@wildo-ai/saas-backend-lib 1.1.1 → 1.1.3

package/dist/esm/files/storage/local-directory-storage-provider.backend.service.js

@@ -2,9 +2,23 @@
  * Local Directory Storage Provider
  *
  * IFileStorageProvider implementation backed by the local filesystem.
- * Files are stored under a configurable base directory, organized by
- * application and file ID. Path traversal attacks are guarded against
- * by resolving all paths and verifying they stay inside the base dir.
+ * Files are stored under a configurable base directory, at the SAME relative key the
+ * Wildo-managed provider would use — `applications/<appId>/files/<storageName>/<scope>/<scopeId>/…`,
+ * composed by `application-storage-key.backend.utils`. Path traversal attacks are guarded against
+ * by refusing a `.`/`..` segment in the composed key AND by resolving every path and verifying it
+ * stays inside the base dir.
+ *
+ * ## Why the key shape is shared rather than provider-local
+ *
+ * Until 2026-09-09 this provider composed `[applicationId]/[folderPath]/<leaf>` from the field's
+ * declarative binding alone, and included the application id only when the binding asked
+ * (`includeApplicationId`, defaulting to `false` here). It therefore emitted NONE of the
+ * `<scope>/<scopeId>` segments the managed provider's shape carries, so a deployment routing a
+ * `z_file()` field to local storage had no per-tenant prefix to sweep, list or confine against —
+ * and nothing failed, because an absent prefix produces no error, only an absent capability.
+ *
+ * Both providers now call one composer. See `application-storage-key.backend.utils.ts` for the
+ * argument and for what deliberately stays provider-local.
  *
  * Configured through `storage.localDirectory.baseDir` in resolved application
  * configuration, which the configuration loader seeds from the
@@ -36,6 +50,7 @@ import { describeCaughtError } from '../../errors/utils/error-log-level-classifi
 import { AppConfigurationService } from '../../config/services/app-configuration.backend.service.js';
 import { validateAppId, validateContentType, validateFileId, validateSize, validateStream, resolveConfiguredMaxFileSize } from '../../files/utils/file-validation.utils.js';
 import { resolveStorageApplicationIdentity } from '../../files/utils/storage-application-identity.backend.utils.js';
+import { composeApplicationStorageKey, composeStorageLeafPath, storageKeyHasTraversalSegment, } from './application-storage-key.backend.utils.js';
 const METADATA_SUFFIX = '.meta.json';
 let LocalDirectoryStorageProvider = class LocalDirectoryStorageProvider {
     logger;
@@ -106,34 +121,53 @@ let LocalDirectoryStorageProvider = class LocalDirectoryStorageProvider {
         return this.baseDir;
     }
     /**
-     * Compose the ordered path segments for an upload.
+     * Compose the relative storage key for an upload.
      *
-     * Layout (all optional segments omitted when absent):
-     * [applicationId] / [folderPath] / <fileName|fileId>
+     * Layout — identical to the managed provider's, minus that provider's bucket prefix:
+     *   `applications/<applicationId>/files/<storageName>/<scope>/<scopeId>/[folderPath/]<fileName|fileId>`
      *
-     * `includeApplicationId` defaults to `false` for local storage.
+     * `includeApplicationId` defaults to `true` here, as it does on the managed provider. It used to
+     * default to `false` ("the volume is typically per-app"), which is exactly what left this provider
+     * with no tenant structure: a per-app VOLUME separates applications from each other and separates
+     * nothing inside one. Set explicitly to `false` the key collapses to the bare leaf path on BOTH
+     * providers — one authored value, one meaning, and the same loss of every prefix operation.
      */
-    composePathSegments(fileId, executionContext, options) {
-        const segments = [];
-        const includeAppId = options?.includeApplicationId ?? false;
-        if (includeAppId) {
-            const applicationId = this.getApplicationId(executionContext);
-            segments.push(applicationId);
-        }
-        if (options?.folderPath) {
-            const trimmed = options.folderPath.trim();
-            if (trimmed) {
-                segments.push(trimmed);
-            }
-        }
-        const leaf = options?.fileName?.trim() || fileId;
-        if (!leaf) {
+    composeStorageKey(fileId, executionContext, options) {
+        const leafPath = composeStorageLeafPath(fileId, options);
+        if (!leafPath) {
             throw this.errorBuilder.buildError(ErrorType.VALIDATION, executionContext, {
                 customMessageReference: ErrorCustomMessageReference.FILE_STORAGE_KEY_COMPOSITION_FAILED,
             });
         }
-        segments.push(leaf);
-        return segments;
+        // Refused on the LEAF, textually, before any prefix is prepended — and this is load-bearing
+        // rather than belt-and-braces. `resolveSafePathFromRelative` below asks "does the resolved path
+        // escape the base directory", which was the whole guard while a key was one or two segments
+        // deep. Under the six-segment tenant prefix a `folderPath: '../../outside'` no longer escapes:
+        // it resolves to `applications/<app>/files/_unlinked/outside/…`, still inside the base, so the
+        // containment check ADMITS what it used to refuse. What the `..` now buys an attacker is not an
+        // escape from the store but an escape from the TENANT prefix — the exact property this key
+        // shape exists to provide.
+        //
+        // The managed provider refuses the same input for the mirror-image reason (its stored-ref prefix
+        // check is textual), so one authored value cannot mean two things depending on which provider a
+        // deployment binds. `assertNoTraversalSegments` there and this share `storageKeyHasTraversalSegment`.
+        if (storageKeyHasTraversalSegment(leafPath)) {
+            throw this.errorBuilder.buildError(ErrorType.AUTHORIZATION, undefined, {
+                customMessageReference: ErrorCustomMessageReference.FILE_PATH_TRAVERSAL_DETECTED,
+                context: {
+                    relativePath: leafPath, // diagnostic (log-only)
+                },
+            });
+        }
+        if (options?.includeApplicationId === false) {
+            return leafPath;
+        }
+        return composeApplicationStorageKey({
+            applicationId: this.getApplicationId(executionContext),
+            leafPath,
+            linkedResourceType: options?.linkedResourceType,
+            scope: options?.scope,
+        });
     }
     /**
      * Resolve a safe absolute path from a relative storage ref.
@@ -162,8 +196,7 @@ let LocalDirectoryStorageProvider = class LocalDirectoryStorageProvider {
         validateContentType(mimeType, this.errorBuilder, executionContext, 'mimeType');
         validateSize(size, resolveConfiguredMaxFileSize(this.appConfigService.config.storage?.maxFileSize), this.errorBuilder, executionContext, 'size');
         validateStream(fileStream, this.errorBuilder, executionContext, 'fileStream');
-        const segments = this.composePathSegments(fileId, executionContext, options);
-        const relativePath = segments.join('/');
+        const relativePath = this.composeStorageKey(fileId, executionContext, options);
         const filePath = this.resolveSafePathFromRelative(relativePath);
         await fs.promises.mkdir(path.dirname(filePath), { recursive: true });
         try {
@@ -255,12 +288,52 @@ let LocalDirectoryStorageProvider = class LocalDirectoryStorageProvider {
     /**
      * Resolve the absolute filesystem path from a persisted storageRef.
      * The ref IS the relative path from baseDir — just validate traversal.
+     *
+     * ## Already-stored files are NOT moved by the key-shape change, and nothing has to be migrated
+     *
+     * Every read verb (`download` / `delete` / `getMetadata`) reaches a blob through this method, and
+     * with a ref present it uses that ref VERBATIM. A blob written under the old
+     * `[applicationId]/[folderPath]/<leaf>` layout therefore stays addressable at exactly the path it
+     * was written to: the shape change governs where NEW uploads land, never how an existing row is
+     * resolved. No migration, and no compatibility branch, because there is nothing to be compatible
+     * with — the persisted ref is the address.
+     *
+     * ## The no-ref branch is LIVE, and it must track `upload` rather than freeze
+     *
+     * It looks like a legacy fallback for rows whose `storageRef` never committed. Its real caller is
+     * the audit-log archive batch: `archiveArtifactExists` probes `getMetadata` with
+     * `fileId: '<folderPath>/<fileName>'` and NO ref, deliberately, so that each provider re-derives
+     * the key its own `upload` produced and the batch never re-implements provider path logic. Pin
+     * the old composition here and that probe would address a blob the upload no longer writes, so
+     * `archiveArtifactExists` would answer `false` forever and every past day would be re-archived on
+     * every tick — a silent, unbounded regression with no failing test anywhere.
+     *
+     * So it composes through the SAME composer, with no resource type and no scope, mirroring the
+     * managed provider's `resolveApplicationObjectKey(file.fileId, ctx, undefined)` argument for
+     * argument. The parity is pinned in this provider's test suite (`upload` then `getMetadata` with
+     * no ref); the batch's own suite uses a fake provider and cannot see it.
+     *
+     * ## Residual, recorded rather than fixed: a `.`/`..` segment inside a PRESENT ref
+     *
+     * `composeStorageKey` refuses one on the composition path; this branch does not, and the managed
+     * provider's `assertNoTraversalSegments(normalizedStorageRef, …)` does. Two reasons it is left
+     * asymmetric, and neither is "nobody thought about it":
+     *
+     * - the containment check below is a real `path.resolve`, not managed's textual `startsWith`, so
+     *   the class of attack that motivated managed's stored-ref check (a ref that satisfies a textual
+     *   prefix while pointing elsewhere) is already caught here for anything leaving the base;
+     * - a `.` ref legitimately addresses the base directory and is pinned as NOT an authorization
+     *   refusal (`ADMITS the base directory itself`), which a whole-segment textual check would break.
+     *
+     * What survives is a ref whose text climbs out of one tenant prefix into another WITHIN the base.
+     * Reaching it needs write access to the `storageRef` column — the composition path can no longer
+     * produce one — so it is a smaller surface than the one closed above, not the same one. Closing it
+     * means deciding what `.` should mean first, which is a separate change.
