@trokky/trokky 3.4.1 → 3.5.1

package/dist/adapters/s3-media/s3-client.d.ts

@@ -0,0 +1,112 @@
+/**
+ * The thinnest S3 client that serves a media adapter.
+ *
+ * Not an SDK. Six operations — put, get, head, delete, list, presign — over `aws4fetch`, which
+ * is ~6KB of WebCrypto and therefore works unchanged in Node, workerd and a browser. The AWS
+ * SDK would be two orders of magnitude larger for the same six calls.
+ *
+ * Two deliberate omissions:
+ *
+ *  - **No `DeleteObjects`.** The multi-key delete requires a `Content-MD5` (or a checksum
+ *    header whose support varies by backend), and WebCrypto has no MD5, so implementing it
+ *    means shipping an MD5. Individual DELETEs with bounded concurrency cost more requests and
+ *    no correctness, and this adapter only ever bulk-deletes a file's variants or a cleanup's
+ *    orphans — both rare and small.
+ *  - **No multipart upload.** The adapter caps a file at 100MB and S3's single-PUT limit is
+ *    5GB, so there is nothing to split. Raising the cap means implementing it.
+ *
+ * Listings ask for `encoding-type=url`, so keys come back percent-encoded and XML entities
+ * cannot smuggle a `&` or a `<` through a filename into the parser.
+ */
+export interface S3ObjectSummary {
+    key: string;
+    size: number;
+    lastModified: Date;
+}
+export interface S3ListPage {
+    objects: S3ObjectSummary[];
+    nextToken?: string;
+}
+export interface S3ClientOptions {
+    endpoint: string;
+    bucket: string;
+    accessKeyId: string;
+    secretAccessKey: string;
+    region: string;
+    forcePathStyle: boolean;
+}
+export declare class S3RequestError extends Error {
+    readonly status: number;
+    readonly code?: string | undefined;
+    constructor(message: string, status: number, code?: string | undefined);
+}
+export declare class S3Client {
+    private readonly logger;
+    private readonly origin;
+    private readonly bucket;
+    private readonly forcePathStyle;
+    private readonly client;
+    constructor(options: S3ClientOptions);
+    /**
+     * The URL for a key. Every path segment is encoded individually: a key contains `/` as a real
+     * separator, and `encodeURIComponent` on the whole key would destroy it.
+     */
+    url(key: string): string;
+    private base;
+    /** One signed request, retried on throttling and 5xx, never on a 4xx that means what it says. */
+    private send;
+    put(key: string, body: ArrayBuffer | Uint8Array | string, options?: {
+        contentType?: string;
+        metadata?: Record<string, string>;
+    }): Promise<void>;
+    get(key: string): Promise<Response | null>;
+    /** Object metadata without the bytes, or null when there is no such key. */
+    head(key: string): Promise<{
+        size: number;
+        metadata: Record<string, string>;
+    } | null>;
+    /** Deleting a key that is not there is a success, exactly as it is on R2. */
+    delete(key: string): Promise<void>;
+    /**
+     * Delete many keys, a few at a time.
+     *
+     * Sixteen in flight keeps a cleanup of a large bucket from opening a thousand sockets while
+     * still finishing in a sensible time. See the header note on why this is not `DeleteObjects`.
+     */
+    deleteMany(keys: string[], concurrency?: number): Promise<void>;
+    /** One page of ListObjectsV2. */
+    list(prefix: string, options?: {
+        token?: string;
+        maxKeys?: number;
+    }): Promise<S3ListPage>;
+    /** Every page of a prefix. A partial listing would mis-count a total. */
+    listAll(prefix: string): Promise<S3ObjectSummary[]>;
+    /**
+     * A URL that carries its own signature, good for `expiresIn` seconds.
+     *
+     * The expiry goes through `URL.searchParams`, not string concatenation. Concatenating let a
+     * caller that forwards a request value smuggle extra query parameters — and because they land
+     * before signing, S3 honours them: `response-content-type=text/html` turns an uploaded image
+     * into stored XSS on the bucket origin.
+     */
+    presign(key: string, expiresIn: number): Promise<string>;
+}
+/**
+ * Pull the contents out of a ListObjectsV2 body.
+ *
+ * A regex rather than an XML parser because neither Node nor workerd ships one, the schema here
+ * is four fields deep, and `encoding-type=url` guarantees the only characters inside the tags we
+ * read are percent-encoded ASCII.
+ */
+export declare function parseListResponse(xml: string): S3ListPage;
+/**
+ * Percent-decode a value this adapter may not have written.
+ *
+ * `put()` encodes metadata values because a filename need not be header-safe, but
+ * `CloudflareR2Adapter` mirrors the filename into `customMetadata` raw — and sharing one bucket
+ * between the two is the point of this layout. A file named `100% off.png` written from a Worker
+ * would otherwise make `decodeURIComponent` throw and take `fileExists`, `listVariants` and
+ * `healthCheck` down with it.
