npm - @wildo-ai/saas-backend-lib - Versions diffs - 1.1.2 → 1.1.4 - Mend

@wildo-ai/saas-backend-lib 1.1.2 → 1.1.4

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (1358) hide show

package/dist/esm/files/storage/local-directory-storage-provider.backend.service.d.ts CHANGED Viewed

@@ -2,9 +2,23 @@
  * Local Directory Storage Provider
  *
  * IFileStorageProvider implementation backed by the local filesystem.
- * Files are stored under a configurable base directory, organized by
- * application and file ID. Path traversal attacks are guarded against
- * by resolving all paths and verifying they stay inside the base dir.
+ * Files are stored under a configurable base directory, at the SAME relative key the
+ * Wildo-managed provider would use — `applications/<appId>/files/<storageName>/<scope>/<scopeId>/…`,
+ * composed by `application-storage-key.backend.utils`. Path traversal attacks are guarded against
+ * by refusing a `.`/`..` segment in the composed key AND by resolving every path and verifying it
+ * stays inside the base dir.
+ *
+ * ## Why the key shape is shared rather than provider-local
+ *
+ * Until 2026-09-09 this provider composed `[applicationId]/[folderPath]/<leaf>` from the field's
+ * declarative binding alone, and included the application id only when the binding asked
+ * (`includeApplicationId`, defaulting to `false` here). It therefore emitted NONE of the
+ * `<scope>/<scopeId>` segments the managed provider's shape carries, so a deployment routing a
+ * `z_file()` field to local storage had no per-tenant prefix to sweep, list or confine against —
+ * and nothing failed, because an absent prefix produces no error, only an absent capability.
+ *
+ * Both providers now call one composer. See `application-storage-key.backend.utils.ts` for the
+ * argument and for what deliberately stays provider-local.
  *
  * Configured through `storage.localDirectory.baseDir` in resolved application
  * configuration, which the configuration loader seeds from the
@@ -39,14 +53,18 @@ export declare class LocalDirectoryStorageProvider implements IFileStorageProvid
     healthCheck(): Promise<StorageProviderHealthResult>;
     private getBaseDir;
     /**
-     * Compose the ordered path segments for an upload.
+     * Compose the relative storage key for an upload.
      *
-     * Layout (all optional segments omitted when absent):
-     * [applicationId] / [folderPath] / <fileName|fileId>
+     * Layout — identical to the managed provider's, minus that provider's bucket prefix:
+     *   `applications/<applicationId>/files/<storageName>/<scope>/<scopeId>/[folderPath/]<fileName|fileId>`
      *
-     * `includeApplicationId` defaults to `false` for local storage.
+     * `includeApplicationId` defaults to `true` here, as it does on the managed provider. It used to
+     * default to `false` ("the volume is typically per-app"), which is exactly what left this provider
+     * with no tenant structure: a per-app VOLUME separates applications from each other and separates
+     * nothing inside one. Set explicitly to `false` the key collapses to the bare leaf path on BOTH
+     * providers — one authored value, one meaning, and the same loss of every prefix operation.
      */
-    private composePathSegments;
+    private composeStorageKey;
     /**
      * Resolve a safe absolute path from a relative storage ref.
      * Throws if the resolved path escapes the base directory (path traversal guard).
@@ -60,6 +78,47 @@ export declare class LocalDirectoryStorageProvider implements IFileStorageProvid
     /**
      * Resolve the absolute filesystem path from a persisted storageRef.
      * The ref IS the relative path from baseDir — just validate traversal.
+     *
+     * ## Already-stored files are NOT moved by the key-shape change, and nothing has to be migrated
+     *
+     * Every read verb (`download` / `delete` / `getMetadata`) reaches a blob through this method, and
+     * with a ref present it uses that ref VERBATIM. A blob written under the old
+     * `[applicationId]/[folderPath]/<leaf>` layout therefore stays addressable at exactly the path it
+     * was written to: the shape change governs where NEW uploads land, never how an existing row is
+     * resolved. No migration, and no compatibility branch, because there is nothing to be compatible
+     * with — the persisted ref is the address.
+     *
+     * ## The no-ref branch is LIVE, and it must track `upload` rather than freeze
+     *
+     * It looks like a legacy fallback for rows whose `storageRef` never committed. Its real caller is
+     * the audit-log archive batch: `archiveArtifactExists` probes `getMetadata` with
+     * `fileId: '<folderPath>/<fileName>'` and NO ref, deliberately, so that each provider re-derives
+     * the key its own `upload` produced and the batch never re-implements provider path logic. Pin
+     * the old composition here and that probe would address a blob the upload no longer writes, so
+     * `archiveArtifactExists` would answer `false` forever and every past day would be re-archived on
+     * every tick — a silent, unbounded regression with no failing test anywhere.
+     *
+     * So it composes through the SAME composer, with no resource type and no scope, mirroring the
+     * managed provider's `resolveApplicationObjectKey(file.fileId, ctx, undefined)` argument for
+     * argument. The parity is pinned in this provider's test suite (`upload` then `getMetadata` with
+     * no ref); the batch's own suite uses a fake provider and cannot see it.
+     *
+     * ## Residual, recorded rather than fixed: a `.`/`..` segment inside a PRESENT ref
+     *
+     * `composeStorageKey` refuses one on the composition path; this branch does not, and the managed
+     * provider's `assertNoTraversalSegments(normalizedStorageRef, …)` does. Two reasons it is left
+     * asymmetric, and neither is "nobody thought about it":
+     *
+     * - the containment check below is a real `path.resolve`, not managed's textual `startsWith`, so
+     *   the class of attack that motivated managed's stored-ref check (a ref that satisfies a textual
+     *   prefix while pointing elsewhere) is already caught here for anything leaving the base;
+     * - a `.` ref legitimately addresses the base directory and is pinned as NOT an authorization
+     *   refusal (`ADMITS the base directory itself`), which a whole-segment textual check would break.
+     *
+     * What survives is a ref whose text climbs out of one tenant prefix into another WITHIN the base.
+     * Reaching it needs write access to the `storageRef` column — the composition path can no longer
+     * produce one — so it is a smaller surface than the one closed above, not the same one. Closing it
+     * means deciding what `.` should mean first, which is a separate change.
      */
     private resolvePathFromStorageRef;
     private readLocalMetadata;

package/dist/esm/files/storage/local-directory-storage-provider.backend.service.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"local-directory-storage-provider.backend.service.d.ts","sourceRoot":"","sources":["~~../../../../../~~src/files/storage/local-directory-storage-provider.backend.service.ts"],"names":[],"mappings":"AAAA~~;;;;;;;;;;;;;GAaG~~;AAGH,OAAO,EAAE,QAAQ,EAAE,MAAM,QAAQ,CAAC;AAKlC,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAE/D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAClG,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAE9G,OAAO,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AAC/G,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qEAAqE,CAAC;~~AAG5G~~,OAAO,KAAK,EACV,oBAAoB,EACpB,mBAAmB,EACnB,oBAAoB,EACpB,qBAAqB,EACrB,mBAAmB,EACnB,2BAA2B,EAC3B,uBAAuB,EACxB,MAAM,+BAA+B,CAAC;AAUvC,qBACa,6BAA8B,YAAW,oBAAoB;IAMtE,OAAO,CAAC,QAAQ,CAAC,MAAM;IAEvB,OAAO,CAAC,QAAQ,CAAC,YAAY;IAE7B,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IATnC,QAAQ,CAAC,UAAU,uCAAuC;IAC1D,OAAO,CAAC,OAAO,CAAuB;gBAInB,MAAM,EAAE,aAAa,EAErB,YAAY,EAAE,0BAA0B,EAExC,gBAAgB,EAAE,uBAAuB;IAG5D;;;;;OAKG;IACH,YAAY,IAAI,OAAO;IAIvB,yFAAyF;IACzF,OAAO,KAAK,iBAAiB,GAE5B;IAEK,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAoB3B,WAAW,IAAI,OAAO,CAAC,2BAA2B,CAAC;IAmBzD,OAAO,CAAC,UAAU;IAkBlB~~;;;;;;;OAOG~~;IACH,OAAO,CAAC,~~mBAAmB~~;~~IAmC3B~~;;;OAGG;IACH,OAAO,CAAC,2BAA2B;IAkBnC,OAAO,CAAC,gBAAgB;IAMlB,MAAM,CACV,UAAU,EAAE,QAAQ,EACpB,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,EACZ,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACvC,OAAO,CAAC,EAAE,oBAAoB,GAC7B,OAAO,CAAC,mBAAmB,CAAC;~~IAsCzB~~,QAAQ,CACZ,IAAI,EAAE,uBAAuB,EAC7B,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,GACtC,OAAO,CAAC,qBAAqB,CAAC;IAgC3B,MAAM,CACV,IAAI,EAAE,uBAAuB,EAC7B,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,GACtC,OAAO,CAAC,IAAI,CAAC;IAoBV,WAAW,CACf,IAAI,EAAE,uBAAuB,EAC7B,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,GACtC,OAAO,CAAC,mBAAmB,CAAC;IA8B/B~~;;;OAGG~~;IACH,OAAO,CAAC,yBAAyB;~~YAYnB~~,iBAAiB;IAkB/B,OAAO,CAAC,mBAAmB;CAuD5B"}
1	+ {"version":3,"file":"local-directory-storage-provider.backend.service.d.ts","sourceRoot":"","sources":["../../../../src/files/storage/local-directory-storage-provider.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAGH,OAAO,EAAE,QAAQ,EAAE,MAAM,QAAQ,CAAC;AAKlC,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAE/D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAClG,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAE9G,OAAO,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AAC/G,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qEAAqE,CAAC;AAQ5G,OAAO,KAAK,EACV,oBAAoB,EACpB,mBAAmB,EACnB,oBAAoB,EACpB,qBAAqB,EACrB,mBAAmB,EACnB,2BAA2B,EAC3B,uBAAuB,EACxB,MAAM,+BAA+B,CAAC;AAUvC,qBACa,6BAA8B,YAAW,oBAAoB;IAMtE,OAAO,CAAC,QAAQ,CAAC,MAAM;IAEvB,OAAO,CAAC,QAAQ,CAAC,YAAY;IAE7B,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IATnC,QAAQ,CAAC,UAAU,uCAAuC;IAC1D,OAAO,CAAC,OAAO,CAAuB;gBAInB,MAAM,EAAE,aAAa,EAErB,YAAY,EAAE,0BAA0B,EAExC,gBAAgB,EAAE,uBAAuB;IAG5D;;;;;OAKG;IACH,YAAY,IAAI,OAAO;IAIvB,yFAAyF;IACzF,OAAO,KAAK,iBAAiB,GAE5B;IAEK,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAoB3B,WAAW,IAAI,OAAO,CAAC,2BAA2B,CAAC;IAmBzD,OAAO,CAAC,UAAU;IAkBlB;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,iBAAiB;IAqDzB;;;OAGG;IACH,OAAO,CAAC,2BAA2B;IAkBnC,OAAO,CAAC,gBAAgB;IAMlB,MAAM,CACV,UAAU,EAAE,QAAQ,EACpB,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,EACZ,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACvC,OAAO,CAAC,EAAE,oBAAoB,GAC7B,OAAO,CAAC,mBAAmB,CAAC;IAqCzB,QAAQ,CACZ,IAAI,EAAE,uBAAuB,EAC7B,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,GACtC,OAAO,CAAC,qBAAqB,CAAC;IAgC3B,MAAM,CACV,IAAI,EAAE,uBAAuB,EAC7B,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,GACtC,OAAO,CAAC,IAAI,CAAC;IAoBV,WAAW,CACf,IAAI,EAAE,uBAAuB,EAC7B,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,GACtC,OAAO,CAAC,mBAAmB,CAAC;IA8B/B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4CG;IACH,OAAO,CAAC,yBAAyB;YAWnB,iBAAiB;IAkB/B,OAAO,CAAC,mBAAmB;CAuD5B"}

package/dist/esm/files/storage/local-directory-storage-provider.backend.service.js CHANGED Viewed

@@ -2,9 +2,23 @@
  * Local Directory Storage Provider
  *
  * IFileStorageProvider implementation backed by the local filesystem.
- * Files are stored under a configurable base directory, organized by
- * application and file ID. Path traversal attacks are guarded against
- * by resolving all paths and verifying they stay inside the base dir.
+ * Files are stored under a configurable base directory, at the SAME relative key the
+ * Wildo-managed provider would use — `applications/<appId>/files/<storageName>/<scope>/<scopeId>/…`,
+ * composed by `application-storage-key.backend.utils`. Path traversal attacks are guarded against
+ * by refusing a `.`/`..` segment in the composed key AND by resolving every path and verifying it
+ * stays inside the base dir.
+ *
+ * ## Why the key shape is shared rather than provider-local
+ *
+ * Until 2026-09-09 this provider composed `[applicationId]/[folderPath]/<leaf>` from the field's
+ * declarative binding alone, and included the application id only when the binding asked
+ * (`includeApplicationId`, defaulting to `false` here). It therefore emitted NONE of the
+ * `<scope>/<scopeId>` segments the managed provider's shape carries, so a deployment routing a
+ * `z_file()` field to local storage had no per-tenant prefix to sweep, list or confine against —
+ * and nothing failed, because an absent prefix produces no error, only an absent capability.
+ *
+ * Both providers now call one composer. See `application-storage-key.backend.utils.ts` for the
+ * argument and for what deliberately stays provider-local.
  *
  * Configured through `storage.localDirectory.baseDir` in resolved application
  * configuration, which the configuration loader seeds from the
@@ -36,6 +50,7 @@ import { describeCaughtError } from '../../errors/utils/error-log-level-classifi
 import { AppConfigurationService } from '../../config/services/app-configuration.backend.service.js';
 import { validateAppId, validateContentType, validateFileId, validateSize, validateStream, resolveConfiguredMaxFileSize } from '../../files/utils/file-validation.utils.js';
 import { resolveStorageApplicationIdentity } from '../../files/utils/storage-application-identity.backend.utils.js';
+import { composeApplicationStorageKey, composeStorageLeafPath, storageKeyHasTraversalSegment, } from './application-storage-key.backend.utils.js';
 const METADATA_SUFFIX = '.meta.json';
 let LocalDirectoryStorageProvider = class LocalDirectoryStorageProvider {
     logger;
@@ -106,34 +121,53 @@ let LocalDirectoryStorageProvider = class LocalDirectoryStorageProvider {
         return this.baseDir;
     }
     /**
-     * Compose the ordered path segments for an upload.
+     * Compose the relative storage key for an upload.
      *
-     * Layout (all optional segments omitted when absent):
-     * [applicationId] / [folderPath] / <fileName|fileId>
+     * Layout — identical to the managed provider's, minus that provider's bucket prefix:
+     *   `applications/<applicationId>/files/<storageName>/<scope>/<scopeId>/[folderPath/]<fileName|fileId>`
      *
-     * `includeApplicationId` defaults to `false` for local storage.
+     * `includeApplicationId` defaults to `true` here, as it does on the managed provider. It used to
+     * default to `false` ("the volume is typically per-app"), which is exactly what left this provider
+     * with no tenant structure: a per-app VOLUME separates applications from each other and separates
+     * nothing inside one. Set explicitly to `false` the key collapses to the bare leaf path on BOTH
+     * providers — one authored value, one meaning, and the same loss of every prefix operation.
      */
-    composePathSegments(fileId, executionContext, options) {
-        const segments = [];
-        const includeAppId = options?.includeApplicationId ?? false;
-        if (includeAppId) {
-            const applicationId = this.getApplicationId(executionContext);
-            segments.push(applicationId);
-        }
-        if (options?.folderPath) {
-            const trimmed = options.folderPath.trim();
-            if (trimmed) {
-                segments.push(trimmed);
-            }
-        }
-        const leaf = options?.fileName?.trim() || fileId;
-        if (!leaf) {
+    composeStorageKey(fileId, executionContext, options) {
+        const leafPath = composeStorageLeafPath(fileId, options);
+        if (!leafPath) {
             throw this.errorBuilder.buildError(ErrorType.VALIDATION, executionContext, {
                 customMessageReference: ErrorCustomMessageReference.FILE_STORAGE_KEY_COMPOSITION_FAILED,
             });
         }
-        segments.push(leaf);
-        return segments;
+        // Refused on the LEAF, textually, before any prefix is prepended — and this is load-bearing
+        // rather than belt-and-braces. `resolveSafePathFromRelative` below asks "does the resolved path
+        // escape the base directory", which was the whole guard while a key was one or two segments
+        // deep. Under the six-segment tenant prefix a `folderPath: '../../outside'` no longer escapes:
+        // it resolves to `applications/<app>/files/_unlinked/outside/…`, still inside the base, so the
+        // containment check ADMITS what it used to refuse. What the `..` now buys an attacker is not an
+        // escape from the store but an escape from the TENANT prefix — the exact property this key
+        // shape exists to provide.
+        //
+        // The managed provider refuses the same input for the mirror-image reason (its stored-ref prefix
+        // check is textual), so one authored value cannot mean two things depending on which provider a
+        // deployment binds. `assertNoTraversalSegments` there and this share `storageKeyHasTraversalSegment`.
+        if (storageKeyHasTraversalSegment(leafPath)) {
+            throw this.errorBuilder.buildError(ErrorType.AUTHORIZATION, undefined, {
+                customMessageReference: ErrorCustomMessageReference.FILE_PATH_TRAVERSAL_DETECTED,
+                context: {
+                    relativePath: leafPath, // diagnostic (log-only)
+                },
+            });
+        }
+        if (options?.includeApplicationId === false) {
+            return leafPath;
+        }
+        return composeApplicationStorageKey({
+            applicationId: this.getApplicationId(executionContext),
+            leafPath,
+            linkedResourceType: options?.linkedResourceType,
+            scope: options?.scope,
+        });
     }
     /**
      * Resolve a safe absolute path from a relative storage ref.
@@ -162,8 +196,7 @@ let LocalDirectoryStorageProvider = class LocalDirectoryStorageProvider {
         validateContentType(mimeType, this.errorBuilder, executionContext, 'mimeType');
         validateSize(size, resolveConfiguredMaxFileSize(this.appConfigService.config.storage?.maxFileSize), this.errorBuilder, executionContext, 'size');
         validateStream(fileStream, this.errorBuilder, executionContext, 'fileStream');
-        const segments = this.composePathSegments(fileId, executionContext, options);
-        const relativePath = segments.join('/');
+        const relativePath = this.composeStorageKey(fileId, executionContext, options);
         const filePath = this.resolveSafePathFromRelative(relativePath);
         await fs.promises.mkdir(path.dirname(filePath), { recursive: true });
         try {
@@ -255,12 +288,52 @@ let LocalDirectoryStorageProvider = class LocalDirectoryStorageProvider {
     /**
      * Resolve the absolute filesystem path from a persisted storageRef.
      * The ref IS the relative path from baseDir — just validate traversal.
+     *
+     * ## Already-stored files are NOT moved by the key-shape change, and nothing has to be migrated
+     *
+     * Every read verb (`download` / `delete` / `getMetadata`) reaches a blob through this method, and
+     * with a ref present it uses that ref VERBATIM. A blob written under the old
+     * `[applicationId]/[folderPath]/<leaf>` layout therefore stays addressable at exactly the path it
+     * was written to: the shape change governs where NEW uploads land, never how an existing row is
+     * resolved. No migration, and no compatibility branch, because there is nothing to be compatible
+     * with — the persisted ref is the address.
+     *
+     * ## The no-ref branch is LIVE, and it must track `upload` rather than freeze
+     *
+     * It looks like a legacy fallback for rows whose `storageRef` never committed. Its real caller is
+     * the audit-log archive batch: `archiveArtifactExists` probes `getMetadata` with
+     * `fileId: '<folderPath>/<fileName>'` and NO ref, deliberately, so that each provider re-derives
+     * the key its own `upload` produced and the batch never re-implements provider path logic. Pin
+     * the old composition here and that probe would address a blob the upload no longer writes, so
+     * `archiveArtifactExists` would answer `false` forever and every past day would be re-archived on
+     * every tick — a silent, unbounded regression with no failing test anywhere.
+     *
+     * So it composes through the SAME composer, with no resource type and no scope, mirroring the
+     * managed provider's `resolveApplicationObjectKey(file.fileId, ctx, undefined)` argument for
+     * argument. The parity is pinned in this provider's test suite (`upload` then `getMetadata` with
+     * no ref); the batch's own suite uses a fake provider and cannot see it.
+     *
+     * ## Residual, recorded rather than fixed: a `.`/`..` segment inside a PRESENT ref
+     *
+     * `composeStorageKey` refuses one on the composition path; this branch does not, and the managed
+     * provider's `assertNoTraversalSegments(normalizedStorageRef, …)` does. Two reasons it is left
+     * asymmetric, and neither is "nobody thought about it":
+     *
+     * - the containment check below is a real `path.resolve`, not managed's textual `startsWith`, so
+     *   the class of attack that motivated managed's stored-ref check (a ref that satisfies a textual
+     *   prefix while pointing elsewhere) is already caught here for anything leaving the base;
+     * - a `.` ref legitimately addresses the base directory and is pinned as NOT an authorization
+     *   refusal (`ADMITS the base directory itself`), which a whole-segment textual check would break.
+     *
+     * What survives is a ref whose text climbs out of one tenant prefix into another WITHIN the base.
+     * Reaching it needs write access to the `storageRef` column — the composition path can no longer
+     * produce one — so it is a smaller surface than the one closed above, not the same one. Closing it
+     * means deciding what `.` should mean first, which is a separate change.
      */
     resolvePathFromStorageRef(file, executionContext) {
         const ref = file.storageRef;
         if (!ref) {
-            const appId = this.getApplicationId(executionContext);
-            return this.resolveSafePathFromRelative(`${appId}/${file.fileId}`);
+            return this.resolveSafePathFromRelative(this.composeStorageKey(file.fileId, executionContext));
         }
         return this.resolveSafePathFromRelative(ref);
     }

