@wildo-ai/saas-backend-lib 1.1.2 → 1.1.4

package/dist/esm/files/services/file-upload-grant.backend.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"file-upload-grant.backend.service.d.ts","sourceRoot":"","sources":["../../../../../src/files/services/file-upload-grant.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAGH,OAAO,EAgBL,KAAK,eAAe,EACpB,KAAK,uBAAuB,EAC5B,KAAK,wBAAwB,EAC7B,KAAK,qBAAqB,EAC1B,KAAK,+BAA+B,EACpC,KAAK,YAAY,EAIlB,MAAM,uBAAuB,CAAC;AAG/B,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAClG,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAE9G,OAAO,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AAC/G,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qEAAqE,CAAC;AAC5G,OAAO,EAAE,6BAA6B,EAAE,MAAM,yFAAyF,CAAC;AACxI,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uFAAuF,CAAC;AAC7H,OAAO,EAAE,2BAA2B,EAAE,MAAM,qFAAqF,CAAC;AAClI,OAAO,EAAE,gCAAgC,EAAE,MAAM,wEAAwE,CAAC;AAC1H,OAAO,EAAE,qCAAqC,EAAE,MAAM,+EAA+E,CAAC;AACtI,OAAO,EAAE,yCAAyC,EAAE,MAAM,qGAAqG,CAAC;AAChK,OAAO,EAAgC,KAAK,qBAAqB,EAAE,MAAM,oDAAoD,CAAC;AAE9H,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,gFAAgF,CAAC;AAE9H,gFAAgF;AAChF,MAAM,WAAW,qBAAqB;IACpC,YAAY,EAAE,YAAY,CAAC;IAC3B,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,wBAAwB,CAAC;IACpC,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,yBAAyB;IACxC,yFAAyF;IACzF,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACxC,MAAM,EAAE,qBAAqB,CAAC;IAC9B,qGAAqG;IACrG,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,+GAA+G;IAC/G,SAAS,EAAE,MAAM,CAAC;IAClB,gHAAgH;IAChH,UAAU,EAAE,MAAM,CAAC;IACnB,6DAA6D;IAC7D,iBAAiB,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CAChE;AAED,qBACa,6BAA6B;IAIH,OAAO,CAAC,QAAQ,CAAC,MAAM;IACV,OAAO,CAAC,QAAQ,CAAC,YAAY;IAC1B,OAAO,CAAC,QAAQ,CAAC,sBAAsB;IAClC,OAAO,CAAC,QAAQ,CAAC,kBAAkB;IACrC,OAAO,CAAC,QAAQ,CAAC,kBAAkB;IACvB,OAAO,CAAC,QAAQ,CAAC,uBAAuB;IAC3C,OAAO,CAAC,QAAQ,CAAC,oBAAoB;IACvD,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IAC9E;;;OAGG;IACsD,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC;IAf7F,SAAS,CAAC,QAAQ,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;gBAG3B,MAAM,EAAE,aAAa,EACR,YAAY,EAAE,0BAA0B,EACrC,sBAAsB,EAAE,6BAA6B,EAChD,kBAAkB,EAAE,2BAA2B,EACjD,kBAAkB,EAAE,gCAAgC,EACxC,uBAAuB,EAAE,qCAAqC,EACjE,oBAAoB,EAAE,yCAAyC,EACjF,gBAAgB,EAAE,uBAAuB;IACvG;;;OAGG;IACuE,gBAAgB,CAAC,EAAE,uBAAuB;IAMtH;;;;;;;;;;;;;OAaG;IACH,MAAM,CAAC,yBAAyB,CAAC,CAAC,SAAS,+BAA+B,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,EAAE,SAAS,EAAE,CAAC,GAAG,CAAC;IAY3G;;;;;;OAMG;IACG,IAAI,CAAC,MAAM,EAAE,yBAAyB,GAAG,OAAO,CAAC,eAAe,CAAC;IA+GvE;;;;;;;;;;;OAWG;IACG,uBAAuB,CAC3B,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACvC,MAAM,EAAE,qBAAqB,GAC5B,OAAO,CAAC;QAAE,KAAK,EAAE,eAAe,CAAC;QAAC,QAAQ,EAAE,uBAAuB,CAAA;KAAE,GAAG,SAAS,CAAC;IA8BrF,2GAA2G;IAC3G,wBAAwB,CAAC,QAAQ,EAAE,uBAAuB,GAAG,qBAAqB;IAIlF;;;;OAIG;IACG,gBAAgB,CACpB,KAAK,EAAE;QAAE,KAAK,EAAE,eAAe,CAAC;QAAC,QAAQ,EAAE,uBAAuB,CAAA;KAAE,EACpE,IAAI,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,EACxD,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,GACtC,OAAO,CAAC,IAAI,CAAC;IAiBhB;;;;OAIG;IACG,UAAU,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,CAAC;IAyCpE;;;;OAIG;IACG,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC;IA+BxF;;;;OAIG;YACW,gBAAgB;IAO9B,OAAO,CAAC,WAAW;IAOnB,2GAA2G;IAC3G,OAAO,CAAC,oBAAoB;IAS5B,uGAAuG;IACvG,OAAO,CAAC,eAAe;IAOvB,OAAO,CAAC,SAAS;YAUH,KAAK;CAuBpB"}
+{"version":3,"file":"file-upload-grant.backend.service.d.ts","sourceRoot":"","sources":["../../../../src/files/services/file-upload-grant.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAGH,OAAO,EAgBL,KAAK,eAAe,EACpB,KAAK,uBAAuB,EAC5B,KAAK,wBAAwB,EAC7B,KAAK,qBAAqB,EAC1B,KAAK,+BAA+B,EACpC,KAAK,YAAY,EAIlB,MAAM,uBAAuB,CAAC;AAG/B,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAClG,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAE9G,OAAO,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AAC/G,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qEAAqE,CAAC;AAC5G,OAAO,EAAE,6BAA6B,EAAE,MAAM,yFAAyF,CAAC;AACxI,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uFAAuF,CAAC;AAC7H,OAAO,EAAE,2BAA2B,EAAE,MAAM,qFAAqF,CAAC;AAClI,OAAO,EAAE,gCAAgC,EAAE,MAAM,wEAAwE,CAAC;AAC1H,OAAO,EAAE,qCAAqC,EAAE,MAAM,+EAA+E,CAAC;AACtI,OAAO,EAAE,yCAAyC,EAAE,MAAM,qGAAqG,CAAC;AAChK,OAAO,EAAgC,KAAK,qBAAqB,EAAE,MAAM,oDAAoD,CAAC;AAE9H,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,gFAAgF,CAAC;AAkD9H,gFAAgF;AAChF,MAAM,WAAW,qBAAqB;IACpC,YAAY,EAAE,YAAY,CAAC;IAC3B,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,wBAAwB,CAAC;IACpC,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,yBAAyB;IACxC,yFAAyF;IACzF,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACxC,MAAM,EAAE,qBAAqB,CAAC;IAC9B,qGAAqG;IACrG,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;;OAGG;IACH,QAAQ,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAC/D,+GAA+G;IAC/G,SAAS,EAAE,MAAM,CAAC;IAClB,gHAAgH;IAChH,UAAU,EAAE,MAAM,CAAC;IACnB,6DAA6D;IAC7D,iBAAiB,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CAChE;AAED,qBACa,6BAA6B;IAIH,OAAO,CAAC,QAAQ,CAAC,MAAM;IACV,OAAO,CAAC,QAAQ,CAAC,YAAY;IAC1B,OAAO,CAAC,QAAQ,CAAC,sBAAsB;IAClC,OAAO,CAAC,QAAQ,CAAC,kBAAkB;IACrC,OAAO,CAAC,QAAQ,CAAC,kBAAkB;IACvB,OAAO,CAAC,QAAQ,CAAC,uBAAuB;IAC3C,OAAO,CAAC,QAAQ,CAAC,oBAAoB;IACvD,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IAC9E;;;OAGG;IACsD,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC;IAf7F,SAAS,CAAC,QAAQ,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;gBAG3B,MAAM,EAAE,aAAa,EACR,YAAY,EAAE,0BAA0B,EACrC,sBAAsB,EAAE,6BAA6B,EAChD,kBAAkB,EAAE,2BAA2B,EACjD,kBAAkB,EAAE,gCAAgC,EACxC,uBAAuB,EAAE,qCAAqC,EACjE,oBAAoB,EAAE,yCAAyC,EACjF,gBAAgB,EAAE,uBAAuB;IACvG;;;OAGG;IACuE,gBAAgB,CAAC,EAAE,uBAAuB;IAMtH;;;;;;;;;;;;;OAaG;IACH,MAAM,CAAC,yBAAyB,CAAC,CAAC,SAAS,+BAA+B,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,EAAE,SAAS,EAAE,CAAC,GAAG,CAAC;IAY3G;;;;;;OAMG;IACG,IAAI,CAAC,MAAM,EAAE,yBAAyB,GAAG,OAAO,CAAC,eAAe,CAAC;IAgHvE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAiCG;IACG,uBAAuB,CAC3B,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACvC,MAAM,EAAE,qBAAqB,EAC7B,mBAAmB,EAAE,MAAM,GAC1B,OAAO,CAAC;QAAE,KAAK,EAAE,eAAe,CAAC;QAAC,QAAQ,EAAE,uBAAuB,CAAA;KAAE,GAAG,SAAS,CAAC;IAyCrF;;;;;;;;;;;OAWG;IACH,wBAAwB,CAAC,QAAQ,EAAE,uBAAuB,GAAG,qBAAqB;IAIlF;;;;OAIG;IACG,gBAAgB,CACpB,KAAK,EAAE;QAAE,KAAK,EAAE,eAAe,CAAC;QAAC,QAAQ,EAAE,uBAAuB,CAAA;KAAE,EACpE,IAAI,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,EACxD,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,GACtC,OAAO,CAAC,IAAI,CAAC;IAiBhB;;;;OAIG;IACG,UAAU,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,CAAC;IAyCpE;;;;OAIG;IACG,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC;IA+BxF;;;;OAIG;YACW,gBAAgB;IAO9B,OAAO,CAAC,WAAW;IAOnB,2GAA2G;IAC3G,OAAO,CAAC,oBAAoB;IAS5B;;;;;OAKG;IACH,OAAO,CAAC,+BAA+B;IA0BvC,mFAAmF;IACnF,OAAO,CAAC,YAAY;IAIpB,uGAAuG;IACvG,OAAO,CAAC,eAAe;IAOvB,OAAO,CAAC,SAAS;YAUH,KAAK;CAuBpB"}

package/dist/esm/files/services/file-upload-grant.backend.service.js

@@ -49,6 +49,54 @@ import { ExecutionContextCreatorBackendService } from '../../runtime/services/ex
 import { RepositoriesRegistryHandlerBackendService } from '../../base-classes/services/repositories/repositories-registry-handler.backend.service.js';
 import { resolveFileUploaderPrincipal } from '../../files/utils/file-uploader.utils.js';
 import { AuthControllerUtils } from '../../security/authentications/services/utils/auth-controller.utils.js';
+/**
+ * Reduce an upload-route URL to the one form the grant's route check compares — its PATH — or
+ * `undefined` when it cannot be read as a URL at all.
+ *
+ * Accepts both shapes the two sides supply: an ABSOLUTE URL (what `metadata.uploadUrl` records, and
+ * what a proxy's absolute-form request target produces) and an ORIGIN-RELATIVE path (what Express's
+ * `req.originalUrl` normally is). Parsed against a throwaway base so one function handles both.
+ *
+ * ## What is normalised away, and why each is safe
+ *
+ * - **Query and fragment.** Mandatory, not cosmetic: GATE 1 accepts the grant in `?consumable_token=`
+ *   as well as the header, so a redemption legitimately carries a query the mint's URL never had.
+ *   Comparing with the query attached would refuse the query-token form outright.
+ * - **A single trailing slash.** Express routes with `strict: false` by default, so `…/attachment/`
+ *   reaches the same handler as `…/attachment`. Refusing one of the two would be an artefact of this
+ *   comparison rather than a fact about the grant. `/` itself is left alone.
+ *
+ * ## What is deliberately NOT normalised
+ *
+ * - **The ORIGIN is not compared at all** — only the path is. Both origins come from the same server
+ *   config (`runtime.endPoints.main_backend_api.publicUrl`, never the client's Host header, which is
+ *   why the mint reads config in the first place), so an origin comparison is tautological against an
+ *   attacker and can only ever produce a false refusal: change `publicUrl` and every unredeemed grant
+ *   — up to an hour of them — stops matching. Nothing is given up, because the origin carries no
+ *   value a caller could vary.
+ * - **Case.** Express matches case-insensitively by default, so `/Files/attachment` would reach the
+ *   route while comparing unequal. Case-folding was rejected: path segments carry IDs, and folding
+ *   them would make `/todos/AbC` ≡ `/todos/abc` and quietly weaken the row and parent pins this check
+ *   exists to add. Folding only the static segments is not available — nothing here can tell a static
+ *   segment from an id. The cost is that a caller who re-cases the URL is refused; there is no
+ *   legitimate reason to, since the grant hands back the exact URL to post to.
+ * - **Percent-encoding.** Not decoded. Decoding is how path-confusion bugs are born: `%2F` would
+ *   become `/` and two different routes would compare equal. The raw encoded forms are compared, and
+ *   the ids that reach these paths are constrained to alphanumerics, `-` and `_` by
+ *   `validateParameterFormat`, which are encoding-invariant.
+ */
+function normalizeUploadRoutePath(url) {
+    let path;
+    try {
+        // The base is never used for an absolute input, and for a relative one only its origin is
+        // discarded below — so it can be any valid origin.
+        path = new URL(url, 'http://upload-route.invalid').pathname;
+    }
+    catch {
+        return undefined;
+    }
+    return path.length > 1 && path.endsWith('/') ? path.slice(0, -1) : path;
+}
 let FileUploadGrantBackendService = class FileUploadGrantBackendService {
     logger;
     errorBuilder;
@@ -138,6 +186,7 @@ let FileUploadGrantBackendService = class FileUploadGrantBackendService {
             });
         }
         const constraint = await this.constraintResolver.resolve({ resourceType: target.resourceType, fieldName: target.fieldName });
+        this.assertDeclarationFitsConstraint(params.declared, constraint, executionContext, target);
         const expiresInMinutes = params.expiresInMinutes ?? FILE_UPLOAD_GRANT_DEFAULT_MINUTES;
         const metadataWithoutUrl = {
             fieldName: target.fieldName,
@@ -163,7 +212,7 @@ let FileUploadGrantBackendService = class FileUploadGrantBackendService {
         const uploadPageUrl = this.resolveUploadPageUrl(tokenValue);
         const statusUrl = `${params.apiBaseUrl}/files/upload-grants/${encodeURIComponent(tokenValue)}`;
         const headerName = WildoHeaderKeys.CONSUMABLE_TOKEN;
-        const fileHint = this.suggestFileName(target.fieldName, constraint.allowedMimeTypes);
+        const fileHint = params.declared?.name?.trim() ? this.safeFileName(params.declared.name) : this.suggestFileName(target.fieldName, constraint.allowedMimeTypes);
         const grant = {
             grantId,
             state: FileUploadGrantState.PENDING,
@@ -214,8 +263,30 @@ let FileUploadGrantBackendService = class FileUploadGrantBackendService {
      *
      * For UPDATE the creator has already coherence-checked `relatedId` against the URL id; the check is
      * repeated here because CREATE has no id, so this is the one place both kinds are decided.
+     *
+     * ## The fifth check: the concrete ROUTE, added 2026-09-08
+     *
+     * `presentedRequestUrl` is the request's own `originalUrl`, and its path must equal the path of the
+     * `uploadUrl` the grant recorded at mint. The other four checks pin the resource, the field, the
+     * write kind and (for UPDATE) the row — they do NOT pin which of a resource's several upload ROUTES
+     * was used. A resource whose operation declares more than one `initiatorInfo` registers one upload
+     * route per parent path, and `validateParameterCoherence` only pins the `{param}`s the TOKEN itself
+     * supplies (`organizationId`, `userId`, and the resource's own id via `relatedId`); every other
+     * segment — an intermediate parent id, a nested FK — comes from the URL alone and matched nothing.
+     * So a grant minted under one parent could be redeemed under another, and the minter's snapshotted
+     * roles would be re-decided there. This closes that: the grant unlocks the ONE route its mint was
+     * authorized on, which is the same route it publishes in `uploadUrl` / `uploadCommand` /
+     * `uploadPageUrl` and re-emits from the status read.
+     *
+     * It does NOT close anything the authorizer would refuse anyway (roles are still re-evaluated on the
+     * presented route), replay (SINGLE_USE consumption does that), or a leaked token being redeemed on
+     * the recorded route by whoever holds it — the token IS the credential, by design.
+     *
+     * Note this middleware also fronts the MINT route (`…/files/<field>/grant`), whose path differs from
+     * the recorded one by that last segment. A grant presented THERE is now refused here rather than two
+     * steps later by mint's own "a grant may not mint a grant" rule. Both refusals stay.
      */
-    async assertGrantMatchesRoute(executionContext, target) {
+    async assertGrantMatchesRoute(executionContext, target, presentedRequestUrl) {
         if (executionContext.executionType !== ExecutionContext_ExecutionType.CONSUMABLE_TOKEN)
             return undefined;
         const tokenValue = executionContext.consumableTokenValue;
@@ -246,9 +317,31 @@ let FileUploadGrantBackendService = class FileUploadGrantBackendService {
             throw mismatch('operation');
         if (target.operation === CoreResourceOperation.UPDATE ? token.relatedId !== target.resourceId : token.relatedId != null)
             throw mismatch('resourceId');
+        // The two `undefined` clauses are REDUNDANT today and kept deliberately, which is worth stating so
+        // nobody "simplifies" them back out. An unreadable side already loses the inequality against a
+        // readable one, and `metadata.uploadUrl` is `z.string().url()` so the recorded side cannot be
+        // unreadable at all — the parse above refuses first. What they guard is the ONE case where the
+        // inequality would ADMIT: both sides unreadable, `undefined === undefined`. Reaching it needs that
+        // schema to loosen, so it cannot be pinned from a test; the pin covers the outcome (an unreadable
+        // request target is refused) rather than the clause.
+        const recordedPath = normalizeUploadRoutePath(metadata.uploadUrl);
+        const presentedPath = normalizeUploadRoutePath(presentedRequestUrl);
+        if (recordedPath === undefined || presentedPath === undefined || recordedPath !== presentedPath)
+            throw mismatch('uploadUrl');
         return { token, metadata };
     }
-    /** The uploader the redeemed file is attributed to: the MINTER, from the grant, never the grant itself. */
+    /**
+     * The uploader the redeemed file is attributed to: the MINTER, from the grant, never the grant itself.
+     *
+     * No cast: `metadata.minter.entityType` is the `FileUploaderEntityType` enum because the metadata
+     * schema says so, and the metadata reached here through `safeParse`. It carried
+     * `as FileUploaderPrincipal['uploadedByEntityType']` until 2026-09-08 — a cast that told the type
+     * system a closed union had been checked when nothing had checked it. The runtime was not actually
+     * open (`validateUploadedByEntityType` re-checks membership in the upload handler and again in
+     * `createFile`), so this was a lie to the compiler rather than a hole to the database; what it cost
+     * was the refusal landing three layers downstream, as a VALIDATION error mid-upload, at a parameter
+     * typed `unknown`, instead of at the boundary that parses the grant.