      */
     resolvePathFromStorageRef(file, executionContext) {
         const ref = file.storageRef;
         if (!ref) {
-            const appId = this.getApplicationId(executionContext);
-            return this.resolveSafePathFromRelative(`${appId}/${file.fileId}`);
+            return this.resolveSafePathFromRelative(this.composeStorageKey(file.fileId, executionContext));
         }
         return this.resolveSafePathFromRelative(ref);
     }

package/dist/esm/files/storage/local-directory-storage-provider.backend.service.js.map

@@ -1 +1 @@
-{"version":3,"file":"local-directory-storage-provider.backend.service.js","sourceRoot":"","sources":["../../../../../src/files/storage/local-directory-storage-provider.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;;;;;;;;;;;;;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAE/C,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAC3C,OAAO,EAAE,SAAS,EAAE,2BAA2B,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AACpG,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAC/D,OAAO,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AAEpF,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAC9G,OAAO,EAAE,mBAAmB,EAAE,MAAM,8EAA8E,CAAC;AACnH,OAAO,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AAE/G,OAAO,EAAE,aAAa,EAAE,mBAAmB,EAAE,cAAc,EAAE,YAAY,EAAE,cAAc,EAAE,4BAA4B,EAAE,MAAM,sDAAsD,CAAC;AACtL,OAAO,EAAE,iCAAiC,EAAE,MAAM,2EAA2E,CAAC;AAW9H,MAAM,eAAe,GAAG,YAAY,CAAC;AAS9B,IAAM,6BAA6B,GAAnC,MAAM,6BAA6B;IAMrB;IAEA;IAEA;IATV,UAAU,GAAG,mBAAmB,CAAC,eAAe,CAAC;IAClD,OAAO,GAAkB,IAAI,CAAC;IAEtC,YAEmB,MAAqB,EAErB,YAAwC,EAExC,gBAAyC;QAJzC,WAAM,GAAN,MAAM,CAAe;QAErB,iBAAY,GAAZ,YAAY,CAA4B;QAExC,qBAAgB,GAAhB,gBAAgB,CAAyB;IACzD,CAAC;IAEJ;;;;;OAKG;IACH,YAAY;QACV,OAAO,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC;IAClC,CAAC;IAED,yFAAyF;IACzF,IAAY,iBAAiB;QAC3B,OAAO,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,OAAO,EAAE,cAAc,EAAE,OAAO,CAAC;IACvE,CAAC;IAED,KAAK,CAAC,UAAU;QACd,MAAM,MAAM,GAAG,IAAI,CAAC,iBAAiB,CAAC;QACtC,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,aAAa,EACvB,SAAS,EACT;gBACE,sBAAsB,EAAE,2BAA2B,CAAC,aAAa;gBACjE,OAAO,EAAE;oBACP,OAAO,EAAE,sGAAsG;iBAChH;aACF,CACF,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACtC,MAAM,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACvD,IAAI,CAAC,OAAO,GAAG,QAAQ,CAAC;IAC1B,CAAC;IAED,KAAK,CAAC,WAAW;QACf,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAE7B,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAClB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,EAAE,KAAK,EAAE,+BAA+B,EAAE,CAAC;QACrG,CAAC;QAED,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,GAAG,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YAC9E,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,EAAE,CAAC;QAC5D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;gBAC/B,KAAK,EAAE,mBAAmB,CAAC,KAAK,CAAC;aAClC,CAAC;QACJ,CAAC;IACH,CAAC;IAEO,UAAU;QAChB,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAClB,MAAM,GAAG,GAAG,IAAI,CAAC,iBAAiB,CAAC;YACnC,IAAI,CAAC,GAAG,EAAE,CAAC;gBACT,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,aAAa,EACvB,SAAS,EACT;oBACE,sBAAsB,EAAE,2BAA2B,CAAC,aAAa;oBACjE,OAAO,EAAE,EAAE,OAAO,EAAE,gFAAgF,EAAE;iBACvG,CACF,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACnC,CAAC;QACD,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IAED;;;;;;;OAOG;IACK,mBAAmB,CACzB,MAAc,EACd,gBAAuC,EACvC,OAA8B;QAE9B,MAAM,QAAQ,GAAa,EAAE,CAAC;QAE9B,MAAM,YAAY,GAAG,OAAO,EAAE,oBAAoB,IAAI,KAAK,CAAC;QAC5D,IAAI,YAAY,EAAE,CAAC;YACjB,MAAM,aAAa,GAAG,IAAI,CAAC,gBAAgB,CAAC,gBAAgB,CAAC,CAAC;YAC9D,QAAQ,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QAC/B,CAAC;QAED,IAAI,OAAO,EAAE,UAAU,EAAE,CAAC;YACxB,MAAM,OAAO,GAAG,OAAO,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;YAC1C,IAAI,OAAO,EAAE,CAAC;gBACZ,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACzB,CAAC;QACH,CAAC;QAED,MAAM,IAAI,GAAG,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,MAAM,CAAC;QACjD,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,UAAU,EACpB,gBAAgB,EAChB;gBACE,sBAAsB,EAAE,2BAA2B,CAAC,mCAAmC;aACxF,CACF,CAAC;QACJ,CAAC;QACD,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAEpB,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED;;;OAGG;IACK,2BAA2B,CAAC,YAAoB;QACtD,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC;QAC/B,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;QAClD,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YAC/D,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,aAAa,EACvB,SAAS,EACT;gBACE,sBAAsB,EAAE,2BAA2B,CAAC,4BAA4B;gBAChF,OAAO,EAAE;oBACP,YAAY,EAAE,wBAAwB;iBACvC;aACF,CACF,CAAC;QACJ,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAEO,gBAAgB,CAAC,gBAAuC;QAC9D,MAAM,aAAa,GAAG,iCAAiC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;QAC/E,aAAa,CAAC,aAAa,EAAE,IAAI,CAAC,YAAY,EAAE,gBAAgB,EAAE,eAAe,CAAC,CAAC;QACnF,OAAO,aAAa,CAAC;IACvB,CAAC;IAED,KAAK,CAAC,MAAM,CACV,UAAoB,EACpB,MAAc,EACd,QAAgB,EAChB,IAAY,EACZ,gBAAuC,EACvC,OAA8B;QAE9B,cAAc,CAAC,MAAM,EAAE,IAAI,CAAC,YAAY,EAAE,gBAAgB,EAAE,QAAQ,CAAC,CAAC;QACtE,mBAAmB,CAAC,QAAQ,EAAE,IAAI,CAAC,YAAY,EAAE,gBAAgB,EAAE,UAAU,CAAC,CAAC;QAC/E,YAAY,CACV,IAAI,EACJ,4BAA4B,CAAC,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,OAAO,EAAE,WAAW,CAAC,EAC/E,IAAI,CAAC,YAAY,EACjB,gBAAgB,EAChB,MAAM,CACP,CAAC;QACF,cAAc,CAAC,UAAU,EAAE,IAAI,CAAC,YAAY,EAAE,gBAAgB,EAAE,YAAY,CAAC,CAAC;QAE9E,MAAM,QAAQ,GAAG,IAAI,CAAC,mBAAmB,CAAC,MAAM,EAAE,gBAAgB,EAAE,OAAO,CAAC,CAAC;QAC7E,MAAM,YAAY,GAAG,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACxC,MAAM,QAAQ,GAAG,IAAI,CAAC,2BAA2B,CAAC,YAAY,CAAC,CAAC;QAEhE,MAAM,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAErE,IAAI,CAAC;YACH,MAAM,WAAW,GAAG,EAAE,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC;YACnD,MAAM,QAAQ,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;QAC1C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,mBAAmB,CAAC,KAAK,EAAE,QAAQ,EAAE,gBAAgB,EAAE;gBAC1D,MAAM;gBACN,QAAQ,EAAE,IAAI,CAAC,UAAU;aAC1B,CAAC,CAAC;QACL,CAAC;QAED,MAAM,cAAc,GAA4B;YAC9C,WAAW,EAAE,QAAQ;YACrB,IAAI;YACJ,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACpC,CAAC;QACF,MAAM,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,QAAQ,GAAG,eAAe,EAAE,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,EAAE,OAAO,CAAC,CAAC;QAEjG,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,QAAQ,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC;IACjE,CAAC;IAED,KAAK,CAAC,QAAQ,CACZ,IAA6B,EAC7B,gBAAuC;QAEvC,MAAM,QAAQ,GAAG,IAAI,CAAC,yBAAyB,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC;QAExE,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QACxD,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,SAAS,EACnB,gBAAgB,EAChB;gBACE,sBAAsB,EAAE,2BAA2B,CAAC,yBAAyB;gBAC7E,OAAO,EAAE;oBACP,wBAAwB;oBACxB,MAAM,EAAE,IAAI,CAAC,MAAM;oBACnB,QAAQ,EAAE,IAAI,CAAC,UAAU;iBAC1B;aACF,CACF,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;QACvF,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC9C,MAAM,MAAM,GAAG,EAAE,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC;QAE7C,OAAO;YACL,MAAM;YACN,WAAW,EAAE,QAAQ,CAAC,WAAW;YACjC,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,YAAY,EAAE,IAAI,CAAC,KAAK;SACzB,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,MAAM,CACV,IAA6B,EAC7B,gBAAuC;QAEvC,MAAM,QAAQ,GAAG,IAAI,CAAC,yBAAyB,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC;QAExE,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACrC,CAAC;QAAC,OAAO,KAAU,EAAE,CAAC;YACpB,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ;gBAAE,OAAO;YACpC,IAAI,CAAC,mBAAmB,CAAC,KAAK,EAAE,QAAQ,EAAE,gBAAgB,EAAE;gBAC1D,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,QAAQ,EAAE,IAAI,CAAC,UAAU;aAC1B,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,GAAG,eAAe,CAAC,CAAC;QACvD,CAAC;QAAC,MAAM,CAAC;YACP,oCAAoC;QACtC,CAAC;IACH,CAAC;IAED,KAAK,CAAC,WAAW,CACf,IAA6B,EAC7B,gBAAuC;QAEvC,MAAM,QAAQ,GAAG,IAAI,CAAC,yBAAyB,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC;QAExE,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QACxD,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,SAAS,EACnB,gBAAgB,EAChB;gBACE,sBAAsB,EAAE,2BAA2B,CAAC,yBAAyB;gBAC7E,OAAO,EAAE;oBACP,wBAAwB;oBACxB,MAAM,EAAE,IAAI,CAAC,MAAM;oBACnB,QAAQ,EAAE,IAAI,CAAC,UAAU;iBAC1B;aACF,CACF,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;QACvF,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAE9C,OAAO;YACL,WAAW,EAAE,QAAQ,CAAC,WAAW;YACjC,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,YAAY,EAAE,IAAI,CAAC,KAAK;SACzB,CAAC;IACJ,CAAC;IAED;;;OAGG;IACK,yBAAyB,CAC/B,IAA6B,EAC7B,gBAAuC;QAEvC,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,CAAC;QAC5B,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,MAAM,KAAK,GAAG,IAAI,CAAC,gBAAgB,CAAC,gBAAgB,CAAC,CAAC;YACtD,OAAO,IAAI,CAAC,2BAA2B,CAAC,GAAG,KAAK,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QACrE,CAAC;QACD,OAAO,IAAI,CAAC,2BAA2B,CAAC,GAAG,CAAC,CAAC;IAC/C,CAAC;IAEO,KAAK,CAAC,iBAAiB,CAC7B,QAAgB,EAChB,MAAc,EACd,gBAAuC;QAEvC,MAAM,QAAQ,GAAG,QAAQ,GAAG,eAAe,CAAC;QAC5C,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YAC1D,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAA4B,CAAC;QACpD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO;gBACL,WAAW,EAAE,0BAA0B;gBACvC,IAAI,EAAE,CAAC;gBACP,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;aACpC,CAAC;QACJ,CAAC;IACH,CAAC;IAEO,mBAAmB,CACzB,KAAc,EACd,SAAwD,EACxD,gBAAmD,EACnD,OAAgC;QAEhC,IAAI,mBAAmB,CAAC,KAAK,CAAC,EAAE,CAAC;YAC/B,MAAM,KAAK,CAAC;QACd,CAAC;QAED,MAAM,YAAY,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAC;QAChD,MAAM,SAAS,GAAI,KAAa,EAAE,IAAI,CAAC;QAEvC,IAAI,SAAS,KAAK,QAAQ,EAAE,CAAC;YAC3B,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,SAAS,EACnB,gBAAgB,EAChB;gBACE,sBAAsB,EAAE,2BAA2B,CAAC,yBAAyB;gBAC7E,OAAO,EAAE,EAAE,SAAS,EAAE,GAAG,OAAO,EAAE,EAAE,wBAAwB;aAC7D,CACF,CAAC;QACJ,CAAC;QAED,IAAI,SAAS,KAAK,QAAQ,IAAI,SAAS,KAAK,OAAO,EAAE,CAAC;YACpD,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,aAAa,EACvB,gBAAgB,EAChB;gBACE,sBAAsB,EAAE,2BAA2B,CAAC,0BAA0B;gBAC9E,OAAO,EAAE,EAAE,SAAS,EAAE,GAAG,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,EAAE,wBAAwB;aAC1F,CACF,CAAC;QACJ,CAAC;QAED,IAAI,SAAS,KAAK,QAAQ,EAAE,CAAC;YAC3B,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,gBAAgB,EAC1B,gBAAgB,EAChB;gBACE,sBAAsB,EAAE,2BAA2B,CAAC,gBAAgB;gBACpE,OAAO,EAAE,EAAE,OAAO,EAAE,yBAAyB,EAAE,SAAS,EAAE,GAAG,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE;aACpG,CACF,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,gBAAgB,EAC1B,gBAAgB,EAChB;YACE,sBAAsB,EAAE,2BAA2B,CAAC,gBAAgB;YACpE,OAAO,EAAE,EAAE,OAAO,EAAE,mCAAmC,SAAS,EAAE,EAAE,SAAS,EAAE,GAAG,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE;SACzH,CACF,CAAC;IACJ,CAAC;CACF,CAAA;AA7XY,6BAA6B;IADzC,UAAU,EAAE;IAMR,WAAA,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAA;IAEjC,WAAA,MAAM,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,CAAA;IAE9C,WAAA,MAAM,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,CAAA;+CADb,0BAA0B;QAEtB,uBAAuB;GAVjD,6BAA6B,CA6XzC","sourcesContent":["/**\n * Local Directory Storage Provider\n *\n * IFileStorageProvider implementation backed by the local filesystem.