@warlock.js/core 5.30.0 → 5.31.0

package/esm/router/types.d.mts

@@ -3,7 +3,7 @@ import { Response } from "../http/response.mjs";
 import { Request } from "../http/request.mjs";
 import { ReturnedResponse } from "../http/types.mjs";
 import { ResponseSchema } from "../resource/types.mjs";
-import { ObjectValidator } from "@warlock.js/seal";
+import { ObjectValidator, ValidationResult } from "@warlock.js/seal";
 import { GenericObject } from "@mongez/reinforcements";
 import { RouteShorthandOptions } from "fastify";
 
@@ -51,7 +51,54 @@ type RequestHandlerValidation<TRequest extends Request = Request> = {
    * schema expose their raw string params.
    */
   params?: ObjectValidator;
+  /**
+   * Shape the response when `schema` or `params` fails, instead of the
+   * framework's `{ errors: [...] }` body.
+   *
+   * Return `{ status?, body }`: `body` is sent as the response, with `status`
+   * or else `validation.response.status` (422 by default). Return `undefined`
+   * to fall back to the global `validation.response.body` hook, then the
+   * framework body. Wins over the global hook.
+   *
+   * Declare the body in the handler's `responseSchema` under the same status
+   * so `warlock generate.openapi` documents it.
+   *
+   * @example
+   * createImportController.validation = {
+   *   schema: importSchema,
+   *   onFailure: () => ({ status: 400, body: { error: "IMPORT_REQUEST_INVALID" } }),
+   * };
+   */
+  onFailure?: ValidationFailureHandler<TRequest>;
+};
+/**
+ * What a validation failure hook answers with.
+ */
+type ValidationFailureResponse = {
+  /**
+   * Response status. Defaults to `validation.response.status` (422).
+   */
+  status?: number;
+  /**
+   * Response body, sent as JSON.
+   */
+  body: unknown;
 };
+/**
+ * The second argument of a route's `validation.onFailure`.
+ */
+type ValidationFailureContext<TRequest extends Request = Request> = {
+  request: TRequest;
+  response: Response;
+  /**
+   * The route whose validation failed.
+   */
+  route: Route;
+};
+/**
+ * A route's `validation.onFailure` hook.
+ */
+type ValidationFailureHandler<TRequest extends Request = Request> = (result: ValidationResult, context: ValidationFailureContext<TRequest>) => ValidationFailureResponse | undefined | void | Promise<ValidationFailureResponse | undefined | void>;
 interface RequestControllerContract {
   /**
    * Request object
@@ -110,6 +157,37 @@ type RequestHandler<TRequest extends Request = Request> = {
    */
   responseSchema?: ResponseSchema;
 };
+/**
+ * A route's own rate limit: its own bucket and quota instead of the global
+ * `http.rateLimit` policy.
+ */
+type RouteRateLimitOptions = {
+  /**
+   * Max number of requests within the time window
+   */
+  max: number;
+  /**
+   * Time window in milliseconds
+   */
+  timeWindow: number;
+  /**
+   * Error message when rate limit is exceeded
+   */
+  errorMessage?: string;
+};
+/**
+ * Options for a static mount: `router.directory()`, `router.file()`,
+ * `router.cachedFile()`, `router.files()` and `router.cachedFiles()`.
+ */
+type StaticMountOptions = {
+  /**
+   * How the rate limiter treats this mount. Leave it unset to follow
+   * `http.rateLimit.staticFiles` (exempt by default); `true` counts the
+   * mount against the global limiter, `false` exempts it, and an object
+   * gives it its own limit and bucket.
+   */
+  rateLimit?: RouteRateLimitOptions | boolean;
+};
 interface RouteOptions {
   /**
    * Route middleware
@@ -170,22 +248,21 @@ interface RouteOptions {
    */
   isPage?: boolean;
   /**
-   * Rate limit options for this route
+   * How the rate limiter treats this route.
+   *
+   * - an object: the route gets its own limit and bucket instead of the
+   *   global `http.rateLimit` policy;
+   * - `false`: the route is exempt from the global limiter (development and
+   *   production alike);
+   * - `true`: the route stays under the global limiter. This is the default
+   *   for application routes; it puts a `router.file()` route back under the
+   *   global limiter when static files are exempt.
+   *
+   * @example
+   * router.post("/login", login, { rateLimit: { max: 5, timeWindow: 60_000 } });
+   * router.get("/webhooks/status", status, { rateLimit: false });
    */
-  rateLimit?: {
-    /**
-     * Max number of requests within the time window
-     */
-    max: number;
-    /**
-     * Time window in milliseconds
-     */
-    timeWindow: number;
-    /**
-     * Error message when rate limit is exceeded
-     */
-    errorMessage?: string;
-  };
+  rateLimit?: RouteRateLimitOptions | boolean;
   /**
    * Opt this route OUT of the default core CSRF-Origin guard
    * (`../http/csrf-default-guard.ts`, SECURITY card 8a752ab2) by passing
@@ -209,6 +286,20 @@ interface RouteOptions {
    * router.post("/oauth/callback", handler, { csrf: false });
    */
   csrf?: false;
+  /**
+   * Route-level validation, merged over the handler's own `validation`
+   * (keys set here win). Lets one handler serve several routes with different
+   * schemas or failure responses.
+   *
+   * @example
+   * router.post("/workspace-import", importWorkspace, {
+   *   validation: {
+   *     schema: importWorkspaceSchema,
+   *     onFailure: () => ({ status: 400, body: { error: "IMPORT_REQUEST_INVALID" } }),
+   *   },
+   * });
+   */
+  validation?: RequestHandlerValidation;
   /**
    * What this route's request log entries carry of its input, overriding
    * `http.logging`. Applied before any entry is built, so an omitted body or
@@ -220,6 +311,18 @@ interface RouteOptions {
    * });
    */
   logging?: RequestLoggingOptions;
+  /**
+   * Declare a mutating route (POST/PUT/PATCH/DELETE) intentionally reachable
+   * without signing in — a login, a webhook, a contact form. It changes
+   * nothing at runtime; it records the decision so `warlock dev` and
+   * `warlock check` (`WL9006`) stop reporting that the route has no auth
+   * middleware. A group's `public: true` applies to every route
+   * registered inside it. `warlock make endpoint --public` writes it.
+   *
+   * @example
+   * router.post("/auth/login", loginController, { public: true });
+   */
+  public?: boolean;
 }
 type RequestMethod = "GET" | "POST" | "PUT" | "DELETE" | "PATCH" | "OPTIONS" | "HEAD" | "all";
 /** Browser-safe snapshot metadata for a named application API route. */
@@ -280,6 +383,12 @@ type Route = RouteOptions & {
    * Rate limit
    */
   rateLimit?: RouteOptions["rateLimit"];
+  /**
+   * Set by `router.file()`, `router.cachedFile()`, `router.files()` and
+   * `router.cachedFiles()`: the route serves a static file, so it follows
+   * `http.rateLimit.staticFiles` unless it sets `rateLimit` itself.
+   */
+  $staticFile?: boolean;
 };
 type PartialPick<T, F extends keyof T> = Omit<T, F> & Partial<Pick<T, F>>;
 /**
@@ -299,6 +408,12 @@ type GroupedRoutesOptions = {
    * This will be added to each route as a name prefix
    */
   name?: string;
+  /**
+   * Mark every route in the group as intentionally reachable without
+   * signing in (see `RouteOptions.public`). A route's own `public: false`
+   * opts it back out.
+   */
+  public?: boolean;
 };
 /** Route resource */
 type RouteResource = {
@@ -356,11 +471,16 @@ type RouterStacks = {
   prefix: string[];
   name: string[];
   middleware: Middleware[];
+  /**
+   * Open `router.group({ public: true })` scopes; routes registered while any
+   * is open default to `public: true`.
+   */
+  public?: number;
   /**
    * Source file path for routes being added (for HMR route tracking)
    */
   sourceFile?: string;
 };
 //#endregion
-export { GroupedRoutesOptions, HttpContext, Middleware, MiddlewareResponse, NamedApiRoute, NamedApiRoutesOptions, PartialPick, RequestControllerContract, RequestHandler, RequestHandlerType, RequestHandlerValidation, RequestMethod, ResourceMethod, RestfulMiddleware, Route, RouteOptions, RouteResource, RouterGroupCallback, RouterStacks };
+export { GroupedRoutesOptions, HttpContext, Middleware, MiddlewareResponse, NamedApiRoute, NamedApiRoutesOptions, PartialPick, RequestControllerContract, RequestHandler, RequestHandlerType, RequestHandlerValidation, RequestMethod, ResourceMethod, RestfulMiddleware, Route, RouteOptions, RouteRateLimitOptions, RouteResource, RouterGroupCallback, RouterStacks, StaticMountOptions, ValidationFailureContext, ValidationFailureHandler, ValidationFailureResponse };
 //# sourceMappingURL=types.d.mts.map

package/esm/router/types.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.mts","names":[],"sources":["../../../../../../../../packages/core/src/router/types.ts"],"mappings":";;;;;;;;;;;;;KAUY,kBAAA,GAAqB,gBAAgB;;AAAjD;;;;AAAiD;KAQrC,UAAA,2BAAqC,OAAA,GAAU,OAAA;EAAA,CACxD,OAAA,EAAS,WAAA,CAAY,iBAAA,IAAqB,kBAAA;AAAA;AAAA,KAGjC,mBAAA;AAAA,KAEA,kBAAA,GAAqB,cAAA,SAAuB,aAAa;;;;KAKzD,cAAA;AAAA,KAEA,iBAAA,GAAoB,MAAM,UAAU,UAAA;AAAA,KAEpC,wBAAA,kBAA0C,OAAA,GAAU,OAAA;EAff;;;EAmB/C,QAAA,GAAW,UAAA,CAAW,QAAA;EAlBrB;;;AAA4D;AAG/D;EAqBE,UAAA;;;AArB6B;EAyB7B,MAAA,GAAS,eAAA;EAvBmB;;;AAAuC;AAKrE;;;EA0BE,MAAA,GAAS,eAAA;AAAA;AAAA,UAGM,yBAAA;EA3BY;;;EA+B3B,OAAA,EAAS,OAAA;EA7BC;;;EAiCV,QAAA,EAAU,QAAA;EAjCoD;;;EAqC9D,OAAA,IAAW,OAAA,CAAQ,gBAAA;EAfV;;;EAmBT,WAAA;EAzCoD;;;EA6CpD,UAAA,SAAmB,OAAA,CAAQ,kBAAA,IAAsB,kBAAA;AAAA;;;;;;;AAvBzB;KAiCd,WAAA,kBAA6B,OAAA,GAAU,OAAA;EA9BT;;;EAkCxC,OAAA,EAAS,QAAA;EAtBU;;;EA0BnB,QAAA,EAAU,QAAA;AAAA;AAAA,KAGA,cAAA,kBAAgC,OAAA,GAAU,OAAA;EArBe;;;EAAA,CAyBlE,OAAA,EAAS,WAAA,CAAY,QAAA,IAAY,gBAAA;EArCxB;;;EA0CV,UAAA,GAAa,wBAAA,CAAyB,QAAA;EAlCtC;;;EAuCA,WAAA;EAnCiD;;AAAkB;AAUrE;EA+BE,cAAA,GAAiB,cAAA;AAAA;AAAA,UAGF,YAAA;EAlCkC;;;EAsCjD,UAAA,GAAa,UAAA;EA9BK;;;EAkClB,oBAAA;EAtCA;;;EA0CA,IAAA;EAtCkB;AAAA;AAGpB;;EAwCE,WAAA;EAxC0C;;;;;;;;;;;;;;;;;;;;;;;;AAoBX;AAGjC;EA4CE,aAAA,GAAgB,qBAAA;;;;;;EAMhB,KAAA;EA9CA;;;EAkDA,OAAA;EArCA;;;EAyCA,MAAA;EAJA;;;EAQA,SAAA;IAQE;;;IAJA,GAAA;IA2CQ;;AAAqB;IAvC7B,UAAA;IA0CqB;;;IAtCrB,YAAA;EAAA;EA0CqB;;;;;;;;;;;;;;;;;AAUG;AAI5B;;;;EAhCE,IAAA;EAwCc;;;;;;;;;;EA7Bd,OAAA,GAAU,qBAAA;AAAA;AAAA,KAGA,aAAA;;KAIA,aAAA,GAAgB,QAAA;EAC1B,IAAA;EACA,IAAA;EACA,MAAA,EAAQ,aAAA;EAyBU;;;;;;EAlBlB,QAAA,GAAW,QAAA,CAAS,MAAA;AAAA;;KAIV,qBAAA,GAAwB,QAAA;EA0BlC;;;;EArBA,eAAA,IACE,MAAA,EAAQ,cAAA,EACR,KAAA,EAAO,KAAA,KACJ,QAAA,CAAS,MAAA;AAAA;;;AAuCU;KAjCd,KAAA,GAAQ,YAAA;EAoCG;;;EAhCrB,MAAA,EAAQ,aAAA;EAgC8C;;;EA5BtD,UAAA;EA4BmE;;;EAxBnE,IAAA;EAwBsB;;;;EAnBtB,OAAA,EAAS,cAAA;EAmB6C;;;;;EAbtD,OAAA;EAa4E;AAK9E;;;;EAZE,YAAA;EAgBa;;;EAZb,SAAA,GAAY,YAAA;AAAA;AAAA,KAGF,WAAA,oBAA+B,CAAA,IAAK,IAAA,CAAK,CAAA,EAAG,CAAA,IAAK,OAAA,CAAQ,IAAA,CAAK,CAAA,EAAG,CAAA;;;;KAKjE,oBAAA;EA6BD;;;EAzBT,UAAA,GAAa,UAAU;EAyCV;;;EArCb,MAAA;EAyDU;;;;EApDV,IAAA;AAAA;;KAIU,aAAA;EAYD;;;EART,IAAA,GAAO,cAAA;EAgBC;;;EAZR,GAAA,GAAM,cAAA;EAoBO;;;EAhBb,MAAA,GAAS,cAAA;EA4BP;;;EAxBF,MAAA,GAAS,cAAA;EAgCP;;;EA5BF,KAAA,GAAQ,cAAA;EAgCE;;;EA5BV,MAAA,GAAS,cAAA;EA6BT;;;EAzBA,UAAA,GAAa,cAAA;EA+Bb;;AAAU;EA3BV,UAAA;;;;IAIE,GAAA,GAAM,wBAAA;;;;IAIN,MAAA,GAAS,wBAAA;;;;IAIT,MAAA,GAAS,wBAAA;;;;IAIT,KAAA,GAAQ,wBAAA;EAAA;AAAA;AAAA,KAIA,YAAA;EACV,MAAA;EACA,IAAA;EACA,UAAA,EAAY,UAAU;;;;EAItB,UAAA;AAAA"}
+{"version":3,"file":"types.d.mts","names":[],"sources":["../../../../../../../../packages/core/src/router/types.ts"],"mappings":";;;;;;;;;;;;;KAUY,kBAAA,GAAqB,gBAAgB;;AAAjD;;;;AAAiD;KAQrC,UAAA,2BAAqC,OAAA,GAAU,OAAA;EAAA,CACxD,OAAA,EAAS,WAAA,CAAY,iBAAA,IAAqB,kBAAA;AAAA;AAAA,KAGjC,mBAAA;AAAA,KAEA,kBAAA,GAAqB,cAAA,SAAuB,aAAa;;;;KAKzD,cAAA;AAAA,KAEA,iBAAA,GAAoB,MAAM,UAAU,UAAA;AAAA,KAEpC,wBAAA,kBAA0C,OAAA,GAAU,OAAA;EAff;;;EAmB/C,QAAA,GAAW,UAAA,CAAW,QAAA;EAlBrB;;;AAA4D;AAG/D;EAqBE,UAAA;;;AArB6B;EAyB7B,MAAA,GAAS,eAAA;EAvBmB;;;AAAuC;AAKrE;;;EA0BE,MAAA,GAAS,eAAA;EA1Be;AAE1B;;;;AAA0D;AAE1D;;;;;;;;;;;;EAyCE,SAAA,GAAY,wBAAA,CAAyB,QAAA;AAAA;;;;KAM3B,yBAAA;EA3CY;;;EA+CtB,MAAA;EA7BA;;;EAiCA,IAAI;AAAA;;AAdyC;AAM/C;KAcY,wBAAA,kBAA0C,OAAA,GAAU,OAAA;EAC9D,OAAA,EAAS,QAAA;EACT,QAAA,EAAU,QAAA;EARN;AAMN;;EAME,KAAA,EAAO,KAAA;AAAA;;;;KAMG,wBAAA,kBAA0C,OAAA,GAAU,OAAA,KAC9D,MAAA,EAAQ,gBAAA,EACR,OAAA,EAAS,wBAAA,CAAyB,QAAA,MAEhC,yBAAA,sBAGA,OAAA,CAAQ,yBAAA;AAAA,UAEK,yBAAA;EAfH;;;EAmBZ,OAAA,EAAS,OAAA;EAxBT;;;EA4BA,QAAA,EAAU,QAAA;EAvBV;;;EA2BA,OAAA,IAAW,OAAA,CAAQ,gBAAA;EArBT;;;EAyBV,WAAA;EAzB8D;;;EA6B9D,UAAA,SAAmB,OAAA,CAAQ,kBAAA,IAAsB,kBAAA;AAAA;;;;;;;;KAUvC,WAAA,kBAA6B,OAAA,GAAU,OAAA;EAtCjD;;;EA0CA,OAAA,EAAS,QAAA;EAvCP;;;EA2CF,QAAA,EAAU,QAAA;AAAA;AAAA,KAGA,cAAA,kBAAgC,OAAA,GAAU,OAAA;EAzCZ;;;EAAA,CA6CvC,OAAA,EAAS,WAAA,CAAY,QAAA,IAAY,gBAAA;EAjCf;;;EAsCnB,UAAA,GAAa,wBAAA,CAAyB,QAAA;EA9BW;;;EAmCjD,WAAA;EAnDS;;;;EAyDT,cAAA,GAAiB,cAAA;AAAA;;;;;KAOP,qBAAA;EAhDyD;AAAA;AAUrE;EA0CE,GAAA;EA1CqB;;;EA8CrB,UAAA;EAtCU;;;EA0CV,YAAA;AAAA;;;;;KAOU,kBAAA;EAjDQ;AAAA;AAGpB;;;;EAqDE,SAAA,GAAY,qBAAqB;AAAA;AAAA,UAGlB,YAAA;EApDmB;;;EAwDlC,UAAA,GAAa,UAAA;EAxCkB;;;EA4C/B,oBAAA;EAhEoD;;;EAoEpD,IAAA;EAhEkC;;;;EAqElC,WAAA;EArDA;;;AAA+B;AAOjC;;;;;;;;AAYc;AAOd;;;;AAOmC;AAGnC;;;;;;;;EA4CE,aAAA,GAAgB,qBAAA;EA8Ee;;;;;EAxE/B,KAAA;EANA;;;EAUA,OAAA;EAIA;;;EAAA,MAAA;EAqDA;;;;;;AAuBM;AAGR;;;;AAAyB;AAWzB;;;EA1EE,SAAA,GAAY,qBAAA;EAoFQ;;;;;;;;;;;;;;AAAM;AAI5B;;;;;;;EAjEE,IAAA;EAiE0C;;;;;;;;;;;AAQtB;AAMtB;EAjEE,UAAA,GAAa,wBAAA;;;;;;;;;;;EAWb,OAAA,GAAU,qBAAA;EAkEV;;;;;;;;;AA2BW;AAGb;EApFE,MAAA;AAAA;AAAA,KAGU,aAAA;;KAWA,aAAA,GAAgB,QAAA;EAC1B,IAAA;EACA,IAAA;EACA,MAAA,EAAQ,aAAA;EAmE2D;;;;;;EA5DnE,QAAA,GAAW,QAAA,CAAS,MAAA;AAAA;;KAIV,qBAAA,GAAwB,QAAA;EAwDyB;;;;EAnD3D,eAAA,IACE,MAAA,EAAQ,cAAA,EACR,KAAA,EAAO,KAAA,KACJ,QAAA,CAAS,MAAA;AAAA;AAqDhB;;;AAAA,KA/CY,KAAA,GAAQ,YAAA;EAmDlB;;;EA/CA,MAAA,EAAQ,aAAA;EA8DR;;AAAM;EA1DN,UAAA;EA8DuB;;;EA1DvB,IAAA;EAsES;;;;EAjET,OAAA,EAAS,cAAA;EAyFD;;;;;EAnFR,OAAA;EAmDA;;;;;EA7CA,YAAA;EAyDA;;;EArDA,SAAA,GAAY,YAAA;EA6DZ;;;;;EAvDA,WAAA;AAAA;AAAA,KAGU,WAAA,oBAA+B,CAAA,IAAK,IAAA,CAAK,CAAA,EAAG,CAAA,IAAK,OAAA,CAAQ,IAAA,CAAK,CAAA,EAAG,CAAA;;;;KAKjE,oBAAA;EAuEA;;AAAwB;EAnElC,UAAA,GAAa,UAAU;EAuED;;;EAnEtB,MAAA;EAqEA;;;;EAhEA,IAAA;EA0EU;AAAA;;;;EApEV,MAAA;AAAA;;KAIU,aAAA;;;;EAIV,IAAA,GAAO,cAAA;;;;EAIP,GAAA,GAAM,cAAA;;;;EAIN,MAAA,GAAS,cAAA;;;;EAIT,MAAA,GAAS,cAAA;;;;EAIT,KAAA,GAAQ,cAAA;;;;EAIR,MAAA,GAAS,cAAA;;;;EAIT,UAAA,GAAa,cAAA;;;;EAIb,UAAA;;;;IAIE,GAAA,GAAM,wBAAA;;;;IAIN,MAAA,GAAS,wBAAA;;;;IAIT,MAAA,GAAS,wBAAA;;;;IAIT,KAAA,GAAQ,wBAAA;EAAA;AAAA;AAAA,KAIA,YAAA;EACV,MAAA;EACA,IAAA;EACA,UAAA,EAAY,UAAU;;;;;EAKtB,MAAA;;;;EAIA,UAAA;AAAA"}

package/esm/router/unguarded-route-diagnostics.d.mts

@@ -0,0 +1,40 @@
+import { Route } from "./types.mjs";
+import { log } from "@warlock.js/logger";
+
+//#region ../../packages/core/src/router/unguarded-route-diagnostics.d.ts
+/**
+ * Marks a middleware as an authentication guard. A registry symbol, so a copy
+ * of core loaded twice (a linked package next to an installed one) still
+ * recognises guards the other copy marked.
