@wildo-ai/saas-backend-lib 1.1.1 → 1.1.3

package/dist/esm/files/services/files.backend.service.js.map

@@ -1 +1 @@
-{"version":3,"file":"files.backend.service.js","sourceRoot":"","sources":["../../../../../src/files/services/files.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;;;;;;;;;;;;;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAGzD,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAgB,SAAS,EAAE,2BAA2B,EAAsD,oBAAoB,EAAE,iCAAiC,EAAE,cAAc,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAChU,OAAO,EAAQ,UAAU,EAAE,uBAAuB,EAAwB,cAAc,EAAE,gBAAgB,EAAE,4BAA4B,EAAE,MAAM,uBAAuB,CAAC;AACxK,OAAO,EAAE,wBAAwB,EAAoD,MAAM,0BAA0B,CAAC;AACtH,OAAO,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AAEpF,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAC9G,OAAO,EAAE,mBAAmB,EAAE,2BAA2B,EAAE,MAAM,8EAA8E,CAAC;AAChJ,OAAO,EAAE,+BAA+B,EAAE,MAAM,0EAA0E,CAAC;AAE3H,OAAO,EAAE,qCAAqC,EAAE,MAAM,+EAA+E,CAAC;AACtI,OAAO,EAAE,qCAAqC,EAAE,MAAM,qFAAqF,CAAC;AAE5I,OAAO,EAAE,yCAAyC,EAAE,MAAM,qGAAqG,CAAC;AAEhK,OAAO,EAAE,cAAc,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,YAAY,EAAE,kBAAkB,EAAE,4BAA4B,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,4BAA4B,EAAE,cAAc,EAAE,MAAM,sDAAsD,CAAC;AAC9S,OAAO,EAAE,2BAA2B,EAAE,MAAM,kDAAkD,CAAC;AAC/F,OAAO,EAAE,4BAA4B,EAAE,MAAM,oDAAoD,CAAC;AAClG,OAAO,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,0BAA0B,EAAE,MAAM,8DAA8D,CAAC;AAC/K,OAAO,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AAC/G,OAAO,EAAE,+BAA+B,EAAE,MAAM,sEAAsE,CAAC;AAEvH,OAAO,EAAE,2CAA2C,EAAE,MAAM,yFAAyF,CAAC;AAItJ,OAAO,EAAE,gCAAgC,EAAE,MAAM,8DAA8D,CAAC;AAEhH;;;;;;;;;GASG;AACH,MAAM,kCAAkC,GAAG,6BAA6B,CAAC;AAEzE;;;;;;;GAOG;AACH,MAAM,8BAA8B,GAAG,IAAI,GAAG,CAAS;IACrD,WAAW;IACX,uBAAuB;IACvB,eAAe;CAChB,CAAC,CAAC;AAEH,+EAA+E;AAC/E,SAAS,4BAA4B,CAAC,WAA+B;IACnE,IAAI,CAAC,WAAW;QAAE,OAAO,KAAK,CAAC;IAC/B,MAAM,SAAS,GAAG,WAAW,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACrE,OAAO,8BAA8B,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;AACvD,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,uBAAuB,GAAG,mCAAmC,CAAC;AAG7D,IAAM,mBAAmB,GAAzB,MAAM,mBAAmB;IAKX;IAEA;IAEA;IAEA;IAEA;IAEA;IAEA;IAEA;IAGA;IAQA;IAGA;IAhCT,QAAQ,CAA+D;IAEjF,YAEmB,MAAqB,EAErB,YAAwC,EAExC,iBAAkD,EAElD,oBAA+D,EAE/D,uBAA8D,EAE9D,uBAA8D,EAE9D,iBAAkD,EAElD,gBAAyC,EAGzC,6BAA2E,EAQ3E,uBAA+D,EAG/D,aAA2C;QA5B3C,WAAM,GAAN,MAAM,CAAe;QAErB,iBAAY,GAAZ,YAAY,CAA4B;QAExC,sBAAiB,GAAjB,iBAAiB,CAAiC;QAElD,yBAAoB,GAApB,oBAAoB,CAA2C;QAE/D,4BAAuB,GAAvB,uBAAuB,CAAuC;QAE9D,4BAAuB,GAAvB,uBAAuB,CAAuC;QAE9D,sBAAiB,GAAjB,iBAAiB,CAAiC;QAElD,qBAAgB,GAAhB,gBAAgB,CAAyB;QAGzC,kCAA6B,GAA7B,6BAA6B,CAA8C;QAQ3E,4BAAuB,GAAvB,uBAAuB,CAAwC;QAG/D,kBAAa,GAAb,aAAa,CAA8B;QAE5D,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,qBAAqB,CAAC,CAAC;QAC/D,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,qBAAqB,EAAE,KAAK,CAAC,CAAC;QAE9D,IAAI,CAAC,QAAQ,CAAC,iCAAiC,CAAC,CAAC;IACnD,CAAC;IAED;;;OAGG;IACH,IAAY,eAAe;QACzB,OAAO,IAAI,CAAC,oBAAoB,CAAC,oBAAoB,CAAC,gBAAgB,CAAC,KAAK,EAAE,EAA2B,CAAC,CAAC;IAC7G,CAAC;IAEO,yBAAyB;QAC/B,OAAO,IAAI,CAAC,iBAAiB,CAAC,kBAAkB,EAAE,CAAC;IACrD,CAAC;IAEM,yBAAyB,CAC9B,IAA6D,EAC7D,gBAAuC;QAEvC,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC;YAC1B,IAAI,CAAC,QAAQ,CAAC,8DAA8D,EAAE;gBAC5E,MAAM,EAAE,IAAI,CAAC,MAAM;aACpB,CAAC,CAAC;YACH,OAAO,IAAI,CAAC,yBAAyB,EAAE,CAAC;QAC1C,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,iBAAiB,CAAC,eAAe,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QAC9E,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,QAAQ,EAClB,gBAAgB,EAChB;gBACE,sBAAsB,EAAE,2BAA2B,CAAC,QAAQ;gBAC5D,OAAO,EAAE;oBACP,OAAO,EAAE,mEAAmE;oBAC5E,MAAM,EAAE,IAAI,CAAC,MAAM;oBACnB,eAAe,EAAE,IAAI,CAAC,eAAe;iBACtC;aACF,CACF,CAAC;QACJ,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IACI,KAAK,CAAC,oBAAoB,CAC/B,IAAU,EACV,GAAa,EACb,gBAAmD,EACnD,OAAoG;QAEpG,MAAM,WAAW,GAAG,OAAO,EAAE,WAAW,IAAI,QAAQ,CAAC;QACrD,MAAM,IAAI,GAAG,OAAO,EAAE,IAAI,CAAC;QAC3B,MAAM,OAAO,GAAG,OAAO,EAAE,OAAO,IAAI,gBAAgB,CAAC,QAAQ,CAAC;QAE9D,6EAA6E;QAC7E,gFAAgF;QAChF,+DAA+D;QAC/D,iFAAiF;QACjF,uFAAuF;QACvF,MAAM,YAAY,GAChB,OAAO,KAAK,gBAAgB,CAAC,SAAS;YACtC,oBAAoB,CAAC,IAAI,CAAC,QAAQ,CAAC;YACnC,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC;YACpB,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,0BAA0B,CAAC;QACjD,IAAI,YAAY,EAAE,CAAC;YACjB,MAAM,IAAI,CAAC,mBAAmB,CAAC,IAAI,EAAE,GAAG,EAAE,gBAAgB,EAAE,IAAI,CAAC,CAAC;YAClE,OAAO;QACT,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,4BAA4B,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;QAElF,IAAI,MAAM,GAAoB,IAAI,CAAC;QAEnC,IAAI,CAAC;YACH,MAAM,eAAe,GAAG,IAAI,CAAC,yBAAyB,CAAC,IAAI,EAAE,gBAAuB,CAAC,CAAC;YACtF,MAAM,cAAc,GAAG,MAAM,eAAe,CAAC,QAAQ,CAAC,IAAI,EAAE,gBAAuB,CAAC,CAAC;YACrF,MAAM,GAAG,cAAc,CAAC,MAAM,CAAC;YAE/B,6EAA6E;YAC7E,cAAc,CAAC,MAAM,EAAE,IAAI,CAAC,YAAY,EAAE,gBAAuB,EAAE,gBAAgB,CAAC,CAAC;YAErF,4EAA4E;YAC5E,IAAI,GAAG,CAAC,WAAW,EAAE,CAAC;gBACpB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,iEAAiE,EAAE;oBAClF,MAAM,EAAE,IAAI,CAAC,MAAM;iBACpB,CAAC,CAAC;YACL,CAAC;iBAAM,CAAC;gBACN,MAAM,WAAW,GAAG,cAAc,CAAC,WAAW,IAAI,IAAI,CAAC,QAAQ,CAAC;gBAChE,GAAG,CAAC,SAAS,CAAC,eAAe,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC;gBAEzD,yEAAyE;gBACzE,2EAA2E;gBAC3E,uEAAuE;gBACvE,6EAA6E;gBAC7E,wEAAwE;gBACxE,sEAAsE;gBACtE,iEAAiE;gBACjE,8EAA8E;gBAC9E,2EAA2E;gBAC3E,kFAAkF;gBAClF,GAAG,CAAC,SAAS,CAAC,wBAAwB,EAAE,SAAS,CAAC,CAAC;gBACnD,GAAG,CAAC,SAAS,CAAC,yBAAyB,EAAE,kCAAkC,CAAC,CAAC;gBAE7E,MAAM,aAAa,GAAG,cAAc,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC;gBACvF,IAAI,aAAa,GAAG,CAAC,EAAE,CAAC;oBACtB,GAAG,CAAC,SAAS,CAAC,eAAe,CAAC,cAAc,EAAE,aAAa,CAAC,QAAQ,EAAE,CAAC,CAAC;gBAC1E,CAAC;gBAED,4EAA4E;gBAC5E,sEAAsE;gBACtE,sEAAsE;gBACtE,8DAA8D;gBAC9D,MAAM,oBAAoB,GACxB,WAAW,KAAK,QAAQ,IAAI,4BAA4B,CAAC,WAAW,CAAC;oBACnE,CAAC,CAAC,YAAY;oBACd,CAAC,CAAC,WAAW,CAAC;gBAClB,MAAM,QAAQ,GAAG,IAAI,CAAC,gBAAgB,IAAI,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC;gBAChE,2BAA2B,CAAC,GAAG,EAAE,QAAQ,EAAE,oBAAoB,CAAC,CAAC;gBAEjE,yEAAyE;gBACzE,IAAI,cAAc,CAAC,IAAI,EAAE,CAAC;oBACxB,GAAG,CAAC,SAAS,CAAC,eAAe,CAAC,IAAI,EAAE,cAAc,CAAC,IAAI,CAAC,CAAC;gBAC3D,CAAC;gBACD,IAAI,cAAc,CAAC,YAAY,EAAE,CAAC;oBAChC,GAAG,CAAC,SAAS,CAAC,eAAe,CAAC,aAAa,EAAE,cAAc,CAAC,YAAY,CAAC,WAAW,EAAE,CAAC,CAAC;gBAC1F,CAAC;YACH,CAAC;YAED,wEAAwE;YACxE,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;gBAC3B,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,8CAA8C,EAAE;oBAChE,MAAM,EAAE,IAAI,CAAC,MAAM;oBACnB,GAAG,2BAA2B,CAAC,KAAK,CAAC;iBACtC,CAAC,CAAC;gBACH,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;oBACrB,IAAI,IAAI,EAAE,CAAC;wBACT,IAAI,CAAC,KAAK,CAAC,CAAC;wBACZ,OAAO;oBACT,CAAC;oBACD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;gBACxB,CAAC;qBAAM,IAAI,MAAM,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;oBACvC,MAAM,CAAC,OAAO,EAAE,CAAC;gBACnB,CAAC;YACH,CAAC,CAAC,CAAC;YAEH,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;gBACxB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,qCAAqC,EAAE;oBACvD,MAAM,EAAE,IAAI,CAAC,MAAM;oBACnB,GAAG,2BAA2B,CAAC,KAAK,CAAC;iBACtC,CAAC,CAAC;gBACH,IAAI,MAAM,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;oBAChC,MAAM,CAAC,OAAO,EAAE,CAAC;gBACnB,CAAC;YACH,CAAC,CAAC,CAAC;YAEH,qEAAqE;YACrE,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;gBACnB,IAAI,MAAM,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;oBAChC,MAAM,CAAC,OAAO,EAAE,CAAC;gBACnB,CAAC;YACH,CAAC,CAAC,CAAC;YAEH,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACnB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,MAAM,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;gBAChC,IAAI,CAAC;oBACH,MAAM,CAAC,OAAO,EAAE,CAAC;gBACnB,CAAC;gBAAC,OAAO,YAAY,EAAE,CAAC;oBACtB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,+CAA+C,EAAE;wBAChE,MAAM,EAAE,IAAI,CAAC,MAAM;wBACnB,GAAG,2BAA2B,CAAC,YAAY,CAAC;wBAC5C,aAAa,EAAE,mBAAmB,CAAC,KAAK,CAAC;qBAC1C,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YAED,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,oCAAoC,EAAE;gBACtD,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,GAAG,2BAA2B,CAAC,KAAK,CAAC;aACtC,CAAC,CAAC;YACH,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;;;;;;;OAkBG;IACK,KAAK,CAAC,mBAAmB,CAC/B,IAAU,EACV,GAAa,EACb,gBAAmD,EACnD,IAA8B;QAE9B,IAAI,CAAC,QAAQ,CAAC,yBAAyB,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QAEnF,IAAI,CAAC;YACH,MAAM,eAAe,GAAG,IAAI,CAAC,yBAAyB,CAAC,IAAI,EAAE,gBAAuB,CAAC,CAAC;YACtF,MAAM,cAAc,GAAG,MAAM,eAAe,CAAC,QAAQ,CAAC,IAAI,EAAE,gBAAuB,CAAC,CAAC;YACrF,MAAM,MAAM,GAAG,cAAc,CAAC,MAAM,CAAC;YACrC,cAAc,CAAC,MAAM,EAAE,IAAI,CAAC,YAAY,EAAE,gBAAuB,EAAE,uBAAuB,CAAC,CAAC;YAE5F,6EAA6E;YAC7E,iFAAiF;YACjF,MAAM,YAAY,GAAG,MAAM,qBAAqB,CAAC,MAAM,EAAE,0BAA0B,CAAC,CAAC;YACrF,MAAM,SAAS,GAAG,MAAM,sBAAsB,CAAC,YAAY,CAAC,CAAC;YAE7D,IAAI,GAAG,CAAC,WAAW,EAAE,CAAC;gBACpB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,uDAAuD,EAAE;oBACxE,MAAM,EAAE,IAAI,CAAC,MAAM;iBACpB,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YAED,6EAA6E;YAC7E,wEAAwE;YACxE,MAAM,IAAI,GAAG,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC;YACvD,MAAM,WAAW,GAAG,SAAS;gBAC3B,CAAC,CAAC,SAAS,CAAC,WAAW;gBACvB,CAAC,CAAC,cAAc,CAAC,WAAW,IAAI,IAAI,CAAC,QAAQ,CAAC;YAChD,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,2DAA2D,EAAE;oBAC5E,MAAM,EAAE,IAAI,CAAC,MAAM;oBACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;iBACxB,CAAC,CAAC;YACL,CAAC;YAED,8EAA8E;YAC9E,yEAAyE;YACzE,gFAAgF;YAChF,oFAAoF;YACpF,GAAG,CAAC,SAAS,CAAC,eAAe,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC;YACzD,GAAG,CAAC,SAAS,CAAC,wBAAwB,EAAE,SAAS,CAAC,CAAC;YACnD,GAAG,CAAC,SAAS,CAAC,yBAAyB,EAAE,kCAAkC,CAAC,CAAC;YAC7E,GAAG,CAAC,SAAS,CAAC,eAAe,CAAC,cAAc,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;YAEtE,8EAA8E;YAC9E,sEAAsE;YACtE,GAAG,CAAC,SAAS,CAAC,eAAe,CAAC,aAAa,EAAE,uBAAuB,CAAC,CAAC;YACtE,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,YAAY,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/E,GAAG,CAAC,SAAS,CAAC,eAAe,CAAC,IAAI,EAAE,UAAU,IAAI,CAAC,MAAM,IAAI,OAAO,GAAG,CAAC,CAAC;YAEzE,MAAM,QAAQ,GAAG,IAAI,CAAC,gBAAgB,IAAI,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC;YAChE,2BAA2B,CAAC,GAAG,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;YAErD,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAChB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,iCAAiC,EAAE;gBACnD,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,GAAG,2BAA2B,CAAC,KAAK,CAAC;aACtC,CAAC,CAAC;YACH,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;gBACrB,IAAI,IAAI,EAAE,CAAC;oBACT,IAAI,CAAC,KAAc,CAAC,CAAC;oBACrB,OAAO;gBACT,CAAC;gBACD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;gBACtB,OAAO;YACT,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4BG;IACK,KAAK,CAAC,8BAA8B,CAC1C,SAAgC,EAChC,eAAsC,EACtC,WAAiC;QAEjC,MAAM,aAAa,GAAG,eAAe,CAAC,aAAa,IAAI,IAAI,CAAC,gBAAgB,CAAC,aAAa,CAAC;QAE3F,OAAO,IAAI,CAAC,uBAAuB,CAAC,oCAAoC,CAAC;YACvE,YAAY,EAAE,gBAAgB,CAAC,KAAK;YACpC,mBAAmB,EAAE,SAAS;YAC9B,YAAY,EAAE,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,IAAI;YACtD,+BAA+B,EAAE,WAAW;YAC5C,cAAc,EAAE;gBACd;oBACE,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,mBAAmB,EAAE,oBAAoB,CAAC,WAAW;iBACtD;aACF;SACF,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,UAAU,CACd,QAeyB,EACzB,gBAAuC,EACvC,OAA2B;QAE3B,gEAAgE;QAChE,MAAM,WAAW,GAAG,4BAA4B,CAAC,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;QACpG,mBAAmB,CAAC,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC,YAAY,EAAE,gBAAgB,EAAE,UAAU,CAAC,CAAC;QACxF,YAAY,CAAC,QAAQ,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,YAAY,EAAE,gBAAgB,EAAE,MAAM,CAAC,CAAC;QACtF,MAAM,qBAAqB,GAAG,QAAQ,CAAC,UAAU,KAAK,SAAS,CAAC;QAChE,MAAM,6BAA6B,GAAG,QAAQ,CAAC,oBAAoB,KAAK,SAAS,CAAC;QAClF,IAAI,qBAAqB,KAAK,6BAA6B,EAAE,CAAC;YAC5D,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,UAAU,EACpB,gBAAgB,EAChB;gBACE,sBAAsB,EAAE,2BAA2B,CAAC,iCAAiC;gBACrF,OAAO,EAAE;oBACP,wBAAwB;oBACxB,UAAU,EAAE,QAAQ,CAAC,UAAU;oBAC/B,oBAAoB,EAAE,QAAQ,CAAC,oBAAoB;iBACpD;aACF,CACF,CAAC;QACJ,CAAC;QAED,IAAI,qBAAqB,IAAI,6BAA6B,EAAE,CAAC;YAC3D,kBAAkB,CAAC,QAAQ,CAAC,UAAU,EAAE,IAAI,CAAC,YAAY,EAAE,gBAAgB,EAAE,YAAY,CAAC,CAAC;YAC3F,4BAA4B,CAAC,QAAQ,CAAC,oBAAoB,EAAE,IAAI,CAAC,YAAY,EAAE,gBAAgB,EAAE,sBAAsB,CAAC,CAAC;QAC3H,CAAC;QAED,6BAA6B;QAC7B,IAAI,QAAQ,CAAC,KAAK,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YAC/D,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,UAAU,EACpB,gBAAgB,EAChB;gBACE,sBAAsB,EAAE,2BAA2B,CAAC,6BAA6B;gBACjF,OAAO,EAAE;oBACP,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,wBAAwB;iBAChD;aACF,CACF,CAAC;QACJ,CAAC;QAED,uDAAuD;QACvD,MAAM,cAAc,GAAG,QAAQ,CAAC,KAAK,EAAE,cAAc,IAAI,QAAQ,CAAC,cAAc,CAAC;QACjF,IAAI,cAAc,EAAE,CAAC;YACnB,sBAAsB,CAAC,cAAc,EAAE,IAAI,CAAC,YAAY,EAAE,gBAAgB,EAAE,gBAAgB,CAAC,CAAC;QAChG,CAAC;QAED,mGAAmG;QACnG,gGAAgG;QAChG,MAAM,WAAW,GAAG,IAAI,CAAC,iBAAiB,CAAC,gBAAgB,CAAC,CAAC;QAC7D,MAAM,aAAa,GAAG,QAAQ,CAAC,KAAK,EAAE,aAAa,IAAI,WAAW,CAAC,aAAa,CAAC;QACjF,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,UAAU,EACpB,gBAAgB,EAChB;gBACE,sBAAsB,EAAE,2BAA2B,CAAC,6BAA6B;aAClF,CACF,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,sBAAsB,EAAE;YACpC,QAAQ,EAAE,QAAQ,CAAC,QAAQ;YAC3B,YAAY,EAAE,QAAQ,CAAC,KAAK,EAAE,YAAY;YAC1C,cAAc;SACf,CAAC,CAAC;QAEH,kDAAkD;QAClD,MAAM,SAAS,GAAG,QAAQ,CAAC,SAAS,IAAI,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC;QAEzF,kFAAkF;QAClF,oFAAoF;QACpF,mFAAmF;QACnF,sFAAsF;QACtF,qFAAqF;QACrF,iFAAiF;QACjF,MAAM,yBAAyB,GAAG,QAAQ,CAAC,eAAe,IAAI,IAAI,CAAC,yBAAyB,EAAE,CAAC,UAAU,CAAC;QAE1G,MAAM,eAAe,GAAG,4BAA4B,CAAC,gBAAgB,CAAC,CAAC;QACvE,MAAM,iBAAiB,GAAG,qBAAqB,IAAI,6BAA6B;YAC9E,CAAC,CAAC;gBACE,UAAU,EAAE,QAAQ,CAAC,UAAW;gBAChC,oBAAoB,EAAE,QAAQ,CAAC,oBAAqB;aACrD;YACH,CAAC,CAAC,eAAe,CAAC;QAEpB,IAAI,qBAAqB,IAAI,6BAA6B;eACrD,eAAe;eACf,CACD,QAAQ,CAAC,UAAU,KAAK,eAAe,CAAC,UAAU;mBAC/C,QAAQ,CAAC,oBAAoB,KAAK,eAAe,CAAC,oBAAoB,CAC1E,EACD,CAAC;YACD,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,UAAU,EACpB,gBAAgB,EAChB;gBACE,sBAAsB,EAAE,2BAA2B,CAAC,sBAAsB;gBAC1E,OAAO,EAAE;oBACP,wBAAwB;oBACxB,UAAU,EAAE,QAAQ,CAAC,UAAU;oBAC/B,oBAAoB,EAAE,QAAQ,CAAC,oBAAoB;oBACnD,iBAAiB,EAAE,eAAe,CAAC,UAAU;oBAC7C,2BAA2B,EAAE,eAAe,CAAC,oBAAoB;iBAClE;aACF,CACF,CAAC;QACJ,CAAC;QAED,6EAA6E;QAC7E,oFAAoF;QACpF,MAAM,UAAU,GAAkB;YAChC,QAAQ,EAAE,QAAQ,CAAC,QAAQ;YAC3B,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB;YAC3C,QAAQ,EAAE,QAAQ,CAAC,QAAQ;YAC3B,IAAI,EAAE,QAAQ,CAAC,IAAI;YACnB,SAAS,EAAE,SAAS,IAAI,SAAS;YACjC,QAAQ,EAAE,QAAQ,CAAC,QAAQ;YAC3B,eAAe,EAAE,yBAAyB;YAC1C,MAAM,EAAE,UAAU,CAAC,OAAO;YAC1B,UAAU,EAAE,iBAAiB,EAAE,UAAU;YACzC,oBAAoB,EAAE,iBAAiB,EAAE,oBAAoB;YAC7D,iCAAiC;YACjC,YAAY,EAAE,QAAQ,CAAC,KAAK,EAAE,YAAY;YAC1C,aAAa;YACb,cAAc,EAAE,cAAc;YAC9B,MAAM,EAAE,QAAQ,CAAC,KAAK,EAAE,MAAM;SAC/B,CAAC;QAEF,6DAA6D;QAC7D,+EAA+E;QAC/E,oFAAoF;QACpF,qFAAqF;QACrF,sFAAsF;QACtF,mFAAmF;QACnF,yFAAyF;QACzF,MAAM,iBAAiB,GAAG,IAAI,GAAG,EAAkB,CAAC;QACpD,IAAI,QAAQ,CAAC,KAAK,EAAE,cAAc,EAAE,CAAC;YACnC,iBAAiB,CAAC,GAAG,CAAC,gBAAgB,EAAE,QAAQ,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;QACzE,CAAC;QACD,IAAI,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,CAAC;YAC3B,iBAAiB,CAAC,GAAG,CAAC,QAAQ,EAAE,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACzD,CAAC;QACD,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,8BAA8B,CAC/D,qBAAqB,CAAC,MAAM,EAC5B,gBAAgB,EAChB,iBAAiB,CAClB,CAAC;QAEF,sFAAsF;QACtF,sFAAsF;QACtF,mFAAmF;QACnF,sFAAsF;QACtF,MAAM,yBAAyB,GAAG,KAAK,EACrC,YAA2C,EAC5B,EAAE;YACjB,iFAAiF;YACjF,wDAAwD;YACxD,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,MAAM,CACnD,eAAe,EACf,UAAkB,EAClB,YAAY,CACb,CAAC;YAEF,wFAAwF;YACxF,0FAA0F;YAC1F,uFAAuF;YACvF,wFAAwF;YACxF,4BAA4B;YAC5B,MAAM,UAAU,GAAG,QAAQ,CAAC,KAAK;gBAC/B,CAAC,CAAC,cAAc,CAAC,gBAAgB,CAAC,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC,MAAM,CAAC;gBACrE,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC;YACvB,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,MAAM,CACtD,eAAe,EACf,EAAE,GAAG,EAAE,WAAW,CAAC,MAAM,EAAE,EAC3B,EAAE,UAAU,EAAmB,EAC/B,YAAY,CACb,CAAC;YAEF,IAAI,CAAC,cAAc,EAAE,CAAC;gBACpB,uFAAuF;gBACvF,iFAAiF;gBACjF,uFAAuF;gBACvF,UAAU;gBACV,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,2DAA2D,EAAE;oBAC9E,MAAM,EAAE,WAAW,CAAC,MAAM;iBAC3B,CAAC,CAAC;gBACH,IAAI,CAAC,QAAQ,CAAC,qBAAqB,EAAE,EAAE,MAAM,EAAE,WAAW,CAAC,MAAM,EAAE,CAAC,CAAC;gBACrE,OAAO,WAAW,CAAC;YACrB,CAAC;YAED,IAAI,CAAC,QAAQ,CAAC,qBAAqB,EAAE,EAAE,MAAM,EAAE,cAAc,CAAC,MAAM,EAAE,CAAC,CAAC;YACxE,OAAO,cAAc,CAAC;QACxB,CAAC,CAAC;QAEF,uFAAuF;QACvF,0FAA0F;QAC1F,wFAAwF;QACxF,uFAAuF;QACvF,kFAAkF;QAClF,EAAE;QACF,qFAAqF;QACrF,4FAA4F;QAC5F,yFAAyF;QACzF,2FAA2F;QAC3F,gBAAgB;QAChB,MAAM,UAAU,GAAG,IAAI,CAAC,aAAa,CAAC,gBAAgB,CAAC,CAAC;QACxD,IAAI,OAAO,EAAE,WAAW,EAAE,YAAY,KAAK,UAAU,CAAC,kBAAkB,EAAE,CAAC;YACzE,OAAO,yBAAyB,CAAC,OAAO,CAAC,CAAC;QAC5C,CAAC;QACD,OAAO,UAAU,CAAC,eAAe,CAAC,kBAAkB,CAClD,CAAC,kBAAkB,EAAE,EAAE,CAAC,yBAAyB,CAAC,EAAE,GAAG,OAAO,EAAE,WAAW,EAAE,kBAAkB,EAAE,CAAC,EAClG,EAAE,cAAc,EAAE,OAAO,EAAE,CAC5B,CAAC;IACJ,CAAC;IAED;;;;;;;;;;OAUG;IACK,aAAa,CAAC,gBAAuC;QAC3D,MAAM,UAAU,GAAG,IAAI,CAAC,6BAA6B,EAAE,6BAA6B,CAClF,gBAAgB,CAAC,KAAK,CACvB,CAAC;QAEF,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,aAAa,EACvB,gBAAgB,EAChB;gBACE,sBAAsB,EAAE,2BAA2B,CAAC,aAAa;gBACjE,OAAO,EAAE;oBACP,OAAO,EAAE,+DAA+D;oBACxE,YAAY,EAAE,gBAAgB,CAAC,KAAK;oBACpC,eAAe,EAAE,OAAO,CAAC,IAAI,CAAC,6BAA6B,CAAC;iBAC7D;aACF,CACF,CAAC;QACJ,CAAC;QAED,OAAO,UAAU,CAAC;IACpB,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,OAAO,CACX,MAAc,EACd,gBAAuC,EACvC,OAA2B;QAE3B,IAAI,CAAC,QAAQ,CAAC,qBAAqB,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QAEjD,kFAAkF;QAClF,cAAc,CAAC,MAAM,EAAE,IAAI,CAAC,YAAY,EAAE,gBAAgB,EAAE,QAAQ,CAAC,CAAC;QAEtE,6DAA6D;QAC7D,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,8BAA8B,CAC/D,qBAAqB,CAAC,IAAI,EAC1B,gBAAgB,CACjB,CAAC;QAEF,oFAAoF;QACpF,gEAAgE;QAChE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,IAAI,CAC1C,eAAe,EACf,EAAE,GAAG,EAAE,MAAM,EAAE,EACf,OAAO,CACR,CAAC;QAEF,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,IAAI,CAAC,QAAQ,CAAC,gBAAgB,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;YAC5C,OAAO,IAAI,CAAC;QACd,CAAC;QAED,yFAAyF;QACzF,mGAAmG;QACnG,kFAAkF;QAClF,kGAAkG;QAClG,iGAAiG;QACjG,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,sBAAsB,CAAC,CAAC;QAC1G,IAAI,CAAC,SAAS,EAAE,CAAC;YACb,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,aAAa,EACvB,gBAAgB,EAChB;gBACE,sBAAsB,EAAE,2BAA2B,CAAC,kBAAkB;gBACxE,OAAO,EAAE;oBACP,MAAM,EAAE,wBAAwB;iBACjC;aACF,CACF,CAAC;QACJ,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,aAAa,CACjB,OAAiB,EACjB,gBAAuC,EACvC,OAA2B;QAE3B,IAAI,CAAC,QAAQ,CAAC,4BAA4B,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;QAEhF,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,yFAAyF;QACzF,6BAA6B;QAC7B,EAAE;QACF,0FAA0F;QAC1F,yFAAyF;QACzF,4FAA4F;QAC5F,MAAM,YAAY,GAAG,OAAO,CAAC,MAAM,CACjC,CAAC,EAAE,EAAE,EAAE,CAAC,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,qBAAqB,CAAC,iBAAiB,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,CACzG,CAAC;QAEF,mDAAmD;QACnD,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC9B,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,MAAM,qBAAqB,GAAG,IAAI,CAAC,0BAA0B,CAAC,gBAAgB,CAAC,CAAC;QAChF,IAAI,CAAC,qBAAqB,EAAE,CAAC;YAC3B,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,UAAU,EACpB,gBAAgB,EAChB;gBACE,sBAAsB,EAAE,2BAA2B,CAAC,6BAA6B;gBACjF,OAAO,EAAE;oBACP,YAAY,EAAE,OAAO,CAAC,MAAM,EAAE,wBAAwB;iBACvD;aACF,CACF,CAAC;QACJ,CAAC;QAED,6DAA6D;QAC7D,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,8BAA8B,CAC/D,qBAAqB,CAAC,IAAI,EAC1B,gBAAgB,CACjB,CAAC;QAEF,gEAAgE;QAChE,8EAA8E;QAC9E,8EAA8E;QAC9E,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,IAAI,CAC3C,eAAe,EACf;YACE,8EAA8E;YAC9E,GAAG,EAAE,EAAE,GAAG,EAAE,YAAY,EAAE;YAC1B,GAAG,qBAAqB;SACzB,EACD,OAAO,CACR,CAAC;QAEF,0BAA0B;QAC1B,MAAM,eAAe,GAAW,EAAE,CAAC;QACnC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC;YACzE,IAAI,SAAS,EAAE,CAAC;gBACd,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC7B,CAAC;QACH,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,qBAAqB,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE,UAAU,EAAE,eAAe,CAAC,MAAM,EAAE,CAAC,CAAC;QAC7H,OAAO,eAAe,CAAC;IACzB,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,gBAAgB,CACpB,MAAc,EACd,MAAkB,EAClB,gBAAuC,EACvC,OAA2B,EAC3B,gBAAsC;QAEtC,IAAI,CAAC,QAAQ,CAAC,sBAAsB,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;QAE1D,kFAAkF;QAClF,cAAc,CAAC,MAAM,EAAE,IAAI,CAAC,YAAY,EAAE,gBAAgB,EAAE,QAAQ,CAAC,CAAC;QAEtE,0BAA0B;QAC1B,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,gBAAgB,EAAE,OAAO,CAAC,CAAC;QAC1E,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,SAAS,EACnB,gBAAgB,EAChB;gBACE,sBAAsB,EAAE,2BAA2B,CAAC,cAAc;gBAClE,OAAO,EAAE;oBACP,MAAM,EAAE,wBAAwB;iBACjC;aACF,CACF,CAAC;QACJ,CAAC;QAED,MAAM,kBAAkB,GAAG,uBAAuB,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QACvE,IAAI,CAAC,kBAAkB,EAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YAC1C,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,aAAa,EACvB,gBAAgB,EAChB;gBACE,sBAAsB,EAAE,2BAA2B,CAAC,8BAA8B;gBAClF,OAAO,EAAE;oBACP,wBAAwB;oBACxB,MAAM;oBACN,aAAa,EAAE,WAAW,CAAC,MAAM;oBACjC,eAAe,EAAE,MAAM;oBACvB,kBAAkB;iBACnB;aACF,CACF,CAAC;QACJ,CAAC;QAED,6DAA6D;QAC7D,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,8BAA8B,CAC/D,qBAAqB,CAAC,MAAM,EAC5B,gBAAgB,CACjB,CAAC;QAEF,sFAAsF;QACtF,gEAAgE;QAChE,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,MAAM,CACnD,eAAe,EACf,EAAE,GAAG,EAAE,MAAM,EAAE,EACf;YACE,MAAM;YACN,GAAG,CAAC,gBAAgB;gBAClB,CAAC,CAAC;oBACE,eAAe,EAAE,gBAAgB,CAAC,QAAQ;oBAC1C,UAAU,EAAE,gBAAgB,CAAC,UAAU;iBACxC;gBACH,CAAC,CAAC,EAAE,CAAC;YACP,SAAS,EAAE,IAAI,IAAI,EAAE;SACL,EAClB,OAAO,CACR,CAAC;QAEF,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,QAAQ,EAClB,gBAAgB,EAChB;gBACE,sBAAsB,EAAE,2BAA2B,CAAC,QAAQ;gBAC5D,OAAO,EAAE;oBACP,OAAO,EAAE,8BAA8B;oBACvC,MAAM;oBACN,MAAM;iBACP;aACF,CACF,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,qBAAqB,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,WAAW,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;QACnG,OAAO,WAAW,CAAC;IACrB,CAAC;IAED;;;;;;;;OAQG;IACK,KAAK,CAAC,gCAAgC,CAC5C,OAAgG,EAChG,IAAY,EACZ,OAA2B;QAE3B,IAAI,CAAC,IAAI,CAAC,aAAa,IAAI,CAAC,IAAI,CAAC,uBAAuB;YAAE,OAAO;QACjE,MAAM,EAAE,YAAY,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,OAAO,CAAC;QACxD,IAAI,CAAC,YAAY,IAAI,CAAC,UAAU,IAAI,CAAC,SAAS;YAAE,OAAO;QACvD,MAAM,gCAAgC,CACpC;YACE,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,uBAAuB,EAAE,IAAI,CAAC,uBAAuB;YACrD,MAAM,EAAE,IAAI,CAAC,MAAM;SACpB,EACD;YACE,YAAY,EAAE,YAA4B;YAC1C,WAAW,EAAE,CAAC,UAAU,CAAC;YACzB,kBAAkB,EAAE,CAAC,SAAS,CAAC;YAC/B,IAAI;YACJ,WAAW,EAAE,OAAO,EAAE,WAAW;SAClC,CACF,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;;;;;;OAgBG;IACH,KAAK,CAAC,kBAAkB,CACtB,MAAc,EACd,YAA0B,EAC1B,UAAkB,EAClB,SAAiB,EACjB,gBAAuC,EACvC,OAA2B;QAE3B,IAAI,CAAC,QAAQ,CAAC,0BAA0B,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC,CAAC;QAE3F,2EAA2E;QAC3E,cAAc,CAAC,MAAM,EAAE,IAAI,CAAC,YAAY,EAAE,gBAAgB,EAAE,QAAQ,CAAC,CAAC;QACtE,kBAAkB,CAAC,UAAU,EAAE,IAAI,CAAC,YAAY,EAAE,gBAAgB,EAAE,YAAY,CAAC,CAAC;QAClF,oBAAoB,CAAC,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,gBAAgB,EAAE,cAAc,CAAC,CAAC;QACxF,iBAAiB,CAAC,SAAS,EAAE,IAAI,CAAC,YAAY,EAAE,gBAAgB,EAAE,WAAW,CAAC,CAAC;QAE/E,2DAA2D;QAC3D,MAAM,YAAY,GAAG,IAAI,CAAC,6BAA6B,CAAC,YAAY,EAAE,gBAAgB,CAAC,CAAC;QAExF,6DAA6D;QAC7D,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,8BAA8B,CAC/D,qBAAqB,CAAC,MAAM,EAC5B,gBAAgB,CACjB,CAAC;QAEF,qGAAqG;QACrG,oFAAoF;QACpF,2EAA2E;QAC3E,0DAA0D;QAE1D;;;;;WAKG;QACH,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,MAAM,CACnD,eAAe,EACf;YACE,GAAG,EAAE,MAAM;YACX,MAAM,EAAE,EAAE,GAAG,EAAE,CAAC,UAAU,CAAC,QAAQ,EAAE,UAAU,CAAC,KAAK,CAAC,EAAE;SACzD,EACD;YACE,kBAAkB,EAAE,YAAY;YAChC,gBAAgB,EAAE,UAAU;YAC5B,eAAe,EAAE,SAAS;YAC1B,MAAM,EAAE,UAAU,CAAC,MAAM;YACzB,SAAS,EAAE,IAAI,IAAI,EAAE;YACrB,qCAAqC;YACrC,YAAY,EAAE,YAAY,CAAC,YAAY;YACvC,aAAa,EAAE,YAAY,CAAC,aAAa;YACzC,cAAc,EAAE,YAAY,CAAC,cAAc;YAC3C,MAAM,EAAE,YAAY,CAAC,MAAM;YAC3B,yDAAyD;YACzD,UAAU,EAAE,cAAc,CAAC,gBAAgB,CAAC,YAAY,EAAE,MAAM,CAAC;SACjD,EAClB,OAAO,CACR,CAAC;QAEF,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,uEAAuE;YACvE,+DAA+D;YAC/D,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,gBAAgB,EAAE,OAAO,CAAC,CAAC;YAC1E,IAAI,CAAC,WAAW,EAAE,CAAC;gBACjB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,SAAS,EACnB,gBAAgB,EAChB;oBACE,sBAAsB,EAAE,2BAA2B,CAAC,cAAc;oBAClE,OAAO,EAAE;wBACP,MAAM,EAAE,wBAAwB;qBACjC;iBACF,CACF,CAAC;YACJ,CAAC;YAED,6DAA6D;YAC7D,IAAI,WAAW,CAAC,MAAM,KAAK,UAAU,CAAC,MAAM;gBACxC,WAAW,CAAC,kBAAkB,KAAK,YAAY;gBAC/C,WAAW,CAAC,gBAAgB,KAAK,UAAU;gBAC3C,WAAW,CAAC,eAAe,KAAK,SAAS,EAAE,CAAC;gBAC9C,oEAAoE;gBACpE,IAAI,CAAC,QAAQ,CAAC,mDAAmD,EAAE;oBACjE,MAAM;oBACN,YAAY;oBACZ,UAAU;oBACV,SAAS;iBACV,CAAC,CAAC;gBACH,OAAO,WAAW,CAAC;YACrB,CAAC;YAED,6DAA6D;YAC7D,IAAI,WAAW,CAAC,MAAM,KAAK,UAAU,CAAC,MAAM,EAAE,CAAC;gBAC7C,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,aAAa,EACvB,gBAAgB,EAChB;oBACE,sBAAsB,EAAE,2BAA2B,CAAC,mBAAmB;oBACvE,OAAO,EAAE;wBACP,wBAAwB;wBACxB,MAAM;wBACN,yBAAyB,EAAE,WAAW,CAAC,kBAAkB;wBACzD,uBAAuB,EAAE,WAAW,CAAC,gBAAgB;wBACrD,sBAAsB,EAAE,WAAW,CAAC,eAAe;wBACnD,qBAAqB,EAAE,YAAY;wBACnC,mBAAmB,EAAE,UAAU;wBAC/B,kBAAkB,EAAE,SAAS;qBAC9B;iBACF,CACF,CAAC;YACJ,CAAC;YAED,8BAA8B;YAC9B,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,aAAa,EACvB,gBAAgB,EAChB;gBACE,sBAAsB,EAAE,2BAA2B,CAAC,2BAA2B;gBAC/E,OAAO,EAAE;oBACP,wBAAwB;oBACxB,MAAM;oBACN,UAAU,EAAE,WAAW,CAAC,MAAM;oBAC9B,cAAc,EAAE,UAAU,CAAC,QAAQ;oBACnC,YAAY;oBACZ,UAAU;iBACX;aACF,CACF,CAAC;QACJ,CAAC;QAED,gGAAgG;QAChG,8FAA8F;QAC9F,MAAM,IAAI,CAAC,gCAAgC,CACzC,EAAE,YAAY,EAAE,UAAU,EAAE,SAAS,EAAE,EACvC,WAAW,EACX,OAAO,CACR,CAAC;QAEF,IAAI,CAAC,QAAQ,CAAC,yBAAyB,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,UAAU,EAAE,CAAC,CAAC;QAC/E,OAAO,WAAW,CAAC;IACrB,CAAC;IAED;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,sBAAsB,CAC1B,MAAc,EACd,gBAAuC,EACvC,OAA2B;QAE3B,IAAI,CAAC,QAAQ,CAAC,8BAA8B,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QAE1D,kFAAkF;QAClF,cAAc,CAAC,MAAM,EAAE,IAAI,CAAC,YAAY,EAAE,gBAAgB,EAAE,QAAQ,CAAC,CAAC;QAEtE,0BAA0B;QAC1B,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,gBAAgB,EAAE,OAAO,CAAC,CAAC;QAC1E,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,SAAS,EACnB,gBAAgB,EAChB;gBACE,sBAAsB,EAAE,2BAA2B,CAAC,cAAc;gBAClE,OAAO,EAAE;oBACP,MAAM,EAAE,wBAAwB;iBACjC;aACF,CACF,CAAC;QACJ,CAAC;QAED,6DAA6D;QAC7D,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,8BAA8B,CAC/D,qBAAqB,CAAC,MAAM,EAC5B,gBAAgB,CACjB,CAAC;QAEF,iEAAiE;QACjE,oGAAoG;QACpG,kGAAkG;QAClG,kHAAkH;QAClH,qGAAqG;QACrG,8DAA8D;QAC9D,MAAM,UAAU,GAAkB;YAChC,MAAM,EAAE,UAAU,CAAC,QAAQ;YAC3B,SAAS,EAAE,IAAI,IAAI,EAAE;SACtB,CAAC;QAEF;;;;;WAKG;QACH,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,MAAM,CACnD,eAAe,EACf,EAAE,GAAG,EAAE,MAAM,EAAE,EACf,UAAU,EACV,OAAO,CACR,CAAC;QAEF,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,QAAQ,EAClB,gBAAgB,EAChB;gBACE,sBAAsB,EAAE,2BAA2B,CAAC,QAAQ;gBAC5D,OAAO,EAAE;oBACP,OAAO,EAAE,qCAAqC;oBAC9C,MAAM;iBACP;aACF,CACF,CAAC;QACJ,CAAC;QAED,+FAA+F;QAC/F,sGAAsG;QACtG,MAAM,IAAI,CAAC,gCAAgC,CACzC;YACE,YAAY,EAAE,WAAW,CAAC,kBAAkB;YAC5C,UAAU,EAAE,WAAW,CAAC,gBAAgB;YACxC,SAAS,EAAE,WAAW,CAAC,eAAe;SACvC,EACD,aAAa,EACb,OAAO,CACR,CAAC;QAEF,IAAI,CAAC,QAAQ,CAAC,6BAA6B,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QACzD,OAAO,WAAW,CAAC;IACrB,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,UAAU,CACd,MAAc,EACd,gBAAuC,EACvC,OAA2B;QAE3B,IAAI,CAAC,QAAQ,CAAC,2BAA2B,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QAEvD,kFAAkF;QAClF,cAAc,CAAC,MAAM,EAAE,IAAI,CAAC,YAAY,EAAE,gBAAgB,EAAE,QAAQ,CAAC,CAAC;QAEtE,0BAA0B;QAC1B,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,gBAAgB,EAAE,OAAO,CAAC,CAAC;QAC1E,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,SAAS,EACnB,gBAAgB,EAChB;gBACE,sBAAsB,EAAE,2BAA2B,CAAC,cAAc;gBAClE,OAAO,EAAE;oBACP,MAAM,EAAE,wBAAwB;iBACjC;aACF,CACF,CAAC;QACJ,CAAC;QAED,6DAA6D;QAC7D,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,8BAA8B,CAC/D,qBAAqB,CAAC,MAAM,EAC5B,gBAAgB,CACjB,CAAC;QAEF,+CAA+C;QAE/C;;;;;WAKG;QACH,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,MAAM,CACnD,eAAe,EACf,EAAE,GAAG,EAAE,MAAM,EAAE,EACf;YACE,MAAM,EAAE,UAAU,CAAC,OAAO;YAC1B,SAAS,EAAE,IAAI,IAAI,EAAE;YACrB,SAAS,EAAE,IAAI,IAAI,EAAE;SACL,EAClB,OAAO,CACR,CAAC;QAEF,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,QAAQ,EAClB,gBAAgB,EAChB;gBACE,sBAAsB,EAAE,2BAA2B,CAAC,QAAQ;gBAC5D,OAAO,EAAE;oBACP,OAAO,EAAE,uBAAuB;oBAChC,MAAM;iBACP;aACF,CACF,CAAC;QACJ,CAAC;QAED,6FAA6F;QAC7F,iGAAiG;QACjG,2FAA2F;QAC3F,gGAAgG;QAChG,4DAA4D;QAC5D,MAAM,IAAI,CAAC,gCAAgC,CACzC;YACE,YAAY,EAAE,WAAW,CAAC,kBAAkB;YAC5C,UAAU,EAAE,WAAW,CAAC,gBAAgB;YACxC,SAAS,EAAE,WAAW,CAAC,eAAe;SACvC,EACD,aAAa,EACb,OAAO,CACR,CAAC;QAEF,IAAI,CAAC,QAAQ,CAAC,mBAAmB,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QAC/C,OAAO,WAAW,CAAC;IACrB,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,KAAK,CAAC,SAAS,CACb,MAAc,EACd,gBAAuC,EACvC,OAA2B;QAE3B,IAAI,CAAC,QAAQ,CAAC,iCAAiC,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QAE7D,cAAc,CAAC,MAAM,EAAE,IAAI,CAAC,YAAY,EAAE,gBAAgB,EAAE,QAAQ,CAAC,CAAC;QAEtE,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,gBAAgB,EAAE,OAAO,CAAC,CAAC;QAC1E,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,SAAS,EACnB,gBAAgB,EAChB;gBACE,sBAAsB,EAAE,2BAA2B,CAAC,cAAc;gBAClE,OAAO,EAAE;oBACP,MAAM,EAAE,wBAAwB;iBACjC;aACF,CACF,CAAC;QACJ,CAAC;QAED,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,8BAA8B,CAC/D,qBAAqB,CAAC,MAAM,EAC5B,gBAAgB,CACjB,CAAC;QAEF,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,MAAM,CAClD,eAAe,EACf,EAAE,GAAG,EAAE,MAAM,EAAE,EACf;YACE,MAAM,EAAE,UAAU,CAAC,OAAO;YAC1B,SAAS,EAAE,IAAI,IAAI,EAAE;YACrB,SAAS,EAAE,IAAI,IAAI,EAAE;YACrB,QAAQ,EAAE,4BAA4B;YACtC,gBAAgB,EAAE,4BAA4B;YAC9C,UAAU,EAAE,SAAS;YACrB,oBAAoB,EAAE,SAAS;SACf,EAClB,OAAO,CACR,CAAC;QAEF,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,QAAQ,EAClB,gBAAgB,EAChB;gBACE,sBAAsB,EAAE,2BAA2B,CAAC,QAAQ;gBAC5D,OAAO,EAAE;oBACP,OAAO,EAAE,sBAAsB;oBAC/B,MAAM;iBACP;aACF,CACF,CAAC;QACJ,CAAC;QAED,gGAAgG;QAChG,+FAA+F;QAC/F,iGAAiG;QACjG,4DAA4D;QAC5D,MAAM,IAAI,CAAC,gCAAgC,CACzC;YACE,YAAY,EAAE,WAAW,CAAC,kBAAkB;YAC5C,UAAU,EAAE,WAAW,CAAC,gBAAgB;YACxC,SAAS,EAAE,WAAW,CAAC,eAAe;SACvC,EACD,YAAY,EACZ,OAAO,CACR,CAAC;QAEF,IAAI,CAAC,QAAQ,CAAC,aAAa,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QACzC,OAAO,UAAU,CAAC;IACpB,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,cAAc,CAClB,MAAc,EACd,gBAAuC,EACvC,OAA2B;QAE3B,IAAI,CAAC,QAAQ,CAAC,uCAAuC,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QAEnE,cAAc,CAAC,MAAM,EAAE,IAAI,CAAC,YAAY,EAAE,gBAAgB,EAAE,QAAQ,CAAC,CAAC;QAEtE,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,8BAA8B,CAC3D,qBAAqB,CAAC,IAAI,EAC1B,gBAAgB,CACjB,CAAC;QACF,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,IAAI,CACjD,WAAW,EACX,EAAE,GAAG,EAAE,MAAM,EAAE,EACf,OAAO,CACR,CAAC;QAEF,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,SAAS,EACnB,gBAAgB,EAChB;gBACE,sBAAsB,EAAE,2BAA2B,CAAC,cAAc;gBAClE,OAAO,EAAE;oBACP,MAAM,EAAE,wBAAwB;iBACjC;aACF,CACF,CAAC;QACJ,CAAC;QAED,+EAA+E;QAC/E,kEAAkE;QAClE,IAAI,CAAC;YACH,MAAM,eAAe,GAAG,IAAI,CAAC,yBAAyB,CAAC,WAAW,EAAE,gBAAgB,CAAC,CAAC;YACtF,MAAM,eAAe,CAAC,MAAM,CAAC,WAAW,EAAE,gBAAgB,CAAC,CAAC;QAC9D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,mBAAmB,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,SAAS,EAAE,CAAC;gBACtE,MAAM,KAAK,CAAC;YACd,CAAC;YAED,IAAI,CAAC,QAAQ,CAAC,2EAA2E,EAAE;gBACzF,MAAM;aACP,CAAC,CAAC;QACL,CAAC;QAED,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,8BAA8B,CAC7D,qBAAqB,CAAC,MAAM,EAC5B,gBAAgB,CACjB,CAAC;QACF,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,MAAM,CACrD,aAAa,EACb,EAAE,GAAG,EAAE,MAAM,EAAE,EACf,OAAO,CACR,CAAC;QAEF,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,QAAQ,EAClB,gBAAgB,EAChB;gBACE,sBAAsB,EAAE,2BAA2B,CAAC,QAAQ;gBAC5D,OAAO,EAAE;oBACP,OAAO,EAAE,4BAA4B;oBACrC,MAAM;iBACP;aACF,CACF,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,6CAA6C,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QACzE,OAAO,WAAW,CAAC;IACrB,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,oBAAoB,CACxB,YAA0B,EAC1B,UAAkB,EAClB,SAA6B,EAC7B,gBAAuC,EACvC,OAA2B;QAE3B,IAAI,CAAC,gBAAgB,EAAE,CAAC;YACtB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,QAAQ,EAClB,EAA2B,EAC3B;gBACE,sBAAsB,EAAE,2BAA2B,CAAC,QAAQ;gBAC5D,OAAO,EAAE;oBACP,OAAO,EAAE,wDAAwD;iBAClE;aACF,CACF,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,4BAA4B,EAAE,EAAE,YAAY,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC,CAAC;QAErF,2EAA2E;QAC3E,kBAAkB,CAAC,UAAU,EAAE,IAAI,CAAC,YAAY,EAAE,gBAAgB,EAAE,YAAY,CAAC,CAAC;QAClF,oBAAoB,CAAC,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,gBAAgB,EAAE,cAAc,CAAC,CAAC;QACxF,IAAI,SAAS,EAAE,CAAC;YACd,iBAAiB,CAAC,SAAS,EAAE,IAAI,CAAC,YAAY,EAAE,gBAAgB,EAAE,WAAW,CAAC,CAAC;QACjF,CAAC;QAED,kFAAkF;QAClF,2FAA2F;QAC3F,mGAAmG;QACnG,+FAA+F;QAC/F,6FAA6F;QAC7F,oGAAoG;QACpG,4FAA4F;QAC5F,sGAAsG;QACtG,oGAAoG;QACpG,oGAAoG;QACpG,qFAAqF;QACrF,MAAM,yBAAyB,GAAG,MAAM,IAAI,CAAC,qCAAqC,CAChF,YAAY,EACZ,UAAU,EACV,gBAAgB,EAChB,OAAO,CACR,CAAC;QACF,MAAM,YAAY,GAAG,IAAI,CAAC,6BAA6B,CAAC,YAAY,EAAE,gBAAgB,EAAE,yBAAyB,CAAC,CAAC;QACnH,MAAM,WAAW,GAAG,IAAI,CAAC,uBAAuB,CAAC,YAAY,CAAC,CAAC;QAC/D,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,UAAU,EACpB,gBAAgB,EAChB;gBACE,sBAAsB,EAAE,2BAA2B,CAAC,4BAA4B;aACjF,CACF,CAAC;QACJ,CAAC;QAED,eAAe;QACf,wEAAwE;QACxE,4EAA4E;QAC5E,mDAAmD;QACnD,MAAM,MAAM,GAAQ;YAClB,kBAAkB,EAAE,YAAY;YAChC,gBAAgB,EAAE,UAAU;YAC5B,MAAM,EAAE;gBACN,GAAG,EAAE,CAAC,UAAU,CAAC,MAAM,EAAE,UAAU,CAAC,QAAQ,EAAE,UAAU,CAAC,KAAK,CAAC;aAChE;YACD,GAAG,WAAW;SACf,CAAC;QAEF,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,CAAC,eAAe,GAAG,SAAS,CAAC;QACrC,CAAC;QAED,6DAA6D;QAC7D,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,8BAA8B,CAC/D,qBAAqB,CAAC,IAAI,EAC1B,gBAAgB,CACjB,CAAC;QAEF,kFAAkF;QAClF,qEAAqE;QACrE,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,IAAI,CAC3C,eAAe,EACf,MAAM,EACN,OAAO,CACR,CAAC;QAEF,oGAAoG;QACpG,wGAAwG;QACxG,sGAAsG;QACtG,mGAAmG;QACnG,mGAAmG;QACnG,iFAAiF;QACjF,MAAM,eAAe,GAAW,EAAE,CAAC;QACnC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,IAAI,EAAE,gBAAgB,EAAE;gBACvE,aAAa,EAAE,YAAY,CAAC,aAAa;gBACzC,cAAc,EAAE,YAAY,CAAC,cAAc;gBAC3C,MAAM,EAAE,YAAY,CAAC,MAAM;aAC5B,CAAC,CAAC;YACH,IAAI,SAAS,EAAE,CAAC;gBACd,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC7B,CAAC;QACH,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,mCAAmC,EAAE,EAAE,YAAY,EAAE,UAAU,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE,UAAU,EAAE,eAAe,CAAC,MAAM,EAAE,CAAC,CAAC;QAC1I,OAAO,eAAe,CAAC;IACzB,CAAC;IAED;;;;;;;;;;;;;OAaG;IACH,KAAK,CAAC,mBAAmB,CACvB,IAAU,EACV,gBAAuC;IACvC;;;;;;;;;OASG;IACH,0BAAiG;QAEjG,MAAM,WAAW,GAAG,0BAA0B,IAAI,IAAI,CAAC,iBAAiB,CAAC,gBAAgB,CAAC,CAAC;QAE3F,6EAA6E;QAC7E,6EAA6E;QAC7E,uCAAuC;QACvC,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;YACvB,IAAI,CAAC,IAAI,CAAC,cAAc,IAAI,CAAC,WAAW,CAAC,cAAc,EAAE,CAAC;gBACxD,IAAI,CAAC,QAAQ,CAAC,mEAAmE,EAAE;oBACjF,kBAAkB,EAAE,IAAI,CAAC,cAAc;oBACvC,qBAAqB,EAAE,WAAW,CAAC,cAAc;iBAClD,CAAC,CAAC;gBACH,OAAO,KAAK,CAAC;YACf,CAAC;YAED,IAAI,IAAI,CAAC,cAAc,KAAK,WAAW,CAAC,cAAc,EAAE,CAAC;gBACvD,IAAI,CAAC,QAAQ,CAAC,oDAAoD,EAAE;oBAClE,kBAAkB,EAAE,IAAI,CAAC,cAAc;oBACvC,qBAAqB,EAAE,WAAW,CAAC,cAAc;iBAClD,CAAC,CAAC;gBACH,OAAO,KAAK,CAAC;YACf,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,4BAA4B;QAC5B,QAAQ,IAAI,CAAC,YAAY,EAAE,CAAC;YAC1B,KAAK,oBAAoB,CAAC,WAAW;gBACnC,IAAI,CAAC,IAAI,CAAC,aAAa,IAAI,IAAI,CAAC,aAAa,KAAK,WAAW,CAAC,aAAa,EAAE,CAAC;oBAC5E,IAAI,CAAC,QAAQ,CAAC,0CAA0C,EAAE;wBACxD,iBAAiB,EAAE,IAAI,CAAC,aAAa;wBACrC,oBAAoB,EAAE,WAAW,CAAC,aAAa;qBAChD,CAAC,CAAC;oBACH,OAAO,KAAK,CAAC;gBACf,CAAC;gBACD,OAAO,IAAI,CAAC;YAEd,KAAK,oBAAoB,CAAC,aAAa;gBACrC,4DAA4D;gBAC5D,IAAI,IAAI,CAAC,cAAc,KAAK,WAAW,CAAC,cAAc,EAAE,CAAC;oBACvD,IAAI,CAAC,QAAQ,CAAC,2CAA2C,EAAE;wBACzD,kBAAkB,EAAE,IAAI,CAAC,cAAc;wBACvC,qBAAqB,EAAE,WAAW,CAAC,cAAc;qBAClD,CAAC,CAAC;oBACH,OAAO,KAAK,CAAC;gBACf,CAAC;gBACD,OAAO,IAAI,CAAC;YAEd,KAAK,oBAAoB,CAAC,SAAS;gBACjC,gFAAgF;gBAChF,oFAAoF;gBACpF,iFAAiF;gBACjF,sDAAsD;gBACtD,IAAI,IAAI,CAAC,MAAM,KAAK,WAAW,CAAC,MAAM,EAAE,CAAC;oBACvC,IAAI,CAAC,QAAQ,CAAC,mCAAmC,EAAE;wBACjD,UAAU,EAAE,IAAI,CAAC,MAAM;wBACvB,aAAa,EAAE,WAAW,CAAC,MAAM;qBAClC,CAAC,CAAC;oBACH,OAAO,KAAK,CAAC;gBACf,CAAC;gBACD,OAAO,IAAI,CAAC;YAEd;gBACE,8BAA8B;gBAC9B,IAAI,CAAC,QAAQ,CAAC,0CAA0C,EAAE;oBACxD,YAAY,EAAE,IAAI,CAAC,YAAY;iBAChC,CAAC,CAAC;gBACH,OAAO,KAAK,CAAC;QACjB,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACH,kBAAkB,CAAC,IAAU;QAkB3B,+DAA+D;QAC/D,8EAA8E;QAC9E,MAAM,MAAM,GAAuB,IAAI,CAAC,MAA4B,IAAI,wBAAwB,CAAC,SAAS,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QAE3H,OAAO;YACL,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,QAAQ,EAAE,IAAI,CAAC,gBAAgB,IAAI,IAAI,CAAC,QAAQ;YAChD,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,MAAM;YACN,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,oBAAoB,EAAE,IAAI,CAAC,oBAAoB;SAChD,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACO,iBAAiB,CAAC,gBAAuC;QAKjE,MAAM,cAAc,GAAG,IAAI,CAAC,uBAAuB,CAAC,cAAc,CAAC,gBAAgB,EAAE,cAAc,CAAC,CAAC;QACrG,MAAM,MAAM,GAAG,IAAI,CAAC,uBAAuB,CAAC,cAAc,CAAC,gBAAgB,EAAE,MAAM,CAAC,CAAC;QACrF,8EAA8E;QAC9E,kFAAkF;QAClF,gFAAgF;QAChF,kFAAkF;QAClF,6EAA6E;QAC7E,MAAM,aAAa,GAAG,gBAAgB,CAAC,aAAa,IAAI,IAAI,CAAC,gBAAgB,CAAC,aAAa,CAAC;QAE5F,OAAO;YACL,aAAa;YACb,cAAc;YACd,MAAM;SACP,CAAC;IACJ,CAAC;IAED;;;OAGG;IACO,0BAA0B,CAAC,gBAAuC;QAC1E,MAAM,WAAW,GAAG,IAAI,CAAC,iBAAiB,CAAC,gBAAgB,CAAC,CAAC;QAC7D,MAAM,aAAa,GAA8B,EAAE,CAAC;QAEpD,IAAI,WAAW,CAAC,aAAa,EAAE,CAAC;YAC9B,aAAa,CAAC,IAAI,CAAC;gBACjB,YAAY,EAAE,oBAAoB,CAAC,WAAW;gBAC9C,aAAa,EAAE,WAAW,CAAC,aAAa;aACzC,CAAC,CAAC;QACL,CAAC;QAED,IAAI,WAAW,CAAC,cAAc,EAAE,CAAC;YAC/B,8EAA8E;YAC9E,aAAa,CAAC,IAAI,CAAC;gBACjB,cAAc,EAAE,WAAW,CAAC,cAAc;aAC3C,CAAC,CAAC;QACL,CAAC;QAED,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC/B,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,aAAa,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,aAAa,EAAE,CAAC;IAChF,CAAC;IAES,uBAAuB,CAAC,KAA2B;QAC3D,QAAQ,KAAK,CAAC,YAAY,EAAE,CAAC;YAC3B,KAAK,oBAAoB,CAAC,WAAW;gBACnC,OAAO,KAAK,CAAC,aAAa;oBACxB,CAAC,CAAC;wBACE,YAAY,EAAE,oBAAoB,CAAC,WAAW;wBAC9C,aAAa,EAAE,KAAK,CAAC,aAAa;qBACnC;oBACH,CAAC,CAAC,IAAI,CAAC;YACX,KAAK,oBAAoB,CAAC,aAAa;gBACrC,OAAO,KAAK,CAAC,cAAc;oBACzB,CAAC,CAAC;wBACE,cAAc,EAAE,KAAK,CAAC,cAAc;qBACrC;oBACH,CAAC,CAAC,IAAI,CAAC;YACX,KAAK,oBAAoB,CAAC,SAAS;gBACjC,qFAAqF;gBACrF,OAAO,KAAK,CAAC,MAAM;oBACjB,CAAC,CAAC;wBACE,YAAY,EAAE,oBAAoB,CAAC,SAAS;wBAC5C,MAAM,EAAE,KAAK,CAAC,MAAM;qBACrB;oBACH,CAAC,CAAC,IAAI,CAAC;YACX;gBACE,OAAO,IAAI,CAAC;QAChB,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;;;;;;OAiBG;IACK,KAAK,CAAC,qCAAqC,CACjD,YAA0B,EAC1B,UAAkB,EAClB,gBAAuC,EACvC,OAA2B;QAE3B,MAAM,YAAY,GAChB,IAAI,CAAC,iBAAiB,CAAC,wBAAwB,CAAC,YAAY,CAAC,EAAE,oBAAoB;eAChF,oBAAoB,CAAC,aAAa,CAAC;QAExC,MAAM,WAAW,GAAG,IAAI,CAAC,iBAAiB,CAAC,gBAAgB,CAAC,CAAC;QAC7D,MAAM,qBAAqB,GACzB,YAAY,KAAK,oBAAoB,CAAC,WAAW;eAC9C,CAAC,YAAY,KAAK,oBAAoB,CAAC,SAAS,IAAI,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC;eACzE,CAAC,YAAY,KAAK,oBAAoB,CAAC,aAAa,IAAI,CAAC,CAAC,WAAW,CAAC,cAAc,CAAC,CAAC;QAC3F,IAAI,qBAAqB,EAAE,CAAC;YAC1B,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,MAAM,UAAU,GAAG,IAAI,CAAC,oBAAoB,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC;QACzE,IAAI,CAAC,UAAU,EAAE,iBAAiB,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE,CAAC;YAC/D,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,IAAI,CAA0B,gBAAgB,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC;YAClG,OAAO,GAAG,IAAI,SAAS,CAAC;QAC1B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;;;OAcG;IACO,6BAA6B,CACrC,YAA0B,EAC1B,gBAAuC;IACvC;;;;;OAKG;IACH,iBAA2C;QAE3C,6DAA6D;QAC7D,MAAM,cAAc,GAAG,IAAI,CAAC,iBAAiB,CAAC,wBAAwB,CAAC,YAAY,CAAC,CAAC;QAErF,+CAA+C;QAC/C,4CAA4C;QAC5C,MAAM,YAAY,GAAG,cAAc,EAAE,oBAAoB,IAAI,oBAAoB,CAAC,aAAa,CAAC;QAEhG,MAAM,WAAW,GAAG,IAAI,CAAC,iBAAiB,CAAC,gBAAgB,CAAC,CAAC;QAE7D,8FAA8F;QAC9F,iGAAiG;QACjG,+FAA+F;QAC/F,MAAM,uBAAuB,GAAG,iCAAiC,CAAC,YAAY,CAAC,CAAC;QAChF,MAAM,WAAW,GAAG,iBAAiB,EAAE,CAAC,uBAAuB,CAAC,CAAC;QACjE,MAAM,aAAa,GAAG,WAAW,IAAI,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAE5E,QAAQ,YAAY,EAAE,CAAC;YACrB,KAAK,oBAAoB,CAAC,WAAW;gBACnC,IAAI,CAAC,WAAW,CAAC,aAAa,EAAE,CAAC;oBAC/B,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,UAAU,EACpB,gBAAgB,EAChB;wBACE,sBAAsB,EAAE,2BAA2B,CAAC,6BAA6B;wBACjF,OAAO,EAAE;4BACP,YAAY,EAAE,wBAAwB;yBACvC;qBACF,CACF,CAAC;gBACJ,CAAC;gBACD,OAAO;oBACL,YAAY,EAAE,oBAAoB,CAAC,WAAW;oBAC9C,aAAa,EAAE,WAAW,CAAC,aAAa;iBACzC,CAAC;YAEJ,KAAK,oBAAoB,CAAC,aAAa,CAAC,CAAC,CAAC;gBACxC,4FAA4F;gBAC5F,MAAM,cAAc,GAAG,WAAW,CAAC,cAAc,IAAI,aAAa,CAAC;gBACnE,IAAI,CAAC,cAAc,EAAE,CAAC;oBACpB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,UAAU,EACpB,gBAAgB,EAChB;wBACE,sBAAsB,EAAE,2BAA2B,CAAC,6BAA6B;wBACjF,OAAO,EAAE;4BACP,YAAY,EAAE,wBAAwB;yBACvC;qBACF,CACF,CAAC;gBACJ,CAAC;gBACD,IAAI,CAAC,WAAW,CAAC,aAAa,EAAE,CAAC;oBAC/B,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,UAAU,EACpB,gBAAgB,EAChB;wBACE,sBAAsB,EAAE,2BAA2B,CAAC,6BAA6B;wBACjF,OAAO,EAAE;4BACP,YAAY,EAAE,wBAAwB;yBACvC;qBACF,CACF,CAAC;gBACJ,CAAC;gBACD,OAAO;oBACL,YAAY,EAAE,oBAAoB,CAAC,aAAa;oBAChD,aAAa,EAAE,WAAW,CAAC,aAAa;oBACxC,cAAc;iBACf,CAAC;YACJ,CAAC;YAED,KAAK,oBAAoB,CAAC,SAAS,CAAC,CAAC,CAAC;gBACpC,gFAAgF;gBAChF,6EAA6E;gBAC7E,6EAA6E;gBAC7E,yFAAyF;gBACzF,+EAA+E;gBAC/E,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,IAAI,aAAa,CAAC;gBACnD,IAAI,CAAC,MAAM,EAAE,CAAC;oBACZ,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,UAAU,EACpB,gBAAgB,EAChB;wBACE,sBAAsB,EAAE,2BAA2B,CAAC,6BAA6B;wBACjF,OAAO,EAAE;4BACP,YAAY,EAAE,wBAAwB;yBACvC;qBACF,CACF,CAAC;gBACJ,CAAC;gBACD,IAAI,CAAC,WAAW,CAAC,aAAa,EAAE,CAAC;oBAC/B,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,UAAU,EACpB,gBAAgB,EAChB;wBACE,sBAAsB,EAAE,2BAA2B,CAAC,6BAA6B;wBACjF,OAAO,EAAE;4BACP,YAAY,EAAE,wBAAwB;yBACvC;qBACF,CACF,CAAC;gBACJ,CAAC;gBACD,OAAO;oBACL,YAAY,EAAE,oBAAoB,CAAC,SAAS;oBAC5C,aAAa,EAAE,WAAW,CAAC,aAAa;oBACxC,MAAM;iBACP,CAAC;YACJ,CAAC;YAED;gBACE,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,aAAa,EACvB,gBAAgB,EAChB;oBACE,sBAAsB,EAAE,2BAA2B,CAAC,aAAa;oBACjE,OAAO,EAAE;wBACP,OAAO,EAAE,yFAAyF;wBAClG,YAAY;wBACZ,YAAY;qBACb;iBACF,CACF,CAAC;QACN,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACK,gBAAgB,CAAC,QAAgB;QACvC,MAAM,OAAO,GAAG,QAAQ,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QAC1C,IAAI,OAAO,KAAK,CAAC,CAAC,IAAI,OAAO,KAAK,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtD,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,OAAO,QAAQ,CAAC,SAAS,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;IACvD,CAAC;CACF,CAAA;AAh/DY,mBAAmB;IAD/B,UAAU,EAAE;IAKR,WAAA,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAA;IAEjC,WAAA,MAAM,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,CAAA;IAE9C,WAAA,MAAM,CAAC,kBAAkB,CAAC,uBAAuB,CAAC,CAAA;IAElD,WAAA,MAAM,CAAC,kBAAkB,CAAC,kCAAkC,CAAC,CAAA;IAE7D,WAAA,MAAM,CAAC,kBAAkB,CAAC,qCAAqC,CAAC,CAAA;IAEhE,WAAA,MAAM,CAAC,kBAAkB,CAAC,8BAA8B,CAAC,CAAA;IAEzD,WAAA,MAAM,CAAC,kBAAkB,CAAC,iBAAiB,CAAC,CAAA;IAE5C,WAAA,MAAM,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,CAAA;IAE3C,WAAA,MAAM,CAAC,kBAAkB,CAAC,oCAAoC,CAAC,CAAA;IAC/D,WAAA,QAAQ,EAAE,CAAA;IAOV,WAAA,MAAM,CAAC,kBAAkB,CAAC,8BAA8B,CAAC,CAAA;IACzD,WAAA,QAAQ,EAAE,CAAA;IAEV,YAAA,MAAM,CAAC,kBAAkB,CAAC,oBAAoB,CAAC,CAAA;IAC/C,YAAA,QAAQ,EAAE,CAAA;+CAzBoB,0BAA0B;QAErB,+BAA+B;QAE5B,yCAAyC;QAEtC,qCAAqC;QAErC,qCAAqC;QAE3C,+BAA+B;QAEhC,uBAAuB;QAGT,2CAA2C;GAtBnF,mBAAmB,CAg/D/B","sourcesContent":["/**\n * Files Backend Service\n *\n * Manages file metadata and coordinates with storage providers (MinIO/S3).\n * Files are stored in external storage, this service tracks metadata in MongoDB.\n *\n * Features:\n * - File upload coordination\n * - File metadata management\n * - File linking to resources\n * - File access authorization\n * - File lifecycle management (status tracking)\n */\n\nimport { injectable, inject, optional } from 'inversify';\nimport type { Response, NextFunction } from 'express';\nimport type { Readable } from 'stream';\nimport { CoreResourceOperation, CoreResourceType, ResourceType, ErrorType, ErrorCustomMessageReference, FileUploaderEntityType, type FileUploaderOwnership, ResourcePrimaryScope, PRIMARY_SCOPE_TO_FIELD_IDENTIFIER, CORE_APP_ROLES, Resources_SharedUtils, isWildoBackendError, WildoHeaderKeys } from '@wildo-ai/saas-models';\nimport { File, FileStatus, FILE_STATUS_TRANSITIONS, FileScopeIdentifiers, FileScopeUtils, FileServeVariant, ERASED_FILE_NAME_PLACEHOLDER } from '@wildo-ai/saas-models';\nimport { resolveFileDisplayNature, type FileDisplayNature, type FileStorageAccepted } from '@wildo-ai/zod-decorators';\nimport { SAAS_SERVICE_TYPES } from '~wildo-backend-lib/inject/models/service-types';\nimport type { LoggerService } from '~wildo-backend-lib/monitoring/logger/services/logger.service';\nimport { ErrorBuilderBackendService } from '~wildo-backend-lib/errors/services/error-builder.backend.service';\nimport { describeCaughtError, projectCaughtErrorLogFields } from '~wildo-backend-lib/errors/utils/error-log-level-classification.backend.utils';\nimport { ResourcesRegistryBackendService } from '~wildo-backend-lib/resources/services/resources-registry.backend.service';\nimport { ExecutionContext } from '~wildo-backend-lib/runtime/models/execution-context.backend.schemas';\nimport { ExecutionContextCreatorBackendService } from '~wildo-backend-lib/runtime/services/execution-context-creator.backend.service';\nimport { ResourceOperationHelperBackendService } from '~wildo-backend-lib/base-classes/services/resource-operations-helper.backend.service';\nimport type { BackendResourceRepository } from '~wildo-backend-lib/base-classes/services/repositories/repositories-registry-handler.backend.service';\nimport { RepositoriesRegistryHandlerBackendService } from '~wildo-backend-lib/base-classes/services/repositories/repositories-registry-handler.backend.service';\nimport { RepositoryOptions } from '~wildo-backend-lib/base-classes/models/repositories.backend.schemas';\nimport { validateFileId, validateResourceId, validateResourceType, validateFieldName, validateSize, validateUploadedBy, validateUploadedByEntityType, validateOrganizationId, validateContentType, resolveConfiguredMaxFileSize, validateStream } from '~wildo-backend-lib/files/utils/file-validation.utils';\nimport { setContentDispositionHeader } from '~wildo-backend-lib/files/utils/file-upload.utils';\nimport { resolveFileUploaderPrincipal } from '~wildo-backend-lib/files/utils/file-uploader.utils';\nimport { generateImageThumbnail, collectStreamToBuffer, isThumbnailableImage, THUMBNAIL_SOURCE_MAX_BYTES } from '~wildo-backend-lib/files/utils/image-thumbnail.backend.utils';\nimport { AppConfigurationService } from '~wildo-backend-lib/config/services/app-configuration.backend.service';\nimport { FileStorageRouterBackendService } from '~wildo-backend-lib/files/storage/file-storage-router.backend.service';\nimport type { IFileStorageProvider, StorageUploadResult } from '~wildo-backend-lib/files/storage/file-storage-provider.types';\nimport { ResourcePersistenceUnitOfWorkBackendService } from '~wildo-backend-lib/databases/services/resource-persistence-unit-of-work.backend.service';\nimport type { ResourcePersistenceResourceStore } from '~wildo-backend-lib/databases/services/resource-persistence-unit-of-work.backend.service';\nimport type { RagSourceFieldDetectionBackendService } from '~wildo-backend-lib/files/services/rag-source-field-detection.backend.service';\nimport type { RagChunkStoreBackendService } from '~wildo-backend-lib/rag/services/rag-chunk-store.backend.service';\nimport { scheduleRagChunkRemovalForFields } from '~wildo-backend-lib/rag/utils/rag-chunk-removal.backend.utils';\n\n/**\n * Content-Security-Policy applied to EVERY file-byte response (see\n * `FilesBackendService.streamFileToResponse`). `default-src 'none'` blocks all\n * subresource loads + inline/script execution; `sandbox` (with NO `allow-*`\n * tokens) drops the response into a fully-restricted sandbox if it is navigated\n * to directly at the top level — so an attacker-uploaded HTML/SVG can never run\n * script, submit a form, or navigate. Media loaded via `<img>`/`<video>` is\n * unaffected: those are governed by the EMBEDDING page's CSP, not this response's.\n * Same pattern GitHub/Dropbox use for user-uploaded content.\n */\nconst FILE_SERVE_CONTENT_SECURITY_POLICY = \"default-src 'none'; sandbox\";\n\n/**\n * Media types that must NEVER be served `inline`, even when a preview is\n * requested, because a browser parses them into an ACTIVE document context that\n * can execute script (the classic stored-XSS-via-upload vector). They are forced\n * to `attachment` (download) instead. Safe media (`image/*` except SVG, `video/*`,\n * `audio/*`, `application/pdf`) keep the requested `inline` disposition.\n * Matched against the leading media type only (`; charset=…` params ignored).\n */\nconst DANGEROUS_INLINE_CONTENT_TYPES = new Set<string>([\n  'text/html',\n  'application/xhtml+xml',\n  'image/svg+xml',\n]);\n\n/** True when `contentType` must not be rendered inline (see the set above). */\nfunction isDangerousInlineContentType(contentType: string | undefined): boolean {\n  if (!contentType) return false;\n  const mediaType = contentType.split(';', 1)[0]!.trim().toLowerCase();\n  return DANGEROUS_INLINE_CONTENT_TYPES.has(mediaType);\n}\n\n/**\n * Cache policy for a generated thumbnail response: `private` (auth-gated bytes —\n * never a shared/CDN cache), fresh for a day, and `immutable` because a thumbnail is\n * fully determined by the file's id + version. The response ETag encodes both, so a\n * client holding a still-fresh thumbnail never revalidates; replacing the underlying\n * image bumps `updatedAt`, which changes the ETag and busts the cache. Applied ONLY\n * to the thumbnail path — the original-bytes path relies on the storage\n * ETag/Last-Modified it already forwards.\n */\nconst THUMBNAIL_CACHE_CONTROL = 'private, max-age=86400, immutable';\n\n@injectable()\nexport class FilesBackendService {\n  protected logDebug: (message: string, context?: Record<string, unknown>) => void;\n\n  constructor(\n    @inject(SAAS_SERVICE_TYPES.Logger)\n    private readonly logger: LoggerService,\n    @inject(SAAS_SERVICE_TYPES.ErrorBuilderService)\n    private readonly errorBuilder: ErrorBuilderBackendService,\n    @inject(SAAS_SERVICE_TYPES.ResourceRegistryService)\n    private readonly resourcesRegistry: ResourcesRegistryBackendService,\n    @inject(SAAS_SERVICE_TYPES.RepositoriesRegistryHandlerService)\n    private readonly repositoriesRegistry: RepositoriesRegistryHandlerBackendService,\n    @inject(SAAS_SERVICE_TYPES.ExecutionContextCreatorBackendService)\n    private readonly executionContextCreator: ExecutionContextCreatorBackendService,\n    @inject(SAAS_SERVICE_TYPES.ResourceOperationHelperService)\n    private readonly resourceOperationHelper: ResourceOperationHelperBackendService,\n    @inject(SAAS_SERVICE_TYPES.FileStorageRouter)\n    private readonly fileStorageRouter: FileStorageRouterBackendService,\n    @inject(SAAS_SERVICE_TYPES.AppConfigService)\n    private readonly appConfigService: AppConfigurationService,\n    @inject(SAAS_SERVICE_TYPES.ResourcePersistenceUnitOfWorkService)\n    @optional()\n    private readonly resourcePersistenceUnitOfWork?: ResourcePersistenceUnitOfWorkBackendService,\n    // RAG derived-data tier (plan D3): file link/unlink/delete/erase mutate WHICH file backs a\n    // FILE_EXTRACTION `.ragSource()` field, so the affected field's chunk set is removed in the same\n    // decision (seam helper below). `@optional()` keeps minimal test containers constructing — the\n    // seams no-op without the pair, and the startup capability probe owns refusing a real\n    // application whose RAG-source resources have no usable store.\n    @inject(SAAS_SERVICE_TYPES.RagSourceFieldDetectionService)\n    @optional()\n    private readonly ragSourceFieldDetection?: RagSourceFieldDetectionBackendService,\n    @inject(SAAS_SERVICE_TYPES.RagChunkStoreService)\n    @optional()\n    private readonly ragChunkStore?: RagChunkStoreBackendService,\n  ) {\n    this.logDebug = this.logger.debugByType('FilesBackendService');\n    this.logger.setDebugTypeLogging('FilesBackendService', false);\n\n    this.logDebug('FilesBackendService initialized');\n  }\n\n  /**\n   * Get the files repository for internal operations.\n   * Lazy getter to ensure repository is initialized.\n   */\n  private get filesRepository(): BackendResourceRepository<any, any, any> {\n    return this.repositoriesRegistry.getRepositoryOrThrow(CoreResourceType.FILES, {} as ExecutionContext<any>);\n  }\n\n  private getDefaultStorageProvider(): IFileStorageProvider {\n    return this.fileStorageRouter.getDefaultProvider();\n  }\n\n  public getStorageProviderForFile(\n    file: Pick<File, 'fileId' | 'storageProvider' | 'storageRef'>,\n    executionContext: ExecutionContext<any>,\n  ): IFileStorageProvider {\n    if (!file.storageProvider) {\n      this.logDebug('Falling back to default storage provider for legacy file row', {\n        fileId: file.fileId,\n      });\n      return this.getDefaultStorageProvider();\n    }\n\n    const provider = this.fileStorageRouter.getProviderById(file.storageProvider);\n    if (!provider) {\n      throw this.errorBuilder.buildError(\n        ErrorType.INTERNAL,\n        executionContext,\n        {\n          customMessageReference: ErrorCustomMessageReference.INTERNAL,\n          context: {\n            message: 'No registered storage provider matches the persisted file routing',\n            fileId: file.fileId,\n            storageProvider: file.storageProvider,\n          },\n        }\n      );\n    }\n\n    return provider;\n  }\n\n  /**\n   * Stream a file's bytes from its storage provider to an Express response.\n   *\n   * Shared streaming seam used by BOTH the global `FileController` download route\n   * and the resource-integrated file **serve** route. Callers own authorization\n   * BEFORE invoking this (the global controller via file-scope/token checks; the\n   * resource serve route via the parent resource's READ authorization + a\n   * link-ownership assertion) — this method performs NO authorization, it only\n   * pipes bytes and manages the stream/response lifecycle.\n   *\n   * Sets Content-Type / Content-Length / ETag / Last-Modified from the storage\n   * download result, and Content-Disposition from `disposition` (`inline` for\n   * preview surfaces like avatars/PDFs, `attachment` for forced downloads).\n   * Registers stream/response error + close handlers before piping so an\n   * immediate storage error is caught and the source stream is always destroyed\n   * on client disconnect.\n   *\n   * @param file - The file record (already fetched + authorized by the caller).\n   * @param res - Express response to pipe into.\n   * @param executionContext - Context for storage-provider resolution/errors.\n   * @param options.disposition - `inline` (default) or `attachment`.\n   * @param options.next - Express `next` to forward pre-header stream errors.\n   * @param options.variant - `original` (default) streams the stored bytes as-is;\n   *   `thumbnail` delegates to `serveImageThumbnail` for eligible raster images.\n   *   Non-images, oversized sources, and resize failures transparently fall through\n   *   to the original-bytes streaming path — a preview request never hard-fails.\n   */\n  public async streamFileToResponse(\n    file: File,\n    res: Response,\n    executionContext: ExecutionContext<any> | undefined,\n    options?: { disposition?: 'inline' | 'attachment'; next?: NextFunction; variant?: FileServeVariant },\n  ): Promise<void> {\n    const disposition = options?.disposition ?? 'inline';\n    const next = options?.next;\n    const variant = options?.variant ?? FileServeVariant.ORIGINAL;\n\n    // ── THUMBNAIL VARIANT — a preview surface asked for a downscaled rendition.\n    // Only raster images within the memory-safe size ceiling are transformed; every\n    // other case (non-image, oversized, or a resize failure inside\n    // `serveImageThumbnail`) serves the ORIGINAL bytes via the streaming path below.\n    // Gated on the RECORDED `mimeType`/`size` so the decision costs no storage round-trip.\n    const canThumbnail =\n      variant === FileServeVariant.THUMBNAIL &&\n      isThumbnailableImage(file.mimeType) &&\n      (file.size ?? 0) > 0 &&\n      (file.size ?? 0) <= THUMBNAIL_SOURCE_MAX_BYTES;\n    if (canThumbnail) {\n      await this.serveImageThumbnail(file, res, executionContext, next);\n      return;\n    }\n\n    this.logDebug('Streaming file to response', { fileId: file.fileId, disposition });\n\n    let stream: Readable | null = null;\n\n    try {\n      const storageProvider = this.getStorageProviderForFile(file, executionContext as any);\n      const downloadResult = await storageProvider.download(file, executionContext as any);\n      stream = downloadResult.stream;\n\n      // Validate stream before use (ensures stream is readable and not destroyed).\n      validateStream(stream, this.errorBuilder, executionContext as any, 'downloadStream');\n\n      // Storage metadata is more accurate than the DB copy for transport headers.\n      if (res.headersSent) {\n        this.logger.warn('Response headers already sent, cannot set file response headers', {\n          fileId: file.fileId,\n        });\n      } else {\n        const contentType = downloadResult.contentType || file.mimeType;\n        res.setHeader(WildoHeaderKeys.CONTENT_TYPE, contentType);\n\n        // ── SECURITY (untrusted bytes) — file content is user-uploaded and must\n        // NEVER be able to execute as stored XSS. Two always-on response defenses:\n        //   1. `X-Content-Type-Options: nosniff` — the browser must honour the\n        //      declared Content-Type and not MIME-sniff a body into executable HTML.\n        //   2. file-serve CSP (`default-src 'none'; sandbox`) — even a directly\n        //      navigated HTML/SVG runs no script (see the const's doc above).\n        // These are cheap, unconditional, and safe for legitimate media.\n        // Standard lowercase HTTP header names, set as literals here (rather than via\n        // the cross-package WildoHeaderKeys registry) to keep this untrusted-bytes\n        // serving seam self-contained — see the `FILE_SERVE_CONTENT_SECURITY_POLICY` doc.\n        res.setHeader('x-content-type-options', 'nosniff');\n        res.setHeader('content-security-policy', FILE_SERVE_CONTENT_SECURITY_POLICY);\n\n        const contentLength = downloadResult.size > 0 ? downloadResult.size : (file.size || 0);\n        if (contentLength > 0) {\n          res.setHeader(WildoHeaderKeys.CONTENT_LENGTH, contentLength.toString());\n        }\n\n        // ── SECURITY (disposition) — a `preview` (inline) request is only honoured\n        // for SAFE media; script-capable types (html/xhtml/svg) are forced to\n        // `attachment` so the browser downloads rather than renders them in a\n        // document context. Belt-and-braces with nosniff + CSP above.\n        const effectiveDisposition =\n          disposition === 'inline' && isDangerousInlineContentType(contentType)\n            ? 'attachment'\n            : disposition;\n        const filename = file.originalFilename || file.fileId || 'file';\n        setContentDispositionHeader(res, filename, effectiveDisposition);\n\n        // ETag / Last-Modified are standard HTTP headers (not platform headers).\n        if (downloadResult.etag) {\n          res.setHeader(WildoHeaderKeys.ETAG, downloadResult.etag);\n        }\n        if (downloadResult.lastModified) {\n          res.setHeader(WildoHeaderKeys.LAST_MODIFIED, downloadResult.lastModified.toUTCString());\n        }\n      }\n\n      // Register error handlers BEFORE piping so immediate errors are caught.\n      stream.on('error', (error) => {\n        this.logger.error('Stream error while serving file from storage', {\n          fileId: file.fileId,\n          ...projectCaughtErrorLogFields(error),\n        });\n        if (!res.headersSent) {\n          if (next) {\n            next(error);\n            return;\n          }\n          res.status(500).end();\n        } else if (stream && !stream.destroyed) {\n          stream.destroy();\n        }\n      });\n\n      res.on('error', (error) => {\n        this.logger.error('Response error while streaming file', {\n          fileId: file.fileId,\n          ...projectCaughtErrorLogFields(error),\n        });\n        if (stream && !stream.destroyed) {\n          stream.destroy();\n        }\n      });\n\n      // Client disconnect / response finished → destroy the source stream.\n      res.on('close', () => {\n        if (stream && !stream.destroyed) {\n          stream.destroy();\n        }\n      });\n\n      stream.pipe(res);\n    } catch (error) {\n      if (stream && !stream.destroyed) {\n        try {\n          stream.destroy();\n        } catch (destroyError) {\n          this.logger.warn('Failed to destroy stream during error cleanup', {\n            fileId: file.fileId,\n            ...projectCaughtErrorLogFields(destroyError),\n            originalError: describeCaughtError(error),\n          });\n        }\n      }\n\n      this.logger.error('Failed to stream file from storage', {\n        fileId: file.fileId,\n        ...projectCaughtErrorLogFields(error),\n      });\n      throw error;\n    }\n  }\n\n  /**\n   * Serve a downscaled `webp` thumbnail of a raster image — the `?variant=thumbnail`\n   * path of {@link streamFileToResponse}.\n   *\n   * Unlike the original-bytes path, this BUFFERS the source in memory to hand it to\n   * libvips. Callers MUST gate on {@link isThumbnailableImage} + a size ceiling\n   * before delegating here (see `streamFileToResponse`). On any resize failure the\n   * ORIGINAL bytes (already buffered) are returned with their real content-type, so a\n   * corrupt/edge-case image degrades to \"full image\" rather than a 500.\n   *\n   * Applies the SAME untrusted-bytes hardening as the streaming path (`nosniff` +\n   * file-serve CSP) plus an immutable, version-keyed cache policy so the resize cost\n   * is paid at most once per (file, version) per client.\n   *\n   * @param file - The image file record (already fetched + authorized by the caller).\n   * @param res - Express response to write the encoded thumbnail into.\n   * @param executionContext - Context for storage-provider resolution/errors.\n   * @param next - Express `next` to forward pre-header errors to the error middleware.\n   */\n  private async serveImageThumbnail(\n    file: File,\n    res: Response,\n    executionContext: ExecutionContext<any> | undefined,\n    next: NextFunction | undefined,\n  ): Promise<void> {\n    this.logDebug('Serving image thumbnail', { fileId: file.fileId, size: file.size });\n\n    try {\n      const storageProvider = this.getStorageProviderForFile(file, executionContext as any);\n      const downloadResult = await storageProvider.download(file, executionContext as any);\n      const stream = downloadResult.stream;\n      validateStream(stream, this.errorBuilder, executionContext as any, 'thumbnailSourceStream');\n\n      // BUFFER the full source (this path can't stream — libvips needs the bytes).\n      // The cap is a defensive backstop; the caller already pre-filtered on file.size.\n      const sourceBuffer = await collectStreamToBuffer(stream, THUMBNAIL_SOURCE_MAX_BYTES);\n      const thumbnail = await generateImageThumbnail(sourceBuffer);\n\n      if (res.headersSent) {\n        this.logger.warn('Response headers already sent, cannot serve thumbnail', {\n          fileId: file.fileId,\n        });\n        return;\n      }\n\n      // Resize failure → serve the ORIGINAL bytes we already hold (degrade to full\n      // image, never a 500). Only reachable for raster images (caller-gated).\n      const body = thumbnail ? thumbnail.data : sourceBuffer;\n      const contentType = thumbnail\n        ? thumbnail.contentType\n        : downloadResult.contentType || file.mimeType;\n      if (!thumbnail) {\n        this.logger.warn('Thumbnail generation failed; serving original image bytes', {\n          fileId: file.fileId,\n          mimeType: file.mimeType,\n        });\n      }\n\n      // ── SECURITY (untrusted bytes) — identical to the streaming path: honour the\n      // declared type (nosniff) and neutralise any directly-navigated document\n      // (file-serve CSP). A generated webp is inert; the original-bytes fallback is a\n      // raster image, so `inline` is always safe here (html/svg never reach this method).\n      res.setHeader(WildoHeaderKeys.CONTENT_TYPE, contentType);\n      res.setHeader('x-content-type-options', 'nosniff');\n      res.setHeader('content-security-policy', FILE_SERVE_CONTENT_SECURITY_POLICY);\n      res.setHeader(WildoHeaderKeys.CONTENT_LENGTH, body.length.toString());\n\n      // Immutable, version-keyed cache — see `THUMBNAIL_CACHE_CONTROL`. `updatedAt`\n      // participates in the ETag so replacing the image busts stale copies.\n      res.setHeader(WildoHeaderKeys.CACHE_CONTROL, THUMBNAIL_CACHE_CONTROL);\n      const version = file.updatedAt instanceof Date ? file.updatedAt.getTime() : '';\n      res.setHeader(WildoHeaderKeys.ETAG, `\"thumb-${file.fileId}-${version}\"`);\n\n      const filename = file.originalFilename || file.fileId || 'file';\n      setContentDispositionHeader(res, filename, 'inline');\n\n      res.end(body);\n    } catch (error) {\n      this.logger.error('Failed to serve image thumbnail', {\n        fileId: file.fileId,\n        ...projectCaughtErrorLogFields(error),\n      });\n      if (!res.headersSent) {\n        if (next) {\n          next(error as Error);\n          return;\n        }\n        res.status(500).end();\n        return;\n      }\n      throw error;\n    }\n  }\n\n  /**\n   * Build the internal execution context for a FILES (`REPOSITORY_ONLY`) repository\n   * operation invoked as a side effect of an originating request (a resource CREATE\n   * that generates a PDF, an upload handler, a link, a cleanup pass).\n   *\n   * The originating context carries two distinct concerns; this routes each correctly:\n   *\n   * - **Identity (`initiatorIds`) stays application-only.** The builder produces an\n   *   `INTERNALLY_INITIATED_REQUEST`, whose `ExecutionContext` invariant forbids the\n   *   user's `organizationId` / `userId` on `initiatorIds` (only `applicationId`).\n   *   Forwarding the user's full identity here 500'd every user-initiated file write.\n   *   `applicationId` is seeded from the originating context (or the single app tenant)\n   *   for a second reason: the FILES resource is APPLICATION-scoped, so a missing\n   *   `applicationId` would trigger `populateApplicationIdIfNeeded`'s internal\n   *   APPLICATION read, which would apply this op's scope map and fail (the APPLICATIONS\n   *   schema has no `organizationId`). Seeding it skips that read.\n   * - **Scope (`scopeFields` → `contextResourcesFieldIdentifier`) carries the file's own\n   *   tenant scope.** A FILES record's `organizationId` / `userId` are scope fields that\n   *   the create DTO strips and `enrichDataWithContext` re-injects from the context map;\n   *   they are SECONDARY scopes (FILES' primary scope is `applicationId`), so they are\n   *   not auto-re-injected. Callers that know the file's scope (CREATE) pass it here so\n   *   the record is correctly tenant-scoped and `authorizeFileAccess` later matches the\n   *   caller's org; by-id operations omit it (they resolve by `_id`).\n   *\n   * `createForInternalRepositoryOperation` resolves the FILES `REPOSITORY_ONLY`\n   * operation `REPOSITORY_ONLY`-preferred (URL-fallback); the URL-only resolver would\n   * throw `RESOURCES_REGISTRY_OPERATION_PATH_NOT_FOUND` for the non-URL-bearing FILES\n   * resource.\n   */\n  private async createInternalExecutionContext(\n    operation: CoreResourceOperation,\n    providedContext: ExecutionContext<any>,\n    scopeFields?: Map<string, string>,\n  ): Promise<ExecutionContext<any>> {\n    const applicationId = providedContext.applicationId ?? this.appConfigService.applicationId;\n\n    return this.executionContextCreator.createForInternalRepositoryOperation({\n      resourceType: CoreResourceType.FILES,\n      operationIdentifier: operation,\n      initiatorIds: applicationId ? { applicationId } : null,\n      contextResourcesFieldIdentifier: scopeFields,\n      initiatorRoles: [\n        {\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          relatedPrimaryScope: ResourcePrimaryScope.APPLICATION,\n        },\n      ],\n    });\n  }\n\n  /**\n   * Create a new file record with status PENDING.\n   * Called before upload starts to reserve the fileId.\n   *\n   * Scope can be provided at creation time (when known) or derived later\n   * when linking to a resource via linkFileToResource().\n   *\n   * @param fileData - Initial file data (filename, mimeType, size, etc.)\n   * @param executionContext - Execution context for authorization\n   * @param options - Repository options\n   * @returns Created file record with fileId\n   */\n  async createFile(\n    fileData: {\n      filename: string;\n      originalFilename: string;\n      mimeType: string;\n      size: number;\n      extension?: string;\n      checksum?: string;\n      /** Resolved storage provider. Falls back to default when omitted. */\n      storageProvider?: FileStorageAccepted;\n      // Scope identifiers - segregated (not hierarchical)\n      // If not provided, will be derived when linking to resource\n      scope?: FileScopeIdentifiers;\n      // Legacy: organizationId for backward compatibility\n      // Use scope.organizationId instead for new code\n      organizationId?: string;\n    } & FileUploaderOwnership,\n    executionContext: ExecutionContext<any>,\n    options?: RepositoryOptions\n  ): Promise<File> {\n    // Validate inputs (CRITICAL: Prevents invalid data propagation)\n    const maxFileSize = resolveConfiguredMaxFileSize(this.appConfigService.config.storage?.maxFileSize);\n    validateContentType(fileData.mimeType, this.errorBuilder, executionContext, 'mimeType');\n    validateSize(fileData.size, maxFileSize, this.errorBuilder, executionContext, 'size');\n    const hasExplicitUploadedBy = fileData.uploadedBy !== undefined;\n    const hasExplicitUploaderEntityType = fileData.uploadedByEntityType !== undefined;\n    if (hasExplicitUploadedBy !== hasExplicitUploaderEntityType) {\n      throw this.errorBuilder.buildError(\n        ErrorType.VALIDATION,\n        executionContext,\n        {\n          customMessageReference: ErrorCustomMessageReference.FILE_UPLOADER_FIELDS_INCONSISTENT,\n          context: {\n            // diagnostic (log-only)\n            uploadedBy: fileData.uploadedBy,\n            uploadedByEntityType: fileData.uploadedByEntityType,\n          },\n        }\n      );\n    }\n\n    if (hasExplicitUploadedBy && hasExplicitUploaderEntityType) {\n      validateUploadedBy(fileData.uploadedBy, this.errorBuilder, executionContext, 'uploadedBy');\n      validateUploadedByEntityType(fileData.uploadedByEntityType, this.errorBuilder, executionContext, 'uploadedByEntityType');\n    }\n\n    // Validate scope if provided\n    if (fileData.scope && !FileScopeUtils.validate(fileData.scope)) {\n      throw this.errorBuilder.buildError(\n        ErrorType.VALIDATION,\n        executionContext,\n        {\n          customMessageReference: ErrorCustomMessageReference.FILE_SCOPE_IDENTIFIER_INVALID,\n          context: {\n            scope: fileData.scope, // diagnostic (log-only)\n          },\n        }\n      );\n    }\n\n    // Derive organizationId from scope or use legacy field\n    const organizationId = fileData.scope?.organizationId || fileData.organizationId;\n    if (organizationId) {\n      validateOrganizationId(organizationId, this.errorBuilder, executionContext, 'organizationId');\n    }\n\n    // Derive applicationId from scope (always set after schema fix) or fall back to execution context.\n    // applicationId is the top-level tenant isolation field — always required on every file record.