+ */
+export declare function decodeMetadata(value: string): string;
+//# sourceMappingURL=s3-client.d.ts.map

package/dist/adapters/s3-media/s3-client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"s3-client.d.ts","sourceRoot":"","sources":["../../../src/adapters/s3-media/s3-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAMH,MAAM,WAAW,eAAe;IAC9B,GAAG,EAAE,MAAM,CAAA;IACX,IAAI,EAAE,MAAM,CAAA;IACZ,YAAY,EAAE,IAAI,CAAA;CACnB;AAED,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,eAAe,EAAE,CAAA;IAC1B,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,MAAM,CAAA;IAChB,MAAM,EAAE,MAAM,CAAA;IACd,WAAW,EAAE,MAAM,CAAA;IACnB,eAAe,EAAE,MAAM,CAAA;IACvB,MAAM,EAAE,MAAM,CAAA;IACd,cAAc,EAAE,OAAO,CAAA;CACxB;AAoBD,qBAAa,cAAe,SAAQ,KAAK;aAGrB,MAAM,EAAE,MAAM;aACd,IAAI,CAAC,EAAE,MAAM;gBAF7B,OAAO,EAAE,MAAM,EACC,MAAM,EAAE,MAAM,EACd,IAAI,CAAC,EAAE,MAAM,YAAA;CAKhC;AAED,qBAAa,QAAQ;IACnB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAsC;IAC7D,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAQ;IAC/B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAQ;IAC/B,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAS;IACxC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAW;gBAEtB,OAAO,EAAE,eAAe;IAYpC;;;OAGG;IACI,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM;IAO/B,OAAO,CAAC,IAAI;IAMZ,iGAAiG;YACnF,IAAI;IA0CL,GAAG,CACd,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,WAAW,GAAG,UAAU,GAAG,MAAM,EACvC,OAAO,GAAE;QAAE,WAAW,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KAAO,GACxE,OAAO,CAAC,IAAI,CAAC;IAaH,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;IAQvD,4EAA4E;IAC/D,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KAAE,GAAG,IAAI,CAAC;IAelG,6EAA6E;IAChE,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAI/C;;;;;OAKG;IACU,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,WAAW,SAAK,GAAG,OAAO,CAAC,IAAI,CAAC;IAMxE,iCAAiC;IACpB,IAAI,CACf,MAAM,EAAE,MAAM,EACd,OAAO,GAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAO,GACjD,OAAO,CAAC,UAAU,CAAC;IAiBtB,yEAAyE;IAC5D,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC;IAahE;;;;;;;OAOG;IACU,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;CAiBtE;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,UAAU,CAuBzD;AAgBD;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAMpD"}

package/dist/adapters/s3-media/s3-client.js

@@ -0,0 +1,261 @@
+/**
+ * The thinnest S3 client that serves a media adapter.
+ *
+ * Not an SDK. Six operations — put, get, head, delete, list, presign — over `aws4fetch`, which
+ * is ~6KB of WebCrypto and therefore works unchanged in Node, workerd and a browser. The AWS
+ * SDK would be two orders of magnitude larger for the same six calls.
+ *
+ * Two deliberate omissions:
+ *
+ *  - **No `DeleteObjects`.** The multi-key delete requires a `Content-MD5` (or a checksum
+ *    header whose support varies by backend), and WebCrypto has no MD5, so implementing it
+ *    means shipping an MD5. Individual DELETEs with bounded concurrency cost more requests and
+ *    no correctness, and this adapter only ever bulk-deletes a file's variants or a cleanup's
+ *    orphans — both rare and small.
+ *  - **No multipart upload.** The adapter caps a file at 100MB and S3's single-PUT limit is
+ *    5GB, so there is nothing to split. Raising the cap means implementing it.
+ *
+ * Listings ask for `encoding-type=url`, so keys come back percent-encoded and XML entities
+ * cannot smuggle a `&` or a `<` through a filename into the parser.
+ */
+import { AwsClient } from 'aws4fetch';
+import { createLogger } from '../../core/index.js';
+import { withRetry } from '../../core/utils/retry.js';
+/** Status codes worth trying again: throttling and the backend having a bad moment. */
+const RETRYABLE_STATUS = new Set([429, 500, 502, 503, 504]);
+/**
+ * Methods for which a 404 is an answer rather than a failure.
+ *
+ * On a GET, HEAD or DELETE it means "no such key", which every caller here handles. On a PUT or
+ * a LIST it means `NoSuchBucket` — and swallowing that made a misconfigured bucket look like an
+ * empty one: uploads returned a MediaFile having written nothing, and listings reported zero.
