@uploadcn/server 0.0.0-stage → 0.1.0

package/dist/index.js

@@ -0,0 +1,579 @@
+import { n as sha256Hex, t as createUrlSigner } from "./signing-DZiuKRaJ.js";
+import { matchesAccept } from "@uploadcn/core";
+import { AwsClient } from "aws4fetch";
+//#region src/route.ts
+var UploadRouteError = class extends Error {
+	status;
+	code;
+	name = "UploadRouteError";
+	constructor(message, status = 400, code) {
+		super(message);
+		this.status = status;
+		this.code = code;
+	}
+};
+const MAX_PARTS = 1e4;
+function sanitizeFileName(name) {
+	return name.normalize("NFKD").replace(/[̀-ͯ]/g, "").replace(/[^\w.\- ]+/g, "").replace(/\s+/g, "-").replace(/^[.-]+/, "").slice(-120) || "file";
+}
+function json(data, status = 200) {
+	return new Response(JSON.stringify(data), {
+		status,
+		headers: {
+			"content-type": "application/json",
+			"cache-control": "no-store"
+		}
+	});
+}
+function isRecord(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function requireString(body, field) {
+	const value = body[field];
+	if (typeof value !== "string" || value.length === 0 || value.length > 1024) throw new UploadRouteError(`Invalid "${field}"`);
+	return value;
+}
+function requireFile(body) {
+	const file = body.file;
+	if (!isRecord(file)) throw new UploadRouteError("Invalid \"file\"");
+	const { name, type, size } = file;
+	if (typeof name !== "string" || typeof type !== "string" || typeof size !== "number") throw new UploadRouteError("Invalid \"file\"");
+	if (!Number.isSafeInteger(size) || size < 0) throw new UploadRouteError("Invalid file size");
+	return {
+		name: name.slice(0, 255),
+		type: type || "application/octet-stream",
+		size
+	};
+}
+function readMeta(body) {
+	return isRecord(body.meta) ? body.meta : {};
+}
+function parseRequest(body) {
+	if (!isRecord(body)) throw new UploadRouteError("Expected a JSON object");
+	const action = body.action;
+	switch (action) {
+		case "presign":
+		case "create-multipart": return {
+			action,
+			file: requireFile(body),
+			meta: readMeta(body)
+		};
+		case "complete": return {
+			action,
+			key: requireString(body, "key"),
+			file: requireFile(body),
+			meta: readMeta(body)
+		};
+		case "sign-part": {
+			const partNumber = body.partNumber;
+			if (typeof partNumber !== "number" || !Number.isInteger(partNumber) || partNumber < 1 || partNumber > MAX_PARTS) throw new UploadRouteError("Invalid \"partNumber\"");
+			return {
+				action,
+				key: requireString(body, "key"),
+				uploadId: requireString(body, "uploadId"),
+				partNumber
+			};
+		}
+		case "list-parts":
+		case "abort-multipart": return {
+			action,
+			key: requireString(body, "key"),
+			uploadId: requireString(body, "uploadId")
+		};
+		case "complete-multipart": {
+			const parts = body.parts;
+			if (!Array.isArray(parts) || parts.length === 0 || parts.length > MAX_PARTS) throw new UploadRouteError("Invalid \"parts\"");
+			return {
+				action,
+				key: requireString(body, "key"),
+				uploadId: requireString(body, "uploadId"),
+				file: requireFile(body),
+				meta: readMeta(body),
+				parts: parts.map((part) => {
+					if (!isRecord(part) || typeof part.partNumber !== "number" || typeof part.etag !== "string") throw new UploadRouteError("Invalid \"parts\"");
+					return {
+						partNumber: part.partNumber,
+						etag: part.etag
+					};
+				})
+			};
+		}
+		default: throw new UploadRouteError("Unknown \"action\"");
+	}
+}
+/**
+* A single POST endpoint that signs uploads for the browser's `s3Adapter`.
+* It speaks Web standard `Request`/`Response`, so it mounts directly in
+* Next.js route handlers, TanStack Start server routes, Hono, Remix, Bun,
+* Deno and Cloudflare Workers.
+*
+* @example
+* // app/api/upload/route.ts
+* export const { POST } = createUploadRoute({ storage: s3Storage({...}) })
+*/
+function createUploadRoute(options) {
+	const { storage } = options;
+	const expiresIn = options.expiresIn ?? 3600;
+	if (options.scan && !storage.getObject) throw new Error(`[uploadcn] scan needs a storage that can read objects; "${storage.name}" can't`);
+	async function scanObject(context, key, file, size) {
+		const scan = options.scan;
+		let result;
+		try {
+			if (scan.maxFileSize != null && (size ?? file.size) > scan.maxFileSize) result = {
+				status: "unknown",
+				threats: [],
+				scanner: scan.scanner.name,
+				details: { skipped: "too large" }
+			};
+			else {
+				const stream = await storage.getObject(key);
+				if (!stream) throw new UploadRouteError("Upload not found", 409);
+				result = await scan.scanner.scan({
+					stream,
+					file,
+					key,
+					signal: context.request.signal
+				});
+			}
+		} catch (error) {
+			if (error instanceof UploadRouteError) throw error;
+			console.error("[uploadcn] virus scan failed", error);
+			result = {
+				status: "unknown",
+				threats: [],
+				scanner: scan.scanner.name,
+				details: { error: error instanceof Error ? error.message : String(error) }
+			};
+		}
+		await scan.onResult?.({
+			...context,
+			key,
+			file,
+			result
+		});
+		if (result.status === "infected" || result.status === "unknown" && (scan.onUnknown ?? "reject") === "reject") {
+			await storage.deleteObject(key);
+			throw new UploadRouteError(result.status === "infected" ? "This file contains malware and was removed" : "This file couldn't be scanned and was removed", 422, "rejected");
+		}
+		return result;
+	}
+	function checkFile(file) {
+		if (options.maxFileSize != null && file.size > options.maxFileSize) throw new UploadRouteError("File is too large", 413);
+		if (options.allowedTypes && !matchesAccept(file, options.allowedTypes)) throw new UploadRouteError("File type is not allowed", 415);
+	}
+	async function finalize(context, key, file, meta, etag) {
+		let size;
+		if (options.verify ?? true) {
+			const info = await storage.headObject(key);
+			size = info?.size;
+			if (info === null) throw new UploadRouteError("Upload not found", 409);
+			if (info && options.maxFileSize != null && info.size > options.maxFileSize) {
+				await storage.deleteObject(key);
+				throw new UploadRouteError("File is too large", 413);
+			}
+			etag ??= info?.etag;
+		}
+		const scan = options.scan ? await scanObject(context, key, file, size) : void 0;
+		const url = await storage.getUrl(key);
+		const data = await options.onUploadComplete?.({
+			...context,
+			key,
+			url,
+			file,
+			meta,
+			scan
+		});
+		return {
+			key,
+			url,
+			etag,
+			...data === void 0 ? {} : { data },
+			...scan ? { scan: {
+				status: scan.status === "clean" ? "clean" : "unknown",
+				scanner: scan.scanner
+			} } : {}
+		};
+	}
+	async function handle(request) {
+		try {
+			if (request.method !== "POST") return json({ error: "Method not allowed" }, 405);
+			let body;
+			try {
+				body = await request.json();
+			} catch {
+				throw new UploadRouteError("Expected a JSON body");
+			}
+			const input = parseRequest(body);
+			const auth = await options.authorize?.({
+				request,
+				action: input.action,
+				key: "key" in input ? input.key : void 0
+			});
+			const context = {
+				request,
+				action: input.action,
+				auth
+			};
+			switch (input.action) {
+				case "presign": {
+					checkFile(input.file);
+					const key = await resolveKey(context, input.file, input.meta ?? {});
+					const signed = await storage.presignPut({
+						key,
+						contentType: input.file.type,
+						contentLength: input.file.size,
+						expiresIn
+					});
+					return json({
+						key,
+						url: signed.url,
+						method: "PUT",
+						headers: signed.headers
+					});
+				}
+				case "complete":
+					checkFile(input.file);
+					return json(await finalize(context, input.key, input.file, input.meta ?? {}));
+				case "create-multipart": {
+					checkFile(input.file);
+					const key = await resolveKey(context, input.file, input.meta ?? {});
+					const { uploadId } = await storage.createMultipart({
+						key,
+						contentType: input.file.type
+					});
+					return json({
+						key,
+						uploadId
+					});
+				}
+				case "sign-part": return json({ url: await storage.presignPart({
+					...input,
+					expiresIn
+				}) });
+				case "list-parts": return json({ parts: await storage.listParts(input) });
+				case "complete-multipart": {
+					checkFile(input.file);
+					const { etag } = await storage.completeMultipart(input);
+					return json(await finalize(context, input.key, input.file, input.meta ?? {}, etag));
+				}
+				case "abort-multipart":
+					await storage.abortMultipart(input);
+					return json({ ok: true });
+			}
+		} catch (error) {
+			if (error instanceof UploadRouteError) return json(error.code ? {
+				error: error.message,
+				code: error.code
+			} : { error: error.message }, error.status);
+			console.error("[uploadcn] upload route error", error);
+			return json({ error: "Upload failed" }, 500);
+		}
+	}
+	async function resolveKey(context, file, meta) {
+		if (options.getKey) return options.getKey({
+			...context,
+			file,
+			meta
+		});
+		return `${crypto.randomUUID()}/${sanitizeFileName(file.name)}`;
+	}
+	return {
+		POST: handle,
+		handler: handle
+	};
+}
+//#endregion
+//#region src/s3.ts
+function encodeKey(key) {
+	return key.split("/").map(encodeURIComponent).join("/");
+}
+function escapeXml(value) {
+	return value.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&apos;");
+}
+function unescapeXml(value) {
+	return value.replace(/&quot;/g, "\"").replace(/&apos;/g, "'").replace(/&lt;/g, "<").replace(/&gt;/g, ">").replace(/&amp;/g, "&");
+}
+function readTag(xml, tag) {
+	const match = xml.match(new RegExp(`<${tag}>([\\s\\S]*?)</${tag}>`));
+	return match ? unescapeXml(match[1]) : void 0;
+}
+function readAll(xml, tag) {
+	return [...xml.matchAll(new RegExp(`<${tag}>([\\s\\S]*?)</${tag}>`, "g"))].map((match) => match[1]);
+}
+var S3StorageError = class extends Error {
+	status;
+	code;
+	name = "S3StorageError";
+	constructor(message, status, code) {
+		super(message);
+		this.status = status;
+		this.code = code;
+	}
+};
+async function assertOk(response, operation) {
+	const body = await response.text();
+	if (response.ok && !body.includes("<Error>")) return body;
+	const code = readTag(body, "Code");
+	const message = readTag(body, "Message") ?? response.statusText;
+	throw new S3StorageError(`${operation} failed: ${code ?? response.status} ${message}`, response.status, code);
+}
+/**
+* Amazon S3 and any S3-compatible service, signed with SigV4 via aws4fetch.