\n * Files are stored under a configurable base directory, organized by\n * application and file ID. Path traversal attacks are guarded against\n * by resolving all paths and verifying they stay inside the base dir.\n *\n * Configured through `storage.localDirectory.baseDir` in resolved application\n * configuration, which the configuration loader seeds from the\n * `STORAGE_LOCAL_BASE_DIR` environment variable. The provider itself reads\n * configuration, never the environment — see\n * `.claude/plans/application-runtime-topology-delivery.md`.\n */\n\nimport { injectable, inject } from 'inversify';\nimport { Readable } from 'stream';\nimport * as fs from 'fs';\nimport * as path from 'path';\nimport { pipeline } from 'stream/promises';\nimport { ErrorType, ErrorCustomMessageReference, isWildoBackendError } from '@wildo-ai/saas-models';\nimport { FileStorageAccepted } from '@wildo-ai/zod-decorators';\nimport { SAAS_SERVICE_TYPES } from '~wildo-backend-lib/inject/models/service-types';\nimport type { LoggerService } from '~wildo-backend-lib/monitoring/logger/services/logger.service';\nimport { ErrorBuilderBackendService } from '~wildo-backend-lib/errors/services/error-builder.backend.service';\nimport { describeCaughtError } from '~wildo-backend-lib/errors/utils/error-log-level-classification.backend.utils';\nimport { AppConfigurationService } from '~wildo-backend-lib/config/services/app-configuration.backend.service';\nimport type { ExecutionContext } from '~wildo-backend-lib/runtime/models/execution-context.backend.schemas';\nimport { validateAppId, validateContentType, validateFileId, validateSize, validateStream, resolveConfiguredMaxFileSize } from '~wildo-backend-lib/files/utils/file-validation.utils';\nimport { resolveStorageApplicationIdentity } from '~wildo-backend-lib/files/utils/storage-application-identity.backend.utils';\nimport type {\n  IFileStorageProvider,\n  StorageUploadResult,\n  StorageUploadOptions,\n  StorageDownloadResult,\n  StorageFileMetadata,\n  StorageProviderHealthResult,\n  StoredFileStorageTarget,\n} from './file-storage-provider.types';\n\nconst METADATA_SUFFIX = '.meta.json';\n\ninterface LocalFileMetadataRecord {\n  contentType: string;\n  size: number;\n  createdAt: string;\n}\n\n@injectable()\nexport class LocalDirectoryStorageProvider implements IFileStorageProvider {\n  readonly providerId = FileStorageAccepted.LOCAL_DIRECTORY;\n  private baseDir: string | null = null;\n\n  constructor(\n    @inject(SAAS_SERVICE_TYPES.Logger)\n    private readonly logger: LoggerService,\n    @inject(SAAS_SERVICE_TYPES.ErrorBuilderService)\n    private readonly errorBuilder: ErrorBuilderBackendService,\n    @inject(SAAS_SERVICE_TYPES.AppConfigService)\n    private readonly appConfigService: AppConfigurationService,\n  ) {}\n\n  /**\n   * Reading configuration here can throw `app_configuration_not_initialized`,\n   * and that is left unsoftened on purpose: answering `false` for \"configuration\n   * is not loaded yet\" is indistinguishable from \"this application has no local\n   * storage\", and the router would SKIP the provider in silence.\n   */\n  isConfigured(): boolean {\n    return !!this.configuredBaseDir;\n  }\n\n  /** The authored filesystem root, or `undefined` when local storage is not configured. */\n  private get configuredBaseDir(): string | undefined {\n    return this.appConfigService.config.storage?.localDirectory?.baseDir;\n  }\n\n  async initialize(): Promise<void> {\n    const rawDir = this.configuredBaseDir;\n    if (!rawDir) {\n      throw this.errorBuilder.buildError(\n        ErrorType.CONFIGURATION,\n        undefined,\n        {\n          customMessageReference: ErrorCustomMessageReference.CONFIGURATION,\n          context: {\n            message: 'storage.localDirectory.baseDir (from STORAGE_LOCAL_BASE_DIR) is required for local directory storage',\n          },\n        }\n      );\n    }\n\n    const resolved = path.resolve(rawDir);\n    await fs.promises.mkdir(resolved, { recursive: true });\n    this.baseDir = resolved;\n  }\n\n  async healthCheck(): Promise<StorageProviderHealthResult> {\n    const startTime = Date.now();\n\n    if (!this.baseDir) {\n      return { healthy: false, latency: Date.now() - startTime, error: 'Local storage not initialized' };\n    }\n\n    try {\n      await fs.promises.access(this.baseDir, fs.constants.R_OK | fs.constants.W_OK);\n      return { healthy: true, latency: Date.now() - startTime };\n    } catch (error) {\n      return {\n        healthy: false,\n        latency: Date.now() - startTime,\n        error: describeCaughtError(error),\n      };\n    }\n  }\n\n  private getBaseDir(): string {\n    if (!this.baseDir) {\n      const raw = this.configuredBaseDir;\n      if (!raw) {\n        throw this.errorBuilder.buildError(\n          ErrorType.CONFIGURATION,\n          undefined,\n          {\n            customMessageReference: ErrorCustomMessageReference.CONFIGURATION,\n            context: { message: 'storage.localDirectory.baseDir (from STORAGE_LOCAL_BASE_DIR) is not configured' },\n          }\n        );\n      }\n      this.baseDir = path.resolve(raw);\n    }\n    return this.baseDir;\n  }\n\n  /**\n   * Compose the ordered path segments for an upload.\n   *\n   * Layout (all optional segments omitted when absent):\n   * [applicationId] / [folderPath] / <fileName|fileId>\n   *\n   * `includeApplicationId` defaults to `false` for local storage.\n   */\n  private composePathSegments(\n    fileId: string,\n    executionContext: ExecutionContext<any>,\n    options?: StorageUploadOptions,\n  ): string[] {\n    const segments: string[] = [];\n\n    const includeAppId = options?.includeApplicationId ?? false;\n    if (includeAppId) {\n      const applicationId = this.getApplicationId(executionContext);\n      segments.push(applicationId);\n    }\n\n    if (options?.folderPath) {\n      const trimmed = options.folderPath.trim();\n      if (trimmed) {\n        segments.push(trimmed);\n      }\n    }\n\n    const leaf = options?.fileName?.trim() || fileId;\n    if (!leaf) {\n      throw this.errorBuilder.buildError(\n        ErrorType.VALIDATION,\n        executionContext,\n        {\n          customMessageReference: ErrorCustomMessageReference.FILE_STORAGE_KEY_COMPOSITION_FAILED,\n        }\n      );\n    }\n    segments.push(leaf);\n\n    return segments;\n  }\n\n  /**\n   * Resolve a safe absolute path from a relative storage ref.\n   * Throws if the resolved path escapes the base directory (path traversal guard).\n   */\n  private resolveSafePathFromRelative(relativePath: string): string {\n    const base = this.getBaseDir();\n    const filePath = path.resolve(base, relativePath);\n    if (!filePath.startsWith(base + path.sep) && filePath !== base) {\n      throw this.errorBuilder.buildError(\n        ErrorType.AUTHORIZATION,\n        undefined,\n        {\n          customMessageReference: ErrorCustomMessageReference.FILE_PATH_TRAVERSAL_DETECTED,\n          context: {\n            relativePath, // diagnostic (log-only)\n          },\n        }\n      );\n    }\n    return filePath;\n  }\n\n  private getApplicationId(executionContext: ExecutionContext<any>): string {\n    const applicationId = resolveStorageApplicationIdentity(this.appConfigService);\n    validateAppId(applicationId, this.errorBuilder, executionContext, 'applicationId');\n    return applicationId;\n  }\n\n  async upload(\n    fileStream: Readable,\n    fileId: string,\n    mimeType: string,\n    size: number,\n    executionContext: ExecutionContext<any>,\n    options?: StorageUploadOptions,\n  ): Promise<StorageUploadResult> {\n    validateFileId(fileId, this.errorBuilder, executionContext, 'fileId');\n    validateContentType(mimeType, this.errorBuilder, executionContext, 'mimeType');\n    validateSize(\n      size,\n      resolveConfiguredMaxFileSize(this.appConfigService.config.storage?.maxFileSize),\n      this.errorBuilder,\n      executionContext,\n      'size',\n    );\n    validateStream(fileStream, this.errorBuilder, executionContext, 'fileStream');\n\n    const segments = this.composePathSegments(fileId, executionContext, options);\n    const relativePath = segments.join('/');\n    const filePath = this.resolveSafePathFromRelative(relativePath);\n\n    await fs.promises.mkdir(path.dirname(filePath), { recursive: true });\n\n    try {\n      const writeStream = fs.createWriteStream(filePath);\n      await pipeline(fileStream, writeStream);\n    } catch (error) {\n      this.convertStorageError(error, 'upload', executionContext, {\n        fileId,\n        provider: this.providerId,\n      });\n    }\n\n    const metadataRecord: LocalFileMetadataRecord = {\n      contentType: mimeType,\n      size,\n      createdAt: new Date().toISOString(),\n    };\n    await fs.promises.writeFile(filePath + METADATA_SUFFIX, JSON.stringify(metadataRecord), 'utf-8');\n\n    return { storageRef: relativePath, provider: this.providerId };\n  }\n\n  async download(\n    file: StoredFileStorageTarget,\n    executionContext: ExecutionContext<any>,\n  ): Promise<StorageDownloadResult> {\n    const filePath = this.resolvePathFromStorageRef(file, executionContext);\n\n    try {\n      await fs.promises.access(filePath, fs.constants.R_OK);\n    } catch {\n      throw this.errorBuilder.buildError(\n        ErrorType.NOT_FOUND,\n        executionContext,\n        {\n          customMessageReference: ErrorCustomMessageReference.FILE_NOT_FOUND_IN_STORAGE,\n          context: {\n            // diagnostic (log-only)\n            fileId: file.fileId,\n            provider: this.providerId,\n          },\n        }\n      );\n    }\n\n    const metadata = await this.readLocalMetadata(filePath, file.fileId, executionContext);\n    const stat = await fs.promises.stat(filePath);\n    const stream = fs.createReadStream(filePath);\n\n    return {\n      stream,\n      contentType: metadata.contentType,\n      size: stat.size,\n      lastModified: stat.mtime,\n    };\n  }\n\n  async delete(\n    file: StoredFileStorageTarget,\n    executionContext: ExecutionContext<any>,\n  ): Promise<void> {\n    const filePath = this.resolvePathFromStorageRef(file, executionContext);\n\n    try {\n      await fs.promises.unlink(filePath);\n    } catch (error: any) {\n      if (error.code === 'ENOENT') return;\n      this.convertStorageError(error, 'delete', executionContext, {\n        fileId: file.fileId,\n        provider: this.providerId,\n      });\n    }\n\n    try {\n      await fs.promises.unlink(filePath + METADATA_SUFFIX);\n    } catch {\n      // metadata file already gone — fine\n    }\n  }\n\n  async getMetadata(\n    file: StoredFileStorageTarget,\n    executionContext: ExecutionContext<any>,\n  ): Promise<StorageFileMetadata> {\n    const filePath = this.resolvePathFromStorageRef(file, executionContext);\n\n    try {\n      await fs.promises.access(filePath, fs.constants.R_OK);\n    } catch {\n      throw this.errorBuilder.buildError(\n        ErrorType.NOT_FOUND,\n        executionContext,\n        {\n          customMessageReference: ErrorCustomMessageReference.FILE_NOT_FOUND_IN_STORAGE,\n          context: {\n            // diagnostic (log-only)\n            fileId: file.fileId,\n            provider: this.providerId,\n          },\n        }\n      );\n    }\n\n    const metadata = await this.readLocalMetadata(filePath, file.fileId, executionContext);\n    const stat = await fs.promises.stat(filePath);\n\n    return {\n      contentType: metadata.contentType,\n      size: stat.size,\n      lastModified: stat.mtime,\n    };\n  }\n\n  /**\n   * Resolve the absolute filesystem path from a persisted storageRef.\n   * The ref IS the relative path from baseDir — just validate traversal.\n   */\n  private resolvePathFromStorageRef(\n    file: StoredFileStorageTarget,\n    executionContext: ExecutionContext<any>,\n  ): string {\n    const ref = file.storageRef;\n    if (!ref) {\n      const appId = this.getApplicationId(executionContext);\n      return this.resolveSafePathFromRelative(`${appId}/${file.fileId}`);\n    }\n    return this.resolveSafePathFromRelative(ref);\n  }\n\n  private async readLocalMetadata(\n    filePath: string,\n    fileId: string,\n    executionContext: ExecutionContext<any>,\n  ): Promise<LocalFileMetadataRecord> {\n    const metaPath = filePath + METADATA_SUFFIX;\n    try {\n      const raw = await fs.promises.readFile(metaPath, 'utf-8');\n      return JSON.parse(raw) as LocalFileMetadataRecord;\n    } catch {\n      return {\n        contentType: 'application/octet-stream',\n        size: 0,\n        createdAt: new Date().toISOString(),\n      };\n    }\n  }\n\n  private convertStorageError(\n    error: unknown,\n    operation: 'upload' | 'download' | 'delete' | 'metadata',\n    executionContext: ExecutionContext<any> | undefined,\n    context: Record<string, unknown>,\n  ): never {\n    if (isWildoBackendError(error)) {\n      throw error;\n    }\n\n    const errorMessage = describeCaughtError(error);\n    const errorCode = (error as any)?.code;\n\n    if (errorCode === 'ENOENT') {\n      throw this.errorBuilder.buildError(\n        ErrorType.NOT_FOUND,\n        executionContext,\n        {\n          customMessageReference: ErrorCustomMessageReference.FILE_NOT_FOUND_IN_STORAGE,\n          context: { operation, ...context }, // diagnostic (log-only)\n        }\n      );\n    }\n\n    if (errorCode === 'EACCES' || errorCode === 'EPERM') {\n      throw this.errorBuilder.buildError(\n        ErrorType.AUTHORIZATION,\n        executionContext,\n        {\n          customMessageReference: ErrorCustomMessageReference.FILE_STORAGE_ACCESS_DENIED,\n          context: { operation, ...context, originalError: errorMessage }, // diagnostic (log-only)\n        }\n      );\n    }\n\n    if (errorCode === 'ENOSPC') {\n      throw this.errorBuilder.buildError(\n        ErrorType.EXTERNAL_SERVICE,\n        executionContext,\n        {\n          customMessageReference: ErrorCustomMessageReference.EXTERNAL_SERVICE,\n          context: { message: 'Local storage disk full', operation, ...context, originalError: errorMessage },\n        }\n      );\n    }\n\n    throw this.errorBuilder.buildError(\n      ErrorType.EXTERNAL_SERVICE,\n      executionContext,\n      {\n        customMessageReference: ErrorCustomMessageReference.EXTERNAL_SERVICE,\n        context: { message: `Local storage operation failed: ${operation}`, operation, ...context, originalError: errorMessage },\n      }\n    );\n  }\n}\n"]}
+{"version":3,"file":"local-directory-storage-provider.backend.service.js","sourceRoot":"","sources":["../../../../../src/files/storage/local-directory-storage-provider.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;;;;;;;;;;;;;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAE/C,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAC3C,OAAO,EAAE,SAAS,EAAE,2BAA2B,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AACpG,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAC/D,OAAO,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AAEpF,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAC9G,OAAO,EAAE,mBAAmB,EAAE,MAAM,8EAA8E,CAAC;AACnH,OAAO,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AAE/G,OAAO,EAAE,aAAa,EAAE,mBAAmB,EAAE,cAAc,EAAE,YAAY,EAAE,cAAc,EAAE,4BAA4B,EAAE,MAAM,sDAAsD,CAAC;AACtL,OAAO,EAAE,iCAAiC,EAAE,MAAM,2EAA2E,CAAC;AAC9H,OAAO,EACL,4BAA4B,EAC5B,sBAAsB,EACtB,6BAA6B,GAC9B,MAAM,yCAAyC,CAAC;AAWjD,MAAM,eAAe,GAAG,YAAY,CAAC;AAS9B,IAAM,6BAA6B,GAAnC,MAAM,6BAA6B;IAMrB;IAEA;IAEA;IATV,UAAU,GAAG,mBAAmB,CAAC,eAAe,CAAC;IAClD,OAAO,GAAkB,IAAI,CAAC;IAEtC,YAEmB,MAAqB,EAErB,YAAwC,EAExC,gBAAyC;QAJzC,WAAM,GAAN,MAAM,CAAe;QAErB,iBAAY,GAAZ,YAAY,CAA4B;QAExC,qBAAgB,GAAhB,gBAAgB,CAAyB;IACzD,CAAC;IAEJ;;;;;OAKG;IACH,YAAY;QACV,OAAO,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC;IAClC,CAAC;IAED,yFAAyF;IACzF,IAAY,iBAAiB;QAC3B,OAAO,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,OAAO,EAAE,cAAc,EAAE,OAAO,CAAC;IACvE,CAAC;IAED,KAAK,CAAC,UAAU;QACd,MAAM,MAAM,GAAG,IAAI,CAAC,iBAAiB,CAAC;QACtC,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,aAAa,EACvB,SAAS,EACT;gBACE,sBAAsB,EAAE,2BAA2B,CAAC,aAAa;gBACjE,OAAO,EAAE;oBACP,OAAO,EAAE,sGAAsG;iBAChH;aACF,CACF,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACtC,MAAM,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACvD,IAAI,CAAC,OAAO,GAAG,QAAQ,CAAC;IAC1B,CAAC;IAED,KAAK,CAAC,WAAW;QACf,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAE7B,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAClB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,EAAE,KAAK,EAAE,+BAA+B,EAAE,CAAC;QACrG,CAAC;QAED,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,GAAG,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YAC9E,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,EAAE,CAAC;QAC5D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;gBAC/B,KAAK,EAAE,mBAAmB,CAAC,KAAK,CAAC;aAClC,CAAC;QACJ,CAAC;IACH,CAAC;IAEO,UAAU;QAChB,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAClB,MAAM,GAAG,GAAG,IAAI,CAAC,iBAAiB,CAAC;YACnC,IAAI,CAAC,GAAG,EAAE,CAAC;gBACT,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,aAAa,EACvB,SAAS,EACT;oBACE,sBAAsB,EAAE,2BAA2B,CAAC,aAAa;oBACjE,OAAO,EAAE,EAAE,OAAO,EAAE,gFAAgF,EAAE;iBACvG,CACF,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACnC,CAAC;QACD,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IAED;;;;;;;;;;;OAWG;IACK,iBAAiB,CACvB,MAAc,EACd,gBAAuC,EACvC,OAA8B;QAE9B,MAAM,QAAQ,GAAG,sBAAsB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACzD,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,UAAU,EACpB,gBAAgB,EAChB;gBACE,sBAAsB,EAAE,2BAA2B,CAAC,mCAAmC;aACxF,CACF,CAAC;QACJ,CAAC;QAED,4FAA4F;QAC5F,gGAAgG;QAChG,4FAA4F;QAC5F,+FAA+F;QAC/F,+FAA+F;QAC/F,gGAAgG;QAChG,2FAA2F;QAC3F,2BAA2B;QAC3B,EAAE;QACF,iGAAiG;QACjG,gGAAgG;QAChG,sGAAsG;QACtG,IAAI,6BAA6B,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC5C,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,aAAa,EACvB,SAAS,EACT;gBACE,sBAAsB,EAAE,2BAA2B,CAAC,4BAA4B;gBAChF,OAAO,EAAE;oBACP,YAAY,EAAE,QAAQ,EAAE,wBAAwB;iBACjD;aACF,CACF,CAAC;QACJ,CAAC;QAED,IAAI,OAAO,EAAE,oBAAoB,KAAK,KAAK,EAAE,CAAC;YAC5C,OAAO,QAAQ,CAAC;QAClB,CAAC;QAED,OAAO,4BAA4B,CAAC;YAClC,aAAa,EAAE,IAAI,CAAC,gBAAgB,CAAC,gBAAgB,CAAC;YACtD,QAAQ;YACR,