+ */
+const ABSENCE_IS_NOT_FAILURE = new Set(['GET', 'HEAD', 'DELETE']);
+/** A stalled connection is the classic object-store failure; without this the promise never settles. */
+const REQUEST_TIMEOUT_MS = 30_000;
+/** SigV4 caps a presigned URL at seven days. */
+const MAX_PRESIGN_SECONDS = 604_800;
+export class S3RequestError extends Error {
+    status;
+    code;
+    constructor(message, status, code) {
+        super(message);
+        this.status = status;
+        this.code = code;
+        this.name = 'S3RequestError';
+    }
+}
+export class S3Client {
+    logger = createLogger('adapter', 'S3Client');
+    origin;
+    bucket;
+    forcePathStyle;
+    client;
+    constructor(options) {
+        this.origin = options.endpoint.replace(/\/+$/, '');
+        this.bucket = options.bucket;
+        this.forcePathStyle = options.forcePathStyle;
+        this.client = new AwsClient({
+            accessKeyId: options.accessKeyId,
+            secretAccessKey: options.secretAccessKey,
+            region: options.region,
+            service: 's3'
+        });
+    }
+    /**
+     * The URL for a key. Every path segment is encoded individually: a key contains `/` as a real
+     * separator, and `encodeURIComponent` on the whole key would destroy it.
+     */
+    url(key) {
+        const path = key.split('/').map(encodeURIComponent).join('/');
+        return this.forcePathStyle
+            ? `${this.origin}/${this.bucket}/${path}`
+            : this.origin.replace('://', `://${this.bucket}.`) + `/${path}`;
+    }
+    base() {
+        return this.forcePathStyle
+            ? `${this.origin}/${this.bucket}`
+            : this.origin.replace('://', `://${this.bucket}.`);
+    }
+    /** One signed request, retried on throttling and 5xx, never on a 4xx that means what it says. */
+    async send(url, init, label) {
+        const method = (init.method ?? 'GET').toUpperCase();
+        const absenceIsAnswer = ABSENCE_IS_NOT_FAILURE.has(method);
+        return withRetry(async () => {
+            const response = await this.client.fetch(url, {
+                ...init,
+                // Without this a stalled connection never settles, so withRetry never sees an error
+                // and the caller's request hangs for as long as the process lives.
+                signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS)
+            });
+            // A 404 means "no such key" on a read or a delete, which every caller here handles. On a
+            // PUT or a LIST it means NoSuchBucket, and treating that as success made a misconfigured
+            // bucket indistinguishable from an empty one.
+            if (response.ok || (response.status === 404 && absenceIsAnswer))
+                return response;
+            const body = await response.text().catch(() => '');
+            const code = /<Code>([^<]+)<\/Code>/.exec(body)?.[1];
+            // The body is NOT in the message. AWS puts AWSAccessKeyId, StringToSign and
+            // CanonicalRequest in a SignatureDoesNotMatch document, and this message travels
+            // to an HTTP 500 response body through the Express error handler.
+            this.logger.debug(`${label} failed`, { status: response.status, body: body.slice(0, 300) });
+            throw new S3RequestError(`${label} failed: ${response.status} ${response.statusText}${code ? ` (${code})` : ''}`, response.status, code);
+        }, {
+            attempts: 4,
+            isRetryable: error => !(error instanceof S3RequestError) || RETRYABLE_STATUS.has(error.status),
+            onRetry: ({ error, attempt }) => this.logger.warn(`${label}: retrying after failure`, { attempt, error: String(error) })
+        });
+    }
+    async put(key, body, options = {}) {
+        const headers = {};
+        if (options.contentType)
+            headers['content-type'] = options.contentType;
+        for (const [name, value] of Object.entries(options.metadata ?? {})) {
+            // User metadata must be a header-safe latin-1 string; a filename need not be either.
+            headers[`x-amz-meta-${name}`] = encodeURIComponent(value);
+        }
+        await drain(await this.send(this.url(key), { method: 'PUT', body: body, headers }, `PUT ${key}`));
+    }
+    async get(key) {
+        const response = await this.send(this.url(key), { method: 'GET' }, `GET ${key}`);
+        if (response.status !== 404)
+            return response;
+        // An undici body that is never read pins its connection until GC.
+        await drain(response);
+        return null;
+    }
+    /** Object metadata without the bytes, or null when there is no such key. */
+    async head(key) {
+        const response = await this.send(this.url(key), { method: 'HEAD' }, `HEAD ${key}`);
+        await drain(response);
+        if (response.status === 404)
+            return null;
+        const metadata = {};
+        response.headers.forEach((value, name) => {
+            if (name.toLowerCase().startsWith('x-amz-meta-')) {
+                metadata[name.slice('x-amz-meta-'.length).toLowerCase()] = decodeMetadata(value);
+            }
+        });
+        return { size: Number(response.headers.get('content-length') ?? 0), metadata };
+    }
+    /** Deleting a key that is not there is a success, exactly as it is on R2. */
+    async delete(key) {
+        await drain(await this.send(this.url(key), { method: 'DELETE' }, `DELETE ${key}`));
+    }
+    /**
+     * Delete many keys, a few at a time.
+     *
+     * Sixteen in flight keeps a cleanup of a large bucket from opening a thousand sockets while
+     * still finishing in a sensible time. See the header note on why this is not `DeleteObjects`.