\n    const accessScope = this.deriveAccessScope(executionContext);\n    const applicationId = fileData.scope?.applicationId ?? accessScope.applicationId;\n    if (!applicationId) {\n      throw this.errorBuilder.buildError(\n        ErrorType.VALIDATION,\n        executionContext,\n        {\n          customMessageReference: ErrorCustomMessageReference.FILE_SCOPE_IDENTIFIER_MISSING,\n        }\n      );\n    }\n\n    this.logDebug('Creating file record', {\n      filename: fileData.filename,\n      primaryScope: fileData.scope?.primaryScope,\n      organizationId,\n    });\n\n    // Extract extension from filename if not provided\n    const extension = fileData.extension || this.extractExtension(fileData.originalFilename);\n\n    // NOTE (insert-first): the file's identity is the Mongo-generated `_id` (surfaced\n    // externally as the `fileId` virtual). `storageKey` embeds that identity, so it can\n    // only be derived AFTER the row exists — it is computed + persisted in a follow-up\n    // update below, not at insert time. (Previously a `fileId` was pre-generated here and\n    // stored as a second identity, which both diverged from `_id` and — being a stripped\n    // `excludeFromCreate` primary key — failed Mongoose's required-path validation.)\n    const resolvedStorageProviderId = fileData.storageProvider ?? this.getDefaultStorageProvider().providerId;\n\n    const derivedUploader = resolveFileUploaderPrincipal(executionContext);\n    const uploaderPrincipal = hasExplicitUploadedBy && hasExplicitUploaderEntityType\n      ? {\n          uploadedBy: fileData.uploadedBy!,\n          uploadedByEntityType: fileData.uploadedByEntityType!,\n        }\n      : derivedUploader;\n\n    if (hasExplicitUploadedBy && hasExplicitUploaderEntityType\n      && derivedUploader\n      && (\n        fileData.uploadedBy !== derivedUploader.uploadedBy\n        || fileData.uploadedByEntityType !== derivedUploader.uploadedByEntityType\n      )\n    ) {\n      throw this.errorBuilder.buildError(\n        ErrorType.VALIDATION,\n        executionContext,\n        {\n          customMessageReference: ErrorCustomMessageReference.FILE_UPLOADER_MISMATCH,\n          context: {\n            // diagnostic (log-only)\n            uploadedBy: fileData.uploadedBy,\n            uploadedByEntityType: fileData.uploadedByEntityType,\n            derivedUploadedBy: derivedUploader.uploadedBy,\n            derivedUploadedByEntityType: derivedUploader.uploadedByEntityType,\n          },\n        }\n      );\n    }\n\n    // Prepare file record data. No `fileId` (it is the virtual projection of the\n    // Mongo-generated `_id`) and no `storageKey` (derived from `_id`, set post-insert).\n    const fileRecord: Partial<File> = {\n      filename: fileData.filename,\n      originalFilename: fileData.originalFilename,\n      mimeType: fileData.mimeType,\n      size: fileData.size,\n      extension: extension || undefined,\n      checksum: fileData.checksum,\n      storageProvider: resolvedStorageProviderId,\n      status: FileStatus.PENDING,\n      uploadedBy: uploaderPrincipal?.uploadedBy,\n      uploadedByEntityType: uploaderPrincipal?.uploadedByEntityType,\n      // Scope identifiers (segregated)\n      primaryScope: fileData.scope?.primaryScope,\n      applicationId,\n      organizationId: organizationId,\n      userId: fileData.scope?.userId,\n    };\n\n    // Create internal execution context for repository operation\n    // Carry the file's OWN tenant scope (per its `primaryScope`) into the internal\n    // context so the `organizationId` / `userId` scope fields — stripped from the FILES\n    // create DTO and re-injected from the context map — land on the record. Sourced from\n    // the explicit `fileData.scope` (already correct for the file's primaryScope: org for\n    // ORGANIZATIONS, user-only for USER_SELF, neither for APPLICATION), so no spurious\n    // scope is set. Without this the file is scope-less and `authorizeFileAccess` denies it.\n    const createScopeFields = new Map<string, string>();\n    if (fileData.scope?.organizationId) {\n      createScopeFields.set('organizationId', fileData.scope.organizationId);\n    }\n    if (fileData.scope?.userId) {\n      createScopeFields.set('userId', fileData.scope.userId);\n    }\n    const internalContext = await this.createInternalExecutionContext(\n      CoreResourceOperation.CREATE,\n      executionContext,\n      createScopeFields\n    );\n\n    // The file is persisted as TWO writes — insert (Mongo assigns `_id`, surfaced via the\n    // `fileId` virtual) then a storageKey update derived from that identity. They MUST be\n    // atomic: a crash between them would otherwise commit a `storageKey`-less row (the\n    // pre-transaction design's regression). The wrapping transaction below makes them so.\n    const persistFileWithStorageKey = async (\n      writeOptions: RepositoryOptions | undefined,\n    ): Promise<File> => {\n      // Create file record via repository. Mongo generates `_id`; the `fileId` virtual\n      // projects it, so `createdFile.fileId === String(_id)`.\n      const createdFile = await this.filesRepository.create<File>(\n        internalContext,\n        fileRecord as File,\n        writeOptions\n      );\n\n      // Now that the identity (`_id`, surfaced as `fileId`) exists, derive the storageKey and\n      // persist it. This preserves the historical contract that a created file always carries a\n      // storageKey — scope-derived when a scope is known at creation, else the bare identity\n      // (`fileId`) as a fallback (re-derived with the full scope path by `linkFileToResource`\n      // once the file is linked).\n      const storageKey = fileData.scope\n        ? FileScopeUtils.buildStoragePath(fileData.scope, createdFile.fileId)\n        : createdFile.fileId;\n      const withStorageKey = await this.filesRepository.update<File>(\n        internalContext,\n        { _id: createdFile.fileId },\n        { storageKey } as Partial<File>,\n        writeOptions\n      );\n\n      if (!withStorageKey) {\n        // The row was just created under this same context and transaction, so a missing match\n        // here is unexpected (e.g. a contextual-filter mismatch). Surface it rather than\n        // silently returning a storageKey-less file: the file row still exists, but the gap is\n        // logged.\n        this.logger.warn?.('File record created but storageKey could not be persisted', {\n          fileId: createdFile.fileId,\n        });\n        this.logDebug('File record created', { fileId: createdFile.fileId });\n        return createdFile;\n      }\n\n      this.logDebug('File record created', { fileId: withStorageKey.fileId });\n      return withStorageKey;\n    };\n\n    // Make the insert + storageKey update atomic. If the caller already supplied an active\n    // transaction on the FILES store (e.g. file work cascaded from a resource mutation), both\n    // writes join it; otherwise open a self-contained one so a crash between the two writes\n    // cannot leave a storageKey-less row. `nestedBehavior: 'reuse'` is a safety net for an\n    // ambient (AsyncLocalStorage-tracked) transaction not threaded through `options`.\n    //\n    // The store is resolved from the FILES resource rather than named: this used to read\n    // `=== PersistenceAdapter.MONGODB` and open on `this.mongoDBService`, which is correct only\n    // while FILES sits on MongoDB and inverts in silence the day it moves — the row would be\n    // written by the FILES repository on one connection while the \"atomicity\" wrapping it came\n    // from another.\n    const filesStore = this.getFilesStore(executionContext);\n    if (options?.transaction?.databaseType === filesStore.persistenceAdapter) {\n      return persistFileWithStorageKey(options);\n    }\n    return filesStore.databaseService.executeTransaction(\n      (transactionContext) => persistFileWithStorageKey({ ...options, transaction: transactionContext }),\n      { nestedBehavior: 'reuse' }\n    );\n  }\n\n  /**\n   * The transaction-owning service for the FILES store.\n   *\n   * Resolved through the persistence unit of work, which is the one place that holds both\n   * every adapter's database service and the resource → adapter mapping. Re-deriving either\n   * here is what produced the `mongoDBService`-by-name coupling this replaced.\n   *\n   * Throws rather than degrading: every caller uses the returned service to establish\n   * atomicity across two writes, and continuing without a transaction would leave exactly\n   * the storageKey-less row the transaction exists to prevent — silently.\n   */\n  private getFilesStore(executionContext: ExecutionContext<any>): ResourcePersistenceResourceStore {\n    const filesStore = this.resourcePersistenceUnitOfWork?.getDatabaseServiceForResource(\n      CoreResourceType.FILES,\n    );\n\n    if (!filesStore) {\n      throw this.errorBuilder.buildError(\n        ErrorType.CONFIGURATION,\n        executionContext,\n        {\n          customMessageReference: ErrorCustomMessageReference.CONFIGURATION,\n          context: {\n            message: 'No database service is available for the FILES resource store',\n            resourceType: CoreResourceType.FILES,\n            unitOfWorkBound: Boolean(this.resourcePersistenceUnitOfWork),\n          },\n        }\n      );\n    }\n\n    return filesStore;\n  }\n\n  /**\n   * Get file metadata by fileId.\n   *\n   * @param fileId - File identifier\n   * @param executionContext - Execution context for authorization\n   * @returns File metadata or null if not found\n   */\n  async getFile(\n    fileId: string,\n    executionContext: ExecutionContext<any>,\n    options?: RepositoryOptions\n  ): Promise<File | null> {\n    this.logDebug('Getting file record', { fileId });\n\n    // Validate fileId format (CRITICAL: Prevents query injection and database errors)\n    validateFileId(fileId, this.errorBuilder, executionContext, 'fileId');\n\n    // Create internal execution context for repository operation\n    const internalContext = await this.createInternalExecutionContext(\n      CoreResourceOperation.READ,\n      executionContext\n    );\n\n    // Read file record via repository. `fileId` is the `_id` virtual projection, so the\n    // collection filter keys on `_id` (virtuals are not queryable).\n    const file = await this.filesRepository.read<File>(\n      internalContext,\n      { _id: fileId },\n      options\n    );\n\n    if (!file) {\n      this.logDebug('File not found', { fileId });\n      return null;\n    }\n\n    // Check authorization. A system-cascade file teardown (subject erasure) reaches this via\n    // deleteFile/eraseFile/unlinkFileFromResource on an identity-less EC that would deny the subject's\n    // OWN file; it forwards the owner it already verified at the listing gate through\n    // `options.authoritativeFileScope`, so the deletion gate authorizes against that owner instead of\n    // the empty EC. Every other (user-facing) caller leaves it undefined ⇒ authorize against the EC.\n    const hasAccess = await this.authorizeFileAccess(file, executionContext, options?.authoritativeFileScope);\n    if (!hasAccess) {\n        throw this.errorBuilder.buildError(\n          ErrorType.AUTHORIZATION,\n          executionContext,\n          {\n            customMessageReference: ErrorCustomMessageReference.FILE_ACCESS_DENIED,\n          context: {\n            fileId, // diagnostic (log-only)\n          },\n        }\n      );\n    }\n\n    return file;\n  }\n\n  /**\n   * Get multiple files by their IDs.\n   *\n   * @param fileIds - Array of file identifiers\n   * @param executionContext - Execution context for authorization\n   * @returns Array of file metadata\n   */\n  async batchGetFiles(\n    fileIds: string[],\n    executionContext: ExecutionContext<any>,\n    options?: RepositoryOptions\n  ): Promise<File[]> {\n    this.logDebug('Batch getting file records', { fileIds, count: fileIds.length });\n\n    if (fileIds.length === 0) {\n      return [];\n    }\n\n    // Filter and validate fileIds format before query — an optimization that avoids querying\n    // for ids that cannot exist.\n    //\n    // `isValidResourceId` accepts BOTH ObjectId and UUID, so this is already adapter-neutral.\n    // The previous comment claimed an \"ObjectId regex pattern\", which would have made this a\n    // blocker for moving FILES to PostgreSQL (uuid ids). It reads as a coupling and is not one.\n    const validFileIds = fileIds.filter(\n      (id) => typeof id === 'string' && id.trim() !== '' && Resources_SharedUtils.isValidResourceId(id.trim())\n    );\n\n    // Early return if no valid fileIds after filtering\n    if (validFileIds.length === 0) {\n      return [];\n    }\n\n    const accessibleScopeFilter = this.buildAccessibleScopeFilter(executionContext);\n    if (!accessibleScopeFilter) {\n      throw this.errorBuilder.buildError(\n        ErrorType.VALIDATION,\n        executionContext,\n        {\n          customMessageReference: ErrorCustomMessageReference.FILE_SCOPE_IDENTIFIER_MISSING,\n          context: {\n            fileIdsCount: fileIds.length, // diagnostic (log-only)\n          },\n        }\n      );\n    }\n\n    // Create internal execution context for repository operation\n    const internalContext = await this.createInternalExecutionContext(\n      CoreResourceOperation.READ,\n      executionContext\n    );\n\n    // Add the narrowest tenant-aware filter we can BEFORE fetching.\n    // This prevents cross-tenant prefetches for app-scoped files while preserving\n    // legacy org-scoped rows until all persisted file records carry primaryScope.\n    const files = await this.filesRepository.list<File>(\n      internalContext,\n      {\n        // `fileId` values are `_id` strings (the virtual projection); query on `_id`.\n        _id: { $in: validFileIds },\n        ...accessibleScopeFilter,\n      },\n      options\n    );\n\n    // Filter by authorization\n    const authorizedFiles: File[] = [];\n    for (const file of files) {\n      const hasAccess = await this.authorizeFileAccess(file, executionContext);\n      if (hasAccess) {\n        authorizedFiles.push(file);\n      }\n    }\n\n    this.logDebug('Batch get completed', { requested: fileIds.length, found: files.length, authorized: authorizedFiles.length });\n    return authorizedFiles;\n  }\n\n  /**\n   * Update file status (e.g., PENDING -> UPLOADED, UPLOADED -> LINKED).\n   *\n   * @param fileId - File identifier\n   * @param status - New status\n   * @param executionContext - Execution context for authorization\n   * @returns Updated file record\n   */\n  async updateFileStatus(\n    fileId: string,\n    status: FileStatus,\n    executionContext: ExecutionContext<any>,\n    options?: RepositoryOptions,\n    storagePlacement?: StorageUploadResult,\n  ): Promise<File> {\n    this.logDebug('Updating file status', { fileId, status });\n\n    // Validate fileId format (CRITICAL: Prevents query injection and database errors)\n    validateFileId(fileId, this.errorBuilder, executionContext, 'fileId');\n\n    // Get current file record\n    const currentFile = await this.getFile(fileId, executionContext, options);\n    if (!currentFile) {\n      throw this.errorBuilder.buildError(\n        ErrorType.NOT_FOUND,\n        executionContext,\n        {\n          customMessageReference: ErrorCustomMessageReference.FILE_NOT_FOUND,\n          context: {\n            fileId, // diagnostic (log-only)\n          },\n        }\n      );\n    }\n\n    const allowedTransitions = FILE_STATUS_TRANSITIONS[currentFile.status];\n    if (!allowedTransitions?.includes(status)) {\n      throw this.errorBuilder.buildError(\n        ErrorType.BUSINESS_RULE,\n        executionContext,\n        {\n          customMessageReference: ErrorCustomMessageReference.FILE_INVALID_STATUS_TRANSITION,\n          context: {\n            // diagnostic (log-only)\n            fileId,\n            currentStatus: currentFile.status,\n            requestedStatus: status,\n            allowedTransitions,\n          },\n        }\n      );\n    }\n\n    // Create internal execution context for repository operation\n    const internalContext = await this.createInternalExecutionContext(\n      CoreResourceOperation.UPDATE,\n      executionContext\n    );\n\n    // Update file status via repository. `fileId` is the `_id` virtual projection, so the\n    // collection filter keys on `_id` (virtuals are not queryable).\n    const updatedFile = await this.filesRepository.update<File>(\n      internalContext,\n      { _id: fileId },\n      {\n        status,\n        ...(storagePlacement\n          ? {\n              storageProvider: storagePlacement.provider,\n              storageRef: storagePlacement.storageRef,\n            }\n          : {}),\n        updatedAt: new Date(),\n      } as Partial<File>,\n      options\n    );\n\n    if (!updatedFile) {\n      throw this.errorBuilder.buildError(\n        ErrorType.INTERNAL,\n        executionContext,\n        {\n          customMessageReference: ErrorCustomMessageReference.INTERNAL,\n          context: {\n            message: 'Failed to update file status',\n            fileId,\n            status,\n          },\n        }\n      );\n    }\n\n    this.logDebug('File status updated', { fileId, oldStatus: currentFile.status, newStatus: status });\n    return updatedFile;\n  }\n\n  /**\n   * RAG removal seam — FILE-BINDING MUTATION. A link, unlink, delete or erase changes WHICH file (if\n   * any) backs a `(resourceType, resourceId, fieldName)` tuple, so any chunks derived from the\n   * PREVIOUS binding's extracted text are stale the moment the write lands and must not stay\n   * retrievable (re-indexing from the new binding is Phase 3's write path; deletion is this phase's\n   * whole job). No-op unless the tuple names a declared `.ragSource()` field — the intersection and\n   * the shared failure/transaction contract (post-commit when `options` carries a transaction, inline\n   * otherwise, log-at-ERROR never throw) live in `rag-chunk-removal.backend.utils.ts`.\n   */\n  private async runRagChunkRemovalForFileBinding(\n    binding: { resourceType?: string | null; resourceId?: string | null; fieldName?: string | null },\n    seam: string,\n    options?: RepositoryOptions,\n  ): Promise<void> {\n    if (!this.ragChunkStore || !this.ragSourceFieldDetection) return;\n    const { resourceType, resourceId, fieldName } = binding;\n    if (!resourceType || !resourceId || !fieldName) return;\n    await scheduleRagChunkRemovalForFields(\n      {\n        ragChunkStore: this.ragChunkStore,\n        ragSourceFieldDetection: this.ragSourceFieldDetection,\n        logger: this.logger,\n      },\n      {\n        resourceType: resourceType as ResourceType,\n        resourceIds: [resourceId],\n        affectedFieldNames: [fieldName],\n        seam,\n        transaction: options?.transaction,\n      },\n    );\n  }\n\n  /**\n   * Link a file to a resource (resource-integrated uploads).\n   * Updates file status to LINKED, stores resource reference, and derives scope\n   * from the parent resource's resourcePrimaryScope.\n   *\n   * Scope derivation:\n   * - APPLICATION: applicationId from execution context\n   * - ORGANIZATIONS: organizationId from execution context\n   * - USER_SELF: userId + applicationId from execution context (no org — separate scope axis)\n   *\n   * @param fileId - File identifier\n   * @param resourceType - Resource type\n   * @param resourceId - Resource identifier\n   * @param fieldName - Field name on the resource\n   * @param executionContext - Execution context for authorization\n   * @returns Updated file record\n   */\n  async linkFileToResource(\n    fileId: string,\n    resourceType: ResourceType,\n    resourceId: string,\n    fieldName: string,\n    executionContext: ExecutionContext<any>,\n    options?: RepositoryOptions\n  ): Promise<File> {\n    this.logDebug('Linking file to resource', { fileId, resourceType, resourceId, fieldName });\n\n    // Validate inputs (CRITICAL: Prevents query injection and database errors)\n    validateFileId(fileId, this.errorBuilder, executionContext, 'fileId');\n    validateResourceId(resourceId, this.errorBuilder, executionContext, 'resourceId');\n    validateResourceType(resourceType, this.errorBuilder, executionContext, 'resourceType');\n    validateFieldName(fieldName, this.errorBuilder, executionContext, 'fieldName');\n\n    // Derive scope from parent resource's resourcePrimaryScope\n    const derivedScope = this.deriveScopeFromParentResource(resourceType, executionContext);\n\n    // Create internal execution context for repository operation\n    const internalContext = await this.createInternalExecutionContext(\n      CoreResourceOperation.UPDATE,\n      executionContext\n    );\n\n    // CRITICAL: Use atomic update with status filter to prevent race conditions (Decision 2.4: Option A)\n    // The repository's update() method internally uses findOneAndUpdate, so it's atomic\n    // Filter includes status check: only updates if file is in UPLOADED status\n    // This ensures no race condition between check and update\n\n    /**\n     * Updates file status, link fields, and scope atomically.\n     *\n     * @note MongoDB updates are atomic, so partial updates are not possible.\n     * If the update fails, the entire operation fails atomically.\n     */\n    const updatedFile = await this.filesRepository.update<File>(\n      internalContext,\n      {\n        _id: fileId,\n        status: { $in: [FileStatus.UPLOADED, FileStatus.CLEAN] },\n      },\n      {\n        linkedResourceType: resourceType,\n        linkedResourceId: resourceId,\n        linkedFieldName: fieldName,\n        status: FileStatus.LINKED,\n        updatedAt: new Date(),\n        // Scope derived from parent resource\n        primaryScope: derivedScope.primaryScope,\n        applicationId: derivedScope.applicationId,\n        organizationId: derivedScope.organizationId,\n        userId: derivedScope.userId,\n        // Update storageKey if scope wasn't set at creation time\n        storageKey: FileScopeUtils.buildStoragePath(derivedScope, fileId),\n      } as Partial<File>,\n      options\n    );\n\n    if (!updatedFile) {\n      // File was not in a linkable status (race condition or already linked)\n      // Re-fetch to determine the reason and throw appropriate error\n      const currentFile = await this.getFile(fileId, executionContext, options);\n      if (!currentFile) {\n        throw this.errorBuilder.buildError(\n          ErrorType.NOT_FOUND,\n          executionContext,\n          {\n            customMessageReference: ErrorCustomMessageReference.FILE_NOT_FOUND,\n            context: {\n              fileId, // diagnostic (log-only)\n            },\n          }\n        );\n      }\n\n      // Check if already linked to same resource (idempotent case)\n      if (currentFile.status === FileStatus.LINKED &&\n          currentFile.linkedResourceType === resourceType &&\n          currentFile.linkedResourceId === resourceId &&\n          currentFile.linkedFieldName === fieldName) {\n        // Already linked to same resource - idempotent, return current file\n        this.logDebug('File already linked to same resource (idempotent)', {\n          fileId,\n          resourceType,\n          resourceId,\n          fieldName,\n        });\n        return currentFile;\n      }\n\n      // Check if already linked to different resource (error case)\n      if (currentFile.status === FileStatus.LINKED) {\n        throw this.errorBuilder.buildError(\n          ErrorType.BUSINESS_RULE,\n          executionContext,\n          {\n            customMessageReference: ErrorCustomMessageReference.FILE_ALREADY_LINKED,\n            context: {\n              // diagnostic (log-only)\n              fileId,\n              currentLinkedResourceType: currentFile.linkedResourceType,\n              currentLinkedResourceId: currentFile.linkedResourceId,\n              currentLinkedFieldName: currentFile.linkedFieldName,\n              requestedResourceType: resourceType,\n              requestedResourceId: resourceId,\n              requestedFieldName: fieldName,\n            },\n          }\n        );\n      }\n\n      // Wrong status (not UPLOADED)\n      throw this.errorBuilder.buildError(\n        ErrorType.BUSINESS_RULE,\n        executionContext,\n        {\n          customMessageReference: ErrorCustomMessageReference.FILE_NOT_IN_UPLOADED_STATUS,\n          context: {\n            // diagnostic (log-only)\n            fileId,\n            fileStatus: currentFile.status,\n            expectedStatus: FileStatus.UPLOADED,\n            resourceType,\n            resourceId,\n          },\n        }\n      );\n    }\n\n    // RAG removal seam — a (re-)link binds a NEW file to the tuple, so chunks derived from whatever\n    // backed it before are stale and must not survive the re-link (plan §Removal-seam inventory).\n    await this.runRagChunkRemovalForFileBinding(\n      { resourceType, resourceId, fieldName },\n      'file-link',\n      options,\n    );\n\n    this.logDebug('File linked to resource', { fileId, resourceType, resourceId });\n    return updatedFile;\n  }\n\n  /**\n   * Unlink a file from a resource.\n   * Updates file status to ORPHANED and clears resource link fields.\n   *\n   * Note: Due to Mongoose behavior, optional fields set to `undefined` are ignored in updates.\n   * We attempt to clear linked resource fields, but if schema validation prevents this,\n   * the status change to ORPHANED is the authoritative indicator that the file is unlinked.\n   *\n   * @param fileId - File identifier\n   * @param executionContext - Execution context for authorization\n   * @returns Updated file record\n   */\n  async unlinkFileFromResource(\n    fileId: string,\n    executionContext: ExecutionContext<any>,\n    options?: RepositoryOptions\n  ): Promise<File> {\n    this.logDebug('Unlinking file from resource', { fileId });\n\n    // Validate fileId format (CRITICAL: Prevents query injection and database errors)\n    validateFileId(fileId, this.errorBuilder, executionContext, 'fileId');\n\n    // Get current file record\n    const currentFile = await this.getFile(fileId, executionContext, options);\n    if (!currentFile) {\n      throw this.errorBuilder.buildError(\n        ErrorType.NOT_FOUND,\n        executionContext,\n        {\n          customMessageReference: ErrorCustomMessageReference.FILE_NOT_FOUND,\n          context: {\n            fileId, // diagnostic (log-only)\n          },\n        }\n      );\n    }\n\n    // Create internal execution context for repository operation\n    const internalContext = await this.createInternalExecutionContext(\n      CoreResourceOperation.UPDATE,\n      executionContext\n    );\n\n    // Update file to remove resource link and set status to ORPHANED\n    // Note: Mongoose ignores undefined values in updates, and optional string fields don't accept null.\n    // The status change to ORPHANED is the authoritative indicator that the file is no longer linked.\n    // The linked resource fields may remain in the database but are considered stale/invalid when status is ORPHANED.\n    // Future enhancement: If explicit field clearing is required, consider using MongoDB $unset operator\n    // via direct Mongoose model access or repository enhancement.\n    const updateData: Partial<File> = {\n      status: FileStatus.ORPHANED,\n      updatedAt: new Date(),\n    };\n\n    /**\n     * Updates file status and clears link fields atomically.\n     *\n     * @note MongoDB updates are atomic, so partial updates are not possible.\n     * If the update fails, the entire operation fails atomically.\n     */\n    const updatedFile = await this.filesRepository.update<File>(\n      internalContext,\n      { _id: fileId },\n      updateData,\n      options\n    );\n\n    if (!updatedFile) {\n      throw this.errorBuilder.buildError(\n        ErrorType.INTERNAL,\n        executionContext,\n        {\n          customMessageReference: ErrorCustomMessageReference.INTERNAL,\n          context: {\n            message: 'Failed to unlink file from resource',\n            fileId,\n          },\n        }\n      );\n    }\n\n    // RAG removal seam — the tuple no longer has a backing file; its extracted-text chunks go with\n    // the binding. The tuple is read from the PRE-unlink row (the write above clears/staleness-marks it).\n    await this.runRagChunkRemovalForFileBinding(\n      {\n        resourceType: currentFile.linkedResourceType,\n        resourceId: currentFile.linkedResourceId,\n        fieldName: currentFile.linkedFieldName,\n      },\n      'file-unlink',\n      options,\n    );\n\n    this.logDebug('File unlinked from resource', { fileId });\n    return updatedFile;\n  }\n\n  /**\n   * Delete a file (soft delete - marks as DELETED).\n   * Physical deletion from storage happens in cleanup batch job.\n   *\n   * @param fileId - File identifier\n   * @param executionContext - Execution context for authorization\n   * @returns Deleted file record\n   */\n  async deleteFile(\n    fileId: string,\n    executionContext: ExecutionContext<any>,\n    options?: RepositoryOptions\n  ): Promise<File> {\n    this.logDebug('Soft deleting file record', { fileId });\n\n    // Validate fileId format (CRITICAL: Prevents query injection and database errors)\n    validateFileId(fileId, this.errorBuilder, executionContext, 'fileId');\n\n    // Get current file record\n    const currentFile = await this.getFile(fileId, executionContext, options);\n    if (!currentFile) {\n      throw this.errorBuilder.buildError(\n        ErrorType.NOT_FOUND,\n        executionContext,\n        {\n          customMessageReference: ErrorCustomMessageReference.FILE_NOT_FOUND,\n          context: {\n            fileId, // diagnostic (log-only)\n          },\n        }\n      );\n    }\n\n    // Create internal execution context for repository operation\n    const internalContext = await this.createInternalExecutionContext(\n      CoreResourceOperation.UPDATE,\n      executionContext\n    );\n\n    // Soft delete: update status and set deletedAt\n\n    /**\n     * Updates file status to DELETED atomically.\n     *\n     * @note MongoDB updates are atomic, so partial updates are not possible.\n     * If the update fails, the entire operation fails atomically.\n     */\n    const deletedFile = await this.filesRepository.update<File>(\n      internalContext,\n      { _id: fileId },\n      {\n        status: FileStatus.DELETED,\n        deletedAt: new Date(),\n        updatedAt: new Date(),\n      } as Partial<File>,\n      options\n    );\n\n    if (!deletedFile) {\n      throw this.errorBuilder.buildError(\n        ErrorType.INTERNAL,\n        executionContext,\n        {\n          customMessageReference: ErrorCustomMessageReference.INTERNAL,\n          context: {\n            message: 'Failed to delete file',\n            fileId,\n          },\n        }\n      );\n    }\n\n    // RAG removal seam — a DELETED file no longer backs its linked field (the cleanup batch will\n    // hard-delete the bytes), so text extracted from it must stop being retrievable now. A file that\n    // was never linked to a RAG-source field no-ops. Beyond the plan's link/unlink rows, wired\n    // deliberately: the row-delete and impersonalize seams cover the ORCHESTRATED deleteFile calls,\n    // but a direct deleteFile on a linked file reaches neither.\n    await this.runRagChunkRemovalForFileBinding(\n      {\n        resourceType: currentFile.linkedResourceType,\n        resourceId: currentFile.linkedResourceId,\n        fieldName: currentFile.linkedFieldName,\n      },\n      'file-delete',\n      options,\n    );\n\n    this.logDebug('File soft deleted', { fileId });\n    return deletedFile;\n  }\n\n  /**\n   * ERASE a file for privacy (gate **G-FILE**) — a soft delete that also scrubs the file row's OWN\n   * personal data, in one write.\n   *\n   * Deliberately distinct from {@link deleteFile} rather than a flag on it, because the two mean\n   * different things and must not drift:\n   *  - `deleteFile` is a LIFECYCLE delete. The row is on its way out but its provenance\n   *    (`originalFilename`, `uploadedBy`) is still legitimate history — an admin auditing \"who\n   *    uploaded what, and what happened to it\" needs exactly those fields.\n   *  - `eraseFile` is a PRIVACY erasure. The filename IS personal data (`passport-jane-doe.pdf`\n   *    identifies its subject as surely as the bytes do), and so is the uploader link. Keeping them\n   *    for the weeks until the cleanup batch runs means the erasure only *looks* complete.\n   *\n   * `filename` / `originalFilename` are REQUIRED (`min(1)`), so they are overwritten with the shared\n   * {@link ERASED_FILE_NAME_PLACEHOLDER} constant rather than nulled — nulling would need a schema\n   * reshape and would make every erased file distinguishable from every other by its emptiness.\n   * `uploadedBy` and `uploadedByEntityType` are cleared TOGETHER: the schema's `validateUploaderPair`\n   * refinement requires both or neither, and clearing one alone would make the row unwritable.\n   *\n   * The blob itself is removed by the existing cleanup batch, exactly as for `deleteFile` — an erasure\n   * must never mix a DB rollback with non-transactional storage side effects.\n   *\n   * Idempotent: erasing an already-erased file rewrites the same terminal values.\n   */\n  async eraseFile(\n    fileId: string,\n    executionContext: ExecutionContext<any>,\n    options?: RepositoryOptions\n  ): Promise<File> {\n    this.logDebug('Erasing file record for privacy', { fileId });\n\n    validateFileId(fileId, this.errorBuilder, executionContext, 'fileId');\n\n    const currentFile = await this.getFile(fileId, executionContext, options);\n    if (!currentFile) {\n      throw this.errorBuilder.buildError(\n        ErrorType.NOT_FOUND,\n        executionContext,\n        {\n          customMessageReference: ErrorCustomMessageReference.FILE_NOT_FOUND,\n          context: {\n            fileId, // diagnostic (log-only)\n          },\n        }\n      );\n    }\n\n    const internalContext = await this.createInternalExecutionContext(\n      CoreResourceOperation.UPDATE,\n      executionContext\n    );\n\n    const erasedFile = await this.filesRepository.update<File>(\n      internalContext,\n      { _id: fileId },\n      {\n        status: FileStatus.DELETED,\n        deletedAt: new Date(),\n        updatedAt: new Date(),\n        filename: ERASED_FILE_NAME_PLACEHOLDER,\n        originalFilename: ERASED_FILE_NAME_PLACEHOLDER,\n        uploadedBy: undefined,\n        uploadedByEntityType: undefined,\n      } as Partial<File>,\n      options\n    );\n\n    if (!erasedFile) {\n      throw this.errorBuilder.buildError(\n        ErrorType.INTERNAL,\n        executionContext,\n        {\n          customMessageReference: ErrorCustomMessageReference.INTERNAL,\n          context: {\n            message: 'Failed to erase file',\n            fileId,\n          },\n        }\n      );\n    }\n\n    // RAG removal seam — a privacy erasure of the file makes any text extracted from it exactly the\n    // personal data the erasure exists to remove; the chunk set goes in the same decision. Usually\n    // redundant with the impersonalize seam that invoked this erasure (idempotent), and load-bearing\n    // for a DIRECT eraseFile call, which reaches no other seam.