+     */
     resolveUploaderFromGrant(metadata) {
         return { uploadedBy: metadata.minter.id, uploadedByEntityType: metadata.minter.entityType };
     }
@@ -382,6 +475,37 @@ let FileUploadGrantBackendService = class FileUploadGrantBackendService {
         const trimmed = base.endsWith('/') ? base.slice(0, -1) : base;
         return `${trimmed}${FILE_UPLOAD_GRANT_PAGE_PATH}/${encodeURIComponent(tokenValue)}`;
     }
+    /**
+     * Refuse, at MINT, a declared file the field could never accept — the early half of the check the
+     * upload route performs on receipt. Only what was declared is checked; an undeclared fact is checked
+     * on the bytes. `allowedMimeTypes` empty means every type is accepted; a `type/*` entry matches its
+     * whole family, as the upload validator reads it.
+     */
+    assertDeclarationFitsConstraint(declared, constraint, executionContext, target) {
+        if (!declared)
+            return;
+        if (declared.size !== undefined && declared.size > constraint.maxSize) {
+            throw this.errorBuilder.buildError(ErrorType.VALIDATION, executionContext, {
+                customMessageReference: ErrorCustomMessageReference.VALIDATION,
+                context: { message: 'Declared file size exceeds the field maximum', declaredSize: declared.size, maxBytes: constraint.maxSize, fieldName: target.fieldName }, // diagnostic (log-only)
+            });
+        }
+        const allowed = constraint.allowedMimeTypes ?? [];
+        if (declared.mimeType && allowed.length > 0) {
+            const mime = declared.mimeType.toLowerCase();
+            const fits = allowed.some((a) => a.toLowerCase() === mime || (a.endsWith('/*') && mime.startsWith(a.slice(0, -1).toLowerCase())));
+            if (!fits) {
+                throw this.errorBuilder.buildError(ErrorType.VALIDATION, executionContext, {
+                    customMessageReference: ErrorCustomMessageReference.VALIDATION,
+                    context: { message: 'Declared MIME type is not accepted by the field', declaredMimeType: declared.mimeType, allowedMimeTypes: allowed, fieldName: target.fieldName }, // diagnostic (log-only)
+                });
+            }
+        }
+    }
+    /** A declared file name reduced to what is safe inside a quoted shell argument. */
+    safeFileName(name) {
+        return name.replace(/[^\w.\- ]+/g, '_').replace(/\s+/g, ' ').trim().slice(0, 120) || 'file';
+    }
     /** A plausible file name for the curl example, from the field name and the first allowed MIME type. */
     suggestFileName(fieldName, allowedMimeTypes) {
         const stem = fieldName.replace(/[^\w.-]+/g, '_').replace(/\./g, '-').slice(0, 40) || 'file';

package/dist/esm/files/services/file-upload-grant.backend.service.js.map

@@ -1 +1 @@
-{"version":3,"file":"file-upload-grant.backend.service.js","sourceRoot":"","sources":["../../../../../src/files/services/file-upload-grant.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;;;;;;;;;;;;;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AACzD,OAAO,EAEL,+BAA+B,EAC/B,sBAAsB,EACtB,wBAAwB,EACxB,cAAc,EACd,2BAA2B,EAC3B,SAAS,EACT,8BAA8B,EAC9B,iCAAiC,EACjC,2BAA2B,EAC3B,6BAA6B,EAC7B,oBAAoB,EACpB,0BAA0B,EAC1B,yBAAyB,EACzB,eAAe,EAOf,gBAAgB,EAChB,qBAAqB,GAEtB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,YAAY,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAC9E,OAAO,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AAEpF,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAC9G,OAAO,EAAE,2BAA2B,EAAE,MAAM,8EAA8E,CAAC;AAC3H,OAAO,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AAE/G,OAAO,EAAE,6BAA6B,EAAE,MAAM,yFAAyF,CAAC;AAExI,OAAO,EAAE,2BAA2B,EAAE,MAAM,qFAAqF,CAAC;AAClI,OAAO,EAAE,gCAAgC,EAAE,MAAM,wEAAwE,CAAC;AAC1H,OAAO,EAAE,qCAAqC,EAAE,MAAM,+EAA+E,CAAC;AACtI,OAAO,EAAE,yCAAyC,EAAE,MAAM,qGAAqG,CAAC;AAChK,OAAO,EAAE,4BAA4B,EAA8B,MAAM,oDAAoD,CAAC;AAC9H,OAAO,EAAE,mBAAmB,EAAE,MAAM,kFAAkF,CAAC;AA0BhH,IAAM,6BAA6B,GAAnC,MAAM,6BAA6B;IAIc;IACa;IACG;IACK;IACF;IACY;IACH;IAClB;IAKY;IAflE,QAAQ,CAA+D;IAEjF,YACsD,MAAqB,EACR,YAAwC,EACrC,sBAAqD,EAChD,kBAA+C,EACjD,kBAAoD,EACxC,uBAA8D,EACjE,oBAA+D,EACjF,gBAAyC,EAK7B,gBAA0C;QAZhE,WAAM,GAAN,MAAM,CAAe;QACR,iBAAY,GAAZ,YAAY,CAA4B;QACrC,2BAAsB,GAAtB,sBAAsB,CAA+B;QAChD,uBAAkB,GAAlB,kBAAkB,CAA6B;QACjD,uBAAkB,GAAlB,kBAAkB,CAAkC;QACxC,4BAAuB,GAAvB,uBAAuB,CAAuC;QACjE,yBAAoB,GAApB,oBAAoB,CAA2C;QACjF,qBAAgB,GAAhB,gBAAgB,CAAyB;QAK7B,qBAAgB,GAAhB,gBAAgB,CAA0B;QAEpH,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,+BAA+B,CAAC,CAAC;QACzE,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,+BAA+B,EAAE,KAAK,CAAC,CAAC;IAC1E,CAAC;IAED;;;;;;;;;;;;;OAaG;IACH,MAAM,CAAC,yBAAyB,CAA2D,SAAY;QACrG,MAAM,QAAQ,GAAG,qBAAqB,IAAI,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,mBAAmB,CAAC,CAAC,CAAC,SAAS,CAAC;QAChG,MAAM,aAAa,GAAG,QAAQ,EAAE,MAAM,KAAK,yBAAyB,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/G,OAAO;YACL,GAAG,SAAS;YACZ,mBAAmB,EAAE;gBACnB,KAAK,EAAE,CAAC,GAAG,aAAa,EAAE,wBAAwB,CAAC,iBAAiB,CAAC;gBACrE,MAAM,EAAE,yBAAyB,CAAC,WAAW;aAC9C;SACG,CAAC;IACT,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,IAAI,CAAC,MAAiC;QAC1C,MAAM,EAAE,gBAAgB,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC;QAE5C,IACE,gBAAgB,CAAC,aAAa,KAAK,8BAA8B,CAAC,gBAAgB;eAC/E,gBAAgB,CAAC,aAAa,KAAK,8BAA8B,CAAC,iBAAiB,EACtF,CAAC;YACD,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,gBAAgB,EAAE;gBAC5E,sBAAsB,EAAE,2BAA2B,CAAC,qCAAqC;gBACzF,OAAO,EAAE,EAAE,aAAa,EAAE,gBAAgB,CAAC,aAAa,EAAE,EAAE,wBAAwB;aACrF,CAAC,CAAC;QACL,CAAC;QAED,MAAM,MAAM,GAAG,4BAA4B,CAAC,gBAAgB,CAAC,CAAC;QAC9D,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,mFAAmF;YACnF,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,gBAAgB,EAAE;gBAC5E,sBAAsB,EAAE,2BAA2B,CAAC,qCAAqC;gBACzF,OAAO,EAAE,EAAE,aAAa,EAAE,gBAAgB,CAAC,aAAa,EAAE,MAAM,EAAE,uBAAuB,EAAE,EAAE,wBAAwB;aACtH,CAAC,CAAC;QACL,CAAC;QAED,MAAM,SAAS,GAAG,IAAI,CAAC,kBAAkB,CAAC,oBAAoB,CAAC,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;QACtG,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,gBAAgB,EAAE;gBACzE,sBAAsB,EAAE,2BAA2B,CAAC,UAAU;gBAC9D,OAAO,EAAE,EAAE,OAAO,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,EAAE,wBAAwB;aACnI,CAAC,CAAC;QACL,CAAC;QACD,IAAI,SAAS,CAAC,YAAY,CAAC,UAAU,EAAE,MAAM,KAAK,oBAAoB,CAAC,YAAY,EAAE,CAAC;YACpF,kGAAkG;YAClG,sFAAsF;YACtF,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,gBAAgB,EAAE;gBAC5E,sBAAsB,EAAE,2BAA2B,CAAC,iCAAiC;gBACrF,OAAO,EAAE,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,EAAE,wBAAwB;aACtG,CAAC,CAAC;QACL,CAAC;QAED,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC;QAC7H,MAAM,gBAAgB,GAAG,MAAM,CAAC,gBAAgB,IAAI,iCAAiC,CAAC;QAEtF,MAAM,kBAAkB,GAAkE;YACxF,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,MAAM,EAAE,EAAE,UAAU,EAAE,MAAM,CAAC,oBAAoB,EAAE,EAAE,EAAE,MAAM,CAAC,UAAU,EAAE;SAC3E,CAAC;QAEF,qGAAqG;QACrG,iGAAiG;QACjG,6FAA6F;QAC7F,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,WAAW,CAAC;YAC1D,SAAS,EAAE,wBAAwB,CAAC,iBAAiB;YACrD,eAAe,EAAE,+BAA+B,CAAC,UAAU;YAC3D,SAAS,EAAE,EAAE,KAAK,EAAE,gBAAgB,EAAE,IAAI,EAAE,YAAY,CAAC,OAAO,EAAE;YAClE,cAAc,EAAE,gBAAgB,CAAC,YAAY,EAAE,cAAc;YAC7D,MAAM,EAAE,gBAAgB,CAAC,YAAY,EAAE,MAAM;YAC7C,kBAAkB,EAAE,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC;YAC/C,SAAS,EAAE,MAAM,CAAC,UAAU;YAC5B,KAAK,EAAE,CAAC,GAAG,CAAC,gBAAgB,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC;YACnD,QAAQ,EAAE,EAAE,GAAG,kBAAkB,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE;SACjE,CAAC,CAAC;QAEH,MAAM,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC;QAC1B,MAAM,UAAU,GAAG,KAAK,CAAC,KAAK,CAAC;QAC/B,MAAM,aAAa,GAAG,IAAI,CAAC,oBAAoB,CAAC,UAAU,CAAC,CAAC;QAC5D,MAAM,SAAS,GAAG,GAAG,MAAM,CAAC,UAAU,wBAAwB,kBAAkB,CAAC,UAAU,CAAC,EAAE,CAAC;QAC/F,MAAM,UAAU,GAAG,eAAe,CAAC,gBAAgB,CAAC;QACpD,MAAM,QAAQ,GAAG,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,SAAS,EAAE,UAAU,CAAC,gBAAgB,CAAC,CAAC;QAErF,MAAM,KAAK,GAAoB;YAC7B,OAAO;YACP,KAAK,EAAE,oBAAoB,CAAC,OAAO;YACnC,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC,WAAW,EAAE;YACxC,SAAS,EAAE,IAAI;YACf,MAAM,EAAE;gBACN,YAAY,EAAE,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC;gBACzC,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,IAAI;aACtC;YACD,WAAW,EAAE;gBACX,QAAQ,EAAE,UAAU,CAAC,OAAO;gBAC5B,gBAAgB,EAAE,UAAU,CAAC,gBAAgB,IAAI,EAAE;aACpD;YACD,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,YAAY,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,UAAU,EAAE;YACrD,yFAAyF;YACzF,aAAa,EAAE,gBAAgB,UAAU,KAAK,UAAU,wBAAwB,QAAQ,MAAM,MAAM,CAAC,SAAS,GAAG;YACjH,6GAA6G;YAC7G,uBAAuB,EAAE,oBAAoB,UAAU,KAAK,UAAU,6BAA6B,QAAQ,MAAM,MAAM,CAAC,SAAS,GAAG;YACpI,aAAa;YACb,SAAS;YACT,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,aAAa,KAAK,IAAI,CAAC;SACrD,CAAC;QAEF,MAAM,IAAI,CAAC,KAAK,CAAC,gBAAgB,EAAE,sBAAsB,CAAC,wBAAwB,EAAE,0BAA0B,CAAC,MAAM,EAAE;YACrH,OAAO;YACP,YAAY,EAAE,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC;YACzC,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,IAAI;YACrC,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,MAAM,EAAE,kBAAkB,CAAC,MAAM;YACjC,SAAS,EAAE,MAAM,CAAC,iBAAiB,EAAE,SAAS;YAC9C,SAAS,EAAE,MAAM,CAAC,iBAAiB,EAAE,SAAS;SAC/C,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,0BAA0B,EAAE,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC;QACpJ,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,uBAAuB,CAC3B,gBAAuC,EACvC,MAA6B;QAE7B,IAAI,gBAAgB,CAAC,aAAa,KAAK,8BAA8B,CAAC,gBAAgB;YAAE,OAAO,SAAS,CAAC;QACzG,MAAM,UAAU,GAAG,gBAAgB,CAAC,oBAAoB,CAAC;QACzD,IAAI,CAAC,UAAU;YAAE,OAAO,SAAS,CAAC;QAElC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC;QAC1E,IAAI,KAAK,CAAC,SAAS,KAAK,wBAAwB,CAAC,iBAAiB;YAAE,OAAO,SAAS,CAAC;QAErF,MAAM,MAAM,GAAG,6BAA6B,CAAC,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACvE,MAAM,QAAQ,GAAG,CAAC,MAAc,EAAE,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,gBAAgB,EAAE;YAC5G,sBAAsB,EAAE,2BAA2B,CAAC,iCAAiC;YACrF,OAAO,EAAE;gBACP,wBAAwB;gBACxB,OAAO,EAAE,KAAK,CAAC,GAAG;gBAClB,MAAM;gBACN,WAAW,EAAE,MAAM;gBACnB,WAAW,EAAE,EAAE,kBAAkB,EAAE,KAAK,CAAC,kBAAkB,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,QAAQ,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,EAAE;aAC9I;SACF,CAAC,CAAC;QAEH,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,MAAM,QAAQ,CAAC,4BAA4B,CAAC,CAAC;QAClE,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC;QAC7B,IAAI,KAAK,CAAC,kBAAkB,KAAK,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC;YAAE,MAAM,QAAQ,CAAC,UAAU,CAAC,CAAC;QACzF,IAAI,QAAQ,CAAC,SAAS,KAAK,MAAM,CAAC,SAAS;YAAE,MAAM,QAAQ,CAAC,OAAO,CAAC,CAAC;QACrE,IAAI,QAAQ,CAAC,SAAS,KAAK,MAAM,CAAC,SAAS;YAAE,MAAM,QAAQ,CAAC,WAAW,CAAC,CAAC;QACzE,IAAI,MAAM,CAAC,SAAS,KAAK,qBAAqB,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,KAAK,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,IAAI,IAAI;YAAE,MAAM,QAAQ,CAAC,YAAY,CAAC,CAAC;QAEtJ,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;IAC7B,CAAC;IAED,2GAA2G;IAC3G,wBAAwB,CAAC,QAAiC;QACxD,OAAO,EAAE,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,EAAE,oBAAoB,EAAE,QAAQ,CAAC,MAAM,CAAC,UAA2D,EAAE,CAAC;IAC/I,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,gBAAgB,CACpB,KAAoE,EACpE,IAAwD,EACxD,gBAAuC;QAEvC,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,sBAAsB,CAAC,iCAAiC,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QACpG,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,wFAAwF,EAAE;gBACzG,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,GAAG,2BAA2B,CAAC,KAAK,CAAC;aACrF,CAAC,CAAC;QACL,CAAC;QACD,MAAM,IAAI,CAAC,KAAK,CAAC,gBAAgB,EAAE,sBAAsB,CAAC,0BAA0B,EAAE,0BAA0B,CAAC,GAAG,EAAE;YACpH,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,GAAG;YACxB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,MAAM,EAAE,KAAK,CAAC,QAAQ,CAAC,MAAM;SAC9B,CAAC,CAAC;IACL,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,UAAU,CAAC,UAAkB;QACjC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,gBAAgB,CAAC,UAAU,CAAC,CAAC;QAC7E,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,SAAS,KAAK,wBAAwB,CAAC,iBAAiB,EAAE,CAAC;YAC7E,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,SAAS,EAAE,SAAS,EAAE;gBACjE,sBAAsB,EAAE,2BAA2B,CAAC,2BAA2B;aAChF,CAAC,CAAC;QACL,CAAC;QACD,MAAM,MAAM,GAAG,6BAA6B,CAAC,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACvE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,SAAS,EAAE,SAAS,EAAE;gBACjE,sBAAsB,EAAE,2BAA2B,CAAC,2BAA2B;gBAC/E,OAAO,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,4BAA4B,EAAE,EAAE,wBAAwB;aAChG,CAAC,CAAC;QACL,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC;QAC7B,MAAM,YAAY,GAAG,KAAK,CAAC,kBAAkC,CAAC;QAC9D,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC,EAAE,YAAY,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS,EAAE,CAAC,CAAC;QAE1G,IAAI,IAAI,GAAkC,IAAI,CAAC;QAC/C,IAAI,QAAQ,CAAC,cAAc,EAAE,CAAC;YAC5B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;YACtE,IAAI,QAAQ;gBAAE,IAAI,GAAG,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;QAC5E,CAAC;QAED,OAAO;YACL,OAAO,EAAE,KAAK,CAAC,GAAG;YAClB,KAAK,EAAE,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC;YAC9B,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC,WAAW,EAAE;YACxC,MAAM,EAAE;gBACN,YAAY,EAAE,MAAM,CAAC,YAAY,CAAC;gBAClC,SAAS,EAAE,QAAQ,CAAC,SAAS;gBAC7B,SAAS,EAAE,QAAQ,CAAC,SAAS;gBAC7B,UAAU,EAAE,KAAK,CAAC,SAAS,IAAI,IAAI;aACpC;YACD,WAAW,EAAE,EAAE,QAAQ,EAAE,UAAU,CAAC,OAAO,EAAE,gBAAgB,EAAE,UAAU,CAAC,gBAAgB,IAAI,EAAE,EAAE;YAClG,SAAS,EAAE,QAAQ,CAAC,SAAS;YAC7B,gBAAgB,EAAE,eAAe,CAAC,gBAAgB;YAClD,IAAI;SACL,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,MAAM,CAAC,OAAe,EAAE,gBAAuC;QACnE,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;QACvE,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,SAAS,KAAK,wBAAwB,CAAC,iBAAiB,EAAE,CAAC;YAC7E,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,SAAS,EAAE,gBAAgB,EAAE;gBACxE,sBAAsB,EAAE,2BAA2B,CAAC,2BAA2B;aAChF,CAAC,CAAC;QACL,CAAC;QACD,MAAM,MAAM,GAAG,6BAA6B,CAAC,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACvE,MAAM,MAAM,GAAG,4BAA4B,CAAC,gBAAgB,CAAC,CAAC;QAC9D,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,IAAI,MAAM,KAAK,SAAS;eAClD,MAAM,CAAC,UAAU,KAAK,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,MAAM,CAAC,oBAAoB,KAAK,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC;QAClH,MAAM,YAAY,GAAG,CAAC,gBAAgB,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,cAAc,CAAC,qBAAqB,CAAC,CAAC,CAAC;QACzI,IAAI,CAAC,QAAQ,IAAI,CAAC,YAAY,EAAE,CAAC;YAC/B,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,gBAAgB,EAAE;gBAC5E,sBAAsB,EAAE,2BAA2B,CAAC,4BAA4B;gBAChF,OAAO,EAAE,EAAE,OAAO,EAAE,EAAE,wBAAwB;aAC/C,CAAC,CAAC;QACL,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;QACvE,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,IAAI,CAAC,KAAK,CAAC,gBAAgB,EAAE,sBAAsB,CAAC,yBAAyB,EAAE,0BAA0B,CAAC,GAAG,EAAE;gBACnH,OAAO;gBACP,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,oBAAoB,EAAE,EAAE,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,IAAI;gBAC7F,YAAY,EAAE,CAAC,QAAQ,IAAI,YAAY;aACxC,CAAC,CAAC;QACL,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,8EAA8E;IAE9E;;;;OAIG;IACK,KAAK,CAAC,gBAAgB,CAAC,MAAc;QAC3C,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,gCAAgC,EAAE,CAAC;QAC9F,MAAM,eAAe,GAAG,IAAI,CAAC,oBAAoB,CAAC,oBAAoB,CAAC,gBAAgB,CAAC,KAAK,EAAE,eAAe,CAAC,CAAC;QAChH,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,IAAI,CAAO,eAAe,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC;QAChF,OAAO,IAAI,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACpE,CAAC;IAEO,WAAW,CAAC,KAAsB;QACxC,IAAI,KAAK,CAAC,SAAS;YAAE,OAAO,oBAAoB,CAAC,OAAO,CAAC;QACzD,IAAI,KAAK,CAAC,UAAU;YAAE,OAAO,oBAAoB,CAAC,QAAQ,CAAC;QAC3D,IAAI,KAAK,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE;YAAE,OAAO,oBAAoB,CAAC,OAAO,CAAC;QACjF,OAAO,oBAAoB,CAAC,OAAO,CAAC;IACtC,CAAC;IAED,2GAA2G;IACnG,oBAAoB,CAAC,UAAkB;QAC7C,MAAM,MAAM,GAAG,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC;QAC5C,MAAM,mBAAmB,GAAG,IAAI,CAAC,gBAAgB,CAAC,iCAAiC,EAAE,CAAC;QACtF,MAAM,IAAI,GAAG,mBAAmB,CAAC,CAAC,CAAC,mBAAmB,CAAC,uBAAuB,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACnH,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC;QACvB,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC9D,OAAO,GAAG,OAAO,GAAG,2BAA2B,IAAI,kBAAkB,CAAC,UAAU,CAAC,EAAE,CAAC;IACtF,CAAC;IAED,uGAAuG;IAC/F,eAAe,CAAC,SAAiB,EAAE,gBAAsC;QAC/E,MAAM,IAAI,GAAG,SAAS,CAAC,OAAO,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC;QAC5F,MAAM,KAAK,GAAG,gBAAgB,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;QAC/D,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC7F,OAAO,GAAG,IAAI,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACvE,CAAC;IAEO,SAAS,CAAC,MAA6B,EAAE,OAAgB;QAC/D,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,KAAK,qBAAqB,CAAC,MAAM;YAC9D,CAAC,CAAC,qCAAqC,MAAM,CAAC,SAAS,0BAA0B,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,MAAM,CAAC,UAAU,EAAE;YACnI,CAAC,CAAC,qCAAqC,MAAM,CAAC,SAAS,8BAA8B,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,SAAS,CAAC;QAC5H,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,CAAC,gFAAgF,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9G,OAAO,qFAAqF,KAAK,GAAG,MAAM,IAAI;cAC1G,8GAA8G;cAC9G,0EAA0E,CAAC;IACjF,CAAC;IAEO,KAAK,CAAC,KAAK,CACjB,gBAAuC,EACvC,SAAiC,EACjC,SAAqC,EACrC,SAAkC;QAElC,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,CAAC;YAC3B,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,8DAA8D,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC;YAChG,OAAO;QACT,CAAC;QACD,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,gBAAgB,CAAC,eAAe,CAAC;gBAC1C,MAAM,EAAE,gBAAgB,CAAC,YAAY,EAAE,MAAM;gBAC7C,cAAc,EAAE,gBAAgB,CAAC,YAAY,EAAE,cAAc;gBAC7D,SAAS;gBACT,SAAS;gBACT,SAAS;aACV,EAAE,gBAAgB,CAAC,CAAC;QACvB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,4FAA4F;YAC5F,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,0CAA0C,EAAE,EAAE,SAAS,EAAE,GAAG,2BAA2B,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACrH,CAAC;IACH,CAAC;CACF,CAAA;AA1YY,6BAA6B;IADzC,UAAU,EAAE;IAKR,WAAA,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAA;IACjC,WAAA,MAAM,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,CAAA;IAC9C,WAAA,MAAM,CAAC,kBAAkB,CAAC,sBAAsB,CAAC,CAAA;IACjD,WAAA,MAAM,CAAC,kBAAkB,CAAC,2BAA2B,CAAC,CAAA;IACtD,WAAA,MAAM,CAAC,kBAAkB,CAAC,yBAAyB,CAAC,CAAA;IACpD,WAAA,MAAM,CAAC,kBAAkB,CAAC,qCAAqC,CAAC,CAAA;IAChE,WAAA,MAAM,CAAC,kBAAkB,CAAC,kCAAkC,CAAC,CAAA;IAC7D,WAAA,MAAM,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,CAAA;IAK3C,WAAA,MAAM,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,CAAA;IAAE,WAAA,QAAQ,EAAE,CAAA;+CAXuB,0BAA0B;QACb,6BAA6B;QAC5B,2BAA2B;QAC7B,gCAAgC;QACf,qCAAqC;QAC3C,yCAAyC;QAC/D,uBAAuB;GAX9F,6BAA6B,CA0YzC","sourcesContent":["/**\n * File Upload Grant Backend Service\n *\n * The ONE mint function behind both doors — the REST sibling route (`…/files/<field>/grant`) and the\n * MCP derived tool — plus the route-binding check the upload middleware runs, the public status read,\n * revocation, and the post-redemption write-back. Issue #312.