@strapi/provider-upload-aws-s3 5.35.0 → 5.36.1

package/dist/index.js

@@ -6,11 +6,107 @@ var s3RequestPresigner = require('@aws-sdk/s3-request-presigner');
 var libStorage = require('@aws-sdk/lib-storage');
 var utils = require('./utils.js');
 
-const assertUrlProtocol = (url)=>{
-    // Regex to test protocol like "http://", "https://"
-    return /^\w*:\/\//.test(url);
+/**
+ * Validates that a URL uses HTTP or HTTPS protocol.
+ * Rejects dangerous protocols like file://, javascript:, data:, etc.
+ */ const assertUrlProtocol = (url)=>{
+    return /^https?:\/\//.test(url);
 };
-const getConfig = ({ baseUrl, rootPath, s3Options, ...legacyS3Options })=>{
+/**
+ * Sanitizes a path component to prevent path traversal attacks.
+ * Removes directory traversal sequences and normalizes the path.
+ */ const sanitizePathComponent = (component)=>{
+    if (!component) return '';
+    return component.replace(/\.\./g, '').replace(/^\/+|\/+$/g, '').replace(/\/+/g, '/');
+};
+/**
+ * Maps the provider checksum algorithm to the AWS SDK checksum algorithm.
+ */ const mapChecksumAlgorithm = (algorithm)=>{
+    if (!algorithm) return undefined;
+    const mapping = {
+        CRC32: clientS3.ChecksumAlgorithm.CRC32,
+        CRC32C: clientS3.ChecksumAlgorithm.CRC32C,
+        SHA1: clientS3.ChecksumAlgorithm.SHA1,
+        SHA256: clientS3.ChecksumAlgorithm.SHA256,
+        CRC64NVME: clientS3.ChecksumAlgorithm.CRC64NVME
+    };
+    return mapping[algorithm];
+};
+/**
+ * Maps the provider storage class to the AWS SDK storage class.
+ */ const mapStorageClass = (storageClass)=>{
+    if (!storageClass) return undefined;
+    const mapping = {
+        STANDARD: clientS3.StorageClass.STANDARD,
+        REDUCED_REDUNDANCY: clientS3.StorageClass.REDUCED_REDUNDANCY,
+        STANDARD_IA: clientS3.StorageClass.STANDARD_IA,
+        ONEZONE_IA: clientS3.StorageClass.ONEZONE_IA,
+        INTELLIGENT_TIERING: clientS3.StorageClass.INTELLIGENT_TIERING,
+        GLACIER: clientS3.StorageClass.GLACIER,
+        DEEP_ARCHIVE: clientS3.StorageClass.DEEP_ARCHIVE,
+        GLACIER_IR: clientS3.StorageClass.GLACIER_IR
+    };
+    return mapping[storageClass];
+};
+/**
+ * Maps the provider encryption type to the AWS SDK server-side encryption.
+ */ const mapServerSideEncryption = (type)=>{
+    if (!type) return undefined;
+    const mapping = {
+        AES256: clientS3.ServerSideEncryption.AES256,
+        'aws:kms': clientS3.ServerSideEncryption.aws_kms,
+        'aws:kms:dsse': clientS3.ServerSideEncryption.aws_kms_dsse
+    };
+    return mapping[type];
+};
+/**
+ * Converts a tags object to the S3 Tagging header format.
+ * Format: key1=value1&key2=value2
+ */ const formatTagsForHeader = (tags)=>{
+    if (!tags || Object.keys(tags).length === 0) return undefined;
+    return Object.entries(tags).map(([key, value])=>`${encodeURIComponent(key)}=${encodeURIComponent(value)}`).join('&');
+};
+/**
+ * Checks if the endpoint appears to be a non-AWS S3-compatible provider.
+ */ const isNonAwsEndpoint = (endpoint)=>{
+    if (!endpoint) return false;
+    const awsPatterns = [
+        /\.amazonaws\.com$/i,
+        /\.amazonaws\.com\.cn$/i
+    ];
+    return !awsPatterns.some((pattern)=>pattern.test(endpoint));
+};
+/**
+ * Validates provider configuration and emits warnings for potential compatibility issues.
+ */ const validateProviderConfig = (providerConfig, s3Options)=>{
+    if (!providerConfig) return;
+    const endpoint = s3Options?.endpoint?.toString() || '';
+    const isNonAws = isNonAwsEndpoint(endpoint);
+    // Warn about AWS-specific features when using non-AWS endpoints
+    if (isNonAws) {
+        if (providerConfig.storageClass) {
+            process.emitWarning(`Storage class '${providerConfig.storageClass}' is AWS S3-specific and may be ignored by your S3-compatible provider.`);
+        }
+        if (providerConfig.encryption?.type && providerConfig.encryption.type !== 'AES256') {
+            process.emitWarning(`Encryption type '${providerConfig.encryption.type}' is AWS S3-specific. Consider using 'AES256' for better compatibility.`);
+        }
+    }
+    // Validate multipart configuration
+    if (providerConfig.multipart?.partSize) {
+        const minPartSize = 5 * 1024 * 1024; // 5MB
+        const maxPartSize = 5 * 1024 * 1024 * 1024; // 5GB
+        if (providerConfig.multipart.partSize < minPartSize) {
+            process.emitWarning(`Multipart partSize ${providerConfig.multipart.partSize} is below the minimum of 5MB. This may cause upload failures.`);
+        }
+        if (providerConfig.multipart.partSize > maxPartSize) {
+            process.emitWarning(`Multipart partSize ${providerConfig.multipart.partSize} exceeds the maximum of 5GB. This may cause upload failures.`);
+        }
+    }
+    if (providerConfig.multipart?.queueSize && providerConfig.multipart.queueSize > 16) {
+        process.emitWarning(`Multipart queueSize ${providerConfig.multipart.queueSize} is high and may cause memory issues. Consider using 4-8.`);
+    }
+};
+const getConfig = ({ s3Options, legacyS3Options })=>{
     if (Object.keys(legacyS3Options).length > 0) {
         process.emitWarning("S3 configuration options passed at root level of the plugin's providerOptions is deprecated and will be removed in a future release. Please wrap them inside the 's3Options:{}' property.");
     }
@@ -25,65 +121,219 @@ const getConfig = ({ baseUrl, rootPath, s3Options, ...legacyS3Options })=>{
             credentials
         } : {}
     };
-    config.params.ACL = fp.getOr(clientS3.ObjectCannedACL.public_read, [
-        'params',
-        'ACL'
-    ], config);
+    if (config.params !== undefined) {
+        // Only set default ACL when ACL is not explicitly present in params.
+        // Since April 2023, new AWS S3 buckets have ACLs disabled by default
+        // ("Bucket owner enforced"). Sending an ACL header to such buckets
+        // throws AccessControlListNotSupported. To disable ACLs, users should
+        // simply not include ACL in their params configuration.
+        if (!('ACL' in config.params)) {
+            config.params.ACL = clientS3.ObjectCannedACL.public_read;
+        }
+    } else {
+        throw new Error('Upload AWS S3 provider: `params` are required in the config object');
+    }
     return config;
 };
 var index = {
-    init ({ baseUrl, rootPath, s3Options, ...legacyS3Options }) {
+    init ({ baseUrl, rootPath, s3Options, providerConfig, ...legacyS3Options }) {
+        // Validate configuration and emit warnings for potential issues
+        validateProviderConfig(providerConfig, s3Options);
         // TODO V5 change config structure to avoid having to do this
         const config = getConfig({
-            baseUrl,
-            rootPath,
-            s3Options,
-            ...legacyS3Options
+            s3Options: s3Options,
+            legacyS3Options
         });
         const s3Client = new clientS3.S3Client(config);
         const filePrefix = rootPath ? `${rootPath.replace(/\/+$/, '')}/` : '';
         const getFileKey = (file)=>{
-            const path = file.path ? `${file.path}/` : '';
-            return `${filePrefix}${path}${file.hash}${file.ext}`;
+            const sanitizedPath = sanitizePathComponent(file.path);
+            const path = sanitizedPath ? `${sanitizedPath}/` : '';
+            const sanitizedHash = sanitizePathComponent(file.hash);
+            const sanitizedExt = file.ext ? file.ext.replace(/[^a-zA-Z0-9.]/g, '') : '';
+            return `${filePrefix}${path}${sanitizedHash}${sanitizedExt}`;
+        };
+        /**
+     * Builds the upload parameters including all configured features.
+     */ const buildUploadParams = (file, fileKey, customParams = {})=>{
+            const params = {
+                Bucket: config.params.Bucket,
+                Key: fileKey,
+                Body: file.stream || Buffer.from(file.buffer, 'binary'),
+                // ACL is optional to support providers like Cloudflare R2 that don't support ACLs.
+                // Set params.ACL to undefined or omit it entirely to disable ACL headers.
+                ...config.params.ACL ? {
+                    ACL: config.params.ACL
+                } : {},
+                ContentType: file.mime
+            };
+            // Checksum validation
+            const checksumAlgorithm = mapChecksumAlgorithm(providerConfig?.checksumAlgorithm);
+            if (checksumAlgorithm) {
+                params.ChecksumAlgorithm = checksumAlgorithm;
+            }
+            // Conditional writes - prevent overwrite
+            if (providerConfig?.preventOverwrite) {
+                params.IfNoneMatch = '*';
+            }
+            // Storage class
+            const storageClass = mapStorageClass(providerConfig?.storageClass);
+            if (storageClass) {
+                params.StorageClass = storageClass;
+            }
+            // Server-side encryption
+            if (providerConfig?.encryption) {
+                const sse = mapServerSideEncryption(providerConfig.encryption.type);
+                if (sse) {
+                    params.ServerSideEncryption = sse;
+                    if (providerConfig.encryption.kmsKeyId) {
+                        params.SSEKMSKeyId = providerConfig.encryption.kmsKeyId;
+                    }
+                }
+            }
+            // Object tagging
+            const tagging = formatTagsForHeader(providerConfig?.tags);
+            if (tagging) {
+                params.Tagging = tagging;
+            }
+            // Merge customParams but preserve critical security parameters
+            // Bucket, Key, and Body must not be overridden by customParams
+            // eslint-disable-next-line @typescript-eslint/no-unused-vars
+            const { Bucket, Key, Body, ...safeCustomParams } = customParams;
+            return {
+                ...params,
+                ...safeCustomParams
+            };
+        };
+        /**
+     * Constructs the correct file URL.
+     * Handles S3-compatible providers that return incorrect Location formats.
