@wildo-ai/saas-backend-lib 1.1.1 → 1.1.3

package/dist/esm/files/handlers/resource-file-upload-handler.backend.service.d.ts

@@ -36,6 +36,8 @@ import { FileStorageRouterBackendService } from '../../files/storage/file-storag
 import { FileFieldDetectionBackendService } from '../../files/services/file-field-detection.backend.service';
 import { FileStoragePathResolverBackendService } from '../../files/storage/file-storage-path-resolver.backend.service';
 import { FileScanningBackendService } from '../../files/services/file-scanning.backend.service';
+import { ConsumableTokenBackendService } from '../../security/consumable-tokens/services/consumable-token.backend.service';
+import { FileUploadGrantBackendService } from '../../files/services/file-upload-grant.backend.service';
 export declare class ResourceFileUploadHandlerBackendService {
     private readonly logger;
     private readonly errorBuilder;
@@ -49,8 +51,10 @@ export declare class ResourceFileUploadHandlerBackendService {
     private readonly appConfigService;
     private readonly pathResolver;
     private readonly fileScanningService;
+    private readonly consumableTokenService;
+    private readonly fileUploadGrantService;
     protected logDebug: (message: string, context?: Record<string, unknown>) => void;
-    constructor(logger: LoggerService, errorBuilder: ErrorBuilderBackendService, resourcesRegistry: ResourcesRegistryBackendService, constraintResolver: FileConstraintResolverChain, fileValidator: FileValidationService, filesService: FilesBackendService, fileStorageRouter: FileStorageRouterBackendService, fileFieldDetection: FileFieldDetectionBackendService, resourceOperationHelper: ResourceOperationHelperBackendService, appConfigService: AppConfigurationService, pathResolver: FileStoragePathResolverBackendService, fileScanningService: FileScanningBackendService);
+    constructor(logger: LoggerService, errorBuilder: ErrorBuilderBackendService, resourcesRegistry: ResourcesRegistryBackendService, constraintResolver: FileConstraintResolverChain, fileValidator: FileValidationService, filesService: FilesBackendService, fileStorageRouter: FileStorageRouterBackendService, fileFieldDetection: FileFieldDetectionBackendService, resourceOperationHelper: ResourceOperationHelperBackendService, appConfigService: AppConfigurationService, pathResolver: FileStoragePathResolverBackendService, fileScanningService: FileScanningBackendService, consumableTokenService: ConsumableTokenBackendService, fileUploadGrantService: FileUploadGrantBackendService);
     /**
      * Extract the resource instance from the request body (if available).
      * In multipart uploads, the resource data may be present in `req.body`

package/dist/esm/files/handlers/resource-file-upload-handler.backend.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resource-file-upload-handler.backend.service.d.ts","sourceRoot":"","sources":["../../../../../src/files/handlers/resource-file-upload-handler.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAGH,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAG/D,OAAO,EAAE,qBAAqB,EAAE,YAAY,EAAiN,MAAM,uBAAuB,CAAC;AAG3R,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAClG,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAC9G,OAAO,EAAE,+BAA+B,EAAE,MAAM,0EAA0E,CAAC;AAC3H,OAAO,EAAE,gBAAgB,EAAE,MAAM,qEAAqE,CAAC;AACvG,OAAO,EAAE,2BAA2B,EAAE,MAAM,qFAAqF,CAAC;AAClI,OAAO,EAAE,qBAAqB,EAAE,MAAM,sEAAsE,CAAC;AAC7G,OAAO,EAAE,mBAAmB,EAAE,MAAM,yDAAyD,CAAC;AAC9F,OAAO,EAAE,qCAAqC,EAAE,MAAM,qFAAqF,CAAC;AAG5I,OAAO,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AAC/G,OAAO,EAAE,+BAA+B,EAAE,MAAM,sEAAsE,CAAC;AACvH,OAAO,EAAE,gCAAgC,EAAE,MAAM,wEAAwE,CAAC;AAC1H,OAAO,EAAE,qCAAqC,EAAE,MAAM,6EAA6E,CAAC;AAEpI,OAAO,EAAE,0BAA0B,EAAE,MAAM,iEAAiE,CAAC;AAI7G,qBACa,uCAAuC;IAKhD,OAAO,CAAC,QAAQ,CAAC,MAAM;IAEvB,OAAO,CAAC,QAAQ,CAAC,YAAY;IAE7B,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IAElC,OAAO,CAAC,QAAQ,CAAC,kBAAkB;IAEnC,OAAO,CAAC,QAAQ,CAAC,aAAa;IAE9B,OAAO,CAAC,QAAQ,CAAC,YAAY;IAE7B,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IAElC,OAAO,CAAC,QAAQ,CAAC,kBAAkB;IAEnC,OAAO,CAAC,QAAQ,CAAC,uBAAuB;IAExC,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IAEjC,OAAO,CAAC,QAAQ,CAAC,YAAY;IAE7B,OAAO,CAAC,QAAQ,CAAC,mBAAmB;IA1BtC,SAAS,CAAC,QAAQ,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;gBAI9D,MAAM,EAAE,aAAa,EAErB,YAAY,EAAE,0BAA0B,EAExC,iBAAiB,EAAE,+BAA+B,EAElD,kBAAkB,EAAE,2BAA2B,EAE/C,aAAa,EAAE,qBAAqB,EAEpC,YAAY,EAAE,mBAAmB,EAEjC,iBAAiB,EAAE,+BAA+B,EAElD,kBAAkB,EAAE,gCAAgC,EAEpD,uBAAuB,EAAE,qCAAqC,EAE9D,gBAAgB,EAAE,uBAAuB,EAEzC,YAAY,EAAE,qCAAqC,EAEnD,mBAAmB,EAAE,0BAA0B;IAMlE;;;;OAIG;IACH,OAAO,CAAC,uBAAuB;IAO/B;;;;;;;;;;OAUG;IACG,gBAAgB,CACpB,OAAO,EAAE,OAAO,EAChB,QAAQ,EAAE,QAAQ,EAClB,YAAY,EAAE,YAAY,EAC1B,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,MAAM,GAAG,SAAS,EAC9B,SAAS,EAAE,qBAAqB,CAAC,MAAM,GAAG,qBAAqB,CAAC,MAAM,EACtE,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,GACtC,OAAO,CAAC,IAAI,CAAC;IA2ZhB;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4BG;IACG,eAAe,CACnB,OAAO,EAAE,OAAO,EAChB,QAAQ,EAAE,QAAQ,EAClB,IAAI,EAAE,YAAY,EAClB,YAAY,EAAE,YAAY,EAC1B,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,MAAM,EACd,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,GACtC,OAAO,CAAC,IAAI,CAAC;IA0FhB;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,6BAA6B;CAyHtC"}
+{"version":3,"file":"resource-file-upload-handler.backend.service.d.ts","sourceRoot":"","sources":["../../../../../src/files/handlers/resource-file-upload-handler.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAGH,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAG/D,OAAO,EAAE,qBAAqB,EAAE,YAAY,EAAiN,MAAM,uBAAuB,CAAC;AAG3R,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAClG,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAC9G,OAAO,EAAE,+BAA+B,EAAE,MAAM,0EAA0E,CAAC;AAC3H,OAAO,EAAE,gBAAgB,EAAE,MAAM,qEAAqE,CAAC;AACvG,OAAO,EAAE,2BAA2B,EAAE,MAAM,qFAAqF,CAAC;AAClI,OAAO,EAAE,qBAAqB,EAAE,MAAM,sEAAsE,CAAC;AAC7G,OAAO,EAAE,mBAAmB,EAAE,MAAM,yDAAyD,CAAC;AAC9F,OAAO,EAAE,qCAAqC,EAAE,MAAM,qFAAqF,CAAC;AAG5I,OAAO,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AAC/G,OAAO,EAAE,+BAA+B,EAAE,MAAM,sEAAsE,CAAC;AACvH,OAAO,EAAE,gCAAgC,EAAE,MAAM,wEAAwE,CAAC;AAC1H,OAAO,EAAE,qCAAqC,EAAE,MAAM,6EAA6E,CAAC;AAEpI,OAAO,EAAE,0BAA0B,EAAE,MAAM,iEAAiE,CAAC;AAG7G,OAAO,EAAE,6BAA6B,EAAE,MAAM,yFAAyF,CAAC;AACxI,OAAO,EAAE,6BAA6B,EAAE,MAAM,qEAAqE,CAAC;AAGpH,qBACa,uCAAuC;IAKhD,OAAO,CAAC,QAAQ,CAAC,MAAM;IAEvB,OAAO,CAAC,QAAQ,CAAC,YAAY;IAE7B,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IAElC,OAAO,CAAC,QAAQ,CAAC,kBAAkB;IAEnC,OAAO,CAAC,QAAQ,CAAC,aAAa;IAE9B,OAAO,CAAC,QAAQ,CAAC,YAAY;IAE7B,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IAElC,OAAO,CAAC,QAAQ,CAAC,kBAAkB;IAEnC,OAAO,CAAC,QAAQ,CAAC,uBAAuB;IAExC,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IAEjC,OAAO,CAAC,QAAQ,CAAC,YAAY;IAE7B,OAAO,CAAC,QAAQ,CAAC,mBAAmB;IAEpC,OAAO,CAAC,QAAQ,CAAC,sBAAsB;IAEvC,OAAO,CAAC,QAAQ,CAAC,sBAAsB;IA9BzC,SAAS,CAAC,QAAQ,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;gBAI9D,MAAM,EAAE,aAAa,EAErB,YAAY,EAAE,0BAA0B,EAExC,iBAAiB,EAAE,+BAA+B,EAElD,kBAAkB,EAAE,2BAA2B,EAE/C,aAAa,EAAE,qBAAqB,EAEpC,YAAY,EAAE,mBAAmB,EAEjC,iBAAiB,EAAE,+BAA+B,EAElD,kBAAkB,EAAE,gCAAgC,EAEpD,uBAAuB,EAAE,qCAAqC,EAE9D,gBAAgB,EAAE,uBAAuB,EAEzC,YAAY,EAAE,qCAAqC,EAEnD,mBAAmB,EAAE,0BAA0B,EAE/C,sBAAsB,EAAE,6BAA6B,EAErD,sBAAsB,EAAE,6BAA6B;IAMxE;;;;OAIG;IACH,OAAO,CAAC,uBAAuB;IAO/B;;;;;;;;;;OAUG;IACG,gBAAgB,CACpB,OAAO,EAAE,OAAO,EAChB,QAAQ,EAAE,QAAQ,EAClB,YAAY,EAAE,YAAY,EAC1B,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,MAAM,GAAG,SAAS,EAC9B,SAAS,EAAE,qBAAqB,CAAC,MAAM,GAAG,qBAAqB,CAAC,MAAM,EACtE,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,GACtC,OAAO,CAAC,IAAI,CAAC;IAkdhB;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4BG;IACG,eAAe,CACnB,OAAO,EAAE,OAAO,EAChB,QAAQ,EAAE,QAAQ,EAClB,IAAI,EAAE,YAAY,EAClB,YAAY,EAAE,YAAY,EAC1B,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,MAAM,EACd,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,GACtC,OAAO,CAAC,IAAI,CAAC;IA0FhB;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,6BAA6B;CAyHtC"}

package/dist/esm/files/handlers/resource-file-upload-handler.backend.service.js

@@ -53,6 +53,8 @@ import { FileStoragePathResolverBackendService } from '../../files/storage/file-
 import { FileScanningBackendService } from '../../files/services/file-scanning.backend.service.js';
 import { describeCaughtError, projectCaughtErrorLogFields } from '../../errors/utils/error-log-level-classification.backend.utils.js';
 import { resolveStorageApplicationIdentity } from '../../files/utils/storage-application-identity.backend.utils.js';
+import { ConsumableTokenBackendService } from '../../security/consumable-tokens/services/consumable-token.backend.service.js';
+import { FileUploadGrantBackendService } from '../../files/services/file-upload-grant.backend.service.js';
 let ResourceFileUploadHandlerBackendService = class ResourceFileUploadHandlerBackendService {
     logger;
     errorBuilder;
@@ -66,8 +68,10 @@ let ResourceFileUploadHandlerBackendService = class ResourceFileUploadHandlerBac
     appConfigService;
     pathResolver;
     fileScanningService;
+    consumableTokenService;
+    fileUploadGrantService;
     logDebug;
-    constructor(logger, errorBuilder, resourcesRegistry, constraintResolver, fileValidator, filesService, fileStorageRouter, fileFieldDetection, resourceOperationHelper, appConfigService, pathResolver, fileScanningService) {
+    constructor(logger, errorBuilder, resourcesRegistry, constraintResolver, fileValidator, filesService, fileStorageRouter, fileFieldDetection, resourceOperationHelper, appConfigService, pathResolver, fileScanningService, consumableTokenService, fileUploadGrantService) {
         this.logger = logger;
         this.errorBuilder = errorBuilder;
         this.resourcesRegistry = resourcesRegistry;
@@ -80,6 +84,8 @@ let ResourceFileUploadHandlerBackendService = class ResourceFileUploadHandlerBac
         this.appConfigService = appConfigService;
         this.pathResolver = pathResolver;
         this.fileScanningService = fileScanningService;
+        this.consumableTokenService = consumableTokenService;
+        this.fileUploadGrantService = fileUploadGrantService;
         this.logDebug = this.logger.debugByType('ResourceFileUploadHandlerBackendService');
         this.logger.setDebugTypeLogging('ResourceFileUploadHandlerBackendService', false);
     }
@@ -179,8 +185,24 @@ let ResourceFileUploadHandlerBackendService = class ResourceFileUploadHandlerBac
             // Step 4c: Resolve storage provider from z_file() metadata.
             const storageAccepted = fieldMeta?.fileMetadata.storageAccepted;
             const storageProvider = this.fileStorageRouter.resolveProvider(storageAccepted);
+            // Step 4d: a file upload GRANT (issue #312) is claimed HERE — the point of no return. Every check a
+            // caller can act on (no file, wrong type, too large, generated field) has run; nothing has been
+            // written. A refusal above leaves the grant usable for a retry; a race loser is refused by the
+            // atomic consume and writes nothing. This handler is NOT on the services-registry pipeline, so its
+            // post-operation consumption never sees this request — this is the one consumption site.
+            const grant = response.locals?.fileUploadGrant;
+            if (grant) {
+                await this.consumableTokenService.consumeToken(executionContext.consumableTokenValue);
+                executionContext.markConsumableTokenConsumed();
+            }
             // Step 5: Create file record (status: PENDING) with scope
-            const uploaderPrincipal = resolveFileUploaderPrincipal(executionContext);
+            // Under a grant the file is attributed to the MINTER — the person or machine that delegated the
+            // upload — never to the grant. A user-minted grant already yields that through the token context
+            // (`resolveFileUploaderPrincipal`, CONSUMABLE_TOKEN case); a machine-minted one yields nothing
+            // there, so the grant's own `minter` record is used. Both agree with createFile's mismatch guard.
+            const uploaderPrincipal = grant
+                ? this.fileUploadGrantService.resolveUploaderFromGrant(grant.metadata)
+                : resolveFileUploaderPrincipal(executionContext);
             if (uploaderPrincipal) {
                 validateUploadedBy(uploaderPrincipal.uploadedBy, this.errorBuilder, executionContext, 'uploadedBy');
                 validateUploadedByEntityType(uploaderPrincipal.uploadedByEntityType, this.errorBuilder, executionContext, 'uploadedByEntityType');
@@ -370,9 +392,44 @@ let ResourceFileUploadHandlerBackendService = class ResourceFileUploadHandlerBac
                     },
                 });
             }
-            // Step 9: Return success response with file metadata
-            const fileMetadata = this.filesService.toMetadataResponse(uploadedFile);
-            uploadReachedSuccessState = uploadedFile.status === FileStatus.UPLOADED;
+            /*
+             * Step 9: hold a scanned file NON-DOWNLOADABLE before anyone is told the upload succeeded.
+             *
+             * `initiateScan` awaits the UPLOADED -> SCANNING transition and only then fires the scan
+             * pipeline asynchronously, so awaiting it here costs ONE status write, not the scan. Until
+             * 2026-09-08 this ran AFTER the response, fire-and-forget (#433): the file sat at UPLOADED —
+             * a downloadable status — for the whole gap between the upload committing and the transition
+             * landing, so a field declaring `scanPolicy: 'required'` had a window in which its bytes were
+             * servable unscanned. The control advertised more than it held.
+             *
+             * FAIL-CLOSED, deliberately: this is NOT wrapped in a catch. A scan that cannot be initiated
+             * fails the upload, and because `uploadReachedSuccessState` is still false the catch below
+             * marks the file FAILED. A caught-and-logged failure would leave the row at UPLOADED, which is
+             * exactly the servable state this closes — a scanner outage would silently reopen the window
+             * on every upload. An operator gets a failed upload instead, which is the behaviour a control
+             * named `required` has to have.
+             */
+            const scanIsRequired = this.fileScanningService.shouldScan(fieldMeta?.fileMetadata);
+            let uploadedFileForResponse = uploadedFile;
+            if (scanIsRequired) {
+                await this.fileScanningService.initiateScan(uploadedFile.fileId, executionContext);
+                // Re-read so the response reports SCANNING rather than the UPLOADED this row no longer has.
+                // A client polling `GET /files/:fileId/metadata` sees SCANNING either way; reporting
+                // UPLOADED here would make the upload response the one place the two disagree. A null read
+                // keeps the pre-transition row rather than failing an upload that already succeeded.
+                const afterScanInitiation = await this.filesService.getFile(uploadedFile.fileId, executionContext);
+                if (afterScanInitiation) {
+                    uploadedFileForResponse = afterScanInitiation;
+                }
+            }
+            // Step 9b: Return success response with file metadata
+            const fileMetadata = this.filesService.toMetadataResponse(uploadedFileForResponse);
+            /*
+             * SCANNING counts as reached-success alongside UPLOADED: the upload itself committed, and the
+             * catch below must not roll a scanned file back to FAILED for a later response-layer failure.
+             */
+            uploadReachedSuccessState = uploadedFileForResponse.status === FileStatus.UPLOADED
+                || uploadedFileForResponse.status === FileStatus.SCANNING;
             response.status(200).json({
                 success: true,
                 file: fileMetadata,
@@ -382,14 +439,16 @@ let ResourceFileUploadHandlerBackendService = class ResourceFileUploadHandlerBac
                 resourceType,
                 fieldName,
             });
-            // Step 10: Post-upload async pipeline (fire-and-forget, response already sent)
-            const shouldScan = this.fileScanningService.shouldScan(fieldMeta?.fileMetadata);
-            if (shouldScan) {
-                this.fileScanningService.initiateScan(uploadedFile.fileId, executionContext)
-                    .catch((scanError) => {
-                    this.logger.error('Failed to initiate file scanning', {
+            // Step 10: a redeemed grant records what it produced and is audited. Best-effort by contract —
+            // the upload has succeeded and the response is sent; a failure here is logged, never thrown.
