@wildo-ai/saas-backend-lib 1.1.3 → 1.1.4

package/dist/esm/files/storage/google-drive-storage-provider.backend.service.js

@@ -0,0 +1,340 @@
+/**
+ * `FileStorageAccepted.GOOGLE_DRIVE` — a file storage whose bytes live in a PERSON's Google Drive
+ * (#394 P5).
+ *
+ * Every other storage here is the application's: it holds a credential of its own and every row
+ * is reachable with it. This one holds none. A Drive file is reachable through exactly one grant —
+ * the delegated OAuth2 token of the person who linked it (a picker's `REMOTE_REFERENCE`) or
+ * uploaded it — so the row's `uploadedBy` is the credential key, resolved through the same
+ * connected-accounts store and the same admissibility predicate the browser access-token door
+ * uses. A reader who is not the linker still reads the file: the application authorizes the ROW,
+ * and the storage reads the BYTES as the linker, which is the delegated access the person granted
+ * when they connected the account. Each such read is a recorded credential USE.
+ *
+ * Two decisions, written down because they are not the obvious ones:
+ *
+ * - `delete` NEVER touches Drive. The application never owned these bytes: a linked file is the
+ *   person's document, and an uploaded one landed in their Drive under their account. Deleting a
+ *   person's own document because an application row went away is the irreversible act this
+ *   repository requires a deliberate door for, and there is no such door yet. So a delete forgets
+ *   the reference and says so — a stale file in someone's Drive is a nuisance; a vanished one is
+ *   an incident.
+ * - `isConfigured` asks the registry, not the network. There is no application credential to
+ *   probe with, and a per-person storage is "configured" exactly when the provider admits a
+ *   USER-owned delegated connection — the condition under which any row could ever be read.
+ *
+ * Outbound calls go to one fixed vendor host, so they are not SSRF-pinned; each carries a deadline.
+ */
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+import { injectable, inject } from 'inversify';
+import { Readable } from 'stream';
+import { ErrorType, ErrorCustomMessageReference } from '@wildo-ai/saas-models';
+import { FileStorageAccepted, FileUploaderEntityType } from '@wildo-ai/zod-decorators';
+import { SAAS_SERVICE_TYPES } from '../../inject/models/service-types.js';
+import { ErrorBuilderBackendService } from '../../errors/services/error-builder.backend.service.js';
+import { describeCaughtError } from '../../errors/utils/error-log-level-classification.backend.utils.js';
+import { AppConfigurationService } from '../../config/services/app-configuration.backend.service.js';
+import { ExternalProvidersRegistryBackendService } from '../../external-providers/services/external-providers-registry.backend.service.js';
+import { resolveUserDelegatedAccessTokenSlot } from '../../security/connected-accounts/utils/user-delegated-access-token-slot.backend.utils.js';
+import { validateContentType, validateFileId, validateSize, validateStream, resolveConfiguredMaxFileSize } from '../../files/utils/file-validation.utils.js';
+import { resolveFileUploaderPrincipal } from '../../files/utils/file-uploader.utils.js';
+/**
+ * The provider whose delegated credential this storage reads through: the CATALOGUE `google-drive`
+ * provider (`@wildo-ai/providers/google-drive`), whose OAuth2 client a person connects their Drive
+ * through under the `drive.file` scope — not the engine `google` SSO provider, which mints no
+ * delegated token. The frontend `google-drive` module carries the same ref, so the picker, the
+ * access-token door and this storage all name one account.
+ */
+export const GOOGLE_DRIVE_CONNECTED_PROVIDER_REF = 'google-drive';
+/** Drive v3, the only host this storage ever talks to. */
+export const GOOGLE_DRIVE_API_ORIGIN = 'https://www.googleapis.com';
+const GOOGLE_DRIVE_FILES_URL = `${GOOGLE_DRIVE_API_ORIGIN}/drive/v3/files`;
+const GOOGLE_DRIVE_UPLOAD_URL = `${GOOGLE_DRIVE_API_ORIGIN}/upload/drive/v3/files`;
+/** Metadata fields read for a link or a metadata call — the FILES row is built from these. */
+const GOOGLE_DRIVE_METADATA_FIELDS = 'id,name,mimeType,size,modifiedTime,md5Checksum';
+/** One deadline for every call; a download of a large file streams past it only once headers arrived. */
+export const GOOGLE_DRIVE_REQUEST_TIMEOUT_MS = 30_000;
+let GoogleDriveStorageProvider = class GoogleDriveStorageProvider {
+    logger;
+    errorBuilder;
+    appConfigService;
+    registry;
+    userCredentials;
+    providerId = FileStorageAccepted.GOOGLE_DRIVE;
+    connectedProviderRef = GOOGLE_DRIVE_CONNECTED_PROVIDER_REF;
+    /** `delete` forgets the reference and leaves the bytes in the person's Drive — see the header. */
+    retainsBytesOnDelete = true;
+    logDebug;
+    constructor(logger, errorBuilder, appConfigService, registry, userCredentials) {
+        this.logger = logger;
+        this.errorBuilder = errorBuilder;
+        this.appConfigService = appConfigService;
+        this.registry = registry;
+        this.userCredentials = userCredentials;
+        this.logDebug = this.logger.debugByType('GoogleDriveStorageProvider');
+        this.logger.setDebugTypeLogging('GoogleDriveStorageProvider', false);
+    }
+    isConfigured() {
+        // A question, never a throw. The storage router asks EVERY bound provider at readiness in EVERY
+        // runtime, and a platform service (`platform-crontabs-batches-manager`) never initializes the
+        // external-providers registry, so the slot resolution below would trip `ensureInitialized()`
+        // and take the whole storage health check down with it — measured 2026-09-09: crontabs
+        // answered `/health/ready` 503 forever, logging `external_provider_registry_initialization_failed`
+        // every two seconds, from a provider that runtime could not have configured in the first place.
+        if (!this.registry.isReady())
+            return false;
+        return resolveUserDelegatedAccessTokenSlot(this.registry, this.connectedProviderRef).admitted;
+    }
+    async initialize() {
+        // Nothing to open. The "picker listed, storage not configured" diagnostic is NOT here: the
+        // router initializes only configured providers, so a warning on this method never runs. It
+        // lives in the startup validator's storage collector, which sees every provider with the
+        // registry ready (`collectVendorStorageListedWithoutConnectionIssues`).
+        this.logDebug('Google Drive storage ready', { configured: this.isConfigured() });
+    }
+    async healthCheck() {
+        // No probe: there is no application-level credential to probe WITH, and a probe as some
+        // arbitrary person would be a credential use nobody asked for.
+        const configured = this.isConfigured();
+        return {
+            healthy: configured,
+            latency: 0,
+            ...(configured ? {} : { error: `Provider '${this.connectedProviderRef}' does not admit a user-owned delegated connection` }),
+        };
+    }
+    async describeRemoteReference(externalId, linker, executionContext) {
+        const token = await this.resolveLinkerToken(linker, executionContext);
+        const wire = await this.fetchMetadata(externalId, token, executionContext);
+        return this.toDescription(wire, externalId, executionContext);
+    }
+    async upload(fileStream, fileId, mimeType, size, executionContext, options) {
+        validateFileId(fileId, this.errorBuilder, executionContext, 'fileId');
+        validateContentType(mimeType, this.errorBuilder, executionContext, 'mimeType');
+        const maxFileSize = resolveConfiguredMaxFileSize(this.appConfigService.config.storage?.maxFileSize);
+        validateSize(size, maxFileSize, this.errorBuilder, executionContext, 'size');
+        validateStream(fileStream, this.errorBuilder, executionContext, 'fileStream');
+        // An upload lands in the UPLOADER's Drive: the caller is the person, not a row.
+        const token = await this.resolveLinkerToken(resolveFileUploaderPrincipal(executionContext) ?? {}, executionContext);
+        // Drive's multipart upload wants the whole body; a resumable session would avoid buffering at
+        // the cost of two more round trips, and the configured maximum already bounds what is read.
+        const bytes = await readAllBounded(fileStream, maxFileSize, () => this.errorBuilder.buildError(ErrorType.VALIDATION, executionContext, {
+            customMessageReference: ErrorCustomMessageReference.VALIDATION,
+            context: { message: 'Stream exceeded the configured maximum file size', fileId, maxFileSize },
+        }));
+        const boundary = `wildo-${fileId}`;
+        const metadata = JSON.stringify({ name: options?.fileName ?? fileId, mimeType });
+        const body = Buffer.concat([
+            Buffer.from(`--${boundary}\r\nContent-Type: application/json; charset=UTF-8\r\n\r\n${metadata}\r\n--${boundary}\r\nContent-Type: ${mimeType}\r\n\r\n`, 'utf8'),
+            bytes,
+            Buffer.from(`\r\n--${boundary}--`, 'utf8'),
+        ]);
+        const response = await this.call(`${GOOGLE_DRIVE_UPLOAD_URL}?uploadType=multipart&fields=id&supportsAllDrives=true`, { method: 'POST', headers: { authorization: `Bearer ${token}`, 'content-type': `multipart/related; boundary=${boundary}` }, body }, executionContext, { fileId });
+        const wire = (await response.json());
+        const storageRef = typeof wire.id === 'string' && wire.id.length > 0 ? wire.id : undefined;
+        if (storageRef === undefined) {
+            throw this.errorBuilder.buildError(ErrorType.EXTERNAL_SERVICE, executionContext, {
+                customMessageReference: ErrorCustomMessageReference.EXTERNAL_SERVICE,
+                context: { message: 'Google Drive accepted the upload but returned no file id', fileId },
+            });
+        }
+        this.logDebug('Uploaded to Google Drive', { fileId, storageRef });
+        return { storageRef, provider: this.providerId };
+    }
+    async download(file, executionContext) {
+        const externalId = this.requireStorageRef(file, executionContext);
+        const token = await this.resolveLinkerToken(file, executionContext);
+        // Metadata first: `alt=media` answers with the bytes and a content-type, but the size Drive
+        // reports on the media response is not reliable for converted documents, and the row's
+        // consumers size their buffers from this result.
+        const wire = await this.fetchMetadata(externalId, token, executionContext, file.fileId);
+        const description = this.toDescription(wire, externalId, executionContext);
+        const response = await this.call(`${GOOGLE_DRIVE_FILES_URL}/${encodeURIComponent(externalId)}?alt=media&supportsAllDrives=true`, { method: 'GET', headers: { authorization: `Bearer ${token}` } }, executionContext, { fileId: file.fileId, storageRef: externalId });
+        if (response.body === null) {
+            throw this.errorBuilder.buildError(ErrorType.EXTERNAL_SERVICE, executionContext, {
+                customMessageReference: ErrorCustomMessageReference.EXTERNAL_SERVICE,
+                context: { message: 'Google Drive answered a media request with no body', fileId: file.fileId },
+            });
+        }
+        return {
+            stream: Readable.fromWeb(response.body),
+            contentType: response.headers.get('content-type') ?? description.contentType,
+            size: description.size,
+            ...(description.etag !== undefined ? { etag: description.etag } : {}),
+            ...(description.lastModified !== undefined ? { lastModified: description.lastModified } : {}),
+        };
+    }
+    async delete(file, _executionContext) {
+        // Deliberately no vendor call — see the file header. The reference is forgotten with the row.
