceof Error ? error.message : String(error)}`);
+        });
+        if (!info.isDirectory()) {
+            throw new Error("artifacts path is not a directory");
+        }
+        const testFile = path.join(this.root(), ".health_check");
+        await writeFile(testFile, "ok", { mode: 0o600 }).catch((error) => {
+            throw new Error(`artifacts directory not writable: ${error instanceof Error ? error.message : String(error)}`);
+        });
+        await rm(testFile, { force: true });
+    }
+    /**
+     * The single directory every key resolves under — the base path itself
+     * (#285): the key→path mapping, the health probe, and the cleanup floor
+     * can never disagree about where the store lives.
+     */
+    root() {
+        return this.basePath;
+    }
+    /**
+     * Maps a storage key to an absolute path, guaranteeing the result stays
+     * inside the artifact root. Keys carry caller-influenced segments (an
+     * attachment's original filename rides in the key) and path.join CLEANS
+     * `..` rather than rejecting it — without this guard a crafted key
+     * escapes the store. A key resolving outside the root is refused with a
+     * descriptive, non-path error.
+     */
+    resolveWithinRoot(key) {
+        const root = this.root();
+        const full = path.join(root, key);
+        if (!isWithin(root, full)) {
+            throw new Error(`storage key ${JSON.stringify(key)} resolves outside the artifact storage root`);
+        }
+        return full;
+    }
+    /**
+     * Removes empty parent directories up to (but never including) the
+     * artifact root; stops at the first non-empty directory.
+     */
+    async cleanupEmptyDirs(dir) {
+        const root = this.root();
+        if (!isWithin(root, dir) || path.resolve(dir) === path.resolve(root)) {
+            return;
+        }
+        try {
+            // rmdir fails on non-empty directories — exactly the stop signal
+            // (Go os.Remove semantics).
+            await rmdir(dir);
+        }
+        catch {
+            return;
+        }
+        await this.cleanupEmptyDirs(path.dirname(dir));
+    }
+}
+// goQueryEscape moved to src/gocompat/query-escape.ts when the github
+// broker became its second consumer (#13) — the shared-steps promotion
+// rule. Behavior unchanged; the URL parity tests below still pin it.
+/**
+ * Whether `p` is `root` itself or a descendant — cleaned-path comparison
+ * with a trailing separator so a sibling sharing a name prefix (`/a/bc`
+ * vs `/a/b`) is correctly excluded (Go isWithin).
+ */
+function isWithin(root, p) {
+    const cleanRoot = path.resolve(root);
+    const cleanPath = path.resolve(p);
+    return (cleanPath === cleanRoot || cleanPath.startsWith(cleanRoot + path.sep));
+}
+/**
+ * Content-Disposition header value instructing a browser to save the
+ * response as a download named filename (Go
+ * ContentDispositionAttachment): a plain quoted `filename="..."`
+ * (ASCII-sanitized fallback) plus, when the name carries non-ASCII, the
+ * RFC 5987 `filename*=UTF-8''...` parameter modern browsers prefer. The
+ * fallback escapes embedded quotes and backslashes, so a crafted name can
+ * never break out of the header value. Consumed by #13's file server;
+ * defined with the storage it describes.