+     */ const constructFileUrl = (fileKey, uploadLocation)=>{
+            // Priority 1: Use baseUrl if configured (CDN or custom domain)
+            if (baseUrl) {
+                const cleanBase = baseUrl.replace(/\/+$/, '');
+                return `${cleanBase}/${fileKey}`;
+            }
+            // Priority 2: Construct URL from endpoint if configured
+            // This fixes issues with S3-compatible providers (IONOS, MinIO, etc.)
+            // that return Location in incorrect format for multipart uploads
+            const endpoint = config.endpoint?.toString();
+            if (endpoint) {
+                const endpointUrl = endpoint.startsWith('http') ? endpoint : `https://${endpoint}`;
+                const cleanEndpoint = endpointUrl.replace(/\/+$/, '');
+                return `${cleanEndpoint}/${config.params.Bucket}/${fileKey}`;
+            }
+            // Priority 3: Use the Location from S3 response
+            if (assertUrlProtocol(uploadLocation)) {
+                return uploadLocation;
+            }
+            // Priority 4: Prepend https if protocol is missing
+            return `https://${uploadLocation}`;
         };
         const upload = async (file, customParams = {})=>{
             const fileKey = getFileKey(file);
-            const uploadObj = new libStorage.Upload({
+            const params = buildUploadParams(file, fileKey, customParams);
+            const uploadOptions = {
                 client: s3Client,
-                params: {
-                    Bucket: config.params.Bucket,
-                    Key: fileKey,
-                    Body: file.stream || Buffer.from(file.buffer, 'binary'),
-                    ACL: config.params.ACL,
-                    ContentType: file.mime,
-                    ...customParams
+                params
+            };
+            // Multipart configuration
+            if (providerConfig?.multipart) {
+                if (providerConfig.multipart.partSize) {
+                    uploadOptions.partSize = providerConfig.multipart.partSize;
+                }
+                if (providerConfig.multipart.queueSize) {
+                    uploadOptions.queueSize = providerConfig.multipart.queueSize;
+                }
+                if (providerConfig.multipart.leavePartsOnError !== undefined) {
+                    uploadOptions.leavePartsOnError = providerConfig.multipart.leavePartsOnError;
                 }
+            }
+            const uploadObj = new libStorage.Upload(uploadOptions);
+            const result = await uploadObj.done();
+            // Construct the correct URL (handles S3-compatible provider quirks)
+            file.url = constructFileUrl(fileKey, result.Location);
+            // Store ETag for potential future conditional updates
+            if (result.ETag) {
+                file.etag = result.ETag.replace(/"/g, '');
+            }
+        };
+        /**
+     * Uploads a file only if the existing object matches the expected ETag.
+     * This implements optimistic locking to prevent lost updates.
+     */ const uploadIfMatch = async (file, expectedETag, customParams = {})=>{
+            const fileKey = getFileKey(file);
+            const params = buildUploadParams(file, fileKey, {
+                ...customParams,
+                IfMatch: expectedETag
+            });
+            const uploadObj = new libStorage.Upload({
+                client: s3Client,
+                params
             });
-            const upload = await uploadObj.done();
-            if (assertUrlProtocol(upload.Location)) {
-                file.url = baseUrl ? `${baseUrl}/${fileKey}` : upload.Location;
-            } else {
-                // Default protocol to https protocol
-                file.url = `https://${upload.Location}`;
+            const result = await uploadObj.done();
+            // Construct the correct URL (handles S3-compatible provider quirks)
+            file.url = constructFileUrl(fileKey, result.Location);
+            if (result.ETag) {
+                file.etag = result.ETag.replace(/"/g, '');
+            }
+        };
+        /**
+     * Retrieves metadata for an object including its ETag.
+     */ const getObjectMetadata = async (file)=>{
+            const command = new clientS3.HeadObjectCommand({
+                Bucket: config.params.Bucket,
+                Key: getFileKey(file)
+            });
+            const response = await s3Client.send(command);
+            return {
+                etag: response.ETag?.replace(/"/g, ''),
+                contentLength: response.ContentLength,
+                contentType: response.ContentType,
+                lastModified: response.LastModified,
+                storageClass: response.StorageClass,
+                serverSideEncryption: response.ServerSideEncryption
+            };
+        };
+        /**
+     * Checks if an object exists in the bucket.
+     */ const objectExists = async (file)=>{
+            try {
+                await getObjectMetadata(file);
+                return true;
+            } catch (error) {
+                if (error.name === 'NotFound' || error.$metadata?.httpStatusCode === 404) {
+                    return false;
+                }
+                throw error;
             }
         };
         return {
-            isPrivate () {
+            /**
+       * Returns whether the bucket is configured with private ACL.
+       */ isPrivate () {
                 return config.params.ACL === 'private';
             },
-            async getSignedUrl (file, customParams) {
-                // Do not sign the url if it does not come from the same bucket.
+            /**
+       * Returns the current provider configuration.
+       */ getProviderConfig () {
+                return providerConfig;
+            },
+            /**
+       * Generates a signed URL for accessing a private object.
+       */ async getSignedUrl (file, customParams) {
                 if (!utils.isUrlFromBucket(file.url, config.params.Bucket, baseUrl)) {
                     return {
                         url: file.url
                     };
                 }
                 const fileKey = getFileKey(file);
-                const url = await s3RequestPresigner.getSignedUrl(// @ts-expect-error - TODO fix client type
-                s3Client, new clientS3.GetObjectCommand({
+                // Spread customParams first, then override with secure values
+                // This prevents malicious override of Bucket and Key
+                const url = await s3RequestPresigner.getSignedUrl(s3Client, new clientS3.GetObjectCommand({
+                    ...customParams,
                     Bucket: config.params.Bucket,
-                    Key: fileKey,
-                    ...customParams
+                    Key: fileKey
                 }), {
                     expiresIn: fp.getOr(15 * 60, [
                         'params',
@@ -94,17 +344,42 @@ var index = {
                     url
                 };
             },
-            uploadStream (file, customParams = {}) {
+            /**
+       * Uploads a file using streaming.
+       */ uploadStream (file, customParams = {}) {
                 return upload(file, customParams);
             },
-            upload (file, customParams = {}) {
+            /**
+       * Uploads a file to S3.
+       */ upload (file, customParams = {}) {
                 return upload(file, customParams);