+* Runs on Node, Bun, Deno, Cloudflare Workers and edge runtimes.
+*/
+function s3Storage(options) {
+	const client = new AwsClient({
+		accessKeyId: options.accessKeyId,
+		secretAccessKey: options.secretAccessKey,
+		sessionToken: options.sessionToken,
+		service: "s3",
+		region: options.region
+	});
+	const pathStyle = options.forcePathStyle ?? !!options.endpoint;
+	const endpoint = (options.endpoint ?? `https://s3.${options.region}.amazonaws.com`).replace(/\/+$/, "");
+	const readExpiry = options.readUrlExpiresIn ?? 3600;
+	function objectUrl(key, query = {}) {
+		const base = pathStyle ? `${endpoint}/${options.bucket}/${encodeKey(key)}` : `${endpoint.replace("://", `://${options.bucket}.`)}/${encodeKey(key)}`;
+		const url = new URL(base);
+		for (const [name, value] of Object.entries(query)) url.searchParams.set(name, value);
+		return url;
+	}
+	async function presign(method, url, expiresIn, headers = {}) {
+		url.searchParams.set("X-Amz-Expires", String(expiresIn));
+		return (await client.sign(new Request(url, {
+			method,
+			headers
+		}), { aws: {
+			signQuery: true,
+			allHeaders: true
+		} })).url;
+	}
+	return {
+		name: "s3",
+		async presignPut({ key, contentType, contentLength, expiresIn }) {
+			const signedHeaders = {
+				"content-type": contentType,
+				"content-length": String(contentLength)
+			};
+			return {
+				url: await presign("PUT", objectUrl(key), expiresIn, signedHeaders),
+				headers: { "content-type": contentType }
+			};
+		},
+		async createMultipart({ key, contentType }) {
+			const uploadId = readTag(await assertOk(await client.fetch(objectUrl(key, { uploads: "" }), {
+				method: "POST",
+				headers: { "content-type": contentType }
+			}), "CreateMultipartUpload"), "UploadId");
+			if (!uploadId) throw new S3StorageError("CreateMultipartUpload returned no UploadId", 502);
+			return { uploadId };
+		},
+		presignPart({ key, uploadId, partNumber, expiresIn }) {
+			return presign("PUT", objectUrl(key, {
+				partNumber: String(partNumber),
+				uploadId
+			}), expiresIn);
+		},
+		async listParts({ key, uploadId }) {
+			const parts = [];
+			let marker;
+			for (;;) {
+				const query = { uploadId };
+				if (marker) query["part-number-marker"] = marker;
+				const body = await assertOk(await client.fetch(objectUrl(key, query), { method: "GET" }), "ListParts");
+				for (const part of readAll(body, "Part")) parts.push({
+					partNumber: Number(readTag(part, "PartNumber")),
+					etag: readTag(part, "ETag") ?? "",
+					size: Number(readTag(part, "Size"))
+				});
+				if (readTag(body, "IsTruncated") !== "true") break;
+				marker = readTag(body, "NextPartNumberMarker");
+				if (!marker) break;
+			}
+			return parts;
+		},
+		async completeMultipart({ key, uploadId, parts }) {
+			const xml = "<CompleteMultipartUpload>" + [...parts].sort((a, b) => a.partNumber - b.partNumber).map((part) => `<Part><PartNumber>${part.partNumber}</PartNumber><ETag>${escapeXml(part.etag)}</ETag></Part>`).join("") + "</CompleteMultipartUpload>";
+			return { etag: readTag(await assertOk(await client.fetch(objectUrl(key, { uploadId }), {
+				method: "POST",
+				headers: { "content-type": "application/xml" },
+				body: xml
+			}), "CompleteMultipartUpload"), "ETag") };
+		},
+		async abortMultipart({ key, uploadId }) {
+			const response = await client.fetch(objectUrl(key, { uploadId }), { method: "DELETE" });
+			if (response.status !== 404) await assertOk(response, "AbortMultipartUpload");
+		},
+		async headObject(key) {
+			const response = await client.fetch(objectUrl(key), { method: "HEAD" });
+			if (response.status === 404) return null;
+			if (!response.ok) await assertOk(response, "HeadObject");
+			return {
+				size: Number(response.headers.get("content-length") ?? 0),
+				etag: response.headers.get("etag") ?? void 0,
+				contentType: response.headers.get("content-type") ?? void 0
+			};
+		},
+		async deleteObject(key) {
+			const response = await client.fetch(objectUrl(key), { method: "DELETE" });
+			if (response.status !== 404) await assertOk(response, "DeleteObject");
+		},
+		async getObject(key) {
+			const response = await client.fetch(objectUrl(key));
+			if (response.status === 404) return null;
+			if (!response.ok) await assertOk(response, "GetObject");
+			return response.body;
+		},
+		async getUrl(key) {
+			if (options.publicUrl) return `${options.publicUrl.replace(/\/+$/, "")}/${encodeKey(key)}`;
+			return presign("GET", objectUrl(key), readExpiry);
+		}
+	};
+}
+/** Cloudflare R2 through its S3-compatible API. */
+function r2Storage({ accountId, jurisdiction, ...options }) {
+	const host = jurisdiction ? `${accountId}.${jurisdiction}.r2.cloudflarestorage.com` : `${accountId}.r2.cloudflarestorage.com`;
+	return {
+		...s3Storage({
+			...options,
+			region: "auto",
+			endpoint: `https://${host}`,
+			forcePathStyle: true
+		}),
+		name: "r2"
+	};
+}
+//#endregion
+//#region src/memory.ts
+/**
+* A development storage that accepts uploads in-process and keeps only
+* metadata (size, ETag) — the bytes are discarded. It implements the full
+* presigned + multipart flow with HMAC-signed URLs, so you can build and
+* test upload UIs without cloud credentials. Not for production.
+*/
+function createMemoryStorage(options) {
+	const objects = /* @__PURE__ */ new Map();
+	const maxBodySize = options.maxBodySize ?? 5 * 1024 ** 3;
+	const { base, sign, verify } = createUrlSigner(options.secret, options.baseUrl);
+	const storage = {
+		name: "memory",
+		async presignPut({ key, contentType, contentLength, expiresIn }) {
+			return {
+				url: await sign({
+					key,
+					method: "PUT",
+					size: contentLength,
+					expires: Date.now() + expiresIn * 1e3
+				}),
+				headers: { "content-type": contentType }
+			};
+		},
+		async createMultipart() {
+			return { uploadId: crypto.randomUUID() };
+		},
+		presignPart({ key, uploadId, partNumber, expiresIn }) {
+			return sign({
+				key,
+				method: "PUT",
+				uploadId,
+				partNumber,
+				expires: Date.now() + expiresIn * 1e3
+			});
+		},
+		async listParts() {
+			return null;
+		},
+		async completeMultipart({ key, parts }) {
+			const size = parts.reduce((total, part) => total + Number(part.etag.replace(/"/g, "").split("-")[0]), 0);
+			const etag = `"${parts.length}-${size}"`;
+			objects.set(key, {
+				size,
+				etag
+			});
+			return { etag };
+		},
+		async abortMultipart() {},
+		async headObject(key) {
+			return objects.get(key);
+		},
+		async deleteObject(key) {
+			objects.delete(key);
+		},
+		async getUrl(key) {
+			return `${base}/${key.split("/").map(encodeURIComponent).join("/")}`;
+		}
+	};
+	/** Handles the signed PUT requests. Mount it at `baseUrl`. */
+	async function handler(request) {
+		if (request.method !== "PUT") return new Response("Method not allowed", {
+			status: 405,
+			headers: { allow: "PUT" }
+		});
+		const token = await verify(new URL(request.url).searchParams.get("token"));
+		if (!token || token.method !== "PUT") return new Response("Invalid or expired signature", { status: 403 });
+		if (Number(request.headers.get("content-length") ?? NaN) > maxBodySize) return new Response("Payload too large", { status: 413 });
+		const body = await request.arrayBuffer();
+		if (token.size != null && body.byteLength !== token.size) return new Response("Body size does not match the signed size", { status: 400 });
+		const etag = `"${body.byteLength}-${await sha256Hex(body)}"`;
+		if (token.uploadId == null) objects.set(token.key, {
+			size: body.byteLength,
+			etag,
+			contentType: request.headers.get("content-type") ?? void 0
+		});
+		return new Response(null, {
+			status: 200,
+			headers: {
+				etag,
+				"access-control-expose-headers": "ETag"
+			}
+		});
+	}
+	return {
+		storage,
+		handler
+	};
+}
+//#endregion
+//#region src/cloudinary.ts
+/**
+* Signs Cloudinary upload parameters with your API secret, for
+* `cloudinaryAdapter({ sign })`. Run it on the server only.