\n *\n * ## What a grant is\n *\n * A `SINGLE_USE` consumable token of type `FILE_UPLOAD_GRANT` that lets whoever holds it perform ONE\n * upload into ONE resource file field with the MINTER's authority. Nothing durable is created at mint\n * but the token. The upload goes through the resource's EXISTING file-upload route: the token becomes\n * an ordinary `CONSUMABLE_TOKEN` execution context (typed fields → identity) and the ordinary\n * authorizer decides. This service never decides \"may this principal put a file here\" — the upload\n * middleware does, once, for mint and upload alike, which is what makes mint-authority ≡\n * upload-authority by construction.\n *\n * ## Why the route binding lives in `metadata` and is checked HERE\n *\n * `createExecutionContextFromRequest` turns the token's TYPED fields (`userId`, `organizationId`,\n * `roles`, `resourceIdentifier`, `relatedId`) into identity and deliberately reads nothing from\n * `metadata`. Which field, which operation kind, which concrete upload URL — those are ROUTE facts,\n * and the upload middleware asks this service to check them against the route the token was\n * presented on. Identity and route stay separate concerns.\n */\n\nimport { injectable, inject, optional } from 'inversify';\nimport {\n  BackendApiType,\n  ConsumableToken_ConsumptionMode,\n  CoreAuditableEventType,\n  CoreConsumableTokenTypes,\n  CORE_APP_ROLES,\n  ErrorCustomMessageReference,\n  ErrorType,\n  ExecutionContext_ExecutionType,\n  FILE_UPLOAD_GRANT_DEFAULT_MINUTES,\n  FILE_UPLOAD_GRANT_PAGE_PATH,\n  FileUploadGrantMetadataSchema,\n  FileUploadGrantState,\n  ResourceOperationRiskLevel,\n  TokenAuthenticationPolicy,\n  WildoHeaderKeys,\n  type FileUploadGrant,\n  type FileUploadGrantMetadata,\n  type FileUploadGrantOperation,\n  type FileUploadGrantStatus,\n  type ResourceConfiguration_Operation,\n  type ResourceType,\n  CoreResourceType,\n  CoreResourceOperation,\n  type File,\n} from '@wildo-ai/saas-models';\nimport { DurationUnit, FileGenerationSource } from '@wildo-ai/zod-decorators';\nimport { SAAS_SERVICE_TYPES } from '~wildo-backend-lib/inject/models/service-types';\nimport type { LoggerService } from '~wildo-backend-lib/monitoring/logger/services/logger.service';\nimport { ErrorBuilderBackendService } from '~wildo-backend-lib/errors/services/error-builder.backend.service';\nimport { projectCaughtErrorLogFields } from '~wildo-backend-lib/errors/utils/error-log-level-classification.backend.utils';\nimport { AppConfigurationService } from '~wildo-backend-lib/config/services/app-configuration.backend.service';\nimport type { ExecutionContext } from '~wildo-backend-lib/runtime/models/execution-context.backend.schemas';\nimport { ConsumableTokenBackendService } from '~wildo-backend-lib/security/consumable-tokens/services/consumable-token.backend.service';\nimport type { ConsumableToken } from '~wildo-backend-lib/security/consumable-tokens/models/consumable-tokens.shared.schemas';\nimport { FileConstraintResolverChain } from '~wildo-backend-lib/files/constraints/file-constraint-resolver-chain.backend.service';\nimport { FileFieldDetectionBackendService } from '~wildo-backend-lib/files/services/file-field-detection.backend.service';\nimport { ExecutionContextCreatorBackendService } from '~wildo-backend-lib/runtime/services/execution-context-creator.backend.service';\nimport { RepositoriesRegistryHandlerBackendService } from '~wildo-backend-lib/base-classes/services/repositories/repositories-registry-handler.backend.service';\nimport { resolveFileUploaderPrincipal, type FileUploaderPrincipal } from '~wildo-backend-lib/files/utils/file-uploader.utils';\nimport { AuthControllerUtils } from '~wildo-backend-lib/security/authentications/services/utils/auth-controller.utils';\nimport type { AuditLogsBackendService } from '~wildo-backend-lib/compliance/audit-trails/services/audit-logs.backend.service';\n\n/** The route facts a grant is bound to, as the upload middleware knows them. */\nexport interface FileUploadGrantTarget {\n  resourceType: ResourceType;\n  fieldName: string;\n  operation: FileUploadGrantOperation;\n  resourceId?: string;\n}\n\nexport interface MintFileUploadGrantParams {\n  /** The MINTER's context, produced by the upload route's own authorization middleware. */\n  executionContext: ExecutionContext<any>;\n  target: FileUploadGrantTarget;\n  /** Requested lifetime; the engine ceiling is enforced at `createToken`, rejecting never clamping. */\n  expiresInMinutes?: number;\n  /** The concrete, absolute URL of the upload route this grant is for (the request's own URL minus `/grant`). */\n  uploadUrl: string;\n  /** Absolute API base including the mount prefix (e.g. `https://api.example.com/api/v1`), for the status URL. */\n  apiBaseUrl: string;\n  /** Request provenance for the audit row; never the token. */\n  requestProvenance?: { ipAddress?: string; userAgent?: string };\n}\n\n@injectable()\nexport class FileUploadGrantBackendService {\n  protected logDebug: (message: string, context?: Record<string, unknown>) => void;\n\n  constructor(\n    @inject(SAAS_SERVICE_TYPES.Logger) private readonly logger: LoggerService,\n    @inject(SAAS_SERVICE_TYPES.ErrorBuilderService) private readonly errorBuilder: ErrorBuilderBackendService,\n    @inject(SAAS_SERVICE_TYPES.ConsumableTokenService) private readonly consumableTokenService: ConsumableTokenBackendService,\n    @inject(SAAS_SERVICE_TYPES.FileConstraintResolverChain) private readonly constraintResolver: FileConstraintResolverChain,\n    @inject(SAAS_SERVICE_TYPES.FileFieldDetectionService) private readonly fileFieldDetection: FileFieldDetectionBackendService,\n    @inject(SAAS_SERVICE_TYPES.ExecutionContextCreatorBackendService) private readonly executionContextCreator: ExecutionContextCreatorBackendService,\n    @inject(SAAS_SERVICE_TYPES.RepositoriesRegistryHandlerService) private readonly repositoriesRegistry: RepositoriesRegistryHandlerBackendService,\n    @inject(SAAS_SERVICE_TYPES.AppConfigService) private readonly appConfigService: AppConfigurationService,\n    /**\n     * Optional so a harness without the audit stack can construct this service; in production the\n     * container always binds it. A missing service is logged at WARN on first use, never silent.\n     */\n    @inject(SAAS_SERVICE_TYPES.AuditLogsService) @optional() private readonly auditLogsService?: AuditLogsBackendService,\n  ) {\n    this.logDebug = this.logger.debugByType('FileUploadGrantBackendService');\n    this.logger.setDebugTypeLogging('FileUploadGrantBackendService', false);\n  }\n\n  /**\n   * The operation the upload routes hand to the execution-context creator (issue #312, D4).\n   *\n   * `tokenAuthentication` lives on the OPERATION, so declaring it on the authored CREATE/UPDATE would\n   * let a grant perform the whole JSON write. Instead the `…/files/<field>` and `…/files/<field>/grant`\n   * routes — and ONLY those — get this derived copy, which accepts the grant type as an ALTERNATIVE\n   * credential beside whatever the author declared. The JSON routes keep the authored operation, so a\n   * grant presented there is refused by GATE 1 (`CONSUMABLE_TOKEN_NOT_ACCEPTED_FOR_OPERATION`).\n   *\n   * An authored ADDITIVE policy is NOT preserved as ADDITIVE here: the upload route's own authorizer\n   * decides on the resulting context either way, and an additive token on a multipart upload is not a\n   * case any resource declares today. If one appears, this is the seam to widen — do not widen the\n   * authored operation.\n   */\n  static withUploadGrantAcceptance<T extends ResourceConfiguration_Operation<any, any, any>>(operation: T): T {\n    const authored = 'tokenAuthentication' in operation ? operation.tokenAuthentication : undefined;\n    const authoredTypes = authored?.policy === TokenAuthenticationPolicy.ALTERNATIVE ? (authored.types ?? []) : [];\n    return {\n      ...operation,\n      tokenAuthentication: {\n        types: [...authoredTypes, CoreConsumableTokenTypes.FILE_UPLOAD_GRANT],\n        policy: TokenAuthenticationPolicy.ALTERNATIVE,\n      },\n    } as T;\n  }\n\n  /**\n   * Mint a grant for the target the caller has JUST been authorized on.\n   *\n   * Refuses two minter kinds: a `CONSUMABLE_TOKEN` context (a grant may not mint a grant — no\n   * delegation chains) and an `ANONYMOUS_SESSION` (no stable subject to attribute the file to, no\n   * roles worth snapshotting). `USER_REQUEST` and both machine principals mint.\n   */\n  async mint(params: MintFileUploadGrantParams): Promise<FileUploadGrant> {\n    const { executionContext, target } = params;\n\n    if (\n      executionContext.executionType === ExecutionContext_ExecutionType.CONSUMABLE_TOKEN\n      || executionContext.executionType === ExecutionContext_ExecutionType.ANONYMOUS_SESSION\n    ) {\n      throw this.errorBuilder.buildError(ErrorType.AUTHORIZATION, executionContext, {\n        customMessageReference: ErrorCustomMessageReference.FILE_UPLOAD_GRANT_MINTER_NOT_ELIGIBLE,\n        context: { executionType: executionContext.executionType }, // diagnostic (log-only)\n      });\n    }\n\n    const minter = resolveFileUploaderPrincipal(executionContext);\n    if (!minter) {\n      // A principal the uploader resolver cannot name cannot be the file's owner either.\n      throw this.errorBuilder.buildError(ErrorType.AUTHORIZATION, executionContext, {\n        customMessageReference: ErrorCustomMessageReference.FILE_UPLOAD_GRANT_MINTER_NOT_ELIGIBLE,\n        context: { executionType: executionContext.executionType, reason: 'no uploader principal' }, // diagnostic (log-only)\n      });\n    }\n\n    const fieldMeta = this.fileFieldDetection.getFileFieldMetadata(target.resourceType, target.fieldName);\n    if (!fieldMeta) {\n      throw this.errorBuilder.buildError(ErrorType.VALIDATION, executionContext, {\n        customMessageReference: ErrorCustomMessageReference.VALIDATION,\n        context: { message: 'Not a file field', resourceType: target.resourceType, fieldName: target.fieldName }, // diagnostic (log-only)\n      });\n    }\n    if (fieldMeta.fileMetadata.generation?.source === FileGenerationSource.PDF_TEMPLATE) {\n      // Same refusal the upload handler makes, made EARLY: a grant for a field that can never receive a\n      // user upload would be a link that fails on redemption for a reason knowable at mint.\n      throw this.errorBuilder.buildError(ErrorType.BUSINESS_RULE, executionContext, {\n        customMessageReference: ErrorCustomMessageReference.FILE_GENERATED_FIELD_NOT_WRITABLE,\n        context: { resourceType: target.resourceType, fieldName: target.fieldName }, // diagnostic (log-only)\n      });\n    }\n\n    const constraint = await this.constraintResolver.resolve({ resourceType: target.resourceType, fieldName: target.fieldName });\n    const expiresInMinutes = params.expiresInMinutes ?? FILE_UPLOAD_GRANT_DEFAULT_MINUTES;\n\n    const metadataWithoutUrl: Omit<FileUploadGrantMetadata, 'uploadUrl' | 'producedFileId'> = {\n      fieldName: target.fieldName,\n      operation: target.operation,\n      minter: { entityType: minter.uploadedByEntityType, id: minter.uploadedBy },\n    };\n\n    // assurance-control: WILDO.IDENTITY.DELEGATED_AUTHORIZATION — a principal delegates ONE upload, into\n    // ONE field, under its own authority, to whoever holds the grant. The ceiling and SINGLE_USE are\n    // enforced inside createToken; the audit row below is what makes the delegation accountable.\n    const token = await this.consumableTokenService.createToken({\n      tokenType: CoreConsumableTokenTypes.FILE_UPLOAD_GRANT,\n      consumptionMode: ConsumableToken_ConsumptionMode.SINGLE_USE,\n      expiresIn: { value: expiresInMinutes, unit: DurationUnit.MINUTES },\n      organizationId: executionContext.initiatorIds?.organizationId,\n      userId: executionContext.initiatorIds?.userId,\n      resourceIdentifier: String(target.resourceType),\n      relatedId: target.resourceId,\n      roles: [...(executionContext.initiatorRoles ?? [])],\n      metadata: { ...metadataWithoutUrl, uploadUrl: params.uploadUrl },\n    });\n\n    const grantId = token._id;\n    const tokenValue = token.token;\n    const uploadPageUrl = this.resolveUploadPageUrl(tokenValue);\n    const statusUrl = `${params.apiBaseUrl}/files/upload-grants/${encodeURIComponent(tokenValue)}`;\n    const headerName = WildoHeaderKeys.CONSUMABLE_TOKEN;\n    const fileHint = this.suggestFileName(target.fieldName, constraint.allowedMimeTypes);\n\n    const grant: FileUploadGrant = {\n      grantId,\n      state: FileUploadGrantState.PENDING,\n      expiresAt: token.expiresAt.toISOString(),\n      singleUse: true,\n      target: {\n        resourceType: String(target.resourceType),\n        fieldName: target.fieldName,\n        operation: target.operation,\n        resourceId: target.resourceId ?? null,\n      },\n      constraints: {\n        maxBytes: constraint.maxSize,\n        allowedMimeTypes: constraint.allowedMimeTypes ?? [],\n      },\n      uploadUrl: params.uploadUrl,\n      uploadHeader: { name: headerName, value: tokenValue },\n      // No `-f`: on a refusal the JSON error body is the only thing that tells the caller why.\n      uploadCommand: `curl -sS -H \"${headerName}: ${tokenValue}\" -F \"file=@/path/to/${fileHint}\" \"${params.uploadUrl}\"`,\n      // In PowerShell `curl` aliases Invoke-WebRequest, which does not understand -F; the real binary is curl.exe.\n      uploadCommandPowerShell: `curl.exe -sS -H \"${headerName}: ${tokenValue}\" -F \"file=@C:\\\\path\\\\to\\\\${fileHint}\" \"${params.uploadUrl}\"`,\n      uploadPageUrl,\n      statusUrl,\n      note: this.buildNote(target, uploadPageUrl !== null),\n    };\n\n    await this.audit(executionContext, CoreAuditableEventType.FILE_UPLOAD_GRANT_ISSUED, ResourceOperationRiskLevel.MEDIUM, {\n      grantId,\n      resourceType: String(target.resourceType),\n      fieldName: target.fieldName,\n      operation: target.operation,\n      resourceId: target.resourceId ?? null,\n      expiresAt: grant.expiresAt,\n      minter: metadataWithoutUrl.minter,\n      ipAddress: params.requestProvenance?.ipAddress,\n      userAgent: params.requestProvenance?.userAgent,\n    });\n\n    this.logDebug('File upload grant minted', { grantId, resourceType: target.resourceType, fieldName: target.fieldName, operation: target.operation });\n    return grant;\n  }\n\n  /**\n   * The upload middleware's question: is the token this context was built from a grant for THIS route?\n   *\n   * Returns `undefined` when the context is not a grant context at all — a JWT/API-key upload, or an\n   * authored non-grant ALTERNATIVE token, which keeps behaving as it did. Throws\n   * `FILE_UPLOAD_GRANT_TARGET_MISMATCH` when it IS a grant minted for a different resource, field,\n   * operation kind or row. Mirrors `validateFileToken` on the download twin: type pinned AND target\n   * pinned; a grant with no binding unlocks nothing.\n   *\n   * For UPDATE the creator has already coherence-checked `relatedId` against the URL id; the check is\n   * repeated here because CREATE has no id, so this is the one place both kinds are decided.\n   */\n  async assertGrantMatchesRoute(\n    executionContext: ExecutionContext<any>,\n    target: FileUploadGrantTarget,\n  ): Promise<{ token: ConsumableToken; metadata: FileUploadGrantMetadata } | undefined> {\n    if (executionContext.executionType !== ExecutionContext_ExecutionType.CONSUMABLE_TOKEN) return undefined;\n    const tokenValue = executionContext.consumableTokenValue;\n    if (!tokenValue) return undefined;\n\n    const token = await this.consumableTokenService.validateToken(tokenValue);\n    if (token.tokenType !