+ */
+declare const AUTH_GUARD_MARKER: unique symbol;
+/**
+ * Declare whether a middleware authenticates the request. `authMiddleware()`
+ * from `@warlock.js/auth` marks itself (and marks `{ optional: true }` as not
+ * a guard); use this for a hand-written guard whose name does not contain
+ * `auth` or `guard`.
+ *
+ * @example
+ * export const requireApiKey = markAuthGuard(async ({ request, response }) => {
+ *   if (request.headers["x-api-key"] !== env("API_KEY")) return response.unauthorized();
+ * });
+ */
+declare function markAuthGuard<T extends (...args: never[]) => unknown>(middleware: T, isGuard?: boolean): T;
+/**
+ * Whether a middleware authenticates the request: its {@link markAuthGuard}
+ * marker when it has one, otherwise a function name containing `auth` or
+ * `guard`.
+ */
+declare function isAuthGuardMiddleware(middleware: unknown): boolean;
+/** Whether a route mutates state, is not a page route, and is neither guarded nor public. */
+declare function isUnguardedMutatingRoute(route: Route): boolean;
+/**
+ * Warn, once per route per process, about every mutating route with no auth
+ * middleware and no `public: true`. Returns the routes it reported.
+ */
+declare function reportUnguardedMutatingRoutes(routes: readonly Route[], logger?: Pick<typeof log, "warn">): Route[];
+/** Forget what was reported (tests). */
+declare function resetUnguardedRouteReports(): void;
+//#endregion
+export { AUTH_GUARD_MARKER, isAuthGuardMiddleware, isUnguardedMutatingRoute, markAuthGuard, reportUnguardedMutatingRoutes, resetUnguardedRouteReports };
+//# sourceMappingURL=unguarded-route-diagnostics.d.mts.map

package/esm/router/unguarded-route-diagnostics.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"unguarded-route-diagnostics.d.mts","names":[],"sources":["../../../../../../../../packages/core/src/router/unguarded-route-diagnostics.ts"],"mappings":";;;;;;;;;cAuBa,iBAAA;AA+Bb;;;;AAAyD;AAUzD;;;;AAAqD;AAoBrD;AA9BA,iBAlBgB,aAAA,eAA4B,IAAA,uBAC1C,UAAA,EAAY,CAAA,EACZ,OAAA,aACC,CAAC;;;;;;iBAeY,qBAAA,CAAsB,UAAmB;;iBAUzC,wBAAA,CAAyB,KAAY,EAAL,KAAK;;;;;iBAoBrC,6BAAA,CACd,MAAA,WAAiB,KAAA,IACjB,MAAA,GAAQ,IAAA,QAAY,GAAA,YACnB,KAAA;;iBAsCa,0BAAA"}

package/esm/router/unguarded-route-diagnostics.mjs

@@ -0,0 +1,95 @@
+import { isAuthGuardName, isMutatingHttpMethod } from "./route-guard-names.mjs";
+import { log } from "@warlock.js/logger";
+
+//#region ../../packages/core/src/router/unguarded-route-diagnostics.ts
+/**
+* Development warning for mutating routes that nobody guarded.
+*
+* A POST/PUT/PATCH/DELETE route without auth middleware is reachable by anyone
+* who can reach the server. Sometimes that is the point (a login, a webhook, a
+* contact form) and sometimes it is a forgotten `guarded()` block. The router
+* cannot tell the two apart, so the app says which with `public: true`, and
+* `warlock dev` lists every mutating route that has neither.
+*
+* Warning only: routes register and behave exactly as before, nothing here
+* throws, and production never runs it. `warlock check` reports the same
+* routes from source as `WL9006`, before the app runs.
+*/
+/**
+* Marks a middleware as an authentication guard. A registry symbol, so a copy
+* of core loaded twice (a linked package next to an installed one) still
+* recognises guards the other copy marked.
+*/
+const AUTH_GUARD_MARKER = Symbol.for("warlock.js.authGuard");
+/**
+* Declare whether a middleware authenticates the request. `authMiddleware()`
+* from `@warlock.js/auth` marks itself (and marks `{ optional: true }` as not
+* a guard); use this for a hand-written guard whose name does not contain
+* `auth` or `guard`.
+*
+* @example
+* export const requireApiKey = markAuthGuard(async ({ request, response }) => {
+*   if (request.headers["x-api-key"] !== env("API_KEY")) return response.unauthorized();
+* });
+*/
+function markAuthGuard(middleware, isGuard = true) {
+	Object.defineProperty(middleware, AUTH_GUARD_MARKER, {
+		value: isGuard,
+		configurable: true,
+		enumerable: false
+	});
+	return middleware;
+}
+/**
+* Whether a middleware authenticates the request: its {@link markAuthGuard}
+* marker when it has one, otherwise a function name containing `auth` or
+* `guard`.
+*/
+function isAuthGuardMiddleware(middleware) {
+	if (typeof middleware !== "function") return false;
+	const marker = Reflect.get(middleware, AUTH_GUARD_MARKER);
+	if (typeof marker === "boolean") return marker;
+	return isAuthGuardName(middleware.name);
+}
+/** Whether a route mutates state, is not a page route, and is neither guarded nor public. */
+function isUnguardedMutatingRoute(route) {
+	if (!isMutatingHttpMethod(String(route.method))) return false;
+	if (route.isPage) return false;
+	if (route.public === true) return false;
+	return !(route.middleware ?? []).some(isAuthGuardMiddleware);
+}
+/** Routes already reported in this process, so an HMR reload does not repeat them. */
+const reported = /* @__PURE__ */ new Set();
+function routeKey(route) {
+	return `${String(route.method).toUpperCase()} ${route.path}`;
+}
+/**
+* Warn, once per route per process, about every mutating route with no auth
+* middleware and no `public: true`. Returns the routes it reported.
+*/
+function reportUnguardedMutatingRoutes(routes, logger = log) {
+	const fresh = routes.filter((route) => isUnguardedMutatingRoute(route) && !reported.has(routeKey(route)));
+	if (fresh.length === 0) return fresh;
+	for (const route of fresh) reported.add(routeKey(route));
+	const headline = fresh.length === 1 ? "1 mutating route has no auth middleware and is not marked public." : `${fresh.length} mutating routes have no auth middleware and are not marked public.`;
+	logger.warn({
+		module: "router",
+		action: "unguardedRoute",
+		message: `${headline} Anyone who can reach the server can call them. Add auth middleware (e.g. register them inside a guarded group), or pass { public: true } if they are meant to be open:\n` + fresh.map((route) => `  - ${routeKey(route)}${route.sourceFile ? ` (${route.sourceFile})` : ""}`).join("\n"),
+		context: { routes: fresh.map((route) => ({
+			method: route.method,
+			path: route.path,
+			name: route.name,
+			sourceFile: route.sourceFile
+		})) }
+	});
+	return fresh;
+}
+/** Forget what was reported (tests). */
+function resetUnguardedRouteReports() {
+	reported.clear();
+}
+
+//#endregion
+export { AUTH_GUARD_MARKER, isAuthGuardMiddleware, isUnguardedMutatingRoute, markAuthGuard, reportUnguardedMutatingRoutes, resetUnguardedRouteReports };
+//# sourceMappingURL=unguarded-route-diagnostics.mjs.map

package/esm/router/unguarded-route-diagnostics.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"unguarded-route-diagnostics.mjs","names":[],"sources":["../../../../../../../../packages/core/src/router/unguarded-route-diagnostics.ts"],"sourcesContent":["/**\n * Development warning for mutating routes that nobody guarded.\n *\n * A POST/PUT/PATCH/DELETE route without auth middleware is reachable by anyone\n * who can reach the server. Sometimes that is the point (a login, a webhook, a\n * contact form) and sometimes it is a forgotten `guarded()` block. The router\n * cannot tell the two apart, so the app says which with `public: true`, and\n * `warlock dev` lists every mutating route that has neither.\n *\n * Warning only: routes register and behave exactly as before, nothing here\n * throws, and production never runs it. `warlock check` reports the same\n * routes from source as `WL9006`, before the app runs.\n */\n\nimport { log } from \"@warlock.js/logger\";\nimport { isAuthGuardName, isMutatingHttpMethod } from \"./route-guard-names\";\nimport type { Route } from \"./types\";\n\n/**\n * Marks a middleware as an authentication guard. A registry symbol, so a copy\n * of core loaded twice (a linked package next to an installed one) still\n * recognises guards the other copy marked.\n */\nexport const AUTH_GUARD_MARKER: unique symbol = Symbol.for(\"warlock.js.authGuard\");\n\n/**\n * Declare whether a middleware authenticates the request. `authMiddleware()`\n * from `@warlock.js/auth` marks itself (and marks `{ optional: true }` as not\n * a guard); use this for a hand-written guard whose name does not contain\n * `auth` or `guard`.\n *\n * @example\n * export const requireApiKey = markAuthGuard(async ({ request, response }) => {\n *   if (request.headers[\"x-api-key\"] !== env(\"API_KEY\")) return response.unauthorized();\n * });\n */\nexport function markAuthGuard<T extends (...args: never[]) => unknown>(\n  middleware: T,\n  isGuard = true,\n): T {\n  Object.defineProperty(middleware, AUTH_GUARD_MARKER, {\n    value: isGuard,\n    configurable: true,\n    enumerable: false,\n  });\n\n  return middleware;\n}\n\n/**\n * Whether a middleware authenticates the request: its {@link markAuthGuard}\n * marker when it has one, otherwise a function name containing `auth` or\n * `guard`.\n */\nexport function isAuthGuardMiddleware(middleware: unknown): boolean {\n  if (typeof middleware !== \"function\") return false;\n\n  const marker: unknown = Reflect.get(middleware, AUTH_GUARD_MARKER);\n  if (typeof marker === \"boolean\") return marker;\n\n  return isAuthGuardName(middleware.name);\n}\n\n/** Whether a route mutates state, is not a page route, and is neither guarded nor public. */\nexport function isUnguardedMutatingRoute(route: Route): boolean {\n  if (!isMutatingHttpMethod(String(route.method))) return false;\n  // Page actions are authorized by the page itself (`requireUser()`).\n  if (route.isPage) return false;\n  if (route.public === true) return false;\n\n  return !(route.middleware ?? []).some(isAuthGuardMiddleware);\n}\n\n/** Routes already reported in this process, so an HMR reload does not repeat them. */\nconst reported = new Set<string>();\n\nfunction routeKey(route: Route): string {\n  return `${String(route.method).toUpperCase()} ${route.path}`;\n}\n\n/**\n * Warn, once per route per process, about every mutating route with no auth\n * middleware and no `public: true`. Returns the routes it reported.\n */\nexport function reportUnguardedMutatingRoutes(\n  routes: readonly Route[],\n  logger: Pick<typeof log, \"warn\"> = log,\n): Route[] {\n  const fresh = routes.filter(\n    (route) => isUnguardedMutatingRoute(route) && !reported.has(routeKey(route)),\n  );\n\n  if (fresh.length === 0) return fresh;\n\n  for (const route of fresh) reported.add(routeKey(route));\n\n  const headline =\n    fresh.length === 1\n      ? \"1 mutating route has no auth middleware and is not marked public.\"\n      : `${fresh.length} mutating routes have no auth middleware and are not marked public.`;\n\n  logger.warn({\n    module: \"router\",\n    action: \"unguardedRoute\",\n    message:\n      `${headline} Anyone who can reach the server can call them. Add auth middleware ` +\n      `(e.g. register them inside a guarded group), or pass { public: true } if they are ` +\n      `meant to be open:\\n` +\n      fresh\n        .map((route) => `  - ${routeKey(route)}${route.sourceFile ? ` (${route.sourceFile})` : \"\"}`)\n        .join(\"\\n\"),\n    context: {\n      routes: fresh.map((route) => ({\n        method: route.method,\n        path: route.path,\n        name: route.name,\n        sourceFile: route.sourceFile,\n      })),\n    },\n  });\n\n  return fresh;\n}\n\n/** Forget what was reported (tests). */\nexport function resetUnguardedRouteReports(): void {\n  reported.clear();\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAuBA,MAAa,oBAAmC,OAAO,IAAI,sBAAsB;;;;;;;;;;;;AAajF,SAAgB,cACd,YACA,UAAU,MACP;CACH,OAAO,eAAe,YAAY,mBAAmB;EACnD,OAAO;EACP,cAAc;EACd,YAAY;CACd,CAAC;CAED,OAAO;AACT;;;;;;AAOA,SAAgB,sBAAsB,YAA8B;CAClE,IAAI,OAAO,eAAe,YAAY,OAAO;CAE7C,MAAM,SAAkB,QAAQ,IAAI,YAAY,iBAAiB;CACjE,IAAI,OAAO,WAAW,WAAW,OAAO;CAExC,OAAO,gBAAgB,WAAW,IAAI;AACxC;;AAGA,SAAgB,yBAAyB,OAAuB;CAC9D,IAAI,CAAC,qBAAqB,OAAO,MAAM,MAAM,CAAC,GAAG,OAAO;CAExD,IAAI,MAAM,QAAQ,OAAO;CACzB,IAAI,MAAM,WAAW,MAAM,OAAO;CAElC,OAAO,EAAE,MAAM,cAAc,CAAC,EAAC,CAAE,KAAK,qBAAqB;AAC7D;;AAGA,MAAM,2BAAW,IAAI,IAAY;AAEjC,SAAS,SAAS,OAAsB;CACtC,OAAO,GAAG,OAAO,MAAM,MAAM,CAAC,CAAC,YAAY,EAAE,GAAG,MAAM;AACxD;;;;;AAMA,SAAgB,8BACd,QACA,SAAmC,KAC1B;CACT,MAAM,QAAQ,OAAO,QAClB,UAAU,yBAAyB,KAAK,KAAK,CAAC,SAAS,IAAI,SAAS,KAAK,CAAC,CAC7E;CAEA,IAAI,MAAM,WAAW,GAAG,OAAO;CAE/B,KAAK,MAAM,SAAS,OAAO,SAAS,IAAI,SAAS,KAAK,CAAC;CAEvD,MAAM,WACJ,MAAM,WAAW,IACb,sEACA,GAAG,MAAM,OAAO;CAEtB,OAAO,KAAK;EACV,QAAQ;EACR,QAAQ;EACR,SACE,GAAG,SAAS,6KAGZ,MACG,KAAK,UAAU,OAAO,SAAS,KAAK,IAAI,MAAM,aAAa,KAAK,MAAM,WAAW,KAAK,IAAI,CAAC,CAC3F,KAAK,IAAI;EACd,SAAS,EACP,QAAQ,MAAM,KAAK,WAAW;GAC5B,QAAQ,MAAM;GACd,MAAM,MAAM;GACZ,MAAM,MAAM;GACZ,YAAY,MAAM;EACpB,EAAE,EACJ;CACF,CAAC;CAED,OAAO;AACT;;AAGA,SAAgB,6BAAmC;CACjD,SAAS,MAAM;AACjB"}

package/esm/storage/drivers/cloud-driver.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"cloud-driver.d.mts","names":[],"sources":["../../../../../../../../../packages/core/src/storage/drivers/cloud-driver.ts"],"mappings":";;;;;;AA2DA;;;;AAAuC;AAuFvC;;iBAvFsB,MAAA,IAAU,OAAO;;;;;;;;;;;;;;;;;uBAuFjB,WAAA,kBACH,OAAA,CAAQ,yBAAA,IAA6B,yBAAA,aAC3C,0BAAA;EAyCe,OAAA,EAAS,QAAA;EA0QxB;;;EAAA,UA/SD,MAAA,EAAS,YAAA,qCAAiD,QAAA;EAgXzD;;;EAAA,UA3WD,WAAA;IACR,UAAA;IACA,cAAA;IACA,UAAA;IACA,iBAAA;EAAA;EAmhBmD;;;;;;EAAA,cA1gBvC,cAAA;EAsqBmC;;;;;EAAA,UA7pBvC,UAAA,CAAW,UAAA,GAAa,cAAA;cAUR,OAAA,EAAS,QAAA;EA6vBY;;;EAAA,kBA3sBtB,IAAA,EAAM,iBAAA;EA4yB0B;;;;EAAA,SAtyBzC,GAAA,CAAI,QAAA;EAjGT;;;;EAAA,UAuGD,WAAA;EAxGe;;;;;;;;;EAyHlB,WAAA,CAAY,QAAA;EA7GjB;;;;EAAA,UAqIQ,aAAA,CAAc,IAAA;EAjHU;;;;;;;;;;EAAA,UAkIlB,SAAA,IACd,SAAA,QAAiB,OAAA,CAAQ,CAAA,GACzB,aAAA,YACC,OAAA,CAAQ,CAAA;EA5CQ;;;;;;;;;;;;;;;;;;EAAA,UAkGT,gBAAA,CAAiB,KAAA;EAuCxB;;;EAJU,GAAA,CACX,IAAA,EAAM,MAAA,EACN,QAAA,UACA,OAAA,GAAU,UAAA,GACT,OAAA,CAAQ,oBAAA;EA+CT;;;;;;;;EADW,WAAA,CACX,IAAA,EAAM,MAAA,WACN,QAAA,UACA,OAAA,GAAU,UAAA,GACT,OAAA,CAAQ,oBAAA;EA+DT;;;;EAFW,SAAA,CACX,MAAA,EAAQ,QAAA,EACR,QAAA,UACA,OAAA,GAAU,UAAA,GACT,OAAA,CAAQ,oBAAA;EAgDE;;;EAAA,GAAA,CAAI,QAAA,WAAmB,OAAA,CAAQ,MAAA;EAyB/B;;;EAAA,SAAA,CAAU,QAAA,WAAmB,OAAA,CAAQ,QAAA;EAyBrC;;;EAAA,MAAA,CAAO,QAAA,WAAmB,OAAA;EAqBf;;;EAAX,UAAA,CAAW,SAAA,aAAsB,OAAA,CAAQ,gBAAA;EAqDzB;;;;;;;;;EAAhB,eAAA,CAAgB,aAAA,WAAwB,OAAA;EAuGxB;;;EA7ChB,MAAA,CAAO,QAAA,WAAmB,OAAA;EAmE1B;;;EA7BA,YAAA,CAAa,QAAA,UAAkB,SAAA,YAAmB,OAAA;EAgC5D;;;EAzBU,eAAA,CAAgB,QAAA,UAAkB,OAAA,GAAU,gBAAA,GAAmB,OAAA;EAqD3B;;;EA/BpC,qBAAA,CACX,QAAA,UACA,OAAA,GAAU,sBAAA,GACT,OAAA;EAuEO;;;EA3CG,QAAA,CAAS,QAAA,WAAmB,OAAA,CAAQ,eAAA;EAoDjB;;;EArBnB,IAAA,CAAK,QAAA,WAAmB,OAAA;EAkEnB;;;EAAA,UAtDR,UAAA,CAAW,GAAA;EA+DR;;;EAtDA,IAAA,CAAK,IAAA,UAAc,EAAA,WAAa,OAAA,CAAQ,oBAAA;EAsDQ;;;EAThD,IAAA,CAAK,IAAA,UAAc,EAAA,WAAa,OAAA,CAAQ,oBAAA;EAoFxC;;;EA3EA,IAAA,CAAK,SAAA,UAAmB,OAAA,GAAU,WAAA,GAAc,OAAA,CAAQ,eAAA;EAiGxD;;;EApCN,SAAA;EAoCmE;;;EA7BnE,SAAA;EAqD+C;;;EA9CzC,eAAA,CAAgB,QAAA,UAAkB,YAAA,WAAuB,OAAA;EAqF5D;;;EA/DG,aAAA,CAAc,QAAA,UAAkB,UAAA,EAAY,cAAA,GAAiB,OAAA;;;;EAwB7D,aAAA,CAAc,QAAA,WAAmB,OAAA,CAAQ,cAAA;;;;YAgC5C,aAAA,CAAc,MAAA,EAAQ,MAAA;;;;YAOtB,aAAA,CAAc,QAAA;AAAA"}