+*
+* @example
+* // app/api/cloudinary/route.ts
+* export async function POST(request: Request) {
+*   const params = await request.json()
+*   if (params.folder !== "avatars") return new Response(null, { status: 403 })
+*   return Response.json(
+*     await signCloudinaryParams(params, {
+*       apiKey: process.env.CLOUDINARY_API_KEY!,
+*       apiSecret: process.env.CLOUDINARY_API_SECRET!,
+*     })
+*   )
+* }
+*/
+async function signCloudinaryParams(params, { apiKey, apiSecret, timestamp = Math.floor(Date.now() / 1e3) }) {
+	if (!apiSecret) throw new Error("signCloudinaryParams needs an API secret");
+	const signed = {
+		...params,
+		timestamp
+	};
+	const excluded = /* @__PURE__ */ new Set([
+		"file",
+		"cloud_name",
+		"resource_type",
+		"api_key",
+		"signature"
+	]);
+	const payload = Object.keys(signed).filter((key) => !excluded.has(key) && signed[key] !== "").sort().map((key) => `${key}=${signed[key]}`).join("&");
+	const digest = await crypto.subtle.digest("SHA-1", new TextEncoder().encode(payload + apiSecret));
+	return {
+		signature: [...new Uint8Array(digest)].map((byte) => byte.toString(16).padStart(2, "0")).join(""),
+		timestamp,
+		apiKey
+	};
+}
+//#endregion
+export { S3StorageError, UploadRouteError, createMemoryStorage, createUploadRoute, r2Storage, s3Storage, sanitizeFileName, signCloudinaryParams };
+
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","names":[],"sources":["../src/route.ts","../src/s3.ts","../src/memory.ts","../src/cloudinary.ts"],"sourcesContent":["import {\n  type FileDescriptor,\n  type StoredObject,\n  type UploadRouteAction,\n  type UploadRouteRequest,\n  matchesAccept,\n} from \"@uploadcn/core\"\n\nimport type { ScanResult, Scanner } from \"./scan\"\nimport type { UploadStorage } from \"./storage\"\n\nexport class UploadRouteError extends Error {\n  override readonly name = \"UploadRouteError\"\n  constructor(\n    message: string,\n    readonly status = 400,\n    /** `\"rejected\"` tells the client the file itself was refused (no retry). */\n    readonly code?: \"rejected\"\n  ) {\n    super(message)\n  }\n}\n\nexport interface UploadScanOptions<TAuth> {\n  /** `clamavScanner()`, `virusTotalScanner()`, `httpScanner()` or your own. */\n  scanner: Scanner\n  /**\n   * What to do when the scanner can't decide, or fails: `\"reject\"` (default,\n   * fail closed) deletes the file; `\"allow\"` keeps it.\n   */\n  onUnknown?: \"reject\" | \"allow\"\n  /** Files larger than this (bytes) are not scanned and count as unknown. */\n  maxFileSize?: number\n  /** Every verdict, for logging, alerts or an audit trail. */\n  onResult?: (\n    context: UploadRouteContext<TAuth> & {\n      key: string\n      file: FileDescriptor\n      result: ScanResult\n    }\n  ) => void | Promise<void>\n}\n\nexport interface UploadRouteContext<TAuth> {\n  request: Request\n  action: UploadRouteAction\n  /** Value returned by `authorize`. */\n  auth: TAuth\n}\n\nexport interface UploadRouteOptions<TAuth = undefined> {\n  storage: UploadStorage\n  /**\n   * Runs before every action. Return a value (user, tenant…) to pass along,\n   * or throw `UploadRouteError` to deny. For multipart actions, `key` is\n   * provided so you can verify the caller owns it.\n   */\n  authorize?: (context: {\n    request: Request\n    action: UploadRouteAction\n    key?: string\n  }) => TAuth | Promise<TAuth>\n  /** Largest allowed file in bytes. Enforced by the signature for single PUTs. */\n  maxFileSize?: number\n  /** Allowed types, in `<input accept>` syntax (`image/*`, `.pdf`…). */\n  allowedTypes?: string | readonly string[]\n  /** Builds the object key. Default: `<uuid>/<sanitized file name>`. */\n  getKey?: (\n    context: UploadRouteContext<TAuth> & {\n      file: FileDescriptor\n      meta: Record<string, unknown>\n    }\n  ) => string | Promise<string>\n  /** Signed URL lifetime in seconds. Default 3600. */\n  expiresIn?: number\n  /**\n   * Called once an upload is stored, verified and (with `scan`) found clean:\n   * save metadata, trigger processing. The return value is sent to the\n   * client as `result.data`.\n   */\n  onUploadComplete?: (\n    context: UploadRouteContext<TAuth> & {\n      key: string\n      url: string\n      file: FileDescriptor\n      meta: Record<string, unknown>\n      /** The scan verdict, when `scan` is set. */\n      scan?: ScanResult\n    }\n  ) => unknown\n  /** Check that the object exists (HEAD) before completing. Default `true`. */\n  verify?: boolean\n  /**\n   * Scan every upload for malware before it completes. Infected files are\n   * deleted and the client sees the item as rejected. Requires a storage\n   * that can read objects (`s3Storage`, `r2Storage`, `createFileSystemStorage`).\n   */\n  scan?: UploadScanOptions<TAuth>\n}\n\nconst MAX_PARTS = 10_000\n\nexport function sanitizeFileName(name: string) {\n  const cleaned = name\n    .normalize(\"NFKD\")\n    .replace(/[̀-ͯ]/g, \"\")\n    .replace(/[^\\w.\\- ]+/g, \"\")\n    .replace(/\\s+/g, \"-\")\n    .replace(/^[.-]+/, \"\")\n    .slice(-120)\n  return cleaned || \"file\"\n}\n\nfunction json(data: unknown, status = 200) {\n  return new Response(JSON.stringify(data), {\n    status,\n    headers: {\n      \"content-type\": \"application/json\",\n      \"cache-control\": \"no-store\",\n    },\n  })\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n  return typeof value === \"object\" && value !== null && !Array.isArray(value)\n}\n\nfunction requireString(body: Record<string, unknown>, field: string) {\n  const value = body[field]\n  if (typeof value !== \"string\" || value.length === 0 || value.length > 1024) {\n    throw new UploadRouteError(`Invalid \"${field}\"`)\n  }\n  return value\n}\n\nfunction requireFile(body: Record<string, unknown>): FileDescriptor {\n  const file = body.file\n  if (!isRecord(file)) throw new UploadRouteError('Invalid \"file\"')\n  const { name, type, size } = file\n  if (\n    typeof name !== \"string\" ||\n    typeof type !== \"string\" ||\n    typeof size !== \"number\"\n  ) {\n    throw new UploadRouteError('Invalid \"file\"')\n  }\n  if (!Number.isSafeInteger(size) || size < 0)\n    throw new UploadRouteError(\"Invalid file size\")\n  return {\n    name: name.slice(0, 255),\n    type: type || \"application/octet-stream\",\n    size,\n  }\n}\n\nfunction readMeta(body: Record<string, unknown>) {\n  return isRecord(body.meta) ? body.meta : {}\n}\n\nfunction parseRequest(body: unknown): UploadRouteRequest {\n  if (!isRecord(body)) throw new UploadRouteError(\"Expected a JSON object\")\n  const action = body.action\n  switch (action) {\n    case \"presign\":\n    case \"create-multipart\":\n      return { action, file: requireFile(body), meta: readMeta(body) }\n    case \"complete\":\n      return {\n        action,\n        key: requireString(body, \"key\"),\n        file: requireFile(body),\n        meta: readMeta(body),\n      }\n    case \"sign-part\": {\n      const partNumber = body.partNumber\n      if (\n        typeof partNumber !