@strapi/upload 5.58.0 → 5.59.0

package/dist/server/mcp/handlers/write-handlers.js.map

@@ -1 +1 @@
-{"version":3,"file":"write-handlers.js","sources":["../../../../server/src/mcp/handlers/write-handlers.ts"],"sourcesContent":["import { errors } from '@strapi/utils';\nimport type { Core, Modules } from '@strapi/types';\n\nimport { getService } from '../../utils';\nimport { ACTIONS, FILE_MODEL_UID, FOLDER_MODEL_UID } from '../../constants';\nimport { findEntityAndCheckPermissions } from '../../controllers/utils/find-entity-and-check-permissions';\nimport { assertAmbientInstance } from '../ambient-instance';\nimport { assertMediaPermission } from '../permissions';\nimport { sanitizeMediaAsset } from '../sanitizers/sanitize-media';\nimport {\n  MCP_NOT_FOUND_ASSET,\n  MCP_UPDATE_ASSET_NO_FIELDS,\n  MCP_MOVE_ASSETS_DESTINATION_NOT_FOUND,\n  MCP_MOVE_ASSETS_ID_NOT_FOUND,\n  MCP_MOVE_ASSETS_ID_FORBIDDEN,\n  MCP_MOVE_ASSETS_ID_FAILED,\n  MCP_DELETE_ASSETS_ID_NOT_FOUND,\n  MCP_DELETE_ASSETS_ID_FORBIDDEN,\n  MCP_DELETE_ASSETS_ID_FAILED,\n} from './constants';\nimport { ok } from '../utils';\n\n// Type-level only: the MCP SDK validates `args` against the tool's strict Zod input schema\n// before the handler runs, so unknown keys never reach here.\ntype MediaUpdateAssetArgs = {\n  id: number;\n  name?: string;\n  alternativeText?: string | null;\n  caption?: string | null;\n};\n\ntype MediaMoveAssetsArgs = {\n  ids: number[];\n  folder: number | null;\n};\n\ntype MediaDeleteAssetsArgs = {\n  ids: number[];\n  dryRun?: boolean;\n};\n\n/** The metadata keys `media_update_asset` may write. Everything else is rejected by the schema. */\nconst WRITABLE_FIELDS = ['name', 'alternativeText', 'caption'] as const;\n\n/**\n * Picks the metadata the caller actually sent.\n *\n * `updateFileInfo` treats nil as \"keep the stored value\" (`_.isNil`), so an explicit\n * `alternativeText: null` cannot be forwarded as null — it would be read as \"unchanged\"\n * instead of \"clear it\". Clearing is expressed as an empty string, which is what the admin\n * panel writes when the field is emptied.\n */\nconst buildFileInfo = (args: MediaUpdateAssetArgs): Record<string, string> => {\n  const fileInfo: Record<string, string> = {};\n\n  for (const field of WRITABLE_FIELDS) {\n    const value = args[field];\n\n    if (value !== undefined) {\n      fileInfo[field] = value === null ? '' : value;\n    }\n  }\n\n  return fileInfo;\n};\n\n/**\n * `media_update_asset` — edits the writable metadata of one asset.\n *\n * Gated on `plugin::upload.assets.update` and mirrors `PUT /upload/files/:id`: the same\n * `findEntityAndCheckPermissions` row-level check, the same `updateFileInfo` service call, and\n * the same `updatedBy` attribution from the session user.\n *\n * The response carries the updated asset through the read sanitizer, so a client can confirm\n * the write without a second `media_get_asset` round-trip — and so provider fields stay\n * invisible on the write path too.\n */\nexport const createMediaUpdateAssetHandler = (\n  strapi: Core.Strapi,\n  context: Modules.MCP.McpHandlerContext\n) => {\n  assertAmbientInstance(strapi);\n\n  return async ({\n    args,\n  }: {\n    args: Record<string, unknown>;\n  }): Promise<Modules.MCP.McpToolHandlerReturn> => {\n    const { id, ...metadata } = args as MediaUpdateAssetArgs;\n    const fileInfo = buildFileInfo(metadata as MediaUpdateAssetArgs);\n\n    // A patch with no writable field is a caller error, not a no-op success: the schema cannot\n    // express \"at least one of\" without becoming a ZodEffects the registry can't publish.\n    if (Object.keys(fileInfo).length === 0) {\n      throw new errors.ValidationError(MCP_UPDATE_ASSET_NO_FIELDS);\n    }\n\n    // Model-level gate first, so a token without the action is refused before any DB read.\n    // `findEntityAndCheckPermissions` only covers the row-level check.\n    assertMediaPermission(strapi, context, ACTIONS.update, FILE_MODEL_UID);\n\n    // Row-level check, shared with the admin controller: resolves the creator's roles so an\n    // owner-scoped permission condition is evaluated against the same subject the REST API\n    // would build, and throws Forbidden when a condition excludes this asset.\n    //\n    // Its NotFoundError carries no message, which would reach the agent as a bare \"Not Found\";\n    // rethrowing adds the same wording the read tools use.\n    try {\n      await findEntityAndCheckPermissions(\n        context.userAbility,\n        ACTIONS.update,\n        FILE_MODEL_UID,\n        id,\n        strapi\n      );\n    } catch (error) {\n      if (error instanceof errors.NotFoundError) {\n        throw new errors.NotFoundError(MCP_NOT_FOUND_ASSET);\n      }\n\n      throw error;\n    }\n\n    const written = await getService('upload', strapi).updateFileInfo(id, fileInfo, {\n      user: context.user,\n    });\n\n    const updated = await getService('upload', strapi).findOne(id, ['folder']);\n\n    return ok({ data: sanitizeMediaAsset(updated ?? written) });\n  };\n};\n\n/**\n * Resolves the destination folder for `media_move_assets`, and rejects one that does not exist.\n *\n * `null` is the media library root and always valid. A named folder is looked up so a typo — or a\n * folder id passed where the agent meant an asset — is refused before anything is moved, matching\n * the `folder-exists` test the admin bulk-move validation applies to `destinationFolderId`.\n *\n * A bad destination is the one failure that rejects the whole call rather than being reported per\n * id: it is a property of the request, not of any single asset, so every id would fail for the\n * same reason and a per-id report would say nothing the agent could act on.\n */\nconst resolveDestinationFolder = async (strapi: Core.Strapi, folder: number | null) => {\n  if (folder === null) {\n    return null;\n  }\n\n  const destination = await strapi.db.query(FOLDER_MODEL_UID).findOne({\n    select: ['id', 'name'],\n    where: { id: folder },\n  });\n\n  if (destination === null || destination === undefined) {\n    throw new errors.ValidationError(MCP_MOVE_ASSETS_DESTINATION_NOT_FOUND);\n  }\n\n  return { id: Number(destination.id), name: String(destination.name ?? '') };\n};\n\n/**\n * `media_move_assets` — moves assets between folders in bulk.\n *\n * Bulk with a per-id report, rather than all-or-nothing: an agent reorganising a library moves\n * many assets at once, and one bad id among good ones must not discard the valid moves. Each\n * asset is moved on its own, so a failure is confined to its own id and the response says exactly\n * which ids to retry.\n *\n * That is why this does not reuse the admin `/actions/bulk-move` controller path, whose single\n * transaction is all-or-nothing by construction (and which also handles folders, out of scope\n * here). It goes through `updateFileInfo` instead — the same service `media_update_asset` and\n * `PUT /upload/files/:id` use — which sets the `folder` relation, recomputes the private\n * `folderPath`, attributes `updatedBy`, and emits `media.update` per asset. Replicating the\n * controller's raw join-table writes would skip all four.\n *\n * The moves are sequential on purpose. Each one writes the join table and `folderPath` for its\n * asset, and a bounded reorganisation (100 ids max, per the input schema) is not worth the\n * connection-pool contention of firing them in parallel.\n */\nexport const createMediaMoveAssetsHandler = (\n  strapi: Core.Strapi,\n  context: Modules.MCP.McpHandlerContext\n) => {\n  assertAmbientInstance(strapi);\n\n  return async ({\n    args,\n  }: {\n    args: Record<string, unknown>;\n  }): Promise<Modules.MCP.McpToolHandlerReturn> => {\n    const { ids, folder } = args as MediaMoveAssetsArgs;\n\n    // Model-level gate first, so a token without the action is refused before any DB read.\n    assertMediaPermission(strapi, context, ACTIONS.update, FILE_MODEL_UID);\n\n    const destinationFolder = await resolveDestinationFolder(strapi, folder);\n\n    const moved: ReturnType<typeof sanitizeMediaAsset>[] = [];\n    const failed: { id: number; reason: string }[] = [];\n\n    // `ids` can repeat an id; de-duplicating keeps the report one entry per id rather than\n    // reporting the same asset twice for a request that moved it once.\n    for (const id of new Set(ids)) {\n      try {\n        // Row-level check, shared with the admin controller: an owner-scoped permission\n        // condition is evaluated against the same subject the REST API would build.\n        await findEntityAndCheckPermissions(\n          context.userAbility,\n          ACTIONS.update,\n          FILE_MODEL_UID,\n          id,\n          strapi\n        );\n        const updated = await getService('upload', strapi).updateFileInfo(\n          id,\n          // `updateFileInfo` reads `undefined` as \"keep the stored folder\" and null as the root,\n          // so the destination is forwarded as-is.\n          { folder },\n          { user: context.user }\n        );\n\n        // `updateFileInfo` resolves the row it wrote without the `folder` relation populated, so\n        // the destination is attached here instead of costing a read-back per asset.\n        moved.push(sanitizeMediaAsset({ ...updated, folder: destinationFolder }));\n      } catch (error) {\n        if (error instanceof errors.NotFoundError) {\n          failed.push({ id, reason: MCP_MOVE_ASSETS_ID_NOT_FOUND });\n          continue;\n        }\n\n        if (error instanceof errors.ForbiddenError) {\n          failed.push({ id, reason: MCP_MOVE_ASSETS_ID_FORBIDDEN });\n          continue;\n        }\n\n        /**\n         * Any other failure — a DB error, a provider fault — is reported against this id too,\n         * rather than thrown.\n         *\n         * Throwing here would be the one way to lose committed work silently: a tool error\n         * reaches the client as `{ content: [text], isError: true }` with NO\n         * `structuredContent` (see `tool-registry.ts`), so an error on the third id would\n         * discard the report saying the first two had already moved. The agent would be left\n         * unable to tell which ids to retry — exactly the recoverability this tool exists to\n         * provide.\n         *\n         * The message is carried through verbatim so the real fault is still legible, and the\n         * loop continues: one broken asset must not strand the rest of a reorganisation.\n         */\n        failed.push({\n          id,\n          reason: MCP_MOVE_ASSETS_ID_FAILED(error instanceof Error ? error.message : String(error)),\n        });\n      }\n    }\n\n    /**\n     * A request where nothing moved still returns the per-id report.\n     *\n     * `moved: []` alongside a populated `failed` is not ambiguous — it says plainly that nothing\n     * moved and why, per id. Throwing instead would drop `structuredContent` entirely (a tool\n     * error carries text only), so `ids: [999]` would get prose while `ids: [1, 999]` got a\n     * machine-readable entry, for the same class of mistake.\n     *\n     * The only failure that still rejects the whole call is an invalid destination folder, which\n     * is checked before the loop: nothing has moved, so there is no report to preserve.\n     */\n    return ok({ destinationFolder, moved, failed });\n  };\n};\n\n/**\n * `media_delete_assets` — previews or performs the permanent deletion of assets, in bulk.\n *\n * Two branches behind one tool, for the same reason as `media_delete_folder`: the preview and the\n * deletion must agree on what would be destroyed, and splitting them across tools would both let\n * the two drift apart and let an agent reach the destructive one without ever seeing a preview.\n * `dryRun` defaults to true (see the input schema), so omitting the flag previews and deleting\n * takes an explicit `dryRun: false`.