@wildo-ai/saas-backend-lib 1.1.2 → 1.1.4

package/dist/esm/files/handlers/resource-file-upload-handler.backend.service.js.map

@@ -1 +1 @@
-{"version":3,"file":"resource-file-upload-handler.backend.service.js","sourceRoot":"","sources":["../../../../../src/files/handlers/resource-file-upload-handler.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;;;;;;;;;;;;;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAG/C,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,EAAuC,SAAS,EAAE,2BAA2B,EAAQ,UAAU,EAAE,0BAA0B,EAAE,+BAA+B,EAAE,oBAAoB,EAAwB,mBAAmB,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAC3R,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAChE,OAAO,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AAEpF,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAC9G,OAAO,EAAE,+BAA+B,EAAE,MAAM,0EAA0E,CAAC;AAE3H,OAAO,EAAE,2BAA2B,EAAE,MAAM,qFAAqF,CAAC;AAClI,OAAO,EAAE,qBAAqB,EAAE,MAAM,sEAAsE,CAAC;AAC7G,OAAO,EAAE,mBAAmB,EAAE,MAAM,yDAAyD,CAAC;AAC9F,OAAO,EAAE,qCAAqC,EAAE,MAAM,qFAAqF,CAAC;AAC5I,OAAO,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,cAAc,EAAE,mBAAmB,EAAE,YAAY,EAAE,kBAAkB,EAAE,4BAA4B,EAAE,4BAA4B,EAAE,MAAM,sDAAsD,CAAC;AACtQ,OAAO,EAAE,4BAA4B,EAAE,MAAM,oDAAoD,CAAC;AAClG,OAAO,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AAC/G,OAAO,EAAE,+BAA+B,EAAE,MAAM,sEAAsE,CAAC;AACvH,OAAO,EAAE,gCAAgC,EAAE,MAAM,wEAAwE,CAAC;AAC1H,OAAO,EAAE,qCAAqC,EAAE,MAAM,6EAA6E,CAAC;AAEpI,OAAO,EAAE,0BAA0B,EAAE,MAAM,iEAAiE,CAAC;AAC7G,OAAO,EAAE,mBAAmB,EAAE,2BAA2B,EAAE,MAAM,8EAA8E,CAAC;AAChJ,OAAO,EAAE,iCAAiC,EAAE,MAAM,2EAA2E,CAAC;AAC9H,OAAO,EAAE,6BAA6B,EAAE,MAAM,yFAAyF,CAAC;AACxI,OAAO,EAAE,6BAA6B,EAAE,MAAM,qEAAqE,CAAC;AAI7G,IAAM,uCAAuC,GAA7C,MAAM,uCAAuC;IAK/B;IAEA;IAEA;IAEA;IAEA;IAEA;IAEA;IAEA;IAEA;IAEA;IAEA;IAEA;IAEA;IAEA;IA9BT,QAAQ,CAA+D;IAEjF,YAEmB,MAAqB,EAErB,YAAwC,EAExC,iBAAkD,EAElD,kBAA+C,EAE/C,aAAoC,EAEpC,YAAiC,EAEjC,iBAAkD,EAElD,kBAAoD,EAEpD,uBAA8D,EAE9D,gBAAyC,EAEzC,YAAmD,EAEnD,mBAA+C,EAE/C,sBAAqD,EAErD,sBAAqD;QA1BrD,WAAM,GAAN,MAAM,CAAe;QAErB,iBAAY,GAAZ,YAAY,CAA4B;QAExC,sBAAiB,GAAjB,iBAAiB,CAAiC;QAElD,uBAAkB,GAAlB,kBAAkB,CAA6B;QAE/C,kBAAa,GAAb,aAAa,CAAuB;QAEpC,iBAAY,GAAZ,YAAY,CAAqB;QAEjC,sBAAiB,GAAjB,iBAAiB,CAAiC;QAElD,uBAAkB,GAAlB,kBAAkB,CAAkC;QAEpD,4BAAuB,GAAvB,uBAAuB,CAAuC;QAE9D,qBAAgB,GAAhB,gBAAgB,CAAyB;QAEzC,iBAAY,GAAZ,YAAY,CAAuC;QAEnD,wBAAmB,GAAnB,mBAAmB,CAA4B;QAE/C,2BAAsB,GAAtB,sBAAsB,CAA+B;QAErD,2BAAsB,GAAtB,sBAAsB,CAA+B;QAEtE,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,yCAAyC,CAAC,CAAC;QACnF,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,yCAAyC,EAAE,KAAK,CAAC,CAAC;IACpF,CAAC;IAED;;;;OAIG;IACK,uBAAuB,CAAC,GAAY;QAC1C,IAAI,GAAG,CAAC,IAAI,IAAI,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACjF,OAAO,GAAG,CAAC,IAA+B,CAAC;QAC7C,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAED;;;;;;;;;;OAUG;IACH,KAAK,CAAC,gBAAgB,CACpB,OAAgB,EAChB,QAAkB,EAClB,YAA0B,EAC1B,SAAiB,EACjB,UAA8B,EAC9B,SAAsE,EACtE,gBAAuC;QAEvC,6FAA6F;QAC7F,oBAAoB,CAAC,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,gBAAgB,EAAE,cAAc,CAAC,CAAC;QACxF,iBAAiB,CAAC,SAAS,EAAE,IAAI,CAAC,YAAY,EAAE,gBAAgB,EAAE,WAAW,CAAC,CAAC;QAC/E,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YAC7B,kBAAkB,CAAC,UAAU,EAAE,IAAI,CAAC,YAAY,EAAE,gBAAgB,EAAE,YAAY,CAAC,CAAC;QACpF,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,sBAAsB,EAAE;YACpC,YAAY;YACZ,SAAS;YACT,UAAU;YACV,SAAS;YACT,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI;SACxB,CAAC,CAAC;QAEH,IAAI,UAA0C,CAAC;QAC/C,IAAI,yBAAyB,GAAG,KAAK,CAAC;QACtC,IAAI,mBAAmB,GAAG,KAAK,CAAC;QAEhC,IAAI,CAAC;YACH,0CAA0C;YAC1C,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;gBAClB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,UAAU,EACpB,gBAAgB,EAChB;oBACE,sBAAsB,EAAE,2BAA2B,CAAC,mBAAmB;oBACvE,OAAO,EAAE;wBACP,wBAAwB;wBACxB,YAAY;wBACZ,SAAS;qBACV;iBACF,CACF,CAAC;YACJ,CAAC;YAED,MAAM,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;YAChC,MAAM,WAAW,GAAG,4BAA4B,CAAC,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;YAEpG,gEAAgE;YAChE,mBAAmB,CAAC,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,YAAY,EAAE,gBAAgB,EAAE,aAAa,CAAC,CAAC;YAC7F,YAAY,CAAC,UAAU,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,YAAY,EAAE,gBAAgB,EAAE,MAAM,CAAC,CAAC;YAExF,8DAA8D;YAC9D,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC;gBACvD,YAAY;gBACZ,SAAS;aACV,CAAC,CAAC;YAEH,4CAA4C;YAC5C,MAAM,gBAAgB,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,YAAY,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;YAEvF,IAAI,CAAC,gBAAgB,CAAC,OAAO,EAAE,CAAC;gBAC9B,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,UAAU,EACpB,gBAAgB,EAChB;oBACE,sBAAsB,EAAE,2BAA2B,CAAC,UAAU;oBAC9D,OAAO,EAAE;wBACP,OAAO,EAAE,wBAAwB;wBACjC,MAAM,EAAE,gBAAgB,CAAC,MAAM;wBAC/B,QAAQ,EAAE,UAAU,CAAC,YAAY;wBACjC,QAAQ,EAAE,UAAU,CAAC,QAAQ;wBAC7B,IAAI,EAAE,UAAU,CAAC,IAAI;qBACtB;iBACF,CACF,CAAC;YACJ,CAAC;YAED,iEAAiE;YACjE,sEAAsE;YACtE,sEAAsE;YACtE,iEAAiE;YACjE,uEAAuE;YACvE,MAAM,SAAS,GAAG,IAAI,CAAC,kBAAkB,CAAC,oBAAoB,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;YACxF,IAAI,SAAS,EAAE,YAAY,CAAC,UAAU,EAAE,MAAM,KAAK,oBAAoB,CAAC,YAAY,EAAE,CAAC;gBACrF,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,aAAa,EACvB,gBAAgB,EAChB;oBACE,sBAAsB,EAAE,2BAA2B,CAAC,iCAAiC;oBACrF,OAAO,EAAE;wBACP,wBAAwB;wBACxB,YAAY;wBACZ,SAAS;qBACV;iBACF,CACF,CAAC;YACJ,CAAC;YAED,qEAAqE;YACrE,MAAM,KAAK,GAAG,IAAI,CAAC,6BAA6B,CAAC,YAAY,EAAE,gBAAgB,CAAC,CAAC;YAEjF,4DAA4D;YAC5D,MAAM,eAAe,GAAG,SAAS,EAAE,YAAY,CAAC,eAAe,CAAC;YAChE,MAAM,eAAe,GAAG,IAAI,CAAC,iBAAiB,CAAC,eAAe,CAAC,eAAe,CAAC,CAAC;YAEhF,oGAAoG;YACpG,gGAAgG;YAChG,+FAA+F;YAC/F,mGAAmG;YACnG,yFAAyF;YACzF,MAAM,KAAK,GAAI,QAAQ,CAAC,MAAiD,EAAE,eAAe,CAAC;YAC3F,IAAI,KAAK,EAAE,CAAC;gBACV,MAAM,IAAI,CAAC,sBAAsB,CAAC,YAAY,CAAC,gBAAgB,CAAC,oBAAqB,CAAC,CAAC;gBACvF,gBAAgB,CAAC,2BAA2B,EAAE,CAAC;YACjD,CAAC;YAED,0DAA0D;YAC1D,gGAAgG;YAChG,iGAAiG;YACjG,+FAA+F;YAC/F,kGAAkG;YAClG,MAAM,iBAAiB,GAAG,KAAK;gBAC7B,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC,wBAAwB,CAAC,KAAK,CAAC,QAAQ,CAAC;gBACtE,CAAC,CAAC,4BAA4B,CAAC,gBAAgB,CAAC,CAAC;YACnD,IAAI,iBAAiB,EAAE,CAAC;gBACtB,kBAAkB,CAAC,iBAAiB,CAAC,UAAU,EAAE,IAAI,CAAC,YAAY,EAAE,gBAAgB,EAAE,YAAY,CAAC,CAAC;gBACpG,4BAA4B,CAC1B,iBAAiB,CAAC,oBAAoB,EACtC,IAAI,CAAC,YAAY,EACjB,gBAAgB,EAChB,sBAAsB,CACvB,CAAC;YACJ,CAAC;YAED,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CACpD;gBACE,QAAQ,EAAE,UAAU,CAAC,YAAY,IAAI,UAAU,CAAC,QAAQ;gBACxD,gBAAgB,EAAE,UAAU,CAAC,YAAY;gBACzC,QAAQ,EAAE,UAAU,CAAC,QAAQ;gBAC7B,IAAI,EAAE,UAAU,CAAC,IAAI;gBACrB,eAAe,EAAE,eAAe,CAAC,UAAU;gBAC3C,KAAK;gBACL,UAAU,EAAE,iBAAiB,EAAE,UAAU;gBACzC,oBAAoB,EAAE,iBAAiB,EAAE,oBAAoB;aAC9D,EACD,gBAAgB,CACjB,CAAC;YAEF,UAAU,GAAG,EAAE,MAAM,EAAE,WAAW,CAAC,MAAM,EAAE,CAAC;YAE5C,oEAAoE;YACpE,MAAM,gBAAgB,GAAG,IAAI,CAAC,uBAAuB,CAAC,OAAO,CAAC,CAAC;YAC/D,IAAI,aAA+C,CAAC;YACpD,IAAI,SAAS,EAAE,CAAC;gBACd,aAAa,GAAG,IAAI,CAAC,YAAY,CAAC,OAAO,CACvC,WAAW,CAAC,MAAM,EAClB,SAAS,EACT,SAAS,CAAC,YAAY,EACtB,iCAAiC,CAAC,IAAI,CAAC,gBAAgB,CAAC,EACxD,UAAU,CAAC,YAAY,EACvB,gBAAgB,CACjB,CAAC;YACJ,CAAC;YAED,0FAA0F;YAC1F,yFAAyF;YACzF,yFAAyF;YACzF,qEAAqE;YACrE,EAAE;YACF,sFAAsF;YACtF,qCAAqC;YACrC,wFAAwF;YACxF,EAAE;YACF,+FAA+F;YAC/F,4FAA4F;YAC5F,8FAA8F;YAC9F,0FAA0F;YAC1F,qFAAqF;YACrF,EAAE;YACF,uFAAuF;YACvF,2FAA2F;YAC3F,sBAAsB;YACtB,+FAA+F;YAC/F,4FAA4F;YAC5F,8CAA8C;YAC9C,aAAa,GAAG,EAAE,GAAG,aAAa,EAAE,kBAAkB,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC;YAE9E,6EAA6E;YAC7E,iEAAiE;YACjE,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;gBACrB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,QAAQ,EAClB,gBAAgB,EAChB;oBACE,sBAAsB,EAAE,2BAA2B,CAAC,QAAQ;oBAC5D,OAAO,EAAE;wBACP,OAAO,EAAE,kDAAkD;wBAC3D,QAAQ,EAAE,UAAU,CAAC,YAAY;qBAClC;iBACF,CACF,CAAC;YACJ,CAAC;YAED,4CAA4C;YAC5C,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;gBACpC,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,QAAQ,EAClB,gBAAgB,EAChB;oBACE,sBAAsB,EAAE,2BAA2B,CAAC,QAAQ;oBAC5D,OAAO,EAAE;wBACP,OAAO,EAAE,6BAA6B;wBACtC,IAAI,EAAE,UAAU,CAAC,IAAI;wBACrB,QAAQ,EAAE,UAAU,CAAC,YAAY;qBAClC;iBACF,CACF,CAAC;YACJ,CAAC;YAED,IAAI,UAAU,GAAoB,IAAI,CAAC;YACvC,IAAI,YAAY,GAA+B,IAAI,CAAC;YAEpD,iEAAiE;YACjE,IAAI,CAAC;gBACH,qEAAqE;gBACrE,UAAU,GAAG,EAAE,CAAC,gBAAgB,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;gBAElD,YAAY,GAAG,MAAM,eAAe,CAAC,MAAM,CACzC,UAAU,EACV,WAAW,CAAC,MAAM,EAClB,UAAU,CAAC,QAAQ,EACnB,UAAU,CAAC,IAAI,EACf,gBAAgB,EAChB,aAAa,CACd,CAAC;gBACF,mBAAmB,GAAG,IAAI,CAAC;gBAE3B,IAAI,CAAC,QAAQ,CAAC,uCAAuC,EAAE;oBACrD,MAAM,EAAE,WAAW,CAAC,MAAM;iBAC3B,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,WAAW,EAAE,CAAC;gBACrB,uCAAuC;gBACvC,MAAM,IAAI,CAAC,YAAY,CAAC,gBAAgB,CACtC,WAAW,CAAC,MAAM,EAClB,UAAU,CAAC,MAAM,EACjB,gBAAgB,CACjB,CAAC;gBAEF,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,gBAAgB,EAC1B,gBAAgB,EAChB;oBACE,sBAAsB,EAAE,2BAA2B,CAAC,gBAAgB;oBACpE,OAAO,EAAE;wBACP,OAAO,EAAE,kCAAkC;wBAC3C,MAAM,EAAE,WAAW,CAAC,MAAM;wBAC1B,KAAK,EAAE,mBAAmB,CAAC,WAAW,CAAC;qBACxC;iBACF,CACF,CAAC;YACJ,CAAC;oBAAS,CAAC;gBACT,6CAA6C;gBAC7C,iFAAiF;gBACjF,IAAI,UAAU,CAAC,IAAI,IAAI,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;oBACtD,IAAI,CAAC;wBACH,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;wBAC/B,IAAI,CAAC,QAAQ,CAAC,sBAAsB,EAAE,EAAE,IAAI,EAAE,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC;oBACnE,CAAC;oBAAC,OAAO,YAAY,EAAE,CAAC;wBACtB,6CAA6C;wBAC7C,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,8BAA8B,EAAE;4BAC/C,IAAI,EAAE,UAAU,CAAC,IAAI;4BACrB,GAAG,2BAA2B,CAAC,YAAY,CAAC;yBAC7C,CAAC,CAAC;oBACL,CAAC;gBACH,CAAC;gBAED,wCAAwC;gBACxC,IAAI,UAAU,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,CAAC;oBACxC,UAAU,CAAC,OAAO,EAAE,CAAC;gBACvB,CAAC;YACH,CAAC;YAED,4DAA4D;YAC5D,yEAAyE;YACzE,iEAAiE;YACjE,8EAA8E;YAC9E,4DAA4D;YAC5D,MAAM,UAAU,GAAG,CAAC,CAAC;YACrB,MAAM,YAAY,GAAG,IAAI,CAAC,CAAC,WAAW;YAEtC,IAAI,SAAS,GAAiB,IAAI,CAAC;YACnC,IAAI,YAAY,GAAgB,IAAI,CAAC;YAErC,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,IAAI,UAAU,EAAE,OAAO,EAAE,EAAE,CAAC;gBACvD,IAAI,CAAC;oBACH,YAAY,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,gBAAgB,CACrD,WAAW,CAAC,MAAM,EAClB,UAAU,CAAC,QAAQ,EACnB,gBAAgB,EAChB,SAAS,EACT,YAAY,IAAI,SAAS,CAC1B,CAAC;oBACF,MAAM,CAAC,UAAU;gBACnB,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,SAAS,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC,CAAC;oBAEnF,IAAI,OAAO,GAAG,UAAU,EAAE,CAAC;wBACzB,MAAM,KAAK,GAAG,YAAY,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;wBAClD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,qCAAqC,EAAE;4BACtD,MAAM,EAAE,WAAW,CAAC,MAAM;4BAC1B,OAAO,EAAE,OAAO,GAAG,CAAC;4BACpB,UAAU;4BACV,KAAK;4BACL,KAAK,EAAE,SAAS,CAAC,OAAO;yBACzB,CAAC,CAAC;wBACH,MAAM,IAAI,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;oBAC3D,CAAC;yBAAM,CAAC;wBACN,gDAAgD;wBAChD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,6CAA6C,EAAE;4BAC/D,MAAM,EAAE,WAAW,CAAC,MAAM;4BAC1B,QAAQ,EAAE,UAAU,GAAG,CAAC;4BACxB,KAAK,EAAE,SAAS,CAAC,OAAO;4BACxB,gEAAgE;4BAChE,8DAA8D;yBAC/D,CAAC,CAAC;wBAEH,uEAAuE;wBACvE,sEAAsE;wBACtE,qEAAqE;wBACrE,IAAI,mBAAmB,IAAI,YAAY,EAAE,CAAC;4BACxC,IAAI,CAAC;gCACH,MAAM,eAAe,CAAC,MAAM,CAC1B;oCACE,MAAM,EAAE,WAAW,CAAC,MAAM;oCAC1B,eAAe,EAAE,YAAY,CAAC,QAAQ;oCACtC,UAAU,EAAE,YAAY,CAAC,UAAU;iCACpC,EACD,gBAAgB,CACjB,CAAC;gCACF,mBAAmB,GAAG,KAAK,CAAC;gCAC5B,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,4DAA4D,EAAE;oCAC7E,MAAM,EAAE,WAAW,CAAC,MAAM;iCAC3B,CAAC,CAAC;4BACL,CAAC;4BAAC,OAAO,aAAa,EAAE,CAAC;gCACvB,IAAI,CAAC,mBAAmB,CAAC,aAAa,CAAC,IAAI,aAAa,CAAC,IAAI,KAAK,SAAS,CAAC,SAAS,EAAE,CAAC;oCACtF,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,oEAAoE,EAAE;wCACtF,MAAM,EAAE,WAAW,CAAC,MAAM;wCAC1B,GAAG,2BAA2B,CAAC,aAAa,CAAC;wCAC7C,aAAa,EAAE,SAAS,CAAC,OAAO;qCACjC,CAAC,CAAC;gCACL,CAAC;qCAAM,CAAC;oCACN,mBAAmB,GAAG,KAAK,CAAC;gCAC9B,CAAC;4BACH,CAAC;wBACH,CAAC;wBAED,iCAAiC;wBACjC,MAAM,SAAS,CAAC;oBAClB,CAAC;gBACH,CAAC;YACH,CAAC;YAED,uDAAuD;YACvD,IAAI,CAAC,YAAY,EAAE,CAAC;gBAClB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,QAAQ,EAClB,gBAAgB,EAChB;oBACE,sBAAsB,EAAE,2BAA2B,CAAC,QAAQ;oBAC5D,OAAO,EAAE;wBACP,OAAO,EAAE,gEAAgE;wBACzE,MAAM,EAAE,WAAW,CAAC,MAAM;qBAC3B;iBACF,CACF,CAAC;YACJ,CAAC;YAED,qDAAqD;YACrD,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,CAAC,kBAAkB,CAAC,YAAY,CAAC,CAAC;YACxE,yBAAyB,GAAG,YAAY,CAAC,MAAM,KAAK,UAAU,CAAC,QAAQ,CAAC;YAExE,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACxB,OAAO,EAAE,IAAI;gBACb,IAAI,EAAE,YAAY;aACnB,CAAC,CAAC;YAEH,IAAI,CAAC,QAAQ,CAAC,oCAAoC,EAAE;gBAClD,MAAM,EAAE,YAAY,CAAC,MAAM;gBAC3B,YAAY;gBACZ,SAAS;aACV,CAAC,CAAC;YAEH,+FAA+F;YAC/F,6FAA6F;YAC7F,IAAI,KAAK,EAAE,CAAC;gBACV,IAAI,CAAC,sBAAsB;qBACxB,gBAAgB,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,YAAY,CAAC,MAAM,EAAE,QAAQ,EAAE,YAAY,CAAC,QAAQ,EAAE,IAAI,EAAE,YAAY,CAAC,IAAI,EAAE,EAAE,gBAAgB,CAAC;qBACpI,KAAK,CAAC,CAAC,eAAe,EAAE,EAAE;oBACzB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,6CAA6C,EAAE;wBAC/D,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,GAAG;wBACxB,MAAM,EAAE,YAAa,CAAC,MAAM;wBAC5B,GAAG,2BAA2B,CAAC,eAAe,CAAC;qBAChD,CAAC,CAAC;gBACL,CAAC,CAAC,CAAC;YACP,CAAC;YAED,+EAA+E;YAC/E,MAAM,UAAU,GAAG,IAAI,CAAC,mBAAmB,CAAC,UAAU,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;YAEhF,IAAI,UAAU,EAAE,CAAC;gBACf,IAAI,CAAC,mBAAmB,CAAC,YAAY,CAAC,YAAY,CAAC,MAAM,EAAE,gBAAgB,CAAC;qBACzE,KAAK,CAAC,CAAC,SAAS,EAAE,EAAE;oBACnB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,kCAAkC,EAAE;wBACpD,MAAM,EAAE,YAAa,CAAC,MAAM;wBAC5B,GAAG,2BAA2B,CAAC,SAAS,CAAC;qBAC1C,CAAC,CAAC;gBACL,CAAC,CAAC,CAAC;YACP,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,yEAAyE;YACzE,0EAA0E;YAC1E,0EAA0E;YAC1E,2EAA2E;YAC3E,2EAA2E;YAC3E,MAAM,kBAAkB,GAAG,CAAC,CAAC,UAAU,EAAE,MAAM,IAAI,CAAC,yBAAyB,IAAI,CAAC,mBAAmB,CAAC;YACtG,IAAI,kBAAkB,EAAE,CAAC;gBACvB,IAAI,CAAC;oBACH,MAAM,IAAI,CAAC,YAAY,CAAC,gBAAgB,CACtC,UAAU,CAAC,MAAM,EACjB,UAAU,CAAC,MAAM,EACjB,gBAAgB,CACjB,CAAC;oBACF,IAAI,CAAC,QAAQ,CAAC,2CAA2C,EAAE;wBACzD,MAAM,EAAE,UAAU,CAAC,MAAM;qBAC1B,CAAC,CAAC;gBACL,CAAC;gBAAC,OAAO,WAAW,EAAE,CAAC;oBACrB,wDAAwD;oBACxD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,+BAA+B,EAAE;wBACjD,MAAM,EAAE,UAAU,CAAC,MAAM;wBACzB,GAAG,2BAA2B,CAAC,WAAW,CAAC;qBAC5C,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YAED,wDAAwD;YACxD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4BG;IACH,KAAK,CAAC,eAAe,CACnB,OAAgB,EAChB,QAAkB,EAClB,IAAkB,EAClB,YAA0B,EAC1B,SAAiB,EACjB,UAAkB,EAClB,MAAc,EACd,gBAAuC;QAEvC,oBAAoB,CAAC,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,gBAAgB,EAAE,cAAc,CAAC,CAAC;QACxF,iBAAiB,CAAC,SAAS,EAAE,IAAI,CAAC,YAAY,EAAE,gBAAgB,EAAE,WAAW,CAAC,CAAC;QAC/E,kBAAkB,CAAC,UAAU,EAAE,IAAI,CAAC,YAAY,EAAE,gBAAgB,EAAE,YAAY,CAAC,CAAC;QAClF,cAAc,CAAC,MAAM,EAAE,IAAI,CAAC,YAAY,EAAE,gBAAgB,EAAE,QAAQ,CAAC,CAAC;QAEtE,IAAI,CAAC,QAAQ,CAAC,qBAAqB,EAAE,EAAE,YAAY,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,CAAC;QAEtF,kFAAkF;QAClF,qEAAqE;QACrE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;QAEvE,8EAA8E;QAC9E,MAAM,sBAAsB,GAC1B,CAAC,CAAC,IAAI;YACN,IAAI,CAAC,kBAAkB,KAAK,YAAY;YACxC,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,KAAK,MAAM,CAAC,UAAU,CAAC;YACpD,IAAI,CAAC,eAAe,KAAK,SAAS,CAAC;QAErC,IAAI,CAAC,sBAAsB,EAAE,CAAC;YAC5B,IAAI,CAAC,QAAQ,CAAC,4DAA4D,EAAE;gBAC1E,MAAM;gBACN,YAAY;gBACZ,UAAU;gBACV,SAAS;gBACT,kBAAkB,EAAE,IAAI,EAAE,kBAAkB;gBAC5C,gBAAgB,EAAE,IAAI,EAAE,gBAAgB;gBACxC,eAAe,EAAE,IAAI,EAAE,eAAe;aACvC,CAAC,CAAC;YACH,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,SAAS,EACnB,gBAAgB,EAChB;gBACE,sBAAsB,EAAE,2BAA2B,CAAC,cAAc;gBAClE,OAAO,EAAE,EAAE,MAAM,EAAE,EAAE,wBAAwB;aAC9C,CACF,CAAC;QACJ,CAAC;QAED,8FAA8F;QAC9F,iCAAiC;QACjC,EAAE;QACF,8FAA8F;QAC9F,+FAA+F;QAC/F,iGAAiG;QACjG,iGAAiG;QACjG,kGAAkG;QAClG,wEAAwE;QACxE,EAAE;QACF,iFAAiF;QACjF,kGAAkG;QAClG,2FAA2F;QAC3F,mEAAmE;QACnE,+FAA+F;QAC/F,gGAAgG;QAChG,yEAAyE;QACzE,IAAI,+BAA+B,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YACrD,IAAI,CAAC,QAAQ,CAAC,oCAAoC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;YACrF,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,SAAS,EACnB,gBAAgB,EAChB;gBACE,sBAAsB,EAAE,2BAA2B,CAAC,cAAc;gBAClE,OAAO,EAAE,EAAE,MAAM,EAAE,EAAE,wBAAwB;aAC9C,CACF,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,0BAA0B,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YACjD,IAAI,CAAC,QAAQ,CAAC,wCAAwC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;YACzF,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,UAAU,EACpB,gBAAgB,EAChB;gBACE,sBAAsB,EAAE,2BAA2B,CAAC,UAAU;gBAC9D,OAAO,EAAE,EAAE,OAAO,EAAE,oCAAoC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE;aACxF,CACF,CAAC;QACJ,CAAC;QAED,+EAA+E;QAC/E,mFAAmF;QACnF,MAAM,OAAO,GAAG,qBAAqB,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAE7D,MAAM,IAAI,CAAC,YAAY,CAAC,oBAAoB,CAAC,IAAI,EAAE,QAAQ,EAAE,gBAAgB,EAAE;YAC7E,WAAW,EAAE,QAAQ;YACrB,IAAI;YACJ,OAAO;SACR,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;;;OAWG;IACK,6BAA6B,CACnC,YAA0B,EAC1B,gBAAuC;QAEvC,6DAA6D;QAC7D,MAAM,cAAc,GAAG,IAAI,CAAC,iBAAiB,CAAC,wBAAwB,CAAC,YAAY,CAAC,CAAC;QAErF,+CAA+C;QAC/C,4CAA4C;QAC5C,MAAM,YAAY,GAAG,cAAc,EAAE,oBAAoB,IAAI,oBAAoB,CAAC,aAAa,CAAC;QAEhG,mDAAmD;QACnD,MAAM,cAAc,GAAG,IAAI,CAAC,uBAAuB,CAAC,cAAc,CAAC,gBAAgB,EAAE,cAAc,CAAC,CAAC;QACrG,MAAM,MAAM,GAAG,IAAI,CAAC,uBAAuB,CAAC,cAAc,CAAC,gBAAgB,EAAE,MAAM,CAAC,CAAC;QACrF,yEAAyE;QACzE,0EAA0E;QAC1E,kEAAkE;QAClE,0EAA0E;QAC1E,oDAAoD;QACpD,MAAM,aAAa,GAAG,gBAAgB,CAAC,aAAa,IAAI,IAAI,CAAC,gBAAgB,CAAC,aAAa,CAAC;QAE5F,QAAQ,YAAY,EAAE,CAAC;YACrB,KAAK,oBAAoB,CAAC,WAAW;gBACnC,IAAI,CAAC,aAAa,EAAE,CAAC;oBACnB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,UAAU,EACpB,gBAAgB,EAChB;wBACE,sBAAsB,EAAE,2BAA2B,CAAC,6BAA6B;wBACjF,OAAO,EAAE;4BACP,YAAY,EAAE,wBAAwB;yBACvC;qBACF,CACF,CAAC;gBACJ,CAAC;gBACD,OAAO;oBACL,YAAY,EAAE,oBAAoB,CAAC,WAAW;oBAC9C,aAAa;iBACd,CAAC;YAEJ,KAAK,oBAAoB,CAAC,aAAa;gBACrC,IAAI,CAAC,cAAc,EAAE,CAAC;oBACpB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,UAAU,EACpB,gBAAgB,EAChB;wBACE,sBAAsB,EAAE,2BAA2B,CAAC,6BAA6B;wBACjF,OAAO,EAAE;4BACP,YAAY,EAAE,wBAAwB;yBACvC;qBACF,CACF,CAAC;gBACJ,CAAC;gBACD,IAAI,CAAC,aAAa,EAAE,CAAC;oBACnB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,UAAU,EACpB,gBAAgB,EAChB;wBACE,sBAAsB,EAAE,2BAA2B,CAAC,6BAA6B;wBACjF,OAAO,EAAE;4BACP,YAAY,EAAE,wBAAwB;yBACvC;qBACF,CACF,CAAC;gBACJ,CAAC;gBACD,OAAO;oBACL,YAAY,EAAE,oBAAoB,CAAC,aAAa;oBAChD,aAAa;oBACb,cAAc;iBACf,CAAC;YAEJ,KAAK,oBAAoB,CAAC,SAAS;gBACjC,gFAAgF;gBAChF,iFAAiF;gBACjF,iFAAiF;gBACjF,+DAA+D;gBAC/D,IAAI,CAAC,MAAM,EAAE,CAAC;oBACZ,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,UAAU,EACpB,gBAAgB,EAChB;wBACE,sBAAsB,EAAE,2BAA2B,CAAC,6BAA6B;wBACjF,OAAO,EAAE;4BACP,YAAY,EAAE,wBAAwB;yBACvC;qBACF,CACF,CAAC;gBACJ,CAAC;gBACD,IAAI,CAAC,aAAa,EAAE,CAAC;oBACnB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,UAAU,EACpB,gBAAgB,EAChB;wBACE,sBAAsB,EAAE,2BAA2B,CAAC,6BAA6B;wBACjF,OAAO,EAAE;4BACP,YAAY,EAAE,wBAAwB;yBACvC;qBACF,CACF,CAAC;gBACJ,CAAC;gBACD,OAAO;oBACL,YAAY,EAAE,oBAAoB,CAAC,SAAS;oBAC5C,aAAa;oBACb,MAAM;iBACP,CAAC;YAEJ;gBACE,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,aAAa,EACvB,gBAAgB,EAChB;oBACE,sBAAsB,EAAE,2BAA2B,CAAC,aAAa;oBACjE,OAAO,EAAE;wBACP,OAAO,EAAE,qFAAqF;wBAC9F,YAAY;wBACZ,YAAY;qBACb;iBACF,CACF,CAAC;QACN,CAAC;IACH,CAAC;CACF,CAAA;AAnwBY,uCAAuC;IADnD,UAAU,EAAE;IAKR,WAAA,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAA;IAEjC,WAAA,MAAM,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,CAAA;IAE9C,WAAA,MAAM,CAAC,kBAAkB,CAAC,uBAAuB,CAAC,CAAA;IAElD,WAAA,MAAM,CAAC,kBAAkB,CAAC,2BAA2B,CAAC,CAAA;IAEtD,WAAA,MAAM,CAAC,kBAAkB,CAAC,qBAAqB,CAAC,CAAA;IAEhD,WAAA,MAAM,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,CAAA;IAE9C,WAAA,MAAM,CAAC,kBAAkB,CAAC,iBAAiB,CAAC,CAAA;IAE5C,WAAA,MAAM,CAAC,kBAAkB,CAAC,yBAAyB,CAAC,CAAA;IAEpD,WAAA,MAAM,CAAC,kBAAkB,CAAC,8BAA8B,CAAC,CAAA;IAEzD,WAAA,MAAM,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,CAAA;IAE3C,YAAA,MAAM,CAAC,kBAAkB,CAAC,uBAAuB,CAAC,CAAA;IAElD,YAAA,MAAM,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,CAAA;IAE9C,YAAA,MAAM,CAAC,kBAAkB,CAAC,sBAAsB,CAAC,CAAA;IAEjD,YAAA,MAAM,CAAC,kBAAkB,CAAC,sBAAsB,CAAC,CAAA;+CAvBnB,0BAA0B;QAErB,+BAA+B;QAE9B,2BAA2B;QAEhC,qBAAqB;QAEtB,mBAAmB;QAEd,+BAA+B;QAE9B,gCAAgC;QAE3B,qCAAqC;QAE5C,uBAAuB;QAE3B,qCAAqC;QAE9B,0BAA0B;QAEvB,6BAA6B;QAE7B,6BAA6B;GA/B7D,uCAAuC,CAmwBnD","sourcesContent":["/**\n * Resource File Upload Handler Backend Service\n *\n * Handles user-provided uploads for resource-integrated file fields after the\n * controller's pre-Multer middleware has already established execution context\n * and authorized access to the owning resource route.\n *\n * Coordinates validation, file record creation, and storage upload. UPDATE\n * routes authorize the target resource before reaching this handler, but the\n * upload itself still creates a new File record; attaching/replacing that file\n * on the resource is owned by the calling form/field mutation lane, not by this\n * upload transport.\n *\n * Flow:\n * 1. Validate file exists in request\n * 2. Resolve file constraints from resource field schema\n * 3. Validate file against constraints\n * 4. Create file record (status: PENDING)\n * 5. Upload file to storage\n * 6. Update file status to UPLOADED\n * 7. Return file metadata\n * 8. (async) Initiate AV scan if enabled (UPLOADED → SCANNING → CLEAN/INFECTED)\n */\n\nimport { injectable, inject } from 'inversify';\nimport type { Request, Response, NextFunction } from 'express';\nimport { Readable } from 'stream';\nimport fs from 'fs';\nimport { CoreResourceOperation, ResourceType, ErrorType, ErrorCustomMessageReference, File, FileStatus, FILE_DOWNLOADABLE_STATUSES, FILE_METADATA_WITHHELD_STATUSES, ResourcePrimaryScope, FileScopeIdentifiers, isWildoBackendError, parseFileServeVariant } from '@wildo-ai/saas-models';\nimport { FileGenerationSource } from '@wildo-ai/zod-decorators';\nimport { SAAS_SERVICE_TYPES } from '~wildo-backend-lib/inject/models/service-types';\nimport type { LoggerService } from '~wildo-backend-lib/monitoring/logger/services/logger.service';\nimport { ErrorBuilderBackendService } from '~wildo-backend-lib/errors/services/error-builder.backend.service';\nimport { ResourcesRegistryBackendService } from '~wildo-backend-lib/resources/services/resources-registry.backend.service';\nimport { ExecutionContext } from '~wildo-backend-lib/runtime/models/execution-context.backend.schemas';\nimport { FileConstraintResolverChain } from '~wildo-backend-lib/files/constraints/file-constraint-resolver-chain.backend.service';\nimport { FileValidationService } from '~wildo-backend-lib/files/constraints/file-validation.backend.service';\nimport { FilesBackendService } from '~wildo-backend-lib/files/services/files.backend.service';\nimport { ResourceOperationHelperBackendService } from '~wildo-backend-lib/base-classes/services/resource-operations-helper.backend.service';\nimport { validateResourceType, validateFieldName, validateResourceId, validateFileId, validateContentType, validateSize, validateUploadedBy, validateUploadedByEntityType, resolveConfiguredMaxFileSize } from '~wildo-backend-lib/files/utils/file-validation.utils';\nimport { resolveFileUploaderPrincipal } from '~wildo-backend-lib/files/utils/file-uploader.utils';\nimport { AppConfigurationService } from '~wildo-backend-lib/config/services/app-configuration.backend.service';\nimport { FileStorageRouterBackendService } from '~wildo-backend-lib/files/storage/file-storage-router.backend.service';\nimport { FileFieldDetectionBackendService } from '~wildo-backend-lib/files/services/file-field-detection.backend.service';\nimport { FileStoragePathResolverBackendService } from '~wildo-backend-lib/files/storage/file-storage-path-resolver.backend.service';\nimport type { StorageUploadResult, StorageUploadOptions } from '~wildo-backend-lib/files/storage/file-storage-provider.types';\nimport { FileScanningBackendService } from '~wildo-backend-lib/files/services/file-scanning.backend.service';\nimport { describeCaughtError, projectCaughtErrorLogFields } from '~wildo-backend-lib/errors/utils/error-log-level-classification.backend.utils';\nimport { resolveStorageApplicationIdentity } from '~wildo-backend-lib/files/utils/storage-application-identity.backend.utils';\nimport { ConsumableTokenBackendService } from '~wildo-backend-lib/security/consumable-tokens/services/consumable-token.backend.service';\nimport { FileUploadGrantBackendService } from '~wildo-backend-lib/files/services/file-upload-grant.backend.service';\nimport type { FileUploadRouteGrantLocals } from '~wildo-backend-lib/files/handlers/file-upload-route-locals.backend.types';\n\n@injectable()\nexport class ResourceFileUploadHandlerBackendService {\n  protected logDebug: (message: string, context?: Record<string, unknown>) => void;\n\n  constructor(\n    @inject(SAAS_SERVICE_TYPES.Logger)\n    private readonly logger: LoggerService,\n    @inject(SAAS_SERVICE_TYPES.ErrorBuilderService)\n    private readonly errorBuilder: ErrorBuilderBackendService,\n    @inject(SAAS_SERVICE_TYPES.ResourceRegistryService)\n    private readonly resourcesRegistry: ResourcesRegistryBackendService,\n    @inject(SAAS_SERVICE_TYPES.FileConstraintResolverChain)\n    private readonly constraintResolver: FileConstraintResolverChain,\n    @inject(SAAS_SERVICE_TYPES.FileValidationService)\n    private readonly fileValidator: FileValidationService,\n    @inject(SAAS_SERVICE_TYPES.FilesBackendService)\n    private readonly filesService: FilesBackendService,\n    @inject(SAAS_SERVICE_TYPES.FileStorageRouter)\n    private readonly fileStorageRouter: FileStorageRouterBackendService,\n    @inject(SAAS_SERVICE_TYPES.FileFieldDetectionService)\n    private readonly fileFieldDetection: FileFieldDetectionBackendService,\n    @inject(SAAS_SERVICE_TYPES.ResourceOperationHelperService)\n    private readonly resourceOperationHelper: ResourceOperationHelperBackendService,\n    @inject(SAAS_SERVICE_TYPES.AppConfigService)\n    private readonly appConfigService: AppConfigurationService,\n    @inject(SAAS_SERVICE_TYPES.FileStoragePathResolver)\n    private readonly pathResolver: FileStoragePathResolverBackendService,\n    @inject(SAAS_SERVICE_TYPES.FileScanningService)\n    private readonly fileScanningService: FileScanningBackendService,\n    @inject(SAAS_SERVICE_TYPES.ConsumableTokenService)\n    private readonly consumableTokenService: ConsumableTokenBackendService,\n    @inject(SAAS_SERVICE_TYPES.FileUploadGrantService)\n    private readonly fileUploadGrantService: FileUploadGrantBackendService,\n  ) {\n    this.logDebug = this.logger.debugByType('ResourceFileUploadHandlerBackendService');\n    this.logger.setDebugTypeLogging('ResourceFileUploadHandlerBackendService', false);\n  }\n\n  /**\n   * Extract the resource instance from the request body (if available).