\n    await this.runRagChunkRemovalForFileBinding(\n      {\n        resourceType: currentFile.linkedResourceType,\n        resourceId: currentFile.linkedResourceId,\n        fieldName: currentFile.linkedFieldName,\n      },\n      'file-erase',\n      options,\n    );\n\n    this.logDebug('File erased', { fileId });\n    return erasedFile;\n  }\n\n  /**\n   * Permanently delete a file by removing the blob first, then deleting the\n   * metadata row. This is intentionally reserved for post-commit cleanup flows\n   * such as the cleanup batch, not inline resource transactions.\n   */\n  async hardDeleteFile(\n    fileId: string,\n    executionContext: ExecutionContext<any>,\n    options?: RepositoryOptions\n  ): Promise<File> {\n    this.logDebug('Hard deleting file record and storage', { fileId });\n\n    validateFileId(fileId, this.errorBuilder, executionContext, 'fileId');\n\n    const readContext = await this.createInternalExecutionContext(\n      CoreResourceOperation.READ,\n      executionContext\n    );\n    const currentFile = await this.filesRepository.read<File>(\n      readContext,\n      { _id: fileId },\n      options\n    );\n\n    if (!currentFile) {\n      throw this.errorBuilder.buildError(\n        ErrorType.NOT_FOUND,\n        executionContext,\n        {\n          customMessageReference: ErrorCustomMessageReference.FILE_NOT_FOUND,\n          context: {\n            fileId, // diagnostic (log-only)\n          },\n        }\n      );\n    }\n\n    // Hard-delete now flows through the storage provider seam so future slices can\n    // swap backend resolution without reopening the cleanup contract.\n    try {\n      const storageProvider = this.getStorageProviderForFile(currentFile, executionContext);\n      await storageProvider.delete(currentFile, executionContext);\n    } catch (error) {\n      if (!isWildoBackendError(error) || error.type !== ErrorType.NOT_FOUND) {\n        throw error;\n      }\n\n      this.logDebug('File blob already missing during hard delete, continuing metadata cleanup', {\n        fileId,\n      });\n    }\n\n    const deleteContext = await this.createInternalExecutionContext(\n      CoreResourceOperation.DELETE,\n      executionContext\n    );\n    const deletedFileId = await this.filesRepository.delete(\n      deleteContext,\n      { _id: fileId },\n      options\n    );\n\n    if (!deletedFileId) {\n      throw this.errorBuilder.buildError(\n        ErrorType.INTERNAL,\n        executionContext,\n        {\n          customMessageReference: ErrorCustomMessageReference.INTERNAL,\n          context: {\n            message: 'Failed to hard delete file',\n            fileId,\n          },\n        }\n      );\n    }\n\n    this.logDebug('File hard deleted from storage and metadata', { fileId });\n    return currentFile;\n  }\n\n  /**\n   * List files for a specific resource.\n   *\n   * @param resourceType - Resource type\n   * @param resourceId - Resource identifier\n   * @param fieldName - Optional field name filter\n   * @param executionContext - Execution context for authorization\n   * @returns Array of file metadata\n   */\n  async listFilesForResource(\n    resourceType: ResourceType,\n    resourceId: string,\n    fieldName: string | undefined,\n    executionContext: ExecutionContext<any>,\n    options?: RepositoryOptions\n  ): Promise<File[]> {\n    if (!executionContext) {\n      throw this.errorBuilder.buildError(\n        ErrorType.INTERNAL,\n        {} as ExecutionContext<any>,\n        {\n          customMessageReference: ErrorCustomMessageReference.INTERNAL,\n          context: {\n            message: 'Execution context is required for listFilesForResource',\n          },\n        }\n      );\n    }\n\n    this.logDebug('Listing files for resource', { resourceType, resourceId, fieldName });\n\n    // Validate inputs (CRITICAL: Prevents query injection and database errors)\n    validateResourceId(resourceId, this.errorBuilder, executionContext, 'resourceId');\n    validateResourceType(resourceType, this.errorBuilder, executionContext, 'resourceType');\n    if (fieldName) {\n      validateFieldName(fieldName, this.errorBuilder, executionContext, 'fieldName');\n    }\n\n    // A system-cascade file teardown (subject erasure, cross-scope delete) runs on an\n    // internally_initiated_request EC, whose constructor FORBIDS user/organization identity on\n    // `initiatorIds` — only `applicationId` is allowed. So `deriveScopeFromParentResource` cannot read\n    // the owner from the EC and would fail closed with FILE_SCOPE_IDENTIFIER_MISSING, aborting the\n    // whole erasure transaction before the subject is scrubbed. The resource ROW being torn down\n    // carries its OWN scope FK (a USER_SELF row's `userId`, an org-scoped row's `organizationId`) — the\n    // authoritative owner of that row's files. Read it and hand it to the scope derivation as a\n    // fallback. This is the single chokepoint every delete/impersonalize/deleteMany file teardown funnels\n    // through, so the recovery is unbypassable rather than threaded through each cascade site. It costs\n    // one extra read ONLY on the system path — an ordinary request already carries the owner on its EC,\n    // so `loadParentResourceRowForScopeFallback` returns undefined and performs no read.\n    const parentResourceRowForScope = await this.loadParentResourceRowForScopeFallback(\n      resourceType,\n      resourceId,\n      executionContext,\n      options,\n    );\n    const derivedScope = this.deriveScopeFromParentResource(resourceType, executionContext, parentResourceRowForScope);\n    const scopeFilter = this.buildFilterForFileScope(derivedScope);\n    if (!scopeFilter) {\n      throw this.errorBuilder.buildError(\n        ErrorType.VALIDATION,\n        executionContext,\n        {\n          customMessageReference: ErrorCustomMessageReference.FILE_SCOPE_DERIVATION_FAILED,\n        }\n      );\n    }\n\n    // Build filter\n    // Be defensive against malformed persisted rows where link metadata was\n    // written but status drifted from LINKED. Delete-time cleanup must still be\n    // able to discover those rows by parent ownership.\n    const filter: any = {\n      linkedResourceType: resourceType,\n      linkedResourceId: resourceId,\n      status: {\n        $in: [FileStatus.LINKED, FileStatus.UPLOADED, FileStatus.CLEAN],\n      },\n      ...scopeFilter,\n    };\n\n    if (fieldName) {\n      filter.linkedFieldName = fieldName;\n    }\n\n    // Create internal execution context for repository operation\n    const internalContext = await this.createInternalExecutionContext(\n      CoreResourceOperation.LIST,\n      executionContext\n    );\n\n    // Apply the linked resource's derived scope to the repository query before fetch.\n    // This keeps app-scoped parents from going through an org-only path.\n    const files = await this.filesRepository.list<File>(\n      internalContext,\n      filter,\n      options\n    );\n\n    // Filter by authorization — against the SCOPE WE DERIVED (the parent resource's owner), not the raw\n    // EC. `listFilesForResource` is exclusively a system-cascade file-teardown path (delete/impersonalize),\n    // whose EC carries no owner identity; deriving the access scope from that EC would deny the subject's\n    // OWN file and silently retain PII. `derivedScope` is the authoritative owner (from the row on the\n    // system path, from the EC on any owner-bearing path) and is exactly what the file query above was\n    // scoped by, so this re-confirms that scoping rather than trusting the empty EC.\n    const authorizedFiles: File[] = [];\n    for (const file of files) {\n      const hasAccess = await this.authorizeFileAccess(file, executionContext, {\n        applicationId: derivedScope.applicationId,\n        organizationId: derivedScope.organizationId,\n        userId: derivedScope.userId,\n      });\n      if (hasAccess) {\n        authorizedFiles.push(file);\n      }\n    }\n\n    this.logDebug('List files for resource completed', { resourceType, resourceId, found: files.length, authorized: authorizedFiles.length });\n    return authorizedFiles;\n  }\n\n  /**\n   * Authorize file access based on file's primaryScope.\n   *\n   * Access rules by primaryScope:\n   * - APPLICATION: User must have access to the application\n   * - ORGANIZATIONS: User must belong to the organization\n   * - USER_SELF: User must be the owner (userId match) — no org check (separate scope axis)\n   *\n   * Fallback (no primaryScope): Uses legacy organizationId match\n   *\n   * @param file - File record\n   * @param executionContext - Execution context for authorization\n   * @returns true if access is allowed\n   */\n  async authorizeFileAccess(\n    file: File,\n    executionContext: ExecutionContext<any>,\n    /**\n     * The AUTHORITATIVE owner to check the file against, supplied ONLY by the system-cascade teardown\n     * path ({@link listFilesForResource}, whose sole callers are the delete/impersonalize file teardown).\n     * That path runs on an identity-less `internally_initiated_request` EC, so `deriveAccessScope` yields\n     * no owner and this check would deny the SUBJECT'S OWN file — silently retaining PII while the erasure\n     * reports success. The teardown has already resolved the owner from the row being torn down (the same\n     * value the file query was scoped by), so authorizing against it re-confirms the query's own scoping\n     * rather than trusting the empty EC. A present EC owner always wins for every other caller — this\n     * override is `undefined` on the two non-teardown callers, so their behaviour is unchanged.\n     */\n    authoritativeScopeOverride?: { applicationId?: string; organizationId?: string; userId?: string },\n  ): Promise<boolean> {\n    const accessScope = authoritativeScopeOverride ?? this.deriveAccessScope(executionContext);\n\n    // Legacy scope-less rows are tolerated only when they still carry a concrete\n    // organization owner. Missing organization ownership is treated as malformed\n    // persisted data and must fail closed.\n    if (!file.primaryScope) {\n      if (!file.organizationId || !accessScope.organizationId) {\n        this.logDebug('File access denied: missing organization ownership on legacy file', {\n          fileOrganizationId: file.organizationId,\n          requestOrganizationId: accessScope.organizationId,\n        });\n        return false;\n      }\n\n      if (file.organizationId !== accessScope.organizationId) {\n        this.logDebug('File access denied: organization mismatch (legacy)', {\n          fileOrganizationId: file.organizationId,\n          requestOrganizationId: accessScope.organizationId,\n        });\n        return false;\n      }\n      return true;\n    }\n\n    // Scope-based authorization\n    switch (file.primaryScope) {\n      case ResourcePrimaryScope.APPLICATION:\n        if (!file.applicationId || file.applicationId !== accessScope.applicationId) {\n          this.logDebug('File access denied: application mismatch', {\n            fileApplicationId: file.applicationId,\n            requestApplicationId: accessScope.applicationId,\n          });\n          return false;\n        }\n        return true;\n\n      case ResourcePrimaryScope.ORGANIZATIONS:\n        // ORGANIZATIONS scope: user must belong to the organization\n        if (file.organizationId !== accessScope.organizationId) {\n          this.logDebug('File access denied: organization mismatch', {\n            fileOrganizationId: file.organizationId,\n            requestOrganizationId: accessScope.organizationId,\n          });\n          return false;\n        }\n        return true;\n\n      case ResourcePrimaryScope.USER_SELF:\n        // USER_SELF scope: access is granted iff the caller IS the owner. USER_SELF and\n        // ORGANIZATIONS are independent primary-scope axes, so there is NO org check here —\n        // a self-owned file carries no org. `applicationId` tenant isolation is enforced\n        // upstream (batchGetFiles / access-scope resolution).\n        if (file.userId !== accessScope.userId) {\n          this.logDebug('File access denied: user mismatch', {\n            fileUserId: file.userId,\n            requestUserId: accessScope.userId,\n          });\n          return false;\n        }\n        return true;\n\n      default:\n        // Unknown scope - deny access\n        this.logDebug('File access denied: unknown primaryScope', {\n          primaryScope: file.primaryScope,\n        });\n        return false;\n    }\n  }\n\n  /**\n   * Convert File record to FileMetadata response format.\n   * Used by the getMetadata endpoint.\n   *\n   * @param file - File record\n   * @returns FileMetadata object\n   */\n  toMetadataResponse(file: File): {\n    fileId: string;\n    filename: string;\n    size: number;\n    mimeType: string;\n    extension?: string;\n    checksum?: string;\n    url?: string;\n    thumbnailUrl?: string;\n    nature: FileDisplayNature;\n    width?: number;\n    height?: number;\n    duration?: number;\n    pageCount?: number;\n    uploadedAt: Date;\n    uploadedBy?: string;\n    uploadedByEntityType?: FileUploaderEntityType;\n  } {\n    // Infer nature from MIME type if not stored on the file record\n    // Uses the shared resolveFileDisplayNature() utility (single source of truth)\n    const nature: FileDisplayNature = (file.nature as FileDisplayNature) ?? resolveFileDisplayNature(undefined, file.mimeType);\n\n    return {\n      fileId: file.fileId,\n      filename: file.originalFilename || file.filename,\n      size: file.size,\n      mimeType: file.mimeType,\n      extension: file.extension,\n      checksum: file.checksum,\n      url: file.url,\n      thumbnailUrl: file.thumbnailUrl,\n      nature,\n      width: file.width,\n      height: file.height,\n      duration: file.duration,\n      pageCount: file.pageCount,\n      uploadedAt: file.uploadedAt,\n      uploadedBy: file.uploadedBy,\n      uploadedByEntityType: file.uploadedByEntityType,\n    };\n  }\n\n  /**\n   * Derive access scope from execution context.\n   * Extracts all scope identifiers for authorization checks.\n   *\n   * @param executionContext - Execution context\n   * @returns Access scope information with all identifiers\n   */\n  protected deriveAccessScope(executionContext: ExecutionContext<any>): {\n    applicationId?: string;\n    organizationId?: string;\n    userId?: string;\n  } {\n    const organizationId = this.resourceOperationHelper.getInitiatorId(executionContext, 'organization');\n    const userId = this.resourceOperationHelper.getInitiatorId(executionContext, 'user');\n    // Fall back to the single backend application's id when the execution context\n    // doesn't carry one (e.g. a USER_REQUEST EC, whose initiatorIds hold org/user but\n    // not applicationId). Mirrors `PdfGeneratedFileWriterBackendService` — there is\n    // exactly one application per backend, so `appConfigService.applicationId` is the\n    // correct anchor for `applicationId`-scoped file resolution + access checks.\n    const applicationId = executionContext.applicationId || this.appConfigService.applicationId;\n\n    return {\n      applicationId,\n      organizationId,\n      userId,\n    };\n  }\n\n  /**\n   * Build the narrowest repository filter we can from the caller's accessible scope.\n   * This keeps prefetching tenant-aware even before per-row authorization runs.\n   */\n  protected buildAccessibleScopeFilter(executionContext: ExecutionContext<any>): Record<string, unknown> | null {\n    const accessScope = this.deriveAccessScope(executionContext);\n    const scopeBranches: Record<string, unknown>[] = [];\n\n    if (accessScope.applicationId) {\n      scopeBranches.push({\n        primaryScope: ResourcePrimaryScope.APPLICATION,\n        applicationId: accessScope.applicationId,\n      });\n    }\n\n    if (accessScope.organizationId) {\n      // Keep legacy org-only rows reachable until all file rows carry primaryScope.\n      scopeBranches.push({\n        organizationId: accessScope.organizationId,\n      });\n    }\n\n    if (scopeBranches.length === 0) {\n      return null;\n    }\n\n    return scopeBranches.length === 1 ? scopeBranches[0] : { $or: scopeBranches };\n  }\n\n  protected buildFilterForFileScope(scope: FileScopeIdentifiers): Record<string, unknown> | null {\n    switch (scope.primaryScope) {\n      case ResourcePrimaryScope.APPLICATION:\n        return scope.applicationId\n          ? {\n              primaryScope: ResourcePrimaryScope.APPLICATION,\n              applicationId: scope.applicationId,\n            }\n          : null;\n      case ResourcePrimaryScope.ORGANIZATIONS:\n        return scope.organizationId\n          ? {\n              organizationId: scope.organizationId,\n            }\n          : null;\n      case ResourcePrimaryScope.USER_SELF:\n        // USER_SELF files are keyed by owner (userId) only — no org (separation of concern).\n        return scope.userId\n          ? {\n              primaryScope: ResourcePrimaryScope.USER_SELF,\n              userId: scope.userId,\n            }\n          : null;\n      default:\n        return null;\n    }\n  }\n\n  /**\n   * Recover a scoped resource's owner from the ROW when the EC cannot supply it — the system-cascade\n   * file-teardown path (subject erasure, cross-scope delete). Such a cascade runs on an\n   * `internally_initiated_request` EC, whose constructor is fail-closed and REJECTS user/organization\n   * identity on `initiatorIds` (only `applicationId` is allowed), because the initiator of a system\n   * operation is the SYSTEM, not the org/user being targeted. So {@link deriveScopeFromParentResource}\n   * has no owner to read from the EC and fails closed with FILE_SCOPE_IDENTIFIER_MISSING — which,\n   * inside an erasure, rolls back the whole transaction before the subject is scrubbed.\n   *\n   * Returns `undefined` — and performs NO read — whenever the EC already carries the owner (every\n   * ordinary request, and any APPLICATION-scoped resource, whose id is always available from the single\n   * backend). Only a genuinely owner-less EC over a USER_SELF/ORGANIZATIONS resource triggers the read,\n   * so the hot path is unchanged.\n   *\n   * Fail-open to `undefined` on any obstacle (missing repository, no READ support, absent row, read\n   * error): the caller then runs the EC-only derivation, which still fails closed exactly as before.\n   * This helper only ADDS a recovery; it never weakens the existing guard.\n   */\n  private async loadParentResourceRowForScopeFallback(\n    resourceType: ResourceType,\n    resourceId: string,\n    executionContext: ExecutionContext<any>,\n    options?: RepositoryOptions,\n  ): Promise<Record<string, unknown> | undefined> {\n    const primaryScope =\n      this.resourcesRegistry.getResourceConfiguration(resourceType)?.resourcePrimaryScope\n      ?? ResourcePrimaryScope.ORGANIZATIONS;\n\n    const accessScope = this.deriveAccessScope(executionContext);\n    const ecAlreadyCarriesOwner =\n      primaryScope === ResourcePrimaryScope.APPLICATION\n      || (primaryScope === ResourcePrimaryScope.USER_SELF && !!accessScope.userId)\n      || (primaryScope === ResourcePrimaryScope.ORGANIZATIONS && !!accessScope.organizationId);\n    if (ecAlreadyCarriesOwner) {\n      return undefined;\n    }\n\n    const repository = this.repositoriesRegistry.getRepository(resourceType);\n    if (!repository?.supportsOperation(CoreResourceOperation.READ)) {\n      return undefined;\n    }\n\n    try {\n      const row = await repository.read<Record<string, unknown>>(executionContext, resourceId, options);\n      return row ?? undefined;\n    } catch {\n      return undefined;\n    }\n  }\n\n  /**\n   * Derive file scope from parent resource's resourcePrimaryScope.\n   *\n   * Scope derivation rules:\n   * - APPLICATION: sets applicationId from execution context\n   * - ORGANIZATIONS: sets organizationId from execution context (or the row's own FK — system cascade)\n   * - USER_SELF: sets userId + applicationId from execution context (no org — separate scope axis; or\n   *   the row's own FK — system cascade)\n   *\n   * @param resourceType - Parent resource type\n   * @param executionContext - Execution context for scope values\n   * @param parentResourceRow - The row being torn down; its own scope FK is used as a FALLBACK owner\n   *   only when the EC carries none (system cascade). A present EC owner always wins.\n   * @returns FileScopeIdentifiers derived from parent resource\n   */\n  protected deriveScopeFromParentResource(\n    resourceType: ResourceType,\n    executionContext: ExecutionContext<any>,\n    /**\n     * The resource row being torn down, supplied ONLY by system-cascade paths whose EC carries no\n     * owner identity (see the caller comment in {@link listFilesForResource}). Its own scope FK is the\n     * authoritative owner of the row's files. Used strictly as a FALLBACK: a present EC owner always\n     * wins, so every ordinary request behaves exactly as before this parameter existed.\n     */\n    parentResourceRow?: Record<string, unknown>,\n  ): FileScopeIdentifiers {\n    // Get parent resource configuration to find its primaryScope\n    const resourceConfig = this.resourcesRegistry.getResourceConfiguration(resourceType);\n\n    // Get primaryScope from resource configuration\n    // Default to ORGANIZATIONS if not specified\n    const primaryScope = resourceConfig?.resourcePrimaryScope || ResourcePrimaryScope.ORGANIZATIONS;\n\n    const accessScope = this.deriveAccessScope(executionContext);\n\n    // The row's value for its OWN primary-scope FK — `userId` for USER_SELF, `organizationId` for\n    // ORGANIZATIONS — resolved through the single named mapping so it can never drift from the write\n    // path. Stored FKs are ObjectIds; normalize to the string form the EC-derived scope also uses.\n    const rowScopeFieldIdentifier = PRIMARY_SCOPE_TO_FIELD_IDENTIFIER[primaryScope];\n    const rowScopeRaw = parentResourceRow?.[rowScopeFieldIdentifier];\n    const rowScopeValue = rowScopeRaw != null ? String(rowScopeRaw) : undefined;\n\n    switch (primaryScope) {\n      case ResourcePrimaryScope.APPLICATION:\n        if (!accessScope.applicationId) {\n          throw this.errorBuilder.buildError(\n            ErrorType.VALIDATION,\n            executionContext,\n            {\n              customMessageReference: ErrorCustomMessageReference.FILE_SCOPE_IDENTIFIER_MISSING,\n              context: {\n                resourceType, // diagnostic (log-only)\n              },\n            }\n          );\n        }\n        return {\n          primaryScope: ResourcePrimaryScope.APPLICATION,\n          applicationId: accessScope.applicationId,\n        };\n\n      case ResourcePrimaryScope.ORGANIZATIONS: {\n        // EC owner wins; fall back to the torn-down row's own organization FK for a system cascade.\n        const organizationId = accessScope.organizationId ?? rowScopeValue;\n        if (!organizationId) {\n          throw this.errorBuilder.buildError(\n            ErrorType.VALIDATION,\n            executionContext,\n            {\n              customMessageReference: ErrorCustomMessageReference.FILE_SCOPE_IDENTIFIER_MISSING,\n              context: {\n                resourceType, // diagnostic (log-only)\n              },\n            }\n          );\n        }\n        if (!accessScope.applicationId) {\n          throw this.errorBuilder.buildError(\n            ErrorType.VALIDATION,\n            executionContext,\n            {\n              customMessageReference: ErrorCustomMessageReference.FILE_SCOPE_IDENTIFIER_MISSING,\n              context: {\n                resourceType, // diagnostic (log-only)\n              },\n            }\n          );\n        }\n        return {\n          primaryScope: ResourcePrimaryScope.ORGANIZATIONS,\n          applicationId: accessScope.applicationId,\n          organizationId,\n        };\n      }\n\n      case ResourcePrimaryScope.USER_SELF: {\n        // USER_SELF and ORGANIZATIONS are independent primary-scope axes (separation of\n        // concern): a self-owned file is owned by the USER, not an org. Require user\n        // (owner) + applicationId (tenant/bucket anchor); never read/persist an org.\n        // EC owner wins; fall back to the torn-down row's own user FK for a system cascade — the\n        // subject-erasure path, whose EC is forbidden from carrying the user identity.\n        const userId = accessScope.userId ?? rowScopeValue;\n        if (!userId) {\n          throw this.errorBuilder.buildError(\n            ErrorType.VALIDATION,\n            executionContext,\n            {\n              customMessageReference: ErrorCustomMessageReference.FILE_SCOPE_IDENTIFIER_MISSING,\n              context: {\n                resourceType, // diagnostic (log-only)\n              },\n            }\n          );\n        }\n        if (!accessScope.applicationId) {\n          throw this.errorBuilder.buildError(\n            ErrorType.VALIDATION,\n            executionContext,\n            {\n              customMessageReference: ErrorCustomMessageReference.FILE_SCOPE_IDENTIFIER_MISSING,\n              context: {\n                resourceType, // diagnostic (log-only)\n              },\n            }\n          );\n        }\n        return {\n          primaryScope: ResourcePrimaryScope.USER_SELF,\n          applicationId: accessScope.applicationId,\n          userId,\n        };\n      }\n\n      default:\n        throw this.errorBuilder.buildError(\n          ErrorType.CONFIGURATION,\n          executionContext,\n          {\n            customMessageReference: ErrorCustomMessageReference.CONFIGURATION,\n            context: {\n              message: 'File scope derivation only supports APPLICATION, ORGANIZATIONS, and USER_SELF resources',\n              resourceType,\n              primaryScope,\n            },\n          }\n        );\n    }\n  }\n\n  /**\n   * Extract file extension from filename.\n   *\n   * @param filename - Filename with or without extension\n   * @returns Extension without dot, or empty string if none\n   */\n  private extractExtension(filename: string): string {\n    const lastDot = filename.lastIndexOf('.');\n    if (lastDot === -1 || lastDot === filename.length - 1) {\n      return '';\n    }\n    return filename.substring(lastDot + 1).toLowerCase();\n  }\n}\n"]}
+{"version":3,"file":"files.backend.service.js","sourceRoot":"","sources":["../../../../../src/files/services/files.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;;;;;;;;;;;;;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAGzD,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAgB,SAAS,EAAE,2BAA2B,EAAsD,oBAAoB,EAAE,iCAAiC,EAAE,cAAc,EAAE,qBAAqB,EAAE,0BAA0B,EAAE,mBAAmB,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC5V,OAAO,EAAQ,UAAU,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,0BAA0B,EAAwB,cAAc,EAAE,gBAAgB,EAAE,4BAA4B,EAAE,MAAM,uBAAuB,CAAC;AAC5N,OAAO,EAAE,wBAAwB,EAAoD,MAAM,0BAA0B,CAAC;AACtH,OAAO,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AAEpF,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAC9G,OAAO,EAAE,mBAAmB,EAAE,2BAA2B,EAAE,MAAM,8EAA8E,CAAC;AAChJ,OAAO,EAAE,+BAA+B,EAAE,MAAM,0EAA0E,CAAC;AAE3H,OAAO,EAAE,qCAAqC,EAAE,MAAM,+EAA+E,CAAC;AACtI,OAAO,EAAE,qCAAqC,EAAE,MAAM,qFAAqF,CAAC;AAE5I,OAAO,EAAE,yCAAyC,EAAE,MAAM,qGAAqG,CAAC;AAEhK,OAAO,EAAE,cAAc,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,YAAY,EAAE,kBAAkB,EAAE,4BAA4B,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,4BAA4B,EAAE,cAAc,EAAE,MAAM,sDAAsD,CAAC;AAC9S,OAAO,EAAE,2BAA2B,EAAE,MAAM,kDAAkD,CAAC;AAC/F,OAAO,EAAE,4BAA4B,EAAE,MAAM,oDAAoD,CAAC;AAClG,OAAO,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,0BAA0B,EAAE,MAAM,8DAA8D,CAAC;AAC/K,OAAO,EAAE,gCAAgC,EAAE,MAAM,qEAAqE,CAAC;AACvH,OAAO,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AAC/G,OAAO,EAAE,+BAA+B,EAAE,MAAM,sEAAsE,CAAC;AAEvH,OAAO,EAAE,2CAA2C,EAAE,MAAM,yFAAyF,CAAC;AAItJ,OAAO,EAAE,gCAAgC,EAAE,MAAM,8DAA8D,CAAC;AAEhH;;;;;;;;;GASG;AACH,MAAM,kCAAkC,GAAG,6BAA6B,CAAC;AAEzE;;;;;;;GAOG;AACH,MAAM,8BAA8B,GAAG,IAAI,GAAG,CAAS;IACrD,WAAW;IACX,uBAAuB;IACvB,eAAe;CAChB,CAAC,CAAC;AAEH,+EAA+E;AAC/E,SAAS,4BAA4B,CAAC,WAA+B;IACnE,IAAI,CAAC,WAAW;QAAE,OAAO,KAAK,CAAC;IAC/B,MAAM,SAAS,GAAG,WAAW,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACrE,OAAO,8BAA8B,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;AACvD,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,uBAAuB,GAAG,mCAAmC,CAAC;AAG7D,IAAM,mBAAmB,GAAzB,MAAM,mBAAmB;IAKX;IAEA;IAEA;IAEA;IAEA;IAEA;IAEA;IAEA;IAGA;IAQA;IAGA;IAhCT,QAAQ,CAA+D;IAEjF,YAEmB,MAAqB,EAErB,YAAwC,EAExC,iBAAkD,EAElD,oBAA+D,EAE/D,uBAA8D,EAE9D,uBAA8D,EAE9D,iBAAkD,EAElD,gBAAyC,EAGzC,6BAA2E,EAQ3E,uBAA+D,EAG/D,aAA2C;QA5B3C,WAAM,GAAN,MAAM,CAAe;QAErB,iBAAY,GAAZ,YAAY,CAA4B;QAExC,sBAAiB,GAAjB,iBAAiB,CAAiC;QAElD,yBAAoB,GAApB,oBAAoB,CAA2C;QAE/D,4BAAuB,GAAvB,uBAAuB,CAAuC;QAE9D,4BAAuB,GAAvB,uBAAuB,CAAuC;QAE9D,sBAAiB,GAAjB,iBAAiB,CAAiC;QAElD,qBAAgB,GAAhB,gBAAgB,CAAyB;QAGzC,kCAA6B,GAA7B,6BAA6B,CAA8C;QAQ3E,4BAAuB,GAAvB,uBAAuB,CAAwC;QAG/D,kBAAa,GAAb,aAAa,CAA8B;QAE5D,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,qBAAqB,CAAC,CAAC;QAC/D,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,qBAAqB,EAAE,KAAK,CAAC,CAAC;QAE9D,IAAI,CAAC,QAAQ,CAAC,iCAAiC,CAAC,CAAC;IACnD,CAAC;IAED;;;OAGG;IACH,IAAY,eAAe;QACzB,OAAO,IAAI,CAAC,oBAAoB,CAAC,oBAAoB,CAAC,gBAAgB,CAAC,KAAK,EAAE,EAA2B,CAAC,CAAC;IAC7G,CAAC;IAEO,yBAAyB;QAC/B,OAAO,IAAI,CAAC,iBAAiB,CAAC,kBAAkB,EAAE,CAAC;IACrD,CAAC;IAEM,yBAAyB,CAC9B,IAA6D,EAC7D,gBAAuC;QAEvC,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC;YAC1B,IAAI,CAAC,QAAQ,CAAC,8DAA8D,EAAE;gBAC5E,MAAM,EAAE,IAAI,CAAC,MAAM;aACpB,CAAC,CAAC;YACH,OAAO,IAAI,CAAC,yBAAyB,EAAE,CAAC;QAC1C,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,iBAAiB,CAAC,eAAe,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QAC9E,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,QAAQ,EAClB,gBAAgB,EAChB;gBACE,sBAAsB,EAAE,2BAA2B,CAAC,QAAQ;gBAC5D,OAAO,EAAE;oBACP,OAAO,EAAE,mEAAmE;oBAC5E,MAAM,EAAE,IAAI,CAAC,MAAM;oBACnB,eAAe,EAAE,IAAI,CAAC,eAAe;iBACtC;aACF,CACF,CAAC;QACJ,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IACI,KAAK,CAAC,oBAAoB,CAC/B,IAAU,EACV,GAAa,EACb,gBAAmD,EACnD,OAAoG;QAEpG,MAAM,WAAW,GAAG,OAAO,EAAE,WAAW,IAAI,QAAQ,CAAC;QACrD,MAAM,IAAI,GAAG,OAAO,EAAE,IAAI,CAAC;QAC3B,MAAM,OAAO,GAAG,OAAO,EAAE,OAAO,IAAI,gBAAgB,CAAC,QAAQ,CAAC;QAE9D,6EAA6E;QAC7E,EAAE;QACF,qEAAqE;QACrE,EAAE;QACF,8FAA8F;QAC9F,yFAAyF;QACzF,6FAA6F;QAC7F,uFAAuF;QACvF,6FAA6F;QAC7F,0EAA0E;QAC1E,EAAE;QACF,2FAA2F;QAC3F,8FAA8F;QAC9F,gEAAgE;QAChE,EAAE;QACF,oFAAoF;QACpF,6DAA6D;QAC7D,IAAI,OAAO,KAAK,gBAAgB,CAAC,SAAS,IAAI,CAAC,IAAI,CAAC,6BAA6B,CAAC,IAAI,CAAC,EAAE,CAAC;YACxF,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,UAAU,EACpB,gBAAuB,EACvB;gBACE,sBAAsB,EAAE,2BAA2B,CAAC,UAAU;gBAC9D,OAAO,EAAE;oBACP,OAAO,EAAE,sFAAsF;oBAC/F,MAAM,EAAE,IAAI,CAAC,MAAM;oBACnB,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;oBAC3C,eAAe,EAAE,IAAI,CAAC,eAAe;iBACtC;aACF,CACF,CAAC;QACJ,CAAC;QAED,MAAM,YAAY,GAChB,OAAO,KAAK,gBAAgB,CAAC,SAAS;YACtC,oBAAoB,CAAC,IAAI,CAAC,QAAQ,CAAC;YACnC,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC;YACpB,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,0BAA0B,CAAC;QACjD,IAAI,YAAY,EAAE,CAAC;YACjB,MAAM,IAAI,CAAC,mBAAmB,CAAC,IAAI,EAAE,GAAG,EAAE,gBAAgB,EAAE,IAAI,CAAC,CAAC;YAClE,OAAO;QACT,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,4BAA4B,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;QAElF,IAAI,MAAM,GAAoB,IAAI,CAAC;QAEnC,IAAI,CAAC;YACH,MAAM,eAAe,GAAG,IAAI,CAAC,yBAAyB,CAAC,IAAI,EAAE,gBAAuB,CAAC,CAAC;YACtF,MAAM,cAAc,GAAG,MAAM,eAAe,CAAC,QAAQ,CAAC,IAAI,EAAE,gBAAuB,CAAC,CAAC;YACrF,MAAM,GAAG,cAAc,CAAC,MAAM,CAAC;YAE/B,6EAA6E;YAC7E,cAAc,CAAC,MAAM,EAAE,IAAI,CAAC,YAAY,EAAE,gBAAuB,EAAE,gBAAgB,CAAC,CAAC;YAErF,4EAA4E;YAC5E,IAAI,GAAG,CAAC,WAAW,EAAE,CAAC;gBACpB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,iEAAiE,EAAE;oBAClF,MAAM,EAAE,IAAI,CAAC,MAAM;iBACpB,CAAC,CAAC;YACL,CAAC;iBAAM,CAAC;gBACN,MAAM,WAAW,GAAG,cAAc,CAAC,WAAW,IAAI,IAAI,CAAC,QAAQ,CAAC;gBAChE,GAAG,CAAC,SAAS,CAAC,eAAe,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC;gBAEzD,yEAAyE;gBACzE,2EAA2E;gBAC3E,uEAAuE;gBACvE,6EAA6E;gBAC7E,wEAAwE;gBACxE,sEAAsE;gBACtE,iEAAiE;gBACjE,8EAA8E;gBAC9E,2EAA2E;gBAC3E,kFAAkF;gBAClF,GAAG,CAAC,SAAS,CAAC,wBAAwB,EAAE,SAAS,CAAC,CAAC;gBACnD,GAAG,CAAC,SAAS,CAAC,yBAAyB,EAAE,kCAAkC,CAAC,CAAC;gBAE7E,MAAM,aAAa,GAAG,cAAc,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC;gBACvF,IAAI,aAAa,GAAG,CAAC,EAAE,CAAC;oBACtB,GAAG,CAAC,SAAS,CAAC,eAAe,CAAC,cAAc,EAAE,aAAa,CAAC,QAAQ,EAAE,CAAC,CAAC;gBAC1E,CAAC;gBAED,4EAA4E;gBAC5E,sEAAsE;gBACtE,sEAAsE;gBACtE,8DAA8D;gBAC9D,MAAM,oBAAoB,GACxB,WAAW,KAAK,QAAQ,IAAI,4BAA4B,CAAC,WAAW,CAAC;oBACnE,CAAC,CAAC,YAAY;oBACd,CAAC,CAAC,WAAW,CAAC;gBAClB,MAAM,QAAQ,GAAG,IAAI,CAAC,gBAAgB,IAAI,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC;gBAChE,2BAA2B,CAAC,GAAG,EAAE,QAAQ,EAAE,oBAAoB,CAAC,CAAC;gBAEjE,yEAAyE;gBACzE,IAAI,cAAc,CAAC,IAAI,EAAE,CAAC;oBACxB,GAAG,CAAC,SAAS,CAAC,eAAe,CAAC,IAAI,EAAE,cAAc,CAAC,IAAI,CAAC,CAAC;gBAC3D,CAAC;gBACD,IAAI,cAAc,CAAC,YAAY,EAAE,CAAC;oBAChC,GAAG,CAAC,SAAS,CAAC,eAAe,CAAC,aAAa,EAAE,cAAc,CAAC,YAAY,CAAC,WAAW,EAAE,CAAC,CAAC;gBAC1F,CAAC;YACH,CAAC;YAED,wEAAwE;YACxE,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;gBAC3B,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,8CAA8C,EAAE;oBAChE,MAAM,EAAE,IAAI,CAAC,MAAM;oBACnB,GAAG,2BAA2B,CAAC,KAAK,CAAC;iBACtC,CAAC,CAAC;gBACH,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;oBACrB,IAAI,IAAI,EAAE,CAAC;wBACT,IAAI,CAAC,KAAK,CAAC,CAAC;wBACZ,OAAO;oBACT,CAAC;oBACD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;gBACxB,CAAC;qBAAM,IAAI,MAAM,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;oBACvC,MAAM,CAAC,OAAO,EAAE,CAAC;gBACnB,CAAC;YACH,CAAC,CAAC,CAAC;YAEH,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;gBACxB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,qCAAqC,EAAE;oBACvD,MAAM,EAAE,IAAI,CAAC,MAAM;oBACnB,GAAG,2BAA2B,CAAC,KAAK,CAAC;iBACtC,CAAC,CAAC;gBACH,IAAI,MAAM,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;oBAChC,MAAM,CAAC,OAAO,EAAE,CAAC;gBACnB,CAAC;YACH,CAAC,CAAC,CAAC;YAEH,qEAAqE;YACrE,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;gBACnB,IAAI,MAAM,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;oBAChC,MAAM,CAAC,OAAO,EAAE,CAAC;gBACnB,CAAC;YACH,CAAC,CAAC,CAAC;YAEH,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACnB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,MAAM,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;gBAChC,IAAI,CAAC;oBACH,MAAM,CAAC,OAAO,EAAE,CAAC;gBACnB,CAAC;gBAAC,OAAO,YAAY,EAAE,CAAC;oBACtB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,+CAA+C,EAAE;wBAChE,MAAM,EAAE,IAAI,CAAC,MAAM;wBACnB,GAAG,2BAA2B,CAAC,YAAY,CAAC;wBAC5C,aAAa,EAAE,mBAAmB,CAAC,KAAK,CAAC;qBAC1C,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YAED,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,oCAAoC,EAAE;gBACtD,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,GAAG,2BAA2B,CAAC,KAAK,CAAC;aACtC,CAAC,CAAC;YACH,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;OAqBG;IACK,6BAA6B,CAAC,IAAU;QAC9C,MAAM,YAAY,GAAG,IAAI,CAAC,kBAAkB,CAAC;QAC7C,MAAM,SAAS,GAAG,IAAI,CAAC,eAAe,CAAC;QACvC,IAAI,CAAC,YAAY,IAAI,CAAC,SAAS,EAAE,CAAC;YAChC,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,cAAc,GAAG,IAAI,CAAC,iBAAiB,CAAC,wBAAwB,CAAC,YAA4B,CAAC,CAAC;QACrG,IAAI,CAAC,cAAc,EAAE,UAAU,EAAE,CAAC;YAChC,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,QAA6D,CAAC;QAClE,IAAI,CAAC;YACH,QAAQ,GAAG,gCAAgC,CAAC,cAAc,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;QACpF,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,kFAAkF;YAClF,uFAAuF;YACvF,yFAAyF;YACzF,IAAI,CAAC,QAAQ,CAAC,0EAA0E,EAAE;gBACxF,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,YAAY;gBACZ,SAAS;gBACT,GAAG,2BAA2B,CAAC,KAAK,CAAC;aACtC,CAAC,CAAC;YACH,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,QAAQ,EAAE,YAAY,CAAC,gBAAgB,EAAE,kBAAkB,KAAK,KAAK,CAAC;IAC/E,CAAC;IAED;;;;;;;;;;;;;;;;;;OAkBG;IACK,KAAK,CAAC,mBAAmB,CAC/B,IAAU,EACV,GAAa,EACb,gBAAmD,EACnD,IAA8B;QAE9B,IAAI,CAAC,QAAQ,CAAC,yBAAyB,