             },
-            delete (file, customParams = {}) {
+            /**
+       * Uploads a file only if it matches the expected ETag (optimistic locking).
+       * Throws PreconditionFailed error if ETag does not match.
+       */ uploadIfMatch (file, expectedETag, customParams = {}) {
+                return uploadIfMatch(file, expectedETag, customParams);
+            },
+            /**
+       * Retrieves object metadata including ETag.
+       */ getObjectMetadata (file) {
+                return getObjectMetadata(file);
+            },
+            /**
+       * Checks if an object exists in the bucket.
+       */ objectExists (file) {
+                return objectExists(file);
+            },
+            /**
+       * Deletes an object from S3.
+       */ delete (file, customParams = {}) {
+                // Spread customParams first, then override with secure values
+                // eslint-disable-next-line @typescript-eslint/no-unused-vars
+                const { Bucket, Key, ...safeParams } = customParams;
                 const command = new clientS3.DeleteObjectCommand({
+                    ...safeParams,
                     Bucket: config.params.Bucket,
-                    Key: getFileKey(file),
-                    ...customParams
+                    Key: getFileKey(file)
                 });
                 return s3Client.send(command);
             }

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sources":["../src/index.ts"],"sourcesContent":["import type { ReadStream } from 'node:fs';\nimport { getOr } from 'lodash/fp';\nimport {\n  S3Client,\n  GetObjectCommand,\n  DeleteObjectCommand,\n  DeleteObjectCommandOutput,\n  PutObjectCommandInput,\n  CompleteMultipartUploadCommandOutput,\n  AbortMultipartUploadCommandOutput,\n  S3ClientConfig,\n  ObjectCannedACL,\n} from '@aws-sdk/client-s3';\nimport type { AwsCredentialIdentity } from '@aws-sdk/types';\nimport { getSignedUrl } from '@aws-sdk/s3-request-presigner';\nimport { Upload } from '@aws-sdk/lib-storage';\nimport { extractCredentials, isUrlFromBucket } from './utils';\n\nexport interface File {\n  name: string;\n  alternativeText?: string;\n  caption?: string;\n  width?: number;\n  height?: number;\n  formats?: Record<string, unknown>;\n  hash: string;\n  ext?: string;\n  mime: string;\n  size: number;\n  sizeInBytes: number;\n  url: string;\n  previewUrl?: string;\n  path?: string;\n  provider?: string;\n  provider_metadata?: Record<string, unknown>;\n  stream?: ReadStream;\n  buffer?: Buffer;\n}\n\nexport type UploadCommandOutput = (\n  | CompleteMultipartUploadCommandOutput\n  | AbortMultipartUploadCommandOutput\n) & {\n  Location: string;\n};\n\nexport interface AWSParams {\n  Bucket: string; // making it required\n  ACL?: ObjectCannedACL;\n  signedUrlExpires?: number;\n}\n\nexport interface DefaultOptions extends S3ClientConfig {\n  // TODO Remove this in V5\n  accessKeyId?: AwsCredentialIdentity['accessKeyId'];\n  secretAccessKey?: AwsCredentialIdentity['secretAccessKey'];\n  // Keep this for V5\n  credentials?: AwsCredentialIdentity;\n  params?: AWSParams;\n  [k: string]: any;\n}\n\nexport type InitOptions = (DefaultOptions | { s3Options: DefaultOptions }) & {\n  baseUrl?: string;\n  rootPath?: string;\n  [k: string]: any;\n};\n\nconst assertUrlProtocol = (url: string) => {\n  // Regex to test protocol like \"http://\", \"https://\"\n  return /^\\w*:\\/\\//.test(url);\n};\n\nconst getConfig = ({ baseUrl, rootPath, s3Options, ...legacyS3Options }: InitOptions) => {\n  if (Object.keys(legacyS3Options).length > 0) {\n    process.emitWarning(\n      \"S3 configuration options passed at root level of the plugin's providerOptions is deprecated and will be removed in a future release. Please wrap them inside the 's3Options:{}' property.\"\n    );\n  }\n  const credentials = extractCredentials({ s3Options, ...legacyS3Options });\n  const config = {\n    ...s3Options,\n    ...legacyS3Options,\n    ...(credentials ? { credentials } : {}),\n  };\n\n  config.params.ACL = getOr(ObjectCannedACL.public_read, ['params', 'ACL'], config);\n\n  return config;\n};\n\nexport default {\n  init({ baseUrl, rootPath, s3Options, ...legacyS3Options }: InitOptions) {\n    // TODO V5 change config structure to avoid having to do this\n    const config = getConfig({ baseUrl, rootPath, s3Options, ...legacyS3Options });\n    const s3Client = new S3Client(config);\n    const filePrefix = rootPath ? `${rootPath.replace(/\\/+$/, '')}/` : '';\n\n    const getFileKey = (file: File) => {\n      const path = file.path ? `${file.path}/` : '';\n      return `${filePrefix}${path}${file.hash}${file.ext}`;\n    };\n\n    const upload = async (file: File, customParams: Partial<PutObjectCommandInput> = {}) => {\n      const fileKey = getFileKey(file);\n      const uploadObj = new Upload({\n        client: s3Client,\n        params: {\n          Bucket: config.params.Bucket,\n          Key: fileKey,\n          Body: file.stream || Buffer.from(file.buffer as any, 'binary'),\n          ACL: config.params.ACL,\n          ContentType: file.mime,\n          ...customParams,\n        },\n      });\n\n      const upload = (await uploadObj.done()) as UploadCommandOutput;\n\n      if (assertUrlProtocol(upload.Location)) {\n        file.url = baseUrl ? `${baseUrl}/${fileKey}` : upload.Location;\n      } else {\n        // Default protocol to https protocol\n        file.url = `https://${upload.Location}`;\n      }\n    };\n\n    return {\n      isPrivate() {\n        return config.params.ACL === 'private';\n      },\n\n      async getSignedUrl(file: File, customParams: any): Promise<{ url: string }> {\n        // Do not sign the url if it does not come from the same bucket.\n        if (!isUrlFromBucket(file.url, config.params.Bucket, baseUrl)) {\n          return { url: file.url };\n        }\n        const fileKey = getFileKey(file);\n\n        const url = await getSignedUrl(\n          // @ts-expect-error - TODO fix client type\n          s3Client,\n          new GetObjectCommand({\n            Bucket: config.params.Bucket,\n            Key: fileKey,\n            ...customParams,\n          }),\n          {\n            expiresIn: getOr(15 * 60, ['params', 'signedUrlExpires'], config),\n          }\n        );\n\n        return { url };\n      },\n      uploadStream(file: File, customParams = {}) {\n        return upload(file, customParams);\n      },\n      upload(file: File, customParams = {}) {\n        return upload(file, customParams);\n      },\n      delete(file: File, customParams = {}): Promise<DeleteObjectCommandOutput> {\n        const command = new DeleteObjectCommand({\n          Bucket: config.params.Bucket,\n          Key: getFileKey(file),\n          ...customParams,\n        });\n        return s3Client.send(command);\n      },\n    };\n  },\n};\n"],"names":["assertUrlProtocol","url","test","getConfig","baseUrl","rootPath","s3Options","legacyS3Options","Object","keys","length","process","emitWarning","credentials","extractCredentials","config","params","ACL","getOr","ObjectCannedACL","public_read","init","s3Client","S3Client","filePrefix","replace","getFileKey","file","path","hash","ext","upload","customParams","fileKey","uploadObj","Upload","client","Bucket","Key","Body","stream","Buffer","from","buffer","ContentType","mime","done","Location","isPrivate","getSignedUrl","isUrlFromBucket","GetObjectCommand","expiresIn","uploadStream","delete","command","DeleteObjectCommand","send"],"mappings":";;;;;;;;AAoEA,MAAMA,oBAAoB,CAACC,GAAAA,GAAAA;;IAEzB,OAAO,WAAA,CAAYC,IAAI,CAACD,GAAAA,CAAAA;AAC1B,CAAA;AAEA,MAAME,SAAAA,GAAY,CAAC,EAAEC,OAAO,EAAEC,QAAQ,EAAEC,SAAS,EAAE,GAAGC,eAA8B,EAAA,GAAA;AAClF,IAAA,IAAIC,OAAOC,IAAI,CAACF,eAAiBG,CAAAA,CAAAA,MAAM,GAAG,CAAG,EAAA;AAC3CC,QAAAA,OAAAA,CAAQC,WAAW,CACjB,2LAAA,CAAA;AAEJ;AACA,IAAA,MAAMC,cAAcC,wBAAmB,CAAA;AAAER,QAAAA,SAAAA;AAAW,QAAA,GAAGC;AAAgB,KAAA,CAAA;AACvE,IAAA,MAAMQ,MAAS,GAAA;AACb,QAAA,GAAGT,SAAS;AACZ,QAAA,GAAGC,eAAe;AAClB,QAAA,GAAIM,WAAc,GAAA;AAAEA,YAAAA;AAAY,SAAA,GAAI;AACtC,KAAA;AAEAE,IAAAA,MAAAA,CAAOC,MAAM,CAACC,GAAG,GAAGC,QAAMC,CAAAA,wBAAAA,CAAgBC,WAAW,EAAE;AAAC,QAAA,QAAA;AAAU,QAAA;KAAM,EAAEL,MAAAA,CAAAA;IAE1E,OAAOA,MAAAA;AACT,CAAA;AAEA,YAAe;IACbM,IAAK,CAAA,CAAA,EAAEjB,OAAO,EAAEC,QAAQ,EAAEC,SAAS,EAAE,GAAGC,eAA8B,EAAA,EAAA;;AAEpE,QAAA,MAAMQ,SAASZ,SAAU,CAAA;AAAEC,YAAAA,OAAAA;AAASC,YAAAA,QAAAA;AAAUC,YAAAA,SAAAA;AAAW,YAAA,GAAGC;AAAgB,SAAA,CAAA;QAC5E,MAAMe,QAAAA,GAAW,IAAIC,iBAASR,CAAAA,MAAAA,CAAAA;QAC9B,MAAMS,UAAAA,GAAanB,QAAW,GAAA,CAAA,EAAGA,QAASoB,CAAAA,OAAO,CAAC,MAAQ,EAAA,EAAA,CAAA,CAAI,CAAC,CAAC,GAAG,EAAA;AAEnE,QAAA,MAAMC,aAAa,CAACC,IAAAA,GAAAA;YAClB,MAAMC,IAAAA,GAAOD,IAAKC,CAAAA,IAAI,GAAG,CAAA,EAAGD,KAAKC,IAAI,CAAC,CAAC,CAAC,GAAG,EAAA;YAC3C,OAAO,CAAA,EAAGJ,aAAaI,IAAOD,CAAAA,EAAAA,IAAAA,CAAKE,IAAI,CAAGF,EAAAA,IAAAA,CAAKG,GAAG,CAAE,CAAA;AACtD,SAAA;AAEA,QAAA,MAAMC,MAAS,GAAA,OAAOJ,IAAYK,EAAAA,YAAAA,GAA+C,EAAE,GAAA;AACjF,YAAA,MAAMC,UAAUP,UAAWC,CAAAA,IAAAA,CAAAA;YAC3B,MAAMO,SAAAA,GAAY,IAAIC,iBAAO,CAAA;gBAC3BC,MAAQd,EAAAA,QAAAA;gBACRN,MAAQ,EAAA;oBACNqB,MAAQtB,EAAAA,MAAAA,CAAOC,MAAM,CAACqB,MAAM;oBAC5BC,GAAKL,EAAAA,OAAAA;oBACLM,IAAMZ,EAAAA,IAAAA,CAAKa,MAAM,IAAIC,MAAAA,CAAOC,IAAI,CAACf,IAAAA,CAAKgB,MAAM,EAAS,QAAA,CAAA;oBACrD1B,GAAKF,EAAAA,MAAAA,CAAOC,MAAM,CAACC,GAAG;AACtB2B,oBAAAA,WAAAA,EAAajB,KAAKkB,IAAI;AACtB,oBAAA,GAAGb;AACL;AACF,aAAA,CAAA;YAEA,MAAMD,MAAAA,GAAU,MAAMG,SAAAA,CAAUY,IAAI,EAAA;YAEpC,IAAI9C,iBAAAA,CAAkB+B,MAAOgB,CAAAA,QAAQ,CAAG,EAAA;gBACtCpB,IAAK1B,CAAAA,GAAG,GAAGG,OAAAA,GAAU,CAAGA,EAAAA,OAAAA,CAAQ,CAAC,EAAE6B,OAAAA,CAAAA,CAAS,GAAGF,MAAAA,CAAOgB,QAAQ;aACzD,MAAA;;AAELpB,gBAAAA,IAAAA,CAAK1B,GAAG,GAAG,CAAC,QAAQ,EAAE8B,MAAAA,CAAOgB,QAAQ,CAAE,CAAA;AACzC;AACF,SAAA;QAEA,OAAO;AACLC,YAAAA,SAAAA,CAAAA,GAAAA;AACE,gBAAA,OAAOjC,MAAOC,CAAAA,MAAM,CAACC,GAAG,KAAK,SAAA;AAC/B,aAAA;YAEA,MAAMgC,YAAAA,CAAAA,CAAatB,IAAU,EAAEK,YAAiB,EAAA;;gBAE9C,IAAI,CAACkB,qBAAgBvB,CAAAA,IAAAA,CAAK1B,GAAG,EAAEc,OAAOC,MAAM,CAACqB,MAAM,EAAEjC,OAAU,CAAA,EAAA;oBAC7D,OAAO;AAAEH,wBAAAA,GAAAA,EAAK0B,KAAK1B;AAAI,qBAAA;AACzB;AACA,gBAAA,MAAMgC,UAAUP,UAAWC,CAAAA,IAAAA,CAAAA;gBAE3B,MAAM1B,GAAAA,GAAM,MAAMgD,+BAAAA;AAEhB3B,gBAAAA,QAAAA,EACA,IAAI6B,yBAAiB,CAAA;oBACnBd,MAAQtB,EAAAA,MAAAA,CAAOC,MAAM,CAACqB,MAAM;oBAC5BC,GAAKL,EAAAA,OAAAA;AACL,oBAAA,GAAGD;iBAEL,CAAA,EAAA;oBACEoB,SAAWlC,EAAAA,QAAAA,CAAM,KAAK,EAAI,EAAA;AAAC,wBAAA,QAAA;AAAU,wBAAA;qBAAmB,EAAEH,MAAAA;AAC5D,iBAAA,CAAA;gBAGF,OAAO;AAAEd,oBAAAA;AAAI,iBAAA;AACf,aAAA;AACAoD,YAAAA,YAAAA,CAAAA,CAAa1B,IAAU,EAAEK,YAAe,GAAA,EAAE,EAAA;AACxC,gBAAA,OAAOD,OAAOJ,IAAMK,EAAAA,YAAAA,CAAAA;AACtB,aAAA;AACAD,YAAAA,MAAAA,CAAAA,CAAOJ,IAAU,EAAEK,YAAe,GAAA,EAAE,EAAA;AAClC,gBAAA,OAAOD,OAAOJ,IAAMK,EAAAA,YAAAA,CAAAA;AACtB,aAAA;AACAsB,YAAAA,MAAAA,CAAAA,CAAO3B,IAAU,EAAEK,YAAe,GAAA,EAAE,EAAA;gBAClC,MAAMuB,OAAAA,GAAU,IAAIC,4BAAoB,CAAA;oBACtCnB,MAAQtB,EAAAA,MAAAA,CAAOC,MAAM,CAACqB,MAAM;AAC5BC,oBAAAA,GAAAA,EAAKZ,UAAWC,CAAAA,IAAAA,CAAAA;AAChB,oBAAA,GAAGK;AACL,iBAAA,CAAA;gBACA,OAAOV,QAAAA,CAASmC,IAAI,CAACF,OAAAA,CAAAA;AACvB;AACF,SAAA;AACF;AACF,CAAE;;;;"}
+{"version":3,"file":"index.js","sources":["../src/index.ts"],"sourcesContent":["import type { ReadStream } from 'node:fs';\nimport { getOr } from 'lodash/fp';\nimport {\n  S3Client,\n  GetObjectCommand,\n  DeleteObjectCommand,\n  DeleteObjectCommandOutput,\n  HeadObjectCommand,\n  PutObjectCommandInput,\n  CompleteMultipartUploadCommandOutput,\n  AbortMultipartUploadCommandOutput,\n  S3ClientConfig,\n  ObjectCannedACL,\n  ChecksumAlgorithm,\n  StorageClass,\n  ServerSideEncryption,\n} from '@aws-sdk/client-s3';\nimport type { AwsCredentialIdentity } from '@aws-sdk/types';\nimport { getSignedUrl } from '@aws-sdk/s3-request-presigner';\nimport { Upload } from '@aws-sdk/lib-storage';\nimport { extractCredentials, isUrlFromBucket } from './utils';\n\n/**\n * Supported checksum algorithms for data integrity validation.\n * CRC64NVME is recommended for best performance on modern hardware.\n */\nexport type SupportedChecksumAlgorithm = 'CRC32' | 'CRC32C' | 'SHA1' | 'SHA256' | 'CRC64NVME';\n\n/**\n * Supported S3 storage classes for cost optimization.\n */\nexport type SupportedStorageClass =\n  | 'STANDARD'\n  | 'REDUCED_REDUNDANCY'\n  | 'STANDARD_IA'\n  | 'ONEZONE_IA'\n  | 'INTELLIGENT_TIERING'\n  | 'GLACIER'\n  | 'DEEP_ARCHIVE'\n  | 'GLACIER_IR';\n\n/**\n * Server-side encryption types.\n */\nexport type EncryptionType = 'AES256' | 'aws:kms' | 'aws:kms:dsse';\n\n/**\n * Encryption configuration for server-side encryption.\n */\nexport interface EncryptionConfig {\n  type: EncryptionType;\n  kmsKeyId?: string;\n}\n\n/**\n * Multipart upload configuration for large files.\n */\nexport interface MultipartConfig {\n  partSize?: number;\n  queueSize?: number;\n  leavePartsOnError?: boolean;\n}\n\nexport interface File {\n  name: string;\n  alternativeText?: string;\n  caption?: string;\n  width?: number;\n  height?: number;\n  formats?: Record<string, unknown>;\n  hash: string;\n  ext?: string;\n  mime: string;\n  size: number;\n  sizeInBytes: number;\n  url: string;\n  previewUrl?: string;\n  path?: string;\n  provider?: string;\n  provider_metadata?: Record<string, unknown>;\n  stream?: ReadStream;\n  buffer?: Buffer;\n  etag?: string;\n}\n\nexport type UploadCommandOutput = (\n  | CompleteMultipartUploadCommandOutput\n  | AbortMultipartUploadCommandOutput\n) & {\n  Location: string;\n  ETag?: string;\n};\n\nexport interface AWSParams {\n  Bucket: string;\n  ACL?: ObjectCannedACL;\n  signedUrlExpires?: number;\n}\n\n/**\n * Extended configuration options for the S3 provider.\n */\nexport interface ProviderConfig {\n  /**\n   * Checksum algorithm for data integrity validation during upload.\n   * When enabled, the SDK calculates a checksum and S3 validates it server-side.\n   */\n  checksumAlgorithm?: SupportedChecksumAlgorithm;\n\n  /**\n   * When true, uploads will fail if an object with the same key already exists.\n   * This prevents accidental overwrites due to race conditions.\n   */\n  preventOverwrite?: boolean;\n\n  /**\n   * S3 storage class for uploaded objects.\n   * Use lower-cost classes for infrequently accessed data.\n   */\n  storageClass?: SupportedStorageClass;\n\n  /**\n   * Server-side encryption configuration.\n   */\n  encryption?: EncryptionConfig;\n\n  /**\n   * Tags to apply to uploaded objects.\n   * Useful for cost allocation and lifecycle policies.\n   */\n  tags?: Record<string, string>;\n\n  /**\n   * Multipart upload configuration for large files.\n   */\n  multipart?: MultipartConfig;\n}\n\nexport interface DefaultOptions extends S3ClientConfig {\n  // TODO Remove this in V5\n  accessKeyId?: AwsCredentialIdentity['accessKeyId'];\n  secretAccessKey?: AwsCredentialIdentity['secretAccessKey'];\n  // Keep this for V5\n  credentials?: AwsCredentialIdentity;\n  params?: AWSParams;\n  [k: string]: unknown;\n}\n\nexport type InitOptions = (DefaultOptions | { s3Options: DefaultOptions }) & {\n  baseUrl?: string;\n  rootPath?: string;\n  providerConfig?: ProviderConfig;\n  [k: string]: unknown;\n};\n\n/**\n * Validates that a URL uses HTTP or HTTPS protocol.