\n   * In multipart uploads, the resource data may be present in `req.body`\n   * as parsed form fields.\n   */\n  private extractResourceInstance(req: Request): Record<string, unknown> | undefined {\n    if (req.body && typeof req.body === 'object' && Object.keys(req.body).length > 0) {\n      return req.body as Record<string, unknown>;\n    }\n    return undefined;\n  }\n\n  /**\n   * Handle file upload for resource-integrated file fields.\n   *\n   * @param request - Express request with file in request.file (Multer)\n   * @param response - Express response\n   * @param resourceType - Resource type (e.g., 'todos')\n   * @param fieldName - File field name (e.g., 'attachments')\n   * @param resourceId - Resource ID (undefined for CREATE, string for UPDATE route authorization)\n   * @param operation - Route operation used for authorization; the upload always creates a new File record\n   * @param executionContext - Execution context from request\n   */\n  async handleFileUpload(\n    request: Request,\n    response: Response,\n    resourceType: ResourceType,\n    fieldName: string,\n    resourceId: string | undefined,\n    operation: CoreResourceOperation.CREATE | CoreResourceOperation.UPDATE,\n    executionContext: ExecutionContext<any>\n  ): Promise<void> {\n    // Validate inputs (CRITICAL: Prevents invalid data propagation and security vulnerabilities)\n    validateResourceType(resourceType, this.errorBuilder, executionContext, 'resourceType');\n    validateFieldName(fieldName, this.errorBuilder, executionContext, 'fieldName');\n    if (resourceId !== undefined) {\n      validateResourceId(resourceId, this.errorBuilder, executionContext, 'resourceId');\n    }\n\n    this.logDebug('Handling file upload', {\n      resourceType,\n      fieldName,\n      resourceId,\n      operation,\n      hasFile: !!request.file,\n    });\n\n    let fileRecord: { fileId: string } | undefined;\n    let uploadReachedSuccessState = false;\n    let blobStoredInStorage = false;\n\n    try {\n      // Step 1: Validate file exists in request\n      if (!request.file) {\n        throw this.errorBuilder.buildError(\n          ErrorType.VALIDATION,\n          executionContext,\n          {\n            customMessageReference: ErrorCustomMessageReference.FILE_UPLOAD_NO_FILE,\n            context: {\n              // diagnostic (log-only)\n              resourceType,\n              fieldName,\n            },\n          }\n        );\n      }\n\n      const multerFile = request.file;\n      const maxFileSize = resolveConfiguredMaxFileSize(this.appConfigService.config.storage?.maxFileSize);\n\n      // Validate file metadata (CRITICAL: Prevents invalid file data)\n      validateContentType(multerFile.mimetype, this.errorBuilder, executionContext, 'contentType');\n      validateSize(multerFile.size, maxFileSize, this.errorBuilder, executionContext, 'size');\n\n      // Step 2: Resolve file constraints from resource field schema\n      const constraint = await this.constraintResolver.resolve({\n        resourceType,\n        fieldName,\n      });\n\n      // Step 3: Validate file against constraints\n      const validationResult = await this.fileValidator.validateFile(multerFile, constraint);\n\n      if (!validationResult.success) {\n        throw this.errorBuilder.buildError(\n          ErrorType.VALIDATION,\n          executionContext,\n          {\n            customMessageReference: ErrorCustomMessageReference.VALIDATION,\n            context: {\n              message: 'File validation failed',\n              errors: validationResult.errors,\n              filename: multerFile.originalname,\n              mimeType: multerFile.mimetype,\n              size: multerFile.size,\n            },\n          }\n        );\n      }\n\n      // Step 4: Reject direct uploads to generated file fields FIRST —\n      // before scope derivation. \"This field cannot receive user uploads at\n      // all\" is a more fundamental rejection than \"what scope does the file\n      // belong to\", and must not be masked by a scope-derivation error\n      // (e.g. a missing applicationId) on a field that was never uploadable.\n      const fieldMeta = this.fileFieldDetection.getFileFieldMetadata(resourceType, fieldName);\n      if (fieldMeta?.fileMetadata.generation?.source === FileGenerationSource.PDF_TEMPLATE) {\n        throw this.errorBuilder.buildError(\n          ErrorType.BUSINESS_RULE,\n          executionContext,\n          {\n            customMessageReference: ErrorCustomMessageReference.FILE_GENERATED_FIELD_NOT_WRITABLE,\n            context: {\n              // diagnostic (log-only)\n              resourceType,\n              fieldName,\n            },\n          }\n        );\n      }\n\n      // Step 4b: Derive scope from parent resource's resourcePrimaryScope.\n      const scope = this.deriveScopeFromParentResource(resourceType, executionContext);\n\n      // Step 4c: Resolve storage provider from z_file() metadata.\n      const storageAccepted = fieldMeta?.fileMetadata.storageAccepted;\n      const storageProvider = this.fileStorageRouter.resolveProvider(storageAccepted);\n\n      // Step 4d: a file upload GRANT (issue #312) is claimed HERE — the point of no return. Every check a\n      // caller can act on (no file, wrong type, too large, generated field) has run; nothing has been\n      // written. A refusal above leaves the grant usable for a retry; a race loser is refused by the\n      // atomic consume and writes nothing. This handler is NOT on the services-registry pipeline, so its\n      // post-operation consumption never sees this request — this is the one consumption site.\n      const grant = (response.locals as FileUploadRouteGrantLocals | undefined)?.fileUploadGrant;\n      if (grant) {\n        await this.consumableTokenService.consumeToken(executionContext.consumableTokenValue!);\n        executionContext.markConsumableTokenConsumed();\n      }\n\n      // Step 5: Create file record (status: PENDING) with scope\n      // Under a grant the file is attributed to the MINTER — the person or machine that delegated the\n      // upload — never to the grant. A user-minted grant already yields that through the token context\n      // (`resolveFileUploaderPrincipal`, CONSUMABLE_TOKEN case); a machine-minted one yields nothing\n      // there, so the grant's own `minter` record is used. Both agree with createFile's mismatch guard.\n      const uploaderPrincipal = grant\n        ? this.fileUploadGrantService.resolveUploaderFromGrant(grant.metadata)\n        : resolveFileUploaderPrincipal(executionContext);\n      if (uploaderPrincipal) {\n        validateUploadedBy(uploaderPrincipal.uploadedBy, this.errorBuilder, executionContext, 'uploadedBy');\n        validateUploadedByEntityType(\n          uploaderPrincipal.uploadedByEntityType,\n          this.errorBuilder,\n          executionContext,\n          'uploadedByEntityType',\n        );\n      }\n\n      const createdFile = await this.filesService.createFile(\n        {\n          filename: multerFile.originalname || multerFile.filename,\n          originalFilename: multerFile.originalname,\n          mimeType: multerFile.mimetype,\n          size: multerFile.size,\n          storageProvider: storageProvider.providerId,\n          scope,\n          uploadedBy: uploaderPrincipal?.uploadedBy,\n          uploadedByEntityType: uploaderPrincipal?.uploadedByEntityType,\n        },\n        executionContext\n      );\n\n      fileRecord = { fileId: createdFile.fileId };\n\n      // Step 5b: Resolve upload path options now that we have the fileId.\n      const resourceInstance = this.extractResourceInstance(request);\n      let uploadOptions: StorageUploadOptions | undefined;\n      if (fieldMeta) {\n        uploadOptions = this.pathResolver.resolve(\n          createdFile.fileId,\n          fieldName,\n          fieldMeta.fileMetadata,\n          resolveStorageApplicationIdentity(this.appConfigService),\n          multerFile.originalname,\n          resourceInstance,\n        );\n      }\n\n      // The resource segment of the object key comes from the row that was just created, and is\n      // applied OUTSIDE the `fieldMeta` branch on purpose: a file without field metadata still\n      // belongs to a resource, and keying it as unlinked would place it outside the prefix its\n      // principal is granted once the session policy narrows per resource.\n      //\n      // Derived once, here, at create — the key never moves afterwards, so this is the only\n      // moment the segment can be decided.\n      // Use the handler's OWN `resourceType` parameter, NOT `createdFile.linkedResourceType`.\n      //\n      // `createFile` above is called WITHOUT a linked resource — the row is created unlinked and the\n      // association is written later — so reading the field back off the created record is always\n      // `undefined`, and every upload silently took the `_unlinked/` staging branch. Caught only by\n      // uploading a real file and listing the object store: `tsc` was clean and every unit test\n      // green, because nothing in either exercises the value that reaches the key builder.\n      //\n      // `resourceType` is a parameter of this method and is validated at entry, so it is the\n      // authoritative answer to \"which resource does this blob belong to\" at the only moment the\n      // key can be decided.\n      // `scope` rides along so the key carries `<scope>/<scopeId>` — the same `FileScopeIdentifiers`\n      // already built above for the File row, so the row and the object key agree by construction\n      // rather than by two independent derivations.\n      uploadOptions = { ...uploadOptions, linkedResourceType: resourceType, scope };\n\n      // Step 6: Create stream from disk file (true streaming, no memory buffering)\n      // With disk storage, multerFile.path contains the temp file path\n      if (!multerFile.path) {\n        throw this.errorBuilder.buildError(\n          ErrorType.INTERNAL,\n          executionContext,\n          {\n            customMessageReference: ErrorCustomMessageReference.INTERNAL,\n            context: {\n              message: 'Multer file path is missing (disk storage error)',\n              filename: multerFile.originalname,\n            },\n          }\n        );\n      }\n\n      // Verify file exists before creating stream\n      if (!fs.existsSync(multerFile.path)) {\n        throw this.errorBuilder.buildError(\n          ErrorType.INTERNAL,\n          executionContext,\n          {\n            customMessageReference: ErrorCustomMessageReference.INTERNAL,\n            context: {\n              message: 'Temp file not found on disk',\n              path: multerFile.path,\n              filename: multerFile.originalname,\n            },\n          }\n        );\n      }\n\n      let fileStream: Readable | null = null;\n      let uploadResult: StorageUploadResult | null = null;\n\n      // Step 7: Upload the blob through the resolved storage provider.\n      try {\n        // Create stream from disk file (true streaming, no memory buffering)\n        fileStream = fs.createReadStream(multerFile.path);\n\n        uploadResult = await storageProvider.upload(\n          fileStream,\n          createdFile.fileId,\n          multerFile.mimetype,\n          multerFile.size,\n          executionContext,\n          uploadOptions,\n        );\n        blobStoredInStorage = true;\n\n        this.logDebug('File uploaded to storage successfully', {\n          fileId: createdFile.fileId,\n        });\n      } catch (uploadError) {\n        // If upload fails, mark file as FAILED\n        await this.filesService.updateFileStatus(\n          createdFile.fileId,\n          FileStatus.FAILED,\n          executionContext\n        );\n\n        throw this.errorBuilder.buildError(\n          ErrorType.EXTERNAL_SERVICE,\n          executionContext,\n          {\n            customMessageReference: ErrorCustomMessageReference.EXTERNAL_SERVICE,\n            context: {\n              message: 'Failed to upload file to storage',\n              fileId: createdFile.fileId,\n              error: describeCaughtError(uploadError),\n            },\n          }\n        );\n      } finally {\n        // Clean up temp file (always, even on error)\n        // This ensures temp files are removed even if upload fails or other errors occur\n        if (multerFile.path && fs.existsSync(multerFile.path)) {\n          try {\n            fs.unlinkSync(multerFile.path);\n            this.logDebug('Temp file cleaned up', { path: multerFile.path });\n          } catch (cleanupError) {\n            // Log cleanup error but don't fail operation\n            this.logger.warn('Failed to clean up temp file', {\n              path: multerFile.path,\n              ...projectCaughtErrorLogFields(cleanupError),\n            });\n          }\n        }\n\n        // Also destroy stream if it was created\n        if (fileStream && !fileStream.destroyed) {\n          fileStream.destroy();\n        }\n      }\n\n      // Step 8: Update file status to UPLOADED (with retry logic)\n      // CRITICAL: If updateFileStatus() fails after successful storage upload,\n      // file exists in storage but status remains PENDING in database.\n      // Retry logic handles transient errors (network issues, database locks, etc.)\n      // Decision 5.1: Retry Logic with audit log error (Option A)\n      const maxRetries = 3;\n      const initialDelay = 1000; // 1 second\n\n      let lastError: Error | null = null;\n      let uploadedFile: File | null = null;\n\n      for (let attempt = 0; attempt <= maxRetries; attempt++) {\n        try {\n          uploadedFile = await this.filesService.updateFileStatus(\n            createdFile.fileId,\n            FileStatus.UPLOADED,\n            executionContext,\n            undefined,\n            uploadResult ?? undefined,\n          );\n          break; // Success\n        } catch (error) {\n          lastError = error instanceof Error ? error : new Error(describeCaughtError(error));\n\n          if (attempt < maxRetries) {\n            const delay = initialDelay * Math.pow(2, attempt);\n            this.logger.warn('File status update failed, retrying', {\n              fileId: createdFile.fileId,\n              attempt: attempt + 1,\n              maxRetries,\n              delay,\n              error: lastError.message,\n            });\n            await new Promise(resolve => setTimeout(resolve, delay));\n          } else {\n            // Final attempt failed - audit log and re-throw\n            this.logger.error('File status update failed after all retries', {\n              fileId: createdFile.fileId,\n              attempts: maxRetries + 1,\n              error: lastError.message,\n              // File exists in storage but status remains PENDING in database\n              // This is a data inconsistency that needs manual intervention\n            });\n\n            // If the blob already reached storage but metadata could not commit to\n            // UPLOADED, try to roll the blob back so the row can safely move into\n            // a failed lifecycle path instead of silently pointing at live data.\n            if (blobStoredInStorage && uploadResult) {\n              try {\n                await storageProvider.delete(\n                  {\n                    fileId: createdFile.fileId,\n                    storageProvider: uploadResult.provider,\n                    storageRef: uploadResult.storageRef,\n                  },\n                  executionContext,\n                );\n                blobStoredInStorage = false;\n                this.logger.warn('Rolled back stored blob after upload status commit failure', {\n                  fileId: createdFile.fileId,\n                });\n              } catch (rollbackError) {\n                if (!isWildoBackendError(rollbackError) || rollbackError.type !== ErrorType.NOT_FOUND) {\n                  this.logger.error('Failed to roll back stored blob after upload status commit failure', {\n                    fileId: createdFile.fileId,\n                    ...projectCaughtErrorLogFields(rollbackError),\n                    originalError: lastError.message,\n                  });\n                } else {\n                  blobStoredInStorage = false;\n                }\n              }\n            }\n\n            // Re-throw to fail the operation\n            throw lastError;\n          }\n        }\n      }\n\n      // Ensure uploadedFile is set (TypeScript safety check)\n      if (!uploadedFile) {\n        throw this.errorBuilder.buildError(\n          ErrorType.INTERNAL,\n          executionContext,\n          {\n            customMessageReference: ErrorCustomMessageReference.INTERNAL,\n            context: {\n              message: 'File status update failed - uploadedFile is null after retries',\n              fileId: createdFile.fileId,\n            },\n          }\n        );\n      }\n\n      // Step 9: Return success response with file metadata\n      const fileMetadata = this.filesService.toMetadataResponse(uploadedFile);\n      uploadReachedSuccessState = uploadedFile.status === FileStatus.UPLOADED;\n\n      response.status(200).json({\n        success: true,\n        file: fileMetadata,\n      });\n\n      this.logDebug('File upload completed successfully', {\n        fileId: uploadedFile.fileId,\n        resourceType,\n        fieldName,\n      });\n\n      // Step 9b: a redeemed grant records what it produced and is audited. Best-effort by contract —\n      // the upload has succeeded and the response is sent; a failure here is logged, never thrown.\n      if (grant) {\n        this.fileUploadGrantService\n          .recordRedemption(grant, { fileId: uploadedFile.fileId, mimeType: uploadedFile.mimeType, size: uploadedFile.size }, executionContext)\n          .catch((redemptionError) => {\n            this.logger.error('File upload grant: redemption record failed', {\n              grantId: grant.token._id,\n              fileId: uploadedFile!.fileId,\n              ...projectCaughtErrorLogFields(redemptionError),\n            });\n          });\n      }\n\n      // Step 10: Post-upload async pipeline (fire-and-forget, response already sent)\n      const shouldScan = this.fileScanningService.shouldScan(fieldMeta?.fileMetadata);\n\n      if (shouldScan) {\n        this.fileScanningService.initiateScan(uploadedFile.fileId, executionContext)\n          .catch((scanError) => {\n            this.logger.error('Failed to initiate file scanning', {\n              fileId: uploadedFile!.fileId,\n              ...projectCaughtErrorLogFields(scanError),\n            });\n          });\n      }\n    } catch (error) {\n      // Only pre-success failures should transition a file to FAILED. Once the\n      // upload already reached UPLOADED, later response-layer failures must not\n      // corrupt the persisted state back to FAILED. Likewise, if the blob still\n      // exists in storage because rollback failed, keep the row out of FAILED so\n      // operators can distinguish that inconsistency from a clean failed upload.\n      const shouldMarkAsFailed = !!fileRecord?.fileId && !uploadReachedSuccessState && !blobStoredInStorage;\n      if (shouldMarkAsFailed) {\n        try {\n          await this.filesService.updateFileStatus(\n            fileRecord.fileId,\n            FileStatus.FAILED,\n            executionContext\n          );\n          this.logDebug('File marked as FAILED due to upload error', {\n            fileId: fileRecord.fileId,\n          });\n        } catch (updateError) {\n          // Log but don't throw - we're already in error handling\n          this.logger.error('Failed to mark file as FAILED', {\n            fileId: fileRecord.fileId,\n            ...projectCaughtErrorLogFields(updateError),\n          });\n        }\n      }\n\n      // Re-throw error to be handled by Express error handler\n      throw error;\n    }\n  }\n\n  /**\n   * Serve (stream) a resource-linked file's bytes for INLINE preview/consumption.\n   *\n   * This is the read counterpart to `handleFileUpload` — the resource-integrated\n   * file **serve** route (`GET .../{res}/:resourceId/files/:fieldName/:fileId`). The\n   * controller has ALREADY authorized the caller against the parent resource's READ\n   * operation before delegating here, so authorization **inherits from the linked\n   * resource** — no consumable token, no public share (those belong to the global\n   * `FileController` for its separate cross-resource/share purpose).\n   *\n   * The one job this method owns is the LINK-OWNERSHIP boundary: the requested\n   * `fileId` MUST be linked to exactly this `{resourceType, resourceId, fieldName}`.\n   * Without it, any caller who can READ a parent record could stream an arbitrary or\n   * cross-resource file id through the route. A mismatch fails closed as NOT_FOUND\n   * (no existence disclosure). `getFile()`'s own scope check is defense-in-depth.\n   *\n   * A `?variant=thumbnail` query asks for a downscaled preview rendition; it is\n   * parsed fail-safe (unknown values → original bytes) and forwarded to the shared\n   * streaming seam, which only transforms eligible raster images.\n   *\n   * @param request - Express request (`:fileId` etc. in params, `?variant=` in query).\n   * @param response - Express response to stream into.\n   * @param next - Express next (forwards pre-header stream errors).\n   * @param resourceType - Parent resource type from the route.\n   * @param fieldName - File field name from the route.\n   * @param resourceId - Parent resource id from the route (authorization target).\n   * @param fileId - The specific file id to serve (must belong to the field above).\n   * @param executionContext - READ execution context built + authorized by the controller.\n   */\n  async handleFileServe(\n    request: Request,\n    response: Response,\n    next: NextFunction,\n    resourceType: ResourceType,\n    fieldName: string,\n    resourceId: string,\n    fileId: string,\n    executionContext: ExecutionContext<any>,\n  ): Promise<void> {\n    validateResourceType(resourceType, this.errorBuilder, executionContext, 'resourceType');\n    validateFieldName(fieldName, this.errorBuilder, executionContext, 'fieldName');\n    validateResourceId(resourceId, this.errorBuilder, executionContext, 'resourceId');\n    validateFileId(fileId, this.errorBuilder, executionContext, 'fileId');\n\n    this.logDebug('Handling file serve', { resourceType, fieldName, resourceId, fileId });\n\n    // getFile applies the file-scope access check (defense-in-depth). Primary authz —\n    // the parent resource READ — was already enforced by the controller.