== \"number\" ||\n        !Number.isInteger(partNumber) ||\n        partNumber < 1 ||\n        partNumber > MAX_PARTS\n      ) {\n        throw new UploadRouteError('Invalid \"partNumber\"')\n      }\n      return {\n        action,\n        key: requireString(body, \"key\"),\n        uploadId: requireString(body, \"uploadId\"),\n        partNumber,\n      }\n    }\n    case \"list-parts\":\n    case \"abort-multipart\":\n      return {\n        action,\n        key: requireString(body, \"key\"),\n        uploadId: requireString(body, \"uploadId\"),\n      }\n    case \"complete-multipart\": {\n      const parts = body.parts\n      if (\n        !Array.isArray(parts) ||\n        parts.length === 0 ||\n        parts.length > MAX_PARTS\n      ) {\n        throw new UploadRouteError('Invalid \"parts\"')\n      }\n      return {\n        action,\n        key: requireString(body, \"key\"),\n        uploadId: requireString(body, \"uploadId\"),\n        file: requireFile(body),\n        meta: readMeta(body),\n        parts: parts.map((part) => {\n          if (\n            !isRecord(part) ||\n            typeof part.partNumber !== \"number\" ||\n            typeof part.etag !== \"string\"\n          ) {\n            throw new UploadRouteError('Invalid \"parts\"')\n          }\n          return { partNumber: part.partNumber, etag: part.etag }\n        }),\n      }\n    }\n    default:\n      throw new UploadRouteError('Unknown \"action\"')\n  }\n}\n\n/**\n * A single POST endpoint that signs uploads for the browser's `s3Adapter`.\n * It speaks Web standard `Request`/`Response`, so it mounts directly in\n * Next.js route handlers, TanStack Start server routes, Hono, Remix, Bun,\n * Deno and Cloudflare Workers.\n *\n * @example\n * // app/api/upload/route.ts\n * export const { POST } = createUploadRoute({ storage: s3Storage({...}) })\n */\nexport function createUploadRoute<TAuth = undefined>(\n  options: UploadRouteOptions<TAuth>\n) {\n  const { storage } = options\n  const expiresIn = options.expiresIn ?? 3600\n  if (options.scan && !storage.getObject) {\n    throw new Error(\n      `[uploadcn] scan needs a storage that can read objects; \"${storage.name}\" can't`\n    )\n  }\n\n  async function scanObject(\n    context: UploadRouteContext<TAuth>,\n    key: string,\n    file: FileDescriptor,\n    size: number | undefined\n  ): Promise<ScanResult> {\n    const scan = options.scan!\n    let result: ScanResult\n    try {\n      if (scan.maxFileSize != null && (size ?? file.size) > scan.maxFileSize) {\n        result = {\n          status: \"unknown\",\n          threats: [],\n          scanner: scan.scanner.name,\n          details: { skipped: \"too large\" },\n        }\n      } else {\n        const stream = await storage.getObject!(key)\n        if (!stream) throw new UploadRouteError(\"Upload not found\", 409)\n        result = await scan.scanner.scan({\n          stream,\n          file,\n          key,\n          signal: context.request.signal,\n        })\n      }\n    } catch (error) {\n      if (error instanceof UploadRouteError) throw error\n      console.error(\"[uploadcn] virus scan failed\", error)\n      result = {\n        status: \"unknown\",\n        threats: [],\n        scanner: scan.scanner.name,\n        details: {\n          error: error instanceof Error ? error.message : String(error),\n        },\n      }\n    }\n    await scan.onResult?.({ ...context, key, file, result })\n    const reject =\n      result.status === \"infected\" ||\n      (result.status === \"unknown\" && (scan.onUnknown ?? \"reject\") === \"reject\")\n    if (reject) {\n      await storage.deleteObject(key)\n      throw new UploadRouteError(\n        result.status === \"infected\"\n          ? \"This file contains malware and was removed\"\n          : \"This file couldn't be scanned and was removed\",\n        422,\n        \"rejected\"\n      )\n    }\n    return result\n  }\n\n  function checkFile(file: FileDescriptor) {\n    if (options.maxFileSize != null && file.size > options.maxFileSize) {\n      throw new UploadRouteError(\"File is too large\", 413)\n    }\n    if (options.allowedTypes && !matchesAccept(file, options.allowedTypes)) {\n      throw new UploadRouteError(\"File type is not allowed\", 415)\n    }\n  }\n\n  async function finalize(\n    context: UploadRouteContext<TAuth>,\n    key: string,\n    file: FileDescriptor,\n    meta: Record<string, unknown>,\n    etag?: string\n  ): Promise<StoredObject> {\n    let size: number | undefined\n    if (options.verify ?? true) {\n      const info = await storage.headObject(key)\n      size = info?.size\n      if (info === null) throw new UploadRouteError(\"Upload not found\", 409)\n      if (\n        info &&\n        options.maxFileSize != null &&\n        info.size > options.maxFileSize\n      ) {\n        await storage.deleteObject(key)\n        throw new UploadRouteError(\"File is too large\", 413)\n      }\n      etag ??= info?.etag\n    }\n    const scan = options.scan\n      ? await scanObject(context, key, file, size)\n      : undefined\n    const url = await storage.getUrl(key)\n    const data = await options.onUploadComplete?.({\n      ...context,\n      key,\n      url,\n      file,\n      meta,\n      scan,\n    })\n    return {\n      key,\n      url,\n      etag,\n      ...(data === undefined ? {} : { data }),\n      ...(scan\n        ? {\n            scan: {\n              status: scan.status === \"clean\" ? \"clean\" : \"unknown\",\n              scanner: scan.scanner,\n            },\n          }\n        : {}),\n    }\n  }\n\n  async function handle(request: Request): Promise<Response> {\n    try {\n      if (request.method !== \"POST\") {\n        return json({ error: \"Method not allowed\" }, 405)\n      }\n      let body: unknown\n      try {\n        body = await request.json()\n      } catch {\n        throw new UploadRouteError(\"Expected a JSON body\")\n      }\n      const input = parseRequest(body)\n      const auth = (await options.authorize?.({\n        request,\n        action: input.action,\n        key: \"key\" in input ? input.key : undefined,\n      })) as TAuth\n      const context: UploadRouteContext<TAuth> = {\n        request,\n        action: input.action,\n        auth,\n      }\n\n      switch (input.action) {\n        case \"presign\": {\n          checkFile(input.file)\n          const key = await resolveKey(context, input.file, input.meta ?? {})\n          const signed = await storage.presignPut({\n            key,\n            contentType: input.file.type,\n            contentLength: input.file.size,\n            expiresIn,\n          })\n          return json({\n            key,\n            url: signed.url,\n            method: \"PUT\",\n            headers: signed.headers,\n          })\n        }\n        case \"complete\":\n          checkFile(input.file)\n          return json(\n            await finalize(context, input.key, input.file, input.meta ?? {})\n          )\n        case \"create-multipart\": {\n          checkFile(input.file)\n          const key = await resolveKey(context, input.file, input.meta ?? {})\n          const { uploadId } = await storage.createMultipart({\n            key,\n            contentType: input.file.type,\n          })\n          return json({ key, uploadId })\n        }\n        case \"sign-part\":\n          return json({\n            url: await storage.presignPart({ ...input, expiresIn }),\n          })\n        case \"list-parts\":\n          return json({ parts: await storage.listParts(input) })\n        case \"complete-multipart\": {\n          checkFile(input.file)\n          const { etag } = await storage.completeMultipart(input)\n          return json(\n            await finalize(\n              context,\n              input.key,\n              input.file,\n              input.meta ?? {},\n              etag\n            )\n          )\n        }\n        case \"abort-multipart\":\n          await storage.abortMultipart(input)\n          return json({ ok: true })\n      }\n    } catch (error) {\n      if (error instanceof UploadRouteError) {\n        return json(\n          error.code\n            ? { error: error.message, code: error.code }\n            : { error: error.message },\n          error.status\n        )\n      }\n      console.error(\"[uploadcn] upload route error\", error)\n      return json({ error: \"Upload failed\" }, 500)\n    }\n  }\n\n  async function resolveKey(\n    context: UploadRouteContext<TAuth>,\n    file: FileDescriptor,\n    meta: Record<string, unknown>\n  ) {\n    if (options.getKey) return options.getKey({ ...context, file, meta })\n    return `${crypto.randomUUID()}/${sanitizeFileName(file.name)}`\n  }\n\n  return { POST: handle, handler: handle }\n}\n","import { AwsClient } from \"aws4fetch\"\n\nimport type { PresignedRequest, StoragePart, UploadStorage } from \"./storage\"\n\nexport interface S3StorageOptions {\n  bucket: string\n  /** AWS region, or `\"auto\"` for R2. */\n  region: string\n  accessKeyId: string\n  secretAccessKey: string\n  sessionToken?: string\n  /**\n   * Custom endpoint for S3-compatible services (R2, MinIO, B2, Spaces…).\n   * Defaults to AWS.\n   */\n  endpoint?: string\n  /** Use `endpoint/bucket/key` URLs. Defaults to `true` with a custom endpoint. */\n  forcePathStyle?: boolean\n  /**\n   * Base URL for reading objects (a CDN or public bucket domain). Without\n   * it, `getUrl` returns a signed GET URL valid for `readUrlExpiresIn`.\n   */\n  publicUrl?: string\n  /** Seconds. Default 3600. */\n  readUrlExpiresIn?: number\n}\n\nfunction encodeKey(key: string) {\n  return key.split(\"/\").map(encodeURIComponent).join(\"/\")\n}\n\nfunction escapeXml(value: string) {\n  return value\n    .replace(/&/g, \"&amp;\")\n    .replace(/</g, \"&lt;\")\n    .replace(/>/g, \"&gt;\")\n    .replace(/\"/g, \"&quot;\")\n    .replace(/'/g, \"&apos;\")\n}\n\nfunction unescapeXml(value: string) {\n  return value\n    .replace(/&quot;/g, '\"')\n    .replace(/&apos;/g, \"'\")\n    .replace(/&lt;/g, \"<\")\n    .replace(/&gt;/g, \">\")\n    .replace(/&amp;/g, \"&\")\n}\n\nfunction readTag(xml: string, tag: string) {\n  const match = xml.match(new RegExp(`<${tag}>([\\\\s\\\\S]*?)</${tag}>`))\n  return match ? unescapeXml(match[1]!) : undefined\n}\n\nfunction readAll(xml: string, tag: string) {\n  return [\n    ...xml.matchAll(new RegExp(`<${tag}>([\\\\s\\\\S]*?)</${tag}>`, \"g\")),\n  ].map((match) => match[1]!)\n}\n\nexport class S3StorageError extends Error {\n  override readonly name = \"S3StorageError\"\n  constructor(\n    message: string,\n    readonly status: number,\n    readonly code?: string\n  ) {\n    super(message)\n  }\n}\n\nasync function assertOk(response: Response, operation: string) {\n  const body = await response.text()\n  // CompleteMultipartUpload can fail with a 200 and an <Error> body.\n  if (response.ok && !body.includes(\"<Error>\")) return body\n  const code = readTag(body, \"Code\")\n  const message = readTag(body, \"Message\") ?? response.statusText\n  throw new S3StorageError(\n    `${operation} failed: ${code ?? response.status} ${message}`,\n    response.status,\n    code\n  )\n}\n\n/**\n * Amazon S3 and any S3-compatible service, signed with SigV4 via aws4fetch.\n * Runs on Node, Bun, Deno, Cloudflare Workers and edge runtimes.\n */\nexport function s3Storage(options: S3StorageOptions): UploadStorage {\n  const client = new AwsClient({\n    accessKeyId: options.accessKeyId,\n    secretAccessKey: options.secretAccessKey,\n    sessionToken: options.sessionToken,\n    service: \"s3\",\n    region: options.region,\n  })\n  const pathStyle = options.forcePathStyle ?? !!options.endpoint\n  const endpoint = (\n    options.endpoint ?? `https://s3.${options.region}.amazonaws.com`\n  ).replace(/\\/+$/, \"\")\n  const readExpiry = options.readUrlExpiresIn ?? 3600\n\n  function objectUrl(key: string, query: Record<string, string> = {}) {\n    const base = pathStyle\n      ? `${endpoint}/${options.bucket}/${encodeKey(key)}`\n      : `${endpoint.replace(\"://\", `://${options.bucket}.`)}/${encodeKey(key)}`\n    const url = new URL(base)\n    for (const [name, value] of Object.entries(query))\n      url.searchParams.set(name, value)\n    return url\n  }\n\n  async function presign(\n    method: string,\n    url: URL,\n    expiresIn: number,\n    headers: Record<string, string> = {}\n  ): Promise<string> {\n    url.searchParams.set(\"X-Amz-Expires\", String(expiresIn))\n    const signed = await client.sign(new Request(url, { method, headers }), {\n      aws: { signQuery: true, allHeaders: true },\n    })\n    return signed.url\n  }\n\n  return {\n    name: \"s3\",\n\n    async presignPut({\n      key,\n      contentType,\n      contentLength,\n      expiresIn,\n    }): Promise<PresignedRequest> {\n      // Signing content-length makes S3 reject bodies of any other size.\n      const signedHeaders = {\n        \"content-type\": contentType,\n        \"content-length\": String(contentLength),\n      }\n      const url = await presign(\"PUT\", objectUrl(key), expiresIn, signedHeaders)\n      // Browsers set Content-Length themselves; only send Content-Type.\n      return { url, headers: { \"content-type\": contentType } }\n    },\n\n    async createMultipart({ key, contentType }) {\n      const response = await client.fetch(objectUrl(key, { uploads: \"\" }), {\n        method: \"POST\",\n        headers: { \"content-type\": contentType },\n      })\n      const body = await assertOk(response, \"CreateMultipartUpload\")\n      const uploadId = readTag(body, \"UploadId\")\n      if (!uploadId)\n        throw new S3StorageError(\n          \"CreateMultipartUpload returned no UploadId\",\n          502\n        )\n      return { uploadId }\n    },\n\n    presignPart({ key, uploadId, partNumber, expiresIn }) {\n      return presign(\n        \"PUT\",\n        objectUrl(key, { partNumber: String(partNumber), uploadId }),\n        expiresIn\n      )\n    },\n\n    async listParts({ key, uploadId }) {\n      const parts: StoragePart[] = []\n      let marker: string | undefined\n      for (;;) {\n        const query: Record<string, string> = { uploadId }\n        if (marker) query[\"part-number-marker\"] = marker\n        const response = await client.fetch(objectUrl(key, query), {\n          method: \"GET\",\n        })\n        const body = await assertOk(response, \"ListParts\")\n        for (const part of readAll(body, \"Part\")) {\n          parts.push({\n            partNumber: Number(readTag(part, \"PartNumber\")),\n            etag: readTag(part, \"ETag\") ?? \"\",\n            size: Number(readTag(part, \"Size\")),\n          })\n        }\n        if (readTag(body, \"IsTruncated\") !