\n * Rejects dangerous protocols like file://, javascript:, data:, etc.\n */\nconst assertUrlProtocol = (url: string) => {\n  return /^https?:\\/\\//.test(url);\n};\n\n/**\n * Sanitizes a path component to prevent path traversal attacks.\n * Removes directory traversal sequences and normalizes the path.\n */\nconst sanitizePathComponent = (component: string | undefined): string => {\n  if (!component) return '';\n  return component\n    .replace(/\\.\\./g, '')\n    .replace(/^\\/+|\\/+$/g, '')\n    .replace(/\\/+/g, '/');\n};\n\n/**\n * Maps the provider checksum algorithm to the AWS SDK checksum algorithm.\n */\nconst mapChecksumAlgorithm = (\n  algorithm?: SupportedChecksumAlgorithm\n): ChecksumAlgorithm | undefined => {\n  if (!algorithm) return undefined;\n  const mapping: Record<SupportedChecksumAlgorithm, ChecksumAlgorithm> = {\n    CRC32: ChecksumAlgorithm.CRC32,\n    CRC32C: ChecksumAlgorithm.CRC32C,\n    SHA1: ChecksumAlgorithm.SHA1,\n    SHA256: ChecksumAlgorithm.SHA256,\n    CRC64NVME: ChecksumAlgorithm.CRC64NVME,\n  };\n  return mapping[algorithm];\n};\n\n/**\n * Maps the provider storage class to the AWS SDK storage class.\n */\nconst mapStorageClass = (storageClass?: SupportedStorageClass): StorageClass | undefined => {\n  if (!storageClass) return undefined;\n  const mapping: Record<SupportedStorageClass, StorageClass> = {\n    STANDARD: StorageClass.STANDARD,\n    REDUCED_REDUNDANCY: StorageClass.REDUCED_REDUNDANCY,\n    STANDARD_IA: StorageClass.STANDARD_IA,\n    ONEZONE_IA: StorageClass.ONEZONE_IA,\n    INTELLIGENT_TIERING: StorageClass.INTELLIGENT_TIERING,\n    GLACIER: StorageClass.GLACIER,\n    DEEP_ARCHIVE: StorageClass.DEEP_ARCHIVE,\n    GLACIER_IR: StorageClass.GLACIER_IR,\n  };\n  return mapping[storageClass];\n};\n\n/**\n * Maps the provider encryption type to the AWS SDK server-side encryption.\n */\nconst mapServerSideEncryption = (type?: EncryptionType): ServerSideEncryption | undefined => {\n  if (!type) return undefined;\n  const mapping: Record<EncryptionType, ServerSideEncryption> = {\n    AES256: ServerSideEncryption.AES256,\n    'aws:kms': ServerSideEncryption.aws_kms,\n    'aws:kms:dsse': ServerSideEncryption.aws_kms_dsse,\n  };\n  return mapping[type];\n};\n\n/**\n * Converts a tags object to the S3 Tagging header format.\n * Format: key1=value1&key2=value2\n */\nconst formatTagsForHeader = (tags?: Record<string, string>): string | undefined => {\n  if (!tags || Object.keys(tags).length === 0) return undefined;\n  return Object.entries(tags)\n    .map(([key, value]) => `${encodeURIComponent(key)}=${encodeURIComponent(value)}`)\n    .join('&');\n};\n\n/**\n * Checks if the endpoint appears to be a non-AWS S3-compatible provider.\n */\nconst isNonAwsEndpoint = (endpoint?: string): boolean => {\n  if (!endpoint) return false;\n  const awsPatterns = [/\\.amazonaws\\.com$/i, /\\.amazonaws\\.com\\.cn$/i];\n  return !awsPatterns.some((pattern) => pattern.test(endpoint));\n};\n\n/**\n * Validates provider configuration and emits warnings for potential compatibility issues.\n */\nconst validateProviderConfig = (\n  providerConfig: ProviderConfig | undefined,\n  s3Options: DefaultOptions | undefined\n): void => {\n  if (!providerConfig) return;\n\n  const endpoint = s3Options?.endpoint?.toString() || '';\n  const isNonAws = isNonAwsEndpoint(endpoint);\n\n  // Warn about AWS-specific features when using non-AWS endpoints\n  if (isNonAws) {\n    if (providerConfig.storageClass) {\n      process.emitWarning(\n        `Storage class '${providerConfig.storageClass}' is AWS S3-specific and may be ignored by your S3-compatible provider.`\n      );\n    }\n\n    if (providerConfig.encryption?.type && providerConfig.encryption.type !== 'AES256') {\n      process.emitWarning(\n        `Encryption type '${providerConfig.encryption.type}' is AWS S3-specific. Consider using 'AES256' for better compatibility.`\n      );\n    }\n  }\n\n  // Validate multipart configuration\n  if (providerConfig.multipart?.partSize) {\n    const minPartSize = 5 * 1024 * 1024; // 5MB\n    const maxPartSize = 5 * 1024 * 1024 * 1024; // 5GB\n\n    if (providerConfig.multipart.partSize < minPartSize) {\n      process.emitWarning(\n        `Multipart partSize ${providerConfig.multipart.partSize} is below the minimum of 5MB. This may cause upload failures.`\n      );\n    }\n\n    if (providerConfig.multipart.partSize > maxPartSize) {\n      process.emitWarning(\n        `Multipart partSize ${providerConfig.multipart.partSize} exceeds the maximum of 5GB. This may cause upload failures.`\n      );\n    }\n  }\n\n  if (providerConfig.multipart?.queueSize && providerConfig.multipart.queueSize > 16) {\n    process.emitWarning(\n      `Multipart queueSize ${providerConfig.multipart.queueSize} is high and may cause memory issues. Consider using 4-8.`\n    );\n  }\n};\n\nconst getConfig = ({\n  s3Options,\n  legacyS3Options,\n}: {\n  s3Options: DefaultOptions;\n  legacyS3Options: Record<string, unknown>;\n}) => {\n  if (Object.keys(legacyS3Options).length > 0) {\n    process.emitWarning(\n      \"S3 configuration options passed at root level of the plugin's providerOptions is deprecated and will be removed in a future release. Please wrap them inside the 's3Options:{}' property.\"\n    );\n  }\n  const credentials = extractCredentials({ s3Options, ...legacyS3Options });\n  const config = {\n    ...s3Options,\n    ...legacyS3Options,\n    ...(credentials ? { credentials } : {}),\n  };\n\n  if (config.params !== undefined) {\n    // Only set default ACL when ACL is not explicitly present in params.\n    // Since April 2023, new AWS S3 buckets have ACLs disabled by default\n    // (\"Bucket owner enforced\"). Sending an ACL header to such buckets\n    // throws AccessControlListNotSupported. To disable ACLs, users should\n    // simply not include ACL in their params configuration.\n    if (!('ACL' in config.params)) {\n      config.params.ACL = ObjectCannedACL.public_read;\n    }\n  } else {\n    throw new Error('Upload AWS S3 provider: `params` are required in the config object');\n  }\n\n  return config as DefaultOptions & {\n    params: AWSParams;\n  };\n};\n\nexport default {\n  init({ baseUrl, rootPath, s3Options, providerConfig, ...legacyS3Options }: InitOptions) {\n    // Validate configuration and emit warnings for potential issues\n    validateProviderConfig(providerConfig, s3Options as DefaultOptions);\n\n    // TODO V5 change config structure to avoid having to do this\n    const config = getConfig({ s3Options: s3Options as DefaultOptions, legacyS3Options });\n    const s3Client = new S3Client(config);\n    const filePrefix = rootPath ? `${rootPath.replace(/\\/+$/, '')}/` : '';\n\n    const getFileKey = (file: File) => {\n      const sanitizedPath = sanitizePathComponent(file.path);\n      const path = sanitizedPath ? `${sanitizedPath}/` : '';\n      const sanitizedHash = sanitizePathComponent(file.hash);\n      const sanitizedExt = file.ext ? file.ext.replace(/[^a-zA-Z0-9.]/g, '') : '';\n      return `${filePrefix}${path}${sanitizedHash}${sanitizedExt}`;\n    };\n\n    /**\n     * Builds the upload parameters including all configured features.\n     */\n    const buildUploadParams = (\n      file: File,\n      fileKey: string,\n      customParams: Partial<PutObjectCommandInput> = {}\n    ): PutObjectCommandInput => {\n      const params: PutObjectCommandInput = {\n        Bucket: config.params.Bucket,\n        Key: fileKey,\n        Body: file.stream || Buffer.from(file.buffer as any, 'binary'),\n        // ACL is optional to support providers like Cloudflare R2 that don't support ACLs.