\n    const file = await this.filesService.getFile(fileId, executionContext);\n\n    // SECURITY BOUNDARY: the served file MUST be linked to THIS resource + field.\n    const belongsToRouteResource =\n      !!file &&\n      file.linkedResourceType === resourceType &&\n      String(file.linkedResourceId) === String(resourceId) &&\n      file.linkedFieldName === fieldName;\n\n    if (!belongsToRouteResource) {\n      this.logDebug('File serve denied: file not linked to route resource/field', {\n        fileId,\n        resourceType,\n        resourceId,\n        fieldName,\n        linkedResourceType: file?.linkedResourceType,\n        linkedResourceId: file?.linkedResourceId,\n        linkedFieldName: file?.linkedFieldName,\n      });\n      throw this.errorBuilder.buildError(\n        ErrorType.NOT_FOUND,\n        executionContext,\n        {\n          customMessageReference: ErrorCustomMessageReference.FILE_NOT_FOUND,\n          context: { fileId }, // diagnostic (log-only)\n        },\n      );\n    }\n\n    // STATUS GATE — the same invariant the two GLOBAL file routes already enforce, applied at the\n    // third site that streams bytes.\n    //\n    // It was missing here, and the omission became reachable the moment generated files got serve\n    // routes (2026-08-25): a REGENERATE marks the superseded document `DELETED` while DELIBERATELY\n    // retaining its `linkedResourceType/Id/FieldName`, so the link-ownership boundary above says yes\n    // and the old document kept streaming — measured, 200 with 2,222 bytes. The same hole applies to\n    // an UPLOADED file a privacy erasure marked `DELETED`: physical cleanup is a batch that runs much\n    // later, and until it did, the erased bytes were still served in place.\n    //\n    // Two tiers, mirroring the existing gates rather than inventing a third posture:\n    //  - `FILE_METADATA_WITHHELD_STATUSES` (i.e. `DELETED`, the erasure outcome) → NOT_FOUND, because\n    //    for an erased file, confirming the id still resolves is itself a disclosure (the same\n    //    reasoning as `FileController.assertFileMetadataDisclosable`);\n    //  - anything else outside `FILE_DOWNLOADABLE_STATUSES` (`PENDING`, `SCANNING`, `FAILED`, …) →\n    //    the download route's VALIDATION shape, because such a file genuinely exists and may become\n    //    servable, and an uploader polling a preview needs to be told which.\n    if (FILE_METADATA_WITHHELD_STATUSES.has(file.status)) {\n      this.logDebug('File serve denied: withheld status', { fileId, status: file.status });\n      throw this.errorBuilder.buildError(\n        ErrorType.NOT_FOUND,\n        executionContext,\n        {\n          customMessageReference: ErrorCustomMessageReference.FILE_NOT_FOUND,\n          context: { fileId }, // diagnostic (log-only)\n        },\n      );\n    }\n    if (!FILE_DOWNLOADABLE_STATUSES.has(file.status)) {\n      this.logDebug('File serve denied: non-servable status', { fileId, status: file.status });\n      throw this.errorBuilder.buildError(\n        ErrorType.VALIDATION,\n        executionContext,\n        {\n          customMessageReference: ErrorCustomMessageReference.VALIDATION,\n          context: { message: 'File is not available for download', fileId, status: file.status },\n        },\n      );\n    }\n\n    // `?variant=thumbnail` → downscaled preview rendition (raster images only; the\n    // streaming seam falls back to original bytes for anything else). Fail-safe parse.\n    const variant = parseFileServeVariant(request.query.variant);\n\n    await this.filesService.streamFileToResponse(file, response, executionContext, {\n      disposition: 'inline',\n      next,\n      variant,\n    });\n  }\n\n  /**\n   * Derive file scope from parent resource's resourcePrimaryScope.\n   *\n   * Scope derivation rules:\n   * - APPLICATION: sets applicationId from execution context\n   * - ORGANIZATIONS: sets organizationId from execution context\n   * - USER_SELF: sets userId + applicationId from execution context (no org — separate scope axis)\n   *\n   * @param resourceType - Parent resource type\n   * @param executionContext - Execution context for scope values\n   * @returns FileScopeIdentifiers derived from parent resource\n   */\n  private deriveScopeFromParentResource(\n    resourceType: ResourceType,\n    executionContext: ExecutionContext<any>\n  ): FileScopeIdentifiers {\n    // Get parent resource configuration to find its primaryScope\n    const resourceConfig = this.resourcesRegistry.getResourceConfiguration(resourceType);\n\n    // Get primaryScope from resource configuration\n    // Default to ORGANIZATIONS if not specified\n    const primaryScope = resourceConfig?.resourcePrimaryScope || ResourcePrimaryScope.ORGANIZATIONS;\n\n    // Extract scope identifiers from execution context\n    const organizationId = this.resourceOperationHelper.getInitiatorId(executionContext, 'organization');\n    const userId = this.resourceOperationHelper.getInitiatorId(executionContext, 'user');\n    // Fall back to the app config's applicationId when the execution context\n    // doesn't carry one — same pattern this handler already uses for the path\n    // binding above. There is exactly one application per backend, so\n    // `appConfigService.applicationId` is the correct anchor when an internal\n    // EC was built without a populated `applicationId`.\n    const applicationId = executionContext.applicationId || this.appConfigService.applicationId;\n\n    switch (primaryScope) {\n      case ResourcePrimaryScope.APPLICATION:\n        if (!applicationId) {\n          throw this.errorBuilder.buildError(\n            ErrorType.VALIDATION,\n            executionContext,\n            {\n              customMessageReference: ErrorCustomMessageReference.FILE_SCOPE_IDENTIFIER_MISSING,\n              context: {\n                resourceType, // diagnostic (log-only)\n              },\n            }\n          );\n        }\n        return {\n          primaryScope: ResourcePrimaryScope.APPLICATION,\n          applicationId,\n        };\n\n      case ResourcePrimaryScope.ORGANIZATIONS:\n        if (!organizationId) {\n          throw this.errorBuilder.buildError(\n            ErrorType.VALIDATION,\n            executionContext,\n            {\n              customMessageReference: ErrorCustomMessageReference.FILE_SCOPE_IDENTIFIER_MISSING,\n              context: {\n                resourceType, // diagnostic (log-only)\n              },\n            }\n          );\n        }\n        if (!applicationId) {\n          throw this.errorBuilder.buildError(\n            ErrorType.VALIDATION,\n            executionContext,\n            {\n              customMessageReference: ErrorCustomMessageReference.FILE_SCOPE_IDENTIFIER_MISSING,\n              context: {\n                resourceType, // diagnostic (log-only)\n              },\n            }\n          );\n        }\n        return {\n          primaryScope: ResourcePrimaryScope.ORGANIZATIONS,\n          applicationId,\n          organizationId,\n        };\n\n      case ResourcePrimaryScope.USER_SELF:\n        // USER_SELF and ORGANIZATIONS are independent primary-scope axes (separation of\n        // concern): a self-owned file is owned by the USER, never by an org. Require the\n        // user (owner) + applicationId (tenant/bucket anchor); do NOT read or persist an\n        // organizationId here — a self-profile carries no org context.\n        if (!userId) {\n          throw this.errorBuilder.buildError(\n            ErrorType.VALIDATION,\n            executionContext,\n            {\n              customMessageReference: ErrorCustomMessageReference.FILE_SCOPE_IDENTIFIER_MISSING,\n              context: {\n                resourceType, // diagnostic (log-only)\n              },\n            }\n          );\n        }\n        if (!applicationId) {\n          throw this.errorBuilder.buildError(\n            ErrorType.VALIDATION,\n            executionContext,\n            {\n              customMessageReference: ErrorCustomMessageReference.FILE_SCOPE_IDENTIFIER_MISSING,\n              context: {\n                resourceType, // diagnostic (log-only)\n              },\n            }\n          );\n        }\n        return {\n          primaryScope: ResourcePrimaryScope.USER_SELF,\n          applicationId,\n          userId,\n        };\n\n      default:\n        throw this.errorBuilder.buildError(\n          ErrorType.CONFIGURATION,\n          executionContext,\n          {\n            customMessageReference: ErrorCustomMessageReference.CONFIGURATION,\n            context: {\n              message: 'File uploads only support APPLICATION, ORGANIZATIONS, and USER_SELF resource scopes',\n              resourceType,\n              primaryScope,\n            },\n          }\n        );\n    }\n  }\n}\n"]}
+{"version":3,"file":"resource-file-upload-handler.backend.service.js","sourceRoot":"","sources":["../../../../src/files/handlers/resource-file-upload-handler.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;;;;;;;;;;;;;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAG/C,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,EAAuC,SAAS,EAAE,2BAA2B,EAAQ,UAAU,EAAE,0BAA0B,EAAE,+BAA+B,EAAE,oBAAoB,EAAwB,mBAAmB,EAAE,qBAAqB,EAAE,2BAA2B,EAAE,kCAAkC,EAAE,MAAM,uBAAuB,CAAC;AAE5V,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAChE,OAAO,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AAEpF,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAC9G,OAAO,EAAE,+BAA+B,EAAE,MAAM,0EAA0E,CAAC;AAE3H,OAAO,EAAE,2BAA2B,EAAE,MAAM,qFAAqF,CAAC;AAClI,OAAO,EAAE,qBAAqB,EAAE,MAAM,sEAAsE,CAAC;AAC7G,OAAO,EAAE,mBAAmB,EAAE,MAAM,yDAAyD,CAAC;AAC9F,OAAO,EAAE,qCAAqC,EAAE,MAAM,qFAAqF,CAAC;AAC5I,OAAO,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,cAAc,EAAE,mBAAmB,EAAE,YAAY,EAAE,kBAAkB,EAAE,4BAA4B,EAAE,4BAA4B,EAAE,MAAM,sDAAsD,CAAC;AACtQ,OAAO,EAAE,4BAA4B,EAAE,MAAM,oDAAoD,CAAC;AAElG,OAAO,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AAC/G,OAAO,EAAE,+BAA+B,EAAE,MAAM,sEAAsE,CAAC;AACvH,OAAO,EAAE,gCAAgC,EAAE,MAAM,wEAAwE,CAAC;AAC1H,OAAO,EAAE,qCAAqC,EAAE,MAAM,6EAA6E,CAAC;AAGpI,OAAO,EAAE,0BAA0B,EAAE,MAAM,iEAAiE,CAAC;AAC7G,OAAO,EAAE,mBAAmB,EAAE,2BAA2B,EAAE,MAAM,8EAA8E,CAAC;AAChJ,OAAO,EAAE,iCAAiC,EAAE,MAAM,2EAA2E,CAAC;AAC9H,OAAO,EAAE,6BAA6B,EAAE,MAAM,yFAAyF,CAAC;AACxI,OAAO,EAAE,6BAA6B,EAAE,MAAM,qEAAqE,CAAC;AAI7G,IAAM,uCAAuC,GAA7C,MAAM,uCAAuC;IAK/B;IAEA;IAEA;IAEA;IAEA;IAEA;IAEA;IAEA;IAEA;IAEA;IAEA;IAEA;IAEA;IAEA;IA9BT,QAAQ,CAA+D;IAEjF,YAEmB,MAAqB,EAErB,YAAwC,EAExC,iBAAkD,EAElD,kBAA+C,EAE/C,aAAoC,EAEpC,YAAiC,EAEjC,iBAAkD,EAElD,kBAAoD,EAEpD,uBAA8D,EAE9D,gBAAyC,EAEzC,YAAmD,EAEnD,mBAA+C,EAE/C,sBAAqD,EAErD,sBAAqD;QA1BrD,WAAM,GAAN,MAAM,CAAe;QAErB,iBAAY,GAAZ,YAAY,CAA4B;QAExC,sBAAiB,GAAjB,iBAAiB,CAAiC;QAElD,uBAAkB,GAAlB,kBAAkB,CAA6B;QAE/C,kBAAa,GAAb,aAAa,CAAuB;QAEpC,iBAAY,GAAZ,YAAY,CAAqB;QAEjC,sBAAiB,GAAjB,iBAAiB,CAAiC;QAElD,uBAAkB,GAAlB,kBAAkB,CAAkC;QAEpD,4BAAuB,GAAvB,uBAAuB,CAAuC;QAE9D,qBAAgB,GAAhB,gBAAgB,CAAyB;QAEzC,iBAAY,GAAZ,YAAY,CAAuC;QAEnD,wBAAmB,GAAnB,mBAAmB,CAA4B;QAE/C,2BAAsB,GAAtB,sBAAsB,CAA+B;QAErD,2BAAsB,GAAtB,sBAAsB,CAA+B;QAEtE,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,yCAAyC,CAAC,CAAC;QACnF,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,yCAAyC,EAAE,KAAK,CAAC,CAAC;IACpF,CAAC;IAED;;;;OAIG;IACK,uBAAuB,CAAC,GAAY;QAC1C,IAAI,GAAG,CAAC,IAAI,IAAI,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACjF,OAAO,GAAG,CAAC,IAA+B,CAAC;QAC7C,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAED;;;;;;;;;;OAUG;IACH,KAAK,CAAC,gBAAgB,CACpB,OAAgB,EAChB,QAAkB,EAClB,YAA0B,EAC1B,SAAiB,EACjB,UAA8B,EAC9B,SAAsE,EACtE,gBAAuC;QAEvC,6FAA6F;QAC7F,oBAAoB,CAAC,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,gBAAgB,EAAE,cAAc,CAAC,CAAC;QACxF,iBAAiB,CAAC,SAAS,EAAE,IAAI,CAAC,YAAY,EAAE,gBAAgB,EAAE,WAAW,CAAC,CAAC;QAC/E,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YAC7B,kBAAkB,CAAC,UAAU,EAAE,IAAI,CAAC,YAAY,EAAE,gBAAgB,EAAE,YAAY,CAAC,CAAC;QACpF,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,sBAAsB,EAAE;YACpC,YAAY;YACZ,SAAS;YACT,UAAU;YACV,SAAS;YACT,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI;SACxB,CAAC,CAAC;QAEH,8FAA8F;QAC9F,+FAA+F;QAC/F,iGAAiG;QACjG,kEAAkE;QAClE,MAAM,eAAe,GAAG,kCAAkC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACzE,IAAI,eAAe,CAAC,IAAI,KAAK,2BAA2B,CAAC,OAAO,EAAE,CAAC;YACjE,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,gBAAgB,EAAE;gBACzE,sBAAsB,EAAE,2BAA2B,CAAC,6BAA6B;gBACjF,OAAO,EAAE,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,EAAE,eAAe,CAAC,MAAM,EAAE;aACrE,CAAC,CAAC;QACL,CAAC;QACD,IAAI,eAAe,CAAC,IAAI,KAAK,2BAA2B,CAAC,OAAO,EAAE,CAAC;YACjE,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;gBACjB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,gBAAgB,EAAE;oBACzE,sBAAsB,EAAE,2BAA2B,CAAC,6BAA6B;oBACjF,OAAO,EAAE,EAAE,YAAY,EAAE,SAAS,EAAE,OAAO,EAAE,sEAAsE,EAAE;iBACtH,CAAC,CAAC;YACL,CAAC;YACD,MAAM,IAAI,CAAC,yBAAyB,CAAC,QAAQ,EAAE,YAAY,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,gBAAgB,EAAE,eAAe,CAAC,IAAI,CAAC,CAAC;YACvI,OAAO;QACT,CAAC;QAED,IAAI,UAA0C,CAAC;QAC/C,IAAI,yBAAyB,GAAG,KAAK,CAAC;QACtC,IAAI,mBAAmB,GAAG,KAAK,CAAC;QAEhC,IAAI,CAAC;YACH,0CAA0C;YAC1C,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;gBAClB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,UAAU,EACpB,gBAAgB,EAChB;oBACE,sBAAsB,EAAE,2BAA2B,CAAC,mBAAmB;oBACvE,OAAO,EAAE;wBACP,wBAAwB;wBACxB,YAAY;wBACZ,SAAS;qBACV;iBACF,CACF,CAAC;YACJ,CAAC;YAED,MAAM,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;YAChC,MAAM,WAAW,GAAG,4BAA4B,CAAC,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;YAEpG,gEAAgE;YAChE,mBAAmB,CAAC,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,YAAY,EAAE,gBAAgB,EAAE,aAAa,CAAC,CAAC;YAC7F,YAAY,CAAC,UAAU,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,YAAY,EAAE,gBAAgB,EAAE,MAAM,CAAC,CAAC;YAExF,8DAA8D;YAC9D,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC;gBACvD,YAAY;gBACZ,SAAS;aACV,CAAC,CAAC;YAEH,4CAA4C;YAC5C,MAAM,gBAAgB,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,YAAY,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;YAEvF,IAAI,CAAC,gBAAgB,CAAC,OAAO,EAAE,CAAC;gBAC9B,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,UAAU,EACpB,gBAAgB,EAChB;oBACE,sBAAsB,EAAE,2BAA2B,CAAC,UAAU;oBAC9D,OAAO,EAAE;wBACP,OAAO,EAAE,wBAAwB;wBACjC,MAAM,EAAE,gBAAgB,CAAC,MAAM;wBAC/B,QAAQ,EAAE,UAAU,CAAC,YAAY;wBACjC,QAAQ,EAAE,UAAU,CAAC,QAAQ;wBAC7B,IAAI,EAAE,UAAU,CAAC,IAAI;qBACtB;iBACF,CACF,CAAC;YACJ,CAAC;YAED,iEAAiE;YACjE,sEAAsE;YACtE,sEAAsE;YACtE,iEAAiE;YACjE,uEAAuE;YACvE,MAAM,SAAS,GAAG,IAAI,CAAC,kBAAkB,CAAC,oBAAoB,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;YACxF,IAAI,SAAS,EAAE,YAAY,CAAC,UAAU,EAAE,MAAM,KAAK,oBAAoB,CAAC,YAAY,EAAE,CAAC;gBACrF,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,aAAa,EACvB,gBAAgB,EAChB;oBACE,sBAAsB,EAAE,2BAA2B,CAAC,iCAAiC;oBACrF,OAAO,EAAE;wBACP,wBAAwB;wBACxB,YAAY;wBACZ,SAAS;qBACV;iBACF,CACF,CAAC;YACJ,CAAC;YAED,qEAAqE;YACrE,MAAM,KAAK,GAAG,IAAI,CAAC,6BAA6B,CAAC,YAAY,EAAE,gBAAgB,CAAC,CAAC;YAEjF,4DAA4D;YAC5D,MAAM,eAAe,GAAG,SAAS,EAAE,YAAY,CAAC,eAAe,CAAC;YAChE,MAAM,eAAe,GAAG,IAAI,CAAC,iBAAiB,CAAC,eAAe,CAAC,eAAe,CAAC,CAAC;YAEhF,oGAAoG;YACpG,gGAAgG;YAChG,+FAA+F;YAC/F,mGAAmG;YACnG,yFAAyF;YACzF,MAAM,EAAE,KAAK,EAAE,iBAAiB,EAAE,GAAG,IAAI,CAAC,0BAA0B,CAAC,QAAQ,EAAE,gBAAgB,CAAC,CAAC;YACjG,MAAM,IAAI,CAAC,kBAAkB,CAAC,KAAK,EAAE,gBAAgB,CAAC,CAAC;YAEvD,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CACpD;gBACE,QAAQ,EAAE,UAAU,CAAC,YAAY,IAAI,UAAU,CAAC,QAAQ;gBACxD,gBAAgB,EAAE,UAAU,CAAC,YAAY;gBACzC,QAAQ,EAAE,UAAU,CAAC,QAAQ;gBAC7B,IAAI,EAAE,UAAU,CAAC,IAAI;gBACrB,eAAe,EAAE,eAAe,CAAC,UAAU;gBAC3C,KAAK;gBACL,UAAU,EAAE,iBAAiB,EAAE,UAAU;gBACzC,oBAAoB,EAAE,iBAAiB,EAAE,oBAAoB;aAC9D,EACD,gBAAgB,CACjB,CAAC;YAEF,UAAU,GAAG,EAAE,MAAM,EAAE,WAAW,CAAC,MAAM,EAAE,CAAC;YAE5C,oEAAoE;YACpE,MAAM,gBAAgB,GAAG,IAAI,CAAC,uBAAuB,CAAC,OAAO,CAAC,CAAC;YAC/D,IAAI,aAA+C,CAAC;YACpD,IAAI,SAAS,EAAE,CAAC;gBACd,aAAa,GAAG,IAAI,CAAC,YAAY,CAAC,OAAO,CACvC,WAAW,CAAC,MAAM,EAClB,SAAS,EACT,SAAS,CAAC,YAAY,EACtB,iCAAiC,CAAC,IAAI,CAAC,gBAAgB,CAAC,EACxD,UAAU,CAAC,YAAY,EACvB,gBAAgB,CACjB,CAAC;YACJ,CAAC;YAED,0FAA0F;YAC1F,yFAAyF;YACzF,yFAAyF;YACzF,qEAAqE;YACrE,EAAE;YACF,sFAAsF;YACtF,qCAAqC;YACrC,wFAAwF;YACxF,EAAE;YACF,+FAA+F;YAC/F,4FAA4F;YAC5F,8FAA8F;YAC9F,0FAA0F;YAC1F,qFAAqF;YACrF,EAAE;YACF,uFAAuF;YACvF,2FAA2F;YAC3F,sBAAsB;YACtB,+FAA+F;YAC/F,4FAA4F;YAC5F,8CAA8C;YAC9C,aAAa,GAAG,EAAE,GAAG,aAAa,EAAE,kBAAkB,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC;YAE9E,6EAA6E;YAC7E,iEAAiE;YACjE,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;gBACrB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,QAAQ,EAClB,gBAAgB,EAChB;oBACE,sBAAsB,EAAE,2BAA2B,CAAC,QAAQ;oBAC5D,OAAO,EAAE;wBACP,OAAO,EAAE,kDAAkD;wBAC3D,QAAQ,EAAE,UAAU,CAAC,YAAY;qBAClC;iBACF,CACF,CAAC;YACJ,CAAC;YAED,4CAA4C;YAC5C,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;gBACpC,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,QAAQ,EAClB,gBAAgB,EAChB;oBACE,sBAAsB,EAAE,2BAA2B,CAAC,QAAQ;oBAC5D,OAAO,EAAE;wBACP,OAAO,EAAE,6BAA6B;wBACtC,IAAI,EAAE,UAAU,CAAC,IAAI;wBACrB,QAAQ,EAAE,UAAU,CAAC,YAAY;qBAClC;iBACF,CACF,CAAC;YACJ,CAAC;YAED,IAAI,UAAU,GAAoB,IAAI,CAAC;YACvC,IAAI,YAAY,GAA+B,IAAI,CAAC;YAEpD,iEAAiE;YACjE,IAAI,CAAC;gBACH,qEAAqE;gBACrE,UAAU,GAAG,EAAE,CAAC,gBAAgB,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;gBAElD,YAAY,GAAG,MAAM,eAAe,CAAC,MAAM,CACzC,UAAU,EACV,WAAW,CAAC,MAAM,EAClB,UAAU,CAAC,QAAQ,EACnB,UAAU,CAAC,IAAI,EACf,gBAAgB,EAChB,aAAa,CACd,CAAC;gBACF,mBAAmB,GAAG,IAAI,CAAC;gBAE3B,IAAI,CAAC,QAAQ,CAAC,uCAAuC,EAAE;oBACrD,MAAM,EAAE,WAAW,CAAC,MAAM;iBAC3B,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,WAAW,EAAE,CAAC;gBACrB,uCAAuC;gBACvC,MAAM,IAAI,CAAC,YAAY,CAAC,gBAAgB,CACtC,WAAW,CAAC,MAAM,EAClB,UAAU,CAAC,MAAM,EACjB,gBAAgB,CACjB,CAAC;gBAEF,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,gBAAgB,EAC1B,gBAAgB,EAChB;oBACE,sBAAsB,EAAE,2BAA2B,CAAC,gBAAgB;oBACpE,OAAO,EAAE;wBACP,OAAO,EAAE,kCAAkC;wBAC3C,MAAM,EAAE,WAAW,CAAC,MAAM;wBAC1B,KAAK,EAAE,mBAAmB,CAAC,WAAW,CAAC;qBACxC;iBACF,CACF,CAAC;YACJ,CAAC;oBAAS,CAAC;gBACT,6CAA6C;gBAC7C,iFAAiF;gBACjF,IAAI,UAAU,CAAC,IAAI,IAAI,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;oBACtD,IAAI,CAAC;wBACH,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;wBAC/B,IAAI,CAAC,QAAQ,CAAC,sBAAsB,EAAE,EAAE,IAAI,EAAE,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC;oBACnE,CAAC;oBAAC,OAAO,YAAY,EAAE,CAAC;wBACtB,6CAA6C;wBAC7C,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,8BAA8B,EAAE;4BAC/C,IAAI,EAAE,UAAU,CAAC,IAAI;4BACrB,GAAG,2BAA2B,CAAC,YAAY,CAAC;yBAC7C,CAAC,CAAC;oBACL,CAAC;gBACH,CAAC;gBAED,wCAAwC;gBACxC,IAAI,UAAU,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,CAAC;oBACxC,UAAU,CAAC,OAAO,EAAE,CAAC;gBACvB,CAAC;YACH,CAAC;YAED,4DAA4D;YAC5D,yEAAyE;YACzE,iEAAiE;YACjE,8EAA8E;YAC9E,4DAA4D;YAC5D,MAAM,UAAU,GAAG,CAAC,CAAC;YACrB,MAAM,YAAY,GAAG,IAAI,CAAC,CAAC,WAAW;YAEtC,IAAI,SAAS,GAAiB,IAAI,CAAC;YACnC,IAAI,YAAY,GAAgB,IAAI,CAAC;YAErC,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,IAAI,UAAU,EAAE,OAAO,EAAE,EAAE,CAAC;gBACvD,IAAI,CAAC;oBACH,YAAY,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,gBAAgB,CACrD,WAAW,CAAC,MAAM,EAClB,UAAU,CAAC,QAAQ,EACnB,gBAAgB,EAChB,SAAS,EACT,YAAY,IAAI,SAAS,CAC1B,CAAC;oBACF,MAAM,CAAC,UAAU;gBACnB,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,SAAS,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC,CAAC;oBAEnF,IAAI,OAAO,GAAG,UAAU,EAAE,CAAC;wBACzB,MAAM,KAAK,GAAG,YAAY,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;wBAClD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,qCAAqC,EAAE;4BACtD,MAAM,EAAE,WAAW,CAAC,MAAM;4BAC1B,OAAO,EAAE,OAAO,GAAG,CAAC;4BACpB,UAAU;4BACV,KAAK;4BACL,KAAK,EAAE,SAAS,CAAC,OAAO;yBACzB,CAAC,CAAC;wBACH,MAAM,IAAI,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;oBAC3D,CAAC;yBAAM,CAAC;wBACN,gDAAgD;wBAChD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,6CAA6C,EAAE;4BAC/D,MAAM,EAAE,WAAW,CAAC,MAAM;4BAC1B,QAAQ,EAAE,UAAU,GAAG,CAAC;4BACxB,KAAK,EAAE,SAAS,CAAC,OAAO;4BACxB,gEAAgE;4BAChE,8DAA8D;yBAC/D,CAAC,CAAC;wBAEH,uEAAuE;wBACvE,sEAAsE;wBACtE,qEAAqE;wBACrE,IAAI,mBAAmB,IAAI,YAAY,EAAE,CAAC;4BACxC,IAAI,CAAC;gCACH,MAAM,eAAe,CAAC,MAAM,CAC1B;oCACE,MAAM,EAAE,WAAW,CAAC,MAAM;oCAC1B,eAAe,EAAE,YAAY,CAAC,QAAQ;oCACtC,UAAU,EAAE,YAAY,CAAC,UAAU;iCACpC,EACD,gBAAgB,CACjB,CAAC;gCACF,mBAAmB,GAAG,KAAK,CAAC;gCAC5B,IAAI,eAAe,CAAC,oBAAoB,EAAE,CAAC;oCACzC,6EAA6E;oCAC7E,gFAAgF;oCAChF,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,6HAA6H,EAAE;wCAC9I,MAAM,EAAE,WAAW,CAAC,MAAM;wCAC1B,eAAe,EAAE,YAAY,CAAC,QAAQ;wCACtC,UAAU,EAAE,YAAY,CAAC,UAAU;qCACpC,CAAC,CAAC;gCACL,CAAC;qCAAM,CAAC;oCACN,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,4DAA4D,EAAE;wCAC7E,MAAM,EAAE,WAAW,CAAC,MAAM;qCAC3B,CAAC,CAAC;gCACL,CAAC;4BACH,CAAC;4BAAC,OAAO,aAAa,EAAE,CAAC;gCACvB,IAAI,CAAC,mBAAmB,CAAC,aAAa,CAAC,IAAI,aAAa,CAAC,IAAI,KAAK,SAAS,CAAC,SAAS,EAAE,CAAC;oCACtF,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,oEAAoE,EAAE;wCACtF,MAAM,EAAE,WAAW,CAAC,MAAM;wCAC1B,GAAG,2BAA2B,CAAC,aAAa,CAAC;wCAC7C,aAAa,EAAE,SAAS,CAAC,OAAO;qCACjC,CAAC,CAAC;gCACL,CAAC;qCAAM,CAAC;oCACN,mBAAmB,GAAG,KAAK,CAAC;gCAC9B,CAAC;4BACH,CAAC;wBACH,CAAC;wBAED,iCAAiC;wBACjC,MAAM,SAAS,CAAC;oBAClB,CAAC;gBACH,CAAC;YACH,CAAC;YAED,uDAAuD;YACvD,IAAI,CAAC,YAAY,EAAE,CAAC;gBAClB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,QAAQ,EAClB,gBAAgB,EAChB;oBACE,sBAAsB,EAAE,2BAA2B,CAAC,QAAQ;oBAC5D,OAAO,EAAE;wBACP,OAAO,EAAE,gEAAgE;wBACzE,MAAM,EAAE,WAAW,CAAC,MAAM;qBAC3B;iBACF,CACF,CAAC;YACJ,CAAC;YAED;;;;;;;;;;;;;;;;eAgBG;YACH,MAAM,cAAc,GAAG,IAAI,CAAC,mBAAmB,CAAC,UAAU,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;YACpF,IAAI,uBAAuB,GAAS,YAAY,CAAC;YACjD,IAAI,cAAc,EAAE,CAAC;gBACnB,MAAM,IAAI,CAAC,mBAAmB,CAAC,YAAY,CAAC,YAAY,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;gBACnF,4FAA4F;gBAC5F,qFAAqF;gBACrF,2FAA2F;gBAC3F,qFAAqF;gBACrF,MAAM,mBAAmB,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,YAAY,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;gBACnG,IAAI,mBAAmB,EAAE,CAAC;oBACxB,uBAAuB,GAAG,mBAAmB,CAAC;gBAChD,CAAC;YACH,CAAC;YAED,sDAAsD;YACtD,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,CAAC,kBAAkB,CAAC,uBAAuB,CAAC,CAAC;YACnF;;;eAGG;YACH,yBAAyB,GAAG,uBAAuB,CAAC,MAAM,KAAK,UAAU,CAAC,QAAQ;mBAC7E,uBAAuB,CAAC,MAAM,KAAK,UAAU,CAAC,QAAQ,CAAC;YAE5D,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACxB,OAAO,EAAE,IAAI;gBACb,IAAI,EAAE,YAAY;aACnB,CAAC,CAAC;YAEH,IAAI,CAAC,QAAQ,CAAC,oCAAoC,EAAE;gBAClD,MAAM,EAAE,YAAY,CAAC,MAAM;gBAC3B,YAAY;gBACZ,SAAS;aACV,CAAC,CAAC;YAEH,+FAA+F;YAC/F,6FAA6F;YAC7F,IAAI,KAAK,EAAE,CAAC;gBACV,IAAI,CAAC,sBAAsB;qBACxB,gBAAgB,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,YAAY,CAAC,MAAM,EAAE,QAAQ,EAAE,YAAY,CAAC,QAAQ,EAAE,IAAI,EAAE,YAAY,CAAC,IAAI,EAAE,EAAE,gBAAgB,CAAC;qBACpI,KAAK,CAAC,CAAC,eAAe,EAAE,EAAE;oBACzB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,6CAA6C,EAAE;wBAC/D,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,GAAG;wBACxB,MAAM,EAAE,YAAa,CAAC,MAAM;wBAC5B,GAAG,2BAA2B,CAAC,eAAe,CAAC;qBAChD,CAAC,CAAC;gBACL,CAAC,CAAC,CAAC;YACP,CAAC;QAEH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,yEAAyE;YACzE,0EAA0E;YAC1E,0EAA0E;YAC1E,2EAA2E;YAC3E,2EAA2E;YAC3E,MAAM,kBAAkB,GAAG,CAAC,CAAC,UAAU,EAAE,MAAM,IAAI,CAAC,yBAAyB,IAAI,CAAC,mBAAmB,CAAC;YACtG,IAAI,kBAAkB,EAAE,CAAC;gBACvB,IAAI,CAAC;oBACH,MAAM,IAAI,CAAC,YAAY,CAAC,gBAAgB,CACtC,UAAU,CAAC,MAAM,EACjB,UAAU,CAAC,MAAM,EACjB,gBAAgB,CACjB,CAAC;oBACF,IAAI,CAAC,QAAQ,CAAC,2CAA2C,EAAE;wBACzD,MAAM,EAAE,UAAU,CAAC,MAAM;qBAC1B,CAAC,CAAC;gBACL,CAAC;gBAAC,OAAO,WAAW,EAAE,CAAC;oBACrB,wDAAwD;oBACxD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,+BAA+B,EAAE;wBACjD,MAAM,EAAE,UAAU,CAAC,MAAM;wBACzB,GAAG,2BAA2B,CAAC,WAAW,CAAC;qBAC5C,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YAED,wDAAwD;YACxD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4BG;IACH,KAAK,CAAC,eAAe,CACnB,OAAgB,EAChB,QAAkB,EAClB,IAAkB,EAClB,YAA0B,EAC1B,SAAiB,EACjB,UAAkB,EAClB,MAAc,EACd,gBAAuC;QAEvC,oBAAoB,CAAC,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,gBAAgB,EAAE,cAAc,CAAC,CAAC;QACxF,iBAAiB,CAAC,SAAS,EAAE,IAAI,CAAC,YAAY,EAAE,gBAAgB,EAAE,WAAW,CAAC,CAAC;QAC/E,kBAAkB,CAAC,UAAU,EAAE,IAAI,CAAC,YAAY,EAAE,gBAAgB,EAAE,YAAY,CAAC,CAAC;QAClF,cAAc,CAAC,MAAM,EAAE,IAAI,CAAC,YAAY,EAAE,gBAAgB,EAAE,QAAQ,CAAC,CAAC;QAEtE,IAAI,CAAC,QAAQ,CAAC,qBAAqB,EAAE,EAAE,YAAY,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,CAAC;QAEtF,kFAAkF;QAClF,qEAAqE;QACrE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;QAEvE,8EAA8E;QAC9E,MAAM,sBAAsB,GAC1B,CAAC,CAAC,IAAI;YACN,IAAI,CAAC,kBAAkB,KAAK