+ */
+export function contentDispositionAttachment(filename) {
+    const ascii = sanitizeAsciiFilename(filename);
+    const quoted = `"${ascii.replaceAll("\\", "\\\\").replaceAll('"', '\\"')}"`;
+    let disposition = `attachment; filename=${quoted}`;
+    if (ascii !== filename) {
+        disposition += `; filename*=UTF-8''${rfc5987Encode(filename)}`;
+    }
+    return disposition;
+}
+/** Bytes outside printable ASCII (and controls) become '_' (Go twin). */
+function sanitizeAsciiFilename(filename) {
+    let out = "";
+    for (const r of filename) {
+        const code = r.codePointAt(0) ?? 0;
+        out += code < 0x20 || code > 0x7e ? "_" : r;
+    }
+    return out;
+}
+/** Percent-encodes per RFC 5987 ext-value, attr-chars unescaped. */
+function rfc5987Encode(filename) {
+    const bytes = Buffer.from(filename, "utf-8");
+    let out = "";
+    for (const c of bytes) {
+        if (isRfc5987AttrChar(c)) {
+            out += String.fromCharCode(c);
+        }
+        else {
+            out += `%${c.toString(16).toUpperCase().padStart(2, "0")}`;
+        }
+    }
+    return out;
+}
+function isRfc5987AttrChar(c) {
+    if ((c >= 0x41 && c <= 0x5a) || // A-Z
+        (c >= 0x61 && c <= 0x7a) || // a-z
+        (c >= 0x30 && c <= 0x39) // 0-9
+    ) {
+        return true;
+    }
+    return "!#$&+-.^_`|~".includes(String.fromCharCode(c));
+}
+//# sourceMappingURL=artifact-storage.js.map

package/dist/artifactstorage/artifact-storage.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"artifact-storage.js","sourceRoot":"","sources":["../../src/artifactstorage/artifact-storage.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,EACL,KAAK,EACL,QAAQ,EACR,EAAE,EACF,KAAK,EACL,IAAI,EACJ,SAAS,GACV,MAAM,kBAAkB,CAAC;AAC1B,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAC5D,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAEpD;qEACqE;AACrE,MAAM,CAAC,MAAM,0BAA0B,GAAG,UAAU,CAAC;AAErD;;;;;;GAMG;AACH,MAAM,OAAO,4BAA6B,SAAQ,KAAK;IACrD,YAAY,GAAW;QACrB,uEAAuE;QACvE,qDAAqD;QACrD,KAAK,CAAC,uBAAuB,GAAG,EAAE,CAAC,CAAC;QACpC,IAAI,CAAC,IAAI,GAAG,8BAA8B,CAAC;IAC7C,CAAC;CACF;AA0GD;;;;GAIG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,OAAO,EAAE,IAAI,CAAU,CAAC;AAE/D;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAChC,MAA6B,EAC7B,oBAAuE,IAAI,GAAG,EAAE;IAEhF,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC;IAC/D,QAAQ,WAAW,EAAE,CAAC;QACpB,KAAK,OAAO;YACV,OAAO,IAAI,oBAAoB,CAC7B,MAAM,CAAC,aAAa,EACpB,MAAM,CAAC,aAAa,CACrB,CAAC;QACJ,KAAK,IAAI;YACP,OAAO,IAAI,iBAAiB,CAAC;gBAC3B,MAAM,EAAE,MAAM,CAAC,QAAQ;gBACvB,QAAQ,EAAE,MAAM,CAAC,UAAU;gBAC3B,WAAW,EAAE,MAAM,CAAC,aAAa;gBACjC,eAAe,EAAE,MAAM,CAAC,iBAAiB;gBACzC,MAAM,EAAE,MAAM,CAAC,QAAQ;aACxB,CAAC,CAAC;QACL,OAAO,CAAC,CAAC,CAAC;YACR,MAAM,UAAU,GAAG,iBAAiB,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;YACtD,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;gBAC7B,OAAO,UAAU,EAAE,CAAC;YACtB,CAAC;YACD,MAAM,KAAK,GAAG,CAAC,GAAG,sBAAsB,EAAE,GAAG,iBAAiB,CAAC,IAAI,EAAE,CAAC;iBACnE,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,IAAI,GAAG,CAAC;iBAC1B,IAAI,CAAC,MAAM,CAAC,CAAC;YAChB,MAAM,IAAI,KAAK,CAAC,yBAAyB,WAAW,aAAa,KAAK,GAAG,CAAC,CAAC;QAC7E,CAAC;IACH,CAAC;AACH,CAAC;AAED,MAAM,OAAO,oBAAoB;IAEZ;IACA;IAQA;IAVnB,YACmB,QAAgB,EAChB,QAAgB;IACjC;;;;;;OAMG;IACc,gBAAmC;QATnC,aAAQ,GAAR,QAAQ,CAAQ;QAChB,aAAQ,GAAR,QAAQ,CAAQ;QAQhB,qBAAgB,GAAhB,gBAAgB,CAAmB;QAEpD,iEAAiE;QACjE,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9C,CAAC;IAED,KAAK,CAAC,MAAM,CACV,GAAW,EACX,IAAgB,EAChB,YAAoB;QAEpB,MAAM,QAAQ,GAAG,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC;QAC7C,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACzD,8CAA8C;QAC9C,MAAM,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACnD,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,GAAW;QACxB,MAAM,QAAQ,GAAG,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC;QAC7C,IAAI,CAAC;YACH,OAAO,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAClC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACvD,MAAM,IAAI,4BAA4B,CAAC,GAAG,CAAC,CAAC;YAC9C,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,GAAW;QACpB,MAAM,QAAQ,GAAG,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC;QAC7C,IAAI,CAAC;YACH,OAAO,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;QACrC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACvD,MAAM,IAAI,4BAA4B,CAAC,GAAG,CAAC,CAAC;YAC9C,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED,KAAK,CAAC,UAAU,CACd,iBAAyB,EACzB,MAAc;QAEd,IAAI,IAAI,CAAC,gBAAgB,KAAK,SAAS,EAAE,CAAC;YACxC,MAAM,IAAI,KAAK,CACb,gGAAgG,CACjG,CAAC;QACJ,CAAC;QACD,+DAA+D;QAC/D,sEAAsE;QACtE,4BAA4B;QAC5B,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;QACrE,OAAO;YACL,GAAG,EAAE,IAAI,CAAC,gBAAgB,CAAC,SAAS,CAAC,GAAG,CAAC;YACzC,UAAU,EAAE,IAAI,CAAC,gBAAgB,CAAC,SAAS,CAAC,GAAG,CAAC;YAChD,KAAK;SACN,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,YAAY,CAChB,GAAW,EACX,YAAoB,EACpB,gBAAwB;QAExB,IAAI,IAAI,CAAC,QAAQ,KAAK,EAAE,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;QACpD,CAAC;QACD,IAAI,GAAG,GAAG,GAAG,IAAI,CAAC,QAAQ,IAAI,GAAG,EAAE,CAAC;QACpC,IAAI,gBAAgB,KAAK,EAAE,EAAE,CAAC;YAC5B,GAAG,IAAI,IAAI,0BAA0B,IAAI,aAAa,CAAC,gBAAgB,CAAC,EAAE,CAAC;QAC7E,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,GAAW;QACtB,MAAM,QAAQ,GAAG,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC;QAC7C,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACpC,MAAM,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;IACtD,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,GAAW;QACtB,MAAM,QAAQ,GAAG,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC;QAC7C,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,QAAQ,CAAC,CAAC;YACrB,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACvD,OAAO,KAAK,CAAC;YACf,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED,KAAK,CAAC,MAAM;QACV,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;YAC5D,MAAM,IAAI,KAAK,CACb,uCAAuC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAChG,CAAC;QACJ,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;QACvD,CAAC;QACD,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,eAAe,CAAC,CAAC;QACzD,MAAM,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,CACpD,CAAC,KAAc,EAAE,EAAE;YACjB,MAAM,IAAI,KAAK,CACb,qCAAqC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAC9F,CAAC;QACJ,CAAC,CACF,CAAC;QACF,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACtC,CAAC;IAED;;;;OAIG;IACK,IAAI;QACV,OAAO,IAAI,CAAC,QAAQ,CAAC;IACvB,CAAC;IAED;;;;;;;OAOG;IACK,iBAAiB,CAAC,GAAW;QACnC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAClC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CACb,eAAe,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,6CAA6C,CAChF,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,gBAAgB,CAAC,GAAW;QACxC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QACzB,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YACrE,OAAO;QACT,CAAC;QACD,IAAI,CAAC;YACH,iEAAiE;YACjE,4BAA4B;YAC5B,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC;QACnB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO;QACT,CAAC;QACD,MAAM,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;IACjD,CAAC;CACF;AAED,sEAAsE;AACtE,uEAAuE;AACvE,qEAAqE;AAErE;;;;GAIG;AACH,SAAS,QAAQ,CAAC,IAAY,EAAE,CAAS;IACvC,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACrC,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IAClC,OAAO,CACL,SAAS,KAAK,SAAS,IAAI,SAAS,CAAC,UAAU,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,CACtE,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,4BAA4B,CAAC,QAAgB;IAC3D,MAAM,KAAK,GAAG,qBAAqB,CAAC,QAAQ,CAAC,CAAC;IAC9C,MAAM,MAAM,GAAG,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC;IAC5E,IAAI,WAAW,GAAG,wBAAwB,MAAM,EAAE,