+        this.logger.info('Google Drive file reference forgotten; the file stays in its owner\'s Drive', {
+            fileId: file.fileId,
+            storageRef: file.storageRef,
+        });
+    }
+    async getMetadata(file, executionContext) {
+        const externalId = this.requireStorageRef(file, executionContext);
+        const token = await this.resolveLinkerToken(file, executionContext);
+        const wire = await this.fetchMetadata(externalId, token, executionContext, file.fileId);
+        const { name: _name, ...metadata } = this.toDescription(wire, externalId, executionContext);
+        return metadata;
+    }
+    // ---------------------------------------------------------------------------
+    /**
+     * The delegated token of the person a target names. Three refusals, each naming what is
+     * missing: the target names no signed-in person; the provider admits no personal connection;
+     * the person's connection is gone. Every success is a recorded credential use.
+     *
+     * assurance-control: WILDO.IDENTITY.DELEGATED_AUTHORIZATION — a person's delegated grant is
+     * spent server-side only, only for a file that person linked or uploaded, and only as a
+     * recorded use; the token never reaches the reader.
+     */
+    async resolveLinkerToken(linker, executionContext) {
+        const identity = this.requireLinker(linker, executionContext);
+        const slot = resolveUserDelegatedAccessTokenSlot(this.registry, this.connectedProviderRef);
+        if (slot.admitted === false) {
+            throw this.errorBuilder.buildError(ErrorType.CONFIGURATION, executionContext, {
+                customMessageReference: ErrorCustomMessageReference.CONFIGURATION,
+                context: {
+                    message: `Google Drive storage needs the '${this.connectedProviderRef}' provider to admit a user-owned delegated connection`,
+                    refusal: slot.refusal,
+                },
+            });
+        }
+        const query = { userId: identity.userId, providerRef: this.connectedProviderRef, secretSlug: slot.secretSlug };
+        const resolution = await this.userCredentials.resolveUserCredential(query);
+        if (resolution === undefined) {
+            throw this.errorBuilder.buildError(ErrorType.AUTHORIZATION, executionContext, {
+                customMessageReference: ErrorCustomMessageReference.FILE_STORAGE_ACCESS_DENIED,
+                context: {
+                    message: `The person this Google Drive file is reachable through has no '${this.connectedProviderRef}' connection`,
+                    userId: identity.userId,
+                },
+            });
+        }
+        await this.userCredentials.recordCredentialUse({ ...query, credentialId: resolution.credentialId });
+        return resolution.value;
+    }
+    requireLinker(linker, executionContext) {
+        if (linker.uploadedByEntityType !== FileUploaderEntityType.USER || !linker.uploadedBy) {
+            throw this.errorBuilder.buildError(ErrorType.AUTHORIZATION, executionContext, {
+                customMessageReference: ErrorCustomMessageReference.FILE_STORAGE_ACCESS_DENIED,
+                context: {
+                    message: 'A Google Drive file is reachable only through the signed-in person who linked or uploaded it, and this one names none',
+                    uploadedByEntityType: linker.uploadedByEntityType,
+                },
+            });
+        }
+        return { userId: linker.uploadedBy };
+    }
+    requireStorageRef(file, executionContext) {
+        if (!file.storageRef) {
+            throw this.errorBuilder.buildError(ErrorType.VALIDATION, executionContext, {
+                customMessageReference: ErrorCustomMessageReference.FILE_STORAGE_REF_INVALID,
+                context: { message: 'Google Drive file row carries no storageRef', fileId: file.fileId },
+            });
+        }
+        return file.storageRef;
+    }
+    async fetchMetadata(externalId, token, executionContext, fileId) {
+        const response = await this.call(`${GOOGLE_DRIVE_FILES_URL}/${encodeURIComponent(externalId)}?fields=${encodeURIComponent(GOOGLE_DRIVE_METADATA_FIELDS)}&supportsAllDrives=true`, { method: 'GET', headers: { authorization: `Bearer ${token}` } }, executionContext, { fileId, storageRef: externalId });
+        return (await response.json());
+    }
+    toDescription(wire, externalId, executionContext) {
+        const contentType = typeof wire.mimeType === 'string' && wire.mimeType.length > 0 ? wire.mimeType : undefined;
+        // Drive reports `size` as a decimal STRING, and omits it for Google-native documents (Docs,
+        // Sheets), which have no bytes until exported. A file with no size cannot be linked as a file.
+        const size = typeof wire.size === 'string' && /^\d+$/.test(wire.size) ? Number(wire.size)
+            : typeof wire.size === 'number' ? wire.size : undefined;
+        if (contentType === undefined || size === undefined) {
+            throw this.errorBuilder.buildError(ErrorType.VALIDATION, executionContext, {
+                customMessageReference: ErrorCustomMessageReference.FILE_STORAGE_REF_INVALID,
+                context: {
+                    message: contentType === undefined
+                        ? 'Google Drive reports no MIME type for this file'
+                        : 'Google Drive reports no byte size for this file — a Google-native document has none until exported',
+                    storageRef: externalId,
+                },
+            });
+        }
+        const lastModified = typeof wire.modifiedTime === 'string' ? new Date(wire.modifiedTime) : undefined;
+        return {
+            name: typeof wire.name === 'string' && wire.name.length > 0 ? wire.name : externalId,
+            contentType,
+            size,
+            ...(typeof wire.md5Checksum === 'string' ? { etag: wire.md5Checksum } : {}),
+            ...(lastModified !== undefined && !Number.isNaN(lastModified.getTime()) ? { lastModified } : {}),
+        };
+    }
+    /** One call shape: fixed host, a deadline, and vendor status codes mapped to this repository's error types. */
+    async call(url, init, executionContext, context) {
+        let response;
+        try {
+            response = await fetch(url, {
+                method: init.method,
+                headers: init.headers,
+                ...(init.body === undefined ? {} : { body: new Uint8Array(init.body) }),
+                signal: AbortSignal.timeout(GOOGLE_DRIVE_REQUEST_TIMEOUT_MS),
+            });
+        }
+        catch (error) {
+            throw this.errorBuilder.buildError(ErrorType.EXTERNAL_SERVICE, executionContext, {
+                customMessageReference: ErrorCustomMessageReference.EXTERNAL_SERVICE,
+                context: { message: 'Google Drive request failed', ...context, error: describeCaughtError(error) },
+            });
+        }
+        if (response.ok)
+            return response;
+        if (response.status === 404) {
+            throw this.errorBuilder.buildError(ErrorType.NOT_FOUND, executionContext, {
+                customMessageReference: ErrorCustomMessageReference.FILE_NOT_FOUND_IN_STORAGE,
+                context: { message: 'Google Drive knows no such file for this person', ...context },
+            });
+        }
+        if (response.status === 401 || response.status === 403) {
+            throw this.errorBuilder.buildError(ErrorType.AUTHORIZATION, executionContext, {
+                customMessageReference: ErrorCustomMessageReference.FILE_STORAGE_ACCESS_DENIED,
+                context: { message: 'Google Drive refused the delegated credential for this file', status: response.status, ...context },
+            });
+        }
+        throw this.errorBuilder.buildError(ErrorType.EXTERNAL_SERVICE, executionContext, {
+            customMessageReference: ErrorCustomMessageReference.EXTERNAL_SERVICE,
+            context: { message: 'Google Drive answered with an error', status: response.status, ...context },
+        });
+    }
+};
+GoogleDriveStorageProvider = __decorate([
+    injectable(),
+    __param(0, inject(SAAS_SERVICE_TYPES.Logger)),
+    __param(1, inject(SAAS_SERVICE_TYPES.ErrorBuilderService)),
+    __param(2, inject(SAAS_SERVICE_TYPES.AppConfigService)),
+    __param(3, inject(SAAS_SERVICE_TYPES.ExternalProvidersRegistryService)),
+    __param(4, inject(SAAS_SERVICE_TYPES.UserProviderCredentialResolver)),
+    __metadata("design:paramtypes", [Function, ErrorBuilderBackendService,
+        AppConfigurationService,
+        ExternalProvidersRegistryBackendService, Object])
+], GoogleDriveStorageProvider);
+export { GoogleDriveStorageProvider };
+/** Drains a stream into one buffer, refusing past `limit` before the whole thing is in memory. */
+async function readAllBounded(stream, limit, overflow) {
+    const chunks = [];
+    let total = 0;
+    for await (const chunk of stream) {
+        const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+        total += buffer.length;
+        if (total > limit)
+            throw overflow();
+        chunks.push(buffer);
+    }
+    return Buffer.concat(chunks);
+}
+//# sourceMappingURL=google-drive-storage-provider.backend.service.js.map