+     */
+    async deleteMany(keys, concurrency = 16) {
+        for (let index = 0; index < keys.length; index += concurrency) {
+            await Promise.all(keys.slice(index, index + concurrency).map(key => this.delete(key)));
+        }
+    }
+    /** One page of ListObjectsV2. */
+    async list(prefix, options = {}) {
+        const query = new URLSearchParams({
+            'list-type': '2',
+            prefix,
+            'encoding-type': 'url',
+            'max-keys': String(options.maxKeys ?? 1000)
+        });
+        if (options.token)
+            query.set('continuation-token', options.token);
+        const response = await this.send(`${this.base()}?${query.toString()}`, { method: 'GET' }, `LIST ${prefix}`);
+        return parseListResponse(await response.text());
+    }
+    /** Every page of a prefix. A partial listing would mis-count a total. */
+    async listAll(prefix) {
+        const objects = [];
+        let token;
+        do {
+            const page = await this.list(prefix, { token });
+            objects.push(...page.objects);
+            token = page.nextToken;
+        } while (token);
+        return objects;
+    }
+    /**
+     * A URL that carries its own signature, good for `expiresIn` seconds.
+     *
+     * The expiry goes through `URL.searchParams`, not string concatenation. Concatenating let a
+     * caller that forwards a request value smuggle extra query parameters — and because they land
+     * before signing, S3 honours them: `response-content-type=text/html` turns an uploaded image
+     * into stored XSS on the bucket origin.
+     */
+    async presign(key, expiresIn) {
+        const seconds = Math.floor(Number(expiresIn));
+        if (!Number.isFinite(seconds) || seconds <= 0 || seconds > MAX_PRESIGN_SECONDS) {
+            throw new Error(`expiresIn must be a whole number of seconds between 1 and ${MAX_PRESIGN_SECONDS}`);
+        }
+        const url = new URL(this.url(key));
+        url.searchParams.set('X-Amz-Expires', String(seconds));
+        const signed = await this.client.sign(url.toString(), {
+            method: 'GET',
+            aws: { signQuery: true }
+        });
+        return signed.url;
+    }
+}
+/**
+ * Pull the contents out of a ListObjectsV2 body.
+ *
+ * A regex rather than an XML parser because neither Node nor workerd ships one, the schema here
+ * is four fields deep, and `encoding-type=url` guarantees the only characters inside the tags we
+ * read are percent-encoded ASCII.
+ */
+export function parseListResponse(xml) {
+    const objects = [];
+    for (const match of xml.matchAll(/<Contents>([\s\S]*?)<\/Contents>/g)) {
+        const entry = match[1];
+        const key = /<Key>([\s\S]*?)<\/Key>/.exec(entry)?.[1];
+        if (key === undefined)
+            continue;
+        objects.push({
+            key: decodeURIComponent(key),
+            // \s* because a pretty-printing backend puts the digits on their own line.
+            size: Number(/<Size>\s*(\d+)\s*<\/Size>/.exec(entry)?.[1] ?? 0),
+            lastModified: new Date(/<LastModified>([\s\S]*?)<\/LastModified>/.exec(entry)?.[1] ?? 0)
+        });
+    }
+    const truncated = /<IsTruncated>\s*true\s*<\/IsTruncated>/i.test(xml);
+    const token = /<NextContinuationToken>([\s\S]*?)<\/NextContinuationToken>/.exec(xml)?.[1];
+    // `encoding-type=url` is specified to cover Delimiter, Prefix, Key and StartAfter — NOT the
+    // continuation token. AWS and R2 return base64, where decoding is a no-op, but a backend that
+    // returns a raw marker could carry a `%` that decodeURIComponent would throw on or corrupt.
+    return { objects, nextToken: truncated && token ? decodeMetadata(token) : undefined };
+}
+/**
+ * Read and discard a body we do not need.
+ *
+ * Under undici a response body that is neither read nor cancelled pins its connection until GC,
+ * so a cleanup issuing thousands of DELETEs can exhaust the pool.
+ */
+async function drain(response) {
+    try {
+        await response.arrayBuffer();
+    }
+    catch {
+        // A body that cannot be read is already gone, which is the state we wanted.
+    }
+}
+/**
+ * Percent-decode a value this adapter may not have written.
+ *
+ * `put()` encodes metadata values because a filename need not be header-safe, but
+ * `CloudflareR2Adapter` mirrors the filename into `customMetadata` raw — and sharing one bucket
+ * between the two is the point of this layout. A file named `100% off.png` written from a Worker
+ * would otherwise make `decodeURIComponent` throw and take `fileExists`, `listVariants` and
+ * `healthCheck` down with it.