== \"true\") break\n        marker = readTag(body, \"NextPartNumberMarker\")\n        if (!marker) break\n      }\n      return parts\n    },\n\n    async completeMultipart({ key, uploadId, parts }) {\n      const xml =\n        \"<CompleteMultipartUpload>\" +\n        [...parts]\n          .sort((a, b) => a.partNumber - b.partNumber)\n          .map(\n            (part) =>\n              `<Part><PartNumber>${part.partNumber}</PartNumber><ETag>${escapeXml(part.etag)}</ETag></Part>`\n          )\n          .join(\"\") +\n        \"</CompleteMultipartUpload>\"\n      const response = await client.fetch(objectUrl(key, { uploadId }), {\n        method: \"POST\",\n        headers: { \"content-type\": \"application/xml\" },\n        body: xml,\n      })\n      const body = await assertOk(response, \"CompleteMultipartUpload\")\n      return { etag: readTag(body, \"ETag\") }\n    },\n\n    async abortMultipart({ key, uploadId }) {\n      const response = await client.fetch(objectUrl(key, { uploadId }), {\n        method: \"DELETE\",\n      })\n      // 404 means it is already gone, which is what we wanted.\n      if (response.status !== 404)\n        await assertOk(response, \"AbortMultipartUpload\")\n    },\n\n    async headObject(key) {\n      const response = await client.fetch(objectUrl(key), { method: \"HEAD\" })\n      if (response.status === 404) return null\n      if (!response.ok) await assertOk(response, \"HeadObject\")\n      return {\n        size: Number(response.headers.get(\"content-length\") ?? 0),\n        etag: response.headers.get(\"etag\") ?? undefined,\n        contentType: response.headers.get(\"content-type\") ?? undefined,\n      }\n    },\n\n    async deleteObject(key) {\n      const response = await client.fetch(objectUrl(key), { method: \"DELETE\" })\n      if (response.status !== 404) await assertOk(response, \"DeleteObject\")\n    },\n\n    async getObject(key) {\n      const response = await client.fetch(objectUrl(key))\n      if (response.status === 404) return null\n      if (!response.ok) await assertOk(response, \"GetObject\")\n      return response.body\n    },\n\n    async getUrl(key) {\n      if (options.publicUrl) {\n        return `${options.publicUrl.replace(/\\/+$/, \"\")}/${encodeKey(key)}`\n      }\n      return presign(\"GET\", objectUrl(key), readExpiry)\n    },\n  }\n}\n\nexport interface R2StorageOptions extends Omit<\n  S3StorageOptions,\n  \"region\" | \"endpoint\" | \"forcePathStyle\"\n> {\n  /** Your Cloudflare account id. */\n  accountId: string\n  /** `\"eu\"` or `\"fedramp\"` for jurisdiction-restricted buckets. */\n  jurisdiction?: \"eu\" | \"fedramp\"\n}\n\n/** Cloudflare R2 through its S3-compatible API. */\nexport function r2Storage({\n  accountId,\n  jurisdiction,\n  ...options\n}: R2StorageOptions): UploadStorage {\n  const host = jurisdiction\n    ? `${accountId}.${jurisdiction}.r2.cloudflarestorage.com`\n    : `${accountId}.r2.cloudflarestorage.com`\n  return {\n    ...s3Storage({\n      ...options,\n      region: \"auto\",\n      endpoint: `https://${host}`,\n      forcePathStyle: true,\n    }),\n    name: \"r2\",\n  }\n}\n","import { createUrlSigner, sha256Hex } from \"./signing\"\nimport type { StoredObjectInfo, UploadStorage } from \"./storage\"\n\nexport interface MemoryStorageOptions {\n  /**\n   * Absolute or root-relative URL where `handler` is mounted, e.g.\n   * `/api/storage`. Presigned URLs point here.\n   */\n  baseUrl: string\n  /** HMAC secret used to sign URLs. Use a random value per deployment. */\n  secret: string\n  /** Largest accepted request body, in bytes. Default 5 GiB. */\n  maxBodySize?: number\n}\n\n/**\n * A development storage that accepts uploads in-process and keeps only\n * metadata (size, ETag) — the bytes are discarded. It implements the full\n * presigned + multipart flow with HMAC-signed URLs, so you can build and\n * test upload UIs without cloud credentials. Not for production.\n */\nexport function createMemoryStorage(options: MemoryStorageOptions) {\n  const objects = new Map<string, StoredObjectInfo>()\n  const maxBodySize = options.maxBodySize ?? 5 * 1024 ** 3\n  const { base, sign, verify } = createUrlSigner(\n    options.secret,\n    options.baseUrl\n  )\n\n  const storage: UploadStorage = {\n    name: \"memory\",\n    async presignPut({ key, contentType, contentLength, expiresIn }) {\n      const url = await sign({\n        key,\n        method: \"PUT\",\n        size: contentLength,\n        expires: Date.now() + expiresIn * 1000,\n      })\n      return { url, headers: { \"content-type\": contentType } }\n    },\n    async createMultipart() {\n      return { uploadId: crypto.randomUUID() }\n    },\n    presignPart({ key, uploadId, partNumber, expiresIn }) {\n      return sign({\n        key,\n        method: \"PUT\",\n        uploadId,\n        partNumber,\n        expires: Date.now() + expiresIn * 1000,\n      })\n    },\n    // Parts are not tracked between requests; clients keep their own record.\n    async listParts() {\n      return null\n    },\n    async completeMultipart({ key, parts }) {\n      // Part ETags encode their size, so completion needs no stored state.\n      const size = parts.reduce(\n        (total, part) =>\n          total + Number(part.etag.replace(/\"/g, \"\").split(\"-\")[0]),\n        0\n      )\n      const etag = `\"${parts.length}-${size}\"`\n      objects.set(key, { size, etag })\n      return { etag }\n    },\n    async abortMultipart() {},\n    async headObject(key) {\n      return objects.get(key)\n    },\n    async deleteObject(key) {\n      objects.delete(key)\n    },\n    async getUrl(key) {\n      return `${base}/${key.split(\"/\").map(encodeURIComponent).join(\"/\")}`\n    },\n  }\n\n  /** Handles the signed PUT requests. Mount it at `baseUrl`. */\n  async function handler(request: Request): Promise<Response> {\n    if (request.method !== \"PUT\") {\n      return new Response(\"Method not allowed\", {\n        status: 405,\n        headers: { allow: \"PUT\" },\n      })\n    }\n    const token = await verify(new URL(request.url).searchParams.get(\"token\"))\n    if (!token || token.method !== \"PUT\")\n      return new Response(\"Invalid or expired signature\", { status: 403 })\n    const declared = Number(request.headers.get(\"content-length\") ?? NaN)\n    if (declared > maxBodySize)\n      return new Response(\"Payload too large\", { status: 413 })\n    const body = await request.arrayBuffer()\n    if (token.size != null && body.byteLength !== token.size) {\n      return new Response(\"Body size does not match the signed size\", {\n        status: 400,\n      })\n    }\n    const etag = `\"${body.byteLength}-${await sha256Hex(body)}\"`\n    if (token.uploadId == null) {\n      objects.set(token.key, {\n        size: body.byteLength,\n        etag,\n        contentType: request.headers.get(\"content-type\") ?? undefined,\n      })\n    }\n    return new Response(null, {\n      status: 200,\n      headers: { etag, \"access-control-expose-headers\": \"ETag\" },\n    })\n  }\n\n  return { storage, handler }\n}\n","/**\n * Signs Cloudinary upload parameters with your API secret, for\n * `cloudinaryAdapter({ sign })`. Run it on the server only.