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QAEnF,IAAI,CAAC;YACH,MAAM,eAAe,GAAG,IAAI,CAAC,yBAAyB,CAAC,IAAI,EAAE,gBAAuB,CAAC,CAAC;YACtF,MAAM,cAAc,GAAG,MAAM,eAAe,CAAC,QAAQ,CAAC,IAAI,EAAE,gBAAuB,CAAC,CAAC;YACrF,MAAM,MAAM,GAAG,cAAc,CAAC,MAAM,CAAC;YACrC,cAAc,CAAC,MAAM,EAAE,IAAI,CAAC,YAAY,EAAE,gBAAuB,EAAE,uBAAuB,CAAC,CAAC;YAE5F,6EAA6E;YAC7E,iFAAiF;YACjF,MAAM,YAAY,GAAG,MAAM,qBAAqB,CAAC,MAAM,EAAE,0BAA0B,CAAC,CAAC;YACrF,MAAM,SAAS,GAAG,MAAM,sBAAsB,CAAC,YAAY,CAAC,CAAC;YAE7D,IAAI,GAAG,CAAC,WAAW,EAAE,CAAC;gBACpB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,uDAAuD,EAAE;oBACxE,MAAM,EAAE,IAAI,CAAC,MAAM;iBACpB,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YAED,6EAA6E;YAC7E,wEAAwE;YACxE,MAAM,IAAI,GAAG,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC;YACvD,MAAM,WAAW,GAAG,SAAS;gBAC3B,CAAC,CAAC,SAAS,CAAC,WAAW;gBACvB,CAAC,CAAC,cAAc,CAAC,WAAW,IAAI,IAAI,CAAC,QAAQ,CAAC;YAChD,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,2DAA2D,EAAE;oBAC5E,MAAM,EAAE,IAAI,CAAC,MAAM;oBACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;iBACxB,CAAC,CAAC;YACL,CAAC;YAED,8EAA8E;YAC9E,yEAAyE;YACzE,gFAAgF;YAChF,oFAAoF;YACpF,GAAG,CAAC,SAAS,CAAC,eAAe,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC;YACzD,GAAG,CAAC,SAAS,CAAC,wBAAwB,EAAE,SAAS,CAAC,CAAC;YACnD,GAAG,CAAC,SAAS,CAAC,yBAAyB,EAAE,kCAAkC,CAAC,CAAC;YAC7E,GAAG,CAAC,SAAS,CAAC,eAAe,CAAC,cAAc,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;YAEtE,8EAA8E;YAC9E,sEAAsE;YACtE,GAAG,CAAC,SAAS,CAAC,eAAe,CAAC,aAAa,EAAE,uBAAuB,CAAC,CAAC;YACtE,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,YAAY,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/E,GAAG,CAAC,SAAS,CAAC,eAAe,CAAC,IAAI,EAAE,UAAU,IAAI,CAAC,MAAM,IAAI,OAAO,GAAG,CAAC,CAAC;YAEzE,MAAM,QAAQ,GAAG,IAAI,CAAC,gBAAgB,IAAI,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC;YAChE,2BAA2B,CAAC,GAAG,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;YAErD,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAChB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,iCAAiC,EAAE;gBACnD,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,GAAG,2BAA2B,CAAC,KAAK,CAAC;aACtC,CAAC,CAAC;YACH,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;gBACrB,IAAI,IAAI,EAAE,CAAC;oBACT,IAAI,CAAC,KAAc,CAAC,CAAC;oBACrB,OAAO;gBACT,CAAC;gBACD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;gBACtB,OAAO;YACT,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4BG;IACK,KAAK,CAAC,8BAA8B,CAC1C,SAAgC,EAChC,eAAsC,EACtC,WAAiC;QAEjC,MAAM,aAAa,GAAG,eAAe,CAAC,aAAa,IAAI,IAAI,CAAC,gBAAgB,CAAC,aAAa,CAAC;QAE3F,OAAO,IAAI,CAAC,uBAAuB,CAAC,oCAAoC,CAAC;YACvE,YAAY,EAAE,gBAAgB,CAAC,KAAK;YACpC,mBAAmB,EAAE,SAAS;YAC9B,YAAY,EAAE,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,IAAI;YACtD,+BAA+B,EAAE,WAAW;YAC5C,cAAc,EAAE;gBACd;oBACE,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,mBAAmB,EAAE,oBAAoB,CAAC,WAAW;iBACtD;aACF;SACF,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,UAAU,CACd,QAeyB,EACzB,gBAAuC,EACvC,OAA2B;QAE3B,gEAAgE;QAChE,MAAM,WAAW,GAAG,4BAA4B,CAAC,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;QACpG,mBAAmB,CAAC,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC,YAAY,EAAE,gBAAgB,EAAE,UAAU,CAAC,CAAC;QACxF,YAAY,CAAC,QAAQ,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,YAAY,EAAE,gBAAgB,EAAE,MAAM,CAAC,CAAC;QACtF,MAAM,qBAAqB,GAAG,QAAQ,CAAC,UAAU,KAAK,SAAS,CAAC;QAChE,MAAM,6BAA6B,GAAG,QAAQ,CAAC,oBAAoB,KAAK,SAAS,CAAC;QAClF,IAAI,qBAAqB,KAAK,6BAA6B,EAAE,CAAC;YAC5D,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,UAAU,EACpB,gBAAgB,EAChB;gBACE,sBAAsB,EAAE,2BAA2B,CAAC,iCAAiC;gBACrF,OAAO,EAAE;oBACP,wBAAwB;oBACxB,UAAU,EAAE,QAAQ,CAAC,UAAU;oBAC/B,oBAAoB,EAAE,QAAQ,CAAC,oBAAoB;iBACpD;aACF,CACF,CAAC;QACJ,CAAC;QAED,IAAI,qBAAqB,IAAI,6BAA6B,EAAE,CAAC;YAC3D,kBAAkB,CAAC,QAAQ,CAAC,UAAU,EAAE,IAAI,CAAC,YAAY,EAAE,gBAAgB,EAAE,YAAY,CAAC,CAAC;YAC3F,4BAA4B,CAAC,QAAQ,CAAC,oBAAoB,EAAE,IAAI,CAAC,YAAY,EAAE,gBAAgB,EAAE,sBAAsB,CAAC,CAAC;QAC3H,CAAC;QAED,6BAA6B;QAC7B,IAAI,QAAQ,CAAC,KAAK,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YAC/D,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,UAAU,EACpB,gBAAgB,EAChB;gBACE,sBAAsB,EAAE,2BAA2B,CAAC,6BAA6B;gBACjF,OAAO,EAAE;oBACP,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,wBAAwB;iBAChD;aACF,CACF,CAAC;QACJ,CAAC;QAED,uDAAuD;QACvD,MAAM,cAAc,GAAG,QAAQ,CAAC,KAAK,EAAE,cAAc,IAAI,QAAQ,CAAC,cAAc,CAAC;QACjF,IAAI,cAAc,EAAE,CAAC;YACnB,sBAAsB,CAAC,cAAc,EAAE,IAAI,CAAC,YAAY,EAAE,gBAAgB,EAAE,gBAAgB,CAAC,CAAC;QAChG,CAAC;QAED,mGAAmG;QACnG,gGAAgG;QAChG,MAAM,WAAW,GAAG,IAAI,CAAC,iBAAiB,CAAC,gBAAgB,CAAC,CAAC;QAC7D,MAAM,aAAa,GAAG,QAAQ,CAAC,KAAK,EAAE,aAAa,IAAI,WAAW,CAAC,aAAa,CAAC;QACjF,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,UAAU,EACpB,gBAAgB,EAChB;gBACE,sBAAsB,EAAE,2BAA2B,CAAC,6BAA6B;aAClF,CACF,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,sBAAsB,EAAE;YACpC,QAAQ,EAAE,QAAQ,CAAC,QAAQ;YAC3B,YAAY,EAAE,QAAQ,CAAC,KAAK,EAAE,YAAY;YAC1C,cAAc;SACf,CAAC,CAAC;QAEH,kDAAkD;QAClD,MAAM,SAAS,GAAG,QAAQ,CAAC,SAAS,IAAI,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC;QAEzF,kFAAkF;QAClF,oFAAoF;QACpF,mFAAmF;QACnF,sFAAsF;QACtF,qFAAqF;QACrF,iFAAiF;QACjF,MAAM,yBAAyB,GAAG,QAAQ,CAAC,eAAe,IAAI,IAAI,CAAC,yBAAyB,EAAE,CAAC,UAAU,CAAC;QAE1G,MAAM,eAAe,GAAG,4BAA4B,CAAC,gBAAgB,CAAC,CAAC;QACvE,MAAM,iBAAiB,GAAG,qBAAqB,IAAI,6BAA6B;YAC9E,CAAC,CAAC;gBACE,UAAU,EAAE,QAAQ,CAAC,UAAW;gBAChC,oBAAoB,EAAE,QAAQ,CAAC,oBAAqB;aACrD;YACH,CAAC,CAAC,eAAe,CAAC;QAEpB,IAAI,qBAAqB,IAAI,6BAA6B;eACrD,eAAe;eACf,CACD,QAAQ,CAAC,UAAU,KAAK,eAAe,CAAC,UAAU;mBAC/C,QAAQ,CAAC,oBAAoB,KAAK,eAAe,CAAC,oBAAoB,CAC1E,EACD,CAAC;YACD,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,UAAU,EACpB,gBAAgB,EAChB;gBACE,sBAAsB,EAAE,2BAA2B,CAAC,sBAAsB;gBAC1E,OAAO,EAAE;oBACP,wBAAwB;oBACxB,UAAU,EAAE,QAAQ,CAAC,UAAU;oBAC/B,oBAAoB,EAAE,QAAQ,CAAC,oBAAoB;oBACnD,iBAAiB,EAAE,eAAe,CAAC,UAAU;oBAC7C,2BAA2B,EAAE,eAAe,CAAC,oBAAoB;iBAClE;aACF,CACF,CAAC;QACJ,CAAC;QAED,6EAA6E;QAC7E,oFAAoF;QACpF,MAAM,UAAU,GAAkB;YAChC,QAAQ,EAAE,QAAQ,CAAC,QAAQ;YAC3B,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB;YAC3C,QAAQ,EAAE,QAAQ,CAAC,QAAQ;YAC3B,IAAI,EAAE,QAAQ,CAAC,IAAI;YACnB,SAAS,EAAE,SAAS,IAAI,SAAS;YACjC,QAAQ,EAAE,QAAQ,CAAC,QAAQ;YAC3B,eAAe,EAAE,yBAAyB;YAC1C,MAAM,EAAE,UAAU,CAAC,OAAO;YAC1B,UAAU,EAAE,iBAAiB,EAAE,UAAU;YACzC,oBAAoB,EAAE,iBAAiB,EAAE,oBAAoB;YAC7D,iCAAiC;YACjC,YAAY,EAAE,QAAQ,CAAC,KAAK,EAAE,YAAY;YAC1C,aAAa;YACb,cAAc,EAAE,cAAc;YAC9B,MAAM,EAAE,QAAQ,CAAC,KAAK,EAAE,MAAM;SAC/B,CAAC;QAEF,6DAA6D;QAC7D,+EAA+E;QAC/E,oFAAoF;QACpF,qFAAqF;QACrF,sFAAsF;QACtF,mFAAmF;QACnF,yFAAyF;QACzF,MAAM,iBAAiB,GAAG,IAAI,GAAG,EAAkB,CAAC;QACpD,IAAI,QAAQ,CAAC,KAAK,EAAE,cAAc,EAAE,CAAC;YACnC,iBAAiB,CAAC,GAAG,CAAC,gBAAgB,EAAE,QAAQ,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;QACzE,CAAC;QACD,IAAI,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,CAAC;YAC3B,iBAAiB,CAAC,GAAG,CAAC,QAAQ,EAAE,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACzD,CAAC;QACD,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,8BAA8B,CAC/D,qBAAqB,CAAC,MAAM,EAC5B,gBAAgB,EAChB,iBAAiB,CAClB,CAAC;QAEF,sFAAsF;QACtF,sFAAsF;QACtF,mFAAmF;QACnF,sFAAsF;QACtF,MAAM,yBAAyB,GAAG,KAAK,EACrC,YAA2C,EAC5B,EAAE;YACjB,iFAAiF;YACjF,wDAAwD;YACxD,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,MAAM,CACnD,eAAe,EACf,UAAkB,EAClB,YAAY,CACb,CAAC;YAEF,wFAAwF;YACxF,0FAA0F;YAC1F,uFAAuF;YACvF,wFAAwF;YACxF,4BAA4B;YAC5B,MAAM,UAAU,GAAG,QAAQ,CAAC,KAAK;gBAC/B,CAAC,CAAC,cAAc,CAAC,gBAAgB,CAAC,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC,MAAM,CAAC;gBACrE,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC;YACvB,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,MAAM,CACtD,eAAe,EACf,EAAE,GAAG,EAAE,WAAW,CAAC,MAAM,EAAE,EAC3B,EAAE,UAAU,EAAmB,EAC/B,YAAY,CACb,CAAC;YAEF,IAAI,CAAC,cAAc,EAAE,CAAC;gBACpB,uFAAuF;gBACvF,iFAAiF;gBACjF,uFAAuF;gBACvF,UAAU;gBACV,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,2DAA2D,EAAE;oBAC9E,MAAM,EAAE,WAAW,CAAC,MAAM;iBAC3B,CAAC,CAAC;gBACH,IAAI,CAAC,QAAQ,CAAC,qBAAqB,EAAE,EAAE,MAAM,EAAE,WAAW,CAAC,MAAM,EAAE,CAAC,CAAC;gBACrE,OAAO,WAAW,CAAC;YACrB,CAAC;YAED,IAAI,CAAC,QAAQ,CAAC,qBAAqB,EAAE,EAAE,MAAM,EAAE,cAAc,CAAC,MAAM,EAAE,CAAC,CAAC;YACxE,OAAO,cAAc,CAAC;QACxB,CAAC,CAAC;QAEF,uFAAuF;QACvF,0FAA0F;QAC1F,wFAAwF;QACxF,uFAAuF;QACvF,kFAAkF;QAClF,EAAE;QACF,qFAAqF;QACrF,4FAA4F;QAC5F,yFAAyF;QACzF,2FAA2F;QAC3F,gBAAgB;QAChB,MAAM,UAAU,GAAG,IAAI,CAAC,aAAa,CAAC,gBAAgB,CAAC,CAAC;QACxD,IAAI,OAAO,EAAE,WAAW,EAAE,YAAY,KAAK,UAAU,CAAC,kBAAkB,EAAE,CAAC;YACzE,OAAO,yBAAyB,CAAC,OAAO,CAAC,CAAC;QAC5C,CAAC;QACD,OAAO,UAAU,CAAC,eAAe,CAAC,kBAAkB,CAClD,CAAC,kBAAkB,EAAE,EAAE,CAAC,yBAAyB,CAAC,EAAE,GAAG,OAAO,EAAE,WAAW,EAAE,kBAAkB,EAAE,CAAC,EAClG,EAAE,cAAc,EAAE,OAAO,EAAE,CAC5B,CAAC;IACJ,CAAC;IAED;;;;;;;;;;OAUG;IACK,aAAa,CAAC,gBAAuC;QAC3D,MAAM,UAAU,GAAG,IAAI,CAAC,6BAA6B,EAAE,6BAA6B,CAClF,gBAAgB,CAAC,KAAK,CACvB,CAAC;QAEF,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,aAAa,EACvB,gBAAgB,EAChB;gBACE,sBAAsB,EAAE,2BAA2B,CAAC,aAAa;gBACjE,OAAO,EAAE;oBACP,OAAO,EAAE,+DAA+D;oBACxE,YAAY,EAAE,gBAAgB,CAAC,KAAK;oBACpC,eAAe,EAAE,OAAO,CAAC,IAAI,CAAC,6BAA6B,CAAC;iBAC7D;aACF,CACF,CAAC;QACJ,CAAC;QAED,OAAO,UAAU,CAAC;IACpB,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,OAAO,CACX,MAAc,EACd,gBAAuC,EACvC,OAA2B;QAE3B,IAAI,CAAC,QAAQ,CAAC,qBAAqB,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QAEjD,kFAAkF;QAClF,cAAc,CAAC,MAAM,EAAE,IAAI,CAAC,YAAY,EAAE,gBAAgB,EAAE,QAAQ,CAAC,CAAC;QAEtE,6DAA6D;QAC7D,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,8BAA8B,CAC/D,qBAAqB,CAAC,IAAI,EAC1B,gBAAgB,CACjB,CAAC;QAEF,oFAAoF;QACpF,gEAAgE;QAChE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,IAAI,CAC1C,eAAe,EACf,EAAE,GAAG,EAAE,MAAM,EAAE,EACf,OAAO,CACR,CAAC;QAEF,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,IAAI,CAAC,QAAQ,CAAC,gBAAgB,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;YAC5C,OAAO,IAAI,CAAC;QACd,CAAC;QAED,yFAAyF;QACzF,mGAAmG;QACnG,kFAAkF;QAClF,kGAAkG;QAClG,iGAAiG;QACjG,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,sBAAsB,CAAC,CAAC;QAC1G,IAAI,CAAC,SAAS,EAAE,CAAC;YACb,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,aAAa,EACvB,gBAAgB,EAChB;gBACE,sBAAsB,EAAE,2BAA2B,CAAC,kBAAkB;gBACxE,OAAO,EAAE;oBACP,MAAM,EAAE,wBAAwB;iBACjC;aACF,CACF,CAAC;QACJ,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,aAAa,CACjB,OAAiB,EACjB,gBAAuC,EACvC,OAA2B;QAE3B,IAAI,CAAC,QAAQ,CAAC,4BAA4B,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;QAEhF,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,yFAAyF;QACzF,6BAA6B;QAC7B,EAAE;QACF,0FAA0F;QAC1F,yFAAyF;QACzF,4FAA4F;QAC5F,MAAM,YAAY,GAAG,OAAO,CAAC,MAAM,CACjC,CAAC,EAAE,EAAE,EAAE,CAAC,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,qBAAqB,CAAC,iBAAiB,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,CACzG,CAAC;QAEF,mDAAmD;QACnD,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC9B,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,MAAM,qBAAqB,GAAG,IAAI,CAAC,0BAA0B,CAAC,gBAAgB,CAAC,CAAC;QAChF,IAAI,CAAC,qBAAqB,EAAE,CAAC;YAC3B,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,UAAU,EACpB,gBAAgB,EAChB;gBACE,sBAAsB,EAAE,2BAA2B,CAAC,6BAA6B;gBACjF,OAAO,EAAE;oBACP,YAAY,EAAE,OAAO,CAAC,MAAM,EAAE,wBAAwB;iBACvD;aACF,CACF,CAAC;QACJ,CAAC;QAED,6DAA6D;QAC7D,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,8BAA8B,CAC/D,qBAAqB,CAAC,IAAI,EAC1B,gBAAgB,CACjB,CAAC;QAEF,gEAAgE;QAChE,8EAA8E;QAC9E,8EAA8E;QAC9E,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,IAAI,CAC3C,eAAe,EACf;YACE,8EAA8E;YAC9E,GAAG,EAAE,EAAE,GAAG,EAAE,YAAY,EAAE;YAC1B,GAAG,qBAAqB;SACzB,EACD,OAAO,CACR,CAAC;QAEF,0BAA0B;QAC1B,MAAM,eAAe,GAAW,EAAE,CAAC;QACnC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC;YACzE,IAAI,SAAS,EAAE,CAAC;gBACd,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC7B,CAAC;QACH,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,qBAAqB,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE,UAAU,EAAE,eAAe,CAAC,MAAM,EAAE,CAAC,CAAC;QAC7H,OAAO,eAAe,CAAC;IACzB,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAkCG;IACH,KAAK,CAAC,8BAA8B,CAClC,OAA0B,EAC1B,KAA2E;QAE3E,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,MAAM,aAAa,GAAG,KAAK,CAAC,aAAa,IAAI,IAAI,CAAC,gBAAgB,CAAC,aAAa,IAAI,SAAS,CAAC;QAC9F,MAAM,gBAAgB,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,oCAAoC,CAAC;YAC/F,YAAY,EAAE,gBAAgB,CAAC,KAAK;YACpC,mBAAmB,EAAE,qBAAqB,CAAC,IAAI;YAC/C,YAAY,EAAE;gBACZ,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC3C,GAAG,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,KAAK,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACzE,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAClD;YACD,cAAc,EAAE;gBACd;oBACE,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,mBAAmB,EAAE,oBAAoB,CAAC,WAAW;iBACtD;aACF;SACF,CAAC,CAAC;QAEH,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,IAAI,CAC3C,gBAAgB,EAChB,EAAE,GAAG,EAAE,EAAE,GAAG,EAAE,CAAC,GAAG,OAAO,CAAC,EAAE,EAAE,CAC/B,CAAC;QACF,MAAM,SAAS,GAAG,IAAI,GAAG,CAAe,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAkB,EAAE,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;QAElG,MAAM,QAAQ,GAAiF,EAAE,CAAC;QAClG,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YACnC,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,gBAAgB,EAAE;oBACzE,sBAAsB,EAAE,2BAA2B,CAAC,UAAU;oBAC9D,OAAO,EAAE,EAAE,OAAO,EAAE,2BAA2B,EAAE,MAAM,EAAE;iBAC1D,CAAC,CAAC;YACL,CAAC;YAED,sFAAsF;YACtF,qFAAqF;YACrF,IAAI,CAAC,0BAA0B,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;gBACjD,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,gBAAgB,EAAE;oBACzE,sBAAsB,EAAE,2BAA2B,CAAC,UAAU;oBAC9D,OAAO,EAAE,EAAE,OAAO,EAAE,6CAA6C,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE;iBACjG,CAAC,CAAC;YACL,CAAC;YAED,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,IAAI,EAAE,gBAAgB,EAAE,KAAK,CAAC,CAAC;YACjF,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,gBAAgB,EAAE;oBAC5E,sBAAsB,EAAE,2BAA2B,CAAC,aAAa;oBACjE,OAAO,EAAE,EAAE,OAAO,EAAE,8CAA8C,EAAE,MAAM,EAAE;iBAC7E,CAAC,CAAC;YACL,CAAC;YAED,MAAM,QAAQ,GAAG,IAAI,CAAC,yBAAyB,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC;YACxE,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,QAAQ,CACtC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,eAAe,EAAE,IAAI,CAAC,eAAe,EAAE,EAC3F,gBAAgB,CACjB,CAAC;YACF,MAAM,MAAM,GAAa,EAAE,CAAC;YAC5B,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC;gBAC1C,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;YACnE,CAAC;YAED,QAAQ,CAAC,IAAI,CAAC;gBACZ,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC;aAC7B,CAAC,CAAC;QACL,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,gBAAgB,CACpB,MAAc,EACd,MAAkB,EAClB,gBAAuC,EACvC,OAA2B,EAC3B,gBAAsC;QAEtC,IAAI,CAAC,QAAQ,CAAC,sBAAsB,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;QAE1D,kFAAkF;QAClF,cAAc,CAAC,MAAM,EAAE,IAAI,CAAC,YAAY,EAAE,gBAAgB,EAAE,QAAQ,CAAC,CAAC;QAEtE,0BAA0B;QAC1B,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,gBAAgB,EAAE,OAAO,CAAC,CAAC;QAC1E,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,SAAS,EACnB,gBAAgB,EAChB;gBACE,sBAAsB,EAAE,2BAA2B,CAAC,cAAc;gBAClE,OAAO,EAAE;oBACP,MAAM,EAAE,wBAAwB;iBACjC;aACF,CACF,CAAC;QACJ,CAAC;QAED,MAAM,kBAAkB,GAAG,uBAAuB,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QACvE,IAAI,CAAC,kBAAkB,EAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YAC1C,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,aAAa,EACvB,gBAAgB,EAChB;gBACE,sBAAsB,EAAE,2BAA2B,CAAC,8BAA8B;gBAClF,OAAO,EAAE;oBACP,wBAAwB;oBACxB,MAAM;oBACN,aAAa,EAAE,WAAW,CAAC,MAAM;oBACjC,eAAe,EAAE,MAAM;oBACvB,kBAAkB;iBACnB;aACF,CACF,CAAC;QACJ,CAAC;QAED,6DAA6D;QAC7D,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,8BAA8B,CAC/D,qBAAqB,CAAC,MAAM,EAC5B,gBAAgB,CACjB,CAAC;QAEF,sFAAsF;QACtF,gEAAgE;QAChE,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,MAAM,CACnD,eAAe,EACf,EAAE,GAAG,EAAE,MAAM,EAAE,EACf;YACE,MAAM;YACN,GAAG,CAAC,gBAAgB;gBAClB,CAAC,CAAC;oBACE,eAAe,EAAE,gBAAgB,CAAC,QAAQ;oBAC1C,UAAU,EAAE,gBAAgB,CAAC,UAAU;iBACxC;gBACH,CAAC,CAAC,EAAE,CAAC;YACP,SAAS,EAAE,IAAI,IAAI,EAAE;SACL,EAClB,OAAO,CACR,CAAC;QAEF,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,QAAQ,EAClB,gBAAgB,EAChB;gBACE,sBAAsB,EAAE,2BAA2B,CAAC,QAAQ;gBAC5D,OAAO,EAAE;oBACP,OAAO,EAAE,8BAA8B;oBACvC,MAAM;oBACN,MAAM;iBACP;aACF,CACF,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,qBAAqB,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,WAAW,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;QACnG,OAAO,WAAW,CAAC;IACrB,CAAC;IAED;;;;;;;;OAQG;IACK,KAAK,CAAC,gCAAgC,CAC5C,OAAgG,EAChG,IAAY,EACZ,OAA2B;QAE3B,IAAI,CAAC,IAAI,CAAC,aAAa,IAAI,CAAC,IAAI,CAAC,uBAAuB;YAAE,OAAO;QACjE,MAAM,EAAE,YAAY,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,OAAO,CAAC;QACxD,IAAI,CAAC,YAAY,IAAI,CAAC,UAAU,IAAI,CAAC,SAAS;YAAE,OAAO;QACvD,MAAM,gCAAgC,CACpC;YACE,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,uBAAuB,EAAE,IAAI,CAAC,uBAAuB;YACrD,MAAM,EAAE,IAAI,CAAC,MAAM;SACpB,EACD;YACE,YAAY,EAAE,YAA4B;YAC1C,WAAW,EAAE,CAAC,UAAU,CAAC;YACzB,kBAAkB,EAAE,CAAC,SAAS,CAAC;YAC/B,IAAI;YACJ,WAAW,EAAE,OAAO,EAAE,WAAW;SAClC,CACF,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;;;;;;OAgBG;IACH,KAAK,CAAC,kBAAkB,CACtB,MAAc,EACd,YAA0B,EAC1B,UAAkB,EAClB,SAAiB,EACjB,gBAAuC,EACvC,OAA2B;QAE3B,IAAI,CAAC,QAAQ,CAAC,0BAA0B,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC,CAAC;QAE3F,2EAA2E;QAC3E,cAAc,CAAC,MAAM,EAAE,IAAI,CAAC,YAAY,EAAE,gBAAgB,EAAE,QAAQ,CAAC,CAAC;QACtE,kBAAkB,CAAC,UAAU,EAAE,IAAI,CAAC,YAAY,EAAE,gBAAgB,EAAE,YAAY,CAAC,CAAC;QAClF,oBAAoB,CAAC,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,gBAAgB,EAAE,cAAc,CAAC,CAAC;QACxF,iBAAiB,CAAC,SAAS,EAAE,IAAI,CAAC,YAAY,EAAE,gBAAgB,EAAE,WAAW,CAAC,CAAC;QAE/E,2DAA2D;QAC3D,MAAM,YAAY,GAAG,IAAI,CAAC,6BAA6B,CAAC,YAAY,EAAE,gBAAgB,CAAC,CAAC;QAExF,6DAA6D;QAC7D,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,8BAA8B,CAC/D,qBAAqB,CAAC,MAAM,EAC5B,gBAAgB,CACjB,CAAC;QAEF,qGAAqG;QACrG,oFAAoF;QACpF,2EAA2E;QAC3E,0DAA0D;QAE1D;;;;;WAKG;QACH,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,MAAM,CACnD,eAAe,EACf;YACE,GAAG,EAAE,MAAM;YACX,6FAA6F;YAC7F,MAAM,EAAE,EAAE,GAAG,EAAE,CAAC,GAAG,sBAAsB,CAAC,EAAE;SAC7C,EACD;YACE,kBAAkB,EAAE,YAAY;YAChC,gBAAgB,EAAE,UAAU;YAC5B,eAAe,EAAE,SAAS;YAC1B,MAAM,EAAE,UAAU,CAAC,MAAM;YACzB,SAAS,EAAE,IAAI,IAAI,EAAE;YACrB,qCAAqC;YACrC,YAAY,EAAE,YAAY,CAAC,YAAY;YACvC,aAAa,EAAE,YAAY,CAAC,aAAa;YACzC,cAAc,EAAE,YAAY,CAAC,cAAc;YAC3C,MAAM,EAAE,YAAY,CAAC,MAAM;YAC3B,yDAAyD;YACzD,UAAU,EAAE,cAAc,CAAC,gBAAgB,CAAC,YAAY,EAAE,MAAM,CAAC;SACjD,EAClB,OAAO,CACR,CAAC;QAEF,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,uEAAuE;YACvE,+DAA+D;YAC/D,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,gBAAgB,EAAE,OAAO,CAAC,CAAC;YAC1E,IAAI,CAAC,WAAW,EAAE,CAAC;gBACjB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,SAAS,EACnB,gBAAgB,EAChB;oBACE,sBAAsB,EAAE,2BAA2B,CAAC,cAAc;oBAClE,OAAO,EAAE;wBACP,MAAM,EAAE,wBAAwB;qBACjC;iBACF,CACF,CAAC;YACJ,CAAC;YAED,6DAA6D;YAC7D,IAAI,WAAW,CAAC,MAAM,KAAK,UAAU,CAAC,MAAM;gBACxC,WAAW,CAAC,kBAAkB,KAAK,YAAY;gBAC/C,WAAW,CAAC,gBAAgB,KAAK,UAAU;gBAC3C,WAAW,CAAC,eAAe,KAAK,SAAS,EAAE,CAAC;gBAC9C,oEAAoE;gBACpE,IAAI,CAAC,QAAQ,CAAC,mDAAmD,EAAE;oBACjE,MAAM;oBACN,YAAY;oBACZ,UAAU;oBACV,SAAS;iBACV,CAAC,CAAC;gBACH,OAAO,WAAW,CAAC;YACrB,CAAC;YAED,6DAA6D;YAC7D,IAAI,WAAW,CAAC,MAAM,KAAK,UAAU,CAAC,MAAM,EAAE,CAAC;gBAC7C,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,aAAa,EACvB,gBAAgB,EAChB;oBACE,sBAAsB,EAAE,2BAA2B,CAAC,mBAAmB;oBACvE,OAAO,EAAE;wBACP,wBAAwB;wBACxB,MAAM;wBACN,yBAAyB,EAAE,WAAW,CAAC,kBAAkB;wBACzD,uBAAuB,EAAE,WAAW,CAAC,gBAAgB;wBACrD,sBAAsB,EAAE,WAAW,CAAC,eAAe;wBACnD,qBAAqB,EAAE,YAAY;wBACnC,mBAAmB,EAAE,UAAU;wBAC/B,kBAAkB,EAAE,SAAS;qBAC9B;iBACF,CACF,CAAC;YACJ,CAAC;YAED,4FAA4F;YAC5F,+FAA+F;YAC/F,8FAA8F;YAC9F,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,aAAa,EACvB,gBAAgB,EAChB;gBACE,sBAAsB,EAAE,WAAW,CAAC,MAAM,KAAK,UAAU,CAAC,QAAQ;oBAChE,CAAC,CAAC,2BAA2B,CAAC,qBAAqB;oBACnD,CAAC,CAAC,2BAA2B,CAAC,iBAAiB;gBACjD,OAAO,EAAE;oBACP,wBAAwB;oBACxB,MAAM;oBACN,UAAU,EAAE,WAAW,CAAC,MAAM;oBAC9B,gBAAgB,EAAE,CAAC,GAAG,sBAAsB,CAAC;oBAC7C,YAAY;oBACZ,UAAU;iBACX;aACF,CACF,CAAC;QACJ,CAAC;QAED,gGAAgG;QAChG,8FAA8F;QAC9F,MAAM,IAAI,CAAC,gCAAgC,CACzC,EAAE,YAAY,EAAE,UAAU,EAAE,SAAS,EAAE,EACvC,WAAW,EACX,OAAO,CACR,CAAC;QAEF,IAAI,CAAC,QAAQ,CAAC,yBAAyB,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,UAAU,EAAE,CAAC,CAAC;QAC/E,OAAO,WAAW,CAAC;IACrB,CAAC;IAED;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,sBAAsB,CAC1B,MAAc,EACd,gBAAuC,EACvC,OAA2B;QAE3B,IAAI,CAAC,QAAQ,CAAC,8BAA8B,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QAE1D,kFAAkF;QAClF,cAAc,CAAC,MAAM,EAAE,IAAI,CAAC,YAAY,EAAE,gBAAgB,EAAE,QAAQ,CAAC,CAAC;QAEtE,0BAA0B;QAC1B,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,gBAAgB,EAAE,OAAO,CAAC,CAAC;QAC1E,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,SAAS,EACnB,gBAAgB,EAChB;gBACE,sBAAsB,EAAE,2BAA2B,CAAC,cAAc;gBAClE,OAAO,EAAE;oBACP,MAAM,EAAE,wBAAwB;iBACjC;aACF,CACF,CAAC;QACJ,CAAC;QAED,6DAA6D;QAC7D,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,8BAA8B,CAC/D,qBAAqB,CAAC,MAAM,EAC5B,gBAAgB,CACjB,CAAC;QAEF,iEAAiE;QACjE,oGAAoG;QACpG,kGAAkG;QAClG,kHAAkH;QAClH,qGAAqG;QACrG,8DAA8D;QAC9D,MAAM,UAAU,GAAkB;YAChC,MAAM,EAAE,UAAU,CAAC,QAAQ;YAC3B,SAAS,EAAE,IAAI,IAAI,EAAE;SACtB,CAAC;QAEF;;;;;WAKG;QACH,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,MAAM,CACnD,eAAe,EACf,EAAE,GAAG,EAAE,MAAM,EAAE,EACf,UAAU,EACV,OAAO,CACR,CAAC;QAEF,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,QAAQ,EAClB,gBAAgB,EAChB;gBACE,sBAAsB,EAAE,2BAA2B,CAAC,QAAQ;gBAC5D,OAAO,EAAE;oBACP,OAAO,EAAE,qCAAqC;oBAC9C,MAAM;iBACP;aACF,CACF,CAAC;QACJ,CAAC;QAED,+FAA+F;QAC/F,sGAAsG;QACtG,MAAM,IAAI,CAAC,gCAAgC,CACzC;YACE,YAAY,EAAE,WAAW,CAAC,kBAAkB;YAC5C,UAAU,EAAE,WAAW,CAAC,gBAAgB;YACxC,SAAS,EAAE,WAAW,CAAC,eAAe;SACvC,EACD,aAAa,EACb,OAAO,CACR,CAAC;QAEF,IAAI,CAAC,QAAQ,CAAC,6BAA6B,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QACzD,OAAO,WAAW,CAAC;IACrB,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,UAAU,CACd,MAAc,EACd,gBAAuC,EACvC,OAA2B;QAE3B,IAAI,CAAC,QAAQ,CAAC,2BAA2B,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QAEvD,kFAAkF;QAClF,cAAc,CAAC,MAAM,EAAE,IAAI,CAAC,YAAY,EAAE,gBAAgB,EAAE,QAAQ,CAAC,CAAC;QAEtE,0BAA0B;QAC1B,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,gBAAgB,EAAE,OAAO,CAAC,CAAC;QAC1E,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,SAAS,EACnB,gBAAgB,EAChB;gBACE,sBAAsB,EAAE,2BAA2B,CAAC,cAAc;gBAClE,OAAO,EAAE;oBACP,MAAM,EAAE,wBAAwB;iBACjC;aACF,CACF,CAAC;QACJ,CAAC;QAED,6DAA6D;QAC7D,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,8BAA8B,CAC/D,qBAAqB,CAAC,MAAM,EAC5B,gBAAgB,CACjB,CAAC;QAEF,+CAA+C;QAE/C;;;;;WAKG;QACH,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,MAAM,CACnD,eAAe,EACf,EAAE,GAAG,EAAE,MAAM,EAAE,EACf;YACE,MAAM,EAAE,UAAU,CAAC,OAAO;YAC1B,SAAS,EAAE,IAAI,IAAI,EAAE;YACrB,SAAS,EAAE,IAAI,IAAI,EAAE;SACL,EAClB,OAAO,CACR,CAAC;QAEF,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,QAAQ,EAClB,gBAAgB,EAChB;gBACE,sBAAsB,EAAE,2BAA2B,CAAC,QAAQ;gBAC5D,OAAO,EAAE;oBACP,OAAO,EAAE,uBAAuB;oBAChC,MAAM;iBACP;aACF,CACF,CAAC;QACJ,CAAC;QAED,6FAA6F;QAC7F,iGAAiG;QACjG,2FAA2F;QAC3F,gGAAgG;QAChG,4DAA4D;QAC5D,MAAM,IAAI,CAAC,gCAAgC,CACzC;YACE,YAAY,EAAE,WAAW,CAAC,kBAAkB;YAC5C,UAAU,EAAE,WAAW,CAAC,gBAAgB;YACxC,SAAS,EAAE,WAAW,CAAC,eAAe;SACvC,EACD,aAAa,EACb,OAAO,CACR,CAAC;QAEF,IAAI,CAAC,QAAQ,CAAC,mBAAmB,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QAC/C,OAAO,WAAW,CAAC;IACrB,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,KAAK,CAAC,SAAS,CACb,MAAc,EACd,gBAAuC,EACvC,OAA2B;QAE3B,IAAI,CAAC,QAAQ,CAAC,iCAAiC,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QAE7D,cAAc,CAAC,MAAM,EAAE,IAAI,CAAC,YAAY,EAAE,gBAAgB,EAAE,QAAQ,CAAC,CAAC;QAEtE,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,gBAAgB,EAAE,OAAO,CAAC,CAAC;QAC1E,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,SAAS,EACnB,gBAAgB,EAChB;gBACE,sBAAsB,EAAE,2BAA2B,CAAC,cAAc;gBAClE,OAAO,EAAE;oBACP,MAAM,EAAE,wBAAwB;iBACjC;aACF,CACF,CAAC;QACJ,CAAC;QAED,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,8BAA8B,CAC/D,qBAAqB,CAAC,MAAM,EAC5B,gBAAgB,CACjB,CAAC;QAEF,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,MAAM,CAClD,eAAe,EACf,EAAE,GAAG,EAAE,MAAM,EAAE,EACf;YACE,MAAM,EAAE,UAAU,CAAC,OAAO;YAC1B,SAAS,EAAE,IAAI,IAAI,EAAE;YACrB,SAAS,EAAE,IAAI,IAAI,EAAE;YACrB,QAAQ,EAAE,4BAA4B;YACtC,gBAAgB,EAAE,4BAA4B;YAC9C,UAAU,EAAE,SAAS;YACrB,oBAAoB,EAAE,SAAS;SACf,EAClB,OAAO,CACR,CAAC;QAEF,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,QAAQ,EAClB,gBAAgB,EAChB;gBACE,sBAAsB,EAAE,2BAA2B,CAAC,QAAQ;gBAC5D,OAAO,EAAE;oBACP,OAAO,EAAE,sBAAsB;oBAC/B,MAAM;iBACP;aACF,CACF,CAAC;QACJ,CAAC;QAED,gGAAgG;QAChG,+FAA+F;QAC/F,iGAAiG;QACjG,4DAA4D;QAC5D,MAAM,IAAI,CAAC,gCAAgC,CACzC;YACE,YAAY,EAAE,WAAW,CAAC,kBAAkB;YAC5C,UAAU,EAAE,WAAW,CAAC,gBAAgB;YACxC,SAAS,EAAE,WAAW,CAAC,eAAe;SACvC,EACD,YAAY,EACZ,OAAO,CACR,CAAC;QAEF,IAAI,CAAC,QAAQ,CAAC,aAAa,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QACzC,OAAO,UAAU,CAAC;IACpB,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,cAAc,CAClB,MAAc,EACd,gBAAuC,EACvC,OAA2B;QAE3B,IAAI,CAAC,QAAQ,CAAC,uCAAuC,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QAEnE,cAAc,CAAC,MAAM,EAAE,IAAI,CAAC,YAAY,EAAE,gBAAgB,EAAE,QAAQ,CAAC,CAAC;QAEtE,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,8BAA8B,CAC3D,qBAAqB,CAAC,IAAI,EAC1B,gBAAgB,CACjB,CAAC;QACF,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,IAAI,CACjD,WAAW,EACX,EAAE,GAAG,EAAE,MAAM,EAAE,EACf,OAAO,CACR,CAAC;QAEF,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,SAAS,EACnB,gBAAgB,EAChB;gBACE,sBAAsB,EAAE,2BAA2B,CAAC,cAAc;gBAClE,OAAO,EAAE;oBACP,MAAM,EAAE,wBAAwB;iBACjC;aACF,CACF,CAAC;QACJ,CAAC;QAED,+EAA+E;QAC/E,kEAAkE;QAClE,IAAI,CAAC;YACH,MAAM,eAAe,GAAG,IAAI,CAAC,yBAAyB,CAAC,WAAW,EAAE,gBAAgB,CAAC,CAAC;YACtF,MAAM,eAAe,CAAC,MAAM,CAAC,WAAW,EAAE,gBAAgB,CAAC,CAAC;QAC9D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,mBAAmB,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,SAAS,EAAE,CAAC;gBACtE,MAAM,KAAK,CAAC;YACd,CAAC;YAED,IAAI,CAAC,QAAQ,CAAC,2EAA2E,EAAE;gBACzF,MAAM;aACP,CAAC,CAAC;QACL,CAAC;QAED,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,8BAA8B,CAC7D,qBAAqB,CAAC,MAAM,EAC5B,gBAAgB,CACjB,CAAC;QACF,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,MAAM,CACrD,aAAa,EACb,EAAE,GAAG,EAAE,MAAM,EAAE,EACf,OAAO,CACR,CAAC;QAEF,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,QAAQ,EAClB,gBAAgB,EAChB;gBACE,sBAAsB,EAAE,2BAA2B,CAAC,QAAQ;gBAC5D,OAAO,EAAE;oBACP,OAAO,EAAE,4BAA4B;oBACrC,MAAM;iBACP;aACF,CACF,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,6CAA6C,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QACzE,OAAO,WAAW,CAAC;IACrB,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,oBAAoB,CACxB,YAA0B,EAC1B,UAAkB,EAClB,SAA6B,EAC7B,gBAAuC,EACvC,OAA2B;QAE3B,IAAI,CAAC,gBAAgB,EAAE,CAAC;YACtB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,QAAQ,EAClB,EAA2B,EAC3B;gBACE,sBAAsB,EAAE,2BAA2B,CAAC,QAAQ;gBAC5D,OAAO,EAAE;oBACP,OAAO,EAAE,wDAAwD;iBAClE;aACF,CACF,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,4BAA4B,EAAE,EAAE,YAAY,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC,CAAC;QAErF,2EAA2E;QAC3E,kBAAkB,CAAC,UAAU,EAAE,IAAI,CAAC,YAAY,EAAE,gBAAgB,EAAE,YAAY,CAAC,CAAC;QAClF,oBAAoB,CAAC,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,gBAAgB,EAAE,cAAc,CAAC,CAAC;QACxF,IAAI,SAAS,EAAE,CAAC;YACd,iBAAiB,CAAC,SAAS,EAAE,IAAI,CAAC,YAAY,EAAE,gBAAgB,EAAE,WAAW,CAAC,CAAC;QACjF,CAAC;QAED,kFAAkF;QAClF,2FAA2F;QAC3F,mGAAmG;QACnG,+FAA+F;QAC/F,6FAA6F;QAC7F,oGAAoG;QACpG,4FAA4F;QAC5F,sGAAsG;QACtG,oGAAoG;QACpG,oGAAoG;QACpG,qFAAqF;QACrF,MAAM,yBAAyB,GAAG,MAAM,IAAI,CAAC,qCAAqC,CAChF,YAAY,EACZ,UAAU,EACV,gBAAgB,EAChB,OAAO,CACR,CAAC;QACF,MAAM,YAAY,GAAG,IAAI,CAAC,6BAA6B,CAAC,YAAY,EAAE,gBAAgB,EAAE,yBAAyB,CAAC,CAAC;QACnH,MAAM,WAAW,GAAG,IAAI,CAAC,uBAAuB,CAAC,YAAY,CAAC,CAAC;QAC/D,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,UAAU,EACpB,gBAAgB,EAChB;gBACE,sBAAsB,EAAE,2BAA2B,CAAC,4BAA4B;aACjF,CACF,CAAC;QACJ,CAAC;QAED,eAAe;QACf,wEAAwE;QACxE,4EAA4E;QAC5E,mDAAmD;QACnD,MAAM,MAAM,GAAQ;YAClB,kBAAkB,EAAE,YAAY;YAChC,gBAAgB,EAAE,UAAU;YAC5B,MAAM,EAAE;gBACN,GAAG,EAAE,CAAC,UAAU,CAAC,MAAM,EAAE,UAAU,CAAC,QAAQ,EAAE,UAAU,CAAC,KAAK,CAAC;aAChE;YACD,GAAG,WAAW;SACf,CAAC;QAEF,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,CAAC,eAAe,GAAG,SAAS,CAAC;QACrC,CAAC;QAED,6DAA6D;QAC7D,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,8BAA8B,CAC/D,qBAAqB,CAAC,IAAI,EAC1B,gBAAgB,CACjB,CAAC;QAEF,kFAAkF;QAClF,qEAAqE;QACrE,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,IAAI,CAC3C,eAAe,EACf,MAAM,EACN,OAAO,CACR,CAAC;QAEF,oGAAoG;QACpG,wGAAwG;QACxG,sGAAsG;QACtG,mGAAmG;QACnG,mGAAmG;QACnG,iFAAiF;QACjF,MAAM,eAAe,GAAW,EAAE,CAAC;QACnC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,IAAI,EAAE,gBAAgB,EAAE;gBACvE,aAAa,EAAE,YAAY,CAAC,aAAa;gBACzC,cAAc,EAAE,YAAY,CAAC,cAAc;gBAC3C,MAAM,EAAE,YAAY,CAAC,MAAM;aAC5B,CAAC,CAAC;YACH,IAAI,SAAS,EAAE,CAAC;gBACd,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC7B,CAAC;QACH,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,mCAAmC,EAAE,EAAE,YAAY,EAAE,UAAU,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE,UAAU,EAAE,eAAe,CAAC,MAAM,EAAE,CAAC,CAAC;QAC1I,OAAO,eAAe,CAAC;IACzB,CAAC;IAED;;;;;;;;;;;;;OAaG;IACH,KAAK,CAAC,mBAAmB,CACvB,IAAU,EACV,gBAAuC;IACvC;;;;;;;;;OASG;IACH,0BAAiG;QAEjG,MAAM,WAAW,GAAG,0BAA0B,IAAI,IAAI,CAAC,iBAAiB,CAAC,gBAAgB,CAAC,CAAC;QAE3F,6EAA6E;QAC7E,6EAA6E;QAC7E,uCAAuC;QACvC,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;YACvB,IAAI,CAAC,IAAI,CAAC,cAAc,IAAI,CAAC,WAAW,CAAC,cAAc,EAAE,CAAC;gBACxD,IAAI,CAAC,QAAQ,CAAC,mEAAmE,EAAE;oBACjF,kBAAkB,EAAE,IAAI,CAAC,cAAc;oBACvC,qBAAqB,EAAE,WAAW,CAAC,cAAc;iBAClD,CAAC,CAAC;gBACH,OAAO,KAAK,CAAC;YACf,CAAC;YAED,IAAI,IAAI,CAAC,cAAc,KAAK,WAAW,CAAC,cAAc,EAAE,CAAC;gBACvD,IAAI,CAAC,QAAQ,CAAC,oDAAoD,EAAE;oBAClE,kBAAkB,EAAE,IAAI,CAAC,cAAc;oBACvC,qBAAqB,EAAE,WAAW,CAAC,cAAc;iBAClD,CAAC,CAAC;gBACH,OAAO,KAAK,CAAC;YACf,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,4BAA4B;QAC5B,QAAQ,IAAI,CAAC,YAAY,EAAE,CAAC;YAC1B,KAAK,oBAAoB,CAAC,WAAW;gBACnC,IAAI,CAAC,IAAI,CAAC,aAAa,IAAI,IAAI,CAAC,aAAa,KAAK,WAAW,CAAC,aAAa,EAAE,CAAC;oBAC5E,IAAI,CAAC,QAAQ,CAAC,0CAA0C,EAAE;wBACxD,iBAAiB,EAAE,IAAI,CAAC,aAAa;wBACrC,oBAAoB,EAAE,WAAW,CAAC,aAAa;qBAChD,CAAC,CAAC;oBACH,OAAO,KAAK,CAAC;gBACf,CAAC;gBACD,OAAO,IAAI,CAAC;YAEd,KAAK,oBAAoB,CAAC,aAAa,CAAC,CAAC,CAAC;gBACxC,8FAA8F;gBAC9F,0FAA0F;gBAC1F,+FAA+F;gBAC/F,IAAI,WAAW,CAAC,cAAc,EAAE,CAAC;oBAC/B,IAAI,IAAI,CAAC,cAAc,KAAK,WAAW,CAAC,cAAc,EAAE,CAAC;wBACvD,IAAI,CAAC,QAAQ,CAAC,2CAA2C,EAAE;4BACzD,kBAAkB,EAAE,IAAI,CAAC,cAAc;4BACvC,qBAAqB,EAAE,WAAW,CAAC,cAAc;yBAClD,CAAC,CAAC;wBACH,OAAO,KAAK,CAAC;oBACf,CAAC;oBACD,OAAO,IAAI,CAAC;gBACd,CAAC;gBAED;;;;;;;;;;;;;;;;;mBAiBG;gBACH,OAAO,IAAI,CAAC,qCAAqC,CAAC,IAAI,CAAC,cAAc,EAAE,gBAAgB,CAAC,CAAC;YAC3F,CAAC;YAED,KAAK,oBAAoB,CAAC,SAAS;gBACjC,gFAAgF;gBAChF,oFAAoF;gBACpF,iFAAiF;gBACjF,sDAAsD;gBACtD,IAAI,IAAI,CAAC,MAAM,KAAK,WAAW,CAAC,MAAM,EAAE,CAAC;oBACvC,IAAI,CAAC,QAAQ,CAAC,mCAAmC,EAAE;wBACjD,UAAU,EAAE,IAAI,CAAC,MAAM;wBACvB,aAAa,EAAE,WAAW,CAAC,MAAM;qBAClC,CAAC,CAAC;oBACH,OAAO,KAAK,CAAC;gBACf,CAAC;gBACD,OAAO,IAAI,CAAC;YAEd;gBACE,8BAA8B;gBAC9B,IAAI,CAAC,QAAQ,CAAC,0CAA0C,EAAE;oBACxD,YAAY,EAAE,IAAI,CAAC,YAAY;iBAChC,CAAC,CAAC;gBACH,OAAO,KAAK,CAAC;QACjB,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACH,kBAAkB,CAAC,IAAU;QAkB3B,+DAA+D;QAC/D,8EAA8E;QAC9E,MAAM,MAAM,GAAuB,IAAI,CAAC,MAA4B,IAAI,wBAAwB,CAAC,SAAS,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QAE3H,OAAO;YACL,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,QAAQ,EAAE,IAAI,CAAC,gBAAgB,IAAI,IAAI,CAAC,QAAQ;YAChD,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,MAAM;YACN,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,oBAAoB,EAAE,IAAI,CAAC,oBAAoB;SAChD,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACH;;;;;;;;;;;;;;;;;OAiBG;IACK,qCAAqC,CAAC,kBAAsC,EAAE,gBAAuC;QAC3H,IAAI,CAAC,kBAAkB,EAAE,CAAC;YACxB,IAAI,CAAC,QAAQ,CAAC,4EAA4E,CAAC,CAAC;YAC5F,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,UAAU,GAAG,CAAC,gBAAgB,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC,IAAI,CAC7D,CAAC,QAAQ,EAAE,EAAE,CACX,QAAQ,CAAC,mBAAmB,KAAK,oBAAoB,CAAC,aAAa;YACnE,0BAA0B,CAAC,QAAQ,CAAC;YACpC,QAAQ,CAAC,iBAAiB,KAAK,kBAAkB,CACpD,CAAC;QACF,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,IAAI,CAAC,QAAQ,CAAC,8FAA8F,EAAE;gBAC5G,kBAAkB;aACnB,CAAC,CAAC;YACH,OAAO,KAAK,CAAC;QACf,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAES,iBAAiB,CAAC,gBAAuC;QAKjE,MAAM,cAAc,GAAG,IAAI,CAAC,uBAAuB,CAAC,cAAc,CAAC,gBAAgB,EAAE,cAAc,CAAC,CAAC;QACrG,MAAM,MAAM,GAAG,IAAI,CAAC,uBAAuB,CAAC,cAAc,CAAC,gBAAgB,EAAE,MAAM,CAAC,CAAC;QACrF,8EAA8E;QAC9E,kFAAkF;QAClF,gFAAgF;QAChF,kFAAkF;QAClF,6EAA6E;QAC7E,MAAM,aAAa,GAAG,gBAAgB,CAAC,aAAa,IAAI,IAAI,CAAC,gBAAgB,CAAC,aAAa,CAAC;QAE5F,OAAO;YACL,aAAa;YACb,cAAc;YACd,MAAM;SACP,CAAC;IACJ,CAAC;IAED;;;OAGG;IACO,0BAA0B,CAAC,gBAAuC;QAC1E,MAAM,WAAW,GAAG,IAAI,CAAC,iBAAiB,CAAC,gBAAgB,CAAC,CAAC;QAC7D,MAAM,aAAa,GAA8B,EAAE,CAAC;QAEpD,IAAI,WAAW,CAAC,aAAa,EAAE,CAAC;YAC9B,aAAa,CAAC,IAAI,CAAC;gBACjB,YAAY,EAAE,oBAAoB,CAAC,WAAW;gBAC9C,aAAa,EAAE,WAAW,CAAC,aAAa;aACzC,CAAC,CAAC;QACL,CAAC;QAED,IAAI,WAAW,CAAC,cAAc,EAAE,CAAC;YAC/B,8EAA8E;YAC9E,aAAa,CAAC,IAAI,CAAC;gBACjB,cAAc,EAAE,WAAW,CAAC,cAAc;aAC3C,CAAC,CAAC;QACL,CAAC;QAED,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC/B,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,aAAa,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,aAAa,EAAE,CAAC;IAChF,CAAC;IAES,uBAAuB,CAAC,KAA2B;QAC3D,QAAQ,KAAK,CAAC,YAAY,EAAE,CAAC;YAC3B,KAAK,oBAAoB,CAAC,WAAW;gBACnC,OAAO,KAAK,CAAC,aAAa;oBACxB,CAAC,CAAC;wBACE,YAAY,EAAE,oBAAoB,CAAC,WAAW;wBAC9C,aAAa,EAAE,KAAK,CAAC,aAAa;qBACnC;oBACH,CAAC,CAAC,IAAI,CAAC;YACX,KAAK,oBAAoB,CAAC,aAAa;gBACrC,OAAO,KAAK,CAAC,cAAc;oBACzB,CAAC,CAAC;wBACE,cAAc,EAAE,KAAK,CAAC,cAAc;qBACrC;oBACH,CAAC,CAAC,IAAI,CAAC;YACX,KAAK,oBAAoB,CAAC,SAAS;gBACjC,qFAAqF;gBACrF,OAAO,KAAK,CAAC,MAAM;oBACjB,CAAC,CAAC;wBACE,YAAY,EAAE,oBAAoB,CAAC,SAAS;wBAC5C,MAAM,EAAE,KAAK,CAAC,MAAM;qBACrB;oBACH,CAAC,CAAC,IAAI,CAAC;YACX;gBACE,OAAO,IAAI,CAAC;QAChB,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;;;;;;OAiBG;IACK,KAAK,CAAC,qCAAqC,CACjD,YAA0B,EAC1B,UAAkB,EAClB,gBAAuC,EACvC,OAA2B;QAE3B,MAAM,YAAY,GAChB,IAAI,CAAC,iBAAiB,CAAC,wBAAwB,CAAC,YAAY,CAAC,EAAE,oBAAoB;eAChF,oBAAoB,CAAC,aAAa,CAAC;QAExC,MAAM,WAAW,GAAG,IAAI,CAAC,iBAAiB,CAAC,gBAAgB,CAAC,CAAC;QAC7D,MAAM,qBAAqB,GACzB,YAAY,KAAK,oBAAoB,CAAC,WAAW;eAC9C,CAAC,YAAY,KAAK,oBAAoB,CAAC,SAAS,IAAI,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC;eACzE,CAAC,YAAY,KAAK,oBAAoB,CAAC,aAAa,IAAI,CAAC,CAAC,WAAW,CAAC,cAAc,CAAC,CAAC;QAC3F,IAAI,qBAAqB,EAAE,CAAC;YAC1B,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,MAAM,UAAU,GAAG,IAAI,CAAC,oBAAoB,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC;QACzE,IAAI,CAAC,UAAU,EAAE,iBAAiB,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE,CAAC;YAC/D,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,IAAI,CAA0B,gBAAgB,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC;YAClG,OAAO,GAAG,IAAI,SAAS,CAAC;QAC1B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;;;OAcG;IACO,6BAA6B,CACrC,YAA0B,EAC1B,gBAAuC;IACvC;;;;;OAKG;IACH,iBAA2C;QAE3C,6DAA6D;QAC7D,MAAM,cAAc,GAAG,IAAI,CAAC,iBAAiB,CAAC,wBAAwB,CAAC,YAAY,CAAC,CAAC;QAErF,+CAA+C;QAC/C,4CAA4C;QAC5C,MAAM,YAAY,GAAG,cAAc,EAAE,oBAAoB,IAAI,oBAAoB,CAAC,aAAa,CAAC;QAEhG,MAAM,WAAW,GAAG,IAAI,CAAC,iBAAiB,CAAC,gBAAgB,CAAC,CAAC;QAE7D,8FAA8F;QAC9F,iGAAiG;QACjG,+FAA+F;QAC/F,MAAM,uBAAuB,GAAG,iCAAiC,CAAC,YAAY,CAAC,CAAC;QAChF,MAAM,WAAW,GAAG,iBAAiB,EAAE,CAAC,uBAAuB,CAAC,CAAC;QACjE,MAAM,aAAa,GAAG,WAAW,IAAI,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAE5E,QAAQ,YAAY,EAAE,CAAC;YACrB,KAAK,oBAAoB,CAAC,WAAW;gBACnC,IAAI,CAAC,WAAW,CAAC,aAAa,EAAE,CAAC;oBAC/B,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,UAAU,EACpB,gBAAgB,EAChB;wBACE,sBAAsB,EAAE,2BAA2B,CAAC,6BAA6B;wBACjF,OAAO,EAAE;4BACP,YAAY,EAAE,wBAAwB;yBACvC;qBACF,CACF,CAAC;gBACJ,CAAC;gBACD,OAAO;oBACL,YAAY,EAAE,oBAAoB,CAAC,WAAW;oBAC9C,aAAa,EAAE,WAAW,CAAC,aAAa;iBACzC,CAAC;YAEJ,KAAK,oBAAoB,CAAC,aAAa,CAAC,CAAC,CAAC;gBACxC,4FAA4F;gBAC5F,MAAM,cAAc,GAAG,WAAW,CAAC,cAAc,IAAI,aAAa,CAAC;gBACnE,IAAI,CAAC,cAAc,EAAE,CAAC;oBACpB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,UAAU,EACpB,gBAAgB,EAChB;wBACE,sBAAsB,EAAE,2BAA2B,CAAC,6BAA6B;wBACjF,OAAO,EAAE;4BACP,YAAY,EAAE,wBAAwB;yBACvC;qBACF,CACF,CAAC;gBACJ,CAAC;gBACD,IAAI,CAAC,WAAW,CAAC,aAAa,EAAE,CAAC;oBAC/B,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,UAAU,EACpB,gBAAgB,EAChB;wBACE,sBAAsB,EAAE,2BAA2B,CAAC,6BAA6B;wBACjF,OAAO,EAAE;4BACP,YAAY,EAAE,wBAAwB;yBACvC;qBACF,CACF,CAAC;gBACJ,CAAC;gBACD,OAAO;oBACL,YAAY,EAAE,oBAAoB,CAAC,aAAa;oBAChD,aAAa,EAAE,WAAW,CAAC,aAAa;oBACxC,cAAc;iBACf,CAAC;YACJ,CAAC;YAED,KAAK,oBAAoB,CAAC,SAAS,CAAC,CAAC,CAAC;gBACpC,gFAAgF;gBAChF,6EAA6E;gBAC7E,6EAA6E;gBAC7E,yFAAyF;gBACzF,+EAA+E;gBAC/E,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,IAAI,aAAa,CAAC;gBACnD,IAAI,CAAC,MAAM,EAAE,CAAC;oBACZ,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,UAAU,EACpB,gBAAgB,EAChB;wBACE,sBAAsB,EAAE,2BAA2B,CAAC,6BAA6B;wBACjF,OAAO,EAAE;4BACP,YAAY,EAAE,wBAAwB;yBACvC;qBACF,CACF,CAAC;gBACJ,CAAC;gBACD,IAAI,CAAC,WAAW,CAAC,aAAa,EAAE,CAAC;oBAC/B,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,UAAU,EACpB,gBAAgB,EAChB;wBACE,sBAAsB,EAAE,2BAA2B,CAAC,6BAA6B;wBACjF,OAAO,EAAE;4BACP,YAAY,EAAE,wBAAwB;yBACvC;qBACF,CACF,CAAC;gBACJ,CAAC;gBACD,OAAO;oBACL,YAAY,EAAE,oBAAoB,CAAC,SAAS;oBAC5C,aAAa,EAAE,WAAW,CAAC,aAAa;oBACxC,MAAM;iBACP,CAAC;YACJ,CAAC;YAED;gBACE,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,aAAa,EACvB,gBAAgB,EAChB;oBACE,sBAAsB,EAAE,2BAA2B,CAAC,aAAa;oBACjE,OAAO,EAAE;wBACP,OAAO,EAAE,yFAAyF;wBAClG,YAAY;wBACZ,YAAY;qBACb;iBACF,CACF,CAAC;QACN,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACK,gBAAgB,CAAC,QAAgB;QACvC,MAAM,OAAO,GAAG,QAAQ,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QAC1C,IAAI,OAAO,KAAK,CAAC,CAAC,IAAI,OAAO,KAAK,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtD,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,OAAO,QAAQ,CAAC,SAAS,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;IACvD,CAAC;CACF,CAAA;AAvvEY,mBAAmB;IAD/B,UAAU,EAAE;IAKR,WAAA,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAA;IAEjC,WAAA,MAAM,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,CAAA;IAE9C,WAAA,MAAM,CAAC,kBAAkB,CAAC,uBAAuB,CAAC,CAAA;IAElD,WAAA,MAAM,CAAC,kBAAkB,CAAC,kCAAkC,CAAC,CAAA;IAE7D,WAAA,MAAM,CAAC,kBAAkB,CAAC,qCAAqC,CAAC,CAAA;IAEhE,WAAA,MAAM,CAAC,kBAAkB,CAAC,8BAA8B,CAAC,CAAA;IAEzD,WAAA,MAAM,CAAC,kBAAkB,CAAC,iBAAiB,CAAC,CAAA;IAE5C,WAAA,MAAM,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,CAAA;IAE3C,WAAA,MAAM,CAAC,kBAAkB,CAAC,oCAAoC,CAAC,CAAA;IAC/D,WAAA,QAAQ,EAAE,CAAA;IAOV,WAAA,MAAM,CAAC,kBAAkB,CAAC,8BAA8B,CAAC,CAAA;IACzD,WAAA,QAAQ,EAAE,CAAA;IAEV,YAAA,MAAM,CAAC,kBAAkB,CAAC,oBAAoB,CAAC,CAAA;IAC/C,YAAA,QAAQ,EAAE,CAAA;+CAzBoB,0BAA0B;QAErB,+BAA+B;QAE5B,yCAAyC;QAEtC,qCAAqC;QAErC,qCAAqC;QAE3C,+BAA+B;QAEhC,uBAAuB;QAGT,2CAA2C;GAtBnF,mBAAmB,CAuvE/B","sourcesContent":["/**\n * Files Backend Service\n *\n * Manages file metadata and coordinates with storage providers (MinIO/S3).