\n *\n * Per-id, not all-or-nothing — the opposite of `media_delete_folder`, on purpose. A folder delete\n * cascades, so a mixed id list there is refused outright rather than half-applied over an unknown\n * amount of content. Here each id is exactly one asset, the blast radius of a bad one is nil, and\n * the requirement is explicit: a bad id among good ones must not discard the valid deletions.\n * The dry run reports the same per-id split, so an agent sees which ids will not resolve *before*\n * anything is destroyed rather than after.\n *\n * This does not reuse `file.deleteByIds` (the admin `/actions/bulk-delete` path). That helper\n * fires `upload.remove` under a single `Promise.all`, so the first rejection discards the report\n * of everything already deleted — unrecoverable for an operation with no undo. The removals are\n * driven one at a time here instead, through the same `upload.remove` service, which deletes the\n * provider file and every generated format, emits `media.delete`, and then deletes the row.\n *\n * The deletions are sequential on purpose: each one performs provider I/O, and a bounded batch\n * (100 ids max, per the input schema) is not worth firing at a provider in parallel.\n */\nexport const createMediaDeleteAssetsHandler = (\n  strapi: Core.Strapi,\n  context: Modules.MCP.McpHandlerContext\n) => {\n  assertAmbientInstance(strapi);\n\n  return async ({\n    args,\n  }: {\n    args: Record<string, unknown>;\n  }): Promise<Modules.MCP.McpToolHandlerReturn> => {\n    const { ids, dryRun = true } = args as MediaDeleteAssetsArgs;\n\n    // Model-level gate first, so a token without the action is refused before any DB read.\n    // The preview takes the same gate: it reveals which assets exist and what they are.\n    assertMediaPermission(strapi, context, ACTIONS.update, FILE_MODEL_UID);\n\n    const deleted: ReturnType<typeof sanitizeMediaAsset>[] = [];\n    const failed: { id: number; reason: string }[] = [];\n\n    // `ids` can repeat an id; de-duplicating keeps the report one entry per id, and stops the\n    // second occurrence of an already-deleted asset from being reported as a missing one.\n    for (const id of new Set(ids)) {\n      let file;\n\n      try {\n        // Row-level check, shared with the admin controller: an owner-scoped permission\n        // condition is evaluated against the same subject the REST API would build. Run on the\n        // dry run too — a preview must not list an asset the executing call would refuse.\n        ({ file } = await findEntityAndCheckPermissions(\n          context.userAbility,\n          ACTIONS.update,\n          FILE_MODEL_UID,\n          id,\n          strapi\n        ));\n      } catch (error) {\n        if (error instanceof errors.NotFoundError) {\n          failed.push({ id, reason: MCP_DELETE_ASSETS_ID_NOT_FOUND });\n          continue;\n        }\n\n        if (error instanceof errors.ForbiddenError) {\n          failed.push({ id, reason: MCP_DELETE_ASSETS_ID_FORBIDDEN });\n          continue;\n        }\n\n        failed.push({\n          id,\n          reason: MCP_DELETE_ASSETS_ID_FAILED(\n            error instanceof Error ? error.message : String(error)\n          ),\n        });\n        continue;\n      }\n\n      // The preview stops here: the asset resolved and this token may delete it, which is\n      // everything the agent needs to confirm — reported in the same shape the real run uses.\n      if (dryRun) {\n        deleted.push(sanitizeMediaAsset(file));\n        continue;\n      }\n\n      try {\n        await getService('upload', strapi).remove(file);\n\n        // Reported from the row read before the delete: the asset no longer exists, so this is\n        // the only description of it the agent will ever get.\n        deleted.push(sanitizeMediaAsset(file));\n      } catch (error) {\n        /**\n         * A failed removal is reported against its own id rather than thrown, for the reason\n         * spelled out on `media_move_assets` — a tool error carries no `structuredContent`, so throwing\n         * on the third id would discard the report saying the first two are gone. Here that\n         * matters more: the earlier deletions cannot be re-read, undone or discovered afterwards.\n         */\n        failed.push({\n          id,\n          reason: MCP_DELETE_ASSETS_ID_FAILED(\n            error instanceof Error ? error.message : String(error)\n          ),\n        });\n      }\n    }\n\n    /**\n     * A request where nothing was deleted still returns the per-id report, on both branches:\n     * `deleted: []` with every id in `failed` says plainly that nothing happened and why, per id.\n     * Throwing instead would drop `structuredContent` entirely, so `ids: [999]` would get prose\n     * where `ids: [1, 999]` gets a machine-readable entry, for the same class of mistake.\n     */\n    return ok({ dryRun, deleted, failed, totalFileNumber: deleted.length });\n  };\n};\n"],"names":["WRITABLE_FIELDS","buildFileInfo","args","fileInfo","field","value","undefined","createMediaUpdateAssetHandler","strapi","context","assertAmbientInstance","id","metadata","Object","keys","length","errors","ValidationError","MCP_UPDATE_ASSET_NO_FIELDS","assertMediaPermission","ACTIONS","update","FILE_MODEL_UID","findEntityAndCheckPermissions","userAbility","error","NotFoundError","MCP_NOT_FOUND_ASSET","written","getService","updateFileInfo","user","updated","findOne","ok","data","sanitizeMediaAsset","resolveDestinationFolder","folder","destination","db","query","FOLDER_MODEL_UID","select","where","MCP_MOVE_ASSETS_DESTINATION_NOT_FOUND","Number","name","String","createMediaMoveAssetsHandler","ids","destinationFolder","moved","failed","Set","push","reason","MCP_MOVE_ASSETS_ID_NOT_FOUND","ForbiddenError","MCP_MOVE_ASSETS_ID_FORBIDDEN","MCP_MOVE_ASSETS_ID_FAILED","Error","message","createMediaDeleteAssetsHandler","dryRun","deleted","file","MCP_DELETE_ASSETS_ID_NOT_FOUND","MCP_DELETE_ASSETS_ID_FORBIDDEN","MCP_DELETE_ASSETS_ID_FAILED","remove","totalFileNumber"],"mappings":";;;;;;;;;;;;AAyCA,oGACA,MAAMA,eAAAA,GAAkB;AAAC,IAAA,MAAA;AAAQ,IAAA,iBAAA;AAAmB,IAAA;AAAU,CAAA;AAE9D;;;;;;;IAQA,MAAMC,gBAAgB,CAACC,IAAAA,GAAAA;AACrB,IAAA,MAAMC,WAAmC,EAAC;IAE1C,KAAK,MAAMC,SAASJ,eAAAA,CAAiB;QACnC,MAAMK,KAAAA,GAAQH,IAAI,CAACE,KAAAA,CAAM;AAEzB,QAAA,IAAIC,UAAUC,SAAAA,EAAW;AACvBH,YAAAA,QAAQ,CAACC,KAAAA,CAAM,GAAGC,KAAAA,KAAU,OAAO,EAAA,GAAKA,KAAAA;AAC1C,QAAA;AACF,IAAA;IAEA,OAAOF,QAAAA;AACT,CAAA;AAEA;;;;;;;;;;AAUC,IACM,MAAMI,6BAAAA,GAAgC,CAC3CC,MAAAA,EACAC,OAAAA,GAAAA;IAEAC,qCAAAA,CAAsBF,MAAAA,CAAAA;IAEtB,OAAO,OAAO,EACZN,IAAI,EAGL,GAAA;AACC,QAAA,MAAM,EAAES,EAAE,EAAE,GAAGC,UAAU,GAAGV,IAAAA;AAC5B,QAAA,MAAMC,WAAWF,aAAAA,CAAcW,QAAAA,CAAAA;;;AAI/B,QAAA,IAAIC,OAAOC,IAAI,CAACX,QAAAA,CAAAA,CAAUY,MAAM,KAAK,CAAA,EAAG;YACtC,MAAM,IAAIC,YAAAA,CAAOC,eAAe,CAACC,oCAAAA,CAAAA;AACnC,QAAA;;;AAIAC,QAAAA,iCAAAA,CAAsBX,MAAAA,EAAQC,OAAAA,EAASW,mBAAAA,CAAQC,MAAM,EAAEC,0BAAAA,CAAAA;;;;;;;QAQvD,IAAI;YACF,MAAMC,2DAAAA,CACJd,QAAQe,WAAW,EACnBJ,oBAAQC,MAAM,EACdC,4BACAX,EAAAA,EACAH,MAAAA,CAAAA;AAEJ,QAAA,CAAA,CAAE,OAAOiB,KAAAA,EAAO;YACd,IAAIA,KAAAA,YAAiBT,YAAAA,CAAOU,aAAa,EAAE;gBACzC,MAAM,IAAIV,YAAAA,CAAOU,aAAa,CAACC,6BAAAA,CAAAA;AACjC,YAAA;YAEA,MAAMF,KAAAA;AACR,QAAA;QAEA,MAAMG,OAAAA,GAAU,MAAMC,gBAAAA,CAAW,QAAA,EAAUrB,QAAQsB,cAAc,CAACnB,IAAIR,QAAAA,EAAU;AAC9E4B,YAAAA,IAAAA,EAAMtB,QAAQsB;AAChB,SAAA,CAAA;AAEA,QAAA,MAAMC,UAAU,MAAMH,gBAAAA,CAAW,UAAUrB,MAAAA,CAAAA,CAAQyB,OAAO,CAACtB,EAAAA,EAAI;AAAC,YAAA;AAAS,SAAA,CAAA;AAEzE,QAAA,OAAOuB,UAAAA,CAAG;AAAEC,YAAAA,IAAAA,EAAMC,iCAAmBJ,OAAAA,IAAWJ,OAAAA;AAAS,SAAA,CAAA;AAC3D,IAAA,CAAA;AACF;AAEA;;;;;;;;;;IAWA,MAAMS,wBAAAA,GAA2B,OAAO7B,MAAAA,EAAqB8B,MAAAA,GAAAA;AAC3D,IAAA,IAAIA,WAAW,IAAA,EAAM;QACnB,OAAO,IAAA;AACT,IAAA;IAEA,MAAMC,WAAAA,GAAc,MAAM/B,MAAAA,CAAOgC,EAAE,CAACC,KAAK,CAACC,4BAAAA,CAAAA,CAAkBT,OAAO,CAAC;QAClEU,MAAAA,EAAQ;AAAC,YAAA,IAAA;AAAM,YAAA;AAAO,SAAA;QACtBC,KAAAA,EAAO;YAAEjC,EAAAA,EAAI2B;AAAO;AACtB,KAAA,CAAA;IAEA,IAAIC,WAAAA,KAAgB,IAAA,IAAQA,WAAAA,KAAgBjC,SAAAA,EAAW;QACrD,MAAM,IAAIU,YAAAA,CAAOC,eAAe,CAAC4B,+CAAAA,CAAAA;AACnC,IAAA;IAEA,OAAO;QAAElC,EAAAA,EAAImC,MAAAA,CAAOP,YAAY5B,EAAE,CAAA;QAAGoC,IAAAA,EAAMC,MAAAA,CAAOT,WAAAA,CAAYQ,IAAI,IAAI,EAAA;AAAI,KAAA;AAC5E,CAAA;AAEA;;;;;;;;;;;;;;;;;;AAkBC,IACM,MAAME,4BAAAA,GAA+B,CAC1CzC,MAAAA,EACAC,OAAAA,GAAAA;IAEAC,qCAAAA,CAAsBF,MAAAA,CAAAA;IAEtB,OAAO,OAAO,EACZN,IAAI,EAGL,GAAA;AACC,QAAA,MAAM,EAAEgD,GAAG,EAAEZ,MAAM,EAAE,GAAGpC,IAAAA;;AAGxBiB,QAAAA,iCAAAA,CAAsBX,MAAAA,EAAQC,OAAAA,EAASW,mBAAAA,CAAQC,MAAM,EAAEC,0BAAAA,CAAAA;QAEvD,MAAM6B,iBAAAA,GAAoB,MAAMd,wBAAAA,CAAyB7B,MAAAA,EAAQ8B,MAAAA,CAAAA;AAEjE,QAAA,MAAMc,QAAiD,EAAE;AACzD,QAAA,MAAMC,SAA2C,EAAE;;;AAInD,QAAA,KAAK,MAAM1C,EAAAA,IAAM,IAAI2C,GAAAA,CAAIJ,GAAAA,CAAAA,CAAM;YAC7B,IAAI;;;gBAGF,MAAM3B,2DAAAA,CACJd,QAAQe,WAAW,EACnBJ,oBAAQC,MAAM,EACdC,4BACAX,EAAAA,EACAH,MAAAA,CAAAA;gBAEF,MAAMwB,OAAAA,GAAU,MAAMH,gBAAAA,CAAW,QAAA,EAAUrB,QAAQsB,cAAc,CAC/DnB;;AAGA,gBAAA;AAAE2B,oBAAAA;iBAAO,EACT;AAAEP,oBAAAA,IAAAA,EAAMtB,QAAQsB;AAAK,iBAAA,CAAA;;;gBAKvBqB,KAAAA,CAAMG,IAAI,CAACnB,gCAAAA,CAAmB;AAAE,oBAAA,GAAGJ,OAAO;oBAAEM,MAAAA,EAAQa;AAAkB,iBAAA,CAAA,CAAA;AACxE,YAAA,CAAA,CAAE,OAAO1B,KAAAA,EAAO;gBACd,IAAIA,KAAAA,YAAiBT,YAAAA,CAAOU,aAAa,EAAE;AACzC2B,oBAAAA,MAAAA,CAAOE,IAAI,CAAC;AAAE5C,wBAAAA,EAAAA;wBAAI6C,MAAAA,EAAQC;AAA6B,qBAAA,CAAA;AACvD,oBAAA;AACF,gBAAA;gBAEA,IAAIhC,KAAAA,YAAiBT,YAAAA,CAAO0C,cAAc,EAAE;AAC1CL,oBAAAA,MAAAA,CAAOE,IAAI,CAAC;AAAE5C,wBAAAA,EAAAA;wBAAI6C,MAAAA,EAAQG;AAA6B,qBAAA,CAAA;AACvD,oBAAA;AACF,gBAAA;AAEA;;;;;;;;;;;;;YAcAN,MAAAA,CAAOE,IAAI,CAAC;AACV5C,oBAAAA,EAAAA;AACA6C,oBAAAA,MAAAA,EAAQI,oCAA0BnC,KAAAA,YAAiBoC,KAAAA,GAAQpC,KAAAA,CAAMqC,OAAO,GAAGd,MAAAA,CAAOvB,KAAAA,CAAAA;AACpF,iBAAA,CAAA;AACF,YAAA;AACF,QAAA;AAEA;;;;;;;;;;AAUC,QACD,OAAOS,UAAAA,CAAG;AAAEiB,YAAAA,iBAAAA;AAAmBC,YAAAA,KAAAA;AAAOC,YAAAA;AAAO,SAAA,CAAA;AAC/C,IAAA,CAAA;AACF;AAEA;;;;;;;;;;;;;;;;;;;;;;;;AAwBC,IACM,MAAMU,8BAAAA,GAAiC,CAC5CvD,MAAAA,EACAC,OAAAA,GAAAA;IAEAC,qCAAAA,CAAsBF,MAAAA,CAAAA;IAEtB,OAAO,OAAO,EACZN,IAAI,EAGL,GAAA;AACC,QAAA,MAAM,EAAEgD,GAAG,EAAEc,MAAAA,GAAS,IAAI,EAAE,GAAG9D,IAAAA;;;AAI/BiB,QAAAA,iCAAAA,CAAsBX,MAAAA,EAAQC,OAAAA,EAASW,mBAAAA,CAAQC,MAAM,EAAEC,0BAAAA,CAAAA;AAEvD,QAAA,MAAM2C,UAAmD,EAAE;AAC3D,QAAA,MAAMZ,SAA2C,EAAE;;;AAInD,QAAA,KAAK,MAAM1C,EAAAA,IAAM,IAAI2C,GAAAA,CAAIJ,GAAAA,CAAAA,CAAM;YAC7B,IAAIgB,IAAAA;YAEJ,IAAI;;;;AAID,gBAAA,CAAA,EAAEA,IAAI,EAAE,GAAG,MAAM3C,2DAAAA,CAChBd,OAAAA,CAAQe,WAAW,EACnBJ,mBAAAA,CAAQC,MAAM,EACdC,0BAAAA,EACAX,IACAH,MAAAA,CACF;AACF,YAAA,CAAA,CAAE,OAAOiB,KAAAA,EAAO;gBACd,IAAIA,KAAAA,YAAiBT,YAAAA,CAAOU,aAAa,EAAE;AACzC2B,oBAAAA,MAAAA,CAAOE,IAAI,CAAC;AAAE5C,wBAAAA,EAAAA;wBAAI6C,MAAAA,EAAQW;AAA+B,qBAAA,CAAA;AACzD,oBAAA;AACF,gBAAA;gBAEA,IAAI1C,KAAAA,YAAiBT,YAAAA,CAAO0C,cAAc,EAAE;AAC1CL,oBAAAA,MAAAA,CAAOE,IAAI,CAAC;AAAE5C,wBAAAA,EAAAA;wBAAI6C,MAAAA,EAAQY;AAA+B,qBAAA,CAAA;AACzD,oBAAA;AACF,gBAAA;AAEAf,gBAAAA,MAAAA,CAAOE,IAAI,CAAC;AACV5C,oBAAAA,EAAAA;AACA6C,oBAAAA,MAAAA,EAAQa,sCACN5C,KAAAA,YAAiBoC,KAAAA,GAAQpC,KAAAA,CAAMqC,OAAO,GAAGd,MAAAA,CAAOvB,KAAAA,CAAAA;AAEpD,iBAAA,CAAA;AACA,gBAAA;AACF,YAAA;;;AAIA,YAAA,IAAIuC,MAAAA,EAAQ;gBACVC,OAAAA,CAAQV,IAAI,CAACnB,gCAAAA,CAAmB8B,IAAAA,CAAAA,CAAAA;AAChC,gBAAA;AACF,YAAA;YAEA,IAAI;AACF,gBAAA,MAAMrC,gBAAAA,CAAW,QAAA,EAAUrB,MAAAA,CAAAA,CAAQ8D,MAAM,CAACJ,IAAAA,CAAAA;;;gBAI1CD,OAAAA,CAAQV,IAAI,CAACnB,gCAAAA,CAAmB8B,IAAAA,CAAAA,CAAAA;AAClC,YAAA,CAAA,CAAE,OAAOzC,KAAAA,EAAO;AACd;;;;;YAMA4B,MAAAA,CAAOE,IAAI,CAAC;AACV5C,oBAAAA,EAAAA;AACA6C,oBAAAA,MAAAA,EAAQa,sCACN5C,KAAAA,YAAiBoC,KAAAA,GAAQpC,KAAAA,CAAMqC,OAAO,GAAGd,MAAAA,CAAOvB,KAAAA,CAAAA;AAEpD,iBAAA,CAAA;AACF,YAAA;AACF,QAAA;AAEA;;;;;AAKC,QACD,OAAOS,UAAAA,CAAG;AAAE8B,YAAAA,MAAAA;AAAQC,YAAAA,OAAAA;AAASZ,YAAAA,MAAAA;AAAQkB,YAAAA,eAAAA,EAAiBN,QAAQlD;AAAO,SAAA,CAAA;AACvE,IAAA,CAAA;AACF;;;;;;"}