package/dist/esm/files/storage/local-directory-storage-provider.backend.service.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"local-directory-storage-provider.backend.service.js","sourceRoot":"","sources":["../../../../../src/files/storage/local-directory-storage-provider.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;;;;;;;;;;;;;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAE/C,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAC3C,OAAO,EAAE,SAAS,EAAE,2BAA2B,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AACpG,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAC/D,OAAO,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AAEpF,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAC9G,OAAO,EAAE,mBAAmB,EAAE,MAAM,8EAA8E,CAAC;AACnH,OAAO,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AAE/G,OAAO,EAAE,aAAa,EAAE,mBAAmB,EAAE,cAAc,EAAE,YAAY,EAAE,cAAc,EAAE,4BAA4B,EAAE,MAAM,sDAAsD,CAAC;AACtL,OAAO,EAAE,iCAAiC,EAAE,MAAM,2EAA2E,CAAC;AAW9H,MAAM,eAAe,GAAG,YAAY,CAAC;AAS9B,IAAM,6BAA6B,GAAnC,MAAM,6BAA6B;IAMrB;IAEA;IAEA;IATV,UAAU,GAAG,mBAAmB,CAAC,eAAe,CAAC;IAClD,OAAO,GAAkB,IAAI,CAAC;IAEtC,YAEmB,MAAqB,EAErB,YAAwC,EAExC,gBAAyC;QAJzC,WAAM,GAAN,MAAM,CAAe;QAErB,iBAAY,GAAZ,YAAY,CAA4B;QAExC,qBAAgB,GAAhB,gBAAgB,CAAyB;IACzD,CAAC;IAEJ;;;;;OAKG;IACH,YAAY;QACV,OAAO,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC;IAClC,CAAC;IAED,yFAAyF;IACzF,IAAY,iBAAiB;QAC3B,OAAO,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,OAAO,EAAE,cAAc,EAAE,OAAO,CAAC;IACvE,CAAC;IAED,KAAK,CAAC,UAAU;QACd,MAAM,MAAM,GAAG,IAAI,CAAC,iBAAiB,CAAC;QACtC,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,aAAa,EACvB,SAAS,EACT;gBACE,sBAAsB,EAAE,2BAA2B,CAAC,aAAa;gBACjE,OAAO,EAAE;oBACP,OAAO,EAAE,sGAAsG;iBAChH;aACF,CACF,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACtC,MAAM,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACvD,IAAI,CAAC,OAAO,GAAG,QAAQ,CAAC;IAC1B,CAAC;IAED,KAAK,CAAC,WAAW;QACf,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAE7B,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAClB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,EAAE,KAAK,EAAE,+BAA+B,EAAE,CAAC;QACrG,CAAC;QAED,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,GAAG,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YAC9E,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,EAAE,CAAC;QAC5D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;gBAC/B,KAAK,EAAE,mBAAmB,CAAC,KAAK,CAAC;aAClC,CAAC;QACJ,CAAC;IACH,CAAC;IAEO,UAAU;QAChB,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAClB,MAAM,GAAG,GAAG,IAAI,CAAC,iBAAiB,CAAC;YACnC,IAAI,CAAC,GAAG,EAAE,CAAC;gBACT,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,aAAa,EACvB,SAAS,EACT;oBACE,sBAAsB,EAAE,2BAA2B,CAAC,aAAa;oBACjE,OAAO,EAAE,EAAE,OAAO,EAAE,gFAAgF,EAAE;iBACvG,CACF,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACnC,CAAC;QACD,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IAED;;;;;;;OAOG;IACK,mBAAmB,CACzB,MAAc,EACd,gBAAuC,EACvC,OAA8B;QAE9B,MAAM,QAAQ,GAAa,EAAE,CAAC;QAE9B,MAAM,YAAY,GAAG,OAAO,EAAE,oBAAoB,IAAI,KAAK,CAAC;QAC5D,IAAI,YAAY,EAAE,CAAC;YACjB,MAAM,aAAa,GAAG,IAAI,CAAC,gBAAgB,CAAC,gBAAgB,CAAC,CAAC;YAC9D,QAAQ,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QAC/B,CAAC;QAED,IAAI,OAAO,EAAE,UAAU,EAAE,CAAC;YACxB,MAAM,OAAO,GAAG,OAAO,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;YAC1C,IAAI,OAAO,EAAE,CAAC;gBACZ,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACzB,CAAC;QACH,CAAC;QAED,MAAM,IAAI,GAAG,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,MAAM,CAAC;QACjD,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,UAAU,EACpB,gBAAgB,EAChB;gBACE,sBAAsB,EAAE,2BAA2B,CAAC,mCAAmC;aACxF,CACF,CAAC;QACJ,CAAC;QACD,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAEpB,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED;;;OAGG;IACK,2BAA2B,CAAC,YAAoB;QACtD,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC;QAC/B,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;QAClD,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YAC/D,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,aAAa,EACvB,SAAS,EACT;gBACE,sBAAsB,EAAE,2BAA2B,CAAC,4BAA4B;gBAChF,OAAO,EAAE;oBACP,YAAY,EAAE,wBAAwB;iBACvC;aACF,CACF,CAAC;QACJ,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAEO,gBAAgB,CAAC,gBAAuC;QAC9D,MAAM,aAAa,GAAG,iCAAiC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;QAC/E,aAAa,CAAC,aAAa,EAAE,IAAI,CAAC,YAAY,EAAE,gBAAgB,EAAE,eAAe,CAAC,CAAC;QACnF,OAAO,aAAa,CAAC;IACvB,CAAC;IAED,KAAK,CAAC,MAAM,CACV,UAAoB,EACpB,MAAc,EACd,QAAgB,EAChB,IAAY,EACZ,gBAAuC,EACvC,OAA8B;QAE9B,cAAc,CAAC,MAAM,EAAE,IAAI,CAAC,YAAY,EAAE,gBAAgB,EAAE,QAAQ,CAAC,CAAC;QACtE,mBAAmB,CAAC,QAAQ,EAAE,IAAI,CAAC,YAAY,EAAE,gBAAgB,EAAE,UAAU,CAAC,CAAC;QAC/E,YAAY,CACV,IAAI,EACJ,4BAA4B,CAAC,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,OAAO,EAAE,WAAW,CAAC,EAC/E,IAAI,CAAC,YAAY,EACjB,gBAAgB,EAChB,MAAM,CACP,CAAC;QACF,cAAc,CAAC,UAAU,EAAE,IAAI,CAAC,YAAY,EAAE,gBAAgB,EAAE,YAAY,CAAC,CAAC;QAE9E,MAAM,QAAQ,GAAG,IAAI,CAAC,mBAAmB,CAAC,MAAM,EAAE,gBAAgB,EAAE,OAAO,CAAC,CAAC;QAC7E,MAAM,YAAY,GAAG,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACxC,MAAM,QAAQ,GAAG,IAAI,CAAC,2BAA2B,CAAC,YAAY,CAAC,CAAC;QAEhE,MAAM,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAErE,IAAI,CAAC;YACH,MAAM,WAAW,GAAG,EAAE,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC;YACnD,MAAM,QAAQ,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;QAC1C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,mBAAmB,CAAC,KAAK,EAAE,QAAQ,EAAE,gBAAgB,EAAE;gBAC1D,MAAM;gBACN,QAAQ,EAAE,IAAI,CAAC,UAAU;aAC1B,CAAC,CAAC;QACL,CAAC;QAED,MAAM,cAAc,GAA4B;YAC9C,WAAW,EAAE,QAAQ;YACrB,IAAI;YACJ,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACpC,CAAC;QACF,MAAM,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,QAAQ,GAAG,eAAe,EAAE,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,EAAE,OAAO,CAAC,CAAC;QAEjG,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,QAAQ,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC;IACjE,CAAC;IAED,KAAK,CAAC,QAAQ,CACZ,IAA6B,EAC7B,gBAAuC;QAEvC,MAAM,QAAQ,GAAG,IAAI,CAAC,yBAAyB,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC;QAExE,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QACxD,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,SAAS,EACnB,gBAAgB,EAChB;gBACE,sBAAsB,EAAE,2BAA2B,CAAC,yBAAyB;gBAC7E,OAAO,EAAE;oBACP,wBAAwB;oBACxB,MAAM,EAAE,IAAI,CAAC,MAAM;oBACnB,QAAQ,EAAE,IAAI,CAAC,UAAU;iBAC1B;aACF,CACF,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;QACvF,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC9C,MAAM,MAAM,GAAG,EAAE,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC;QAE7C,OAAO;YACL,MAAM;YACN,WAAW,EAAE,QAAQ,CAAC,WAAW;YACjC,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,YAAY,EAAE,IAAI,CAAC,KAAK;SACzB,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,MAAM,CACV,IAA6B,EAC7B,gBAAuC;QAEvC,MAAM,QAAQ,GAAG,IAAI,CAAC,yBAAyB,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC;QAExE,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACrC,CAAC;QAAC,OAAO,KAAU,EAAE,CAAC;YACpB,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ;gBAAE,OAAO;YACpC,IAAI,CAAC,mBAAmB,CAAC,KAAK,EAAE,QAAQ,EAAE,gBAAgB,EAAE;gBAC1D,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,QAAQ,EAAE,IAAI,CAAC,UAAU;aAC1B,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,GAAG,eAAe,CAAC,CAAC;QACvD,CAAC;QAAC,MAAM,CAAC;YACP,oCAAoC;QACtC,CAAC;IACH,CAAC;IAED,KAAK,CAAC,WAAW,CACf,IAA6B,EAC7B,gBAAuC;QAEvC,MAAM,QAAQ,GAAG,IAAI,CAAC,yBAAyB,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC;QAExE,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QACxD,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,SAAS,EACnB,gBAAgB,EAChB;gBACE,sBAAsB,EAAE,2BAA2B,CAAC,yBAAyB;gBAC7E,OAAO,EAAE;oBACP,wBAAwB;oBACxB,MAAM,EAAE,IAAI,CAAC,MAAM;oBACnB,QAAQ,EAAE,IAAI,CAAC,UAAU;iBAC1B;aACF,CACF,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;QACvF,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAE9C,OAAO;YACL,WAAW,EAAE,QAAQ,CAAC,WAAW;YACjC,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,YAAY,EAAE,IAAI,CAAC,KAAK;SACzB,CAAC;IACJ,CAAC;IAED;;;OAGG;IACK,yBAAyB,CAC/B,IAA6B,EAC7B,gBAAuC;QAEvC,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,CAAC;QAC5B,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,MAAM,KAAK,GAAG,IAAI,CAAC,gBAAgB,CAAC,gBAAgB,CAAC,CAAC;YACtD,OAAO,IAAI,CAAC,2BAA2B,CAAC,GAAG,KAAK,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QACrE,CAAC;QACD,OAAO,IAAI,CAAC,2BAA2B,CAAC,GAAG,CAAC,CAAC;IAC/C,CAAC;IAEO,KAAK,CAAC,iBAAiB,CAC7B,QAAgB,EAChB,MAAc,EACd,gBAAuC;QAEvC,MAAM,QAAQ,GAAG,QAAQ,GAAG,eAAe,CAAC;QAC5C,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YAC1D,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAA4B,CAAC;QACpD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO;gBACL,WAAW,EAAE,0BAA0B;gBACvC,IAAI,EAAE,CAAC;gBACP,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;aACpC,CAAC;QACJ,CAAC;IACH,CAAC;IAEO,mBAAmB,CACzB,KAAc,EACd,SAAwD,EACxD,gBAAmD,EACnD,OAAgC;QAEhC,IAAI,mBAAmB,CAAC,KAAK,CAAC,EAAE,CAAC;YAC/B,MAAM,KAAK,CAAC;QACd,CAAC;QAED,MAAM,YAAY,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAC;QAChD,MAAM,SAAS,GAAI,KAAa,EAAE,IAAI,CAAC;QAEvC,IAAI,SAAS,KAAK,QAAQ,EAAE,CAAC;YAC3B,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,SAAS,EACnB,gBAAgB,EAChB;gBACE,sBAAsB,EAAE,2BAA2B,CAAC,yBAAyB;gBAC7E,OAAO,EAAE,EAAE,SAAS,EAAE,GAAG,OAAO,EAAE,EAAE,wBAAwB;aAC7D,CACF,CAAC;QACJ,CAAC;QAED,IAAI,SAAS,KAAK,QAAQ,IAAI,SAAS,KAAK,OAAO,EAAE,CAAC;YACpD,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,aAAa,EACvB,gBAAgB,EAChB;gBACE,sBAAsB,EAAE,2BAA2B,CAAC,0BAA0B;gBAC9E,OAAO,EAAE,EAAE,SAAS,EAAE,GAAG,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,EAAE,wBAAwB;aAC1F,CACF,CAAC;QACJ,CAAC;QAED,IAAI,SAAS,KAAK,QAAQ,EAAE,CAAC;YAC3B,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,gBAAgB,EAC1B,gBAAgB,EAChB;gBACE,sBAAsB,EAAE,2BAA2B,CAAC,gBAAgB;gBACpE,OAAO,EAAE,EAAE,OAAO,EAAE,yBAAyB,EAAE,SAAS,EAAE,GAAG,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE;aACpG,CACF,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,gBAAgB,EAC1B,gBAAgB,EAChB;YACE,sBAAsB,EAAE,2BAA2B,CAAC,gBAAgB;YACpE,OAAO,EAAE,EAAE,OAAO,EAAE,mCAAmC,SAAS,EAAE,EAAE,SAAS,EAAE,GAAG,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE;SACzH,CACF,CAAC;IACJ,CAAC;CACF,CAAA;AA7XY,6BAA6B;IADzC,UAAU,EAAE;IAMR,WAAA,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAA;IAEjC,WAAA,MAAM,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,CAAA;IAE9C,WAAA,MAAM,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,CAAA;+CADb,0BAA0B;QAEtB,uBAAuB;GAVjD,6BAA6B,CA6XzC","sourcesContent":["/*\n Local Directory Storage Provider\n \n IFileStorageProvider implementation backed by the local filesystem.\n * Files are stored under a configurable base directory, organized by\n * application and file ID. Path traversal attacks are guarded against\n * by resolving all paths and verifying they stay inside the base dir.\n \n Configured through `storage.localDirectory.baseDir` in resolved application\n * configuration, which the configuration loader seeds from the\n * `STORAGE_LOCAL_BASE_DIR` environment variable. The provider itself reads\n * configuration, never the environment — see\n * `.claude/plans/application-runtime-topology-delivery.md`.\n /\n\nimport { injectable, inject } from 'inversify';\nimport { Readable } from 'stream';\nimport as fs from 'fs';\nimport * as path from 'path';\nimport { pipeline } from 'stream/promises';\nimport { ErrorType, ErrorCustomMessageReference, isWildoBackendError } from '@wildo-ai/saas-models';\nimport { FileStorageAccepted } from '@wildo-ai/zod-decorators';\nimport { SAAS_SERVICE_TYPES } from '~wildo-backend-lib/inject/models/service-types';\nimport type { LoggerService } from '~wildo-backend-lib/monitoring/logger/services/logger.service';\nimport { ErrorBuilderBackendService } from '~wildo-backend-lib/errors/services/error-builder.backend.service';\nimport { describeCaughtError } from '~wildo-backend-lib/errors/utils/error-log-level-classification.backend.utils';\nimport { AppConfigurationService } from '~wildo-backend-lib/config/services/app-configuration.backend.service';\nimport type { ExecutionContext } from '~wildo-backend-lib/runtime/models/execution-context.backend.schemas';\nimport { validateAppId, validateContentType, validateFileId, validateSize, validateStream, resolveConfiguredMaxFileSize } from '~wildo-backend-lib/files/utils/file-validation.utils';\nimport { resolveStorageApplicationIdentity } from '~wildo-backend-lib/files/utils/storage-application-identity.backend.utils';\nimport type {\n IFileStorageProvider,\n StorageUploadResult,\n StorageUploadOptions,\n StorageDownloadResult,\n StorageFileMetadata,\n StorageProviderHealthResult,\n StoredFileStorageTarget,\n} from './file-storage-provider.types';\n\nconst METADATA_SUFFIX = '.meta.json';\n\ninterface LocalFileMetadataRecord {\n contentType: string;\n size: number;\n createdAt: string;\n}\n\n@injectable()\nexport class LocalDirectoryStorageProvider implements IFileStorageProvider {\n readonly providerId = FileStorageAccepted.LOCAL_DIRECTORY;\n private baseDir: string \| null = null;\n\n constructor(\n @inject(SAAS_SERVICE_TYPES.Logger)\n private readonly logger: LoggerService,\n @inject(SAAS_SERVICE_TYPES.ErrorBuilderService)\n private readonly errorBuilder: ErrorBuilderBackendService,\n @inject(SAAS_SERVICE_TYPES.AppConfigService)\n private readonly appConfigService: AppConfigurationService,\n ) {}\n\n /*\n Reading configuration here can throw `app_configuration_not_initialized`,\n * and that is left unsoftened on purpose: answering `false` for \"configuration\n * is not loaded yet\" is indistinguishable from \"this application has no local\n * storage\", and the router would SKIP the provider in silence.\n /\n isConfigured(): boolean {\n return !!this.configuredBaseDir;\n }\n\n /* The authored filesystem root, or `undefined` when local storage is not configured. /\n private get configuredBaseDir(): string \| undefined {\n return this.appConfigService.config.storage?.localDirectory?.baseDir;\n }\n\n async initialize(): Promise<void> {\n const rawDir = this.configuredBaseDir;\n if (!rawDir) {\n throw this.errorBuilder.buildError(\n ErrorType.CONFIGURATION,\n undefined,\n {\n customMessageReference: ErrorCustomMessageReference.CONFIGURATION,\n context: {\n message: 'storage.localDirectory.baseDir (from STORAGE_LOCAL_BASE_DIR) is required for local directory storage',\n },\n }\n );\n }\n\n const resolved = path.resolve(rawDir);\n await fs.promises.mkdir(resolved, { recursive: true });\n this.baseDir = resolved;\n }\n\n async healthCheck(): Promise<StorageProviderHealthResult> {\n const startTime = Date.now();\n\n if (!this.baseDir) {\n return { healthy: false, latency: Date.now() - startTime, error: 'Local storage not initialized' };\n }\n\n try {\n await fs.promises.access(this.baseDir, fs.constants.R_OK \| fs.constants.W_OK);\n return { healthy: true, latency: Date.now() - startTime };\n } catch (error) {\n return {\n healthy: false,\n latency: Date.now() - startTime,\n error: describeCaughtError(error),\n };\n }\n }\n\n private getBaseDir(): string {\n if (!this.baseDir) {\n const raw = this.configuredBaseDir;\n if (!raw) {\n throw this.errorBuilder.buildError(\n ErrorType.CONFIGURATION,\n undefined,\n {\n customMessageReference: ErrorCustomMessageReference.CONFIGURATION,\n context: { message: 'storage.localDirectory.baseDir (from STORAGE_LOCAL_BASE_DIR) is not configured' },\n }\n );\n }\n this.baseDir = path.resolve(raw);\n }\n return this.baseDir;\n }\n\n /\n Compose the ordered path segments for an upload.\n \n Layout (all optional segments omitted when absent):\n * [applicationId] / [folderPath] / <fileName\|fileId>\n \n `includeApplicationId` defaults to `false` for local storage.\n /\n private composePathSegments(\n fileId: string,\n executionContext: ExecutionContext<any>,\n options?: StorageUploadOptions,\n ): string[] {\n const segments: string[] = [];\n\n const includeAppId = options?.includeApplicationId ?? false;\n if (includeAppId) {\n const applicationId = this.getApplicationId(executionContext);\n segments.push(applicationId);\n }\n\n if (options?.folderPath) {\n const trimmed = options.folderPath.trim();\n if (trimmed) {\n segments.push(trimmed);\n }\n }\n\n const leaf = options?.fileName?.trim() \|\| fileId;\n if (!leaf) {\n throw this.errorBuilder.buildError(\n ErrorType.VALIDATION,\n executionContext,\n {\n customMessageReference: ErrorCustomMessageReference.FILE_STORAGE_KEY_COMPOSITION_FAILED,\n }\n );\n }\n segments.push(leaf);\n\n return segments;\n }\n\n /\n Resolve a safe absolute path from a relative storage ref.\n * Throws if the resolved path escapes the base directory (path traversal guard).\n /\n private resolveSafePathFromRelative(relativePath: string): string {\n const base = this.getBaseDir();\n const filePath = path.resolve(base, relativePath);\n if (!filePath.startsWith(base + path.sep) && filePath !== base) {\n throw this.errorBuilder.buildError(\n ErrorType.AUTHORIZATION,\n undefined,\n {\n customMessageReference: ErrorCustomMessageReference.FILE_PATH_TRAVERSAL_DETECTED,\n context: {\n relativePath, // diagnostic (log-only)\n },\n }\n );\n }\n return filePath;\n }\n\n private getApplicationId(executionContext: ExecutionContext<any>): string {\n const applicationId = resolveStorageApplicationIdentity(this.appConfigService);\n validateAppId(applicationId, this.errorBuilder, executionContext, 'applicationId');\n return applicationId;\n }\n\n async upload(\n fileStream: Readable,\n fileId: string,\n mimeType: string,\n size: number,\n executionContext: ExecutionContext<any>,\n options?: StorageUploadOptions,\n ): Promise<StorageUploadResult> {\n validateFileId(fileId, this.errorBuilder, executionContext, 'fileId');\n validateContentType(mimeType, this.errorBuilder, executionContext, 'mimeType');\n validateSize(\n size,\n resolveConfiguredMaxFileSize(this.appConfigService.config.storage?.maxFileSize),\n this.errorBuilder,\n executionContext,\n 'size',\n );\n validateStream(fileStream, this.errorBuilder, executionContext, 'fileStream');\n\n const segments = this.composePathSegments(fileId, executionContext, options);\n const relativePath = segments.join('/');\n const filePath = this.resolveSafePathFromRelative(relativePath);\n\n await fs.promises.mkdir(path.dirname(filePath), { recursive: true });\n\n try {\n const writeStream = fs.createWriteStream(filePath);\n await pipeline(fileStream, writeStream);\n } catch (error) {\n this.convertStorageError(error, 'upload', executionContext, {\n fileId,\n provider: this.providerId,\n });\n }\n\n const metadataRecord: LocalFileMetadataRecord = {\n contentType: mimeType,\n size,\n createdAt: new Date().toISOString(),\n };\n await fs.promises.writeFile(filePath + METADATA_SUFFIX, JSON.stringify(metadataRecord), 'utf-8');\n\n return { storageRef: relativePath, provider: this.providerId };\n }\n\n async download(\n file: StoredFileStorageTarget,\n executionContext: ExecutionContext<any>,\n ): Promise<StorageDownloadResult> {\n const filePath = this.resolvePathFromStorageRef(file, executionContext);\n\n try {\n await fs.promises.access(filePath, fs.constants.R_OK);\n } catch {\n throw this.errorBuilder.buildError(\n ErrorType.NOT_FOUND,\n executionContext,\n {\n customMessageReference: ErrorCustomMessageReference.FILE_NOT_FOUND_IN_STORAGE,\n context: {\n // diagnostic (log-only)\n fileId: file.fileId,\n provider: this.providerId,\n },\n }\n );\n }\n\n const metadata = await this.readLocalMetadata(filePath, file.fileId, executionContext);\n const stat = await fs.promises.stat(filePath);\n const stream = fs.createReadStream(filePath);\n\n return {\n stream,\n contentType: metadata.contentType,\n size: stat.size,\n lastModified: stat.mtime,\n };\n }\n\n async delete(\n file: StoredFileStorageTarget,\n executionContext: ExecutionContext<any>,\n ): Promise<void> {\n const filePath = this.resolvePathFromStorageRef(file, executionContext);\n\n try {\n await fs.promises.unlink(filePath);\n } catch (error: any) {\n if (error.code === 'ENOENT') return;\n this.convertStorageError(error, 'delete', executionContext, {\n fileId: file.fileId,\n provider: this.providerId,\n });\n }\n\n try {\n await fs.promises.unlink(filePath + METADATA_SUFFIX);\n } catch {\n // metadata file already gone — fine\n }\n }\n\n async getMetadata(\n file: StoredFileStorageTarget,\n executionContext: ExecutionContext<any>,\n ): Promise<StorageFileMetadata> {\n const filePath = this.resolvePathFromStorageRef(file, executionContext);\n\n try {\n await fs.promises.access(filePath, fs.constants.R_OK);\n } catch {\n throw this.errorBuilder.buildError(\n ErrorType.NOT_FOUND,\n executionContext,\n {\n customMessageReference: ErrorCustomMessageReference.FILE_NOT_FOUND_IN_STORAGE,\n context: {\n // diagnostic (log-only)\n fileId: file.fileId,\n provider: this.providerId,\n },\n }\n );\n }\n\n const metadata = await this.readLocalMetadata(filePath, file.fileId, executionContext);\n const stat = await fs.promises.stat(filePath);\n\n return {\n contentType: metadata.contentType,\n size: stat.size,\n lastModified: stat.mtime,\n };\n }\n\n /\n Resolve the absolute filesystem path from a persisted storageRef.\n * The ref IS the relative path from baseDir — just validate traversal.\n */\n private resolvePathFromStorageRef(\n file: StoredFileStorageTarget,\n executionContext: ExecutionContext<any>,\n ): string {\n const ref = file.storageRef;\n if (!ref) {\n const appId = this.getApplicationId(executionContext);\n return this.resolveSafePathFromRelative(`${appId}/${file.fileId}`);\n }\n return this.resolveSafePathFromRelative(ref);\n }\n\n private async readLocalMetadata(\n filePath: string,\n fileId: string,\n executionContext: ExecutionContext<any>,\n ): Promise<LocalFileMetadataRecord> {\n const metaPath = filePath + METADATA_SUFFIX;\n try {\n const raw = await fs.promises.readFile(metaPath, 'utf-8');\n return JSON.parse(raw) as LocalFileMetadataRecord;\n } catch {\n return {\n contentType: 'application/octet-stream',\n size: 0,\n createdAt: new Date().toISOString(),\n };\n }\n }\n\n private convertStorageError(\n error: unknown,\n operation: 'upload' \| 'download' \| 'delete' \| 'metadata',\n executionContext: ExecutionContext<any> \| undefined,\n context: Record<string, unknown>,\n ): never {\n if (isWildoBackendError(error)) {\n throw error;\n }\n\n const errorMessage = describeCaughtError(error);\n const errorCode = (error as any)?.code;\n\n if (errorCode === 'ENOENT') {\n throw this.errorBuilder.buildError(\n ErrorType.NOT_FOUND,\n executionContext,\n {\n customMessageReference: ErrorCustomMessageReference.FILE_NOT_FOUND_IN_STORAGE,\n context: { operation, ...context }, // diagnostic (log-only)\n }\n );\n }\n\n if (errorCode === 'EACCES' \|\| errorCode === 'EPERM') {\n throw this.errorBuilder.buildError(\n ErrorType.AUTHORIZATION,\n executionContext,\n {\n customMessageReference: ErrorCustomMessageReference.FILE_STORAGE_ACCESS_DENIED,\n context: { operation, ...context, originalError: errorMessage }, // diagnostic (log-only)\n }\n );\n }\n\n if (errorCode === 'ENOSPC') {\n throw this.errorBuilder.buildError(\n ErrorType.EXTERNAL_SERVICE,\n executionContext,\n {\n customMessageReference: ErrorCustomMessageReference.EXTERNAL_SERVICE,\n context: { message: 'Local storage disk full', operation, ...context, originalError: errorMessage },\n }\n );\n }\n\n throw this.errorBuilder.buildError(\n ErrorType.EXTERNAL_SERVICE,\n executionContext,\n {\n customMessageReference: ErrorCustomMessageReference.EXTERNAL_SERVICE,\n context: { message: `Local storage operation failed: ${operation}`, operation, ...context, originalError: errorMessage },\n }\n );\n }\n}\n"]}