,YAAY;YACxC,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,KAAK,MAAM,CAAC,UAAU,CAAC;YACpD,IAAI,CAAC,eAAe,KAAK,SAAS,CAAC;QAErC,IAAI,CAAC,sBAAsB,EAAE,CAAC;YAC5B,IAAI,CAAC,QAAQ,CAAC,4DAA4D,EAAE;gBAC1E,MAAM;gBACN,YAAY;gBACZ,UAAU;gBACV,SAAS;gBACT,kBAAkB,EAAE,IAAI,EAAE,kBAAkB;gBAC5C,gBAAgB,EAAE,IAAI,EAAE,gBAAgB;gBACxC,eAAe,EAAE,IAAI,EAAE,eAAe;aACvC,CAAC,CAAC;YACH,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,SAAS,EACnB,gBAAgB,EAChB;gBACE,sBAAsB,EAAE,2BAA2B,CAAC,cAAc;gBAClE,OAAO,EAAE,EAAE,MAAM,EAAE,EAAE,wBAAwB;aAC9C,CACF,CAAC;QACJ,CAAC;QAED,8FAA8F;QAC9F,iCAAiC;QACjC,EAAE;QACF,8FAA8F;QAC9F,+FAA+F;QAC/F,iGAAiG;QACjG,iGAAiG;QACjG,kGAAkG;QAClG,wEAAwE;QACxE,EAAE;QACF,iFAAiF;QACjF,kGAAkG;QAClG,2FAA2F;QAC3F,mEAAmE;QACnE,+FAA+F;QAC/F,gGAAgG;QAChG,yEAAyE;QACzE,IAAI,+BAA+B,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YACrD,IAAI,CAAC,QAAQ,CAAC,oCAAoC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;YACrF,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,SAAS,EACnB,gBAAgB,EAChB;gBACE,sBAAsB,EAAE,2BAA2B,CAAC,cAAc;gBAClE,OAAO,EAAE,EAAE,MAAM,EAAE,EAAE,wBAAwB;aAC9C,CACF,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,0BAA0B,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YACjD,IAAI,CAAC,QAAQ,CAAC,wCAAwC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;YACzF,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,UAAU,EACpB,gBAAgB,EAChB;gBACE,sBAAsB,EAAE,2BAA2B,CAAC,UAAU;gBAC9D,OAAO,EAAE,EAAE,OAAO,EAAE,oCAAoC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE;aACxF,CACF,CAAC;QACJ,CAAC;QAED,+EAA+E;QAC/E,mFAAmF;QACnF,MAAM,OAAO,GAAG,qBAAqB,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAE7D,MAAM,IAAI,CAAC,YAAY,CAAC,oBAAoB,CAAC,IAAI,EAAE,QAAQ,EAAE,gBAAgB,EAAE;YAC7E,WAAW,EAAE,QAAQ;YACrB,IAAI;YACJ,OAAO;SACR,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;;;OAWG;IACH;;;;;;OAMG;IACK,KAAK,CAAC,kBAAkB,CAAC,KAA6E,EAAE,gBAAuC;QACrJ,IAAI,CAAC,KAAK;YAAE,OAAO;QACnB,MAAM,IAAI,CAAC,sBAAsB,CAAC,YAAY,CAAC,gBAAgB,CAAC,oBAAqB,CAAC,CAAC;QACvF,gBAAgB,CAAC,2BAA2B,EAAE,CAAC;IACjD,CAAC;IAED;;;;;;;OAOG;IACK,0BAA0B,CAChC,QAAkB,EAClB,gBAAuC;QAEvC,MAAM,KAAK,GAAI,QAAQ,CAAC,MAAiD,EAAE,eAAe,CAAC;QAC3F,MAAM,iBAAiB,GAAG,KAAK;YAC7B,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC,wBAAwB,CAAC,KAAK,CAAC,QAAQ,CAAC;YACtE,CAAC,CAAC,4BAA4B,CAAC,gBAAgB,CAAC,CAAC;QACnD,IAAI,iBAAiB,EAAE,CAAC;YACtB,kBAAkB,CAAC,iBAAiB,CAAC,UAAU,EAAE,IAAI,CAAC,YAAY,EAAE,gBAAgB,EAAE,YAAY,CAAC,CAAC;YACpG,4BAA4B,CAC1B,iBAAiB,CAAC,oBAAoB,EACtC,IAAI,CAAC,YAAY,EACjB,gBAAgB,EAChB,sBAAsB,CACvB,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC;IACtC,CAAC;IAED;;;;;;;;;;OAUG;IACK,KAAK,CAAC,yBAAyB,CACrC,QAAkB,EAClB,YAA0B,EAC1B,SAAiB,EACjB,UAA8B,EAC9B,SAAsE,EACtE,gBAAuC,EACvC,IAA6B;QAE7B,IAAI,CAAC,QAAQ,CAAC,gCAAgC,EAAE,EAAE,YAAY,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;QAEnI,MAAM,SAAS,GAAG,IAAI,CAAC,kBAAkB,CAAC,oBAAoB,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;QACxF,IAAI,SAAS,EAAE,YAAY,CAAC,UAAU,EAAE,MAAM,KAAK,oBAAoB,CAAC,YAAY,EAAE,CAAC;YACrF,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,gBAAgB,EAAE;gBAC5E,sBAAsB,EAAE,2BAA2B,CAAC,iCAAiC;gBACrF,OAAO,EAAE,EAAE,YAAY,EAAE,SAAS,EAAE;aACrC,CAAC,CAAC;QACL,CAAC;QAED,MAAM,eAAe,GAAG,IAAI,CAAC,iBAAiB,CAAC,mCAAmC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACrG,IAAI,eAAe,KAAK,SAAS,IAAI,eAAe,CAAC,uBAAuB,KAAK,SAAS,EAAE,CAAC;YAC3F,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,gBAAgB,EAAE;gBACzE,sBAAsB,EAAE,2BAA2B,CAAC,sCAAsC;gBAC1F,OAAO,EAAE,EAAE,YAAY,EAAE,SAAS,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE;aACpE,CAAC,CAAC;QACL,CAAC;QACD,MAAM,eAAe,GAAG,SAAS,EAAE,YAAY,CAAC,eAAe,IAAI,EAAE,CAAC;QACtE,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,eAAe,CAAC,UAAU,CAAC,EAAE,CAAC;YAC1D,uFAAuF;YACvF,wFAAwF;YACxF,uCAAuC;YACvC,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,gBAAgB,EAAE;gBACzE,sBAAsB,EAAE,2BAA2B,CAAC,0CAA0C;gBAC9F,OAAO,EAAE,EAAE,YAAY,EAAE,SAAS,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,OAAO,EAAE,eAAe,CAAC,UAAU,EAAE,eAAe,EAAE;aAC1H,CAAC,CAAC;QACL,CAAC;QACD,IAAI,CAAC,eAAe,CAAC,YAAY,EAAE,EAAE,CAAC;YACpC,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,gBAAgB,EAAE;gBAC5E,sBAAsB,EAAE,2BAA2B,CAAC,aAAa;gBACjE,OAAO,EAAE,EAAE,OAAO,EAAE,YAAY,eAAe,CAAC,UAAU,yDAAyD,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE;aACrJ,CAAC,CAAC;QACL,CAAC;QAED,MAAM,KAAK,GAAG,IAAI,CAAC,6BAA6B,CAAC,YAAY,EAAE,gBAAgB,CAAC,CAAC;QACjF,MAAM,EAAE,KAAK,EAAE,iBAAiB,EAAE,GAAG,IAAI,CAAC,0BAA0B,CAAC,QAAQ,EAAE,gBAAgB,CAAC,CAAC;QAEjG,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC,EAAE,YAAY,EAAE,SAAS,EAAE,CAAC,CAAC;QACtF,MAAM,WAAW,GAAG,4BAA4B,CAAC,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;QACpG,8FAA8F;QAC9F,8FAA8F;QAC9F,8FAA8F;QAC9F,IAAI,IAAI,CAAC,SAAS,KAAK,SAAS,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YAChE,MAAM,iBAAiB,GAAG,0CAA0C,CAClE,EAAE,GAAG,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,OAAO,EAAE,WAAW,CAAC,EAAE,EACrE,EAAE,WAAW,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,EAAE,CACrD,CAAC;YACF,IAAI,iBAAiB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACjC,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,gBAAgB,EAAE;oBACzE,sBAAsB,EAAE,2BAA2B,CAAC,UAAU;oBAC9D,OAAO,EAAE,EAAE,OAAO,EAAE,wBAAwB,EAAE,MAAM,EAAE,iBAAiB,EAAE,QAAQ,EAAE,IAAI,CAAC,WAAW,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,EAAE;iBACrJ,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,MAAM,WAAW,GAAG,MAAM,eAAe,CAAC,uBAAuB,CAAC,IAAI,CAAC,UAAU,EAAE,iBAAiB,IAAI,EAAE,EAAE,gBAAgB,CAAC,CAAC;QAC9H,mBAAmB,CAAC,WAAW,CAAC,WAAW,EAAE,IAAI,CAAC,YAAY,EAAE,gBAAgB,EAAE,aAAa,CAAC,CAAC;QACjG,YAAY,CAAC,WAAW,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,YAAY,EAAE,gBAAgB,EAAE,MAAM,CAAC,CAAC;QACzF,MAAM,UAAU,GAAG,0CAA0C,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;QACvF,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,gBAAgB,EAAE;gBACzE,sBAAsB,EAAE,2BAA2B,CAAC,UAAU;gBAC9D,OAAO,EAAE,EAAE,OAAO,EAAE,wBAAwB,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,WAAW,CAAC,IAAI,EAAE,QAAQ,EAAE,WAAW,CAAC,WAAW,EAAE,IAAI,EAAE,WAAW,CAAC,IAAI,EAAE;aAC1J,CAAC,CAAC;QACL,CAAC;QAED,MAAM,IAAI,CAAC,kBAAkB,CAAC,KAAK,EAAE,gBAAgB,CAAC,CAAC;QAEvD,IAAI,UAA0C,CAAC;QAC/C,8FAA8F;QAC9F,2FAA2F;QAC3F,qEAAqE;QACrE,IAAI,uBAAuB,GAAG,KAAK,CAAC;QACpC,IAAI,CAAC;YACH,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CACpD;gBACE,QAAQ,EAAE,WAAW,CAAC,IAAI;gBAC1B,gBAAgB,EAAE,IAAI,CAAC,WAAW,IAAI,WAAW,CAAC,IAAI;gBACtD,QAAQ,EAAE,WAAW,CAAC,WAAW;gBACjC,IAAI,EAAE,WAAW,CAAC,IAAI;gBACtB,QAAQ,EAAE,WAAW,CAAC,IAAI;gBAC1B,eAAe,EAAE,eAAe,CAAC,UAAU;gBAC3C,KAAK;gBACL,UAAU,EAAE,iBAAiB,EAAE,UAAU;gBACzC,oBAAoB,EAAE,iBAAiB,EAAE,oBAAoB;aAC9D,EACD,gBAAgB,CACjB,CAAC;YACF,UAAU,GAAG,EAAE,MAAM,EAAE,WAAW,CAAC,MAAM,EAAE,CAAC;YAE5C,IAAI,UAAU,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,gBAAgB,CACvD,WAAW,CAAC,MAAM,EAClB,UAAU,CAAC,QAAQ,EACnB,gBAAgB,EAChB,SAAS,EACT,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,QAAQ,EAAE,eAAe,CAAC,UAAU,EAAE,CACtE,CAAC;YAEF,uFAAuF;YACvF,0FAA0F;YAC1F,4FAA4F;YAC5F,2FAA2F;YAC3F,iFAAiF;YACjF,IAAI,IAAI,CAAC,mBAAmB,CAAC,UAAU,CAAC,SAAS,EAAE,YAAY,CAAC,EAAE,CAAC;gBACjE,MAAM,IAAI,CAAC,mBAAmB,CAAC,YAAY,CAAC,UAAU,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;gBACjF,MAAM,mBAAmB,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;gBACjG,IAAI,mBAAmB;oBAAE,UAAU,GAAG,mBAAmB,CAAC;YAC5D,CAAC;YACD,uBAAuB,GAAG,UAAU,CAAC,MAAM,KAAK,UAAU,CAAC,QAAQ,IAAI,UAAU,CAAC,MAAM,KAAK,UAAU,CAAC,QAAQ,CAAC;YAEjH,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACxB,OAAO,EAAE,IAAI;gBACb,IAAI,EAAE,IAAI,CAAC,YAAY,CAAC,kBAAkB,CAAC,UAAU,CAAC;aACvD,CAAC,CAAC;YACH,IAAI,CAAC,QAAQ,CAAC,yBAAyB,EAAE,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,YAAY,EAAE,SAAS,EAAE,OAAO,EAAE,eAAe,CAAC,UAAU,EAAE,CAAC,CAAC;YAEtI,IAAI,KAAK,EAAE,CAAC;gBACV,IAAI,CAAC,sBAAsB;qBACxB,gBAAgB,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,QAAQ,EAAE,UAAU,CAAC,QAAQ,EAAE,IAAI,EAAE,UAAU,CAAC,IAAI,EAAE,EAAE,gBAAgB,CAAC;qBAC9H,KAAK,CAAC,CAAC,eAAe,EAAE,EAAE;oBACzB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,6CAA6C,EAAE;wBAC/D,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,GAAG;wBACxB,MAAM,EAAE,UAAU,CAAC,MAAM;wBACzB,GAAG,2BAA2B,CAAC,eAAe,CAAC;qBAChD,CAAC,CAAC;gBACL,CAAC,CAAC,CAAC;YACP,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,UAAU,IAAI,CAAC,uBAAuB,EAAE,CAAC;gBAC3C,IAAI,CAAC;oBACH,MAAM,IAAI,CAAC,YAAY,CAAC,gBAAgB,CAAC,UAAU,CAAC,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;gBACnG,CAAC;gBAAC,OAAO,WAAW,EAAE,CAAC;oBACrB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,sCAAsC,EAAE,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,GAAG,2BAA2B,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;gBACxI,CAAC;YACH,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAEO,6BAA6B,CACnC,YAA0B,EAC1B,gBAAuC;QAEvC,6DAA6D;QAC7D,MAAM,cAAc,GAAG,IAAI,CAAC,iBAAiB,CAAC,wBAAwB,CAAC,YAAY,CAAC,CAAC;QAErF,+CAA+C;QAC/C,4CAA4C;QAC5C,MAAM,YAAY,GAAG,cAAc,EAAE,oBAAoB,IAAI,oBAAoB,CAAC,aAAa,CAAC;QAEhG,mDAAmD;QACnD,MAAM,cAAc,GAAG,IAAI,CAAC,uBAAuB,CAAC,cAAc,CAAC,gBAAgB,EAAE,cAAc,CAAC,CAAC;QACrG,MAAM,MAAM,GAAG,IAAI,CAAC,uBAAuB,CAAC,cAAc,CAAC,gBAAgB,EAAE,MAAM,CAAC,CAAC;QACrF,yEAAyE;QACzE,0EAA0E;QAC1E,kEAAkE;QAClE,0EAA0E;QAC1E,oDAAoD;QACpD,MAAM,aAAa,GAAG,gBAAgB,CAAC,aAAa,IAAI,IAAI,CAAC,gBAAgB,CAAC,aAAa,CAAC;QAE5F,QAAQ,YAAY,EAAE,CAAC;YACrB,KAAK,oBAAoB,CAAC,WAAW;gBACnC,IAAI,CAAC,aAAa,EAAE,CAAC;oBACnB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,UAAU,EACpB,gBAAgB,EAChB;wBACE,sBAAsB,EAAE,2BAA2B,CAAC,6BAA6B;wBACjF,OAAO,EAAE;4BACP,YAAY,EAAE,wBAAwB;yBACvC;qBACF,CACF,CAAC;gBACJ,CAAC;gBACD,OAAO;oBACL,YAAY,EAAE,oBAAoB,CAAC,WAAW;oBAC9C,aAAa;iBACd,CAAC;YAEJ,KAAK,oBAAoB,CAAC,aAAa;gBACrC,IAAI,CAAC,cAAc,EAAE,CAAC;oBACpB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,UAAU,EACpB,gBAAgB,EAChB;wBACE,sBAAsB,EAAE,2BAA2B,CAAC,6BAA6B;wBACjF,OAAO,EAAE;4BACP,YAAY,EAAE,wBAAwB;yBACvC;qBACF,CACF,CAAC;gBACJ,CAAC;gBACD,IAAI,CAAC,aAAa,EAAE,CAAC;oBACnB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,UAAU,EACpB,gBAAgB,EAChB;wBACE,sBAAsB,EAAE,2BAA2B,CAAC,6BAA6B;wBACjF,OAAO,EAAE;4BACP,YAAY,EAAE,wBAAwB;yBACvC;qBACF,CACF,CAAC;gBACJ,CAAC;gBACD,OAAO;oBACL,YAAY,EAAE,oBAAoB,CAAC,aAAa;oBAChD,aAAa;oBACb,cAAc;iBACf,CAAC;YAEJ,KAAK,oBAAoB,CAAC,SAAS;gBACjC,gFAAgF;gBAChF,iFAAiF;gBACjF,iFAAiF;gBACjF,+DAA+D;gBAC/D,IAAI,CAAC,MAAM,EAAE,CAAC;oBACZ,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,UAAU,EACpB,gBAAgB,EAChB;wBACE,sBAAsB,EAAE,2BAA2B,CAAC,6BAA6B;wBACjF,OAAO,EAAE;4BACP,YAAY,EAAE,wBAAwB;yBACvC;qBACF,CACF,CAAC;gBACJ,CAAC;gBACD,IAAI,CAAC,aAAa,EAAE,CAAC;oBACnB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,UAAU,EACpB,gBAAgB,EAChB;wBACE,sBAAsB,EAAE,2BAA2B,CAAC,6BAA6B;wBACjF,OAAO,EAAE;4BACP,YAAY,EAAE,wBAAwB;yBACvC;qBACF,CACF,CAAC;gBACJ,CAAC;gBACD,OAAO;oBACL,YAAY,EAAE,oBAAoB,CAAC,SAAS;oBAC5C,aAAa;oBACb,MAAM;iBACP,CAAC;YAEJ;gBACE,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,aAAa,EACvB,gBAAgB,EAChB;oBACE,sBAAsB,EAAE,2BAA2B,CAAC,aAAa;oBACjE,OAAO,EAAE;wBACP,OAAO,EAAE,qFAAqF;wBAC9F,YAAY;wBACZ,YAAY;qBACb;iBACF,CACF,CAAC;QACN,CAAC;IACH,CAAC;CACF,CAAA;AA9+BY,uCAAuC;IADnD,UAAU,EAAE;IAKR,WAAA,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAA;IAEjC,WAAA,MAAM,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,CAAA;IAE9C,WAAA,MAAM,CAAC,kBAAkB,CAAC,uBAAuB,CAAC,CAAA;IAElD,WAAA,MAAM,CAAC,kBAAkB,CAAC,2BAA2B,CAAC,CAAA;IAEtD,WAAA,MAAM,CAAC,kBAAkB,CAAC,qBAAqB,CAAC,CAAA;IAEhD,WAAA,MAAM,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,CAAA;IAE9C,WAAA,MAAM,CAAC,kBAAkB,CAAC,iBAAiB,CAAC,CAAA;IAE5C,WAAA,MAAM,CAAC,kBAAkB,CAAC,yBAAyB,CAAC,CAAA;IAEpD,WAAA,MAAM,CAAC,kBAAkB,CAAC,8BAA8B,CAAC,CAAA;IAEzD,WAAA,MAAM,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,CAAA;IAE3C,YAAA,MAAM,CAAC,kBAAkB,CAAC,uBAAuB,CAAC,CAAA;IAElD,YAAA,MAAM,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,CAAA;IAE9C,YAAA,MAAM,CAAC,kBAAkB,CAAC,sBAAsB,CAAC,CAAA;IAEjD,YAAA,MAAM,CAAC,kBAAkB,CAAC,sBAAsB,CAAC,CAAA;+CAvBnB,0BAA0B;QAErB,+BAA+B;QAE9B,2BAA2B;QAEhC,qBAAqB;QAEtB,mBAAmB;QAEd,+BAA+B;QAE9B,gCAAgC;QAE3B,qCAAqC;QAE5C,uBAAuB;QAE3B,qCAAqC;QAE9B,0BAA0B;QAEvB,6BAA6B;QAE7B,6BAA6B;GA/B7D,uCAAuC,CA8+BnD;;AAED;;;;GAIG;AACH,MAAM,UAAU,0CAA0C,CACxD,UAA0B,EAC1B,WAAgF;IAEhF,+FAA+F;IAC/F,8FAA8F;IAC9F,oFAAoF;IACpF,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,IAAI,WAAW,CAAC,WAAW,KAAK,SAAS,IAAI,UAAU,CAAC,gBAAgB,KAAK,SAAS,IAAI,UAAU,CAAC,gBAAgB,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,gBAAgB,CAAC,QAAQ,CAAC,WAAW,CAAC,WAAW,CAAC,EAAE,CAAC;QACnM,UAAU,CAAC,IAAI,CAAC,cAAc,WAAW,CAAC,WAAW,oCAAoC,UAAU,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACrI,CAAC;IACD,IAAI,WAAW,CAAC,IAAI,KAAK,SAAS,IAAI,UAAU,CAAC,OAAO,KAAK,SAAS,IAAI,WAAW,CAAC,IAAI,GAAG,UAAU,CAAC,OAAO,EAAE,CAAC;QAChH,UAAU,CAAC,IAAI,CAAC,aAAa,WAAW,CAAC,IAAI,2BAA2B,UAAU,CAAC,OAAO,QAAQ,CAAC,CAAC;IACtG,CAAC;IACD,IAAI,WAAW,CAAC,IAAI,KAAK,SAAS,IAAI,UAAU,CAAC,OAAO,KAAK,SAAS,IAAI,WAAW,CAAC,IAAI,GAAG,UAAU,CAAC,OAAO,EAAE,CAAC;QAChH,UAAU,CAAC,IAAI,CAAC,aAAa,WAAW,CAAC,IAAI,4BAA4B,UAAU,CAAC,OAAO,QAAQ,CAAC,CAAC;IACvG,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC","sourcesContent":["/**\n * Resource File Upload Handler Backend Service\n *\n * Handles user-provided uploads for resource-integrated file fields after the\n * controller's pre-Multer middleware has already established execution context\n * and authorized access to the owning resource route.\n *\n * Coordinates validation, file record creation, and storage upload. UPDATE\n * routes authorize the target resource before reaching this handler, but the\n * upload itself still creates a new File record; attaching/replacing that file\n * on the resource is owned by the calling form/field mutation lane, not by this\n * upload transport.\n *\n * Flow:\n * 1. Validate file exists in request\n * 2. Resolve file constraints from resource field schema\n * 3. Validate file against constraints\n * 4. Create file record (status: PENDING)\n * 5. Upload file to storage\n * 6. Update file status to UPLOADED\n * 7. Return file metadata\n * 8. (async) Initiate AV scan if enabled (UPLOADED → SCANNING → CLEAN/INFECTED)\n */\n\nimport { injectable, inject } from 'inversify';\nimport type { Request, Response, NextFunction } from 'express';\nimport { Readable } from 'stream';\nimport fs from 'fs';\nimport { CoreResourceOperation, ResourceType, ErrorType, ErrorCustomMessageReference, File, FileStatus, FILE_DOWNLOADABLE_STATUSES, FILE_METADATA_WITHHELD_STATUSES, ResourcePrimaryScope, FileScopeIdentifiers, isWildoBackendError, parseFileServeVariant, FileRemoteReferenceLinkRead, readFileRemoteReferenceLinkRequest } from '@wildo-ai/saas-models';\nimport type { FileRemoteReferenceLink } from '@wildo-ai/saas-models';\nimport { FileGenerationSource } from '@wildo-ai/zod-decorators';\nimport { SAAS_SERVICE_TYPES } from '~wildo-backend-lib/inject/models/service-types';\nimport type { LoggerService } from '~wildo-backend-lib/monitoring/logger/services/logger.service';\nimport { ErrorBuilderBackendService } from '~wildo-backend-lib/errors/services/error-builder.backend.service';\nimport { ResourcesRegistryBackendService } from '~wildo-backend-lib/resources/services/resources-registry.backend.service';\nimport { ExecutionContext } from '~wildo-backend-lib/runtime/models/execution-context.backend.schemas';\nimport { FileConstraintResolverChain } from '~wildo-backend-lib/files/constraints/file-constraint-resolver-chain.backend.service';\nimport { FileValidationService } from '~wildo-backend-lib/files/constraints/file-validation.backend.service';\nimport { FilesBackendService } from '~wildo-backend-lib/files/services/files.backend.service';\nimport { ResourceOperationHelperBackendService } from '~wildo-backend-lib/base-classes/services/resource-operations-helper.backend.service';\nimport { validateResourceType, validateFieldName, validateResourceId, validateFileId, validateContentType, validateSize, validateUploadedBy, validateUploadedByEntityType, resolveConfiguredMaxFileSize } from '~wildo-backend-lib/files/utils/file-validation.utils';\nimport { resolveFileUploaderPrincipal } from '~wildo-backend-lib/files/utils/file-uploader.utils';\nimport type { FileUploaderPrincipal } from '~wildo-backend-lib/files/utils/file-uploader.utils';\nimport { AppConfigurationService } from '~wildo-backend-lib/config/services/app-configuration.backend.service';\nimport { FileStorageRouterBackendService } from '~wildo-backend-lib/files/storage/file-storage-router.backend.service';\nimport { FileFieldDetectionBackendService } from '~wildo-backend-lib/files/services/file-field-detection.backend.service';\nimport { FileStoragePathResolverBackendService } from '~wildo-backend-lib/files/storage/file-storage-path-resolver.backend.service';\nimport type { StorageUploadResult, StorageUploadOptions, StorageRemoteFileDescription } from '~wildo-backend-lib/files/storage/file-storage-provider.types';\nimport type { FileConstraint } from '~wildo-backend-lib/files/constraints/file-constraint.types';\nimport { FileScanningBackendService } from '~wildo-backend-lib/files/services/file-scanning.backend.service';\nimport { describeCaughtError, projectCaughtErrorLogFields } from '~wildo-backend-lib/errors/utils/error-log-level-classification.backend.utils';\nimport { resolveStorageApplicationIdentity } from '~wildo-backend-lib/files/utils/storage-application-identity.backend.utils';\nimport { ConsumableTokenBackendService } from '~wildo-backend-lib/security/consumable-tokens/services/consumable-token.backend.service';\nimport { FileUploadGrantBackendService } from '~wildo-backend-lib/files/services/file-upload-grant.backend.service';\nimport type { FileUploadRouteGrantLocals } from '~wildo-backend-lib/files/handlers/file-upload-route-locals.backend.types';\n\n@injectable()\nexport class ResourceFileUploadHandlerBackendService {\n  protected logDebug: (message: string, context?: Record<string, unknown>) => void;\n\n  constructor(\n    @inject(SAAS_SERVICE_TYPES.Logger)\n    private readonly logger: LoggerService,\n    @inject(SAAS_SERVICE_TYPES.ErrorBuilderService)\n    private readonly errorBuilder: ErrorBuilderBackendService,\n    @inject(SAAS_SERVICE_TYPES.ResourceRegistryService)\n    private readonly resourcesRegistry: ResourcesRegistryBackendService,\n    @inject(SAAS_SERVICE_TYPES.FileConstraintResolverChain)\n    private readonly constraintResolver: FileConstraintResolverChain,\n    @inject(SAAS_SERVICE_TYPES.FileValidationService)\n    private readonly fileValidator: FileValidationService,\n    @inject(SAAS_SERVICE_TYPES.FilesBackendService)\n    private readonly filesService: FilesBackendService,\n    @inject(SAAS_SERVICE_TYPES.FileStorageRouter)\n    private readonly fileStorageRouter: FileStorageRouterBackendService,\n    @inject(SAAS_SERVICE_TYPES.FileFieldDetectionService)\n    private readonly fileFieldDetection: FileFieldDetectionBackendService,\n    @inject(SAAS_SERVICE_TYPES.ResourceOperationHelperService)\n    private readonly resourceOperationHelper: ResourceOperationHelperBackendService,\n    @inject(SAAS_SERVICE_TYPES.AppConfigService)\n    private readonly appConfigService: AppConfigurationService,\n    @inject(SAAS_SERVICE_TYPES.FileStoragePathResolver)\n    private readonly pathResolver: FileStoragePathResolverBackendService,\n    @inject(SAAS_SERVICE_TYPES.FileScanningService)\n    private readonly fileScanningService: FileScanningBackendService,\n    @inject(SAAS_SERVICE_TYPES.ConsumableTokenService)\n    private readonly consumableTokenService: ConsumableTokenBackendService,\n    @inject(SAAS_SERVICE_TYPES.FileUploadGrantService)\n    private readonly fileUploadGrantService: FileUploadGrantBackendService,\n  ) {\n    this.logDebug = this.logger.debugByType('ResourceFileUploadHandlerBackendService');\n    this.logger.setDebugTypeLogging('ResourceFileUploadHandlerBackendService', false);\n  }\n\n  /**\n   * Extract the resource instance from the request body (if available).\n   * In multipart uploads, the resource data may be present in `req.body`\n   * as parsed form fields.\n   */\n  private extractResourceInstance(req: Request): Record<string, unknown> | undefined {\n    if (req.body && typeof req.body === 'object' && Object.keys(req.body).length > 0) {\n      return req.body as Record<string, unknown>;\n    }\n    return undefined;\n  }\n\n  /**\n   * Handle file upload for resource-integrated file fields.\n   *\n   * @param request - Express request with file in request.file (Multer)\n   * @param response - Express response\n   * @param resourceType - Resource type (e.g., 'todos')\n   * @param fieldName - File field name (e.g., 'attachments')\n   * @param resourceId - Resource ID (undefined for CREATE, string for UPDATE route authorization)\n   * @param operation - Route operation used for authorization; the upload always creates a new File record\n   * @param executionContext - Execution context from request\n   */\n  async handleFileUpload(\n    request: Request,\n    response: Response,\n    resourceType: ResourceType,\n    fieldName: string,\n    resourceId: string | undefined,\n    operation: CoreResourceOperation.CREATE | CoreResourceOperation.UPDATE,\n    executionContext: ExecutionContext<any>\n  ): Promise<void> {\n    // Validate inputs (CRITICAL: Prevents invalid data propagation and security vulnerabilities)\n    validateResourceType(resourceType, this.errorBuilder, executionContext, 'resourceType');\n    validateFieldName(fieldName, this.errorBuilder, executionContext, 'fieldName');\n    if (resourceId !== undefined) {\n      validateResourceId(resourceId, this.errorBuilder, executionContext, 'resourceId');\n    }\n\n    this.logDebug('Handling file upload', {\n      resourceType,\n      fieldName,\n      resourceId,\n      operation,\n      hasFile: !!request.file,\n    });\n\n    // One route, two bodies (#394 P5): a multipart `file` carries bytes; a JSON `remoteReference`\n    // carries a picker's reference to a file that STAYS at a vendor. Dispatched before anything is\n    // read off `request.file`, so a reference never reaches the byte path and a body that is neither\n    // fails as \"no file\" exactly as it did before references existed.\n    const remoteReference = readFileRemoteReferenceLinkRequest(request.body);\n    if (remoteReference.kind === FileRemoteReferenceLinkRead.INVALID) {\n      throw this.errorBuilder.buildError(ErrorType.VALIDATION, executionContext, {\n        customMessageReference: ErrorCustomMessageReference.FILE_REMOTE_REFERENCE_INVALID,\n        context: { resourceType, fieldName, issues: remoteReference.issues },\n      });\n    }\n    if (remoteReference.kind === FileRemoteReferenceLinkRead.PRESENT) {\n      if (request.file) {\n        throw this.errorBuilder.buildError(ErrorType.VALIDATION, executionContext, {\n          customMessageReference: ErrorCustomMessageReference.FILE_REMOTE_REFERENCE_INVALID,\n          context: { resourceType, fieldName, message: 'A request carries EITHER a file part OR a remote reference, not both' },\n        });\n      }\n      await this.handleRemoteReferenceLink(response, resourceType, fieldName, resourceId, operation, executionContext, remoteReference.link);\n      return;\n    }\n\n    let fileRecord: { fileId: string } | undefined;\n    let uploadReachedSuccessState = false;\n    let blobStoredInStorage = false;\n\n    try {\n      // Step 1: Validate file exists in request\n      if (!request.file) {\n        throw this.errorBuilder.buildError(\n          ErrorType.VALIDATION,\n          executionContext,\n          {\n            customMessageReference: ErrorCustomMessageReference.FILE_UPLOAD_NO_FILE,\n            context: {\n              // diagnostic (log-only)\n              resourceType,\n              fieldName,\n            },\n          }\n        );\n      }\n\n      const multerFile = request.file;\n      const maxFileSize = resolveConfiguredMaxFileSize(this.appConfigService.config.storage?.maxFileSize);\n\n      // Validate file metadata (CRITICAL: Prevents invalid file data)\n      validateContentType(multerFile.mimetype, this.errorBuilder, executionContext, 'contentType');\n      validateSize(multerFile.size, maxFileSize, this.errorBuilder, executionContext, 'size');\n\n      // Step 2: Resolve file constraints from resource field schema\n      const constraint = await this.constraintResolver.resolve({\n        resourceType,\n        fieldName,\n      });\n\n      // Step 3: Validate file against constraints\n      const validationResult = await this.fileValidator.validateFile(multerFile, constraint);\n\n      if (!validationResult.success) {\n        throw this.errorBuilder.buildError(\n          ErrorType.VALIDATION,\n          executionContext,\n          {\n            customMessageReference: ErrorCustomMessageReference.VALIDATION,\n            context: {\n              message: 'File validation failed',\n              errors: validationResult.errors,\n              filename: multerFile.originalname,\n              mimeType: multerFile.mimetype,\n              size: multerFile.size,\n            },\n          }\n        );\n      }\n\n      // Step 4: Reject direct uploads to generated file fields FIRST —\n      // before scope derivation. \"This field cannot receive user uploads at\n      // all\" is a more fundamental rejection than \"what scope does the file\n      // belong to\", and must not be masked by a scope-derivation error\n      // (e.g. a missing applicationId) on a field that was never uploadable.