+{"version":3,"file":"write-handlers.js","sources":["../../../../server/src/mcp/handlers/write-handlers.ts"],"sourcesContent":["import { errors } from '@strapi/utils';\nimport type { Core, Modules } from '@strapi/types';\n\nimport { getService } from '../../utils';\nimport { ACTIONS, FILE_MODEL_UID, FOLDER_MODEL_UID } from '../../constants';\nimport { findEntityAndCheckPermissions } from '../../controllers/utils/find-entity-and-check-permissions';\nimport { assertMediaPermission } from '../permissions';\nimport { sanitizeMediaAsset } from '../sanitizers/sanitize-media';\nimport {\n  MCP_NOT_FOUND_ASSET,\n  MCP_UPDATE_ASSET_NO_FIELDS,\n  MCP_MOVE_ASSETS_DESTINATION_NOT_FOUND,\n  MCP_MOVE_ASSETS_ID_NOT_FOUND,\n  MCP_MOVE_ASSETS_ID_FORBIDDEN,\n  MCP_MOVE_ASSETS_ID_FAILED,\n  MCP_DELETE_ASSETS_ID_NOT_FOUND,\n  MCP_DELETE_ASSETS_ID_FORBIDDEN,\n  MCP_DELETE_ASSETS_ID_FAILED,\n} from './constants';\nimport { ok } from '../utils';\n\n// Type-level only: the MCP SDK validates `args` against the tool's strict Zod input schema\n// before the handler runs, so unknown keys never reach here.\ntype MediaUpdateAssetArgs = {\n  id: number;\n  name?: string;\n  alternativeText?: string | null;\n  caption?: string | null;\n};\n\ntype MediaMoveAssetsArgs = {\n  ids: number[];\n  folder: number | null;\n};\n\ntype MediaDeleteAssetsArgs = {\n  ids: number[];\n  dryRun?: boolean;\n};\n\n/** The metadata keys `media_update_asset` may write. Everything else is rejected by the schema. */\nconst WRITABLE_FIELDS = ['name', 'alternativeText', 'caption'] as const;\n\n/**\n * Picks the metadata the caller actually sent.\n *\n * `updateFileInfo` treats nil as \"keep the stored value\" (`_.isNil`), so an explicit\n * `alternativeText: null` cannot be forwarded as null — it would be read as \"unchanged\"\n * instead of \"clear it\". Clearing is expressed as an empty string, which is what the admin\n * panel writes when the field is emptied.\n */\nconst buildFileInfo = (args: MediaUpdateAssetArgs): Record<string, string> => {\n  const fileInfo: Record<string, string> = {};\n\n  for (const field of WRITABLE_FIELDS) {\n    const value = args[field];\n\n    if (value !== undefined) {\n      fileInfo[field] = value === null ? '' : value;\n    }\n  }\n\n  return fileInfo;\n};\n\n/**\n * `media_update_asset` — edits the writable metadata of one asset.\n *\n * Gated on `plugin::upload.assets.update` and mirrors `PUT /upload/files/:id`: the same\n * `findEntityAndCheckPermissions` row-level check, the same `updateFileInfo` service call, and\n * the same `updatedBy` attribution from the session user.\n *\n * The response carries the updated asset through the read sanitizer, so a client can confirm\n * the write without a second `media_get_asset` round-trip — and so provider fields stay\n * invisible on the write path too.\n */\nexport const createMediaUpdateAssetHandler =\n  (strapi: Core.Strapi, context: Modules.MCP.McpHandlerContext) =>\n  async ({\n    args,\n  }: {\n    args: Record<string, unknown>;\n  }): Promise<Modules.MCP.McpToolHandlerReturn> => {\n    const { id, ...metadata } = args as MediaUpdateAssetArgs;\n    const fileInfo = buildFileInfo(metadata as MediaUpdateAssetArgs);\n\n    // A patch with no writable field is a caller error, not a no-op success: the schema cannot\n    // express \"at least one of\" without becoming a ZodEffects the registry can't publish.\n    if (Object.keys(fileInfo).length === 0) {\n      throw new errors.ValidationError(MCP_UPDATE_ASSET_NO_FIELDS);\n    }\n\n    // Model-level gate first, so a token without the action is refused before any DB read.\n    // `findEntityAndCheckPermissions` only covers the row-level check.\n    assertMediaPermission(strapi, context, ACTIONS.update, FILE_MODEL_UID);\n\n    // Row-level check, shared with the admin controller: resolves the creator's roles so an\n    // owner-scoped permission condition is evaluated against the same subject the REST API\n    // would build, and throws Forbidden when a condition excludes this asset.\n    //\n    // Its NotFoundError carries no message, which would reach the agent as a bare \"Not Found\";\n    // rethrowing adds the same wording the read tools use.\n    try {\n      await findEntityAndCheckPermissions(\n        context.userAbility,\n        ACTIONS.update,\n        FILE_MODEL_UID,\n        id,\n        strapi\n      );\n    } catch (error) {\n      if (error instanceof errors.NotFoundError) {\n        throw new errors.NotFoundError(MCP_NOT_FOUND_ASSET);\n      }\n\n      throw error;\n    }\n\n    const written = await getService('upload', strapi).updateFileInfo(id, fileInfo, {\n      user: context.user,\n    });\n\n    const updated = await getService('upload', strapi).findOne(id, ['folder']);\n\n    return ok({ data: sanitizeMediaAsset(updated ?? written) });\n  };\n\n/**\n * Resolves the destination folder for `media_move_assets`, and rejects one that does not exist.\n *\n * `null` is the media library root and always valid. A named folder is looked up so a typo — or a\n * folder id passed where the agent meant an asset — is refused before anything is moved, matching\n * the `folder-exists` test the admin bulk-move validation applies to `destinationFolderId`.\n *\n * A bad destination is the one failure that rejects the whole call rather than being reported per\n * id: it is a property of the request, not of any single asset, so every id would fail for the\n * same reason and a per-id report would say nothing the agent could act on.\n */\nconst resolveDestinationFolder = async (strapi: Core.Strapi, folder: number | null) => {\n  if (folder === null) {\n    return null;\n  }\n\n  const destination = await strapi.db.query(FOLDER_MODEL_UID).findOne({\n    select: ['id', 'name'],\n    where: { id: folder },\n  });\n\n  if (destination === null || destination === undefined) {\n    throw new errors.ValidationError(MCP_MOVE_ASSETS_DESTINATION_NOT_FOUND);\n  }\n\n  return { id: Number(destination.id), name: String(destination.name ?? '') };\n};\n\n/**\n * `media_move_assets` — moves assets between folders in bulk.\n *\n * Bulk with a per-id report, rather than all-or-nothing: an agent reorganising a library moves\n * many assets at once, and one bad id among good ones must not discard the valid moves. Each\n * asset is moved on its own, so a failure is confined to its own id and the response says exactly\n * which ids to retry.\n *\n * That is why this does not reuse the admin `/actions/bulk-move` controller path, whose single\n * transaction is all-or-nothing by construction (and which also handles folders, out of scope\n * here). It goes through `updateFileInfo` instead — the same service `media_update_asset` and\n * `PUT /upload/files/:id` use — which sets the `folder` relation, recomputes the private\n * `folderPath`, attributes `updatedBy`, and emits `media.update` per asset. Replicating the\n * controller's raw join-table writes would skip all four.\n *\n * The moves are sequential on purpose. Each one writes the join table and `folderPath` for its\n * asset, and a bounded reorganisation (100 ids max, per the input schema) is not worth the\n * connection-pool contention of firing them in parallel.\n */\nexport const createMediaMoveAssetsHandler =\n  (strapi: Core.Strapi, context: Modules.MCP.McpHandlerContext) =>\n  async ({\n    args,\n  }: {\n    args: Record<string, unknown>;\n  }): Promise<Modules.MCP.McpToolHandlerReturn> => {\n    const { ids, folder } = args as MediaMoveAssetsArgs;\n\n    // Model-level gate first, so a token without the action is refused before any DB read.\n    assertMediaPermission(strapi, context, ACTIONS.update, FILE_MODEL_UID);\n\n    const destinationFolder = await resolveDestinationFolder(strapi, folder);\n\n    const moved: ReturnType<typeof sanitizeMediaAsset>[] = [];\n    const failed: { id: number; reason: string }[] = [];\n\n    // `ids` can repeat an id; de-duplicating keeps the report one entry per id rather than\n    // reporting the same asset twice for a request that moved it once.\n    for (const id of new Set(ids)) {\n      try {\n        // Row-level check, shared with the admin controller: an owner-scoped permission\n        // condition is evaluated against the same subject the REST API would build.\n        await findEntityAndCheckPermissions(\n          context.userAbility,\n          ACTIONS.update,\n          FILE_MODEL_UID,\n          id,\n          strapi\n        );\n        const updated = await getService('upload', strapi).updateFileInfo(\n          id,\n          // `updateFileInfo` reads `undefined` as \"keep the stored folder\" and null as the root,\n          // so the destination is forwarded as-is.\n          { folder },\n          { user: context.user }\n        );\n\n        // `updateFileInfo` resolves the row it wrote without the `folder` relation populated, so\n        // the destination is attached here instead of costing a read-back per asset.\n        moved.push(sanitizeMediaAsset({ ...updated, folder: destinationFolder }));\n      } catch (error) {\n        if (error instanceof errors.NotFoundError) {\n          failed.push({ id, reason: MCP_MOVE_ASSETS_ID_NOT_FOUND });\n          continue;\n        }\n\n        if (error instanceof errors.ForbiddenError) {\n          failed.push({ id, reason: MCP_MOVE_ASSETS_ID_FORBIDDEN });\n          continue;\n        }\n\n        /**\n         * Any other failure — a DB error, a provider fault — is reported against this id too,\n         * rather than thrown.\n         *\n         * Throwing here would be the one way to lose committed work silently: a tool error\n         * reaches the client as `{ content: [text], isError: true }` with NO\n         * `structuredContent` (see `tool-registry.ts`), so an error on the third id would\n         * discard the report saying the first two had already moved. The agent would be left\n         * unable to tell which ids to retry — exactly the recoverability this tool exists to\n         * provide.\n         *\n         * The message is carried through verbatim so the real fault is still legible, and the\n         * loop continues: one broken asset must not strand the rest of a reorganisation.\n         */\n        failed.push({\n          id,\n          reason: MCP_MOVE_ASSETS_ID_FAILED(error instanceof Error ? error.message : String(error)),\n        });\n      }\n    }\n\n    /**\n     * A request where nothing moved still returns the per-id report.\n     *\n     * `moved: []` alongside a populated `failed` is not ambiguous — it says plainly that nothing\n     * moved and why, per id. Throwing instead would drop `structuredContent` entirely (a tool\n     * error carries text only), so `ids: [999]` would get prose while `ids: [1, 999]` got a\n     * machine-readable entry, for the same class of mistake.\n     *\n     * The only failure that still rejects the whole call is an invalid destination folder, which\n     * is checked before the loop: nothing has moved, so there is no report to preserve.\n     */\n    return ok({ destinationFolder, moved, failed });\n  };\n\n/**\n * `media_delete_assets` — previews or performs the permanent deletion of assets, in bulk.\n *\n * Two branches behind one tool, for the same reason as `media_delete_folder`: the preview and the\n * deletion must agree on what would be destroyed, and splitting them across tools would both let\n * the two drift apart and let an agent reach the destructive one without ever seeing a preview.\n * `dryRun` defaults to true (see the input schema), so omitting the flag previews and deleting\n * takes an explicit `dryRun: false`.\n *\n * Per-id, not all-or-nothing — the opposite of `media_delete_folder`, on purpose. A folder delete\n * cascades, so a mixed id list there is refused outright rather than half-applied over an unknown\n * amount of content. Here each id is exactly one asset, the blast radius of a bad one is nil, and\n * the requirement is explicit: a bad id among good ones must not discard the valid deletions.\n * The dry run reports the same per-id split, so an agent sees which ids will not resolve *before*\n * anything is destroyed rather than after.\n *\n * This does not reuse `file.deleteByIds` (the admin `/actions/bulk-delete` path). That helper\n * fires `upload.remove` under a single `Promise.all`, so the first rejection discards the report\n * of everything already deleted — unrecoverable for an operation with no undo. The removals are\n * driven one at a time here instead, through the same `upload.remove` service, which deletes the\n * provider file and every generated format, emits `media.delete`, and then deletes the row.