1	+ {"version":3,"file":"local-directory-storage-provider.backend.service.js","sourceRoot":"","sources":["../../../../src/files/storage/local-directory-storage-provider.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;;;;;;;;;;;;;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAE/C,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAC3C,OAAO,EAAE,SAAS,EAAE,2BAA2B,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AACpG,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAC/D,OAAO,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AAEpF,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAC9G,OAAO,EAAE,mBAAmB,EAAE,MAAM,8EAA8E,CAAC;AACnH,OAAO,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AAE/G,OAAO,EAAE,aAAa,EAAE,mBAAmB,EAAE,cAAc,EAAE,YAAY,EAAE,cAAc,EAAE,4BAA4B,EAAE,MAAM,sDAAsD,CAAC;AACtL,OAAO,EAAE,iCAAiC,EAAE,MAAM,2EAA2E,CAAC;AAC9H,OAAO,EACL,4BAA4B,EAC5B,sBAAsB,EACtB,6BAA6B,GAC9B,MAAM,yCAAyC,CAAC;AAWjD,MAAM,eAAe,GAAG,YAAY,CAAC;AAS9B,IAAM,6BAA6B,GAAnC,MAAM,6BAA6B;IAMrB;IAEA;IAEA;IATV,UAAU,GAAG,mBAAmB,CAAC,eAAe,CAAC;IAClD,OAAO,GAAkB,IAAI,CAAC;IAEtC,YAEmB,MAAqB,EAErB,YAAwC,EAExC,gBAAyC;QAJzC,WAAM,GAAN,MAAM,CAAe;QAErB,iBAAY,GAAZ,YAAY,CAA4B;QAExC,qBAAgB,GAAhB,gBAAgB,CAAyB;IACzD,CAAC;IAEJ;;;;;OAKG;IACH,YAAY;QACV,OAAO,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC;IAClC,CAAC;IAED,yFAAyF;IACzF,IAAY,iBAAiB;QAC3B,OAAO,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,OAAO,EAAE,cAAc,EAAE,OAAO,CAAC;IACvE,CAAC;IAED,KAAK,CAAC,UAAU;QACd,MAAM,MAAM,GAAG,IAAI,CAAC,iBAAiB,CAAC;QACtC,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,aAAa,EACvB,SAAS,EACT;gBACE,sBAAsB,EAAE,2BAA2B,CAAC,aAAa;gBACjE,OAAO,EAAE;oBACP,OAAO,EAAE,sGAAsG;iBAChH;aACF,CACF,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACtC,MAAM,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACvD,IAAI,CAAC,OAAO,GAAG,QAAQ,CAAC;IAC1B,CAAC;IAED,KAAK,CAAC,WAAW;QACf,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAE7B,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAClB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,EAAE,KAAK,EAAE,+BAA+B,EAAE,CAAC;QACrG,CAAC;QAED,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,GAAG,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YAC9E,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,EAAE,CAAC;QAC5D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;gBAC/B,KAAK,EAAE,mBAAmB,CAAC,KAAK,CAAC;aAClC,CAAC;QACJ,CAAC;IACH,CAAC;IAEO,UAAU;QAChB,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAClB,MAAM,GAAG,GAAG,IAAI,CAAC,iBAAiB,CAAC;YACnC,IAAI,CAAC,GAAG,EAAE,CAAC;gBACT,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,aAAa,EACvB,SAAS,EACT;oBACE,sBAAsB,EAAE,2BAA2B,CAAC,aAAa;oBACjE,OAAO,EAAE,EAAE,OAAO,EAAE,gFAAgF,EAAE;iBACvG,CACF,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACnC,CAAC;QACD,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IAED;;;;;;;;;;;OAWG;IACK,iBAAiB,CACvB,MAAc,EACd,gBAAuC,EACvC,OAA8B;QAE9B,MAAM,QAAQ,GAAG,sBAAsB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACzD,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,UAAU,EACpB,gBAAgB,EAChB;gBACE,sBAAsB,EAAE,2BAA2B,CAAC,mCAAmC;aACxF,CACF,CAAC;QACJ,CAAC;QAED,4FAA4F;QAC5F,gGAAgG;QAChG,4FAA4F;QAC5F,+FAA+F;QAC/F,+FAA+F;QAC/F,gGAAgG;QAChG,2FAA2F;QAC3F,2BAA2B;QAC3B,EAAE;QACF,iGAAiG;QACjG,gGAAgG;QAChG,sGAAsG;QACtG,IAAI,6BAA6B,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC5C,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,aAAa,EACvB,SAAS,EACT;gBACE,sBAAsB,EAAE,2BAA2B,CAAC,4BAA4B;gBAChF,OAAO,EAAE;oBACP,YAAY,EAAE,QAAQ,EAAE,wBAAwB;iBACjD;aACF,CACF,CAAC;QACJ,CAAC;QAED,IAAI,OAAO,EAAE,oBAAoB,KAAK,KAAK,EAAE,CAAC;YAC5C,OAAO,QAAQ,CAAC;QAClB,CAAC;QAED,OAAO,4BAA4B,CAAC;YAClC,aAAa,EAAE,IAAI,CAAC,gBAAgB,CAAC,gBAAgB,CAAC;YACtD,QAAQ;YACR,kBAAkB,EAAE,OAAO,EAAE,kBAAkB;YAC/C,KAAK,EAAE,OAAO,EAAE,KAAK;SACtB,CAAC,CAAC;IACL,CAAC;IAED;;;OAGG;IACK,2BAA2B,CAAC,YAAoB;QACtD,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC;QAC/B,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;QAClD,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YAC/D,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,aAAa,EACvB,SAAS,EACT;gBACE,sBAAsB,EAAE,2BAA2B,CAAC,4BAA4B;gBAChF,OAAO,EAAE;oBACP,YAAY,EAAE,wBAAwB;iBACvC;aACF,CACF,CAAC;QACJ,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAEO,gBAAgB,CAAC,gBAAuC;QAC9D,MAAM,aAAa,GAAG,iCAAiC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;QAC/E,aAAa,CAAC,aAAa,EAAE,IAAI,CAAC,YAAY,EAAE,gBAAgB,EAAE,eAAe,CAAC,CAAC;QACnF,OAAO,aAAa,CAAC;IACvB,CAAC;IAED,KAAK,CAAC,MAAM,CACV,UAAoB,EACpB,MAAc,EACd,QAAgB,EAChB,IAAY,EACZ,gBAAuC,EACvC,OAA8B;QAE9B,cAAc,CAAC,MAAM,EAAE,IAAI,CAAC,YAAY,EAAE,gBAAgB,EAAE,QAAQ,CAAC,CAAC;QACtE,mBAAmB,CAAC,QAAQ,EAAE,IAAI,CAAC,YAAY,EAAE,gBAAgB,EAAE,UAAU,CAAC,CAAC;QAC/E,YAAY,CACV,IAAI,EACJ,4BAA4B,CAAC,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,OAAO,EAAE,WAAW,CAAC,EAC/E,IAAI,CAAC,YAAY,EACjB,gBAAgB,EAChB,MAAM,CACP,CAAC;QACF,cAAc,CAAC,UAAU,EAAE,IAAI,CAAC,YAAY,EAAE,gBAAgB,EAAE,YAAY,CAAC,CAAC;QAE9E,MAAM,YAAY,GAAG,IAAI,CAAC,iBAAiB,CAAC,MAAM,EAAE,gBAAgB,EAAE,OAAO,CAAC,CAAC;QAC/E,MAAM,QAAQ,GAAG,IAAI,CAAC,2BAA2B,CAAC,YAAY,CAAC,CAAC;QAEhE,MAAM,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAErE,IAAI,CAAC;YACH,MAAM,WAAW,GAAG,EAAE,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC;YACnD,MAAM,QAAQ,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;QAC1C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,mBAAmB,CAAC,KAAK,EAAE,QAAQ,EAAE,gBAAgB,EAAE;gBAC1D,MAAM;gBACN,QAAQ,EAAE,IAAI,CAAC,UAAU;aAC1B,CAAC,CAAC;QACL,CAAC;QAED,MAAM,cAAc,GAA4B;YAC9C,WAAW,EAAE,QAAQ;YACrB,IAAI;YACJ,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACpC,CAAC;QACF,MAAM,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,QAAQ,GAAG,eAAe,EAAE,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,EAAE,OAAO,CAAC,CAAC;QAEjG,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,QAAQ,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC;IACjE,CAAC;IAED,KAAK,CAAC,QAAQ,CACZ,IAA6B,EAC7B,gBAAuC;QAEvC,MAAM,QAAQ,GAAG,IAAI,CAAC,yBAAyB,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC;QAExE,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QACxD,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,SAAS,EACnB,gBAAgB,EAChB;gBACE,sBAAsB,EAAE,2BAA2B,CAAC,yBAAyB;gBAC7E,OAAO,EAAE;oBACP,wBAAwB;oBACxB,MAAM,EAAE,IAAI,CAAC,MAAM;oBACnB,QAAQ,EAAE,IAAI,CAAC,UAAU;iBAC1B;aACF,CACF,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;QACvF,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC9C,MAAM,MAAM,GAAG,EAAE,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC;QAE7C,OAAO;YACL,MAAM;YACN,WAAW,EAAE,QAAQ,CAAC,WAAW;YACjC,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,YAAY,EAAE,IAAI,CAAC,KAAK;SACzB,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,MAAM,CACV,IAA6B,EAC7B,gBAAuC;QAEvC,MAAM,QAAQ,GAAG,IAAI,CAAC,yBAAyB,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC;QAExE,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACrC,CAAC;QAAC,OAAO,KAAU,EAAE,CAAC;YACpB,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ;gBAAE,OAAO;YACpC,IAAI,CAAC,mBAAmB,CAAC,KAAK,EAAE,QAAQ,EAAE,gBAAgB,EAAE;gBAC1D,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,QAAQ,EAAE,IAAI,CAAC,UAAU;aAC1B,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,GAAG,eAAe,CAAC,CAAC;QACvD,CAAC;QAAC,MAAM,CAAC;YACP,oCAAoC;QACtC,CAAC;IACH,CAAC;IAED,KAAK,CAAC,WAAW,CACf,IAA6B,EAC7B,gBAAuC;QAEvC,MAAM,QAAQ,GAAG,IAAI,CAAC,yBAAyB,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC;QAExE,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QACxD,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,SAAS,EACnB,gBAAgB,EAChB;gBACE,sBAAsB,EAAE,2BAA2B,CAAC,yBAAyB;gBAC7E,OAAO,EAAE;oBACP,wBAAwB;oBACxB,MAAM,EAAE,IAAI,CAAC,MAAM;oBACnB,QAAQ,EAAE,IAAI,CAAC,UAAU;iBAC1B;aACF,CACF,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;QACvF,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAE9C,OAAO;YACL,WAAW,EAAE,QAAQ,CAAC,WAAW;YACjC,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,YAAY,EAAE,IAAI,CAAC,KAAK;SACzB,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4CG;IACK,yBAAyB,CAC/B,IAA6B,EAC7B,gBAAuC;QAEvC,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,CAAC;QAC5B,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,OAAO,IAAI,CAAC,2BAA2B,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC,CAAC;QACjG,CAAC;QACD,OAAO,IAAI,CAAC,2BAA2B,CAAC,GAAG,CAAC,CAAC;IAC/C,CAAC;IAEO,KAAK,CAAC,iBAAiB,CAC7B,QAAgB,EAChB,MAAc,EACd,gBAAuC;QAEvC,MAAM,QAAQ,GAAG,QAAQ,GAAG,eAAe,CAAC;QAC5C,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YAC1D,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAA4B,CAAC;QACpD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO;gBACL,WAAW,EAAE,0BAA0B;gBACvC,IAAI,EAAE,CAAC;gBACP,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;aACpC,CAAC;QACJ,CAAC;IACH,CAAC;IAEO,mBAAmB,CACzB,KAAc,EACd,SAAwD,EACxD,gBAAmD,EACnD,OAAgC;QAEhC,IAAI,mBAAmB,CAAC,KAAK,CAAC,EAAE,CAAC;YAC/B,MAAM,KAAK,CAAC;QACd,CAAC;QAED,MAAM,YAAY,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAC;QAChD,MAAM,SAAS,GAAI,KAAa,EAAE,IAAI,CAAC;QAEvC,IAAI,SAAS,KAAK,QAAQ,EAAE,CAAC;YAC3B,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,SAAS,EACnB,gBAAgB,EAChB;gBACE,sBAAsB,EAAE,2BAA2B,CAAC,yBAAyB;gBAC7E,OAAO,EAAE,EAAE,SAAS,EAAE,GAAG,OAAO,EAAE,EAAE,wBAAwB;aAC7D,CACF,CAAC;QACJ,CAAC;QAED,IAAI,SAAS,KAAK,QAAQ,IAAI,SAAS,KAAK,OAAO,EAAE,CAAC;YACpD,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,aAAa,EACvB,gBAAgB,EAChB;gBACE,sBAAsB,EAAE,2BAA2B,CAAC,0BAA0B;gBAC9E,OAAO,EAAE,EAAE,SAAS,EAAE,GAAG,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,EAAE,wBAAwB;aAC1F,CACF,CAAC;QACJ,CAAC;QAED,IAAI,SAAS,KAAK,QAAQ,EAAE,CAAC;YAC3B,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,gBAAgB,EAC1B,gBAAgB,EAChB;gBACE,sBAAsB,EAAE,2BAA2B,CAAC,gBAAgB;gBACpE,OAAO,EAAE,EAAE,OAAO,EAAE,yBAAyB,EAAE,SAAS,EAAE,GAAG,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE;aACpG,CACF,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,gBAAgB,EAC1B,gBAAgB,EAChB;YACE,sBAAsB,EAAE,2BAA2B,CAAC,gBAAgB;YACpE,OAAO,EAAE,EAAE,OAAO,EAAE,mCAAmC,SAAS,EAAE,EAAE,SAAS,EAAE,GAAG,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE;SACzH,CACF,CAAC;IACJ,CAAC;CACF,CAAA;AA1bY,6BAA6B;IADzC,UAAU,EAAE;IAMR,WAAA,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAA;IAEjC,WAAA,MAAM,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,CAAA;IAE9C,WAAA,MAAM,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,CAAA;+CADb,0BAA0B;QAEtB,uBAAuB;GAVjD,6BAA6B,CA0bzC","sourcesContent":["/*\n Local Directory Storage Provider\n \n IFileStorageProvider implementation backed by the local filesystem.\n * Files are stored under a configurable base directory, at the SAME relative key the\n * Wildo-managed provider would use — `applications/<appId>/files/<storageName>/<scope>/<scopeId>/…`,\n * composed by `application-storage-key.backend.utils`. Path traversal attacks are guarded against\n * by refusing a `.`/`..` segment in the composed key AND by resolving every path and verifying it\n * stays inside the base dir.\n \n ## Why the key shape is shared rather than provider-local\n \n Until 2026-09-09 this provider composed `[applicationId]/[folderPath]/<leaf>` from the field's\n * declarative binding alone, and included the application id only when the binding asked\n * (`includeApplicationId`, defaulting to `false` here). It therefore emitted NONE of the\n * `<scope>/<scopeId>` segments the managed provider's shape carries, so a deployment routing a\n * `z_file()` field to local storage had no per-tenant prefix to sweep, list or confine against —\n * and nothing failed, because an absent prefix produces no error, only an absent capability.\n \n Both providers now call one composer. See `application-storage-key.backend.utils.ts` for the\n * argument and for what deliberately stays provider-local.\n \n Configured through `storage.localDirectory.baseDir` in resolved application\n * configuration, which the configuration loader seeds from the\n * `STORAGE_LOCAL_BASE_DIR` environment variable. The provider itself reads\n * configuration, never the environment — see\n * `.claude/plans/application-runtime-topology-delivery.md`.\n /\n\nimport { injectable, inject } from 'inversify';\nimport { Readable } from 'stream';\nimport as fs from 'fs';\nimport * as path from 'path';\nimport { pipeline } from 'stream/promises';\nimport { ErrorType, ErrorCustomMessageReference, isWildoBackendError } from '@wildo-ai/saas-models';\nimport { FileStorageAccepted } from '@wildo-ai/zod-decorators';\nimport { SAAS_SERVICE_TYPES } from '~wildo-backend-lib/inject/models/service-types';\nimport type { LoggerService } from '~wildo-backend-lib/monitoring/logger/services/logger.service';\nimport { ErrorBuilderBackendService } from '~wildo-backend-lib/errors/services/error-builder.backend.service';\nimport { describeCaughtError } from '~wildo-backend-lib/errors/utils/error-log-level-classification.backend.utils';\nimport { AppConfigurationService } from '~wildo-backend-lib/config/services/app-configuration.backend.service';\nimport type { ExecutionContext } from '~wildo-backend-lib/runtime/models/execution-context.backend.schemas';\nimport { validateAppId, validateContentType, validateFileId, validateSize, validateStream, resolveConfiguredMaxFileSize } from '~wildo-backend-lib/files/utils/file-validation.utils';\nimport { resolveStorageApplicationIdentity } from '~wildo-backend-lib/files/utils/storage-application-identity.backend.utils';\nimport {\n composeApplicationStorageKey,\n composeStorageLeafPath,\n storageKeyHasTraversalSegment,\n} from './application-storage-key.backend.utils';\nimport type {\n IFileStorageProvider,\n StorageUploadResult,\n StorageUploadOptions,\n StorageDownloadResult,\n StorageFileMetadata,\n StorageProviderHealthResult,\n StoredFileStorageTarget,\n} from './file-storage-provider.types';\n\nconst METADATA_SUFFIX = '.meta.json';\n\ninterface LocalFileMetadataRecord {\n contentType: string;\n size: number;\n createdAt: string;\n}\n\n@injectable()\nexport class LocalDirectoryStorageProvider implements IFileStorageProvider {\n readonly providerId = FileStorageAccepted.LOCAL_DIRECTORY;\n private baseDir: string \| null = null;\n\n constructor(\n @inject(SAAS_SERVICE_TYPES.Logger)\n private readonly logger: LoggerService,\n @inject(SAAS_SERVICE_TYPES.ErrorBuilderService)\n private readonly errorBuilder: ErrorBuilderBackendService,\n @inject(SAAS_SERVICE_TYPES.AppConfigService)\n private readonly appConfigService: AppConfigurationService,\n ) {}\n\n /*\n Reading configuration here can throw `app_configuration_not_initialized`,\n * and that is left unsoftened on purpose: answering `false` for \"configuration\n * is not loaded yet\" is indistinguishable from \"this application has no local\n * storage\", and the router would SKIP the provider in silence.\n /\n isConfigured(): boolean {\n return !!this.configuredBaseDir;\n }\n\n /* The authored filesystem root, or `undefined` when local storage is not configured. /\n private get configuredBaseDir(): string \| undefined {\n return this.appConfigService.config.storage?.localDirectory?.baseDir;\n }\n\n async initialize(): Promise<void> {\n const rawDir = this.configuredBaseDir;\n if (!rawDir) {\n throw this.errorBuilder.buildError(\n ErrorType.CONFIGURATION,\n undefined,\n {\n customMessageReference: ErrorCustomMessageReference.CONFIGURATION,\n context: {\n message: 'storage.localDirectory.baseDir (from STORAGE_LOCAL_BASE_DIR) is required for local directory storage',\n },\n }\n );\n }\n\n const resolved = path.resolve(rawDir);\n await fs.promises.mkdir(resolved, { recursive: true });\n this.baseDir = resolved;\n }\n\n async healthCheck(): Promise<StorageProviderHealthResult> {\n const startTime = Date.now();\n\n if (!this.baseDir) {\n return { healthy: false, latency: Date.now() - startTime, error: 'Local storage not initialized' };\n }\n\n try {\n await fs.promises.access(this.baseDir, fs.constants.R_OK \| fs.constants.W_OK);\n return { healthy: true, latency: Date.now() - startTime };\n } catch (error) {\n return {\n healthy: false,\n latency: Date.now() - startTime,\n error: describeCaughtError(error),\n };\n }\n }\n\n private getBaseDir(): string {\n if (!this.baseDir) {\n const raw = this.configuredBaseDir;\n if (!raw) {\n throw this.errorBuilder.buildError(\n ErrorType.CONFIGURATION,\n undefined,\n {\n customMessageReference: ErrorCustomMessageReference.CONFIGURATION,\n context: { message: 'storage.localDirectory.baseDir (from STORAGE_LOCAL_BASE_DIR) is not configured' },\n }\n );\n }\n this.baseDir = path.resolve(raw);\n }\n return this.baseDir;\n }\n\n /\n Compose the relative storage key for an upload.\n \n Layout — identical to the managed provider's, minus that provider's bucket prefix:\n * `applications/<applicationId>/files/<storageName>/<scope>/<scopeId>/[folderPath/]<fileName\|fileId>`\n \n `includeApplicationId` defaults to `true` here, as it does on the managed provider. It used to\n * default to `false` (\"the volume is typically per-app\"), which is exactly what left this provider\n * with no tenant structure: a per-app VOLUME separates applications from each other and separates\n * nothing inside one. Set explicitly to `false` the key collapses to the bare leaf path on BOTH\n * providers — one authored value, one meaning, and the same loss of every prefix operation.\n /\n private composeStorageKey(\n fileId: string,\n executionContext: ExecutionContext<any>,\n options?: StorageUploadOptions,\n ): string {\n const leafPath = composeStorageLeafPath(fileId, options);\n if (!leafPath) {\n throw this.errorBuilder.buildError(\n ErrorType.VALIDATION,\n executionContext,\n {\n customMessageReference: ErrorCustomMessageReference.FILE_STORAGE_KEY_COMPOSITION_FAILED,\n }\n );\n }\n\n // Refused on the LEAF, textually, before any prefix is prepended — and this is load-bearing\n // rather than belt-and-braces. `resolveSafePathFromRelative` below asks \"does the resolved path\n // escape the base directory\", which was the whole guard while a key was one or two segments\n // deep. Under the six-segment tenant prefix a `folderPath: '../../outside'` no longer escapes:\n // it resolves to `applications/<app>/files/_unlinked/outside/…`, still inside the base, so the\n // containment check ADMITS what it used to refuse. What the `..` now buys an attacker is not an\n // escape from the store but an escape from the TENANT prefix — the exact property this key\n // shape exists to provide.\n //\n // The managed provider refuses the same input for the mirror-image reason (its stored-ref prefix\n // check is textual), so one authored value cannot mean two things depending on which provider a\n // deployment binds. `assertNoTraversalSegments` there and this share `storageKeyHasTraversalSegment`.\n if (storageKeyHasTraversalSegment(leafPath)) {\n throw this.errorBuilder.buildError(\n ErrorType.AUTHORIZATION,\n undefined,\n {\n customMessageReference: ErrorCustomMessageReference.FILE_PATH_TRAVERSAL_DETECTED,\n context: {\n relativePath: leafPath, // diagnostic (log-only)\n },\n }\n );\n }\n\n if (options?.includeApplicationId === false) {\n return leafPath;\n }\n\n return composeApplicationStorageKey({\n applicationId: this.getApplicationId(executionContext),\n leafPath,\n linkedResourceType: options?.linkedResourceType,\n scope: options?.scope,\n });\n }\n\n /\n Resolve a safe absolute path from a relative storage ref.\n * Throws if the resolved path escapes the base directory (path traversal guard).\n /\n private resolveSafePathFromRelative(relativePath: string): string {\n const base = this.getBaseDir();\n const filePath = path.resolve(base, relativePath);\n if (!filePath.startsWith(base + path.sep) && filePath !== base) {\n throw this.errorBuilder.buildError(\n ErrorType.AUTHORIZATION,\n undefined,\n {\n customMessageReference: ErrorCustomMessageReference.FILE_PATH_TRAVERSAL_DETECTED,\n context: {\n relativePath, // diagnostic (log-only)\n },\n }\n );\n }\n return filePath;\n }\n\n private getApplicationId(executionContext: ExecutionContext<any>): string {\n const applicationId = resolveStorageApplicationIdentity(this.appConfigService);\n validateAppId(applicationId, this.errorBuilder, executionContext, 'applicationId');\n return applicationId;\n }\n\n async upload(\n fileStream: Readable,\n fileId: string,\n mimeType: string,\n size: number,\n executionContext: ExecutionContext<any>,\n options?: StorageUploadOptions,\n ): Promise<StorageUploadResult> {\n validateFileId(fileId, this.errorBuilder, executionContext, 'fileId');\n validateContentType(mimeType, this.errorBuilder, executionContext, 'mimeType');\n validateSize(\n size,\n resolveConfiguredMaxFileSize(this.appConfigService.config.storage?.maxFileSize),\n this.errorBuilder,\n executionContext,\n 'size',\n );\n validateStream(fileStream, this.errorBuilder, executionContext, 'fileStream');\n\n const relativePath = this.composeStorageKey(fileId, executionContext, options);\n const filePath = this.resolveSafePathFromRelative(relativePath);\n\n await fs.promises.mkdir(path.dirname(filePath), { recursive: true });\n\n try {\n const writeStream = fs.createWriteStream(filePath);\n await pipeline(fileStream, writeStream);\n } catch (error) {\n this.convertStorageError(error, 'upload', executionContext, {\n fileId,\n provider: this.providerId,\n });\n }\n\n const metadataRecord: LocalFileMetadataRecord = {\n contentType: mimeType,\n size,\n createdAt: new Date().toISOString(),\n };\n await fs.promises.writeFile(filePath + METADATA_SUFFIX, JSON.stringify(metadataRecord), 'utf-8');\n\n return { storageRef: relativePath, provider: this.providerId };\n }\n\n async download(\n file: StoredFileStorageTarget,\n executionContext: ExecutionContext<any>,\n ): Promise<StorageDownloadResult> {\n const filePath = this.resolvePathFromStorageRef(file, executionContext);\n\n try {\n await fs.promises.access(filePath, fs.constants.R_OK);\n } catch {\n throw this.errorBuilder.buildError(\n ErrorType.NOT_FOUND,\n executionContext,\n {\n customMessageReference: ErrorCustomMessageReference.FILE_NOT_FOUND_IN_STORAGE,\n context: {\n // diagnostic (log-only)\n fileId: file.fileId,\n provider: this.providerId,\n },\n }\n );\n }\n\n const metadata = await this.readLocalMetadata(filePath, file.fileId, executionContext);\n const stat = await fs.promises.stat(filePath);\n const stream = fs.createReadStream(filePath);\n\n return {\n stream,\n contentType: metadata.contentType,\n size: stat.size,\n lastModified: stat.mtime,\n };\n }\n\n async delete(\n file: StoredFileStorageTarget,\n executionContext: ExecutionContext<any>,\n ): Promise<void> {\n const filePath = this.resolvePathFromStorageRef(file, executionContext);\n\n try {\n await fs.promises.unlink(filePath);\n } catch (error: any) {\n if (error.code === 'ENOENT') return;\n this.convertStorageError(error, 'delete', executionContext, {\n fileId: file.fileId,\n provider: this.providerId,\n });\n }\n\n try {\n await fs.promises.unlink(filePath + METADATA_SUFFIX);\n } catch {\n // metadata file already gone — fine\n }\n }\n\n async getMetadata(\n file: StoredFileStorageTarget,\n executionContext: ExecutionContext<any>,\n ): Promise<StorageFileMetadata> {\n const filePath = this.resolvePathFromStorageRef(file, executionContext);\n\n try {\n await fs.promises.access(filePath, fs.constants.R_OK);\n } catch {\n throw this.errorBuilder.buildError(\n ErrorType.NOT_FOUND,\n executionContext,\n {\n customMessageReference: ErrorCustomMessageReference.FILE_NOT_FOUND_IN_STORAGE,\n context: {\n // diagnostic (log-only)\n fileId: file.fileId,\n provider: this.providerId,\n },\n }\n );\n }\n\n const metadata = await this.readLocalMetadata(filePath, file.fileId, executionContext);\n const stat = await fs.promises.stat(filePath);\n\n return {\n contentType: metadata.contentType,\n size: stat.size,\n lastModified: stat.mtime,\n };\n }\n\n /\n Resolve the absolute filesystem path from a persisted storageRef.\n * The ref IS the relative path from baseDir — just validate traversal.\n \n ## Already-stored files are NOT moved by the key-shape change, and nothing has to be migrated\n \n Every read verb (`download` / `delete` / `getMetadata`) reaches a blob through this method, and\n * with a ref present it uses that ref VERBATIM. A blob written under the old\n * `[applicationId]/[folderPath]/<leaf>` layout therefore stays addressable at exactly the path it\n * was written to: the shape change governs where NEW uploads land, never how an existing row is\n * resolved. No migration, and no compatibility branch, because there is nothing to be compatible\n * with — the persisted ref is the address.\n \n ## The no-ref branch is LIVE, and it must track `upload` rather than freeze\n \n It looks like a legacy fallback for rows whose `storageRef` never committed. Its real caller is\n * the audit-log archive batch: `archiveArtifactExists` probes `getMetadata` with\n * `fileId: '<folderPath>/<fileName>'` and NO ref, deliberately, so that each provider re-derives\n * the key its own `upload` produced and the batch never re-implements provider path logic. Pin\n * the old composition here and that probe would address a blob the upload no longer writes, so\n * `archiveArtifactExists` would answer `false` forever and every past day would be re-archived on\n * every tick — a silent, unbounded regression with no failing test anywhere.\n \n So it composes through the SAME composer, with no resource type and no scope, mirroring the\n * managed provider's `resolveApplicationObjectKey(file.fileId, ctx, undefined)` argument for\n * argument. The parity is pinned in this provider's test suite (`upload` then `getMetadata` with\n * no ref); the batch's own suite uses a fake provider and cannot see it.\n \n ## Residual, recorded rather than fixed: a `.`/`..` segment inside a PRESENT ref\n \n `composeStorageKey` refuses one on the composition path; this branch does not, and the managed\n * provider's `assertNoTraversalSegments(normalizedStorageRef, …)` does. Two reasons it is left\n * asymmetric, and neither is \"nobody thought about it\":\n \n - the containment check below is a real `path.resolve`, not managed's textual `startsWith`, so\n * the class of attack that motivated managed's stored-ref check (a ref that satisfies a textual\n * prefix while pointing elsewhere) is already caught here for anything leaving the base;\n * - a `.` ref legitimately addresses the base directory and is pinned as NOT an authorization\n * refusal (`ADMITS the base directory itself`), which a whole-segment textual check would break.\n \n What survives is a ref whose text climbs out of one tenant prefix into another WITHIN the base.\n * Reaching it needs write access to the `storageRef` column — the composition path can no longer\n * produce one — so it is a smaller surface than the one closed above, not the same one. Closing it\n * means deciding what `.` should mean first, which is a separate change.\n */\n private resolvePathFromStorageRef(\n file: StoredFileStorageTarget,\n executionContext: ExecutionContext<any>,\n ): string {\n const ref = file.storageRef;\n if (!ref) {\n return this.resolveSafePathFromRelative(this.composeStorageKey(file.fileId, executionContext));\n }\n return this.resolveSafePathFromRelative(ref);\n }\n\n private async readLocalMetadata(\n filePath: string,\n fileId: string,\n executionContext: ExecutionContext<any>,\n ): Promise<LocalFileMetadataRecord> {\n const metaPath = filePath + METADATA_SUFFIX;\n try {\n const raw = await fs.promises.readFile(metaPath, 'utf-8');\n return JSON.parse(raw) as LocalFileMetadataRecord;\n } catch {\n return {\n contentType: 'application/octet-stream',\n size: 0,\n createdAt: new Date().toISOString(),\n };\n }\n }\n\n private convertStorageError(\n error: unknown,\n operation: 'upload' \| 'download' \| 'delete' \| 'metadata',\n executionContext: ExecutionContext<any> \| undefined,\n context: Record<string, unknown>,\n ): never {\n if (isWildoBackendError(error)) {\n throw error;\n }\n\n const errorMessage = describeCaughtError(error);\n const errorCode = (error as any)?.code;\n\n if (errorCode === 'ENOENT') {\n throw this.errorBuilder.buildError(\n ErrorType.NOT_FOUND,\n executionContext,\n {\n customMessageReference: ErrorCustomMessageReference.FILE_NOT_FOUND_IN_STORAGE,\n context: { operation, ...context }, // diagnostic (log-only)\n }\n );\n }\n\n if (errorCode === 'EACCES' \|\| errorCode === 'EPERM') {\n throw this.errorBuilder.buildError(\n ErrorType.AUTHORIZATION,\n executionContext,\n {\n customMessageReference: ErrorCustomMessageReference.FILE_STORAGE_ACCESS_DENIED,\n context: { operation, ...context, originalError: errorMessage }, // diagnostic (log-only)\n }\n );\n }\n\n if (errorCode === 'ENOSPC') {\n throw this.errorBuilder.buildError(\n ErrorType.EXTERNAL_SERVICE,\n executionContext,\n {\n customMessageReference: ErrorCustomMessageReference.EXTERNAL_SERVICE,\n context: { message: 'Local storage disk full', operation, ...context, originalError: errorMessage },\n }\n );\n }\n\n throw this.errorBuilder.buildError(\n ErrorType.EXTERNAL_SERVICE,\n executionContext,\n {\n customMessageReference: ErrorCustomMessageReference.EXTERNAL_SERVICE,\n context: { message: `Local storage operation failed: ${operation}`, operation, ...context, originalError: errorMessage },\n }\n );\n }\n}\n"]}