CAAC;IACnD,IAAI,KAAK,KAAK,QAAQ,EAAE,CAAC;QACvB,WAAW,IAAI,sBAAsB,aAAa,CAAC,QAAQ,CAAC,EAAE,CAAC;IACjE,CAAC;IACD,OAAO,WAAW,CAAC;AACrB,CAAC;AAED,yEAAyE;AACzE,SAAS,qBAAqB,CAAC,QAAgB;IAC7C,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACnC,GAAG,IAAI,IAAI,GAAG,IAAI,IAAI,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9C,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,oEAAoE;AACpE,SAAS,aAAa,CAAC,QAAgB;IACrC,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC7C,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,IAAI,iBAAiB,CAAC,CAAC,CAAC,EAAE,CAAC;YACzB,GAAG,IAAI,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAChC,CAAC;aAAM,CAAC;YACN,GAAG,IAAI,IAAI,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC;QAC7D,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,iBAAiB,CAAC,CAAS;IAClC,IACE,CAAC,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,MAAM;QAClC,CAAC,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,MAAM;QAClC,CAAC,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,MAAM;MAC/B,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,cAAc,CAAC,QAAQ,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC;AACzD,CAAC"}

package/dist/artifactstorage/r2-storage.d.ts

@@ -0,0 +1,55 @@
+import { S3Client } from "@aws-sdk/client-s3";
+import { getSignedUrl as presignGetObject } from "@aws-sdk/s3-request-presigner";
+import type { ArtifactStorage, PresignedUpload } from "./artifact-storage.js";
+/** Go: "R2 has a maximum expiration of 7 days" — presigns clamp here. */
+export declare const R2_MAX_EXPIRATION_MS: number;
+/**
+ * Key prefix for presignPut staging blobs (§6b). Pinned as the surface a
+ * deployment's bucket lifecycle rule targets: the driver mints under it,
+ * operations sweeps it — changing it orphans staged blobs from the sweep.
+ */
+export declare const R2_STAGING_PREFIX = "staging/";
+export interface R2StorageConfig {
+    readonly bucket: string;
+    readonly endpoint: string;
+    readonly accessKeyId: string;
+    readonly secretAccessKey: string;
+    /** Usually "auto" for R2 (Go default). */
+    readonly region: string;
+}
+/** Test seam: the two AWS clients, injectable for hermetic unit tests. */
+export interface R2Clients {
+    readonly client: S3Client;
+    readonly presign: typeof presignGetObject;
+}
+/**
+ * The exported R2 driver constructor (C1 seam, 20260827.04): a composition
+ * registers R2-backed drivers with ITS OWN config — the cloud's verified
+ * shape is distinct buckets/credentials per domain (blueprint §6b) — while
+ * the S3 plumbing, presign clamp, and not-found mapping live exactly once
+ * here. Loud-fail: the required-config throws below fire at driver
+ * construction, which the registered lazy factory defers to first use of
+ * the named driver (the factory contract in drivers.ts).
+ */
+export declare function newR2ArtifactStorage(config: R2StorageConfig): ArtifactStorage;
+export declare class R2ArtifactStorage implements ArtifactStorage {
+    private readonly client;
+    private readonly presign;
+    private readonly bucket;
+    constructor(config: R2StorageConfig, clients?: R2Clients);
+    upload(key: string, data: Uint8Array, contentType: string): Promise<void>;
+    download(key: string): Promise<Uint8Array>;
+    size(key: string): Promise<number>;
+    presignPut(declaredSizeBytes: number, ttlMs: number): Promise<PresignedUpload>;
+    getSignedUrl(key: string, expiresInMs: number, downloadFilename: string): Promise<string>;
+    delete(key: string): Promise<void>;
+    exists(key: string): Promise<boolean>;
+    health(): Promise<void>;
+}
+/**
+ * Whether the error means "no such object" (Go isNotFoundError, adapted to
+ * the SDK's structured errors instead of Go's string matching): the S3
+ * NotFound/NoSuchKey names, an HTTP 404, or the legacy text forms.