kBAAkB,EAAE,OAAO,EAAE,kBAAkB;YAC/C,KAAK,EAAE,OAAO,EAAE,KAAK;SACtB,CAAC,CAAC;IACL,CAAC;IAED;;;OAGG;IACK,2BAA2B,CAAC,YAAoB;QACtD,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC;QAC/B,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;QAClD,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YAC/D,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,aAAa,EACvB,SAAS,EACT;gBACE,sBAAsB,EAAE,2BAA2B,CAAC,4BAA4B;gBAChF,OAAO,EAAE;oBACP,YAAY,EAAE,wBAAwB;iBACvC;aACF,CACF,CAAC;QACJ,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAEO,gBAAgB,CAAC,gBAAuC;QAC9D,MAAM,aAAa,GAAG,iCAAiC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;QAC/E,aAAa,CAAC,aAAa,EAAE,IAAI,CAAC,YAAY,EAAE,gBAAgB,EAAE,eAAe,CAAC,CAAC;QACnF,OAAO,aAAa,CAAC;IACvB,CAAC;IAED,KAAK,CAAC,MAAM,CACV,UAAoB,EACpB,MAAc,EACd,QAAgB,EAChB,IAAY,EACZ,gBAAuC,EACvC,OAA8B;QAE9B,cAAc,CAAC,MAAM,EAAE,IAAI,CAAC,YAAY,EAAE,gBAAgB,EAAE,QAAQ,CAAC,CAAC;QACtE,mBAAmB,CAAC,QAAQ,EAAE,IAAI,CAAC,YAAY,EAAE,gBAAgB,EAAE,UAAU,CAAC,CAAC;QAC/E,YAAY,CACV,IAAI,EACJ,4BAA4B,CAAC,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,OAAO,EAAE,WAAW,CAAC,EAC/E,IAAI,CAAC,YAAY,EACjB,gBAAgB,EAChB,MAAM,CACP,CAAC;QACF,cAAc,CAAC,UAAU,EAAE,IAAI,CAAC,YAAY,EAAE,gBAAgB,EAAE,YAAY,CAAC,CAAC;QAE9E,MAAM,YAAY,GAAG,IAAI,CAAC,iBAAiB,CAAC,MAAM,EAAE,gBAAgB,EAAE,OAAO,CAAC,CAAC;QAC/E,MAAM,QAAQ,GAAG,IAAI,CAAC,2BAA2B,CAAC,YAAY,CAAC,CAAC;QAEhE,MAAM,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAErE,IAAI,CAAC;YACH,MAAM,WAAW,GAAG,EAAE,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC;YACnD,MAAM,QAAQ,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;QAC1C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,mBAAmB,CAAC,KAAK,EAAE,QAAQ,EAAE,gBAAgB,EAAE;gBAC1D,MAAM;gBACN,QAAQ,EAAE,IAAI,CAAC,UAAU;aAC1B,CAAC,CAAC;QACL,CAAC;QAED,MAAM,cAAc,GAA4B;YAC9C,WAAW,EAAE,QAAQ;YACrB,IAAI;YACJ,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACpC,CAAC;QACF,MAAM,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,QAAQ,GAAG,eAAe,EAAE,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,EAAE,OAAO,CAAC,CAAC;QAEjG,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,QAAQ,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC;IACjE,CAAC;IAED,KAAK,CAAC,QAAQ,CACZ,IAA6B,EAC7B,gBAAuC;QAEvC,MAAM,QAAQ,GAAG,IAAI,CAAC,yBAAyB,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC;QAExE,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QACxD,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,SAAS,EACnB,gBAAgB,EAChB;gBACE,sBAAsB,EAAE,2BAA2B,CAAC,yBAAyB;gBAC7E,OAAO,EAAE;oBACP,wBAAwB;oBACxB,MAAM,EAAE,IAAI,CAAC,MAAM;oBACnB,QAAQ,EAAE,IAAI,CAAC,UAAU;iBAC1B;aACF,CACF,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;QACvF,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC9C,MAAM,MAAM,GAAG,EAAE,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC;QAE7C,OAAO;YACL,MAAM;YACN,WAAW,EAAE,QAAQ,CAAC,WAAW;YACjC,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,YAAY,EAAE,IAAI,CAAC,KAAK;SACzB,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,MAAM,CACV,IAA6B,EAC7B,gBAAuC;QAEvC,MAAM,QAAQ,GAAG,IAAI,CAAC,yBAAyB,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC;QAExE,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACrC,CAAC;QAAC,OAAO,KAAU,EAAE,CAAC;YACpB,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ;gBAAE,OAAO;YACpC,IAAI,CAAC,mBAAmB,CAAC,KAAK,EAAE,QAAQ,EAAE,gBAAgB,EAAE;gBAC1D,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,QAAQ,EAAE,IAAI,CAAC,UAAU;aAC1B,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,GAAG,eAAe,CAAC,CAAC;QACvD,CAAC;QAAC,MAAM,CAAC;YACP,oCAAoC;QACtC,CAAC;IACH,CAAC;IAED,KAAK,CAAC,WAAW,CACf,IAA6B,EAC7B,gBAAuC;QAEvC,MAAM,QAAQ,GAAG,IAAI,CAAC,yBAAyB,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC;QAExE,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QACxD,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,SAAS,EACnB,gBAAgB,EAChB;gBACE,sBAAsB,EAAE,2BAA2B,CAAC,yBAAyB;gBAC7E,OAAO,EAAE;oBACP,wBAAwB;oBACxB,MAAM,EAAE,IAAI,CAAC,MAAM;oBACnB,QAAQ,EAAE,IAAI,CAAC,UAAU;iBAC1B;aACF,CACF,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;QACvF,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAE9C,OAAO;YACL,WAAW,EAAE,QAAQ,CAAC,WAAW;YACjC,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,YAAY,EAAE,IAAI,CAAC,KAAK;SACzB,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4CG;IACK,yBAAyB,CAC/B,IAA6B,EAC7B,gBAAuC;QAEvC,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,CAAC;QAC5B,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,OAAO,IAAI,CAAC,2BAA2B,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC,CAAC;QACjG,CAAC;QACD,OAAO,IAAI,CAAC,2BAA2B,CAAC,GAAG,CAAC,CAAC;IAC/C,CAAC;IAEO,KAAK,CAAC,iBAAiB,CAC7B,QAAgB,EAChB,MAAc,EACd,gBAAuC;QAEvC,MAAM,QAAQ,GAAG,QAAQ,GAAG,eAAe,CAAC;QAC5C,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YAC1D,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAA4B,CAAC;QACpD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO;gBACL,WAAW,EAAE,0BAA0B;gBACvC,IAAI,EAAE,CAAC;gBACP,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;aACpC,CAAC;QACJ,CAAC;IACH,CAAC;IAEO,mBAAmB,CACzB,KAAc,EACd,SAAwD,EACxD,gBAAmD,EACnD,OAAgC;QAEhC,IAAI,mBAAmB,CAAC,KAAK,CAAC,EAAE,CAAC;YAC/B,MAAM,KAAK,CAAC;QACd,CAAC;QAED,MAAM,YAAY,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAC;QAChD,MAAM,SAAS,GAAI,KAAa,EAAE,IAAI,CAAC;QAEvC,IAAI,SAAS,KAAK,QAAQ,EAAE,CAAC;YAC3B,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,SAAS,EACnB,gBAAgB,EAChB;gBACE,sBAAsB,EAAE,2BAA2B,CAAC,yBAAyB;gBAC7E,OAAO,EAAE,EAAE,SAAS,EAAE,GAAG,OAAO,EAAE,EAAE,wBAAwB;aAC7D,CACF,CAAC;QACJ,CAAC;QAED,IAAI,SAAS,KAAK,QAAQ,IAAI,SAAS,KAAK,OAAO,EAAE,CAAC;YACpD,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,aAAa,EACvB,gBAAgB,EAChB;gBACE,sBAAsB,EAAE,2BAA2B,CAAC,0BAA0B;gBAC9E,OAAO,EAAE,EAAE,SAAS,EAAE,GAAG,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,EAAE,wBAAwB;aAC1F,CACF,CAAC;QACJ,CAAC;QAED,IAAI,SAAS,KAAK,QAAQ,EAAE,CAAC;YAC3B,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,gBAAgB,EAC1B,gBAAgB,EAChB;gBACE,sBAAsB,EAAE,2BAA2B,CAAC,gBAAgB;gBACpE,OAAO,EAAE,EAAE,OAAO,EAAE,yBAAyB,EAAE,SAAS,EAAE,GAAG,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE;aACpG,CACF,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,gBAAgB,EAC1B,gBAAgB,EAChB;YACE,sBAAsB,EAAE,2BAA2B,CAAC,gBAAgB;YACpE,OAAO,EAAE,EAAE,OAAO,EAAE,mCAAmC,SAAS,EAAE,EAAE,SAAS,EAAE,GAAG,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE;SACzH,CACF,CAAC;IACJ,CAAC;CACF,CAAA;AA1bY,6BAA6B;IADzC,UAAU,EAAE;IAMR,WAAA,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAA;IAEjC,WAAA,MAAM,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,CAAA;IAE9C,WAAA,MAAM,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,CAAA;+CADb,0BAA0B;QAEtB,uBAAuB;GAVjD,6BAA6B,CA0bzC","sourcesContent":["/**\n * Local Directory Storage Provider\n *\n * IFileStorageProvider implementation backed by the local filesystem.\n * Files are stored under a configurable base directory, at the SAME relative key the\n * Wildo-managed provider would use — `applications/<appId>/files/<storageName>/<scope>/<scopeId>/…`,\n * composed by `application-storage-key.backend.utils`. Path traversal attacks are guarded against\n * by refusing a `.`/`..` segment in the composed key AND by resolving every path and verifying it\n * stays inside the base dir.\n *\n * ## Why the key shape is shared rather than provider-local\n *\n * Until 2026-09-09 this provider composed `[applicationId]/[folderPath]/<leaf>` from the field's\n * declarative binding alone, and included the application id only when the binding asked\n * (`includeApplicationId`, defaulting to `false` here). It therefore emitted NONE of the\n * `<scope>/<scopeId>` segments the managed provider's shape carries, so a deployment routing a\n * `z_file()` field to local storage had no per-tenant prefix to sweep, list or confine against —\n * and nothing failed, because an absent prefix produces no error, only an absent capability.\n *\n * Both providers now call one composer. See `application-storage-key.backend.utils.ts` for the\n * argument and for what deliberately stays provider-local.\n *\n * Configured through `storage.localDirectory.baseDir` in resolved application\n * configuration, which the configuration loader seeds from the\n * `STORAGE_LOCAL_BASE_DIR` environment variable. The provider itself reads\n * configuration, never the environment — see\n * `.claude/plans/application-runtime-topology-delivery.md`.\n */\n\nimport { injectable, inject } from 'inversify';\nimport { Readable } from 'stream';\nimport * as fs from 'fs';\nimport * as path from 'path';\nimport { pipeline } from 'stream/promises';\nimport { ErrorType, ErrorCustomMessageReference, isWildoBackendError } from '@wildo-ai/saas-models';\nimport { FileStorageAccepted } from '@wildo-ai/zod-decorators';\nimport { SAAS_SERVICE_TYPES } from '~wildo-backend-lib/inject/models/service-types';\nimport type { LoggerService } from '~wildo-backend-lib/monitoring/logger/services/logger.service';\nimport { ErrorBuilderBackendService } from '~wildo-backend-lib/errors/services/error-builder.backend.service';\nimport { describeCaughtError } from '~wildo-backend-lib/errors/utils/error-log-level-classification.backend.utils';\nimport { AppConfigurationService } from '~wildo-backend-lib/config/services/app-configuration.backend.service';\nimport type { ExecutionContext } from '~wildo-backend-lib/runtime/models/execution-context.backend.schemas';\nimport { validateAppId, validateContentType, validateFileId, validateSize, validateStream, resolveConfiguredMaxFileSize } from '~wildo-backend-lib/files/utils/file-validation.utils';\nimport { resolveStorageApplicationIdentity } from '~wildo-backend-lib/files/utils/storage-application-identity.backend.utils';\nimport {\n  composeApplicationStorageKey,\n  composeStorageLeafPath,\n  storageKeyHasTraversalSegment,\n} from './application-storage-key.backend.utils';\nimport type {\n  IFileStorageProvider,\n  StorageUploadResult,\n  StorageUploadOptions,\n  StorageDownloadResult,\n  StorageFileMetadata,\n  StorageProviderHealthResult,\n  StoredFileStorageTarget,\n} from './file-storage-provider.types';\n\nconst METADATA_SUFFIX = '.meta.json';\n\ninterface LocalFileMetadataRecord {\n  contentType: string;\n  size: number;\n  createdAt: string;\n}\n\n@injectable()\nexport class LocalDirectoryStorageProvider implements IFileStorageProvider {\n  readonly providerId = FileStorageAccepted.LOCAL_DIRECTORY;\n  private baseDir: string | null = null;\n\n  constructor(\n    @inject(SAAS_SERVICE_TYPES.Logger)\n    private readonly logger: LoggerService,\n    @inject(SAAS_SERVICE_TYPES.ErrorBuilderService)\n    private readonly errorBuilder: ErrorBuilderBackendService,\n    @inject(SAAS_SERVICE_TYPES.AppConfigService)\n    private readonly appConfigService: AppConfigurationService,\n  ) {}\n\n  /**\n   * Reading configuration here can throw `app_configuration_not_initialized`,\n   * and that is left unsoftened on purpose: answering `false` for \"configuration\n   * is not loaded yet\" is indistinguishable from \"this application has no local\n   * storage\", and the router would SKIP the provider in silence.