\n        // Set params.ACL to undefined or omit it entirely to disable ACL headers.\n        ...(config.params.ACL ? { ACL: config.params.ACL } : {}),\n        ContentType: file.mime,\n      };\n\n      // Checksum validation\n      const checksumAlgorithm = mapChecksumAlgorithm(providerConfig?.checksumAlgorithm);\n      if (checksumAlgorithm) {\n        params.ChecksumAlgorithm = checksumAlgorithm;\n      }\n\n      // Conditional writes - prevent overwrite\n      if (providerConfig?.preventOverwrite) {\n        params.IfNoneMatch = '*';\n      }\n\n      // Storage class\n      const storageClass = mapStorageClass(providerConfig?.storageClass);\n      if (storageClass) {\n        params.StorageClass = storageClass;\n      }\n\n      // Server-side encryption\n      if (providerConfig?.encryption) {\n        const sse = mapServerSideEncryption(providerConfig.encryption.type);\n        if (sse) {\n          params.ServerSideEncryption = sse;\n          if (providerConfig.encryption.kmsKeyId) {\n            params.SSEKMSKeyId = providerConfig.encryption.kmsKeyId;\n          }\n        }\n      }\n\n      // Object tagging\n      const tagging = formatTagsForHeader(providerConfig?.tags);\n      if (tagging) {\n        params.Tagging = tagging;\n      }\n\n      // Merge customParams but preserve critical security parameters\n      // Bucket, Key, and Body must not be overridden by customParams\n      // eslint-disable-next-line @typescript-eslint/no-unused-vars\n      const { Bucket, Key, Body, ...safeCustomParams } = customParams as any;\n      return { ...params, ...safeCustomParams };\n    };\n\n    /**\n     * Constructs the correct file URL.\n     * Handles S3-compatible providers that return incorrect Location formats.\n     */\n    const constructFileUrl = (fileKey: string, uploadLocation: string): string => {\n      // Priority 1: Use baseUrl if configured (CDN or custom domain)\n      if (baseUrl) {\n        const cleanBase = baseUrl.replace(/\\/+$/, '');\n        return `${cleanBase}/${fileKey}`;\n      }\n\n      // Priority 2: Construct URL from endpoint if configured\n      // This fixes issues with S3-compatible providers (IONOS, MinIO, etc.)\n      // that return Location in incorrect format for multipart uploads\n      const endpoint = config.endpoint?.toString();\n      if (endpoint) {\n        const endpointUrl = endpoint.startsWith('http') ? endpoint : `https://${endpoint}`;\n        const cleanEndpoint = endpointUrl.replace(/\\/+$/, '');\n        return `${cleanEndpoint}/${config.params.Bucket}/${fileKey}`;\n      }\n\n      // Priority 3: Use the Location from S3 response\n      if (assertUrlProtocol(uploadLocation)) {\n        return uploadLocation;\n      }\n\n      // Priority 4: Prepend https if protocol is missing\n      return `https://${uploadLocation}`;\n    };\n\n    const upload = async (file: File, customParams: Partial<PutObjectCommandInput> = {}) => {\n      const fileKey = getFileKey(file);\n      const params = buildUploadParams(file, fileKey, customParams);\n\n      const uploadOptions: {\n        client: S3Client;\n        params: PutObjectCommandInput;\n        partSize?: number;\n        queueSize?: number;\n        leavePartsOnError?: boolean;\n      } = {\n        client: s3Client,\n        params,\n      };\n\n      // Multipart configuration\n      if (providerConfig?.multipart) {\n        if (providerConfig.multipart.partSize) {\n          uploadOptions.partSize = providerConfig.multipart.partSize;\n        }\n        if (providerConfig.multipart.queueSize) {\n          uploadOptions.queueSize = providerConfig.multipart.queueSize;\n        }\n        if (providerConfig.multipart.leavePartsOnError !== undefined) {\n          uploadOptions.leavePartsOnError = providerConfig.multipart.leavePartsOnError;\n        }\n      }\n\n      const uploadObj = new Upload(uploadOptions);\n      const result = (await uploadObj.done()) as UploadCommandOutput;\n\n      // Construct the correct URL (handles S3-compatible provider quirks)\n      file.url = constructFileUrl(fileKey, result.Location);\n\n      // Store ETag for potential future conditional updates\n      if (result.ETag) {\n        file.etag = result.ETag.replace(/\"/g, '');\n      }\n    };\n\n    /**\n     * Uploads a file only if the existing object matches the expected ETag.\n     * This implements optimistic locking to prevent lost updates.\n     */\n    const uploadIfMatch = async (\n      file: File,\n      expectedETag: string,\n      customParams: Partial<PutObjectCommandInput> = {}\n    ) => {\n      const fileKey = getFileKey(file);\n      const params = buildUploadParams(file, fileKey, {\n        ...customParams,\n        IfMatch: expectedETag,\n      });\n\n      const uploadObj = new Upload({\n        client: s3Client,\n        params,\n      });\n\n      const result = (await uploadObj.done()) as UploadCommandOutput;\n\n      // Construct the correct URL (handles S3-compatible provider quirks)\n      file.url = constructFileUrl(fileKey, result.Location);\n\n      if (result.ETag) {\n        file.etag = result.ETag.replace(/\"/g, '');\n      }\n    };\n\n    /**\n     * Retrieves metadata for an object including its ETag.\n     */\n    const getObjectMetadata = async (file: File) => {\n      const command = new HeadObjectCommand({\n        Bucket: config.params.Bucket,\n        Key: getFileKey(file),\n      });\n\n      const response = await s3Client.send(command);\n\n      return {\n        etag: response.ETag?.replace(/\"/g, ''),\n        contentLength: response.ContentLength,\n        contentType: response.ContentType,\n        lastModified: response.LastModified,\n        storageClass: response.StorageClass,\n        serverSideEncryption: response.ServerSideEncryption,\n      };\n    };\n\n    /**\n     * Checks if an object exists in the bucket.\n     */\n    const objectExists = async (file: File): Promise<boolean> => {\n      try {\n        await getObjectMetadata(file);\n        return true;\n      } catch (error: any) {\n        if (error.name === 'NotFound' || error.$metadata?.httpStatusCode === 404) {\n          return false;\n        }\n        throw error;\n      }\n    };\n\n    return {\n      /**\n       * Returns whether the bucket is configured with private ACL.\n       */\n      isPrivate() {\n        return config.params.ACL === 'private';\n      },\n\n      /**\n       * Returns the current provider configuration.\n       */\n      getProviderConfig(): ProviderConfig | undefined {\n        return providerConfig;\n      },\n\n      /**\n       * Generates a signed URL for accessing a private object.\n       */\n      async getSignedUrl(file: File, customParams: any): Promise<{ url: string }> {\n        if (!isUrlFromBucket(file.url, config.params.Bucket, baseUrl)) {\n          return { url: file.url };\n        }\n        const fileKey = getFileKey(file);\n\n        // Spread customParams first, then override with secure values\n        // This prevents malicious override of Bucket and Key\n        const url = await getSignedUrl(\n          s3Client,\n          new GetObjectCommand({\n            ...customParams,\n            Bucket: config.params.Bucket,\n            Key: fileKey,\n          }),\n          {\n            expiresIn: getOr(15 * 60, ['params', 'signedUrlExpires'], config),\n          }\n        );\n\n        return { url };\n      },\n\n      /**\n       * Uploads a file using streaming.