package/dist/esm/files/storage/storage-credential-provider.backend.utils.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"storage-credential-provider.backend.utils.d.ts","sourceRoot":"","sources":["~~../../../../../~~src/files/storage/storage-credential-provider.backend.utils.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,MAAM,WAAW,0BAA0B;IACzC,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,oEAAoE;IACpE,SAAS,CAAC,EAAE,IAAI,CAAC;IACjB;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,MAAM,yBAAyB,GAAG,MAAM,OAAO,CAAC,0BAA0B,CAAC,CAAC;AAUlF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,qBAAa,yBAAyB;IAKlC,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,mEAAmE;IACnE,OAAO,CAAC,QAAQ,CAAC,GAAG;IANtB,OAAO,CAAC,MAAM,CAA2C;IACzD,OAAO,CAAC,QAAQ,CAAoD;gBAGjD,OAAO,EAAE,yBAAyB;IACnD,mEAAmE;IAClD,GAAG,GAAE,MAAM,MAAyB;IAGvD;;OAEG;IACU,cAAc,IAAI,OAAO,CAAC,0BAA0B,CAAC;IAyBlE;;;;;OAKG;IACI,oBAAoB,CAAC,iBAAiB,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO;IAI3E,sFAAsF;IAC/E,UAAU,IAAI,IAAI;IAIzB,OAAO,CAAC,eAAe;CAYxB"}
1	+ {"version":3,"file":"storage-credential-provider.backend.utils.d.ts","sourceRoot":"","sources":["../../../../src/files/storage/storage-credential-provider.backend.utils.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,MAAM,WAAW,0BAA0B;IACzC,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,oEAAoE;IACpE,SAAS,CAAC,EAAE,IAAI,CAAC;IACjB;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,MAAM,yBAAyB,GAAG,MAAM,OAAO,CAAC,0BAA0B,CAAC,CAAC;AAUlF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,qBAAa,yBAAyB;IAKlC,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,mEAAmE;IACnE,OAAO,CAAC,QAAQ,CAAC,GAAG;IANtB,OAAO,CAAC,MAAM,CAA2C;IACzD,OAAO,CAAC,QAAQ,CAAoD;gBAGjD,OAAO,EAAE,yBAAyB;IACnD,mEAAmE;IAClD,GAAG,GAAE,MAAM,MAAyB;IAGvD;;OAEG;IACU,cAAc,IAAI,OAAO,CAAC,0BAA0B,CAAC;IAyBlE;;;;;OAKG;IACI,oBAAoB,CAAC,iBAAiB,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO;IAI3E,sFAAsF;IAC/E,UAAU,IAAI,IAAI;IAIzB,OAAO,CAAC,eAAe;CAYxB"}