\n *\n * The deletions are sequential on purpose: each one performs provider I/O, and a bounded batch\n * (100 ids max, per the input schema) is not worth firing at a provider in parallel.\n */\nexport const createMediaDeleteAssetsHandler =\n  (strapi: Core.Strapi, context: Modules.MCP.McpHandlerContext) =>\n  async ({\n    args,\n  }: {\n    args: Record<string, unknown>;\n  }): Promise<Modules.MCP.McpToolHandlerReturn> => {\n    const { ids, dryRun = true } = args as MediaDeleteAssetsArgs;\n\n    // Model-level gate first, so a token without the action is refused before any DB read.\n    // The preview takes the same gate: it reveals which assets exist and what they are.\n    assertMediaPermission(strapi, context, ACTIONS.update, FILE_MODEL_UID);\n\n    const deleted: ReturnType<typeof sanitizeMediaAsset>[] = [];\n    const failed: { id: number; reason: string }[] = [];\n\n    // `ids` can repeat an id; de-duplicating keeps the report one entry per id, and stops the\n    // second occurrence of an already-deleted asset from being reported as a missing one.\n    for (const id of new Set(ids)) {\n      let file;\n\n      try {\n        // Row-level check, shared with the admin controller: an owner-scoped permission\n        // condition is evaluated against the same subject the REST API would build. Run on the\n        // dry run too — a preview must not list an asset the executing call would refuse.\n        ({ file } = await findEntityAndCheckPermissions(\n          context.userAbility,\n          ACTIONS.update,\n          FILE_MODEL_UID,\n          id,\n          strapi\n        ));\n      } catch (error) {\n        if (error instanceof errors.NotFoundError) {\n          failed.push({ id, reason: MCP_DELETE_ASSETS_ID_NOT_FOUND });\n          continue;\n        }\n\n        if (error instanceof errors.ForbiddenError) {\n          failed.push({ id, reason: MCP_DELETE_ASSETS_ID_FORBIDDEN });\n          continue;\n        }\n\n        failed.push({\n          id,\n          reason: MCP_DELETE_ASSETS_ID_FAILED(\n            error instanceof Error ? error.message : String(error)\n          ),\n        });\n        continue;\n      }\n\n      // The preview stops here: the asset resolved and this token may delete it, which is\n      // everything the agent needs to confirm — reported in the same shape the real run uses.\n      if (dryRun) {\n        deleted.push(sanitizeMediaAsset(file));\n        continue;\n      }\n\n      try {\n        await getService('upload', strapi).remove(file);\n\n        // Reported from the row read before the delete: the asset no longer exists, so this is\n        // the only description of it the agent will ever get.\n        deleted.push(sanitizeMediaAsset(file));\n      } catch (error) {\n        /**\n         * A failed removal is reported against its own id rather than thrown, for the reason\n         * spelled out on `media_move_assets` — a tool error carries no `structuredContent`, so throwing\n         * on the third id would discard the report saying the first two are gone. Here that\n         * matters more: the earlier deletions cannot be re-read, undone or discovered afterwards.\n         */\n        failed.push({\n          id,\n          reason: MCP_DELETE_ASSETS_ID_FAILED(\n            error instanceof Error ? error.message : String(error)\n          ),\n        });\n      }\n    }\n\n    /**\n     * A request where nothing was deleted still returns the per-id report, on both branches:\n     * `deleted: []` with every id in `failed` says plainly that nothing happened and why, per id.\n     * Throwing instead would drop `structuredContent` entirely, so `ids: [999]` would get prose\n     * where `ids: [1, 999]` gets a machine-readable entry, for the same class of mistake.\n     */\n    return ok({ dryRun, deleted, failed, totalFileNumber: deleted.length });\n  };\n"],"names":["WRITABLE_FIELDS","buildFileInfo","args","fileInfo","field","value","undefined","createMediaUpdateAssetHandler","strapi","context","id","metadata","Object","keys","length","errors","ValidationError","MCP_UPDATE_ASSET_NO_FIELDS","assertMediaPermission","ACTIONS","update","FILE_MODEL_UID","findEntityAndCheckPermissions","userAbility","error","NotFoundError","MCP_NOT_FOUND_ASSET","written","getService","updateFileInfo","user","updated","findOne","ok","data","sanitizeMediaAsset","resolveDestinationFolder","folder","destination","db","query","FOLDER_MODEL_UID","select","where","MCP_MOVE_ASSETS_DESTINATION_NOT_FOUND","Number","name","String","createMediaMoveAssetsHandler","ids","destinationFolder","moved","failed","Set","push","reason","MCP_MOVE_ASSETS_ID_NOT_FOUND","ForbiddenError","MCP_MOVE_ASSETS_ID_FORBIDDEN","MCP_MOVE_ASSETS_ID_FAILED","Error","message","createMediaDeleteAssetsHandler","dryRun","deleted","file","MCP_DELETE_ASSETS_ID_NOT_FOUND","MCP_DELETE_ASSETS_ID_FORBIDDEN","MCP_DELETE_ASSETS_ID_FAILED","remove","totalFileNumber"],"mappings":";;;;;;;;;;;AAwCA,oGACA,MAAMA,eAAAA,GAAkB;AAAC,IAAA,MAAA;AAAQ,IAAA,iBAAA;AAAmB,IAAA;AAAU,CAAA;AAE9D;;;;;;;IAQA,MAAMC,gBAAgB,CAACC,IAAAA,GAAAA;AACrB,IAAA,MAAMC,WAAmC,EAAC;IAE1C,KAAK,MAAMC,SAASJ,eAAAA,CAAiB;QACnC,MAAMK,KAAAA,GAAQH,IAAI,CAACE,KAAAA,CAAM;AAEzB,QAAA,IAAIC,UAAUC,SAAAA,EAAW;AACvBH,YAAAA,QAAQ,CAACC,KAAAA,CAAM,GAAGC,KAAAA,KAAU,OAAO,EAAA,GAAKA,KAAAA;AAC1C,QAAA;AACF,IAAA;IAEA,OAAOF,QAAAA;AACT,CAAA;AAEA;;;;;;;;;;UAWaI,6BAAAA,GACX,CAACC,QAAqBC,OAAAA,GACtB,OAAO,EACLP,IAAI,EAGL,GAAA;AACC,QAAA,MAAM,EAAEQ,EAAE,EAAE,GAAGC,UAAU,GAAGT,IAAAA;AAC5B,QAAA,MAAMC,WAAWF,aAAAA,CAAcU,QAAAA,CAAAA;;;AAI/B,QAAA,IAAIC,OAAOC,IAAI,CAACV,QAAAA,CAAAA,CAAUW,MAAM,KAAK,CAAA,EAAG;YACtC,MAAM,IAAIC,YAAAA,CAAOC,eAAe,CAACC,oCAAAA,CAAAA;AACnC,QAAA;;;AAIAC,QAAAA,iCAAAA,CAAsBV,MAAAA,EAAQC,OAAAA,EAASU,mBAAAA,CAAQC,MAAM,EAAEC,0BAAAA,CAAAA;;;;;;;QAQvD,IAAI;YACF,MAAMC,2DAAAA,CACJb,QAAQc,WAAW,EACnBJ,oBAAQC,MAAM,EACdC,4BACAX,EAAAA,EACAF,MAAAA,CAAAA;AAEJ,QAAA,CAAA,CAAE,OAAOgB,KAAAA,EAAO;YACd,IAAIA,KAAAA,YAAiBT,YAAAA,CAAOU,aAAa,EAAE;gBACzC,MAAM,IAAIV,YAAAA,CAAOU,aAAa,CAACC,6BAAAA,CAAAA;AACjC,YAAA;YAEA,MAAMF,KAAAA;AACR,QAAA;QAEA,MAAMG,OAAAA,GAAU,MAAMC,gBAAAA,CAAW,QAAA,EAAUpB,QAAQqB,cAAc,CAACnB,IAAIP,QAAAA,EAAU;AAC9E2B,YAAAA,IAAAA,EAAMrB,QAAQqB;AAChB,SAAA,CAAA;AAEA,QAAA,MAAMC,UAAU,MAAMH,gBAAAA,CAAW,UAAUpB,MAAAA,CAAAA,CAAQwB,OAAO,CAACtB,EAAAA,EAAI;AAAC,YAAA;AAAS,SAAA,CAAA;AAEzE,QAAA,OAAOuB,UAAAA,CAAG;AAAEC,YAAAA,IAAAA,EAAMC,iCAAmBJ,OAAAA,IAAWJ,OAAAA;AAAS,SAAA,CAAA;IAC3D;AAEF;;;;;;;;;;IAWA,MAAMS,wBAAAA,GAA2B,OAAO5B,MAAAA,EAAqB6B,MAAAA,GAAAA;AAC3D,IAAA,IAAIA,WAAW,IAAA,EAAM;QACnB,OAAO,IAAA;AACT,IAAA;IAEA,MAAMC,WAAAA,GAAc,MAAM9B,MAAAA,CAAO+B,EAAE,CAACC,KAAK,CAACC,4BAAAA,CAAAA,CAAkBT,OAAO,CAAC;QAClEU,MAAAA,EAAQ;AAAC,YAAA,IAAA;AAAM,YAAA;AAAO,SAAA;QACtBC,KAAAA,EAAO;YAAEjC,EAAAA,EAAI2B;AAAO;AACtB,KAAA,CAAA;IAEA,IAAIC,WAAAA,KAAgB,IAAA,IAAQA,WAAAA,KAAgBhC,SAAAA,EAAW;QACrD,MAAM,IAAIS,YAAAA,CAAOC,eAAe,CAAC4B,+CAAAA,CAAAA;AACnC,IAAA;IAEA,OAAO;QAAElC,EAAAA,EAAImC,MAAAA,CAAOP,YAAY5B,EAAE,CAAA;QAAGoC,IAAAA,EAAMC,MAAAA,CAAOT,WAAAA,CAAYQ,IAAI,IAAI,EAAA;AAAI,KAAA;AAC5E,CAAA;AAEA;;;;;;;;;;;;;;;;;;UAmBaE,4BAAAA,GACX,CAACxC,QAAqBC,OAAAA,GACtB,OAAO,EACLP,IAAI,EAGL,GAAA;AACC,QAAA,MAAM,EAAE+C,GAAG,EAAEZ,MAAM,EAAE,GAAGnC,IAAAA;;AAGxBgB,QAAAA,iCAAAA,CAAsBV,MAAAA,EAAQC,OAAAA,EAASU,mBAAAA,CAAQC,MAAM,EAAEC,0BAAAA,CAAAA;QAEvD,MAAM6B,iBAAAA,GAAoB,MAAMd,wBAAAA,CAAyB5B,MAAAA,EAAQ6B,MAAAA,CAAAA;AAEjE,QAAA,MAAMc,QAAiD,EAAE;AACzD,QAAA,MAAMC,SAA2C,EAAE;;;AAInD,QAAA,KAAK,MAAM1C,EAAAA,IAAM,IAAI2C,GAAAA,CAAIJ,GAAAA,CAAAA,CAAM;YAC7B,IAAI;;;gBAGF,MAAM3B,2DAAAA,CACJb,QAAQc,WAAW,EACnBJ,oBAAQC,MAAM,EACdC,4BACAX,EAAAA,EACAF,MAAAA,CAAAA;gBAEF,MAAMuB,OAAAA,GAAU,MAAMH,gBAAAA,CAAW,QAAA,EAAUpB,QAAQqB,cAAc,CAC/DnB;;AAGA,gBAAA;AAAE2B,oBAAAA;iBAAO,EACT;AAAEP,oBAAAA,IAAAA,EAAMrB,QAAQqB;AAAK,iBAAA,CAAA;;;gBAKvBqB,KAAAA,CAAMG,IAAI,CAACnB,gCAAAA,CAAmB;AAAE,oBAAA,GAAGJ,OAAO;oBAAEM,MAAAA,EAAQa;AAAkB,iBAAA,CAAA,CAAA;AACxE,YAAA,CAAA,CAAE,OAAO1B,KAAAA,EAAO;gBACd,IAAIA,KAAAA,YAAiBT,YAAAA,CAAOU,aAAa,EAAE;AACzC2B,oBAAAA,MAAAA,CAAOE,IAAI,CAAC;AAAE5C,wBAAAA,EAAAA;wBAAI6C,MAAAA,EAAQC;AAA6B,qBAAA,CAAA;AACvD,oBAAA;AACF,gBAAA;gBAEA,IAAIhC,KAAAA,YAAiBT,YAAAA,CAAO0C,cAAc,EAAE;AAC1CL,oBAAAA,MAAAA,CAAOE,IAAI,CAAC;AAAE5C,wBAAAA,EAAAA;wBAAI6C,MAAAA,EAAQG;AAA6B,qBAAA,CAAA;AACvD,oBAAA;AACF,gBAAA;AAEA;;;;;;;;;;;;;YAcAN,MAAAA,CAAOE,IAAI,CAAC;AACV5C,oBAAAA,EAAAA;AACA6C,oBAAAA,MAAAA,EAAQI,oCAA0BnC,KAAAA,YAAiBoC,KAAAA,GAAQpC,KAAAA,CAAMqC,OAAO,GAAGd,MAAAA,CAAOvB,KAAAA,CAAAA;AACpF,iBAAA,CAAA;AACF,YAAA;AACF,QAAA;AAEA;;;;;;;;;;AAUC,QACD,OAAOS,UAAAA,CAAG;AAAEiB,YAAAA,iBAAAA;AAAmBC,YAAAA,KAAAA;AAAOC,YAAAA;AAAO,SAAA,CAAA;IAC/C;AAEF;;;;;;;;;;;;;;;;;;;;;;;;UAyBaU,8BAAAA,GACX,CAACtD,QAAqBC,OAAAA,GACtB,OAAO,EACLP,IAAI,EAGL,GAAA;AACC,QAAA,MAAM,EAAE+C,GAAG,EAAEc,MAAAA,GAAS,IAAI,EAAE,GAAG7D,IAAAA;;;AAI/BgB,QAAAA,iCAAAA,CAAsBV,MAAAA,EAAQC,OAAAA,EAASU,mBAAAA,CAAQC,MAAM,EAAEC,0BAAAA,CAAAA;AAEvD,QAAA,MAAM2C,UAAmD,EAAE;AAC3D,QAAA,MAAMZ,SAA2C,EAAE;;;AAInD,QAAA,KAAK,MAAM1C,EAAAA,IAAM,IAAI2C,GAAAA,CAAIJ,GAAAA,CAAAA,CAAM;YAC7B,IAAIgB,IAAAA;YAEJ,IAAI;;;;AAID,gBAAA,CAAA,EAAEA,IAAI,EAAE,GAAG,MAAM3C,2DAAAA,CAChBb,OAAAA,CAAQc,WAAW,EACnBJ,mBAAAA,CAAQC,MAAM,EACdC,0BAAAA,EACAX,IACAF,MAAAA,CACF;AACF,YAAA,CAAA,CAAE,OAAOgB,KAAAA,EAAO;gBACd,IAAIA,KAAAA,YAAiBT,YAAAA,CAAOU,aAAa,EAAE;AACzC2B,oBAAAA,MAAAA,CAAOE,IAAI,CAAC;AAAE5C,wBAAAA,EAAAA;wBAAI6C,MAAAA,EAAQW;AAA+B,qBAAA,CAAA;AACzD,oBAAA;AACF,gBAAA;gBAEA,IAAI1C,KAAAA,YAAiBT,YAAAA,CAAO0C,cAAc,EAAE;AAC1CL,oBAAAA,MAAAA,CAAOE,IAAI,CAAC;AAAE5C,wBAAAA,EAAAA;wBAAI6C,MAAAA,EAAQY;AAA+B,qBAAA,CAAA;AACzD,oBAAA;AACF,gBAAA;AAEAf,gBAAAA,MAAAA,CAAOE,IAAI,CAAC;AACV5C,oBAAAA,EAAAA;AACA6C,oBAAAA,MAAAA,EAAQa,sCACN5C,KAAAA,YAAiBoC,KAAAA,GAAQpC,KAAAA,CAAMqC,OAAO,GAAGd,MAAAA,CAAOvB,KAAAA,CAAAA;AAEpD,iBAAA,CAAA;AACA,gBAAA;AACF,YAAA;;;AAIA,YAAA,IAAIuC,MAAAA,EAAQ;gBACVC,OAAAA,CAAQV,IAAI,CAACnB,gCAAAA,CAAmB8B,IAAAA,CAAAA,CAAAA;AAChC,gBAAA;AACF,YAAA;YAEA,IAAI;AACF,gBAAA,MAAMrC,gBAAAA,CAAW,QAAA,EAAUpB,MAAAA,CAAAA,CAAQ6D,MAAM,CAACJ,IAAAA,CAAAA;;;gBAI1CD,OAAAA,CAAQV,IAAI,CAACnB,gCAAAA,CAAmB8B,IAAAA,CAAAA,CAAAA;AAClC,YAAA,CAAA,CAAE,OAAOzC,KAAAA,EAAO;AACd;;;;;YAMA4B,MAAAA,CAAOE,IAAI,CAAC;AACV5C,oBAAAA,EAAAA;AACA6C,oBAAAA,MAAAA,EAAQa,sCACN5C,KAAAA,YAAiBoC,KAAAA,GAAQpC,KAAAA,CAAMqC,OAAO,GAAGd,MAAAA,CAAOvB,KAAAA,CAAAA;AAEpD,iBAAA,CAAA;AACF,YAAA;AACF,QAAA;AAEA;;;;;AAKC,QACD,OAAOS,UAAAA,CAAG;AAAE8B,YAAAA,MAAAA;AAAQC,YAAAA,OAAAA;AAASZ,YAAAA,MAAAA;AAAQkB,YAAAA,eAAAA,EAAiBN,QAAQlD;AAAO,SAAA,CAAA;IACvE;;;;;;"}

package/dist/server/mcp/handlers/write-handlers.mjs

@@ -2,7 +2,6 @@ import { errors } from '@strapi/utils';
 import { getService } from '../../utils/index.mjs';
 import { ACTIONS, FILE_MODEL_UID, FOLDER_MODEL_UID } from '../../constants.mjs';
 import { findEntityAndCheckPermissions } from '../../controllers/utils/find-entity-and-check-permissions.mjs';
-import { assertAmbientInstance } from '../ambient-instance.mjs';
 import { assertMediaPermission } from '../permissions.mjs';
 import { sanitizeMediaAsset } from '../sanitizers/sanitize-media.mjs';
 import { MCP_UPDATE_ASSET_NO_FIELDS, MCP_NOT_FOUND_ASSET, MCP_MOVE_ASSETS_ID_FAILED, MCP_DELETE_ASSETS_ID_FAILED, MCP_MOVE_ASSETS_DESTINATION_NOT_FOUND, MCP_MOVE_ASSETS_ID_NOT_FOUND, MCP_MOVE_ASSETS_ID_FORBIDDEN, MCP_DELETE_ASSETS_ID_NOT_FOUND, MCP_DELETE_ASSETS_ID_FORBIDDEN } from './constants.mjs';
@@ -40,9 +39,7 @@ import { ok } from '../utils.mjs';
  * The response carries the updated asset through the read sanitizer, so a client can confirm
  * the write without a second `media_get_asset` round-trip — and so provider fields stay
  * invisible on the write path too.
- */ const createMediaUpdateAssetHandler = (strapi, context)=>{
-    assertAmbientInstance(strapi);
-    return async ({ args })=>{
+ */ const createMediaUpdateAssetHandler = (strapi, context)=>async ({ args })=>{
         const { id, ...metadata } = args;
         const fileInfo = buildFileInfo(metadata);
         // A patch with no writable field is a caller error, not a no-op success: the schema cannot
@@ -77,7 +74,6 @@ import { ok } from '../utils.mjs';
             data: sanitizeMediaAsset(updated ?? written)
         });
     };
-};
 /**
  * Resolves the destination folder for `media_move_assets`, and rejects one that does not exist.