\n       */\n      uploadStream(file: File, customParams = {}) {\n        return upload(file, customParams);\n      },\n\n      /**\n       * Uploads a file to S3.\n       */\n      upload(file: File, customParams = {}) {\n        return upload(file, customParams);\n      },\n\n      /**\n       * Uploads a file only if it matches the expected ETag (optimistic locking).\n       * Throws PreconditionFailed error if ETag does not match.\n       */\n      uploadIfMatch(file: File, expectedETag: string, customParams = {}) {\n        return uploadIfMatch(file, expectedETag, customParams);\n      },\n\n      /**\n       * Retrieves object metadata including ETag.\n       */\n      getObjectMetadata(file: File) {\n        return getObjectMetadata(file);\n      },\n\n      /**\n       * Checks if an object exists in the bucket.\n       */\n      objectExists(file: File) {\n        return objectExists(file);\n      },\n\n      /**\n       * Deletes an object from S3.\n       */\n      delete(file: File, customParams = {}): Promise<DeleteObjectCommandOutput> {\n        // Spread customParams first, then override with secure values\n        // eslint-disable-next-line @typescript-eslint/no-unused-vars\n        const { Bucket, Key, ...safeParams } = customParams as any;\n        const command = new DeleteObjectCommand({\n          ...safeParams,\n          Bucket: config.params.Bucket,\n          Key: getFileKey(file),\n        });\n        return s3Client.send(command);\n      },\n    };\n  },\n};\n"],"names":["assertUrlProtocol","url","test","sanitizePathComponent","component","replace","mapChecksumAlgorithm","algorithm","undefined","mapping","CRC32","ChecksumAlgorithm","CRC32C","SHA1","SHA256","CRC64NVME","mapStorageClass","storageClass","STANDARD","StorageClass","REDUCED_REDUNDANCY","STANDARD_IA","ONEZONE_IA","INTELLIGENT_TIERING","GLACIER","DEEP_ARCHIVE","GLACIER_IR","mapServerSideEncryption","type","AES256","ServerSideEncryption","aws_kms","aws_kms_dsse","formatTagsForHeader","tags","Object","keys","length","entries","map","key","value","encodeURIComponent","join","isNonAwsEndpoint","endpoint","awsPatterns","some","pattern","validateProviderConfig","providerConfig","s3Options","toString","isNonAws","process","emitWarning","encryption","multipart","partSize","minPartSize","maxPartSize","queueSize","getConfig","legacyS3Options","credentials","extractCredentials","config","params","ACL","ObjectCannedACL","public_read","Error","init","baseUrl","rootPath","s3Client","S3Client","filePrefix","getFileKey","file","sanitizedPath","path","sanitizedHash","hash","sanitizedExt","ext","buildUploadParams","fileKey","customParams","Bucket","Key","Body","stream","Buffer","from","buffer","ContentType","mime","checksumAlgorithm","preventOverwrite","IfNoneMatch","sse","kmsKeyId","SSEKMSKeyId","tagging","Tagging","safeCustomParams","constructFileUrl","uploadLocation","cleanBase","endpointUrl","startsWith","cleanEndpoint","upload","uploadOptions","client","leavePartsOnError","uploadObj","Upload","result","done","Location","ETag","etag","uploadIfMatch","expectedETag","IfMatch","getObjectMetadata","command","HeadObjectCommand","response","send","contentLength","ContentLength","contentType","lastModified","LastModified","serverSideEncryption","objectExists","error","name","$metadata","httpStatusCode","isPrivate","getProviderConfig","getSignedUrl","isUrlFromBucket","GetObjectCommand","expiresIn","getOr","uploadStream","delete","safeParams","DeleteObjectCommand"],"mappings":";;;;;;;;AA2JA;;;IAIA,MAAMA,oBAAoB,CAACC,GAAAA,GAAAA;IACzB,OAAO,cAAA,CAAeC,IAAI,CAACD,GAAAA,CAAAA;AAC7B,CAAA;AAEA;;;IAIA,MAAME,wBAAwB,CAACC,SAAAA,GAAAA;IAC7B,IAAI,CAACA,WAAW,OAAO,EAAA;IACvB,OAAOA,SAAAA,CACJC,OAAO,CAAC,OAAS,EAAA,EAAA,CAAA,CACjBA,OAAO,CAAC,YAAc,EAAA,EAAA,CAAA,CACtBA,OAAO,CAAC,MAAQ,EAAA,GAAA,CAAA;AACrB,CAAA;AAEA;;IAGA,MAAMC,uBAAuB,CAC3BC,SAAAA,GAAAA;IAEA,IAAI,CAACA,WAAW,OAAOC,SAAAA;AACvB,IAAA,MAAMC,OAAiE,GAAA;AACrEC,QAAAA,KAAAA,EAAOC,2BAAkBD,KAAK;AAC9BE,QAAAA,MAAAA,EAAQD,2BAAkBC,MAAM;AAChCC,QAAAA,IAAAA,EAAMF,2BAAkBE,IAAI;AAC5BC,QAAAA,MAAAA,EAAQH,2BAAkBG,MAAM;AAChCC,QAAAA,SAAAA,EAAWJ,2BAAkBI;AAC/B,KAAA;IACA,OAAON,OAAO,CAACF,SAAU,CAAA;AAC3B,CAAA;AAEA;;IAGA,MAAMS,kBAAkB,CAACC,YAAAA,GAAAA;IACvB,IAAI,CAACA,cAAc,OAAOT,SAAAA;AAC1B,IAAA,MAAMC,OAAuD,GAAA;AAC3DS,QAAAA,QAAAA,EAAUC,sBAAaD,QAAQ;AAC/BE,QAAAA,kBAAAA,EAAoBD,sBAAaC,kBAAkB;AACnDC,QAAAA,WAAAA,EAAaF,sBAAaE,WAAW;AACrCC,QAAAA,UAAAA,EAAYH,sBAAaG,UAAU;AACnCC,QAAAA,mBAAAA,EAAqBJ,sBAAaI,mBAAmB;AACrDC,QAAAA,OAAAA,EAASL,sBAAaK,OAAO;AAC7BC,QAAAA,YAAAA,EAAcN,sBAAaM,YAAY;AACvCC,QAAAA,UAAAA,EAAYP,sBAAaO;AAC3B,KAAA;IACA,OAAOjB,OAAO,CAACQ,YAAa,CAAA;AAC9B,CAAA;AAEA;;IAGA,MAAMU,0BAA0B,CAACC,IAAAA,GAAAA;IAC/B,IAAI,CAACA,MAAM,OAAOpB,SAAAA;AAClB,IAAA,MAAMC,OAAwD,GAAA;AAC5DoB,QAAAA,MAAAA,EAAQC,8BAAqBD,MAAM;AACnC,QAAA,SAAA,EAAWC,8BAAqBC,OAAO;AACvC,QAAA,cAAA,EAAgBD,8BAAqBE;AACvC,KAAA;IACA,OAAOvB,OAAO,CAACmB,IAAK,CAAA;AACtB,CAAA;AAEA;;;IAIA,MAAMK,sBAAsB,CAACC,IAAAA,GAAAA;IAC3B,IAAI,CAACA,QAAQC,MAAOC,CAAAA,IAAI,CAACF,IAAMG,CAAAA,CAAAA,MAAM,KAAK,CAAA,EAAG,OAAO7B,SAAAA;IACpD,OAAO2B,MAAAA,CAAOG,OAAO,CAACJ,IAAAA,CAAAA,CACnBK,GAAG,CAAC,CAAC,CAACC,GAAKC,EAAAA,KAAAA,CAAM,GAAK,CAAGC,EAAAA,kBAAAA,CAAmBF,KAAK,CAAC,EAAEE,mBAAmBD,KAAQ,CAAA,CAAA,CAAA,CAAA,CAC/EE,IAAI,CAAC,GAAA,CAAA;AACV,CAAA;AAEA;;IAGA,MAAMC,mBAAmB,CAACC,QAAAA,GAAAA;IACxB,IAAI,CAACA,UAAU,OAAO,KAAA;AACtB,IAAA,MAAMC,WAAc,GAAA;AAAC,QAAA,oBAAA;AAAsB,QAAA;AAAyB,KAAA;IACpE,OAAO,CAACA,YAAYC,IAAI,CAAC,CAACC,OAAYA,GAAAA,OAAAA,CAAQ9C,IAAI,CAAC2C,QAAAA,CAAAA,CAAAA;AACrD,CAAA;AAEA;;IAGA,MAAMI,sBAAyB,GAAA,CAC7BC,cACAC,EAAAA,SAAAA,GAAAA;AAEA,IAAA,IAAI,CAACD,cAAgB,EAAA;IAErB,MAAML,QAAAA,GAAWM,SAAWN,EAAAA,QAAAA,EAAUO,QAAc,EAAA,IAAA,EAAA;AACpD,IAAA,MAAMC,WAAWT,gBAAiBC,CAAAA,QAAAA,CAAAA;;AAGlC,IAAA,IAAIQ,QAAU,EAAA;QACZ,IAAIH,cAAAA,CAAejC,YAAY,EAAE;YAC/BqC,OAAQC,CAAAA,WAAW,CACjB,CAAC,eAAe,EAAEL,cAAejC,CAAAA,YAAY,CAAC,uEAAuE,CAAC,CAAA;AAE1H;QAEA,IAAIiC,cAAAA,CAAeM,UAAU,EAAE5B,IAAAA,IAAQsB,eAAeM,UAAU,CAAC5B,IAAI,KAAK,QAAU,EAAA;YAClF0B,OAAQC,CAAAA,WAAW,CACjB,CAAC,iBAAiB,EAAEL,cAAeM,CAAAA,UAAU,CAAC5B,IAAI,CAAC,uEAAuE,CAAC,CAAA;AAE/H;AACF;;IAGA,IAAIsB,cAAAA,CAAeO,SAAS,EAAEC,QAAU,EAAA;AACtC,QAAA,MAAMC,WAAc,GAAA,CAAA,GAAI,IAAO,GAAA,IAAA,CAAA;AAC/B,QAAA,MAAMC,WAAc,GAAA,CAAA,GAAI,IAAO,GAAA,IAAA,GAAO;AAEtC,QAAA,IAAIV,cAAeO,CAAAA,SAAS,CAACC,QAAQ,GAAGC,WAAa,EAAA;YACnDL,OAAQC,CAAAA,WAAW,CACjB,CAAC,mBAAmB,EAAEL,cAAeO,CAAAA,SAAS,CAACC,QAAQ,CAAC,6DAA6D,CAAC,CAAA;AAE1H;AAEA,QAAA,IAAIR,cAAeO,CAAAA,SAAS,CAACC,QAAQ,GAAGE,WAAa,EAAA;YACnDN,OAAQC,CAAAA,WAAW,CACjB,CAAC,mBAAmB,EAAEL,cAAeO,CAAAA,SAAS,CAACC,QAAQ,CAAC,4DAA4D,CAAC,CAAA;AAEzH;AACF;IAEA,IAAIR,cAAAA,CAAeO,SAAS,EAAEI,SAAAA,IAAaX,eAAeO,SAAS,CAACI,SAAS,GAAG,EAAI,EAAA;QAClFP,OAAQC,CAAAA,WAAW,CACjB,CAAC,oBAAoB,EAAEL,cAAeO,CAAAA,SAAS,CAACI,SAAS,CAAC,yDAAyD,CAAC,CAAA;AAExH;AACF,CAAA;AAEA,MAAMC,YAAY,CAAC,EACjBX,SAAS,EACTY,eAAe,EAIhB,GAAA;AACC,IAAA,IAAI5B,OAAOC,IAAI,CAAC2B,eAAiB1B,CAAAA,CAAAA,MAAM,GAAG,CAAG,EAAA;AAC3CiB,QAAAA,OAAAA,CAAQC,WAAW,CACjB,2LAAA,CAAA;AAEJ;AACA,IAAA,MAAMS,cAAcC,wBAAmB,CAAA;AAAEd,QAAAA,SAAAA;AAAW,QAAA,GAAGY;AAAgB,KAAA,CAAA;AACvE,IAAA,MAAMG,MAAS,GAAA;AACb,QAAA,GAAGf,SAAS;AACZ,QAAA,GAAGY,eAAe;AAClB,QAAA,GAAIC,WAAc,GAAA;AAAEA,YAAAA;AAAY,SAAA,GAAI;AACtC,KAAA;IAEA,IAAIE,MAAAA,CAAOC,MAAM,KAAK3D,SAAW,EAAA;;;;;;AAM/B,QAAA,IAAI,EAAE,KAAA,IAAS0D,MAAOC,CAAAA,MAAM,CAAG,EAAA;AAC7BD,YAAAA,