package/dist/esm/files/storage/storage-platform-sts-credential-resolver.backend.utils.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"storage-platform-sts-credential-resolver.backend.utils.d.ts","sourceRoot":"","sources":["~~../../../../../~~src/files/storage/storage-platform-sts-credential-resolver.backend.utils.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAA8B,yBAAyB,EAAE,MAAM,4EAA4E,CAAC;AAExJ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,wBAAgB,iDAAiD,IAAI,yBAAyB,CA2B7F"}
1	+ {"version":3,"file":"storage-platform-sts-credential-resolver.backend.utils.d.ts","sourceRoot":"","sources":["../../../../src/files/storage/storage-platform-sts-credential-resolver.backend.utils.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAA8B,yBAAyB,EAAE,MAAM,4EAA4E,CAAC;AAExJ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,wBAAgB,iDAAiD,IAAI,yBAAyB,CA2B7F"}

package/dist/esm/files/storage/storage-sts-credential-resolver.backend.utils.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"storage-sts-credential-resolver.backend.utils.d.ts","sourceRoot":"","sources":["~~../../../../../~~src/files/storage/storage-sts-credential-resolver.backend.utils.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,0BAA0B,EAAE,yBAAyB,EAAE,MAAM,4EAA4E,CAAC;AAsGxJ;;;;;;;;;;;;GAYG;AACH,wBAAgB,kCAAkC,CAChD,oBAAoB,EAAE,MAAM,MAAM,GACjC,yBAAyB,CAiE3B;~~AAED~~;;;;;;;;;GASG;AACH,wBAAsB,2BAA2B,CAAC,KAAK,EAAE;IACvD,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACjC,GAAG,OAAO,CAAC,OAAO,CAAC,~~CA+CnB~~;AAED;;;;;;;GAOG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,OAAO,GAAG,0BAA0B,CAkCtF"}
1	+ {"version":3,"file":"storage-sts-credential-resolver.backend.utils.d.ts","sourceRoot":"","sources":["../../../../src/files/storage/storage-sts-credential-resolver.backend.utils.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,0BAA0B,EAAE,yBAAyB,EAAE,MAAM,4EAA4E,CAAC;AAsGxJ;;;;;;;;;;;;GAYG;AACH,wBAAgB,kCAAkC,CAChD,oBAAoB,EAAE,MAAM,MAAM,GACjC,yBAAyB,CAiE3B;AAYD;;;;;;;;;GASG;AACH,wBAAsB,2BAA2B,CAAC,KAAK,EAAE;IACvD,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACjC,GAAG,OAAO,CAAC,OAAO,CAAC,CA6CnB;AAED;;;;;;;GAOG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,OAAO,GAAG,0BAA0B,CAkCtF"}

package/dist/esm/files/storage/storage-sts-credential-resolver.backend.utils.js CHANGED Viewed