+            if (grant) {
+                this.fileUploadGrantService
+                    .recordRedemption(grant, { fileId: uploadedFile.fileId, mimeType: uploadedFile.mimeType, size: uploadedFile.size }, executionContext)
+                    .catch((redemptionError) => {
+                    this.logger.error('File upload grant: redemption record failed', {
+                        grantId: grant.token._id,
                         fileId: uploadedFile.fileId,
-                        ...projectCaughtErrorLogFields(scanError),
+                        ...projectCaughtErrorLogFields(redemptionError),
                     });
                 });
             }
@@ -633,6 +692,8 @@ ResourceFileUploadHandlerBackendService = __decorate([
     __param(9, inject(SAAS_SERVICE_TYPES.AppConfigService)),
     __param(10, inject(SAAS_SERVICE_TYPES.FileStoragePathResolver)),
     __param(11, inject(SAAS_SERVICE_TYPES.FileScanningService)),
+    __param(12, inject(SAAS_SERVICE_TYPES.ConsumableTokenService)),
+    __param(13, inject(SAAS_SERVICE_TYPES.FileUploadGrantService)),
     __metadata("design:paramtypes", [Function, ErrorBuilderBackendService,
         ResourcesRegistryBackendService,
         FileConstraintResolverChain,
@@ -643,7 +704,9 @@ ResourceFileUploadHandlerBackendService = __decorate([
         ResourceOperationHelperBackendService,
         AppConfigurationService,
         FileStoragePathResolverBackendService,
-        FileScanningBackendService])
+        FileScanningBackendService,
+        ConsumableTokenBackendService,
+        FileUploadGrantBackendService])
 ], ResourceFileUploadHandlerBackendService);
 export { ResourceFileUploadHandlerBackendService };
 //# sourceMappingURL=resource-file-upload-handler.backend.service.js.map

package/dist/esm/files/handlers/resource-file-upload-handler.backend.service.js.map

@@ -1 +1 @@
-{"version":3,"file":"resource-file-upload-handler.backend.service.js","sourceRoot":"","sources":["../../../../../src/files/handlers/resource-file-upload-handler.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;;;;;;;;;;;;;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAG/C,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,EAAuC,SAAS,EAAE,2BAA2B,EAAQ,UAAU,EAAE,0BAA0B,EAAE,+BAA+B,EAAE,oBAAoB,EAAwB,mBAAmB,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAC3R,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAChE,OAAO,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AAEpF,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAC9G,OAAO,EAAE,+BAA+B,EAAE,MAAM,0EAA0E,CAAC;AAE3H,OAAO,EAAE,2BAA2B,EAAE,MAAM,qFAAqF,CAAC;AAClI,OAAO,EAAE,qBAAqB,EAAE,MAAM,sEAAsE,CAAC;AAC7G,OAAO,EAAE,mBAAmB,EAAE,MAAM,yDAAyD,CAAC;AAC9F,OAAO,EAAE,qCAAqC,EAAE,MAAM,qFAAqF,CAAC;AAC5I,OAAO,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,cAAc,EAAE,mBAAmB,EAAE,YAAY,EAAE,kBAAkB,EAAE,4BAA4B,EAAE,4BAA4B,EAAE,MAAM,sDAAsD,CAAC;AACtQ,OAAO,EAAE,4BAA4B,EAAE,MAAM,oDAAoD,CAAC;AAClG,OAAO,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AAC/G,OAAO,EAAE,+BAA+B,EAAE,MAAM,sEAAsE,CAAC;AACvH,OAAO,EAAE,gCAAgC,EAAE,MAAM,wEAAwE,CAAC;AAC1H,OAAO,EAAE,qCAAqC,EAAE,MAAM,6EAA6E,CAAC;AAEpI,OAAO,EAAE,0BAA0B,EAAE,MAAM,iEAAiE,CAAC;AAC7G,OAAO,EAAE,mBAAmB,EAAE,2BAA2B,EAAE,MAAM,8EAA8E,CAAC;AAChJ,OAAO,EAAE,iCAAiC,EAAE,MAAM,2EAA2E,CAAC;AAGvH,IAAM,uCAAuC,GAA7C,MAAM,uCAAuC;IAK/B;IAEA;IAEA;IAEA;IAEA;IAEA;IAEA;IAEA;IAEA;IAEA;IAEA;IAEA;IA1BT,QAAQ,CAA+D;IAEjF,YAEmB,MAAqB,EAErB,YAAwC,EAExC,iBAAkD,EAElD,kBAA+C,EAE/C,aAAoC,EAEpC,YAAiC,EAEjC,iBAAkD,EAElD,kBAAoD,EAEpD,uBAA8D,EAE9D,gBAAyC,EAEzC,YAAmD,EAEnD,mBAA+C;QAtB/C,WAAM,GAAN,MAAM,CAAe;QAErB,iBAAY,GAAZ,YAAY,CAA4B;QAExC,sBAAiB,GAAjB,iBAAiB,CAAiC;QAElD,uBAAkB,GAAlB,kBAAkB,CAA6B;QAE/C,kBAAa,GAAb,aAAa,CAAuB;QAEpC,iBAAY,GAAZ,YAAY,CAAqB;QAEjC,sBAAiB,GAAjB,iBAAiB,CAAiC;QAElD,uBAAkB,GAAlB,kBAAkB,CAAkC;QAEpD,4BAAuB,GAAvB,uBAAuB,CAAuC;QAE9D,qBAAgB,GAAhB,gBAAgB,CAAyB;QAEzC,iBAAY,GAAZ,YAAY,CAAuC;QAEnD,wBAAmB,GAAnB,mBAAmB,CAA4B;QAEhE,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,yCAAyC,CAAC,CAAC;QACnF,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,yCAAyC,EAAE,KAAK,CAAC,CAAC;IACpF,CAAC;IAED;;;;OAIG;IACK,uBAAuB,CAAC,GAAY;QAC1C,IAAI,GAAG,CAAC,IAAI,IAAI,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACjF,OAAO,GAAG,CAAC,IAA+B,CAAC;QAC7C,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAED;;;;;;;;;;OAUG;IACH,KAAK,CAAC,gBAAgB,CACpB,OAAgB,EAChB,QAAkB,EAClB,YAA0B,EAC1B,SAAiB,EACjB,UAA8B,EAC9B,SAAsE,EACtE,gBAAuC;QAEvC,6FAA6F;QAC7F,oBAAoB,CAAC,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,gBAAgB,EAAE,cAAc,CAAC,CAAC;QACxF,iBAAiB,CAAC,SAAS,EAAE,IAAI,CAAC,YAAY,EAAE,gBAAgB,EAAE,WAAW,CAAC,CAAC;QAC/E,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YAC7B,kBAAkB,CAAC,UAAU,EAAE,IAAI,CAAC,YAAY,EAAE,gBAAgB,EAAE,YAAY,CAAC,CAAC;QACpF,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,sBAAsB,EAAE;YACpC,YAAY;YACZ,SAAS;YACT,UAAU;YACV,SAAS;YACT,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI;SACxB,CAAC,CAAC;QAEH,IAAI,UAA0C,CAAC;QAC/C,IAAI,yBAAyB,GAAG,KAAK,CAAC;QACtC,IAAI,mBAAmB,GAAG,KAAK,CAAC;QAEhC,IAAI,CAAC;YACH,0CAA0C;YAC1C,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;gBAClB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,UAAU,EACpB,gBAAgB,EAChB;oBACE,sBAAsB,EAAE,2BAA2B,CAAC,mBAAmB;oBACvE,OAAO,EAAE;wBACP,wBAAwB;wBACxB,YAAY;wBACZ,SAAS;qBACV;iBACF,CACF,CAAC;YACJ,CAAC;YAED,MAAM,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;YAChC,MAAM,WAAW,GAAG,4BAA4B,CAAC,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;YAEpG,gEAAgE;YAChE,mBAAmB,CAAC,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,YAAY,EAAE,gBAAgB,EAAE,aAAa,CAAC,CAAC;YAC7F,YAAY,CAAC,UAAU,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,YAAY,EAAE,gBAAgB,EAAE,MAAM,CAAC,CAAC;YAExF,8DAA8D;YAC9D,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC;gBACvD,YAAY;gBACZ,SAAS;aACV,CAAC,CAAC;YAEH,4CAA4C;YAC5C,MAAM,gBAAgB,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,YAAY,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;YAEvF,IAAI,CAAC,gBAAgB,CAAC,OAAO,EAAE,CAAC;gBAC9B,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,UAAU,EACpB,gBAAgB,EAChB;oBACE,sBAAsB,EAAE,2BAA2B,CAAC,UAAU;oBAC9D,OAAO,EAAE;wBACP,OAAO,EAAE,wBAAwB;wBACjC,MAAM,EAAE,gBAAgB,CAAC,MAAM;wBAC/B,QAAQ,EAAE,UAAU,CAAC,YAAY;wBACjC,QAAQ,EAAE,UAAU,CAAC,QAAQ;wBAC7B,IAAI,EAAE,UAAU,CAAC,IAAI;qBACtB;iBACF,CACF,CAAC;YACJ,CAAC;YAED,iEAAiE;YACjE,sEAAsE;YACtE,sEAAsE;YACtE,iEAAiE;YACjE,uEAAuE;YACvE,MAAM,SAAS,GAAG,IAAI,CAAC,kBAAkB,CAAC,oBAAoB,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;YACxF,IAAI,SAAS,EAAE,YAAY,CAAC,UAAU,EAAE,MAAM,KAAK,oBAAoB,CAAC,YAAY,EAAE,CAAC;gBACrF,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,aAAa,EACvB,gBAAgB,EAChB;oBACE,sBAAsB,EAAE,2BAA2B,CAAC,iCAAiC;oBACrF,OAAO,EAAE;wBACP,wBAAwB;wBACxB,YAAY;wBACZ,SAAS;qBACV;iBACF,CACF,CAAC;YACJ,CAAC;YAED,qEAAqE;YACrE,MAAM,KAAK,GAAG,IAAI,CAAC,6BAA6B,CAAC,YAAY,EAAE,gBAAgB,CAAC,CAAC;YAEjF,4DAA4D;YAC5D,MAAM,eAAe,GAAG,SAAS,EAAE,YAAY,CAAC,eAAe,CAAC;YAChE,MAAM,eAAe,GAAG,IAAI,CAAC,iBAAiB,CAAC,eAAe,CAAC,eAAe,CAAC,CAAC;YAEhF,0DAA0D;YAC1D,MAAM,iBAAiB,GAAG,4BAA4B,CAAC,gBAAgB,CAAC,CAAC;YACzE,IAAI,iBAAiB,EAAE,CAAC;gBACtB,kBAAkB,CAAC,iBAAiB,CAAC,UAAU,EAAE,IAAI,CAAC,YAAY,EAAE,gBAAgB,EAAE,YAAY,CAAC,CAAC;gBACpG,4BAA4B,CAC1B,iBAAiB,CAAC,oBAAoB,EACtC,IAAI,CAAC,YAAY,EACjB,gBAAgB,EAChB,sBAAsB,CACvB,CAAC;YACJ,CAAC;YAED,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CACpD;gBACE,QAAQ,EAAE,UAAU,CAAC,YAAY,IAAI,UAAU,CAAC,QAAQ;gBACxD,gBAAgB,EAAE,UAAU,CAAC,YAAY;gBACzC,QAAQ,EAAE,UAAU,CAAC,QAAQ;gBAC7B,IAAI,EAAE,UAAU,CAAC,IAAI;gBACrB,eAAe,EAAE,eAAe,CAAC,UAAU;gBAC3C,KAAK;gBACL,UAAU,EAAE,iBAAiB,EAAE,UAAU;gBACzC,oBAAoB,EAAE,iBAAiB,EAAE,oBAAoB;aAC9D,EACD,gBAAgB,CACjB,CAAC;YAEF,UAAU,GAAG,EAAE,MAAM,EAAE,WAAW,CAAC,MAAM,EAAE,CAAC;YAE5C,oEAAoE;YACpE,MAAM,gBAAgB,GAAG,IAAI,CAAC,uBAAuB,CAAC,OAAO,CAAC,CAAC;YAC/D,IAAI,aAA+C,CAAC;YACpD,IAAI,SAAS,EAAE,CAAC;gBACd,aAAa,GAAG,IAAI,CAAC,YAAY,CAAC,OAAO,CACvC,WAAW,CAAC,MAAM,EAClB,SAAS,EACT,SAAS,CAAC,YAAY,EACtB,iCAAiC,CAAC,IAAI,CAAC,gBAAgB,CAAC,EACxD,UAAU,CAAC,YAAY,EACvB,gBAAgB,CACjB,CAAC;YACJ,CAAC;YAED,0FAA0F;YAC1F,yFAAyF;YACzF,yFAAyF;YACzF,qEAAqE;YACrE,EAAE;YACF,sFAAsF;YACtF,qCAAqC;YACrC,wFAAwF;YACxF,EAAE;YACF,+FAA+F;YAC/F,4FAA4F;YAC5F,8FAA8F;YAC9F,0FAA0F;YAC1F,qFAAqF;YACrF,EAAE;YACF,uFAAuF;YACvF,2FAA2F;YAC3F,sBAAsB;YACtB,+FAA+F;YAC/F,4FAA4F;YAC5F,8CAA8C;YAC9C,aAAa,GAAG,EAAE,GAAG,aAAa,EAAE,kBAAkB,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC;YAE9E,6EAA6E;YAC7E,iEAAiE;YACjE,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;gBACrB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,QAAQ,EAClB,gBAAgB,EAChB;oBACE,sBAAsB,EAAE,2BAA2B,CAAC,QAAQ;oBAC5D,OAAO,EAAE;wBACP,OAAO,EAAE,kDAAkD;wBAC3D,QAAQ,EAAE,UAAU,CAAC,YAAY;qBAClC;iBACF,CACF,CAAC;YACJ,CAAC;YAED,4CAA4C;YAC5C,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;gBACpC,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,QAAQ,EAClB,gBAAgB,EAChB;oBACE,sBAAsB,EAAE,2BAA2B,CAAC,QAAQ;oBAC5D,OAAO,EAAE;wBACP,OAAO,EAAE,6BAA6B;wBACtC,IAAI,EAAE,UAAU,CAAC,IAAI;wBACrB,QAAQ,EAAE,UAAU,CAAC,YAAY;qBAClC;iBACF,CACF,CAAC;YACJ,CAAC;YAED,IAAI,UAAU,GAAoB,IAAI,CAAC;YACvC,IAAI,YAAY,GAA+B,IAAI,CAAC;YAEpD,iEAAiE;YACjE,IAAI,CAAC;gBACH,qEAAqE;gBACrE,UAAU,GAAG,EAAE,CAAC,gBAAgB,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;gBAElD,YAAY,GAAG,MAAM,eAAe,CAAC,MAAM,CACzC,UAAU,EACV,WAAW,CAAC,MAAM,EAClB,UAAU,CAAC,QAAQ,EACnB,UAAU,CAAC,IAAI,EACf,gBAAgB,EAChB,aAAa,CACd,CAAC;gBACF,mBAAmB,GAAG,IAAI,CAAC;gBAE3B,IAAI,CAAC,QAAQ,CAAC,uCAAuC,EAAE;oBACrD,MAAM,EAAE,WAAW,CAAC,MAAM;iBAC3B,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,WAAW,EAAE,CAAC;gBACrB,uCAAuC;gBACvC,MAAM,IAAI,CAAC,YAAY,CAAC,gBAAgB,CACtC,WAAW,CAAC,MAAM,EAClB,UAAU,CAAC,MAAM,EACjB,gBAAgB,CACjB,CAAC;gBAEF,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,gBAAgB,EAC1B,gBAAgB,EAChB;oBACE,sBAAsB,EAAE,2BAA2B,CAAC,gBAAgB;oBACpE,OAAO,EAAE;wBACP,OAAO,EAAE,kCAAkC;wBAC3C,MAAM,EAAE,WAAW,CAAC,MAAM;wBAC1B,KAAK,EAAE,mBAAmB,CAAC,WAAW,CAAC;qBACxC;iBACF,CACF,CAAC;YACJ,CAAC;oBAAS,CAAC;gBACT,6CAA6C;gBAC7C,iFAAiF;gBACjF,IAAI,UAAU,CAAC,IAAI,IAAI,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;oBACtD,IAAI,CAAC;wBACH,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;wBAC/B,IAAI,CAAC,QAAQ,CAAC,sBAAsB,EAAE,EAAE,IAAI,EAAE,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC;oBACnE,CAAC;oBAAC,OAAO,YAAY,EAAE,CAAC;wBACtB,6CAA6C;wBAC7C,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,8BAA8B,EAAE;4BAC/C,IAAI,EAAE,UAAU,CAAC,IAAI;4BACrB,GAAG,2BAA2B,CAAC,YAAY,CAAC;yBAC7C,CAAC,CAAC;oBACL,CAAC;gBACH,CAAC;gBAED,wCAAwC;gBACxC,IAAI,UAAU,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,CAAC;oBACxC,UAAU,CAAC,OAAO,EAAE,CAAC;gBACvB,CAAC;YACH,CAAC;YAED,4DAA4D;YAC5D,yEAAyE;YACzE,iEAAiE;YACjE,8EAA8E;YAC9E,4DAA4D;YAC5D,MAAM,UAAU,GAAG,CAAC,CAAC;YACrB,MAAM,YAAY,GAAG,IAAI,CAAC,CAAC,WAAW;YAEtC,IAAI,SAAS,GAAiB,IAAI,CAAC;YACnC,IAAI,YAAY,GAAgB,IAAI,CAAC;YAErC,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,IAAI,UAAU,EAAE,OAAO,EAAE,EAAE,CAAC;gBACvD,IAAI,CAAC;oBACH,YAAY,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,gBAAgB,CACrD,WAAW,CAAC,MAAM,EAClB,UAAU,CAAC,QAAQ,EACnB,gBAAgB,EAChB,SAAS,EACT,YAAY,IAAI,SAAS,CAC1B,CAAC;oBACF,MAAM,CAAC,UAAU;gBACnB,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,SAAS,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC,CAAC;oBAEnF,IAAI,OAAO,GAAG,UAAU,EAAE,CAAC;wBACzB,MAAM,KAAK,GAAG,YAAY,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;wBAClD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,qCAAqC,EAAE;4BACtD,MAAM,EAAE,WAAW,CAAC,MAAM;4BAC1B,OAAO,EAAE,OAAO,GAAG,CAAC;4BACpB,UAAU;4BACV,KAAK;4BACL,KAAK,EAAE,SAAS,CAAC,OAAO;yBACzB,CAAC,CAAC;wBACH,MAAM,IAAI,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;oBAC3D,CAAC;yBAAM,CAAC;wBACN,gDAAgD;wBAChD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,6CAA6C,EAAE;4BAC/D,MAAM,EAAE,WAAW,CAAC,MAAM;4BAC1B,QAAQ,EAAE,UAAU,GAAG,CAAC;4BACxB,KAAK,EAAE,SAAS,CAAC,OAAO;4BACxB,gEAAgE;4BAChE,8DAA8D;yBAC/D,CAAC,CAAC;wBAEH,uEAAuE;wBACvE,sEAAsE;wBACtE,qEAAqE;wBACrE,IAAI,mBAAmB,IAAI,YAAY,EAAE,CAAC;4BACxC,IAAI,CAAC;gCACH,MAAM,eAAe,CAAC,MAAM,CAC1B;oCACE,MAAM,EAAE,WAAW,CAAC,MAAM;oCAC1B,eAAe,EAAE,YAAY,CAAC,QAAQ;oCACtC,UAAU,EAAE,YAAY,CAAC,UAAU;iCACpC,EACD,gBAAgB,CACjB,CAAC;gCACF,mBAAmB,GAAG,KAAK,CAAC;gCAC5B,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,4DAA4D,EAAE;oCAC7E,MAAM,EAAE,WAAW,CAAC,MAAM;iCAC3B,CAAC,CAAC;4BACL,CAAC;4BAAC,OAAO,aAAa,EAAE,CAAC;gCACvB,IAAI,CAAC,mBAAmB,CAAC,aAAa,CAAC,IAAI,aAAa,CAAC,IAAI,KAAK,SAAS,CAAC,SAAS,EAAE,CAAC;oCACtF,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,oEAAoE,EAAE;wCACtF,MAAM,EAAE,WAAW,CAAC,MAAM;wCAC1B,GAAG,2BAA2B,CAAC,aAAa,CAAC;wCAC7C,aAAa,EAAE,SAAS,CAAC,OAAO;qCACjC,CAAC,CAAC;gCACL,CAAC;qCAAM,CAAC;oCACN,mBAAmB,GAAG,KAAK,CAAC;gCAC9B,CAAC;4BACH,CAAC;wBACH,CAAC;wBAED,iCAAiC;wBACjC,MAAM,SAAS,CAAC;oBAClB,CAAC;gBACH,CAAC;YACH,CAAC;YAED,uDAAuD;YACvD,IAAI,CAAC,YAAY,EAAE,CAAC;gBAClB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,QAAQ,EAClB,gBAAgB,EAChB;oBACE,sBAAsB,EAAE,2BAA2B,CAAC,QAAQ;oBAC5D,OAAO,EAAE;wBACP,OAAO,EAAE,gEAAgE;wBACzE,MAAM,EAAE,WAAW,CAAC,MAAM;qBAC3B;iBACF,CACF,CAAC;YACJ,CAAC;YAED,qDAAqD;YACrD,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,CAAC,kBAAkB,CAAC,YAAY,CAAC,CAAC;YACxE,yBAAyB,GAAG,YAAY,CAAC,MAAM,KAAK,UAAU,CAAC,QAAQ,CAAC;YAExE,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACxB,OAAO,EAAE,IAAI;gBACb,IAAI,EAAE,YAAY;aACnB,CAAC,CAAC;YAEH,IAAI,CAAC,QAAQ,CAAC,oCAAoC,EAAE;gBAClD,MAAM,EAAE,YAAY,CAAC,MAAM;gBAC3B,YAAY;gBACZ,SAAS;aACV,CAAC,CAAC;YAEH,+EAA+E;YAC/E,MAAM,UAAU,GAAG,IAAI,CAAC,mBAAmB,CAAC,UAAU,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;YAEhF,IAAI,UAAU,EAAE,CAAC;gBACf,IAAI,CAAC,mBAAmB,CAAC,YAAY,CAAC,YAAY,CAAC,MAAM,EAAE,gBAAgB,CAAC;qBACzE,KAAK,CAAC,CAAC,SAAS,EAAE,EAAE;oBACnB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,kCAAkC,EAAE;wBACpD,MAAM,EAAE,YAAa,CAAC,MAAM;wBAC5B,GAAG,2BAA2B,CAAC,SAAS,CAAC;qBAC1C,CAAC,CAAC;gBACL,CAAC,CAAC,CAAC;YACP,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,yEAAyE;YACzE,0EAA0E;YAC1E,0EAA0E;YAC1E,2EAA2E;YAC3E,2EAA2E;YAC3E,MAAM,kBAAkB,GAAG,CAAC,CAAC,UAAU,EAAE,MAAM,IAAI,CAAC,yBAAyB,IAAI,CAAC,mBAAmB,CAAC;YACtG,IAAI,kBAAkB,EAAE,CAAC;gBACvB,IAAI,CAAC;oBACH,MAAM,IAAI,CAAC,YAAY,CAAC,gBAAgB,CACtC,UAAU,CAAC,MAAM,EACjB,UAAU,CAAC,MAAM,EACjB,gBAAgB,CACjB,CAAC;oBACF,IAAI,CAAC,QAAQ,CAAC,2CAA2C,EAAE;wBACzD,MAAM,EAAE,UAAU,CAAC,MAAM;qBAC1B,CAAC,CAAC;gBACL,CAAC;gBAAC,OAAO,WAAW,EAAE,CAAC;oBACrB,wDAAwD;oBACxD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,+BAA+B,EAAE;wBACjD,MAAM,EAAE,UAAU,CAAC,MAAM;wBACzB,GAAG,2BAA2B,CAAC,WAAW,CAAC;qBAC5C,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YAED,wDAAwD;YACxD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4BG;IACH,KAAK,CAAC,eAAe,CACnB,OAAgB,EAChB,QAAkB,EAClB,IAAkB,EAClB,YAA0B,EAC1B,SAAiB,EACjB,UAAkB,EAClB,MAAc,EACd,gBAAuC;QAEvC,oBAAoB,CAAC,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,gBAAgB,EAAE,cAAc,CAAC,CAAC;QACxF,iBAAiB,CAAC,SAAS,EAAE,IAAI,CAAC,YAAY,EAAE,gBAAgB,EAAE,WAAW,CAAC,CAAC;QAC/E,kBAAkB,CAAC,UAAU,EAAE,IAAI,CAAC,YAAY,EAAE,gBAAgB,EAAE,YAAY,CAAC,CAAC;QAClF,cAAc,CAAC,MAAM,EAAE,IAAI,CAAC,YAAY,EAAE,gBAAgB,EAAE,QAAQ,CAAC,CAAC;QAEtE,IAAI,CAAC,QAAQ,CAAC,qBAAqB,EAAE,EAAE,YAAY,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,CAAC;QAEtF,kFAAkF;QAClF,qEAAqE;QACrE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;QAEvE,8EAA8E;QAC9E,MAAM,sBAAsB,GAC1B,CAAC,CAAC,IAAI;YACN,IAAI,CAAC,kBAAkB,KAAK,YAAY;YACxC,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,KAAK,MAAM,CAAC,UAAU,CAAC;YACpD,IAAI,CAAC,eAAe,KAAK,SAAS,CAAC;QAErC,IAAI,CAAC,sBAAsB,EAAE,CAAC;YAC5B,IAAI,CAAC,QAAQ,CAAC,4DAA4D,EAAE;gBAC1E,MAAM;gBACN,YAAY;gBACZ,UAAU;gBACV,SAAS;gBACT,kBAAkB,EAAE,IAAI,EAAE,kBAAkB;gBAC5C,gBAAgB,EAAE,IAAI,EAAE,gBAAgB;gBACxC,eAAe,EAAE,IAAI,EAAE,eAAe;aACvC,CAAC,CAAC;YACH,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,SAAS,EACnB,gBAAgB,EAChB;gBACE,sBAAsB,EAAE,2BAA2B,CAAC,cAAc;gBAClE,OAAO,EAAE,EAAE,MAAM,EAAE,EAAE,wBAAwB;aAC9C,CACF,CAAC;QACJ,CAAC;QAED,8FAA8F;QAC9F,iCAAiC;QACjC,EAAE;QACF,8FAA8F;QAC9F,+FAA+F;QAC/F,iGAAiG;QACjG,iGAAiG;QACjG,kGAAkG;QAClG,wEAAwE;QACxE,EAAE;QACF,iFAAiF;QACjF,kGAAkG;QAClG,2FAA2F;QAC3F,mEAAmE;QACnE,+FAA+F;QAC/F,gGAAgG;QAChG,yEAAyE;QACzE,IAAI,+BAA+B,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YACrD,IAAI,CAAC,QAAQ,CAAC,oCAAoC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;YACrF,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,SAAS,EACnB,gBAAgB,EAChB;gBACE,sBAAsB,EAAE,2BAA2B,CAAC,cAAc;gBAClE,OAAO,EAAE,EAAE,MAAM,EAAE,EAAE,wBAAwB;aAC9C,CACF,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,0BAA0B,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YACjD,IAAI,CAAC,QAAQ,CAAC,wCAAwC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;YACzF,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,UAAU,EACpB,gBAAgB,EAChB;gBACE,sBAAsB,EAAE,2BAA2B,CAAC,UAAU;gBAC9D,OAAO,EAAE,EAAE,OAAO,EAAE,oCAAoC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE;aACxF,CACF,CAAC;QACJ,CAAC;QAED,+EAA+E;QAC/E,mFAAmF;QACnF,MAAM,OAAO,GAAG,qBAAqB,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAE7D,MAAM,IAAI,CAAC,YAAY,CAAC,oBAAoB,CAAC,IAAI,EAAE,QAAQ,EAAE,gBAAgB,EAAE;YAC7E,WAAW,EAAE,QAAQ;YACrB,IAAI;YACJ,OAAO;SACR,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;;;OAWG;IACK,6BAA6B,CACnC,YAA0B,EAC1B,gBAAuC;QAEvC,6DAA6D;QAC7D,MAAM,cAAc,GAAG,IAAI,CAAC,iBAAiB,CAAC,wBAAwB,CAAC,YAAY,CAAC,CAAC;QAErF,+CAA+C;QAC/C,4CAA4C;QAC5C,MAAM,YAAY,GAAG,cAAc,EAAE,oBAAoB,IAAI,oBAAoB,CAAC,aAAa,CAAC;QAEhG,mDAAmD;QACnD,MAAM,cAAc,GAAG,IAAI,CAAC,uBAAuB,CAAC,cAAc,CAAC,gBAAgB,EAAE,cAAc,CAAC,CAAC;QACrG,MAAM,MAAM,GAAG,IAAI,CAAC,uBAAuB,CAAC,cAAc,CAAC,gBAAgB,EAAE,MAAM,CAAC,CAAC;QACrF,yEAAyE;QACzE,0EAA0E;QAC1E,kEAAkE;QAClE,0EAA0E;QAC1E,oDAAoD;QACpD,MAAM,aAAa,GAAG,gBAAgB,CAAC,aAAa,IAAI,IAAI,CAAC,gBAAgB,CAAC,aAAa,CAAC;QAE5F,QAAQ,YAAY,EAAE,CAAC;YACrB,KAAK,oBAAoB,CAAC,WAAW;gBACnC,IAAI,CAAC,aAAa,EAAE,CAAC;oBACnB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,UAAU,EACpB,gBAAgB,EAChB;wBACE,sBAAsB,EAAE,2BAA2B,CAAC,6BAA6B;wBACjF,OAAO,EAAE;4BACP,YAAY,EAAE,wBAAwB;yBACvC;qBACF,CACF,CAAC;gBACJ,CAAC;gBACD,OAAO;oBACL,YAAY,EAAE,oBAAoB,CAAC,WAAW;oBAC9C,aAAa;iBACd,CAAC;YAEJ,KAAK,oBAAoB,CAAC,aAAa;gBACrC,IAAI,CAAC,cAAc,EAAE,CAAC;oBACpB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,UAAU,EACpB,gBAAgB,EAChB;wBACE,sBAAsB,EAAE,2BAA2B,CAAC,6BAA6B;wBACjF,OAAO,EAAE;4BACP,YAAY,EAAE,wBAAwB;yBACvC;qBACF,CACF,CAAC;gBACJ,CAAC;gBACD,IAAI,CAAC,aAAa,EAAE,CAAC;oBACnB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,UAAU,EACpB,gBAAgB,EAChB;wBACE,sBAAsB,EAAE,2BAA2B,CAAC,6BAA6B;wBACjF,OAAO,EAAE;4BACP,YAAY,EAAE,wBAAwB;yBACvC;qBACF,CACF,CAAC;gBACJ,CAAC;gBACD,OAAO;oBACL,YAAY,EAAE,oBAAoB,CAAC,aAAa;oBAChD,aAAa;oBACb,cAAc;iBACf,CAAC;YAEJ,KAAK,oBAAoB,CAAC,SAAS;gBACjC,gFAAgF;gBAChF,iFAAiF;gBACjF,iFAAiF;gBACjF,+DAA+D;gBAC/D,IAAI,CAAC,MAAM,EAAE,CAAC;oBACZ,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,UAAU,EACpB,gBAAgB,EAChB;wBACE,sBAAsB,EAAE,2BAA2B,CAAC,6BAA6B;wBACjF,OAAO,EAAE;4BACP,YAAY,EAAE,wBAAwB;yBACvC;qBACF,CACF,CAAC;gBACJ,CAAC;gBACD,IAAI,CAAC,aAAa,EAAE,CAAC;oBACnB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,UAAU,EACpB,gBAAgB,EAChB;wBACE,sBAAsB,EAAE,2BAA2B,CAAC,6BAA6B;wBACjF,OAAO,EAAE;4BACP,YAAY,EAAE,wBAAwB;yBACvC;qBACF,CACF,CAAC;gBACJ,CAAC;gBACD,OAAO;oBACL,YAAY,EAAE,oBAAoB,CAAC,SAAS;oBAC5C,aAAa;oBACb,MAAM;iBACP,CAAC;YAEJ;gBACE,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,aAAa,EACvB,gBAAgB,EAChB;oBACE,sBAAsB,EAAE,2BAA2B,CAAC,aAAa;oBACjE,OAAO,EAAE;wBACP,OAAO,EAAE,qFAAqF;wBAC9F,YAAY;wBACZ,YAAY;qBACb;iBACF,CACF,CAAC;QACN,CAAC;IACH,CAAC;CACF,CAAA;AAhuBY,uCAAuC;IADnD,UAAU,EAAE;IAKR,WAAA,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAA;IAEjC,WAAA,MAAM,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,CAAA;IAE9C,WAAA,MAAM,CAAC,kBAAkB,CAAC,uBAAuB,CAAC,CAAA;IAElD,WAAA,MAAM,CAAC,kBAAkB,CAAC,2BAA2B,CAAC,CAAA;IAEtD,WAAA,MAAM,CAAC,kBAAkB,CAAC,qBAAqB,CAAC,CAAA;IAEhD,WAAA,MAAM,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,CAAA;IAE9C,WAAA,MAAM,CAAC,kBAAkB,CAAC,iBAAiB,CAAC,CAAA;IAE5C,WAAA,MAAM,CAAC,kBAAkB,CAAC,yBAAyB,CAAC,CAAA;IAEpD,WAAA,MAAM,CAAC,kBAAkB,CAAC,8BAA8B,CAAC,CAAA;IAEzD,WAAA,MAAM,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,CAAA;IAE3C,YAAA,MAAM,CAAC,kBAAkB,CAAC,uBAAuB,CAAC,CAAA;IAElD,YAAA,MAAM,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,CAAA;+CAnBhB,0BAA0B;QAErB,+BAA+B;QAE9B,2BAA2B;QAEhC,qBAAqB;QAEtB,mBAAmB;QAEd,+BAA+B;QAE9B,gCAAgC;QAE3B,qCAAqC;QAE5C,uBAAuB;QAE3B,qCAAqC;QAE9B,0BAA0B;GA3BvD,uCAAuC,CAguBnD","sourcesContent":["/**\n * Resource File Upload Handler Backend Service\n *\n * Handles user-provided uploads for resource-integrated file fields after the\n * controller's pre-Multer middleware has already established execution context\n * and authorized access to the owning resource route.