+{"version":3,"file":"cloud-driver.d.mts","names":[],"sources":["../../../../../../../../../packages/core/src/storage/drivers/cloud-driver.ts"],"mappings":";;;;;;AA2DA;;;;AAAuC;AAuFvC;;iBAvFsB,MAAA,IAAU,OAAO;;;;;;;;;;;;;;;;;uBAuFjB,WAAA,kBACH,OAAA,CAAQ,yBAAA,IAA6B,yBAAA,aAC3C,0BAAA;EAyCe,OAAA,EAAS,QAAA;EA0QxB;;;EAAA,UA/SD,MAAA,EAAS,YAAA,qCAAiD,QAAA;EAgXzD;;;EAAA,UA3WD,WAAA;IACR,UAAA;IACA,cAAA;IACA,UAAA;IACA,iBAAA;EAAA;EAmhBmD;;;;;;EAAA,cA1gBvC,cAAA;EAsqBmC;;;;;EAAA,UA7pBvC,UAAA,CAAW,UAAA,GAAa,cAAA;cAUR,OAAA,EAAS,QAAA;EA8vBY;;;EAAA,kBA5sBtB,IAAA,EAAM,iBAAA;EA6yB0B;;;;EAAA,SAvyBzC,GAAA,CAAI,QAAA;EAjGT;;;;EAAA,UAuGD,WAAA;EAxGe;;;;;;;;;EAyHlB,WAAA,CAAY,QAAA;EA7GjB;;;;EAAA,UAqIQ,aAAA,CAAc,IAAA;EAjHU;;;;;;;;;;EAAA,UAkIlB,SAAA,IACd,SAAA,QAAiB,OAAA,CAAQ,CAAA,GACzB,aAAA,YACC,OAAA,CAAQ,CAAA;EA5CQ;;;;;;;;;;;;;;;;;;EAAA,UAkGT,gBAAA,CAAiB,KAAA;EAuCxB;;;EAJU,GAAA,CACX,IAAA,EAAM,MAAA,EACN,QAAA,UACA,OAAA,GAAU,UAAA,GACT,OAAA,CAAQ,oBAAA;EA+CT;;;;;;;;EADW,WAAA,CACX,IAAA,EAAM,MAAA,WACN,QAAA,UACA,OAAA,GAAU,UAAA,GACT,OAAA,CAAQ,oBAAA;EA+DT;;;;EAFW,SAAA,CACX,MAAA,EAAQ,QAAA,EACR,QAAA,UACA,OAAA,GAAU,UAAA,GACT,OAAA,CAAQ,oBAAA;EAgDE;;;EAAA,GAAA,CAAI,QAAA,WAAmB,OAAA,CAAQ,MAAA;EAyB/B;;;EAAA,SAAA,CAAU,QAAA,WAAmB,OAAA,CAAQ,QAAA;EAyBrC;;;EAAA,MAAA,CAAO,QAAA,WAAmB,OAAA;EAqBf;;;EAAX,UAAA,CAAW,SAAA,aAAsB,OAAA,CAAQ,gBAAA;EAqDzB;;;;;;;;;EAAhB,eAAA,CAAgB,aAAA,WAAwB,OAAA;EAuGxB;;;EA7ChB,MAAA,CAAO,QAAA,WAAmB,OAAA;EAmE1B;;;EA7BA,YAAA,CAAa,QAAA,UAAkB,SAAA,YAAmB,OAAA;EAgC5D;;;EAzBU,eAAA,CAAgB,QAAA,UAAkB,OAAA,GAAU,gBAAA,GAAmB,OAAA;EAqD3B;;;EA/BpC,qBAAA,CACX,QAAA,UACA,OAAA,GAAU,sBAAA,GACT,OAAA;EAuEO;;;EA3CG,QAAA,CAAS,QAAA,WAAmB,OAAA,CAAQ,eAAA;EAoDjB;;;EArBnB,IAAA,CAAK,QAAA,WAAmB,OAAA;EAmEnB;;;EAAA,UAvDR,UAAA,CAAW,GAAA;EAgER;;;EAvDA,IAAA,CAAK,IAAA,UAAc,EAAA,WAAa,OAAA,CAAQ,oBAAA;EAuDQ;;;EAThD,IAAA,CAAK,IAAA,UAAc,EAAA,WAAa,OAAA,CAAQ,oBAAA;EAoFxC;;;EA3EA,IAAA,CAAK,SAAA,UAAmB,OAAA,GAAU,WAAA,GAAc,OAAA,CAAQ,eAAA;EAiGxD;;;EApCN,SAAA;EAoCmE;;;EA7BnE,SAAA;EAqD+C;;;EA9CzC,eAAA,CAAgB,QAAA,UAAkB,YAAA,WAAuB,OAAA;EAqF5D;;;EA/DG,aAAA,CAAc,QAAA,UAAkB,UAAA,EAAY,cAAA,GAAiB,OAAA;;;;EAwB7D,aAAA,CAAc,QAAA,WAAmB,OAAA,CAAQ,cAAA;;;;YAgC5C,aAAA,CAAc,MAAA,EAAQ,MAAA;;;;YAOtB,aAAA,CAAc,QAAA;AAAA"}

package/esm/storage/drivers/cloud-driver.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"cloud-driver.mjs","names":[],"sources":["../../../../../../../../../packages/core/src/storage/drivers/cloud-driver.ts"],"sourcesContent":["import crypto from \"crypto\";\nimport { createRequire } from \"module\";\nimport type { Readable } from \"stream\";\nimport { storageDriverContext } from \"../context/storage-driver-context\";\nimport type {\n  CloudStorageDriverContract,\n  CloudStorageDriverOptions,\n  CloudStorageFileData,\n  DeleteManyResult,\n  FileVisibility,\n  ListOptions,\n  PresignedOptions,\n  PresignedUploadOptions,\n  PutOptions,\n  StorageDriverType,\n  StorageFileInfo,\n} from \"../types\";\nimport { getMimeType } from \"../utils/mime\";\nimport { StorageCapabilityError } from \"../utils/storage-capability-error\";\n\n// ============================================================\n// Lazy-loaded S3 SDK Types\n// ============================================================\n\n/**\n * Cached S3 SDK modules (loaded once, reused)\n */\nlet S3Client: typeof import(\"@aws-sdk/client-s3\");\nlet S3Storage: typeof import(\"@aws-sdk/lib-storage\");\nlet S3Presigner: typeof import(\"@aws-sdk/s3-request-presigner\");\n\nlet isModuleExists: boolean | null = null;\n\n/**\n * Installation instructions for S3 SDK packages\n */\nconst S3_INSTALL_INSTRUCTIONS = `\nCloud storage requires the AWS S3 SDK packages.\nInstall them with:\n\n  warlock add s3\n\n(raw packages: @aws-sdk/client-s3, @aws-sdk/lib-storage, @aws-sdk/s3-request-presigner)\n`.trim();\n\n/**\n * Atomic initialization promise to handle concurrent calls to loadS3\n */\nlet initializationPromise: Promise<void> | null = null;\n\n/**\n * Load S3 modules lazily\n *\n * @example\n * await loadS3();\n * if (isModuleExists) {\n *   // Safe to use S3Client, S3Storage, S3Presigner\n * }\n */\nexport async function loadS3(): Promise<void> {\n  // If already successfully loaded, no need to do anything\n  if (isModuleExists === true) return;\n\n  // If currently loading, return the existing promise so the caller waits\n  if (initializationPromise) return initializationPromise;\n\n  initializationPromise = (async () => {\n    try {\n      // Use Promise.all to load modules in parallel for efficiency\n      const [client, storage, presigner] = await Promise.all([\n        import(\"@aws-sdk/client-s3\"),\n        import(\"@aws-sdk/lib-storage\"),\n        import(\"@aws-sdk/s3-request-presigner\"),\n      ]);\n\n      S3Client = client;\n      S3Storage = storage;\n      S3Presigner = presigner;\n\n      isModuleExists = true;\n    } catch {\n      // Mark as failed if any import fails (usually means packages aren't installed)\n      isModuleExists = false;\n    }\n  })();\n\n  return initializationPromise;\n}\n\nloadS3();\n\n/**\n * Synchronous fallback loader.\n *\n * `loadS3()` above is async and fire-and-forget at module load, so on the\n * very first *synchronous* `CloudDriver` construction the dynamic `import()`\n * microtask has not yet resolved — `isModuleExists` is still `null` even when\n * the SDK is genuinely installed. The constructor's install-check would then\n * throw the misleading \"SDK not installed\" error.\n *\n * This probes the modules synchronously via `require` (the AWS SDK ships\n * CJS-compatible builds) so a present SDK resolves the install-check\n * immediately, without waiting on the async path. Returns `true` when all\n * three modules loaded, `false` otherwise. Only invoked while\n * `isModuleExists` is still indeterminate.\n */\nfunction loadS3Sync(): boolean {\n  if (isModuleExists !== null) {\n    return isModuleExists;\n  }\n\n  try {\n    // `createRequire` gives an ESM-safe synchronous `require` regardless of\n    // whether this module runs as CJS or ESM at runtime.\n    const req = createRequire(import.meta.url);\n    S3Client = req(\"@aws-sdk/client-s3\");\n    S3Storage = req(\"@aws-sdk/lib-storage\");\n    S3Presigner = req(\"@aws-sdk/s3-request-presigner\");\n    isModuleExists = true;\n  } catch {\n    isModuleExists = false;\n  }\n\n  return isModuleExists;\n}\n\n// ============================================================\n// CloudDriver Base Class\n// ============================================================\n\n/**\n * Base abstract class for all S3-compatible cloud storage drivers\n *\n * This class contains all shared logic for S3-compatible storage services\n * including AWS S3, Cloudflare R2, DigitalOcean Spaces, and others.\n *\n * **Important:** S3 SDK packages are lazy-loaded on first use.\n * Users must install them separately:\n * ```\n * npm install @aws-sdk/client-s3 @aws-sdk/lib-storage @aws-sdk/s3-request-presigner\n * ```\n *\n * Subclasses must implement:\n * - `name`: Driver identifier (e.g., \"s3\", \"r2\", \"spaces\")\n * - `url()`: Returns the public URL for a file (provider-specific format)\n */\nexport abstract class CloudDriver<\n  TOptions extends Partial<CloudStorageDriverOptions> = CloudStorageDriverOptions,\n> implements CloudStorageDriverContract {\n  /**\n   * S3-compatible client (lazy-loaded)\n   */\n  protected client!: InstanceType<typeof import(\"@aws-sdk/client-s3\").S3Client>;\n\n  /**\n   * Retry configuration\n   */\n  protected retryConfig: {\n    maxRetries: number;\n    initialDelayMs: number;\n    maxDelayMs: number;\n    backoffMultiplier: number;\n  };\n\n  /**\n   * How object visibility is applied: per-object ACLs (default), bucket\n   * policy (no per-object ACL is sent), or unsupported (\"none\").\n   * Buckets with ACLs disabled (S3 BucketOwnerEnforced, R2) need\n   * \"policy\" or \"none\".\n   */\n  protected get visibilityMode(): \"acl\" | \"policy\" | \"none\" {\n    return (this.options as { visibilityMode?: \"acl\" | \"policy\" | \"none\" }).visibilityMode ?? \"acl\";\n  }\n\n  /**\n   * Resolve the ACL to send on a put for the requested visibility.\n   *\n   * @throws {StorageCapabilityError} When public is requested but the driver has no visibility support\n   */\n  protected resolveAcl(visibility?: FileVisibility): \"public-read\" | undefined {\n    if (visibility !== \"public\") return undefined;\n\n    if (this.visibilityMode === \"none\") {\n      throw new StorageCapabilityError(\"public visibility\", this.name);\n    }\n\n    return this.visibilityMode === \"acl\" ? \"public-read\" : undefined;\n  }\n\n  public constructor(public options: TOptions) {\n    // The async loadS3() may not have resolved yet on the first synchronous\n    // construction. When the flag is still indeterminate, probe synchronously\n    // so a genuinely-installed SDK never triggers the misleading throw below.\n    if (isModuleExists === null) {\n      loadS3Sync();\n    }\n\n    if (!isModuleExists) {\n      throw new Error(S3_INSTALL_INSTRUCTIONS);\n    }\n\n    // Any remaining option is an S3ClientConfig option (forcePathStyle,\n    // requestHandler, maxAttempts, ...) and is passed through to the SDK.\n    const {\n      bucket: _bucket,\n      accessKeyId,\n      secretAccessKey,\n      endpoint: _endpoint,\n      prefix: _prefix,\n      urlPrefix: _urlPrefix,\n      retry: _retry,\n      accountId: _accountId,\n      publicDomain: _publicDomain,\n      driver: _driver,\n      visibilityMode: _visibilityMode,\n      ...clientOptions\n    } = this.options as TOptions & Record<string, unknown>;\n\n    this.client = new S3Client.S3Client({\n      ...clientOptions,\n      region: this.options.region!,\n      // Without static keys the SDK default provider chain applies\n      // (IAM role, ECS task role, IRSA, SSO profile).\n      ...(accessKeyId && secretAccessKey && { credentials: { accessKeyId, secretAccessKey } }),\n      ...(this.getEndpoint() && { endpoint: this.getEndpoint() }),\n    } as import(\"@aws-sdk/client-s3\").S3ClientConfig);\n\n    // Initialize retry configuration\n    this.retryConfig = {\n      maxRetries: this.options.retry?.maxRetries ?? 3,\n      initialDelayMs: this.options.retry?.initialDelayMs ?? 1000,\n      maxDelayMs: this.options.retry?.maxDelayMs ?? 10000,\n      backoffMultiplier: this.options.retry?.backoffMultiplier ?? 2,\n    };\n  }\n\n  /**\n   * Driver name identifier\n   */\n  public abstract readonly name: StorageDriverType;\n\n  /**\n   * Get public URL for file\n   * Must be implemented by subclasses with provider-specific format\n   */\n  public abstract url(location: string): string;\n\n  /**\n   * Get endpoint URL\n   * Can be overridden by subclasses for provider-specific endpoints\n   */\n  protected getEndpoint(): string | undefined {\n    return this.options.endpoint;\n  }\n\n  // ============================================================\n  // Helper Methods\n  // ============================================================\n\n  /**\n   * Apply prefix to location path\n   *\n   * Priority: context prefix > driver options prefix > no prefix\n   * This allows multi-tenant scenarios where context overrides driver config.\n   *\n   * @param location - Original location path\n   * @returns Location with prefix applied if one exists\n   */\n  public applyPrefix(location: string): string {\n    // Check context prefix first (highest priority)\n    const contextPrefix = storageDriverContext.getPrefix();\n    const prefix = contextPrefix || this.options.prefix;\n\n    if (!prefix) {\n      return location;\n    }\n\n    const cleanPrefix = prefix.replace(/\\/+$/, \"\");\n    const cleanLocation = location.replace(/^\\/+/, \"\");\n\n    // Avoid double-prefixing\n    if (cleanLocation.startsWith(cleanPrefix + \"/\") || cleanLocation === cleanPrefix) {\n      return cleanLocation;\n    }\n\n    return `${cleanPrefix}/${cleanLocation}`;\n  }\n\n  /**\n   * Normalize storage path (remove double slashes, sanitize)\n   * @internal\n   */\n  protected normalizePath(path: string): string {\n    return path\n      .replace(/\\/+/g, \"/\") // Remove multiple slashes\n      .replace(/^\\//, \"\") // Remove leading slash\n      .trim();\n  }\n\n  /**\n   * Execute an operation with retry logic\n   *\n   * Retries on transient errors with exponential backoff.\n   *\n   * @param operation - Async operation to execute\n   * @param operationName - Name for logging\n   * @returns Result of the operation\n   * @internal\n   */\n  protected async withRetry<T>(\n    operation: () => Promise<T>,\n    operationName: string = \"operation\",\n  ): Promise<T> {\n    const { maxRetries, initialDelayMs, backoffMultiplier, maxDelayMs } = this.retryConfig;\n\n    let lastError: unknown;\n\n    // maxRetries counts retries, not attempts: 0 means a single attempt\n    const attempts = maxRetries + 1;\n\n    for (let attempt = 0; attempt < attempts; attempt++) {\n      try {\n        return await operation();\n      } catch (error) {\n        lastError = error;\n\n        // Don't retry on the last attempt\n        if (attempt === attempts - 1) {\n          break;\n        }\n\n        // Check if error is retryable\n        if (!this.isRetryableError(error)) {\n          throw error; // Non-retryable error, fail immediately\n        }\n\n        // Calculate delay with exponential backoff\n        const delayMs = Math.min(initialDelayMs * Math.pow(backoffMultiplier, attempt), maxDelayMs);\n\n        // Wait before retrying\n        await new Promise((resolve) => setTimeout(resolve, delayMs));\n      }\n    }\n\n    // Rethrow the original error so name/$metadata survive\n    throw lastError;\n  }\n\n  /**\n   * Check if an error is retryable\n   *\n   * Retries on:\n   * - Network errors\n   * - 5xx server errors\n   * - Rate limiting (429)\n   * - Timeout errors\n   *\n   * Does NOT retry on:\n   * - 4xx client errors (except 429)\n   * - Authentication errors\n   * - Not found errors\n   *\n   * @param error - Error to check\n   * @returns true if error is retryable\n   * @internal\n   */\n  protected isRetryableError(error: any): boolean {\n    // Network errors\n    if (error.code === \"ECONNRESET\" || error.code === \"ETIMEDOUT\" || error.code === \"ENOTFOUND\") {\n      return true;\n    }\n\n    // S3 SDK errors\n    if (error.name === \"NetworkingError\" || error.name === \"TimeoutError\") {\n      return true;\n    }\n\n    // HTTP status codes\n    const statusCode = error.$metadata?.httpStatusCode || error.statusCode;\n    if (statusCode) {\n      // 5xx server errors are retryable\n      if (statusCode >= 500 && statusCode < 600) {\n        return true;\n      }\n\n      // 429 Too Many Requests is retryable\n      if (statusCode === 429) {\n        return true;\n      }\n    }\n\n    return false;\n  }\n\n  // ============================================================\n  // Core File Operations\n  // ============================================================\n\n  /**\n   * Put file to cloud storage\n   */\n  public async put(\n    file: Buffer,\n    location: string,\n    options?: PutOptions,\n  ): Promise<CloudStorageFileData> {\n    return this.withRetry(async () => {\n      const { PutObjectCommand } = S3Client;\n\n      // Apply storage prefix\n      location = this.applyPrefix(location);\n\n      const hash = this.calculateHash(file);\n      const mimeType = options?.mimeType || this.guessMimeType(location);\n\n      const command = new PutObjectCommand({\n        Bucket: this.options.bucket,\n        Key: location,\n        Body: file,\n        ContentType: mimeType,\n        CacheControl: options?.cacheControl,\n        ContentDisposition: options?.contentDisposition,\n        Metadata: options?.metadata,\n        ACL: this.resolveAcl(options?.visibility),\n      });\n\n      const result = await this.client.send(command);\n\n      return {\n        path: location,\n        url: this.url(location),\n        size: file.length,\n        hash,\n        mimeType,\n        driver: this.name,\n        bucket: this.options.bucket!,\n        region: this.options.region!,\n        etag: result.ETag,\n        versionId: result.VersionId,\n      };\n    }, \"put\");\n  }\n\n  /**\n   * Atomically put a file only if the key does not exist (S3 conditional\n   * write, `If-None-Match: *`).