+ */
+export function decodeMetadata(value) {
+    try {
+        return decodeURIComponent(value);
+    }
+    catch {
+        return value;
+    }
+}
+//# sourceMappingURL=s3-client.js.map

package/dist/adapters/s3-media/s3-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"s3-client.js","sourceRoot":"","sources":["../../../src/adapters/s3-media/s3-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAA;AACrC,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAA;AAClD,OAAO,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAA;AAsBrD,uFAAuF;AACvF,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAA;AAE3D;;;;;;GAMG;AACH,MAAM,sBAAsB,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAA;AAEjE,wGAAwG;AACxG,MAAM,kBAAkB,GAAG,MAAM,CAAA;AAEjC,gDAAgD;AAChD,MAAM,mBAAmB,GAAG,OAAO,CAAA;AAEnC,MAAM,OAAO,cAAe,SAAQ,KAAK;IAGrB;IACA;IAHlB,YACE,OAAe,EACC,MAAc,EACd,IAAa;QAE7B,KAAK,CAAC,OAAO,CAAC,CAAA;QAHE,WAAM,GAAN,MAAM,CAAQ;QACd,SAAI,GAAJ,IAAI,CAAS;QAG7B,IAAI,CAAC,IAAI,GAAG,gBAAgB,CAAA;IAC9B,CAAC;CACF;AAED,MAAM,OAAO,QAAQ;IACF,MAAM,GAAG,YAAY,CAAC,SAAS,EAAE,UAAU,CAAC,CAAA;IAC5C,MAAM,CAAQ;IACd,MAAM,CAAQ;IACd,cAAc,CAAS;IACvB,MAAM,CAAW;IAElC,YAAY,OAAwB;QAClC,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;QAClD,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAA;QAC5B,IAAI,CAAC,cAAc,GAAG,OAAO,CAAC,cAAc,CAAA;QAC5C,IAAI,CAAC,MAAM,GAAG,IAAI,SAAS,CAAC;YAC1B,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,eAAe,EAAE,OAAO,CAAC,eAAe;YACxC,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,OAAO,EAAE,IAAI;SACd,CAAC,CAAA;IACJ,CAAC;IAED;;;OAGG;IACI,GAAG,CAAC,GAAW;QACpB,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAC7D,OAAO,IAAI,CAAC,cAAc;YACxB,CAAC,CAAC,GAAG,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,IAAI,IAAI,EAAE;YACzC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,IAAI,CAAC,MAAM,GAAG,CAAC,GAAG,IAAI,IAAI,EAAE,CAAA;IACnE,CAAC;IAEO,IAAI;QACV,OAAO,IAAI,CAAC,cAAc;YACxB,CAAC,CAAC,GAAG,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,EAAE;YACjC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,IAAI,CAAC,MAAM,GAAG,CAAC,CAAA;IACtD,CAAC;IAED,iGAAiG;IACzF,KAAK,CAAC,IAAI,CAAC,GAAW,EAAE,IAAiB,EAAE,KAAa;QAC9D,MAAM,MAAM,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,KAAK,CAAC,CAAC,WAAW,EAAE,CAAA;QACnD,MAAM,eAAe,GAAG,sBAAsB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;QAE1D,OAAO,SAAS,CACd,KAAK,IAAI,EAAE;YACT,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE;gBAC5C,GAAG,IAAI;gBACP,oFAAoF;gBACpF,mEAAmE;gBACnE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,kBAAkB,CAAC;aAChD,CAAC,CAAA;YAEF,yFAAyF;YACzF,yFAAyF;YACzF,8CAA8C;YAC9C,IAAI,QAAQ,CAAC,EAAE,IAAI,CAAC,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,eAAe,CAAC;gBAAE,OAAO,QAAQ,CAAA;YAEhF,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAA;YAClD,MAAM,IAAI,GAAG,uBAAuB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;YAEpD,4EAA4E;YAC5E,iFAAiF;YACjF,kEAAkE;YAClE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,KAAK,SAAS,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAA;YAE3F,MAAM,IAAI,cAAc,CACtB,GAAG,KAAK,YAAY,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,EACvF,QAAQ,CAAC,MAAM,EACf,IAAI,CACL,CAAA;QACH,CAAC,EACD;YACE,QAAQ,EAAE,CAAC;YACX,WAAW,EAAE,KAAK,CAAC,EAAE,CACnB,CAAC,CAAC,KAAK,YAAY,cAAc,CAAC,IAAI,gBAAgB,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC;YAC1E,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,CAC9B,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,0BAA0B,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;SAC1F,CACF,CAAA;IACH,CAAC;IAEM,KAAK,CAAC,GAAG,CACd,GAAW,EACX,IAAuC,EACvC,UAAuE,EAAE;QAEzE,MAAM,OAAO,GAA2B,EAAE,CAAA;QAC1C,IAAI,OAAO,CAAC,WAAW;YAAE,OAAO,CAAC,cAAc,CAAC,GAAG,OAAO,CAAC,WAAW,CAAA;QACtE,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,IAAI,EAAE,CAAC,EAAE,CAAC;YACnE,qFAAqF;YACrF,OAAO,CAAC,cAAc,IAAI,EAAE,CAAC,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAA;QAC3D,CAAC;QAED,MAAM,KAAK,CACT,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,IAAgB,EAAE,OAAO,EAAE,EAAE,OAAO,GAAG,EAAE,CAAC,CACjG,CAAA;IACH,CAAC;IAEM,KAAK,CAAC,GAAG,CAAC,GAAW;QAC1B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,OAAO,GAAG,EAAE,CAAC,CAAA;QAChF,