\n *\n * Coordinates validation, file record creation, and storage upload. UPDATE\n * routes authorize the target resource before reaching this handler, but the\n * upload itself still creates a new File record; attaching/replacing that file\n * on the resource is owned by the calling form/field mutation lane, not by this\n * upload transport.\n *\n * Flow:\n * 1. Validate file exists in request\n * 2. Resolve file constraints from resource field schema\n * 3. Validate file against constraints\n * 4. Create file record (status: PENDING)\n * 5. Upload file to storage\n * 6. Update file status to UPLOADED\n * 7. Return file metadata\n * 8. (async) Initiate AV scan if enabled (UPLOADED → SCANNING → CLEAN/INFECTED)\n */\n\nimport { injectable, inject } from 'inversify';\nimport type { Request, Response, NextFunction } from 'express';\nimport { Readable } from 'stream';\nimport fs from 'fs';\nimport { CoreResourceOperation, ResourceType, ErrorType, ErrorCustomMessageReference, File, FileStatus, FILE_DOWNLOADABLE_STATUSES, FILE_METADATA_WITHHELD_STATUSES, ResourcePrimaryScope, FileScopeIdentifiers, isWildoBackendError, parseFileServeVariant } from '@wildo-ai/saas-models';\nimport { FileGenerationSource } from '@wildo-ai/zod-decorators';\nimport { SAAS_SERVICE_TYPES } from '~wildo-backend-lib/inject/models/service-types';\nimport type { LoggerService } from '~wildo-backend-lib/monitoring/logger/services/logger.service';\nimport { ErrorBuilderBackendService } from '~wildo-backend-lib/errors/services/error-builder.backend.service';\nimport { ResourcesRegistryBackendService } from '~wildo-backend-lib/resources/services/resources-registry.backend.service';\nimport { ExecutionContext } from '~wildo-backend-lib/runtime/models/execution-context.backend.schemas';\nimport { FileConstraintResolverChain } from '~wildo-backend-lib/files/constraints/file-constraint-resolver-chain.backend.service';\nimport { FileValidationService } from '~wildo-backend-lib/files/constraints/file-validation.backend.service';\nimport { FilesBackendService } from '~wildo-backend-lib/files/services/files.backend.service';\nimport { ResourceOperationHelperBackendService } from '~wildo-backend-lib/base-classes/services/resource-operations-helper.backend.service';\nimport { validateResourceType, validateFieldName, validateResourceId, validateFileId, validateContentType, validateSize, validateUploadedBy, validateUploadedByEntityType, resolveConfiguredMaxFileSize } from '~wildo-backend-lib/files/utils/file-validation.utils';\nimport { resolveFileUploaderPrincipal } from '~wildo-backend-lib/files/utils/file-uploader.utils';\nimport { AppConfigurationService } from '~wildo-backend-lib/config/services/app-configuration.backend.service';\nimport { FileStorageRouterBackendService } from '~wildo-backend-lib/files/storage/file-storage-router.backend.service';\nimport { FileFieldDetectionBackendService } from '~wildo-backend-lib/files/services/file-field-detection.backend.service';\nimport { FileStoragePathResolverBackendService } from '~wildo-backend-lib/files/storage/file-storage-path-resolver.backend.service';\nimport type { StorageUploadResult, StorageUploadOptions } from '~wildo-backend-lib/files/storage/file-storage-provider.types';\nimport { FileScanningBackendService } from '~wildo-backend-lib/files/services/file-scanning.backend.service';\nimport { describeCaughtError, projectCaughtErrorLogFields } from '~wildo-backend-lib/errors/utils/error-log-level-classification.backend.utils';\nimport { resolveStorageApplicationIdentity } from '~wildo-backend-lib/files/utils/storage-application-identity.backend.utils';\n\n@injectable()\nexport class ResourceFileUploadHandlerBackendService {\n  protected logDebug: (message: string, context?: Record<string, unknown>) => void;\n\n  constructor(\n    @inject(SAAS_SERVICE_TYPES.Logger)\n    private readonly logger: LoggerService,\n    @inject(SAAS_SERVICE_TYPES.ErrorBuilderService)\n    private readonly errorBuilder: ErrorBuilderBackendService,\n    @inject(SAAS_SERVICE_TYPES.ResourceRegistryService)\n    private readonly resourcesRegistry: ResourcesRegistryBackendService,\n    @inject(SAAS_SERVICE_TYPES.FileConstraintResolverChain)\n    private readonly constraintResolver: FileConstraintResolverChain,\n    @inject(SAAS_SERVICE_TYPES.FileValidationService)\n    private readonly fileValidator: FileValidationService,\n    @inject(SAAS_SERVICE_TYPES.FilesBackendService)\n    private readonly filesService: FilesBackendService,\n    @inject(SAAS_SERVICE_TYPES.FileStorageRouter)\n    private readonly fileStorageRouter: FileStorageRouterBackendService,\n    @inject(SAAS_SERVICE_TYPES.FileFieldDetectionService)\n    private readonly fileFieldDetection: FileFieldDetectionBackendService,\n    @inject(SAAS_SERVICE_TYPES.ResourceOperationHelperService)\n    private readonly resourceOperationHelper: ResourceOperationHelperBackendService,\n    @inject(SAAS_SERVICE_TYPES.AppConfigService)\n    private readonly appConfigService: AppConfigurationService,\n    @inject(SAAS_SERVICE_TYPES.FileStoragePathResolver)\n    private readonly pathResolver: FileStoragePathResolverBackendService,\n    @inject(SAAS_SERVICE_TYPES.FileScanningService)\n    private readonly fileScanningService: FileScanningBackendService,\n  ) {\n    this.logDebug = this.logger.debugByType('ResourceFileUploadHandlerBackendService');\n    this.logger.setDebugTypeLogging('ResourceFileUploadHandlerBackendService', false);\n  }\n\n  /**\n   * Extract the resource instance from the request body (if available).\n   * In multipart uploads, the resource data may be present in `req.body`\n   * as parsed form fields.\n   */\n  private extractResourceInstance(req: Request): Record<string, unknown> | undefined {\n    if (req.body && typeof req.body === 'object' && Object.keys(req.body).length > 0) {\n      return req.body as Record<string, unknown>;\n    }\n    return undefined;\n  }\n\n  /**\n   * Handle file upload for resource-integrated file fields.\n   *\n   * @param request - Express request with file in request.file (Multer)\n   * @param response - Express response\n   * @param resourceType - Resource type (e.g., 'todos')\n   * @param fieldName - File field name (e.g., 'attachments')\n   * @param resourceId - Resource ID (undefined for CREATE, string for UPDATE route authorization)\n   * @param operation - Route operation used for authorization; the upload always creates a new File record\n   * @param executionContext - Execution context from request\n   */\n  async handleFileUpload(\n    request: Request,\n    response: Response,\n    resourceType: ResourceType,\n    fieldName: string,\n    resourceId: string | undefined,\n    operation: CoreResourceOperation.CREATE | CoreResourceOperation.UPDATE,\n    executionContext: ExecutionContext<any>\n  ): Promise<void> {\n    // Validate inputs (CRITICAL: Prevents invalid data propagation and security vulnerabilities)\n    validateResourceType(resourceType, this.errorBuilder, executionContext, 'resourceType');\n    validateFieldName(fieldName, this.errorBuilder, executionContext, 'fieldName');\n    if (resourceId !== undefined) {\n      validateResourceId(resourceId, this.errorBuilder, executionContext, 'resourceId');\n    }\n\n    this.logDebug('Handling file upload', {\n      resourceType,\n      fieldName,\n      resourceId,\n      operation,\n      hasFile: !!request.file,\n    });\n\n    let fileRecord: { fileId: string } | undefined;\n    let uploadReachedSuccessState = false;\n    let blobStoredInStorage = false;\n\n    try {\n      // Step 1: Validate file exists in request\n      if (!request.file) {\n        throw this.errorBuilder.buildError(\n          ErrorType.VALIDATION,\n          executionContext,\n          {\n            customMessageReference: ErrorCustomMessageReference.FILE_UPLOAD_NO_FILE,\n            context: {\n              // diagnostic (log-only)\n              resourceType,\n              fieldName,\n            },\n          }\n        );\n      }\n\n      const multerFile = request.file;\n      const maxFileSize = resolveConfiguredMaxFileSize(this.appConfigService.config.storage?.maxFileSize);\n\n      // Validate file metadata (CRITICAL: Prevents invalid file data)\n      validateContentType(multerFile.mimetype, this.errorBuilder, executionContext, 'contentType');\n      validateSize(multerFile.size, maxFileSize, this.errorBuilder, executionContext, 'size');\n\n      // Step 2: Resolve file constraints from resource field schema\n      const constraint = await this.constraintResolver.resolve({\n        resourceType,\n        fieldName,\n      });\n\n      // Step 3: Validate file against constraints\n      const validationResult = await this.fileValidator.validateFile(multerFile, constraint);\n\n      if (!validationResult.success) {\n        throw this.errorBuilder.buildError(\n          ErrorType.VALIDATION,\n          executionContext,\n          {\n            customMessageReference: ErrorCustomMessageReference.VALIDATION,\n            context: {\n              message: 'File validation failed',\n              errors: validationResult.errors,\n              filename: multerFile.originalname,\n              mimeType: multerFile.mimetype,\n              size: multerFile.size,\n            },\n          }\n        );\n      }\n\n      // Step 4: Reject direct uploads to generated file fields FIRST —\n      // before scope derivation. \"This field cannot receive user uploads at\n      // all\" is a more fundamental rejection than \"what scope does the file\n      // belong to\", and must not be masked by a scope-derivation error\n      // (e.g. a missing applicationId) on a field that was never uploadable.\n      const fieldMeta = this.fileFieldDetection.getFileFieldMetadata(resourceType, fieldName);\n      if (fieldMeta?.fileMetadata.generation?.source === FileGenerationSource.PDF_TEMPLATE) {\n        throw this.errorBuilder.buildError(\n          ErrorType.BUSINESS_RULE,\n          executionContext,\n          {\n            customMessageReference: ErrorCustomMessageReference.FILE_GENERATED_FIELD_NOT_WRITABLE,\n            context: {\n              // diagnostic (log-only)\n              resourceType,\n              fieldName,\n            },\n          }\n        );\n      }\n\n      // Step 4b: Derive scope from parent resource's resourcePrimaryScope.\n      const scope = this.deriveScopeFromParentResource(resourceType, executionContext);\n\n      // Step 4c: Resolve storage provider from z_file() metadata.\n      const storageAccepted = fieldMeta?.fileMetadata.storageAccepted;\n      const storageProvider = this.fileStorageRouter.resolveProvider(storageAccepted);\n\n      // Step 5: Create file record (status: PENDING) with scope\n      const uploaderPrincipal = resolveFileUploaderPrincipal(executionContext);\n      if (uploaderPrincipal) {\n        validateUploadedBy(uploaderPrincipal.uploadedBy, this.errorBuilder, executionContext, 'uploadedBy');\n        validateUploadedByEntityType(\n          uploaderPrincipal.uploadedByEntityType,\n          this.errorBuilder,\n          executionContext,\n          'uploadedByEntityType',\n        );\n      }\n\n      const createdFile = await this.filesService.createFile(\n        {\n          filename: multerFile.originalname || multerFile.filename,\n          originalFilename: multerFile.originalname,\n          mimeType: multerFile.mimetype,\n          size: multerFile.size,\n          storageProvider: storageProvider.providerId,\n          scope,\n          uploadedBy: uploaderPrincipal?.uploadedBy,\n          uploadedByEntityType: uploaderPrincipal?.uploadedByEntityType,\n        },\n        executionContext\n      );\n\n      fileRecord = { fileId: createdFile.fileId };\n\n      // Step 5b: Resolve upload path options now that we have the fileId.\n      const resourceInstance = this.extractResourceInstance(request);\n      let uploadOptions: StorageUploadOptions | undefined;\n      if (fieldMeta) {\n        uploadOptions = this.pathResolver.resolve(\n          createdFile.fileId,\n          fieldName,\n          fieldMeta.fileMetadata,\n          resolveStorageApplicationIdentity(this.appConfigService),\n          multerFile.originalname,\n          resourceInstance,\n        );\n      }\n\n      // The resource segment of the object key comes from the row that was just created, and is\n      // applied OUTSIDE the `fieldMeta` branch on purpose: a file without field metadata still\n      // belongs to a resource, and keying it as unlinked would place it outside the prefix its\n      // principal is granted once the session policy narrows per resource.\n      //\n      // Derived once, here, at create — the key never moves afterwards, so this is the only\n      // moment the segment can be decided.\n      // Use the handler's OWN `resourceType` parameter, NOT `createdFile.linkedResourceType`.\n      //\n      // `createFile` above is called WITHOUT a linked resource — the row is created unlinked and the\n      // association is written later — so reading the field back off the created record is always\n      // `undefined`, and every upload silently took the `_unlinked/` staging branch. Caught only by\n      // uploading a real file and listing the object store: `tsc` was clean and every unit test\n      // green, because nothing in either exercises the value that reaches the key builder.\n      //\n      // `resourceType` is a parameter of this method and is validated at entry, so it is the\n      // authoritative answer to \"which resource does this blob belong to\" at the only moment the\n      // key can be decided.\n      // `scope` rides along so the key carries `<scope>/<scopeId>` — the same `FileScopeIdentifiers`\n      // already built above for the File row, so the row and the object key agree by construction\n      // rather than by two independent derivations.\n      uploadOptions = { ...uploadOptions, linkedResourceType: resourceType, scope };\n\n      // Step 6: Create stream from disk file (true streaming, no memory buffering)\n      // With disk storage, multerFile.path contains the temp file path\n      if (!multerFile.path) {\n        throw this.errorBuilder.buildError(\n          ErrorType.INTERNAL,\n          executionContext,\n          {\n            customMessageReference: ErrorCustomMessageReference.INTERNAL,\n            context: {\n              message: 'Multer file path is missing (disk storage error)',\n              filename: multerFile.originalname,\n            },\n          }\n        );\n      }\n\n      // Verify file exists before creating stream\n      if (!fs.existsSync(multerFile.path)) {\n        throw this.errorBuilder.buildError(\n          ErrorType.INTERNAL,\n          executionContext,\n          {\n            customMessageReference: ErrorCustomMessageReference.INTERNAL,\n            context: {\n              message: 'Temp file not found on disk',\n              path: multerFile.path,\n              filename: multerFile.originalname,\n            },\n          }\n        );\n      }\n\n      let fileStream: Readable | null = null;\n      let uploadResult: StorageUploadResult | null = null;\n\n      // Step 7: Upload the blob through the resolved storage provider.