\n      const fieldMeta = this.fileFieldDetection.getFileFieldMetadata(resourceType, fieldName);\n      if (fieldMeta?.fileMetadata.generation?.source === FileGenerationSource.PDF_TEMPLATE) {\n        throw this.errorBuilder.buildError(\n          ErrorType.BUSINESS_RULE,\n          executionContext,\n          {\n            customMessageReference: ErrorCustomMessageReference.FILE_GENERATED_FIELD_NOT_WRITABLE,\n            context: {\n              // diagnostic (log-only)\n              resourceType,\n              fieldName,\n            },\n          }\n        );\n      }\n\n      // Step 4b: Derive scope from parent resource's resourcePrimaryScope.\n      const scope = this.deriveScopeFromParentResource(resourceType, executionContext);\n\n      // Step 4c: Resolve storage provider from z_file() metadata.\n      const storageAccepted = fieldMeta?.fileMetadata.storageAccepted;\n      const storageProvider = this.fileStorageRouter.resolveProvider(storageAccepted);\n\n      // Step 4d: a file upload GRANT (issue #312) is claimed HERE — the point of no return. Every check a\n      // caller can act on (no file, wrong type, too large, generated field) has run; nothing has been\n      // written. A refusal above leaves the grant usable for a retry; a race loser is refused by the\n      // atomic consume and writes nothing. This handler is NOT on the services-registry pipeline, so its\n      // post-operation consumption never sees this request — this is the one consumption site.\n      const { grant, uploaderPrincipal } = this.resolveUploaderFromRequest(response, executionContext);\n      await this.consumeUploadGrant(grant, executionContext);\n\n      const createdFile = await this.filesService.createFile(\n        {\n          filename: multerFile.originalname || multerFile.filename,\n          originalFilename: multerFile.originalname,\n          mimeType: multerFile.mimetype,\n          size: multerFile.size,\n          storageProvider: storageProvider.providerId,\n          scope,\n          uploadedBy: uploaderPrincipal?.uploadedBy,\n          uploadedByEntityType: uploaderPrincipal?.uploadedByEntityType,\n        },\n        executionContext\n      );\n\n      fileRecord = { fileId: createdFile.fileId };\n\n      // Step 5b: Resolve upload path options now that we have the fileId.\n      const resourceInstance = this.extractResourceInstance(request);\n      let uploadOptions: StorageUploadOptions | undefined;\n      if (fieldMeta) {\n        uploadOptions = this.pathResolver.resolve(\n          createdFile.fileId,\n          fieldName,\n          fieldMeta.fileMetadata,\n          resolveStorageApplicationIdentity(this.appConfigService),\n          multerFile.originalname,\n          resourceInstance,\n        );\n      }\n\n      // The resource segment of the object key comes from the row that was just created, and is\n      // applied OUTSIDE the `fieldMeta` branch on purpose: a file without field metadata still\n      // belongs to a resource, and keying it as unlinked would place it outside the prefix its\n      // principal is granted once the session policy narrows per resource.\n      //\n      // Derived once, here, at create — the key never moves afterwards, so this is the only\n      // moment the segment can be decided.\n      // Use the handler's OWN `resourceType` parameter, NOT `createdFile.linkedResourceType`.\n      //\n      // `createFile` above is called WITHOUT a linked resource — the row is created unlinked and the\n      // association is written later — so reading the field back off the created record is always\n      // `undefined`, and every upload silently took the `_unlinked/` staging branch. Caught only by\n      // uploading a real file and listing the object store: `tsc` was clean and every unit test\n      // green, because nothing in either exercises the value that reaches the key builder.\n      //\n      // `resourceType` is a parameter of this method and is validated at entry, so it is the\n      // authoritative answer to \"which resource does this blob belong to\" at the only moment the\n      // key can be decided.\n      // `scope` rides along so the key carries `<scope>/<scopeId>` — the same `FileScopeIdentifiers`\n      // already built above for the File row, so the row and the object key agree by construction\n      // rather than by two independent derivations.\n      uploadOptions = { ...uploadOptions, linkedResourceType: resourceType, scope };\n\n      // Step 6: Create stream from disk file (true streaming, no memory buffering)\n      // With disk storage, multerFile.path contains the temp file path\n      if (!multerFile.path) {\n        throw this.errorBuilder.buildError(\n          ErrorType.INTERNAL,\n          executionContext,\n          {\n            customMessageReference: ErrorCustomMessageReference.INTERNAL,\n            context: {\n              message: 'Multer file path is missing (disk storage error)',\n              filename: multerFile.originalname,\n            },\n          }\n        );\n      }\n\n      // Verify file exists before creating stream\n      if (!fs.existsSync(multerFile.path)) {\n        throw this.errorBuilder.buildError(\n          ErrorType.INTERNAL,\n          executionContext,\n          {\n            customMessageReference: ErrorCustomMessageReference.INTERNAL,\n            context: {\n              message: 'Temp file not found on disk',\n              path: multerFile.path,\n              filename: multerFile.originalname,\n            },\n          }\n        );\n      }\n\n      let fileStream: Readable | null = null;\n      let uploadResult: StorageUploadResult | null = null;\n\n      // Step 7: Upload the blob through the resolved storage provider.\n      try {\n        // Create stream from disk file (true streaming, no memory buffering)\n        fileStream = fs.createReadStream(multerFile.path);\n\n        uploadResult = await storageProvider.upload(\n          fileStream,\n          createdFile.fileId,\n          multerFile.mimetype,\n          multerFile.size,\n          executionContext,\n          uploadOptions,\n        );\n        blobStoredInStorage = true;\n\n        this.logDebug('File uploaded to storage successfully', {\n          fileId: createdFile.fileId,\n        });\n      } catch (uploadError) {\n        // If upload fails, mark file as FAILED\n        await this.filesService.updateFileStatus(\n          createdFile.fileId,\n          FileStatus.FAILED,\n          executionContext\n        );\n\n        throw this.errorBuilder.buildError(\n          ErrorType.EXTERNAL_SERVICE,\n          executionContext,\n          {\n            customMessageReference: ErrorCustomMessageReference.EXTERNAL_SERVICE,\n            context: {\n              message: 'Failed to upload file to storage',\n              fileId: createdFile.fileId,\n              error: describeCaughtError(uploadError),\n            },\n          }\n        );\n      } finally {\n        // Clean up temp file (always, even on error)\n        // This ensures temp files are removed even if upload fails or other errors occur\n        if (multerFile.path && fs.existsSync(multerFile.path)) {\n          try {\n            fs.unlinkSync(multerFile.path);\n            this.logDebug('Temp file cleaned up', { path: multerFile.path });\n          } catch (cleanupError) {\n            // Log cleanup error but don't fail operation\n            this.logger.warn('Failed to clean up temp file', {\n              path: multerFile.path,\n              ...projectCaughtErrorLogFields(cleanupError),\n            });\n          }\n        }\n\n        // Also destroy stream if it was created\n        if (fileStream && !fileStream.destroyed) {\n          fileStream.destroy();\n        }\n      }\n\n      // Step 8: Update file status to UPLOADED (with retry logic)\n      // CRITICAL: If updateFileStatus() fails after successful storage upload,\n      // file exists in storage but status remains PENDING in database.\n      // Retry logic handles transient errors (network issues, database locks, etc.)\n      // Decision 5.1: Retry Logic with audit log error (Option A)\n      const maxRetries = 3;\n      const initialDelay = 1000; // 1 second\n\n      let lastError: Error | null = null;\n      let uploadedFile: File | null = null;\n\n      for (let attempt = 0; attempt <= maxRetries; attempt++) {\n        try {\n          uploadedFile = await this.filesService.updateFileStatus(\n            createdFile.fileId,\n            FileStatus.UPLOADED,\n            executionContext,\n            undefined,\n            uploadResult ?? undefined,\n          );\n          break; // Success\n        } catch (error) {\n          lastError = error instanceof Error ? error : new Error(describeCaughtError(error));\n\n          if (attempt < maxRetries) {\n            const delay = initialDelay * Math.pow(2, attempt);\n            this.logger.warn('File status update failed, retrying', {\n              fileId: createdFile.fileId,\n              attempt: attempt + 1,\n              maxRetries,\n              delay,\n              error: lastError.message,\n            });\n            await new Promise(resolve => setTimeout(resolve, delay));\n          } else {\n            // Final attempt failed - audit log and re-throw\n            this.logger.error('File status update failed after all retries', {\n              fileId: createdFile.fileId,\n              attempts: maxRetries + 1,\n              error: lastError.message,\n              // File exists in storage but status remains PENDING in database\n              // This is a data inconsistency that needs manual intervention\n            });\n\n            // If the blob already reached storage but metadata could not commit to\n            // UPLOADED, try to roll the blob back so the row can safely move into\n            // a failed lifecycle path instead of silently pointing at live data.\n            if (blobStoredInStorage && uploadResult) {\n              try {\n                await storageProvider.delete(\n                  {\n                    fileId: createdFile.fileId,\n                    storageProvider: uploadResult.provider,\n                    storageRef: uploadResult.storageRef,\n                  },\n                  executionContext,\n                );\n                blobStoredInStorage = false;\n                if (storageProvider.retainsBytesOnDelete) {\n                  // A vendor storage forgets the reference and keeps the bytes (a person's own\n                  // Drive); saying \"rolled back\" here would record a removal that never happened.\n                  this.logger.warn('Forgot the stored reference after upload status commit failure; the bytes remain at the vendor with no row pointing at them', {\n                    fileId: createdFile.fileId,\n                    storageProvider: uploadResult.provider,\n                    storageRef: uploadResult.storageRef,\n                  });\n                } else {\n                  this.logger.warn('Rolled back stored blob after upload status commit failure', {\n                    fileId: createdFile.fileId,\n                  });\n                }\n              } catch (rollbackError) {\n                if (!isWildoBackendError(rollbackError) || rollbackError.type !== ErrorType.NOT_FOUND) {\n                  this.logger.error('Failed to roll back stored blob after upload status commit failure', {\n                    fileId: createdFile.fileId,\n                    ...projectCaughtErrorLogFields(rollbackError),\n                    originalError: lastError.message,\n                  });\n                } else {\n                  blobStoredInStorage = false;\n                }\n              }\n            }\n\n            // Re-throw to fail the operation\n            throw lastError;\n          }\n        }\n      }\n\n      // Ensure uploadedFile is set (TypeScript safety check)\n      if (!uploadedFile) {\n        throw this.errorBuilder.buildError(\n          ErrorType.INTERNAL,\n          executionContext,\n          {\n            customMessageReference: ErrorCustomMessageReference.INTERNAL,\n            context: {\n              message: 'File status update failed - uploadedFile is null after retries',\n              fileId: createdFile.fileId,\n            },\n          }\n        );\n      }\n\n      /*\n       * Step 9: hold a scanned file NON-DOWNLOADABLE before anyone is told the upload succeeded.\n       *\n       * `initiateScan` awaits the UPLOADED -> SCANNING transition and only then fires the scan\n       * pipeline asynchronously, so awaiting it here costs ONE status write, not the scan. Until\n       * 2026-09-08 this ran AFTER the response, fire-and-forget (#433): the file sat at UPLOADED —\n       * a downloadable status — for the whole gap between the upload committing and the transition\n       * landing, so a field declaring `scanPolicy: 'required'` had a window in which its bytes were\n       * servable unscanned. The control advertised more than it held.\n       *\n       * FAIL-CLOSED, deliberately: this is NOT wrapped in a catch. A scan that cannot be initiated\n       * fails the upload, and because `uploadReachedSuccessState` is still false the catch below\n       * marks the file FAILED. A caught-and-logged failure would leave the row at UPLOADED, which is\n       * exactly the servable state this closes — a scanner outage would silently reopen the window\n       * on every upload. An operator gets a failed upload instead, which is the behaviour a control\n       * named `required` has to have.\n       */\n      const scanIsRequired = this.fileScanningService.shouldScan(fieldMeta?.fileMetadata);\n      let uploadedFileForResponse: File = uploadedFile;\n      if (scanIsRequired) {\n        await this.fileScanningService.initiateScan(uploadedFile.fileId, executionContext);\n        // Re-read so the response reports SCANNING rather than the UPLOADED this row no longer has.\n        // A client polling `GET /files/:fileId/metadata` sees SCANNING either way; reporting\n        // UPLOADED here would make the upload response the one place the two disagree. A null read\n        // keeps the pre-transition row rather than failing an upload that already succeeded.\n        const afterScanInitiation = await this.filesService.getFile(uploadedFile.fileId, executionContext);\n        if (afterScanInitiation) {\n          uploadedFileForResponse = afterScanInitiation;\n        }\n      }\n\n      // Step 9b: Return success response with file metadata\n      const fileMetadata = this.filesService.toMetadataResponse(uploadedFileForResponse);\n      /*\n       * SCANNING counts as reached-success alongside UPLOADED: the upload itself committed, and the\n       * catch below must not roll a scanned file back to FAILED for a later response-layer failure.\n       */\n      uploadReachedSuccessState = uploadedFileForResponse.status === FileStatus.UPLOADED\n        || uploadedFileForResponse.status === FileStatus.SCANNING;\n\n      response.status(200).json({\n        success: true,\n        file: fileMetadata,\n      });\n\n      this.logDebug('File upload completed successfully', {\n        fileId: uploadedFile.fileId,\n        resourceType,\n        fieldName,\n      });\n\n      // Step 10: a redeemed grant records what it produced and is audited. Best-effort by contract —\n      // the upload has succeeded and the response is sent; a failure here is logged, never thrown.\n      if (grant) {\n        this.fileUploadGrantService\n          .recordRedemption(grant, { fileId: uploadedFile.fileId, mimeType: uploadedFile.mimeType, size: uploadedFile.size }, executionContext)\n          .catch((redemptionError) => {\n            this.logger.error('File upload grant: redemption record failed', {\n              grantId: grant.token._id,\n              fileId: uploadedFile!.fileId,\n              ...projectCaughtErrorLogFields(redemptionError),\n            });\n          });\n      }\n\n    } catch (error) {\n      // Only pre-success failures should transition a file to FAILED. Once the\n      // upload already reached UPLOADED, later response-layer failures must not\n      // corrupt the persisted state back to FAILED. Likewise, if the blob still\n      // exists in storage because rollback failed, keep the row out of FAILED so\n      // operators can distinguish that inconsistency from a clean failed upload.\n      const shouldMarkAsFailed = !!fileRecord?.fileId && !uploadReachedSuccessState && !blobStoredInStorage;\n      if (shouldMarkAsFailed) {\n        try {\n          await this.filesService.updateFileStatus(\n            fileRecord.fileId,\n            FileStatus.FAILED,\n            executionContext\n          );\n          this.logDebug('File marked as FAILED due to upload error', {\n            fileId: fileRecord.fileId,\n          });\n        } catch (updateError) {\n          // Log but don't throw - we're already in error handling\n          this.logger.error('Failed to mark file as FAILED', {\n            fileId: fileRecord.fileId,\n            ...projectCaughtErrorLogFields(updateError),\n          });\n        }\n      }\n\n      // Re-throw error to be handled by Express error handler\n      throw error;\n    }\n  }\n\n  /**\n   * Serve (stream) a resource-linked file's bytes for INLINE preview/consumption.\n   *\n   * This is the read counterpart to `handleFileUpload` — the resource-integrated\n   * file **serve** route (`GET .../{res}/:resourceId/files/:fieldName/:fileId`). The\n   * controller has ALREADY authorized the caller against the parent resource's READ\n   * operation before delegating here, so authorization **inherits from the linked\n   * resource** — no consumable token, no public share (those belong to the global\n   * `FileController` for its separate cross-resource/share purpose).\n   *\n   * The one job this method owns is the LINK-OWNERSHIP boundary: the requested\n   * `fileId` MUST be linked to exactly this `{resourceType, resourceId, fieldName}`.\n   * Without it, any caller who can READ a parent record could stream an arbitrary or\n   * cross-resource file id through the route. A mismatch fails closed as NOT_FOUND\n   * (no existence disclosure). `getFile()`'s own scope check is defense-in-depth.\n   *\n   * A `?variant=thumbnail` query asks for a downscaled preview rendition; it is\n   * parsed fail-safe (unknown values → original bytes) and forwarded to the shared\n   * streaming seam, which only transforms eligible raster images.\n   *\n   * @param request - Express request (`:fileId` etc. in params, `?variant=` in query).\n   * @param response - Express response to stream into.\n   * @param next - Express next (forwards pre-header stream errors).\n   * @param resourceType - Parent resource type from the route.\n   * @param fieldName - File field name from the route.\n   * @param resourceId - Parent resource id from the route (authorization target).\n   * @param fileId - The specific file id to serve (must belong to the field above).\n   * @param executionContext - READ execution context built + authorized by the controller.\n   */\n  async handleFileServe(\n    request: Request,\n    response: Response,\n    next: NextFunction,\n    resourceType: ResourceType,\n    fieldName: string,\n    resourceId: string,\n    fileId: string,\n    executionContext: ExecutionContext<any>,\n  ): Promise<void> {\n    validateResourceType(resourceType, this.errorBuilder, executionContext, 'resourceType');\n    validateFieldName(fieldName, this.errorBuilder, executionContext, 'fieldName');\n    validateResourceId(resourceId, this.errorBuilder, executionContext, 'resourceId');\n    validateFileId(fileId, this.errorBuilder, executionContext, 'fileId');\n\n    this.logDebug('Handling file serve', { resourceType, fieldName, resourceId, fileId });\n\n    // getFile applies the file-scope access check (defense-in-depth). Primary authz —\n    // the parent resource READ — was already enforced by the controller.\n    const file = await this.filesService.getFile(fileId, executionContext);\n\n    // SECURITY BOUNDARY: the served file MUST be linked to THIS resource + field.\n    const belongsToRouteResource =\n      !!file &&\n      file.linkedResourceType === resourceType &&\n      String(file.linkedResourceId) === String(resourceId) &&\n      file.linkedFieldName === fieldName;\n\n    if (!belongsToRouteResource) {\n      this.logDebug('File serve denied: file not linked to route resource/field', {\n        fileId,\n        resourceType,\n        resourceId,\n        fieldName,\n        linkedResourceType: file?.linkedResourceType,\n        linkedResourceId: file?.linkedResourceId,\n        linkedFieldName: file?.linkedFieldName,\n      });\n      throw this.errorBuilder.buildError(\n        ErrorType.NOT_FOUND,\n        executionContext,\n        {\n          customMessageReference: ErrorCustomMessageReference.FILE_NOT_FOUND,\n          context: { fileId }, // diagnostic (log-only)\n        },\n      );\n    }\n\n    // STATUS GATE — the same invariant the two GLOBAL file routes already enforce, applied at the\n    // third site that streams bytes.\n    //\n    // It was missing here, and the omission became reachable the moment generated files got serve\n    // routes (2026-08-25): a REGENERATE marks the superseded document `DELETED` while DELIBERATELY\n    // retaining its `linkedResourceType/Id/FieldName`, so the link-ownership boundary above says yes\n    // and the old document kept streaming — measured, 200 with 2,222 bytes. The same hole applies to\n    // an UPLOADED file a privacy erasure marked `DELETED`: physical cleanup is a batch that runs much\n    // later, and until it did, the erased bytes were still served in place.\n    //\n    // Two tiers, mirroring the existing gates rather than inventing a third posture:\n    //  - `FILE_METADATA_WITHHELD_STATUSES` (i.e. `DELETED`, the erasure outcome) → NOT_FOUND, because\n    //    for an erased file, confirming the id still resolves is itself a disclosure (the same\n    //    reasoning as `FileController.assertFileMetadataDisclosable`);\n    //  - anything else outside `FILE_DOWNLOADABLE_STATUSES` (`PENDING`, `SCANNING`, `FAILED`, …) →\n    //    the download route's VALIDATION shape, because such a file genuinely exists and may become\n    //    servable, and an uploader polling a preview needs to be told which.\n    if (FILE_METADATA_WITHHELD_STATUSES.has(file.status)) {\n      this.logDebug('File serve denied: withheld status', { fileId, status: file.status });\n      throw this.errorBuilder.buildError(\n        ErrorType.NOT_FOUND,\n        executionContext,\n        {\n          customMessageReference: ErrorCustomMessageReference.FILE_NOT_FOUND,\n          context: { fileId }, // diagnostic (log-only)\n        },\n      );\n    }\n    if (!FILE_DOWNLOADABLE_STATUSES.has(file.status)) {\n      this.logDebug('File serve denied: non-servable status', { fileId, status: file.status });\n      throw this.errorBuilder.buildError(\n        ErrorType.VALIDATION,\n        executionContext,\n        {\n          customMessageReference: ErrorCustomMessageReference.VALIDATION,\n          context: { message: 'File is not available for download', fileId, status: file.status },\n        },\n      );\n    }\n\n    // `?variant=thumbnail` → downscaled preview rendition (raster images only; the\n    // streaming seam falls back to original bytes for anything else). Fail-safe parse.