  *
@@ -127,9 +123,7 @@ import { ok } from '../utils.mjs';
  * The moves are sequential on purpose. Each one writes the join table and `folderPath` for its
  * asset, and a bounded reorganisation (100 ids max, per the input schema) is not worth the
  * connection-pool contention of firing them in parallel.
- */ const createMediaMoveAssetsHandler = (strapi, context)=>{
-    assertAmbientInstance(strapi);
-    return async ({ args })=>{
+ */ const createMediaMoveAssetsHandler = (strapi, context)=>async ({ args })=>{
         const { ids, folder } = args;
         // Model-level gate first, so a token without the action is refused before any DB read.
         assertMediaPermission(strapi, context, ACTIONS.update, FILE_MODEL_UID);
@@ -206,7 +200,6 @@ import { ok } from '../utils.mjs';
             failed
         });
     };
-};
 /**
  * `media_delete_assets` — previews or performs the permanent deletion of assets, in bulk.
  *
@@ -231,9 +224,7 @@ import { ok } from '../utils.mjs';
  *
  * The deletions are sequential on purpose: each one performs provider I/O, and a bounded batch
  * (100 ids max, per the input schema) is not worth firing at a provider in parallel.
- */ const createMediaDeleteAssetsHandler = (strapi, context)=>{
-    assertAmbientInstance(strapi);
-    return async ({ args })=>{
+ */ const createMediaDeleteAssetsHandler = (strapi, context)=>async ({ args })=>{
         const { ids, dryRun = true } = args;
         // Model-level gate first, so a token without the action is refused before any DB read.
         // The preview takes the same gate: it reveals which assets exist and what they are.
@@ -305,7 +296,6 @@ import { ok } from '../utils.mjs';
             totalFileNumber: deleted.length
         });
     };
-};
 
 export { createMediaDeleteAssetsHandler, createMediaMoveAssetsHandler, createMediaUpdateAssetHandler };
 //# sourceMappingURL=write-handlers.mjs.map

package/dist/server/mcp/handlers/write-handlers.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"write-handlers.mjs","sources":["../../../../server/src/mcp/handlers/write-handlers.ts"],"sourcesContent":["import { errors } from '@strapi/utils';\nimport type { Core, Modules } from '@strapi/types';\n\nimport { getService } from '../../utils';\nimport { ACTIONS, FILE_MODEL_UID, FOLDER_MODEL_UID } from '../../constants';\nimport { findEntityAndCheckPermissions } from '../../controllers/utils/find-entity-and-check-permissions';\nimport { assertAmbientInstance } from '../ambient-instance';\nimport { assertMediaPermission } from '../permissions';\nimport { sanitizeMediaAsset } from '../sanitizers/sanitize-media';\nimport {\n  MCP_NOT_FOUND_ASSET,\n  MCP_UPDATE_ASSET_NO_FIELDS,\n  MCP_MOVE_ASSETS_DESTINATION_NOT_FOUND,\n  MCP_MOVE_ASSETS_ID_NOT_FOUND,\n  MCP_MOVE_ASSETS_ID_FORBIDDEN,\n  MCP_MOVE_ASSETS_ID_FAILED,\n  MCP_DELETE_ASSETS_ID_NOT_FOUND,\n  MCP_DELETE_ASSETS_ID_FORBIDDEN,\n  MCP_DELETE_ASSETS_ID_FAILED,\n} from './constants';\nimport { ok } from '../utils';\n\n// Type-level only: the MCP SDK validates `args` against the tool's strict Zod input schema\n// before the handler runs, so unknown keys never reach here.\ntype MediaUpdateAssetArgs = {\n  id: number;\n  name?: string;\n  alternativeText?: string | null;\n  caption?: string | null;\n};\n\ntype MediaMoveAssetsArgs = {\n  ids: number[];\n  folder: number | null;\n};\n\ntype MediaDeleteAssetsArgs = {\n  ids: number[];\n  dryRun?: boolean;\n};\n\n/** The metadata keys `media_update_asset` may write. Everything else is rejected by the schema. */\nconst WRITABLE_FIELDS = ['name', 'alternativeText', 'caption'] as const;\n\n/**\n * Picks the metadata the caller actually sent.\n *\n * `updateFileInfo` treats nil as \"keep the stored value\" (`_.isNil`), so an explicit\n * `alternativeText: null` cannot be forwarded as null — it would be read as \"unchanged\"\n * instead of \"clear it\". Clearing is expressed as an empty string, which is what the admin\n * panel writes when the field is emptied.\n */\nconst buildFileInfo = (args: MediaUpdateAssetArgs): Record<string, string> => {\n  const fileInfo: Record<string, string> = {};\n\n  for (const field of WRITABLE_FIELDS) {\n    const value = args[field];\n\n    if (value !== undefined) {\n      fileInfo[field] = value === null ? '' : value;\n    }\n  }\n\n  return fileInfo;\n};\n\n/**\n * `media_update_asset` — edits the writable metadata of one asset.\n *\n * Gated on `plugin::upload.assets.update` and mirrors `PUT /upload/files/:id`: the same\n * `findEntityAndCheckPermissions` row-level check, the same `updateFileInfo` service call, and\n * the same `updatedBy` attribution from the session user.\n *\n * The response carries the updated asset through the read sanitizer, so a client can confirm\n * the write without a second `media_get_asset` round-trip — and so provider fields stay\n * invisible on the write path too.\n */\nexport const createMediaUpdateAssetHandler = (\n  strapi: Core.Strapi,\n  context: Modules.MCP.McpHandlerContext\n) => {\n  assertAmbientInstance(strapi);\n\n  return async ({\n    args,\n  }: {\n    args: Record<string, unknown>;\n  }): Promise<Modules.MCP.McpToolHandlerReturn> => {\n    const { id, ...metadata } = args as MediaUpdateAssetArgs;\n    const fileInfo = buildFileInfo(metadata as MediaUpdateAssetArgs);\n\n    // A patch with no writable field is a caller error, not a no-op success: the schema cannot\n    // express \"at least one of\" without becoming a ZodEffects the registry can't publish.\n    if (Object.keys(fileInfo).length === 0) {\n      throw new errors.ValidationError(MCP_UPDATE_ASSET_NO_FIELDS);\n    }\n\n    // Model-level gate first, so a token without the action is refused before any DB read.\n    // `findEntityAndCheckPermissions` only covers the row-level check.\n    assertMediaPermission(strapi, context, ACTIONS.update, FILE_MODEL_UID);\n\n    // Row-level check, shared with the admin controller: resolves the creator's roles so an\n    // owner-scoped permission condition is evaluated against the same subject the REST API\n    // would build, and throws Forbidden when a condition excludes this asset.\n    //\n    // Its NotFoundError carries no message, which would reach the agent as a bare \"Not Found\";\n    // rethrowing adds the same wording the read tools use.\n    try {\n      await findEntityAndCheckPermissions(\n        context.userAbility,\n        ACTIONS.update,\n        FILE_MODEL_UID,\n        id,\n        strapi\n      );\n    } catch (error) {\n      if (error instanceof errors.NotFoundError) {\n        throw new errors.NotFoundError(MCP_NOT_FOUND_ASSET);\n      }\n\n      throw error;\n    }\n\n    const written = await getService('upload', strapi).updateFileInfo(id, fileInfo, {\n      user: context.user,\n    });\n\n    const updated = await getService('upload', strapi).findOne(id, ['folder']);\n\n    return ok({ data: sanitizeMediaAsset(updated ?? written) });\n  };\n};\n\n/**\n * Resolves the destination folder for `media_move_assets`, and rejects one that does not exist.\n *\n * `null` is the media library root and always valid. A named folder is looked up so a typo — or a\n * folder id passed where the agent meant an asset — is refused before anything is moved, matching\n * the `folder-exists` test the admin bulk-move validation applies to `destinationFolderId`.\n *\n * A bad destination is the one failure that rejects the whole call rather than being reported per\n * id: it is a property of the request, not of any single asset, so every id would fail for the\n * same reason and a per-id report would say nothing the agent could act on.\n */\nconst resolveDestinationFolder = async (strapi: Core.Strapi, folder: number | null) => {\n  if (folder === null) {\n    return null;\n  }\n\n  const destination = await strapi.db.query(FOLDER_MODEL_UID).findOne({\n    select: ['id', 'name'],\n    where: { id: folder },\n  });\n\n  if (destination === null || destination === undefined) {\n    throw new errors.ValidationError(MCP_MOVE_ASSETS_DESTINATION_NOT_FOUND);\n  }\n\n  return { id: Number(destination.id), name: String(destination.name ?? '') };\n};\n\n/**\n * `media_move_assets` — moves assets between folders in bulk.\n *\n * Bulk with a per-id report, rather than all-or-nothing: an agent reorganising a library moves\n * many assets at once, and one bad id among good ones must not discard the valid moves. Each\n * asset is moved on its own, so a failure is confined to its own id and the response says exactly\n * which ids to retry.\n *\n * That is why this does not reuse the admin `/actions/bulk-move` controller path, whose single\n * transaction is all-or-nothing by construction (and which also handles folders, out of scope\n * here). It goes through `updateFileInfo` instead — the same service `media_update_asset` and\n * `PUT /upload/files/:id` use — which sets the `folder` relation, recomputes the private\n * `folderPath`, attributes `updatedBy`, and emits `media.update` per asset. Replicating the\n * controller's raw join-table writes would skip all four.\n *\n * The moves are sequential on purpose. Each one writes the join table and `folderPath` for its\n * asset, and a bounded reorganisation (100 ids max, per the input schema) is not worth the\n * connection-pool contention of firing them in parallel.\n */\nexport const createMediaMoveAssetsHandler = (\n  strapi: Core.Strapi,\n  context: Modules.MCP.McpHandlerContext\n) => {\n  assertAmbientInstance(strapi);\n\n  return async ({\n    args,\n  }: {\n    args: Record<string, unknown>;\n  }): Promise<Modules.MCP.McpToolHandlerReturn> => {\n    const { ids, folder } = args as MediaMoveAssetsArgs;\n\n    // Model-level gate first, so a token without the action is refused before any DB read.\n    assertMediaPermission(strapi, context, ACTIONS.update, FILE_MODEL_UID);\n\n    const destinationFolder = await resolveDestinationFolder(strapi, folder);\n\n    const moved: ReturnType<typeof sanitizeMediaAsset>[] = [];\n    const failed: { id: number; reason: string }[] = [];\n\n    // `ids` can repeat an id; de-duplicating keeps the report one entry per id rather than\n    // reporting the same asset twice for a request that moved it once.\n    for (const id of new Set(ids)) {\n      try {\n        // Row-level check, shared with the admin controller: an owner-scoped permission\n        // condition is evaluated against the same subject the REST API would build.\n        await findEntityAndCheckPermissions(\n          context.userAbility,\n          ACTIONS.update,\n          FILE_MODEL_UID,\n          id,\n          strapi\n        );\n        const updated = await getService('upload', strapi).updateFileInfo(\n          id,\n          // `updateFileInfo` reads `undefined` as \"keep the stored folder\" and null as the root,\n          // so the destination is forwarded as-is.\n          { folder },\n          { user: context.user }\n        );\n\n        // `updateFileInfo` resolves the row it wrote without the `folder` relation populated, so\n        // the destination is attached here instead of costing a read-back per asset.\n        moved.push(sanitizeMediaAsset({ ...updated, folder: destinationFolder }));\n      } catch (error) {\n        if (error instanceof errors.NotFoundError) {\n          failed.push({ id, reason: MCP_MOVE_ASSETS_ID_NOT_FOUND });\n          continue;\n        }\n\n        if (error instanceof errors.ForbiddenError) {\n          failed.push({ id, reason: MCP_MOVE_ASSETS_ID_FORBIDDEN });\n          continue;\n        }\n\n        /**\n         * Any other failure — a DB error, a provider fault — is reported against this id too,\n         * rather than thrown.\n         *\n         * Throwing here would be the one way to lose committed work silently: a tool error\n         * reaches the client as `{ content: [text], isError: true }` with NO\n         * `structuredContent` (see `tool-registry.ts`), so an error on the third id would\n         * discard the report saying the first two had already moved. The agent would be left\n         * unable to tell which ids to retry — exactly the recoverability this tool exists to\n         * provide.