\n   *\n   * HTTP 412 (PreconditionFailed) and 409 (ConditionalRequestConflict, a\n   * concurrent conditional write in flight) mean \"already exists\" and return\n   * `null`. Every other error throws.\n   */\n  public async putIfAbsent(\n    file: Buffer | string,\n    location: string,\n    options?: PutOptions,\n  ): Promise<CloudStorageFileData | null> {\n    const body = typeof file === \"string\" ? Buffer.from(file) : file;\n\n    return this.withRetry(async () => {\n      const { PutObjectCommand } = S3Client;\n\n      location = this.applyPrefix(location);\n\n      const hash = this.calculateHash(body);\n      const mimeType = options?.mimeType || this.guessMimeType(location);\n\n      const command = new PutObjectCommand({\n        Bucket: this.options.bucket,\n        Key: location,\n        Body: body,\n        ContentType: mimeType,\n        CacheControl: options?.cacheControl,\n        ContentDisposition: options?.contentDisposition,\n        Metadata: options?.metadata,\n        ACL: this.resolveAcl(options?.visibility),\n        IfNoneMatch: \"*\",\n      });\n\n      let result;\n\n      try {\n        result = await this.client.send(command);\n      } catch (error: any) {\n        const status = error?.$metadata?.httpStatusCode;\n\n        if (\n          status === 412 ||\n          status === 409 ||\n          error?.name === \"PreconditionFailed\" ||\n          error?.name === \"ConditionalRequestConflict\"\n        ) {\n          return null;\n        }\n\n        throw error;\n      }\n\n      return {\n        path: location,\n        url: this.url(location),\n        size: body.length,\n        hash,\n        mimeType,\n        driver: this.name,\n        bucket: this.options.bucket!,\n        region: this.options.region!,\n        etag: result.ETag,\n        versionId: result.VersionId,\n      };\n    }, \"putIfAbsent\");\n  }\n\n  /**\n   * Put file from a readable stream (for large files)\n   * Uses S3 multipart upload for efficient streaming\n   */\n  public async putStream(\n    stream: Readable,\n    location: string,\n    options?: PutOptions,\n  ): Promise<CloudStorageFileData> {\n    // Not wrapped in withRetry: a retry would replay an already-consumed\n    // stream, and lib-storage already retries individual parts.\n    {\n      const { Upload } = S3Storage;\n\n      // Apply storage prefix\n      location = this.applyPrefix(location);\n\n      const mimeType = options?.mimeType || this.guessMimeType(location);\n\n      const upload = new Upload({\n        client: this.client,\n        params: {\n          Bucket: this.options.bucket,\n          Key: location,\n          Body: stream,\n          ContentType: mimeType,\n          CacheControl: options?.cacheControl,\n          ContentDisposition: options?.contentDisposition,\n          Metadata: options?.metadata,\n          ACL: this.resolveAcl(options?.visibility),\n        },\n      });\n\n      const result = await upload.done();\n\n      // Get file info for size and hash\n      const info = await this.metadata(location);\n\n      return {\n        path: location,\n        url: this.url(location),\n        size: info.size,\n        hash: info.etag?.replace(/\"/g, \"\") || \"\",\n        mimeType,\n        driver: this.name,\n        bucket: this.options.bucket!,\n        region: this.options.region!,\n        etag: result.ETag,\n        versionId: result.VersionId,\n      };\n    }\n  }\n\n  /**\n   * Get file contents as Buffer\n   */\n  public async get(location: string): Promise<Buffer> {\n    return this.withRetry(async () => {\n      const { GetObjectCommand } = S3Client;\n\n      // Apply storage prefix\n      location = this.applyPrefix(location);\n\n      const command = new GetObjectCommand({\n        Bucket: this.options.bucket,\n        Key: location,\n      });\n\n      const result = await this.client.send(command);\n\n      if (!result.Body) {\n        throw new Error(`File not found: ${location}`);\n      }\n\n      return Buffer.from(await result.Body.transformToByteArray());\n    }, \"get\");\n  }\n\n  /**\n   * Get file as a readable stream (for large files)\n   */\n  public async getStream(location: string): Promise<Readable> {\n    return this.withRetry(async () => {\n      const { GetObjectCommand } = S3Client;\n\n      // Apply storage prefix\n      location = this.applyPrefix(location);\n\n      const command = new GetObjectCommand({\n        Bucket: this.options.bucket,\n        Key: location,\n      });\n\n      const result = await this.client.send(command);\n\n      if (!result.Body) {\n        throw new Error(`File not found: ${location}`);\n      }\n\n      return result.Body as Readable;\n    }, \"getStream\");\n  }\n\n  /**\n   * Delete a file\n   */\n  public async delete(location: string): Promise<boolean> {\n    return this.withRetry(async () => {\n      const { DeleteObjectCommand } = S3Client;\n\n      // Apply storage prefix\n      location = this.applyPrefix(location);\n\n      const command = new DeleteObjectCommand({\n        Bucket: this.options.bucket,\n        Key: location,\n      });\n\n      await this.client.send(command);\n\n      return true;\n    }, \"delete\");\n  }\n\n  /**\n   * Delete multiple files at once (uses batch delete for efficiency)\n   */\n  public async deleteMany(locations: string[]): Promise<DeleteManyResult[]> {\n    if (locations.length === 0) {\n      return [];\n    }\n\n    return this.withRetry(async () => {\n      const { DeleteObjectsCommand } = S3Client;\n\n      // Apply storage prefix to all locations\n      const prefixedLocations = locations.map((loc) => this.applyPrefix(loc));\n\n      const command = new DeleteObjectsCommand({\n        Bucket: this.options.bucket,\n        Delete: {\n          Objects: prefixedLocations.map((Key) => ({ Key })),\n          Quiet: false,\n        },\n      });\n\n      const result = await this.client.send(command);\n      const results: DeleteManyResult[] = [];\n\n      // Process successful deletes\n      for (const deleted of result.Deleted || []) {\n        if (deleted.Key) {\n          results.push({ location: deleted.Key, deleted: true });\n        }\n      }\n\n      // Process errors\n      for (const error of result.Errors || []) {\n        if (error.Key) {\n          results.push({\n            location: error.Key,\n            deleted: false,\n            error: error.Message || \"Unknown error\",\n          });\n        }\n      }\n\n      return results;\n    }, \"deleteMany\");\n  }\n\n  /**\n   * Delete directory (recursively deletes all objects with matching prefix)\n   *\n   * S3/R2 doesn't have true directories - only key prefixes.\n   * This method lists all objects with the prefix and deletes them in batches.\n   *\n   * @param directoryPath - Directory prefix to delete\n   * @returns true when all objects are deleted\n   */\n  public async deleteDirectory(directoryPath: string): Promise<boolean> {\n    const { ListObjectsV2Command, DeleteObjectsCommand } = S3Client;\n\n    // Apply storage prefix\n    directoryPath = this.applyPrefix(directoryPath);\n\n    // Ensure directory path ends with / for proper prefix matching\n    const prefix = directoryPath.endsWith(\"/\") ? directoryPath : `${directoryPath}/`;\n\n    // Drive the loop with the ListObjectsV2 IsTruncated / ContinuationToken\n    // contract rather than guessing termination from page size. Each page\n    // carries its own ContinuationToken so we never re-list page one.\n    let continuationToken: string | undefined;\n\n    do {\n      const listResult = await this.withRetry(\n        () =>\n          this.client.send(\n            new ListObjectsV2Command({\n              Bucket: this.options.bucket,\n              Prefix: prefix,\n              ContinuationToken: continuationToken,\n            }),\n          ),\n        \"deleteDirectory:list\",\n      );\n\n      const keys = (listResult.Contents || [])\n        .map((object) => object.Key)\n        .filter((key): key is string => Boolean(key));\n\n      if (keys.length > 0) {\n        // Delete the raw keys directly — they already carry the full prefix\n        // from the listing, so we bypass deleteMany's applyPrefix step.\n        await this.withRetry(\n          () =>\n            this.client.send(\n              new DeleteObjectsCommand({\n                Bucket: this.options.bucket,\n                Delete: {\n                  Objects: keys.map((Key) => ({ Key })),\n                  Quiet: true,\n                },\n              }),\n            ),\n          \"deleteDirectory:delete\",\n        );\n      }\n\n      continuationToken = listResult.IsTruncated ? listResult.NextContinuationToken : undefined;\n    } while (continuationToken);\n\n    return true;\n  }\n\n  /**\n   * Check if file exists\n   */\n  public async exists(location: string): Promise<boolean> {\n    // No retry for exists - it should be fast and failure means non-existent\n    try {\n      const { HeadObjectCommand } = S3Client;\n\n      // Apply storage prefix\n      location = this.applyPrefix(location);\n\n      const command = new HeadObjectCommand({\n        Bucket: this.options.bucket,\n        Key: location,\n      });\n\n      await this.client.send(command);\n      return true;\n    } catch (error) {\n      // Only a definite \"not found\" means absent; credential/network/5xx\n      // errors must surface, otherwise `if (!exists) put()` overwrites.\n      const { name, $metadata } = (error ?? {}) as {\n        name?: string;\n        $metadata?: { httpStatusCode?: number };\n      };\n\n      if (name === \"NotFound\" || name === \"NoSuchKey\" || $metadata?.httpStatusCode === 404) {\n        return false;\n      }\n\n      throw error;\n    }\n  }\n\n  // ============================================================\n  // URL Operations\n  // ============================================================\n\n  /**\n   * Get a temporary presigned URL (alias for getPresignedUrl)\n   */\n  public async temporaryUrl(location: string, expiresIn = 3600): Promise<string> {\n    return this.getPresignedUrl(location, { expiresIn });\n  }\n\n  /**\n   * Get presigned URL for downloading\n   */\n  public async getPresignedUrl(location: string, options?: PresignedOptions): Promise<string> {\n    return this.withRetry(async () => {\n      const { GetObjectCommand } = S3Client;\n      const { getSignedUrl } = S3Presigner;\n\n      // Apply storage prefix\n      location = this.applyPrefix(location);\n\n      const command = new GetObjectCommand({\n        Bucket: this.options.bucket,\n        Key: location,\n      });\n\n      return getSignedUrl(this.client, command, {\n        expiresIn: options?.expiresIn || 3600,\n      });\n    }, \"getPresignedUrl\");\n  }\n\n  /**\n   * Get presigned URL for uploading\n   */\n  public async getPresignedUploadUrl(\n    location: string,\n    options?: PresignedUploadOptions,\n  ): Promise<string> {\n    return this.withRetry(async () => {\n      const { PutObjectCommand } = S3Client;\n      const { getSignedUrl } = S3Presigner;\n\n      // Apply storage prefix\n      location = this.applyPrefix(location);\n\n      const command = new PutObjectCommand({\n        Bucket: this.options.bucket,\n        Key: location,\n        ContentType: options?.contentType,\n        Metadata: options?.metadata,\n      });\n\n      return getSignedUrl(this.client, command, {\n        expiresIn: options?.expiresIn || 3600,\n      });\n    }, \"getPresignedUploadUrl\");\n  }\n\n  // ============================================================\n  // Metadata Operations\n  // ============================================================\n\n  /**\n   * Get file info/metadata without downloading\n   */\n  public async metadata(location: string): Promise<StorageFileInfo> {\n    return this.withRetry(async () => {\n      const { HeadObjectCommand } = S3Client;\n\n      // Apply storage prefix\n      location = this.applyPrefix(location);\n\n      const command = new HeadObjectCommand({\n        Bucket: this.options.bucket,\n        Key: location,\n      });\n\n      const result = await this.client.send(command);\n      const name = location.split(\"/\").pop() || \"\";\n\n      return {\n        path: location,\n        name,\n        size: result.ContentLength || 0,\n        isDirectory: false,\n        lastModified: result.LastModified,\n        mimeType: result.ContentType || this.guessMimeType(location),\n        etag: result.ETag,\n        storageClass: result.StorageClass,\n      };\n    }, \"metadata\");\n  }\n\n  /**\n   * Get file size in bytes (shortcut for metadata().size)\n   */\n  public async size(location: string): Promise<number> {\n    const info = await this.metadata(location);\n    return info.size;\n  }\n\n  // ============================================================\n  // File Operations\n  // ============================================================\n\n  /**\n   * Build a URL-encoded CopySource (\"bucket/key\") as the SDK requires\n   */\n  protected copySource(key: string): string {\n    const encodedKey = key.split(\"/\").map(encodeURIComponent).join(\"/\");\n\n    return `${this.options.bucket}/${encodedKey}`;\n  }\n\n  /**\n   * Copy file to a new location\n   */\n  public async copy(from: string, to: string): Promise<CloudStorageFileData> {\n    return this.withRetry(async () => {\n      const { CopyObjectCommand, HeadObjectCommand } = S3Client;\n\n      // CopyObject drops the ACL, so a public source would silently become private\n      const visibility = await this.getVisibility(from).catch(() => \"private\" as const);\n\n      // Apply storage prefix to both paths\n      from = this.applyPrefix(from);\n      to = this.applyPrefix(to);\n\n      const command = new CopyObjectCommand({\n        Bucket: this.options.bucket,\n        CopySource: this.copySource(from),\n        Key: to,\n        ...(this.visibilityMode === \"acl\" && visibility === \"public\" && { ACL: \"public-read\" as const }),\n      });\n\n      const result = await this.client.send(command);\n\n      // Get file metadata\n      const headCommand = new HeadObjectCommand({\n        Bucket: this.options.bucket,\n        Key: to,\n      });\n      const headResult = await this.client.send(headCommand);\n\n      return {\n        path: to,\n        url: this.url(to),\n        size: headResult.ContentLength || 0,\n        hash: headResult.ETag?.replace(/\"/g, \"\") || \"\",\n        mimeType: headResult.ContentType || this.guessMimeType(to),\n        driver: this.name,\n        bucket: this.options.bucket!,\n        region: this.options.region!,\n        etag: result.CopyObjectResult?.ETag,\n        versionId: result.VersionId,\n      };\n    }, \"copy\");\n  }\n\n  /**\n   * Move file to a new location\n   */\n  public async move(from: string, to: string): Promise<CloudStorageFileData> {\n    const file = await this.copy(from, to);\n    await this.delete(from);\n    return file;\n  }\n\n  /**\n   * List files in a directory\n   */\n  public async list(directory: string, options?: ListOptions): Promise<StorageFileInfo[]> {\n    return this.withRetry(async () => {\n      const { ListObjectsV2Command } = S3Client;\n\n      // Apply storage prefix\n      directory = this.applyPrefix(directory);\n\n      // A directory prefix must end in \"/\" so \"images\" doesn't match \"images-old/…\"\n      if (directory && directory !