\n * Files are stored in external storage, this service tracks metadata in MongoDB.\n *\n * Features:\n * - File upload coordination\n * - File metadata management\n * - File linking to resources\n * - File access authorization\n * - File lifecycle management (status tracking)\n */\n\nimport { injectable, inject, optional } from 'inversify';\nimport type { Response, NextFunction } from 'express';\nimport type { Readable } from 'stream';\nimport { CoreResourceOperation, CoreResourceType, ResourceType, ErrorType, ErrorCustomMessageReference, FileUploaderEntityType, type FileUploaderOwnership, ResourcePrimaryScope, PRIMARY_SCOPE_TO_FIELD_IDENTIFIER, CORE_APP_ROLES, Resources_SharedUtils, isOrganizationWideRoleInfo, isWildoBackendError, WildoHeaderKeys } from '@wildo-ai/saas-models';\nimport { File, FileStatus, FILE_STATUS_TRANSITIONS, FILE_LINKABLE_STATUSES, FILE_DOWNLOADABLE_STATUSES, FileScopeIdentifiers, FileScopeUtils, FileServeVariant, ERASED_FILE_NAME_PLACEHOLDER } from '@wildo-ai/saas-models';\nimport { resolveFileDisplayNature, type FileDisplayNature, type FileStorageAccepted } from '@wildo-ai/zod-decorators';\nimport { SAAS_SERVICE_TYPES } from '~wildo-backend-lib/inject/models/service-types';\nimport type { LoggerService } from '~wildo-backend-lib/monitoring/logger/services/logger.service';\nimport { ErrorBuilderBackendService } from '~wildo-backend-lib/errors/services/error-builder.backend.service';\nimport { describeCaughtError, projectCaughtErrorLogFields } from '~wildo-backend-lib/errors/utils/error-log-level-classification.backend.utils';\nimport { ResourcesRegistryBackendService } from '~wildo-backend-lib/resources/services/resources-registry.backend.service';\nimport { ExecutionContext } from '~wildo-backend-lib/runtime/models/execution-context.backend.schemas';\nimport { ExecutionContextCreatorBackendService } from '~wildo-backend-lib/runtime/services/execution-context-creator.backend.service';\nimport { ResourceOperationHelperBackendService } from '~wildo-backend-lib/base-classes/services/resource-operations-helper.backend.service';\nimport type { BackendResourceRepository } from '~wildo-backend-lib/base-classes/services/repositories/repositories-registry-handler.backend.service';\nimport { RepositoriesRegistryHandlerBackendService } from '~wildo-backend-lib/base-classes/services/repositories/repositories-registry-handler.backend.service';\nimport { RepositoryOptions } from '~wildo-backend-lib/base-classes/models/repositories.backend.schemas';\nimport { validateFileId, validateResourceId, validateResourceType, validateFieldName, validateSize, validateUploadedBy, validateUploadedByEntityType, validateOrganizationId, validateContentType, resolveConfiguredMaxFileSize, validateStream } from '~wildo-backend-lib/files/utils/file-validation.utils';\nimport { setContentDispositionHeader } from '~wildo-backend-lib/files/utils/file-upload.utils';\nimport { resolveFileUploaderPrincipal } from '~wildo-backend-lib/files/utils/file-uploader.utils';\nimport { generateImageThumbnail, collectStreamToBuffer, isThumbnailableImage, THUMBNAIL_SOURCE_MAX_BYTES } from '~wildo-backend-lib/files/utils/image-thumbnail.backend.utils';\nimport { getFileFieldSchemaMetadataByPath } from '~wildo-backend-lib/files/utils/file-field-schema-path.backend.utils';\nimport { AppConfigurationService } from '~wildo-backend-lib/config/services/app-configuration.backend.service';\nimport { FileStorageRouterBackendService } from '~wildo-backend-lib/files/storage/file-storage-router.backend.service';\nimport type { IFileStorageProvider, StorageUploadResult } from '~wildo-backend-lib/files/storage/file-storage-provider.types';\nimport { ResourcePersistenceUnitOfWorkBackendService } from '~wildo-backend-lib/databases/services/resource-persistence-unit-of-work.backend.service';\nimport type { ResourcePersistenceResourceStore } from '~wildo-backend-lib/databases/services/resource-persistence-unit-of-work.backend.service';\nimport type { RagSourceFieldDetectionBackendService } from '~wildo-backend-lib/files/services/rag-source-field-detection.backend.service';\nimport type { RagChunkStoreBackendService } from '~wildo-backend-lib/rag/services/rag-chunk-store.backend.service';\nimport { scheduleRagChunkRemovalForFields } from '~wildo-backend-lib/rag/utils/rag-chunk-removal.backend.utils';\n\n/**\n * Content-Security-Policy applied to EVERY file-byte response (see\n * `FilesBackendService.streamFileToResponse`). `default-src 'none'` blocks all\n * subresource loads + inline/script execution; `sandbox` (with NO `allow-*`\n * tokens) drops the response into a fully-restricted sandbox if it is navigated\n * to directly at the top level — so an attacker-uploaded HTML/SVG can never run\n * script, submit a form, or navigate. Media loaded via `<img>`/`<video>` is\n * unaffected: those are governed by the EMBEDDING page's CSP, not this response's.\n * Same pattern GitHub/Dropbox use for user-uploaded content.\n */\nconst FILE_SERVE_CONTENT_SECURITY_POLICY = \"default-src 'none'; sandbox\";\n\n/**\n * Media types that must NEVER be served `inline`, even when a preview is\n * requested, because a browser parses them into an ACTIVE document context that\n * can execute script (the classic stored-XSS-via-upload vector). They are forced\n * to `attachment` (download) instead. Safe media (`image/*` except SVG, `video/*`,\n * `audio/*`, `application/pdf`) keep the requested `inline` disposition.\n * Matched against the leading media type only (`; charset=…` params ignored).\n */\nconst DANGEROUS_INLINE_CONTENT_TYPES = new Set<string>([\n  'text/html',\n  'application/xhtml+xml',\n  'image/svg+xml',\n]);\n\n/** True when `contentType` must not be rendered inline (see the set above). */\nfunction isDangerousInlineContentType(contentType: string | undefined): boolean {\n  if (!contentType) return false;\n  const mediaType = contentType.split(';', 1)[0]!.trim().toLowerCase();\n  return DANGEROUS_INLINE_CONTENT_TYPES.has(mediaType);\n}\n\n/**\n * Cache policy for a generated thumbnail response: `private` (auth-gated bytes —\n * never a shared/CDN cache), fresh for a day, and `immutable` because a thumbnail is\n * fully determined by the file's id + version. The response ETag encodes both, so a\n * client holding a still-fresh thumbnail never revalidates; replacing the underlying\n * image bumps `updatedAt`, which changes the ETag and busts the cache. Applied ONLY\n * to the thumbnail path — the original-bytes path relies on the storage\n * ETag/Last-Modified it already forwards.\n */\nconst THUMBNAIL_CACHE_CONTROL = 'private, max-age=86400, immutable';\n\n@injectable()\nexport class FilesBackendService {\n  protected logDebug: (message: string, context?: Record<string, unknown>) => void;\n\n  constructor(\n    @inject(SAAS_SERVICE_TYPES.Logger)\n    private readonly logger: LoggerService,\n    @inject(SAAS_SERVICE_TYPES.ErrorBuilderService)\n    private readonly errorBuilder: ErrorBuilderBackendService,\n    @inject(SAAS_SERVICE_TYPES.ResourceRegistryService)\n    private readonly resourcesRegistry: ResourcesRegistryBackendService,\n    @inject(SAAS_SERVICE_TYPES.RepositoriesRegistryHandlerService)\n    private readonly repositoriesRegistry: RepositoriesRegistryHandlerBackendService,\n    @inject(SAAS_SERVICE_TYPES.ExecutionContextCreatorBackendService)\n    private readonly executionContextCreator: ExecutionContextCreatorBackendService,\n    @inject(SAAS_SERVICE_TYPES.ResourceOperationHelperService)\n    private readonly resourceOperationHelper: ResourceOperationHelperBackendService,\n    @inject(SAAS_SERVICE_TYPES.FileStorageRouter)\n    private readonly fileStorageRouter: FileStorageRouterBackendService,\n    @inject(SAAS_SERVICE_TYPES.AppConfigService)\n    private readonly appConfigService: AppConfigurationService,\n    @inject(SAAS_SERVICE_TYPES.ResourcePersistenceUnitOfWorkService)\n    @optional()\n    private readonly resourcePersistenceUnitOfWork?: ResourcePersistenceUnitOfWorkBackendService,\n    // RAG derived-data tier (plan D3): file link/unlink/delete/erase mutate WHICH file backs a\n    // FILE_EXTRACTION `.ragSource()` field, so the affected field's chunk set is removed in the same\n    // decision (seam helper below). `@optional()` keeps minimal test containers constructing — the\n    // seams no-op without the pair, and the startup capability probe owns refusing a real\n    // application whose RAG-source resources have no usable store.\n    @inject(SAAS_SERVICE_TYPES.RagSourceFieldDetectionService)\n    @optional()\n    private readonly ragSourceFieldDetection?: RagSourceFieldDetectionBackendService,\n    @inject(SAAS_SERVICE_TYPES.RagChunkStoreService)\n    @optional()\n    private readonly ragChunkStore?: RagChunkStoreBackendService,\n  ) {\n    this.logDebug = this.logger.debugByType('FilesBackendService');\n    this.logger.setDebugTypeLogging('FilesBackendService', false);\n\n    this.logDebug('FilesBackendService initialized');\n  }\n\n  /**\n   * Get the files repository for internal operations.\n   * Lazy getter to ensure repository is initialized.\n   */\n  private get filesRepository(): BackendResourceRepository<any, any, any> {\n    return this.repositoriesRegistry.getRepositoryOrThrow(CoreResourceType.FILES, {} as ExecutionContext<any>);\n  }\n\n  private getDefaultStorageProvider(): IFileStorageProvider {\n    return this.fileStorageRouter.getDefaultProvider();\n  }\n\n  public getStorageProviderForFile(\n    file: Pick<File, 'fileId' | 'storageProvider' | 'storageRef'>,\n    executionContext: ExecutionContext<any>,\n  ): IFileStorageProvider {\n    if (!file.storageProvider) {\n      this.logDebug('Falling back to default storage provider for legacy file row', {\n        fileId: file.fileId,\n      });\n      return this.getDefaultStorageProvider();\n    }\n\n    const provider = this.fileStorageRouter.getProviderById(file.storageProvider);\n    if (!provider) {\n      throw this.errorBuilder.buildError(\n        ErrorType.INTERNAL,\n        executionContext,\n        {\n          customMessageReference: ErrorCustomMessageReference.INTERNAL,\n          context: {\n            message: 'No registered storage provider matches the persisted file routing',\n            fileId: file.fileId,\n            storageProvider: file.storageProvider,\n          },\n        }\n      );\n    }\n\n    return provider;\n  }\n\n  /**\n   * Stream a file's bytes from its storage provider to an Express response.\n   *\n   * Shared streaming seam used by BOTH the global `FileController` download route\n   * and the resource-integrated file **serve** route. Callers own authorization\n   * BEFORE invoking this (the global controller via file-scope/token checks; the\n   * resource serve route via the parent resource's READ authorization + a\n   * link-ownership assertion) — this method performs NO authorization, it only\n   * pipes bytes and manages the stream/response lifecycle.\n   *\n   * Sets Content-Type / Content-Length / ETag / Last-Modified from the storage\n   * download result, and Content-Disposition from `disposition` (`inline` for\n   * preview surfaces like avatars/PDFs, `attachment` for forced downloads).\n   * Registers stream/response error + close handlers before piping so an\n   * immediate storage error is caught and the source stream is always destroyed\n   * on client disconnect.\n   *\n   * @param file - The file record (already fetched + authorized by the caller).\n   * @param res - Express response to pipe into.\n   * @param executionContext - Context for storage-provider resolution/errors.\n   * @param options.disposition - `inline` (default) or `attachment`.\n   * @param options.next - Express `next` to forward pre-header stream errors.\n   * @param options.variant - `original` (default) streams the stored bytes as-is;\n   *   `thumbnail` delegates to `serveImageThumbnail` for eligible raster images.\n   *   Non-images, oversized sources, and resize failures transparently fall through\n   *   to the original-bytes streaming path — a preview request never hard-fails.\n   */\n  public async streamFileToResponse(\n    file: File,\n    res: Response,\n    executionContext: ExecutionContext<any> | undefined,\n    options?: { disposition?: 'inline' | 'attachment'; next?: NextFunction; variant?: FileServeVariant },\n  ): Promise<void> {\n    const disposition = options?.disposition ?? 'inline';\n    const next = options?.next;\n    const variant = options?.variant ?? FileServeVariant.ORIGINAL;\n\n    // ── THUMBNAIL VARIANT — a preview surface asked for a downscaled rendition.\n    //\n    // TWO refusals, and they are deliberately NOT the same shape (#478):\n    //\n    //  1. The field SUPPRESSED derived renditions (`imageConstraints.generateThumbnails: false`).\n    //     This is a declared intent — cost, or privacy on a sensitive image — so it REFUSES.\n    //     Falling through to the original bytes, which is what every other ineligible case does,\n    //     would serve the FULL-SIZE image to a caller who asked for a small one: the exact\n    //     outcome an author suppressing thumbnails is trying to prevent. A control that degrades\n    //     into serving more data than was asked for is worse than no control.\n    //\n    //  2. The file cannot be thumbnailed (non-image, zero-size, oversized, or a resize failure\n    //     inside `serveImageThumbnail`). Nothing was declared about it, so the original bytes are\n    //     the honest answer and a preview request never hard-fails.\n    //\n    // Both gates read RECORDED state — the field's declared metadata and the file's own\n    // `mimeType`/`size` — so neither costs a storage round-trip.\n    if (variant === FileServeVariant.THUMBNAIL && !this.fieldPermitsDerivedRenditions(file)) {\n      throw this.errorBuilder.buildError(\n        ErrorType.VALIDATION,\n        executionContext as any,\n        {\n          customMessageReference: ErrorCustomMessageReference.VALIDATION,\n          context: {\n            message: 'This file field suppresses derived renditions; request the original variant instead.',\n            fileId: file.fileId,\n            linkedResourceType: file.linkedResourceType,\n            linkedFieldName: file.linkedFieldName,\n          },\n        },\n      );\n    }\n\n    const canThumbnail =\n      variant === FileServeVariant.THUMBNAIL &&\n      isThumbnailableImage(file.mimeType) &&\n      (file.size ?? 0) > 0 &&\n      (file.size ?? 0) <= THUMBNAIL_SOURCE_MAX_BYTES;\n    if (canThumbnail) {\n      await this.serveImageThumbnail(file, res, executionContext, next);\n      return;\n    }\n\n    this.logDebug('Streaming file to response', { fileId: file.fileId, disposition });\n\n    let stream: Readable | null = null;\n\n    try {\n      const storageProvider = this.getStorageProviderForFile(file, executionContext as any);\n      const downloadResult = await storageProvider.download(file, executionContext as any);\n      stream = downloadResult.stream;\n\n      // Validate stream before use (ensures stream is readable and not destroyed).\n      validateStream(stream, this.errorBuilder, executionContext as any, 'downloadStream');\n\n      // Storage metadata is more accurate than the DB copy for transport headers.\n      if (res.headersSent) {\n        this.logger.warn('Response headers already sent, cannot set file response headers', {\n          fileId: file.fileId,\n        });\n      } else {\n        const contentType = downloadResult.contentType || file.mimeType;\n        res.setHeader(WildoHeaderKeys.CONTENT_TYPE, contentType);\n\n        // ── SECURITY (untrusted bytes) — file content is user-uploaded and must\n        // NEVER be able to execute as stored XSS. Two always-on response defenses:\n        //   1. `X-Content-Type-Options: nosniff` — the browser must honour the\n        //      declared Content-Type and not MIME-sniff a body into executable HTML.\n        //   2. file-serve CSP (`default-src 'none'; sandbox`) — even a directly\n        //      navigated HTML/SVG runs no script (see the const's doc above).\n        // These are cheap, unconditional, and safe for legitimate media.\n        // Standard lowercase HTTP header names, set as literals here (rather than via\n        // the cross-package WildoHeaderKeys registry) to keep this untrusted-bytes\n        // serving seam self-contained — see the `FILE_SERVE_CONTENT_SECURITY_POLICY` doc.\n        res.setHeader('x-content-type-options', 'nosniff');\n        res.setHeader('content-security-policy', FILE_SERVE_CONTENT_SECURITY_POLICY);\n\n        const contentLength = downloadResult.size > 0 ? downloadResult.size : (file.size || 0);\n        if (contentLength > 0) {\n          res.setHeader(WildoHeaderKeys.CONTENT_LENGTH, contentLength.toString());\n        }\n\n        // ── SECURITY (disposition) — a `preview` (inline) request is only honoured\n        // for SAFE media; script-capable types (html/xhtml/svg) are forced to\n        // `attachment` so the browser downloads rather than renders them in a\n        // document context. Belt-and-braces with nosniff + CSP above.\n        const effectiveDisposition =\n          disposition === 'inline' && isDangerousInlineContentType(contentType)\n            ? 'attachment'\n            : disposition;\n        const filename = file.originalFilename || file.fileId || 'file';\n        setContentDispositionHeader(res, filename, effectiveDisposition);\n\n        // ETag / Last-Modified are standard HTTP headers (not platform headers).\n        if (downloadResult.etag) {\n          res.setHeader(WildoHeaderKeys.ETAG, downloadResult.etag);\n        }\n        if (downloadResult.lastModified) {\n          res.setHeader(WildoHeaderKeys.LAST_MODIFIED, downloadResult.lastModified.toUTCString());\n        }\n      }\n\n      // Register error handlers BEFORE piping so immediate errors are caught.\n      stream.on('error', (error) => {\n        this.logger.error('Stream error while serving file from storage', {\n          fileId: file.fileId,\n          ...projectCaughtErrorLogFields(error),\n        });\n        if (!res.headersSent) {\n          if (next) {\n            next(error);\n            return;\n          }\n          res.status(500).end();\n        } else if (stream && !stream.destroyed) {\n          stream.destroy();\n        }\n      });\n\n      res.on('error', (error) => {\n        this.logger.error('Response error while streaming file', {\n          fileId: file.fileId,\n          ...projectCaughtErrorLogFields(error),\n        });\n        if (stream && !stream.destroyed) {\n          stream.destroy();\n        }\n      });\n\n      // Client disconnect / response finished → destroy the source stream.\n      res.on('close', () => {\n        if (stream && !stream.destroyed) {\n          stream.destroy();\n        }\n      });\n\n      stream.pipe(res);\n    } catch (error) {\n      if (stream && !stream.destroyed) {\n        try {\n          stream.destroy();\n        } catch (destroyError) {\n          this.logger.warn('Failed to destroy stream during error cleanup', {\n            fileId: file.fileId,\n            ...projectCaughtErrorLogFields(destroyError),\n            originalError: describeCaughtError(error),\n          });\n        }\n      }\n\n      this.logger.error('Failed to stream file from storage', {\n        fileId: file.fileId,\n        ...projectCaughtErrorLogFields(error),\n      });\n      throw error;\n    }\n  }\n\n  /**\n   * Does the DECLARING field permit derived renditions of this file?\n   *\n   * Reads `imageConstraints.generateThumbnails` off the file field's own schema metadata,\n   * resolved from the file's recorded `linkedResourceType` + `linkedFieldName`. Until #478 the\n   * flag was declared, set on the framework's own user-avatar field, and read by nothing — every\n   * eligible raster image got a rendition whether or not its author had asked for one, and an\n   * author who set it `false` for cost or privacy got thumbnails and no error. It degraded in the\n   * PERMISSIVE direction, which is why it was worth wiring rather than deleting.\n   *\n   * ## Absence means PERMIT, at three different levels, and each is deliberate\n   *\n   * A file with no `linkedResourceType`/`linkedFieldName` (a standalone upload), a field the\n   * registry cannot resolve, a field with no `imageConstraints`, or `imageConstraints` with no\n   * `generateThumbnails` — all permit. Only an EXPLICIT `false` suppresses. The flag is opt-OUT:\n   * nobody has declared it today except to say `true`, and a resolution failure must not become a\n   * silent refusal on a preview surface that works now.\n   *\n   * The `{ sizes: [...] }` form counts as permission. Its sizes are not honoured — the derivation\n   * has one fixed longest-edge — so it is truthy-permits here and nothing more; an author reading\n   * this should not expect their sizes to reach the renderer.\n   */\n  private fieldPermitsDerivedRenditions(file: File): boolean {\n    const resourceType = file.linkedResourceType;\n    const fieldName = file.linkedFieldName;\n    if (!resourceType || !fieldName) {\n      return true;\n    }\n\n    const resourceConfig = this.resourcesRegistry.getResourceConfiguration(resourceType as ResourceType);\n    if (!resourceConfig?.mainSchema) {\n      return true;\n    }\n\n    let resolved: ReturnType<typeof getFileFieldSchemaMetadataByPath>;\n    try {\n      resolved = getFileFieldSchemaMetadataByPath(resourceConfig.mainSchema, fieldName);\n    } catch (error) {\n      // The walker throws on schema shapes it refuses to descend (plain unions, dynamic\n      // containers). That is a question about the SCHEMA, not about this file's permission —\n      // serving a preview is the safe answer, and the walker's own consumers report the shape.\n      this.logDebug('Could not resolve file field metadata for the rendition gate; permitting', {\n        fileId: file.fileId,\n        resourceType,\n        fieldName,\n        ...projectCaughtErrorLogFields(error),\n      });\n      return true;\n    }\n\n    return resolved?.fileMetadata.imageConstraints?.generateThumbnails !== false;\n  }\n\n  /**\n   * Serve a downscaled `webp` thumbnail of a raster image — the `?variant=thumbnail`\n   * path of {@link streamFileToResponse}.\n   *\n   * Unlike the original-bytes path, this BUFFERS the source in memory to hand it to\n   * libvips. Callers MUST gate on {@link isThumbnailableImage} + a size ceiling\n   * before delegating here (see `streamFileToResponse`). On any resize failure the\n   * ORIGINAL bytes (already buffered) are returned with their real content-type, so a\n   * corrupt/edge-case image degrades to \"full image\" rather than a 500.\n   *\n   * Applies the SAME untrusted-bytes hardening as the streaming path (`nosniff` +\n   * file-serve CSP) plus an immutable, version-keyed cache policy so the resize cost\n   * is paid at most once per (file, version) per client.\n   *\n   * @param file - The image file record (already fetched + authorized by the caller).\n   * @param res - Express response to write the encoded thumbnail into.\n   * @param executionContext - Context for storage-provider resolution/errors.\n   * @param next - Express `next` to forward pre-header errors to the error middleware.\n   */\n  private async serveImageThumbnail(\n    file: File,\n    res: Response,\n    executionContext: ExecutionContext<any> | undefined,\n    next: NextFunction | undefined,\n  ): Promise<void> {\n    this.logDebug('Serving image thumbnail', { fileId: file.fileId, size: file.size });\n\n    try {\n      const storageProvider = this.getStorageProviderForFile(file, executionContext as any);\n      const downloadResult = await storageProvider.download(file, executionContext as any);\n      const stream = downloadResult.stream;\n      validateStream(stream, this.errorBuilder, executionContext as any, 'thumbnailSourceStream');\n\n      // BUFFER the full source (this path can't stream — libvips needs the bytes).\n      // The cap is a defensive backstop; the caller already pre-filtered on file.size.\n      const sourceBuffer = await collectStreamToBuffer(stream, THUMBNAIL_SOURCE_MAX_BYTES);\n      const thumbnail = await generateImageThumbnail(sourceBuffer);\n\n      if (res.headersSent) {\n        this.logger.warn('Response headers already sent, cannot serve thumbnail', {\n          fileId: file.fileId,\n        });\n        return;\n      }\n\n      // Resize failure → serve the ORIGINAL bytes we already hold (degrade to full\n      // image, never a 500). Only reachable for raster images (caller-gated).\n      const body = thumbnail ? thumbnail.data : sourceBuffer;\n      const contentType = thumbnail\n        ? thumbnail.contentType\n        : downloadResult.contentType || file.mimeType;\n      if (!thumbnail) {\n        this.logger.warn('Thumbnail generation failed; serving original image bytes', {\n          fileId: file.fileId,\n          mimeType: file.mimeType,\n        });\n      }\n\n      // ── SECURITY (untrusted bytes) — identical to the streaming path: honour the\n      // declared type (nosniff) and neutralise any directly-navigated document\n      // (file-serve CSP). A generated webp is inert; the original-bytes fallback is a\n      // raster image, so `inline` is always safe here (html/svg never reach this method).\n      res.setHeader(WildoHeaderKeys.CONTENT_TYPE, contentType);\n      res.setHeader('x-content-type-options', 'nosniff');\n      res.setHeader('content-security-policy', FILE_SERVE_CONTENT_SECURITY_POLICY);\n      res.setHeader(WildoHeaderKeys.CONTENT_LENGTH, body.length.toString());\n\n      // Immutable, version-keyed cache — see `THUMBNAIL_CACHE_CONTROL`. `updatedAt`\n      // participates in the ETag so replacing the image busts stale copies.\n      res.setHeader(WildoHeaderKeys.CACHE_CONTROL, THUMBNAIL_CACHE_CONTROL);\n      const version = file.updatedAt instanceof Date ? file.updatedAt.getTime() : '';\n      res.setHeader(WildoHeaderKeys.ETAG, `\"thumb-${file.fileId}-${version}\"`);\n\n      const filename = file.originalFilename || file.fileId || 'file';\n      setContentDispositionHeader(res, filename, 'inline');\n\n      res.end(body);\n    } catch (error) {\n      this.logger.error('Failed to serve image thumbnail', {\n        fileId: file.fileId,\n        ...projectCaughtErrorLogFields(error),\n      });\n      if (!res.headersSent) {\n        if (next) {\n          next(error as Error);\n          return;\n        }\n        res.status(500).end();\n        return;\n      }\n      throw error;\n    }\n  }\n\n  /**\n   * Build the internal execution context for a FILES (`REPOSITORY_ONLY`) repository\n   * operation invoked as a side effect of an originating request (a resource CREATE\n   * that generates a PDF, an upload handler, a link, a cleanup pass).\n   *\n   * The originating context carries two distinct concerns; this routes each correctly:\n   *\n   * - **Identity (`initiatorIds`) stays application-only.** The builder produces an\n   *   `INTERNALLY_INITIATED_REQUEST`, whose `ExecutionContext` invariant forbids the\n   *   user's `organizationId` / `userId` on `initiatorIds` (only `applicationId`).\n   *   Forwarding the user's full identity here 500'd every user-initiated file write.\n   *   `applicationId` is seeded from the originating context (or the single app tenant)\n   *   for a second reason: the FILES resource is APPLICATION-scoped, so a missing\n   *   `applicationId` would trigger `populateApplicationIdIfNeeded`'s internal\n   *   APPLICATION read, which would apply this op's scope map and fail (the APPLICATIONS\n   *   schema has no `organizationId`). Seeding it skips that read.\n   * - **Scope (`scopeFields` → `contextResourcesFieldIdentifier`) carries the file's own\n   *   tenant scope.** A FILES record's `organizationId` / `userId` are scope fields that\n   *   the create DTO strips and `enrichDataWithContext` re-injects from the context map;\n   *   they are SECONDARY scopes (FILES' primary scope is `applicationId`), so they are\n   *   not auto-re-injected. Callers that know the file's scope (CREATE) pass it here so\n   *   the record is correctly tenant-scoped and `authorizeFileAccess` later matches the\n   *   caller's org; by-id operations omit it (they resolve by `_id`).\n   *\n   * `createForInternalRepositoryOperation` resolves the FILES `REPOSITORY_ONLY`\n   * operation `REPOSITORY_ONLY`-preferred (URL-fallback); the URL-only resolver would\n   * throw `RESOURCES_REGISTRY_OPERATION_PATH_NOT_FOUND` for the non-URL-bearing FILES\n   * resource.\n   */\n  private async createInternalExecutionContext(\n    operation: CoreResourceOperation,\n    providedContext: ExecutionContext<any>,\n    scopeFields?: Map<string, string>,\n  ): Promise<ExecutionContext<any>> {\n    const applicationId = providedContext.applicationId ?? this.appConfigService.applicationId;\n\n    return this.executionContextCreator.createForInternalRepositoryOperation({\n      resourceType: CoreResourceType.FILES,\n      operationIdentifier: operation,\n      initiatorIds: applicationId ? { applicationId } : null,\n      contextResourcesFieldIdentifier: scopeFields,\n      initiatorRoles: [\n        {\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          relatedPrimaryScope: ResourcePrimaryScope.APPLICATION,\n        },\n      ],\n    });\n  }\n\n  /**\n   * Create a new file record with status PENDING.\n   * Called before upload starts to reserve the fileId.\n   *\n   * Scope can be provided at creation time (when known) or derived later\n   * when linking to a resource via linkFileToResource().\n   *\n   * @param fileData - Initial file data (filename, mimeType, size, etc.)\n   * @param executionContext - Execution context for authorization\n   * @param options - Repository options\n   * @returns Created file record with fileId\n   */\n  async createFile(\n    fileData: {\n      filename: string;\n      originalFilename: string;\n      mimeType: string;\n      size: number;\n      extension?: string;\n      checksum?: string;\n      /** Resolved storage provider. Falls back to default when omitted. */\n      storageProvider?: FileStorageAccepted;\n      // Scope identifiers - segregated (not hierarchical)\n      // If not provided, will be derived when linking to resource\n      scope?: FileScopeIdentifiers;\n      // Legacy: organizationId for backward compatibility\n      // Use scope.organizationId instead for new code\n      organizationId?: string;\n    } & FileUploaderOwnership,\n    executionContext: ExecutionContext<any>,\n    options?: RepositoryOptions\n  ): Promise<File> {\n    // Validate inputs (CRITICAL: Prevents invalid data propagation)\n    const maxFileSize = resolveConfiguredMaxFileSize(this.appConfigService.config.storage?.maxFileSize);\n    validateContentType(fileData.mimeType, this.errorBuilder, executionContext, 'mimeType');\n    validateSize(fileData.size, maxFileSize, this.errorBuilder, executionContext, 'size');\n    const hasExplicitUploadedBy = fileData.uploadedBy !== undefined;\n    const hasExplicitUploaderEntityType = fileData.uploadedByEntityType !== undefined;\n    if (hasExplicitUploadedBy !== hasExplicitUploaderEntityType) {\n      throw this.errorBuilder.buildError(\n        ErrorType.VALIDATION,\n        executionContext,\n        {\n          customMessageReference: ErrorCustomMessageReference.FILE_UPLOADER_FIELDS_INCONSISTENT,\n          context: {\n            // diagnostic (log-only)\n            uploadedBy: fileData.uploadedBy,\n            uploadedByEntityType: fileData.uploadedByEntityType,\n          },\n        }\n      );\n    }\n\n    if (hasExplicitUploadedBy && hasExplicitUploaderEntityType) {\n      validateUploadedBy(fileData.uploadedBy, this.errorBuilder, executionContext, 'uploadedBy');\n      validateUploadedByEntityType(fileData.uploadedByEntityType, this.errorBuilder, executionContext, 'uploadedByEntityType');\n    }\n\n    // Validate scope if provided\n    if (fileData.scope && !FileScopeUtils.validate(fileData.scope)) {\n      throw this.errorBuilder.buildError(\n        ErrorType.VALIDATION,\n        executionContext,\n        {\n          customMessageReference: ErrorCustomMessageReference.FILE_SCOPE_IDENTIFIER_INVALID,\n          context: {\n            scope: fileData.scope, // diagnostic (log-only)\n          },\n        }\n      );\n    }\n\n    // Derive organizationId from scope or use legacy field\n    const organizationId = fileData.scope?.organizationId || fileData.organizationId;\n    if (organizationId) {\n      validateOrganizationId(organizationId, this.errorBuilder, executionContext, 'organizationId');\n    }\n\n    // Derive applicationId from scope (always set after schema fix) or fall back to execution context.\n    // applicationId is the top-level tenant isolation field — always required on every file record.