\n *\n * @example\n * // app/api/cloudinary/route.ts\n * export async function POST(request: Request) {\n *   const params = await request.json()\n *   if (params.folder !== \"avatars\") return new Response(null, { status: 403 })\n *   return Response.json(\n *     await signCloudinaryParams(params, {\n *       apiKey: process.env.CLOUDINARY_API_KEY!,\n *       apiSecret: process.env.CLOUDINARY_API_SECRET!,\n *     })\n *   )\n * }\n */\nexport async function signCloudinaryParams(\n  params: Record<string, string | number>,\n  {\n    apiKey,\n    apiSecret,\n    timestamp = Math.floor(Date.now() / 1000),\n  }: { apiKey: string; apiSecret: string; timestamp?: number }\n) {\n  if (!apiSecret) throw new Error(\"signCloudinaryParams needs an API secret\")\n  const signed: Record<string, string | number> = { ...params, timestamp }\n  // Cloudinary signs every parameter except these, sorted by name.\n  const excluded = new Set([\n    \"file\",\n    \"cloud_name\",\n    \"resource_type\",\n    \"api_key\",\n    \"signature\",\n  ])\n  const payload = Object.keys(signed)\n    .filter((key) => !excluded.has(key) && signed[key] !== \"\")\n    .sort()\n    .map((key) => `${key}=${signed[key]}`)\n    .join(\"&\")\n  const digest = await crypto.subtle.digest(\n    \"SHA-1\",\n    new TextEncoder().encode(payload + apiSecret)\n  )\n  const signature = [...new Uint8Array(digest)]\n    .map((byte) => byte.toString(16).padStart(2, \"0\"))\n    .join(\"\")\n  return { signature, timestamp, apiKey }\n}\n"],"mappings":";;;;AAWA,IAAa,mBAAb,cAAsC,MAAM;CAI/B;CAEA;CALX,OAAyB;CACzB,YACE,SACA,SAAkB,KAElB,MACA;EACA,MAAM,OAAO;EAJJ,KAAA,SAAA;EAEA,KAAA,OAAA;CAGX;AACF;AA+EA,MAAM,YAAY;AAElB,SAAgB,iBAAiB,MAAc;CAQ7C,OAPgB,KACb,UAAU,MAAM,CAAC,CACjB,QAAQ,UAAU,EAAE,CAAC,CACrB,QAAQ,eAAe,EAAE,CAAC,CAC1B,QAAQ,QAAQ,GAAG,CAAC,CACpB,QAAQ,UAAU,EAAE,CAAC,CACrB,MAAM,IACI,KAAK;AACpB;AAEA,SAAS,KAAK,MAAe,SAAS,KAAK;CACzC,OAAO,IAAI,SAAS,KAAK,UAAU,IAAI,GAAG;EACxC;EACA,SAAS;GACP,gBAAgB;GAChB,iBAAiB;EACnB;CACF,CAAC;AACH;AAEA,SAAS,SAAS,OAAkD;CAClE,OAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK;AAC5E;AAEA,SAAS,cAAc,MAA+B,OAAe;CACnE,MAAM,QAAQ,KAAK;CACnB,IAAI,OAAO,UAAU,YAAY,MAAM,WAAW,KAAK,MAAM,SAAS,MACpE,MAAM,IAAI,iBAAiB,YAAY,MAAM,EAAE;CAEjD,OAAO;AACT;AAEA,SAAS,YAAY,MAA+C;CAClE,MAAM,OAAO,KAAK;CAClB,IAAI,CAAC,SAAS,IAAI,GAAG,MAAM,IAAI,iBAAiB,kBAAgB;CAChE,MAAM,EAAE,MAAM,MAAM,SAAS;CAC7B,IACE,OAAO,SAAS,YAChB,OAAO,SAAS,YAChB,OAAO,SAAS,UAEhB,MAAM,IAAI,iBAAiB,kBAAgB;CAE7C,IAAI,CAAC,OAAO,cAAc,IAAI,KAAK,OAAO,GACxC,MAAM,IAAI,iBAAiB,mBAAmB;CAChD,OAAO;EACL,MAAM,KAAK,MAAM,GAAG,GAAG;EACvB,MAAM,QAAQ;EACd;CACF;AACF;AAEA,SAAS,SAAS,MAA+B;CAC/C,OAAO,SAAS,KAAK,IAAI,IAAI,KAAK,OAAO,CAAC;AAC5C;AAEA,SAAS,aAAa,MAAmC;CACvD,IAAI,CAAC,SAAS,IAAI,GAAG,MAAM,IAAI,iBAAiB,wBAAwB;CACxE,MAAM,SAAS,KAAK;CACpB,QAAQ,QAAR;EACE,KAAK;EACL,KAAK,oBACH,OAAO;GAAE;GAAQ,MAAM,YAAY,IAAI;GAAG,MAAM,SAAS,IAAI;EAAE;EACjE,KAAK,YACH,OAAO;GACL;GACA,KAAK,cAAc,MAAM,KAAK;GAC9B,MAAM,YAAY,IAAI;GACtB,MAAM,SAAS,IAAI;EACrB;EACF,KAAK,aAAa;GAChB,MAAM,aAAa,KAAK;GACxB,IACE,OAAO,eAAe,YACtB,CAAC,OAAO,UAAU,UAAU,KAC5B,aAAa,KACb,aAAa,WAEb,MAAM,IAAI,iBAAiB,wBAAsB;GAEnD,OAAO;IACL;IACA,KAAK,cAAc,MAAM,KAAK;IAC9B,UAAU,cAAc,MAAM,UAAU;IACxC;GACF;EACF;EACA,KAAK;EACL,KAAK,mBACH,OAAO;GACL;GACA,KAAK,cAAc,MAAM,KAAK;GAC9B,UAAU,cAAc,MAAM,UAAU;EAC1C;EACF,KAAK,sBAAsB;GACzB,MAAM,QAAQ,KAAK;GACnB,IACE,CAAC,MAAM,QAAQ,KAAK,KACpB,MAAM,WAAW,KACjB,MAAM,SAAS,WAEf,MAAM,IAAI,iBAAiB,mBAAiB;GAE9C,OAAO;IACL;IACA,KAAK,cAAc,MAAM,KAAK;IAC9B,UAAU,cAAc,MAAM,UAAU;IACxC,MAAM,YAAY,IAAI;IACtB,MAAM,SAAS,IAAI;IACnB,OAAO,MAAM,KAAK,SAAS;KACzB,IACE,CAAC,SAAS,IAAI,KACd,OAAO,KAAK,eAAe,YAC3B,OAAO,KAAK,SAAS,UAErB,MAAM,IAAI,iBAAiB,mBAAiB;KAE9C,OAAO;MAAE,YAAY,KAAK;MAAY,MAAM,KAAK;KAAK;IACxD,CAAC;GACH;EACF;EACA,SACE,MAAM,IAAI,iBAAiB,oBAAkB;CACjD;AACF;;;;;;;;;;;AAYA,SAAgB,kBACd,SACA;CACA,MAAM,EAAE,YAAY;CACpB,MAAM,YAAY,QAAQ,aAAa;CACvC,IAAI,QAAQ,QAAQ,CAAC,QAAQ,WAC3B,MAAM,IAAI,MACR,2DAA2D,QAAQ,KAAK,QAC1E;CAGF,eAAe,WACb,SACA,KACA,MACA,MACqB;EACrB,MAAM,OAAO,QAAQ;EACrB,IAAI;EACJ,IAAI;GACF,IAAI,KAAK,eAAe,SAAS,QAAQ,KAAK,QAAQ,KAAK,aACzD,SAAS;IACP,QAAQ;IACR,SAAS,CAAC;IACV,SAAS,KAAK,QAAQ;IACtB,SAAS,EAAE,SAAS,YAAY;GAClC;QACK;IACL,MAAM,SAAS,MAAM,QAAQ,UAAW,GAAG;IAC3C,IAAI,CAAC,QAAQ,MAAM,IAAI,iBAAiB,oBAAoB,GAAG;IAC/D,SAAS,MAAM,KAAK,QAAQ,KAAK;KAC/B;KACA;KACA;KACA,QAAQ,QAAQ,QAAQ;IAC1B,CAAC;GACH;EACF,SAAS,OAAO;GACd,IAAI,iBAAiB,kBAAkB,MAAM;GAC7C,QAAQ,MAAM,gCAAgC,KAAK;GACnD,SAAS;IACP,QAAQ;IACR,SAAS,CAAC;IACV,SAAS,KAAK,QAAQ;IACtB,SAAS,EACP,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAC9D;GACF;EACF;EACA,MAAM,KAAK,WAAW;GAAE,GAAG;GAAS;GAAK;GAAM;EAAO,CAAC;EAIvD,IAFE,OAAO,WAAW,cACjB,OAAO,WAAW,cAAc,KAAK,aAAa,cAAc,UACvD;GACV,MAAM,QAAQ,aAAa,GAAG;GAC9B,MAAM,IAAI,iBACR,OAAO,WAAW,aACd,+CACA,iDACJ,KACA,UACF;EACF;EACA,OAAO;CACT;CAEA,SAAS,UAAU,MAAsB;EACvC,IAAI,QAAQ,eAAe,QAAQ,KAAK,OAAO,QAAQ,aACrD,MAAM,IAAI,iBAAiB,qBAAqB,GAAG;EAErD,IAAI,QAAQ,gBAAgB,CAAC,cAAc,MAAM,QAAQ,YAAY,GACnE,MAAM,IAAI,iBAAiB,4BAA4B,GAAG;CAE9D;CAEA,eAAe,SACb,SACA,KACA,MACA,MACA,MACuB;EACvB,IAAI;EACJ,IAAI,QAAQ,UAAU,MAAM;GAC1B,MAAM,OAAO,MAAM,QAAQ,WAAW,GAAG;GACzC,OAAO,MAAM;GACb,IAAI,SAAS,MAAM,MAAM,IAAI,iBAAiB,oBAAoB,GAAG;GACrE,IACE,QACA,QAAQ,eAAe,QACvB,KAAK,OAAO,QAAQ,aACpB;IACA,MAAM,QAAQ,aAAa,GAAG;IAC9B,MAAM,IAAI,iBAAiB,qBAAqB,GAAG;GACrD;GACA,SAAS,MAAM;EACjB;EACA,MAAM,OAAO,QAAQ,OACjB,MAAM,WAAW,SAAS,KAAK,MAAM,IAAI,IACzC,KAAA;EACJ,MAAM,MAAM,MAAM,QAAQ,OAAO,GAAG;EACpC,MAAM,OAAO,MAAM,QAAQ,mBAAmB;GAC5C,GAAG;GACH;GACA;GACA;GACA;GACA;EACF,CAAC;EACD,OAAO;GACL;GACA;GACA;GACA,GAAI,SAAS,KAAA,IAAY,CAAC,IAAI,EAAE,KAAK;GACrC,GAAI,OACA,EACE,MAAM;IACJ,QAAQ,KAAK,WAAW,UAAU,UAAU;IAC5C,SAAS,KAAK;GAChB,EACF,IACA,CAAC;EACP;CACF;CAEA,eAAe,OAAO,SAAqC;EACzD,IAAI;GACF,IAAI,QAAQ,WAAW,QACrB,OAAO,KAAK,EAAE,OAAO,qBAAqB,GAAG,GAAG;GAElD,IAAI;GACJ,IAAI;IACF,OAAO,MAAM,QAAQ,KAAK;GAC5B,QAAQ;IACN,MAAM,IAAI,iBAAiB,sBAAsB;GACnD;GACA,MAAM,QAAQ,aAAa,IAAI;GAC/B,MAAM,OAAQ,MAAM,QAAQ,YAAY;IACtC;IACA,QAAQ,MAAM;IACd,KAAK,SAAS,QAAQ,MAAM,MAAM,KAAA;GACpC,CAAC;GACD,MAAM,UAAqC;IACzC;IACA,QAAQ,MAAM;IACd;GACF;GAEA,QAAQ,MAAM,QAAd;IACE,KAAK,WAAW;KACd,UAAU,MAAM,IAAI;KACpB,MAAM,MAAM,MAAM,WAAW,SAAS,MAAM,MAAM,MAAM,QAAQ,CAAC,CAAC;KAClE,MAAM,SAAS,MAAM,QAAQ,WAAW;MACtC;MACA,aAAa,MAAM,KAAK;MACxB,eAAe,MAAM,KAAK;MAC1B;KACF,CAAC;KACD,OAAO,KAAK;MACV;MACA,KAAK,OAAO;MACZ,QAAQ;MACR,SAAS,OAAO;KAClB,CAAC;IACH;IACA,KAAK;KACH,UAAU,MAAM,IAAI;KACpB,OAAO,KACL,MAAM,SAAS,SAAS,MAAM,KAAK,MAAM,MAAM,MAAM,QAAQ,CAAC,CAAC,CACjE;IACF,KAAK,oBAAoB;KACvB,UAAU,MAAM,IAAI;KACpB,MAAM,MAAM,MAAM,WAAW,SAAS,MAAM,MAAM,MAAM,QAAQ,CAAC,CAAC;KAClE,MAAM,EAAE,aAAa,MAAM,QAAQ,gBAAgB;MACjD;MACA,aAAa,MAAM,KAAK;KAC1B,CAAC;KACD,OAAO,KAAK;MAAE;MAAK;KAAS,CAAC;IAC/B;IACA,KAAK,aACH,OAAO,KAAK,EACV,KAAK,MAAM,QAAQ,YAAY;KAAE,GAAG;KAAO;IAAU,CAAC,EACxD,CAAC;IACH,KAAK,cACH,OAAO,KAAK,EAAE,OAAO,MAAM,QAAQ,UAAU,KAAK,EAAE,CAAC;IACvD,KAAK,sBAAsB;KACzB,UAAU,MAAM,IAAI;KACpB,MAAM,EAAE,SAAS,MAAM,QAAQ,kBAAkB,KAAK;KACtD,OAAO,KACL,MAAM,SACJ,SACA,MAAM,KACN,MAAM,MACN,MAAM,QAAQ,CAAC,GACf,IACF,CACF;IACF;IACA,KAAK;KACH,MAAM,QAAQ,eAAe,KAAK;KAClC,OAAO,KAAK,EAAE,IAAI,KAAK,CAAC;GAC5B;EACF,SAAS,OAAO;GACd,IAAI,iBAAiB,kBACnB,OAAO,KACL,MAAM,OACF;IAAE,OAAO,MAAM;IAAS,MAAM,MAAM;GAAK,IACzC,EAAE,OAAO,MAAM,QAAQ,GAC3B,MAAM,MACR;GAEF,QAAQ,MAAM,iCAAiC,KAAK;GACpD,OAAO,KAAK,EAAE,OAAO,gBAAgB,GAAG,GAAG;EAC7C;CACF;CAEA,eAAe