== \"/\" && !directory.endsWith(\"/\")) {\n        directory = `${directory}/`;\n      }\n\n      const command = new ListObjectsV2Command({\n        Bucket: this.options.bucket,\n        Prefix: directory,\n        MaxKeys: options?.limit,\n        ContinuationToken: options?.cursor,\n        Delimiter: options?.recursive ? undefined : \"/\",\n      });\n\n      const result = await this.client.send(command);\n      const files: StorageFileInfo[] = [];\n\n      // Add files\n      for (const object of result.Contents || []) {\n        if (!object.Key) continue;\n\n        files.push({\n          path: object.Key,\n          name: object.Key.split(\"/\").pop() || \"\",\n          size: object.Size || 0,\n          isDirectory: false,\n          lastModified: object.LastModified,\n          etag: object.ETag,\n          storageClass: object.StorageClass,\n        });\n      }\n\n      // Add directories\n      for (const prefix of result.CommonPrefixes || []) {\n        if (!prefix.Prefix) continue;\n\n        files.push({\n          path: prefix.Prefix,\n          name: prefix.Prefix.split(\"/\").filter(Boolean).pop() || \"\",\n          size: 0,\n          isDirectory: true,\n        });\n      }\n\n      return files;\n    }, \"list\");\n  }\n\n  // ============================================================\n  // Cloud-Specific Operations\n  // ============================================================\n\n  /**\n   * Get bucket name\n   */\n  public getBucket(): string {\n    return this.options.bucket!;\n  }\n\n  /**\n   * Get region\n   */\n  public getRegion(): string {\n    return this.options.region!;\n  }\n\n  /**\n   * Set storage class (e.g., STANDARD, GLACIER, etc.)\n   */\n  public async setStorageClass(location: string, storageClass: string): Promise<void> {\n    return this.withRetry(async () => {\n      const { CopyObjectCommand } = S3Client;\n\n      // Apply storage prefix\n      location = this.applyPrefix(location);\n\n      const command = new CopyObjectCommand({\n        Bucket: this.options.bucket,\n        CopySource: this.copySource(location),\n        Key: location,\n        StorageClass: storageClass as any,\n        MetadataDirective: \"COPY\",\n      });\n\n      await this.client.send(command);\n    }, \"setStorageClass\");\n  }\n\n  /**\n   * Set file visibility (public or private)\n   */\n  public async setVisibility(location: string, visibility: FileVisibility): Promise<void> {\n    if (this.visibilityMode !== \"acl\") {\n      throw new StorageCapabilityError(\"setVisibility\", this.name);\n    }\n\n    return this.withRetry(async () => {\n      const { PutObjectAclCommand } = S3Client;\n\n      // Apply storage prefix\n      location = this.applyPrefix(location);\n\n      const command = new PutObjectAclCommand({\n        Bucket: this.options.bucket,\n        Key: location,\n        ACL: visibility === \"public\" ? \"public-read\" : \"private\",\n      });\n\n      await this.client.send(command);\n    }, \"setVisibility\");\n  }\n\n  /**\n   * Get file visibility\n   */\n  public async getVisibility(location: string): Promise<FileVisibility> {\n    return this.withRetry(async () => {\n      const { GetObjectAclCommand } = S3Client;\n\n      // Apply storage prefix\n      location = this.applyPrefix(location);\n\n      const command = new GetObjectAclCommand({\n        Bucket: this.options.bucket,\n        Key: location,\n      });\n\n      const result = await this.client.send(command);\n\n      // Check if any grant allows public read\n      const hasPublicRead = result.Grants?.some(\n        (grant) =>\n          grant.Grantee?.URI === \"http://acs.amazonaws.com/groups/global/AllUsers\" &&\n          grant.Permission === \"READ\",\n      );\n\n      return hasPublicRead ? \"public\" : \"private\";\n    }, \"getVisibility\");\n  }\n\n  // ============================================================\n  // Utilities\n  // ============================================================\n\n  /**\n   * Calculate SHA-256 hash\n   */\n  protected calculateHash(buffer: Buffer): string {\n    return crypto.createHash(\"sha256\").update(new Uint8Array(buffer)).digest(\"hex\");\n  }\n\n  /**\n   * Guess MIME type from file extension\n   */\n  protected guessMimeType(location: string): string {\n    return getMimeType(location);\n  }\n}\n"],"mappings":";;;;;;;;;;AA2BA,IAAI;AACJ,IAAI;AACJ,IAAI;AAEJ,IAAI,iBAAiC;;;;AAKrC,MAAM,0BAA0B;;;;;;;EAO9B,KAAK;;;;AAKP,IAAI,wBAA8C;;;;;;;;;;AAWlD,eAAsB,SAAwB;CAE5C,IAAI,mBAAmB,MAAM;CAG7B,IAAI,uBAAuB,OAAO;CAElC,yBAAyB,YAAY;EACnC,IAAI;GAEF,MAAM,CAAC,QAAQ,SAAS,aAAa,MAAM,QAAQ,IAAI;IACrD,OAAO;IACP,OAAO;IACP,OAAO;GACT,CAAC;GAED,WAAW;GACX,YAAY;GACZ,cAAc;GAEd,iBAAiB;EACnB,QAAQ;GAEN,iBAAiB;EACnB;CACF,EAAC,CAAE;CAEH,OAAO;AACT;AAEA,OAAO;;;;;;;;;;;;;;;;AAiBP,SAAS,aAAsB;CAC7B,IAAI,mBAAmB,MACrB,OAAO;CAGT,IAAI;EAGF,MAAM,MAAM,cAAc,OAAO,KAAK,GAAG;EACzC,WAAW,IAAI,oBAAoB;EACnC,YAAY,IAAI,sBAAsB;EACtC,cAAc,IAAI,+BAA+B;EACjD,iBAAiB;CACnB,QAAQ;EACN,iBAAiB;CACnB;CAEA,OAAO;AACT;;;;;;;;;;;;;;;;;AAsBA,IAAsB,cAAtB,MAEwC;;;;;;;CAsBtC,IAAc,iBAA4C;EACxD,OAAQ,KAAK,QAA2D,kBAAkB;CAC5F;;;;;;CAOA,AAAU,WAAW,YAAwD;EAC3E,IAAI,eAAe,UAAU,OAAO;EAEpC,IAAI,KAAK,mBAAmB,QAC1B,MAAM,IAAI,uBAAuB,qBAAqB,KAAK,IAAI;EAGjE,OAAO,KAAK,mBAAmB,QAAQ,gBAAgB;CACzD;CAEA,AAAO,YAAY,AAAO,SAAmB;EAAnB;EAIxB,IAAI,mBAAmB,MACrB,WAAW;EAGb,IAAI,CAAC,gBACH,MAAM,IAAI,MAAM,uBAAuB;EAKzC,MAAM,EACJ,QAAQ,SACR,aACA,iBACA,UAAU,WACV,QAAQ,SACR,WAAW,YACX,OAAO,QACP,WAAW,YACX,cAAc,eACd,QAAQ,SACR,gBAAgB,iBAChB,GAAG,kBACD,KAAK;EAET,KAAK,SAAS,IAAI,SAAS,SAAS;GAClC,GAAG;GACH,QAAQ,KAAK,QAAQ;GAGrB,GAAI,eAAe,mBAAmB,EAAE,aAAa;IAAE;IAAa;GAAgB,EAAE;GACtF,GAAI,KAAK,YAAY,KAAK,EAAE,UAAU,KAAK,YAAY,EAAE;EAC3D,CAAgD;EAGhD,KAAK,cAAc;GACjB,YAAY,KAAK,QAAQ,OAAO,cAAc;GAC9C,gBAAgB,KAAK,QAAQ,OAAO,kBAAkB;GACtD,YAAY,KAAK,QAAQ,OAAO,cAAc;GAC9C,mBAAmB,KAAK,QAAQ,OAAO,qBAAqB;EAC9D;CACF;;;;;CAiBA,AAAU,cAAkC;EAC1C,OAAO,KAAK,QAAQ;CACtB;;;;;;;;;;CAeA,AAAO,YAAY,UAA0B;EAG3C,MAAM,SADgB,qBAAqB,UAChB,KAAK,KAAK,QAAQ;EAE7C,IAAI,CAAC,QACH,OAAO;EAGT,MAAM,cAAc,OAAO,QAAQ,QAAQ,EAAE;EAC7C,MAAM,gBAAgB,SAAS,QAAQ,QAAQ,EAAE;EAGjD,IAAI,cAAc,WAAW,cAAc,GAAG,KAAK,kBAAkB,aACnE,OAAO;EAGT,OAAO,GAAG,YAAY,GAAG;CAC3B;;;;;CAMA,AAAU,cAAc,MAAsB;EAC5C,OAAO,KACJ,QAAQ,QAAQ,GAAG,CAAC,CACpB,QAAQ,OAAO,EAAE,CAAC,CAClB,KAAK;CACV;;;;;;;;;;;CAYA,MAAgB,UACd,WACA,gBAAwB,aACZ;EACZ,MAAM,EAAE,YAAY,gBAAgB,mBAAmB,eAAe,KAAK;EAE3E,IAAI;EAGJ,MAAM,WAAW,aAAa;EAE9B,KAAK,IAAI,UAAU,GAAG,UAAU,UAAU,WACxC,IAAI;GACF,OAAO,MAAM,UAAU;EACzB,SAAS,OAAO;GACd,YAAY;GAGZ,IAAI,YAAY,WAAW,GACzB;GAIF,IAAI,CAAC,KAAK,iBAAiB,KAAK,GAC9B,MAAM;GAIR,MAAM,UAAU,KAAK,IAAI,iBAAiB,KAAK,IAAI,mBAAmB,OAAO,GAAG,UAAU;GAG1F,MAAM,IAAI,SAAS,YAAY,WAAW,SAAS,OAAO,CAAC;EAC7D;EAIF,MAAM;CACR;;;;;;;;;;;;;;;;;;;CAoBA,AAAU,iBAAiB,OAAqB;EAE9C,IAAI,MAAM,SAAS,gBAAgB,MAAM,SAAS,eAAe,MAAM,SAAS,aAC9E,OAAO;EAIT,IAAI,MAAM,SAAS,qBAAqB,MAAM,SAAS,gBACrD,OAAO;EAIT,MAAM,aAAa,MAAM,WAAW,kBAAkB,MAAM;EAC5D,IAAI,YAAY;GAEd,IAAI,cAAc,OAAO,aAAa,KACpC,OAAO;GAIT,IAAI,eAAe,KACjB,OAAO;EAEX;EAEA,OAAO;CACT;;;;CASA,MAAa,IACX,MACA,UACA,SAC+B;EAC/B,OAAO,KAAK,UAAU,YAAY;GAChC,MAAM,EAAE,qBAAqB;GAG7B,WAAW,KAAK,YAAY,QAAQ;GAEpC,MAAM,OAAO,KAAK,cAAc,IAAI;GACpC,MAAM,WAAW,SAAS,YAAY,KAAK,cAAc,QAAQ;GAEjE,MAAM,UAAU,IAAI,iBAAiB;IACnC,QAAQ,KAAK,QAAQ;IACrB,KAAK;IACL,MAAM;IACN,aAAa;IACb,cAAc,SAAS;IACvB,oBAAoB,SAAS;IAC7B,UAAU,SAAS;IACnB,KAAK,KAAK,WAAW,SAAS,UAAU;GAC1C,CAAC;GAED,MAAM,SAAS,MAAM,KAAK,OAAO,KAAK,OAAO;GAE7C,OAAO;IACL,MAAM;IACN,KAAK,KAAK,IAAI,QAAQ;IACtB,MAAM,KAAK;IACX;IACA;IACA,QAAQ,KAAK;IACb,QAAQ,KAAK,QAAQ;IACrB,QAAQ,KAAK,QAAQ;IACrB,MAAM,OAAO;IACb,WAAW,OAAO;GACpB;EACF,GAAG,KAAK;CACV;;;;;;;;;CAUA,MAAa,YACX,MACA,UACA,SACsC;EACtC,MAAM,OAAO,OAAO,SAAS,WAAW,OAAO,KAAK,IAAI,IAAI;EAE5D,OAAO,KAAK,UAAU,YAAY;GAChC,MAAM,EAAE,qBAAqB;GAE7B,WAAW,KAAK,YAAY,QAAQ;GAEpC,MAAM,OAAO,KAAK,cAAc,IAAI;GACpC,MAAM,WAAW,SAAS,YAAY,KAAK,cAAc,QAAQ;GAEjE,MAAM,UAAU,IAAI,iBAAiB;IACnC,QAAQ,KAAK,QAAQ;IACrB,KAAK;IACL,MAAM;IACN,aAAa;IACb,cAAc,SAAS;IACvB,oBAAoB,SAAS;IAC7B,UAAU,SAAS;IACnB,KAAK,KAAK,WAAW,SAAS,UAAU;IACxC,aAAa;GACf,CAAC;GAED,IAAI;GAEJ,IAAI;IACF,SAAS,MAAM,KAAK,OAAO,KAAK,OAAO;GACzC,SAAS,OAAY;IACnB,MAAM,SAAS,OAAO,WAAW;IAEjC,IACE,WAAW,OACX,WAAW,OACX,OAAO,SAAS,wBAChB,OAAO,SAAS,8BAEhB,OAAO;IAGT,MAAM;GACR;GAEA,OAAO;IACL,MAAM;IACN,KAAK,KAAK,IAAI,QAAQ;IACtB,MAAM,KAAK;IACX;IACA;IACA,QAAQ,KAAK;IACb,QAAQ,KAAK,QAAQ;IACrB,QAAQ,KAAK,QAAQ;IACrB,MAAM,OAAO;IACb,WAAW,OAAO;GACpB;EACF,GAAG,aAAa;CAClB;;;;;CAMA,MAAa,UACX,QACA,UACA,SAC+B;EAG/B;GACE,MAAM,EAAE,WAAW;GAGnB,WAAW,KAAK,YAAY,QAAQ;GAEpC,MAAM,WAAW,SAAS,YAAY,KAAK,cAAc,QAAQ;GAgBjE,MAAM,SAAS,MAAM,IAdF,OAAO;IACxB,QAAQ,KAAK;IACb,QAAQ;KACN,QAAQ,KAAK,QAAQ;KACrB,KAAK;KACL,MAAM;KACN,aAAa;KACb,cAAc,SAAS;KACvB,oBAAoB,SAAS;KAC7B,UAAU,SAAS;KACnB,KAAK,KAAK,WAAW,SAAS,UAAU;IAC1C;GACF,CAE0B,CAAC,CAAC,KAAK;GAGjC,MAAM,OAAO,MAAM,KAAK,SAAS,QAAQ;GAEzC,OAAO;IACL,MAAM;IACN,KAAK,KAAK,IAAI,QAAQ;IACtB,MAAM,KAAK;IACX,MAAM,KAAK,MAAM,QAAQ,MAAM,EAAE,KAAK;IACtC;IACA,QAAQ,KAAK;IACb,QAAQ,KAAK,QAAQ;IACrB,QAAQ,KAAK,QAAQ;IACrB,MAAM,OAAO;IACb,WAAW,OAAO;GACpB;EACF;CACF;;;;CAKA,MAAa,IAAI,UAAmC;EAClD,OAAO,KAAK,UAAU,YAAY;GAChC,MAAM,EAAE,qBAAqB;GAG7B,WAAW,KAAK,YAAY,QAAQ;GAEpC,MAAM,UAAU,IAAI,iBAAiB;IACnC,QAAQ,KAAK,QAAQ;IACrB,KAAK;GACP,CAAC;GAED,MAAM,SAAS,MAAM,KAAK,OAAO,KAAK,OAAO;GAE7C,IAAI,CAAC,OAAO,MACV,MAAM,IAAI,MAAM,mBAAmB,UAAU;GAG/C,OAAO,OAAO,KAAK,MAAM,OAAO,KAAK,qBAAqB,CAAC;EAC7D,GAAG,KAAK;CACV;;;;CAKA,MAAa,UAAU,UAAqC;EAC1D,OAAO,KAAK,UAAU,YAAY;GAChC,MAAM,EAAE,qBAAqB;GAG7B,WAAW,KAAK,YAAY,QAAQ;GAEpC,MAAM,UAAU,IAAI,iBAAiB;IACnC,QAAQ,KAAK,QAAQ;IACrB,KAAK;GACP,CAAC;GAED,MAAM,SAAS,MAAM,KAAK,OAAO,KAAK,OAAO;GAE7C,IAAI,CAAC,OAAO,MACV,MAAM,IAAI,MAAM,mBAAmB,UAAU;GAG/C,OAAO,OAAO;EAChB,GAAG,WAAW;CAChB;;;;CAKA,MAAa,OAAO,UAAoC;EACtD,OAAO,KAAK,UAAU,YAAY;GAChC,MAAM,EAAE,wBAAwB;GAGhC,WAAW,KAAK,YAAY,QAAQ;GAEpC,MAAM,UAAU,IAAI,oBAAoB;IACtC,QAAQ,KAAK,QAAQ;IACrB,KAAK;GACP,CAAC;GAED,MAAM,KAAK,OAAO,KAAK,OAAO;GAE9B,OAAO;EACT,GAAG,QAAQ;CACb;;;;CAKA,MAAa,WAAW,WAAkD;EACxE,IAAI,UAAU,WAAW,GACvB,OAAO,CAAC;EAGV,OAAO,KAAK,UAAU,YAAY;GAChC,MAAM,EAAE,yBAAyB;GAGjC,MAAM,oBAAoB,UAAU,KAAK,QAAQ,KAAK,YAAY,GAAG,CAAC;GAEtE,MAAM,UAAU,IAAI,qBAAqB;IACvC,QAAQ,KAAK,QAAQ;IACrB,QAAQ;KACN,SAAS,kBAAkB,KAAK,SAAS,EAAE,IAAI,EAAE;KACjD,OAAO;IACT;GACF,CAAC;GAED,MAAM,SAAS,MAAM,KAAK,OAAO,KAAK,OAAO;GAC7C,MAAM,UAA8B,CAAC;GAGrC,KAAK,MAAM,WAAW,OAAO,WAAW,CAAC,GACvC,IAAI,QAAQ,KACV,QAAQ,KAAK;IAAE,UAAU,QAAQ;IAAK,SAAS;GAAK,CAAC;GAKzD,KAAK,MAAM,SAAS,OAAO,UAAU,CAAC,GACpC,IAAI,MAAM,KACR,QAAQ,KAAK;IACX,UAAU,MAAM;IAChB,SAAS;IACT,OAAO,MAAM,WAAW;GAC1B,CAAC;GAIL,OAAO;EACT,GAAG,YAAY;CACjB;;;;;;;;;;CAWA,MAAa,gBAAgB,eAAyC;EACpE,MAAM,EAAE,sBAAsB,yBAAyB;EAGvD,gBAAgB,KAAK,YAAY,aAAa;EAG9C,MAAM,SAAS,cAAc,SAAS,GAAG,IAAI,gBAAgB,GAAG,cAAc;EAK9E,IAAI;EAEJ,GAAG;GACD,MAAM,aAAa,MAAM,KAAK,gBAE1B,KAAK,OAAO,KACV,IAAI,qBAAqB;IACvB,QAAQ,KAAK,QAAQ;IACrB,QAAQ;IACR,mBAAmB;GACrB,CAAC,CACH,GACF,sBACF;GAEA,MAAM,QAAQ,WAAW,YAAY,CAAC,EAAC,CACpC,KAAK,WAAW,OAAO,GAAG,CAAC,CAC3B,QAAQ,QAAuB,QAAQ,GAAG,CAAC;GAE9C,IAAI,KAAK,SAAS,GAGhB,MAAM,KAAK,gBAEP,KAAK,OAAO,KACV,IAAI,qBAAqB;IACvB,QAAQ,KAAK,QAAQ;IACrB,QAAQ;KACN,SAAS,KAAK,KAAK,SAAS,EAAE,IAAI,EAAE;KACpC,OAAO;IACT;GACF,CAAC,CACH,GACF,wBACF;GAGF,oBAAoB,WAAW,cAAc,WAAW,wBAAwB;EAClF,SAAS;EAET,OAAO;CACT;;;;CAKA,MAAa,OAAO,UAAoC;EAEtD,IAAI;GACF,MAAM,EAAE,sBAAsB;GAG9B,WAAW,KAAK,YAAY,QAAQ;GAEpC,MAAM,UAAU,IAAI,kBAAkB;IACpC,QAAQ,KAAK,QAAQ;IACrB,KAAK;GACP,CAAC;GAED,MAAM,KAAK,OAAO,KAAK,OAAO;GAC9B,OAAO;EACT,SAAS,OAAO;GAGd,MAAM,EAAE,MAAM,cAAe,SAAS,CAAC;GAKvC,IAAI,SAAS,cAAc,SAAS,eAAe,WAAW,mBAAmB,KAC/E,OAAO;GAGT,MAAM;EACR;CACF;;;;CASA,MAAa,aAAa,UAAkB,YAAY,MAAuB;EAC7E,OAAO,KAAK,gBAAgB,UAAU,EAAE,UAAU,CAAC;CACrD;;;;CAKA,MAAa,gBAAgB,UAAkB,SAA6C;EAC1F,OAAO,KAAK,UAAU,YAAY;GAChC,MAAM,EAAE,qBAAqB;GAC7B,MAAM,EAAE,iBAAiB;GAGzB,WAAW,KAAK,YAAY,QAAQ;GAEpC,MAAM,UAAU,IAAI,iBAAiB;IACnC,QAAQ,KAAK,QAAQ;IACrB,KAAK;GACP,CAAC;GAED,OAAO,aAAa,KAAK,QAAQ,SAAS,EACxC,WAAW,SAAS,aAAa,KACnC,CAAC;EACH,GAAG,iBAAiB;CACtB;;;;CAKA,MAAa,sBACX,UACA,SACiB;EACjB,OAAO,KAAK,UAAU,YAAY;GAChC,MAAM,EAAE,qBAAqB;GAC7B,MAAM,EAAE,iBAAiB;GAGzB,WAAW,KAAK,YAAY,QAAQ;GAEpC,MAAM,UAAU,IAAI,iBAAiB;IACnC,QAAQ,KAAK,QAAQ;IACrB,KAAK;IACL,aAAa,SAAS;IACtB,UAAU,SAAS;GACrB,CAAC;GAED,OAAO,aAAa,KAAK,QAAQ,SAAS,EACxC,WAAW,SAAS,aAAa,KACnC,CAAC;EACH,GAAG,uBAAuB;CAC5B;;;;CASA,MAAa,SAAS,UAA4C;EAChE,OAAO,KAAK,UAAU,YAAY;GAChC,MAAM,EAAE,sBAAsB;GAG9B,WAAW,KAAK,YAAY,QAAQ;GAEpC,MAAM,UAAU,IAAI,kBAAkB;IACpC,QAAQ,KAAK,QAAQ;IACrB,KAAK;GACP,CAAC;GAED,MAAM,SAAS,MAAM,KAAK,OAAO,KAAK,OAAO;GAC7C,MAAM,OAAO,SAAS,MAAM,GAAG,CAAC,CAAC,IAAI,KAAK;GAE1C,OAAO;IACL,MAAM;IACN;IACA,MAAM,OAAO,iBAAiB;IAC9B,aAAa;IACb,cAAc,OAAO;IACrB,UAAU,OAAO,eAAe,KAAK,cAAc,QAAQ;IAC3D,MAAM,OAAO;IACb,cAAc,OAAO;GACvB;EACF,GAAG,UAAU;CACf;;;;CAKA,MAAa,KAAK,UAAmC;EAEnD,QAAO,MADY,KAAK,SAAS,QAAQ,EAC9B,CAAC;CACd;;;;CASA,AAAU,WAAW,KAAqB;EACxC,MAAM,aAAa,IAAI,MAAM,GAAG,CAAC,CAAC,IAAI,kBAAkB,CAAC,CAAC,KAAK,GAAG;EAElE,OAAO,GAAG,KAAK,QAAQ,OAAO,GAAG;CACnC;;;;CAKA,MAAa,KAAK,MAAc,IAA2C;EACzE,OAAO,KAAK,UAAU,YAAY;GAChC,MAAM,EAAE,mBAAmB,sBAAsB;GAGjD,MAAM,aAAa,MAAM,KAAK,cAAc,IAAI,CAAC,CAAC,YAAY,SAAkB;GAGhF,OAAO,KAAK,YAAY,IAAI;GAC5B,KAAK,KAAK,YAAY,EAAE;GAExB,MAAM,UAAU,IAAI,kBAAkB;IACpC,QAAQ,KAAK,QAAQ;IACrB,YAAY,KAAK,WAAW,IAAI;IAChC,KAAK;IACL,GAAI,KAAK,mBAAmB,SAAS,eAAe,YAAY,EAAE,KAAK,cAAuB;GAChG,CAAC;GAED,MAAM,SAAS,MAAM,KAAK,OAAO,KAAK,OAAO;GAG7C,MAAM,cAAc,IAAI,kBAAkB;IACxC,QAAQ,KAAK,QAAQ;IACrB,KAAK;GACP,CAAC;GACD,MAAM,aAAa,MAAM,KAAK,OAAO,KAAK,WAAW;GAErD,OAAO;IACL,MAAM;IACN,KAAK,KAAK,IAAI,EAAE;IAChB,MAAM,WAAW,iBAAiB;IAClC,MAAM,WAAW,MAAM,QAAQ,MAAM,EAAE,KAAK;IAC5C,UAAU,WAAW,eAAe,KAAK,cAAc,EAAE;IACzD,QAAQ,KAAK;IACb,QAAQ,KAAK,QAAQ;IACrB,QAAQ,KAAK,QAAQ;IACrB,MAAM,OAAO,kBAAkB;IAC/B,WAAW,OAAO;GACpB;EACF,GAAG,MAAM;CACX;;;;CAKA,MAAa,KAAK,MAAc,IAA2C;EACzE,MAAM,OAAO,MAAM,KAAK,KAAK,MAAM,EAAE;EACrC,MAAM,KAAK,OAAO,IAAI;EACtB,OAAO;CACT;;;;CAKA,MAAa,KAAK,WAAmB,SAAmD;EACtF,OAAO,KAAK,UAAU,YAAY;GAChC,MAAM,EAAE,yBAAyB;GAGjC,YAAY,KAAK,YAAY,SAAS;GAGtC,IAAI,aAAa,cAAc,OAAO,CAAC,UAAU,SAAS,GAAG,GAC3D,YAAY,GAAG,UAAU;GAG3B,MAAM,UAAU,IAAI,qBAAqB;IACvC,QAAQ,KAAK,QAAQ;IACrB,QAAQ;IACR,SAAS,SAAS;IAClB,mBAAmB,SAAS;IAC5B,WAAW,SAAS,YAAY,SAAY;GAC9C,CAAC;GAED,MAAM,SAAS,MAAM,KAAK,OAAO,KAAK,OAAO;GAC7C,MAAM,QAA2B,CAAC;GAGlC,KAAK,MAAM,UAAU,OAAO,YAAY,CAAC,GAAG;IAC1C,IAAI,CAAC,OAAO,KAAK;IAEjB,MAAM,KAAK;KACT,MAAM,OAAO;KACb,MAAM,OAAO,IAAI,MAAM,GAAG,CAAC,CAAC,IAAI,KAAK;KACrC,MAAM,OAAO,QAAQ;KACrB,aAAa;KACb,cAAc,OAAO;KACrB,MAAM,OAAO;KACb,cAAc,OAAO;IACvB,CAAC;GACH;GAGA,KAAK,MAAM,UAAU,OAAO,kBAAkB,CAAC,GAAG;IAChD,IAAI,CAAC,OAAO,QAAQ;IAEpB,MAAM,KAAK;KACT,MAAM,OAAO;KACb,MAAM,OAAO,OAAO,MAAM,GAAG,CAAC,CAAC,OAAO,OAAO,CAAC,CAAC,IAAI,KAAK;KACxD,MAAM;KACN,aAAa;IACf,CAAC;GACH;GAEA,OAAO;EACT,GAAG,MAAM;CACX;;;;CASA,AAAO,YAAoB;EACzB,OAAO,KAAK,QAAQ;CACtB;;;;CAKA,AAAO,YAAoB;EACzB,OAAO,KAAK,QAAQ;CACtB;;;;CAKA,MAAa,gBAAgB,UAAkB,cAAqC;EAClF,OAAO,KAAK,UAAU,YAAY;GAChC,MAAM,EAAE,sBAAsB;GAG9B,WAAW,KAAK,YAAY,QAAQ;GAEpC,MAAM,UAAU,IAAI,kBAAkB;IACpC,QAAQ,KAAK,QAAQ;IACrB,YAAY,KAAK,WAAW,QAAQ;IACpC,KAAK;IACL,cAAc;IACd,mBAAmB;GACrB,CAAC;GAED,MAAM,KAAK,OAAO,KAAK,OAAO;EAChC,GAAG,iBAAiB;CACtB;;;;CAKA,MAAa,cAAc,UAAkB,YAA2C;EACtF,IAAI,KAAK,mBAAmB,OAC1B,MAAM,IAAI,uBAAuB,iBAAiB,KAAK,IAAI;EAG7D,OAAO,KAAK,UAAU,YAAY;GAChC,MAAM,EAAE,wBAAwB;GAGhC,WAAW,KAAK,YAAY,QAAQ;GAEpC,MAAM,UAAU,IAAI,oBAAoB;IACtC,QAAQ,KAAK,QAAQ;IACrB,KAAK;IACL,KAAK,eAAe,WAAW,gBAAgB;GACjD,CAAC;GAED,MAAM,KAAK,OAAO,KAAK,OAAO;EAChC,GAAG,eAAe;CACpB;;;;CAKA,MAAa,cAAc,UAA2C;EACpE,OAAO,KAAK,UAAU,YAAY;GAChC,MAAM,EAAE,wBAAwB;GAGhC,WAAW,KAAK,YAAY,QAAQ;GAEpC,MAAM,UAAU,IAAI,oBAAoB;IACtC,QAAQ,KAAK,QAAQ;IACrB,KAAK;GACP,CAAC;GAWD,QANsB,MAHD,KAAK,OAAO,KAAK,OAAO,EAGjB,CAAC,QAAQ,MAClC,UACC,MAAM,SAAS,QAAQ,qDACvB,MAAM,eAAe,MACzB,IAEuB,WAAW;EACpC,GAAG,eAAe;CACpB;;;;CASA,AAAU,cAAc,QAAwB;EAC9C,OAAO,OAAO,WAAW,QAAQ,CAAC,CAAC,OAAO,IAAI,WAAW,MAAM,CAAC,CAAC,CAAC,OAAO,KAAK;CAChF;;;;CAKA,AAAU,cAAc,UAA0B;EAChD,OAAO,YAAY,QAAQ;CAC7B;AACF"}