\n      try {\n        // Create stream from disk file (true streaming, no memory buffering)\n        fileStream = fs.createReadStream(multerFile.path);\n\n        uploadResult = await storageProvider.upload(\n          fileStream,\n          createdFile.fileId,\n          multerFile.mimetype,\n          multerFile.size,\n          executionContext,\n          uploadOptions,\n        );\n        blobStoredInStorage = true;\n\n        this.logDebug('File uploaded to storage successfully', {\n          fileId: createdFile.fileId,\n        });\n      } catch (uploadError) {\n        // If upload fails, mark file as FAILED\n        await this.filesService.updateFileStatus(\n          createdFile.fileId,\n          FileStatus.FAILED,\n          executionContext\n        );\n\n        throw this.errorBuilder.buildError(\n          ErrorType.EXTERNAL_SERVICE,\n          executionContext,\n          {\n            customMessageReference: ErrorCustomMessageReference.EXTERNAL_SERVICE,\n            context: {\n              message: 'Failed to upload file to storage',\n              fileId: createdFile.fileId,\n              error: describeCaughtError(uploadError),\n            },\n          }\n        );\n      } finally {\n        // Clean up temp file (always, even on error)\n        // This ensures temp files are removed even if upload fails or other errors occur\n        if (multerFile.path && fs.existsSync(multerFile.path)) {\n          try {\n            fs.unlinkSync(multerFile.path);\n            this.logDebug('Temp file cleaned up', { path: multerFile.path });\n          } catch (cleanupError) {\n            // Log cleanup error but don't fail operation\n            this.logger.warn('Failed to clean up temp file', {\n              path: multerFile.path,\n              ...projectCaughtErrorLogFields(cleanupError),\n            });\n          }\n        }\n\n        // Also destroy stream if it was created\n        if (fileStream && !fileStream.destroyed) {\n          fileStream.destroy();\n        }\n      }\n\n      // Step 8: Update file status to UPLOADED (with retry logic)\n      // CRITICAL: If updateFileStatus() fails after successful storage upload,\n      // file exists in storage but status remains PENDING in database.\n      // Retry logic handles transient errors (network issues, database locks, etc.)\n      // Decision 5.1: Retry Logic with audit log error (Option A)\n      const maxRetries = 3;\n      const initialDelay = 1000; // 1 second\n\n      let lastError: Error | null = null;\n      let uploadedFile: File | null = null;\n\n      for (let attempt = 0; attempt <= maxRetries; attempt++) {\n        try {\n          uploadedFile = await this.filesService.updateFileStatus(\n            createdFile.fileId,\n            FileStatus.UPLOADED,\n            executionContext,\n            undefined,\n            uploadResult ?? undefined,\n          );\n          break; // Success\n        } catch (error) {\n          lastError = error instanceof Error ? error : new Error(describeCaughtError(error));\n\n          if (attempt < maxRetries) {\n            const delay = initialDelay * Math.pow(2, attempt);\n            this.logger.warn('File status update failed, retrying', {\n              fileId: createdFile.fileId,\n              attempt: attempt + 1,\n              maxRetries,\n              delay,\n              error: lastError.message,\n            });\n            await new Promise(resolve => setTimeout(resolve, delay));\n          } else {\n            // Final attempt failed - audit log and re-throw\n            this.logger.error('File status update failed after all retries', {\n              fileId: createdFile.fileId,\n              attempts: maxRetries + 1,\n              error: lastError.message,\n              // File exists in storage but status remains PENDING in database\n              // This is a data inconsistency that needs manual intervention\n            });\n\n            // If the blob already reached storage but metadata could not commit to\n            // UPLOADED, try to roll the blob back so the row can safely move into\n            // a failed lifecycle path instead of silently pointing at live data.\n            if (blobStoredInStorage && uploadResult) {\n              try {\n                await storageProvider.delete(\n                  {\n                    fileId: createdFile.fileId,\n                    storageProvider: uploadResult.provider,\n                    storageRef: uploadResult.storageRef,\n                  },\n                  executionContext,\n                );\n                blobStoredInStorage = false;\n                this.logger.warn('Rolled back stored blob after upload status commit failure', {\n                  fileId: createdFile.fileId,\n                });\n              } catch (rollbackError) {\n                if (!isWildoBackendError(rollbackError) || rollbackError.type !== ErrorType.NOT_FOUND) {\n                  this.logger.error('Failed to roll back stored blob after upload status commit failure', {\n                    fileId: createdFile.fileId,\n                    ...projectCaughtErrorLogFields(rollbackError),\n                    originalError: lastError.message,\n                  });\n                } else {\n                  blobStoredInStorage = false;\n                }\n              }\n            }\n\n            // Re-throw to fail the operation\n            throw lastError;\n          }\n        }\n      }\n\n      // Ensure uploadedFile is set (TypeScript safety check)\n      if (!uploadedFile) {\n        throw this.errorBuilder.buildError(\n          ErrorType.INTERNAL,\n          executionContext,\n          {\n            customMessageReference: ErrorCustomMessageReference.INTERNAL,\n            context: {\n              message: 'File status update failed - uploadedFile is null after retries',\n              fileId: createdFile.fileId,\n            },\n          }\n        );\n      }\n\n      // Step 9: Return success response with file metadata\n      const fileMetadata = this.filesService.toMetadataResponse(uploadedFile);\n      uploadReachedSuccessState = uploadedFile.status === FileStatus.UPLOADED;\n\n      response.status(200).json({\n        success: true,\n        file: fileMetadata,\n      });\n\n      this.logDebug('File upload completed successfully', {\n        fileId: uploadedFile.fileId,\n        resourceType,\n        fieldName,\n      });\n\n      // Step 10: Post-upload async pipeline (fire-and-forget, response already sent)\n      const shouldScan = this.fileScanningService.shouldScan(fieldMeta?.fileMetadata);\n\n      if (shouldScan) {\n        this.fileScanningService.initiateScan(uploadedFile.fileId, executionContext)\n          .catch((scanError) => {\n            this.logger.error('Failed to initiate file scanning', {\n              fileId: uploadedFile!.fileId,\n              ...projectCaughtErrorLogFields(scanError),\n            });\n          });\n      }\n    } catch (error) {\n      // Only pre-success failures should transition a file to FAILED. Once the\n      // upload already reached UPLOADED, later response-layer failures must not\n      // corrupt the persisted state back to FAILED. Likewise, if the blob still\n      // exists in storage because rollback failed, keep the row out of FAILED so\n      // operators can distinguish that inconsistency from a clean failed upload.\n      const shouldMarkAsFailed = !!fileRecord?.fileId && !uploadReachedSuccessState && !blobStoredInStorage;\n      if (shouldMarkAsFailed) {\n        try {\n          await this.filesService.updateFileStatus(\n            fileRecord.fileId,\n            FileStatus.FAILED,\n            executionContext\n          );\n          this.logDebug('File marked as FAILED due to upload error', {\n            fileId: fileRecord.fileId,\n          });\n        } catch (updateError) {\n          // Log but don't throw - we're already in error handling\n          this.logger.error('Failed to mark file as FAILED', {\n            fileId: fileRecord.fileId,\n            ...projectCaughtErrorLogFields(updateError),\n          });\n        }\n      }\n\n      // Re-throw error to be handled by Express error handler\n      throw error;\n    }\n  }\n\n  /**\n   * Serve (stream) a resource-linked file's bytes for INLINE preview/consumption.\n   *\n   * This is the read counterpart to `handleFileUpload` — the resource-integrated\n   * file **serve** route (`GET .../{res}/:resourceId/files/:fieldName/:fileId`). The\n   * controller has ALREADY authorized the caller against the parent resource's READ\n   * operation before delegating here, so authorization **inherits from the linked\n   * resource** — no consumable token, no public share (those belong to the global\n   * `FileController` for its separate cross-resource/share purpose).\n   *\n   * The one job this method owns is the LINK-OWNERSHIP boundary: the requested\n   * `fileId` MUST be linked to exactly this `{resourceType, resourceId, fieldName}`.\n   * Without it, any caller who can READ a parent record could stream an arbitrary or\n   * cross-resource file id through the route. A mismatch fails closed as NOT_FOUND\n   * (no existence disclosure). `getFile()`'s own scope check is defense-in-depth.\n   *\n   * A `?variant=thumbnail` query asks for a downscaled preview rendition; it is\n   * parsed fail-safe (unknown values → original bytes) and forwarded to the shared\n   * streaming seam, which only transforms eligible raster images.\n   *\n   * @param request - Express request (`:fileId` etc. in params, `?variant=` in query).\n   * @param response - Express response to stream into.\n   * @param next - Express next (forwards pre-header stream errors).\n   * @param resourceType - Parent resource type from the route.\n   * @param fieldName - File field name from the route.\n   * @param resourceId - Parent resource id from the route (authorization target).\n   * @param fileId - The specific file id to serve (must belong to the field above).\n   * @param executionContext - READ execution context built + authorized by the controller.\n   */\n  async handleFileServe(\n    request: Request,\n    response: Response,\n    next: NextFunction,\n    resourceType: ResourceType,\n    fieldName: string,\n    resourceId: string,\n    fileId: string,\n    executionContext: ExecutionContext<any>,\n  ): Promise<void> {\n    validateResourceType(resourceType, this.errorBuilder, executionContext, 'resourceType');\n    validateFieldName(fieldName, this.errorBuilder, executionContext, 'fieldName');\n    validateResourceId(resourceId, this.errorBuilder, executionContext, 'resourceId');\n    validateFileId(fileId, this.errorBuilder, executionContext, 'fileId');\n\n    this.logDebug('Handling file serve', { resourceType, fieldName, resourceId, fileId });\n\n    // getFile applies the file-scope access check (defense-in-depth). Primary authz —\n    // the parent resource READ — was already enforced by the controller.\n    const file = await this.filesService.getFile(fileId, executionContext);\n\n    // SECURITY BOUNDARY: the served file MUST be linked to THIS resource + field.\n    const belongsToRouteResource =\n      !!file &&\n      file.linkedResourceType === resourceType &&\n      String(file.linkedResourceId) === String(resourceId) &&\n      file.linkedFieldName === fieldName;\n\n    if (!belongsToRouteResource) {\n      this.logDebug('File serve denied: file not linked to route resource/field', {\n        fileId,\n        resourceType,\n        resourceId,\n        fieldName,\n        linkedResourceType: file?.linkedResourceType,\n        linkedResourceId: file?.linkedResourceId,\n        linkedFieldName: file?.linkedFieldName,\n      });\n      throw this.errorBuilder.buildError(\n        ErrorType.NOT_FOUND,\n        executionContext,\n        {\n          customMessageReference: ErrorCustomMessageReference.FILE_NOT_FOUND,\n          context: { fileId }, // diagnostic (log-only)\n        },\n      );\n    }\n\n    // STATUS GATE — the same invariant the two GLOBAL file routes already enforce, applied at the\n    // third site that streams bytes.\n    //\n    // It was missing here, and the omission became reachable the moment generated files got serve\n    // routes (2026-08-25): a REGENERATE marks the superseded document `DELETED` while DELIBERATELY\n    // retaining its `linkedResourceType/Id/FieldName`, so the link-ownership boundary above says yes\n    // and the old document kept streaming — measured, 200 with 2,222 bytes. The same hole applies to\n    // an UPLOADED file a privacy erasure marked `DELETED`: physical cleanup is a batch that runs much\n    // later, and until it did, the erased bytes were still served in place.\n    //\n    // Two tiers, mirroring the existing gates rather than inventing a third posture:\n    //  - `FILE_METADATA_WITHHELD_STATUSES` (i.e. `DELETED`, the erasure outcome) → NOT_FOUND, because\n    //    for an erased file, confirming the id still resolves is itself a disclosure (the same\n    //    reasoning as `FileController.assertFileMetadataDisclosable`);\n    //  - anything else outside `FILE_DOWNLOADABLE_STATUSES` (`PENDING`, `SCANNING`, `FAILED`, …) →\n    //    the download route's VALIDATION shape, because such a file genuinely exists and may become\n    //    servable, and an uploader polling a preview needs to be told which.\n    if (FILE_METADATA_WITHHELD_STATUSES.has(file.status)) {\n      this.logDebug('File serve denied: withheld status', { fileId, status: file.status });\n      throw this.errorBuilder.buildError(\n        ErrorType.NOT_FOUND,\n        executionContext,\n        {\n          customMessageReference: ErrorCustomMessageReference.FILE_NOT_FOUND,\n          context: { fileId }, // diagnostic (log-only)\n        },\n      );\n    }\n    if (!FILE_DOWNLOADABLE_STATUSES.has(file.status)) {\n      this.logDebug('File serve denied: non-servable status', { fileId, status: file.status });\n      throw this.errorBuilder.buildError(\n        ErrorType.VALIDATION,\n        executionContext,\n        {\n          customMessageReference: ErrorCustomMessageReference.VALIDATION,\n          context: { message: 'File is not available for download', fileId, status: file.status },\n        },\n      );\n    }\n\n    // `?variant=thumbnail` → downscaled preview rendition (raster images only; the\n    // streaming seam falls back to original bytes for anything else). Fail-safe parse.\n    const variant = parseFileServeVariant(request.query.variant);\n\n    await this.filesService.streamFileToResponse(file, response, executionContext, {\n      disposition: 'inline',\n      next,\n      variant,\n    });\n  }\n\n  /**\n   * Derive file scope from parent resource's resourcePrimaryScope.\n   *\n   * Scope derivation rules:\n   * - APPLICATION: sets applicationId from execution context\n   * - ORGANIZATIONS: sets organizationId from execution context\n   * - USER_SELF: sets userId + applicationId from execution context (no org — separate scope axis)\n   *\n   * @param resourceType - Parent resource type\n   * @param executionContext - Execution context for scope values\n   * @returns FileScopeIdentifiers derived from parent resource\n   */\n  private deriveScopeFromParentResource(\n    resourceType: ResourceType,\n    executionContext: ExecutionContext<any>\n  ): FileScopeIdentifiers {\n    // Get parent resource configuration to find its primaryScope\n    const resourceConfig = this.resourcesRegistry.getResourceConfiguration(resourceType);\n\n    // Get primaryScope from resource configuration\n    // Default to ORGANIZATIONS if not specified\n    const primaryScope = resourceConfig?.resourcePrimaryScope || ResourcePrimaryScope.ORGANIZATIONS;\n\n    // Extract scope identifiers from execution context\n    const organizationId = this.resourceOperationHelper.getInitiatorId(executionContext, 'organization');\n    const userId = this.resourceOperationHelper.getInitiatorId(executionContext, 'user');\n    // Fall back to the app config's applicationId when the execution context\n    // doesn't carry one — same pattern this handler already uses for the path\n    // binding above. There is exactly one application per backend, so\n    // `appConfigService.applicationId` is the correct anchor when an internal\n    // EC was built without a populated `applicationId`.\n    const applicationId = executionContext.applicationId || this.appConfigService.applicationId;\n\n    switch (primaryScope) {\n      case ResourcePrimaryScope.APPLICATION:\n        if (!applicationId) {\n          throw this.errorBuilder.buildError(\n            ErrorType.VALIDATION,\n            executionContext,\n            {\n              customMessageReference: ErrorCustomMessageReference.FILE_SCOPE_IDENTIFIER_MISSING,\n              context: {\n                resourceType, // diagnostic (log-only)\n              },\n            }\n          );\n        }\n        return {\n          primaryScope: ResourcePrimaryScope.APPLICATION,\n          applicationId,\n        };\n\n      case ResourcePrimaryScope.ORGANIZATIONS:\n        if (!organizationId) {\n          throw this.errorBuilder.buildError(\n            ErrorType.VALIDATION,\n            executionContext,\n            {\n              customMessageReference: ErrorCustomMessageReference.FILE_SCOPE_IDENTIFIER_MISSING,\n              context: {\n                resourceType, // diagnostic (log-only)\n              },\n            }\n          );\n        }\n        if (!applicationId) {\n          throw this.errorBuilder.buildError(\n            ErrorType.VALIDATION,\n            executionContext,\n            {\n              customMessageReference: ErrorCustomMessageReference.FILE_SCOPE_IDENTIFIER_MISSING,\n              context: {\n                resourceType, // diagnostic (log-only)\n              },\n            }\n          );\n        }\n        return {\n          primaryScope: ResourcePrimaryScope.ORGANIZATIONS,\n          applicationId,\n          organizationId,\n        };\n\n      case ResourcePrimaryScope.USER_SELF:\n        // USER_SELF and ORGANIZATIONS are independent primary-scope axes (separation of\n        // concern): a self-owned file is owned by the USER, never by an org. Require the\n        // user (owner) + applicationId (tenant/bucket anchor); do NOT read or persist an\n        // organizationId here — a self-profile carries no org context.\n        if (!userId) {\n          throw this.errorBuilder.buildError(\n            ErrorType.VALIDATION,\n            executionContext,\n            {\n              customMessageReference: ErrorCustomMessageReference.FILE_SCOPE_IDENTIFIER_MISSING,\n              context: {\n                resourceType, // diagnostic (log-only)\n              },\n            }\n          );\n        }\n        if (!applicationId) {\n          throw this.errorBuilder.buildError(\n            ErrorType.VALIDATION,\n            executionContext,\n            {\n              customMessageReference: ErrorCustomMessageReference.FILE_SCOPE_IDENTIFIER_MISSING,\n              context: {\n                resourceType, // diagnostic (log-only)\n              },\n            }\n          );\n        }\n        return {\n          primaryScope: ResourcePrimaryScope.USER_SELF,\n          applicationId,\n          userId,\n        };\n\n      default:\n        throw this.errorBuilder.buildError(\n          ErrorType.CONFIGURATION,\n          executionContext,\n          {\n            customMessageReference: ErrorCustomMessageReference.CONFIGURATION,\n            context: {\n              message: 'File uploads only support APPLICATION, ORGANIZATIONS, and USER_SELF resource scopes',\n              resourceType,\n              primaryScope,\n            },\n          }\n        );\n    }\n  }\n}\n"]}