\n         *\n         * The message is carried through verbatim so the real fault is still legible, and the\n         * loop continues: one broken asset must not strand the rest of a reorganisation.\n         */\n        failed.push({\n          id,\n          reason: MCP_MOVE_ASSETS_ID_FAILED(error instanceof Error ? error.message : String(error)),\n        });\n      }\n    }\n\n    /**\n     * A request where nothing moved still returns the per-id report.\n     *\n     * `moved: []` alongside a populated `failed` is not ambiguous — it says plainly that nothing\n     * moved and why, per id. Throwing instead would drop `structuredContent` entirely (a tool\n     * error carries text only), so `ids: [999]` would get prose while `ids: [1, 999]` got a\n     * machine-readable entry, for the same class of mistake.\n     *\n     * The only failure that still rejects the whole call is an invalid destination folder, which\n     * is checked before the loop: nothing has moved, so there is no report to preserve.\n     */\n    return ok({ destinationFolder, moved, failed });\n  };\n};\n\n/**\n * `media_delete_assets` — previews or performs the permanent deletion of assets, in bulk.\n *\n * Two branches behind one tool, for the same reason as `media_delete_folder`: the preview and the\n * deletion must agree on what would be destroyed, and splitting them across tools would both let\n * the two drift apart and let an agent reach the destructive one without ever seeing a preview.\n * `dryRun` defaults to true (see the input schema), so omitting the flag previews and deleting\n * takes an explicit `dryRun: false`.\n *\n * Per-id, not all-or-nothing — the opposite of `media_delete_folder`, on purpose. A folder delete\n * cascades, so a mixed id list there is refused outright rather than half-applied over an unknown\n * amount of content. Here each id is exactly one asset, the blast radius of a bad one is nil, and\n * the requirement is explicit: a bad id among good ones must not discard the valid deletions.\n * The dry run reports the same per-id split, so an agent sees which ids will not resolve *before*\n * anything is destroyed rather than after.\n *\n * This does not reuse `file.deleteByIds` (the admin `/actions/bulk-delete` path). That helper\n * fires `upload.remove` under a single `Promise.all`, so the first rejection discards the report\n * of everything already deleted — unrecoverable for an operation with no undo. The removals are\n * driven one at a time here instead, through the same `upload.remove` service, which deletes the\n * provider file and every generated format, emits `media.delete`, and then deletes the row.\n *\n * The deletions are sequential on purpose: each one performs provider I/O, and a bounded batch\n * (100 ids max, per the input schema) is not worth firing at a provider in parallel.\n */\nexport const createMediaDeleteAssetsHandler = (\n  strapi: Core.Strapi,\n  context: Modules.MCP.McpHandlerContext\n) => {\n  assertAmbientInstance(strapi);\n\n  return async ({\n    args,\n  }: {\n    args: Record<string, unknown>;\n  }): Promise<Modules.MCP.McpToolHandlerReturn> => {\n    const { ids, dryRun = true } = args as MediaDeleteAssetsArgs;\n\n    // Model-level gate first, so a token without the action is refused before any DB read.\n    // The preview takes the same gate: it reveals which assets exist and what they are.\n    assertMediaPermission(strapi, context, ACTIONS.update, FILE_MODEL_UID);\n\n    const deleted: ReturnType<typeof sanitizeMediaAsset>[] = [];\n    const failed: { id: number; reason: string }[] = [];\n\n    // `ids` can repeat an id; de-duplicating keeps the report one entry per id, and stops the\n    // second occurrence of an already-deleted asset from being reported as a missing one.\n    for (const id of new Set(ids)) {\n      let file;\n\n      try {\n        // Row-level check, shared with the admin controller: an owner-scoped permission\n        // condition is evaluated against the same subject the REST API would build. Run on the\n        // dry run too — a preview must not list an asset the executing call would refuse.\n        ({ file } = await findEntityAndCheckPermissions(\n          context.userAbility,\n          ACTIONS.update,\n          FILE_MODEL_UID,\n          id,\n          strapi\n        ));\n      } catch (error) {\n        if (error instanceof errors.NotFoundError) {\n          failed.push({ id, reason: MCP_DELETE_ASSETS_ID_NOT_FOUND });\n          continue;\n        }\n\n        if (error instanceof errors.ForbiddenError) {\n          failed.push({ id, reason: MCP_DELETE_ASSETS_ID_FORBIDDEN });\n          continue;\n        }\n\n        failed.push({\n          id,\n          reason: MCP_DELETE_ASSETS_ID_FAILED(\n            error instanceof Error ? error.message : String(error)\n          ),\n        });\n        continue;\n      }\n\n      // The preview stops here: the asset resolved and this token may delete it, which is\n      // everything the agent needs to confirm — reported in the same shape the real run uses.\n      if (dryRun) {\n        deleted.push(sanitizeMediaAsset(file));\n        continue;\n      }\n\n      try {\n        await getService('upload', strapi).remove(file);\n\n        // Reported from the row read before the delete: the asset no longer exists, so this is\n        // the only description of it the agent will ever get.\n        deleted.push(sanitizeMediaAsset(file));\n      } catch (error) {\n        /**\n         * A failed removal is reported against its own id rather than thrown, for the reason\n         * spelled out on `media_move_assets` — a tool error carries no `structuredContent`, so throwing\n         * on the third id would discard the report saying the first two are gone. Here that\n         * matters more: the earlier deletions cannot be re-read, undone or discovered afterwards.\n         */\n        failed.push({\n          id,\n          reason: MCP_DELETE_ASSETS_ID_FAILED(\n            error instanceof Error ? error.message : String(error)\n          ),\n        });\n      }\n    }\n\n    /**\n     * A request where nothing was deleted still returns the per-id report, on both branches:\n     * `deleted: []` with every id in `failed` says plainly that nothing happened and why, per id.\n     * Throwing instead would drop `structuredContent` entirely, so `ids: [999]` would get prose\n     * where `ids: [1, 999]` gets a machine-readable entry, for the same class of mistake.\n     */\n    return ok({ dryRun, deleted, failed, totalFileNumber: deleted.length });\n  };\n};\n"],"names":["WRITABLE_FIELDS","buildFileInfo","args","fileInfo","field","value","undefined","createMediaUpdateAssetHandler","strapi","context","assertAmbientInstance","id","metadata","Object","keys","length","errors","ValidationError","MCP_UPDATE_ASSET_NO_FIELDS","assertMediaPermission","ACTIONS","update","FILE_MODEL_UID","findEntityAndCheckPermissions","userAbility","error","NotFoundError","MCP_NOT_FOUND_ASSET","written","getService","updateFileInfo","user","updated","findOne","ok","data","sanitizeMediaAsset","resolveDestinationFolder","folder","destination","db","query","FOLDER_MODEL_UID","select","where","MCP_MOVE_ASSETS_DESTINATION_NOT_FOUND","Number","name","String","createMediaMoveAssetsHandler","ids","destinationFolder","moved","failed","Set","push","reason","MCP_MOVE_ASSETS_ID_NOT_FOUND","ForbiddenError","MCP_MOVE_ASSETS_ID_FORBIDDEN","MCP_MOVE_ASSETS_ID_FAILED","Error","message","createMediaDeleteAssetsHandler","dryRun","deleted","file","MCP_DELETE_ASSETS_ID_NOT_FOUND","MCP_DELETE_ASSETS_ID_FORBIDDEN","MCP_DELETE_ASSETS_ID_FAILED","remove","totalFileNumber"],"mappings":";;;;;;;;;;AAyCA,oGACA,MAAMA,eAAAA,GAAkB;AAAC,IAAA,MAAA;AAAQ,IAAA,iBAAA;AAAmB,IAAA;AAAU,CAAA;AAE9D;;;;;;;IAQA,MAAMC,gBAAgB,CAACC,IAAAA,GAAAA;AACrB,IAAA,MAAMC,WAAmC,EAAC;IAE1C,KAAK,MAAMC,SAASJ,eAAAA,CAAiB;QACnC,MAAMK,KAAAA,GAAQH,IAAI,CAACE,KAAAA,CAAM;AAEzB,QAAA,IAAIC,UAAUC,SAAAA,EAAW;AACvBH,YAAAA,QAAQ,CAACC,KAAAA,CAAM,GAAGC,KAAAA,KAAU,OAAO,EAAA,GAAKA,KAAAA;AAC1C,QAAA;AACF,IAAA;IAEA,OAAOF,QAAAA;AACT,CAAA;AAEA;;;;;;;;;;AAUC,IACM,MAAMI,6BAAAA,GAAgC,CAC3CC,MAAAA,EACAC,OAAAA,GAAAA;IAEAC,qBAAAA,CAAsBF,MAAAA,CAAAA;IAEtB,OAAO,OAAO,EACZN,IAAI,EAGL,GAAA;AACC,QAAA,MAAM,EAAES,EAAE,EAAE,GAAGC,UAAU,GAAGV,IAAAA;AAC5B,QAAA,MAAMC,WAAWF,aAAAA,CAAcW,QAAAA,CAAAA;;;AAI/B,QAAA,IAAIC,OAAOC,IAAI,CAACX,QAAAA,CAAAA,CAAUY,MAAM,KAAK,CAAA,EAAG;YACtC,MAAM,IAAIC,MAAAA,CAAOC,eAAe,CAACC,0BAAAA,CAAAA;AACnC,QAAA;;;AAIAC,QAAAA,qBAAAA,CAAsBX,MAAAA,EAAQC,OAAAA,EAASW,OAAAA,CAAQC,MAAM,EAAEC,cAAAA,CAAAA;;;;;;;QAQvD,IAAI;YACF,MAAMC,6BAAAA,CACJd,QAAQe,WAAW,EACnBJ,QAAQC,MAAM,EACdC,gBACAX,EAAAA,EACAH,MAAAA,CAAAA;AAEJ,QAAA,CAAA,CAAE,OAAOiB,KAAAA,EAAO;YACd,IAAIA,KAAAA,YAAiBT,MAAAA,CAAOU,aAAa,EAAE;gBACzC,MAAM,IAAIV,MAAAA,CAAOU,aAAa,CAACC,mBAAAA,CAAAA;AACjC,YAAA;YAEA,MAAMF,KAAAA;AACR,QAAA;QAEA,MAAMG,OAAAA,GAAU,MAAMC,UAAAA,CAAW,QAAA,EAAUrB,QAAQsB,cAAc,CAACnB,IAAIR,QAAAA,EAAU;AAC9E4B,YAAAA,IAAAA,EAAMtB,QAAQsB;AAChB,SAAA,CAAA;AAEA,QAAA,MAAMC,UAAU,MAAMH,UAAAA,CAAW,UAAUrB,MAAAA,CAAAA,CAAQyB,OAAO,CAACtB,EAAAA,EAAI;AAAC,YAAA;AAAS,SAAA,CAAA;AAEzE,QAAA,OAAOuB,EAAAA,CAAG;AAAEC,YAAAA,IAAAA,EAAMC,mBAAmBJ,OAAAA,IAAWJ,OAAAA;AAAS,SAAA,CAAA;AAC3D,IAAA,CAAA;AACF;AAEA;;;;;;;;;;IAWA,MAAMS,wBAAAA,GAA2B,OAAO7B,MAAAA,EAAqB8B,MAAAA,GAAAA;AAC3D,IAAA,IAAIA,WAAW,IAAA,EAAM;QACnB,OAAO,IAAA;AACT,IAAA;IAEA,MAAMC,WAAAA,GAAc,MAAM/B,MAAAA,CAAOgC,EAAE,CAACC,KAAK,CAACC,gBAAAA,CAAAA,CAAkBT,OAAO,CAAC;QAClEU,MAAAA,EAAQ;AAAC,YAAA,IAAA;AAAM,YAAA;AAAO,SAAA;QACtBC,KAAAA,EAAO;YAAEjC,EAAAA,EAAI2B;AAAO;AACtB,KAAA,CAAA;IAEA,IAAIC,WAAAA,KAAgB,IAAA,IAAQA,WAAAA,KAAgBjC,SAAAA,EAAW;QACrD,MAAM,IAAIU,MAAAA,CAAOC,eAAe,CAAC4B,qCAAAA,CAAAA;AACnC,IAAA;IAEA,OAAO;QAAElC,EAAAA,EAAImC,MAAAA,CAAOP,YAAY5B,EAAE,CAAA;QAAGoC,IAAAA,EAAMC,MAAAA,CAAOT,WAAAA,CAAYQ,IAAI,IAAI,EAAA;AAAI,KAAA;AAC5E,CAAA;AAEA;;;;;;;;;;;;;;;;;;AAkBC,IACM,MAAME,4BAAAA,GAA+B,CAC1CzC,MAAAA,EACAC,OAAAA,GAAAA;IAEAC,qBAAAA,CAAsBF,MAAAA,CAAAA;IAEtB,OAAO,OAAO,EACZN,IAAI,EAGL,GAAA;AACC,QAAA,MAAM,EAAEgD,GAAG,EAAEZ,MAAM,EAAE,GAAGpC,IAAAA;;AAGxBiB,QAAAA,qBAAAA,CAAsBX,MAAAA,EAAQC,OAAAA,EAASW,OAAAA,CAAQC,MAAM,EAAEC,cAAAA,CAAAA;QAEvD,MAAM6B,iBAAAA,GAAoB,MAAMd,wBAAAA,CAAyB7B,MAAAA,EAAQ8B,MAAAA,CAAAA;AAEjE,QAAA,MAAMc,QAAiD,EAAE;AACzD,QAAA,MAAMC,SAA2C,EAAE;;;AAInD,QAAA,KAAK,MAAM1C,EAAAA,IAAM,IAAI2C,GAAAA,CAAIJ,GAAAA,CAAAA,CAAM;YAC7B,IAAI;;;gBAGF,MAAM3B,6BAAAA,CACJd,QAAQe,WAAW,EACnBJ,QAAQC,MAAM,EACdC,gBACAX,EAAAA,EACAH,MAAAA,CAAAA;gBAEF,MAAMwB,OAAAA,GAAU,MAAMH,UAAAA,CAAW,QAAA,EAAUrB,QAAQsB,cAAc,CAC/DnB;;AAGA,gBAAA;AAAE2B,oBAAAA;iBAAO,EACT;AAAEP,oBAAAA,IAAAA,EAAMtB,QAAQsB;AAAK,iBAAA,CAAA;;;gBAKvBqB,KAAAA,CAAMG,IAAI,CAACnB,kBAAAA,CAAmB;AAAE,oBAAA,GAAGJ,OAAO;oBAAEM,MAAAA,EAAQa;AAAkB,iBAAA,CAAA,CAAA;AACxE,YAAA,CAAA,CAAE,OAAO1B,KAAAA,EAAO;gBACd,IAAIA,KAAAA,YAAiBT,MAAAA,CAAOU,aAAa,EAAE;AACzC2B,oBAAAA,MAAAA,CAAOE,IAAI,CAAC;AAAE5C,wBAAAA,EAAAA;wBAAI6C,MAAAA,EAAQC;AAA6B,qBAAA,CAAA;AACvD,oBAAA;AACF,gBAAA;gBAEA,IAAIhC,KAAAA,YAAiBT,MAAAA,CAAO0C,cAAc,EAAE;AAC1CL,oBAAAA,MAAAA,CAAOE,IAAI,CAAC;AAAE5C,wBAAAA,EAAAA;wBAAI6C,MAAAA,EAAQG;AAA6B,qBAAA,CAAA;AACvD,oBAAA;AACF,gBAAA;AAEA;;;;;;;;;;;;;YAcAN,MAAAA,CAAOE,IAAI,CAAC;AACV5C,oBAAAA,EAAAA;AACA6C,oBAAAA,MAAAA,EAAQI,0BAA0BnC,KAAAA,YAAiBoC,KAAAA,GAAQpC,KAAAA,CAAMqC,OAAO,GAAGd,MAAAA,CAAOvB,KAAAA,CAAAA;AACpF,iBAAA,CAAA;AACF,YAAA;AACF,QAAA;AAEA;;;;;;;;;;AAUC,QACD,OAAOS,EAAAA,CAAG;AAAEiB,YAAAA,iBAAAA;AAAmBC,YAAAA,KAAAA;AAAOC,YAAAA;AAAO,SAAA,CAAA;AAC/C,IAAA,CAAA;AACF;AAEA;;;;;;;;;;;;;;;;;;;;;;;;AAwBC,IACM,MAAMU,8BAAAA,GAAiC,CAC5CvD,MAAAA,EACAC,OAAAA,GAAAA;IAEAC,qBAAAA,CAAsBF,MAAAA,CAAAA;IAEtB,OAAO,OAAO,EACZN,IAAI,EAGL,GAAA;AACC,QAAA,MAAM,EAAEgD,GAAG,EAAEc,MAAAA,GAAS,IAAI,EAAE,GAAG9D,IAAAA;;;AAI/BiB,QAAAA,qBAAAA,CAAsBX,MAAAA,EAAQC,OAAAA,EAASW,OAAAA,CAAQC,MAAM,EAAEC,cAAAA,CAAAA;AAEvD,QAAA,MAAM2C,UAAmD,EAAE;AAC3D,QAAA,MAAMZ,SAA2C,EAAE;;;AAInD,QAAA,KAAK,MAAM1C,EAAAA,IAAM,IAAI2C,GAAAA,CAAIJ,GAAAA,CAAAA,CAAM;YAC7B,IAAIgB,IAAAA;YAEJ,IAAI;;;;AAID,gBAAA,CAAA,EAAEA,IAAI,EAAE,GAAG,MAAM3C,6BAAAA,CAChBd,OAAAA,CAAQe,WAAW,EACnBJ,OAAAA,CAAQC,MAAM,EACdC,cAAAA,EACAX,IACAH,MAAAA,CACF;AACF,YAAA,CAAA,CAAE,OAAOiB,KAAAA,EAAO;gBACd,IAAIA,KAAAA,YAAiBT,MAAAA,CAAOU,aAAa,EAAE;AACzC2B,oBAAAA,MAAAA,CAAOE,IAAI,CAAC;AAAE5C,wBAAAA,EAAAA;wBAAI6C,MAAAA,EAAQW;AAA+B,qBAAA,CAAA;AACzD,oBAAA;AACF,gBAAA;gBAEA,IAAI1C,KAAAA,YAAiBT,MAAAA,CAAO0C,cAAc,EAAE;AAC1CL,oBAAAA,MAAAA,CAAOE,IAAI,CAAC;AAAE5C,wBAAAA,EAAAA;wBAAI6C,MAAAA,EAAQY;AAA+B,qBAAA,CAAA;AACzD,oBAAA;AACF,gBAAA;AAEAf,gBAAAA,MAAAA,CAAOE,IAAI,CAAC;AACV5C,oBAAAA,EAAAA;AACA6C,oBAAAA,MAAAA,EAAQa,4BACN5C,KAAAA,YAAiBoC,KAAAA,GAAQpC,KAAAA,CAAMqC,OAAO,GAAGd,MAAAA,CAAOvB,KAAAA,CAAAA;AAEpD,iBAAA,CAAA;AACA,gBAAA;AACF,YAAA;;;AAIA,YAAA,IAAIuC,MAAAA,EAAQ;gBACVC,OAAAA,CAAQV,IAAI,CAACnB,kBAAAA,CAAmB8B,IAAAA,CAAAA,CAAAA;AAChC,gBAAA;AACF,YAAA;YAEA,IAAI;AACF,gBAAA,MAAMrC,UAAAA,CAAW,QAAA,EAAUrB,MAAAA,CAAAA,CAAQ8D,MAAM,CAACJ,IAAAA,CAAAA;;;gBAI1CD,OAAAA,CAAQV,IAAI,CAACnB,kBAAAA,CAAmB8B,IAAAA,CAAAA,CAAAA;AAClC,YAAA,CAAA,CAAE,OAAOzC,KAAAA,EAAO;AACd;;;;;YAMA4B,MAAAA,CAAOE,IAAI,CAAC;AACV5C,oBAAAA,EAAAA;AACA6C,oBAAAA,MAAAA,EAAQa,4BACN5C,KAAAA,YAAiBoC,KAAAA,GAAQpC,KAAAA,CAAMqC,OAAO,GAAGd,MAAAA,CAAOvB,KAAAA,CAAAA;AAEpD,iBAAA,CAAA;AACF,YAAA;AACF,QAAA;AAEA;;;;;AAKC,QACD,OAAOS,EAAAA,CAAG;AAAE8B,YAAAA,MAAAA;AAAQC,YAAAA,OAAAA;AAASZ,YAAAA,MAAAA;AAAQkB,YAAAA,eAAAA,EAAiBN,QAAQlD;AAAO,SAAA,CAAA;AACvE,IAAA,CAAA;AACF;;;;"}