package/dist/esm/files/storage/google-drive-storage-provider.backend.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"google-drive-storage-provider.backend.service.js","sourceRoot":"","sources":["../../../../src/files/storage/google-drive-storage-provider.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;;;;;;;;;;;;;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAC/C,OAAO,EAAE,QAAQ,EAAE,MAAM,QAAQ,CAAC;AAElC,OAAO,EAAE,SAAS,EAAE,2BAA2B,EAAE,MAAM,uBAAuB,CAAC;AAE/E,OAAO,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AACvF,OAAO,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AAEpF,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAC9G,OAAO,EAAE,mBAAmB,EAAE,MAAM,8EAA8E,CAAC;AACnH,OAAO,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AAE/G,OAAO,EAAE,uCAAuC,EAAE,MAAM,4FAA4F,CAAC;AAErJ,OAAO,EAAE,mCAAmC,EAAE,MAAM,qGAAqG,CAAC;AAC1J,OAAO,EAAE,mBAAmB,EAAE,cAAc,EAAE,YAAY,EAAE,cAAc,EAAE,4BAA4B,EAAE,MAAM,sDAAsD,CAAC;AACvK,OAAO,EAAE,4BAA4B,EAAE,MAAM,oDAAoD,CAAC;AAYlG;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,mCAAmC,GAAG,cAAc,CAAC;AAElE,0DAA0D;AAC1D,MAAM,CAAC,MAAM,uBAAuB,GAAG,4BAA4B,CAAC;AACpE,MAAM,sBAAsB,GAAG,GAAG,uBAAuB,iBAAiB,CAAC;AAC3E,MAAM,uBAAuB,GAAG,GAAG,uBAAuB,wBAAwB,CAAC;AACnF,8FAA8F;AAC9F,MAAM,4BAA4B,GAAG,gDAAgD,CAAC;AACtF,yGAAyG;AACzG,MAAM,CAAC,MAAM,+BAA+B,GAAG,MAAM,CAAC;AAiB/C,IAAM,0BAA0B,GAAhC,MAAM,0BAA0B;IAQiB;IACa;IACH;IACgB;IACF;IAXrE,UAAU,GAAG,mBAAmB,CAAC,YAAY,CAAC;IAC9C,oBAAoB,GAAG,mCAAmC,CAAC;IACpE,kGAAkG;IACzF,oBAAoB,GAAG,IAAI,CAAC;IACpB,QAAQ,CAA+D;IAExF,YACsD,MAAqB,EACR,YAAwC,EAC3C,gBAAyC,EACzB,QAAiD,EACnD,eAAmD;QAJ3E,WAAM,GAAN,MAAM,CAAe;QACR,iBAAY,GAAZ,YAAY,CAA4B;QAC3C,qBAAgB,GAAhB,gBAAgB,CAAyB;QACzB,aAAQ,GAAR,QAAQ,CAAyC;QACnD,oBAAe,GAAf,eAAe,CAAoC;QAE/H,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,4BAA4B,CAAC,CAAC;QACtE,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,4BAA4B,EAAE,KAAK,CAAC,CAAC;IACvE,CAAC;IAED,YAAY;QACV,gGAAgG;QAChG,8FAA8F;QAC9F,6FAA6F;QAC7F,uFAAuF;QACvF,mGAAmG;QACnG,gGAAgG;QAChG,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE;YAAE,OAAO,KAAK,CAAC;QAC3C,OAAO,mCAAmC,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,oBAAoB,CAAC,CAAC,QAAQ,CAAC;IAChG,CAAC;IAED,KAAK,CAAC,UAAU;QACd,2FAA2F;QAC3F,2FAA2F;QAC3F,yFAAyF;QACzF,wEAAwE;QACxE,IAAI,CAAC,QAAQ,CAAC,4BAA4B,EAAE,EAAE,UAAU,EAAE,IAAI,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;IACnF,CAAC;IAED,KAAK,CAAC,WAAW;QACf,wFAAwF;QACxF,+DAA+D;QAC/D,MAAM,UAAU,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;QACvC,OAAO;YACL,OAAO,EAAE,UAAU;YACnB,OAAO,EAAE,CAAC;YACV,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,aAAa,IAAI,CAAC,oBAAoB,oDAAoD,EAAE,CAAC;SAC7H,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,uBAAuB,CAC3B,UAAkB,EAClB,MAAyD,EACzD,gBAAuC;QAEvC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;QACtE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,UAAU,EAAE,KAAK,EAAE,gBAAgB,CAAC,CAAC;QAC3E,OAAO,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,UAAU,EAAE,gBAAgB,CAAC,CAAC;IAChE,CAAC;IAED,KAAK,CAAC,MAAM,CACV,UAAoB,EACpB,MAAc,EACd,QAAgB,EAChB,IAAY,EACZ,gBAAuC,EACvC,OAA8B;QAE9B,cAAc,CAAC,MAAM,EAAE,IAAI,CAAC,YAAY,EAAE,gBAAgB,EAAE,QAAQ,CAAC,CAAC;QACtE,mBAAmB,CAAC,QAAQ,EAAE,IAAI,CAAC,YAAY,EAAE,gBAAgB,EAAE,UAAU,CAAC,CAAC;QAC/E,MAAM,WAAW,GAAG,4BAA4B,CAAC,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;QACpG,YAAY,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,YAAY,EAAE,gBAAgB,EAAE,MAAM,CAAC,CAAC;QAC7E,cAAc,CAAC,UAAU,EAAE,IAAI,CAAC,YAAY,EAAE,gBAAgB,EAAE,YAAY,CAAC,CAAC;QAE9E,gFAAgF;QAChF,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,4BAA4B,CAAC,gBAAgB,CAAC,IAAI,EAAE,EAAE,gBAAgB,CAAC,CAAC;QAEpH,8FAA8F;QAC9F,4FAA4F;QAC5F,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,UAAU,EAAE,WAAW,EAAE,GAAG,EAAE,CAC/D,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,gBAAgB,EAAE;YACnE,sBAAsB,EAAE,2BAA2B,CAAC,UAAU;YAC9D,OAAO,EAAE,EAAE,OAAO,EAAE,kDAAkD,EAAE,MAAM,EAAE,WAAW,EAAE;SAC9F,CAAC,CAAC,CAAC;QAEN,MAAM,QAAQ,GAAG,SAAS,MAAM,EAAE,CAAC;QACnC,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,IAAI,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;QACjF,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC;YACzB,MAAM,CAAC,IAAI,CAAC,KAAK,QAAQ,4DAA4D,QAAQ,SAAS,QAAQ,qBAAqB,QAAQ,UAAU,EAAE,MAAM,CAAC;YAC9J,KAAK;YACL,MAAM,CAAC,IAAI,CAAC,SAAS,QAAQ,IAAI,EAAE,MAAM,CAAC;SAC3C,CAAC,CAAC;QAEH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAC9B,GAAG,uBAAuB,wDAAwD,EAClF,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE,cAAc,EAAE,+BAA+B,QAAQ,EAAE,EAAE,EAAE,IAAI,EAAE,EAClI,gBAAgB,EAChB,EAAE,MAAM,EAAE,CACX,CAAC;QACF,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAA0B,CAAC;QAC9D,MAAM,UAAU,GAAG,OAAO,IAAI,CAAC,EAAE,KAAK,QAAQ,IAAI,IAAI,CAAC,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;QAC3F,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YAC7B,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,gBAAgB,EAAE,gBAAgB,EAAE;gBAC/E,sBAAsB,EAAE,2BAA2B,CAAC,gBAAgB;gBACpE,OAAO,EAAE,EAAE,OAAO,EAAE,0DAA0D,EAAE,MAAM,EAAE;aACzF,CAAC,CAAC;QACL,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,0BAA0B,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;QAClE,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC;IACnD,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,IAA6B,EAAE,gBAAuC;QACnF,MAAM,UAAU,GAAG,IAAI,CAAC,iBAAiB,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC;QAClE,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC;QACpE,4FAA4F;QAC5F,uFAAuF;QACvF,iDAAiD;QACjD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,UAAU,EAAE,KAAK,EAAE,gBAAgB,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QACxF,MAAM,WAAW,GAAG,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,UAAU,EAAE,gBAAgB,CAAC,CAAC;QAC3E,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAC9B,GAAG,sBAAsB,IAAI,kBAAkB,CAAC,UAAU,CAAC,mCAAmC,EAC9F,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE,EAAE,EAChE,gBAAgB,EAChB,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,CAChD,CAAC;QACF,IAAI,QAAQ,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;YAC3B,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,gBAAgB,EAAE,gBAAgB,EAAE;gBAC/E,sBAAsB,EAAE,2BAA2B,CAAC,gBAAgB;gBACpE,OAAO,EAAE,EAAE,OAAO,EAAE,oDAAoD,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE;aAChG,CAAC,CAAC;QACL,CAAC;QACD,OAAO;YACL,MAAM,EAAE,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAgD,CAAC;YACnF,WAAW,EAAE,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,WAAW,CAAC,WAAW;YAC5E,IAAI,EAAE,WAAW,CAAC,IAAI;YACtB,GAAG,CAAC,WAAW,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrE,GAAG,CAAC,WAAW,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,WAAW,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC9F,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,IAA6B,EAAE,iBAAwC;QAClF,8FAA8F;QAC9F,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,6EAA6E,EAAE;YAC9F,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,UAAU,EAAE,IAAI,CAAC,UAAU;SAC5B,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,IAA6B,EAAE,gBAAuC;QACtF,MAAM,UAAU,GAAG,IAAI,CAAC,iBAAiB,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC;QAClE,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC;QACpE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,UAAU,EAAE,KAAK,EAAE,gBAAgB,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QACxF,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,QAAQ,EAAE,GAAG,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,UAAU,EAAE,gBAAgB,CAAC,CAAC;QAC5F,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,8EAA8E;IAE9E;;;;;;;;OAQG;IACK,KAAK,CAAC,kBAAkB,CAC9B,MAAyD,EACzD,gBAAuC;QAEvC,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;QAC9D,MAAM,IAAI,GAAG,mCAAmC,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,oBAAoB,CAAC,CAAC;QAC3F,IAAI,IAAI,CAAC,QAAQ,KAAK,KAAK,EAAE,CAAC;YAC5B,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,gBAAgB,EAAE;gBAC5E,sBAAsB,EAAE,2BAA2B,CAAC,aAAa;gBACjE,OAAO,EAAE;oBACP,OAAO,EAAE,mCAAmC,IAAI,CAAC,oBAAoB,uDAAuD;oBAC5H,OAAO,EAAE,IAAI,CAAC,OAAO;iBACtB;aACF,CAAC,CAAC;QACL,CAAC;QACD,MAAM,KAAK,GAAG,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,WAAW,EAAE,IAAI,CAAC,oBAAoB,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC;QAC/G,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAAC;QAC3E,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YAC7B,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,gBAAgB,EAAE;gBAC5E,sBAAsB,EAAE,2BAA2B,CAAC,0BAA0B;gBAC9E,OAAO,EAAE;oBACP,OAAO,EAAE,kEAAkE,IAAI,CAAC,oBAAoB,cAAc;oBAClH,MAAM,EAAE,QAAQ,CAAC,MAAM;iBACxB;aACF,CAAC,CAAC;QACL,CAAC;QACD,MAAM,IAAI,CAAC,eAAe,CAAC,mBAAmB,CAAC,EAAE,GAAG,KAAK,EAAE,YAAY,EAAE,UAAU,CAAC,YAAY,EAAE,CAAC,CAAC;QACpG,OAAO,UAAU,CAAC,KAAK,CAAC;IAC1B,CAAC;IAEO,aAAa,CAAC,MAAyD,EAAE,gBAAuC;QACtH,IAAI,MAAM,CAAC,oBAAoB,KAAK,sBAAsB,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;YACtF,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,gBAAgB,EAAE;gBAC5E,sBAAsB,EAAE,2BAA2B,CAAC,0BAA0B;gBAC9E,OAAO,EAAE;oBACP,OAAO,EAAE,uHAAuH;oBAChI,oBAAoB,EAAE,MAAM,CAAC,oBAAoB;iBAClD;aACF,CAAC,CAAC;QACL,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC;IACvC,CAAC;IAEO,iBAAiB,CAAC,IAA6B,EAAE,gBAAuC;QAC9F,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;YACrB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,gBAAgB,EAAE;gBACzE,sBAAsB,EAAE,2BAA2B,CAAC,wBAAwB;gBAC5E,OAAO,EAAE,EAAE,OAAO,EAAE,6CAA6C,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE;aACzF,CAAC,CAAC;QACL,CAAC;QACD,OAAO,IAAI,CAAC,UAAU,CAAC;IACzB,CAAC;IAEO,KAAK,CAAC,aAAa,CAAC,UAAkB,EAAE,KAAa,EAAE,gBAAuC,EAAE,MAAe;QACrH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAC9B,GAAG,sBAAsB,IAAI,kBAAkB,CAAC,UAAU,CAAC,WAAW,kBAAkB,CAAC,4BAA4B,CAAC,yBAAyB,EAC/I,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE,EAAE,EAChE,gBAAgB,EAChB,EAAE,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,CACnC,CAAC;QACF,OAAO,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAA0B,CAAC;IAC1D,CAAC;IAEO,aAAa,CAAC,IAA2B,EAAE,UAAkB,EAAE,gBAAuC;QAC5G,MAAM,WAAW,GAAG,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;QAC9G,4FAA4F;QAC5F,+FAA+F;QAC/F,MAAM,IAAI,GAAG,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC;YACvF,CAAC,CAAC,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;QAC1D,IAAI,WAAW,KAAK,SAAS,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACpD,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,gBAAgB,EAAE;gBACzE,sBAAsB,EAAE,2BAA2B,CAAC,wBAAwB;gBAC5E,OAAO,EAAE;oBACP,OAAO,EAAE,WAAW,KAAK,SAAS;wBAChC,CAAC,CAAC,iDAAiD;wBACnD,CAAC,CAAC,oGAAoG;oBACxG,UAAU,EAAE,UAAU;iBACvB;aACF,CAAC,CAAC;QACL,CAAC;QACD,MAAM,YAAY,GAAG,OAAO,IAAI,CAAC,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACrG,OAAO;YACL,IAAI,EAAE,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU;YACpF,WAAW;YACX,IAAI;YACJ,GAAG,CAAC,OAAO,IAAI,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3E,GAAG,CAAC,YAAY,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACjG,CAAC;IACJ,CAAC;IAED,+GAA+G;IACvG,KAAK,CAAC,IAAI,CAChB,GAAW,EACX,IAAwE,EACxE,gBAAuC,EACvC,OAAgC;QAEhC,IAAI,QAAkB,CAAC;QACvB,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;gBAC1B,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBACvE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,+BAA+B,CAAC;aAC7D,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,gBAAgB,EAAE,gBAAgB,EAAE;gBAC/E,sBAAsB,EAAE,2BAA2B,CAAC,gBAAgB;gBACpE,OAAO,EAAE,EAAE,OAAO,EAAE,6BAA6B,EAAE,GAAG,OAAO,EAAE,KAAK,EAAE,mBAAmB,CAAC,KAAK,CAAC,EAAE;aACnG,CAAC,CAAC;QACL,CAAC;QACD,IAAI,QAAQ,CAAC,EAAE;YAAE,OAAO,QAAQ,CAAC;QACjC,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YAC5B,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,SAAS,EAAE,gBAAgB,EAAE;gBACxE,sBAAsB,EAAE,2BAA2B,CAAC,yBAAyB;gBAC7E,OAAO,EAAE,EAAE,OAAO,EAAE,iDAAiD,EAAE,GAAG,OAAO,EAAE;aACpF,CAAC,CAAC;QACL,CAAC;QACD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACvD,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,gBAAgB,EAAE;gBAC5E,sBAAsB,EAAE,2BAA2B,CAAC,0BAA0B;gBAC9E,OAAO,EAAE,EAAE,OAAO,EAAE,6DAA6D,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,GAAG,OAAO,EAAE;aACzH,CAAC,CAAC;QACL,CAAC;QACD,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,gBAAgB,EAAE,gBAAgB,EAAE;YAC/E,sBAAsB,EAAE,2BAA2B,CAAC,gBAAgB;YACpE,OAAO,EAAE,EAAE,OAAO,EAAE,qCAAqC,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,GAAG,OAAO,EAAE;SACjG,CAAC,CAAC;IACL,CAAC;CACF,CAAA;AAtSY,0BAA0B;IADtC,UAAU,EAAE;IASR,WAAA,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAA;IACjC,WAAA,MAAM,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,CAAA;IAC9C,WAAA,MAAM,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,CAAA;IAC3C,WAAA,MAAM,CAAC,kBAAkB,CAAC,gCAAgC,CAAC,CAAA;IAC3D,WAAA,MAAM,CAAC,kBAAkB,CAAC,8BAA8B,CAAC,CAAA;+CAHqB,0BAA0B;QACzB,uBAAuB;QACf,uCAAuC;GAXtH,0BAA0B,CAsStC;;AAED,kGAAkG;AAClG,KAAK,UAAU,cAAc,CAAC,MAAgB,EAAE,KAAa,EAAE,QAAuB;IACpF,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QACjC,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAA4B,CAAC,CAAC;QAC1F,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC;QACvB,IAAI,KAAK,GAAG,KAAK;YAAE,MAAM,QAAQ,EAAE,CAAC;QACpC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACtB,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;AAC/B,CAAC","sourcesContent":["/**\n * `FileStorageAccepted.GOOGLE_DRIVE` — a file storage whose bytes live in a PERSON's Google Drive\n * (#394 P5).\n *\n * Every other storage here is the application's: it holds a credential of its own and every row\n * is reachable with it. This one holds none. A Drive file is reachable through exactly one grant —\n * the delegated OAuth2 token of the person who linked it (a picker's `REMOTE_REFERENCE`) or\n * uploaded it — so the row's `uploadedBy` is the credential key, resolved through the same\n * connected-accounts store and the same admissibility predicate the browser access-token door\n * uses. A reader who is not the linker still reads the file: the application authorizes the ROW,\n * and the storage reads the BYTES as the linker, which is the delegated access the person granted\n * when they connected the account. Each such read is a recorded credential USE.\n *\n * Two decisions, written down because they are not the obvious ones:\n *\n * - `delete` NEVER touches Drive. The application never owned these bytes: a linked file is the\n *   person's document, and an uploaded one landed in their Drive under their account. Deleting a\n *   person's own document because an application row went away is the irreversible act this\n *   repository requires a deliberate door for, and there is no such door yet. So a delete forgets\n *   the reference and says so — a stale file in someone's Drive is a nuisance; a vanished one is\n *   an incident.\n * - `isConfigured` asks the registry, not the network. There is no application credential to\n *   probe with, and a per-person storage is \"configured\" exactly when the provider admits a\n *   USER-owned delegated connection — the condition under which any row could ever be read.\n *\n * Outbound calls go to one fixed vendor host, so they are not SSRF-pinned; each carries a deadline.\n */\n\nimport { injectable, inject } from 'inversify';\nimport { Readable } from 'stream';\nimport type { ReadableStream as WebReadableStream } from 'stream/web';\nimport { ErrorType, ErrorCustomMessageReference } from '@wildo-ai/saas-models';\nimport type { File } from '@wildo-ai/saas-models';\nimport { FileStorageAccepted, FileUploaderEntityType } from '@wildo-ai/zod-decorators';\nimport { SAAS_SERVICE_TYPES } from '~wildo-backend-lib/inject/models/service-types';\nimport type { LoggerService } from '~wildo-backend-lib/monitoring/logger/services/logger.service';\nimport { ErrorBuilderBackendService } from '~wildo-backend-lib/errors/services/error-builder.backend.service';\nimport { describeCaughtError } from '~wildo-backend-lib/errors/utils/error-log-level-classification.backend.utils';\nimport { AppConfigurationService } from '~wildo-backend-lib/config/services/app-configuration.backend.service';\nimport type { ExecutionContext } from '~wildo-backend-lib/runtime/models/execution-context.backend.schemas';\nimport { ExternalProvidersRegistryBackendService } from '~wildo-backend-lib/external-providers/services/external-providers-registry.backend.service';\nimport type { UserProviderCredentialResolverPort } from '~wildo-backend-lib/security/connected-accounts/user-provider-credential-resolver.port';\nimport { resolveUserDelegatedAccessTokenSlot } from '~wildo-backend-lib/security/connected-accounts/utils/user-delegated-access-token-slot.backend.utils';\nimport { validateContentType, validateFileId, validateSize, validateStream, resolveConfiguredMaxFileSize } from '~wildo-backend-lib/files/utils/file-validation.utils';\nimport { resolveFileUploaderPrincipal } from '~wildo-backend-lib/files/utils/file-uploader.utils';\nimport type {\n  IFileStorageProvider,\n  StorageDownloadResult,\n  StorageFileMetadata,\n  StorageProviderHealthResult,\n  StorageRemoteFileDescription,\n  StorageUploadOptions,\n  StorageUploadResult,\n  StoredFileStorageTarget,\n} from './file-storage-provider.types';\n\n/**\n * The provider whose delegated credential this storage reads through: the CATALOGUE `google-drive`\n * provider (`@wildo-ai/providers/google-drive`), whose OAuth2 client a person connects their Drive\n * through under the `drive.file` scope — not the engine `google` SSO provider, which mints no\n * delegated token. The frontend `google-drive` module carries the same ref, so the picker, the\n * access-token door and this storage all name one account.\n */\nexport const GOOGLE_DRIVE_CONNECTED_PROVIDER_REF = 'google-drive';\n\n/** Drive v3, the only host this storage ever talks to. */\nexport const GOOGLE_DRIVE_API_ORIGIN = 'https://www.googleapis.com';\nconst GOOGLE_DRIVE_FILES_URL = `${GOOGLE_DRIVE_API_ORIGIN}/drive/v3/files`;\nconst GOOGLE_DRIVE_UPLOAD_URL = `${GOOGLE_DRIVE_API_ORIGIN}/upload/drive/v3/files`;\n/** Metadata fields read for a link or a metadata call — the FILES row is built from these. */\nconst GOOGLE_DRIVE_METADATA_FIELDS = 'id,name,mimeType,size,modifiedTime,md5Checksum';\n/** One deadline for every call; a download of a large file streams past it only once headers arrived. */\nexport const GOOGLE_DRIVE_REQUEST_TIMEOUT_MS = 30_000;\n\ninterface DriveFileMetadataWire {\n  id?: unknown;\n  name?: unknown;\n  mimeType?: unknown;\n  size?: unknown;\n  modifiedTime?: unknown;\n  md5Checksum?: unknown;\n}\n\n/** The linker a target names, once it has been checked to be a signed-in person. */\ninterface LinkerIdentity {\n  readonly userId: string;\n}\n\n@injectable()\nexport class GoogleDriveStorageProvider implements IFileStorageProvider {\n  readonly providerId = FileStorageAccepted.GOOGLE_DRIVE;\n  readonly connectedProviderRef = GOOGLE_DRIVE_CONNECTED_PROVIDER_REF;\n  /** `delete` forgets the reference and leaves the bytes in the person's Drive — see the header. */\n  readonly retainsBytesOnDelete = true;\n  private readonly logDebug: (message: string, context?: Record<string, unknown>) => void;\n\n  constructor(\n    @inject(SAAS_SERVICE_TYPES.Logger) private readonly logger: LoggerService,\n    @inject(SAAS_SERVICE_TYPES.ErrorBuilderService) private readonly errorBuilder: ErrorBuilderBackendService,\n    @inject(SAAS_SERVICE_TYPES.AppConfigService) private readonly appConfigService: AppConfigurationService,\n    @inject(SAAS_SERVICE_TYPES.ExternalProvidersRegistryService) private readonly registry: ExternalProvidersRegistryBackendService,\n    @inject(SAAS_SERVICE_TYPES.UserProviderCredentialResolver) private readonly userCredentials: UserProviderCredentialResolverPort,\n  ) {\n    this.logDebug = this.logger.debugByType('GoogleDriveStorageProvider');\n    this.logger.setDebugTypeLogging('GoogleDriveStorageProvider', false);\n  }\n\n  isConfigured(): boolean {\n    // A question, never a throw. The storage router asks EVERY bound provider at readiness in EVERY\n    // runtime, and a platform service (`platform-crontabs-batches-manager`) never initializes the\n    // external-providers registry, so the slot resolution below would trip `ensureInitialized()`\n    // and take the whole storage health check down with it — measured 2026-09-09: crontabs\n    // answered `/health/ready` 503 forever, logging `external_provider_registry_initialization_failed`\n    // every two seconds, from a provider that runtime could not have configured in the first place.\n    if (!this.registry.isReady()) return false;\n    return resolveUserDelegatedAccessTokenSlot(this.registry, this.connectedProviderRef).admitted;\n  }\n\n  async initialize(): Promise<void> {\n    // Nothing to open. The \"picker listed, storage not configured\" diagnostic is NOT here: the\n    // router initializes only configured providers, so a warning on this method never runs. It\n    // lives in the startup validator's storage collector, which sees every provider with the\n    // registry ready (`collectVendorStorageListedWithoutConnectionIssues`).