== CoreConsumableTokenTypes.FILE_UPLOAD_GRANT) return undefined;\n\n    const parsed = FileUploadGrantMetadataSchema.safeParse(token.metadata);\n    const mismatch = (reason: string) => this.errorBuilder.buildError(ErrorType.AUTHENTICATION, executionContext, {\n      customMessageReference: ErrorCustomMessageReference.FILE_UPLOAD_GRANT_TARGET_MISMATCH,\n      context: {\n        // diagnostic (log-only)\n        grantId: token._id,\n        reason,\n        routeTarget: target,\n        grantTarget: { resourceIdentifier: token.resourceIdentifier, relatedId: token.relatedId, metadata: parsed.success ? parsed.data : undefined },\n      },\n    });\n\n    if (!parsed.success) throw mismatch('unparseable grant metadata');\n    const metadata = parsed.data;\n    if (token.resourceIdentifier !== String(target.resourceType)) throw mismatch('resource');\n    if (metadata.fieldName !== target.fieldName) throw mismatch('field');\n    if (metadata.operation !== target.operation) throw mismatch('operation');\n    if (target.operation === CoreResourceOperation.UPDATE ? token.relatedId !== target.resourceId : token.relatedId != null) throw mismatch('resourceId');\n\n    return { token, metadata };\n  }\n\n  /** The uploader the redeemed file is attributed to: the MINTER, from the grant, never the grant itself. */\n  resolveUploaderFromGrant(metadata: FileUploadGrantMetadata): FileUploaderPrincipal {\n    return { uploadedBy: metadata.minter.id, uploadedByEntityType: metadata.minter.entityType as FileUploaderPrincipal['uploadedByEntityType'] };\n  }\n\n  /**\n   * After the one upload landed: write the produced fileId back and audit the redemption. Best-effort\n   * by contract — the upload has succeeded; a failure here is logged and the status read degrades to\n   * \"REDEEMED, file unknown\".\n   */\n  async recordRedemption(\n    grant: { token: ConsumableToken; metadata: FileUploadGrantMetadata },\n    file: { fileId: string; mimeType: string; size: number },\n    executionContext: ExecutionContext<any>,\n  ): Promise<void> {\n    try {\n      await this.consumableTokenService.recordFileUploadGrantProducedFile(grant.token._id, file.fileId);\n    } catch (error) {\n      this.logger.warn('File upload grant: produced-file write-back failed; status read will not name the file', {\n        grantId: grant.token._id, fileId: file.fileId, ...projectCaughtErrorLogFields(error),\n      });\n    }\n    await this.audit(executionContext, CoreAuditableEventType.FILE_UPLOAD_GRANT_REDEEMED, ResourceOperationRiskLevel.LOW, {\n      grantId: grant.token._id,\n      fileId: file.fileId,\n      mimeType: file.mimeType,\n      size: file.size,\n      minter: grant.metadata.minter,\n    });\n  }\n\n  /**\n   * Public status read: the token IS the credential, so anyone holding it learns the grant's state,\n   * the target and constraints (what the drop page renders), and — after redemption — the `fileId`\n   * and file status (what the agent needs). Never the file's name.\n   */\n  async readStatus(tokenValue: string): Promise<FileUploadGrantStatus> {\n    const token = await this.consumableTokenService.findTokenByValue(tokenValue);\n    if (!token || token.tokenType !== CoreConsumableTokenTypes.FILE_UPLOAD_GRANT) {\n      throw this.errorBuilder.buildError(ErrorType.NOT_FOUND, undefined, {\n        customMessageReference: ErrorCustomMessageReference.FILE_UPLOAD_GRANT_NOT_FOUND,\n      });\n    }\n    const parsed = FileUploadGrantMetadataSchema.safeParse(token.metadata);\n    if (!parsed.success) {\n      throw this.errorBuilder.buildError(ErrorType.NOT_FOUND, undefined, {\n        customMessageReference: ErrorCustomMessageReference.FILE_UPLOAD_GRANT_NOT_FOUND,\n        context: { grantId: token._id, reason: 'unparseable grant metadata' }, // diagnostic (log-only)\n      });\n    }\n    const metadata = parsed.data;\n    const resourceType = token.resourceIdentifier as ResourceType;\n    const constraint = await this.constraintResolver.resolve({ resourceType, fieldName: metadata.fieldName });\n\n    let file: FileUploadGrantStatus['file'] = null;\n    if (metadata.producedFileId) {\n      const produced = await this.readProducedFile(metadata.producedFileId);\n      if (produced) file = { fileId: produced.fileId, status: produced.status };\n    }\n\n    return {\n      grantId: token._id,\n      state: this.deriveState(token),\n      expiresAt: token.expiresAt.toISOString(),\n      target: {\n        resourceType: String(resourceType),\n        fieldName: metadata.fieldName,\n        operation: metadata.operation,\n        resourceId: token.relatedId ?? null,\n      },\n      constraints: { maxBytes: constraint.maxSize, allowedMimeTypes: constraint.allowedMimeTypes ?? [] },\n      uploadUrl: metadata.uploadUrl,\n      uploadHeaderName: WildoHeaderKeys.CONSUMABLE_TOKEN,\n      file,\n    };\n  }\n\n  /**\n   * Revoke an unredeemed grant — by ID, never by value, and AUTHENTICATED: the minter, or a platform\n   * super-administrator. Revoke-by-value on a public route was rejected: anyone holding the link could\n   * burn it (harmless) while learning that it existed (not).\n   */\n  async revoke(grantId: string, executionContext: ExecutionContext<any>): Promise<boolean> {\n    const token = await this.consumableTokenService.findTokenById(grantId);\n    if (!token || token.tokenType !== CoreConsumableTokenTypes.FILE_UPLOAD_GRANT) {\n      throw this.errorBuilder.buildError(ErrorType.NOT_FOUND, executionContext, {\n        customMessageReference: ErrorCustomMessageReference.FILE_UPLOAD_GRANT_NOT_FOUND,\n      });\n    }\n    const parsed = FileUploadGrantMetadataSchema.safeParse(token.metadata);\n    const caller = resolveFileUploaderPrincipal(executionContext);\n    const isMinter = parsed.success && caller !== undefined\n      && caller.uploadedBy === parsed.data.minter.id && caller.uploadedByEntityType === parsed.data.minter.entityType;\n    const isSuperAdmin = (executionContext.initiatorRoles ?? []).some((entry) => entry.roles.includes(CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN));\n    if (!isMinter && !isSuperAdmin) {\n      throw this.errorBuilder.buildError(ErrorType.AUTHORIZATION, executionContext, {\n        customMessageReference: ErrorCustomMessageReference.AUTHORIZATIONS_ACCESS_DENIED,\n        context: { grantId }, // diagnostic (log-only)\n      });\n    }\n    const revoked = await this.consumableTokenService.revokeToken(grantId);\n    if (revoked) {\n      await this.audit(executionContext, CoreAuditableEventType.FILE_UPLOAD_GRANT_REVOKED, ResourceOperationRiskLevel.LOW, {\n        grantId,\n        revokedBy: caller ? { entityType: caller.uploadedByEntityType, id: caller.uploadedBy } : null,\n        asSuperAdmin: !isMinter && isSuperAdmin,\n      });\n    }\n    return revoked;\n  }\n\n  // ── helpers ────────────────────────────────────────────────────────────────\n\n  /**\n   * Read the produced FILES row with no caller context — the status route is public and the token is\n   * the credential. Same mechanism as the file controller's token-access download path (an internal\n   * system context against the FILES repository, keyed on `_id`); only `fileId` and `status` leave here.\n   */\n  private async readProducedFile(fileId: string): Promise<Pick<File, 'fileId' | 'status'> | null> {\n    const internalContext = await this.executionContextCreator.createForInternalSystemOperation();\n    const filesRepository = this.repositoriesRegistry.getRepositoryOrThrow(CoreResourceType.FILES, internalContext);\n    const file = await filesRepository.read<File>(internalContext, { _id: fileId });\n    return file ? { fileId: file.fileId, status: file.status } : null;\n  }\n\n  private deriveState(token: ConsumableToken): FileUploadGrantState {\n    if (token.revokedAt) return FileUploadGrantState.REVOKED;\n    if (token.isConsumed) return FileUploadGrantState.REDEEMED;\n    if (token.expiresAt.getTime() <= Date.now()) return FileUploadGrantState.EXPIRED;\n    return FileUploadGrantState.PENDING;\n  }\n\n  /** `null` for a headless application (no frontend service declared) — there is no page to hand a human. */\n  private resolveUploadPageUrl(tokenValue: string): string | null {\n    const config = this.appConfigService.config;\n    const frontendServiceName = this.appConfigService.resolveDefaultFrontendServiceName();\n    const base = frontendServiceName ? AuthControllerUtils.lookupFrontendPublicUrl(config, frontendServiceName) : null;\n    if (!base) return null;\n    const trimmed = base.endsWith('/') ? base.slice(0, -1) : base;\n    return `${trimmed}${FILE_UPLOAD_GRANT_PAGE_PATH}/${encodeURIComponent(tokenValue)}`;\n  }\n\n  /** A plausible file name for the curl example, from the field name and the first allowed MIME type. */\n  private suggestFileName(fieldName: string, allowedMimeTypes: string[] | undefined): string {\n    const stem = fieldName.replace(/[^\\w.-]+/g, '_').replace(/\\./g, '-').slice(0, 40) || 'file';\n    const first = allowedMimeTypes?.find((m) => !m.endsWith('/*'));\n    const ext = first ? first.split('/')[1]?.replace(/^x-/, '').replace(/\\+.*$/, '') : undefined;\n    return ext && /^[a-z0-9]{2,5}$/i.test(ext) ? `${stem}.${ext}` : stem;\n  }\n\n  private buildNote(target: FileUploadGrantTarget, hasPage: boolean): string {\n    const attach = target.operation === CoreResourceOperation.UPDATE\n      ? `then pass the returned fileId as \"${target.fieldName}.fileId\" when updating ${String(target.resourceType)} ${target.resourceId}`\n      : `then pass the returned fileId as \"${target.fieldName}.fileId\" when creating the ${String(target.resourceType)} record`;\n    const human = hasPage ? 'or show uploadPageUrl to the user so they can drop the file in their browser, ' : '';\n    return `Run uploadCommand if you can execute commands and the file is on your filesystem, ${human}${attach}. `\n      + 'The link is single-use and bound to this one field: if it expires or the upload is refused, mint a new one. '\n      + 'The header value is not your credential — it unlocks exactly one upload.';\n  }\n\n  private async audit(\n    executionContext: ExecutionContext<any>,\n    eventType: CoreAuditableEventType,\n    riskLevel: ResourceOperationRiskLevel,\n    eventData: Record<string, unknown>,\n  ): Promise<void> {\n    if (!this.auditLogsService) {\n      this.logger.warn('File upload grant: audit service unbound; event not recorded', { eventType });\n      return;\n    }\n    try {\n      await this.auditLogsService.logGenericEvent({\n        userId: executionContext.initiatorIds?.userId,\n        organizationId: executionContext.initiatorIds?.organizationId,\n        riskLevel,\n        eventType,\n        eventData,\n      }, executionContext);\n    } catch (error) {\n      // An audit failure never fails the operation it observes; it is logged so it is not silent.\n      this.logger.warn('File upload grant: audit emission failed', { eventType, ...projectCaughtErrorLogFields(error) });\n    }\n  }\n}\n"]}
+{"version":3,"file":"file-upload-grant.backend.service.js","sourceRoot":"","sources":["../../../../src/files/services/file-upload-grant.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;;;;;;;;;;;;;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AACzD,OAAO,EAEL,+BAA+B,EAC/B,sBAAsB,EACtB,wBAAwB,EACxB,cAAc,EACd,2BAA2B,EAC3B,SAAS,EACT,8BAA8B,EAC9B,iCAAiC,EACjC,2BAA2B,EAC3B,6BAA6B,EAC7B,oBAAoB,EACpB,0BAA0B,EAC1B,yBAAyB,EACzB,eAAe,EAOf,gBAAgB,EAChB,qBAAqB,GAEtB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,YAAY,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAC9E,OAAO,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AAEpF,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAC9G,OAAO,EAAE,2BAA2B,EAAE,MAAM,8EAA8E,CAAC;AAC3H,OAAO,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AAE/G,OAAO,EAAE,6BAA6B,EAAE,MAAM,yFAAyF,CAAC;AAExI,OAAO,EAAE,2BAA2B,EAAE,MAAM,qFAAqF,CAAC;AAClI,OAAO,EAAE,gCAAgC,EAAE,MAAM,wEAAwE,CAAC;AAC1H,OAAO,EAAE,qCAAqC,EAAE,MAAM,+EAA+E,CAAC;AACtI,OAAO,EAAE,yCAAyC,EAAE,MAAM,qGAAqG,CAAC;AAChK,OAAO,EAAE,4BAA4B,EAA8B,MAAM,oDAAoD,CAAC;AAC9H,OAAO,EAAE,mBAAmB,EAAE,MAAM,kFAAkF,CAAC;AAGvH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,SAAS,wBAAwB,CAAC,GAAW;IAC3C,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,0FAA0F;QAC1F,mDAAmD;QACnD,IAAI,GAAG,IAAI,GAAG,CAAC,GAAG,EAAE,6BAA6B,CAAC,CAAC,QAAQ,CAAC;IAC9D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAC1E,CAAC;AA8BM,IAAM,6BAA6B,GAAnC,MAAM,6BAA6B;IAIc;IACa;IACG;IACK;IACF;IACY;IACH;IAClB;IAKY;IAflE,QAAQ,CAA+D;IAEjF,YACsD,MAAqB,EACR,YAAwC,EACrC,sBAAqD,EAChD,kBAA+C,EACjD,kBAAoD,EACxC,uBAA8D,EACjE,oBAA+D,EACjF,gBAAyC,EAK7B,gBAA0C;QAZhE,WAAM,GAAN,MAAM,CAAe;QACR,iBAAY,GAAZ,YAAY,CAA4B;QACrC,2BAAsB,GAAtB,sBAAsB,CAA+B;QAChD,uBAAkB,GAAlB,kBAAkB,CAA6B;QACjD,uBAAkB,GAAlB,kBAAkB,CAAkC;QACxC,4BAAuB,GAAvB,uBAAuB,CAAuC;QACjE,yBAAoB,GAApB,oBAAoB,CAA2C;QACjF,qBAAgB,GAAhB,gBAAgB,CAAyB;QAK7B,qBAAgB,GAAhB,gBAAgB,CAA0B;QAEpH,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,+BAA+B,CAAC,CAAC;QACzE,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,+BAA+B,EAAE,KAAK,CAAC,CAAC;IAC1E,CAAC;IAED;;;;;;;;;;;;;OAaG;IACH,MAAM,CAAC,yBAAyB,CAA2D,SAAY;QACrG,MAAM,QAAQ,GAAG,qBAAqB,IAAI,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,mBAAmB,CAAC,CAAC,CAAC,SAAS,CAAC;QAChG,MAAM,aAAa,GAAG,QAAQ,EAAE,MAAM,KAAK,yBAAyB,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/G,OAAO;YACL,GAAG,SAAS;YACZ,mBAAmB,EAAE;gBACnB,KAAK,EAAE,CAAC,GAAG,aAAa,EAAE,wBAAwB,CAAC,iBAAiB,CAAC;gBACrE,MAAM,EAAE,yBAAyB,CAAC,WAAW;aAC9C;SACG,CAAC;IACT,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,IAAI,CAAC,MAAiC;QAC1C,MAAM,EAAE,gBAAgB,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC;QAE5C,IACE,gBAAgB,CAAC,aAAa,KAAK,8BAA8B,CAAC,gBAAgB;eAC/E,gBAAgB,CAAC,aAAa,KAAK,8BAA8B,CAAC,iBAAiB,EACtF,CAAC;YACD,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,gBAAgB,EAAE;gBAC5E,sBAAsB,EAAE,2BAA2B,CAAC,qCAAqC;gBACzF,OAAO,EAAE,EAAE,aAAa,EAAE,gBAAgB,CAAC,aAAa,EAAE,EAAE,wBAAwB;aACrF,CAAC,CAAC;QACL,CAAC;QAED,MAAM,MAAM,GAAG,4BAA4B,CAAC,gBAAgB,CAAC,CAAC;QAC9D,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,mFAAmF;YACnF,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,gBAAgB,EAAE;gBAC5E,sBAAsB,EAAE,2BAA2B,CAAC,qCAAqC;gBACzF,OAAO,EAAE,EAAE,aAAa,EAAE,gBAAgB,CAAC,aAAa,EAAE,MAAM,EAAE,uBAAuB,EAAE,EAAE,wBAAwB;aACtH,CAAC,CAAC;QACL,CAAC;QAED,MAAM,SAAS,GAAG,IAAI,CAAC,kBAAkB,CAAC,oBAAoB,CAAC,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;QACtG,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,gBAAgB,EAAE;gBACzE,sBAAsB,EAAE,2BAA2B,CAAC,UAAU;gBAC9D,OAAO,EAAE,EAAE,OAAO,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,EAAE,wBAAwB;aACnI,CAAC,CAAC;QACL,CAAC;QACD,IAAI,SAAS,CAAC,YAAY,CAAC,UAAU,EAAE,MAAM,KAAK,oBAAoB,CAAC,YAAY,EAAE,CAAC;YACpF,kGAAkG;YAClG,sFAAsF;YACtF,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,gBAAgB,EAAE;gBAC5E,sBAAsB,EAAE,2BAA2B,CAAC,iCAAiC;gBACrF,OAAO,EAAE,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,EAAE,wBAAwB;aACtG,CAAC,CAAC;QACL,CAAC;QAED,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC;QAC7H,IAAI,CAAC,+BAA+B,CAAC,MAAM,CAAC,QAAQ,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,CAAC,CAAC;QAC5F,MAAM,gBAAgB,GAAG,MAAM,CAAC,gBAAgB,IAAI,iCAAiC,CAAC;QAEtF,MAAM,kBAAkB,GAAkE;YACxF,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,MAAM,EAAE,EAAE,UAAU,EAAE,MAAM,CAAC,oBAAoB,EAAE,EAAE,EAAE,MAAM,CAAC,UAAU,EAAE;SAC3E,CAAC;QAEF,qGAAqG;QACrG,iGAAiG;QACjG,6FAA6F;QAC7F,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,WAAW,CAAC;YAC1D,SAAS,EAAE,wBAAwB,CAAC,iBAAiB;YACrD,eAAe,EAAE,+BAA+B,CAAC,UAAU;YAC3D,SAAS,EAAE,EAAE,KAAK,EAAE,gBAAgB,EAAE,IAAI,EAAE,YAAY,CAAC,OAAO,EAAE;YAClE,cAAc,EAAE,gBAAgB,CAAC,YAAY,EAAE,cAAc;YAC7D,MAAM,EAAE,gBAAgB,CAAC,YAAY,EAAE,MAAM;YAC7C,kBAAkB,EAAE,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC;YAC/C,SAAS,EAAE,MAAM,CAAC,UAAU;YAC5B,KAAK,EAAE,CAAC,GAAG,CAAC,gBAAgB,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC;YACnD,QAAQ,EAAE,EAAE,GAAG,kBAAkB,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE;SACjE,CAAC,CAAC;QAEH,MAAM,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC;QAC1B,MAAM,UAAU,GAAG,KAAK,CAAC,KAAK,CAAC;QAC/B,MAAM,aAAa,GAAG,IAAI,CAAC,oBAAoB,CAAC,UAAU,CAAC,CAAC;QAC5D,MAAM,SAAS,GAAG,GAAG,MAAM,CAAC,UAAU,wBAAwB,kBAAkB,CAAC,UAAU,CAAC,EAAE,CAAC;QAC/F,MAAM,UAAU,GAAG,eAAe,CAAC,gBAAgB,CAAC;QACpD,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,SAAS,EAAE,UAAU,CAAC,gBAAgB,CAAC,CAAC;QAE/J,MAAM,KAAK,GAAoB;YAC7B,OAAO;YACP,KAAK,EAAE,oBAAoB,CAAC,OAAO;YACnC,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC,WAAW,EAAE;YACxC,SAAS,EAAE,IAAI;YACf,MAAM,EAAE;gBACN,YAAY,EAAE,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC;gBACzC,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,IAAI;aACtC;YACD,WAAW,EAAE;gBACX,QAAQ,EAAE,UAAU,CAAC,OAAO;gBAC5B,gBAAgB,EAAE,UAAU,CAAC,gBAAgB,IAAI,EAAE;aACpD;YACD,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,YAAY,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,UAAU,EAAE;YACrD,yFAAyF;YACzF,aAAa,EAAE,gBAAgB,UAAU,KAAK,UAAU,wBAAwB,QAAQ,MAAM,MAAM,CAAC,SAAS,GAAG;YACjH,6GAA6G;YAC7G,uBAAuB,EAAE,oBAAoB,UAAU,KAAK,UAAU,6BAA6B,QAAQ,MAAM,MAAM,CAAC,SAAS,GAAG;YACpI,aAAa;YACb,SAAS;YACT,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,aAAa,KAAK,IAAI,CAAC;SACrD,CAAC;QAEF,MAAM,IAAI,CAAC,KAAK,CAAC,gBAAgB,EAAE,sBAAsB,CAAC,wBAAwB,EAAE,0BAA0B,CAAC,MAAM,EAAE;YACrH,OAAO;YACP,YAAY,EAAE,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC;YACzC,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,IAAI;YACrC,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,MAAM,EAAE,kBAAkB,CAAC,MAAM;YACjC,SAAS,EAAE,MAAM,CAAC,iBAAiB,EAAE,SAAS;YAC9C,SAAS,EAAE