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,QAAQ,CAAA;QAC5C,kEAAkE;QAClE,MAAM,KAAK,CAAC,QAAQ,CAAC,CAAA;QACrB,OAAO,IAAI,CAAA;IACb,CAAC;IAED,4EAA4E;IACrE,KAAK,CAAC,IAAI,CAAC,GAAW;QAC3B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,QAAQ,GAAG,EAAE,CAAC,CAAA;QAClF,MAAM,KAAK,CAAC,QAAQ,CAAC,CAAA;QACrB,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,IAAI,CAAA;QAExC,MAAM,QAAQ,GAA2B,EAAE,CAAA;QAC3C,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;YACvC,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;gBACjD,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC,GAAG,cAAc,CAAC,KAAK,CAAC,CAAA;YAClF,CAAC;QACH,CAAC,CAAC,CAAA;QAEF,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAA;IAChF,CAAC;IAED,6EAA6E;IACtE,KAAK,CAAC,MAAM,CAAC,GAAW;QAC7B,MAAM,KAAK,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,UAAU,GAAG,EAAE,CAAC,CAAC,CAAA;IACpF,CAAC;IAED;;;;;OAKG;IACI,KAAK,CAAC,UAAU,CAAC,IAAc,EAAE,WAAW,GAAG,EAAE;QACtD,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,KAAK,IAAI,WAAW,EAAE,CAAC;YAC9D,MAAM,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,GAAG,WAAW,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;QACxF,CAAC;IACH,CAAC;IAED,iCAAiC;IAC1B,KAAK,CAAC,IAAI,CACf,MAAc,EACd,UAAgD,EAAE;QAElD,MAAM,KAAK,GAAG,IAAI,eAAe,CAAC;YAChC,WAAW,EAAE,GAAG;YAChB,MAAM;YACN,eAAe,EAAE,KAAK;YACtB,UAAU,EAAE,MAAM,CAAC,OAAO,CAAC,OAAO,IAAI,IAAI,CAAC;SAC5C,CAAC,CAAA;QACF,IAAI,OAAO,CAAC,KAAK;YAAE,KAAK,CAAC,GAAG,CAAC,oBAAoB,EAAE,OAAO,CAAC,KAAK,CAAC,CAAA;QAEjE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAC9B,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,KAAK,CAAC,QAAQ,EAAE,EAAE,EACpC,EAAE,MAAM,EAAE,KAAK,EAAE,EACjB,QAAQ,MAAM,EAAE,CACjB,CAAA;QACD,OAAO,iBAAiB,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAA;IACjD,CAAC;IAED,yEAAyE;IAClE,KAAK,CAAC,OAAO,CAAC,MAAc;QACjC,MAAM,OAAO,GAAsB,EAAE,CAAA;QACrC,IAAI,KAAyB,CAAA;QAE7B,GAAG,CAAC;YACF,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,CAAC,CAAA;YAC/C,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,CAAA;YAC7B,KAAK,GAAG,IAAI,CAAC,SAAS,CAAA;QACxB,CAAC,QAAQ,KAAK,EAAC;QAEf,OAAO,OAAO,CAAA;IAChB,CAAC;IAED;;;;;;;OAOG;IACI,KAAK,CAAC,OAAO,CAAC,GAAW,EAAE,SAAiB;QACjD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAA;QAC7C,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,OAAO,IAAI,CAAC,IAAI,OAAO,GAAG,mBAAmB,EAAE,CAAC;YAC/E,MAAM,IAAI,KAAK,CACb,6DAA6D,mBAAmB,EAAE,CACnF,CAAA;QACH,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAA;QAClC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAA;QAEtD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE;YACpD,MAAM,EAAE,KAAK;YACb,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE;SACzB,CAAC,CAAA;QACF,OAAO,MAAM,CAAC,GAAG,CAAA;IACnB,CAAC;CACF;AAED;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAAC,GAAW;IAC3C,MAAM,OAAO,GAAsB,EAAE,CAAA;IAErC,KAAK,MAAM,KAAK,IAAI,GAAG,CAAC,QAAQ,CAAC,mCAAmC,CAAC,EAAE,CAAC;QACtE,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAA;QACtB,MAAM,GAAG,GAAG,wBAAwB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;QACrD,IAAI,GAAG,KAAK,SAAS;YAAE,SAAQ;QAE/B,OAAO,CAAC,IAAI,CAAC;YACX,GAAG,EAAE,kBAAkB,CAAC,GAAG,CAAC;YAC5B,2EAA2E;YAC3E,IAAI,EAAE,MAAM,CAAC,2BAA2B,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YAC/D,YAAY,EAAE,IAAI,IAAI,CAAC,0CAA0C,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;SACzF,CAAC,CAAA;IACJ,CAAC;IAED,MAAM,SAAS,GAAG,yCAAyC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IACrE,MAAM,KAAK,GAAG,4DAA4D,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;IAEzF,4FAA4F;IAC5F,8FAA8F;IAC9F,4FAA4F;IAC5F,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,IAAI,KAAK,CAAC,CAAC,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,CAAA;AACvF,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,KAAK,CAAC,QAAkB;IACrC,IAAI,CAAC;QACH,MAAM,QAAQ,CAAC,WAAW,EAAE,CAAA;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,4EAA4E;IAC9E,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,cAAc,CAAC,KAAa;IAC1C,IAAI,CAAC;QACH,OAAO,kBAAkB,CAAC,KAAK,CAAC,CAAA;IAClC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC"}

package/dist/adapters/s3-media/s3-media-adapter.d.ts

@@ -0,0 +1,118 @@
+/**
+ * S3-compatible media storage adapter.