+ */
+export declare function isNotFoundError(error: unknown): boolean;
+//# sourceMappingURL=r2-storage.d.ts.map

package/dist/artifactstorage/r2-storage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"r2-storage.d.ts","sourceRoot":"","sources":["../../src/artifactstorage/r2-storage.ts"],"names":[],"mappings":"AAaA,OAAO,EAML,QAAQ,EACT,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,YAAY,IAAI,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AAEjF,OAAO,KAAK,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAM9E,yEAAyE;AACzE,eAAO,MAAM,oBAAoB,QAA0B,CAAC;AAE5D;;;;GAIG;AACH,eAAO,MAAM,iBAAiB,aAAa,CAAC;AAU5C,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,0CAA0C;IAC1C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,0EAA0E;AAC1E,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,OAAO,gBAAgB,CAAC;CAC3C;AAED;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,eAAe,GAAG,eAAe,CAE7E;AAED,qBAAa,iBAAkB,YAAW,eAAe;IACvD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAW;IAClC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA0B;IAClD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;gBAEpB,MAAM,EAAE,eAAe,EAAE,OAAO,CAAC,EAAE,SAAS;IAkClD,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAezE,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;IAyB1C,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAclC,UAAU,CACd,iBAAiB,EAAE,MAAM,EACzB,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,eAAe,CAAC;IAwBrB,YAAY,CAChB,GAAG,EAAE,MAAM,EACX,WAAW,EAAE,MAAM,EACnB,gBAAgB,EAAE,MAAM,GACvB,OAAO,CAAC,MAAM,CAAC;IAoBZ,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAUlC,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAcrC,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC;CAS9B;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAevD"}

package/dist/artifactstorage/r2-storage.js

@@ -0,0 +1,225 @@
+/**
+ * R2 artifact storage — ports pkg/domain/artifact/storage/r2_storage.go:
+ * the Cloudflare R2 (S3-compatible) backend, filling the factory arm #17
+ * deferred to this sub-project (owner-ratified, approved at the #13 plan
+ * gate together with the @aws-sdk dependency).
+ *
+ * Not conformance-assertable on the local targets (same as Go — the Go
+ * tree carries no R2 tests at all); the port adds unit pins for the pieces
+ * that have logic: config validation copy, the 7-day presign clamp, the
+ * signed Content-Disposition, and the not-found mapping.
+ */
+import { randomBytes } from "node:crypto";
+import { DeleteObjectCommand, GetObjectCommand, HeadBucketCommand, HeadObjectCommand, PutObjectCommand, S3Client, } from "@aws-sdk/client-s3";
+import { getSignedUrl as presignGetObject } from "@aws-sdk/s3-request-presigner";
+import { ArtifactStorageNotFoundError, contentDispositionAttachment, } from "./artifact-storage.js";
+/** Go: "R2 has a maximum expiration of 7 days" — presigns clamp here. */
+export const R2_MAX_EXPIRATION_MS = 7 * 24 * 60 * 60 * 1000;
+/**
+ * Key prefix for presignPut staging blobs (§6b). Pinned as the surface a
+ * deployment's bucket lifecycle rule targets: the driver mints under it,
+ * operations sweeps it — changing it orphans staged blobs from the sweep.
+ */
+export const R2_STAGING_PREFIX = "staging/";
+/**
+ * Go get_content/get_download_url wrap their storage calls in a 30s
+ * context timeout. The TS ArtifactStorage interface carries no signal, so
+ * the same bound lives one layer down, on the driver's network reads —
+ * identical ceiling, applied at the only backend where it can fire.
+ */
+const R2_CALL_TIMEOUT_MS = 30_000;
+/**
+ * The exported R2 driver constructor (C1 seam, 20260827.04): a composition
+ * registers R2-backed drivers with ITS OWN config — the cloud's verified
+ * shape is distinct buckets/credentials per domain (blueprint §6b) — while
+ * the S3 plumbing, presign clamp, and not-found mapping live exactly once
+ * here. Loud-fail: the required-config throws below fire at driver
+ * construction, which the registered lazy factory defers to first use of
+ * the named driver (the factory contract in drivers.ts).
+ */
+export function newR2ArtifactStorage(config) {
+    return new R2ArtifactStorage(config);
+}
+export class R2ArtifactStorage {
+    client;
+    presign;
+    bucket;
+    constructor(config, clients) {
+        // Go NewR2Storage's required-config errors, byte-mirrored.
+        if (config.bucket === "") {
+            throw new Error("R2 bucket name is required");
+        }
+        if (config.endpoint === "") {
+            throw new Error("R2 endpoint is required");
+        }
+        if (config.accessKeyId === "") {
+            throw new Error("R2 access key ID is required");
+        }
+        if (config.secretAccessKey === "") {
+            throw new Error("R2 secret access key is required");
+        }
+        this.bucket = config.bucket;
+        if (clients !== undefined) {
+            this.client = clients.client;
+            this.presign = clients.presign;
+            return;
+        }
+        this.client = new S3Client({
+            region: config.region === "" ? "auto" : config.region,
+            endpoint: config.endpoint,
+            // R2 uses path-style addressing (Go o.UsePathStyle = true).