\n    const accessScope = this.deriveAccessScope(executionContext);\n    const applicationId = fileData.scope?.applicationId ?? accessScope.applicationId;\n    if (!applicationId) {\n      throw this.errorBuilder.buildError(\n        ErrorType.VALIDATION,\n        executionContext,\n        {\n          customMessageReference: ErrorCustomMessageReference.FILE_SCOPE_IDENTIFIER_MISSING,\n        }\n      );\n    }\n\n    this.logDebug('Creating file record', {\n      filename: fileData.filename,\n      primaryScope: fileData.scope?.primaryScope,\n      organizationId,\n    });\n\n    // Extract extension from filename if not provided\n    const extension = fileData.extension || this.extractExtension(fileData.originalFilename);\n\n    // NOTE (insert-first): the file's identity is the Mongo-generated `_id` (surfaced\n    // externally as the `fileId` virtual). `storageKey` embeds that identity, so it can\n    // only be derived AFTER the row exists — it is computed + persisted in a follow-up\n    // update below, not at insert time. (Previously a `fileId` was pre-generated here and\n    // stored as a second identity, which both diverged from `_id` and — being a stripped\n    // `excludeFromCreate` primary key — failed Mongoose's required-path validation.)\n    const resolvedStorageProviderId = fileData.storageProvider ?? this.getDefaultStorageProvider().providerId;\n\n    const derivedUploader = resolveFileUploaderPrincipal(executionContext);\n    const uploaderPrincipal = hasExplicitUploadedBy && hasExplicitUploaderEntityType\n      ? {\n          uploadedBy: fileData.uploadedBy!,\n          uploadedByEntityType: fileData.uploadedByEntityType!,\n        }\n      : derivedUploader;\n\n    if (hasExplicitUploadedBy && hasExplicitUploaderEntityType\n      && derivedUploader\n      && (\n        fileData.uploadedBy !== derivedUploader.uploadedBy\n        || fileData.uploadedByEntityType !== derivedUploader.uploadedByEntityType\n      )\n    ) {\n      throw this.errorBuilder.buildError(\n        ErrorType.VALIDATION,\n        executionContext,\n        {\n          customMessageReference: ErrorCustomMessageReference.FILE_UPLOADER_MISMATCH,\n          context: {\n            // diagnostic (log-only)\n            uploadedBy: fileData.uploadedBy,\n            uploadedByEntityType: fileData.uploadedByEntityType,\n            derivedUploadedBy: derivedUploader.uploadedBy,\n            derivedUploadedByEntityType: derivedUploader.uploadedByEntityType,\n          },\n        }\n      );\n    }\n\n    // Prepare file record data. No `fileId` (it is the virtual projection of the\n    // Mongo-generated `_id`) and no `storageKey` (derived from `_id`, set post-insert).\n    const fileRecord: Partial<File> = {\n      filename: fileData.filename,\n      originalFilename: fileData.originalFilename,\n      mimeType: fileData.mimeType,\n      size: fileData.size,\n      extension: extension || undefined,\n      checksum: fileData.checksum,\n      storageProvider: resolvedStorageProviderId,\n      status: FileStatus.PENDING,\n      uploadedBy: uploaderPrincipal?.uploadedBy,\n      uploadedByEntityType: uploaderPrincipal?.uploadedByEntityType,\n      // Scope identifiers (segregated)\n      primaryScope: fileData.scope?.primaryScope,\n      applicationId,\n      organizationId: organizationId,\n      userId: fileData.scope?.userId,\n    };\n\n    // Create internal execution context for repository operation\n    // Carry the file's OWN tenant scope (per its `primaryScope`) into the internal\n    // context so the `organizationId` / `userId` scope fields — stripped from the FILES\n    // create DTO and re-injected from the context map — land on the record. Sourced from\n    // the explicit `fileData.scope` (already correct for the file's primaryScope: org for\n    // ORGANIZATIONS, user-only for USER_SELF, neither for APPLICATION), so no spurious\n    // scope is set. Without this the file is scope-less and `authorizeFileAccess` denies it.\n    const createScopeFields = new Map<string, string>();\n    if (fileData.scope?.organizationId) {\n      createScopeFields.set('organizationId', fileData.scope.organizationId);\n    }\n    if (fileData.scope?.userId) {\n      createScopeFields.set('userId', fileData.scope.userId);\n    }\n    const internalContext = await this.createInternalExecutionContext(\n      CoreResourceOperation.CREATE,\n      executionContext,\n      createScopeFields\n    );\n\n    // The file is persisted as TWO writes — insert (Mongo assigns `_id`, surfaced via the\n    // `fileId` virtual) then a storageKey update derived from that identity. They MUST be\n    // atomic: a crash between them would otherwise commit a `storageKey`-less row (the\n    // pre-transaction design's regression). The wrapping transaction below makes them so.\n    const persistFileWithStorageKey = async (\n      writeOptions: RepositoryOptions | undefined,\n    ): Promise<File> => {\n      // Create file record via repository. Mongo generates `_id`; the `fileId` virtual\n      // projects it, so `createdFile.fileId === String(_id)`.\n      const createdFile = await this.filesRepository.create<File>(\n        internalContext,\n        fileRecord as File,\n        writeOptions\n      );\n\n      // Now that the identity (`_id`, surfaced as `fileId`) exists, derive the storageKey and\n      // persist it. This preserves the historical contract that a created file always carries a\n      // storageKey — scope-derived when a scope is known at creation, else the bare identity\n      // (`fileId`) as a fallback (re-derived with the full scope path by `linkFileToResource`\n      // once the file is linked).\n      const storageKey = fileData.scope\n        ? FileScopeUtils.buildStoragePath(fileData.scope, createdFile.fileId)\n        : createdFile.fileId;\n      const withStorageKey = await this.filesRepository.update<File>(\n        internalContext,\n        { _id: createdFile.fileId },\n        { storageKey } as Partial<File>,\n        writeOptions\n      );\n\n      if (!withStorageKey) {\n        // The row was just created under this same context and transaction, so a missing match\n        // here is unexpected (e.g. a contextual-filter mismatch). Surface it rather than\n        // silently returning a storageKey-less file: the file row still exists, but the gap is\n        // logged.\n        this.logger.warn?.('File record created but storageKey could not be persisted', {\n          fileId: createdFile.fileId,\n        });\n        this.logDebug('File record created', { fileId: createdFile.fileId });\n        return createdFile;\n      }\n\n      this.logDebug('File record created', { fileId: withStorageKey.fileId });\n      return withStorageKey;\n    };\n\n    // Make the insert + storageKey update atomic. If the caller already supplied an active\n    // transaction on the FILES store (e.g. file work cascaded from a resource mutation), both\n    // writes join it; otherwise open a self-contained one so a crash between the two writes\n    // cannot leave a storageKey-less row. `nestedBehavior: 'reuse'` is a safety net for an\n    // ambient (AsyncLocalStorage-tracked) transaction not threaded through `options`.\n    //\n    // The store is resolved from the FILES resource rather than named: this used to read\n    // `=== PersistenceAdapter.MONGODB` and open on `this.mongoDBService`, which is correct only\n    // while FILES sits on MongoDB and inverts in silence the day it moves — the row would be\n    // written by the FILES repository on one connection while the \"atomicity\" wrapping it came\n    // from another.\n    const filesStore = this.getFilesStore(executionContext);\n    if (options?.transaction?.databaseType === filesStore.persistenceAdapter) {\n      return persistFileWithStorageKey(options);\n    }\n    return filesStore.databaseService.executeTransaction(\n      (transactionContext) => persistFileWithStorageKey({ ...options, transaction: transactionContext }),\n      { nestedBehavior: 'reuse' }\n    );\n  }\n\n  /**\n   * The transaction-owning service for the FILES store.\n   *\n   * Resolved through the persistence unit of work, which is the one place that holds both\n   * every adapter's database service and the resource → adapter mapping. Re-deriving either\n   * here is what produced the `mongoDBService`-by-name coupling this replaced.\n   *\n   * Throws rather than degrading: every caller uses the returned service to establish\n   * atomicity across two writes, and continuing without a transaction would leave exactly\n   * the storageKey-less row the transaction exists to prevent — silently.\n   */\n  private getFilesStore(executionContext: ExecutionContext<any>): ResourcePersistenceResourceStore {\n    const filesStore = this.resourcePersistenceUnitOfWork?.getDatabaseServiceForResource(\n      CoreResourceType.FILES,\n    );\n\n    if (!filesStore) {\n      throw this.errorBuilder.buildError(\n        ErrorType.CONFIGURATION,\n        executionContext,\n        {\n          customMessageReference: ErrorCustomMessageReference.CONFIGURATION,\n          context: {\n            message: 'No database service is available for the FILES resource store',\n            resourceType: CoreResourceType.FILES,\n            unitOfWorkBound: Boolean(this.resourcePersistenceUnitOfWork),\n          },\n        }\n      );\n    }\n\n    return filesStore;\n  }\n\n  /**\n   * Get file metadata by fileId.\n   *\n   * @param fileId - File identifier\n   * @param executionContext - Execution context for authorization\n   * @returns File metadata or null if not found\n   */\n  async getFile(\n    fileId: string,\n    executionContext: ExecutionContext<any>,\n    options?: RepositoryOptions\n  ): Promise<File | null> {\n    this.logDebug('Getting file record', { fileId });\n\n    // Validate fileId format (CRITICAL: Prevents query injection and database errors)\n    validateFileId(fileId, this.errorBuilder, executionContext, 'fileId');\n\n    // Create internal execution context for repository operation\n    const internalContext = await this.createInternalExecutionContext(\n      CoreResourceOperation.READ,\n      executionContext\n    );\n\n    // Read file record via repository. `fileId` is the `_id` virtual projection, so the\n    // collection filter keys on `_id` (virtuals are not queryable).\n    const file = await this.filesRepository.read<File>(\n      internalContext,\n      { _id: fileId },\n      options\n    );\n\n    if (!file) {\n      this.logDebug('File not found', { fileId });\n      return null;\n    }\n\n    // Check authorization. A system-cascade file teardown (subject erasure) reaches this via\n    // deleteFile/eraseFile/unlinkFileFromResource on an identity-less EC that would deny the subject's\n    // OWN file; it forwards the owner it already verified at the listing gate through\n    // `options.authoritativeFileScope`, so the deletion gate authorizes against that owner instead of\n    // the empty EC. Every other (user-facing) caller leaves it undefined ⇒ authorize against the EC.\n    const hasAccess = await this.authorizeFileAccess(file, executionContext, options?.authoritativeFileScope);\n    if (!hasAccess) {\n        throw this.errorBuilder.buildError(\n          ErrorType.AUTHORIZATION,\n          executionContext,\n          {\n            customMessageReference: ErrorCustomMessageReference.FILE_ACCESS_DENIED,\n          context: {\n            fileId, // diagnostic (log-only)\n          },\n        }\n      );\n    }\n\n    return file;\n  }\n\n  /**\n   * Get multiple files by their IDs.\n   *\n   * @param fileIds - Array of file identifiers\n   * @param executionContext - Execution context for authorization\n   * @returns Array of file metadata\n   */\n  async batchGetFiles(\n    fileIds: string[],\n    executionContext: ExecutionContext<any>,\n    options?: RepositoryOptions\n  ): Promise<File[]> {\n    this.logDebug('Batch getting file records', { fileIds, count: fileIds.length });\n\n    if (fileIds.length === 0) {\n      return [];\n    }\n\n    // Filter and validate fileIds format before query — an optimization that avoids querying\n    // for ids that cannot exist.\n    //\n    // `isValidResourceId` accepts BOTH ObjectId and UUID, so this is already adapter-neutral.\n    // The previous comment claimed an \"ObjectId regex pattern\", which would have made this a\n    // blocker for moving FILES to PostgreSQL (uuid ids). It reads as a coupling and is not one.\n    const validFileIds = fileIds.filter(\n      (id) => typeof id === 'string' && id.trim() !== '' && Resources_SharedUtils.isValidResourceId(id.trim())\n    );\n\n    // Early return if no valid fileIds after filtering\n    if (validFileIds.length === 0) {\n      return [];\n    }\n\n    const accessibleScopeFilter = this.buildAccessibleScopeFilter(executionContext);\n    if (!accessibleScopeFilter) {\n      throw this.errorBuilder.buildError(\n        ErrorType.VALIDATION,\n        executionContext,\n        {\n          customMessageReference: ErrorCustomMessageReference.FILE_SCOPE_IDENTIFIER_MISSING,\n          context: {\n            fileIdsCount: fileIds.length, // diagnostic (log-only)\n          },\n        }\n      );\n    }\n\n    // Create internal execution context for repository operation\n    const internalContext = await this.createInternalExecutionContext(\n      CoreResourceOperation.READ,\n      executionContext\n    );\n\n    // Add the narrowest tenant-aware filter we can BEFORE fetching.\n    // This prevents cross-tenant prefetches for app-scoped files while preserving\n    // legacy org-scoped rows until all persisted file records carry primaryScope.\n    const files = await this.filesRepository.list<File>(\n      internalContext,\n      {\n        // `fileId` values are `_id` strings (the virtual projection); query on `_id`.\n        _id: { $in: validFileIds },\n        ...accessibleScopeFilter,\n      },\n      options\n    );\n\n    // Filter by authorization\n    const authorizedFiles: File[] = [];\n    for (const file of files) {\n      const hasAccess = await this.authorizeFileAccess(file, executionContext);\n      if (hasAccess) {\n        authorizedFiles.push(file);\n      }\n    }\n\n    this.logDebug('Batch get completed', { requested: fileIds.length, found: files.length, authorized: authorizedFiles.length });\n    return authorizedFiles;\n  }\n\n  /**\n   * Read a file's BYTES for a system-initiated outbound send — today, an email attachment (#429).\n   *\n   * ## Why this lives here and not in the caller\n   *\n   * Everything it has to get right is file knowledge: which statuses may be served, how a file is\n   * authorized against a scope, and which storage provider holds the bytes. A caller that assembled\n   * those itself would be a second, drifting copy of three decisions this service owns — and the\n   * one most dangerous to copy is the status gate, because getting it wrong means attaching an\n   * INFECTED file to an outbound email.\n   *\n   * ## It REFUSES rather than skipping, and that is the whole point\n   *\n   * The defect this closes is a SILENT drop: `attachmentFileIds` was declared and read by nothing,\n   * so a caller supplying an attachment got a successful send and an attachment-less email. A\n   * resolution that quietly omitted a file it could not serve would be the same defect wearing\n   * error handling, so every rejection throws and names the file.\n   *\n   * ## Authorization: the `authoritativeScopeOverride` this reuses was built for exactly this shape\n   *\n   * A system send carries no user principal, and an identity-less execution context derives no\n   * owner — `authorizeFileAccess` records that trap in its own JSDoc, where an empty context would\n   * have denied the subject's own file during erasure teardown. So the caller's scope is passed\n   * explicitly, the same way the teardown path passes the owner it already resolved. The scope is\n   * NOT optional: without it there is no tenancy confinement, and an attachment path that reads any\n   * file by id is a read-anything primitive wearing an email envelope.\n   *\n   * @param fileIds - The file ids to resolve, in the order the caller supplied them.\n   * @param scope - The AUTHORITATIVE owner every file is authorized against. An organization-scoped\n   *   send passes its `organizationId`; an application-scoped one passes `applicationId` only, and\n   *   then only application-scoped files resolve.\n   * @returns One entry per requested id, in the requested order, carrying the bytes.\n   * @throws When a file is unknown, is in a status that is not servable, is outside the scope, or\n   *   cannot be read from its storage provider.\n   */\n  async readFilesForOutboundAttachment(\n    fileIds: readonly string[],\n    scope: { applicationId?: string; organizationId?: string; userId?: string },\n  ): Promise<Array<{ fileId: string; filename: string; mimeType: string; bytes: Buffer }>> {\n    if (fileIds.length === 0) {\n      return [];\n    }\n\n    const applicationId = scope.applicationId ?? this.appConfigService.applicationId ?? undefined;\n    const executionContext = await this.executionContextCreator.createForInternalRepositoryOperation({\n      resourceType: CoreResourceType.FILES,\n      operationIdentifier: CoreResourceOperation.READ,\n      initiatorIds: {\n        ...(applicationId ? { applicationId } : {}),\n        ...(scope.organizationId ? { organizationId: scope.organizationId } : {}),\n        ...(scope.userId ? { userId: scope.userId } : {}),\n      },\n      initiatorRoles: [\n        {\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          relatedPrimaryScope: ResourcePrimaryScope.APPLICATION,\n        },\n      ],\n    });\n\n    const files = await this.filesRepository.list<File>(\n      executionContext,\n      { _id: { $in: [...fileIds] } },\n    );\n    const filesById = new Map<string, File>(files.map((file): [string, File] => [file.fileId, file]));\n\n    const resolved: Array<{ fileId: string; filename: string; mimeType: string; bytes: Buffer }> = [];\n    for (const fileId of fileIds) {\n      const file = filesById.get(fileId);\n      if (!file) {\n        throw this.errorBuilder.buildError(ErrorType.VALIDATION, executionContext, {\n          customMessageReference: ErrorCustomMessageReference.VALIDATION,\n          context: { message: 'Attachment file not found', fileId },\n        });\n      }\n\n      // The SAME authority the download route uses. INFECTED, SCANNING, PENDING, FAILED and\n      // DELETED are all outside it, so none of them can leave the system as an attachment.\n      if (!FILE_DOWNLOADABLE_STATUSES.has(file.status)) {\n        throw this.errorBuilder.buildError(ErrorType.VALIDATION, executionContext, {\n          customMessageReference: ErrorCustomMessageReference.VALIDATION,\n          context: { message: 'Attachment file is not in a servable status', fileId, status: file.status },\n        });\n      }\n\n      const authorized = await this.authorizeFileAccess(file, executionContext, scope);\n      if (!authorized) {\n        throw this.errorBuilder.buildError(ErrorType.AUTHORIZATION, executionContext, {\n          customMessageReference: ErrorCustomMessageReference.AUTHORIZATION,\n          context: { message: 'Attachment file is outside the sending scope', fileId },\n        });\n      }\n\n      const provider = this.getStorageProviderForFile(file, executionContext);\n      const download = await provider.download(\n        { fileId: file.fileId, storageRef: file.storageRef, storageProvider: file.storageProvider },\n        executionContext,\n      );\n      const chunks: Buffer[] = [];\n      for await (const chunk of download.stream) {\n        chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));\n      }\n\n      resolved.push({\n        fileId: file.fileId,\n        filename: file.filename,\n        mimeType: file.mimeType,\n        bytes: Buffer.concat(chunks),\n      });\n    }\n\n    return resolved;\n  }\n\n  /**\n   * Update file status (e.g., PENDING -> UPLOADED, UPLOADED -> LINKED).\n   *\n   * @param fileId - File identifier\n   * @param status - New status\n   * @param executionContext - Execution context for authorization\n   * @returns Updated file record\n   */\n  async updateFileStatus(\n    fileId: string,\n    status: FileStatus,\n    executionContext: ExecutionContext<any>,\n    options?: RepositoryOptions,\n    storagePlacement?: StorageUploadResult,\n  ): Promise<File> {\n    this.logDebug('Updating file status', { fileId, status });\n\n    // Validate fileId format (CRITICAL: Prevents query injection and database errors)\n    validateFileId(fileId, this.errorBuilder, executionContext, 'fileId');\n\n    // Get current file record\n    const currentFile = await this.getFile(fileId, executionContext, options);\n    if (!currentFile) {\n      throw this.errorBuilder.buildError(\n        ErrorType.NOT_FOUND,\n        executionContext,\n        {\n          customMessageReference: ErrorCustomMessageReference.FILE_NOT_FOUND,\n          context: {\n            fileId, // diagnostic (log-only)\n          },\n        }\n      );\n    }\n\n    const allowedTransitions = FILE_STATUS_TRANSITIONS[currentFile.status];\n    if (!allowedTransitions?.includes(status)) {\n      throw this.errorBuilder.buildError(\n        ErrorType.BUSINESS_RULE,\n        executionContext,\n        {\n          customMessageReference: ErrorCustomMessageReference.FILE_INVALID_STATUS_TRANSITION,\n          context: {\n            // diagnostic (log-only)\n            fileId,\n            currentStatus: currentFile.status,\n            requestedStatus: status,\n            allowedTransitions,\n          },\n        }\n      );\n    }\n\n    // Create internal execution context for repository operation\n    const internalContext = await this.createInternalExecutionContext(\n      CoreResourceOperation.UPDATE,\n      executionContext\n    );\n\n    // Update file status via repository. `fileId` is the `_id` virtual projection, so the\n    // collection filter keys on `_id` (virtuals are not queryable).\n    const updatedFile = await this.filesRepository.update<File>(\n      internalContext,\n      { _id: fileId },\n      {\n        status,\n        ...(storagePlacement\n          ? {\n              storageProvider: storagePlacement.provider,\n              storageRef: storagePlacement.storageRef,\n            }\n          : {}),\n        updatedAt: new Date(),\n      } as Partial<File>,\n      options\n    );\n\n    if (!updatedFile) {\n      throw this.errorBuilder.buildError(\n        ErrorType.INTERNAL,\n        executionContext,\n        {\n          customMessageReference: ErrorCustomMessageReference.INTERNAL,\n          context: {\n            message: 'Failed to update file status',\n            fileId,\n            status,\n          },\n        }\n      );\n    }\n\n    this.logDebug('File status updated', { fileId, oldStatus: currentFile.status, newStatus: status });\n    return updatedFile;\n  }\n\n  /**\n   * RAG removal seam — FILE-BINDING MUTATION. A link, unlink, delete or erase changes WHICH file (if\n   * any) backs a `(resourceType, resourceId, fieldName)` tuple, so any chunks derived from the\n   * PREVIOUS binding's extracted text are stale the moment the write lands and must not stay\n   * retrievable (re-indexing from the new binding is Phase 3's write path; deletion is this phase's\n   * whole job). No-op unless the tuple names a declared `.ragSource()` field — the intersection and\n   * the shared failure/transaction contract (post-commit when `options` carries a transaction, inline\n   * otherwise, log-at-ERROR never throw) live in `rag-chunk-removal.backend.utils.ts`.\n   */\n  private async runRagChunkRemovalForFileBinding(\n    binding: { resourceType?: string | null; resourceId?: string | null; fieldName?: string | null },\n    seam: string,\n    options?: RepositoryOptions,\n  ): Promise<void> {\n    if (!this.ragChunkStore || !this.ragSourceFieldDetection) return;\n    const { resourceType, resourceId, fieldName } = binding;\n    if (!resourceType || !resourceId || !fieldName) return;\n    await scheduleRagChunkRemovalForFields(\n      {\n        ragChunkStore: this.ragChunkStore,\n        ragSourceFieldDetection: this.ragSourceFieldDetection,\n        logger: this.logger,\n      },\n      {\n        resourceType: resourceType as ResourceType,\n        resourceIds: [resourceId],\n        affectedFieldNames: [fieldName],\n        seam,\n        transaction: options?.transaction,\n      },\n    );\n  }\n\n  /**\n   * Link a file to a resource (resource-integrated uploads).\n   * Updates file status to LINKED, stores resource reference, and derives scope\n   * from the parent resource's resourcePrimaryScope.\n   *\n   * Scope derivation:\n   * - APPLICATION: applicationId from execution context\n   * - ORGANIZATIONS: organizationId from execution context\n   * - USER_SELF: userId + applicationId from execution context (no org — separate scope axis)\n   *\n   * @param fileId - File identifier\n   * @param resourceType - Resource type\n   * @param resourceId - Resource identifier\n   * @param fieldName - Field name on the resource\n   * @param executionContext - Execution context for authorization\n   * @returns Updated file record\n   */\n  async linkFileToResource(\n    fileId: string,\n    resourceType: ResourceType,\n    resourceId: string,\n    fieldName: string,\n    executionContext: ExecutionContext<any>,\n    options?: RepositoryOptions\n  ): Promise<File> {\n    this.logDebug('Linking file to resource', { fileId, resourceType, resourceId, fieldName });\n\n    // Validate inputs (CRITICAL: Prevents query injection and database errors)\n    validateFileId(fileId, this.errorBuilder, executionContext, 'fileId');\n    validateResourceId(resourceId, this.errorBuilder, executionContext, 'resourceId');\n    validateResourceType(resourceType, this.errorBuilder, executionContext, 'resourceType');\n    validateFieldName(fieldName, this.errorBuilder, executionContext, 'fieldName');\n\n    // Derive scope from parent resource's resourcePrimaryScope\n    const derivedScope = this.deriveScopeFromParentResource(resourceType, executionContext);\n\n    // Create internal execution context for repository operation\n    const internalContext = await this.createInternalExecutionContext(\n      CoreResourceOperation.UPDATE,\n      executionContext\n    );\n\n    // CRITICAL: Use atomic update with status filter to prevent race conditions (Decision 2.4: Option A)\n    // The repository's update() method internally uses findOneAndUpdate, so it's atomic\n    // Filter includes status check: only updates if file is in UPLOADED status\n    // This ensures no race condition between check and update\n\n    /**\n     * Updates file status, link fields, and scope atomically.\n     *\n     * @note MongoDB updates are atomic, so partial updates are not possible.\n     * If the update fails, the entire operation fails atomically.\n     */\n    const updatedFile = await this.filesRepository.update<File>(\n      internalContext,\n      {\n        _id: fileId,\n        // The linkable set is the same one the link-time validators consult (issue #320) — one copy.\n        status: { $in: [...FILE_LINKABLE_STATUSES] },\n      },\n      {\n        linkedResourceType: resourceType,\n        linkedResourceId: resourceId,\n        linkedFieldName: fieldName,\n        status: FileStatus.LINKED,\n        updatedAt: new Date(),\n        // Scope derived from parent resource\n        primaryScope: derivedScope.primaryScope,\n        applicationId: derivedScope.applicationId,\n        organizationId: derivedScope.organizationId,\n        userId: derivedScope.userId,\n        // Update storageKey if scope wasn't set at creation time\n        storageKey: FileScopeUtils.buildStoragePath(derivedScope, fileId),\n      } as Partial<File>,\n      options\n    );\n\n    if (!updatedFile) {\n      // File was not in a linkable status (race condition or already linked)\n      // Re-fetch to determine the reason and throw appropriate error\n      const currentFile = await this.getFile(fileId, executionContext, options);\n      if (!currentFile) {\n        throw this.errorBuilder.buildError(\n          ErrorType.NOT_FOUND,\n          executionContext,\n          {\n            customMessageReference: ErrorCustomMessageReference.FILE_NOT_FOUND,\n            context: {\n              fileId, // diagnostic (log-only)\n            },\n          }\n        );\n      }\n\n      // Check if already linked to same resource (idempotent case)\n      if (currentFile.status === FileStatus.LINKED &&\n          currentFile.linkedResourceType === resourceType &&\n          currentFile.linkedResourceId === resourceId &&\n          currentFile.linkedFieldName === fieldName) {\n        // Already linked to same resource - idempotent, return current file\n        this.logDebug('File already linked to same resource (idempotent)', {\n          fileId,\n          resourceType,\n          resourceId,\n          fieldName,\n        });\n        return currentFile;\n      }\n\n      // Check if already linked to different resource (error case)\n      if (currentFile.status === FileStatus.LINKED) {\n        throw this.errorBuilder.buildError(\n          ErrorType.BUSINESS_RULE,\n          executionContext,\n          {\n            customMessageReference: ErrorCustomMessageReference.FILE_ALREADY_LINKED,\n            context: {\n              // diagnostic (log-only)\n              fileId,\n              currentLinkedResourceType: currentFile.linkedResourceType,\n              currentLinkedResourceId: currentFile.linkedResourceId,\n              currentLinkedFieldName: currentFile.linkedFieldName,\n              requestedResourceType: resourceType,\n              requestedResourceId: resourceId,\n              requestedFieldName: fieldName,\n            },\n          }\n        );\n      }\n\n      // Not a linkable status. The guarded update above admits exactly FILE_LINKABLE_STATUSES, so\n      // reaching here means the row is outside that set (or moved out of it between read and write).\n      // SCANNING is named on its own: the file is not wrong, only not yet known to be safe — retry.\n      throw this.errorBuilder.buildError(\n        ErrorType.BUSINESS_RULE,\n        executionContext,\n        {\n          customMessageReference: currentFile.status === FileStatus.SCANNING\n            ? ErrorCustomMessageReference.FILE_SCAN_IN_PROGRESS\n            : ErrorCustomMessageReference.FILE_NOT_LINKABLE,\n          context: {\n            // diagnostic (log-only)\n            fileId,\n            fileStatus: currentFile.status,\n            linkableStatuses: [...FILE_LINKABLE_STATUSES],\n            resourceType,\n            resourceId,\n          },\n        }\n      );\n    }\n\n    // RAG removal seam — a (re-)link binds a NEW file to the tuple, so chunks derived from whatever\n    // backed it before are stale and must not survive the re-link (plan §Removal-seam inventory).\n    await this.runRagChunkRemovalForFileBinding(\n      { resourceType, resourceId, fieldName },\n      'file-link',\n      options,\n    );\n\n    this.logDebug('File linked to resource', { fileId, resourceType, resourceId });\n    return updatedFile;\n  }\n\n  /**\n   * Unlink a file from a resource.\n   * Updates file status to ORPHANED and clears resource link fields.\n   *\n   * Note: Due to Mongoose behavior, optional fields set to `undefined` are ignored in updates.\n   * We attempt to clear linked resource fields, but if schema validation prevents this,\n   * the status change to ORPHANED is the authoritative indicator that the file is unlinked.\n   *\n   * @param fileId - File identifier\n   * @param executionContext - Execution context for authorization\n   * @returns Updated file record\n   */\n  async unlinkFileFromResource(\n    fileId: string,\n    executionContext: ExecutionContext<any>,\n    options?: RepositoryOptions\n  ): Promise<File> {\n    this.logDebug('Unlinking file from resource', { fileId });\n\n    // Validate fileId format (CRITICAL: Prevents query injection and database errors)\n    validateFileId(fileId, this.errorBuilder, executionContext, 'fileId');\n\n    // Get current file record\n    const currentFile = await this.getFile(fileId, executionContext, options);\n    if (!currentFile) {\n      throw this.errorBuilder.buildError(\n        ErrorType.NOT_FOUND,\n        executionContext,\n        {\n          customMessageReference: ErrorCustomMessageReference.FILE_NOT_FOUND,\n          context: {\n            fileId, // diagnostic (log-only)\n          },\n        }\n      );\n    }\n\n    // Create internal execution context for repository operation\n    const internalContext = await this.createInternalExecutionContext(\n      CoreResourceOperation.UPDATE,\n      executionContext\n    );\n\n    // Update file to remove resource link and set status to ORPHANED\n    // Note: Mongoose ignores undefined values in updates, and optional string fields don't accept null.\n    // The status change to ORPHANED is the authoritative indicator that the file is no longer linked.\n    // The linked resource fields may remain in the database but are considered stale/invalid when status is ORPHANED.\n    // Future enhancement: If explicit field clearing is required, consider using MongoDB $unset operator\n    // via direct Mongoose model access or repository enhancement.\n    const updateData: Partial<File> = {\n      status: FileStatus.ORPHANED,\n      updatedAt: new Date(),\n    };\n\n    /**\n     * Updates file status and clears link fields atomically.\n     *\n     * @note MongoDB updates are atomic, so partial updates are not possible.\n     * If the update fails, the entire operation fails atomically.\n     */\n    const updatedFile = await this.filesRepository.update<File>(\n      internalContext,\n      { _id: fileId },\n      updateData,\n      options\n    );\n\n    if (!updatedFile) {\n      throw this.errorBuilder.buildError(\n        ErrorType.INTERNAL,\n        executionContext,\n        {\n          customMessageReference: ErrorCustomMessageReference.INTERNAL,\n          context: {\n            message: 'Failed to unlink file from resource',\n            fileId,\n          },\n        }\n      );\n    }\n\n    // RAG removal seam — the tuple no longer has a backing file; its extracted-text chunks go with\n    // the binding. The tuple is read from the PRE-unlink row (the write above clears/staleness-marks it).\n    await this.runRagChunkRemovalForFileBinding(\n      {\n        resourceType: currentFile.linkedResourceType,\n        resourceId: currentFile.linkedResourceId,\n        fieldName: currentFile.linkedFieldName,\n      },\n      'file-unlink',\n      options,\n    );\n\n    this.logDebug('File unlinked from resource', { fileId });\n    return updatedFile;\n  }\n\n  /**\n   * Delete a file (soft delete - marks as DELETED).\n   * Physical deletion from storage happens in cleanup batch job.\n   *\n   * @param fileId - File identifier\n   * @param executionContext - Execution context for authorization\n   * @returns Deleted file record\n   */\n  async deleteFile(\n    fileId: string,\n    executionContext: ExecutionContext<any>,\n    options?: RepositoryOptions\n  ): Promise<File> {\n    this.logDebug('Soft deleting file record', { fileId });\n\n    // Validate fileId format (CRITICAL: Prevents query injection and database errors)\n    validateFileId(fileId, this.errorBuilder, executionContext, 'fileId');\n\n    // Get current file record\n    const currentFile = await this.getFile(fileId, executionContext, options);\n    if (!currentFile) {\n      throw this.errorBuilder.buildError(\n        ErrorType.NOT_FOUND,\n        executionContext,\n        {\n          customMessageReference: ErrorCustomMessageReference.FILE_NOT_FOUND,\n          context: {\n            fileId, // diagnostic (log-only)\n          },\n        }\n      );\n    }\n\n    // Create internal execution context for repository operation\n    const internalContext = await this.createInternalExecutionContext(\n      CoreResourceOperation.UPDATE,\n      executionContext\n    );\n\n    // Soft delete: update status and set deletedAt\n\n    /**\n     * Updates file status to DELETED atomically.