MAAAA,CAAOC,MAAM,CAACC,GAAG,GAAGC,yBAAgBC,WAAW;AACjD;KACK,MAAA;AACL,QAAA,MAAM,IAAIC,KAAM,CAAA,oEAAA,CAAA;AAClB;IAEA,OAAOL,MAAAA;AAGT,CAAA;AAEA,YAAe;IACbM,IAAK,CAAA,CAAA,EAAEC,OAAO,EAAEC,QAAQ,EAAEvB,SAAS,EAAED,cAAc,EAAE,GAAGa,eAA8B,EAAA,EAAA;;AAEpFd,QAAAA,sBAAAA,CAAuBC,cAAgBC,EAAAA,SAAAA,CAAAA;;AAGvC,QAAA,MAAMe,SAASJ,SAAU,CAAA;YAAEX,SAAWA,EAAAA,SAAAA;AAA6BY,YAAAA;AAAgB,SAAA,CAAA;QACnF,MAAMY,QAAAA,GAAW,IAAIC,iBAASV,CAAAA,MAAAA,CAAAA;QAC9B,MAAMW,UAAAA,GAAaH,QAAW,GAAA,CAAA,EAAGA,QAASrE,CAAAA,OAAO,CAAC,MAAQ,EAAA,EAAA,CAAA,CAAI,CAAC,CAAC,GAAG,EAAA;AAEnE,QAAA,MAAMyE,aAAa,CAACC,IAAAA,GAAAA;YAClB,MAAMC,aAAAA,GAAgB7E,qBAAsB4E,CAAAA,IAAAA,CAAKE,IAAI,CAAA;AACrD,YAAA,MAAMA,OAAOD,aAAgB,GAAA,CAAA,EAAGA,aAAc,CAAA,CAAC,CAAC,GAAG,EAAA;YACnD,MAAME,aAAAA,GAAgB/E,qBAAsB4E,CAAAA,IAAAA,CAAKI,IAAI,CAAA;YACrD,MAAMC,YAAAA,GAAeL,IAAKM,CAAAA,GAAG,GAAGN,IAAAA,CAAKM,GAAG,CAAChF,OAAO,CAAC,gBAAA,EAAkB,EAAM,CAAA,GAAA,EAAA;AACzE,YAAA,OAAO,CAAGwE,EAAAA,UAAAA,CAAAA,EAAaI,IAAOC,CAAAA,EAAAA,aAAAA,CAAAA,EAAgBE,YAAc,CAAA,CAAA;AAC9D,SAAA;AAEA;;AAEC,QACD,MAAME,iBAAoB,GAAA,CACxBP,MACAQ,OACAC,EAAAA,YAAAA,GAA+C,EAAE,GAAA;AAEjD,YAAA,MAAMrB,MAAgC,GAAA;gBACpCsB,MAAQvB,EAAAA,MAAAA,CAAOC,MAAM,CAACsB,MAAM;gBAC5BC,GAAKH,EAAAA,OAAAA;gBACLI,IAAMZ,EAAAA,IAAAA,CAAKa,MAAM,IAAIC,MAAAA,CAAOC,IAAI,CAACf,IAAAA,CAAKgB,MAAM,EAAS,QAAA,CAAA;;;AAGrD,gBAAA,GAAI7B,MAAOC,CAAAA,MAAM,CAACC,GAAG,GAAG;oBAAEA,GAAKF,EAAAA,MAAAA,CAAOC,MAAM,CAACC;AAAI,iBAAA,GAAI,EAAE;AACvD4B,gBAAAA,WAAAA,EAAajB,KAAKkB;AACpB,aAAA;;YAGA,MAAMC,iBAAAA,GAAoB5F,qBAAqB4C,cAAgBgD,EAAAA,iBAAAA,CAAAA;AAC/D,YAAA,IAAIA,iBAAmB,EAAA;AACrB/B,gBAAAA,MAAAA,CAAOxD,iBAAiB,GAAGuF,iBAAAA;AAC7B;;AAGA,YAAA,IAAIhD,gBAAgBiD,gBAAkB,EAAA;AACpChC,gBAAAA,MAAAA,CAAOiC,WAAW,GAAG,GAAA;AACvB;;YAGA,MAAMnF,YAAAA,GAAeD,gBAAgBkC,cAAgBjC,EAAAA,YAAAA,CAAAA;AACrD,YAAA,IAAIA,YAAc,EAAA;AAChBkD,gBAAAA,MAAAA,CAAOhD,YAAY,GAAGF,YAAAA;AACxB;;AAGA,YAAA,IAAIiC,gBAAgBM,UAAY,EAAA;AAC9B,gBAAA,MAAM6C,GAAM1E,GAAAA,uBAAAA,CAAwBuB,cAAeM,CAAAA,UAAU,CAAC5B,IAAI,CAAA;AAClE,gBAAA,IAAIyE,GAAK,EAAA;AACPlC,oBAAAA,MAAAA,CAAOrC,oBAAoB,GAAGuE,GAAAA;AAC9B,oBAAA,IAAInD,cAAeM,CAAAA,UAAU,CAAC8C,QAAQ,EAAE;AACtCnC,wBAAAA,MAAAA,CAAOoC,WAAW,GAAGrD,cAAeM,CAAAA,UAAU,CAAC8C,QAAQ;AACzD;AACF;AACF;;YAGA,MAAME,OAAAA,GAAUvE,oBAAoBiB,cAAgBhB,EAAAA,IAAAA,CAAAA;AACpD,YAAA,IAAIsE,OAAS,EAAA;AACXrC,gBAAAA,MAAAA,CAAOsC,OAAO,GAAGD,OAAAA;AACnB;;;;YAKA,MAAM,EAAEf,MAAM,EAAEC,GAAG,EAAEC,IAAI,EAAE,GAAGe,gBAAAA,EAAkB,GAAGlB,YAAAA;YACnD,OAAO;AAAE,gBAAA,GAAGrB,MAAM;AAAE,gBAAA,GAAGuC;AAAiB,aAAA;AAC1C,SAAA;AAEA;;;QAIA,MAAMC,gBAAmB,GAAA,CAACpB,OAAiBqB,EAAAA,cAAAA,GAAAA;;AAEzC,YAAA,IAAInC,OAAS,EAAA;AACX,gBAAA,MAAMoC,SAAYpC,GAAAA,OAAAA,CAAQpE,OAAO,CAAC,MAAQ,EAAA,EAAA,CAAA;AAC1C,gBAAA,OAAO,CAAGwG,EAAAA,SAAAA,CAAU,CAAC,EAAEtB,OAAS,CAAA,CAAA;AAClC;;;;YAKA,MAAM1C,QAAAA,GAAWqB,MAAOrB,CAAAA,QAAQ,EAAEO,QAAAA,EAAAA;AAClC,YAAA,IAAIP,QAAU,EAAA;gBACZ,MAAMiE,WAAAA,GAAcjE,SAASkE,UAAU,CAAC,UAAUlE,QAAW,GAAA,CAAC,QAAQ,EAAEA,QAAU,CAAA,CAAA;AAClF,gBAAA,MAAMmE,aAAgBF,GAAAA,WAAAA,CAAYzG,OAAO,CAAC,MAAQ,EAAA,EAAA,CAAA;gBAClD,OAAO,CAAA,EAAG2G,aAAc,CAAA,CAAC,EAAE9C,MAAAA,CAAOC,MAAM,CAACsB,MAAM,CAAC,CAAC,EAAEF,OAAS,CAAA,CAAA;AAC9D;;AAGA,YAAA,IAAIvF,kBAAkB4G,cAAiB,CAAA,EAAA;gBACrC,OAAOA,cAAAA;AACT;;YAGA,OAAO,CAAC,QAAQ,EAAEA,cAAgB,CAAA,CAAA;AACpC,SAAA;AAEA,QAAA,MAAMK,MAAS,GAAA,OAAOlC,IAAYS,EAAAA,YAAAA,GAA+C,EAAE,GAAA;AACjF,YAAA,MAAMD,UAAUT,UAAWC,CAAAA,IAAAA,CAAAA;YAC3B,MAAMZ,MAAAA,GAASmB,iBAAkBP,CAAAA,IAAAA,EAAMQ,OAASC,EAAAA,YAAAA,CAAAA;AAEhD,YAAA,MAAM0B,aAMF,GAAA;gBACFC,MAAQxC,EAAAA,QAAAA;AACRR,gBAAAA;AACF,aAAA;;AAGA,YAAA,IAAIjB,gBAAgBO,SAAW,EAAA;AAC7B,gBAAA,IAAIP,cAAeO,CAAAA,SAAS,CAACC,QAAQ,EAAE;AACrCwD,oBAAAA,aAAAA,CAAcxD,QAAQ,GAAGR,cAAeO,CAAAA,SAAS,CAACC,QAAQ;AAC5D;AACA,gBAAA,IAAIR,cAAeO,CAAAA,SAAS,CAACI,SAAS,EAAE;AACtCqD,oBAAAA,aAAAA,CAAcrD,SAAS,GAAGX,cAAeO,CAAAA,SAAS,CAACI,SAAS;AAC9D;AACA,gBAAA,IAAIX,cAAeO,CAAAA,SAAS,CAAC2D,iBAAiB,KAAK5G,SAAW,EAAA;AAC5D0G,oBAAAA,aAAAA,CAAcE,iBAAiB,GAAGlE,cAAeO,CAAAA,SAAS,CAAC2D,iBAAiB;AAC9E;AACF;YAEA,MAAMC,SAAAA,GAAY,IAAIC,iBAAOJ,CAAAA,aAAAA,CAAAA;YAC7B,MAAMK,MAAAA,GAAU,MAAMF,SAAAA,CAAUG,IAAI,EAAA;;AAGpCzC,YAAAA,IAAAA,CAAK9E,GAAG,GAAG0G,gBAAiBpB,CAAAA,OAAAA,EAASgC,OAAOE,QAAQ,CAAA;;YAGpD,IAAIF,MAAAA,CAAOG,IAAI,EAAE;AACf3C,gBAAAA,IAAAA,CAAK4C,IAAI,GAAGJ,MAAAA,CAAOG,IAAI,CAACrH,OAAO,CAAC,IAAM,EAAA,EAAA,CAAA;AACxC;AACF,SAAA;AAEA;;;AAGC,QACD,MAAMuH,aAAgB,GAAA,OACpB7C,MACA8C,YACArC,EAAAA,YAAAA,GAA+C,EAAE,GAAA;AAEjD,YAAA,MAAMD,UAAUT,UAAWC,CAAAA,IAAAA,CAAAA;YAC3B,MAAMZ,MAAAA,GAASmB,iBAAkBP,CAAAA,IAAAA,EAAMQ,OAAS,EAAA;AAC9C,gBAAA,GAAGC,YAAY;gBACfsC,OAASD,EAAAA;AACX,aAAA,CAAA;YAEA,MAAMR,SAAAA,GAAY,IAAIC,iBAAO,CAAA;gBAC3BH,MAAQxC,EAAAA,QAAAA;AACRR,gBAAAA;AACF,aAAA,CAAA;YAEA,MAAMoD,MAAAA,GAAU,MAAMF,SAAAA,CAAUG,IAAI,EAAA;;AAGpCzC,YAAAA,IAAAA,CAAK9E,GAAG,GAAG0G,gBAAiBpB,CAAAA,OAAAA,EAASgC,OAAOE,QAAQ,CAAA;YAEpD,IAAIF,MAAAA,CAAOG,IAAI,EAAE;AACf3C,gBAAAA,IAAAA,CAAK4C,IAAI,GAAGJ,MAAAA,CAAOG,IAAI,CAACrH,OAAO,CAAC,IAAM,EAAA,EAAA,CAAA;AACxC;AACF,SAAA;AAEA;;QAGA,MAAM0H,oBAAoB,OAAOhD,IAAAA,GAAAA;YAC/B,MAAMiD,OAAAA,GAAU,IAAIC,0BAAkB,CAAA;gBACpCxC,MAAQvB,EAAAA,MAAAA,CAAOC,MAAM,CAACsB,MAAM;AAC5BC,gBAAAA,GAAAA,EAAKZ,UAAWC,CAAAA,IAAAA;AAClB,aAAA,CAAA;AAEA,YAAA,MAAMmD,QAAW,GAAA,MAAMvD,QAASwD,CAAAA,IAAI,CAACH,OAAAA,CAAAA;YAErC,OAAO;AACLL,gBAAAA,IAAAA,EAAMO,QAASR,CAAAA,IAAI,EAAErH,OAAAA,CAAQ,IAAM,EAAA,EAAA,CAAA;AACnC+H,gBAAAA,aAAAA,EAAeF,SAASG,aAAa;AACrCC,gBAAAA,WAAAA,EAAaJ,SAASlC,WAAW;AACjCuC,gBAAAA,YAAAA,EAAcL,SAASM,YAAY;AACnCvH,gBAAAA,YAAAA,EAAciH,SAAS/G,YAAY;AACnCsH,gBAAAA,oBAAAA,EAAsBP,SAASpG;AACjC,aAAA;AACF,SAAA;AAEA;;QAGA,MAAM4G,eAAe,OAAO3D,IAAAA,GAAAA;YAC1B,IAAI;AACF,gBAAA,MAAMgD,iBAAkBhD,CAAAA,IAAAA,CAAAA;gBACxB,OAAO,IAAA;AACT,aAAA,CAAE,OAAO4D,KAAY,EAAA;gBACnB,IAAIA,KAAAA,CAAMC,IAAI,KAAK,UAAA,IAAcD,MAAME,SAAS,EAAEC,mBAAmB,GAAK,EAAA;oBACxE,OAAO,KAAA;AACT;gBACA,MAAMH,KAAAA;AACR;AACF,SAAA;QAEA,OAAO;AACL;;UAGAI,SAAAA,CAAAA,GAAAA;AACE,gBAAA,OAAO7E,MAAOC,CAAAA,MAAM,CAACC,GAAG,KAAK,SAAA;AAC/B,aAAA;AAEA;;UAGA4E,iBAAAA,CAAAA,GAAAA;gBACE,OAAO9F,cAAAA;AACT,aAAA;AAEA;;AAEC,UACD,MAAM+F,YAAAA,CAAAA,CAAalE,IAAU,EAAES,YAAiB,EAAA;gBAC9C,IAAI,CAAC0D,qBAAgBnE,CAAAA,IAAAA,CAAK9E,GAAG,EAAEiE,OAAOC,MAAM,CAACsB,MAAM,EAAEhB,OAAU,CAAA,EAAA;oBAC7D,OAAO;AAAExE,wBAAAA,GAAAA,EAAK8E,KAAK9E;AAAI,qBAAA;AACzB;AACA,gBAAA,MAAMsF,UAAUT,UAAWC,CAAAA,IAAAA,CAAAA;;;AAI3B,gBAAA,MAAM9E,GAAM,GAAA,MAAMgJ,+BAChBtE,CAAAA,QAAAA,EACA,IAAIwE,yBAAiB,CAAA;AACnB,oBAAA,GAAG3D,YAAY;oBACfC,MAAQvB,EAAAA,MAAAA,CAAOC,MAAM,CAACsB,MAAM;oBAC5BC,GAAKH,EAAAA;iBAEP,CAAA,EAAA;oBACE6D,SAAWC,EAAAA,QAAAA,CAAM,KAAK,EAAI,EAAA;AAAC,wBAAA,QAAA;AAAU,wBAAA;qBAAmB,EAAEnF,MAAAA;AAC5D,iBAAA,CAAA;gBAGF,OAAO;AAAEjE,oBAAAA;AAAI,iBAAA;AACf,aAAA;AAEA;;AAEC,UACDqJ,YAAavE,CAAAA,CAAAA,IAAU,EAAES,YAAAA,GAAe,EAAE,EAAA;AACxC,gBAAA,OAAOyB,OAAOlC,IAAMS,EAAAA,YAAAA,CAAAA;AACtB,aAAA;AAEA;;AAEC,UACDyB,MAAOlC,CAAAA,CAAAA,IAAU,EAAES,YAAAA,GAAe,EAAE,EAAA;AAClC,gBAAA,OAAOyB,OAAOlC,IAAMS,EAAAA,YAAAA,CAAAA;AACtB,aAAA;AAEA;;;AAGC,UACDoC,eAAc7C,IAAU,EAAE8C,YAAoB,EAAErC,YAAAA,GAAe,EAAE,EAAA;gBAC/D,OAAOoC,aAAAA,CAAc7C,MAAM8C,YAAcrC,EAAAA,YAAAA,CAAAA;AAC3C,aAAA;AAEA;;AAEC,UACDuC,mBAAkBhD,IAAU,EAAA;AAC1B,gBAAA,OAAOgD,iBAAkBhD,CAAAA,IAAAA,CAAAA;AAC3B,aAAA;AAEA;;AAEC,UACD2D,cAAa3D,IAAU,EAAA;AACrB,gBAAA,OAAO2D,YAAa3D,CAAAA,IAAAA,CAAAA;AACtB,aAAA;AAEA;;AAEC,UACDwE,MAAOxE,CAAAA,CAAAA,IAAU,EAAES,YAAAA,GAAe,EAAE,EAAA;;;AAGlC,gBAAA,MAAM,EAAEC,MAAM,EAAEC,GAAG,EAAE,GAAG8D,YAAY,GAAGhE,YAAAA;gBACvC,MAAMwC,OAAAA,GAAU,IAAIyB,4BAAoB,CAAA;AACtC,oBAAA,GAAGD,UAAU;oBACb/D,MAAQvB,EAAAA,MAAAA,CAAOC,MAAM,CAACsB,MAAM;AAC5BC,oBAAAA,GAAAA,EAAKZ,UAAWC,CAAAA,IAAAA;AAClB,iBAAA,CAAA;gBACA,OAAOJ,QAAAA,CAASwD,IAAI,CAACH,OAAAA,CAAAA;AACvB;AACF,SAAA;AACF;AACF,CAAE;;;;"}