@@ -170,6 +170,15 @@ export function createStsStorageCredentialResolver(resolveApplicationId) {
         return parseStsCredentialPayload(payload);
     };
 }
+/**
+ * Hard deadline for one STS credential fetch from apps-manager.
+ *
+ * This sits in front of every FIRST storage operation after a renewal, so the cost of an unbounded
+ * wait is not a slow credential — it is an upload that stalls instead of failing, on a fail-closed
+ * path with no fallback. 15s: the payload is a small JSON credential from a service on our own
+ * network, and the operation behind it is a user waiting for a file to move.
+ */
+const STS_CREDENTIAL_REQUEST_TIMEOUT_MS = 15_000;
 /**
  * Perform the credential fetch and unwrap the response envelope.
  *
@@ -197,9 +206,7 @@ export async function requestStsCredentialPayload(input) {
         const response = await fetch(input.url, {
             method: 'GET',
             headers: input.headers,
-            // Bounded: this sits in front of every first storage operation after a
-            // renewal, so an unbounded wait would stall uploads rather than fail them.
-            signal: AbortSignal.timeout(15_000),
+            signal: AbortSignal.timeout(STS_CREDENTIAL_REQUEST_TIMEOUT_MS),
         });
         if (!response.ok) {
             // `fetch` resolves on non-2xx rather than rejecting, so this has to be an