\n    this.logDebug('Google Drive storage ready', { configured: this.isConfigured() });\n  }\n\n  async healthCheck(): Promise<StorageProviderHealthResult> {\n    // No probe: there is no application-level credential to probe WITH, and a probe as some\n    // arbitrary person would be a credential use nobody asked for.\n    const configured = this.isConfigured();\n    return {\n      healthy: configured,\n      latency: 0,\n      ...(configured ? {} : { error: `Provider '${this.connectedProviderRef}' does not admit a user-owned delegated connection` }),\n    };\n  }\n\n  async describeRemoteReference(\n    externalId: string,\n    linker: Pick<File, 'uploadedBy' | 'uploadedByEntityType'>,\n    executionContext: ExecutionContext<any>,\n  ): Promise<StorageRemoteFileDescription> {\n    const token = await this.resolveLinkerToken(linker, executionContext);\n    const wire = await this.fetchMetadata(externalId, token, executionContext);\n    return this.toDescription(wire, externalId, executionContext);\n  }\n\n  async upload(\n    fileStream: Readable,\n    fileId: string,\n    mimeType: string,\n    size: number,\n    executionContext: ExecutionContext<any>,\n    options?: StorageUploadOptions,\n  ): Promise<StorageUploadResult> {\n    validateFileId(fileId, this.errorBuilder, executionContext, 'fileId');\n    validateContentType(mimeType, this.errorBuilder, executionContext, 'mimeType');\n    const maxFileSize = resolveConfiguredMaxFileSize(this.appConfigService.config.storage?.maxFileSize);\n    validateSize(size, maxFileSize, this.errorBuilder, executionContext, 'size');\n    validateStream(fileStream, this.errorBuilder, executionContext, 'fileStream');\n\n    // An upload lands in the UPLOADER's Drive: the caller is the person, not a row.\n    const token = await this.resolveLinkerToken(resolveFileUploaderPrincipal(executionContext) ?? {}, executionContext);\n\n    // Drive's multipart upload wants the whole body; a resumable session would avoid buffering at\n    // the cost of two more round trips, and the configured maximum already bounds what is read.\n    const bytes = await readAllBounded(fileStream, maxFileSize, () =>\n      this.errorBuilder.buildError(ErrorType.VALIDATION, executionContext, {\n        customMessageReference: ErrorCustomMessageReference.VALIDATION,\n        context: { message: 'Stream exceeded the configured maximum file size', fileId, maxFileSize },\n      }));\n\n    const boundary = `wildo-${fileId}`;\n    const metadata = JSON.stringify({ name: options?.fileName ?? fileId, mimeType });\n    const body = Buffer.concat([\n      Buffer.from(`--${boundary}\\r\\nContent-Type: application/json; charset=UTF-8\\r\\n\\r\\n${metadata}\\r\\n--${boundary}\\r\\nContent-Type: ${mimeType}\\r\\n\\r\\n`, 'utf8'),\n      bytes,\n      Buffer.from(`\\r\\n--${boundary}--`, 'utf8'),\n    ]);\n\n    const response = await this.call(\n      `${GOOGLE_DRIVE_UPLOAD_URL}?uploadType=multipart&fields=id&supportsAllDrives=true`,\n      { method: 'POST', headers: { authorization: `Bearer ${token}`, 'content-type': `multipart/related; boundary=${boundary}` }, body },\n      executionContext,\n      { fileId },\n    );\n    const wire = (await response.json()) as DriveFileMetadataWire;\n    const storageRef = typeof wire.id === 'string' && wire.id.length > 0 ? wire.id : undefined;\n    if (storageRef === undefined) {\n      throw this.errorBuilder.buildError(ErrorType.EXTERNAL_SERVICE, executionContext, {\n        customMessageReference: ErrorCustomMessageReference.EXTERNAL_SERVICE,\n        context: { message: 'Google Drive accepted the upload but returned no file id', fileId },\n      });\n    }\n    this.logDebug('Uploaded to Google Drive', { fileId, storageRef });\n    return { storageRef, provider: this.providerId };\n  }\n\n  async download(file: StoredFileStorageTarget, executionContext: ExecutionContext<any>): Promise<StorageDownloadResult> {\n    const externalId = this.requireStorageRef(file, executionContext);\n    const token = await this.resolveLinkerToken(file, executionContext);\n    // Metadata first: `alt=media` answers with the bytes and a content-type, but the size Drive\n    // reports on the media response is not reliable for converted documents, and the row's\n    // consumers size their buffers from this result.\n    const wire = await this.fetchMetadata(externalId, token, executionContext, file.fileId);\n    const description = this.toDescription(wire, externalId, executionContext);\n    const response = await this.call(\n      `${GOOGLE_DRIVE_FILES_URL}/${encodeURIComponent(externalId)}?alt=media&supportsAllDrives=true`,\n      { method: 'GET', headers: { authorization: `Bearer ${token}` } },\n      executionContext,\n      { fileId: file.fileId, storageRef: externalId },\n    );\n    if (response.body === null) {\n      throw this.errorBuilder.buildError(ErrorType.EXTERNAL_SERVICE, executionContext, {\n        customMessageReference: ErrorCustomMessageReference.EXTERNAL_SERVICE,\n        context: { message: 'Google Drive answered a media request with no body', fileId: file.fileId },\n      });\n    }\n    return {\n      stream: Readable.fromWeb(response.body as unknown as WebReadableStream<Uint8Array>),\n      contentType: response.headers.get('content-type') ?? description.contentType,\n      size: description.size,\n      ...(description.etag !== undefined ? { etag: description.etag } : {}),\n      ...(description.lastModified !== undefined ? { lastModified: description.lastModified } : {}),\n    };\n  }\n\n  async delete(file: StoredFileStorageTarget, _executionContext: ExecutionContext<any>): Promise<void> {\n    // Deliberately no vendor call — see the file header. The reference is forgotten with the row.\n    this.logger.info('Google Drive file reference forgotten; the file stays in its owner\\'s Drive', {\n      fileId: file.fileId,\n      storageRef: file.storageRef,\n    });\n  }\n\n  async getMetadata(file: StoredFileStorageTarget, executionContext: ExecutionContext<any>): Promise<StorageFileMetadata> {\n    const externalId = this.requireStorageRef(file, executionContext);\n    const token = await this.resolveLinkerToken(file, executionContext);\n    const wire = await this.fetchMetadata(externalId, token, executionContext, file.fileId);\n    const { name: _name, ...metadata } = this.toDescription(wire, externalId, executionContext);\n    return metadata;\n  }\n\n  // ---------------------------------------------------------------------------\n\n  /**\n   * The delegated token of the person a target names. Three refusals, each naming what is\n   * missing: the target names no signed-in person; the provider admits no personal connection;\n   * the person's connection is gone. Every success is a recorded credential use.\n   *\n   * assurance-control: WILDO.IDENTITY.DELEGATED_AUTHORIZATION — a person's delegated grant is\n   * spent server-side only, only for a file that person linked or uploaded, and only as a\n   * recorded use; the token never reaches the reader.\n   */\n  private async resolveLinkerToken(\n    linker: Pick<File, 'uploadedBy' | 'uploadedByEntityType'>,\n    executionContext: ExecutionContext<any>,\n  ): Promise<string> {\n    const identity = this.requireLinker(linker, executionContext);\n    const slot = resolveUserDelegatedAccessTokenSlot(this.registry, this.connectedProviderRef);\n    if (slot.admitted === false) {\n      throw this.errorBuilder.buildError(ErrorType.CONFIGURATION, executionContext, {\n        customMessageReference: ErrorCustomMessageReference.CONFIGURATION,\n        context: {\n          message: `Google Drive storage needs the '${this.connectedProviderRef}' provider to admit a user-owned delegated connection`,\n          refusal: slot.refusal,\n        },\n      });\n    }\n    const query = { userId: identity.userId, providerRef: this.connectedProviderRef, secretSlug: slot.secretSlug };\n    const resolution = await this.userCredentials.resolveUserCredential(query);\n    if (resolution === undefined) {\n      throw this.errorBuilder.buildError(ErrorType.AUTHORIZATION, executionContext, {\n        customMessageReference: ErrorCustomMessageReference.FILE_STORAGE_ACCESS_DENIED,\n        context: {\n          message: `The person this Google Drive file is reachable through has no '${this.connectedProviderRef}' connection`,\n          userId: identity.userId,\n        },\n      });\n    }\n    await this.userCredentials.recordCredentialUse({ ...query, credentialId: resolution.credentialId });\n    return resolution.value;\n  }\n\n  private requireLinker(linker: Pick<File, 'uploadedBy' | 'uploadedByEntityType'>, executionContext: ExecutionContext<any>): LinkerIdentity {\n    if (linker.uploadedByEntityType !== FileUploaderEntityType.USER || !linker.uploadedBy) {\n      throw this.errorBuilder.buildError(ErrorType.AUTHORIZATION, executionContext, {\n        customMessageReference: ErrorCustomMessageReference.FILE_STORAGE_ACCESS_DENIED,\n        context: {\n          message: 'A Google Drive file is reachable only through the signed-in person who linked or uploaded it, and this one names none',\n          uploadedByEntityType: linker.uploadedByEntityType,\n        },\n      });\n    }\n    return { userId: linker.uploadedBy };\n  }\n\n  private requireStorageRef(file: StoredFileStorageTarget, executionContext: ExecutionContext<any>): string {\n    if (!file.storageRef) {\n      throw this.errorBuilder.buildError(ErrorType.VALIDATION, executionContext, {\n        customMessageReference: ErrorCustomMessageReference.FILE_STORAGE_REF_INVALID,\n        context: { message: 'Google Drive file row carries no storageRef', fileId: file.fileId },\n      });\n    }\n    return file.storageRef;\n  }\n\n  private async fetchMetadata(externalId: string, token: string, executionContext: ExecutionContext<any>, fileId?: string): Promise<DriveFileMetadataWire> {\n    const response = await this.call(\n      `${GOOGLE_DRIVE_FILES_URL}/${encodeURIComponent(externalId)}?fields=${encodeURIComponent(GOOGLE_DRIVE_METADATA_FIELDS)}&supportsAllDrives=true`,\n      { method: 'GET', headers: { authorization: `Bearer ${token}` } },\n      executionContext,\n      { fileId, storageRef: externalId },\n    );\n    return (await response.json()) as DriveFileMetadataWire;\n  }\n\n  private toDescription(wire: DriveFileMetadataWire, externalId: string, executionContext: ExecutionContext<any>): StorageRemoteFileDescription {\n    const contentType = typeof wire.mimeType === 'string' && wire.mimeType.length > 0 ? wire.mimeType : undefined;\n    // Drive reports `size` as a decimal STRING, and omits it for Google-native documents (Docs,\n    // Sheets), which have no bytes until exported. A file with no size cannot be linked as a file.