\n   */\n  isConfigured(): boolean {\n    return !!this.configuredBaseDir;\n  }\n\n  /** The authored filesystem root, or `undefined` when local storage is not configured. */\n  private get configuredBaseDir(): string | undefined {\n    return this.appConfigService.config.storage?.localDirectory?.baseDir;\n  }\n\n  async initialize(): Promise<void> {\n    const rawDir = this.configuredBaseDir;\n    if (!rawDir) {\n      throw this.errorBuilder.buildError(\n        ErrorType.CONFIGURATION,\n        undefined,\n        {\n          customMessageReference: ErrorCustomMessageReference.CONFIGURATION,\n          context: {\n            message: 'storage.localDirectory.baseDir (from STORAGE_LOCAL_BASE_DIR) is required for local directory storage',\n          },\n        }\n      );\n    }\n\n    const resolved = path.resolve(rawDir);\n    await fs.promises.mkdir(resolved, { recursive: true });\n    this.baseDir = resolved;\n  }\n\n  async healthCheck(): Promise<StorageProviderHealthResult> {\n    const startTime = Date.now();\n\n    if (!this.baseDir) {\n      return { healthy: false, latency: Date.now() - startTime, error: 'Local storage not initialized' };\n    }\n\n    try {\n      await fs.promises.access(this.baseDir, fs.constants.R_OK | fs.constants.W_OK);\n      return { healthy: true, latency: Date.now() - startTime };\n    } catch (error) {\n      return {\n        healthy: false,\n        latency: Date.now() - startTime,\n        error: describeCaughtError(error),\n      };\n    }\n  }\n\n  private getBaseDir(): string {\n    if (!this.baseDir) {\n      const raw = this.configuredBaseDir;\n      if (!raw) {\n        throw this.errorBuilder.buildError(\n          ErrorType.CONFIGURATION,\n          undefined,\n          {\n            customMessageReference: ErrorCustomMessageReference.CONFIGURATION,\n            context: { message: 'storage.localDirectory.baseDir (from STORAGE_LOCAL_BASE_DIR) is not configured' },\n          }\n        );\n      }\n      this.baseDir = path.resolve(raw);\n    }\n    return this.baseDir;\n  }\n\n  /**\n   * Compose the relative storage key for an upload.\n   *\n   * Layout — identical to the managed provider's, minus that provider's bucket prefix:\n   *   `applications/<applicationId>/files/<storageName>/<scope>/<scopeId>/[folderPath/]<fileName|fileId>`\n   *\n   * `includeApplicationId` defaults to `true` here, as it does on the managed provider. It used to\n   * default to `false` (\"the volume is typically per-app\"), which is exactly what left this provider\n   * with no tenant structure: a per-app VOLUME separates applications from each other and separates\n   * nothing inside one. Set explicitly to `false` the key collapses to the bare leaf path on BOTH\n   * providers — one authored value, one meaning, and the same loss of every prefix operation.\n   */\n  private composeStorageKey(\n    fileId: string,\n    executionContext: ExecutionContext<any>,\n    options?: StorageUploadOptions,\n  ): string {\n    const leafPath = composeStorageLeafPath(fileId, options);\n    if (!leafPath) {\n      throw this.errorBuilder.buildError(\n        ErrorType.VALIDATION,\n        executionContext,\n        {\n          customMessageReference: ErrorCustomMessageReference.FILE_STORAGE_KEY_COMPOSITION_FAILED,\n        }\n      );\n    }\n\n    // Refused on the LEAF, textually, before any prefix is prepended — and this is load-bearing\n    // rather than belt-and-braces. `resolveSafePathFromRelative` below asks \"does the resolved path\n    // escape the base directory\", which was the whole guard while a key was one or two segments\n    // deep. Under the six-segment tenant prefix a `folderPath: '../../outside'` no longer escapes:\n    // it resolves to `applications/<app>/files/_unlinked/outside/…`, still inside the base, so the\n    // containment check ADMITS what it used to refuse. What the `..` now buys an attacker is not an\n    // escape from the store but an escape from the TENANT prefix — the exact property this key\n    // shape exists to provide.\n    //\n    // The managed provider refuses the same input for the mirror-image reason (its stored-ref prefix\n    // check is textual), so one authored value cannot mean two things depending on which provider a\n    // deployment binds. `assertNoTraversalSegments` there and this share `storageKeyHasTraversalSegment`.\n    if (storageKeyHasTraversalSegment(leafPath)) {\n      throw this.errorBuilder.buildError(\n        ErrorType.AUTHORIZATION,\n        undefined,\n        {\n          customMessageReference: ErrorCustomMessageReference.FILE_PATH_TRAVERSAL_DETECTED,\n          context: {\n            relativePath: leafPath, // diagnostic (log-only)\n          },\n        }\n      );\n    }\n\n    if (options?.includeApplicationId === false) {\n      return leafPath;\n    }\n\n    return composeApplicationStorageKey({\n      applicationId: this.getApplicationId(executionContext),\n      leafPath,\n      linkedResourceType: options?.linkedResourceType,\n      scope: options?.scope,\n    });\n  }\n\n  /**\n   * Resolve a safe absolute path from a relative storage ref.\n   * Throws if the resolved path escapes the base directory (path traversal guard).\n   */\n  private resolveSafePathFromRelative(relativePath: string): string {\n    const base = this.getBaseDir();\n    const filePath = path.resolve(base, relativePath);\n    if (!filePath.startsWith(base + path.sep) && filePath !== base) {\n      throw this.errorBuilder.buildError(\n        ErrorType.AUTHORIZATION,\n        undefined,\n        {\n          customMessageReference: ErrorCustomMessageReference.FILE_PATH_TRAVERSAL_DETECTED,\n          context: {\n            relativePath, // diagnostic (log-only)\n          },\n        }\n      );\n    }\n    return filePath;\n  }\n\n  private getApplicationId(executionContext: ExecutionContext<any>): string {\n    const applicationId = resolveStorageApplicationIdentity(this.appConfigService);\n    validateAppId(applicationId, this.errorBuilder, executionContext, 'applicationId');\n    return applicationId;\n  }\n\n  async upload(\n    fileStream: Readable,\n    fileId: string,\n    mimeType: string,\n    size: number,\n    executionContext: ExecutionContext<any>,\n    options?: StorageUploadOptions,\n  ): Promise<StorageUploadResult> {\n    validateFileId(fileId, this.errorBuilder, executionContext, 'fileId');\n    validateContentType(mimeType, this.errorBuilder, executionContext, 'mimeType');\n    validateSize(\n      size,\n      resolveConfiguredMaxFileSize(this.appConfigService.config.storage?.maxFileSize),\n      this.errorBuilder,\n      executionContext,\n      'size',\n    );\n    validateStream(fileStream, this.errorBuilder, executionContext, 'fileStream');\n\n    const relativePath = this.composeStorageKey(fileId, executionContext, options);\n    const filePath = this.resolveSafePathFromRelative(relativePath);\n\n    await fs.promises.mkdir(path.dirname(filePath), { recursive: true });\n\n    try {\n      const writeStream = fs.createWriteStream(filePath);\n      await pipeline(fileStream, writeStream);\n    } catch (error) {\n      this.convertStorageError(error, 'upload', executionContext, {\n        fileId,\n        provider: this.providerId,\n      });\n    }\n\n    const metadataRecord: LocalFileMetadataRecord = {\n      contentType: mimeType,\n      size,\n      createdAt: new Date().toISOString(),\n    };\n    await fs.promises.writeFile(filePath + METADATA_SUFFIX, JSON.stringify(metadataRecord), 'utf-8');\n\n    return { storageRef: relativePath, provider: this.providerId };\n  }\n\n  async download(\n    file: StoredFileStorageTarget,\n    executionContext: ExecutionContext<any>,\n  ): Promise<StorageDownloadResult> {\n    const filePath = this.resolvePathFromStorageRef(file, executionContext);\n\n    try {\n      await fs.promises.access(filePath, fs.constants.R_OK);\n    } catch {\n      throw this.errorBuilder.buildError(\n        ErrorType.NOT_FOUND,\n        executionContext,\n        {\n          customMessageReference: ErrorCustomMessageReference.FILE_NOT_FOUND_IN_STORAGE,\n          context: {\n            // diagnostic (log-only)\n            fileId: file.fileId,\n            provider: this.providerId,\n          },\n        }\n      );\n    }\n\n    const metadata = await this.readLocalMetadata(filePath, file.fileId, executionContext);\n    const stat = await