+{"version":3,"file":"write-handlers.mjs","sources":["../../../../server/src/mcp/handlers/write-handlers.ts"],"sourcesContent":["import { errors } from '@strapi/utils';\nimport type { Core, Modules } from '@strapi/types';\n\nimport { getService } from '../../utils';\nimport { ACTIONS, FILE_MODEL_UID, FOLDER_MODEL_UID } from '../../constants';\nimport { findEntityAndCheckPermissions } from '../../controllers/utils/find-entity-and-check-permissions';\nimport { assertMediaPermission } from '../permissions';\nimport { sanitizeMediaAsset } from '../sanitizers/sanitize-media';\nimport {\n  MCP_NOT_FOUND_ASSET,\n  MCP_UPDATE_ASSET_NO_FIELDS,\n  MCP_MOVE_ASSETS_DESTINATION_NOT_FOUND,\n  MCP_MOVE_ASSETS_ID_NOT_FOUND,\n  MCP_MOVE_ASSETS_ID_FORBIDDEN,\n  MCP_MOVE_ASSETS_ID_FAILED,\n  MCP_DELETE_ASSETS_ID_NOT_FOUND,\n  MCP_DELETE_ASSETS_ID_FORBIDDEN,\n  MCP_DELETE_ASSETS_ID_FAILED,\n} from './constants';\nimport { ok } from '../utils';\n\n// Type-level only: the MCP SDK validates `args` against the tool's strict Zod input schema\n// before the handler runs, so unknown keys never reach here.\ntype MediaUpdateAssetArgs = {\n  id: number;\n  name?: string;\n  alternativeText?: string | null;\n  caption?: string | null;\n};\n\ntype MediaMoveAssetsArgs = {\n  ids: number[];\n  folder: number | null;\n};\n\ntype MediaDeleteAssetsArgs = {\n  ids: number[];\n  dryRun?: boolean;\n};\n\n/** The metadata keys `media_update_asset` may write. Everything else is rejected by the schema. */\nconst WRITABLE_FIELDS = ['name', 'alternativeText', 'caption'] as const;\n\n/**\n * Picks the metadata the caller actually sent.\n *\n * `updateFileInfo` treats nil as \"keep the stored value\" (`_.isNil`), so an explicit\n * `alternativeText: null` cannot be forwarded as null — it would be read as \"unchanged\"\n * instead of \"clear it\". Clearing is expressed as an empty string, which is what the admin\n * panel writes when the field is emptied.\n */\nconst buildFileInfo = (args: MediaUpdateAssetArgs): Record<string, string> => {\n  const fileInfo: Record<string, string> = {};\n\n  for (const field of WRITABLE_FIELDS) {\n    const value = args[field];\n\n    if (value !== undefined) {\n      fileInfo[field] = value === null ? '' : value;\n    }\n  }\n\n  return fileInfo;\n};\n\n/**\n * `media_update_asset` — edits the writable metadata of one asset.\n *\n * Gated on `plugin::upload.assets.update` and mirrors `PUT /upload/files/:id`: the same\n * `findEntityAndCheckPermissions` row-level check, the same `updateFileInfo` service call, and\n * the same `updatedBy` attribution from the session user.\n *\n * The response carries the updated asset through the read sanitizer, so a client can confirm\n * the write without a second `media_get_asset` round-trip — and so provider fields stay\n * invisible on the write path too.\n */\nexport const createMediaUpdateAssetHandler =\n  (strapi: Core.Strapi, context: Modules.MCP.McpHandlerContext) =>\n  async ({\n    args,\n  }: {\n    args: Record<string, unknown>;\n  }): Promise<Modules.MCP.McpToolHandlerReturn> => {\n    const { id, ...metadata } = args as MediaUpdateAssetArgs;\n    const fileInfo = buildFileInfo(metadata as MediaUpdateAssetArgs);\n\n    // A patch with no writable field is a caller error, not a no-op success: the schema cannot\n    // express \"at least one of\" without becoming a ZodEffects the registry can't publish.\n    if (Object.keys(fileInfo).length === 0) {\n      throw new errors.ValidationError(MCP_UPDATE_ASSET_NO_FIELDS);\n    }\n\n    // Model-level gate first, so a token without the action is refused before any DB read.\n    // `findEntityAndCheckPermissions` only covers the row-level check.\n    assertMediaPermission(strapi, context, ACTIONS.update, FILE_MODEL_UID);\n\n    // Row-level check, shared with the admin controller: resolves the creator's roles so an\n    // owner-scoped permission condition is evaluated against the same subject the REST API\n    // would build, and throws Forbidden when a condition excludes this asset.\n    //\n    // Its NotFoundError carries no message, which would reach the agent as a bare \"Not Found\";\n    // rethrowing adds the same wording the read tools use.\n    try {\n      await findEntityAndCheckPermissions(\n        context.userAbility,\n        ACTIONS.update,\n        FILE_MODEL_UID,\n        id,\n        strapi\n      );\n    } catch (error) {\n      if (error instanceof errors.NotFoundError) {\n        throw new errors.NotFoundError(MCP_NOT_FOUND_ASSET);\n      }\n\n      throw error;\n    }\n\n    const written = await getService('upload', strapi).updateFileInfo(id, fileInfo, {\n      user: context.user,\n    });\n\n    const updated = await getService('upload', strapi).findOne(id, ['folder']);\n\n    return ok({ data: sanitizeMediaAsset(updated ?? written) });\n  };\n\n/**\n * Resolves the destination folder for `media_move_assets`, and rejects one that does not exist.\n *\n * `null` is the media library root and always valid. A named folder is looked up so a typo — or a\n * folder id passed where the agent meant an asset — is refused before anything is moved, matching\n * the `folder-exists` test the admin bulk-move validation applies to `destinationFolderId`.\n *\n * A bad destination is the one failure that rejects the whole call rather than being reported per\n * id: it is a property of the request, not of any single asset, so every id would fail for the\n * same reason and a per-id report would say nothing the agent could act on.\n */\nconst resolveDestinationFolder = async (strapi: Core.Strapi, folder: number | null) => {\n  if (folder === null) {\n    return null;\n  }\n\n  const destination = await strapi.db.query(FOLDER_MODEL_UID).findOne({\n    select: ['id', 'name'],\n    where: { id: folder },\n  });\n\n  if (destination === null || destination === undefined) {\n    throw new errors.ValidationError(MCP_MOVE_ASSETS_DESTINATION_NOT_FOUND);\n  }\n\n  return { id: Number(destination.id), name: String(destination.name ?? '') };\n};\n\n/**\n * `media_move_assets` — moves assets between folders in bulk.\n *\n * Bulk with a per-id report, rather than all-or-nothing: an agent reorganising a library moves\n * many assets at once, and one bad id among good ones must not discard the valid moves. Each\n * asset is moved on its own, so a failure is confined to its own id and the response says exactly\n * which ids to retry.\n *\n * That is why this does not reuse the admin `/actions/bulk-move` controller path, whose single\n * transaction is all-or-nothing by construction (and which also handles folders, out of scope\n * here). It goes through `updateFileInfo` instead — the same service `media_update_asset` and\n * `PUT /upload/files/:id` use — which sets the `folder` relation, recomputes the private\n * `folderPath`, attributes `updatedBy`, and emits `media.update` per asset. Replicating the\n * controller's raw join-table writes would skip all four.\n *\n * The moves are sequential on purpose. Each one writes the join table and `folderPath` for its\n * asset, and a bounded reorganisation (100 ids max, per the input schema) is not worth the\n * connection-pool contention of firing them in parallel.\n */\nexport const createMediaMoveAssetsHandler =\n  (strapi: Core.Strapi, context: Modules.MCP.McpHandlerContext) =>\n  async ({\n    args,\n  }: {\n    args: Record<string, unknown>;\n  }): Promise<Modules.MCP.McpToolHandlerReturn> => {\n    const { ids, folder } = args as MediaMoveAssetsArgs;\n\n    // Model-level gate first, so a token without the action is refused before any DB read.\n    assertMediaPermission(strapi, context, ACTIONS.update, FILE_MODEL_UID);\n\n    const destinationFolder = await resolveDestinationFolder(strapi, folder);\n\n    const moved: ReturnType<typeof sanitizeMediaAsset>[] = [];\n    const failed: { id: number; reason: string }[] = [];\n\n    // `ids` can repeat an id; de-duplicating keeps the report one entry per id rather than\n    // reporting the same asset twice for a request that moved it once.\n    for (const id of new Set(ids)) {\n      try {\n        // Row-level check, shared with the admin controller: an owner-scoped permission\n        // condition is evaluated against the same subject the REST API would build.\n        await findEntityAndCheckPermissions(\n          context.userAbility,\n          ACTIONS.update,\n          FILE_MODEL_UID,\n          id,\n          strapi\n        );\n        const updated = await getService('upload', strapi).updateFileInfo(\n          id,\n          // `updateFileInfo` reads `undefined` as \"keep the stored folder\" and null as the root,\n          // so the destination is forwarded as-is.\n          { folder },\n          { user: context.user }\n        );\n\n        // `updateFileInfo` resolves the row it wrote without the `folder` relation populated, so\n        // the destination is attached here instead of costing a read-back per asset.\n        moved.push(sanitizeMediaAsset({ ...updated, folder: destinationFolder }));\n      } catch (error) {\n        if (error instanceof errors.NotFoundError) {\n          failed.push({ id, reason: MCP_MOVE_ASSETS_ID_NOT_FOUND });\n          continue;\n        }\n\n        if (error instanceof errors.ForbiddenError) {\n          failed.push({ id, reason: MCP_MOVE_ASSETS_ID_FORBIDDEN });\n          continue;\n        }\n\n        /**\n         * Any other failure — a DB error, a provider fault — is reported against this id too,\n         * rather than thrown.\n         *\n         * Throwing here would be the one way to lose committed work silently: a tool error\n         * reaches the client as `{ content: [text], isError: true }` with NO\n         * `structuredContent` (see `tool-registry.ts`), so an error on the third id would\n         * discard the report saying the first two had already moved. The agent would be left\n         * unable to tell which ids to retry — exactly the recoverability this tool exists to\n         * provide.\n         *\n         * The message is carried through verbatim so the real fault is still legible, and the\n         * loop continues: one broken asset must not strand the rest of a reorganisation.\n         */\n        failed.push({\n          id,\n          reason: MCP_MOVE_ASSETS_ID_FAILED(error instanceof Error ? error.message : String(error)),\n        });\n      }\n    }\n\n    /**\n     * A request where nothing moved still returns the per-id report.\n     *\n     * `moved: []` alongside a populated `failed` is not ambiguous — it says plainly that nothing\n     * moved and why, per id. Throwing instead would drop `structuredContent` entirely (a tool\n     * error carries text only), so `ids: [999]` would get prose while `ids: [1, 999]` got a\n     * machine-readable entry, for the same class of mistake.