package/dist/esm/files/storage/storage-sts-credential-resolver.backend.utils.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"storage-sts-credential-resolver.backend.utils.js","sourceRoot":"","sources":["../../../../../src/files/storage/storage-sts-credential-resolver.backend.utils.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,uBAAuB,EAAE,MAAM,gCAAgC,CAAC;AACzE,OAAO,EAAE,8BAA8B,EAAE,MAAM,kEAAkE,CAAC;AAClH,OAAO,EAAE,mBAAmB,EAAE,MAAM,8EAA8E,CAAC;AAGnH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH;;;;;;;;;;;;;;;GAeG;AACH,SAAS,uBAAuB,CAAC,KAAc;IAC7C,MAAM,KAAK,GAAa,EAAE,CAAC;IAE3B,MAAM,OAAO,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAC;IAC3C,+EAA+E;IAC/E,8EAA8E;IAC9E,gFAAgF;IAChF,0EAA0E;IAC1E,IAAI,OAAO,IAAI,OAAO,KAAK,iBAAiB;QAAE,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAElE,MAAM,aAAa,GAAI,KAA4B,EAAE,IAAI,CAAC;IAC1D,IAAI,OAAO,aAAa,KAAK,QAAQ,IAAI,aAAa;QAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,aAAa,EAAE,CAAC,CAAC;IAE5F,6EAA6E;IAC7E,0EAA0E;IAC1E,8EAA8E;IAC9E,mEAAmE;IACnE,MAAM,YAAY,GAAI,KAA2D,EAAE,KAAK,CAAC;IACzF,IAAI,YAAY,EAAE,CAAC;QACjB,MAAM,IAAI,GAAG,OAAO,YAAY,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;QACnF,MAAM,GAAG,GAAG,OAAO,YAAY,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;QACxF,IAAI,IAAI;YAAE,KAAK,CAAC,IAAI,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;aACjC,IAAI,GAAG;YAAE,KAAK,CAAC,IAAI,CAAC,SAAS,GAAG,EAAE,CAAC,CAAC;IAC3C,CAAC;IAED,MAAM,IAAI,GAAI,KAA4B,EAAE,IAAI,CAAC;IACjD,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,IAAI,KAAK,YAAY,IAAI,IAAI,KAAK,cAAc,CAAC,EAAE,CAAC;QACnF,KAAK,CAAC,IAAI,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC;IAChC,CAAC;IAED,6EAA6E;IAC7E,6EAA6E;IAC7E,2CAA2C;IAE3C,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,MAAM,QAAQ,GAAI,KAA6C,EAAE,WAAW,EAAE,IAAI,CAAC;QACnF,OAAO,QAAQ,CAAC,CAAC,CAAC,gBAAgB,QAAQ,EAAE,CAAC,CAAC,CAAC,0DAA0D,CAAC;IAC5G,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC3B,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,kCAAkC,CAChD,oBAAkC;IAElC,OAAO,KAAK,IAAyC,EAAE;QACrD,4EAA4E;QAC5E,EAAE;QACF,4EAA4E;QAC5E,8EAA8E;QAC9E,+EAA+E;QAC/E,8EAA8E;QAC9E,gCAAgC;QAChC,EAAE;QACF,6EAA6E;QAC7E,6EAA6E;QAC7E,6EAA6E;QAC7E,2EAA2E;QAC3E,8EAA8E;QAC9E,8EAA8E;QAC9E,EAAE;QACF,mEAAmE;QACnE,+EAA+E;QAC/E,6BAA6B;QAC7B,IAAI,OAAO,CAAC,GAAG,CAAC,YAAY,KAAK,uBAAuB,CAAC,qBAAqB,EAAE,CAAC;YAC/E,MAAM,IAAI,KAAK,CACb,mFAAmF;kBACjF,IAAI,uBAAuB,CAAC,qBAAqB,gCAAgC;kBACjF,mFAAmF;kBACnF,8EAA8E;kBAC9E,wBAAwB,CAC3B,CAAC;QACJ,CAAC;QAED,MAAM,cAAc,GAAG,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC;QAC7D,MAAM,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC,mCAAmC,CAAC;QACtE,kEAAkE;QAClE,IAAI,aAAiC,CAAC;QACtC,IAAI,CAAC;YACH,aAAa,GAAG,oBAAoB,EAAE,CAAC;QACzC,CAAC;QAAC,MAAM,CAAC;YACP,yEAAyE;YACzE,oEAAoE;YACpE,yEAAyE;YACzE,aAAa,GAAG,SAAS,CAAC;QAC5B,CAAC;QAED,IAAI,CAAC,cAAc,IAAI,CAAC,aAAa,IAAI,CAAC,aAAa,EAAE,CAAC;YACxD,MAAM,IAAI,KAAK,CACb,iFAAiF;kBAC/E,+BAA+B,OAAO,CAAC,cAAc,CAAC,IAAI;kBAC1D,wCAAwC,OAAO,CAAC,aAAa,CAAC,IAAI;kBAClE,kBAAkB,OAAO,CAAC,aAAa,CAAC,IAAI,CAC/C,CAAC;QACJ,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,2BAA2B,CAAC;YAChD,GAAG,EAAE,GAAG,cAAc,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE;kBACxC,8BAA8B,CAAC,YAAY,CAAC,2CAA2C,EAAE;YAC7F,OAAO,EAAE;gBACP,CAAC,eAAe,CAAC,YAAY,CAAC,EAAE,kBAAkB;gBAClD,CAAC,eAAe,CAAC,eAAe,CAAC,EAAE,aAAa;gBAChD,CAAC,eAAe,CAAC,cAAc,CAAC,EAAE,aAAa;gBAC/C,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,CAAC,eAAe,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC,GAAG,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAChG;SACF,CAAC,CAAC;QAEH,OAAO,yBAAyB,CAAC,OAAO,CAAC,CAAC;IAC5C,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,KAGjD;IACC,IAAI,CAAC;QACH,6DAA6D;QAC7D,EAAE;QACF,2EAA2E;QAC3E,4EAA4E;QAC5E,6EAA6E;QAC7E,+EAA+E;QAC/E,mEAAmE;QACnE,+EAA+E;QAC/E,8BAA8B;QAC9B,EAAE;QACF,8EAA8E;QAC9E,gEAAgE;QAChE,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE;YACtC,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,uEAAuE;YACvE,2EAA2E;YAC3E,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;SACpC,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,0EAA0E;YAC1E,wEAAwE;YACxE,0EAA0E;YAC1E,+DAA+D;YAC/D,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;YACnD,MAAM,IAAI,KAAK,CAAC,UAAU,QAAQ,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,WAAW,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC7F,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,EAA+B,CAAC;QAClE,OAAO,MAAM,EAAE,IAAI,IAAI,MAAM,CAAC;IAChC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,kEAAkE;QAClE,+BAA+B;QAC/B,EAAE;QACF,8EAA8E;QAC9E,6EAA6E;QAC7E,8EAA8E;QAC9E,gFAAgF;QAChF,gFAAgF;QAChF,8EAA8E;QAC9E,MAAM,IAAI,KAAK,CACb,0EAA0E,uBAAuB,CAAC,KAAK,CAAC,EAAE,CAC3G,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,yBAAyB,CAAC,OAAgB;IACxD,MAAM,WAAW,GAAG,OAMZ,CAAC;IAET,IACE,OAAO,WAAW,EAAE,SAAS,KAAK,QAAQ;WACvC,OAAO,WAAW,EAAE,SAAS,KAAK,QAAQ;WAC1C,OAAO,WAAW,EAAE,YAAY,KAAK,QAAQ,EAChD,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,sEAAsE,CAAC,CAAC;IAC1F,CAAC;IAED,MAAM,SAAS,GAAG,OAAO,WAAW,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC1G,IAAI,CAAC,SAAS,IAAI,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CAAC,qFAAqF,CAAC,CAAC;IACzG,CAAC;IAED,OAAO;QACL,SAAS,EAAE,WAAW,CAAC,SAAS;QAChC,SAAS,EAAE,WAAW,CAAC,SAAS;QAChC,YAAY,EAAE,WAAW,CAAC,YAAY;QACtC,SAAS;QACT,8EAA8E;QAC9E,+EAA+E;QAC/E,uEAAuE;QACvE,GAAG,CAAC,OAAO,WAAW,CAAC,aAAa,KAAK,QAAQ,IAAI,WAAW,CAAC,aAAa;YAC5E,CAAC,CAAC,EAAE,aAAa,EAAE,WAAW,CAAC,aAAa,EAAE;YAC9C,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;AACJ,CAAC","sourcesContent":["import { WildoHeaderKeys } from '@wildo-ai/saas-models';\nimport { PlatformApplicationType } from '@wildo-ai/platform-core-shared';\nimport { API_ROUTES_BACKEND_DEFINITIONS } from '~wildo-backend-lib/requests/models/api-routes.backend.defintions';\nimport { describeCaughtError } from '~wildo-backend-lib/errors/utils/error-log-level-classification.backend.utils';\nimport type { ResolvedStorageCredentials, StorageCredentialResolver } from '~wildo-backend-lib/files/storage/storage-credential-provider.backend.utils';\n\n/*\n Resolver that obtains SHORT-LIVED, prefix-confined object-storage credentials\n * from apps-manager instead of reading a long-lived key out of process env.\n \n ## Why this replaces the env read outright\n \n `STORAGE_ACCESS_KEY` / `STORAGE_SECRET_KEY` are the object store's ROOT\n * credential, handed to every application, minion and worker through\n * `{appSlug}-secret`. See\n * `.claude/plans/object-storage-root-credential-distribution.md`.\n \n There is deliberately no fallback to those env vars. A fallback beside this\n * path is precisely how the root credential would quietly remain in use: the\n * fallback would fire on any transient apps-manager hiccup, succeed, and leave no\n * signal that the confinement had been bypassed. Failing closed is the whole\n * point — an application with no storage credential cannot leak one.\n \n ## Identity\n \n The request carries the caller's own bootstrap identity — the platform secret\n * plus its `APPLICATION_ID` — and apps-manager confines the returned credential to\n * the application that identity authenticates as. There is no parameter by which a\n * caller could ask for ANOTHER application's credential, and none should ever be\n * added.\n \n (Corrected 2026-08-12: this previously said the request \"names no application\",\n * which is not what the code does — `X-Application-Id` is sent below. The\n * guarantee is real but it comes from the header being the caller's OWN id and\n * being verified against the presented secret, not from the id being absent. A\n * description that does not match the request is the kind of premise a later\n * reader reasons from without re-checking.)\n \n ## This route is on the APPLICATION plane only\n \n It resolves a `wildoApplicationId` through the `apps-to-manager` controller,\n * which authenticates against `WildoApplication` records. Platform services carry\n * their own identity on a SEPARATE plane (`platform-services-to-manager`,\n * `Platform_Application_Config` / `_Secrets`, keyed by `platformApplicationId`) and\n * therefore cannot obtain a session here — which is why every platform service\n * currently reports storage UNCONFIGURED. See F-G in\n * `.claude/plans/object-storage-root-credential-distribution.md`.\n /\n/\n Render an STS-fetch failure into something a reader can act on.\n \n Deliberately assembles from several fields rather than trusting any single\n * one. An HTTP client failure can arrive as a transport error (`code`\n * `ECONNREFUSED`/`ETIMEDOUT`, no response), a non-2xx (`response.status` plus a\n * body explaining why), or a plain programming error — and each of those leaves\n * a DIFFERENT field populated, with the others absent. Reading only `message`\n * is what produced an empty diagnostic here once already.\n \n Falls back to the error's constructor name when everything else is empty, so\n * the output is never a bare string: \"something threw, and here is its type\" is\n * a far better starting point than silence.\n \n Never includes request headers — they carry the platform secret.\n /\nfunction describeStsFetchFailure(error: unknown): string {\n const parts: string[] = [];\n\n const message = describeCaughtError(error);\n // `\"[object Object]\"` is what `String(x)` yields for a plain object, and it is\n // NON-EMPTY while carrying exactly as much information as empty. Accepting it\n // would satisfy a \"message is present\" check and still tell the reader nothing,\n // so it is treated as absent and the type-name fallback below takes over.\n if (message && message !== '[object Object]') parts.push(message);\n\n const transportCode = (error as { code?: unknown })?.code;\n if (typeof transportCode === 'string' && transportCode) parts.push(`code=${transportCode}`);\n\n // `fetch` reports transport faults through `cause` (e.g. `ECONNREFUSED` on a\n // refused connection) while `message` stays a generic \"fetch failed\" — so\n // without this, the single most common real failure renders as no information\n // at all. `AbortError` from the timeout arrives as `name` instead.\n const causeMessage = (error as { cause?: { message?: unknown; code?: unknown } })?.cause;\n if (causeMessage) {\n const code = typeof causeMessage.code === 'string' ? causeMessage.code : undefined;\n const msg = typeof causeMessage.message === 'string' ? causeMessage.message : undefined;\n if (code) parts.push(`cause=${code}`);\n else if (msg) parts.push(`cause=${msg}`);\n }\n\n const name = (error as { name?: unknown })?.name;\n if (typeof name === 'string' && (name === 'AbortError' \|\| name === 'TimeoutError')) {\n parts.push(`aborted=${name}`);\n }\n\n // Status/body arrive already formatted from the `!response.ok` branch above,\n // which reads them off the Response rather than off the error — `fetch` puts\n // nothing HTTP-shaped on the thrown value.\n\n if (parts.length === 0) {\n const typeName = (error as { constructor?: { name?: string } })?.constructor?.name;\n return typeName ? `unrenderable ${typeName}` : 'unrenderable error with no message, code, status or body';\n }\n\n return parts.join(' \| ');\n}\n\n/\n @param resolveApplicationId - the caller's own application identity, taken from\n * RESOLVED CONFIGURATION rather than read from `process.env` here.\n \n The two are the same value for an application — the loader seeds\n * `config.applicationId` from `APPLICATION_ID` — but they are NOT the same for a\n * platform service, which resolves its identity locally and has no\n * `APPLICATION_ID` in env at all. Reading env here while the object-key builder\n * read configuration was a genuine dual-source split: the predicate that decides\n * whether storage is usable and the value the operation addresses could disagree,\n * and for every platform service they did. Passing it in makes the identity\n * single-sourced and defers \"which identity\" to the one place that knows.\n /\nexport function createStsStorageCredentialResolver(\n resolveApplicationId: () => string,\n): StorageCredentialResolver {\n return async (): Promise<ResolvedStorageCredentials> => {\n // ── The ISSUER may never be a CLIENT of itself ───────────────────────────\n //\n // apps-manager mints these credentials. If it ever takes this path it calls\n // its own HTTP endpoint during `initializeConfig()` — before its own listener\n // exists — which is a guaranteed `ECONNREFUSED` on every boot, not a race that\n // occasionally loses. That happened on 2026-08-12 and held `/health/ready` at\n // 503 for the process lifetime.\n //\n // It was PREVENTED before that only by accident: platform env files carry no\n // `APPLICATION_ID`, so the provider's `isConfigured()` happened to be false.\n // An accident is not a guard — it silently stops guarding the moment someone\n // supplies the variable, which is exactly what a future platform-plane STS\n // door will do. This is the explicit form, and it fails with a message naming\n // the real reason instead of a transport error that reads as a network fault.\n //\n // apps-manager does its own storage work with ADMIN rights through\n // `PlatformInfrastructureManagerService`; it does not need, and must not take,\n // the app-tier session path.\n if (process.env.SERVICE_NAME === PlatformApplicationType.PLATFORM_APPS_MANAGER) {\n throw new Error(\n 'Refusing to fetch object storage session credentials: this runtime IS the issuer '\n + `(${PlatformApplicationType.PLATFORM_APPS_MANAGER}). apps-manager brokers these `\n + 'credentials and must never request them from itself — it would call its own HTTP '\n + 'endpoint before that listener exists. Use the administrative object-storage '\n + 'configuration instead.',\n );\n }\n\n const appsManagerUrl = process.env.PLATFORM_APPS_MANAGER_URL;\n const primarySecret = process.env.PLATFORM_APPLICATION_PRIMARY_SECRET;\n // Never `process.env.APPLICATION_ID` — see the parameter's JSDoc.\n let applicationId: string \| undefined;\n try {\n applicationId = resolveApplicationId();\n } catch {\n // The configuration getter throws when configuration is not initialized.\n // Treated as \"no identity yet\" so the message below names the whole\n // incomplete contract rather than escaping as an unrelated config error.\n applicationId = undefined;\n }\n\n if (!appsManagerUrl \|\| !primarySecret \|\| !applicationId) {\n throw new Error(\n 'Cannot obtain object storage credentials: the bootstrap contract is incomplete '\n + `(PLATFORM_APPS_MANAGER_URL: ${Boolean(appsManagerUrl)}, `\n + `PLATFORM_APPLICATION_PRIMARY_SECRET: ${Boolean(primarySecret)}, `\n + `applicationId: ${Boolean(applicationId)}).`,\n );\n }\n\n const payload = await requestStsCredentialPayload({\n url: `${appsManagerUrl.replace(/\\/+$/, '')}`\n + API_ROUTES_BACKEND_DEFINITIONS.APPS_MANAGER.GET_APPLICATION_STORAGE_SESSION_CREDENTIALS(),\n headers: {\n [WildoHeaderKeys.CONTENT_TYPE]: 'application/json',\n [WildoHeaderKeys.PLATFORM_SECRET]: primarySecret,\n [WildoHeaderKeys.APPLICATION_ID]: applicationId,\n ...(process.env.SERVICE_NAME ? { [WildoHeaderKeys.SERVICE_ID]: process.env.SERVICE_NAME } : {}),\n },\n });\n\n return parseStsCredentialPayload(payload);\n };\n}\n\n/\n Perform the credential fetch and unwrap the response envelope.\n \n Shared by the APPLICATION-plane and PLATFORM-plane resolvers, deliberately: the\n * transport, the timeout, the non-2xx branch and the diagnostic are properties of\n * \"fetching a credential from apps-manager\", not of which door was used. This repo\n * has twice paid for a duplicated path where a guard added to one copy was a silent\n * gap in the other (`buildContextualFilter`, the Mongo/PostgreSQL repositories), and\n * a fail-closed credential path is the worst place to repeat that.\n /\nexport async function requestStsCredentialPayload(input: {\n url: string;\n headers: Record<string, string>;\n}): Promise<unknown> {\n try {\n // Global `fetch`, NOT an HTTP client library — deliberately.\n //\n // `axios` is a `peerDependency: \"\"` of this package, not a dependency, so\n // reaching for it here would have added a runtime dependency to the storage\n // path that previously had none: it resolves today only because pnpm happens\n // to place axios in a reachable tree, and `backend-api` does not declare it at\n // all. A consumer that did not provide axios would fail at storage\n // initialisation — on a fail-closed path with no fallback, for a reason having\n // nothing to do with storage.\n //\n // `fetch` is a Node built-in on every runtime this framework supports, so the\n // storage path depends on nothing it is not guaranteed to have.\n const response = await fetch(input.url, {\n method: 'GET',\n headers: input.headers,\n // Bounded: this sits in front of every first storage operation after a\n // renewal, so an unbounded wait would stall uploads rather than fail them.\n signal: AbortSignal.timeout(15_000),\n });\n\n if (!response.ok) {\n // `fetch` resolves on non-2xx rather than rejecting, so this has to be an\n // explicit branch — the classic footgun when porting from a client that\n // throws. Read the body BEFORE giving up on it: apps-manager explains the\n // refusal there, and that explanation is the whole diagnostic.\n const body = await response.text().catch(() => '');\n throw new Error(`status=${response.status}${body ? ` \| body=${body.slice(0, 300)}` : ''}`);\n }\n\n const parsed = await response.json() as { data?: unknown } \| null;\n return parsed?.data ?? parsed;\n } catch (error) {\n // Describe the failure from the HTTP error's OWN fields, not from\n // `describeCaughtError` alone.\n //\n // This wrapper previously read `describeCaughtError(error)` and nothing else,\n // and on 2026-08-10 it produced a message ending in a bare colon — the cause\n // was empty, so the one thing the wrapper exists to surface was the one thing\n // it discarded. Storage is a fail-closed path with no fallback by design, which\n // makes this the ONLY diagnostic a reader gets; an empty one sends them looking\n // at credentials when the fault may be transport, routing, or a non-2xx body.\n throw new Error(\n `Failed to obtain object storage session credentials from apps-manager: ${describeStsFetchFailure(error)}`,\n );\n }\n}\n\n/*\n Validate the credential payload rather than trusting it.\n \n A malformed payload that reached the minio client would surface as an opaque\n * signature error on the first upload, a long way from the response that caused it;\n * a credential with no usable expiry would be cached forever by the provider and\n * then start failing mid-request once the server expired it.\n */\nexport function parseStsCredentialPayload(payload: unknown): ResolvedStorageCredentials {\n const credentials = payload as {\n accessKey?: unknown;\n secretKey?: unknown;\n sessionToken?: unknown;\n expiresAt?: unknown;\n applicationId?: unknown;\n } \| null;\n\n if (\n typeof credentials?.accessKey !== 'string'\n \|\| typeof credentials?.secretKey !== 'string'\n \|\| typeof credentials?.sessionToken !== 'string'\n ) {\n throw new Error('apps-manager returned a malformed object storage session credential.');\n }\n\n const expiresAt = typeof credentials.expiresAt === 'string' ? new Date(credentials.expiresAt) : undefined;\n if (!expiresAt \|\| Number.isNaN(expiresAt.getTime())) {\n throw new Error('apps-manager returned an object storage session credential without a usable expiry.');\n }\n\n return {\n accessKey: credentials.accessKey,\n secretKey: credentials.secretKey,\n sessionToken: credentials.sessionToken,\n expiresAt,\n // Carried through verbatim — the identity the ISSUER confined this credential\n // to. Passed on only when the issuer supplied a usable string; a consumer that\n // needs it must fail closed on absence rather than substitute its own.\n ...(typeof credentials.applicationId === 'string' && credentials.applicationId\n ? { applicationId: credentials.applicationId }\n : {}),\n };\n}\n"]}
1	+ {"version":3,"file":"storage-sts-credential-resolver.backend.utils.js","sourceRoot":"","sources":["../../../../src/files/storage/storage-sts-credential-resolver.backend.utils.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,uBAAuB,EAAE,MAAM,gCAAgC,CAAC;AACzE,OAAO,EAAE,8BAA8B,EAAE,MAAM,kEAAkE,CAAC;AAClH,OAAO,EAAE,mBAAmB,EAAE,MAAM,8EAA8E,CAAC;AAGnH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH;;;;;;;;;;;;;;;GAeG;AACH,SAAS,uBAAuB,CAAC,KAAc;IAC7C,MAAM,KAAK,GAAa,EAAE,CAAC;IAE3B,MAAM,OAAO,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAC;IAC3C,+EAA+E;IAC/E,8EAA8E;IAC9E,gFAAgF;IAChF,0EAA0E;IAC1E,IAAI,OAAO,IAAI,OAAO,KAAK,iBAAiB;QAAE,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAElE,MAAM,aAAa,GAAI,KAA4B,EAAE,IAAI,CAAC;IAC1D,IAAI,OAAO,aAAa,KAAK,QAAQ,IAAI,aAAa;QAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,aAAa,EAAE,CAAC,CAAC;IAE5F,6EAA6E;IAC7E,0EAA0E;IAC1E,8EAA8E;IAC9E,mEAAmE;IACnE,MAAM,YAAY,GAAI,KAA2D,EAAE,KAAK,CAAC;IACzF,IAAI,YAAY,EAAE,CAAC;QACjB,MAAM,IAAI,GAAG,OAAO,YAAY,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;QACnF,MAAM,GAAG,GAAG,OAAO,YAAY,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;QACxF,IAAI,IAAI;YAAE,KAAK,CAAC,IAAI,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;aACjC,IAAI,GAAG;YAAE,KAAK,CAAC,IAAI,CAAC,SAAS,GAAG,EAAE,CAAC,CAAC;IAC3C,CAAC;IAED,MAAM,IAAI,GAAI,KAA4B,EAAE,IAAI,CAAC;IACjD,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,IAAI,KAAK,YAAY,IAAI,IAAI,KAAK,cAAc,CAAC,EAAE,CAAC;QACnF,KAAK,CAAC,IAAI,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC;IAChC,CAAC;IAED,6EAA6E;IAC7E,6EAA6E;IAC7E,2CAA2C;IAE3C,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,MAAM,QAAQ,GAAI,KAA6C,EAAE,WAAW,EAAE,IAAI,CAAC;QACnF,OAAO,QAAQ,CAAC,CAAC,CAAC,gBAAgB,QAAQ,EAAE,CAAC,CAAC,CAAC,0DAA0D,CAAC;IAC5G,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC3B,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,kCAAkC,CAChD,oBAAkC;IAElC,OAAO,KAAK,IAAyC,EAAE;QACrD,4EAA4E;QAC5E,EAAE;QACF,4EAA4E;QAC5E,8EAA8E;QAC9E,+EAA+E;QAC/E,8EAA8E;QAC9E,gCAAgC;QAChC,EAAE;QACF,6EAA6E;QAC7E,6EAA6E;QAC7E,6EAA6E;QAC7E,2EAA2E;QAC3E,8EAA8E;QAC9E,8EAA8E;QAC9E,EAAE;QACF,mEAAmE;QACnE,+EAA+E;QAC/E,6BAA6B;QAC7B,IAAI,OAAO,CAAC,GAAG,CAAC,YAAY,KAAK,uBAAuB,CAAC,qBAAqB,EAAE,CAAC;YAC/E,MAAM,IAAI,KAAK,CACb,mFAAmF;kBACjF,IAAI,uBAAuB,CAAC,qBAAqB,gCAAgC;kBACjF,mFAAmF;kBACnF,8EAA8E;kBAC9E,wBAAwB,CAC3B,CAAC;QACJ,CAAC;QAED,MAAM,cAAc,GAAG,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC;QAC7D,MAAM,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC,mCAAmC,CAAC;QACtE,kEAAkE;QAClE,IAAI,aAAiC,CAAC;QACtC,IAAI,CAAC;YACH,aAAa,GAAG,oBAAoB,EAAE,CAAC;QACzC,CAAC;QAAC,MAAM,CAAC;YACP,yEAAyE;YACzE,oEAAoE;YACpE,yEAAyE;YACzE,aAAa,GAAG,SAAS,CAAC;QAC5B,CAAC;QAED,IAAI,CAAC,cAAc,IAAI,CAAC,aAAa,IAAI,CAAC,aAAa,EAAE,CAAC;YACxD,MAAM,IAAI,KAAK,CACb,iFAAiF;kBAC/E,+BAA+B,OAAO,CAAC,cAAc,CAAC,IAAI;kBAC1D,wCAAwC,OAAO,CAAC,aAAa,CAAC,IAAI;kBAClE,kBAAkB,OAAO,CAAC,aAAa,CAAC,IAAI,CAC/C,CAAC;QACJ,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,2BAA2B,CAAC;YAChD,GAAG,EAAE,GAAG,cAAc,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE;kBACxC,8BAA8B,CAAC,YAAY,CAAC,2CAA2C,EAAE;YAC7F,OAAO,EAAE;gBACP,CAAC,eAAe,CAAC,YAAY,CAAC,EAAE,kBAAkB;gBAClD,CAAC,eAAe,CAAC,eAAe,CAAC,EAAE,aAAa;gBAChD,CAAC,eAAe,CAAC,cAAc,CAAC,EAAE,aAAa;gBAC/C,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,CAAC,eAAe,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC,GAAG,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAChG;SACF,CAAC,CAAC;QAEH,OAAO,yBAAyB,CAAC,OAAO,CAAC,CAAC;IAC5C,CAAC,CAAC;AACJ,CAAC;AACD;;;;;;;GAOG;AACH,MAAM,iCAAiC,GAAG,MAAM,CAAC;AAGjD;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,KAGjD;IACC,IAAI,CAAC;QACH,6DAA6D;QAC7D,EAAE;QACF,2EAA2E;QAC3E,4EAA4E;QAC5E,6EAA6E;QAC7E,+EAA+E;QAC/E,mEAAmE;QACnE,+EAA+E;QAC/E,8BAA8B;QAC9B,EAAE;QACF,8EAA8E;QAC9E,gEAAgE;QAChE,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE;YACtC,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,iCAAiC,CAAC;SAC/D,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,0EAA0E;YAC1E,wEAAwE;YACxE,0EAA0E;YAC1E,+DAA+D;YAC/D,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;YACnD,MAAM,IAAI,KAAK,CAAC,UAAU,QAAQ,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,WAAW,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC7F,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,EAA+B,CAAC;QAClE,OAAO,MAAM,EAAE,IAAI,IAAI,MAAM,CAAC;IAChC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,kEAAkE;QAClE,+BAA+B;QAC/B,EAAE;QACF,8EAA8E;QAC9E,6EAA6E;QAC7E,8EAA8E;QAC9E,gFAAgF;QAChF,gFAAgF;QAChF,8EAA8E;QAC9E,MAAM,IAAI,KAAK,CACb,0EAA0E,uBAAuB,CAAC,KAAK,CAAC,EAAE,CAC3G,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,yBAAyB,CAAC,OAAgB;IACxD,MAAM,WAAW,GAAG,OAMZ,CAAC;IAET,IACE,OAAO,WAAW,EAAE,SAAS,KAAK,QAAQ;WACvC,OAAO,WAAW,EAAE,SAAS,KAAK,QAAQ;WAC1C,OAAO,WAAW,EAAE,YAAY,KAAK,QAAQ,EAChD,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,sEAAsE,CAAC,CAAC;IAC1F,CAAC;IAED,MAAM,SAAS,GAAG,OAAO,WAAW,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC1G,IAAI,CAAC,SAAS,IAAI,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CAAC,qFAAqF,CAAC,CAAC;IACzG,CAAC;IAED,OAAO;QACL,SAAS,EAAE,WAAW,CAAC,SAAS;QAChC,SAAS,EAAE,WAAW,CAAC,SAAS;QAChC,YAAY,EAAE,WAAW,CAAC,YAAY;QACtC,SAAS;QACT,8EAA8E;QAC9E,+EAA+E;QAC/E,uEAAuE;QACvE,GAAG,CAAC,OAAO,WAAW,CAAC,aAAa,KAAK,QAAQ,IAAI,WAAW,CAAC,aAAa;YAC5E,CAAC,CAAC,EAAE,aAAa,EAAE,WAAW,CAAC,aAAa,EAAE;YAC9C,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;AACJ,CAAC","sourcesContent":["import { WildoHeaderKeys } from '@wildo-ai/saas-models';\nimport { PlatformApplicationType } from '@wildo-ai/platform-core-shared';\nimport { API_ROUTES_BACKEND_DEFINITIONS } from '~wildo-backend-lib/requests/models/api-routes.backend.defintions';\nimport { describeCaughtError } from '~wildo-backend-lib/errors/utils/error-log-level-classification.backend.utils';\nimport type { ResolvedStorageCredentials, StorageCredentialResolver } from '~wildo-backend-lib/files/storage/storage-credential-provider.backend.utils';\n\n/*\n Resolver that obtains SHORT-LIVED, prefix-confined object-storage credentials\n * from apps-manager instead of reading a long-lived key out of process env.\n \n ## Why this replaces the env read outright\n \n `STORAGE_ACCESS_KEY` / `STORAGE_SECRET_KEY` are the object store's ROOT\n * credential, handed to every application, minion and worker through\n * `{appSlug}-secret`. See\n * `.claude/plans/object-storage-root-credential-distribution.md`.\n \n There is deliberately no fallback to those env vars. A fallback beside this\n * path is precisely how the root credential would quietly remain in use: the\n * fallback would fire on any transient apps-manager hiccup, succeed, and leave no\n * signal that the confinement had been bypassed. Failing closed is the whole\n * point — an application with no storage credential cannot leak one.\n \n ## Identity\n \n The request carries the caller's own bootstrap identity — the platform secret\n * plus its `APPLICATION_ID` — and apps-manager confines the returned credential to\n * the application that identity authenticates as. There is no parameter by which a\n * caller could ask for ANOTHER application's credential, and none should ever be\n * added.\n \n (Corrected 2026-08-12: this previously said the request \"names no application\",\n * which is not what the code does — `X-Application-Id` is sent below. The\n * guarantee is real but it comes from the header being the caller's OWN id and\n * being verified against the presented secret, not from the id being absent. A\n * description that does not match the request is the kind of premise a later\n * reader reasons from without re-checking.)\n \n ## This route is on the APPLICATION plane only\n \n It resolves a `wildoApplicationId` through the `apps-to-manager` controller,\n * which authenticates against `WildoApplication` records. Platform services carry\n * their own identity on a SEPARATE plane (`platform-services-to-manager`,\n * `Platform_Application_Config` / `_Secrets`, keyed by `platformApplicationId`) and\n * therefore cannot obtain a session here — which is why every platform service\n * currently reports storage UNCONFIGURED. See F-G in\n * `.claude/plans/object-storage-root-credential-distribution.md`.\n /\n/\n Render an STS-fetch failure into something a reader can act on.\n \n Deliberately assembles from several fields rather than trusting any single\n * one. An HTTP client failure can arrive as a transport error (`code`\n * `ECONNREFUSED`/`ETIMEDOUT`, no response), a non-2xx (`response.status` plus a\n * body explaining why), or a plain programming error — and each of those leaves\n * a DIFFERENT field populated, with the others absent. Reading only `message`\n * is what produced an empty diagnostic here once already.\n \n Falls back to the error's constructor name when everything else is empty, so\n * the output is never a bare string: \"something threw, and here is its type\" is\n * a far better starting point than silence.\n \n Never includes request headers — they carry the platform secret.\n /\nfunction describeStsFetchFailure(error: unknown): string {\n const parts: string[] = [];\n\n const message = describeCaughtError(error);\n // `\"[object Object]\"` is what `String(x)` yields for a plain object, and it is\n // NON-EMPTY while carrying exactly as much information as empty. Accepting it\n // would satisfy a \"message is present\" check and still tell the reader nothing,\n // so it is treated as absent and the type-name fallback below takes over.\n if (message && message !== '[object Object]') parts.push(message);\n\n const transportCode = (error as { code?: unknown })?.code;\n if (typeof transportCode === 'string' && transportCode) parts.push(`code=${transportCode}`);\n\n // `fetch` reports transport faults through `cause` (e.g. `ECONNREFUSED` on a\n // refused connection) while `message` stays a generic \"fetch failed\" — so\n // without this, the single most common real failure renders as no information\n // at all. `AbortError` from the timeout arrives as `name` instead.\n const causeMessage = (error as { cause?: { message?: unknown; code?: unknown } })?.cause;\n if (causeMessage) {\n const code = typeof causeMessage.code === 'string' ? causeMessage.code : undefined;\n const msg = typeof causeMessage.message === 'string' ? causeMessage.message : undefined;\n if (code) parts.push(`cause=${code}`);\n else if (msg) parts.push(`cause=${msg}`);\n }\n\n const name = (error as { name?: unknown })?.name;\n if (typeof name === 'string' && (name === 'AbortError' \|\| name === 'TimeoutError')) {\n parts.push(`aborted=${name}`);\n }\n\n // Status/body arrive already formatted from the `!response.ok` branch above,\n // which reads them off the Response rather than off the error — `fetch` puts\n // nothing HTTP-shaped on the thrown value.\n\n if (parts.length === 0) {\n const typeName = (error as { constructor?: { name?: string } })?.constructor?.name;\n return typeName ? `unrenderable ${typeName}` : 'unrenderable error with no message, code, status or body';\n }\n\n return parts.join(' \| ');\n}\n\n/\n @param resolveApplicationId - the caller's own application identity, taken from\n * RESOLVED CONFIGURATION rather than read from `process.env` here.\n \n The two are the same value for an application — the loader seeds\n * `config.applicationId` from `APPLICATION_ID` — but they are NOT the same for a\n * platform service, which resolves its identity locally and has no\n * `APPLICATION_ID` in env at all. Reading env here while the object-key builder\n * read configuration was a genuine dual-source split: the predicate that decides\n * whether storage is usable and the value the operation addresses could disagree,\n * and for every platform service they did. Passing it in makes the identity\n * single-sourced and defers \"which identity\" to the one place that knows.\n /\nexport function createStsStorageCredentialResolver(\n resolveApplicationId: () => string,\n): StorageCredentialResolver {\n return async (): Promise<ResolvedStorageCredentials> => {\n // ── The ISSUER may never be a CLIENT of itself ───────────────────────────\n //\n // apps-manager mints these credentials. If it ever takes this path it calls\n // its own HTTP endpoint during `initializeConfig()` — before its own listener\n // exists — which is a guaranteed `ECONNREFUSED` on every boot, not a race that\n // occasionally loses. That happened on 2026-08-12 and held `/health/ready` at\n // 503 for the process lifetime.\n //\n // It was PREVENTED before that only by accident: platform env files carry no\n // `APPLICATION_ID`, so the provider's `isConfigured()` happened to be false.\n // An accident is not a guard — it silently stops guarding the moment someone\n // supplies the variable, which is exactly what a future platform-plane STS\n // door will do. This is the explicit form, and it fails with a message naming\n // the real reason instead of a transport error that reads as a network fault.\n //\n // apps-manager does its own storage work with ADMIN rights through\n // `PlatformInfrastructureManagerService`; it does not need, and must not take,\n // the app-tier session path.\n if (process.env.SERVICE_NAME === PlatformApplicationType.PLATFORM_APPS_MANAGER) {\n throw new Error(\n 'Refusing to fetch object storage session credentials: this runtime IS the issuer '\n + `(${PlatformApplicationType.PLATFORM_APPS_MANAGER}). apps-manager brokers these `\n + 'credentials and must never request them from itself — it would call its own HTTP '\n + 'endpoint before that listener exists. Use the administrative object-storage '\n + 'configuration instead.',\n );\n }\n\n const appsManagerUrl = process.env.PLATFORM_APPS_MANAGER_URL;\n const primarySecret = process.env.PLATFORM_APPLICATION_PRIMARY_SECRET;\n // Never `process.env.APPLICATION_ID` — see the parameter's JSDoc.\n let applicationId: string \| undefined;\n try {\n applicationId = resolveApplicationId();\n } catch {\n // The configuration getter throws when configuration is not initialized.\n // Treated as \"no identity yet\" so the message below names the whole\n // incomplete contract rather than escaping as an unrelated config error.\n applicationId = undefined;\n }\n\n if (!appsManagerUrl \|\| !primarySecret \|\| !applicationId) {\n throw new Error(\n 'Cannot obtain object storage credentials: the bootstrap contract is incomplete '\n + `(PLATFORM_APPS_MANAGER_URL: ${Boolean(appsManagerUrl)}, `\n + `PLATFORM_APPLICATION_PRIMARY_SECRET: ${Boolean(primarySecret)}, `\n + `applicationId: ${Boolean(applicationId)}).`,\n );\n }\n\n const payload = await requestStsCredentialPayload({\n url: `${appsManagerUrl.replace(/\\/+$/, '')}`\n + API_ROUTES_BACKEND_DEFINITIONS.APPS_MANAGER.GET_APPLICATION_STORAGE_SESSION_CREDENTIALS(),\n headers: {\n [WildoHeaderKeys.CONTENT_TYPE]: 'application/json',\n [WildoHeaderKeys.PLATFORM_SECRET]: primarySecret,\n [WildoHeaderKeys.APPLICATION_ID]: applicationId,\n ...(process.env.SERVICE_NAME ? { [WildoHeaderKeys.SERVICE_ID]: process.env.SERVICE_NAME } : {}),\n },\n });\n\n return parseStsCredentialPayload(payload);\n };\n}\n/\n Hard deadline for one STS credential fetch from apps-manager.\n \n This sits in front of every FIRST storage operation after a renewal, so the cost of an unbounded\n * wait is not a slow credential — it is an upload that stalls instead of failing, on a fail-closed\n * path with no fallback. 15s: the payload is a small JSON credential from a service on our own\n * network, and the operation behind it is a user waiting for a file to move.\n /\nconst STS_CREDENTIAL_REQUEST_TIMEOUT_MS = 15_000;\n\n\n/\n Perform the credential fetch and unwrap the response envelope.\n \n Shared by the APPLICATION-plane and PLATFORM-plane resolvers, deliberately: the\n * transport, the timeout, the non-2xx branch and the diagnostic are properties of\n * \"fetching a credential from apps-manager\", not of which door was used. This repo\n * has twice paid for a duplicated path where a guard added to one copy was a silent\n * gap in the other (`buildContextualFilter`, the Mongo/PostgreSQL repositories), and\n * a fail-closed credential path is the worst place to repeat that.\n /\nexport async function requestStsCredentialPayload(input: {\n url: string;\n headers: Record<string, string>;\n}): Promise<unknown> {\n try {\n // Global `fetch`, NOT an HTTP client library — deliberately.\n //\n // `axios` is a `peerDependency: \"\"` of this package, not a dependency, so\n // reaching for it here would have added a runtime dependency to the storage\n // path that previously had none: it resolves today only because pnpm happens\n // to place axios in a reachable tree, and `backend-api` does not declare it at\n // all. A consumer that did not provide axios would fail at storage\n // initialisation — on a fail-closed path with no fallback, for a reason having\n // nothing to do with storage.\n //\n // `fetch` is a Node built-in on every runtime this framework supports, so the\n // storage path depends on nothing it is not guaranteed to have.\n const response = await fetch(input.url, {\n method: 'GET',\n headers: input.headers,\n signal: AbortSignal.timeout(STS_CREDENTIAL_REQUEST_TIMEOUT_MS),\n });\n\n if (!response.ok) {\n // `fetch` resolves on non-2xx rather than rejecting, so this has to be an\n // explicit branch — the classic footgun when porting from a client that\n // throws. Read the body BEFORE giving up on it: apps-manager explains the\n // refusal there, and that explanation is the whole diagnostic.\n const body = await response.text().catch(() => '');\n throw new Error(`status=${response.status}${body ? ` \| body=${body.slice(0, 300)}` : ''}`);\n }\n\n const parsed = await response.json() as { data?: unknown } \| null;\n return parsed?.data ?? parsed;\n } catch (error) {\n // Describe the failure from the HTTP error's OWN fields, not from\n // `describeCaughtError` alone.\n //\n // This wrapper previously read `describeCaughtError(error)` and nothing else,\n // and on 2026-08-10 it produced a message ending in a bare colon — the cause\n // was empty, so the one thing the wrapper exists to surface was the one thing\n // it discarded. Storage is a fail-closed path with no fallback by design, which\n // makes this the ONLY diagnostic a reader gets; an empty one sends them looking\n // at credentials when the fault may be transport, routing, or a non-2xx body.\n throw new Error(\n `Failed to obtain object storage session credentials from apps-manager: ${describeStsFetchFailure(error)}`,\n );\n }\n}\n\n/*\n Validate the credential payload rather than trusting it.\n \n A malformed payload that reached the minio client would surface as an opaque\n * signature error on the first upload, a long way from the response that caused it;\n * a credential with no usable expiry would be cached forever by the provider and\n * then start failing mid-request once the server expired it.\n */\nexport function parseStsCredentialPayload(payload: unknown): ResolvedStorageCredentials {\n const credentials = payload as {\n accessKey?: unknown;\n secretKey?: unknown;\n sessionToken?: unknown;\n expiresAt?: unknown;\n applicationId?: unknown;\n } \| null;\n\n if (\n typeof credentials?.accessKey !== 'string'\n \|\| typeof credentials?.secretKey !== 'string'\n \|\| typeof credentials?.sessionToken !== 'string'\n ) {\n throw new Error('apps-manager returned a malformed object storage session credential.');\n }\n\n const expiresAt = typeof credentials.expiresAt === 'string' ? new Date(credentials.expiresAt) : undefined;\n if (!expiresAt \|\| Number.isNaN(expiresAt.getTime())) {\n throw new Error('apps-manager returned an object storage session credential without a usable expiry.');\n }\n\n return {\n accessKey: credentials.accessKey,\n secretKey: credentials.secretKey,\n sessionToken: credentials.sessionToken,\n expiresAt,\n // Carried through verbatim — the identity the ISSUER confined this credential\n // to. Passed on only when the issuer supplied a usable string; a consumer that\n // needs it must fail closed on absence rather than substitute its own.\n ...(typeof credentials.applicationId === 'string' && credentials.applicationId\n ? { applicationId: credentials.applicationId }\n : {}),\n };\n}\n"]}