\n    const size = typeof wire.size === 'string' && /^\\d+$/.test(wire.size) ? Number(wire.size)\n      : typeof wire.size === 'number' ? wire.size : undefined;\n    if (contentType === undefined || size === undefined) {\n      throw this.errorBuilder.buildError(ErrorType.VALIDATION, executionContext, {\n        customMessageReference: ErrorCustomMessageReference.FILE_STORAGE_REF_INVALID,\n        context: {\n          message: contentType === undefined\n            ? 'Google Drive reports no MIME type for this file'\n            : 'Google Drive reports no byte size for this file — a Google-native document has none until exported',\n          storageRef: externalId,\n        },\n      });\n    }\n    const lastModified = typeof wire.modifiedTime === 'string' ? new Date(wire.modifiedTime) : undefined;\n    return {\n      name: typeof wire.name === 'string' && wire.name.length > 0 ? wire.name : externalId,\n      contentType,\n      size,\n      ...(typeof wire.md5Checksum === 'string' ? { etag: wire.md5Checksum } : {}),\n      ...(lastModified !== undefined && !Number.isNaN(lastModified.getTime()) ? { lastModified } : {}),\n    };\n  }\n\n  /** One call shape: fixed host, a deadline, and vendor status codes mapped to this repository's error types. */\n  private async call(\n    url: string,\n    init: { method: string; headers: Record<string, string>; body?: Buffer },\n    executionContext: ExecutionContext<any>,\n    context: Record<string, unknown>,\n  ): Promise<Response> {\n    let response: Response;\n    try {\n      response = await fetch(url, {\n        method: init.method,\n        headers: init.headers,\n        ...(init.body === undefined ? {} : { body: new Uint8Array(init.body) }),\n        signal: AbortSignal.timeout(GOOGLE_DRIVE_REQUEST_TIMEOUT_MS),\n      });\n    } catch (error) {\n      throw this.errorBuilder.buildError(ErrorType.EXTERNAL_SERVICE, executionContext, {\n        customMessageReference: ErrorCustomMessageReference.EXTERNAL_SERVICE,\n        context: { message: 'Google Drive request failed', ...context, error: describeCaughtError(error) },\n      });\n    }\n    if (response.ok) return response;\n    if (response.status === 404) {\n      throw this.errorBuilder.buildError(ErrorType.NOT_FOUND, executionContext, {\n        customMessageReference: ErrorCustomMessageReference.FILE_NOT_FOUND_IN_STORAGE,\n        context: { message: 'Google Drive knows no such file for this person', ...context },\n      });\n    }\n    if (response.status === 401 || response.status === 403) {\n      throw this.errorBuilder.buildError(ErrorType.AUTHORIZATION, executionContext, {\n        customMessageReference: ErrorCustomMessageReference.FILE_STORAGE_ACCESS_DENIED,\n        context: { message: 'Google Drive refused the delegated credential for this file', status: response.status, ...context },\n      });\n    }\n    throw this.errorBuilder.buildError(ErrorType.EXTERNAL_SERVICE, executionContext, {\n      customMessageReference: ErrorCustomMessageReference.EXTERNAL_SERVICE,\n      context: { message: 'Google Drive answered with an error', status: response.status, ...context },\n    });\n  }\n}\n\n/** Drains a stream into one buffer, refusing past `limit` before the whole thing is in memory. */\nasync function readAllBounded(stream: Readable, limit: number, overflow: () => unknown): Promise<Buffer> {\n  const chunks: Buffer[] = [];\n  let total = 0;\n  for await (const chunk of stream) {\n    const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk as Uint8Array | string);\n    total += buffer.length;\n    if (total > limit) throw overflow();\n    chunks.push(buffer);\n  }\n  return Buffer.concat(chunks);\n}\n"]}

package/dist/esm/files/storage/local-directory-storage-provider.backend.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"local-directory-storage-provider.backend.service.d.ts","sourceRoot":"","sources":["../../../../../src/files/storage/local-directory-storage-provider.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAGH,OAAO,EAAE,QAAQ,EAAE,MAAM,QAAQ,CAAC;AAKlC,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAE/D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAClG,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAE9G,OAAO,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AAC/G,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qEAAqE,CAAC;AAQ5G,OAAO,KAAK,EACV,oBAAoB,EACpB,mBAAmB,EACnB,oBAAoB,EACpB,qBAAqB,EACrB,mBAAmB,EACnB,2BAA2B,EAC3B,uBAAuB,EACxB,MAAM,+BAA+B,CAAC;AAUvC,qBACa,6BAA8B,YAAW,oBAAoB;IAMtE,OAAO,CAAC,QAAQ,CAAC,MAAM;IAEvB,OAAO,CAAC,QAAQ,CAAC,YAAY;IAE7B,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IATnC,QAAQ,CAAC,UAAU,uCAAuC;IAC1D,OAAO,CAAC,OAAO,CAAuB;gBAInB,MAAM,EAAE,aAAa,EAErB,YAAY,EAAE,0BAA0B,EAExC,gBAAgB,EAAE,uBAAuB;IAG5D;;;;;OAKG;IACH,YAAY,IAAI,OAAO;IAIvB,yFAAyF;IACzF,OAAO,KAAK,iBAAiB,GAE5B;IAEK,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAoB3B,WAAW,IAAI,OAAO,CAAC,2BAA2B,CAAC;IAmBzD,OAAO,CAAC,UAAU;IAkBlB;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,iBAAiB;IAqDzB;;;OAGG;IACH,OAAO,CAAC,2BAA2B;IAkBnC,OAAO,CAAC,gBAAgB;IAMlB,MAAM,CACV,UAAU,EAAE,QAAQ,EACpB,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,EACZ,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACvC,OAAO,CAAC,EAAE,oBAAoB,GAC7B,OAAO,CAAC,mBAAmB,CAAC;IAqCzB,QAAQ,CACZ,IAAI,EAAE,uBAAuB,EAC7B,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,GACtC,OAAO,CAAC,qBAAqB,CAAC;IAgC3B,MAAM,CACV,IAAI,EAAE,uBAAuB,EAC7B,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,GACtC,OAAO,CAAC,IAAI,CAAC;IAoBV,WAAW,CACf,IAAI,EAAE,uBAAuB,EAC7B,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,GACtC,OAAO,CAAC,mBAAmB,CAAC;IA8B/B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4CG;IACH,OAAO,CAAC,yBAAyB;YAWnB,iBAAiB;IAkB/B,OAAO,CAAC,mBAAmB;CAuD5B"}
+{"version":3,"file":"local-directory-storage-provider.backend.service.d.ts","sourceRoot":"","sources":["../../../../src/files/storage/local-directory-storage-provider.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAGH,OAAO,EAAE,QAAQ,EAAE,MAAM,QAAQ,CAAC;AAKlC,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAE/D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAClG,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAE9G,OAAO,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AAC/G,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qEAAqE,CAAC;AAQ5G,OAAO,KAAK,EACV,oBAAoB,EACpB,mBAAmB,EACnB,oBAAoB,EACpB,qBAAqB,EACrB,mBAAmB,EACnB,2BAA2B,EAC3B,uBAAuB,EACxB,MAAM,+BAA+B,CAAC;AAUvC,qBACa,6BAA8B,YAAW,oBAAoB;IAMtE,OAAO,CAAC,QAAQ,CAAC,MAAM;IAEvB,OAAO,CAAC,QAAQ,CAAC,YAAY;IAE7B,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IATnC,QAAQ,CAAC,UAAU,uCAAuC;IAC1D,OAAO,CAAC,OAAO,CAAuB;gBAInB,MAAM,EAAE,aAAa,EAErB,YAAY,EAAE,0BAA0B,EAExC,gBAAgB,EAAE,uBAAuB;IAG5D;;;;;OAKG;IACH,YAAY,IAAI,OAAO;IAIvB,yFAAyF;IACzF,OAAO,KAAK,iBAAiB,GAE5B;IAEK,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAoB3B,WAAW,IAAI,OAAO,CAAC,2BAA2B,CAAC;IAmBzD,OAAO,CAAC,UAAU;IAkBlB;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,iBAAiB;IAqDzB;;;OAGG;IACH,OAAO,CAAC,2BAA2B;IAkBnC,OAAO,CAAC,gBAAgB;IAMlB,MAAM,CACV,UAAU,EAAE,QAAQ,EACpB,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,EACZ,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACvC,OAAO,CAAC,EAAE,oBAAoB,GAC7B,OAAO,CAAC,mBAAmB,CAAC;IAqCzB,QAAQ,CACZ,IAAI,EAAE,uBAAuB,EAC7B,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,GACtC,OAAO,CAAC,qBAAqB,CAAC;IAgC3B,MAAM,CACV,IAAI,EAAE,uBAAuB,EAC7B,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,GACtC,OAAO,CAAC,IAAI,CAAC;IAoBV,WAAW,CACf,IAAI,EAAE,uBAAuB,EAC7B,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,GACtC,OAAO,CAAC,mBAAmB,CAAC;IA8B/B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4CG;IACH,OAAO,CAAC,yBAAyB;YAWnB,iBAAiB;IAkB/B,OAAO,CAAC,mBAAmB;CAuD5B"}

package/dist/esm/files/storage/local-directory-storage-provider.backend.service.js.map

@@ -1 +1 @@
-{"version":3,"file":"local-directory-storage-provider.backend.service.js","sourceRoot":"","sources":["../../../../../src/files/storage/local-directory-storage-provider.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;;;;;;;;;;;;;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAE/C,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAC3C,OAAO,EAAE,SAAS,EAAE,2BAA2B,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AACpG,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAC/D,OAAO,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AAEpF,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAC9G,OAAO,EAAE,mBAAmB,EAAE,MAAM,8EAA8E,CAAC;AACnH,OAAO,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AAE/G,OAAO,EAAE,aAAa,EAAE,mBAAmB,EAAE,cAAc,EAAE,YAAY,EAAE,cAAc,EAAE,4BAA4B,EAAE,MAAM,sDAAsD,CAAC;AACtL,OAAO,EAAE,iCAAiC,EAAE,MAAM,2EAA2E,CAAC;AAC9H,OAAO,EACL,4BAA4B,EAC5B,sBAAsB,EACtB,6BAA6B,GAC9B,MAAM,yCAAyC,CAAC;AAWjD,MAAM,eAAe,GAAG,YAAY,CAAC;AAS9B,IAAM,6BAA6B,GAAnC,MAAM,6BAA6B;IAMrB;IAEA;IAEA;IATV,UAAU,GAAG,mBAAmB,CAAC,eAAe,CAAC;IAClD,OAAO,GAAkB,IAAI,CAAC;IAEtC,YAEmB,MAAqB,EAErB,YAAwC,EAExC,gBAAyC;QAJzC,WAAM,GAAN,MAAM,CAAe;QAErB,iBAAY,GAAZ,YAAY,CAA4B;QAExC,qBAAgB,GAAhB,gBAAgB,CAAyB;IACzD,CAAC;IAEJ;;;;;OAKG;IACH,YAAY;QACV,OAAO,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC;IAClC,CAAC;IAED,yFAAyF;IACzF,IAAY,iBAAiB;QAC3B,OAAO,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,OAAO,EAAE,cAAc,EAAE,OAAO,CAAC;IACvE,CAAC;IAED,KAAK,CAAC,UAAU;QACd,MAAM,MAAM,GAAG,IAAI,CAAC,iBAAiB,CAAC;QACtC,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,aAAa,EACvB,SAAS,EACT;gBACE,sBAAsB,EAAE,2BAA2B,CAAC,aAAa;gBACjE,OAAO,EAAE;oBACP,OAAO,EAAE,sGAAsG;iBAChH;aACF,CACF,