\n     *\n     * @note MongoDB updates are atomic, so partial updates are not possible.\n     * If the update fails, the entire operation fails atomically.\n     */\n    const deletedFile = await this.filesRepository.update<File>(\n      internalContext,\n      { _id: fileId },\n      {\n        status: FileStatus.DELETED,\n        deletedAt: new Date(),\n        updatedAt: new Date(),\n      } as Partial<File>,\n      options\n    );\n\n    if (!deletedFile) {\n      throw this.errorBuilder.buildError(\n        ErrorType.INTERNAL,\n        executionContext,\n        {\n          customMessageReference: ErrorCustomMessageReference.INTERNAL,\n          context: {\n            message: 'Failed to delete file',\n            fileId,\n          },\n        }\n      );\n    }\n\n    // RAG removal seam — a DELETED file no longer backs its linked field (the cleanup batch will\n    // hard-delete the bytes), so text extracted from it must stop being retrievable now. A file that\n    // was never linked to a RAG-source field no-ops. Beyond the plan's link/unlink rows, wired\n    // deliberately: the row-delete and impersonalize seams cover the ORCHESTRATED deleteFile calls,\n    // but a direct deleteFile on a linked file reaches neither.\n    await this.runRagChunkRemovalForFileBinding(\n      {\n        resourceType: currentFile.linkedResourceType,\n        resourceId: currentFile.linkedResourceId,\n        fieldName: currentFile.linkedFieldName,\n      },\n      'file-delete',\n      options,\n    );\n\n    this.logDebug('File soft deleted', { fileId });\n    return deletedFile;\n  }\n\n  /**\n   * ERASE a file for privacy (gate **G-FILE**) — a soft delete that also scrubs the file row's OWN\n   * personal data, in one write.\n   *\n   * Deliberately distinct from {@link deleteFile} rather than a flag on it, because the two mean\n   * different things and must not drift:\n   *  - `deleteFile` is a LIFECYCLE delete. The row is on its way out but its provenance\n   *    (`originalFilename`, `uploadedBy`) is still legitimate history — an admin auditing \"who\n   *    uploaded what, and what happened to it\" needs exactly those fields.\n   *  - `eraseFile` is a PRIVACY erasure. The filename IS personal data (`passport-jane-doe.pdf`\n   *    identifies its subject as surely as the bytes do), and so is the uploader link. Keeping them\n   *    for the weeks until the cleanup batch runs means the erasure only *looks* complete.\n   *\n   * `filename` / `originalFilename` are REQUIRED (`min(1)`), so they are overwritten with the shared\n   * {@link ERASED_FILE_NAME_PLACEHOLDER} constant rather than nulled — nulling would need a schema\n   * reshape and would make every erased file distinguishable from every other by its emptiness.\n   * `uploadedBy` and `uploadedByEntityType` are cleared TOGETHER: the schema's `validateUploaderPair`\n   * refinement requires both or neither, and clearing one alone would make the row unwritable.\n   *\n   * The blob itself is removed by the existing cleanup batch, exactly as for `deleteFile` — an erasure\n   * must never mix a DB rollback with non-transactional storage side effects.\n   *\n   * Idempotent: erasing an already-erased file rewrites the same terminal values.\n   */\n  async eraseFile(\n    fileId: string,\n    executionContext: ExecutionContext<any>,\n    options?: RepositoryOptions\n  ): Promise<File> {\n    this.logDebug('Erasing file record for privacy', { fileId });\n\n    validateFileId(fileId, this.errorBuilder, executionContext, 'fileId');\n\n    const currentFile = await this.getFile(fileId, executionContext, options);\n    if (!currentFile) {\n      throw this.errorBuilder.buildError(\n        ErrorType.NOT_FOUND,\n        executionContext,\n        {\n          customMessageReference: ErrorCustomMessageReference.FILE_NOT_FOUND,\n          context: {\n            fileId, // diagnostic (log-only)\n          },\n        }\n      );\n    }\n\n    const internalContext = await this.createInternalExecutionContext(\n      CoreResourceOperation.UPDATE,\n      executionContext\n    );\n\n    const erasedFile = await this.filesRepository.update<File>(\n      internalContext,\n      { _id: fileId },\n      {\n        status: FileStatus.DELETED,\n        deletedAt: new Date(),\n        updatedAt: new Date(),\n        filename: ERASED_FILE_NAME_PLACEHOLDER,\n        originalFilename: ERASED_FILE_NAME_PLACEHOLDER,\n        uploadedBy: undefined,\n        uploadedByEntityType: undefined,\n      } as Partial<File>,\n      options\n    );\n\n    if (!erasedFile) {\n      throw this.errorBuilder.buildError(\n        ErrorType.INTERNAL,\n        executionContext,\n        {\n          customMessageReference: ErrorCustomMessageReference.INTERNAL,\n          context: {\n            message: 'Failed to erase file',\n            fileId,\n          },\n        }\n      );\n    }\n\n    // RAG removal seam — a privacy erasure of the file makes any text extracted from it exactly the\n    // personal data the erasure exists to remove; the chunk set goes in the same decision. Usually\n    // redundant with the impersonalize seam that invoked this erasure (idempotent), and load-bearing\n    // for a DIRECT eraseFile call, which reaches no other seam.\n    await this.runRagChunkRemovalForFileBinding(\n      {\n        resourceType: currentFile.linkedResourceType,\n        resourceId: currentFile.linkedResourceId,\n        fieldName: currentFile.linkedFieldName,\n      },\n      'file-erase',\n      options,\n    );\n\n    this.logDebug('File erased', { fileId });\n    return erasedFile;\n  }\n\n  /**\n   * Permanently delete a file by removing the blob first, then deleting the\n   * metadata row. This is intentionally reserved for post-commit cleanup flows\n   * such as the cleanup batch, not inline resource transactions.\n   */\n  async hardDeleteFile(\n    fileId: string,\n    executionContext: ExecutionContext<any>,\n    options?: RepositoryOptions\n  ): Promise<File> {\n    this.logDebug('Hard deleting file record and storage', { fileId });\n\n    validateFileId(fileId, this.errorBuilder, executionContext, 'fileId');\n\n    const readContext = await this.createInternalExecutionContext(\n      CoreResourceOperation.READ,\n      executionContext\n    );\n    const currentFile = await this.filesRepository.read<File>(\n      readContext,\n      { _id: fileId },\n      options\n    );\n\n    if (!currentFile) {\n      throw this.errorBuilder.buildError(\n        ErrorType.NOT_FOUND,\n        executionContext,\n        {\n          customMessageReference: ErrorCustomMessageReference.FILE_NOT_FOUND,\n          context: {\n            fileId, // diagnostic (log-only)\n          },\n        }\n      );\n    }\n\n    // Hard-delete now flows through the storage provider seam so future slices can\n    // swap backend resolution without reopening the cleanup contract.\n    try {\n      const storageProvider = this.getStorageProviderForFile(currentFile, executionContext);\n      await storageProvider.delete(currentFile, executionContext);\n    } catch (error) {\n      if (!isWildoBackendError(error) || error.type !== ErrorType.NOT_FOUND) {\n        throw error;\n      }\n\n      this.logDebug('File blob already missing during hard delete, continuing metadata cleanup', {\n        fileId,\n      });\n    }\n\n    const deleteContext = await this.createInternalExecutionContext(\n      CoreResourceOperation.DELETE,\n      executionContext\n    );\n    const deletedFileId = await this.filesRepository.delete(\n      deleteContext,\n      { _id: fileId },\n      options\n    );\n\n    if (!deletedFileId) {\n      throw this.errorBuilder.buildError(\n        ErrorType.INTERNAL,\n        executionContext,\n        {\n          customMessageReference: ErrorCustomMessageReference.INTERNAL,\n          context: {\n            message: 'Failed to hard delete file',\n            fileId,\n          },\n        }\n      );\n    }\n\n    this.logDebug('File hard deleted from storage and metadata', { fileId });\n    return currentFile;\n  }\n\n  /**\n   * List files for a specific resource.\n   *\n   * @param resourceType - Resource type\n   * @param resourceId - Resource identifier\n   * @param fieldName - Optional field name filter\n   * @param executionContext - Execution context for authorization\n   * @returns Array of file metadata\n   */\n  async listFilesForResource(\n    resourceType: ResourceType,\n    resourceId: string,\n    fieldName: string | undefined,\n    executionContext: ExecutionContext<any>,\n    options?: RepositoryOptions\n  ): Promise<File[]> {\n    if (!executionContext) {\n      throw this.errorBuilder.buildError(\n        ErrorType.INTERNAL,\n        {} as ExecutionContext<any>,\n        {\n          customMessageReference: ErrorCustomMessageReference.INTERNAL,\n          context: {\n            message: 'Execution context is required for listFilesForResource',\n          },\n        }\n      );\n    }\n\n    this.logDebug('Listing files for resource', { resourceType, resourceId, fieldName });\n\n    // Validate inputs (CRITICAL: Prevents query injection and database errors)\n    validateResourceId(resourceId, this.errorBuilder, executionContext, 'resourceId');\n    validateResourceType(resourceType, this.errorBuilder, executionContext, 'resourceType');\n    if (fieldName) {\n      validateFieldName(fieldName, this.errorBuilder, executionContext, 'fieldName');\n    }\n\n    // A system-cascade file teardown (subject erasure, cross-scope delete) runs on an\n    // internally_initiated_request EC, whose constructor FORBIDS user/organization identity on\n    // `initiatorIds` — only `applicationId` is allowed. So `deriveScopeFromParentResource` cannot read\n    // the owner from the EC and would fail closed with FILE_SCOPE_IDENTIFIER_MISSING, aborting the\n    // whole erasure transaction before the subject is scrubbed. The resource ROW being torn down\n    // carries its OWN scope FK (a USER_SELF row's `userId`, an org-scoped row's `organizationId`) — the\n    // authoritative owner of that row's files. Read it and hand it to the scope derivation as a\n    // fallback. This is the single chokepoint every delete/impersonalize/deleteMany file teardown funnels\n    // through, so the recovery is unbypassable rather than threaded through each cascade site. It costs\n    // one extra read ONLY on the system path — an ordinary request already carries the owner on its EC,\n    // so `loadParentResourceRowForScopeFallback` returns undefined and performs no read.\n    const parentResourceRowForScope = await this.loadParentResourceRowForScopeFallback(\n      resourceType,\n      resourceId,\n      executionContext,\n      options,\n    );\n    const derivedScope = this.deriveScopeFromParentResource(resourceType, executionContext, parentResourceRowForScope);\n    const scopeFilter = this.buildFilterForFileScope(derivedScope);\n    if (!scopeFilter) {\n      throw this.errorBuilder.buildError(\n        ErrorType.VALIDATION,\n        executionContext,\n        {\n          customMessageReference: ErrorCustomMessageReference.FILE_SCOPE_DERIVATION_FAILED,\n        }\n      );\n    }\n\n    // Build filter\n    // Be defensive against malformed persisted rows where link metadata was\n    // written but status drifted from LINKED. Delete-time cleanup must still be\n    // able to discover those rows by parent ownership.\n    const filter: any = {\n      linkedResourceType: resourceType,\n      linkedResourceId: resourceId,\n      status: {\n        $in: [FileStatus.LINKED, FileStatus.UPLOADED, FileStatus.CLEAN],\n      },\n      ...scopeFilter,\n    };\n\n    if (fieldName) {\n      filter.linkedFieldName = fieldName;\n    }\n\n    // Create internal execution context for repository operation\n    const internalContext = await this.createInternalExecutionContext(\n      CoreResourceOperation.LIST,\n      executionContext\n    );\n\n    // Apply the linked resource's derived scope to the repository query before fetch.\n    // This keeps app-scoped parents from going through an org-only path.\n    const files = await this.filesRepository.list<File>(\n      internalContext,\n      filter,\n      options\n    );\n\n    // Filter by authorization — against the SCOPE WE DERIVED (the parent resource's owner), not the raw\n    // EC. `listFilesForResource` is exclusively a system-cascade file-teardown path (delete/impersonalize),\n    // whose EC carries no owner identity; deriving the access scope from that EC would deny the subject's\n    // OWN file and silently retain PII. `derivedScope` is the authoritative owner (from the row on the\n    // system path, from the EC on any owner-bearing path) and is exactly what the file query above was\n    // scoped by, so this re-confirms that scoping rather than trusting the empty EC.\n    const authorizedFiles: File[] = [];\n    for (const file of files) {\n      const hasAccess = await this.authorizeFileAccess(file, executionContext, {\n        applicationId: derivedScope.applicationId,\n        organizationId: derivedScope.organizationId,\n        userId: derivedScope.userId,\n      });\n      if (hasAccess) {\n        authorizedFiles.push(file);\n      }\n    }\n\n    this.logDebug('List files for resource completed', { resourceType, resourceId, found: files.length, authorized: authorizedFiles.length });\n    return authorizedFiles;\n  }\n\n  /**\n   * Authorize file access based on file's primaryScope.\n   *\n   * Access rules by primaryScope:\n   * - APPLICATION: User must have access to the application\n   * - ORGANIZATIONS: User must belong to the organization\n   * - USER_SELF: User must be the owner (userId match) — no org check (separate scope axis)\n   *\n   * Fallback (no primaryScope): Uses legacy organizationId match\n   *\n   * @param file - File record\n   * @param executionContext - Execution context for authorization\n   * @returns true if access is allowed\n   */\n  async authorizeFileAccess(\n    file: File,\n    executionContext: ExecutionContext<any>,\n    /**\n     * The AUTHORITATIVE owner to check the file against, supplied ONLY by the system-cascade teardown\n     * path ({@link listFilesForResource}, whose sole callers are the delete/impersonalize file teardown).\n     * That path runs on an identity-less `internally_initiated_request` EC, so `deriveAccessScope` yields\n     * no owner and this check would deny the SUBJECT'S OWN file — silently retaining PII while the erasure\n     * reports success. The teardown has already resolved the owner from the row being torn down (the same\n     * value the file query was scoped by), so authorizing against it re-confirms the query's own scoping\n     * rather than trusting the empty EC. A present EC owner always wins for every other caller — this\n     * override is `undefined` on the two non-teardown callers, so their behaviour is unchanged.\n     */\n    authoritativeScopeOverride?: { applicationId?: string; organizationId?: string; userId?: string },\n  ): Promise<boolean> {\n    const accessScope = authoritativeScopeOverride ?? this.deriveAccessScope(executionContext);\n\n    // Legacy scope-less rows are tolerated only when they still carry a concrete\n    // organization owner. Missing organization ownership is treated as malformed\n    // persisted data and must fail closed.\n    if (!file.primaryScope) {\n      if (!file.organizationId || !accessScope.organizationId) {\n        this.logDebug('File access denied: missing organization ownership on legacy file', {\n          fileOrganizationId: file.organizationId,\n          requestOrganizationId: accessScope.organizationId,\n        });\n        return false;\n      }\n\n      if (file.organizationId !== accessScope.organizationId) {\n        this.logDebug('File access denied: organization mismatch (legacy)', {\n          fileOrganizationId: file.organizationId,\n          requestOrganizationId: accessScope.organizationId,\n        });\n        return false;\n      }\n      return true;\n    }\n\n    // Scope-based authorization\n    switch (file.primaryScope) {\n      case ResourcePrimaryScope.APPLICATION:\n        if (!file.applicationId || file.applicationId !== accessScope.applicationId) {\n          this.logDebug('File access denied: application mismatch', {\n            fileApplicationId: file.applicationId,\n            requestApplicationId: accessScope.applicationId,\n          });\n          return false;\n        }\n        return true;\n\n      case ResourcePrimaryScope.ORGANIZATIONS: {\n        // The caller is ACTING IN an organization: it must be the file's. Unchanged, and deliberately\n        // not widened — a principal acting in organization A must not reach organization B's file\n        // through this route merely because it also belongs to B. The acting scope is the confinement.\n        if (accessScope.organizationId) {\n          if (file.organizationId !== accessScope.organizationId) {\n            this.logDebug('File access denied: organization mismatch', {\n              fileOrganizationId: file.organizationId,\n              requestOrganizationId: accessScope.organizationId,\n            });\n            return false;\n          }\n          return true;\n        }\n\n        /*\n         * No acting organization — ask the MEMBERSHIP question instead of denying.\n         *\n         * The four global file routes (`/files/:fileId` and friends) build their execution context from\n         * a URL that carries no parameters, and `extractInitiatorIds` populates `initiatorIds.organizationId`\n         * only from URL critical params. So the context holds `userId` and nothing else, this comparison\n         * ran against `undefined`, and every ORGANIZATIONS-scoped file 404'd for its own owner (#68) —\n         * taking `DisplayFieldFile`'s metadata band with it, since that band loads from this endpoint.\n         *\n         * The row already names its organization, so the open question is not WHICH organization but\n         * whether the caller belongs to it. That is answered from `initiatorRoles`, which the request\n         * cannot author for itself — `execution-context-creator` builds it from memberships, and only\n         * from `OrganizationMemberStatus.ACTIVE` ones, so a suspended member contributes no entry here.\n         *\n         * A caller-supplied `?organizationId=` is deliberately NOT consulted: that resolution exists only\n         * on the manual-controller path, and reading a tenant identity off the request is the shape this\n         * check exists to refuse.\n         */\n        return this.callerHoldsOrganizationWideMembership(file.organizationId, executionContext);\n      }\n\n      case ResourcePrimaryScope.USER_SELF:\n        // USER_SELF scope: access is granted iff the caller IS the owner. USER_SELF and\n        // ORGANIZATIONS are independent primary-scope axes, so there is NO org check here —\n        // a self-owned file carries no org. `applicationId` tenant isolation is enforced\n        // upstream (batchGetFiles / access-scope resolution).\n        if (file.userId !== accessScope.userId) {\n          this.logDebug('File access denied: user mismatch', {\n            fileUserId: file.userId,\n            requestUserId: accessScope.userId,\n          });\n          return false;\n        }\n        return true;\n\n      default:\n        // Unknown scope - deny access\n        this.logDebug('File access denied: unknown primaryScope', {\n          primaryScope: file.primaryScope,\n        });\n        return false;\n    }\n  }\n\n  /**\n   * Convert File record to FileMetadata response format.\n   * Used by the getMetadata endpoint.\n   *\n   * @param file - File record\n   * @returns FileMetadata object\n   */\n  toMetadataResponse(file: File): {\n    fileId: string;\n    filename: string;\n    size: number;\n    mimeType: string;\n    extension?: string;\n    checksum?: string;\n    url?: string;\n    thumbnailUrl?: string;\n    nature: FileDisplayNature;\n    width?: number;\n    height?: number;\n    duration?: number;\n    pageCount?: number;\n    uploadedAt: Date;\n    uploadedBy?: string;\n    uploadedByEntityType?: FileUploaderEntityType;\n  } {\n    // Infer nature from MIME type if not stored on the file record\n    // Uses the shared resolveFileDisplayNature() utility (single source of truth)\n    const nature: FileDisplayNature = (file.nature as FileDisplayNature) ?? resolveFileDisplayNature(undefined, file.mimeType);\n\n    return {\n      fileId: file.fileId,\n      filename: file.originalFilename || file.filename,\n      size: file.size,\n      mimeType: file.mimeType,\n      extension: file.extension,\n      checksum: file.checksum,\n      url: file.url,\n      thumbnailUrl: file.thumbnailUrl,\n      nature,\n      width: file.width,\n      height: file.height,\n      duration: file.duration,\n      pageCount: file.pageCount,\n      uploadedAt: file.uploadedAt,\n      uploadedBy: file.uploadedBy,\n      uploadedByEntityType: file.uploadedByEntityType,\n    };\n  }\n\n  /**\n   * Derive access scope from execution context.\n   * Extracts all scope identifiers for authorization checks.\n   *\n   * @param executionContext - Execution context\n   * @returns Access scope information with all identifiers\n   */\n  /**\n   * Does the caller hold ORGANIZATION-WIDE membership of this exact organization?\n   *\n   * Answered only from `initiatorRoles`, the one input a request cannot author for itself.\n   *\n   * **A unit-scoped entry does not count, and that is a decision rather than an oversight.**\n   * `ExecutionContext_RoleInfo.organizationUnitId` marks a grant that is live authority inside ONE unit,\n   * and its own schema is explicit that reading such an entry as tenant-wide is \"a privilege escalation,\n   * not a convenience\". Membership of the tenant is arguably implied either way — a unit member is a\n   * member — but this route serves a file scoped to the WHOLE organization, so the narrower reading is\n   * the safe one and {@link isOrganizationWideRoleInfo} is the single definition of it. If a unit-scoped\n   * caller should reach an organization-scoped file, argue it and change it here, once.\n   *\n   * A platform administrator who is not a member gets nothing from this, which is also deliberate: the\n   * cross-tenant admission model is per-operation-variant (`admitsCrossTenantPlatformAdministration` plus\n   * a usable platform-access grant), these controller routes are not resource operations, and granting\n   * reach by position in the request path is exactly the ambient privilege that model removed.\n   */\n  private callerHoldsOrganizationWideMembership(fileOrganizationId: string | undefined, executionContext: ExecutionContext<any>): boolean {\n    if (!fileOrganizationId) {\n      this.logDebug('File access denied: organization-scoped file carries no organization owner');\n      return false;\n    }\n    const membership = (executionContext.initiatorRoles ?? []).find(\n      (roleInfo) =>\n        roleInfo.relatedPrimaryScope === ResourcePrimaryScope.ORGANIZATIONS &&\n        isOrganizationWideRoleInfo(roleInfo) &&\n        roleInfo.relatedResourceId === fileOrganizationId,\n    );\n    if (!membership) {\n      this.logDebug('File access denied: caller holds no organization-wide membership of the file\\'s organization', {\n        fileOrganizationId,\n      });\n      return false;\n    }\n    return true;\n  }\n\n  protected deriveAccessScope(executionContext: ExecutionContext<any>): {\n    applicationId?: string;\n    organizationId?: string;\n    userId?: string;\n  } {\n    const organizationId = this.resourceOperationHelper.getInitiatorId(executionContext, 'organization');\n    const userId = this.resourceOperationHelper.getInitiatorId(executionContext, 'user');\n    // Fall back to the single backend application's id when the execution context\n    // doesn't carry one (e.g. a USER_REQUEST EC, whose initiatorIds hold org/user but\n    // not applicationId). Mirrors `PdfGeneratedFileWriterBackendService` — there is\n    // exactly one application per backend, so `appConfigService.applicationId` is the\n    // correct anchor for `applicationId`-scoped file resolution + access checks.\n    const applicationId = executionContext.applicationId || this.appConfigService.applicationId;\n\n    return {\n      applicationId,\n      organizationId,\n      userId,\n    };\n  }\n\n  /**\n   * Build the narrowest repository filter we can from the caller's accessible scope.\n   * This keeps prefetching tenant-aware even before per-row authorization runs.\n   */\n  protected buildAccessibleScopeFilter(executionContext: ExecutionContext<any>): Record<string, unknown> | null {\n    const accessScope = this.deriveAccessScope(executionContext);\n    const scopeBranches: Record<string, unknown>[] = [];\n\n    if (accessScope.applicationId) {\n      scopeBranches.push({\n        primaryScope: ResourcePrimaryScope.APPLICATION,\n        applicationId: accessScope.applicationId,\n      });\n    }\n\n    if (accessScope.organizationId) {\n      // Keep legacy org-only rows reachable until all file rows carry primaryScope.\n      scopeBranches.push({\n        organizationId: accessScope.organizationId,\n      });\n    }\n\n    if (scopeBranches.length === 0) {\n      return null;\n    }\n\n    return scopeBranches.length === 1 ? scopeBranches[0] : { $or: scopeBranches };\n  }\n\n  protected buildFilterForFileScope(scope: FileScopeIdentifiers): Record<string, unknown> | null {\n    switch (scope.primaryScope) {\n      case ResourcePrimaryScope.APPLICATION:\n        return scope.applicationId\n          ? {\n              primaryScope: ResourcePrimaryScope.APPLICATION,\n              applicationId: scope.applicationId,\n            }\n          : null;\n      case ResourcePrimaryScope.ORGANIZATIONS:\n        return scope.organizationId\n          ? {\n              organizationId: scope.organizationId,\n            }\n          : null;\n      case ResourcePrimaryScope.USER_SELF:\n        // USER_SELF files are keyed by owner (userId) only — no org (separation of concern).\n        return scope.userId\n          ? {\n              primaryScope: ResourcePrimaryScope.USER_SELF,\n              userId: scope.userId,\n            }\n          : null;\n      default:\n        return null;\n    }\n  }\n\n  /**\n   * Recover a scoped resource's owner from the ROW when the EC cannot supply it — the system-cascade\n   * file-teardown path (subject erasure, cross-scope delete). Such a cascade runs on an\n   * `internally_initiated_request` EC, whose constructor is fail-closed and REJECTS user/organization\n   * identity on `initiatorIds` (only `applicationId` is allowed), because the initiator of a system\n   * operation is the SYSTEM, not the org/user being targeted. So {@link deriveScopeFromParentResource}\n   * has no owner to read from the EC and fails closed with FILE_SCOPE_IDENTIFIER_MISSING — which,\n   * inside an erasure, rolls back the whole transaction before the subject is scrubbed.\n   *\n   * Returns `undefined` — and performs NO read — whenever the EC already carries the owner (every\n   * ordinary request, and any APPLICATION-scoped resource, whose id is always available from the single\n   * backend). Only a genuinely owner-less EC over a USER_SELF/ORGANIZATIONS resource triggers the read,\n   * so the hot path is unchanged.\n   *\n   * Fail-open to `undefined` on any obstacle (missing repository, no READ support, absent row, read\n   * error): the caller then runs the EC-only derivation, which still fails closed exactly as before.\n   * This helper only ADDS a recovery; it never weakens the existing guard.\n   */\n  private async loadParentResourceRowForScopeFallback(\n    resourceType: ResourceType,\n    resourceId: string,\n    executionContext: ExecutionContext<any>,\n    options?: RepositoryOptions,\n  ): Promise<Record<string, unknown> | undefined> {\n    const primaryScope =\n      this.resourcesRegistry.getResourceConfiguration(resourceType)?.resourcePrimaryScope\n      ?? ResourcePrimaryScope.ORGANIZATIONS;\n\n    const accessScope = this.deriveAccessScope(executionContext);\n    const ecAlreadyCarriesOwner =\n      primaryScope === ResourcePrimaryScope.APPLICATION\n      || (primaryScope === ResourcePrimaryScope.USER_SELF && !!accessScope.userId)\n      || (primaryScope === ResourcePrimaryScope.ORGANIZATIONS && !!accessScope.organizationId);\n    if (ecAlreadyCarriesOwner) {\n      return undefined;\n    }\n\n    const repository = this.repositoriesRegistry.getRepository(resourceType);\n    if (!repository?.supportsOperation(CoreResourceOperation.READ)) {\n      return undefined;\n    }\n\n    try {\n      const row = await repository.read<Record<string, unknown>>(executionContext, resourceId, options);\n      return row ?? undefined;\n    } catch {\n      return undefined;\n    }\n  }\n\n  /**\n   * Derive file scope from parent resource's resourcePrimaryScope.\n   *\n   * Scope derivation rules:\n   * - APPLICATION: sets applicationId from execution context\n   * - ORGANIZATIONS: sets organizationId from execution context (or the row's own FK — system cascade)\n   * - USER_SELF: sets userId + applicationId from execution context (no org — separate scope axis; or\n   *   the row's own FK — system cascade)\n   *\n   * @param resourceType - Parent resource type\n   * @param executionContext - Execution context for scope values\n   * @param parentResourceRow - The row being torn down; its own scope FK is used as a FALLBACK owner\n   *   only when the EC carries none (system cascade). A present EC owner always wins.\n   * @returns FileScopeIdentifiers derived from parent resource\n   */\n  protected deriveScopeFromParentResource(\n    resourceType: ResourceType,\n    executionContext: ExecutionContext<any>,\n    /**\n     * The resource row being torn down, supplied ONLY by system-cascade paths whose EC carries no\n     * owner identity (see the caller comment in {@link listFilesForResource}). Its own scope FK is the\n     * authoritative owner of the row's files. Used strictly as a FALLBACK: a present EC owner always\n     * wins, so every ordinary request behaves exactly as before this parameter existed.\n     */\n    parentResourceRow?: Record<string, unknown>,\n  ): FileScopeIdentifiers {\n    // Get parent resource configuration to find its primaryScope\n    const resourceConfig = this.resourcesRegistry.getResourceConfiguration(resourceType);\n\n    // Get primaryScope from resource configuration\n    // Default to ORGANIZATIONS if not specified\n    const primaryScope = resourceConfig?.resourcePrimaryScope || ResourcePrimaryScope.ORGANIZATIONS;\n\n    const accessScope = this.deriveAccessScope(executionContext);\n\n    // The row's value for its OWN primary-scope FK — `userId` for USER_SELF, `organizationId` for\n    // ORGANIZATIONS — resolved through the single named mapping so it can never drift from the write\n    // path. Stored FKs are ObjectIds; normalize to the string form the EC-derived scope also uses.\n    const rowScopeFieldIdentifier = PRIMARY_SCOPE_TO_FIELD_IDENTIFIER[primaryScope];\n    const rowScopeRaw = parentResourceRow?.[rowScopeFieldIdentifier];\n    const rowScopeValue = rowScopeRaw != null ? String(rowScopeRaw) : undefined;\n\n    switch (primaryScope) {\n      case ResourcePrimaryScope.APPLICATION:\n        if (!accessScope.applicationId) {\n          throw this.errorBuilder.buildError(\n            ErrorType.VALIDATION,\n            executionContext,\n            {\n              customMessageReference: ErrorCustomMessageReference.FILE_SCOPE_IDENTIFIER_MISSING,\n              context: {\n                resourceType, // diagnostic (log-only)\n              },\n            }\n          );\n        }\n        return {\n          primaryScope: ResourcePrimaryScope.APPLICATION,\n          applicationId: accessScope.applicationId,\n        };\n\n      case ResourcePrimaryScope.ORGANIZATIONS: {\n        // EC owner wins; fall back to the torn-down row's own organization FK for a system cascade.\n        const organizationId = accessScope.organizationId ?? rowScopeValue;\n        if (!organizationId) {\n          throw this.errorBuilder.buildError(\n            ErrorType.VALIDATION,\n            executionContext,\n            {\n              customMessageReference: ErrorCustomMessageReference.FILE_SCOPE_IDENTIFIER_MISSING,\n              context: {\n                resourceType, // diagnostic (log-only)\n              },\n            }\n          );\n        }\n        if (!accessScope.applicationId) {\n          throw this.errorBuilder.buildError(\n            ErrorType.VALIDATION,\n            executionContext,\n            {\n              customMessageReference: ErrorCustomMessageReference.FILE_SCOPE_IDENTIFIER_MISSING,\n              context: {\n                resourceType, // diagnostic (log-only)\n              },\n            }\n          );\n        }\n        return {\n          primaryScope: ResourcePrimaryScope.ORGANIZATIONS,\n          applicationId: accessScope.applicationId,\n          organizationId,\n        };\n      }\n\n      case ResourcePrimaryScope.USER_SELF: {\n        // USER_SELF and ORGANIZATIONS are independent primary-scope axes (separation of\n        // concern): a self-owned file is owned by the USER, not an org. Require user\n        // (owner) + applicationId (tenant/bucket anchor); never read/persist an org.\n        // EC owner wins; fall back to the torn-down row's own user FK for a system cascade — the\n        // subject-erasure path, whose EC is forbidden from carrying the user identity.\n        const userId = accessScope.userId ?? rowScopeValue;\n        if (!userId) {\n          throw this.errorBuilder.buildError(\n            ErrorType.VALIDATION,\n            executionContext,\n            {\n              customMessageReference: ErrorCustomMessageReference.FILE_SCOPE_IDENTIFIER_MISSING,\n              context: {\n                resourceType, // diagnostic (log-only)\n              },\n            }\n          );\n        }\n        if (!accessScope.applicationId) {\n          throw this.errorBuilder.buildError(\n            ErrorType.VALIDATION,\n            executionContext,\n            {\n              customMessageReference: ErrorCustomMessageReference.FILE_SCOPE_IDENTIFIER_MISSING,\n              context: {\n                resourceType, // diagnostic (log-only)\n              },\n            }\n          );\n        }\n        return {\n          primaryScope: ResourcePrimaryScope.USER_SELF,\n          applicationId: accessScope.applicationId,\n          userId,\n        };\n      }\n\n      default:\n        throw this.errorBuilder.buildError(\n          ErrorType.CONFIGURATION,\n          executionContext,\n          {\n            customMessageReference: ErrorCustomMessageReference.CONFIGURATION,\n            context: {\n              message: 'File scope derivation only supports APPLICATION, ORGANIZATIONS, and USER_SELF resources',\n              resourceType,\n              primaryScope,\n            },\n          }\n        );\n    }\n  }\n\n  /**\n   * Extract file extension from filename.\n   *\n   * @param filename - Filename with or without extension\n   * @returns Extension without dot, or empty string if none\n   */\n  private extractExtension(filename: string): string {\n    const lastDot = filename.lastIndexOf('.');\n    if (lastDot === -1 || lastDot === filename.length - 1) {\n      return '';\n    }\n    return filename.substring(lastDot + 1).toLowerCase();\n  }\n}\n"]}