+{"version":3,"file":"cloud-driver.mjs","names":[],"sources":["../../../../../../../../../packages/core/src/storage/drivers/cloud-driver.ts"],"sourcesContent":["import crypto from \"crypto\";\nimport { createRequire } from \"module\";\nimport type { Readable } from \"stream\";\nimport { storageDriverContext } from \"../context/storage-driver-context\";\nimport type {\n  CloudStorageDriverContract,\n  CloudStorageDriverOptions,\n  CloudStorageFileData,\n  DeleteManyResult,\n  FileVisibility,\n  ListOptions,\n  PresignedOptions,\n  PresignedUploadOptions,\n  PutOptions,\n  StorageDriverType,\n  StorageFileInfo,\n} from \"../types\";\nimport { getMimeType } from \"../utils/mime\";\nimport { StorageCapabilityError } from \"../utils/storage-capability-error\";\n\n// ============================================================\n// Lazy-loaded S3 SDK Types\n// ============================================================\n\n/**\n * Cached S3 SDK modules (loaded once, reused)\n */\nlet S3Client: typeof import(\"@aws-sdk/client-s3\");\nlet S3Storage: typeof import(\"@aws-sdk/lib-storage\");\nlet S3Presigner: typeof import(\"@aws-sdk/s3-request-presigner\");\n\nlet isModuleExists: boolean | null = null;\n\n/**\n * Installation instructions for S3 SDK packages\n */\nconst S3_INSTALL_INSTRUCTIONS = `\nCloud storage requires the AWS S3 SDK packages.\nInstall them with:\n\n  warlock add s3\n\n(raw packages: @aws-sdk/client-s3, @aws-sdk/lib-storage, @aws-sdk/s3-request-presigner)\n`.trim();\n\n/**\n * Atomic initialization promise to handle concurrent calls to loadS3\n */\nlet initializationPromise: Promise<void> | null = null;\n\n/**\n * Load S3 modules lazily\n *\n * @example\n * await loadS3();\n * if (isModuleExists) {\n *   // Safe to use S3Client, S3Storage, S3Presigner\n * }\n */\nexport async function loadS3(): Promise<void> {\n  // If already successfully loaded, no need to do anything\n  if (isModuleExists === true) return;\n\n  // If currently loading, return the existing promise so the caller waits\n  if (initializationPromise) return initializationPromise;\n\n  initializationPromise = (async () => {\n    try {\n      // Use Promise.all to load modules in parallel for efficiency\n      const [client, storage, presigner] = await Promise.all([\n        import(\"@aws-sdk/client-s3\"),\n        import(\"@aws-sdk/lib-storage\"),\n        import(\"@aws-sdk/s3-request-presigner\"),\n      ]);\n\n      S3Client = client;\n      S3Storage = storage;\n      S3Presigner = presigner;\n\n      isModuleExists = true;\n    } catch {\n      // Mark as failed if any import fails (usually means packages aren't installed)\n      isModuleExists = false;\n    }\n  })();\n\n  return initializationPromise;\n}\n\nloadS3();\n\n/**\n * Synchronous fallback loader.\n *\n * `loadS3()` above is async and fire-and-forget at module load, so on the\n * very first *synchronous* `CloudDriver` construction the dynamic `import()`\n * microtask has not yet resolved — `isModuleExists` is still `null` even when\n * the SDK is genuinely installed. The constructor's install-check would then\n * throw the misleading \"SDK not installed\" error.\n *\n * This probes the modules synchronously via `require` (the AWS SDK ships\n * CJS-compatible builds) so a present SDK resolves the install-check\n * immediately, without waiting on the async path. Returns `true` when all\n * three modules loaded, `false` otherwise. Only invoked while\n * `isModuleExists` is still indeterminate.\n */\nfunction loadS3Sync(): boolean {\n  if (isModuleExists !== null) {\n    return isModuleExists;\n  }\n\n  try {\n    // `createRequire` gives an ESM-safe synchronous `require` regardless of\n    // whether this module runs as CJS or ESM at runtime.\n    const req = createRequire(import.meta.url);\n    S3Client = req(\"@aws-sdk/client-s3\");\n    S3Storage = req(\"@aws-sdk/lib-storage\");\n    S3Presigner = req(\"@aws-sdk/s3-request-presigner\");\n    isModuleExists = true;\n  } catch {\n    isModuleExists = false;\n  }\n\n  return isModuleExists;\n}\n\n// ============================================================\n// CloudDriver Base Class\n// ============================================================\n\n/**\n * Base abstract class for all S3-compatible cloud storage drivers\n *\n * This class contains all shared logic for S3-compatible storage services\n * including AWS S3, Cloudflare R2, DigitalOcean Spaces, and others.\n *\n * **Important:** S3 SDK packages are lazy-loaded on first use.\n * Users must install them separately:\n * ```\n * npm install @aws-sdk/client-s3 @aws-sdk/lib-storage @aws-sdk/s3-request-presigner\n * ```\n *\n * Subclasses must implement:\n * - `name`: Driver identifier (e.g., \"s3\", \"r2\", \"spaces\")\n * - `url()`: Returns the public URL for a file (provider-specific format)\n */\nexport abstract class CloudDriver<\n  TOptions extends Partial<CloudStorageDriverOptions> = CloudStorageDriverOptions,\n> implements CloudStorageDriverContract {\n  /**\n   * S3-compatible client (lazy-loaded)\n   */\n  protected client!: InstanceType<typeof import(\"@aws-sdk/client-s3\").S3Client>;\n\n  /**\n   * Retry configuration\n   */\n  protected retryConfig: {\n    maxRetries: number;\n    initialDelayMs: number;\n    maxDelayMs: number;\n    backoffMultiplier: number;\n  };\n\n  /**\n   * How object visibility is applied: per-object ACLs (default), bucket\n   * policy (no per-object ACL is sent), or unsupported (\"none\").\n   * Buckets with ACLs disabled (S3 BucketOwnerEnforced, R2) need\n   * \"policy\" or \"none\".\n   */\n  protected get visibilityMode(): \"acl\" | \"policy\" | \"none\" {\n    return (this.options as { visibilityMode?: \"acl\" | \"policy\" | \"none\" }).visibilityMode ?? \"acl\";\n  }\n\n  /**\n   * Resolve the ACL to send on a put for the requested visibility.\n   *\n   * @throws {StorageCapabilityError} When public is requested but the driver has no visibility support\n   */\n  protected resolveAcl(visibility?: FileVisibility): \"public-read\" | undefined {\n    if (visibility !== \"public\") return undefined;\n\n    if (this.visibilityMode === \"none\") {\n      throw new StorageCapabilityError(\"public visibility\", this.name);\n    }\n\n    return this.visibilityMode === \"acl\" ? \"public-read\" : undefined;\n  }\n\n  public constructor(public options: TOptions) {\n    // The async loadS3() may not have resolved yet on the first synchronous\n    // construction. When the flag is still indeterminate, probe synchronously\n    // so a genuinely-installed SDK never triggers the misleading throw below.\n    if (isModuleExists === null) {\n      loadS3Sync();\n    }\n\n    if (!isModuleExists) {\n      throw new Error(S3_INSTALL_INSTRUCTIONS);\n    }\n\n    // Any remaining option is an S3ClientConfig option (forcePathStyle,\n    // requestHandler, maxAttempts, ...) and is passed through to the SDK.\n    const {\n      bucket: _bucket,\n      accessKeyId,\n      secretAccessKey,\n      endpoint: _endpoint,\n      prefix: _prefix,\n      urlPrefix: _urlPrefix,\n      retry: _retry,\n      accountId: _accountId,\n      publicDomain: _publicDomain,\n      driver: _driver,\n      visibilityMode: _visibilityMode,\n      ...clientOptions\n    } = this.options as TOptions & Record<string, unknown>;\n\n    this.client = new S3Client.S3Client({\n      ...clientOptions,\n      region: this.options.region!,\n      // Without static keys the SDK default provider chain applies\n      // (IAM role, ECS task role, IRSA, SSO profile).\n      ...(accessKeyId && secretAccessKey && { credentials: { accessKeyId, secretAccessKey } }),\n      ...(this.getEndpoint() && { endpoint: this.getEndpoint() }),\n    } as import(\"@aws-sdk/client-s3\").S3ClientConfig);\n\n    // Initialize retry configuration\n    this.retryConfig = {\n      maxRetries: this.options.retry?.maxRetries ?? 3,\n      initialDelayMs: this.options.retry?.initialDelayMs ?? 1000,\n      maxDelayMs: this.options.retry?.maxDelayMs ?? 10000,\n      backoffMultiplier: this.options.retry?.backoffMultiplier ?? 2,\n    };\n  }\n\n  /**\n   * Driver name identifier\n   */\n  public abstract readonly name: StorageDriverType;\n\n  /**\n   * Get public URL for file\n   * Must be implemented by subclasses with provider-specific format\n   */\n  public abstract url(location: string): string;\n\n  /**\n   * Get endpoint URL\n   * Can be overridden by subclasses for provider-specific endpoints\n   */\n  protected getEndpoint(): string | undefined {\n    return this.options.endpoint;\n  }\n\n  // ============================================================\n  // Helper Methods\n  // ============================================================\n\n  /**\n   * Apply prefix to location path\n   *\n   * Priority: context prefix > driver options prefix > no prefix\n   * This allows multi-tenant scenarios where context overrides driver config.\n   *\n   * @param location - Original location path\n   * @returns Location with prefix applied if one exists\n   */\n  public applyPrefix(location: string): string {\n    // Check context prefix first (highest priority)\n    const contextPrefix = storageDriverContext.getPrefix();\n    const prefix = contextPrefix || this.options.prefix;\n\n    if (!prefix) {\n      return location;\n    }\n\n    const cleanPrefix = prefix.replace(/\\/+$/, \"\");\n    const cleanLocation = location.replace(/^\\/+/, \"\");\n\n    // Avoid double-prefixing\n    if (cleanLocation.startsWith(cleanPrefix + \"/\") || cleanLocation === cleanPrefix) {\n      return cleanLocation;\n    }\n\n    return `${cleanPrefix}/${cleanLocation}`;\n  }\n\n  /**\n   * Normalize storage path (remove double slashes, sanitize)\n   * @internal\n   */\n  protected normalizePath(path: string): string {\n    return path\n      .replace(/\\/+/g, \"/\") // Remove multiple slashes\n      .replace(/^\\//, \"\") // Remove leading slash\n      .trim();\n  }\n\n  /**\n   * Execute an operation with retry logic\n   *\n   * Retries on transient errors with exponential backoff.\n   *\n   * @param operation - Async operation to execute\n   * @param operationName - Name for logging\n   * @returns Result of the operation\n   * @internal\n   */\n  protected async withRetry<T>(\n    operation: () => Promise<T>,\n    operationName: string = \"operation\",\n  ): Promise<T> {\n    const { maxRetries, initialDelayMs, backoffMultiplier, maxDelayMs } = this.retryConfig;\n\n    let lastError: unknown;\n\n    // maxRetries counts retries, not attempts: 0 means a single attempt\n    const attempts = maxRetries + 1;\n\n    for (let attempt = 0; attempt < attempts; attempt++) {\n      try {\n        return await operation();\n      } catch (error) {\n        lastError = error;\n\n        // Don't retry on the last attempt\n        if (attempt === attempts - 1) {\n          break;\n        }\n\n        // Check if error is retryable\n        if (!this.isRetryableError(error)) {\n          throw error; // Non-retryable error, fail immediately\n        }\n\n        // Calculate delay with exponential backoff\n        const delayMs = Math.min(initialDelayMs * Math.pow(backoffMultiplier, attempt), maxDelayMs);\n\n        // Wait before retrying\n        await new Promise((resolve) => setTimeout(resolve, delayMs));\n      }\n    }\n\n    // Rethrow the original error so name/$metadata survive\n    throw lastError;\n  }\n\n  /**\n   * Check if an error is retryable\n   *\n   * Retries on:\n   * - Network errors\n   * - 5xx server errors\n   * - Rate limiting (429)\n   * - Timeout errors\n   *\n   * Does NOT retry on:\n   * - 4xx client errors (except 429)\n   * - Authentication errors\n   * - Not found errors\n   *\n   * @param error - Error to check\n   * @returns true if error is retryable\n   * @internal\n   */\n  protected isRetryableError(error: any): boolean {\n    // Network errors\n    if (error.code === \"ECONNRESET\" || error.code === \"ETIMEDOUT\" || error.code === \"ENOTFOUND\") {\n      return true;\n    }\n\n    // S3 SDK errors\n    if (error.name === \"NetworkingError\" || error.name === \"TimeoutError\") {\n      return true;\n    }\n\n    // HTTP status codes\n    const statusCode = error.$metadata?.httpStatusCode || error.statusCode;\n    if (statusCode) {\n      // 5xx server errors are retryable\n      if (statusCode >= 500 && statusCode < 600) {\n        return true;\n      }\n\n      // 429 Too Many Requests is retryable\n      if (statusCode === 429) {\n        return true;\n      }\n    }\n\n    return false;\n  }\n\n  // ============================================================\n  // Core File Operations\n  // ============================================================\n\n  /**\n   * Put file to cloud storage\n   */\n  public async put(\n    file: Buffer,\n    location: string,\n    options?: PutOptions,\n  ): Promise<CloudStorageFileData> {\n    return this.withRetry(async () => {\n      const { PutObjectCommand } = S3Client;\n\n      // Apply storage prefix\n      location = this.applyPrefix(location);\n\n      const hash = this.calculateHash(file);\n      const mimeType = options?.mimeType || this.guessMimeType(location);\n\n      const command = new PutObjectCommand({\n        Bucket: this.options.bucket,\n        Key: location,\n        Body: file,\n        ContentType: mimeType,\n        CacheControl: options?.cacheControl,\n        ContentDisposition: options?.contentDisposition,\n        Metadata: options?.metadata,\n        ACL: this.resolveAcl(options?.visibility),\n      });\n\n      const result = await this.client.send(command);\n\n      return {\n        path: location,\n        url: this.url(location),\n        size: file.length,\n        hash,\n        mimeType,\n        driver: this.name,\n        bucket: this.options.bucket!,\n        region: this.options.region!,\n        etag: result.ETag,\n        versionId: result.VersionId,\n      };\n    }, \"put\");\n  }\n\n  /**\n   * Atomically put a file only if the key does not exist (S3 conditional\n   * write, `If-None-Match: *`).\n   *\n   * HTTP 412 (PreconditionFailed) and 409 (ConditionalRequestConflict, a\n   * concurrent conditional write in flight) mean \"already exists\" and return\n   * `null`. Every other error throws.