,WACb,SACA,MACA,MACA;EACA,IAAI,QAAQ,QAAQ,OAAO,QAAQ,OAAO;GAAE,GAAG;GAAS;GAAM;EAAK,CAAC;EACpE,OAAO,GAAG,OAAO,WAAW,EAAE,GAAG,iBAAiB,KAAK,IAAI;CAC7D;CAEA,OAAO;EAAE,MAAM;EAAQ,SAAS;CAAO;AACzC;;;ACtbA,SAAS,UAAU,KAAa;CAC9B,OAAO,IAAI,MAAM,GAAG,CAAC,CAAC,IAAI,kBAAkB,CAAC,CAAC,KAAK,GAAG;AACxD;AAEA,SAAS,UAAU,OAAe;CAChC,OAAO,MACJ,QAAQ,MAAM,OAAO,CAAC,CACtB,QAAQ,MAAM,MAAM,CAAC,CACrB,QAAQ,MAAM,MAAM,CAAC,CACrB,QAAQ,MAAM,QAAQ,CAAC,CACvB,QAAQ,MAAM,QAAQ;AAC3B;AAEA,SAAS,YAAY,OAAe;CAClC,OAAO,MACJ,QAAQ,WAAW,IAAG,CAAC,CACvB,QAAQ,WAAW,GAAG,CAAC,CACvB,QAAQ,SAAS,GAAG,CAAC,CACrB,QAAQ,SAAS,GAAG,CAAC,CACrB,QAAQ,UAAU,GAAG;AAC1B;AAEA,SAAS,QAAQ,KAAa,KAAa;CACzC,MAAM,QAAQ,IAAI,MAAM,IAAI,OAAO,IAAI,IAAI,iBAAiB,IAAI,EAAE,CAAC;CACnE,OAAO,QAAQ,YAAY,MAAM,EAAG,IAAI,KAAA;AAC1C;AAEA,SAAS,QAAQ,KAAa,KAAa;CACzC,OAAO,CACL,GAAG,IAAI,SAAS,IAAI,OAAO,IAAI,IAAI,iBAAiB,IAAI,IAAI,GAAG,CAAC,CAClE,CAAC,CAAC,KAAK,UAAU,MAAM,EAAG;AAC5B;AAEA,IAAa,iBAAb,cAAoC,MAAM;CAI7B;CACA;CAJX,OAAyB;CACzB,YACE,SACA,QACA,MACA;EACA,MAAM,OAAO;EAHJ,KAAA,SAAA;EACA,KAAA,OAAA;CAGX;AACF;AAEA,eAAe,SAAS,UAAoB,WAAmB;CAC7D,MAAM,OAAO,MAAM,SAAS,KAAK;CAEjC,IAAI,SAAS,MAAM,CAAC,KAAK,SAAS,SAAS,GAAG,OAAO;CACrD,MAAM,OAAO,QAAQ,MAAM,MAAM;CACjC,MAAM,UAAU,QAAQ,MAAM,SAAS,KAAK,SAAS;CACrD,MAAM,IAAI,eACR,GAAG,UAAU,WAAW,QAAQ,SAAS,OAAO,GAAG,WACnD,SAAS,QACT,IACF;AACF;;;;;AAMA,SAAgB,UAAU,SAA0C;CAClE,MAAM,SAAS,IAAI,UAAU;EAC3B,aAAa,QAAQ;EACrB,iBAAiB,QAAQ;EACzB,cAAc,QAAQ;EACtB,SAAS;EACT,QAAQ,QAAQ;CAClB,CAAC;CACD,MAAM,YAAY,QAAQ,kBAAkB,CAAC,CAAC,QAAQ;CACtD,MAAM,YACJ,QAAQ,YAAY,cAAc,QAAQ,OAAO,gBAAA,CACjD,QAAQ,QAAQ,EAAE;CACpB,MAAM,aAAa,QAAQ,oBAAoB;CAE/C,SAAS,UAAU,KAAa,QAAgC,CAAC,GAAG;EAClE,MAAM,OAAO,YACT,GAAG,SAAS,GAAG,QAAQ,OAAO,GAAG,UAAU,GAAG,MAC9C,GAAG,SAAS,QAAQ,OAAO,MAAM,QAAQ,OAAO,EAAE,EAAE,GAAG,UAAU,GAAG;EACxE,MAAM,MAAM,IAAI,IAAI,IAAI;EACxB,KAAK,MAAM,CAAC,MAAM,UAAU,OAAO,QAAQ,KAAK,GAC9C,IAAI,aAAa,IAAI,MAAM,KAAK;EAClC,OAAO;CACT;CAEA,eAAe,QACb,QACA,KACA,WACA,UAAkC,CAAC,GAClB;EACjB,IAAI,aAAa,IAAI,iBAAiB,OAAO,SAAS,CAAC;EAIvD,QAAO,MAHc,OAAO,KAAK,IAAI,QAAQ,KAAK;GAAE;GAAQ;EAAQ,CAAC,GAAG,EACtE,KAAK;GAAE,WAAW;GAAM,YAAY;EAAK,EAC3C,CAAC,EAAA,CACa;CAChB;CAEA,OAAO;EACL,MAAM;EAEN,MAAM,WAAW,EACf,KACA,aACA,eACA,aAC4B;GAE5B,MAAM,gBAAgB;IACpB,gBAAgB;IAChB,kBAAkB,OAAO,aAAa;GACxC;GAGA,OAAO;IAAE,KAAA,MAFS,QAAQ,OAAO,UAAU,GAAG,GAAG,WAAW,aAAa;IAE3D,SAAS,EAAE,gBAAgB,YAAY;GAAE;EACzD;EAEA,MAAM,gBAAgB,EAAE,KAAK,eAAe;GAM1C,MAAM,WAAW,QAAQ,MADN,SAAS,MAJL,OAAO,MAAM,UAAU,KAAK,EAAE,SAAS,GAAG,CAAC,GAAG;IACnE,QAAQ;IACR,SAAS,EAAE,gBAAgB,YAAY;GACzC,CAAC,GACqC,uBAAuB,GAC9B,UAAU;GACzC,IAAI,CAAC,UACH,MAAM,IAAI,eACR,8CACA,GACF;GACF,OAAO,EAAE,SAAS;EACpB;EAEA,YAAY,EAAE,KAAK,UAAU,YAAY,aAAa;GACpD,OAAO,QACL,OACA,UAAU,KAAK;IAAE,YAAY,OAAO,UAAU;IAAG;GAAS,CAAC,GAC3D,SACF;EACF;EAEA,MAAM,UAAU,EAAE,KAAK,YAAY;GACjC,MAAM,QAAuB,CAAC;GAC9B,IAAI;GACJ,SAAS;IACP,MAAM,QAAgC,EAAE,SAAS;IACjD,IAAI,QAAQ,MAAM,wBAAwB;IAI1C,MAAM,OAAO,MAAM,SAAS,MAHL,OAAO,MAAM,UAAU,KAAK,KAAK,GAAG,EACzD,QAAQ,MACV,CAAC,GACqC,WAAW;IACjD,KAAK,MAAM,QAAQ,QAAQ,MAAM,MAAM,GACrC,MAAM,KAAK;KACT,YAAY,OAAO,QAAQ,MAAM,YAAY,CAAC;KAC9C,MAAM,QAAQ,MAAM,MAAM,KAAK;KAC/B,MAAM,OAAO,QAAQ,MAAM,MAAM,CAAC;IACpC,CAAC;IAEH,IAAI,QAAQ,MAAM,aAAa,MAAM,QAAQ;IAC7C,SAAS,QAAQ,MAAM,sBAAsB;IAC7C,IAAI,CAAC,QAAQ;GACf;GACA,OAAO;EACT;EAEA,MAAM,kBAAkB,EAAE,KAAK,UAAU,SAAS;GAChD,MAAM,MACJ,8BACA,CAAC,GAAG,KAAK,CAAC,CACP,MAAM,GAAG,MAAM,EAAE,aAAa,EAAE,UAAU,CAAC,CAC3C,KACE,SACC,qBAAqB,KAAK,WAAW,qBAAqB,UAAU,KAAK,IAAI,EAAE,eACnF,CAAC,CACA,KAAK,EAAE,IACV;GAOF,OAAO,EAAE,MAAM,QAAQ,MADJ,SAAS,MALL,OAAO,MAAM,UAAU,KAAK,EAAE,SAAS,CAAC,GAAG;IAChE,QAAQ;IACR,SAAS,EAAE,gBAAgB,kBAAkB;IAC7C,MAAM;GACR,CAAC,GACqC,yBAAyB,GAClC,MAAM,EAAE;EACvC;EAEA,MAAM,eAAe,EAAE,KAAK,YAAY;GACtC,MAAM,WAAW,MAAM,OAAO,MAAM,UAAU,KAAK,EAAE,SAAS,CAAC,GAAG,EAChE,QAAQ,SACV,CAAC;GAED,IAAI,SAAS,WAAW,KACtB,MAAM,SAAS,UAAU,sBAAsB;EACnD;EAEA,MAAM,WAAW,KAAK;GACpB,MAAM,WAAW,MAAM,OAAO,MAAM,UAAU,GAAG,GAAG,EAAE,QAAQ,OAAO,CAAC;GACtE,IAAI,SAAS,WAAW,KAAK,OAAO;GACpC,IAAI,CAAC,SAAS,IAAI,MAAM,SAAS,UAAU,YAAY;GACvD,OAAO;IACL,MAAM,OAAO,SAAS,QAAQ,IAAI,gBAAgB,KAAK,CAAC;IACxD,MAAM,SAAS,QAAQ,IAAI,MAAM,KAAK,KAAA;IACtC,aAAa,SAAS,QAAQ,IAAI,cAAc,KAAK,KAAA;GACvD;EACF;EAEA,MAAM,aAAa,KAAK;GACtB,MAAM,WAAW,MAAM,OAAO,MAAM,UAAU,GAAG,GAAG,EAAE,QAAQ,SAAS,CAAC;GACxE,IAAI,SAAS,WAAW,KAAK,MAAM,SAAS,UAAU,cAAc;EACtE;EAEA,MAAM,UAAU,KAAK;GACnB,MAAM,WAAW,MAAM,OAAO,MAAM,UAAU,GAAG,CAAC;GAClD,IAAI,SAAS,WAAW,KAAK,OAAO;GACpC,IAAI,CAAC,SAAS,IAAI,MAAM,SAAS,UAAU,WAAW;GACtD,OAAO,SAAS;EAClB;EAEA,MAAM,OAAO,KAAK;GAChB,IAAI,QAAQ,WACV,OAAO,GAAG,QAAQ,UAAU,QAAQ,QAAQ,EAAE,EAAE,GAAG,UAAU,GAAG;GAElE,OAAO,QAAQ,OAAO,UAAU,GAAG,GAAG,UAAU;EAClD;CACF;AACF;;AAaA,SAAgB,UAAU,EACxB,WACA,cACA,GAAG,WAC+B;CAClC,MAAM,OAAO,eACT,GAAG,UAAU,GAAG,aAAa,6BAC7B,GAAG,UAAU;CACjB,OAAO;EACL,GAAG,UAAU;GACX,GAAG;GACH,QAAQ;GACR,UAAU,WAAW;GACrB,gBAAgB;EAClB,CAAC;EACD,MAAM;CACR;AACF;;;;;;;;;ACnQA,SAAgB,oBAAoB,SAA+B;CACjE,MAAM,0BAAU,IAAI,IAA8B;CAClD,MAAM,cAAc,QAAQ,eAAe,IAAI,QAAQ;CACvD,MAAM,EAAE,MAAM,MAAM,WAAW,gBAC7B,QAAQ,QACR,QAAQ,OACV;CAEA,MAAM,UAAyB;EAC7B,MAAM;EACN,MAAM,WAAW,EAAE,KAAK,aAAa,eAAe,aAAa;GAO/D,OAAO;IAAE,KAAA,MANS,KAAK;KACrB;KACA,QAAQ;KACR,MAAM;KACN,SAAS,KAAK,IAAI,IAAI,YAAY;IACpC,CAAC;IACa,SAAS,EAAE,gBAAgB,YAAY;GAAE;EACzD;EACA,MAAM,kBAAkB;GACtB,OAAO,EAAE,UAAU,OAAO,WAAW,EAAE;EACzC;EACA,YAAY,EAAE,KAAK,UAAU,YAAY,aAAa;GACpD,OAAO,KAAK;IACV;IACA,QAAQ;IACR;IACA;IACA,SAAS,KAAK,IAAI,IAAI,YAAY;GACpC,CAAC;EACH;EAEA,MAAM,YAAY;GAChB,OAAO;EACT;EACA,MAAM,kBAAkB,EAAE,KAAK,SAAS;GAEtC,MAAM,OAAO,MAAM,QAChB,OAAO,SACN,QAAQ,OAAO,KAAK,KAAK,QAAQ,MAAM,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,GAC1D,CACF;GACA,MAAM,OAAO,IAAI,MAAM,OAAO,GAAG,KAAK;GACtC,QAAQ,IAAI,KAAK;IAAE;IAAM;GAAK,CAAC;GAC/B,OAAO,EAAE,KAAK;EAChB;EACA,MAAM,iBAAiB,CAAC;EACxB,MAAM,WAAW,KAAK;GACpB,OAAO,QAAQ,IAAI,GAAG;EACxB;EACA,MAAM,aAAa,KAAK;GACtB,QAAQ,OAAO,GAAG;EACpB;EACA,MAAM,OAAO,KAAK;GAChB,OAAO,GAAG,KAAK,GAAG,IAAI,MAAM,GAAG,CAAC,CAAC,IAAI,kBAAkB,CAAC,CAAC,KAAK,GAAG;EACnE;CACF;;CAGA,eAAe,QAAQ,SAAqC;EAC1D,IAAI,QAAQ,WAAW,OACrB,OAAO,IAAI,SAAS,sBAAsB;GACxC,QAAQ;GACR,SAAS,EAAE,OAAO,MAAM;EAC1B,CAAC;EAEH,MAAM,QAAQ,MAAM,OAAO,IAAI,IAAI,QAAQ,GAAG,CAAC,CAAC,aAAa,IAAI,OAAO,CAAC;EACzE,IAAI,CAAC,SAAS,MAAM,WAAW,OAC7B,OAAO,IAAI,SAAS,gCAAgC,EAAE,QAAQ,IAAI,CAAC;EAErE,IADiB,OAAO,QAAQ,QAAQ,IAAI,gBAAgB,KAAK,GACtD,IAAI,aACb,OAAO,IAAI,SAAS,qBAAqB,EAAE,QAAQ,IAAI,CAAC;EAC1D,MAAM,OAAO,MAAM,QAAQ,YAAY;EACvC,IAAI,MAAM,QAAQ,QAAQ,KAAK,eAAe,MAAM,MAClD,OAAO,IAAI,SAAS,4CAA4C,EAC9D,QAAQ,IACV,CAAC;EAEH,MAAM,OAAO,IAAI,KAAK,WAAW,GAAG,MAAM,UAAU,IAAI,EAAE;EAC1D,IAAI,MAAM,YAAY,MACpB,QAAQ,IAAI,MAAM,KAAK;GACrB,MAAM,KAAK;GACX;GACA,aAAa,QAAQ,QAAQ,IAAI,cAAc,KAAK,KAAA;EACtD,CAAC;EAEH,OAAO,IAAI,SAAS,MAAM;GACxB,QAAQ;GACR,SAAS;IAAE;IAAM,iCAAiC;GAAO;EAC3D,CAAC;CACH;CAEA,OAAO;EAAE;EAAS;CAAQ;AAC5B;;;;;;;;;;;;;;;;;;;;ACjGA,eAAsB,qBACpB,QACA,EACE,QACA,WACA,YAAY,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI,KAE1C;CACA,IAAI,CAAC,WAAW,MAAM,IAAI,MAAM,0CAA0C;CAC1E,MAAM,SAA0C;EAAE,GAAG;EAAQ;CAAU;CAEvE,MAAM,2BAAW,IAAI,IAAI;EACvB;EACA;EACA;EACA;EACA;CACF,CAAC;CACD,MAAM,UAAU,OAAO,KAAK,MAAM,CAAC,CAChC,QAAQ,QAAQ,CAAC,SAAS,IAAI,GAAG,KAAK,OAAO,SAAS,EAAE,CAAC,CACzD,KAAK,CAAC,CACN,KAAK,QAAQ,GAAG,IAAI,GAAG,OAAO,MAAM,CAAC,CACrC,KAAK,GAAG;CACX,MAAM,SAAS,MAAM,OAAO,OAAO,OACjC,SACA,IAAI,YAAY,CAAC,CAAC,OAAO,UAAU,SAAS,CAC9C;CAIA,OAAO;EAAE,WAHS,CAAC,GAAG,IAAI,WAAW,MAAM,CAAC,CAAC,CAC1C,KAAK,SAAS,KAAK,SAAS,EAAE,CAAC,CAAC,SAAS,GAAG,GAAG,CAAC,CAAC,CACjD,KAAK,EACS;EAAG;EAAW;CAAO;AACxC"}