fs.promises.stat(filePath);\n    const stream = fs.createReadStream(filePath);\n\n    return {\n      stream,\n      contentType: metadata.contentType,\n      size: stat.size,\n      lastModified: stat.mtime,\n    };\n  }\n\n  async delete(\n    file: StoredFileStorageTarget,\n    executionContext: ExecutionContext<any>,\n  ): Promise<void> {\n    const filePath = this.resolvePathFromStorageRef(file, executionContext);\n\n    try {\n      await fs.promises.unlink(filePath);\n    } catch (error: any) {\n      if (error.code === 'ENOENT') return;\n      this.convertStorageError(error, 'delete', executionContext, {\n        fileId: file.fileId,\n        provider: this.providerId,\n      });\n    }\n\n    try {\n      await fs.promises.unlink(filePath + METADATA_SUFFIX);\n    } catch {\n      // metadata file already gone — fine\n    }\n  }\n\n  async getMetadata(\n    file: StoredFileStorageTarget,\n    executionContext: ExecutionContext<any>,\n  ): Promise<StorageFileMetadata> {\n    const filePath = this.resolvePathFromStorageRef(file, executionContext);\n\n    try {\n      await fs.promises.access(filePath, fs.constants.R_OK);\n    } catch {\n      throw this.errorBuilder.buildError(\n        ErrorType.NOT_FOUND,\n        executionContext,\n        {\n          customMessageReference: ErrorCustomMessageReference.FILE_NOT_FOUND_IN_STORAGE,\n          context: {\n            // diagnostic (log-only)\n            fileId: file.fileId,\n            provider: this.providerId,\n          },\n        }\n      );\n    }\n\n    const metadata = await this.readLocalMetadata(filePath, file.fileId, executionContext);\n    const stat = await fs.promises.stat(filePath);\n\n    return {\n      contentType: metadata.contentType,\n      size: stat.size,\n      lastModified: stat.mtime,\n    };\n  }\n\n  /**\n   * Resolve the absolute filesystem path from a persisted storageRef.\n   * The ref IS the relative path from baseDir — just validate traversal.\n   *\n   * ## Already-stored files are NOT moved by the key-shape change, and nothing has to be migrated\n   *\n   * Every read verb (`download` / `delete` / `getMetadata`) reaches a blob through this method, and\n   * with a ref present it uses that ref VERBATIM. A blob written under the old\n   * `[applicationId]/[folderPath]/<leaf>` layout therefore stays addressable at exactly the path it\n   * was written to: the shape change governs where NEW uploads land, never how an existing row is\n   * resolved. No migration, and no compatibility branch, because there is nothing to be compatible\n   * with — the persisted ref is the address.\n   *\n   * ## The no-ref branch is LIVE, and it must track `upload` rather than freeze\n   *\n   * It looks like a legacy fallback for rows whose `storageRef` never committed. Its real caller is\n   * the audit-log archive batch: `archiveArtifactExists` probes `getMetadata` with\n   * `fileId: '<folderPath>/<fileName>'` and NO ref, deliberately, so that each provider re-derives\n   * the key its own `upload` produced and the batch never re-implements provider path logic. Pin\n   * the old composition here and that probe would address a blob the upload no longer writes, so\n   * `archiveArtifactExists` would answer `false` forever and every past day would be re-archived on\n   * every tick — a silent, unbounded regression with no failing test anywhere.\n   *\n   * So it composes through the SAME composer, with no resource type and no scope, mirroring the\n   * managed provider's `resolveApplicationObjectKey(file.fileId, ctx, undefined)` argument for\n   * argument. The parity is pinned in this provider's test suite (`upload` then `getMetadata` with\n   * no ref); the batch's own suite uses a fake provider and cannot see it.\n   *\n   * ## Residual, recorded rather than fixed: a `.`/`..` segment inside a PRESENT ref\n   *\n   * `composeStorageKey` refuses one on the composition path; this branch does not, and the managed\n   * provider's `assertNoTraversalSegments(normalizedStorageRef, …)` does. Two reasons it is left\n   * asymmetric, and neither is \"nobody thought about it\":\n   *\n   * - the containment check below is a real `path.resolve`, not managed's textual `startsWith`, so\n   *   the class of attack that motivated managed's stored-ref check (a ref that satisfies a textual\n   *   prefix while pointing elsewhere) is already caught here for anything leaving the base;\n   * - a `.` ref legitimately addresses the base directory and is pinned as NOT an authorization\n   *   refusal (`ADMITS the base directory itself`), which a whole-segment textual check would break.\n   *\n   * What survives is a ref whose text climbs out of one tenant prefix into another WITHIN the base.\n   * Reaching it needs write access to the `storageRef` column — the composition path can no longer\n   * produce one — so it is a smaller surface than the one closed above, not the same one. Closing it\n   * means deciding what `.` should mean first, which is a separate change.\n   */\n  private resolvePathFromStorageRef(\n    file: StoredFileStorageTarget,\n    executionContext: ExecutionContext<any>,\n  ): string {\n    const ref = file.storageRef;\n    if (!ref) {\n      return this.resolveSafePathFromRelative(this.composeStorageKey(file.fileId, executionContext));\n    }\n    return this.resolveSafePathFromRelative(ref);\n  }\n\n  private async readLocalMetadata(\n    filePath: string,\n    fileId: string,\n    executionContext: ExecutionContext<any>,\n  ): Promise<LocalFileMetadataRecord> {\n    const metaPath = filePath + METADATA_SUFFIX;\n    try {\n      const raw = await fs.promises.readFile(metaPath, 'utf-8');\n      return JSON.parse(raw) as LocalFileMetadataRecord;\n    } catch {\n      return {\n        contentType: 'application/octet-stream',\n        size: 0,\n        createdAt: new Date().toISOString(),\n      };\n    }\n  }\n\n  private convertStorageError(\n    error: unknown,\n    operation: 'upload' | 'download' | 'delete' | 'metadata',\n    executionContext: ExecutionContext<any> | undefined,\n    context: Record<string, unknown>,\n  ): never {\n    if (isWildoBackendError(error)) {\n      throw error;\n    }\n\n    const errorMessage = describeCaughtError(error);\n    const errorCode = (error as any)?.code;\n\n    if (errorCode === 'ENOENT') {\n      throw this.errorBuilder.buildError(\n        ErrorType.NOT_FOUND,\n        executionContext,\n        {\n          customMessageReference: ErrorCustomMessageReference.FILE_NOT_FOUND_IN_STORAGE,\n          context: { operation, ...context }, // diagnostic (log-only)\n        }\n      );\n    }\n\n    if (errorCode === 'EACCES' || errorCode === 'EPERM') {\n      throw this.errorBuilder.buildError(\n        ErrorType.AUTHORIZATION,\n        executionContext,\n        {\n          customMessageReference: ErrorCustomMessageReference.FILE_STORAGE_ACCESS_DENIED,\n          context: { operation, ...context, originalError: errorMessage }, // diagnostic (log-only)\n        }\n      );\n    }\n\n    if (errorCode === 'ENOSPC') {\n      throw this.errorBuilder.buildError(\n        ErrorType.EXTERNAL_SERVICE,\n        executionContext,\n        {\n          customMessageReference: ErrorCustomMessageReference.EXTERNAL_SERVICE,\n          context: { message: 'Local storage disk full', operation, ...context, originalError: errorMessage },\n        }\n      );\n    }\n\n    throw this.errorBuilder.buildError(\n      ErrorType.EXTERNAL_SERVICE,\n      executionContext,\n      {\n        customMessageReference: ErrorCustomMessageReference.EXTERNAL_SERVICE,\n        context: { message: `Local storage operation failed: ${operation}`, operation, ...context, originalError: errorMessage },\n      }\n    );\n  }\n}\n"]}

package/dist/esm/files/storage/wildo-managed-storage-provider.backend.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"wildo-managed-storage-provider.backend.service.d.ts","sourceRoot":"","sources":["../../../../../src/files/storage/wildo-managed-storage-provider.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAGH,OAAO,EAAE,QAAQ,EAAE,MAAM,QAAQ,CAAC;AAGlC,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAG/D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAClG,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAE9G,OAAO,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AAE/G,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qEAAqE,CAAC;AA6C5G,OAAO,KAAK,EAA8B,yBAAyB,EAAE,MAAM,4EAA4E,CAAC;AAGxJ,OAAO,KAAK,EACV,oBAAoB,EACpB,mBAAmB,EACnB,oBAAoB,EACpB,qBAAqB,EACrB,mBAAmB,EACnB,2BAA2B,EAC3B,uBAAuB,EACxB,MAAM,+BAA+B,CAAC;AAqEvC,qBACa,2BAA4B,YAAW,oBAAoB;IA4DpE,OAAO,CAAC,QAAQ,CAAC,MAAM;IAEvB,OAAO,CAAC,QAAQ,CAAC,YAAY;IAE7B,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IACjC;;;;;;;;;;;;;OAaG;IAEH,OAAO,CAAC,QAAQ,CAAC,0BAA0B,CAAC;IA/E9C,QAAQ,CAAC,UAAU,qCAAqC;IACxD,OAAO,CAAC,MAAM,CAAuB;IACrC;;;;;;OAMG;IACH,OAAO,CAAC,eAAe,CAAqB;IAC5C;;;;;;OAMG;IACH,OAAO,CAAC,kBAAkB,CAA0C;IACpE;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,OAAO,KAAK,iBAAiB,GAE5B;IAED;;;;;;OAMG;IACH,OAAO,KAAK,UAAU,GAErB;gBAIkB,MAAM,EAAE,aAAa,EAErB,YAAY,EAAE,0BAA0B,EAExC,gBAAgB,EAAE,uBAAuB;IAC1D;;;;;;;;;;;;;OAaG;IAEc,0BAA0B,CAAC,EAAE,yBAAyB;IAGzE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAoCG;IACH,YAAY,IAAI,OAAO;IAIvB;;;;;;;;OAQG;IACH,OAAO,CAAC,yBAAyB;IA2BjC;;;;;;;;;;OAUG;IACH,OAAO,CAAC,qBAAqB;IAY7B;;;;OAIG;IACG,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAIjC;;;;;;;;;;;;;;;;OAgBG;YACW,iBAAiB;IA+D/B;;;;;OAKG;YACW,SAAS;IA+DvB;;;;;;;;;;;;;;;;OAgBG;YACW,gBAAgB;IAyB9B;;;;;;;;;;;;;;;;;OAiBG;IACH,OAAO,CAAC,mBAAmB;IAO3B;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4BG;IACH,OAAO,CAAC,yBAAyB;YA4BnB,2BAA2B;IA+EzC,OAAO,CAAC,mBAAmB;IAqJrB,MAAM,CACV,UAAU,EAAE,QAAQ,EACpB,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,EACZ,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACvC,OAAO,CAAC,EAAE,oBAAoB,GAC7B,OAAO,CAAC,mBAAmB,CAAC;IAyFzB,QAAQ,CACZ,IAAI,EAAE,uBAAuB,EAC7B,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,GACtC,OAAO,CAAC,qBAAqB,CAAC;IAgD3B,MAAM,CACV,IAAI,EAAE,uBAAuB,EAC7B,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,GACtC,OAAO,CAAC,IAAI,CAAC;IA2BV,WAAW,CACf,IAAI,EAAE,uBAAuB,EAC7B,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,GACtC,OAAO,CAAC,mBAAmB,CAAC;IAyCzB,WAAW,IAAI,OAAO,CAAC,2BAA2B,CAAC;IA0IzD;;;;;;;OAOG;IACH,OAAO,CAAC,qBAAqB;CAgB9B"}