,MAAM,CAAC,iBAAiB,EAAE,SAAS;SAC/C,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,0BAA0B,EAAE,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC;QACpJ,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAiCG;IACH,KAAK,CAAC,uBAAuB,CAC3B,gBAAuC,EACvC,MAA6B,EAC7B,mBAA2B;QAE3B,IAAI,gBAAgB,CAAC,aAAa,KAAK,8BAA8B,CAAC,gBAAgB;YAAE,OAAO,SAAS,CAAC;QACzG,MAAM,UAAU,GAAG,gBAAgB,CAAC,oBAAoB,CAAC;QACzD,IAAI,CAAC,UAAU;YAAE,OAAO,SAAS,CAAC;QAElC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC;QAC1E,IAAI,KAAK,CAAC,SAAS,KAAK,wBAAwB,CAAC,iBAAiB;YAAE,OAAO,SAAS,CAAC;QAErF,MAAM,MAAM,GAAG,6BAA6B,CAAC,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACvE,MAAM,QAAQ,GAAG,CAAC,MAAc,EAAE,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,gBAAgB,EAAE;YAC5G,sBAAsB,EAAE,2BAA2B,CAAC,iCAAiC;YACrF,OAAO,EAAE;gBACP,wBAAwB;gBACxB,OAAO,EAAE,KAAK,CAAC,GAAG;gBAClB,MAAM;gBACN,WAAW,EAAE,MAAM;gBACnB,WAAW,EAAE,EAAE,kBAAkB,EAAE,KAAK,CAAC,kBAAkB,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,QAAQ,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,EAAE;aAC9I;SACF,CAAC,CAAC;QAEH,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,MAAM,QAAQ,CAAC,4BAA4B,CAAC,CAAC;QAClE,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC;QAC7B,IAAI,KAAK,CAAC,kBAAkB,KAAK,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC;YAAE,MAAM,QAAQ,CAAC,UAAU,CAAC,CAAC;QACzF,IAAI,QAAQ,CAAC,SAAS,KAAK,MAAM,CAAC,SAAS;YAAE,MAAM,QAAQ,CAAC,OAAO,CAAC,CAAC;QACrE,IAAI,QAAQ,CAAC,SAAS,KAAK,MAAM,CAAC,SAAS;YAAE,MAAM,QAAQ,CAAC,WAAW,CAAC,CAAC;QACzE,IAAI,MAAM,CAAC,SAAS,KAAK,qBAAqB,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,KAAK,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,IAAI,IAAI;YAAE,MAAM,QAAQ,CAAC,YAAY,CAAC,CAAC;QAEtJ,mGAAmG;QACnG,+FAA+F;QAC/F,8FAA8F;QAC9F,+FAA+F;QAC/F,mGAAmG;QACnG,kGAAkG;QAClG,qDAAqD;QACrD,MAAM,YAAY,GAAG,wBAAwB,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;QAClE,MAAM,aAAa,GAAG,wBAAwB,CAAC,mBAAmB,CAAC,CAAC;QACpE,IAAI,YAAY,KAAK,SAAS,IAAI,aAAa,KAAK,SAAS,IAAI,YAAY,KAAK,aAAa;YAAE,MAAM,QAAQ,CAAC,WAAW,CAAC,CAAC;QAE7H,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;IAC7B,CAAC;IAED;;;;;;;;;;;OAWG;IACH,wBAAwB,CAAC,QAAiC;QACxD,OAAO,EAAE,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,EAAE,oBAAoB,EAAE,QAAQ,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;IAC9F,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,gBAAgB,CACpB,KAAoE,EACpE,IAAwD,EACxD,gBAAuC;QAEvC,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,sBAAsB,CAAC,iCAAiC,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QACpG,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,wFAAwF,EAAE;gBACzG,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,GAAG,2BAA2B,CAAC,KAAK,CAAC;aACrF,CAAC,CAAC;QACL,CAAC;QACD,MAAM,IAAI,CAAC,KAAK,CAAC,gBAAgB,EAAE,sBAAsB,CAAC,0BAA0B,EAAE,0BAA0B,CAAC,GAAG,EAAE;YACpH,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,GAAG;YACxB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,MAAM,EAAE,KAAK,CAAC,QAAQ,CAAC,MAAM;SAC9B,CAAC,CAAC;IACL,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,UAAU,CAAC,UAAkB;QACjC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,gBAAgB,CAAC,UAAU,CAAC,CAAC;QAC7E,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,SAAS,KAAK,wBAAwB,CAAC,iBAAiB,EAAE,CAAC;YAC7E,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,SAAS,EAAE,SAAS,EAAE;gBACjE,sBAAsB,EAAE,2BAA2B,CAAC,2BAA2B;aAChF,CAAC,CAAC;QACL,CAAC;QACD,MAAM,MAAM,GAAG,6BAA6B,CAAC,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACvE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,SAAS,EAAE,SAAS,EAAE;gBACjE,sBAAsB,EAAE,2BAA2B,CAAC,2BAA2B;gBAC/E,OAAO,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,4BAA4B,EAAE,EAAE,wBAAwB;aAChG,CAAC,CAAC;QACL,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC;QAC7B,MAAM,YAAY,GAAG,KAAK,CAAC,kBAAkC,CAAC;QAC9D,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC,EAAE,YAAY,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS,EAAE,CAAC,CAAC;QAE1G,IAAI,IAAI,GAAkC,IAAI,CAAC;QAC/C,IAAI,QAAQ,CAAC,cAAc,EAAE,CAAC;YAC5B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;YACtE,IAAI,QAAQ;gBAAE,IAAI,GAAG,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;QAC5E,CAAC;QAED,OAAO;YACL,OAAO,EAAE,KAAK,CAAC,GAAG;YAClB,KAAK,EAAE,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC;YAC9B,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC,WAAW,EAAE;YACxC,MAAM,EAAE;gBACN,YAAY,EAAE,MAAM,CAAC,YAAY,CAAC;gBAClC,SAAS,EAAE,QAAQ,CAAC,SAAS;gBAC7B,SAAS,EAAE,QAAQ,CAAC,SAAS;gBAC7B,UAAU,EAAE,KAAK,CAAC,SAAS,IAAI,IAAI;aACpC;YACD,WAAW,EAAE,EAAE,QAAQ,EAAE,UAAU,CAAC,OAAO,EAAE,gBAAgB,EAAE,UAAU,CAAC,gBAAgB,IAAI,EAAE,EAAE;YAClG,SAAS,EAAE,QAAQ,CAAC,SAAS;YAC7B,gBAAgB,EAAE,eAAe,CAAC,gBAAgB;YAClD,IAAI;SACL,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,MAAM,CAAC,OAAe,EAAE,gBAAuC;QACnE,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;QACvE,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,SAAS,KAAK,wBAAwB,CAAC,iBAAiB,EAAE,CAAC;YAC7E,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,SAAS,EAAE,gBAAgB,EAAE;gBACxE,sBAAsB,EAAE,2BAA2B,CAAC,2BAA2B;aAChF,CAAC,CAAC;QACL,CAAC;QACD,MAAM,MAAM,GAAG,6BAA6B,CAAC,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACvE,MAAM,MAAM,GAAG,4BAA4B,CAAC,gBAAgB,CAAC,CAAC;QAC9D,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,IAAI,MAAM,KAAK,SAAS;eAClD,MAAM,CAAC,UAAU,KAAK,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,MAAM,CAAC,oBAAoB,KAAK,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC;QAClH,MAAM,YAAY,GAAG,CAAC,gBAAgB,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,cAAc,CAAC,qBAAqB,CAAC,CAAC,CAAC;QACzI,IAAI,CAAC,QAAQ,IAAI,CAAC,YAAY,EAAE,CAAC;YAC/B,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,gBAAgB,EAAE;gBAC5E,sBAAsB,EAAE,2BAA2B,CAAC,4BAA4B;gBAChF,OAAO,EAAE,EAAE,OAAO,EAAE,EAAE,wBAAwB;aAC/C,CAAC,CAAC;QACL,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;QACvE,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,IAAI,CAAC,KAAK,CAAC,gBAAgB,EAAE,sBAAsB,CAAC,yBAAyB,EAAE,0BAA0B,CAAC,GAAG,EAAE;gBACnH,OAAO;gBACP,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,oBAAoB,EAAE,EAAE,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,IAAI;gBAC7F,YAAY,EAAE,CAAC,QAAQ,IAAI,YAAY;aACxC,CAAC,CAAC;QACL,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,8EAA8E;IAE9E;;;;OAIG;IACK,KAAK,CAAC,gBAAgB,CAAC,MAAc;QAC3C,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,gCAAgC,EAAE,CAAC;QAC9F,MAAM,eAAe,GAAG,IAAI,CAAC,oBAAoB,CAAC,oBAAoB,CAAC,gBAAgB,CAAC,KAAK,EAAE,eAAe,CAAC,CAAC;QAChH,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,IAAI,CAAO,eAAe,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC;QAChF,OAAO,IAAI,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACpE,CAAC;IAEO,WAAW,CAAC,KAAsB;QACxC,IAAI,KAAK,CAAC,SAAS;YAAE,OAAO,oBAAoB,CAAC,OAAO,CAAC;QACzD,IAAI,KAAK,CAAC,UAAU;YAAE,OAAO,oBAAoB,CAAC,QAAQ,CAAC;QAC3D,IAAI,KAAK,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE;YAAE,OAAO,oBAAoB,CAAC,OAAO,CAAC;QACjF,OAAO,oBAAoB,CAAC,OAAO,CAAC;IACtC,CAAC;IAED,2GAA2G;IACnG,oBAAoB,CAAC,UAAkB;QAC7C,MAAM,MAAM,GAAG,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC;QAC5C,MAAM,mBAAmB,GAAG,IAAI,CAAC,gBAAgB,CAAC,iCAAiC,EAAE,CAAC;QACtF,MAAM,IAAI,GAAG,mBAAmB,CAAC,CAAC,CAAC,mBAAmB,CAAC,uBAAuB,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACnH,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC;QACvB,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC9D,OAAO,GAAG,OAAO,GAAG,2BAA2B,IAAI,kBAAkB,CAAC,UAAU,CAAC,EAAE,CAAC;IACtF,CAAC;IAED;;;;;OAKG;IACK,+BAA+B,CACrC,QAA+C,EAC/C,UAA4D,EAC5D,gBAAuC,EACvC,MAA6B;QAE7B,IAAI,CAAC,QAAQ;YAAE,OAAO;QACtB,IAAI,QAAQ,CAAC,IAAI,KAAK,SAAS,IAAI,QAAQ,CAAC,IAAI,GAAG,UAAU,CAAC,OAAO,EAAE,CAAC;YACtE,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,gBAAgB,EAAE;gBACzE,sBAAsB,EAAE,2BAA2B,CAAC,UAAU;gBAC9D,OAAO,EAAE,EAAE,OAAO,EAAE,8CAA8C,EAAE,YAAY,EAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,EAAE,UAAU,CAAC,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,EAAE,wBAAwB;aACvL,CAAC,CAAC;QACL,CAAC;QACD,MAAM,OAAO,GAAG,UAAU,CAAC,gBAAgB,IAAI,EAAE,CAAC;QAClD,IAAI,QAAQ,CAAC,QAAQ,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC5C,MAAM,IAAI,GAAG,QAAQ,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;YAC7C,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC;YAClI,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,gBAAgB,EAAE;oBACzE,sBAAsB,EAAE,2BAA2B,CAAC,UAAU;oBAC9D,OAAO,EAAE,EAAE,OAAO,EAAE,iDAAiD,EAAE,gBAAgB,EAAE,QAAQ,CAAC,QAAQ,EAAE,gBAAgB,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,EAAE,wBAAwB;iBAC/L,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,mFAAmF;IAC3E,YAAY,CAAC,IAAY;QAC/B,OAAO,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC;IAC9F,CAAC;IAED,uGAAuG;IAC/F,eAAe,CAAC,SAAiB,EAAE,gBAAsC;QAC/E,MAAM,IAAI,GAAG,SAAS,CAAC,OAAO,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC;QAC5F,MAAM,KAAK,GAAG,gBAAgB,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;QAC/D,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC7F,OAAO,GAAG,IAAI,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACvE,CAAC;IAEO,SAAS,CAAC,MAA6B,EAAE,OAAgB;QAC/D,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,KAAK,qBAAqB,CAAC,MAAM;YAC9D,CAAC,CAAC,qCAAqC,MAAM,CAAC,SAAS,0BAA0B,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,MAAM,CAAC,UAAU,EAAE;YACnI,CAAC,CAAC,qCAAqC,MAAM,CAAC,SAAS,8BAA8B,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,SAAS,CAAC;QAC5H,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,CAAC,gFAAgF,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9G,OAAO,qFAAqF,KAAK,GAAG,MAAM,IAAI;cAC1G,8GAA8G;cAC9G,0EAA0E,CAAC;IACjF,CAAC;IAEO,KAAK,CAAC,KAAK,CACjB,gBAAuC,EACvC,SAAiC,EACjC,SAAqC,EACrC,SAAkC;QAElC,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,CAAC;YAC3B,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,8DAA8D,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC;YAChG,OAAO;QACT,CAAC;QACD,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,gBAAgB,CAAC,eAAe,CAAC;gBAC1C,MAAM,EAAE,gBAAgB,CAAC,YAAY,EAAE,MAAM;gBAC7C,cAAc,EAAE,gBAAgB,CAAC,YAAY,EAAE,cAAc;gBAC7D,SAAS;gBACT,SAAS;gBACT,SAAS;aACV,EAAE,gBAAgB,CAAC,CAAC;QACvB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,4FAA4F;YAC5F,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,0CAA0C,EAAE,EAAE,SAAS,EAAE,GAAG,2BAA2B,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACrH,CAAC;IACH,CAAC;CACF,CAAA;AA7dY,6BAA6B;IADzC,UAAU,EAAE;IAKR,WAAA,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAA;IACjC,WAAA,MAAM,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,CAAA;IAC9C,WAAA,MAAM,CAAC,kBAAkB,CAAC,sBAAsB,CAAC,CAAA;IACjD,WAAA,MAAM,CAAC,kBAAkB,CAAC,2BAA2B,CAAC,CAAA;IACtD,WAAA,MAAM,CAAC,kBAAkB,CAAC,yBAAyB,CAAC,CAAA;IACpD,WAAA,MAAM,CAAC,kBAAkB,CAAC,qCAAqC,CAAC,CAAA;IAChE,WAAA,MAAM,CAAC,kBAAkB,CAAC,kCAAkC,CAAC,CAAA;IAC7D,WAAA,MAAM,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,CAAA;IAK3C,WAAA,MAAM,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,CAAA;IAAE,WAAA,QAAQ,EAAE,CAAA;+CAXuB,0BAA0B;QACb,6BAA6B;QAC5B,2BAA2B;QAC7B,gCAAgC;QACf,qCAAqC;QAC3C,yCAAyC;QAC/D,uBAAuB;GAX9F,6BAA6B,CA6dzC","sourcesContent":["/**\n * File Upload Grant Backend Service\n *\n * The ONE mint function behind both doors — the REST sibling route (`…/files/<field>/grant`) and the\n * MCP derived tool — plus the route-binding check the upload middleware runs, the public status read,\n * revocation, and the post-redemption write-back. Issue #312.\n *\n * ## What a grant is\n *\n * A `SINGLE_USE` consumable token of type `FILE_UPLOAD_GRANT` that lets whoever holds it perform ONE\n * upload into ONE resource file field with the MINTER's authority. Nothing durable is created at mint\n * but the token. The upload goes through the resource's EXISTING file-upload route: the token becomes\n * an ordinary `CONSUMABLE_TOKEN` execution context (typed fields → identity) and the ordinary\n * authorizer decides. This service never decides \"may this principal put a file here\" — the upload\n * middleware does, once, for mint and upload alike, which is what makes mint-authority ≡\n * upload-authority by construction.\n *\n * ## Why the route binding lives in `metadata` and is checked HERE\n *\n * `createExecutionContextFromRequest` turns the token's TYPED fields (`userId`, `organizationId`,\n * `roles`, `resourceIdentifier`, `relatedId`) into identity and deliberately reads nothing from\n * `metadata`. Which field, which operation kind, which concrete upload URL — those are ROUTE facts,\n * and the upload middleware asks this service to check them against the route the token was\n * presented on. Identity and route stay separate concerns.\n */\n\nimport { injectable, inject, optional } from 'inversify';\nimport {\n  BackendApiType,\n  ConsumableToken_ConsumptionMode,\n  CoreAuditableEventType,\n  CoreConsumableTokenTypes,\n  CORE_APP_ROLES,\n  ErrorCustomMessageReference,\n  ErrorType,\n  ExecutionContext_ExecutionType,\n  FILE_UPLOAD_GRANT_DEFAULT_MINUTES,\n  FILE_UPLOAD_GRANT_PAGE_PATH,\n  FileUploadGrantMetadataSchema,\n  FileUploadGrantState,\n  ResourceOperationRiskLevel,\n  TokenAuthenticationPolicy,\n  WildoHeaderKeys,\n  type FileUploadGrant,\n  type FileUploadGrantMetadata,\n  type FileUploadGrantOperation,\n  type FileUploadGrantStatus,\n  type ResourceConfiguration_Operation,\n  type ResourceType,\n  CoreResourceType,\n  CoreResourceOperation,\n  type File,\n} from '@wildo-ai/saas-models';\nimport { DurationUnit, FileGenerationSource } from '@wildo-ai/zod-decorators';\nimport { SAAS_SERVICE_TYPES } from '~wildo-backend-lib/inject/models/service-types';\nimport type { LoggerService } from '~wildo-backend-lib/monitoring/logger/services/logger.service';\nimport { ErrorBuilderBackendService } from '~wildo-backend-lib/errors/services/error-builder.backend.service';\nimport { projectCaughtErrorLogFields } from '~wildo-backend-lib/errors/utils/error-log-level-classification.backend.utils';\nimport { AppConfigurationService } from '~wildo-backend-lib/config/services/app-configuration.backend.service';\nimport type { ExecutionContext } from '~wildo-backend-lib/runtime/models/execution-context.backend.schemas';\nimport { ConsumableTokenBackendService } from '~wildo-backend-lib/security/consumable-tokens/services/consumable-token.backend.service';\nimport type { ConsumableToken } from '~wildo-backend-lib/security/consumable-tokens/models/consumable-tokens.shared.schemas';\nimport { FileConstraintResolverChain } from '~wildo-backend-lib/files/constraints/file-constraint-resolver-chain.backend.service';\nimport { FileFieldDetectionBackendService } from '~wildo-backend-lib/files/services/file-field-detection.backend.service';\nimport { ExecutionContextCreatorBackendService } from '~wildo-backend-lib/runtime/services/execution-context-creator.backend.service';\nimport { RepositoriesRegistryHandlerBackendService } from '~wildo-backend-lib/base-classes/services/repositories/repositories-registry-handler.backend.service';\nimport { resolveFileUploaderPrincipal, type FileUploaderPrincipal } from '~wildo-backend-lib/files/utils/file-uploader.utils';\nimport { AuthControllerUtils } from '~wildo-backend-lib/security/authentications/services/utils/auth-controller.utils';\nimport type { AuditLogsBackendService } from '~wildo-backend-lib/compliance/audit-trails/services/audit-logs.backend.service';\n\n/**\n * Reduce an upload-route URL to the one form the grant's route check compares — its PATH — or\n * `undefined` when it cannot be read as a URL at all.\n *\n * Accepts both shapes the two sides supply: an ABSOLUTE URL (what `metadata.uploadUrl` records, and\n * what a proxy's absolute-form request target produces) and an ORIGIN-RELATIVE path (what Express's\n * `req.originalUrl` normally is). Parsed against a throwaway base so one function handles both.\n *\n * ## What is normalised away, and why each is safe\n *\n * - **Query and fragment.** Mandatory, not cosmetic: GATE 1 accepts the grant in `?consumable_token=`\n *   as well as the header, so a redemption legitimately carries a query the mint's URL never had.\n *   Comparing with the query attached would refuse the query-token form outright.\n * - **A single trailing slash.** Express routes with `strict: false` by default, so `…/attachment/`\n *   reaches the same handler as `…/attachment`. Refusing one of the two would be an artefact of this\n *   comparison rather than a fact about the grant. `/` itself is left alone.\n *\n * ## What is deliberately NOT normalised\n *\n * - **The ORIGIN is not compared at all** — only the path is. Both origins come from the same server\n *   config (`runtime.endPoints.main_backend_api.publicUrl`, never the client's Host header, which is\n *   why the mint reads config in the first place), so an origin comparison is tautological against an\n *   attacker and can only ever produce a false refusal: change `publicUrl` and every unredeemed grant\n *   — up to an hour of them — stops matching. Nothing is given up, because the origin carries no\n *   value a caller could vary.\n * - **Case.** Express matches case-insensitively by default, so `/Files/attachment` would reach the\n *   route while comparing unequal. Case-folding was rejected: path segments carry IDs, and folding\n *   them would make `/todos/AbC` ≡ `/todos/abc` and quietly weaken the row and parent pins this check\n *   exists to add. Folding only the static segments is not available — nothing here can tell a static\n *   segment from an id. The cost is that a caller who re-cases the URL is refused; there is no\n *   legitimate reason to, since the grant hands back the exact URL to post to.