package/dist/esm/files/storage/wildo-managed-storage-provider.backend.service.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"wildo-managed-storage-provider.backend.service.d.ts","sourceRoot":"","sources":["~~../../../../../~~src/files/storage/wildo-managed-storage-provider.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAGH,OAAO,EAAE,QAAQ,EAAE,MAAM,QAAQ,CAAC;AAGlC,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAG/D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAClG,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAE9G,OAAO,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AAE/G,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qEAAqE,CAAC;~~AA6C5G~~,OAAO,KAAK,EAA8B,yBAAyB,EAAE,MAAM,4EAA4E,CAAC;~~AAGxJ~~,OAAO,KAAK,EACV,oBAAoB,EACpB,mBAAmB,EACnB,oBAAoB,EACpB,qBAAqB,EACrB,mBAAmB,EACnB,2BAA2B,EAC3B,uBAAuB,EACxB,MAAM,+BAA+B,CAAC;AAqEvC,qBACa,2BAA4B,YAAW,oBAAoB;IA4DpE,OAAO,CAAC,QAAQ,CAAC,MAAM;IAEvB,OAAO,CAAC,QAAQ,CAAC,YAAY;IAE7B,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IACjC;;;;;;;;;;;;;OAaG;IAEH,OAAO,CAAC,QAAQ,CAAC,0BAA0B,CAAC;IA/E9C,QAAQ,CAAC,UAAU,qCAAqC;IACxD,OAAO,CAAC,MAAM,CAAuB;IACrC;;;;;;OAMG;IACH,OAAO,CAAC,eAAe,CAAqB;IAC5C;;;;;;OAMG;IACH,OAAO,CAAC,kBAAkB,CAA0C;IACpE;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,OAAO,KAAK,iBAAiB,GAE5B;IAED;;;;;;OAMG;IACH,OAAO,KAAK,UAAU,GAErB;gBAIkB,MAAM,EAAE,aAAa,EAErB,YAAY,EAAE,0BAA0B,EAExC,gBAAgB,EAAE,uBAAuB;IAC1D;;;;;;;;;;;;;OAaG;IAEc,0BAA0B,CAAC,EAAE,yBAAyB;IAGzE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAoCG;IACH,YAAY,IAAI,OAAO;IAIvB;;;;;;;;OAQG;IACH,OAAO,CAAC,yBAAyB;IA2BjC;;;;;;;;;;OAUG;IACH,OAAO,CAAC,qBAAqB;IAY7B;;;;OAIG;IACG,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAIjC;;;;;;;;;;;;;;;;OAgBG;YACW,iBAAiB;IA+D/B;;;;;OAKG;YACW,SAAS;IA+DvB;;;;;;;;;;;;;;;;OAgBG;YACW,gBAAgB;IAyB9B;;;;;;;;;;;;;;;;;OAiBG;IACH,OAAO,CAAC,mBAAmB;IAO3B;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4BG;IACH,OAAO,CAAC,yBAAyB;~~YA4BnB~~,2BAA2B;~~IA+EzC~~,OAAO,CAAC,mBAAmB;IAqJrB,MAAM,CACV,UAAU,EAAE,QAAQ,EACpB,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,EACZ,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACvC,OAAO,CAAC,EAAE,oBAAoB,GAC7B,OAAO,CAAC,mBAAmB,CAAC;~~IAyFzB~~,QAAQ,CACZ,IAAI,EAAE,uBAAuB,EAC7B,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,GACtC,OAAO,CAAC,qBAAqB,CAAC;IAgD3B,MAAM,CACV,IAAI,EAAE,uBAAuB,EAC7B,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,GACtC,OAAO,CAAC,IAAI,CAAC;IA2BV,WAAW,CACf,IAAI,EAAE,uBAAuB,EAC7B,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,GACtC,OAAO,CAAC,mBAAmB,CAAC;IAyCzB,WAAW,IAAI,OAAO,CAAC,2BAA2B,CAAC;IA0IzD;;;;;;;OAOG;IACH,OAAO,CAAC,qBAAqB;CAgB9B"}
1	+ {"version":3,"file":"wildo-managed-storage-provider.backend.service.d.ts","sourceRoot":"","sources":["../../../../src/files/storage/wildo-managed-storage-provider.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAGH,OAAO,EAAE,QAAQ,EAAE,MAAM,QAAQ,CAAC;AAGlC,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAG/D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAClG,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAE9G,OAAO,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AAE/G,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qEAAqE,CAAC;AAO5G,OAAO,KAAK,EAA8B,yBAAyB,EAAE,MAAM,4EAA4E,CAAC;AASxJ,OAAO,KAAK,EACV,oBAAoB,EACpB,mBAAmB,EACnB,oBAAoB,EACpB,qBAAqB,EACrB,mBAAmB,EACnB,2BAA2B,EAC3B,uBAAuB,EACxB,MAAM,+BAA+B,CAAC;AAqEvC,qBACa,2BAA4B,YAAW,oBAAoB;IA4DpE,OAAO,CAAC,QAAQ,CAAC,MAAM;IAEvB,OAAO,CAAC,QAAQ,CAAC,YAAY;IAE7B,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IACjC;;;;;;;;;;;;;OAaG;IAEH,OAAO,CAAC,QAAQ,CAAC,0BAA0B,CAAC;IA/E9C,QAAQ,CAAC,UAAU,qCAAqC;IACxD,OAAO,CAAC,MAAM,CAAuB;IACrC;;;;;;OAMG;IACH,OAAO,CAAC,eAAe,CAAqB;IAC5C;;;;;;OAMG;IACH,OAAO,CAAC,kBAAkB,CAA0C;IACpE;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,OAAO,KAAK,iBAAiB,GAE5B;IAED;;;;;;OAMG;IACH,OAAO,KAAK,UAAU,GAErB;gBAIkB,MAAM,EAAE,aAAa,EAErB,YAAY,EAAE,0BAA0B,EAExC,gBAAgB,EAAE,uBAAuB;IAC1D;;;;;;;;;;;;;OAaG;IAEc,0BAA0B,CAAC,EAAE,yBAAyB;IAGzE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAoCG;IACH,YAAY,IAAI,OAAO;IAIvB;;;;;;;;OAQG;IACH,OAAO,CAAC,yBAAyB;IA2BjC;;;;;;;;;;OAUG;IACH,OAAO,CAAC,qBAAqB;IAY7B;;;;OAIG;IACG,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAIjC;;;;;;;;;;;;;;;;OAgBG;YACW,iBAAiB;IA+D/B;;;;;OAKG;YACW,SAAS;IA+DvB;;;;;;;;;;;;;;;;OAgBG;YACW,gBAAgB;IAyB9B;;;;;;;;;;;;;;;;;OAiBG;IACH,OAAO,CAAC,mBAAmB;IAO3B;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4BG;IACH,OAAO,CAAC,yBAAyB;YAwBnB,2BAA2B;IA2EzC,OAAO,CAAC,mBAAmB;IAqJrB,MAAM,CACV,UAAU,EAAE,QAAQ,EACpB,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,EACZ,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACvC,OAAO,CAAC,EAAE,oBAAoB,GAC7B,OAAO,CAAC,mBAAmB,CAAC;IAqFzB,QAAQ,CACZ,IAAI,EAAE,uBAAuB,EAC7B,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,GACtC,OAAO,CAAC,qBAAqB,CAAC;IAgD3B,MAAM,CACV,IAAI,EAAE,uBAAuB,EAC7B,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,GACtC,OAAO,CAAC,IAAI,CAAC;IA2BV,WAAW,CACf,IAAI,EAAE,uBAAuB,EAC7B,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,GACtC,OAAO,CAAC,mBAAmB,CAAC;IAyCzB,WAAW,IAAI,OAAO,CAAC,2BAA2B,CAAC;IA0IzD;;;;;;;OAOG;IACH,OAAO,CAAC,qBAAqB;CAgB9B"}