+{"version":3,"file":"wildo-managed-storage-provider.backend.service.d.ts","sourceRoot":"","sources":["../../../../../src/files/storage/wildo-managed-storage-provider.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAGH,OAAO,EAAE,QAAQ,EAAE,MAAM,QAAQ,CAAC;AAGlC,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAG/D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAClG,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAE9G,OAAO,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AAE/G,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qEAAqE,CAAC;AAO5G,OAAO,KAAK,EAA8B,yBAAyB,EAAE,MAAM,4EAA4E,CAAC;AASxJ,OAAO,KAAK,EACV,oBAAoB,EACpB,mBAAmB,EACnB,oBAAoB,EACpB,qBAAqB,EACrB,mBAAmB,EACnB,2BAA2B,EAC3B,uBAAuB,EACxB,MAAM,+BAA+B,CAAC;AAqEvC,qBACa,2BAA4B,YAAW,oBAAoB;IA4DpE,OAAO,CAAC,QAAQ,CAAC,MAAM;IAEvB,OAAO,CAAC,QAAQ,CAAC,YAAY;IAE7B,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IACjC;;;;;;;;;;;;;OAaG;IAEH,OAAO,CAAC,QAAQ,CAAC,0BAA0B,CAAC;IA/E9C,QAAQ,CAAC,UAAU,qCAAqC;IACxD,OAAO,CAAC,MAAM,CAAuB;IACrC;;;;;;OAMG;IACH,OAAO,CAAC,eAAe,CAAqB;IAC5C;;;;;;OAMG;IACH,OAAO,CAAC,kBAAkB,CAA0C;IACpE;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,OAAO,KAAK,iBAAiB,GAE5B;IAED;;;;;;OAMG;IACH,OAAO,KAAK,UAAU,GAErB;gBAIkB,MAAM,EAAE,aAAa,EAErB,YAAY,EAAE,0BAA0B,EAExC,gBAAgB,EAAE,uBAAuB;IAC1D;;;;;;;;;;;;;OAaG;IAEc,0BAA0B,CAAC,EAAE,yBAAyB;IAGzE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAoCG;IACH,YAAY,IAAI,OAAO;IAIvB;;;;;;;;OAQG;IACH,OAAO,CAAC,yBAAyB;IA2BjC;;;;;;;;;;OAUG;IACH,OAAO,CAAC,qBAAqB;IAY7B;;;;OAIG;IACG,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAIjC;;;;;;;;;;;;;;;;OAgBG;YACW,iBAAiB;IA+D/B;;;;;OAKG;YACW,SAAS;IA+DvB;;;;;;;;;;;;;;;;OAgBG;YACW,gBAAgB;IAyB9B;;;;;;;;;;;;;;;;;OAiBG;IACH,OAAO,CAAC,mBAAmB;IAO3B;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4BG;IACH,OAAO,CAAC,yBAAyB;YAwBnB,2BAA2B;IA2EzC,OAAO,CAAC,mBAAmB;IAqJrB,MAAM,CACV,UAAU,EAAE,QAAQ,EACpB,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,EACZ,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACvC,OAAO,CAAC,EAAE,oBAAoB,GAC7B,OAAO,CAAC,mBAAmB,CAAC;IAqFzB,QAAQ,CACZ,IAAI,EAAE,uBAAuB,EAC7B,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,GACtC,OAAO,CAAC,qBAAqB,CAAC;IAgD3B,MAAM,CACV,IAAI,EAAE,uBAAuB,EAC7B,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,GACtC,OAAO,CAAC,IAAI,CAAC;IA2BV,WAAW,CACf,IAAI,EAAE,uBAAuB,EAC7B,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,GACtC,OAAO,CAAC,mBAAmB,CAAC;IAyCzB,WAAW,IAAI,OAAO,CAAC,2BAA2B,CAAC;IA0IzD;;;;;;;OAOG;IACH,OAAO,CAAC,qBAAqB;CAgB9B"}

package/dist/esm/files/storage/wildo-managed-storage-provider.backend.service.js

@@ -36,47 +36,11 @@ import { describeCaughtError } from '../../errors/utils/error-log-level-classifi
 import { AppConfigurationService } from '../../config/services/app-configuration.backend.service.js';
 import { validateAppId, validateContentType, validateFileId, validateSize, validateStream, resolveConfiguredMaxFileSize } from '../../files/utils/file-validation.utils.js';
 import { API_ROUTES_BACKEND_DEFINITIONS } from '../../requests/models/api-routes.backend.defintions.js';
-import { resolveSharedPersistenceCollectionName } from '@wildo-ai/saas-models';
 import { ResourcePrimaryScope } from '@wildo-ai/saas-models';
-/**
- * The key segment for a blob with no resource type.
- *
- * A literal rather than a resource name, and prefixed with `_` so it can never collide with a
- * value `resolveSharedPersistenceCollectionName` produces — that function returns collection
- * names, which never start with an underscore.
- */
-const UNLINKED_STORAGE_SEGMENT = '_unlinked';
-/**
- * The `<scope>/<scopeId>` segments of an object key.
- *
- * This is what makes ONE TENANT's blobs a prefix. Without it every organization's files of a given
- * resource share a single prefix, so erasure, orphan sweeps and "who owns this object" all become
- * per-row database work instead of prefix operations — and no per-tenant confinement is expressible
- * at all. (That was the state until 2026-08-14: the approved shape carried these segments and the
- * first implementation dropped them.)
- *
- * Always emits BOTH segments, including for APPLICATION scope where the id repeats the one already
- * in the prefix. The redundancy is deliberate: one key shape, no branch, nothing that can produce a
- * second layout. A parser can always take the last three segments as scope/scopeId/fileId.
- */
-function resolveScopeSegments(scope, applicationId) {
-    // The SEGMENT IS the enum value — `ResourcePrimaryScope.ORGANIZATIONS === 'organizations'`. Using
-    // the enum directly keeps one vocabulary: a parallel string table here would be a second source
-    // that silently drifts the day a scope is added or renamed.
-    if (scope?.primaryScope === ResourcePrimaryScope.ORGANIZATIONS && scope.organizationId) {
-        return { scope: ResourcePrimaryScope.ORGANIZATIONS, scopeId: scope.organizationId };
-    }
-    if (scope?.primaryScope === ResourcePrimaryScope.USER_SELF && scope.userId) {
-        return { scope: ResourcePrimaryScope.USER_SELF, scopeId: scope.userId };
-    }
-    // APPLICATION scope, or a scope whose id is missing — fall back to the application. Never throw:
-    // a key must always be derivable, and an application-scoped key is the correct conservative answer
-    // (it is the narrowest scope every file provably has).
-    return { scope: ResourcePrimaryScope.APPLICATION, scopeId: applicationId };
-}
 import { StorageCredentialProvider } from '../../files/storage/storage-credential-provider.backend.utils.js';
 import { createStsStorageCredentialResolver } from '../../files/storage/storage-sts-credential-resolver.backend.utils.js';
 import { resolveStorageApplicationIdentity } from '../../files/utils/storage-application-identity.backend.utils.js';
+import { UNLINKED_STORAGE_SEGMENT, composeApplicationStorageKey, composeStorageLeafPath, storageKeyHasTraversalSegment, } from './application-storage-key.backend.utils.js';
 const DEFAULT_STORAGE_REGION = 'us-east-1';
 /**
  * S3's maximum object size for a SINGLE `PutObject` request, and therefore the
@@ -528,10 +492,7 @@ let WildoManagedStorageProvider = class WildoManagedStorageProvider {
      * one authored value cannot mean two different things depending on which provider is bound.
      */
     assertNoTraversalSegments(candidate, executionContext, diagnostics) {
-        const hasTraversalSegment = candidate
-            .split('/')
-            .some((segment) => segment === '.' || segment === '..');
-        if (!hasTraversalSegment) {
+        if (!storageKeyHasTraversalSegment(candidate)) {
             return;
         }
         throw this.errorBuilder.buildError(ErrorType.AUTHORIZATION, executionContext, {
@@ -551,16 +512,12 @@ let WildoManagedStorageProvider = class WildoManagedStorageProvider {
         this.assertNoTraversalSegments(fileId, executionContext, { fileId, source: 'composed_key' });
         const applicationId = await this.getApplicationId(executionContext);
         const bucketPrefix = this.resolveBucketPrefix();
-        // Explicit staging segment, never a fallthrough. A blob with no resource type is NOT placed
-        // under some default resource — it lands in `_unlinked/`, and stays there: late LINKING is
-        // allowed (the row's `linkedResourceId` fills in later), late TYPE declaration is not, because
-        // the key is derived once at create and the blob never moves.
-        const storageName = linkedResourceType
-            ? resolveSharedPersistenceCollectionName(linkedResourceType)
-            : UNLINKED_STORAGE_SEGMENT;
-        const { scope, scopeId } = resolveScopeSegments(fileScope, applicationId);
+        // The relative key comes from the SHARED composer, so the local-directory provider addresses the
+        // same blob at the same place. `bucketPrefix` is the one part that stays here: it is an
+        // object-store namespacing knob (N applications sharing one bucket) with no meaning on a
+        // filesystem, so it frames the shared key rather than living inside it.
         const defaultKey = bucketPrefix
-            + API_ROUTES_BACKEND_DEFINITIONS.FILE_STORAGE.STORAGE_KEY_APPLICATION_FILE(applicationId, fileId, storageName, scope, scopeId);
+            + composeApplicationStorageKey({ applicationId, leafPath: fileId, linkedResourceType, scope: fileScope });
         if (!storageRef) {
             return defaultKey;
         }
@@ -730,11 +687,7 @@ let WildoManagedStorageProvider = class WildoManagedStorageProvider {
                 },
             });
         }
-        const leafName = (options?.fileName?.trim()) || fileId;
-        const folderPath = options?.folderPath?.trim();
-        const effectiveFileId = folderPath
-            ? `${folderPath}/${leafName}`
-            : leafName;
+        const effectiveFileId = composeStorageLeafPath(fileId, options);
         if (!effectiveFileId) {
             throw this.errorBuilder.buildError(ErrorType.VALIDATION, executionContext, {
                 customMessageReference: ErrorCustomMessageReference.FILE_STORAGE_KEY_COMPOSITION_FAILED,