+{"version":3,"file":"resource-file-upload-handler.backend.service.js","sourceRoot":"","sources":["../../../../../src/files/handlers/resource-file-upload-handler.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;;;;;;;;;;;;;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAG/C,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,EAAuC,SAAS,EAAE,2BAA2B,EAAQ,UAAU,EAAE,0BAA0B,EAAE,+BAA+B,EAAE,oBAAoB,EAAwB,mBAAmB,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAC3R,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAChE,OAAO,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AAEpF,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAC9G,OAAO,EAAE,+BAA+B,EAAE,MAAM,0EAA0E,CAAC;AAE3H,OAAO,EAAE,2BAA2B,EAAE,MAAM,qFAAqF,CAAC;AAClI,OAAO,EAAE,qBAAqB,EAAE,MAAM,sEAAsE,CAAC;AAC7G,OAAO,EAAE,mBAAmB,EAAE,MAAM,yDAAyD,CAAC;AAC9F,OAAO,EAAE,qCAAqC,EAAE,MAAM,qFAAqF,CAAC;AAC5I,OAAO,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,cAAc,EAAE,mBAAmB,EAAE,YAAY,EAAE,kBAAkB,EAAE,4BAA4B,EAAE,4BAA4B,EAAE,MAAM,sDAAsD,CAAC;AACtQ,OAAO,EAAE,4BAA4B,EAAE,MAAM,oDAAoD,CAAC;AAClG,OAAO,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AAC/G,OAAO,EAAE,+BAA+B,EAAE,MAAM,sEAAsE,CAAC;AACvH,OAAO,EAAE,gCAAgC,EAAE,MAAM,wEAAwE,CAAC;AAC1H,OAAO,EAAE,qCAAqC,EAAE,MAAM,6EAA6E,CAAC;AAEpI,OAAO,EAAE,0BAA0B,EAAE,MAAM,iEAAiE,CAAC;AAC7G,OAAO,EAAE,mBAAmB,EAAE,2BAA2B,EAAE,MAAM,8EAA8E,CAAC;AAChJ,OAAO,EAAE,iCAAiC,EAAE,MAAM,2EAA2E,CAAC;AAC9H,OAAO,EAAE,6BAA6B,EAAE,MAAM,yFAAyF,CAAC;AACxI,OAAO,EAAE,6BAA6B,EAAE,MAAM,qEAAqE,CAAC;AAI7G,IAAM,uCAAuC,GAA7C,MAAM,uCAAuC;IAK/B;IAEA;IAEA;IAEA;IAEA;IAEA;IAEA;IAEA;IAEA;IAEA;IAEA;IAEA;IAEA;IAEA;IA9BT,QAAQ,CAA+D;IAEjF,YAEmB,MAAqB,EAErB,YAAwC,EAExC,iBAAkD,EAElD,kBAA+C,EAE/C,aAAoC,EAEpC,YAAiC,EAEjC,iBAAkD,EAElD,kBAAoD,EAEpD,uBAA8D,EAE9D,gBAAyC,EAEzC,YAAmD,EAEnD,mBAA+C,EAE/C,sBAAqD,EAErD,sBAAqD;QA1BrD,WAAM,GAAN,MAAM,CAAe;QAErB,iBAAY,GAAZ,YAAY,CAA4B;QAExC,sBAAiB,GAAjB,iBAAiB,CAAiC;QAElD,uBAAkB,GAAlB,kBAAkB,CAA6B;QAE/C,kBAAa,GAAb,aAAa,CAAuB;QAEpC,iBAAY,GAAZ,YAAY,CAAqB;QAEjC,sBAAiB,GAAjB,iBAAiB,CAAiC;QAElD,uBAAkB,GAAlB,kBAAkB,CAAkC;QAEpD,4BAAuB,GAAvB,uBAAuB,CAAuC;QAE9D,qBAAgB,GAAhB,gBAAgB,CAAyB;QAEzC,iBAAY,GAAZ,YAAY,CAAuC;QAEnD,wBAAmB,GAAnB,mBAAmB,CAA4B;QAE/C,2BAAsB,GAAtB,sBAAsB,CAA+B;QAErD,2BAAsB,GAAtB,sBAAsB,CAA+B;QAEtE,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,yCAAyC,CAAC,CAAC;QACnF,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,yCAAyC,EAAE,KAAK,CAAC,CAAC;IACpF,CAAC;IAED;;;;OAIG;IACK,uBAAuB,CAAC,GAAY;QAC1C,IAAI,GAAG,CAAC,IAAI,IAAI,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACjF,OAAO,GAAG,CAAC,IAA+B,CAAC;QAC7C,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAED;;;;;;;;;;OAUG;IACH,KAAK,CAAC,gBAAgB,CACpB,OAAgB,EAChB,QAAkB,EAClB,YAA0B,EAC1B,SAAiB,EACjB,UAA8B,EAC9B,SAAsE,EACtE,gBAAuC;QAEvC,6FAA6F;QAC7F,oBAAoB,CAAC,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,gBAAgB,EAAE,cAAc,CAAC,CAAC;QACxF,iBAAiB,CAAC,SAAS,EAAE,IAAI,CAAC,YAAY,EAAE,gBAAgB,EAAE,WAAW,CAAC,CAAC;QAC/E,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YAC7B,kBAAkB,CAAC,UAAU,EAAE,IAAI,CAAC,YAAY,EAAE,gBAAgB,EAAE,YAAY,CAAC,CAAC;QACpF,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,sBAAsB,EAAE;YACpC,YAAY;YACZ,SAAS;YACT,UAAU;YACV,SAAS;YACT,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI;SACxB,CAAC,CAAC;QAEH,IAAI,UAA0C,CAAC;QAC/C,IAAI,yBAAyB,GAAG,KAAK,CAAC;QACtC,IAAI,mBAAmB,GAAG,KAAK,CAAC;QAEhC,IAAI,CAAC;YACH,0CAA0C;YAC1C,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;gBAClB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,UAAU,EACpB,gBAAgB,EAChB;oBACE,sBAAsB,EAAE,2BAA2B,CAAC,mBAAmB;oBACvE,OAAO,EAAE;wBACP,wBAAwB;wBACxB,YAAY;wBACZ,SAAS;qBACV;iBACF,CACF,CAAC;YACJ,CAAC;YAED,MAAM,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;YAChC,MAAM,WAAW,GAAG,4BAA4B,CAAC,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;YAEpG,gEAAgE;YAChE,mBAAmB,CAAC,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,YAAY,EAAE,gBAAgB,EAAE,aAAa,CAAC,CAAC;YAC7F,YAAY,CAAC,UAAU,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,YAAY,EAAE,gBAAgB,EAAE,MAAM,CAAC,CAAC;YAExF,8DAA8D;YAC9D,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC;gBACvD,YAAY;gBACZ,SAAS;aACV,CAAC,CAAC;YAEH,4CAA4C;YAC5C,MAAM,gBAAgB,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,YAAY,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;YAEvF,IAAI,CAAC,gBAAgB,CAAC,OAAO,EAAE,CAAC;gBAC9B,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,UAAU,EACpB,gBAAgB,EAChB;oBACE,sBAAsB,EAAE,2BAA2B,CAAC,UAAU;oBAC9D,OAAO,EAAE;wBACP,OAAO,EAAE,wBAAwB;wBACjC,MAAM,EAAE,gBAAgB,CAAC,MAAM;wBAC/B,QAAQ,EAAE,UAAU,CAAC,YAAY;wBACjC,QAAQ,EAAE,UAAU,CAAC,QAAQ;wBAC7B,IAAI,EAAE,UAAU,CAAC,IAAI;qBACtB;iBACF,CACF,CAAC;YACJ,CAAC;YAED,iEAAiE;YACjE,sEAAsE;YACtE,sEAAsE;YACtE,iEAAiE;YACjE,uEAAuE;YACvE,MAAM,SAAS,GAAG,IAAI,CAAC,kBAAkB,CAAC,oBAAoB,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;YACxF,IAAI,SAAS,EAAE,YAAY,CAAC,UAAU,EAAE,MAAM,KAAK,oBAAoB,CAAC,YAAY,EAAE,CAAC;gBACrF,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,aAAa,EACvB,gBAAgB,EAChB;oBACE,sBAAsB,EAAE,2BAA2B,CAAC,iCAAiC;oBACrF,OAAO,EAAE;wBACP,wBAAwB;wBACxB,YAAY;wBACZ,SAAS;qBACV;iBACF,CACF,CAAC;YACJ,CAAC;YAED,qEAAqE;YACrE,MAAM,KAAK,GAAG,IAAI,CAAC,6BAA6B,CAAC,YAAY,EAAE,gBAAgB,CAAC,CAAC;YAEjF,4DAA4D;YAC5D,MAAM,eAAe,GAAG,SAAS,EAAE,YAAY,CAAC,eAAe,CAAC;YAChE,MAAM,eAAe,GAAG,IAAI,CAAC,iBAAiB,CAAC,eAAe,CAAC,eAAe,CAAC,CAAC;YAEhF,oGAAoG;YACpG,gGAAgG;YAChG,+FAA+F;YAC/F,mGAAmG;YACnG,yFAAyF;YACzF,MAAM,KAAK,GAAI,QAAQ,CAAC,MAAiD,EAAE,eAAe,CAAC;YAC3F,IAAI,KAAK,EAAE,CAAC;gBACV,MAAM,IAAI,CAAC,sBAAsB,CAAC,YAAY,CAAC,gBAAgB,CAAC,oBAAqB,CAAC,CAAC;gBACvF,gBAAgB,CAAC,2BAA2B,EAAE,CAAC;YACjD,CAAC;YAED,0DAA0D;YAC1D,gGAAgG;YAChG,iGAAiG;YACjG,+FAA+F;YAC/F,kGAAkG;YAClG,MAAM,iBAAiB,GAAG,KAAK;gBAC7B,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC,wBAAwB,CAAC,KAAK,CAAC,QAAQ,CAAC;gBACtE,CAAC,CAAC,4BAA4B,CAAC,gBAAgB,CAAC,CAAC;YACnD,IAAI,iBAAiB,EAAE,CAAC;gBACtB,kBAAkB,CAAC,iBAAiB,CAAC,UAAU,EAAE,IAAI,CAAC,YAAY,EAAE,gBAAgB,EAAE,YAAY,CAAC,CAAC;gBACpG,4BAA4B,CAC1B,iBAAiB,CAAC,oBAAoB,EACtC,IAAI,CAAC,YAAY,EACjB,gBAAgB,EAChB,sBAAsB,CACvB,CAAC;YACJ,CAAC;YAED,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CACpD;gBACE,QAAQ,EAAE,UAAU,CAAC,YAAY,IAAI,UAAU,CAAC,QAAQ;gBACxD,gBAAgB,EAAE,UAAU,CAAC,YAAY;gBACzC,QAAQ,EAAE,UAAU,CAAC,QAAQ;gBAC7B,IAAI,EAAE,UAAU,CAAC,IAAI;gBACrB,eAAe,EAAE,eAAe,CAAC,UAAU;gBAC3C,KAAK;gBACL,UAAU,EAAE,iBAAiB,EAAE,UAAU;gBACzC,oBAAoB,EAAE,iBAAiB,EAAE,oBAAoB;aAC9D,EACD,gBAAgB,CACjB,CAAC;YAEF,UAAU,GAAG,EAAE,MAAM,EAAE,WAAW,CAAC,MAAM,EAAE,CAAC;YAE5C,oEAAoE;YACpE,MAAM,gBAAgB,GAAG,IAAI,CAAC,uBAAuB,CAAC,OAAO,CAAC,CAAC;YAC/D,IAAI,aAA+C,CAAC;YACpD,IAAI,SAAS,EAAE,CAAC;gBACd,aAAa,GAAG,IAAI,CAAC,YAAY,CAAC,OAAO,CACvC,WAAW,CAAC,MAAM,EAClB,SAAS,EACT,SAAS,CAAC,YAAY,EACtB,iCAAiC,CAAC,IAAI,CAAC,gBAAgB,CAAC,EACxD,UAAU,CAAC,YAAY,EACvB,gBAAgB,CACjB,CAAC;YACJ,CAAC;YAED,0FAA0F;YAC1F,yFAAyF;YACzF,yFAAyF;YACzF,qEAAqE;YACrE,EAAE;YACF,sFAAsF;YACtF,qCAAqC;YACrC,wFAAwF;YACxF,EAAE;YACF,+FAA+F;YAC/F,4FAA4F;YAC5F,8FAA8F;YAC9F,0FAA0F;YAC1F,qFAAqF;YACrF,EAAE;YACF,uFAAuF;YACvF,2FAA2F;YAC3F,sBAAsB;YACtB,+FAA+F;YAC/F,4FAA4F;YAC5F,8CAA8C;YAC9C,aAAa,GAAG,EAAE,GAAG,aAAa,EAAE,kBAAkB,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC;YAE9E,6EAA6E;YAC7E,iEAAiE;YACjE,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;gBACrB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,QAAQ,EAClB,gBAAgB,EAChB;oBACE,sBAAsB,EAAE,2BAA2B,CAAC,QAAQ;oBAC5D,OAAO,EAAE;wBACP,OAAO,EAAE,kDAAkD;wBAC3D,QAAQ,EAAE,UAAU,CAAC,YAAY;qBAClC;iBACF,CACF,CAAC;YACJ,CAAC;YAED,4CAA4C;YAC5C,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;gBACpC,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,QAAQ,EAClB,gBAAgB,EAChB;oBACE,sBAAsB,EAAE,2BAA2B,CAAC,QAAQ;oBAC5D,OAAO,EAAE;wBACP,OAAO,EAAE,6BAA6B;wBACtC,IAAI,EAAE,UAAU,CAAC,IAAI;wBACrB,QAAQ,EAAE,UAAU,CAAC,YAAY;qBAClC;iBACF,CACF,CAAC;YACJ,CAAC;YAED,IAAI,UAAU,GAAoB,IAAI,CAAC;YACvC,IAAI,YAAY,GAA+B,IAAI,CAAC;YAEpD,iEAAiE;YACjE,IAAI,CAAC;gBACH,qEAAqE;gBACrE,UAAU,GAAG,EAAE,CAAC,gBAAgB,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;gBAElD,YAAY,GAAG,MAAM,eAAe,CAAC,MAAM,CACzC,UAAU,EACV,WAAW,CAAC,MAAM,EAClB,UAAU,CAAC,QAAQ,EACnB,UAAU,CAAC,IAAI,EACf,gBAAgB,EAChB,aAAa,CACd,CAAC;gBACF,mBAAmB,GAAG,IAAI,CAAC;gBAE3B,IAAI,CAAC,QAAQ,CAAC,uCAAuC,EAAE;oBACrD,MAAM,EAAE,WAAW,CAAC,MAAM;iBAC3B,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,WAAW,EAAE,CAAC;gBACrB,uCAAuC;gBACvC,MAAM,IAAI,CAAC,YAAY,CAAC,gBAAgB,CACtC,WAAW,CAAC,MAAM,EAClB,UAAU,CAAC,MAAM,EACjB,gBAAgB,CACjB,CAAC;gBAEF,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,gBAAgB,EAC1B,gBAAgB,EAChB;oBACE,sBAAsB,EAAE,2BAA2B,CAAC,gBAAgB;oBACpE,OAAO,EAAE;wBACP,OAAO,EAAE,kCAAkC;wBAC3C,MAAM,EAAE,WAAW,CAAC,MAAM;wBAC1B,KAAK,EAAE,mBAAmB,CAAC,WAAW,CAAC;qBACxC;iBACF,CACF,CAAC;YACJ,CAAC;oBAAS,CAAC;gBACT,6CAA6C;gBAC7C,iFAAiF;gBACjF,IAAI,UAAU,CAAC,IAAI,IAAI,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;oBACtD,IAAI,CAAC;wBACH,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;wBAC/B,IAAI,CAAC,QAAQ,CAAC,sBAAsB,EAAE,EAAE,IAAI,EAAE,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC;oBACnE,CAAC;oBAAC,OAAO,YAAY,EAAE,CAAC;wBACtB,6CAA6C;wBAC7C,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,8BAA8B,EAAE;4BAC/C,IAAI,EAAE,UAAU,CAAC,IAAI;4BACrB,GAAG,2BAA2B,CAAC,YAAY,CAAC;yBAC7C,CAAC,CAAC;oBACL,CAAC;gBACH,CAAC;gBAED,wCAAwC;gBACxC,IAAI,UAAU,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,CAAC;oBACxC,UAAU,CAAC,OAAO,EAAE,CAAC;gBACvB,CAAC;YACH,CAAC;YAED,4DAA4D;YAC5D,yEAAyE;YACzE,iEAAiE;YACjE,8EAA8E;YAC9E,4DAA4D;YAC5D,MAAM,UAAU,GAAG,CAAC,CAAC;YACrB,MAAM,YAAY,GAAG,IAAI,CAAC,CAAC,WAAW;YAEtC,IAAI,SAAS,GAAiB,IAAI,CAAC;YACnC,IAAI,YAAY,GAAgB,IAAI,CAAC;YAErC,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,IAAI,UAAU,EAAE,OAAO,EAAE,EAAE,CAAC;gBACvD,IAAI,CAAC;oBACH,YAAY,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,gBAAgB,CACrD,WAAW,CAAC,MAAM,EAClB,UAAU,CAAC,QAAQ,EACnB,gBAAgB,EAChB,SAAS,EACT,YAAY,IAAI,SAAS,CAC1B,CAAC;oBACF,MAAM,CAAC,UAAU;gBACnB,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,SAAS,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC,CAAC;oBAEnF,IAAI,OAAO,GAAG,UAAU,EAAE,CAAC;wBACzB,MAAM,KAAK,GAAG,YAAY,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;wBAClD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,qCAAqC,EAAE;4BACtD,MAAM,EAAE,WAAW,CAAC,MAAM;4BAC1B,OAAO,EAAE,OAAO,GAAG,CAAC;4BACpB,UAAU;4BACV,KAAK;4BACL,KAAK,EAAE,SAAS,CAAC,OAAO;yBACzB,CAAC,CAAC;wBACH,MAAM,IAAI,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;oBAC3D,CAAC;yBAAM,CAAC;wBACN,gDAAgD;wBAChD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,6CAA6C,EAAE;4BAC/D,MAAM,EAAE,WAAW,CAAC,MAAM;4BAC1B,QAAQ,EAAE,UAAU,GAAG,CAAC;4BACxB,KAAK,EAAE,SAAS,CAAC,OAAO;4BACxB,gEAAgE;4BAChE,8DAA8D;yBAC/D,CAAC,CAAC;wBAEH,uEAAuE;wBACvE,sEAAsE;wBACtE,qEAAqE;wBACrE,IAAI,mBAAmB,IAAI,YAAY,EAAE,CAAC;4BACxC,IAAI,CAAC;gCACH,MAAM,eAAe,CAAC,MAAM,CAC1B;oCACE,MAAM,EAAE,WAAW,CAAC,MAAM;oCAC1B,eAAe,EAAE,YAAY,CAAC,QAAQ;oCACtC,UAAU,EAAE,YAAY,CAAC,UAAU;iCACpC,EACD,gBAAgB,CACjB,CAAC;gCACF,mBAAmB,GAAG,KAAK,CAAC;gCAC5B,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,4DAA4D,EAAE;oCAC7E,MAAM,EAAE,WAAW,CAAC,MAAM;iCAC3B,CAAC,CAAC;4BACL,CAAC;4BAAC,OAAO,aAAa,EAAE,CAAC;gCACvB,IAAI,CAAC,mBAAmB,CAAC,aAAa,CAAC,IAAI,aAAa,CAAC,IAAI,KAAK,SAAS,CAAC,SAAS,EAAE,CAAC;oCACtF,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,oEAAoE,EAAE;wCACtF,MAAM,EAAE,WAAW,CAAC,MAAM;wCAC1B,GAAG,2BAA2B,CAAC,aAAa,CAAC;wCAC7C,aAAa,EAAE,SAAS,CAAC,OAAO;qCACjC,CAAC,CAAC;gCACL,CAAC;qCAAM,CAAC;oCACN,mBAAmB,GAAG,KAAK,CAAC;gCAC9B,CAAC;4BACH,CAAC;wBACH,CAAC;wBAED,iCAAiC;wBACjC,MAAM,SAAS,CAAC;oBAClB,CAAC;gBACH,CAAC;YACH,CAAC;YAED,uDAAuD;YACvD,IAAI,CAAC,YAAY,EAAE,CAAC;gBAClB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,QAAQ,EAClB,gBAAgB,EAChB;oBACE,sBAAsB,EAAE,2BAA2B,CAAC,QAAQ;oBAC5D,OAAO,EAAE;wBACP,OAAO,EAAE,gEAAgE;wBACzE,MAAM,EAAE,WAAW,CAAC,MAAM;qBAC3B;iBACF,CACF,CAAC;YACJ,CAAC;YAED;;;;;;;;;;;;;;;;eAgBG;YACH,MAAM,cAAc,GAAG,IAAI,CAAC,mBAAmB,CAAC,UAAU,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;YACpF,IAAI,uBAAuB,GAAS,YAAY,CAAC;YACjD,IAAI,cAAc,EAAE,CAAC;gBACnB,MAAM,IAAI,CAAC,mBAAmB,CAAC,YAAY,CAAC,YAAY,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;gBACnF,4FAA4F;gBAC5F,qFAAqF;gBACrF,2FAA2F;gBAC3F,qFAAqF;gBACrF,MAAM,mBAAmB,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,YAAY,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;gBACnG,IAAI,mBAAmB,EAAE,CAAC;oBACxB,uBAAuB,GAAG,mBAAmB,CAAC;gBAChD,CAAC;YACH,CAAC;YAED,sDAAsD;YACtD,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,CAAC,kBAAkB,CAAC,uBAAuB,CAAC,CAAC;YACnF;;;eAGG;YACH,yBAAyB,GAAG,uBAAuB,CAAC,MAAM,KAAK,UAAU,CAAC,QAAQ;mBAC7E,uBAAuB,CAAC,MAAM,KAAK,UAAU,CAAC,QAAQ,CAAC;YAE5D,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACxB,OAAO,EAAE,IAAI;gBACb,IAAI,EAAE,YAAY;aACnB,CAAC,CAAC;YAEH,IAAI,CAAC,QAAQ,CAAC,oCAAoC,EAAE;gBAClD,MAAM,EAAE,YAAY,CAAC,MAAM;gBAC3B,YAAY;gBACZ,SAAS;aACV,CAAC,CAAC;YAEH,+FAA+F;YAC/F,6FAA6F;YAC7F,IAAI,KAAK,EAAE,CAAC;gBACV,IAAI,CAAC,sBAAsB;qBACxB,gBAAgB,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,YAAY,CAAC,MAAM,EAAE,QAAQ,EAAE,YAAY,CAAC,QAAQ,EAAE,IAAI,EAAE,YAAY,CAAC,IAAI,EAAE,EAAE,gBAAgB,CAAC;qBACpI,KAAK,CAAC,CAAC,eAAe,EAAE,EAAE;oBACzB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,6CAA6C,EAAE;wBAC/D,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,GAAG;wBACxB,MAAM,EAAE,YAAa,CAAC,MAAM;wBAC5B,GAAG,2BAA2B,CAAC,eAAe,CAAC;qBAChD,CAAC,CAAC;gBACL,CAAC,CAAC,CAAC;YACP,CAAC;QAEH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,yEAAyE;YACzE,0EAA0E;YAC1E,0EAA0E;YAC1E,2EAA2E;YAC3E,2EAA2E;YAC3E,MAAM,kBAAkB,GAAG,CAAC,CAAC,UAAU,EAAE,MAAM,IAAI,CAAC,yBAAyB,IAAI,CAAC,mBAAmB,CAAC;YACtG,IAAI,kBAAkB,EAAE,CAAC;gBACvB,IAAI,CAAC;oBACH,MAAM,IAAI,CAAC,YAAY,CAAC,gBAAgB,CACtC,UAAU,CAAC,MAAM,EACjB,UAAU,CAAC,MAAM,EACjB,gBAAgB,CACjB,CAAC;oBACF,IAAI,CAAC,QAAQ,CAAC,2CAA2C,EAAE;wBACzD,MAAM,EAAE,UAAU,CAAC,MAAM;qBAC1B,CAAC,CAAC;gBACL,CAAC;gBAAC,OAAO,WAAW,EAAE,CAAC;oBACrB,wDAAwD;oBACxD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,+BAA+B,EAAE;wBACjD,MAAM,EAAE,UAAU,CAAC,MAAM;wBACzB,GAAG,2BAA2B,CAAC,WAAW,CAAC;qBAC5C,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YAED,wDAAwD;YACxD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4BG;IACH,KAAK,CAAC,eAAe,CACnB,OAAgB,EAChB,QAAkB,EAClB,IAAkB,EAClB,YAA0B,EAC1B,SAAiB,EACjB,UAAkB,EAClB,MAAc,EACd,gBAAuC;QAEvC,oBAAoB,CAAC,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,gBAAgB,EAAE,cAAc,CAAC,CAAC;QACxF,iBAAiB,CAAC,SAAS,EAAE,IAAI,CAAC,YAAY,EAAE,gBAAgB,EAAE,WAAW,CAAC,CAAC;QAC/E,kBAAkB,CAAC,UAAU,EAAE,IAAI,CAAC,YAAY,EAAE,gBAAgB,EAAE,YAAY,CAAC,CAAC;QAClF,cAAc,CAAC,MAAM,EAAE,IAAI,CAAC,YAAY,EAAE,gBAAgB,EAAE,QAAQ,CAAC,CAAC;QAEtE,IAAI,CAAC,QAAQ,CAAC,qBAAqB,EAAE,EAAE,YAAY,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,CAAC;QAEtF,kFAAkF;QAClF,qEAAqE;QACrE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;QAEvE,8EAA8E;QAC9E,MAAM,sBAAsB,GAC1B,CAAC,CAAC,IAAI;YACN,IAAI,CAAC,kBAAkB,KAAK,YAAY;YACxC,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,KAAK,MAAM,CAAC,UAAU,CAAC;YACpD,IAAI,CAAC,eAAe,KAAK,SAAS,CAAC;QAErC,IAAI,CAAC,sBAAsB,EAAE,CAAC;YAC5B,IAAI,CAAC,QAAQ,CAAC,4DAA4D,EAAE;gBAC1E,MAAM;gBACN,YAAY;gBACZ,UAAU;gBACV,SAAS;gBACT,kBAAkB,EAAE,IAAI,EAAE,kBAAkB;gBAC5C,gBAAgB,EAAE,IAAI,EAAE,gBAAgB;gBACxC,eAAe,EAAE,IAAI,EAAE,eAAe;aACvC,CAAC,CAAC;YACH,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,SAAS,EACnB,gBAAgB,EAChB;gBACE,sBAAsB,EAAE,2BAA2B,CAAC,cAAc;gBAClE,OAAO,EAAE,EAAE,MAAM,EAAE,EAAE,wBAAwB;aAC9C,CACF,CAAC;QACJ,CAAC;QAED,8FAA8F;QAC9F,iCAAiC;QACjC,EAAE;QACF,8FAA8F;QAC9F,+FAA+F;QAC/F,iGAAiG;QACjG,iGAAiG;QACjG,kGAAkG;QAClG,wEAAwE;QACxE,EAAE;QACF,iFAAiF;QACjF,kGAAkG;QAClG,2FAA2F;QAC3F,mEAAmE;QACnE,+FAA+F;QAC/F,gGAAgG;QAChG,yEAAyE;QACzE,IAAI,+BAA+B,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YACrD,IAAI,CAAC,QAAQ,CAAC,oCAAoC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;YACrF,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,SAAS,EACnB,gBAAgB,EAChB;gBACE,sBAAsB,EAAE,2BAA2B,CAAC,cAAc;gBAClE,OAAO,EAAE,EAAE,MAAM,EAAE,EAAE,wBAAwB;aAC9C,CACF,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,0BAA0B,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YACjD,IAAI,CAAC,QAAQ,CAAC,wCAAwC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;YACzF,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,UAAU,EACpB,gBAAgB,EAChB;gBACE,sBAAsB,EAAE,2BAA2B,CAAC,UAAU;gBAC9D,OAAO,EAAE,EAAE,OAAO,EAAE,oCAAoC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE;aACxF,CACF,CAAC;QACJ,CAAC;QAED,+EAA+E;QAC/E,mFAAmF;QACnF,MAAM,OAAO,GAAG,qBAAqB,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAE7D,MAAM,IAAI,CAAC,YAAY,CAAC,oBAAoB,CAAC,IAAI,EAAE,QAAQ,EAAE,gBAAgB,EAAE;YAC7E,WAAW,EAAE,QAAQ;YACrB,IAAI;YACJ,OAAO;SACR,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;;;OAWG;IACK,6BAA6B,CACnC,YAA0B,EAC1B,gBAAuC;QAEvC,6DAA6D;QAC7D,MAAM,cAAc,GAAG,IAAI,CAAC,iBAAiB,CAAC,wBAAwB,CAAC,YAAY,CAAC,CAAC;QAErF,+CAA+C;QAC/C,4CAA4C;QAC5C,MAAM,YAAY,GAAG,cAAc,EAAE,oBAAoB,IAAI,oBAAoB,CAAC,aAAa,CAAC;QAEhG,mDAAmD;QACnD,MAAM,cAAc,GAAG,IAAI,CAAC,uBAAuB,CAAC,cAAc,CAAC,gBAAgB,EAAE,cAAc,CAAC,CAAC;QACrG,MAAM,MAAM,GAAG,IAAI,CAAC,uBAAuB,CAAC,cAAc,CAAC,gBAAgB,EAAE,MAAM,CAAC,CAAC;QACrF,yEAAyE;QACzE,0EAA0E;QAC1E,kEAAkE;QAClE,0EAA0E;QAC1E,oDAAoD;QACpD,MAAM,aAAa,GAAG,gBAAgB,CAAC,aAAa,IAAI,IAAI,CAAC,gBAAgB,CAAC,aAAa,CAAC;QAE5F,QAAQ,YAAY,EAAE,CAAC;YACrB,KAAK,oBAAoB,CAAC,WAAW;gBACnC,IAAI,CAAC,aAAa,EAAE,CAAC;oBACnB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,UAAU,EACpB,gBAAgB,EAChB;wBACE,sBAAsB,EAAE,2BAA2B,CAAC,6BAA6B;wBACjF,OAAO,EAAE;4BACP,YAAY,EAAE,wBAAwB;yBACvC;qBACF,CACF,CAAC;gBACJ,CAAC;gBACD,OAAO;oBACL,YAAY,EAAE,oBAAoB,CAAC,WAAW;oBAC9C,aAAa;iBACd,CAAC;YAEJ,KAAK,oBAAoB,CAAC,aAAa;gBACrC,IAAI,CAAC,cAAc,EAAE,CAAC;oBACpB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,UAAU,EACpB,gBAAgB,EAChB;wBACE,sBAAsB,EAAE,2BAA2B,CAAC,6BAA6B;wBACjF,OAAO,EAAE;4BACP,YAAY,EAAE,wBAAwB;yBACvC;qBACF,CACF,CAAC;gBACJ,CAAC;gBACD,IAAI,CAAC,aAAa,EAAE,CAAC;oBACnB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,UAAU,EACpB,gBAAgB,EAChB;wBACE,sBAAsB,EAAE,2BAA2B,CAAC,6BAA6B;wBACjF,OAAO,EAAE;4BACP,YAAY,EAAE,wBAAwB;yBACvC;qBACF,CACF,CAAC;gBACJ,CAAC;gBACD,OAAO;oBACL,YAAY,EAAE,oBAAoB,CAAC,aAAa;oBAChD,aAAa;oBACb,cAAc;iBACf,CAAC;YAEJ,KAAK,oBAAoB,CAAC,SAAS;gBACjC,gFAAgF;gBAChF,iFAAiF;gBACjF,iFAAiF;gBACjF,+DAA+D;gBAC/D,IAAI,CAAC,MAAM,EAAE,CAAC;oBACZ,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,UAAU,EACpB,gBAAgB,EAChB;wBACE,sBAAsB,EAAE,2BAA2B,CAAC,6BAA6B;wBACjF,OAAO,EAAE;4BACP,YAAY,EAAE,wBAAwB;yBACvC;qBACF,CACF,CAAC;gBACJ,CAAC;gBACD,IAAI,CAAC,aAAa,EAAE,CAAC;oBACnB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,UAAU,EACpB,gBAAgB,EAChB;wBACE,sBAAsB,EAAE,2BAA2B,CAAC,6BAA6B;wBACjF,OAAO,EAAE;4BACP,YAAY,EAAE,wBAAwB;yBACvC;qBACF,CACF,CAAC;gBACJ,CAAC;gBACD,OAAO;oBACL,YAAY,EAAE,oBAAoB,CAAC,SAAS;oBAC5C,aAAa;oBACb,MAAM;iBACP,CAAC;YAEJ;gBACE,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,aAAa,EACvB,gBAAgB,EAChB;oBACE,sBAAsB,EAAE,2BAA2B,CAAC,aAAa;oBACjE,OAAO,EAAE;wBACP,OAAO,EAAE,qFAAqF;wBAC9F,YAAY;wBACZ,YAAY;qBACb;iBACF,CACF,CAAC;QACN,CAAC;IACH,CAAC;CACF,CAAA;AA3xBY,uCAAuC;IADnD,UAAU,EAAE;IAKR,WAAA,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAA;IAEjC,WAAA,MAAM,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,CAAA;IAE9C,WAAA,MAAM,CAAC,kBAAkB,CAAC,uBAAuB,CAAC,CAAA;IAElD,WAAA,MAAM,CAAC,kBAAkB,CAAC,2BAA2B,CAAC,CAAA;IAEtD,WAAA,MAAM,CAAC,kBAAkB,CAAC,qBAAqB,CAAC,CAAA;IAEhD,WAAA,MAAM,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,CAAA;IAE9C,WAAA,MAAM,CAAC,kBAAkB,CAAC,iBAAiB,CAAC,CAAA;IAE5C,WAAA,MAAM,CAAC,kBAAkB,CAAC,yBAAyB,CAAC,CAAA;IAEpD,WAAA,MAAM,CAAC,kBAAkB,CAAC,8BAA8B,CAAC,CAAA;IAEzD,WAAA,MAAM,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,CAAA;IAE3C,YAAA,MAAM,CAAC,kBAAkB,CAAC,uBAAuB,CAAC,CAAA;IAElD,YAAA,MAAM,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,CAAA;IAE9C,YAAA,MAAM,CAAC,kBAAkB,CAAC,sBAAsB,CAAC,CAAA;IAEjD,YAAA,MAAM,CAAC,kBAAkB,CAAC,sBAAsB,CAAC,CAAA;+CAvBnB,0BAA0B;QAErB,+BAA+B;QAE9B,2BAA2B;QAEhC,qBAAqB;QAEtB,mBAAmB;QAEd,+BAA+B;QAE9B,gCAAgC;QAE3B,qCAAqC;QAE5C,uBAAuB;QAE3B,qCAAqC;QAE9B,0BAA0B;QAEvB,6BAA6B;QAE7B,6BAA6B;GA/B7D,uCAAuC,CA2xBnD","sourcesContent":["/**\n * Resource File Upload Handler Backend Service\n *\n * Handles user-provided uploads for resource-integrated file fields after the\n * controller's pre-Multer middleware has already established execution context\n * and authorized access to the owning resource route.