\n * - **Percent-encoding.** Not decoded. Decoding is how path-confusion bugs are born: `%2F` would\n *   become `/` and two different routes would compare equal. The raw encoded forms are compared, and\n *   the ids that reach these paths are constrained to alphanumerics, `-` and `_` by\n *   `validateParameterFormat`, which are encoding-invariant.\n */\nfunction normalizeUploadRoutePath(url: string): string | undefined {\n  let path: string;\n  try {\n    // The base is never used for an absolute input, and for a relative one only its origin is\n    // discarded below — so it can be any valid origin.\n    path = new URL(url, 'http://upload-route.invalid').pathname;\n  } catch {\n    return undefined;\n  }\n  return path.length > 1 && path.endsWith('/') ? path.slice(0, -1) : path;\n}\n\n/** The route facts a grant is bound to, as the upload middleware knows them. */\nexport interface FileUploadGrantTarget {\n  resourceType: ResourceType;\n  fieldName: string;\n  operation: FileUploadGrantOperation;\n  resourceId?: string;\n}\n\nexport interface MintFileUploadGrantParams {\n  /** The MINTER's context, produced by the upload route's own authorization middleware. */\n  executionContext: ExecutionContext<any>;\n  target: FileUploadGrantTarget;\n  /** Requested lifetime; the engine ceiling is enforced at `createToken`, rejecting never clamping. */\n  expiresInMinutes?: number;\n  /**\n   * What the caller intends to upload (the File Objects proposal's `{name, mimeType, size}`). Checked\n   * against the field's constraints HERE so an impossible file is refused before a link exists.\n   */\n  declared?: { name?: string; mimeType?: string; size?: number };\n  /** The concrete, absolute URL of the upload route this grant is for (the request's own URL minus `/grant`). */\n  uploadUrl: string;\n  /** Absolute API base including the mount prefix (e.g. `https://api.example.com/api/v1`), for the status URL. */\n  apiBaseUrl: string;\n  /** Request provenance for the audit row; never the token. */\n  requestProvenance?: { ipAddress?: string; userAgent?: string };\n}\n\n@injectable()\nexport class FileUploadGrantBackendService {\n  protected logDebug: (message: string, context?: Record<string, unknown>) => void;\n\n  constructor(\n    @inject(SAAS_SERVICE_TYPES.Logger) private readonly logger: LoggerService,\n    @inject(SAAS_SERVICE_TYPES.ErrorBuilderService) private readonly errorBuilder: ErrorBuilderBackendService,\n    @inject(SAAS_SERVICE_TYPES.ConsumableTokenService) private readonly consumableTokenService: ConsumableTokenBackendService,\n    @inject(SAAS_SERVICE_TYPES.FileConstraintResolverChain) private readonly constraintResolver: FileConstraintResolverChain,\n    @inject(SAAS_SERVICE_TYPES.FileFieldDetectionService) private readonly fileFieldDetection: FileFieldDetectionBackendService,\n    @inject(SAAS_SERVICE_TYPES.ExecutionContextCreatorBackendService) private readonly executionContextCreator: ExecutionContextCreatorBackendService,\n    @inject(SAAS_SERVICE_TYPES.RepositoriesRegistryHandlerService) private readonly repositoriesRegistry: RepositoriesRegistryHandlerBackendService,\n    @inject(SAAS_SERVICE_TYPES.AppConfigService) private readonly appConfigService: AppConfigurationService,\n    /**\n     * Optional so a harness without the audit stack can construct this service; in production the\n     * container always binds it. A missing service is logged at WARN on first use, never silent.\n     */\n    @inject(SAAS_SERVICE_TYPES.AuditLogsService) @optional() private readonly auditLogsService?: AuditLogsBackendService,\n  ) {\n    this.logDebug = this.logger.debugByType('FileUploadGrantBackendService');\n    this.logger.setDebugTypeLogging('FileUploadGrantBackendService', false);\n  }\n\n  /**\n   * The operation the upload routes hand to the execution-context creator (issue #312, D4).\n   *\n   * `tokenAuthentication` lives on the OPERATION, so declaring it on the authored CREATE/UPDATE would\n   * let a grant perform the whole JSON write. Instead the `…/files/<field>` and `…/files/<field>/grant`\n   * routes — and ONLY those — get this derived copy, which accepts the grant type as an ALTERNATIVE\n   * credential beside whatever the author declared. The JSON routes keep the authored operation, so a\n   * grant presented there is refused by GATE 1 (`CONSUMABLE_TOKEN_NOT_ACCEPTED_FOR_OPERATION`).\n   *\n   * An authored ADDITIVE policy is NOT preserved as ADDITIVE here: the upload route's own authorizer\n   * decides on the resulting context either way, and an additive token on a multipart upload is not a\n   * case any resource declares today. If one appears, this is the seam to widen — do not widen the\n   * authored operation.\n   */\n  static withUploadGrantAcceptance<T extends ResourceConfiguration_Operation<any, any, any>>(operation: T): T {\n    const authored = 'tokenAuthentication' in operation ? operation.tokenAuthentication : undefined;\n    const authoredTypes = authored?.policy === TokenAuthenticationPolicy.ALTERNATIVE ? (authored.types ?? []) : [];\n    return {\n      ...operation,\n      tokenAuthentication: {\n        types: [...authoredTypes, CoreConsumableTokenTypes.FILE_UPLOAD_GRANT],\n        policy: TokenAuthenticationPolicy.ALTERNATIVE,\n      },\n    } as T;\n  }\n\n  /**\n   * Mint a grant for the target the caller has JUST been authorized on.\n   *\n   * Refuses two minter kinds: a `CONSUMABLE_TOKEN` context (a grant may not mint a grant — no\n   * delegation chains) and an `ANONYMOUS_SESSION` (no stable subject to attribute the file to, no\n   * roles worth snapshotting). `USER_REQUEST` and both machine principals mint.\n   */\n  async mint(params: MintFileUploadGrantParams): Promise<FileUploadGrant> {\n    const { executionContext, target } = params;\n\n    if (\n      executionContext.executionType === ExecutionContext_ExecutionType.CONSUMABLE_TOKEN\n      || executionContext.executionType === ExecutionContext_ExecutionType.ANONYMOUS_SESSION\n    ) {\n      throw this.errorBuilder.buildError(ErrorType.AUTHORIZATION, executionContext, {\n        customMessageReference: ErrorCustomMessageReference.FILE_UPLOAD_GRANT_MINTER_NOT_ELIGIBLE,\n        context: { executionType: executionContext.executionType }, // diagnostic (log-only)\n      });\n    }\n\n    const minter = resolveFileUploaderPrincipal(executionContext);\n    if (!minter) {\n      // A principal the uploader resolver cannot name cannot be the file's owner either.\n      throw this.errorBuilder.buildError(ErrorType.AUTHORIZATION, executionContext, {\n        customMessageReference: ErrorCustomMessageReference.FILE_UPLOAD_GRANT_MINTER_NOT_ELIGIBLE,\n        context: { executionType: executionContext.executionType, reason: 'no uploader principal' }, // diagnostic (log-only)\n      });\n    }\n\n    const fieldMeta = this.fileFieldDetection.getFileFieldMetadata(target.resourceType, target.fieldName);\n    if (!fieldMeta) {\n      throw this.errorBuilder.buildError(ErrorType.VALIDATION, executionContext, {\n        customMessageReference: ErrorCustomMessageReference.VALIDATION,\n        context: { message: 'Not a file field', resourceType: target.resourceType, fieldName: target.fieldName }, // diagnostic (log-only)\n      });\n    }\n    if (fieldMeta.fileMetadata.generation?.source === FileGenerationSource.PDF_TEMPLATE) {\n      // Same refusal the upload handler makes, made EARLY: a grant for a field that can never receive a\n      // user upload would be a link that fails on redemption for a reason knowable at mint.\n      throw this.errorBuilder.buildError(ErrorType.BUSINESS_RULE, executionContext, {\n        customMessageReference: ErrorCustomMessageReference.FILE_GENERATED_FIELD_NOT_WRITABLE,\n        context: { resourceType: target.resourceType, fieldName: target.fieldName }, // diagnostic (log-only)\n      });\n    }\n\n    const constraint = await this.constraintResolver.resolve({ resourceType: target.resourceType, fieldName: target.fieldName });\n    this.assertDeclarationFitsConstraint(params.declared, constraint, executionContext, target);\n    const expiresInMinutes = params.expiresInMinutes ?? FILE_UPLOAD_GRANT_DEFAULT_MINUTES;\n\n    const metadataWithoutUrl: Omit<FileUploadGrantMetadata, 'uploadUrl' | 'producedFileId'> = {\n      fieldName: target.fieldName,\n      operation: target.operation,\n      minter: { entityType: minter.uploadedByEntityType, id: minter.uploadedBy },\n    };\n\n    // assurance-control: WILDO.IDENTITY.DELEGATED_AUTHORIZATION — a principal delegates ONE upload, into\n    // ONE field, under its own authority, to whoever holds the grant. The ceiling and SINGLE_USE are\n    // enforced inside createToken; the audit row below is what makes the delegation accountable.\n    const token = await this.consumableTokenService.createToken({\n      tokenType: CoreConsumableTokenTypes.FILE_UPLOAD_GRANT,\n      consumptionMode: ConsumableToken_ConsumptionMode.SINGLE_USE,\n      expiresIn: { value: expiresInMinutes, unit: DurationUnit.MINUTES },\n      organizationId: executionContext.initiatorIds?.organizationId,\n      userId: executionContext.initiatorIds?.userId,\n      resourceIdentifier: String(target.resourceType),\n      relatedId: target.resourceId,\n      roles: [...(executionContext.initiatorRoles ?? [])],\n      metadata: { ...metadataWithoutUrl, uploadUrl: params.uploadUrl },\n    });\n\n    const grantId = token._id;\n    const tokenValue = token.token;\n    const uploadPageUrl = this.resolveUploadPageUrl(tokenValue);\n    const statusUrl = `${params.apiBaseUrl}/files/upload-grants/${encodeURIComponent(tokenValue)}`;\n    const headerName = WildoHeaderKeys.CONSUMABLE_TOKEN;\n    const fileHint = params.declared?.name?.trim() ? this.safeFileName(params.declared.name) : this.suggestFileName(target.fieldName, constraint.allowedMimeTypes);\n\n    const grant: FileUploadGrant = {\n      grantId,\n      state: FileUploadGrantState.PENDING,\n      expiresAt: token.expiresAt.toISOString(),\n      singleUse: true,\n      target: {\n        resourceType: String(target.resourceType),\n        fieldName: target.fieldName,\n        operation: target.operation,\n        resourceId: target.resourceId ?? null,\n      },\n      constraints: {\n        maxBytes: constraint.maxSize,\n        allowedMimeTypes: constraint.allowedMimeTypes ?? [],\n      },\n      uploadUrl: params.uploadUrl,\n      uploadHeader: { name: headerName, value: tokenValue },\n      // No `-f`: on a refusal the JSON error body is the only thing that tells the caller why.\n      uploadCommand: `curl -sS -H \"${headerName}: ${tokenValue}\" -F \"file=@/path/to/${fileHint}\" \"${params.uploadUrl}\"`,\n      // In PowerShell `curl` aliases Invoke-WebRequest, which does not understand -F; the real binary is curl.exe.\n      uploadCommandPowerShell: `curl.exe -sS -H \"${headerName}: ${tokenValue}\" -F \"file=@C:\\\\path\\\\to\\\\${fileHint}\" \"${params.uploadUrl}\"`,\n      uploadPageUrl,\n      statusUrl,\n      note: this.buildNote(target, uploadPageUrl !== null),\n    };\n\n    await this.audit(executionContext, CoreAuditableEventType.FILE_UPLOAD_GRANT_ISSUED, ResourceOperationRiskLevel.MEDIUM, {\n      grantId,\n      resourceType: String(target.resourceType),\n      fieldName: target.fieldName,\n      operation: target.operation,\n      resourceId: target.resourceId ?? null,\n      expiresAt: grant.expiresAt,\n      minter: metadataWithoutUrl.minter,\n      ipAddress: params.requestProvenance?.ipAddress,\n      userAgent: params.requestProvenance?.userAgent,\n    });\n\n    this.logDebug('File upload grant minted', { grantId, resourceType: target.resourceType, fieldName: target.fieldName, operation: target.operation });\n    return grant;\n  }\n\n  /**\n   * The upload middleware's question: is the token this context was built from a grant for THIS route?\n   *\n   * Returns `undefined` when the context is not a grant context at all — a JWT/API-key upload, or an\n   * authored non-grant ALTERNATIVE token, which keeps behaving as it did. Throws\n   * `FILE_UPLOAD_GRANT_TARGET_MISMATCH` when it IS a grant minted for a different resource, field,\n   * operation kind or row. Mirrors `validateFileToken` on the download twin: type pinned AND target\n   * pinned; a grant with no binding unlocks nothing.\n   *\n   * For UPDATE the creator has already coherence-checked `relatedId` against the URL id; the check is\n   * repeated here because CREATE has no id, so this is the one place both kinds are decided.\n   *\n   * ## The fifth check: the concrete ROUTE, added 2026-09-08\n   *\n   * `presentedRequestUrl` is the request's own `originalUrl`, and its path must equal the path of the\n   * `uploadUrl` the grant recorded at mint. The other four checks pin the resource, the field, the\n   * write kind and (for UPDATE) the row — they do NOT pin which of a resource's several upload ROUTES\n   * was used. A resource whose operation declares more than one `initiatorInfo` registers one upload\n   * route per parent path, and `validateParameterCoherence` only pins the `{param}`s the TOKEN itself\n   * supplies (`organizationId`, `userId`, and the resource's own id via `relatedId`); every other\n   * segment — an intermediate parent id, a nested FK — comes from the URL alone and matched nothing.\n   * So a grant minted under one parent could be redeemed under another, and the minter's snapshotted\n   * roles would be re-decided there. This closes that: the grant unlocks the ONE route its mint was\n   * authorized on, which is the same route it publishes in `uploadUrl` / `uploadCommand` /\n   * `uploadPageUrl` and re-emits from the status read.\n   *\n   * It does NOT close anything the authorizer would refuse anyway (roles are still re-evaluated on the\n   * presented route), replay (SINGLE_USE consumption does that), or a leaked token being redeemed on\n   * the recorded route by whoever holds it — the token IS the credential, by design.\n   *\n   * Note this middleware also fronts the MINT route (`…/files/<field>/grant`), whose path differs from\n   * the recorded one by that last segment. A grant presented THERE is now refused here rather than two\n   * steps later by mint's own \"a grant may not mint a grant\" rule. Both refusals stay.\n   */\n  async assertGrantMatchesRoute(\n    executionContext: ExecutionContext<any>,\n    target: FileUploadGrantTarget,\n    presentedRequestUrl: string,\n  ): Promise<{ token: ConsumableToken; metadata: FileUploadGrantMetadata } | undefined> {\n    if (executionContext.executionType !== ExecutionContext_ExecutionType.CONSUMABLE_TOKEN) return undefined;\n    const tokenValue = executionContext.consumableTokenValue;\n    if (!tokenValue) return undefined;\n\n    const token = await this.consumableTokenService.validateToken(tokenValue);\n    if (token.tokenType !== CoreConsumableTokenTypes.FILE_UPLOAD_GRANT) return undefined;\n\n    const parsed = FileUploadGrantMetadataSchema.safeParse(token.metadata);\n    const mismatch = (reason: string) => this.errorBuilder.buildError(ErrorType.AUTHENTICATION, executionContext, {\n      customMessageReference: ErrorCustomMessageReference.FILE_UPLOAD_GRANT_TARGET_MISMATCH,\n      context: {\n        // diagnostic (log-only)\n        grantId: token._id,\n        reason,\n        routeTarget: target,\n        grantTarget: { resourceIdentifier: token.resourceIdentifier, relatedId: token.relatedId, metadata: parsed.success ? parsed.data : undefined },\n      },\n    });\n\n    if (!parsed.success) throw mismatch('unparseable grant metadata');\n    const metadata = parsed.data;\n    if (token.resourceIdentifier !== String(target.resourceType)) throw mismatch('resource');\n    if (metadata.fieldName !== target.fieldName) throw mismatch('field');\n    if (metadata.operation !== target.operation) throw mismatch('operation');\n    if (target.operation === CoreResourceOperation.UPDATE ? token.relatedId !== target.resourceId : token.relatedId != null) throw mismatch('resourceId');\n\n    // The two `undefined` clauses are REDUNDANT today and kept deliberately, which is worth stating so\n    // nobody \"simplifies\" them back out. An unreadable side already loses the inequality against a\n    // readable one, and `metadata.uploadUrl` is `z.string().url()` so the recorded side cannot be\n    // unreadable at all — the parse above refuses first. What they guard is the ONE case where the\n    // inequality would ADMIT: both sides unreadable, `undefined === undefined`. Reaching it needs that\n    // schema to loosen, so it cannot be pinned from a test; the pin covers the outcome (an unreadable\n    // request target is refused) rather than the clause.\n    const recordedPath = normalizeUploadRoutePath(metadata.uploadUrl);\n    const presentedPath = normalizeUploadRoutePath(presentedRequestUrl);\n    if (recordedPath === undefined || presentedPath === undefined || recordedPath !== presentedPath) throw mismatch('uploadUrl');\n\n    return { token, metadata };\n  }\n\n  /**\n   * The uploader the redeemed file is attributed to: the MINTER, from the grant, never the grant itself.