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACtC,MAAM,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACvD,IAAI,CAAC,OAAO,GAAG,QAAQ,CAAC;IAC1B,CAAC;IAED,KAAK,CAAC,WAAW;QACf,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAE7B,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAClB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,EAAE,KAAK,EAAE,+BAA+B,EAAE,CAAC;QACrG,CAAC;QAED,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,GAAG,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YAC9E,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,EAAE,CAAC;QAC5D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;gBAC/B,KAAK,EAAE,mBAAmB,CAAC,KAAK,CAAC;aAClC,CAAC;QACJ,CAAC;IACH,CAAC;IAEO,UAAU;QAChB,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAClB,MAAM,GAAG,GAAG,IAAI,CAAC,iBAAiB,CAAC;YACnC,IAAI,CAAC,GAAG,EAAE,CAAC;gBACT,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,aAAa,EACvB,SAAS,EACT;oBACE,sBAAsB,EAAE,2BAA2B,CAAC,aAAa;oBACjE,OAAO,EAAE,EAAE,OAAO,EAAE,gFAAgF,EAAE;iBACvG,CACF,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACnC,CAAC;QACD,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IAED;;;;;;;;;;;OAWG;IACK,iBAAiB,CACvB,MAAc,EACd,gBAAuC,EACvC,OAA8B;QAE9B,MAAM,QAAQ,GAAG,sBAAsB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACzD,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,UAAU,EACpB,gBAAgB,EAChB;gBACE,sBAAsB,EAAE,2BAA2B,CAAC,mCAAmC;aACxF,CACF,CAAC;QACJ,CAAC;QAED,4FAA4F;QAC5F,gGAAgG;QAChG,4FAA4F;QAC5F,+FAA+F;QAC/F,+FAA+F;QAC/F,gGAAgG;QAChG,2FAA2F;QAC3F,2BAA2B;QAC3B,EAAE;QACF,iGAAiG;QACjG,gGAAgG;QAChG,sGAAsG;QACtG,IAAI,6BAA6B,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC5C,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,aAAa,EACvB,SAAS,EACT;gBACE,sBAAsB,EAAE,2BAA2B,CAAC,4BAA4B;gBAChF,OAAO,EAAE;oBACP,YAAY,EAAE,QAAQ,EAAE,wBAAwB;iBACjD;aACF,CACF,CAAC;QACJ,CAAC;QAED,IAAI,OAAO,EAAE,oBAAoB,KAAK,KAAK,EAAE,CAAC;YAC5C,OAAO,QAAQ,CAAC;QAClB,CAAC;QAED,OAAO,4BAA4B,CAAC;YAClC,aAAa,EAAE,IAAI,CAAC,gBAAgB,CAAC,gBAAgB,CAAC;YACtD,QAAQ;YACR,kBAAkB,EAAE,OAAO,EAAE,kBAAkB;YAC/C,KAAK,EAAE,OAAO,EAAE,KAAK;SACtB,CAAC,CAAC;IACL,CAAC;IAED;;;OAGG;IACK,2BAA2B,CAAC,YAAoB;QACtD,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC;QAC/B,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;QAClD,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YAC/D,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,aAAa,EACvB,SAAS,EACT;gBACE,sBAAsB,EAAE,2BAA2B,CAAC,4BAA4B;gBAChF,OAAO,EAAE;oBACP,YAAY,EAAE,wBAAwB;iBACvC;aACF,CACF,CAAC;QACJ,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAEO,gBAAgB,CAAC,gBAAuC;QAC9D,MAAM,aAAa,GAAG,iCAAiC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;QAC/E,aAAa,CAAC,aAAa,EAAE,IAAI,CAAC,YAAY,EAAE,gBAAgB,EAAE,eAAe,CAAC,CAAC;QACnF,OAAO,aAAa,CAAC;IACvB,CAAC;IAED,KAAK,CAAC,MAAM,CACV,UAAoB,EACpB,MAAc,EACd,QAAgB,EAChB,IAAY,EACZ,gBAAuC,EACvC,OAA8B;QAE9B,cAAc,CAAC,MAAM,EAAE,IAAI,CAAC,YAAY,EAAE,gBAAgB,EAAE,QAAQ,CAAC,CAAC;QACtE,mBAAmB,CAAC,QAAQ,EAAE,IAAI,CAAC,YAAY,EAAE,gBAAgB,EAAE,UAAU,CAAC,CAAC;QAC/E,YAAY,CACV,IAAI,EACJ,4BAA4B,CAAC,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,OAAO,EAAE,WAAW,CAAC,EAC/E,IAAI,CAAC,YAAY,EACjB,gBAAgB,EAChB,MAAM,CACP,CAAC;QACF,cAAc,CAAC,UAAU,EAAE,IAAI,CAAC,YAAY,EAAE,gBAAgB,EAAE,YAAY,CAAC,CAAC;QAE9E,MAAM,YAAY,GAAG,IAAI,CAAC,iBAAiB,CAAC,MAAM,EAAE,gBAAgB,EAAE,OAAO,CAAC,CAAC;QAC/E,MAAM,QAAQ,GAAG,IAAI,CAAC,2BAA2B,CAAC,YAAY,CAAC,CAAC;QAEhE,MAAM,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAErE,IAAI,CAAC;YACH,MAAM,WAAW,GAAG,EAAE,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC;YACnD,MAAM,QAAQ,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;QAC1C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,mBAAmB,CAAC,KAAK,EAAE,QAAQ,EAAE,gBAAgB,EAAE;gBAC1D,MAAM;gBACN,QAAQ,EAAE,IAAI,CAAC,UAAU;aAC1B,CAAC,CAAC;QACL,CAAC;QAED,MAAM,cAAc,GAA4B;YAC9C,WAAW,EAAE,QAAQ;YACrB,IAAI;YACJ,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACpC,CAAC;QACF,MAAM,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,QAAQ,GAAG,eAAe,EAAE,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,EAAE,OAAO,CAAC,CAAC;QAEjG,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,QAAQ,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC;IACjE,CAAC;IAED,KAAK,CAAC,QAAQ,CACZ,IAA6B,EAC7B,gBAAuC;QAEvC,MAAM,QAAQ,GAAG,IAAI,CAAC,yBAAyB,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC;QAExE,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QACxD,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,SAAS,EACnB,gBAAgB,EAChB;gBACE,sBAAsB,EAAE,2BAA2B,CAAC,yBAAyB;gBAC7E,OAAO,EAAE;oBACP,wBAAwB;oBACxB,MAAM,EAAE,IAAI,CAAC,MAAM;oBACnB,QAAQ,EAAE,IAAI,CAAC,UAAU;iBAC1B;aACF,CACF,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;QACvF,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC9C,MAAM,MAAM,GAAG,EAAE,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC;QAE7C,OAAO;YACL,MAAM;YACN,WAAW,EAAE,QAAQ,CAAC,WAAW;YACjC,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,YAAY,EAAE,IAAI,CAAC,KAAK;SACzB,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,MAAM,CACV,IAA6B,EAC7B,gBAAuC;QAEvC,MAAM,QAAQ,GAAG,IAAI,CAAC,yBAAyB,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC;QAExE,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACrC,CAAC;QAAC,OAAO,KAAU,EAAE,CAAC;YACpB,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ;gBAAE,OAAO;YACpC,IAAI,CAAC,mBAAmB,CAAC,KAAK,EAAE,QAAQ,EAAE,gBAAgB,EAAE;gBAC1D,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,QAAQ,EAAE,IAAI,CAAC,UAAU;aAC1B,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,GAAG,eAAe,CAAC,CAAC;QACvD,CAAC;QAAC,MAAM,CAAC;YACP,oCAAoC;QACtC,CAAC;IACH,CAAC;IAED,KAAK,CAAC,WAAW,CACf,IAA6B,EAC7B,gBAAuC;QAEvC,MAAM,QAAQ,GAAG,IAAI,CAAC,yBAAyB,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC;QAExE,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QACxD,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,SAAS,EACnB,gBAAgB,EAChB;gBACE,sBAAsB,EAAE,2BAA2B,CAAC,yBAAyB;gBAC7E,OAAO,EAAE;oBACP,wBAAwB;oBACxB,MAAM,EAAE,IAAI,CAAC,MAAM;oBACnB,QAAQ,EAAE,IAAI,CAAC,UAAU;iBAC1B;aACF,CACF,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;QACvF,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAE9C,OAAO;YACL,WAAW,EAAE,QAAQ,CAAC,WAAW;YACjC,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,YAAY,EAAE,IAAI,CAAC,KAAK;SACzB,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4CG;IACK,yBAAyB,CAC/B,IAA6B,EAC7B,gBAAuC;QAEvC,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,CAAC;QAC5B,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,OAAO,IAAI,CAAC,2BAA2B,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC,CAAC;QACjG,CAAC;QACD,OAAO,IAAI,CAAC,2BAA2B,CAAC,GAAG,CAAC,CAAC;IAC/C,CAAC;IAEO,KAAK,CAAC,iBAAiB,CAC7B,QAAgB,EAChB,MAAc,EACd,gBAAuC;QAEvC,MAAM,QAAQ,GAAG,QAAQ,GAAG,eAAe,CAAC;QAC5C,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YAC1D,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAA4B,CAAC;QACpD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO;gBACL,WAAW,EAAE,0BAA0B;gBACvC,IAAI,EAAE,CAAC;gBACP,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;aACpC,CAAC;QACJ,CAAC;IACH,CAAC;IAEO,mBAAmB,CACzB,KAAc,EACd,SAAwD,EACxD,gBAAmD,EACnD,OAAgC;QAEhC,IAAI,mBAAmB,CAAC,KAAK,CAAC,EAAE,CAAC;YAC/B,MAAM,KAAK,CAAC;QACd,CAAC;QAED,MAAM,YAAY,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAC;QAChD,MAAM,SAAS,GAAI,KAAa,EAAE,IAAI,CAAC;QAEvC,IAAI,SAAS,KAAK,QAAQ,EAAE,CAAC;YAC3B,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,SAAS,EACnB,gBAAgB,EAChB;gBACE,sBAAsB,EAAE,2BAA2B,CAAC,yBAAyB;gBAC7E,OAAO,EAAE,EAAE,SAAS,EAAE,GAAG,OAAO,EAAE,EAAE,wBAAwB;aAC7D,CACF,CAAC;QACJ,CAAC;QAED,IAAI,SAAS,KAAK,QAAQ,IAAI,SAAS,KAAK,OAAO,EAAE,CAAC;YACpD,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,aAAa,EACvB,gBAAgB,EAChB;gBACE,sBAAsB,EAAE,2BAA2B,CAAC,0BAA0B;gBAC9E,OAAO,EAAE,EAAE,SAAS,EAAE,GAAG,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,EAAE,wBAAwB;aAC1F,CACF,CAAC;QACJ,CAAC;QAED,IAAI,SAAS,KAAK,QAAQ,EAAE,CAAC;YAC3B,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,gBAAgB,EAC1B,gBAAgB,EAChB;gBACE,sBAAsB,EAAE,2BAA2B,CAAC,gBAAgB;gBACpE,OAAO,EAAE,EAAE,OAAO,EAAE,yBAAyB,EAAE,SAAS,EAAE,GAAG,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE;aACpG,CACF,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,gBAAgB,EAC1B,gBAAgB,EAChB;YACE,sBAAsB,EAAE,2BAA2B,CAAC,gBAAgB;YACpE,OAAO,EAAE,EAAE,OAAO,EAAE,mCAAmC,SAAS,EAAE,EAAE,SAAS,EAAE,GAAG,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE;SACzH,CACF,CAAC;IACJ,CAAC;CACF,CAAA;AA1bY,6BAA6B;IADzC,UAAU,EAAE;IAMR,WAAA,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAA;IAEjC,WAAA,MAAM,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,CAAA;IAE9C,WAAA,MAAM,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,CAAA;+CADb,0BAA0B;QAEtB,uBAAuB;GAVjD,6BAA6B,CA0bzC","sourcesContent":["/**\n * Local Directory Storage Provider\n *\n * IFileStorageProvider implementation backed by the local filesystem.\n * Files are stored under a configurable base directory, at the SAME relative key the\n * Wildo-managed provider would use — `applications/<appId>/files/<storageName>/<scope>/<scopeId>/…`,\n * composed by `application-storage-key.backend.utils`. Path traversal attacks are guarded against\n * by refusing a `.`/`..` segment in the composed key AND by resolving every path and verifying it\n * stays inside the base dir.\n *\n * ## Why the key shape is shared rather than provider-local\n *\n * Until 2026-09-09 this provider composed `[applicationId]/[folderPath]/<leaf>` from the field's\n * declarative binding alone, and included the application id only when the binding asked\n * (`includeApplicationId`, defaulting to `false` here). It therefore emitted NONE of the\n * `<scope>/<scopeId>` segments the managed provider's shape carries, so a deployment routing a\n * `z_file()` field to local storage had no per-tenant prefix to sweep, list or confine against —\n * and nothing failed, because an absent prefix produces no error, only an absent capability.\n *\n * Both providers now call one composer. See `application-storage-key.backend.utils.ts` for the\n * argument and for what deliberately stays provider-local.