\n    const variant = parseFileServeVariant(request.query.variant);\n\n    await this.filesService.streamFileToResponse(file, response, executionContext, {\n      disposition: 'inline',\n      next,\n      variant,\n    });\n  }\n\n  /**\n   * Derive file scope from parent resource's resourcePrimaryScope.\n   *\n   * Scope derivation rules:\n   * - APPLICATION: sets applicationId from execution context\n   * - ORGANIZATIONS: sets organizationId from execution context\n   * - USER_SELF: sets userId + applicationId from execution context (no org — separate scope axis)\n   *\n   * @param resourceType - Parent resource type\n   * @param executionContext - Execution context for scope values\n   * @returns FileScopeIdentifiers derived from parent resource\n   */\n  /**\n   * The point of no return for a file upload GRANT (issue #312): every check a caller can act on has\n   * run and nothing has been written. A refusal before this leaves the grant usable for a retry; a\n   * race loser is refused by the atomic consume and writes nothing. This handler is NOT on the\n   * services-registry pipeline, so its post-operation consumption never sees this request — this is\n   * the one consumption site, for bytes and for references alike.\n   */\n  private async consumeUploadGrant(grant: NonNullable<FileUploadRouteGrantLocals['fileUploadGrant']> | undefined, executionContext: ExecutionContext<any>): Promise<void> {\n    if (!grant) return;\n    await this.consumableTokenService.consumeToken(executionContext.consumableTokenValue!);\n    executionContext.markConsumableTokenConsumed();\n  }\n\n  /**\n   * Who the file is attributed to. Under a grant that is the MINTER — the person or machine that\n   * delegated the upload — never the grant. A user-minted grant already yields that through the token\n   * context (`resolveFileUploaderPrincipal`, CONSUMABLE_TOKEN case); a machine-minted one yields\n   * nothing there, so the grant's own `minter` record is used. Both agree with createFile's mismatch\n   * guard. Consuming the grant is a separate step, because a REFERENCE is verified at the vendor AS\n   * this principal before the grant may be spent on it.\n   */\n  private resolveUploaderFromRequest(\n    response: Response,\n    executionContext: ExecutionContext<any>,\n  ): { grant: NonNullable<FileUploadRouteGrantLocals['fileUploadGrant']> | undefined; uploaderPrincipal: FileUploaderPrincipal | undefined } {\n    const grant = (response.locals as FileUploadRouteGrantLocals | undefined)?.fileUploadGrant;\n    const uploaderPrincipal = grant\n      ? this.fileUploadGrantService.resolveUploaderFromGrant(grant.metadata)\n      : resolveFileUploaderPrincipal(executionContext);\n    if (uploaderPrincipal) {\n      validateUploadedBy(uploaderPrincipal.uploadedBy, this.errorBuilder, executionContext, 'uploadedBy');\n      validateUploadedByEntityType(\n        uploaderPrincipal.uploadedByEntityType,\n        this.errorBuilder,\n        executionContext,\n        'uploadedByEntityType',\n      );\n    }\n    return { grant, uploaderPrincipal };\n  }\n\n  /**\n   * Link a file that stays at a vendor into this field (#394 P5): a picker's `REMOTE_REFERENCE`\n   * becomes a FILES row in the vendor's storage, with no bytes ever transiting this process.\n   *\n   * The order is the same as a byte upload's, with the vendor standing in for the multer file: the\n   * reference is resolved to a storage by the provider it names, refused unless the FIELD accepts\n   * that storage, DESCRIBED at the vendor as the linking person (which is what proves it real and\n   * readable), held to the field's constraints, and only then does a row exist — PENDING, then\n   * UPLOADED with the reference as its `storageRef`. A row that fails between the two is marked\n   * FAILED like an upload's would be.\n   */\n  private async handleRemoteReferenceLink(\n    response: Response,\n    resourceType: ResourceType,\n    fieldName: string,\n    resourceId: string | undefined,\n    operation: CoreResourceOperation.CREATE | CoreResourceOperation.UPDATE,\n    executionContext: ExecutionContext<any>,\n    link: FileRemoteReferenceLink,\n  ): Promise<void> {\n    this.logDebug('Handling remote reference link', { resourceType, fieldName, resourceId, operation, providerRef: link.providerRef });\n\n    const fieldMeta = this.fileFieldDetection.getFileFieldMetadata(resourceType, fieldName);\n    if (fieldMeta?.fileMetadata.generation?.source === FileGenerationSource.PDF_TEMPLATE) {\n      throw this.errorBuilder.buildError(ErrorType.BUSINESS_RULE, executionContext, {\n        customMessageReference: ErrorCustomMessageReference.FILE_GENERATED_FIELD_NOT_WRITABLE,\n        context: { resourceType, fieldName },\n      });\n    }\n\n    const storageProvider = this.fileStorageRouter.resolveProviderForConnectedProvider(link.providerRef);\n    if (storageProvider === undefined || storageProvider.describeRemoteReference === undefined) {\n      throw this.errorBuilder.buildError(ErrorType.VALIDATION, executionContext, {\n        customMessageReference: ErrorCustomMessageReference.FILE_REMOTE_REFERENCE_PROVIDER_UNKNOWN,\n        context: { resourceType, fieldName, providerRef: link.providerRef },\n      });\n    }\n    const storageAccepted = fieldMeta?.fileMetadata.storageAccepted ?? [];\n    if (!storageAccepted.includes(storageProvider.providerId)) {\n      // The chooser filters on the same declaration, so a client that reaches this typed the\n      // request itself — refused rather than routed to the field's default storage, because a\n      // reference has no bytes to put there.\n      throw this.errorBuilder.buildError(ErrorType.VALIDATION, executionContext, {\n        customMessageReference: ErrorCustomMessageReference.FILE_REMOTE_REFERENCE_STORAGE_NOT_ACCEPTED,\n        context: { resourceType, fieldName, providerRef: link.providerRef, storage: storageProvider.providerId, storageAccepted },\n      });\n    }\n    if (!storageProvider.isConfigured()) {\n      throw this.errorBuilder.buildError(ErrorType.CONFIGURATION, executionContext, {\n        customMessageReference: ErrorCustomMessageReference.CONFIGURATION,\n        context: { message: `Storage '${storageProvider.providerId}' is registered but not configured for this application`, providerRef: link.providerRef },\n      });\n    }\n\n    const scope = this.deriveScopeFromParentResource(resourceType, executionContext);\n    const { grant, uploaderPrincipal } = this.resolveUploaderFromRequest(response, executionContext);\n\n    const constraint = await this.constraintResolver.resolve({ resourceType, fieldName });\n    const maxFileSize = resolveConfiguredMaxFileSize(this.appConfigService.config.storage?.maxFileSize);\n    // What the PICKER showed, checked before a vendor round trip: a client's facts cannot admit a\n    // file, but they can refuse one early — a 2 GB pick fails here, at no cost, rather than after\n    // the vendor confirmed it is 2 GB. The vendor's facts below decide; these only short-circuit.\n    if (link.sizeBytes !== undefined || link.mimeType !== undefined) {\n      const claimedViolations = collectRemoteReferenceConstraintViolations(\n        { ...constraint, maxSize: Math.min(constraint.maxSize, maxFileSize) },\n        { contentType: link.mimeType, size: link.sizeBytes },\n      );\n      if (claimedViolations.length > 0) {\n        throw this.errorBuilder.buildError(ErrorType.VALIDATION, executionContext, {\n          customMessageReference: ErrorCustomMessageReference.VALIDATION,\n          context: { message: 'File validation failed', errors: claimedViolations, filename: link.displayName, mimeType: link.mimeType, size: link.sizeBytes },\n        });\n      }\n    }\n\n    const description = await storageProvider.describeRemoteReference(link.externalId, uploaderPrincipal ?? {}, executionContext);\n    validateContentType(description.contentType, this.errorBuilder, executionContext, 'contentType');\n    validateSize(description.size, maxFileSize, this.errorBuilder, executionContext, 'size');\n    const violations = collectRemoteReferenceConstraintViolations(constraint, description);\n    if (violations.length > 0) {\n      throw this.errorBuilder.buildError(ErrorType.VALIDATION, executionContext, {\n        customMessageReference: ErrorCustomMessageReference.VALIDATION,\n        context: { message: 'File validation failed', errors: violations, filename: description.name, mimeType: description.contentType, size: description.size },\n      });\n    }\n\n    await this.consumeUploadGrant(grant, executionContext);\n\n    let fileRecord: { fileId: string } | undefined;\n    // Set once the row is committed (UPLOADED, or SCANNING after a required scan): from then on a\n    // failure is the RESPONSE's, and the catch below must not roll a committed row to FAILED —\n    // the same guard the byte path holds as `uploadReachedSuccessState`.\n    let linkReachedSuccessState = false;\n    try {\n      const createdFile = await this.filesService.createFile(\n        {\n          filename: description.name,\n          originalFilename: link.displayName ?? description.name,\n          mimeType: description.contentType,\n          size: description.size,\n          checksum: description.etag,\n          storageProvider: storageProvider.providerId,\n          scope,\n          uploadedBy: uploaderPrincipal?.uploadedBy,\n          uploadedByEntityType: uploaderPrincipal?.uploadedByEntityType,\n        },\n        executionContext,\n      );\n      fileRecord = { fileId: createdFile.fileId };\n\n      let linkedFile = await this.filesService.updateFileStatus(\n        createdFile.fileId,\n        FileStatus.UPLOADED,\n        executionContext,\n        undefined,\n        { storageRef: link.externalId, provider: storageProvider.providerId },\n      );\n\n      // The same scan control the byte path holds, FAIL-CLOSED for the same reason: a linked\n      // file is servable the moment it is UPLOADED, and a field whose policy is `required` — or\n      // an application with a scanner configured — must not get a servable, unscanned row through\n      // the side door a reference opens. The scanner downloads through the storage as the linker\n      // (`downloadParams` carries `uploadedBy`), so a Drive file scans like any other.\n      if (this.fileScanningService.shouldScan(fieldMeta?.fileMetadata)) {\n        await this.fileScanningService.initiateScan(linkedFile.fileId, executionContext);\n        const afterScanInitiation = await this.filesService.getFile(linkedFile.fileId, executionContext);\n        if (afterScanInitiation) linkedFile = afterScanInitiation;\n      }\n      linkReachedSuccessState = linkedFile.status === FileStatus.UPLOADED || linkedFile.status === FileStatus.SCANNING;\n\n      response.status(200).json({\n        success: true,\n        file: this.filesService.toMetadataResponse(linkedFile),\n      });\n      this.logDebug('Remote reference linked', { fileId: linkedFile.fileId, resourceType, fieldName, storage: storageProvider.providerId });\n\n      if (grant) {\n        this.fileUploadGrantService\n          .recordRedemption(grant, { fileId: linkedFile.fileId, mimeType: linkedFile.mimeType, size: linkedFile.size }, executionContext)\n          .catch((redemptionError) => {\n            this.logger.error('File upload grant: redemption record failed', {\n              grantId: grant.token._id,\n              fileId: linkedFile.fileId,\n              ...projectCaughtErrorLogFields(redemptionError),\n            });\n          });\n      }\n    } catch (error) {\n      if (fileRecord && !linkReachedSuccessState) {\n        try {\n          await this.filesService.updateFileStatus(fileRecord.fileId, FileStatus.FAILED, executionContext);\n        } catch (updateError) {\n          this.logger.error('Failed to mark linked file as FAILED', { fileId: fileRecord.fileId, ...projectCaughtErrorLogFields(updateError) });\n        }\n      }\n      throw error;\n    }\n  }\n\n  private deriveScopeFromParentResource(\n    resourceType: ResourceType,\n    executionContext: ExecutionContext<any>\n  ): FileScopeIdentifiers {\n    // Get parent resource configuration to find its primaryScope\n    const resourceConfig = this.resourcesRegistry.getResourceConfiguration(resourceType);\n\n    // Get primaryScope from resource configuration\n    // Default to ORGANIZATIONS if not specified\n    const primaryScope = resourceConfig?.resourcePrimaryScope || ResourcePrimaryScope.ORGANIZATIONS;\n\n    // Extract scope identifiers from execution context\n    const organizationId = this.resourceOperationHelper.getInitiatorId(executionContext, 'organization');\n    const userId = this.resourceOperationHelper.getInitiatorId(executionContext, 'user');\n    // Fall back to the app config's applicationId when the execution context\n    // doesn't carry one — same pattern this handler already uses for the path\n    // binding above. There is exactly one application per backend, so\n    // `appConfigService.applicationId` is the correct anchor when an internal\n    // EC was built without a populated `applicationId`.\n    const applicationId = executionContext.applicationId || this.appConfigService.applicationId;\n\n    switch (primaryScope) {\n      case ResourcePrimaryScope.APPLICATION:\n        if (!applicationId) {\n          throw this.errorBuilder.buildError(\n            ErrorType.VALIDATION,\n            executionContext,\n            {\n              customMessageReference: ErrorCustomMessageReference.FILE_SCOPE_IDENTIFIER_MISSING,\n              context: {\n                resourceType, // diagnostic (log-only)\n              },\n            }\n          );\n        }\n        return {\n          primaryScope: ResourcePrimaryScope.APPLICATION,\n          applicationId,\n        };\n\n      case ResourcePrimaryScope.ORGANIZATIONS:\n        if (!organizationId) {\n          throw this.errorBuilder.buildError(\n            ErrorType.VALIDATION,\n            executionContext,\n            {\n              customMessageReference: ErrorCustomMessageReference.FILE_SCOPE_IDENTIFIER_MISSING,\n              context: {\n                resourceType, // diagnostic (log-only)\n              },\n            }\n          );\n        }\n        if (!applicationId) {\n          throw this.errorBuilder.buildError(\n            ErrorType.VALIDATION,\n            executionContext,\n            {\n              customMessageReference: ErrorCustomMessageReference.FILE_SCOPE_IDENTIFIER_MISSING,\n              context: {\n                resourceType, // diagnostic (log-only)\n              },\n            }\n          );\n        }\n        return {\n          primaryScope: ResourcePrimaryScope.ORGANIZATIONS,\n          applicationId,\n          organizationId,\n        };\n\n      case ResourcePrimaryScope.USER_SELF:\n        // USER_SELF and ORGANIZATIONS are independent primary-scope axes (separation of\n        // concern): a self-owned file is owned by the USER, never by an org. Require the\n        // user (owner) + applicationId (tenant/bucket anchor); do NOT read or persist an\n        // organizationId here — a self-profile carries no org context.\n        if (!userId) {\n          throw this.errorBuilder.buildError(\n            ErrorType.VALIDATION,\n            executionContext,\n            {\n              customMessageReference: ErrorCustomMessageReference.FILE_SCOPE_IDENTIFIER_MISSING,\n              context: {\n                resourceType, // diagnostic (log-only)\n              },\n            }\n          );\n        }\n        if (!applicationId) {\n          throw this.errorBuilder.buildError(\n            ErrorType.VALIDATION,\n            executionContext,\n            {\n              customMessageReference: ErrorCustomMessageReference.FILE_SCOPE_IDENTIFIER_MISSING,\n              context: {\n                resourceType, // diagnostic (log-only)\n              },\n            }\n          );\n        }\n        return {\n          primaryScope: ResourcePrimaryScope.USER_SELF,\n          applicationId,\n          userId,\n        };\n\n      default:\n        throw this.errorBuilder.buildError(\n          ErrorType.CONFIGURATION,\n          executionContext,\n          {\n            customMessageReference: ErrorCustomMessageReference.CONFIGURATION,\n            context: {\n              message: 'File uploads only support APPLICATION, ORGANIZATIONS, and USER_SELF resource scopes',\n              resourceType,\n              primaryScope,\n            },\n          }\n        );\n    }\n  }\n}\n\n/**\n * The field's constraints applied to what the VENDOR says about a file — the same three checks the\n * multer-file validator runs on bytes, on metadata instead. Extension-vs-MIME is not among them: a\n * reference carries the vendor's MIME type as fact, and there is no local file to sniff.\n */\nexport function collectRemoteReferenceConstraintViolations(\n  constraint: FileConstraint,\n  description: Partial<Pick<StorageRemoteFileDescription, 'contentType' | 'size'>>,\n): string[] {\n  // Each axis is checked only when the description CARRIES it: a client that claimed a MIME type\n  // and no size has not claimed a size of zero, and a `minSize` field must not refuse it before\n  // the vendor answers. The vendor's description carries both and is checked on both.\n  const violations: string[] = [];\n  if (description.contentType !== undefined && constraint.allowedMimeTypes !== undefined && constraint.allowedMimeTypes.length > 0 && !constraint.allowedMimeTypes.includes(description.contentType)) {\n    violations.push(`File type '${description.contentType}' is not allowed. Allowed types: ${constraint.allowedMimeTypes.join(', ')}`);\n  }\n  if (description.size !== undefined && constraint.maxSize !== undefined && description.size > constraint.maxSize) {\n    violations.push(`File size ${description.size} exceeds the maximum of ${constraint.maxSize} bytes`);\n  }\n  if (description.size !== undefined && constraint.minSize !== undefined && description.size < constraint.minSize) {\n    violations.push(`File size ${description.size} is below the minimum of ${constraint.minSize} bytes`);\n  }\n  return violations;\n}\n"]}

package/dist/esm/files/scanning/clamav-scanner.backend.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"clamav-scanner.backend.service.d.ts","sourceRoot":"","sources":["../../../../../src/files/scanning/clamav-scanner.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAGH,OAAO,EAAE,QAAQ,EAAE,MAAM,QAAQ,CAAC;AAGlC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAClG,OAAO,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AAC/G,OAAO,EAEL,KAAK,cAAc,EACpB,MAAM,mDAAmD,CAAC;AAK3D,qBACa,2BAA2B;IAKpC,OAAO,CAAC,QAAQ,CAAC,MAAM;IAEvB,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IANnC,SAAS,CAAC,QAAQ,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;gBAI9D,MAAM,EAAE,aAAa,EAErB,gBAAgB,EAAE,uBAAuB;IAK5D;;;;;;;OAOG;IACH,YAAY,IAAI,OAAO;IAIvB;;;;OAIG;IACH,OAAO,CAAC,mBAAmB;IAK3B;;OAEG;IACG,IAAI,IAAI,OAAO,CAAC,OAAO,CAAC;IAyB9B;;;;;;OAMG;IACG,UAAU,CAAC,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC;IA+E/E;;;;;;;OAOG;IACH,OAAO,CAAC,aAAa;CA+BtB"}
+{"version":3,"file":"clamav-scanner.backend.service.d.ts","sourceRoot":"","sources":["../../../../src/files/scanning/clamav-scanner.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAGH,OAAO,EAAE,QAAQ,EAAE,MAAM,QAAQ,CAAC;AAGlC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAClG,OAAO,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AAC/G,OAAO,EAEL,KAAK,cAAc,EACpB,MAAM,mDAAmD,CAAC;AAK3D,qBACa,2BAA2B;IAKpC,OAAO,CAAC,QAAQ,CAAC,MAAM;IAEvB,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IANnC,SAAS,CAAC,QAAQ,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;gBAI9D,MAAM,EAAE,aAAa,EAErB,gBAAgB,EAAE,uBAAuB;IAK5D;;;;;;;OAOG;IACH,YAAY,IAAI,OAAO;IAIvB;;;;OAIG;IACH,OAAO,CAAC,mBAAmB;IAK3B;;OAEG;IACG,IAAI,IAAI,OAAO,CAAC,OAAO,CAAC;IAyB9B;;;;;;OAMG;IACG,UAAU,CAAC,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC;IA+E/E;;;;;;;OAOG;IACH,OAAO,CAAC,aAAa;CA+BtB"}

package/dist/esm/files/scanning/file-scan.types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"file-scan.types.d.ts","sourceRoot":"","sources":["../../../../../src/files/scanning/file-scan.types.ts"],"names":[],"mappings":"AAAA,oBAAY,eAAe;IACzB,KAAK,UAAU;IACf,QAAQ,aAAa;IACrB,KAAK,UAAU;CAChB;AAED,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,eAAe,CAAC;IACzB,mEAAmE;IACnE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,wDAAwD;IACxD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,oCAAoC;IACpC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,0CAA0C;IAC1C,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB"}
+{"version":3,"file":"file-scan.types.d.ts","sourceRoot":"","sources":["../../../../src/files/scanning/file-scan.types.ts"],"names":[],"mappings":"AAAA,oBAAY,eAAe;IACzB,KAAK,UAAU;IACf,QAAQ,aAAa;IACrB,KAAK,UAAU;CAChB;AAED,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,eAAe,CAAC;IACzB,mEAAmE;IACnE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,wDAAwD;IACxD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,oCAAoC;IACpC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,0CAA0C;IAC1C,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB"}

package/dist/esm/files/scanning/yara-scanner.backend.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"yara-scanner.backend.service.d.ts","sourceRoot":"","sources":["../../../../../src/files/scanning/yara-scanner.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAGH,OAAO,EAAE,QAAQ,EAAE,MAAM,QAAQ,CAAC;AAElC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAClG,OAAO,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AAE/G,OAAO,EAEL,KAAK,cAAc,EACpB,MAAM,mDAAmD,CAAC;AAK3D,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC9B;AAED,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,OAAO,GAAG,UAAU,GAAG,OAAO,CAAC;IACxC,OAAO,EAAE,SAAS,EAAE,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,qBACa,yBAAyB;IAKlC,OAAO,CAAC,QAAQ,CAAC,MAAM;IAEvB,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IANnC,SAAS,CAAC,QAAQ,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;gBAI9D,MAAM,EAAE,aAAa,EAErB,gBAAgB,EAAE,uBAAuB;IAK5D;;;;;OAKG;IACH,mBAAmB,IAAI,OAAO;IAI9B,YAAY,IAAI,OAAO;IAIvB,SAAS,IAAI,OAAO;IAIpB,OAAO,CAAC,OAAO;IAIf,qGAAqG;IACrG,OAAO,CAAC,OAAO;IAIf,OAAO,CAAC,UAAU;IAIlB;;OAEG;IACG,IAAI,IAAI,OAAO,CAAC,OAAO,CAAC;IAa9B;;;OAGG;IACG,WAAW,IAAI,OAAO,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAQnE;;;;;OAKG;IACG,UAAU,CAAC,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC;CAuFhF"}
+{"version":3,"file":"yara-scanner.backend.service.d.ts","sourceRoot":"","sources":["../../../../src/files/scanning/yara-scanner.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAGH,OAAO,EAAE,QAAQ,EAAE,MAAM,QAAQ,CAAC;AAElC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAClG,OAAO,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AAE/G,OAAO,EAEL,KAAK,cAAc,EACpB,MAAM,mDAAmD,CAAC;AAyB3D,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC9B;AAED,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,OAAO,GAAG,UAAU,GAAG,OAAO,CAAC;IACxC,OAAO,EAAE,SAAS,EAAE,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,qBACa,yBAAyB;IAKlC,OAAO,CAAC,QAAQ,CAAC,MAAM;IAEvB,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IANnC,SAAS,CAAC,QAAQ,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;gBAI9D,MAAM,EAAE,aAAa,EAErB,gBAAgB,EAAE,uBAAuB;IAK5D;;;;;OAKG;IACH,mBAAmB,IAAI,OAAO;IAI9B,YAAY,IAAI,OAAO;IAIvB,SAAS,IAAI,OAAO;IAIpB,OAAO,CAAC,OAAO;IAIf,qGAAqG;IACrG,OAAO,CAAC,OAAO;IAIf,OAAO,CAAC,UAAU;IAIlB;;OAEG;IACG,IAAI,IAAI,OAAO,CAAC,OAAO,CAAC;IAa9B;;;OAGG;IACG,WAAW,IAAI,OAAO,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAQnE;;;;;OAKG;IACG,UAAU,CAAC,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC;CAuFhF"}

package/dist/esm/files/scanning/yara-scanner.backend.service.js

@@ -38,7 +38,25 @@ import { AppConfigurationService } from '../../config/services/app-configuration
 import { describeCaughtError } from '../../errors/utils/error-log-level-classification.backend.utils.js';
 import { FileScanVerdict, } from '../../files/scanning/file-scan.types.js';
 const YARA_DEFAULT_PORT = 8080;
+/**
+ * One SCAN. 60s because the file is buffered into memory and matched against the full rule set,
+ * and because a scan is the operation this service exists to perform — timing it out is a scan
+ * that did not happen.