+            forcePathStyle: true,
+            credentials: {
+                accessKeyId: config.accessKeyId,
+                secretAccessKey: config.secretAccessKey,
+            },
+        });
+        this.presign = presignGetObject;
+    }
+    async upload(key, data, contentType) {
+        try {
+            await this.client.send(new PutObjectCommand({
+                Bucket: this.bucket,
+                Key: key,
+                Body: data,
+                ...(contentType !== "" ? { ContentType: contentType } : {}),
+            }));
+        }
+        catch (error) {
+            throw new Error(`r2 upload failed: ${errorText(error)}`, { cause: error });
+        }
+    }
+    async download(key) {
+        let body;
+        try {
+            const result = await this.client.send(new GetObjectCommand({ Bucket: this.bucket, Key: key }), { abortSignal: AbortSignal.timeout(R2_CALL_TIMEOUT_MS) });
+            if (result.Body === undefined) {
+                throw new Error("empty response body");
+            }
+            body = await result.Body.transformToByteArray();
+        }
+        catch (error) {
+            // The typed not-found arm (O5): consumers mapping "missing" onto
+            // domain vocabulary branch on the class; every other failure stays
+            // the wrapped infrastructure fault it always was. Only the log-line
+            // text of the missing-object arm changes — every production caller
+            // wraps download faults in a sanitized Internal before the wire.
+            if (isNotFoundError(error)) {
+                throw new ArtifactStorageNotFoundError(key);
+            }
+            throw new Error(`r2 download failed: ${errorText(error)}`, { cause: error });
+        }
+        return body;
+    }
+    async size(key) {
+        try {
+            const result = await this.client.send(new HeadObjectCommand({ Bucket: this.bucket, Key: key }));
+            return Number(result.ContentLength ?? 0);
+        }
+        catch (error) {
+            if (isNotFoundError(error)) {
+                throw new ArtifactStorageNotFoundError(key);
+            }
+            throw new Error(`r2 head failed: ${errorText(error)}`, { cause: error });
+        }
+    }
+    async presignPut(declaredSizeBytes, ttlMs) {
+        const clampedMs = Math.min(ttlMs, R2_MAX_EXPIRATION_MS);
+        // Random staging key: the URL is the credential (unguessable), and the
+        // prefix is the contract surface a bucket lifecycle rule sweeps (§6b —
+        // staged uploads the domain never committed must not accrete forever).
+        const stagingKey = `${R2_STAGING_PREFIX}${randomBytes(16).toString("hex")}`;
+        const command = new PutObjectCommand({
+            Bucket: this.bucket,
+            Key: stagingKey,
+            // Signed into the URL: a PUT whose body disagrees with the declared
+            // size fails the signature check — R2's arm of the exact-size
+            // contract the local lane enforces by counting bytes.
+            ContentLength: declaredSizeBytes,
+        });
+        try {
+            const url = await this.presign(this.client, command, {
+                expiresIn: Math.floor(clampedMs / 1000),
+            });
+            return { url, stagingKey, ttlMs: clampedMs };
+        }
+        catch (error) {
+            throw new Error(`r2 presign failed: ${errorText(error)}`, { cause: error });
+        }
+    }
+    async getSignedUrl(key, expiresInMs, downloadFilename) {
+        const clampedMs = Math.min(expiresInMs, R2_MAX_EXPIRATION_MS);
+        const command = new GetObjectCommand({
+            Bucket: this.bucket,
+            Key: key,
+            // Go signs Content-Disposition into the presigned URL — the browser
+            // saves the object under the given name instead of rendering inline.