\n   */\n  public async putIfAbsent(\n    file: Buffer | string,\n    location: string,\n    options?: PutOptions,\n  ): Promise<CloudStorageFileData | null> {\n    const body = typeof file === \"string\" ? Buffer.from(file) : file;\n\n    return this.withRetry(async () => {\n      const { PutObjectCommand } = S3Client;\n\n      location = this.applyPrefix(location);\n\n      const hash = this.calculateHash(body);\n      const mimeType = options?.mimeType || this.guessMimeType(location);\n\n      const command = new PutObjectCommand({\n        Bucket: this.options.bucket,\n        Key: location,\n        Body: body,\n        ContentType: mimeType,\n        CacheControl: options?.cacheControl,\n        ContentDisposition: options?.contentDisposition,\n        Metadata: options?.metadata,\n        ACL: this.resolveAcl(options?.visibility),\n        IfNoneMatch: \"*\",\n      });\n\n      let result;\n\n      try {\n        result = await this.client.send(command);\n      } catch (error: any) {\n        const status = error?.$metadata?.httpStatusCode;\n\n        if (\n          status === 412 ||\n          status === 409 ||\n          error?.name === \"PreconditionFailed\" ||\n          error?.name === \"ConditionalRequestConflict\"\n        ) {\n          return null;\n        }\n\n        throw error;\n      }\n\n      return {\n        path: location,\n        url: this.url(location),\n        size: body.length,\n        hash,\n        mimeType,\n        driver: this.name,\n        bucket: this.options.bucket!,\n        region: this.options.region!,\n        etag: result.ETag,\n        versionId: result.VersionId,\n      };\n    }, \"putIfAbsent\");\n  }\n\n  /**\n   * Put file from a readable stream (for large files)\n   * Uses S3 multipart upload for efficient streaming\n   */\n  public async putStream(\n    stream: Readable,\n    location: string,\n    options?: PutOptions,\n  ): Promise<CloudStorageFileData> {\n    // Not wrapped in withRetry: a retry would replay an already-consumed\n    // stream, and lib-storage already retries individual parts.\n    {\n      const { Upload } = S3Storage;\n\n      // Apply storage prefix\n      location = this.applyPrefix(location);\n\n      const mimeType = options?.mimeType || this.guessMimeType(location);\n\n      const upload = new Upload({\n        client: this.client,\n        params: {\n          Bucket: this.options.bucket,\n          Key: location,\n          Body: stream,\n          ContentType: mimeType,\n          CacheControl: options?.cacheControl,\n          ContentDisposition: options?.contentDisposition,\n          Metadata: options?.metadata,\n          ACL: this.resolveAcl(options?.visibility),\n        },\n      });\n\n      const result = await upload.done();\n\n      // Get file info for size and hash\n      const info = await this.metadata(location);\n\n      return {\n        path: location,\n        url: this.url(location),\n        size: info.size,\n        hash: info.etag?.replace(/\"/g, \"\") || \"\",\n        mimeType,\n        driver: this.name,\n        bucket: this.options.bucket!,\n        region: this.options.region!,\n        etag: result.ETag,\n        versionId: result.VersionId,\n      };\n    }\n  }\n\n  /**\n   * Get file contents as Buffer\n   */\n  public async get(location: string): Promise<Buffer> {\n    return this.withRetry(async () => {\n      const { GetObjectCommand } = S3Client;\n\n      // Apply storage prefix\n      location = this.applyPrefix(location);\n\n      const command = new GetObjectCommand({\n        Bucket: this.options.bucket,\n        Key: location,\n      });\n\n      const result = await this.client.send(command);\n\n      if (!result.Body) {\n        throw new Error(`File not found: ${location}`);\n      }\n\n      return Buffer.from(await result.Body.transformToByteArray());\n    }, \"get\");\n  }\n\n  /**\n   * Get file as a readable stream (for large files)\n   */\n  public async getStream(location: string): Promise<Readable> {\n    return this.withRetry(async () => {\n      const { GetObjectCommand } = S3Client;\n\n      // Apply storage prefix\n      location = this.applyPrefix(location);\n\n      const command = new GetObjectCommand({\n        Bucket: this.options.bucket,\n        Key: location,\n      });\n\n      const result = await this.client.send(command);\n\n      if (!result.Body) {\n        throw new Error(`File not found: ${location}`);\n      }\n\n      return result.Body as Readable;\n    }, \"getStream\");\n  }\n\n  /**\n   * Delete a file\n   */\n  public async delete(location: string): Promise<boolean> {\n    return this.withRetry(async () => {\n      const { DeleteObjectCommand } = S3Client;\n\n      // Apply storage prefix\n      location = this.applyPrefix(location);\n\n      const command = new DeleteObjectCommand({\n        Bucket: this.options.bucket,\n        Key: location,\n      });\n\n      await this.client.send(command);\n\n      return true;\n    }, \"delete\");\n  }\n\n  /**\n   * Delete multiple files at once (uses batch delete for efficiency)\n   */\n  public async deleteMany(locations: string[]): Promise<DeleteManyResult[]> {\n    if (locations.length === 0) {\n      return [];\n    }\n\n    return this.withRetry(async () => {\n      const { DeleteObjectsCommand } = S3Client;\n\n      // Apply storage prefix to all locations\n      const prefixedLocations = locations.map((loc) => this.applyPrefix(loc));\n\n      const command = new DeleteObjectsCommand({\n        Bucket: this.options.bucket,\n        Delete: {\n          Objects: prefixedLocations.map((Key) => ({ Key })),\n          Quiet: false,\n        },\n      });\n\n      const result = await this.client.send(command);\n      const results: DeleteManyResult[] = [];\n\n      // Process successful deletes\n      for (const deleted of result.Deleted || []) {\n        if (deleted.Key) {\n          results.push({ location: deleted.Key, deleted: true });\n        }\n      }\n\n      // Process errors\n      for (const error of result.Errors || []) {\n        if (error.Key) {\n          results.push({\n            location: error.Key,\n            deleted: false,\n            error: error.Message || \"Unknown error\",\n          });\n        }\n      }\n\n      return results;\n    }, \"deleteMany\");\n  }\n\n  /**\n   * Delete directory (recursively deletes all objects with matching prefix)\n   *\n   * S3/R2 doesn't have true directories - only key prefixes.\n   * This method lists all objects with the prefix and deletes them in batches.\n   *\n   * @param directoryPath - Directory prefix to delete\n   * @returns true when all objects are deleted\n   */\n  public async deleteDirectory(directoryPath: string): Promise<boolean> {\n    const { ListObjectsV2Command, DeleteObjectsCommand } = S3Client;\n\n    // Apply storage prefix\n    directoryPath = this.applyPrefix(directoryPath);\n\n    // Ensure directory path ends with / for proper prefix matching\n    const prefix = directoryPath.endsWith(\"/\") ? directoryPath : `${directoryPath}/`;\n\n    // Drive the loop with the ListObjectsV2 IsTruncated / ContinuationToken\n    // contract rather than guessing termination from page size. Each page\n    // carries its own ContinuationToken so we never re-list page one.\n    let continuationToken: string | undefined;\n\n    do {\n      const listResult = await this.withRetry(\n        () =>\n          this.client.send(\n            new ListObjectsV2Command({\n              Bucket: this.options.bucket,\n              Prefix: prefix,\n              ContinuationToken: continuationToken,\n            }),\n          ),\n        \"deleteDirectory:list\",\n      );\n\n      const keys = (listResult.Contents || [])\n        .map((object) => object.Key)\n        .filter((key): key is string => Boolean(key));\n\n      if (keys.length > 0) {\n        // Delete the raw keys directly — they already carry the full prefix\n        // from the listing, so we bypass deleteMany's applyPrefix step.\n        await this.withRetry(\n          () =>\n            this.client.send(\n              new DeleteObjectsCommand({\n                Bucket: this.options.bucket,\n                Delete: {\n                  Objects: keys.map((Key) => ({ Key })),\n                  Quiet: true,\n                },\n              }),\n            ),\n          \"deleteDirectory:delete\",\n        );\n      }\n\n      continuationToken = listResult.IsTruncated ? listResult.NextContinuationToken : undefined;\n    } while (continuationToken);\n\n    return true;\n  }\n\n  /**\n   * Check if file exists\n   */\n  public async exists(location: string): Promise<boolean> {\n    // No retry for exists - it should be fast and failure means non-existent\n    try {\n      const { HeadObjectCommand } = S3Client;\n\n      // Apply storage prefix\n      location = this.applyPrefix(location);\n\n      const command = new HeadObjectCommand({\n        Bucket: this.options.bucket,\n        Key: location,\n      });\n\n      await this.client.send(command);\n      return true;\n    } catch (error) {\n      // Only a definite \"not found\" means absent; credential/network/5xx\n      // errors must surface, otherwise `if (!exists) put()` overwrites.\n      const { name, $metadata } = (error ?? {}) as {\n        name?: string;\n        $metadata?: { httpStatusCode?: number };\n      };\n\n      if (name === \"NotFound\" || name === \"NoSuchKey\" || $metadata?.httpStatusCode === 404) {\n        return false;\n      }\n\n      throw error;\n    }\n  }\n\n  // ============================================================\n  // URL Operations\n  // ============================================================\n\n  /**\n   * Get a temporary presigned URL (alias for getPresignedUrl)\n   */\n  public async temporaryUrl(location: string, expiresIn = 3600): Promise<string> {\n    return this.getPresignedUrl(location, { expiresIn });\n  }\n\n  /**\n   * Get presigned URL for downloading\n   */\n  public async getPresignedUrl(location: string, options?: PresignedOptions): Promise<string> {\n    return this.withRetry(async () => {\n      const { GetObjectCommand } = S3Client;\n      const { getSignedUrl } = S3Presigner;\n\n      // Apply storage prefix\n      location = this.applyPrefix(location);\n\n      const command = new GetObjectCommand({\n        Bucket: this.options.bucket,\n        Key: location,\n      });\n\n      return getSignedUrl(this.client, command, {\n        expiresIn: options?.expiresIn || 3600,\n      });\n    }, \"getPresignedUrl\");\n  }\n\n  /**\n   * Get presigned URL for uploading\n   */\n  public async getPresignedUploadUrl(\n    location: string,\n    options?: PresignedUploadOptions,\n  ): Promise<string> {\n    return this.withRetry(async () => {\n      const { PutObjectCommand } = S3Client;\n      const { getSignedUrl } = S3Presigner;\n\n      // Apply storage prefix\n      location = this.applyPrefix(location);\n\n      const command = new PutObjectCommand({\n        Bucket: this.options.bucket,\n        Key: location,\n        ContentType: options?.contentType,\n        Metadata: options?.metadata,\n      });\n\n      return getSignedUrl(this.client, command, {\n        expiresIn: options?.expiresIn || 3600,\n      });\n    }, \"getPresignedUploadUrl\");\n  }\n\n  // ============================================================\n  // Metadata Operations\n  // ============================================================\n\n  /**\n   * Get file info/metadata without downloading\n   */\n  public async metadata(location: string): Promise<StorageFileInfo> {\n    return this.withRetry(async () => {\n      const { HeadObjectCommand } = S3Client;\n\n      // Apply storage prefix\n      location = this.applyPrefix(location);\n\n      const command = new HeadObjectCommand({\n        Bucket: this.options.bucket,\n        Key: location,\n      });\n\n      const result = await this.client.send(command);\n      const name = location.split(\"/\").pop() || \"\";\n\n      return {\n        path: location,\n        name,\n        size: result.ContentLength || 0,\n        isDirectory: false,\n        lastModified: result.LastModified,\n        mimeType: result.ContentType || this.guessMimeType(location),\n        etag: result.ETag,\n        storageClass: result.StorageClass,\n      };\n    }, \"metadata\");\n  }\n\n  /**\n   * Get file size in bytes (shortcut for metadata().size)\n   */\n  public async size(location: string): Promise<number> {\n    const info = await this.metadata(location);\n    return info.size;\n  }\n\n  // ============================================================\n  // File Operations\n  // ============================================================\n\n  /**\n   * Build a URL-encoded CopySource (\"bucket/key\") as the SDK requires\n   */\n  protected copySource(key: string): string {\n    const encodedKey = key.split(\"/\").map(encodeURIComponent).join(\"/\");\n\n    return `${this.options.bucket}/${encodedKey}`;\n  }\n\n  /**\n   * Copy file to a new location\n   */\n  public async copy(from: string, to: string): Promise<CloudStorageFileData> {\n    return this.withRetry(async () => {\n      const { CopyObjectCommand, HeadObjectCommand } = S3Client;\n\n      // CopyObject drops the ACL, so a public source would silently become private\n      const visibility = await this.getVisibility(from).catch(() => \"private\" as const);\n\n      // Apply storage prefix to both paths\n      from = this.applyPrefix(from);\n      to = this.applyPrefix(to);\n\n      const command = new CopyObjectCommand({\n        Bucket: this.options.bucket,\n        CopySource: this.copySource(from),\n        Key: to,\n        ...(this.visibilityMode === \"acl\" &&\n          visibility === \"public\" && { ACL: \"public-read\" as const }),\n      });\n\n      const result = await this.client.send(command);\n\n      // Get file metadata\n      const headCommand = new HeadObjectCommand({\n        Bucket: this.options.bucket,\n        Key: to,\n      });\n      const headResult = await this.client.send(headCommand);\n\n      return {\n        path: to,\n        url: this.url(to),\n        size: headResult.ContentLength || 0,\n        hash: headResult.ETag?.replace(/\"/g, \"\") || \"\",\n        mimeType: headResult.ContentType || this.guessMimeType(to),\n        driver: this.name,\n        bucket: this.options.bucket!,\n        region: this.options.region!,\n        etag: result.CopyObjectResult?.ETag,\n        versionId: result.VersionId,\n      };\n    }, \"copy\");\n  }\n\n  /**\n   * Move file to a new location\n   */\n  public async move(from: string, to: string): Promise<CloudStorageFileData> {\n    const file = await this.copy(from, to);\n    await this.delete(from);\n    return file;\n  }\n\n  /**\n   * List files in a directory\n   */\n  public async list(directory: string, options?: ListOptions): Promise<StorageFileInfo[]> {\n    return this.withRetry(async () => {\n      const { ListObjectsV2Command } = S3Client;\n\n      // Apply storage prefix\n      directory = this.applyPrefix(directory);\n\n      // A directory prefix must end in \"/\" so \"images\" doesn't match \"images-old/…\"\n      if (directory && directory !