+ */
 const YARA_TIMEOUT_MS = 60_000;
+/**
+ * The HEALTH probe. 5s, and deliberately the shortest of the three: `ping()` answers `false` on
+ * any failure, so its whole job is to decide quickly whether the scanner is there. A probe that
+ * waits as long as the work it is probing for tells you nothing you could not have learned by
+ * doing the work.
+ */
+const YARA_PING_TIMEOUT_MS = 5_000;
+/**
+ * A rule RELOAD. 10s: the service re-reads rules from a volume mount and recompiles them, which is
+ * more than a health check and far less than a scan — and it is an operator-triggered action, so a
+ * bound that is too tight reports a failure for an operation that in fact succeeded.
+ */
+const YARA_RELOAD_TIMEOUT_MS = 10_000;
 let YaraScannerBackendService = class YaraScannerBackendService {
     logger;
     appConfigService;
@@ -79,7 +97,7 @@ let YaraScannerBackendService = class YaraScannerBackendService {
     async ping() {
         try {
             const response = await fetch(`${this.getBaseUrl()}/health`, {
-                signal: AbortSignal.timeout(5000),
+                signal: AbortSignal.timeout(YARA_PING_TIMEOUT_MS),
             });
             if (!response.ok)
                 return false;
@@ -97,7 +115,7 @@ let YaraScannerBackendService = class YaraScannerBackendService {
     async reloadRules() {
         const response = await fetch(`${this.getBaseUrl()}/reload`, {
             method: 'POST',
-            signal: AbortSignal.timeout(10_000),
+            signal: AbortSignal.timeout(YARA_RELOAD_TIMEOUT_MS),
         });
         return await response.json();
     }

package/dist/esm/files/scanning/yara-scanner.backend.service.js.map

@@ -1 +1 @@
-{"version":3,"file":"yara-scanner.backend.service.js","sourceRoot":"","sources":["../../../../../src/files/scanning/yara-scanner.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;;;;;;;;;;;;;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAE/C,OAAO,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AAEpF,OAAO,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AAC/G,OAAO,EAAE,mBAAmB,EAAE,MAAM,8EAA8E,CAAC;AACnH,OAAO,EACL,eAAe,GAEhB,MAAM,mDAAmD,CAAC;AAE3D,MAAM,iBAAiB,GAAG,IAAI,CAAC;AAC/B,MAAM,eAAe,GAAG,MAAM,CAAC;AAkBxB,IAAM,yBAAyB,GAA/B,MAAM,yBAAyB;IAKjB;IAEA;IANT,QAAQ,CAA+D;IAEjF,YAEmB,MAAqB,EAErB,gBAAyC;QAFzC,WAAM,GAAN,MAAM,CAAe;QAErB,qBAAgB,GAAhB,gBAAgB,CAAyB;QAE1D,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,2BAA2B,CAAC,CAAC;IACvE,CAAC;IAED;;;;;OAKG;IACH,mBAAmB;QACjB,OAAO,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,YAAY,EAAE,IAAI,EAAE,OAAO,KAAK,IAAI,CAAC;IAC3E,CAAC;IAED,YAAY;QACV,OAAO,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;IAC1B,CAAC;IAED,SAAS;QACP,OAAO,IAAI,CAAC,mBAAmB,EAAE,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;IAC3D,CAAC;IAEO,OAAO;QACb,OAAO,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,YAAY,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC;IAC3E,CAAC;IAED,qGAAqG;IAC7F,OAAO;QACb,OAAO,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,YAAY,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,IAAI,iBAAiB,CAAC;IAChG,CAAC;IAEO,UAAU;QAChB,OAAO,UAAU,IAAI,CAAC,OAAO,EAAE,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC;IACtD,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,IAAI;QACR,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,CAAC,UAAU,EAAE,SAAS,EAAE;gBAC1D,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC;aAClC,CAAC,CAAC;YACH,IAAI,CAAC,QAAQ,CAAC,EAAE;gBAAE,OAAO,KAAK,CAAC;YAC/B,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAwB,CAAC;YACzD,OAAO,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC;QAC9B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,WAAW;QACf,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,CAAC,UAAU,EAAE,SAAS,EAAE;YAC1D,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;SACpC,CAAC,CAAC;QACH,OAAO,MAAM,QAAQ,CAAC,IAAI,EAA2C,CAAC;IACxE,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,UAAU,CAAC,UAAoB,EAAE,MAAc;QACnD,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,CAAC;YACtB,OAAO,EAAE,OAAO,EAAE,eAAe,CAAC,KAAK,EAAE,UAAU,EAAE,eAAe,EAAE,CAAC;QACzE,CAAC;QAED,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAE7B,IAAI,CAAC,QAAQ,CAAC,oBAAoB,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QAEhD,IAAI,CAAC;YACH,MAAM,MAAM,GAAa,EAAE,CAAC;YAC5B,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,UAAU,EAAE,CAAC;gBACrC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;YACnE,CAAC;YACD,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAEzC,MAAM,QAAQ,GAAG,IAAI,QAAQ,EAAE,CAAC;YAChC,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,CAAC,UAAU,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;YAExD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,CAAC,UAAU,EAAE,OAAO,EAAE;gBACxD,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,QAAQ;gBACd,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,eAAe,CAAC;aAC7C,CAAC,CAAC;YAEH,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAsB,CAAC;YACvD,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;YAE1C,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,IAAI,CAAC,OAAO,KAAK,OAAO,EAAE,CAAC;gBAC7C,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,6BAA6B,EAAE;oBAC/C,MAAM;oBACN,MAAM,EAAE,QAAQ,CAAC,MAAM;oBACvB,KAAK,EAAE,IAAI,CAAC,KAAK;iBAClB,CAAC,CAAC;gBACH,OAAO;oBACL,OAAO,EAAE,eAAe,CAAC,KAAK;oBAC9B,YAAY,EAAE,IAAI,CAAC,KAAK,IAAI,qBAAqB,QAAQ,CAAC,MAAM,EAAE;oBAClE,UAAU,EAAE,MAAM;oBAClB,UAAU;iBACX,CAAC;YACJ,CAAC;YAED,IAAI,IAAI,CAAC,OAAO,KAAK,UAAU,EAAE,CAAC;gBAChC,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;gBAClD,MAAM,UAAU,GAAG,SAAS,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBAEnD,IAAI,CAAC,QAAQ,CAAC,oBAAoB,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC,CAAC;gBAE9E,OAAO;oBACL,OAAO,EAAE,eAAe,CAAC,QAAQ;oBACjC,UAAU;oBACV,UAAU,EAAE,MAAM;oBAClB,UAAU;iBACX,CAAC;YACJ,CAAC;YAED,IAAI,CAAC,QAAQ,CAAC,iBAAiB,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;YAEzD,OAAO;gBACL,OAAO,EAAE,eAAe,CAAC,KAAK;gBAC9B,UAAU,EAAE,MAAM;gBAClB,UAAU;aACX,CAAC;QAEJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;YAC1C,MAAM,OAAO,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAC;YAE3C,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC7D,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,qBAAqB,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;gBACjE,OAAO;oBACL,OAAO,EAAE,eAAe,CAAC,KAAK;oBAC9B,YAAY,EAAE,qBAAqB;oBACnC,UAAU,EAAE,MAAM;oBAClB,UAAU;iBACX,CAAC;YACJ,CAAC;YAED,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,kBAAkB,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;YAClE,OAAO;gBACL,OAAO,EAAE,eAAe,CAAC,KAAK;gBAC9B,YAAY,EAAE,oBAAoB,OAAO,EAAE;gBAC3C,UAAU,EAAE,MAAM;gBAClB,UAAU;aACX,CAAC;QACJ,CAAC;IACH,CAAC;CACF,CAAA;AApKY,yBAAyB;IADrC,UAAU,EAAE;IAKR,WAAA,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAA;IAEjC,WAAA,MAAM,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,CAAA;+CACT,uBAAuB;GAPjD,yBAAyB,CAoKrC","sourcesContent":["/**\n * YARA Scanner Backend Service\n *\n * Optional pattern-matching scanning layer that runs on top of ClamAV.\n * Uses YARA rules to detect threats that signature-based AV might miss:\n * - Executable payloads hidden in document uploads\n * - Suspicious scripts (JS, VBS, PowerShell) embedded in files\n * - Macro-enabled Office documents\n * - Archive bombs / decompression exploits\n * - Webshells and server-side code injection\n *\n * Architecture:\n * - YARA runs as a separate Docker service with a REST API wrapper\n * - The backend sends files via multipart/form-data POST to /scan\n * - Rules are volume-mounted into the YARA container (bundled + custom)\n * - Platform-level: enabled via `YARA_ENABLED=true`, not per z_file()\n *\n * Configured through `fileScanning.yara` in resolved application configuration,\n * which the configuration loader seeds from `YARA_ENABLED` / `YARA_HOST` /\n * `YARA_PORT`. The service reads configuration, never the environment — see\n * `.claude/plans/application-runtime-topology-delivery.md`.\n */\n\nimport { injectable, inject } from 'inversify';\nimport { Readable } from 'stream';\nimport { SAAS_SERVICE_TYPES } from '~wildo-backend-lib/inject/models/service-types';\nimport type { LoggerService } from '~wildo-backend-lib/monitoring/logger/services/logger.service';\nimport { AppConfigurationService } from '~wildo-backend-lib/config/services/app-configuration.backend.service';\nimport { describeCaughtError } from '~wildo-backend-lib/errors/utils/error-log-level-classification.backend.utils';\nimport {\n  FileScanVerdict,\n  type FileScanResult,\n} from '~wildo-backend-lib/files/scanning/file-scan.types';\n\nconst YARA_DEFAULT_PORT = 8080;\nconst YARA_TIMEOUT_MS = 60_000;\n\nexport interface YaraMatch {\n  rule: string;\n  namespace: string;\n  tags: string[];\n  meta: Record<string, string>;\n}\n\nexport interface YaraScanResponse {\n  verdict: 'clean' | 'infected' | 'error';\n  matches: YaraMatch[];\n  durationMs?: number;\n  error?: string;\n  note?: string;\n}\n\n@injectable()\nexport class YaraScannerBackendService {\n  protected logDebug: (message: string, context?: Record<string, unknown>) => void;\n\n  constructor(\n    @inject(SAAS_SERVICE_TYPES.Logger)\n    private readonly logger: LoggerService,\n    @inject(SAAS_SERVICE_TYPES.AppConfigService)\n    private readonly appConfigService: AppConfigurationService,\n  ) {\n    this.logDebug = this.logger.debugByType('YaraScannerBackendService');\n  }\n\n  /**\n   * Whether YARA scanning is opted into, INDEPENDENTLY of whether a sidecar is\n   * reachable. The two axes stay separate because the startup config validator\n   * reports \"explicitly enabled but not configured\" as its own issue — collapsing\n   * them would turn that misconfiguration into a silent \"scanning is off\".\n   */\n  isExplicitlyEnabled(): boolean {\n    return this.appConfigService.config.fileScanning?.yara?.enabled === true;\n  }\n\n  isConfigured(): boolean {\n    return !!this.getHost();\n  }\n\n  isEnabled(): boolean {\n    return this.isExplicitlyEnabled() && this.isConfigured();\n  }\n\n  private getHost(): string | undefined {\n    return this.appConfigService.config.fileScanning?.yara?.connection?.host;\n  }\n\n  /** Default resolved by the configuration loader; this fallback covers the unconfigured case only. */\n  private getPort(): number {\n    return this.appConfigService.config.fileScanning?.yara?.connection?.port ?? YARA_DEFAULT_PORT;\n  }\n\n  private getBaseUrl(): string {\n    return `http://${this.getHost()}:${this.getPort()}`;\n  }\n\n  /**\n   * Check YARA service health.\n   */\n  async ping(): Promise<boolean> {\n    try {\n      const response = await fetch(`${this.getBaseUrl()}/health`, {\n        signal: AbortSignal.timeout(5000),\n      });\n      if (!response.ok) return false;\n      const body = await response.json() as { status: string };\n      return body.status === 'ok';\n    } catch {\n      return false;\n    }\n  }\n\n  /**\n   * Tell the YARA service to reload rules from disk.\n   * Use after updating custom rules via volume mount.\n   */\n  async reloadRules(): Promise<{ ruleCount: number; error?: string }> {\n    const response = await fetch(`${this.getBaseUrl()}/reload`, {\n      method: 'POST',\n      signal: AbortSignal.timeout(10_000),\n    });\n    return await response.json() as { ruleCount: number; error?: string };\n  }\n\n  /**\n   * Scan a file stream via the YARA REST API.\n   *\n   * Buffers the stream into memory, sends it as multipart/form-data\n   * to the YARA service's /scan endpoint, and returns a FileScanResult.\n   */\n  async scanStream(fileStream: Readable, fileId: string): Promise<FileScanResult> {\n    if (!this.isEnabled()) {\n      return { verdict: FileScanVerdict.CLEAN, scannerRef: 'yara-disabled' };\n    }\n\n    const startTime = Date.now();\n\n    this.logDebug('Starting YARA scan', { fileId });\n\n    try {\n      const chunks: Buffer[] = [];\n      for await (const chunk of fileStream) {\n        chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));\n      }\n      const fileBuffer = Buffer.concat(chunks);\n\n      const formData = new FormData();\n      formData.append('file', new Blob([fileBuffer]), fileId);\n\n      const response = await fetch(`${this.getBaseUrl()}/scan`, {\n        method: 'POST',\n        body: formData,\n        signal: AbortSignal.timeout(YARA_TIMEOUT_MS),\n      });\n\n      const body = await response.json() as YaraScanResponse;\n      const durationMs = Date.now() - startTime;\n\n      if (!response.ok || body.verdict === 'error') {\n        this.logger.error('YARA service returned error', {\n          fileId,\n          status: response.status,\n          error: body.error,\n        });\n        return {\n          verdict: FileScanVerdict.ERROR,\n          errorMessage: body.error ?? `YARA service HTTP ${response.status}`,\n          scannerRef: 'yara',\n          durationMs,\n        };\n      }\n\n      if (body.verdict === 'infected') {\n        const ruleNames = body.matches.map((m) => m.rule);\n        const threatName = `YARA: ${ruleNames.join(', ')}`;\n\n        this.logDebug('YARA matches found', { fileId, rules: ruleNames, durationMs });\n\n        return {\n          verdict: FileScanVerdict.INFECTED,\n          threatName,\n          scannerRef: 'yara',\n          durationMs,\n        };\n      }\n\n      this.logDebug('YARA scan clean', { fileId, durationMs });\n\n      return {\n        verdict: FileScanVerdict.CLEAN,\n        scannerRef: 'yara',\n        durationMs,\n      };\n\n    } catch (error) {\n      const durationMs = Date.now() - startTime;\n      const message = describeCaughtError(error);\n\n      if (message.includes('abort') || message.includes('timeout')) {\n        this.logger.error('YARA scan timed out', { fileId, durationMs });\n        return {\n          verdict: FileScanVerdict.ERROR,\n          errorMessage: 'YARA scan timed out',\n          scannerRef: 'yara',\n          durationMs,\n        };\n      }\n\n      this.logger.error('YARA scan failed', { fileId, error: message });\n      return {\n        verdict: FileScanVerdict.ERROR,\n        errorMessage: `YARA scan error: ${message}`,\n        scannerRef: 'yara',\n        durationMs,\n      };\n    }\n  }\n}\n"]}
+{"version":3,"file":"yara-scanner.backend.service.js","sourceRoot":"","sources":["../../../../src/files/scanning/yara-scanner.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;;;;;;;;;;;;;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAE/C,OAAO,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AAEpF,OAAO,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AAC/G,OAAO,EAAE,mBAAmB,EAAE,MAAM,8EAA8E,CAAC;AACnH,OAAO,EACL,eAAe,GAEhB,MAAM,mDAAmD,CAAC;AAE3D,MAAM,iBAAiB,GAAG,IAAI,CAAC;AAC/B;;;;GAIG;AACH,MAAM,eAAe,GAAG,MAAM,CAAC;AAE/B;;;;;GAKG;AACH,MAAM,oBAAoB,GAAG,KAAK,CAAC;AAEnC;;;;GAIG;AACH,MAAM,sBAAsB,GAAG,MAAM,CAAC;AAkB/B,IAAM,yBAAyB,GAA/B,MAAM,yBAAyB;IAKjB;IAEA;IANT,QAAQ,CAA+D;IAEjF,YAEmB,MAAqB,EAErB,gBAAyC;QAFzC,WAAM,GAAN,MAAM,CAAe;QAErB,qBAAgB,GAAhB,gBAAgB,CAAyB;QAE1D,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,2BAA2B,CAAC,CAAC;IACvE,CAAC;IAED;;;;;OAKG;IACH,mBAAmB;QACjB,OAAO,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,YAAY,EAAE,IAAI,EAAE,OAAO,KAAK,IAAI,CAAC;IAC3E,CAAC;IAED,YAAY;QACV,OAAO,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;IAC1B,CAAC;IAED,SAAS;QACP,OAAO,IAAI,CAAC,mBAAmB,EAAE,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;IAC3D,CAAC;IAEO,OAAO;QACb,OAAO,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,YAAY,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC;IAC3E,CAAC;IAED,qGAAqG;IAC7F,OAAO;QACb,OAAO,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,YAAY,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,IAAI,iBAAiB,CAAC;IAChG,CAAC;IAEO,UAAU;QAChB,OAAO,UAAU,IAAI,CAAC,OAAO,EAAE,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC;IACtD,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,IAAI;QACR,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,CAAC,UAAU,EAAE,SAAS,EAAE;gBAC1D,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,oBAAoB,CAAC;aAClD,CAAC,CAAC;YACH,IAAI,CAAC,QAAQ,CAAC,EAAE;gBAAE,OAAO,KAAK,CAAC;YAC/B,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAwB,CAAC;YACzD,OAAO,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC;QAC9B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,WAAW;QACf,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,CAAC,UAAU,EAAE,SAAS,EAAE;YAC1D,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,sBAAsB,CAAC;SACpD,CAAC,CAAC;QACH,OAAO,MAAM,QAAQ,CAAC,IAAI,EAA2C,CAAC;IACxE,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,UAAU,CAAC,UAAoB,EAAE,MAAc;QACnD,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,CAAC;YACtB,OAAO,EAAE,OAAO,EAAE,eAAe,CAAC,KAAK,EAAE,UAAU,EAAE,eAAe,EAAE,CAAC;QACzE,CAAC;QAED,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAE7B,IAAI,CAAC,QAAQ,CAAC,oBAAoB,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QAEhD,IAAI,CAAC;YACH,MAAM,MAAM,GAAa,EAAE,CAAC;YAC5B,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,UAAU,EAAE,CAAC;gBACrC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;YACnE,CAAC;YACD,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAEzC,MAAM,QAAQ,GAAG,IAAI,QAAQ,EAAE,CAAC;YAChC,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,CAAC,UAAU,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;YAExD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,CAAC,UAAU,EAAE,OAAO,EAAE;gBACxD,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,QAAQ;gBACd,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,eAAe,CAAC;aAC7C,CAAC,CAAC;YAEH,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAsB,CAAC;YACvD,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;YAE1C,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,IAAI,CAAC,OAAO,KAAK,OAAO,EAAE,CAAC;gBAC7C,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,6BAA6B,EAAE;oBAC/C,MAAM;oBACN,MAAM,EAAE,QAAQ,CAAC,MAAM;oBACvB,KAAK,EAAE,IAAI,CAAC,KAAK;iBAClB,CAAC,CAAC;gBACH,OAAO;oBACL,OAAO,EAAE,eAAe,CAAC,KAAK;oBAC9B,YAAY,EAAE,IAAI,CAAC,KAAK,IAAI,qBAAqB,QAAQ,CAAC,MAAM,EAAE;oBAClE,UAAU,EAAE,MAAM;oBAClB,UAAU;iBACX,CAAC;YACJ,CAAC;YAED,IAAI,IAAI,CAAC,OAAO,KAAK,UAAU,EAAE,CAAC;gBAChC,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;gBAClD,MAAM,UAAU,GAAG,SAAS,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBAEnD,IAAI,CAAC,QAAQ,CAAC,oBAAoB,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC,CAAC;gBAE9E,OAAO;oBACL,OAAO,EAAE,eAAe,CAAC,QAAQ;oBACjC,UAAU;oBACV,UAAU,EAAE,MAAM;oBAClB,UAAU;iBACX,CAAC;YACJ,CAAC;YAED,IAAI,CAAC,QAAQ,CAAC,iBAAiB,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;YAEzD,OAAO;gBACL,OAAO,EAAE,eAAe,CAAC,KAAK;gBAC9B,UAAU,EAAE,MAAM;gBAClB,UAAU;aACX,CAAC;QAEJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;YAC1C,MAAM,OAAO,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAC;YAE3C,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC7D,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,qBAAqB,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;gBACjE,OAAO;oBACL,OAAO,EAAE,eAAe,CAAC,KAAK;oBAC9B,YAAY,EAAE,qBAAqB;oBACnC,UAAU,EAAE,MAAM;oBAClB,UAAU;iBACX,CAAC;YACJ,CAAC;YAED,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,kBAAkB,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;YAClE,OAAO;gBACL,OAAO,EAAE,eAAe,CAAC,KAAK;gBAC9B,YAAY,EAAE,oBAAoB,OAAO,EAAE;gBAC3C,UAAU,EAAE,MAAM;gBAClB,UAAU;aACX,CAAC;QACJ,CAAC;IACH,CAAC;CACF,CAAA;AApKY,yBAAyB;IADrC,UAAU,EAAE;IAKR,WAAA,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAA;IAEjC,WAAA,MAAM,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,CAAA;+CACT,uBAAuB;GAPjD,yBAAyB,CAoKrC","sourcesContent":["/**\n * YARA Scanner Backend Service\n *\n * Optional pattern-matching scanning layer that runs on top of ClamAV.\n * Uses YARA rules to detect threats that signature-based AV might miss:\n * - Executable payloads hidden in document uploads\n * - Suspicious scripts (JS, VBS, PowerShell) embedded in files\n * - Macro-enabled Office documents\n * - Archive bombs / decompression exploits\n * - Webshells and server-side code injection\n *\n * Architecture:\n * - YARA runs as a separate Docker service with a REST API wrapper\n * - The backend sends files via multipart/form-data POST to /scan\n * - Rules are volume-mounted into the YARA container (bundled + custom)\n * - Platform-level: enabled via `YARA_ENABLED=true`, not per z_file()\n *\n * Configured through `fileScanning.yara` in resolved application configuration,\n * which the configuration loader seeds from `YARA_ENABLED` / `YARA_HOST` /\n * `YARA_PORT`. The service reads configuration, never the environment — see\n * `.claude/plans/application-runtime-topology-delivery.md`.