+ *
+ * Talks SigV4 over HTTP, so it reaches R2 from a Node process, and MinIO, Backblaze B2, Spaces,
+ * Ceph or AWS from anywhere. `CloudflareR2Adapter` is the better choice *inside* a Worker — a
+ * binding is faster and needs no credentials — and the two share a key layout on purpose, so
+ * one bucket can be handed from a Worker to a Node server and back.
+ *
+ * The layout, identical to the R2 adapter's:
+ *
+ *   files/<id>              the bytes
+ *   meta/<id>.json          the record — the only authority for existence
+ *   variants/<id>/<name>    variant bytes, format in user metadata
+ *   index/...               the listing cache, see index-key.ts
+ *
+ * What differs, and why:
+ *
+ *  - **The listing is a join, not a sweep.** R2's `list()` can return `customMetadata`;
+ *    `ListObjectsV2` cannot return user metadata at all. So the sortable fields are encoded into
+ *    keys under `index/`, and `listMedia` enumerates ids from `meta/`, reads fields from the
+ *    index, and falls back to reading the record for any id the index does not cover.
+ *  - **The index must never be the enumeration.** Writes go bytes → record → index and deletes
+ *    reverse that, so an interrupted operation leaves a record with no index entry. If the index
+ *    were authoritative that file would exist and never be listed — a ghost. Enumerating from
+ *    `meta/` makes a missing entry cost one GET instead of hiding a file, and `cleanup()`
+ *    rebuilds it.
+ *  - **`listVariants` HEADs each variant.** The format lives in user metadata and a listing does
+ *    not carry it. A file has a handful of variants, so this is a handful of requests, and it
+ *    keeps the R2 invariant that variant keys carry no format — re-encoding a variant to another
+ *    format overwrites it instead of leaving both behind.
+ */
+import type { MediaFile, MediaMetadata } from '../../core/types/index.js';
+import type { MediaListOptions, MediaListResult, MediaStorageAdapter, MediaVariant } from '../../core/types/storage-adapters.js';
+import type { S3MediaAdapterConfig } from './types.js';
+export declare class S3MediaAdapter implements MediaStorageAdapter {
+    private readonly s3;
+    private readonly prefix;
+    private readonly publicBaseUrl?;
+    private readonly urlExpiry;
+    private readonly maxFileSize;
+    private readonly silent;
+    private readonly logger;
+    constructor(config: S3MediaAdapterConfig);
+    private fileKey;
+    private recordKey;
+    private variantKey;
+    private variantPrefix;
+    private recordPrefix;
+    uploadFile(file: File, metadata: MediaMetadata): Promise<MediaFile>;
+    getFile(id: string): Promise<MediaFile | null>;
+    updateFile(id: string, metadata: Record<string, any>): Promise<MediaFile>;
+    getFileContent(id: string): Promise<ArrayBuffer | null>;
+    getFileUrl(id: string, options?: {
+        expiresIn?: number;
+    }): Promise<string | null>;
+    fileExists(id: string): Promise<boolean>;
+    getFileSize(id: string): Promise<number | null>;
+    deleteFile(id: string): Promise<void>;
+    listMedia(options?: MediaListOptions): Promise<MediaListResult>;
+    saveVariantFile(parentId: string, variantName: string, buffer: Buffer, format: string): Promise<string>;
+    getVariantContent(parentId: string, variantName: string): Promise<ArrayBuffer | null>;
+    getVariantUrl(parentId: string, variantName: string, options?: {
+        expiresIn?: number;
+    }): Promise<string | null>;
+    listVariants(parentId: string): Promise<MediaVariant[]>;
+    deleteVariantFiles(parentId: string): Promise<void>;
+    deleteVariant(parentId: string, variantName: string): Promise<void>;
+    healthCheck(): Promise<boolean>;
+    getStorageInfo(): Promise<{
+        totalFiles: number;
+        totalSize: number;
+        availableSpace?: number;
+        usedSpace?: number;
+        [key: string]: unknown;
+    }>;
+    /**
+     * Reconcile the bucket against its records, which are the only authority.