+            ...(downloadFilename !== ""
+                ? { ResponseContentDisposition: contentDispositionAttachment(downloadFilename) }
+                : {}),
+        });
+        try {
+            return await this.presign(this.client, command, {
+                expiresIn: Math.floor(clampedMs / 1000),
+            });
+        }
+        catch (error) {
+            throw new Error(`r2 presign failed: ${errorText(error)}`, { cause: error });
+        }
+    }
+    async delete(key) {
+        try {
+            await this.client.send(new DeleteObjectCommand({ Bucket: this.bucket, Key: key }));
+        }
+        catch (error) {
+            throw new Error(`r2 delete failed: ${errorText(error)}`, { cause: error });
+        }
+    }
+    async exists(key) {
+        try {
+            await this.client.send(new HeadObjectCommand({ Bucket: this.bucket, Key: key }));
+            return true;
+        }
+        catch (error) {
+            if (isNotFoundError(error)) {
+                return false;
+            }
+            throw new Error(`r2 head failed: ${errorText(error)}`, { cause: error });
+        }
+    }
+    async health() {
+        try {
+            await this.client.send(new HeadBucketCommand({ Bucket: this.bucket }));
+        }
+        catch (error) {
+            throw new Error(`r2 health check failed: ${errorText(error)}`, {
+                cause: error,
+            });
+        }
+    }
+}
+/**
+ * Whether the error means "no such object" (Go isNotFoundError, adapted to
+ * the SDK's structured errors instead of Go's string matching): the S3
+ * NotFound/NoSuchKey names, an HTTP 404, or the legacy text forms.
+ */
+export function isNotFoundError(error) {
+    if (error === null || error === undefined) {
+        return false;
+    }
+    const name = error.name ?? "";
+    if (name === "NotFound" || name === "NoSuchKey") {
+        return true;
+    }
+    const statusCode = error
+        .$metadata?.httpStatusCode;
+    if (statusCode === 404) {
+        return true;
+    }
+    const message = error instanceof Error ? error.message : String(error);
+    return message.includes("404") || message.includes("not found");
+}
+function errorText(error) {
+    return error instanceof Error ? error.message : String(error);
+}
+//# sourceMappingURL=r2-storage.js.map

package/dist/artifactstorage/r2-storage.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"r2-storage.js","sourceRoot":"","sources":["../../src/artifactstorage/r2-storage.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C,OAAO,EACL,mBAAmB,EACnB,gBAAgB,EAChB,iBAAiB,EACjB,iBAAiB,EACjB,gBAAgB,EAChB,QAAQ,GACT,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,YAAY,IAAI,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AAGjF,OAAO,EACL,4BAA4B,EAC5B,4BAA4B,GAC7B,MAAM,uBAAuB,CAAC;AAE/B,yEAAyE;AACzE,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAE5D;;;;GAIG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,UAAU,CAAC;AAE5C;;;;;GAKG;AACH,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAiBlC;;;;;;;;GAQG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAAuB;IAC1D,OAAO,IAAI,iBAAiB,CAAC,MAAM,CAAC,CAAC;AACvC,CAAC;AAED,MAAM,OAAO,iBAAiB;IACX,MAAM,CAAW;IACjB,OAAO,CAA0B;IACjC,MAAM,CAAS;IAEhC,YAAY,MAAuB,EAAE,OAAmB;QACtD,2DAA2D;QAC3D,IAAI,MAAM,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;QAChD,CAAC;QACD,IAAI,MAAM,CAAC,QAAQ,KAAK,EAAE,EAAE,CAAC;YAC3B,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;QAC7C,CAAC;QACD,IAAI,MAAM,CAAC,WAAW,KAAK,EAAE,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;QAClD,CAAC;QACD,IAAI,MAAM,CAAC,eAAe,KAAK,EAAE,EAAE,CAAC;YAClC,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;QACtD,CAAC;QAED,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;QAC5B,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;YAC7B,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;YAC/B,OAAO;QACT,CAAC;QACD,IAAI,CAAC,MAAM,GAAG,IAAI,QAAQ,CAAC;YACzB,MAAM,EAAE,MAAM,CAAC,MAAM,KAAK,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM;YACrD,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,4DAA4D;YAC5D,cAAc,EAAE,IAAI;YACpB,WAAW,EAAE;gBACX,WAAW,EAAE,MAAM,CAAC,WAAW;gBAC/B,eAAe,EAAE,MAAM,CAAC,eAAe;aACxC;SACF,CAAC,CAAC;QACH,IAAI,CAAC,OAAO,GAAG,gBAAgB,CAAC;IAClC,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,GAAW,EAAE,IAAgB,EAAE,WAAmB;QAC7D,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CACpB,IAAI,gBAAgB,CAAC;gBACnB,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,GAAG,EAAE,GAAG;gBACR,IAAI,EAAE,IAAI;gBACV,GAAG,CAAC,WAAW,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC5D,CAAC,CACH,