\n *\n * Coordinates validation, file record creation, and storage upload. UPDATE\n * routes authorize the target resource before reaching this handler, but the\n * upload itself still creates a new File record; attaching/replacing that file\n * on the resource is owned by the calling form/field mutation lane, not by this\n * upload transport.\n *\n * Flow:\n * 1. Validate file exists in request\n * 2. Resolve file constraints from resource field schema\n * 3. Validate file against constraints\n * 4. Create file record (status: PENDING)\n * 5. Upload file to storage\n * 6. Update file status to UPLOADED\n * 7. Return file metadata\n * 8. (async) Initiate AV scan if enabled (UPLOADED → SCANNING → CLEAN/INFECTED)\n */\n\nimport { injectable, inject } from 'inversify';\nimport type { Request, Response, NextFunction } from 'express';\nimport { Readable } from 'stream';\nimport fs from 'fs';\nimport { CoreResourceOperation, ResourceType, ErrorType, ErrorCustomMessageReference, File, FileStatus, FILE_DOWNLOADABLE_STATUSES, FILE_METADATA_WITHHELD_STATUSES, ResourcePrimaryScope, FileScopeIdentifiers, isWildoBackendError, parseFileServeVariant } from '@wildo-ai/saas-models';\nimport { FileGenerationSource } from '@wildo-ai/zod-decorators';\nimport { SAAS_SERVICE_TYPES } from '~wildo-backend-lib/inject/models/service-types';\nimport type { LoggerService } from '~wildo-backend-lib/monitoring/logger/services/logger.service';\nimport { ErrorBuilderBackendService } from '~wildo-backend-lib/errors/services/error-builder.backend.service';\nimport { ResourcesRegistryBackendService } from '~wildo-backend-lib/resources/services/resources-registry.backend.service';\nimport { ExecutionContext } from '~wildo-backend-lib/runtime/models/execution-context.backend.schemas';\nimport { FileConstraintResolverChain } from '~wildo-backend-lib/files/constraints/file-constraint-resolver-chain.backend.service';\nimport { FileValidationService } from '~wildo-backend-lib/files/constraints/file-validation.backend.service';\nimport { FilesBackendService } from '~wildo-backend-lib/files/services/files.backend.service';\nimport { ResourceOperationHelperBackendService } from '~wildo-backend-lib/base-classes/services/resource-operations-helper.backend.service';\nimport { validateResourceType, validateFieldName, validateResourceId, validateFileId, validateContentType, validateSize, validateUploadedBy, validateUploadedByEntityType, resolveConfiguredMaxFileSize } from '~wildo-backend-lib/files/utils/file-validation.utils';\nimport { resolveFileUploaderPrincipal } from '~wildo-backend-lib/files/utils/file-uploader.utils';\nimport { AppConfigurationService } from '~wildo-backend-lib/config/services/app-configuration.backend.service';\nimport { FileStorageRouterBackendService } from '~wildo-backend-lib/files/storage/file-storage-router.backend.service';\nimport { FileFieldDetectionBackendService } from '~wildo-backend-lib/files/services/file-field-detection.backend.service';\nimport { FileStoragePathResolverBackendService } from '~wildo-backend-lib/files/storage/file-storage-path-resolver.backend.service';\nimport type { StorageUploadResult, StorageUploadOptions } from '~wildo-backend-lib/files/storage/file-storage-provider.types';\nimport { FileScanningBackendService } from '~wildo-backend-lib/files/services/file-scanning.backend.service';\nimport { describeCaughtError, projectCaughtErrorLogFields } from '~wildo-backend-lib/errors/utils/error-log-level-classification.backend.utils';\nimport { resolveStorageApplicationIdentity } from '~wildo-backend-lib/files/utils/storage-application-identity.backend.utils';\nimport { ConsumableTokenBackendService } from '~wildo-backend-lib/security/consumable-tokens/services/consumable-token.backend.service';\nimport { FileUploadGrantBackendService } from '~wildo-backend-lib/files/services/file-upload-grant.backend.service';\nimport type { FileUploadRouteGrantLocals } from '~wildo-backend-lib/files/handlers/file-upload-route-locals.backend.types';\n\n@injectable()\nexport class ResourceFileUploadHandlerBackendService {\n  protected logDebug: (message: string, context?: Record<string, unknown>) => void;\n\n  constructor(\n    @inject(SAAS_SERVICE_TYPES.Logger)\n    private readonly logger: LoggerService,\n    @inject(SAAS_SERVICE_TYPES.ErrorBuilderService)\n    private readonly errorBuilder: ErrorBuilderBackendService,\n    @inject(SAAS_SERVICE_TYPES.ResourceRegistryService)\n    private readonly resourcesRegistry: ResourcesRegistryBackendService,\n    @inject(SAAS_SERVICE_TYPES.FileConstraintResolverChain)\n    private readonly constraintResolver: FileConstraintResolverChain,\n    @inject(SAAS_SERVICE_TYPES.FileValidationService)\n    private readonly fileValidator: FileValidationService,\n    @inject(SAAS_SERVICE_TYPES.FilesBackendService)\n    private readonly filesService: FilesBackendService,\n    @inject(SAAS_SERVICE_TYPES.FileStorageRouter)\n    private readonly fileStorageRouter: FileStorageRouterBackendService,\n    @inject(SAAS_SERVICE_TYPES.FileFieldDetectionService)\n    private readonly fileFieldDetection: FileFieldDetectionBackendService,\n    @inject(SAAS_SERVICE_TYPES.ResourceOperationHelperService)\n    private readonly resourceOperationHelper: ResourceOperationHelperBackendService,\n    @inject(SAAS_SERVICE_TYPES.AppConfigService)\n    private readonly appConfigService: AppConfigurationService,\n    @inject(SAAS_SERVICE_TYPES.FileStoragePathResolver)\n    private readonly pathResolver: FileStoragePathResolverBackendService,\n    @inject(SAAS_SERVICE_TYPES.FileScanningService)\n    private readonly fileScanningService: FileScanningBackendService,\n    @inject(SAAS_SERVICE_TYPES.ConsumableTokenService)\n    private readonly consumableTokenService: ConsumableTokenBackendService,\n    @inject(SAAS_SERVICE_TYPES.FileUploadGrantService)\n    private readonly fileUploadGrantService: FileUploadGrantBackendService,\n  ) {\n    this.logDebug = this.logger.debugByType('ResourceFileUploadHandlerBackendService');\n    this.logger.setDebugTypeLogging('ResourceFileUploadHandlerBackendService', false);\n  }\n\n  /**\n   * Extract the resource instance from the request body (if available).\n   * In multipart uploads, the resource data may be present in `req.body`\n   * as parsed form fields.\n   */\n  private extractResourceInstance(req: Request): Record<string, unknown> | undefined {\n    if (req.body && typeof req.body === 'object' && Object.keys(req.body).length > 0) {\n      return req.body as Record<string, unknown>;\n    }\n    return undefined;\n  }\n\n  /**\n   * Handle file upload for resource-integrated file fields.\n   *\n   * @param request - Express request with file in request.file (Multer)\n   * @param response - Express response\n   * @param resourceType - Resource type (e.g., 'todos')\n   * @param fieldName - File field name (e.g., 'attachments')\n   * @param resourceId - Resource ID (undefined for CREATE, string for UPDATE route authorization)\n   * @param operation - Route operation used for authorization; the upload always creates a new File record\n   * @param executionContext - Execution context from request\n   */\n  async handleFileUpload(\n    request: Request,\n    response: Response,\n    resourceType: ResourceType,\n    fieldName: string,\n    resourceId: string | undefined,\n    operation: CoreResourceOperation.CREATE | CoreResourceOperation.UPDATE,\n    executionContext: ExecutionContext<any>\n  ): Promise<void> {\n    // Validate inputs (CRITICAL: Prevents invalid data propagation and security vulnerabilities)\n    validateResourceType(resourceType, this.errorBuilder, executionContext, 'resourceType');\n    validateFieldName(fieldName, this.errorBuilder, executionContext, 'fieldName');\n    if (resourceId !== undefined) {\n      validateResourceId(resourceId, this.errorBuilder, executionContext, 'resourceId');\n    }\n\n    this.logDebug('Handling file upload', {\n      resourceType,\n      fieldName,\n      resourceId,\n      operation,\n      hasFile: !!request.file,\n    });\n\n    let fileRecord: { fileId: string } | undefined;\n    let uploadReachedSuccessState = false;\n    let blobStoredInStorage = false;\n\n    try {\n      // Step 1: Validate file exists in request\n      if (!request.file) {\n        throw this.errorBuilder.buildError(\n          ErrorType.VALIDATION,\n          executionContext,\n          {\n            customMessageReference: ErrorCustomMessageReference.FILE_UPLOAD_NO_FILE,\n            context: {\n              // diagnostic (log-only)\n              resourceType,\n              fieldName,\n            },\n          }\n        );\n      }\n\n      const multerFile = request.file;\n      const maxFileSize = resolveConfiguredMaxFileSize(this.appConfigService.config.storage?.maxFileSize);\n\n      // Validate file metadata (CRITICAL: Prevents invalid file data)\n      validateContentType(multerFile.mimetype, this.errorBuilder, executionContext, 'contentType');\n      validateSize(multerFile.size, maxFileSize, this.errorBuilder, executionContext, 'size');\n\n      // Step 2: Resolve file constraints from resource field schema\n      const constraint = await this.constraintResolver.resolve({\n        resourceType,\n        fieldName,\n      });\n\n      // Step 3: Validate file against constraints\n      const validationResult = await this.fileValidator.validateFile(multerFile, constraint);\n\n      if (!validationResult.success) {\n        throw this.errorBuilder.buildError(\n          ErrorType.VALIDATION,\n          executionContext,\n          {\n            customMessageReference: ErrorCustomMessageReference.VALIDATION,\n            context: {\n              message: 'File validation failed',\n              errors: validationResult.errors,\n              filename: multerFile.originalname,\n              mimeType: multerFile.mimetype,\n              size: multerFile.size,\n            },\n          }\n        );\n      }\n\n      // Step 4: Reject direct uploads to generated file fields FIRST —\n      // before scope derivation. \"This field cannot receive user uploads at\n      // all\" is a more fundamental rejection than \"what scope does the file\n      // belong to\", and must not be masked by a scope-derivation error\n      // (e.g. a missing applicationId) on a field that was never uploadable.\n      const fieldMeta = this.fileFieldDetection.getFileFieldMetadata(resourceType, fieldName);\n      if (fieldMeta?.fileMetadata.generation?.source === FileGenerationSource.PDF_TEMPLATE) {\n        throw this.errorBuilder.buildError(\n          ErrorType.BUSINESS_RULE,\n          executionContext,\n          {\n            customMessageReference: ErrorCustomMessageReference.FILE_GENERATED_FIELD_NOT_WRITABLE,\n            context: {\n              // diagnostic (log-only)\n              resourceType,\n              fieldName,\n            },\n          }\n        );\n      }\n\n      // Step 4b: Derive scope from parent resource's resourcePrimaryScope.\n      const scope = this.deriveScopeFromParentResource(resourceType, executionContext);\n\n      // Step 4c: Resolve storage provider from z_file() metadata.\n      const storageAccepted = fieldMeta?.fileMetadata.storageAccepted;\n      const storageProvider = this.fileStorageRouter.resolveProvider(storageAccepted);\n\n      // Step 4d: a file upload GRANT (issue #312) is claimed HERE — the point of no return. Every check a\n      // caller can act on (no file, wrong type, too large, generated field) has run; nothing has been\n      // written. A refusal above leaves the grant usable for a retry; a race loser is refused by the\n      // atomic consume and writes nothing. This handler is NOT on the services-registry pipeline, so its\n      // post-operation consumption never sees this request — this is the one consumption site.\n      const grant = (response.locals as FileUploadRouteGrantLocals | undefined)?.fileUploadGrant;\n      if (grant) {\n        await this.consumableTokenService.consumeToken(executionContext.consumableTokenValue!);\n        executionContext.markConsumableTokenConsumed();\n      }\n\n      // Step 5: Create file record (status: PENDING) with scope\n      // Under a grant the file is attributed to the MINTER — the person or machine that delegated the\n      // upload — never to the grant. A user-minted grant already yields that through the token context\n      // (`resolveFileUploaderPrincipal`, CONSUMABLE_TOKEN case); a machine-minted one yields nothing\n      // there, so the grant's own `minter` record is used. Both agree with createFile's mismatch guard.\n      const uploaderPrincipal = grant\n        ? this.fileUploadGrantService.resolveUploaderFromGrant(grant.metadata)\n        : resolveFileUploaderPrincipal(executionContext);\n      if (uploaderPrincipal) {\n        validateUploadedBy(uploaderPrincipal.uploadedBy, this.errorBuilder, executionContext, 'uploadedBy');\n        validateUploadedByEntityType(\n          uploaderPrincipal.uploadedByEntityType,\n          this.errorBuilder,\n          executionContext,\n          'uploadedByEntityType',\n        );\n      }\n\n      const createdFile = await this.filesService.createFile(\n        {\n          filename: multerFile.originalname || multerFile.filename,\n          originalFilename: multerFile.originalname,\n          mimeType: multerFile.mimetype,\n          size: multerFile.size,\n          storageProvider: storageProvider.providerId,\n          scope,\n          uploadedBy: uploaderPrincipal?.uploadedBy,\n          uploadedByEntityType: uploaderPrincipal?.uploadedByEntityType,\n        },\n        executionContext\n      );\n\n      fileRecord = { fileId: createdFile.fileId };\n\n      // Step 5b: Resolve upload path options now that we have the fileId.\n      const resourceInstance = this.extractResourceInstance(request);\n      let uploadOptions: StorageUploadOptions | undefined;\n      if (fieldMeta) {\n        uploadOptions = this.pathResolver.resolve(\n          createdFile.fileId,\n          fieldName,\n          fieldMeta.fileMetadata,\n          resolveStorageApplicationIdentity(this.appConfigService),\n          multerFile.originalname,\n          resourceInstance,\n        );\n      }\n\n      // The resource segment of the object key comes from the row that was just created, and is\n      // applied OUTSIDE the `fieldMeta` branch on purpose: a file without field metadata still\n      // belongs to a resource, and keying it as unlinked would place it outside the prefix its\n      // principal is granted once the session policy narrows per resource.\n      //\n      // Derived once, here, at create — the key never moves afterwards, so this is the only\n      // moment the segment can be decided.\n      // Use the handler's OWN `resourceType` parameter, NOT `createdFile.linkedResourceType`.\n      //\n      // `createFile` above is called WITHOUT a linked resource — the row is created unlinked and the\n      // association is written later — so reading the field back off the created record is always\n      // `undefined`, and every upload silently took the `_unlinked/` staging branch. Caught only by\n      // uploading a real file and listing the object store: `tsc` was clean and every unit test\n      // green, because nothing in either exercises the value that reaches the key builder.\n      //\n      // `resourceType` is a parameter of this method and is validated at entry, so it is the\n      // authoritative answer to \"which resource does this blob belong to\" at the only moment the\n      // key can be decided.\n      // `scope` rides along so the key carries `<scope>/<scopeId>` — the same `FileScopeIdentifiers`\n      // already built above for the File row, so the row and the object key agree by construction\n      // rather than by two independent derivations.