\n   *\n   * No cast: `metadata.minter.entityType` is the `FileUploaderEntityType` enum because the metadata\n   * schema says so, and the metadata reached here through `safeParse`. It carried\n   * `as FileUploaderPrincipal['uploadedByEntityType']` until 2026-09-08 — a cast that told the type\n   * system a closed union had been checked when nothing had checked it. The runtime was not actually\n   * open (`validateUploadedByEntityType` re-checks membership in the upload handler and again in\n   * `createFile`), so this was a lie to the compiler rather than a hole to the database; what it cost\n   * was the refusal landing three layers downstream, as a VALIDATION error mid-upload, at a parameter\n   * typed `unknown`, instead of at the boundary that parses the grant.\n   */\n  resolveUploaderFromGrant(metadata: FileUploadGrantMetadata): FileUploaderPrincipal {\n    return { uploadedBy: metadata.minter.id, uploadedByEntityType: metadata.minter.entityType };\n  }\n\n  /**\n   * After the one upload landed: write the produced fileId back and audit the redemption. Best-effort\n   * by contract — the upload has succeeded; a failure here is logged and the status read degrades to\n   * \"REDEEMED, file unknown\".\n   */\n  async recordRedemption(\n    grant: { token: ConsumableToken; metadata: FileUploadGrantMetadata },\n    file: { fileId: string; mimeType: string; size: number },\n    executionContext: ExecutionContext<any>,\n  ): Promise<void> {\n    try {\n      await this.consumableTokenService.recordFileUploadGrantProducedFile(grant.token._id, file.fileId);\n    } catch (error) {\n      this.logger.warn('File upload grant: produced-file write-back failed; status read will not name the file', {\n        grantId: grant.token._id, fileId: file.fileId, ...projectCaughtErrorLogFields(error),\n      });\n    }\n    await this.audit(executionContext, CoreAuditableEventType.FILE_UPLOAD_GRANT_REDEEMED, ResourceOperationRiskLevel.LOW, {\n      grantId: grant.token._id,\n      fileId: file.fileId,\n      mimeType: file.mimeType,\n      size: file.size,\n      minter: grant.metadata.minter,\n    });\n  }\n\n  /**\n   * Public status read: the token IS the credential, so anyone holding it learns the grant's state,\n   * the target and constraints (what the drop page renders), and — after redemption — the `fileId`\n   * and file status (what the agent needs). Never the file's name.\n   */\n  async readStatus(tokenValue: string): Promise<FileUploadGrantStatus> {\n    const token = await this.consumableTokenService.findTokenByValue(tokenValue);\n    if (!token || token.tokenType !== CoreConsumableTokenTypes.FILE_UPLOAD_GRANT) {\n      throw this.errorBuilder.buildError(ErrorType.NOT_FOUND, undefined, {\n        customMessageReference: ErrorCustomMessageReference.FILE_UPLOAD_GRANT_NOT_FOUND,\n      });\n    }\n    const parsed = FileUploadGrantMetadataSchema.safeParse(token.metadata);\n    if (!parsed.success) {\n      throw this.errorBuilder.buildError(ErrorType.NOT_FOUND, undefined, {\n        customMessageReference: ErrorCustomMessageReference.FILE_UPLOAD_GRANT_NOT_FOUND,\n        context: { grantId: token._id, reason: 'unparseable grant metadata' }, // diagnostic (log-only)\n      });\n    }\n    const metadata = parsed.data;\n    const resourceType = token.resourceIdentifier as ResourceType;\n    const constraint = await this.constraintResolver.resolve({ resourceType, fieldName: metadata.fieldName });\n\n    let file: FileUploadGrantStatus['file'] = null;\n    if (metadata.producedFileId) {\n      const produced = await this.readProducedFile(metadata.producedFileId);\n      if (produced) file = { fileId: produced.fileId, status: produced.status };\n    }\n\n    return {\n      grantId: token._id,\n      state: this.deriveState(token),\n      expiresAt: token.expiresAt.toISOString(),\n      target: {\n        resourceType: String(resourceType),\n        fieldName: metadata.fieldName,\n        operation: metadata.operation,\n        resourceId: token.relatedId ?? null,\n      },\n      constraints: { maxBytes: constraint.maxSize, allowedMimeTypes: constraint.allowedMimeTypes ?? [] },\n      uploadUrl: metadata.uploadUrl,\n      uploadHeaderName: WildoHeaderKeys.CONSUMABLE_TOKEN,\n      file,\n    };\n  }\n\n  /**\n   * Revoke an unredeemed grant — by ID, never by value, and AUTHENTICATED: the minter, or a platform\n   * super-administrator. Revoke-by-value on a public route was rejected: anyone holding the link could\n   * burn it (harmless) while learning that it existed (not).\n   */\n  async revoke(grantId: string, executionContext: ExecutionContext<any>): Promise<boolean> {\n    const token = await this.consumableTokenService.findTokenById(grantId);\n    if (!token || token.tokenType !== CoreConsumableTokenTypes.FILE_UPLOAD_GRANT) {\n      throw this.errorBuilder.buildError(ErrorType.NOT_FOUND, executionContext, {\n        customMessageReference: ErrorCustomMessageReference.FILE_UPLOAD_GRANT_NOT_FOUND,\n      });\n    }\n    const parsed = FileUploadGrantMetadataSchema.safeParse(token.metadata);\n    const caller = resolveFileUploaderPrincipal(executionContext);\n    const isMinter = parsed.success && caller !== undefined\n      && caller.uploadedBy === parsed.data.minter.id && caller.uploadedByEntityType === parsed.data.minter.entityType;\n    const isSuperAdmin = (executionContext.initiatorRoles ?? []).some((entry) => entry.roles.includes(CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN));\n    if (!isMinter && !isSuperAdmin) {\n      throw this.errorBuilder.buildError(ErrorType.AUTHORIZATION, executionContext, {\n        customMessageReference: ErrorCustomMessageReference.AUTHORIZATIONS_ACCESS_DENIED,\n        context: { grantId }, // diagnostic (log-only)\n      });\n    }\n    const revoked = await this.consumableTokenService.revokeToken(grantId);\n    if (revoked) {\n      await this.audit(executionContext, CoreAuditableEventType.FILE_UPLOAD_GRANT_REVOKED, ResourceOperationRiskLevel.LOW, {\n        grantId,\n        revokedBy: caller ? { entityType: caller.uploadedByEntityType, id: caller.uploadedBy } : null,\n        asSuperAdmin: !isMinter && isSuperAdmin,\n      });\n    }\n    return revoked;\n  }\n\n  // ── helpers ────────────────────────────────────────────────────────────────\n\n  /**\n   * Read the produced FILES row with no caller context — the status route is public and the token is\n   * the credential. Same mechanism as the file controller's token-access download path (an internal\n   * system context against the FILES repository, keyed on `_id`); only `fileId` and `status` leave here.\n   */\n  private async readProducedFile(fileId: string): Promise<Pick<File, 'fileId' | 'status'> | null> {\n    const internalContext = await this.executionContextCreator.createForInternalSystemOperation();\n    const filesRepository = this.repositoriesRegistry.getRepositoryOrThrow(CoreResourceType.FILES, internalContext);\n    const file = await filesRepository.read<File>(internalContext, { _id: fileId });\n    return file ? { fileId: file.fileId, status: file.status } : null;\n  }\n\n  private deriveState(token: ConsumableToken): FileUploadGrantState {\n    if (token.revokedAt) return FileUploadGrantState.REVOKED;\n    if (token.isConsumed) return FileUploadGrantState.REDEEMED;\n    if (token.expiresAt.getTime() <= Date.now()) return FileUploadGrantState.EXPIRED;\n    return FileUploadGrantState.PENDING;\n  }\n\n  /** `null` for a headless application (no frontend service declared) — there is no page to hand a human. */\n  private resolveUploadPageUrl(tokenValue: string): string | null {\n    const config = this.appConfigService.config;\n    const frontendServiceName = this.appConfigService.resolveDefaultFrontendServiceName();\n    const base = frontendServiceName ? AuthControllerUtils.lookupFrontendPublicUrl(config, frontendServiceName) : null;\n    if (!base) return null;\n    const trimmed = base.endsWith('/') ? base.slice(0, -1) : base;\n    return `${trimmed}${FILE_UPLOAD_GRANT_PAGE_PATH}/${encodeURIComponent(tokenValue)}`;\n  }\n\n  /**\n   * Refuse, at MINT, a declared file the field could never accept — the early half of the check the\n   * upload route performs on receipt. Only what was declared is checked; an undeclared fact is checked\n   * on the bytes. `allowedMimeTypes` empty means every type is accepted; a `type/*` entry matches its\n   * whole family, as the upload validator reads it.\n   */\n  private assertDeclarationFitsConstraint(\n    declared: MintFileUploadGrantParams['declared'],\n    constraint: { maxSize: number; allowedMimeTypes?: string[] },\n    executionContext: ExecutionContext<any>,\n    target: FileUploadGrantTarget,\n  ): void {\n    if (!declared) return;\n    if (declared.size !== undefined && declared.size > constraint.maxSize) {\n      throw this.errorBuilder.buildError(ErrorType.VALIDATION, executionContext, {\n        customMessageReference: ErrorCustomMessageReference.VALIDATION,\n        context: { message: 'Declared file size exceeds the field maximum', declaredSize: declared.size, maxBytes: constraint.maxSize, fieldName: target.fieldName }, // diagnostic (log-only)\n      });\n    }\n    const allowed = constraint.allowedMimeTypes ?? [];\n    if (declared.mimeType && allowed.length > 0) {\n      const mime = declared.mimeType.toLowerCase();\n      const fits = allowed.some((a) => a.toLowerCase() === mime || (a.endsWith('/*') && mime.startsWith(a.slice(0, -1).toLowerCase())));\n      if (!fits) {\n        throw this.errorBuilder.buildError(ErrorType.VALIDATION, executionContext, {\n          customMessageReference: ErrorCustomMessageReference.VALIDATION,\n          context: { message: 'Declared MIME type is not accepted by the field', declaredMimeType: declared.mimeType, allowedMimeTypes: allowed, fieldName: target.fieldName }, // diagnostic (log-only)\n        });\n      }\n    }\n  }\n\n  /** A declared file name reduced to what is safe inside a quoted shell argument. */\n  private safeFileName(name: string): string {\n    return name.replace(/[^\\w.\\- ]+/g, '_').replace(/\\s+/g, ' ').trim().slice(0, 120) || 'file';\n  }\n\n  /** A plausible file name for the curl example, from the field name and the first allowed MIME type. */\n  private suggestFileName(fieldName: string, allowedMimeTypes: string[] | undefined): string {\n    const stem = fieldName.replace(/[^\\w.-]+/g, '_').replace(/\\./g, '-').slice(0, 40) || 'file';\n    const first = allowedMimeTypes?.find((m) => !m.endsWith('/*'));\n    const ext = first ? first.split('/')[1]?.replace(/^x-/, '').replace(/\\+.*$/, '') : undefined;\n    return ext && /^[a-z0-9]{2,5}$/i.test(ext) ? `${stem}.${ext}` : stem;\n  }\n\n  private buildNote(target: FileUploadGrantTarget, hasPage: boolean): string {\n    const attach = target.operation === CoreResourceOperation.UPDATE\n      ? `then pass the returned fileId as \"${target.fieldName}.fileId\" when updating ${String(target.resourceType)} ${target.resourceId}`\n      : `then pass the returned fileId as \"${target.fieldName}.fileId\" when creating the ${String(target.resourceType)} record`;\n    const human = hasPage ? 'or show uploadPageUrl to the user so they can drop the file in their browser, ' : '';\n    return `Run uploadCommand if you can execute commands and the file is on your filesystem, ${human}${attach}. `\n      + 'The link is single-use and bound to this one field: if it expires or the upload is refused, mint a new one. '\n      + 'The header value is not your credential — it unlocks exactly one upload.';\n  }\n\n  private async audit(\n    executionContext: ExecutionContext<any>,\n    eventType: CoreAuditableEventType,\n    riskLevel: ResourceOperationRiskLevel,\n    eventData: Record<string, unknown>,\n  ): Promise<void> {\n    if (!this.auditLogsService) {\n      this.logger.warn('File upload grant: audit service unbound; event not recorded', { eventType });\n      return;\n    }\n    try {\n      await this.auditLogsService.logGenericEvent({\n        userId: executionContext.initiatorIds?.userId,\n        organizationId: executionContext.initiatorIds?.organizationId,\n        riskLevel,\n        eventType,\n        eventData,\n      }, executionContext);\n    } catch (error) {\n      // An audit failure never fails the operation it observes; it is logged so it is not silent.\n      this.logger.warn('File upload grant: audit emission failed', { eventType, ...projectCaughtErrorLogFields(error) });\n    }\n  }\n}\n"]}

package/dist/esm/files/services/files.backend.service.d.ts

@@ -82,6 +82,29 @@ export declare class FilesBackendService {
         next?: NextFunction;
         variant?: FileServeVariant;
     }): Promise<void>;
+    /**
+     * Does the DECLARING field permit derived renditions of this file?
+     *
+     * Reads `imageConstraints.generateThumbnails` off the file field's own schema metadata,
+     * resolved from the file's recorded `linkedResourceType` + `linkedFieldName`. Until #478 the
+     * flag was declared, set on the framework's own user-avatar field, and read by nothing — every
+     * eligible raster image got a rendition whether or not its author had asked for one, and an
+     * author who set it `false` for cost or privacy got thumbnails and no error. It degraded in the
+     * PERMISSIVE direction, which is why it was worth wiring rather than deleting.
+     *
+     * ## Absence means PERMIT, at three different levels, and each is deliberate
+     *
+     * A file with no `linkedResourceType`/`linkedFieldName` (a standalone upload), a field the
+     * registry cannot resolve, a field with no `imageConstraints`, or `imageConstraints` with no
+     * `generateThumbnails` — all permit. Only an EXPLICIT `false` suppresses. The flag is opt-OUT:
+     * nobody has declared it today except to say `true`, and a resolution failure must not become a
+     * silent refusal on a preview surface that works now.
+     *
+     * The `{ sizes: [...] }` form counts as permission. Its sizes are not honoured — the derivation
+     * has one fixed longest-edge — so it is truthy-permits here and nothing more; an author reading
+     * this should not expect their sizes to reach the renderer.
+     */
+    private fieldPermitsDerivedRenditions;
     /**
      * Serve a downscaled `webp` thumbnail of a raster image — the `?variant=thumbnail`
      * path of {@link streamFileToResponse}.
@@ -184,6 +207,51 @@ export declare class FilesBackendService {
      * @returns Array of file metadata
      */
     batchGetFiles(fileIds: string[], executionContext: ExecutionContext<any>, options?: RepositoryOptions): Promise<File[]>;
+    /**
+     * Read a file's BYTES for a system-initiated outbound send — today, an email attachment (#429).
+     *
+     * ## Why this lives here and not in the caller
+     *
+     * Everything it has to get right is file knowledge: which statuses may be served, how a file is
+     * authorized against a scope, and which storage provider holds the bytes. A caller that assembled
+     * those itself would be a second, drifting copy of three decisions this service owns — and the
+     * one most dangerous to copy is the status gate, because getting it wrong means attaching an
+     * INFECTED file to an outbound email.
+     *
+     * ## It REFUSES rather than skipping, and that is the whole point
+     *
+     * The defect this closes is a SILENT drop: `attachmentFileIds` was declared and read by nothing,
+     * so a caller supplying an attachment got a successful send and an attachment-less email. A
+     * resolution that quietly omitted a file it could not serve would be the same defect wearing
+     * error handling, so every rejection throws and names the file.
+     *
+     * ## Authorization: the `authoritativeScopeOverride` this reuses was built for exactly this shape
+     *
+     * A system send carries no user principal, and an identity-less execution context derives no
+     * owner — `authorizeFileAccess` records that trap in its own JSDoc, where an empty context would
+     * have denied the subject's own file during erasure teardown. So the caller's scope is passed
+     * explicitly, the same way the teardown path passes the owner it already resolved. The scope is
+     * NOT optional: without it there is no tenancy confinement, and an attachment path that reads any
+     * file by id is a read-anything primitive wearing an email envelope.
+     *
+     * @param fileIds - The file ids to resolve, in the order the caller supplied them.
+     * @param scope - The AUTHORITATIVE owner every file is authorized against. An organization-scoped
+     *   send passes its `organizationId`; an application-scoped one passes `applicationId` only, and
+     *   then only application-scoped files resolve.
+     * @returns One entry per requested id, in the requested order, carrying the bytes.
+     * @throws When a file is unknown, is in a status that is not servable, is outside the scope, or
+     *   cannot be read from its storage provider.
+     */
+    readFilesForOutboundAttachment(fileIds: readonly string[], scope: {
+        applicationId?: string;
+        organizationId?: string;
+        userId?: string;
+    }): Promise<Array<{
+        fileId: string;
+        filename: string;
+        mimeType: string;
+        bytes: Buffer;
+    }>>;
     /**
      * Update file status (e.g., PENDING -> UPLOADED, UPLOADED -> LINKED).