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,qBAAqB,SAAS,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QAC7E,CAAC;IACH,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,GAAW;QACxB,IAAI,IAAgB,CAAC;QACrB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CACnC,IAAI,gBAAgB,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,EACvD,EAAE,WAAW,EAAE,WAAW,CAAC,OAAO,CAAC,kBAAkB,CAAC,EAAE,CACzD,CAAC;YACF,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;gBAC9B,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;YACzC,CAAC;YACD,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,oBAAoB,EAAE,CAAC;QAClD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,iEAAiE;YACjE,mEAAmE;YACnE,oEAAoE;YACpE,mEAAmE;YACnE,iEAAiE;YACjE,IAAI,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC3B,MAAM,IAAI,4BAA4B,CAAC,GAAG,CAAC,CAAC;YAC9C,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,uBAAuB,SAAS,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QAC/E,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,GAAW;QACpB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CACnC,IAAI,iBAAiB,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CACzD,CAAC;YACF,OAAO,MAAM,CAAC,MAAM,CAAC,aAAa,IAAI,CAAC,CAAC,CAAC;QAC3C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC3B,MAAM,IAAI,4BAA4B,CAAC,GAAG,CAAC,CAAC;YAC9C,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,mBAAmB,SAAS,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QAC3E,CAAC;IACH,CAAC;IAED,KAAK,CAAC,UAAU,CACd,iBAAyB,EACzB,KAAa;QAEb,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,oBAAoB,CAAC,CAAC;QACxD,uEAAuE;QACvE,uEAAuE;QACvE,uEAAuE;QACvE,MAAM,UAAU,GAAG,GAAG,iBAAiB,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5E,MAAM,OAAO,GAAG,IAAI,gBAAgB,CAAC;YACnC,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,GAAG,EAAE,UAAU;YACf,oEAAoE;YACpE,8DAA8D;YAC9D,sDAAsD;YACtD,aAAa,EAAE,iBAAiB;SACjC,CAAC,CAAC;QACH,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE;gBACnD,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC;aACxC,CAAC,CAAC;YACH,OAAO,EAAE,GAAG,EAAE,UAAU,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;QAC/C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,sBAAsB,SAAS,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QAC9E,CAAC;IACH,CAAC;IAED,KAAK,CAAC,YAAY,CAChB,GAAW,EACX,WAAmB,EACnB,gBAAwB;QAExB,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,oBAAoB,CAAC,CAAC;QAC9D,MAAM,OAAO,GAAG,IAAI,gBAAgB,CAAC;YACnC,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,GAAG,EAAE,GAAG;YACR,oEAAoE;YACpE,qEAAqE;YACrE,GAAG,CAAC,gBAAgB,KAAK,EAAE;gBACzB,CAAC,CAAC,EAAE,0BAA0B,EAAE,4BAA4B,CAAC,gBAAgB,CAAC,EAAE;gBAChF,CAAC,CAAC,EAAE,CAAC;SACR,CAAC,CAAC;QACH,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE;gBAC9C,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC;aACxC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,sBAAsB,SAAS,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QAC9E,CAAC;IACH,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,GAAW;QACtB,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CACpB,IAAI,mBAAmB,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAC3D,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,qBAAqB,SAAS,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QAC7E,CAAC;IACH,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,GAAW;QACtB,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CACpB,IAAI,iBAAiB,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CACzD,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC3B,OAAO,KAAK,CAAC;YACf,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,mBAAmB,SAAS,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QAC3E,CAAC;IACH,CAAC;IAED,KAAK,CAAC,MAAM;QACV,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,iBAAiB,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QACzE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,2BAA2B,SAAS,CAAC,KAAK,CAAC,EAAE,EAAE;gBAC7D,KAAK,EAAE,KAAK;aACb,CAAC,CAAC;QACL,CAAC;IACH,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,KAAc;IAC5C,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QAC1C,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,IAAI,GAAI,KAA2B,CAAC,IAAI,IAAI,EAAE,CAAC;IACrD,IAAI,IAAI,KAAK,UAAU,IAAI,IAAI,KAAK,WAAW,EAAE,CAAC;QAChD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,UAAU,GAAI,KAAqD;SACtE,SAAS,EAAE,cAAc,CAAC;IAC7B,IAAI,UAAU,KAAK,GAAG,EAAE,CAAC;QACvB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACvE,OAAO,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAClE,CAAC;AAED,SAAS,SAAS,CAAC,KAAc;IAC/B,OAAO,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAChE,CAAC"}