\n      uploadOptions = { ...uploadOptions, linkedResourceType: resourceType, scope };\n\n      // Step 6: Create stream from disk file (true streaming, no memory buffering)\n      // With disk storage, multerFile.path contains the temp file path\n      if (!multerFile.path) {\n        throw this.errorBuilder.buildError(\n          ErrorType.INTERNAL,\n          executionContext,\n          {\n            customMessageReference: ErrorCustomMessageReference.INTERNAL,\n            context: {\n              message: 'Multer file path is missing (disk storage error)',\n              filename: multerFile.originalname,\n            },\n          }\n        );\n      }\n\n      // Verify file exists before creating stream\n      if (!fs.existsSync(multerFile.path)) {\n        throw this.errorBuilder.buildError(\n          ErrorType.INTERNAL,\n          executionContext,\n          {\n            customMessageReference: ErrorCustomMessageReference.INTERNAL,\n            context: {\n              message: 'Temp file not found on disk',\n              path: multerFile.path,\n              filename: multerFile.originalname,\n            },\n          }\n        );\n      }\n\n      let fileStream: Readable | null = null;\n      let uploadResult: StorageUploadResult | null = null;\n\n      // Step 7: Upload the blob through the resolved storage provider.\n      try {\n        // Create stream from disk file (true streaming, no memory buffering)\n        fileStream = fs.createReadStream(multerFile.path);\n\n        uploadResult = await storageProvider.upload(\n          fileStream,\n          createdFile.fileId,\n          multerFile.mimetype,\n          multerFile.size,\n          executionContext,\n          uploadOptions,\n        );\n        blobStoredInStorage = true;\n\n        this.logDebug('File uploaded to storage successfully', {\n          fileId: createdFile.fileId,\n        });\n      } catch (uploadError) {\n        // If upload fails, mark file as FAILED\n        await this.filesService.updateFileStatus(\n          createdFile.fileId,\n          FileStatus.FAILED,\n          executionContext\n        );\n\n        throw this.errorBuilder.buildError(\n          ErrorType.EXTERNAL_SERVICE,\n          executionContext,\n          {\n            customMessageReference: ErrorCustomMessageReference.EXTERNAL_SERVICE,\n            context: {\n              message: 'Failed to upload file to storage',\n              fileId: createdFile.fileId,\n              error: describeCaughtError(uploadError),\n            },\n          }\n        );\n      } finally {\n        // Clean up temp file (always, even on error)\n        // This ensures temp files are removed even if upload fails or other errors occur\n        if (multerFile.path && fs.existsSync(multerFile.path)) {\n          try {\n            fs.unlinkSync(multerFile.path);\n            this.logDebug('Temp file cleaned up', { path: multerFile.path });\n          } catch (cleanupError) {\n            // Log cleanup error but don't fail operation\n            this.logger.warn('Failed to clean up temp file', {\n              path: multerFile.path,\n              ...projectCaughtErrorLogFields(cleanupError),\n            });\n          }\n        }\n\n        // Also destroy stream if it was created\n        if (fileStream && !fileStream.destroyed) {\n          fileStream.destroy();\n        }\n      }\n\n      // Step 8: Update file status to UPLOADED (with retry logic)\n      // CRITICAL: If updateFileStatus() fails after successful storage upload,\n      // file exists in storage but status remains PENDING in database.\n      // Retry logic handles transient errors (network issues, database locks, etc.)\n      // Decision 5.1: Retry Logic with audit log error (Option A)\n      const maxRetries = 3;\n      const initialDelay = 1000; // 1 second\n\n      let lastError: Error | null = null;\n      let uploadedFile: File | null = null;\n\n      for (let attempt = 0; attempt <= maxRetries; attempt++) {\n        try {\n          uploadedFile = await this.filesService.updateFileStatus(\n            createdFile.fileId,\n            FileStatus.UPLOADED,\n            executionContext,\n            undefined,\n            uploadResult ?? undefined,\n          );\n          break; // Success\n        } catch (error) {\n          lastError = error instanceof Error ? error : new Error(describeCaughtError(error));\n\n          if (attempt < maxRetries) {\n            const delay = initialDelay * Math.pow(2, attempt);\n            this.logger.warn('File status update failed, retrying', {\n              fileId: createdFile.fileId,\n              attempt: attempt + 1,\n              maxRetries,\n              delay,\n              error: lastError.message,\n            });\n            await new Promise(resolve => setTimeout(resolve, delay));\n          } else {\n            // Final attempt failed - audit log and re-throw\n            this.logger.error('File status update failed after all retries', {\n              fileId: createdFile.fileId,\n              attempts: maxRetries + 1,\n              error: lastError.message,\n              // File exists in storage but status remains PENDING in database\n              // This is a data inconsistency that needs manual intervention\n            });\n\n            // If the blob already reached storage but metadata could not commit to\n            // UPLOADED, try to roll the blob back so the row can safely move into\n            // a failed lifecycle path instead of silently pointing at live data.\n            if (blobStoredInStorage && uploadResult) {\n              try {\n                await storageProvider.delete(\n                  {\n                    fileId: createdFile.fileId,\n                    storageProvider: uploadResult.provider,\n                    storageRef: uploadResult.storageRef,\n                  },\n                  executionContext,\n                );\n                blobStoredInStorage = false;\n                this.logger.warn('Rolled back stored blob after upload status commit failure', {\n                  fileId: createdFile.fileId,\n                });\n              } catch (rollbackError) {\n                if (!isWildoBackendError(rollbackError) || rollbackError.type !== ErrorType.NOT_FOUND) {\n                  this.logger.error('Failed to roll back stored blob after upload status commit failure', {\n                    fileId: createdFile.fileId,\n                    ...projectCaughtErrorLogFields(rollbackError),\n                    originalError: lastError.message,\n                  });\n                } else {\n                  blobStoredInStorage = false;\n                }\n              }\n            }\n\n            // Re-throw to fail the operation\n            throw lastError;\n          }\n        }\n      }\n\n      // Ensure uploadedFile is set (TypeScript safety check)\n      if (!uploadedFile) {\n        throw this.errorBuilder.buildError(\n          ErrorType.INTERNAL,\n          executionContext,\n          {\n            customMessageReference: ErrorCustomMessageReference.INTERNAL,\n            context: {\n              message: 'File status update failed - uploadedFile is null after retries',\n              fileId: createdFile.fileId,\n            },\n          }\n        );\n      }\n\n      /*\n       * Step 9: hold a scanned file NON-DOWNLOADABLE before anyone is told the upload succeeded.\n       *\n       * `initiateScan` awaits the UPLOADED -> SCANNING transition and only then fires the scan\n       * pipeline asynchronously, so awaiting it here costs ONE status write, not the scan. Until\n       * 2026-09-08 this ran AFTER the response, fire-and-forget (#433): the file sat at UPLOADED —\n       * a downloadable status — for the whole gap between the upload committing and the transition\n       * landing, so a field declaring `scanPolicy: 'required'` had a window in which its bytes were\n       * servable unscanned. The control advertised more than it held.\n       *\n       * FAIL-CLOSED, deliberately: this is NOT wrapped in a catch. A scan that cannot be initiated\n       * fails the upload, and because `uploadReachedSuccessState` is still false the catch below\n       * marks the file FAILED. A caught-and-logged failure would leave the row at UPLOADED, which is\n       * exactly the servable state this closes — a scanner outage would silently reopen the window\n       * on every upload. An operator gets a failed upload instead, which is the behaviour a control\n       * named `required` has to have.\n       */\n      const scanIsRequired = this.fileScanningService.shouldScan(fieldMeta?.fileMetadata);\n      let uploadedFileForResponse: File = uploadedFile;\n      if (scanIsRequired) {\n        await this.fileScanningService.initiateScan(uploadedFile.fileId, executionContext);\n        // Re-read so the response reports SCANNING rather than the UPLOADED this row no longer has.\n        // A client polling `GET /files/:fileId/metadata` sees SCANNING either way; reporting\n        // UPLOADED here would make the upload response the one place the two disagree. A null read\n        // keeps the pre-transition row rather than failing an upload that already succeeded.\n        const afterScanInitiation = await this.filesService.getFile(uploadedFile.fileId, executionContext);\n        if (afterScanInitiation) {\n          uploadedFileForResponse = afterScanInitiation;\n        }\n      }\n\n      // Step 9b: Return success response with file metadata\n      const fileMetadata = this.filesService.toMetadataResponse(uploadedFileForResponse);\n      /*\n       * SCANNING counts as reached-success alongside UPLOADED: the upload itself committed, and the\n       * catch below must not roll a scanned file back to FAILED for a later response-layer failure.\n       */\n      uploadReachedSuccessState = uploadedFileForResponse.status === FileStatus.UPLOADED\n        || uploadedFileForResponse.status === FileStatus.SCANNING;\n\n      response.status(200).json({\n        success: true,\n        file: fileMetadata,\n      });\n\n      this.logDebug('File upload completed successfully', {\n        fileId: uploadedFile.fileId,\n        resourceType,\n        fieldName,\n      });\n\n      // Step 10: a redeemed grant records what it produced and is audited. Best-effort by contract —\n      // the upload has succeeded and the response is sent; a failure here is logged, never thrown.\n      if (grant) {\n        this.fileUploadGrantService\n          .recordRedemption(grant, { fileId: uploadedFile.fileId, mimeType: uploadedFile.mimeType, size: uploadedFile.size }, executionContext)\n          .catch((redemptionError) => {\n            this.logger.error('File upload grant: redemption record failed', {\n              grantId: grant.token._id,\n              fileId: uploadedFile!.fileId,\n              ...projectCaughtErrorLogFields(redemptionError),\n            });\n          });\n      }\n\n    } catch (error) {\n      // Only pre-success failures should transition a file to FAILED. Once the\n      // upload already reached UPLOADED, later response-layer failures must not\n      // corrupt the persisted state back to FAILED. Likewise, if the blob still\n      // exists in storage because rollback failed, keep the row out of FAILED so\n      // operators can distinguish that inconsistency from a clean failed upload.\n      const shouldMarkAsFailed = !!fileRecord?.fileId && !uploadReachedSuccessState && !blobStoredInStorage;\n      if (shouldMarkAsFailed) {\n        try {\n          await this.filesService.updateFileStatus(\n            fileRecord.fileId,\n            FileStatus.FAILED,\n            executionContext\n          );\n          this.logDebug('File marked as FAILED due to upload error', {\n            fileId: fileRecord.fileId,\n          });\n        } catch (updateError) {\n          // Log but don't throw - we're already in error handling\n          this.logger.error('Failed to mark file as FAILED', {\n            fileId: fileRecord.fileId,\n            ...projectCaughtErrorLogFields(updateError),\n          });\n        }\n      }\n\n      // Re-throw error to be handled by Express error handler\n      throw error;\n    }\n  }\n\n  /**\n   * Serve (stream) a resource-linked file's bytes for INLINE preview/consumption.\n   *\n   * This is the read counterpart to `handleFileUpload` — the resource-integrated\n   * file **serve** route (`GET .../{res}/:resourceId/files/:fieldName/:fileId`). The\n   * controller has ALREADY authorized the caller against the parent resource's READ\n   * operation before delegating here, so authorization **inherits from the linked\n   * resource** — no consumable token, no public share (those belong to the global\n   * `FileController` for its separate cross-resource/share purpose).\n   *\n   * The one job this method owns is the LINK-OWNERSHIP boundary: the requested\n   * `fileId` MUST be linked to exactly this `{resourceType, resourceId, fieldName}`.\n   * Without it, any caller who can READ a parent record could stream an arbitrary or\n   * cross-resource file id through the route. A mismatch fails closed as NOT_FOUND\n   * (no existence disclosure). `getFile()`'s own scope check is defense-in-depth.\n   *\n   * A `?variant=thumbnail` query asks for a downscaled preview rendition; it is\n   * parsed fail-safe (unknown values → original bytes) and forwarded to the shared\n   * streaming seam, which only transforms eligible raster images.\n   *\n   * @param request - Express request (`:fileId` etc. in params, `?variant=` in query).\n   * @param response - Express response to stream into.\n   * @param next - Express next (forwards pre-header stream errors).\n   * @param resourceType - Parent resource type from the route.\n   * @param fieldName - File field name from the route.\n   * @param resourceId - Parent resource id from the route (authorization target).\n   * @param fileId - The specific file id to serve (must belong to the field above).\n   * @param executionContext - READ execution context built + authorized by the controller.\n   */\n  async handleFileServe(\n    request: Request,\n    response: Response,\n    next: NextFunction,\n    resourceType: ResourceType,\n    fieldName: string,\n    resourceId: string,\n    fileId: string,\n    executionContext: ExecutionContext<any>,\n  ): Promise<void> {\n    validateResourceType(resourceType, this.errorBuilder, executionContext, 'resourceType');\n    validateFieldName(fieldName, this.errorBuilder, executionContext, 'fieldName');\n    validateResourceId(resourceId, this.errorBuilder, executionContext, 'resourceId');\n    validateFileId(fileId, this.errorBuilder, executionContext, 'fileId');\n\n    this.logDebug('Handling file serve', { resourceType, fieldName, resourceId, fileId });\n\n    // getFile applies the file-scope access check (defense-in-depth). Primary authz —\n    // the parent resource READ — was already enforced by the controller.\n    const file = await this.filesService.getFile(fileId, executionContext);\n\n    // SECURITY BOUNDARY: the served file MUST be linked to THIS resource + field.\n    const belongsToRouteResource =\n      !!file &&\n      file.linkedResourceType === resourceType &&\n      String(file.linkedResourceId) === String(resourceId) &&\n      file.linkedFieldName === fieldName;\n\n    if (!belongsToRouteResource) {\n      this.logDebug('File serve denied: file not linked to route resource/field', {\n        fileId,\n        resourceType,\n        resourceId,\n        fieldName,\n        linkedResourceType: file?.linkedResourceType,\n        linkedResourceId: file?.linkedResourceId,\n        linkedFieldName: file?.linkedFieldName,\n      });\n      throw this.errorBuilder.buildError(\n        ErrorType.NOT_FOUND,\n        executionContext,\n        {\n          customMessageReference: ErrorCustomMessageReference.FILE_NOT_FOUND,\n          context: { fileId }, // diagnostic (log-only)\n        },\n      );\n    }\n\n    // STATUS GATE — the same invariant the two GLOBAL file routes already enforce, applied at the\n    // third site that streams bytes.\n    //\n    // It was missing here, and the omission became reachable the moment generated files got serve\n    // routes (2026-08-25): a REGENERATE marks the superseded document `DELETED` while DELIBERATELY\n    // retaining its `linkedResourceType/Id/FieldName`, so the link-ownership boundary above says yes\n    // and the old document kept streaming — measured, 200 with 2,222 bytes. The same hole applies to\n    // an UPLOADED file a privacy erasure marked `DELETED`: physical cleanup is a batch that runs much\n    // later, and until it did, the erased bytes were still served in place.\n    //\n    // Two tiers, mirroring the existing gates rather than inventing a third posture:\n    //  - `FILE_METADATA_WITHHELD_STATUSES` (i.e. `DELETED`, the erasure outcome) → NOT_FOUND, because\n    //    for an erased file, confirming the id still resolves is itself a disclosure (the same\n    //    reasoning as `FileController.assertFileMetadataDisclosable`);\n    //  - anything else outside `FILE_DOWNLOADABLE_STATUSES` (`PENDING`, `SCANNING`, `FAILED`, …) →\n    //    the download route's VALIDATION shape, because such a file genuinely exists and may become\n    //    servable, and an uploader polling a preview needs to be told which.\n    if (FILE_METADATA_WITHHELD_STATUSES.has(file.status)) {\n      this.logDebug('File serve denied: withheld status', { fileId, status: file.status });\n      throw this.errorBuilder.buildError(\n        ErrorType.NOT_FOUND,\n        executionContext,\n        {\n          customMessageReference: ErrorCustomMessageReference.FILE_NOT_FOUND,\n          context: { fileId }, // diagnostic (log-only)\n        },\n      );\n    }\n    if (!FILE_DOWNLOADABLE_STATUSES.has(file.status)) {\n      this.logDebug('File serve denied: non-servable status', { fileId, status: file.status });\n      throw this.errorBuilder.buildError(\n        ErrorType.VALIDATION,\n        executionContext,\n        {\n          customMessageReference: ErrorCustomMessageReference.VALIDATION,\n          context: { message: 'File is not available for download', fileId, status: file.status },\n        },\n      );\n    }\n\n    // `?variant=thumbnail` → downscaled preview rendition (raster images only; the\n    // streaming seam falls back to original bytes for anything else). Fail-safe parse.