== \"/\" && !directory.endsWith(\"/\")) {\n        directory = `${directory}/`;\n      }\n\n      const command = new ListObjectsV2Command({\n        Bucket: this.options.bucket,\n        Prefix: directory,\n        MaxKeys: options?.limit,\n        ContinuationToken: options?.cursor,\n        Delimiter: options?.recursive ? undefined : \"/\",\n      });\n\n      const result = await this.client.send(command);\n      const files: StorageFileInfo[] = [];\n\n      // Add files\n      for (const object of result.Contents || []) {\n        if (!object.Key) continue;\n\n        files.push({\n          path: object.Key,\n          name: object.Key.split(\"/\").pop() || \"\",\n          size: object.Size || 0,\n          isDirectory: false,\n          lastModified: object.LastModified,\n          etag: object.ETag,\n          storageClass: object.StorageClass,\n        });\n      }\n\n      // Add directories\n      for (const prefix of result.CommonPrefixes || []) {\n        if (!prefix.Prefix) continue;\n\n        files.push({\n          path: prefix.Prefix,\n          name: prefix.Prefix.split(\"/\").filter(Boolean).pop() || \"\",\n          size: 0,\n          isDirectory: true,\n        });\n      }\n\n      return files;\n    }, \"list\");\n  }\n\n  // ============================================================\n  // Cloud-Specific Operations\n  // ============================================================\n\n  /**\n   * Get bucket name\n   */\n  public getBucket(): string {\n    return this.options.bucket!;\n  }\n\n  /**\n   * Get region\n   */\n  public getRegion(): string {\n    return this.options.region!;\n  }\n\n  /**\n   * Set storage class (e.g., STANDARD, GLACIER, etc.)\n   */\n  public async setStorageClass(location: string, storageClass: string): Promise<void> {\n    return this.withRetry(async () => {\n      const { CopyObjectCommand } = S3Client;\n\n      // Apply storage prefix\n      location = this.applyPrefix(location);\n\n      const command = new CopyObjectCommand({\n        Bucket: this.options.bucket,\n        CopySource: this.copySource(location),\n        Key: location,\n        StorageClass: storageClass as any,\n        MetadataDirective: \"COPY\",\n      });\n\n      await this.client.send(command);\n    }, \"setStorageClass\");\n  }\n\n  /**\n   * Set file visibility (public or private)\n   */\n  public async setVisibility(location: string, visibility: FileVisibility): Promise<void> {\n    if (this.visibilityMode !== \"acl\") {\n      throw new StorageCapabilityError(\"setVisibility\", this.name);\n    }\n\n    return this.withRetry(async () => {\n      const { PutObjectAclCommand } = S3Client;\n\n      // Apply storage prefix\n      location = this.applyPrefix(location);\n\n      const command = new PutObjectAclCommand({\n        Bucket: this.options.bucket,\n        Key: location,\n        ACL: visibility === \"public\" ? \"public-read\" : \"private\",\n      });\n\n      await this.client.send(command);\n    }, \"setVisibility\");\n  }\n\n  /**\n   * Get file visibility\n   */\n  public async getVisibility(location: string): Promise<FileVisibility> {\n    return this.withRetry(async () => {\n      const { GetObjectAclCommand } = S3Client;\n\n      // Apply storage prefix\n      location = this.applyPrefix(location);\n\n      const command = new GetObjectAclCommand({\n        Bucket: this.options.bucket,\n        Key: location,\n      });\n\n      const result = await this.client.send(command);\n\n      // Check if any grant allows public read\n      const hasPublicRead = result.Grants?.some(\n        (grant) =>\n          grant.Grantee?.URI === \"http://acs.amazonaws.com/groups/global/AllUsers\" &&\n          grant.Permission === \"READ\",\n      );\n\n      return hasPublicRead ? \"public\" : \"private\";\n    }, \"getVisibility\");\n  }\n\n  // ============================================================\n  // Utilities\n  // ============================================================\n\n  /**\n   * Calculate SHA-256 hash\n   */\n  protected calculateHash(buffer: Buffer): string {\n    return crypto.createHash(\"sha256\").update(new Uint8Array(buffer)).digest(\"hex\");\n  }\n\n  /**\n   * Guess MIME type from file extension\n   */\n  protected guessMimeType(location: string): string {\n    return getMimeType(location);\n  }\n}\n"],"mappings":";;;;;;;;;;AA2BA,IAAI;AACJ,IAAI;AACJ,IAAI;AAEJ,IAAI,iBAAiC;;;;AAKrC,MAAM,0BAA0B;;;;;;;EAO9B,KAAK;;;;AAKP,IAAI,wBAA8C;;;;;;;;;;AAWlD,eAAsB,SAAwB;CAE5C,IAAI,mBAAmB,MAAM;CAG7B,IAAI,uBAAuB,OAAO;CAElC,yBAAyB,YAAY;EACnC,IAAI;GAEF,MAAM,CAAC,QAAQ,SAAS,aAAa,MAAM,QAAQ,IAAI;IACrD,OAAO;IACP,OAAO;IACP,OAAO;GACT,CAAC;GAED,WAAW;GACX,YAAY;GACZ,cAAc;GAEd,iBAAiB;EACnB,QAAQ;GAEN,iBAAiB;EACnB;CACF,EAAC,CAAE;CAEH,OAAO;AACT;AAEA,OAAO;;;;;;;;;;;;;;;;AAiBP,SAAS,aAAsB;CAC7B,IAAI,mBAAmB,MACrB,OAAO;CAGT,IAAI;EAGF,MAAM,MAAM,cAAc,OAAO,KAAK,GAAG;EACzC,WAAW,IAAI,oBAAoB;EACnC,YAAY,IAAI,sBAAsB;EACtC,cAAc,IAAI,+BAA+B;EACjD,iBAAiB;CACnB,QAAQ;EACN,iBAAiB;CACnB;CAEA,OAAO;AACT;;;;;;;;;;;;;;;;;AAsBA,IAAsB,cAAtB,MAEwC;;;;;;;CAsBtC,IAAc,iBAA4C;EACxD,OAAQ,KAAK,QAA2D,kBAAkB;CAC5F;;;;;;CAOA,AAAU,WAAW,YAAwD;EAC3E,IAAI,eAAe,UAAU,OAAO;EAEpC,IAAI,KAAK,mBAAmB,QAC1B,MAAM,IAAI,uBAAuB,qBAAqB,KAAK,IAAI;EAGjE,OAAO,KAAK,mBAAmB,QAAQ,gBAAgB;CACzD;CAEA,AAAO,YAAY,AAAO,SAAmB;EAAnB;EAIxB,IAAI,mBAAmB,MACrB,WAAW;EAGb,IAAI,CAAC,gBACH,MAAM,IAAI,MAAM,uBAAuB;EAKzC,MAAM,EACJ,QAAQ,SACR,aACA,iBACA,UAAU,WACV,QAAQ,SACR,WAAW,YACX,OAAO,QACP,WAAW,YACX,cAAc,eACd,QAAQ,SACR,gBAAgB,iBAChB,GAAG,kBACD,KAAK;EAET,KAAK,SAAS,IAAI,SAAS,SAAS;GAClC,GAAG;GACH,QAAQ,KAAK,QAAQ;GAGrB,GAAI,eAAe,mBAAmB,EAAE,aAAa;IAAE;IAAa;GAAgB,EAAE;GACtF,GAAI,KAAK,YAAY,KAAK,EAAE,UAAU,KAAK,YAAY,EAAE;EAC3D,CAAgD;EAGhD,KAAK,cAAc;GACjB,YAAY,KAAK,QAAQ,OAAO,cAAc;GAC9C,gBAAgB,KAAK,QAAQ,OAAO,kBAAkB;GACtD,YAAY,KAAK,QAAQ,OAAO,cAAc;GAC9C,mBAAmB,KAAK,QAAQ,OAAO,qBAAqB;EAC9D;CACF;;;;;CAiBA,AAAU,cAAkC;EAC1C,OAAO,KAAK,QAAQ;CACtB;;;;;;;;;;CAeA,AAAO,YAAY,UAA0B;EAG3C,MAAM,SADgB,qBAAqB,UAChB,KAAK,KAAK,QAAQ;EAE7C,IAAI,CAAC,QACH,OAAO;EAGT,MAAM,cAAc,OAAO,QAAQ,QAAQ,EAAE;EAC7C,MAAM,gBAAgB,SAAS,QAAQ,QAAQ,EAAE;EAGjD,IAAI,cAAc,WAAW,cAAc,GAAG,KAAK,kBAAkB,aACnE,OAAO;EAGT,OAAO,GAAG,YAAY,GAAG;CAC3B;;;;;CAMA,AAAU,cAAc,MAAsB;EAC5C,OAAO,KACJ,QAAQ,QAAQ,GAAG,CAAC,CACpB,QAAQ,OAAO,EAAE,CAAC,CAClB,KAAK;CACV;;;;;;;;;;;CAYA,MAAgB,UACd,WACA,gBAAwB,aACZ;EACZ,MAAM,EAAE,YAAY,gBAAgB,mBAAmB,eAAe,KAAK;EAE3E,IAAI;EAGJ,MAAM,WAAW,aAAa;EAE9B,KAAK,IAAI,UAAU,GAAG,UAAU,UAAU,WACxC,IAAI;GACF,OAAO,MAAM,UAAU;EACzB,SAAS,OAAO;GACd,YAAY;GAGZ,IAAI,YAAY,WAAW,GACzB;GAIF,IAAI,CAAC,KAAK,iBAAiB,KAAK,GAC9B,MAAM;GAIR,MAAM,UAAU,KAAK,IAAI,iBAAiB,KAAK,IAAI,mBAAmB,OAAO,GAAG,UAAU;GAG1F,MAAM,IAAI,SAAS,YAAY,WAAW,SAAS,OAAO,CAAC;EAC7D;EAIF,MAAM;CACR;;;;;;;;;;;;;;;;;;;CAoBA,AAAU,iBAAiB,OAAqB;EAE9C,IAAI,MAAM,SAAS,gBAAgB,MAAM,SAAS,eAAe,MAAM,SAAS,aAC9E,OAAO;EAIT,IAAI,MAAM,SAAS,qBAAqB,MAAM,SAAS,gBACrD,OAAO;EAIT,MAAM,aAAa,MAAM,WAAW,kBAAkB,MAAM;EAC5D,IAAI,YAAY;GAEd,IAAI,cAAc,OAAO,aAAa,KACpC,OAAO;GAIT,IAAI,eAAe,KACjB,OAAO;EAEX;EAEA,OAAO;CACT;;;;CASA,MAAa,IACX,MACA,UACA,SAC+B;EAC/B,OAAO,KAAK,UAAU,YAAY;GAChC,MAAM,EAAE,qBAAqB;GAG7B,WAAW,KAAK,YAAY,QAAQ;GAEpC,MAAM,OAAO,KAAK,cAAc,IAAI;GACpC,MAAM,WAAW,SAAS,YAAY,KAAK,cAAc,QAAQ;GAEjE,MAAM,UAAU,IAAI,iBAAiB;IACnC,QAAQ,KAAK,QAAQ;IACrB,KAAK;IACL,MAAM;IACN,aAAa;IACb,cAAc,SAAS;IACvB,oBAAoB,SAAS;IAC7B,UAAU,SAAS;IACnB,KAAK,KAAK,WAAW,SAAS,UAAU;GAC1C,CAAC;GAED,MAAM,SAAS,MAAM,KAAK,OAAO,KAAK,OAAO;GAE7C,OAAO;IACL,MAAM;IACN,KAAK,KAAK,IAAI,QAAQ;IACtB,MAAM,KAAK;IACX;IACA;IACA,QAAQ,KAAK;IACb,QAAQ,KAAK,QAAQ;IACrB,QAAQ,KAAK,QAAQ;IACrB,MAAM,OAAO;IACb,WAAW,OAAO;GACpB;EACF,GAAG,KAAK;CACV;;;;;;;;;CAUA,MAAa,YACX,MACA,UACA,SACsC;EACtC,MAAM,OAAO,OAAO,SAAS,WAAW,OAAO,KAAK,IAAI,IAAI;EAE5D,OAAO,KAAK,UAAU,YAAY;GAChC,MAAM,EAAE,qBAAqB;GAE7B,WAAW,KAAK,YAAY,QAAQ;GAEpC,MAAM,OAAO,KAAK,cAAc,IAAI;GACpC,MAAM,WAAW,SAAS,YAAY,KAAK,cAAc,QAAQ;GAEjE,MAAM,UAAU,IAAI,iBAAiB;IACnC,QAAQ,KAAK,QAAQ;IACrB,KAAK;IACL,MAAM;IACN,aAAa;IACb,cAAc,SAAS;IACvB,oBAAoB,SAAS;IAC7B,UAAU,SAAS;IACnB,KAAK,KAAK,WAAW,SAAS,UAAU;IACxC,aAAa;GACf,CAAC;GAED,IAAI;GAEJ,IAAI;IACF,SAAS,MAAM,KAAK,OAAO,KAAK,OAAO;GACzC,SAAS,OAAY;IACnB,MAAM,SAAS,OAAO,WAAW;IAEjC,IACE,WAAW,OACX,WAAW,OACX,OAAO,SAAS,wBAChB,OAAO,SAAS,8BAEhB,OAAO;IAGT,MAAM;GACR;GAEA,OAAO;IACL,MAAM;IACN,KAAK,KAAK,IAAI,QAAQ;IACtB,MAAM,KAAK;IACX;IACA;IACA,QAAQ,KAAK;IACb,QAAQ,KAAK,QAAQ;IACrB,QAAQ,KAAK,QAAQ;IACrB,MAAM,OAAO;IACb,WAAW,OAAO;GACpB;EACF,GAAG,aAAa;CAClB;;;;;CAMA,MAAa,UACX,QACA,UACA,SAC+B;EAG/B;GACE,MAAM,EAAE,WAAW;GAGnB,WAAW,KAAK,YAAY,QAAQ;GAEpC,MAAM,WAAW,SAAS,YAAY,KAAK,cAAc,QAAQ;GAgBjE,MAAM,SAAS,MAAM,IAdF,OAAO;IACxB,QAAQ,KAAK;IACb,QAAQ;KACN,QAAQ,KAAK,QAAQ;KACrB,KAAK;KACL,MAAM;KACN,aAAa;KACb,cAAc,SAAS;KACvB,oBAAoB,SAAS;KAC7B,UAAU,SAAS;KACnB,KAAK,KAAK,WAAW,SAAS,UAAU;IAC1C;GACF,CAE0B,CAAC,CAAC,KAAK;GAGjC,MAAM,OAAO,MAAM,KAAK,SAAS,QAAQ;GAEzC,OAAO;IACL,MAAM;IACN,KAAK,KAAK,IAAI,QAAQ;IACtB,MAAM,KAAK;IACX,MAAM,KAAK,MAAM,QAAQ,MAAM,EAAE,KAAK;IACtC;IACA,QAAQ,KAAK;IACb,QAAQ,KAAK,QAAQ;IACrB,QAAQ,KAAK,QAAQ;IACrB,MAAM,OAAO;IACb,WAAW,OAAO;GACpB;EACF;CACF;;;;CAKA,MAAa,IAAI,UAAmC;EAClD,OAAO,KAAK,UAAU,YAAY;GAChC,MAAM,EAAE,qBAAqB;GAG7B,WAAW,KAAK,YAAY,QAAQ;GAEpC,MAAM,UAAU,IAAI,iBAAiB;IACnC,QAAQ,KAAK,QAAQ;IACrB,KAAK;GACP,CAAC;GAED,MAAM,SAAS,MAAM,KAAK,OAAO,KAAK,OAAO;GAE7C,IAAI,CAAC,OAAO,MACV,MAAM,IAAI,MAAM,mBAAmB,UAAU;GAG/C,OAAO,OAAO,KAAK,MAAM,OAAO,KAAK,qBAAqB,CAAC;EAC7D,GAAG,KAAK;CACV;;;;CAKA,MAAa,UAAU,UAAqC;EAC1D,OAAO,KAAK,UAAU,YAAY;GAChC,MAAM,EAAE,qBAAqB;GAG7B,WAAW,KAAK,YAAY,QAAQ;GAEpC,MAAM,UAAU,IAAI,iBAAiB;IACnC,QAAQ,KAAK,QAAQ;IACrB,KAAK;GACP,CAAC;GAED,MAAM,SAAS,MAAM,KAAK,OAAO,KAAK,OAAO;GAE7C,IAAI,CAAC,OAAO,MACV,MAAM,IAAI,MAAM,mBAAmB,UAAU;GAG/C,OAAO,OAAO;EAChB,GAAG,WAAW;CAChB;;;;CAKA,MAAa,OAAO,UAAoC;EACtD,OAAO,KAAK,UAAU,YAAY;GAChC,MAAM,EAAE,wBAAwB;GAGhC,WAAW,KAAK,YAAY,QAAQ;GAEpC,MAAM,UAAU,IAAI,oBAAoB;IACtC,QAAQ,KAAK,QAAQ;IACrB,KAAK;GACP,CAAC;GAED,MAAM,KAAK,OAAO,KAAK,OAAO;GAE9B,OAAO;EACT,GAAG,QAAQ;CACb;;;;CAKA,MAAa,WAAW,WAAkD;EACxE,IAAI,UAAU,WAAW,GACvB,OAAO,CAAC;EAGV,OAAO,KAAK,UAAU,YAAY;GAChC,MAAM,EAAE,yBAAyB;GAGjC,MAAM,oBAAoB,UAAU,KAAK,QAAQ,KAAK,YAAY,GAAG,CAAC;GAEtE,MAAM,UAAU,IAAI,qBAAqB;IACvC,QAAQ,KAAK,QAAQ;IACrB,QAAQ;KACN,SAAS,kBAAkB,KAAK,SAAS,EAAE,IAAI,EAAE;KACjD,OAAO;IACT;GACF,CAAC;GAED,MAAM,SAAS,MAAM,KAAK,OAAO,KAAK,OAAO;GAC7C,MAAM,UAA8B,CAAC;GAGrC,KAAK,MAAM,WAAW,OAAO,WAAW,CAAC,GACvC,IAAI,QAAQ,KACV,QAAQ,KAAK;IAAE,UAAU,QAAQ;IAAK,SAAS;GAAK,CAAC;GAKzD,KAAK,MAAM,SAAS,OAAO,UAAU,CAAC,GACpC,IAAI,MAAM,KACR,QAAQ,KAAK;IACX,UAAU,MAAM;IAChB,SAAS;IACT,OAAO,MAAM,WAAW;GAC1B,CAAC;GAIL,OAAO;EACT,GAAG,YAAY;CACjB;;;;;;;;;;CAWA,MAAa,gBAAgB,eAAyC;EACpE,MAAM,EAAE,sBAAsB,yBAAyB;EAGvD,gBAAgB,KAAK,YAAY,aAAa;EAG9C,MAAM,SAAS,cAAc,SAAS,GAAG,IAAI,gBAAgB,GAAG,cAAc;EAK9E,IAAI;EAEJ,GAAG;GACD,MAAM,aAAa,MAAM,KAAK,gBAE1B,KAAK,OAAO,KACV,IAAI,qBAAqB;IACvB,QAAQ,KAAK,QAAQ;IACrB,QAAQ;IACR,mBAAmB;GACrB,CAAC,CACH,GACF,sBACF;GAEA,MAAM,QAAQ,WAAW,YAAY,CAAC,EAAC,CACpC,KAAK,WAAW,OAAO,GAAG,CAAC,CAC3B,QAAQ,QAAuB,QAAQ,GAAG,CAAC;GAE9C,IAAI,KAAK,SAAS,GAGhB,MAAM,KAAK,gBAEP,KAAK,OAAO,KACV,IAAI,qBAAqB;IACvB,QAAQ,KAAK,QAAQ;IACrB,QAAQ;KACN,SAAS,KAAK,KAAK,SAAS,EAAE,IAAI,EAAE;KACpC,OAAO;IACT;GACF,CAAC,CACH,GACF,wBACF;GAGF,oBAAoB,WAAW,cAAc,WAAW,wBAAwB;EAClF,SAAS;EAET,OAAO;CACT;;;;CAKA,MAAa,OAAO,UAAoC;EAEtD,IAAI;GACF,MAAM,EAAE,sBAAsB;GAG9B,WAAW,KAAK,YAAY,QAAQ;GAEpC,MAAM,UAAU,IAAI,kBAAkB;IACpC,QAAQ,KAAK,QAAQ;IACrB,KAAK;GACP,CAAC;GAED,MAAM,KAAK,OAAO,KAAK,OAAO;GAC9B,OAAO;EACT,SAAS,OAAO;GAGd,MAAM,EAAE,MAAM,cAAe,SAAS,CAAC;GAKvC,IAAI,SAAS,cAAc,SAAS,eAAe,WAAW,mBAAmB,KAC/E,OAAO;GAGT,MAAM;EACR;CACF;;;;CASA,MAAa,aAAa,UAAkB,YAAY,MAAuB;EAC7E,OAAO,KAAK,gBAAgB,UAAU,EAAE,UAAU,CAAC;CACrD;;;;CAKA,MAAa,gBAAgB,UAAkB,SAA6C;EAC1F,OAAO,KAAK,UAAU,YAAY;GAChC,MAAM,EAAE,qBAAqB;GAC7B,MAAM,EAAE,iBAAiB;GAGzB,WAAW,KAAK,YAAY,QAAQ;GAEpC,MAAM,UAAU,IAAI,iBAAiB;IACnC,QAAQ,KAAK,QAAQ;IACrB,KAAK;GACP,CAAC;GAED,OAAO,aAAa,KAAK,QAAQ,SAAS,EACxC,WAAW,SAAS,aAAa,KACnC,CAAC;EACH,GAAG,iBAAiB;CACtB;;;;CAKA,MAAa,sBACX,UACA,SACiB;EACjB,OAAO,KAAK,UAAU,YAAY;GAChC,MAAM,EAAE,qBAAqB;GAC7B,MAAM,EAAE,iBAAiB;GAGzB,WAAW,KAAK,YAAY,QAAQ;GAEpC,MAAM,UAAU,IAAI,iBAAiB;IACnC,QAAQ,KAAK,QAAQ;IACrB,KAAK;IACL,aAAa,SAAS;IACtB,UAAU,SAAS;GACrB,CAAC;GAED,OAAO,aAAa,KAAK,QAAQ,SAAS,EACxC,WAAW,SAAS,aAAa,KACnC,CAAC;EACH,GAAG,uBAAuB;CAC5B;;;;CASA,MAAa,SAAS,UAA4C;EAChE,OAAO,KAAK,UAAU,YAAY;GAChC,MAAM,EAAE,sBAAsB;GAG9B,WAAW,KAAK,YAAY,QAAQ;GAEpC,MAAM,UAAU,IAAI,kBAAkB;IACpC,QAAQ,KAAK,QAAQ;IACrB,KAAK;GACP,CAAC;GAED,MAAM,SAAS,MAAM,KAAK,OAAO,KAAK,OAAO;GAC7C,MAAM,OAAO,SAAS,MAAM,GAAG,CAAC,CAAC,IAAI,KAAK;GAE1C,OAAO;IACL,MAAM;IACN;IACA,MAAM,OAAO,iBAAiB;IAC9B,aAAa;IACb,cAAc,OAAO;IACrB,UAAU,OAAO,eAAe,KAAK,cAAc,QAAQ;IAC3D,MAAM,OAAO;IACb,cAAc,OAAO;GACvB;EACF,GAAG,UAAU;CACf;;;;CAKA,MAAa,KAAK,UAAmC;EAEnD,QAAO,MADY,KAAK,SAAS,QAAQ,EAC9B,CAAC;CACd;;;;CASA,AAAU,WAAW,KAAqB;EACxC,MAAM,aAAa,IAAI,MAAM,GAAG,CAAC,CAAC,IAAI,kBAAkB,CAAC,CAAC,KAAK,GAAG;EAElE,OAAO,GAAG,KAAK,QAAQ,OAAO,GAAG;CACnC;;;;CAKA,MAAa,KAAK,MAAc,IAA2C;EACzE,OAAO,KAAK,UAAU,YAAY;GAChC,MAAM,EAAE,mBAAmB,sBAAsB;GAGjD,MAAM,aAAa,MAAM,KAAK,cAAc,IAAI,CAAC,CAAC,YAAY,SAAkB;GAGhF,OAAO,KAAK,YAAY,IAAI;GAC5B,KAAK,KAAK,YAAY,EAAE;GAExB,MAAM,UAAU,IAAI,kBAAkB;IACpC,QAAQ,KAAK,QAAQ;IACrB,YAAY,KAAK,WAAW,IAAI;IAChC,KAAK;IACL,GAAI,KAAK,mBAAmB,SAC1B,eAAe,YAAY,EAAE,KAAK,cAAuB;GAC7D,CAAC;GAED,MAAM,SAAS,MAAM,KAAK,OAAO,KAAK,OAAO;GAG7C,MAAM,cAAc,IAAI,kBAAkB;IACxC,QAAQ,KAAK,QAAQ;IACrB,KAAK;GACP,CAAC;GACD,MAAM,aAAa,MAAM,KAAK,OAAO,KAAK,WAAW;GAErD,OAAO;IACL,MAAM;IACN,KAAK,KAAK,IAAI,EAAE;IAChB,MAAM,WAAW,iBAAiB;IAClC,MAAM,WAAW,MAAM,QAAQ,MAAM,EAAE,KAAK;IAC5C,UAAU,WAAW,eAAe,KAAK,cAAc,EAAE;IACzD,QAAQ,KAAK;IACb,QAAQ,KAAK,QAAQ;IACrB,QAAQ,KAAK,QAAQ;IACrB,MAAM,OAAO,kBAAkB;IAC/B,WAAW,OAAO;GACpB;EACF,GAAG,MAAM;CACX;;;;CAKA,MAAa,KAAK,MAAc,IAA2C;EACzE,MAAM,OAAO,MAAM,KAAK,KAAK,MAAM,EAAE;EACrC,MAAM,KAAK,OAAO,IAAI;EACtB,OAAO;CACT;;;;CAKA,MAAa,KAAK,WAAmB,SAAmD;EACtF,OAAO,KAAK,UAAU,YAAY;GAChC,MAAM,EAAE,yBAAyB;GAGjC,YAAY,KAAK,YAAY,SAAS;GAGtC,IAAI,aAAa,cAAc,OAAO,CAAC,UAAU,SAAS,GAAG,GAC3D,YAAY,GAAG,UAAU;GAG3B,MAAM,UAAU,IAAI,qBAAqB;IACvC,QAAQ,KAAK,QAAQ;IACrB,QAAQ;IACR,SAAS,SAAS;IAClB,mBAAmB,SAAS;IAC5B,WAAW,SAAS,YAAY,SAAY;GAC9C,CAAC;GAED,MAAM,SAAS,MAAM,KAAK,OAAO,KAAK,OAAO;GAC7C,MAAM,QAA2B,CAAC;GAGlC,KAAK,MAAM,UAAU,OAAO,YAAY,CAAC,GAAG;IAC1C,IAAI,CAAC,OAAO,KAAK;IAEjB,MAAM,KAAK;KACT,MAAM,OAAO;KACb,MAAM,OAAO,IAAI,MAAM,GAAG,CAAC,CAAC,IAAI,KAAK;KACrC,MAAM,OAAO,QAAQ;KACrB,aAAa;KACb,cAAc,OAAO;KACrB,MAAM,OAAO;KACb,cAAc,OAAO;IACvB,CAAC;GACH;GAGA,KAAK,MAAM,UAAU,OAAO,kBAAkB,CAAC,GAAG;IAChD,IAAI,CAAC,OAAO,QAAQ;IAEpB,MAAM,KAAK;KACT,MAAM,OAAO;KACb,MAAM,OAAO,OAAO,MAAM,GAAG,CAAC,CAAC,OAAO,OAAO,CAAC,CAAC,IAAI,KAAK;KACxD,MAAM;KACN,aAAa;IACf,CAAC;GACH;GAEA,OAAO;EACT,GAAG,MAAM;CACX;;;;CASA,AAAO,YAAoB;EACzB,OAAO,KAAK,QAAQ;CACtB;;;;CAKA,AAAO,YAAoB;EACzB,OAAO,KAAK,QAAQ;CACtB;;;;CAKA,MAAa,gBAAgB,UAAkB,cAAqC;EAClF,OAAO,KAAK,UAAU,YAAY;GAChC,MAAM,EAAE,sBAAsB;GAG9B,WAAW,KAAK,YAAY,QAAQ;GAEpC,MAAM,UAAU,IAAI,kBAAkB;IACpC,QAAQ,KAAK,QAAQ;IACrB,YAAY,KAAK,WAAW,QAAQ;IACpC,KAAK;IACL,cAAc;IACd,mBAAmB;GACrB,CAAC;GAED,MAAM,KAAK,OAAO,KAAK,OAAO;EAChC,GAAG,iBAAiB;CACtB;;;;CAKA,MAAa,cAAc,UAAkB,YAA2C;EACtF,IAAI,KAAK,mBAAmB,OAC1B,MAAM,IAAI,uBAAuB,iBAAiB,KAAK,IAAI;EAG7D,OAAO,KAAK,UAAU,YAAY;GAChC,MAAM,EAAE,wBAAwB;GAGhC,WAAW,KAAK,YAAY,QAAQ;GAEpC,MAAM,UAAU,IAAI,oBAAoB;IACtC,QAAQ,KAAK,QAAQ;IACrB,KAAK;IACL,KAAK,eAAe,WAAW,gBAAgB;GACjD,CAAC;GAED,MAAM,KAAK,OAAO,KAAK,OAAO;EAChC,GAAG,eAAe;CACpB;;;;CAKA,MAAa,cAAc,UAA2C;EACpE,OAAO,KAAK,UAAU,YAAY;GAChC,MAAM,EAAE,wBAAwB;GAGhC,WAAW,KAAK,YAAY,QAAQ;GAEpC,MAAM,UAAU,IAAI,oBAAoB;IACtC,QAAQ,KAAK,QAAQ;IACrB,KAAK;GACP,CAAC;GAWD,QANsB,MAHD,KAAK,OAAO,KAAK,OAAO,EAGjB,CAAC,QAAQ,MAClC,UACC,MAAM,SAAS,QAAQ,qDACvB,MAAM,eAAe,MACzB,IAEuB,WAAW;EACpC,GAAG,eAAe;CACpB;;;;CASA,AAAU,cAAc,QAAwB;EAC9C,OAAO,OAAO,WAAW,QAAQ,CAAC,CAAC,OAAO,IAAI,WAAW,MAAM,CAAC,CAAC,CAAC,OAAO,KAAK;CAChF;;;;CAKA,AAAU,cAAc,UAA0B;EAChD,OAAO,YAAY,QAAQ;CAC7B;AACF"}