      *

package/dist/esm/files/services/files.backend.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"files.backend.service.d.ts","sourceRoot":"","sources":["../../../../../src/files/services/files.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAGH,OAAO,KAAK,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAEtD,OAAO,EAA2C,YAAY,EAA0C,sBAAsB,EAAE,KAAK,qBAAqB,EAAoK,MAAM,uBAAuB,CAAC;AAC5V,OAAO,EAAE,IAAI,EAAE,UAAU,EAAmD,oBAAoB,EAAkB,gBAAgB,EAAgC,MAAM,uBAAuB,CAAC;AAChM,OAAO,EAA4B,KAAK,iBAAiB,EAAE,KAAK,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAEtH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAClG,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAE9G,OAAO,EAAE,+BAA+B,EAAE,MAAM,0EAA0E,CAAC;AAC3H,OAAO,EAAE,gBAAgB,EAAE,MAAM,qEAAqE,CAAC;AACvG,OAAO,EAAE,qCAAqC,EAAE,MAAM,+EAA+E,CAAC;AACtI,OAAO,EAAE,qCAAqC,EAAE,MAAM,qFAAqF,CAAC;AAE5I,OAAO,EAAE,yCAAyC,EAAE,MAAM,qGAAqG,CAAC;AAChK,OAAO,EAAE,iBAAiB,EAAE,MAAM,qEAAqE,CAAC;AAKxG,OAAO,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AAC/G,OAAO,EAAE,+BAA+B,EAAE,MAAM,sEAAsE,CAAC;AACvH,OAAO,KAAK,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,MAAM,8DAA8D,CAAC;AAC9H,OAAO,EAAE,2CAA2C,EAAE,MAAM,yFAAyF,CAAC;AAEtJ,OAAO,KAAK,EAAE,qCAAqC,EAAE,MAAM,8EAA8E,CAAC;AAC1I,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,iEAAiE,CAAC;AA+CnH,qBACa,mBAAmB;IAK5B,OAAO,CAAC,QAAQ,CAAC,MAAM;IAEvB,OAAO,CAAC,QAAQ,CAAC,YAAY;IAE7B,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IAElC,OAAO,CAAC,QAAQ,CAAC,oBAAoB;IAErC,OAAO,CAAC,QAAQ,CAAC,uBAAuB;IAExC,OAAO,CAAC,QAAQ,CAAC,uBAAuB;IAExC,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IAElC,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IAGjC,OAAO,CAAC,QAAQ,CAAC,6BAA6B,CAAC;IAQ/C,OAAO,CAAC,QAAQ,CAAC,uBAAuB,CAAC;IAGzC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC;IAhCjC,SAAS,CAAC,QAAQ,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;gBAI9D,MAAM,EAAE,aAAa,EAErB,YAAY,EAAE,0BAA0B,EAExC,iBAAiB,EAAE,+BAA+B,EAElD,oBAAoB,EAAE,yCAAyC,EAE/D,uBAAuB,EAAE,qCAAqC,EAE9D,uBAAuB,EAAE,qCAAqC,EAE9D,iBAAiB,EAAE,+BAA+B,EAElD,gBAAgB,EAAE,uBAAuB,EAGzC,6BAA6B,CAAC,EAAE,2CAA2C,EAQ3E,uBAAuB,CAAC,EAAE,qCAAqC,EAG/D,aAAa,CAAC,EAAE,2BAA2B;IAQ9D;;;OAGG;IACH,OAAO,KAAK,eAAe,GAE1B;IAED,OAAO,CAAC,yBAAyB;IAI1B,yBAAyB,CAC9B,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,QAAQ,GAAG,iBAAiB,GAAG,YAAY,CAAC,EAC7D,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,GACtC,oBAAoB;IA2BvB;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IACU,oBAAoB,CAC/B,IAAI,EAAE,IAAI,EACV,GAAG,EAAE,QAAQ,EACb,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,GAAG,SAAS,EACnD,OAAO,CAAC,EAAE;QAAE,WAAW,CAAC,EAAE,QAAQ,GAAG,YAAY,CAAC;QAAC,IAAI,CAAC,EAAE,YAAY,CAAC;QAAC,OAAO,CAAC,EAAE,gBAAgB,CAAA;KAAE,GACnG,OAAO,CAAC,IAAI,CAAC;IAuIhB;;;;;;;;;;;;;;;;;;OAkBG;YACW,mBAAmB;IA2EjC;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4BG;YACW,8BAA8B;IAqB5C;;;;;;;;;;;OAWG;IACG,UAAU,CACd,QAAQ,EAAE;QACR,QAAQ,EAAE,MAAM,CAAC;QACjB,gBAAgB,EAAE,MAAM,CAAC;QACzB,QAAQ,EAAE,MAAM,CAAC;QACjB,IAAI,EAAE,MAAM,CAAC;QACb,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,qEAAqE;QACrE,eAAe,CAAC,EAAE,mBAAmB,CAAC;QAGtC,KAAK,CAAC,EAAE,oBAAoB,CAAC;QAG7B,cAAc,CAAC,EAAE,MAAM,CAAC;KACzB,GAAG,qBAAqB,EACzB,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACvC,OAAO,CAAC,EAAE,iBAAiB,GAC1B,OAAO,CAAC,IAAI,CAAC;IAwNhB;;;;;;;;;;OAUG;IACH,OAAO,CAAC,aAAa;IAuBrB;;;;;;OAMG;IACG,OAAO,CACX,MAAM,EAAE,MAAM,EACd,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACvC,OAAO,CAAC,EAAE,iBAAiB,GAC1B,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;IA+CvB;;;;;;OAMG;IACG,aAAa,CACjB,OAAO,EAAE,MAAM,EAAE,EACjB,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACvC,OAAO,CAAC,EAAE,iBAAiB,GAC1B,OAAO,CAAC,IAAI,EAAE,CAAC;IAoElB;;;;;;;OAOG;IACG,gBAAgB,CACpB,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,UAAU,EAClB,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACvC,OAAO,CAAC,EAAE,iBAAiB,EAC3B,gBAAgB,CAAC,EAAE,mBAAmB,GACrC,OAAO,CAAC,IAAI,CAAC;IAkFhB;;;;;;;;OAQG;YACW,gCAAgC;IAwB9C;;;;;;;;;;;;;;;;OAgBG;IACG,kBAAkB,CACtB,MAAM,EAAE,MAAM,EACd,YAAY,EAAE,YAAY,EAC1B,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,MAAM,EACjB,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACvC,OAAO,CAAC,EAAE,iBAAiB,GAC1B,OAAO,CAAC,IAAI,CAAC;IA4IhB;;;;;;;;;;;OAWG;IACG,sBAAsB,CAC1B,MAAM,EAAE,MAAM,EACd,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACvC,OAAO,CAAC,EAAE,iBAAiB,GAC1B,OAAO,CAAC,IAAI,CAAC;IAiFhB;;;;;;;OAOG;IACG,UAAU,CACd,MAAM,EAAE,MAAM,EACd,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACvC,OAAO,CAAC,EAAE,iBAAiB,GAC1B,OAAO,CAAC,IAAI,CAAC;IA+EhB;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACG,SAAS,CACb,MAAM,EAAE,MAAM,EACd,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACvC,OAAO,CAAC,EAAE,iBAAiB,GAC1B,OAAO,CAAC,IAAI,CAAC;IAuEhB;;;;OAIG;IACG,cAAc,CAClB,MAAM,EAAE,MAAM,EACd,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACvC,OAAO,CAAC,EAAE,iBAAiB,GAC1B,OAAO,CAAC,IAAI,CAAC;IAuEhB;;;;;;;;OAQG;IACG,oBAAoB,CACxB,YAAY,EAAE,YAAY,EAC1B,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,MAAM,GAAG,SAAS,EAC7B,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACvC,OAAO,CAAC,EAAE,iBAAiB,GAC1B,OAAO,CAAC,IAAI,EAAE,CAAC;IAyGlB;;;;;;;;;;;;;OAaG;IACG,mBAAmB,CACvB,IAAI,EAAE,IAAI,EACV,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC;IACvC;;;;;;;;;OASG;IACH,0BAA0B,CAAC,EAAE;QAAE,aAAa,CAAC,EAAE,MAAM,CAAC;QAAC,cAAc,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,GAChG,OAAO,CAAC,OAAO,CAAC;IAgGnB;;;;;;OAMG;IACH,kBAAkB,CAAC,IAAI,EAAE,IAAI,GAAG;QAC9B,MAAM,EAAE,MAAM,CAAC;QACf,QAAQ,EAAE,MAAM,CAAC;QACjB,IAAI,EAAE,MAAM,CAAC;QACb,QAAQ,EAAE,MAAM,CAAC;QACjB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,MAAM,EAAE,iBAAiB,CAAC;QAC1B,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,UAAU,EAAE,IAAI,CAAC;QACjB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,oBAAoB,CAAC,EAAE,sBAAsB,CAAC;KAC/C;IAyBD;;;;;;OAMG;IACH;;;;;;;;;;;;;;;;;OAiBG;IACH,OAAO,CAAC,qCAAqC;IAoB7C,SAAS,CAAC,iBAAiB,CAAC,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,GAAG;QACpE,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB;IAiBD;;;OAGG;IACH,SAAS,CAAC,0BAA0B,CAAC,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI;IAyB7G,SAAS,CAAC,uBAAuB,CAAC,KAAK,EAAE,oBAAoB,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI;IA4B9F;;;;;;;;;;;;;;;;;OAiBG;YACW,qCAAqC;IAgCnD;;;;;;;;;;;;;;OAcG;IACH,SAAS,CAAC,6BAA6B,CACrC,YAAY,EAAE,YAAY,EAC1B,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC;IACvC;;;;;OAKG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC1C,oBAAoB;IA4HvB;;;;;OAKG;IACH,OAAO,CAAC,gBAAgB;CAOzB"}
+{"version":3,"file":"files.backend.service.d.ts","sourceRoot":"","sources":["../../../../src/files/services/files.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAGH,OAAO,KAAK,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAEtD,OAAO,EAA2C,YAAY,EAA0C,sBAAsB,EAAE,KAAK,qBAAqB,EAAoK,MAAM,uBAAuB,CAAC;AAC5V,OAAO,EAAE,IAAI,EAAE,UAAU,EAA+E,oBAAoB,EAAkB,gBAAgB,EAAgC,MAAM,uBAAuB,CAAC;AAC5N,OAAO,EAA4B,KAAK,iBAAiB,EAAE,KAAK,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAEtH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAClG,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAE9G,OAAO,EAAE,+BAA+B,EAAE,MAAM,0EAA0E,CAAC;AAC3H,OAAO,EAAE,gBAAgB,EAAE,MAAM,qEAAqE,CAAC;AACvG,OAAO,EAAE,qCAAqC,EAAE,MAAM,+EAA+E,CAAC;AACtI,OAAO,EAAE,qCAAqC,EAAE,MAAM,qFAAqF,CAAC;AAE5I,OAAO,EAAE,yCAAyC,EAAE,MAAM,qGAAqG,CAAC;AAChK,OAAO,EAAE,iBAAiB,EAAE,MAAM,qEAAqE,CAAC;AAMxG,OAAO,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AAC/G,OAAO,EAAE,+BAA+B,EAAE,MAAM,sEAAsE,CAAC;AACvH,OAAO,KAAK,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,MAAM,8DAA8D,CAAC;AAC9H,OAAO,EAAE,2CAA2C,EAAE,MAAM,yFAAyF,CAAC;AAEtJ,OAAO,KAAK,EAAE,qCAAqC,EAAE,MAAM,8EAA8E,CAAC;AAC1I,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,iEAAiE,CAAC;AA+CnH,qBACa,mBAAmB;IAK5B,OAAO,CAAC,QAAQ,CAAC,MAAM;IAEvB,OAAO,CAAC,QAAQ,CAAC,YAAY;IAE7B,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IAElC,OAAO,CAAC,QAAQ,CAAC,oBAAoB;IAErC,OAAO,CAAC,QAAQ,CAAC,uBAAuB;IAExC,OAAO,CAAC,QAAQ,CAAC,uBAAuB;IAExC,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IAElC,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IAGjC,OAAO,CAAC,QAAQ,CAAC,6BAA6B,CAAC;IAQ/C,OAAO,CAAC,QAAQ,CAAC,uBAAuB,CAAC;IAGzC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC;IAhCjC,SAAS,CAAC,QAAQ,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;gBAI9D,MAAM,EAAE,aAAa,EAErB,YAAY,EAAE,0BAA0B,EAExC,iBAAiB,EAAE,+BAA+B,EAElD,oBAAoB,EAAE,yCAAyC,EAE/D,uBAAuB,EAAE,qCAAqC,EAE9D,uBAAuB,EAAE,qCAAqC,EAE9D,iBAAiB,EAAE,+BAA+B,EAElD,gBAAgB,EAAE,uBAAuB,EAGzC,6BAA6B,CAAC,EAAE,2CAA2C,EAQ3E,uBAAuB,CAAC,EAAE,qCAAqC,EAG/D,aAAa,CAAC,EAAE,2BAA2B;IAQ9D;;;OAGG;IACH,OAAO,KAAK,eAAe,GAE1B;IAED,OAAO,CAAC,yBAAyB;IAI1B,yBAAyB,CAC9B,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,QAAQ,GAAG,iBAAiB,GAAG,YAAY,CAAC,EAC7D,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,GACtC,oBAAoB;IA2BvB;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IACU,oBAAoB,CAC/B,IAAI,EAAE,IAAI,EACV,GAAG,EAAE,QAAQ,EACb,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,GAAG,SAAS,EACnD,OAAO,CAAC,EAAE;QAAE,WAAW,CAAC,EAAE,QAAQ,GAAG,YAAY,CAAC;QAAC,IAAI,CAAC,EAAE,YAAY,CAAC;QAAC,OAAO,CAAC,EAAE,gBAAgB,CAAA;KAAE,GACnG,OAAO,CAAC,IAAI,CAAC;IAmKhB;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,OAAO,CAAC,6BAA6B;IA+BrC;;;;;;;;;;;;;;;;;;OAkBG;YACW,mBAAmB;IA2EjC;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4BG;YACW,8BAA8B;IAqB5C;;;;;;;;;;;OAWG;IACG,UAAU,CACd,QAAQ,EAAE;QACR,QAAQ,EAAE,MAAM,CAAC;QACjB,gBAAgB,EAAE,MAAM,CAAC;QACzB,QAAQ,EAAE,MAAM,CAAC;QACjB,IAAI,EAAE,MAAM,CAAC;QACb,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,qEAAqE;QACrE,eAAe,CAAC,EAAE,mBAAmB,CAAC;QAGtC,KAAK,CAAC,EAAE,oBAAoB,CAAC;QAG7B,cAAc,CAAC,EAAE,MAAM,CAAC;KACzB,GAAG,qBAAqB,EACzB,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACvC,OAAO,CAAC,EAAE,iBAAiB,GAC1B,OAAO,CAAC,IAAI,CAAC;IAwNhB;;;;;;;;;;OAUG;IACH,OAAO,CAAC,aAAa;IAuBrB;;;;;;OAMG;IACG,OAAO,CACX,MAAM,EAAE,MAAM,EACd,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACvC,OAAO,CAAC,EAAE,iBAAiB,GAC1B,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;IA+CvB;;;;;;OAMG;IACG,aAAa,CACjB,OAAO,EAAE,MAAM,EAAE,EACjB,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACvC,OAAO,CAAC,EAAE,iBAAiB,GAC1B,OAAO,CAAC,IAAI,EAAE,CAAC;IAoElB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAkCG;IACG,8BAA8B,CAClC,OAAO,EAAE,SAAS,MAAM,EAAE,EAC1B,KAAK,EAAE;QAAE,aAAa,CAAC,EAAE,MAAM,CAAC;QAAC,cAAc,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,GAC1E,OAAO,CAAC,KAAK,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IA2ExF;;;;;;;OAOG;IACG,gBAAgB,CACpB,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,UAAU,EAClB,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACvC,OAAO,CAAC,EAAE,iBAAiB,EAC3B,gBAAgB,CAAC,EAAE,mBAAmB,GACrC,OAAO,CAAC,IAAI,CAAC;IAkFhB;;;;;;;;OAQG;YACW,gCAAgC;IAwB9C;;;;;;;;;;;;;;;;OAgBG;IACG,kBAAkB,CACtB,MAAM,EAAE,MAAM,EACd,YAAY,EAAE,YAAY,EAC1B,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,MAAM,EACjB,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACvC,OAAO,CAAC,EAAE,iBAAiB,GAC1B,OAAO,CAAC,IAAI,CAAC;IA4IhB;;;;;;;;;;;OAWG;IACG,sBAAsB,CAC1B,MAAM,EAAE,MAAM,EACd,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACvC,OAAO,CAAC,EAAE,iBAAiB,GAC1B,OAAO,CAAC,IAAI,CAAC;IAiFhB;;;;;;;OAOG;IACG,UAAU,CACd,MAAM,EAAE,MAAM,EACd,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACvC,OAAO,CAAC,EAAE,iBAAiB,GAC1B,OAAO,CAAC,IAAI,CAAC;IA+EhB;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACG,SAAS,CACb,MAAM,EAAE,MAAM,EACd,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACvC,OAAO,CAAC,EAAE,iBAAiB,GAC1B,OAAO,CAAC,IAAI,CAAC;IAuEhB;;;;OAIG;IACG,cAAc,CAClB,MAAM,EAAE,MAAM,EACd,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACvC,OAAO,CAAC,EAAE,iBAAiB,GAC1B,OAAO,CAAC,IAAI,CAAC;IAuEhB;;;;;;;;OAQG;IACG,oBAAoB,CACxB,YAAY,EAAE,YAAY,EAC1B,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,MAAM,GAAG,SAAS,EAC7B,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACvC,OAAO,CAAC,EAAE,iBAAiB,GAC1B,OAAO,CAAC,IAAI,EAAE,CAAC;IAyGlB;;;;;;;;;;;;;OAaG;IACG,mBAAmB,CACvB,IAAI,EAAE,IAAI,EACV,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC;IACvC;;;;;;;;;OASG;IACH,0BAA0B,CAAC,EAAE;QAAE,aAAa,CAAC,EAAE,MAAM,CAAC;QAAC,cAAc,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,GAChG,OAAO,CAAC,OAAO,CAAC;IAgGnB;;;;;;OAMG;IACH,kBAAkB,CAAC,IAAI,EAAE,IAAI,GAAG;QAC9B,MAAM,EAAE,MAAM,CAAC;QACf,QAAQ,EAAE,MAAM,CAAC;QACjB,IAAI,EAAE,MAAM,CAAC;QACb,QAAQ,EAAE,MAAM,CAAC;QACjB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,MAAM,EAAE,iBAAiB,CAAC;QAC1B,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,UAAU,EAAE,IAAI,CAAC;QACjB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,oBAAoB,CAAC,EAAE,sBAAsB,CAAC;KAC/C;IAyBD;;;;;;OAMG;IACH;;;;;;;;;;;;;;;;;OAiBG;IACH,OAAO,CAAC,qCAAqC;IAoB7C,SAAS,CAAC,iBAAiB,CAAC,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,GAAG;QACpE,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB;IAiBD;;;OAGG;IACH,SAAS,CAAC,0BAA0B,CAAC,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI;IAyB7G,SAAS,CAAC,uBAAuB,CAAC,KAAK,EAAE,oBAAoB,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI;IA4B9F;;;;;;;;;;;;;;;;;OAiBG;YACW,qCAAqC;IAgCnD;;;;;;;;;;;;;;OAcG;IACH,SAAS,CAAC,6BAA6B,CACrC,YAAY,EAAE,YAAY,EAC1B,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC;IACvC;;;;;OAKG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC1C,oBAAoB;IA4HvB;;;;;OAKG;IACH,OAAO,CAAC,gBAAgB;CAOzB"}