\n    const variant = parseFileServeVariant(request.query.variant);\n\n    await this.filesService.streamFileToResponse(file, response, executionContext, {\n      disposition: 'inline',\n      next,\n      variant,\n    });\n  }\n\n  /**\n   * Derive file scope from parent resource's resourcePrimaryScope.\n   *\n   * Scope derivation rules:\n   * - APPLICATION: sets applicationId from execution context\n   * - ORGANIZATIONS: sets organizationId from execution context\n   * - USER_SELF: sets userId + applicationId from execution context (no org — separate scope axis)\n   *\n   * @param resourceType - Parent resource type\n   * @param executionContext - Execution context for scope values\n   * @returns FileScopeIdentifiers derived from parent resource\n   */\n  private deriveScopeFromParentResource(\n    resourceType: ResourceType,\n    executionContext: ExecutionContext<any>\n  ): FileScopeIdentifiers {\n    // Get parent resource configuration to find its primaryScope\n    const resourceConfig = this.resourcesRegistry.getResourceConfiguration(resourceType);\n\n    // Get primaryScope from resource configuration\n    // Default to ORGANIZATIONS if not specified\n    const primaryScope = resourceConfig?.resourcePrimaryScope || ResourcePrimaryScope.ORGANIZATIONS;\n\n    // Extract scope identifiers from execution context\n    const organizationId = this.resourceOperationHelper.getInitiatorId(executionContext, 'organization');\n    const userId = this.resourceOperationHelper.getInitiatorId(executionContext, 'user');\n    // Fall back to the app config's applicationId when the execution context\n    // doesn't carry one — same pattern this handler already uses for the path\n    // binding above. There is exactly one application per backend, so\n    // `appConfigService.applicationId` is the correct anchor when an internal\n    // EC was built without a populated `applicationId`.\n    const applicationId = executionContext.applicationId || this.appConfigService.applicationId;\n\n    switch (primaryScope) {\n      case ResourcePrimaryScope.APPLICATION:\n        if (!applicationId) {\n          throw this.errorBuilder.buildError(\n            ErrorType.VALIDATION,\n            executionContext,\n            {\n              customMessageReference: ErrorCustomMessageReference.FILE_SCOPE_IDENTIFIER_MISSING,\n              context: {\n                resourceType, // diagnostic (log-only)\n              },\n            }\n          );\n        }\n        return {\n          primaryScope: ResourcePrimaryScope.APPLICATION,\n          applicationId,\n        };\n\n      case ResourcePrimaryScope.ORGANIZATIONS:\n        if (!organizationId) {\n          throw this.errorBuilder.buildError(\n            ErrorType.VALIDATION,\n            executionContext,\n            {\n              customMessageReference: ErrorCustomMessageReference.FILE_SCOPE_IDENTIFIER_MISSING,\n              context: {\n                resourceType, // diagnostic (log-only)\n              },\n            }\n          );\n        }\n        if (!applicationId) {\n          throw this.errorBuilder.buildError(\n            ErrorType.VALIDATION,\n            executionContext,\n            {\n              customMessageReference: ErrorCustomMessageReference.FILE_SCOPE_IDENTIFIER_MISSING,\n              context: {\n                resourceType, // diagnostic (log-only)\n              },\n            }\n          );\n        }\n        return {\n          primaryScope: ResourcePrimaryScope.ORGANIZATIONS,\n          applicationId,\n          organizationId,\n        };\n\n      case ResourcePrimaryScope.USER_SELF:\n        // USER_SELF and ORGANIZATIONS are independent primary-scope axes (separation of\n        // concern): a self-owned file is owned by the USER, never by an org. Require the\n        // user (owner) + applicationId (tenant/bucket anchor); do NOT read or persist an\n        // organizationId here — a self-profile carries no org context.\n        if (!userId) {\n          throw this.errorBuilder.buildError(\n            ErrorType.VALIDATION,\n            executionContext,\n            {\n              customMessageReference: ErrorCustomMessageReference.FILE_SCOPE_IDENTIFIER_MISSING,\n              context: {\n                resourceType, // diagnostic (log-only)\n              },\n            }\n          );\n        }\n        if (!applicationId) {\n          throw this.errorBuilder.buildError(\n            ErrorType.VALIDATION,\n            executionContext,\n            {\n              customMessageReference: ErrorCustomMessageReference.FILE_SCOPE_IDENTIFIER_MISSING,\n              context: {\n                resourceType, // diagnostic (log-only)\n              },\n            }\n          );\n        }\n        return {\n          primaryScope: ResourcePrimaryScope.USER_SELF,\n          applicationId,\n          userId,\n        };\n\n      default:\n        throw this.errorBuilder.buildError(\n          ErrorType.CONFIGURATION,\n          executionContext,\n          {\n            customMessageReference: ErrorCustomMessageReference.CONFIGURATION,\n            context: {\n              message: 'File uploads only support APPLICATION, ORGANIZATIONS, and USER_SELF resource scopes',\n              resourceType,\n              primaryScope,\n            },\n          }\n        );\n    }\n  }\n}\n"]}

package/dist/esm/files/services/file-operation-handler.backend.service.d.ts

@@ -33,6 +33,24 @@ export declare class FileOperationHandlerBackendService {
     protected logDebug: (message: string, context?: Record<string, unknown>) => void;
     constructor(logger: LoggerService, errorBuilder: ErrorBuilderBackendService, fileFieldDetection: FileFieldDetectionBackendService, filesService: FilesBackendService);
     private isGeneratedPdfFileField;
+    /**
+     * The ONE place that decides whether a file's status admits linking (issue #320).
+     *
+     * Both link-time validators (CREATE and UPDATE) used to compare against the literal
+     * `FileStatus.UPLOADED`, so a file the scanner had certified `CLEAN` — a status
+     * `FILE_STATUS_TRANSITIONS` explicitly allows to become `LINKED` — was refused with an error
+     * naming `UPLOADED` as the expected state. Whether a scanned file could be attached depended on
+     * beating the scanner. The admitted set now comes from `FILE_LINKABLE_STATUSES`, the single copy
+     * shared with `FilesBackendService.linkFileToResource`.
+     *
+     * `SCANNING` is named separately: the file is not wrong, it is not yet KNOWN to be safe, so the
+     * caller must learn to retry rather than re-upload. Every other non-linkable status (PENDING,
+     * FAILED, DELETED, ORPHANED, INFECTED, QUARANTINED, and LINKED-to-something-else, which
+     * `linkFileToResource` distinguishes further) is a terminal refusal for this write.
+     *
+     * @param diagnostics - log-only context; never rendered to the caller.
+     */
+    private assertFileLinkable;
     /**
      * Best-effort cleanup for the previous generated PDF after REGENERATE.
      *

package/dist/esm/files/services/file-operation-handler.backend.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"file-operation-handler.backend.service.d.ts","sourceRoot":"","sources":["../../../../../src/files/services/file-operation-handler.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAGH,OAAO,EAAE,YAAY,EAAsD,MAAM,uBAAuB,CAAC;AAGzG,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAClG,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAE9G,OAAO,EAAE,gCAAgC,EAAqB,MAAM,wCAAwC,CAAC;AAC7G,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAC9D,OAAO,EAAE,gBAAgB,EAAE,MAAM,qEAAqE,CAAC;AACvG,OAAO,EAAE,iBAAiB,EAAE,MAAM,qEAAqE,CAAC;AAUxG,UAAU,+BAA+B;IACvC;;;;OAIG;IACH,mCAAmC,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC;CACzE;AAED,qBACa,kCAAkC;IAK3C,OAAO,CAAC,QAAQ,CAAC,MAAM;IAEvB,OAAO,CAAC,QAAQ,CAAC,YAAY;IAE7B,OAAO,CAAC,QAAQ,CAAC,kBAAkB;IAEnC,OAAO,CAAC,QAAQ,CAAC,YAAY;IAV/B,SAAS,CAAC,QAAQ,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;gBAI9D,MAAM,EAAE,aAAa,EAErB,YAAY,EAAE,0BAA0B,EAExC,kBAAkB,EAAE,gCAAgC,EAEpD,YAAY,EAAE,mBAAmB;IAMpD,OAAO,CAAC,uBAAuB;IAI/B;;;;;;OAMG;IACG,kCAAkC,CAAC,MAAM,EAAE;QAC/C,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC;QAC3B,iBAAiB,EAAE,MAAM,CAAC;QAC1B,SAAS,EAAE,MAAM,CAAC;QAClB,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC;QACxC,OAAO,CAAC,EAAE,iBAAiB,CAAC;KAC7B,GAAG,OAAO,CAAC,IAAI,CAAC;IAqBjB,OAAO,CAAC,uCAAuC;IA2C/C;;;;;;;;;OASG;IACG,2BAA2B,CAC/B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,YAAY,EAAE,YAAY,EAC1B,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACvC,OAAO,CAAC,EAAE,iBAAiB,EAC3B,iBAAiB,CAAC,EAAE,+BAA+B,GAClD,OAAO,CAAC,IAAI,CAAC;IA2GhB;;;;;;;;OAQG;IACH;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,uBAAuB;IAMzB,0BAA0B,CAC9B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,YAAY,EAAE,YAAY,EAC1B,UAAU,EAAE,MAAM,EAClB,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACvC,OAAO,CAAC,EAAE,iBAAiB,EAC3B,iBAAiB,CAAC,EAAE,+BAA+B,GAClD,OAAO,CAAC,IAAI,CAAC;IA6DhB;;;;;;;;;;;;;;OAcG;IACG,0BAA0B,CAC9B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACrC,YAAY,EAAE,YAAY,EAC1B,UAAU,EAAE,MAAM,EAClB,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACvC,OAAO,CAAC,EAAE,iBAAiB,EAC3B,iBAAiB,CAAC,EAAE,+BAA+B,GAClD,OAAO,CAAC,IAAI,CAAC;IA+NhB;;;;;;;OAOG;IACH;;;;;;OAMG;IACH,OAAO,CAAC,0BAA0B;IAW5B,0BAA0B,CAC9B,YAAY,EAAE,YAAY,EAC1B,UAAU,EAAE,MAAM,EAClB,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACvC,OAAO,CAAC,EAAE,iBAAiB,GAC1B,OAAO,CAAC,IAAI,CAAC;IA+EhB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA0DG;IACG,iCAAiC,CACrC,YAAY,EAAE,YAAY,EAC1B,UAAU,EAAE,MAAM,EAClB,kBAAkB,EAAE,SAAS,MAAM,EAAE,EACrC,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACvC,OAAO,CAAC,EAAE,iBAAiB,GAC1B,OAAO,CAAC,IAAI,CAAC;IA6DhB;;;;;;;OAOG;IACH,OAAO,CAAC,cAAc;IAqFtB;;;OAGG;YACW,kBAAkB;IA6ChC;;;OAGG;YACW,sBAAsB;IAmBpC;;;;;;OAMG;YACW,2BAA2B;IAmCzC,OAAO,CAAC,kBAAkB;IAmB1B,OAAO,CAAC,gBAAgB;CAuGzB"}
+{"version":3,"file":"file-operation-handler.backend.service.d.ts","sourceRoot":"","sources":["../../../../../src/files/services/file-operation-handler.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAGH,OAAO,EAAE,YAAY,EAA8E,MAAM,uBAAuB,CAAC;AAGjI,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAClG,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAE9G,OAAO,EAAE,gCAAgC,EAAqB,MAAM,wCAAwC,CAAC;AAC7G,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAC9D,OAAO,EAAE,gBAAgB,EAAE,MAAM,qEAAqE,CAAC;AACvG,OAAO,EAAE,iBAAiB,EAAE,MAAM,qEAAqE,CAAC;AAUxG,UAAU,+BAA+B;IACvC;;;;OAIG;IACH,mCAAmC,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC;CACzE;AAED,qBACa,kCAAkC;IAK3C,OAAO,CAAC,QAAQ,CAAC,MAAM;IAEvB,OAAO,CAAC,QAAQ,CAAC,YAAY;IAE7B,OAAO,CAAC,QAAQ,CAAC,kBAAkB;IAEnC,OAAO,CAAC,QAAQ,CAAC,YAAY;IAV/B,SAAS,CAAC,QAAQ,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;gBAI9D,MAAM,EAAE,aAAa,EAErB,YAAY,EAAE,0BAA0B,EAExC,kBAAkB,EAAE,gCAAgC,EAEpD,YAAY,EAAE,mBAAmB;IAMpD,OAAO,CAAC,uBAAuB;IAI/B;;;;;;;;;;;;;;;;OAgBG;IACH,OAAO,CAAC,kBAAkB;IAyB1B;;;;;;OAMG;IACG,kCAAkC,CAAC,MAAM,EAAE;QAC/C,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC;QAC3B,iBAAiB,EAAE,MAAM,CAAC;QAC1B,SAAS,EAAE,MAAM,CAAC;QAClB,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC;QACxC,OAAO,CAAC,EAAE,iBAAiB,CAAC;KAC7B,GAAG,OAAO,CAAC,IAAI,CAAC;IAqBjB,OAAO,CAAC,uCAAuC;IA2C/C;;;;;;;;;OASG;IACG,2BAA2B,CAC/B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,YAAY,EAAE,YAAY,EAC1B,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACvC,OAAO,CAAC,EAAE,iBAAiB,EAC3B,iBAAiB,CAAC,EAAE,+BAA+B,GAClD,OAAO,CAAC,IAAI,CAAC;IA2FhB;;;;;;;;OAQG;IACH;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,uBAAuB;IAMzB,0BAA0B,CAC9B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,YAAY,EAAE,YAAY,EAC1B,UAAU,EAAE,MAAM,EAClB,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACvC,OAAO,CAAC,EAAE,iBAAiB,EAC3B,iBAAiB,CAAC,EAAE,+BAA+B,GAClD,OAAO,CAAC,IAAI,CAAC;IA6DhB;;;;;;;;;;;;;;OAcG;IACG,0BAA0B,CAC9B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACrC,YAAY,EAAE,YAAY,EAC1B,UAAU,EAAE,MAAM,EAClB,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACvC,OAAO,CAAC,EAAE,iBAAiB,EAC3B,iBAAiB,CAAC,EAAE,+BAA+B,GAClD,OAAO,CAAC,IAAI,CAAC;IA8MhB;;;;;;;OAOG;IACH;;;;;;OAMG;IACH,OAAO,CAAC,0BAA0B;IAW5B,0BAA0B,CAC9B,YAAY,EAAE,YAAY,EAC1B,UAAU,EAAE,MAAM,EAClB,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACvC,OAAO,CAAC,EAAE,iBAAiB,GAC1B,OAAO,CAAC,IAAI,CAAC;IA+EhB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA0DG;IACG,iCAAiC,CACrC,YAAY,EAAE,YAAY,EAC1B,UAAU,EAAE,MAAM,EAClB,kBAAkB,EAAE,SAAS,MAAM,EAAE,EACrC,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACvC,OAAO,CAAC,EAAE,iBAAiB,GAC1B,OAAO,CAAC,IAAI,CAAC;IA6DhB;;;;;;;OAOG;IACH,OAAO,CAAC,cAAc;IAqFtB;;;OAGG;YACW,kBAAkB;IA6ChC;;;OAGG;YACW,sBAAsB;IAmBpC;;;;;;OAMG;YACW,2BAA2B;IAmCzC,OAAO,CAAC,kBAAkB;IAmB1B,OAAO,CAAC,gBAAgB;CAuGzB"}

package/dist/esm/files/services/file-operation-handler.backend.service.js

@@ -23,7 +23,7 @@ var __param = (this && this.__param) || function (paramIndex, decorator) {
     return function (target, key) { decorator(target, key, paramIndex); }
 };
 import { injectable, inject } from 'inversify';
-import { ErrorType, ErrorCustomMessageReference, FileStatus } from '@wildo-ai/saas-models';
+import { ErrorType, ErrorCustomMessageReference, FileStatus, FILE_LINKABLE_STATUSES } from '@wildo-ai/saas-models';
 import { FileGenerationSource } from '@wildo-ai/zod-decorators';
 import { SAAS_SERVICE_TYPES } from '../../inject/models/service-types.js';
 import { ErrorBuilderBackendService } from '../../errors/services/error-builder.backend.service.js';
@@ -49,6 +49,39 @@ let FileOperationHandlerBackendService = class FileOperationHandlerBackendServic
     isGeneratedPdfFileField(fileField) {
         return fileField.fileMetadata.generation?.source === FileGenerationSource.PDF_TEMPLATE;
     }
+    /**
+     * The ONE place that decides whether a file's status admits linking (issue #320).
+     *
+     * Both link-time validators (CREATE and UPDATE) used to compare against the literal
+     * `FileStatus.UPLOADED`, so a file the scanner had certified `CLEAN` — a status
+     * `FILE_STATUS_TRANSITIONS` explicitly allows to become `LINKED` — was refused with an error
+     * naming `UPLOADED` as the expected state. Whether a scanned file could be attached depended on
+     * beating the scanner. The admitted set now comes from `FILE_LINKABLE_STATUSES`, the single copy
+     * shared with `FilesBackendService.linkFileToResource`.
+     *
+     * `SCANNING` is named separately: the file is not wrong, it is not yet KNOWN to be safe, so the
+     * caller must learn to retry rather than re-upload. Every other non-linkable status (PENDING,
+     * FAILED, DELETED, ORPHANED, INFECTED, QUARANTINED, and LINKED-to-something-else, which
+     * `linkFileToResource` distinguishes further) is a terminal refusal for this write.
+     *
+     * @param diagnostics - log-only context; never rendered to the caller.
+     */
+    assertFileLinkable(file, executionContext, diagnostics) {
+        if (FILE_LINKABLE_STATUSES.has(file.status)) {
+            return;
+        }
+        throw this.errorBuilder.buildError(ErrorType.BUSINESS_RULE, executionContext, {
+            customMessageReference: file.status === FileStatus.SCANNING
+                ? ErrorCustomMessageReference.FILE_SCAN_IN_PROGRESS
+                : ErrorCustomMessageReference.FILE_NOT_LINKABLE,
+            context: {
+                // diagnostic (log-only)
+                ...diagnostics,
+                fileStatus: file.status,
+                linkableStatuses: [...FILE_LINKABLE_STATUSES],
+            },
+        });
+    }
     /**
      * Best-effort cleanup for the previous generated PDF after REGENERATE.
      *
@@ -164,19 +197,7 @@ let FileOperationHandlerBackendService = class FileOperationHandlerBackendServic
                     },
                 });
             }
-            // Verify file is in UPLOADED status (ready to be linked)
-            if (file.status !== FileStatus.UPLOADED) {
-                throw this.errorBuilder.buildError(ErrorType.BUSINESS_RULE, executionContext, {
-                    customMessageReference: ErrorCustomMessageReference.FILE_NOT_IN_UPLOADED_STATUS,
-                    context: {
-                        // diagnostic (log-only)
-                        fileId,
-                        fileStatus: file.status,
-                        resourceType,
-                        expectedStatus: FileStatus.UPLOADED,
-                    },
-                });
-            }
+            this.assertFileLinkable(file, executionContext, { fileId, resourceType });
             // Note: uploadContext validation can be added in Phase 2 if needed
             // For now, we only validate that file is UPLOADED
         }
@@ -394,20 +415,7 @@ let FileOperationHandlerBackendService = class FileOperationHandlerBackendServic
                                 },
                             });
                         }
-                        if (file.status !== FileStatus.UPLOADED) {
-                            throw this.errorBuilder.buildError(ErrorType.BUSINESS_RULE, executionContext, {
-                                customMessageReference: ErrorCustomMessageReference.FILE_NOT_IN_UPLOADED_STATUS,
-                                context: {
-                                    // diagnostic (log-only)
-                                    fileId,
-                                    fileStatus: file.status,
-                                    runtimeFieldPath,
-                                    resourceType,
-                                    resourceId,
-                                    expectedStatus: FileStatus.UPLOADED,
-                                },
-                            });
-                        }
+                        this.assertFileLinkable(file, executionContext, { fileId, runtimeFieldPath, resourceType, resourceId });
                     }
                 }
                 for (const oldFileId of oldFileIds) {