+     *
+     * Three jobs, and the order they are listed in is the order of how much they matter:
+     *
+     *  1. **Rebuild missing index entries.** An upload interrupted after the record but before the
+     *     index — or a delete interrupted the other way — leaves a file that `getFile` serves and
+     *     no listing shows. `listMedia` already heals the symptom by reading the record; this
+     *     removes the cost.
+     *  2. **Drop orphaned bytes.** Anything under `files/` or `variants/` whose id has no record.
+     *  3. **Drop stale index entries.** Unreachable by an interruption under these write orders,
+     *     but reachable by a partial restore or by a re-upload whose old-entry delete failed.
+     *
+     * Returns the number of objects written or deleted.
+     */
+    cleanup(): Promise<number>;
+    private writeRecord;
+    private readRecord;
+    private writeIndexEntry;
+    /**
+     * Every index key for an id, whatever epoch it carries.
+     *
+     * One prefix listing rather than a sweep of the whole index — which is the entire reason the
+     * key puts the id before the timestamp. This runs on every upload.
+     */
+    private deleteIndexEntries;
+    private listRecordIds;
+    /**
+     * Every record in the bucket, with its listable fields.
+     *
+     * Two key-only listings — `meta/` for the ids, `index/` for the fields — joined by id. The
+     * records are the authority for *which* files exist; the index only saves reading them. An id
+     * the index does not cover (a bucket written by the R2 adapter, a hand-copied object, an
+     * interrupted upload) falls back to a real read, so it is never silently invisible.
+     */
+    private listIndex;
+    /** Every request here is a network round trip, so fan out — but not without a ceiling. */
+    private mapWithConcurrency;
+    private sortIndex;
+    private toMediaFile;
+    private validateMediaMetadata;
+}
+//# sourceMappingURL=s3-media-adapter.d.ts.map

package/dist/adapters/s3-media/s3-media-adapter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"s3-media-adapter.d.ts","sourceRoot":"","sources":["../../../src/adapters/s3-media/s3-media-adapter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAGH,OAAO,KAAK,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAA;AACzE,OAAO,KAAK,EACV,gBAAgB,EAChB,eAAe,EACf,mBAAmB,EACnB,YAAY,EACb,MAAM,sCAAsC,CAAA;AAS7C,OAAO,KAAK,EAAE,oBAAoB,EAAiB,MAAM,YAAY,CAAA;AAiBrE,qBAAa,cAAe,YAAW,mBAAmB;IACxD,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAU;IAC7B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAQ;IAC/B,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAQ;IACvC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAQ;IAClC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAQ;IACpC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA4C;gBAEvD,MAAM,EAAE,oBAAoB;IA+CxC,OAAO,CAAC,OAAO;IAIf,OAAO,CAAC,SAAS;IAIjB,OAAO,CAAC,UAAU;IAIlB,OAAO,CAAC,aAAa;IAIrB,OAAO,CAAC,YAAY;IAQP,UAAU,CAAC,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,aAAa,GAAG,OAAO,CAAC,SAAS,CAAC;IA4CnE,OAAO,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC;IAO9C,UAAU,CAAC,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO,CAAC,SAAS,CAAC;IAiDzE,cAAc,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;IAOvD,UAAU,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,GAAE;QAAE,SAAS,CAAC,EAAE,MAAM,CAAA;KAAO,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAUpF,UAAU,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAKxC,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAO/C,UAAU,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAwBrC,SAAS,CAAC,OAAO,GAAE,gBAAqB,GAAG,OAAO,CAAC,eAAe,CAAC;IAgDnE,eAAe,CAC1B,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,MAAM,CAAC;IA0BL,iBAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;IAQrF,aAAa,CACxB,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,MAAM,EACnB,OAAO,GAAE;QAAE,SAAS,CAAC,EAAE,MAAM,CAAA;KAAO,GACnC,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAUZ,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC;IAqBvD,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAanD,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAWnE,WAAW,IAAI,OAAO,CAAC,OAAO,CAAC;IAa/B,cAAc,IAAI,OAAO,CAAC;QACrC,UAAU,EAAE,MAAM,CAAA;QAClB,SAAS,EAAE,MAAM,CAAA;QACjB,cAAc,CAAC,EAAE,MAAM,CAAA;QACvB,SAAS,CAAC,EAAE,MAAM,CAAA;QAClB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;KACvB,CAAC;IAYF;;;;;;;;;;;;;;OAcG;IACU,OAAO,IAAI,OAAO,CAAC,MAAM,CAAC;YAoEzB,WAAW;YAMX,UAAU;YAcV,eAAe;IAI7B;;;;;OAKG;YACW,kBAAkB;YAKlB,aAAa;IAQ3B;;;;;;;OAOG;YACW,SAAS;IA+BvB,0FAA0F;YAC5E,kBAAkB;IAWhC,OAAO,CAAC,SAAS;IA6BjB,OAAO,CAAC,WAAW;IAiBnB,OAAO,CAAC,qBAAqB;CA4B9B"}