\n     *\n     * The only failure that still rejects the whole call is an invalid destination folder, which\n     * is checked before the loop: nothing has moved, so there is no report to preserve.\n     */\n    return ok({ destinationFolder, moved, failed });\n  };\n\n/**\n * `media_delete_assets` — previews or performs the permanent deletion of assets, in bulk.\n *\n * Two branches behind one tool, for the same reason as `media_delete_folder`: the preview and the\n * deletion must agree on what would be destroyed, and splitting them across tools would both let\n * the two drift apart and let an agent reach the destructive one without ever seeing a preview.\n * `dryRun` defaults to true (see the input schema), so omitting the flag previews and deleting\n * takes an explicit `dryRun: false`.\n *\n * Per-id, not all-or-nothing — the opposite of `media_delete_folder`, on purpose. A folder delete\n * cascades, so a mixed id list there is refused outright rather than half-applied over an unknown\n * amount of content. Here each id is exactly one asset, the blast radius of a bad one is nil, and\n * the requirement is explicit: a bad id among good ones must not discard the valid deletions.\n * The dry run reports the same per-id split, so an agent sees which ids will not resolve *before*\n * anything is destroyed rather than after.\n *\n * This does not reuse `file.deleteByIds` (the admin `/actions/bulk-delete` path). That helper\n * fires `upload.remove` under a single `Promise.all`, so the first rejection discards the report\n * of everything already deleted — unrecoverable for an operation with no undo. The removals are\n * driven one at a time here instead, through the same `upload.remove` service, which deletes the\n * provider file and every generated format, emits `media.delete`, and then deletes the row.\n *\n * The deletions are sequential on purpose: each one performs provider I/O, and a bounded batch\n * (100 ids max, per the input schema) is not worth firing at a provider in parallel.\n */\nexport const createMediaDeleteAssetsHandler =\n  (strapi: Core.Strapi, context: Modules.MCP.McpHandlerContext) =>\n  async ({\n    args,\n  }: {\n    args: Record<string, unknown>;\n  }): Promise<Modules.MCP.McpToolHandlerReturn> => {\n    const { ids, dryRun = true } = args as MediaDeleteAssetsArgs;\n\n    // Model-level gate first, so a token without the action is refused before any DB read.\n    // The preview takes the same gate: it reveals which assets exist and what they are.\n    assertMediaPermission(strapi, context, ACTIONS.update, FILE_MODEL_UID);\n\n    const deleted: ReturnType<typeof sanitizeMediaAsset>[] = [];\n    const failed: { id: number; reason: string }[] = [];\n\n    // `ids` can repeat an id; de-duplicating keeps the report one entry per id, and stops the\n    // second occurrence of an already-deleted asset from being reported as a missing one.\n    for (const id of new Set(ids)) {\n      let file;\n\n      try {\n        // Row-level check, shared with the admin controller: an owner-scoped permission\n        // condition is evaluated against the same subject the REST API would build. Run on the\n        // dry run too — a preview must not list an asset the executing call would refuse.\n        ({ file } = await findEntityAndCheckPermissions(\n          context.userAbility,\n          ACTIONS.update,\n          FILE_MODEL_UID,\n          id,\n          strapi\n        ));\n      } catch (error) {\n        if (error instanceof errors.NotFoundError) {\n          failed.push({ id, reason: MCP_DELETE_ASSETS_ID_NOT_FOUND });\n          continue;\n        }\n\n        if (error instanceof errors.ForbiddenError) {\n          failed.push({ id, reason: MCP_DELETE_ASSETS_ID_FORBIDDEN });\n          continue;\n        }\n\n        failed.push({\n          id,\n          reason: MCP_DELETE_ASSETS_ID_FAILED(\n            error instanceof Error ? error.message : String(error)\n          ),\n        });\n        continue;\n      }\n\n      // The preview stops here: the asset resolved and this token may delete it, which is\n      // everything the agent needs to confirm — reported in the same shape the real run uses.\n      if (dryRun) {\n        deleted.push(sanitizeMediaAsset(file));\n        continue;\n      }\n\n      try {\n        await getService('upload', strapi).remove(file);\n\n        // Reported from the row read before the delete: the asset no longer exists, so this is\n        // the only description of it the agent will ever get.\n        deleted.push(sanitizeMediaAsset(file));\n      } catch (error) {\n        /**\n         * A failed removal is reported against its own id rather than thrown, for the reason\n         * spelled out on `media_move_assets` — a tool error carries no `structuredContent`, so throwing\n         * on the third id would discard the report saying the first two are gone. Here that\n         * matters more: the earlier deletions cannot be re-read, undone or discovered afterwards.\n         */\n        failed.push({\n          id,\n          reason: MCP_DELETE_ASSETS_ID_FAILED(\n            error instanceof Error ? error.message : String(error)\n          ),\n        });\n      }\n    }\n\n    /**\n     * A request where nothing was deleted still returns the per-id report, on both branches:\n     * `deleted: []` with every id in `failed` says plainly that nothing happened and why, per id.\n     * Throwing instead would drop `structuredContent` entirely, so `ids: [999]` would get prose\n     * where `ids: [1, 999]` gets a machine-readable entry, for the same class of mistake.\n     */\n    return ok({ dryRun, deleted, failed, totalFileNumber: deleted.length });\n  };\n"],"names":["WRITABLE_FIELDS","buildFileInfo","args","fileInfo","field","value","undefined","createMediaUpdateAssetHandler","strapi","context","id","metadata","Object","keys","length","errors","ValidationError","MCP_UPDATE_ASSET_NO_FIELDS","assertMediaPermission","ACTIONS","update","FILE_MODEL_UID","findEntityAndCheckPermissions","userAbility","error","NotFoundError","MCP_NOT_FOUND_ASSET","written","getService","updateFileInfo","user","updated","findOne","ok","data","sanitizeMediaAsset","resolveDestinationFolder","folder","destination","db","query","FOLDER_MODEL_UID","select","where","MCP_MOVE_ASSETS_DESTINATION_NOT_FOUND","Number","name","String","createMediaMoveAssetsHandler","ids","destinationFolder","moved","failed","Set","push","reason","MCP_MOVE_ASSETS_ID_NOT_FOUND","ForbiddenError","MCP_MOVE_ASSETS_ID_FORBIDDEN","MCP_MOVE_ASSETS_ID_FAILED","Error","message","createMediaDeleteAssetsHandler","dryRun","deleted","file","MCP_DELETE_ASSETS_ID_NOT_FOUND","MCP_DELETE_ASSETS_ID_FORBIDDEN","MCP_DELETE_ASSETS_ID_FAILED","remove","totalFileNumber"],"mappings":";;;;;;;;;AAwCA,oGACA,MAAMA,eAAAA,GAAkB;AAAC,IAAA,MAAA;AAAQ,IAAA,iBAAA;AAAmB,IAAA;AAAU,CAAA;AAE9D;;;;;;;IAQA,MAAMC,gBAAgB,CAACC,IAAAA,GAAAA;AACrB,IAAA,MAAMC,WAAmC,EAAC;IAE1C,KAAK,MAAMC,SAASJ,eAAAA,CAAiB;QACnC,MAAMK,KAAAA,GAAQH,IAAI,CAACE,KAAAA,CAAM;AAEzB,QAAA,IAAIC,UAAUC,SAAAA,EAAW;AACvBH,YAAAA,QAAQ,CAACC,KAAAA,CAAM,GAAGC,KAAAA,KAAU,OAAO,EAAA,GAAKA,KAAAA;AAC1C,QAAA;AACF,IAAA;IAEA,OAAOF,QAAAA;AACT,CAAA;AAEA;;;;;;;;;;UAWaI,6BAAAA,GACX,CAACC,QAAqBC,OAAAA,GACtB,OAAO,EACLP,IAAI,EAGL,GAAA;AACC,QAAA,MAAM,EAAEQ,EAAE,EAAE,GAAGC,UAAU,GAAGT,IAAAA;AAC5B,QAAA,MAAMC,WAAWF,aAAAA,CAAcU,QAAAA,CAAAA;;;AAI/B,QAAA,IAAIC,OAAOC,IAAI,CAACV,QAAAA,CAAAA,CAAUW,MAAM,KAAK,CAAA,EAAG;YACtC,MAAM,IAAIC,MAAAA,CAAOC,eAAe,CAACC,0BAAAA,CAAAA;AACnC,QAAA;;;AAIAC,QAAAA,qBAAAA,CAAsBV,MAAAA,EAAQC,OAAAA,EAASU,OAAAA,CAAQC,MAAM,EAAEC,cAAAA,CAAAA;;;;;;;QAQvD,IAAI;YACF,MAAMC,6BAAAA,CACJb,QAAQc,WAAW,EACnBJ,QAAQC,MAAM,EACdC,gBACAX,EAAAA,EACAF,MAAAA,CAAAA;AAEJ,QAAA,CAAA,CAAE,OAAOgB,KAAAA,EAAO;YACd,IAAIA,KAAAA,YAAiBT,MAAAA,CAAOU,aAAa,EAAE;gBACzC,MAAM,IAAIV,MAAAA,CAAOU,aAAa,CAACC,mBAAAA,CAAAA;AACjC,YAAA;YAEA,MAAMF,KAAAA;AACR,QAAA;QAEA,MAAMG,OAAAA,GAAU,MAAMC,UAAAA,CAAW,QAAA,EAAUpB,QAAQqB,cAAc,CAACnB,IAAIP,QAAAA,EAAU;AAC9E2B,YAAAA,IAAAA,EAAMrB,QAAQqB;AAChB,SAAA,CAAA;AAEA,QAAA,MAAMC,UAAU,MAAMH,UAAAA,CAAW,UAAUpB,MAAAA,CAAAA,CAAQwB,OAAO,CAACtB,EAAAA,EAAI;AAAC,YAAA;AAAS,SAAA,CAAA;AAEzE,QAAA,OAAOuB,EAAAA,CAAG;AAAEC,YAAAA,IAAAA,EAAMC,mBAAmBJ,OAAAA,IAAWJ,OAAAA;AAAS,SAAA,CAAA;IAC3D;AAEF;;;;;;;;;;IAWA,MAAMS,wBAAAA,GAA2B,OAAO5B,MAAAA,EAAqB6B,MAAAA,GAAAA;AAC3D,IAAA,IAAIA,WAAW,IAAA,EAAM;QACnB,OAAO,IAAA;AACT,IAAA;IAEA,MAAMC,WAAAA,GAAc,MAAM9B,MAAAA,CAAO+B,EAAE,CAACC,KAAK,CAACC,gBAAAA,CAAAA,CAAkBT,OAAO,CAAC;QAClEU,MAAAA,EAAQ;AAAC,YAAA,IAAA;AAAM,YAAA;AAAO,SAAA;QACtBC,KAAAA,EAAO;YAAEjC,EAAAA,EAAI2B;AAAO;AACtB,KAAA,CAAA;IAEA,IAAIC,WAAAA,KAAgB,IAAA,IAAQA,WAAAA,KAAgBhC,SAAAA,EAAW;QACrD,MAAM,IAAIS,MAAAA,CAAOC,eAAe,CAAC4B,qCAAAA,CAAAA;AACnC,IAAA;IAEA,OAAO;QAAElC,EAAAA,EAAImC,MAAAA,CAAOP,YAAY5B,EAAE,CAAA;QAAGoC,IAAAA,EAAMC,MAAAA,CAAOT,WAAAA,CAAYQ,IAAI,IAAI,EAAA;AAAI,KAAA;AAC5E,CAAA;AAEA;;;;;;;;;;;;;;;;;;UAmBaE,4BAAAA,GACX,CAACxC,QAAqBC,OAAAA,GACtB,OAAO,EACLP,IAAI,EAGL,GAAA;AACC,QAAA,MAAM,EAAE+C,GAAG,EAAEZ,MAAM,EAAE,GAAGnC,IAAAA;;AAGxBgB,QAAAA,qBAAAA,CAAsBV,MAAAA,EAAQC,OAAAA,EAASU,OAAAA,CAAQC,MAAM,EAAEC,cAAAA,CAAAA;QAEvD,MAAM6B,iBAAAA,GAAoB,MAAMd,wBAAAA,CAAyB5B,MAAAA,EAAQ6B,MAAAA,CAAAA;AAEjE,QAAA,MAAMc,QAAiD,EAAE;AACzD,QAAA,MAAMC,SAA2C,EAAE;;;AAInD,QAAA,KAAK,MAAM1C,EAAAA,IAAM,IAAI2C,GAAAA,CAAIJ,GAAAA,CAAAA,CAAM;YAC7B,IAAI;;;gBAGF,MAAM3B,6BAAAA,CACJb,QAAQc,WAAW,EACnBJ,QAAQC,MAAM,EACdC,gBACAX,EAAAA,EACAF,MAAAA,CAAAA;gBAEF,MAAMuB,OAAAA,GAAU,MAAMH,UAAAA,CAAW,QAAA,EAAUpB,QAAQqB,cAAc,CAC/DnB;;AAGA,gBAAA;AAAE2B,oBAAAA;iBAAO,EACT;AAAEP,oBAAAA,IAAAA,EAAMrB,QAAQqB;AAAK,iBAAA,CAAA;;;gBAKvBqB,KAAAA,CAAMG,IAAI,CAACnB,kBAAAA,CAAmB;AAAE,oBAAA,GAAGJ,OAAO;oBAAEM,MAAAA,EAAQa;AAAkB,iBAAA,CAAA,CAAA;AACxE,YAAA,CAAA,CAAE,OAAO1B,KAAAA,EAAO;gBACd,IAAIA,KAAAA,YAAiBT,MAAAA,CAAOU,aAAa,EAAE;AACzC2B,oBAAAA,MAAAA,CAAOE,IAAI,CAAC;AAAE5C,wBAAAA,EAAAA;wBAAI6C,MAAAA,EAAQC;AAA6B,qBAAA,CAAA;AACvD,oBAAA;AACF,gBAAA;gBAEA,IAAIhC,KAAAA,YAAiBT,MAAAA,CAAO0C,cAAc,EAAE;AAC1CL,oBAAAA,MAAAA,CAAOE,IAAI,CAAC;AAAE5C,wBAAAA,EAAAA;wBAAI6C,MAAAA,EAAQG;AAA6B,qBAAA,CAAA;AACvD,oBAAA;AACF,gBAAA;AAEA;;;;;;;;;;;;;YAcAN,MAAAA,CAAOE,IAAI,CAAC;AACV5C,oBAAAA,EAAAA;AACA6C,oBAAAA,MAAAA,EAAQI,0BAA0BnC,KAAAA,YAAiBoC,KAAAA,GAAQpC,KAAAA,CAAMqC,OAAO,GAAGd,MAAAA,CAAOvB,KAAAA,CAAAA;AACpF,iBAAA,CAAA;AACF,YAAA;AACF,QAAA;AAEA;;;;;;;;;;AAUC,QACD,OAAOS,EAAAA,CAAG;AAAEiB,YAAAA,iBAAAA;AAAmBC,YAAAA,KAAAA;AAAOC,YAAAA;AAAO,SAAA,CAAA;IAC/C;AAEF;;;;;;;;;;;;;;;;;;;;;;;;UAyBaU,8BAAAA,GACX,CAACtD,QAAqBC,OAAAA,GACtB,OAAO,EACLP,IAAI,EAGL,GAAA;AACC,QAAA,MAAM,EAAE+C,GAAG,EAAEc,MAAAA,GAAS,IAAI,EAAE,GAAG7D,IAAAA;;;AAI/BgB,QAAAA,qBAAAA,CAAsBV,MAAAA,EAAQC,OAAAA,EAASU,OAAAA,CAAQC,MAAM,EAAEC,cAAAA,CAAAA;AAEvD,QAAA,MAAM2C,UAAmD,EAAE;AAC3D,QAAA,MAAMZ,SAA2C,EAAE;;;AAInD,QAAA,KAAK,MAAM1C,EAAAA,IAAM,IAAI2C,GAAAA,CAAIJ,GAAAA,CAAAA,CAAM;YAC7B,IAAIgB,IAAAA;YAEJ,IAAI;;;;AAID,gBAAA,CAAA,EAAEA,IAAI,EAAE,GAAG,MAAM3C,6BAAAA,CAChBb,OAAAA,CAAQc,WAAW,EACnBJ,OAAAA,CAAQC,MAAM,EACdC,cAAAA,EACAX,IACAF,MAAAA,CACF;AACF,YAAA,CAAA,CAAE,OAAOgB,KAAAA,EAAO;gBACd,IAAIA,KAAAA,YAAiBT,MAAAA,CAAOU,aAAa,EAAE;AACzC2B,oBAAAA,MAAAA,CAAOE,IAAI,CAAC;AAAE5C,wBAAAA,EAAAA;wBAAI6C,MAAAA,EAAQW;AAA+B,qBAAA,CAAA;AACzD,oBAAA;AACF,gBAAA;gBAEA,IAAI1C,KAAAA,YAAiBT,MAAAA,CAAO0C,cAAc,EAAE;AAC1CL,oBAAAA,MAAAA,CAAOE,IAAI,CAAC;AAAE5C,wBAAAA,EAAAA;wBAAI6C,MAAAA,EAAQY;AAA+B,qBAAA,CAAA;AACzD,oBAAA;AACF,gBAAA;AAEAf,gBAAAA,MAAAA,CAAOE,IAAI,CAAC;AACV5C,oBAAAA,EAAAA;AACA6C,oBAAAA,MAAAA,EAAQa,4BACN5C,KAAAA,YAAiBoC,KAAAA,GAAQpC,KAAAA,CAAMqC,OAAO,GAAGd,MAAAA,CAAOvB,KAAAA,CAAAA;AAEpD,iBAAA,CAAA;AACA,gBAAA;AACF,YAAA;;;AAIA,YAAA,IAAIuC,MAAAA,EAAQ;gBACVC,OAAAA,CAAQV,IAAI,CAACnB,kBAAAA,CAAmB8B,IAAAA,CAAAA,CAAAA;AAChC,gBAAA;AACF,YAAA;YAEA,IAAI;AACF,gBAAA,MAAMrC,UAAAA,CAAW,QAAA,EAAUpB,MAAAA,CAAAA,CAAQ6D,MAAM,CAACJ,IAAAA,CAAAA;;;gBAI1CD,OAAAA,CAAQV,IAAI,CAACnB,kBAAAA,CAAmB8B,IAAAA,CAAAA,CAAAA;AAClC,YAAA,CAAA,CAAE,OAAOzC,KAAAA,EAAO;AACd;;;;;YAMA4B,MAAAA,CAAOE,IAAI,CAAC;AACV5C,oBAAAA,EAAAA;AACA6C,oBAAAA,MAAAA,EAAQa,4BACN5C,KAAAA,YAAiBoC,KAAAA,GAAQpC,KAAAA,CAAMqC,OAAO,GAAGd,MAAAA,CAAOvB,KAAAA,CAAAA;AAEpD,iBAAA,CAAA;AACF,YAAA;AACF,QAAA;AAEA;;;;;AAKC,QACD,OAAOS,EAAAA,CAAG;AAAE8B,YAAAA,MAAAA;AAAQC,YAAAA,OAAAA;AAASZ,YAAAA,MAAAA;AAAQkB,YAAAA,eAAAA,EAAiBN,QAAQlD;AAAO,SAAA,CAAA;IACvE;;;;"}