\n */\n\nimport { injectable, inject } from 'inversify';\nimport { Readable } from 'stream';\nimport { SAAS_SERVICE_TYPES } from '~wildo-backend-lib/inject/models/service-types';\nimport type { LoggerService } from '~wildo-backend-lib/monitoring/logger/services/logger.service';\nimport { AppConfigurationService } from '~wildo-backend-lib/config/services/app-configuration.backend.service';\nimport { describeCaughtError } from '~wildo-backend-lib/errors/utils/error-log-level-classification.backend.utils';\nimport {\n  FileScanVerdict,\n  type FileScanResult,\n} from '~wildo-backend-lib/files/scanning/file-scan.types';\n\nconst YARA_DEFAULT_PORT = 8080;\n/**\n * One SCAN. 60s because the file is buffered into memory and matched against the full rule set,\n * and because a scan is the operation this service exists to perform — timing it out is a scan\n * that did not happen.\n */\nconst YARA_TIMEOUT_MS = 60_000;\n\n/**\n * The HEALTH probe. 5s, and deliberately the shortest of the three: `ping()` answers `false` on\n * any failure, so its whole job is to decide quickly whether the scanner is there. A probe that\n * waits as long as the work it is probing for tells you nothing you could not have learned by\n * doing the work.\n */\nconst YARA_PING_TIMEOUT_MS = 5_000;\n\n/**\n * A rule RELOAD. 10s: the service re-reads rules from a volume mount and recompiles them, which is\n * more than a health check and far less than a scan — and it is an operator-triggered action, so a\n * bound that is too tight reports a failure for an operation that in fact succeeded.\n */\nconst YARA_RELOAD_TIMEOUT_MS = 10_000;\n\nexport interface YaraMatch {\n  rule: string;\n  namespace: string;\n  tags: string[];\n  meta: Record<string, string>;\n}\n\nexport interface YaraScanResponse {\n  verdict: 'clean' | 'infected' | 'error';\n  matches: YaraMatch[];\n  durationMs?: number;\n  error?: string;\n  note?: string;\n}\n\n@injectable()\nexport class YaraScannerBackendService {\n  protected logDebug: (message: string, context?: Record<string, unknown>) => void;\n\n  constructor(\n    @inject(SAAS_SERVICE_TYPES.Logger)\n    private readonly logger: LoggerService,\n    @inject(SAAS_SERVICE_TYPES.AppConfigService)\n    private readonly appConfigService: AppConfigurationService,\n  ) {\n    this.logDebug = this.logger.debugByType('YaraScannerBackendService');\n  }\n\n  /**\n   * Whether YARA scanning is opted into, INDEPENDENTLY of whether a sidecar is\n   * reachable. The two axes stay separate because the startup config validator\n   * reports \"explicitly enabled but not configured\" as its own issue — collapsing\n   * them would turn that misconfiguration into a silent \"scanning is off\".\n   */\n  isExplicitlyEnabled(): boolean {\n    return this.appConfigService.config.fileScanning?.yara?.enabled === true;\n  }\n\n  isConfigured(): boolean {\n    return !!this.getHost();\n  }\n\n  isEnabled(): boolean {\n    return this.isExplicitlyEnabled() && this.isConfigured();\n  }\n\n  private getHost(): string | undefined {\n    return this.appConfigService.config.fileScanning?.yara?.connection?.host;\n  }\n\n  /** Default resolved by the configuration loader; this fallback covers the unconfigured case only. */\n  private getPort(): number {\n    return this.appConfigService.config.fileScanning?.yara?.connection?.port ?? YARA_DEFAULT_PORT;\n  }\n\n  private getBaseUrl(): string {\n    return `http://${this.getHost()}:${this.getPort()}`;\n  }\n\n  /**\n   * Check YARA service health.\n   */\n  async ping(): Promise<boolean> {\n    try {\n      const response = await fetch(`${this.getBaseUrl()}/health`, {\n        signal: AbortSignal.timeout(YARA_PING_TIMEOUT_MS),\n      });\n      if (!response.ok) return false;\n      const body = await response.json() as { status: string };\n      return body.status === 'ok';\n    } catch {\n      return false;\n    }\n  }\n\n  /**\n   * Tell the YARA service to reload rules from disk.\n   * Use after updating custom rules via volume mount.\n   */\n  async reloadRules(): Promise<{ ruleCount: number; error?: string }> {\n    const response = await fetch(`${this.getBaseUrl()}/reload`, {\n      method: 'POST',\n      signal: AbortSignal.timeout(YARA_RELOAD_TIMEOUT_MS),\n    });\n    return await response.json() as { ruleCount: number; error?: string };\n  }\n\n  /**\n   * Scan a file stream via the YARA REST API.\n   *\n   * Buffers the stream into memory, sends it as multipart/form-data\n   * to the YARA service's /scan endpoint, and returns a FileScanResult.\n   */\n  async scanStream(fileStream: Readable, fileId: string): Promise<FileScanResult> {\n    if (!this.isEnabled()) {\n      return { verdict: FileScanVerdict.CLEAN, scannerRef: 'yara-disabled' };\n    }\n\n    const startTime = Date.now();\n\n    this.logDebug('Starting YARA scan', { fileId });\n\n    try {\n      const chunks: Buffer[] = [];\n      for await (const chunk of fileStream) {\n        chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));\n      }\n      const fileBuffer = Buffer.concat(chunks);\n\n      const formData = new FormData();\n      formData.append('file', new Blob([fileBuffer]), fileId);\n\n      const response = await fetch(`${this.getBaseUrl()}/scan`, {\n        method: 'POST',\n        body: formData,\n        signal: AbortSignal.timeout(YARA_TIMEOUT_MS),\n      });\n\n      const body = await response.json() as YaraScanResponse;\n      const durationMs = Date.now() - startTime;\n\n      if (!response.ok || body.verdict === 'error') {\n        this.logger.error('YARA service returned error', {\n          fileId,\n          status: response.status,\n          error: body.error,\n        });\n        return {\n          verdict: FileScanVerdict.ERROR,\n          errorMessage: body.error ?? `YARA service HTTP ${response.status}`,\n          scannerRef: 'yara',\n          durationMs,\n        };\n      }\n\n      if (body.verdict === 'infected') {\n        const ruleNames = body.matches.map((m) => m.rule);\n        const threatName = `YARA: ${ruleNames.join(', ')}`;\n\n        this.logDebug('YARA matches found', { fileId, rules: ruleNames, durationMs });\n\n        return {\n          verdict: FileScanVerdict.INFECTED,\n          threatName,\n          scannerRef: 'yara',\n          durationMs,\n        };\n      }\n\n      this.logDebug('YARA scan clean', { fileId, durationMs });\n\n      return {\n        verdict: FileScanVerdict.CLEAN,\n        scannerRef: 'yara',\n        durationMs,\n      };\n\n    } catch (error) {\n      const durationMs = Date.now() - startTime;\n      const message = describeCaughtError(error);\n\n      if (message.includes('abort') || message.includes('timeout')) {\n        this.logger.error('YARA scan timed out', { fileId, durationMs });\n        return {\n          verdict: FileScanVerdict.ERROR,\n          errorMessage: 'YARA scan timed out',\n          scannerRef: 'yara',\n          durationMs,\n        };\n      }\n\n      this.logger.error('YARA scan failed', { fileId, error: message });\n      return {\n        verdict: FileScanVerdict.ERROR,\n        errorMessage: `YARA scan error: ${message}`,\n        scannerRef: 'yara',\n        durationMs,\n      };\n    }\n  }\n}\n"]}

package/dist/esm/files/services/__tests__/mock-file-field-detection.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mock-file-field-detection.service.d.ts","sourceRoot":"","sources":["../../../../../../src/files/services/__tests__/mock-file-field-detection.service.ts"],"names":[],"mappings":"AAAA,OAAO,kBAAkB,CAAC;AAI1B,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAE1D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,wEAAwE,CAAC;AAChH,OAAO,KAAK,EAAE,gCAAgC,EAAE,MAAM,yCAAyC,CAAC;AAEhG,cACM,iCAAiC;IACrC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAgD;IAE9E,gBAAgB,qEAEb;IAEH,aAAa,yDAEV;IAEH,uBAAuB,qEAIpB;IAEH,qBAAqB,CAAC,YAAY,EAAE,YAAY,EAAE,UAAU,EAAE,iBAAiB,EAAE,GAAG,IAAI;IAIxF,gBAAgB,CAAC,YAAY,EAAE,YAAY,EAAE,SAAS,EAAE,OAAO,GAAG,IAAI;IActE,KAAK,IAAI,IAAI;CAMd;AAED;;;;GAIG;AACH,eAAO,MAAM,6BAA6B,EAAmD;IAC3F,KAAK,GAAG,IAAI,EAAE,qBAAqB,CAAC,OAAO,iCAAiC,CAAC,GAAG,gCAAgC,GAAG,iCAAiC,CAAC;CACtJ,CAAC;AACF,MAAM,MAAM,6BAA6B,GAAG,gCAAgC,GAAG,iCAAiC,CAAC"}
+{"version":3,"file":"mock-file-field-detection.service.d.ts","sourceRoot":"","sources":["../../../../../src/files/services/__tests__/mock-file-field-detection.service.ts"],"names":[],"mappings":"AAAA,OAAO,kBAAkB,CAAC;AAI1B,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAE1D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,wEAAwE,CAAC;AAChH,OAAO,KAAK,EAAE,gCAAgC,EAAE,MAAM,yCAAyC,CAAC;AAEhG,cACM,iCAAiC;IACrC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAgD;IAE9E,gBAAgB,qEAEb;IAEH,aAAa,yDAEV;IAEH,uBAAuB,qEAIpB;IAEH,qBAAqB,CAAC,YAAY,EAAE,YAAY,EAAE,UAAU,EAAE,iBAAiB,EAAE,GAAG,IAAI;IAIxF,gBAAgB,CAAC,YAAY,EAAE,YAAY,EAAE,SAAS,EAAE,OAAO,GAAG,IAAI;IActE,KAAK,IAAI,IAAI;CAMd;AAED;;;;GAIG;AACH,eAAO,MAAM,6BAA6B,EAAmD;IAC3F,KAAK,GAAG,IAAI,EAAE,qBAAqB,CAAC,OAAO,iCAAiC,CAAC,GAAG,gCAAgC,GAAG,iCAAiC,CAAC;CACtJ,CAAC;AACF,MAAM,MAAM,6BAA6B,GAAG,gCAAgC,GAAG,iCAAiC,CAAC"}

package/dist/esm/files/services/__tests__/mock-file-operation-handler.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mock-file-operation-handler.service.d.ts","sourceRoot":"","sources":["../../../../../../src/files/services/__tests__/mock-file-operation-handler.service.ts"],"names":[],"mappings":"AAAA,OAAO,kBAAkB,CAAC;AAI1B,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAC1D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,qEAAqE,CAAC;AAC7G,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qEAAqE,CAAC;AAC5G,OAAO,KAAK,EAAE,kCAAkC,EAAE,MAAM,2CAA2C,CAAC;AAEpG,cACM,mCAAmC;IACvC,OAAO,CAAC,+BAA+B,CAM/B;IACR,OAAO,CAAC,+BAA+B,CAO/B;IACR,OAAO,CAAC,UAAU,CAAS;IAC3B,OAAO,CAAC,UAAU,CAAuB;IACzC,OAAO,CAAC,SAAS,CAAK;IAEtB,2BAA2B,uJAOzB;IAEF,0BAA0B,wKAqBxB;IAEF,0BAA0B,+LAuBxB;IAEF,kCAAkC;cA3E1B,OAAO;sBACC,YAAY;oBACd,MAAM;0BACA,gBAAgB,CAAC,GAAG,CAAC;kBAC7B,iBAAiB;;IA2E7B,kCAAkC;cAxE1B,OAAO;sBACC,OAAO;sBACP,YAAY;oBACd,MAAM;0BACA,gBAAgB,CAAC,GAAG,CAAC;kBAC7B,iBAAiB;;IAuE7B,KAAK,IAAI,IAAI;IAWb,aAAa,CAAC,UAAU,EAAE,OAAO,GAAG,IAAI;IAIxC,aAAa,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI;CAG/C;AAED;;;;GAIG;AACH,eAAO,MAAM,+BAA+B,EAAqD;IAC/F,KAAK,GAAG,IAAI,EAAE,qBAAqB,CAAC,OAAO,mCAAmC,CAAC,GAAG,kCAAkC,GAAG,mCAAmC,CAAC;CAC5J,CAAC;AACF,MAAM,MAAM,+BAA+B,GAAG,kCAAkC,GAAG,mCAAmC,CAAC"}
+{"version":3,"file":"mock-file-operation-handler.service.d.ts","sourceRoot":"","sources":["../../../../../src/files/services/__tests__/mock-file-operation-handler.service.ts"],"names":[],"mappings":"AAAA,OAAO,kBAAkB,CAAC;AAI1B,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAC1D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,qEAAqE,CAAC;AAC7G,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qEAAqE,CAAC;AAC5G,OAAO,KAAK,EAAE,kCAAkC,EAAE,MAAM,2CAA2C,CAAC;AAEpG,cACM,mCAAmC;IACvC,OAAO,CAAC,+BAA+B,CAM/B;IACR,OAAO,CAAC,+BAA+B,CAO/B;IACR,OAAO,CAAC,UAAU,CAAS;IAC3B,OAAO,CAAC,UAAU,CAAuB;IACzC,OAAO,CAAC,SAAS,CAAK;IAEtB,2BAA2B,uJAOzB;IAEF,0BAA0B,wKAqBxB;IAEF,0BAA0B,+LAuBxB;IAEF,kCAAkC;cA3E1B,OAAO;sBACC,YAAY;oBACd,MAAM;0BACA,gBAAgB,CAAC,GAAG,CAAC;kBAC7B,iBAAiB;;IA2E7B,kCAAkC;cAxE1B,OAAO;sBACC,OAAO;sBACP,YAAY;oBACd,MAAM;0BACA,gBAAgB,CAAC,GAAG,CAAC;kBAC7B,iBAAiB;;IAuE7B,KAAK,IAAI,IAAI;IAWb,aAAa,CAAC,UAAU,EAAE,OAAO,GAAG,IAAI;IAIxC,aAAa,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI;CAG/C;AAED;;;;GAIG;AACH,eAAO,MAAM,+BAA+B,EAAqD;IAC/F,KAAK,GAAG,IAAI,EAAE,qBAAqB,CAAC,OAAO,mCAAmC,CAAC,GAAG,kCAAkC,GAAG,mCAAmC,CAAC;CAC5J,CAAC;AACF,MAAM,MAAM,+BAA+B,GAAG,kCAAkC,GAAG,mCAAmC,CAAC"}

package/dist/esm/files/services/__tests__/mock-file-repository.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mock-file-repository.service.d.ts","sourceRoot":"","sources":["../../../../../../src/files/services/__tests__/mock-file-repository.service.ts"],"names":[],"mappings":"AAAA,OAAO,kBAAkB,CAAC;AAG1B,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,uBAAuB,CAAC;AAGlD;;;;;;;;;GASG;AACH,qBACa,yBAAyB;IACpC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA2B;IAEnD,kGAAkG;IAClG,OAAO,CAAC,aAAa;IAKrB,0FAA0F;IAC1F,OAAO,CAAC,SAAS;IAMjB,OAAO,CAAC,aAAa;IA6BrB,MAAM,sEAWH;IAEH,IAAI,4EAID;IAEH,GAAG,4EAIA;IAEH,IAAI,8EAID;IAEH,MAAM,0GAcH;IAEH,MAAM,4EASH;IAEH,KAAK,IAAI,IAAI;IAIb,UAAU,IAAI,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC;IAI/B,KAAK,IAAI,IAAI;CASd"}
+{"version":3,"file":"mock-file-repository.service.d.ts","sourceRoot":"","sources":["../../../../../src/files/services/__tests__/mock-file-repository.service.ts"],"names":[],"mappings":"AAAA,OAAO,kBAAkB,CAAC;AAG1B,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,uBAAuB,CAAC;AAGlD;;;;;;;;;GASG;AACH,qBACa,yBAAyB;IACpC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA2B;IAEnD,kGAAkG;IAClG,OAAO,CAAC,aAAa;IAKrB,0FAA0F;IAC1F,OAAO,CAAC,SAAS;IAMjB,OAAO,CAAC,aAAa;IA6BrB,MAAM,sEAWH;IAEH,IAAI,4EAID;IAEH,GAAG,4EAIA;IAEH,IAAI,8EAID;IAEH,MAAM,0GAcH;IAEH,MAAM,4EASH;IAEH,KAAK,IAAI,IAAI;IAIb,UAAU,IAAI,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC;IAI/B,KAAK,IAAI,IAAI;CASd"}

package/dist/esm/files/services/file-field-detection.backend.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"file-field-detection.backend.service.d.ts","sourceRoot":"","sources":["../../../../../src/files/services/file-field-detection.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,EAAE,YAAY,EAA0C,MAAM,uBAAuB,CAAC;AAE7F,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAClG,OAAO,EAAE,+BAA+B,EAAE,MAAM,0EAA0E,CAAC;AAC3H,OAAO,EAAwB,KAAK,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AACzF,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAQ9G;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,kBAAkB,CAAC;CAClC;AAED,qBACa,gCAAgC;IAQzC,OAAO,CAAC,QAAQ,CAAC,MAAM;IAEvB,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IAElC,OAAO,CAAC,QAAQ,CAAC,YAAY;IAX/B,SAAS,CAAC,QAAQ,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;IAGjF,OAAO,CAAC,eAAe,CAAqD;gBAIzD,MAAM,EAAE,aAAa,EAErB,iBAAiB,EAAE,+BAA+B,EAElD,YAAY,EAAE,0BAA0B;IAM3D;;;;;;OAMG;IACH,gBAAgB,CAAC,YAAY,EAAE,YAAY,GAAG,iBAAiB,EAAE;IAyEjE;;;;;OAKG;IACH,aAAa,CAAC,YAAY,EAAE,YAAY,GAAG,OAAO;IAIlD;;;;;;;;;;;;OAYG;IACH,uBAAuB,CAAC,YAAY,EAAE,YAAY,GAAG,iBAAiB,EAAE;IAMxE;;;;;;OAMG;IACH,oBAAoB,CAAC,YAAY,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,GAAG,iBAAiB,GAAG,SAAS;IAKlG;;;;;OAKG;IACH,UAAU,CAAC,YAAY,CAAC,EAAE,YAAY,GAAG,IAAI;CAS9C"}
+{"version":3,"file":"file-field-detection.backend.service.d.ts","sourceRoot":"","sources":["../../../../src/files/services/file-field-detection.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,EAAE,YAAY,EAA0C,MAAM,uBAAuB,CAAC;AAE7F,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAClG,OAAO,EAAE,+BAA+B,EAAE,MAAM,0EAA0E,CAAC;AAC3H,OAAO,EAAwB,KAAK,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AACzF,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAQ9G;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,kBAAkB,CAAC;CAClC;AAED,qBACa,gCAAgC;IAQzC,OAAO,CAAC,QAAQ,CAAC,MAAM;IAEvB,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IAElC,OAAO,CAAC,QAAQ,CAAC,YAAY;IAX/B,SAAS,CAAC,QAAQ,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;IAGjF,OAAO,CAAC,eAAe,CAAqD;gBAIzD,MAAM,EAAE,aAAa,EAErB,iBAAiB,EAAE,+BAA+B,EAElD,YAAY,EAAE,0BAA0B;IAM3D;;;;;;OAMG;IACH,gBAAgB,CAAC,YAAY,EAAE,YAAY,GAAG,iBAAiB,EAAE;IAyEjE;;;;;OAKG;IACH,aAAa,CAAC,YAAY,EAAE,YAAY,GAAG,OAAO;IAIlD;;;;;;;;;;;;OAYG;IACH,uBAAuB,CAAC,YAAY,EAAE,YAAY,GAAG,iBAAiB,EAAE;IAMxE;;;;;;OAMG;IACH,oBAAoB,CAAC,YAAY,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,GAAG,iBAAiB,GAAG,SAAS;IAKlG;;;;;OAKG;IACH,UAAU,CAAC,YAAY,CAAC,EAAE,YAAY,GAAG,IAAI;CAS9C"}

package/dist/esm/files/services/file-operation-handler.backend.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"file-operation-handler.backend.service.d.ts","sourceRoot":"","sources":["../../../../../src/files/services/file-operation-handler.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAGH,OAAO,EAAE,YAAY,EAA8E,MAAM,uBAAuB,CAAC;AAGjI,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAClG,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAE9G,OAAO,EAAE,gCAAgC,EAAqB,MAAM,wCAAwC,CAAC;AAC7G,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAC9D,OAAO,EAAE,gBAAgB,EAAE,MAAM,qEAAqE,CAAC;AACvG,OAAO,EAAE,iBAAiB,EAAE,MAAM,qEAAqE,CAAC;AAUxG,UAAU,+BAA+B;IACvC;;;;OAIG;IACH,mCAAmC,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC;CACzE;AAED,qBACa,kCAAkC;IAK3C,OAAO,CAAC,QAAQ,CAAC,MAAM;IAEvB,OAAO,CAAC,QAAQ,CAAC,YAAY;IAE7B,OAAO,CAAC,QAAQ,CAAC,kBAAkB;IAEnC,OAAO,CAAC,QAAQ,CAAC,YAAY;IAV/B,SAAS,CAAC,QAAQ,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;gBAI9D,MAAM,EAAE,aAAa,EAErB,YAAY,EAAE,0BAA0B,EAExC,kBAAkB,EAAE,gCAAgC,EAEpD,YAAY,EAAE,mBAAmB;IAMpD,OAAO,CAAC,uBAAuB;IAI/B;;;;;;;;;;;;;;;;OAgBG;IACH,OAAO,CAAC,kBAAkB;IAyB1B;;;;;;OAMG;IACG,kCAAkC,CAAC,MAAM,EAAE;QAC/C,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC;QAC3B,iBAAiB,EAAE,MAAM,CAAC;QAC1B,SAAS,EAAE,MAAM,CAAC;QAClB,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC;QACxC,OAAO,CAAC,EAAE,iBAAiB,CAAC;KAC7B,GAAG,OAAO,CAAC,IAAI,CAAC;IAqBjB,OAAO,CAAC,uCAAuC;IA2C/C;;;;;;;;;OASG;IACG,2BAA2B,CAC/B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,YAAY,EAAE,YAAY,EAC1B,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACvC,OAAO,CAAC,EAAE,iBAAiB,EAC3B,iBAAiB,CAAC,EAAE,+BAA+B,GAClD,OAAO,CAAC,IAAI,CAAC;IA2FhB;;;;;;;;OAQG;IACH;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,uBAAuB;IAMzB,0BAA0B,CAC9B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,YAAY,EAAE,YAAY,EAC1B,UAAU,EAAE,MAAM,EAClB,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACvC,OAAO,CAAC,EAAE,iBAAiB,EAC3B,iBAAiB,CAAC,EAAE,+BAA+B,GAClD,OAAO,CAAC,IAAI,CAAC;IA6DhB;;;;;;;;;;;;;;OAcG;IACG,0BAA0B,CAC9B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACrC,YAAY,EAAE,YAAY,EAC1B,UAAU,EAAE,MAAM,EAClB,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACvC,OAAO,CAAC,EAAE,iBAAiB,EAC3B,iBAAiB,CAAC,EAAE,+BAA+B,GAClD,OAAO,CAAC,IAAI,CAAC;IA8MhB;;;;;;;OAOG;IACH;;;;;;OAMG;IACH,OAAO,CAAC,0BAA0B;IAW5B,0BAA0B,CAC9B,YAAY,EAAE,YAAY,EAC1B,UAAU,EAAE,MAAM,EAClB,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACvC,OAAO,CAAC,EAAE,iBAAiB,GAC1B,OAAO,CAAC,IAAI,CAAC;IA+EhB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA0DG;IACG,iCAAiC,CACrC,YAAY,EAAE,YAAY,EAC1B,UAAU,EAAE,MAAM,EAClB,kBAAkB,EAAE,SAAS,MAAM,EAAE,EACrC,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACvC,OAAO,CAAC,EAAE,iBAAiB,GAC1B,OAAO,CAAC,IAAI,CAAC;IA6DhB;;;;;;;OAOG;IACH,OAAO,CAAC,cAAc;IAqFtB;;;OAGG;YACW,kBAAkB;IA6ChC;;;OAGG;YACW,sBAAsB;IAmBpC;;;;;;OAMG;YACW,2BAA2B;IAmCzC,OAAO,CAAC,kBAAkB;IAmB1B,OAAO,CAAC,gBAAgB;CAuGzB"}
+{"version":3,"file":"file-operation-handler.backend.service.d.ts","sourceRoot":"","sources":["../../../../src/files/services/file-operation-handler.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAGH,OAAO,EAAE,YAAY,EAA8E,MAAM,uBAAuB,CAAC;AAGjI,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAClG,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAE9G,OAAO,EAAE,gCAAgC,EAAqB,MAAM,wCAAwC,CAAC;AAC7G,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAC9D,OAAO,EAAE,gBAAgB,EAAE,MAAM,qEAAqE,CAAC;AACvG,OAAO,EAAE,iBAAiB,EAAE,MAAM,qEAAqE,CAAC;AAUxG,UAAU,+BAA+B;IACvC;;;;OAIG;IACH,mCAAmC,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC;CACzE;AAED,qBACa,kCAAkC;IAK3C,OAAO,CAAC,QAAQ,CAAC,MAAM;IAEvB,OAAO,CAAC,QAAQ,CAAC,YAAY;IAE7B,OAAO,CAAC,QAAQ,CAAC,kBAAkB;IAEnC,OAAO,CAAC,QAAQ,CAAC,YAAY;IAV/B,SAAS,CAAC,QAAQ,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;gBAI9D,MAAM,EAAE,aAAa,EAErB,YAAY,EAAE,0BAA0B,EAExC,kBAAkB,EAAE,gCAAgC,EAEpD,YAAY,EAAE,mBAAmB;IAMpD,OAAO,CAAC,uBAAuB;IAI/B;;;;;;;;;;;;;;;;OAgBG;IACH,OAAO,CAAC,kBAAkB;IAyB1B;;;;;;OAMG;IACG,kCAAkC,CAAC,MAAM,EAAE;QAC/C,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC;QAC3B,iBAAiB,EAAE,MAAM,CAAC;QAC1B,SAAS,EAAE,MAAM,CAAC;QAClB,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC;QACxC,OAAO,CAAC,EAAE,iBAAiB,CAAC;KAC7B,GAAG,OAAO,CAAC,IAAI,CAAC;IAqBjB,OAAO,CAAC,uCAAuC;IA2C/C;;;;;;;;;OASG;IACG,2BAA2B,CAC/B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,YAAY,EAAE,YAAY,EAC1B,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACvC,OAAO,CAAC,EAAE,iBAAiB,EAC3B,iBAAiB,CAAC,EAAE,+BAA+B,GAClD,OAAO,CAAC,IAAI,CAAC;IA2FhB;;;;;;;;OAQG;IACH;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,uBAAuB;IAMzB,0BAA0B,CAC9B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,YAAY,EAAE,YAAY,EAC1B,UAAU,EAAE,MAAM,EAClB,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACvC,OAAO,CAAC,EAAE,iBAAiB,EAC3B,iBAAiB,CAAC,EAAE,+BAA+B,GAClD,OAAO,CAAC,IAAI,CAAC;IA6DhB;;;;;;;;;;;;;;OAcG;IACG,0BAA0B,CAC9B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACrC,YAAY,EAAE,YAAY,EAC1B,UAAU,EAAE,MAAM,EAClB,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACvC,OAAO,CAAC,EAAE,iBAAiB,EAC3B,iBAAiB,CAAC,EAAE,+BAA+B,GAClD,OAAO,CAAC,IAAI,CAAC;IA8MhB;;;;;;;OAOG;IACH;;;;;;OAMG;IACH,OAAO,CAAC,0BAA0B;IAW5B,0BAA0B,CAC9B,YAAY,EAAE,YAAY,EAC1B,UAAU,EAAE,MAAM,EAClB,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACvC,OAAO,CAAC,EAAE,iBAAiB,GAC1B,OAAO,CAAC,IAAI,CAAC;IA+EhB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA0DG;IACG,iCAAiC,CACrC,YAAY,EAAE,YAAY,EAC1B,UAAU,EAAE,MAAM,EAClB,kBAAkB,EAAE,SAAS,MAAM,EAAE,EACrC,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACvC,OAAO,CAAC,EAAE,iBAAiB,GAC1B,OAAO,CAAC,IAAI,CAAC;IA6DhB;;;;;;;OAOG;IACH,OAAO,CAAC,cAAc;IAqFtB;;;OAGG;YACW,kBAAkB;IA6ChC;;;OAGG;YACW,sBAAsB;IAmBpC;;;;;;OAMG;YACW,2BAA2B;IAmCzC,OAAO,CAAC,kBAAkB;IAmB1B,OAAO,CAAC,gBAAgB;CAuGzB"}