\n *\n * Configured through `storage.localDirectory.baseDir` in resolved application\n * configuration, which the configuration loader seeds from the\n * `STORAGE_LOCAL_BASE_DIR` environment variable. The provider itself reads\n * configuration, never the environment — see\n * `.claude/plans/application-runtime-topology-delivery.md`.\n */\n\nimport { injectable, inject } from 'inversify';\nimport { Readable } from 'stream';\nimport * as fs from 'fs';\nimport * as path from 'path';\nimport { pipeline } from 'stream/promises';\nimport { ErrorType, ErrorCustomMessageReference, isWildoBackendError } from '@wildo-ai/saas-models';\nimport { FileStorageAccepted } from '@wildo-ai/zod-decorators';\nimport { SAAS_SERVICE_TYPES } from '~wildo-backend-lib/inject/models/service-types';\nimport type { LoggerService } from '~wildo-backend-lib/monitoring/logger/services/logger.service';\nimport { ErrorBuilderBackendService } from '~wildo-backend-lib/errors/services/error-builder.backend.service';\nimport { describeCaughtError } from '~wildo-backend-lib/errors/utils/error-log-level-classification.backend.utils';\nimport { AppConfigurationService } from '~wildo-backend-lib/config/services/app-configuration.backend.service';\nimport type { ExecutionContext } from '~wildo-backend-lib/runtime/models/execution-context.backend.schemas';\nimport { validateAppId, validateContentType, validateFileId, validateSize, validateStream, resolveConfiguredMaxFileSize } from '~wildo-backend-lib/files/utils/file-validation.utils';\nimport { resolveStorageApplicationIdentity } from '~wildo-backend-lib/files/utils/storage-application-identity.backend.utils';\nimport {\n  composeApplicationStorageKey,\n  composeStorageLeafPath,\n  storageKeyHasTraversalSegment,\n} from './application-storage-key.backend.utils';\nimport type {\n  IFileStorageProvider,\n  StorageUploadResult,\n  StorageUploadOptions,\n  StorageDownloadResult,\n  StorageFileMetadata,\n  StorageProviderHealthResult,\n  StoredFileStorageTarget,\n} from './file-storage-provider.types';\n\nconst METADATA_SUFFIX = '.meta.json';\n\ninterface LocalFileMetadataRecord {\n  contentType: string;\n  size: number;\n  createdAt: string;\n}\n\n@injectable()\nexport class LocalDirectoryStorageProvider implements IFileStorageProvider {\n  readonly providerId = FileStorageAccepted.LOCAL_DIRECTORY;\n  private baseDir: string | null = null;\n\n  constructor(\n    @inject(SAAS_SERVICE_TYPES.Logger)\n    private readonly logger: LoggerService,\n    @inject(SAAS_SERVICE_TYPES.ErrorBuilderService)\n    private readonly errorBuilder: ErrorBuilderBackendService,\n    @inject(SAAS_SERVICE_TYPES.AppConfigService)\n    private readonly appConfigService: AppConfigurationService,\n  ) {}\n\n  /**\n   * Reading configuration here can throw `app_configuration_not_initialized`,\n   * and that is left unsoftened on purpose: answering `false` for \"configuration\n   * is not loaded yet\" is indistinguishable from \"this application has no local\n   * storage\", and the router would SKIP the provider in silence.\n   */\n  isConfigured(): boolean {\n    return !!this.configuredBaseDir;\n  }\n\n  /** The authored filesystem root, or `undefined` when local storage is not configured. */\n  private get configuredBaseDir(): string | undefined {\n    return this.appConfigService.config.storage?.localDirectory?.baseDir;\n  }\n\n  async initialize(): Promise<void> {\n    const rawDir = this.configuredBaseDir;\n    if (!rawDir) {\n      throw this.errorBuilder.buildError(\n        ErrorType.CONFIGURATION,\n        undefined,\n        {\n          customMessageReference: ErrorCustomMessageReference.CONFIGURATION,\n          context: {\n            message: 'storage.localDirectory.baseDir (from STORAGE_LOCAL_BASE_DIR) is required for local directory storage',\n          },\n        }\n      );\n    }\n\n    const resolved = path.resolve(rawDir);\n    await fs.promises.mkdir(resolved, { recursive: true });\n    this.baseDir = resolved;\n  }\n\n  async healthCheck(): Promise<StorageProviderHealthResult> {\n    const startTime = Date.now();\n\n    if (!this.baseDir) {\n      return { healthy: false, latency: Date.now() - startTime, error: 'Local storage not initialized' };\n    }\n\n    try {\n      await fs.promises.access(this.baseDir, fs.constants.R_OK | fs.constants.W_OK);\n      return { healthy: true, latency: Date.now() - startTime };\n    } catch (error) {\n      return {\n        healthy: false,\n        latency: Date.now() - startTime,\n        error: describeCaughtError(error),\n      };\n    }\n  }\n\n  private getBaseDir(): string {\n    if (!this.baseDir) {\n      const raw = this.configuredBaseDir;\n      if (!raw) {\n        throw this.errorBuilder.buildError(\n          ErrorType.CONFIGURATION,\n          undefined,\n          {\n            customMessageReference: ErrorCustomMessageReference.CONFIGURATION,\n            context: { message: 'storage.localDirectory.baseDir (from STORAGE_LOCAL_BASE_DIR) is not configured' },\n          }\n        );\n      }\n      this.baseDir = path.resolve(raw);\n    }\n    return this.baseDir;\n  }\n\n  /**\n   * Compose the relative storage key for an upload.\n   *\n   * Layout — identical to the managed provider's, minus that provider's bucket prefix:\n   *   `applications/<applicationId>/files/<storageName>/<scope>/<scopeId>/[folderPath/]<fileName|fileId>`\n   *\n   * `includeApplicationId` defaults to `true` here, as it does on the managed provider. It used to\n   * default to `false` (\"the volume is typically per-app\"), which is exactly what left this provider\n   * with no tenant structure: a per-app VOLUME separates applications from each other and separates\n   * nothing inside one. Set explicitly to `false` the key collapses to the bare leaf path on BOTH\n   * providers — one authored value, one meaning, and the same loss of every prefix operation.\n   */\n  private composeStorageKey(\n    fileId: string,\n    executionContext: ExecutionContext<any>,\n    options?: StorageUploadOptions,\n  ): string {\n    const leafPath = composeStorageLeafPath(fileId, options);\n    if (!leafPath) {\n      throw this.errorBuilder.buildError(\n        ErrorType.VALIDATION,\n        executionContext,\n        {\n          customMessageReference: ErrorCustomMessageReference.FILE_STORAGE_KEY_COMPOSITION_FAILED,\n        }\n      );\n    }\n\n    // Refused on the LEAF, textually, before any prefix is prepended — and this is load-bearing\n    // rather than belt-and-braces. `resolveSafePathFromRelative` below asks \"does the resolved path\n    // escape the base directory\", which was the whole guard while a key was one or two segments\n    // deep. Under the six-segment tenant prefix a `folderPath: '../../outside'` no longer escapes:\n    // it resolves to `applications/<app>/files/_unlinked/outside/…`, still inside the base, so the\n    // containment check ADMITS what it used to refuse. What the `..` now buys an attacker is not an\n    // escape from the store but an escape from the TENANT prefix — the exact property this key\n    // shape exists to provide.\n    //\n    // The managed provider refuses the same input for the mirror-image reason (its stored-ref prefix\n    // check is textual), so one authored value cannot mean two things depending on which provider a\n    // deployment binds. `assertNoTraversalSegments` there and this share `storageKeyHasTraversalSegment`.\n    if (storageKeyHasTraversalSegment(leafPath)) {\n      throw this.errorBuilder.buildError(\n        ErrorType.AUTHORIZATION,\n        undefined,\n        {\n          customMessageReference: ErrorCustomMessageReference.FILE_PATH_TRAVERSAL_DETECTED,\n          context: {\n            relativePath: leafPath, // diagnostic (log-only)\n          },\n        }\n      );\n    }\n\n    if (options?.includeApplicationId === false) {\n      return leafPath;\n    }\n\n    return composeApplicationStorageKey({\n      applicationId: this.getApplicationId(executionContext),\n      leafPath,\n      linkedResourceType: options?.linkedResourceType,\n      scope: options?.scope,\n    });\n  }\n\n  /**\n   * Resolve a safe absolute path from a relative storage ref.\n   * Throws if the resolved path escapes the base directory (path traversal guard).\n   */\n  private resolveSafePathFromRelative(relativePath: string): string {\n    const base = this.getBaseDir();\n    const filePath = path.resolve(base, relativePath);\n    if (!filePath.startsWith(base + path.sep) && filePath !== base) {\n      throw this.errorBuilder.buildError(\n        ErrorType.AUTHORIZATION,\n        undefined,\n        {\n          customMessageReference: ErrorCustomMessageReference.FILE_PATH_TRAVERSAL_DETECTED,\n          context: {\n            relativePath, // diagnostic (log-only)\n          },\n        }\n      );\n    }\n    return filePath;\n  }\n\n  private getApplicationId(executionContext: ExecutionContext<any>): string {\n    const applicationId = resolveStorageApplicationIdentity(this.appConfigService);\n    validateAppId(applicationId, this.errorBuilder, executionContext, 'applicationId');\n    return applicationId;\n  }\n\n  async upload(\n    fileStream: Readable,\n    fileId: string,\n    mimeType: string,\n    size: number,\n    executionContext: ExecutionContext<any>,\n    options?: StorageUploadOptions,\n  ): Promise<StorageUploadResult> {\n    validateFileId(fileId, this.errorBuilder, executionContext, 'fileId');\n    validateContentType(mimeType, this.errorBuilder, executionContext, 'mimeType');\n    validateSize(\n      size,\n      resolveConfiguredMaxFileSize(this.appConfigService.config.storage?.maxFileSize),\n      this.errorBuilder,\n      executionContext,\n      'size',\n    );\n    validateStream(fileStream, this.errorBuilder, executionContext, 'fileStream');\n\n    const relativePath = this.composeStorageKey(fileId, executionContext, options);\n    const filePath = this.resolveSafePathFromRelative(relativePath);\n\n    await fs.promises.mkdir(path.dirname(filePath), { recursive: true });\n\n    try {\n      const writeStream = fs.createWriteStream(filePath);\n      await pipeline(fileStream, writeStream);\n    } catch (error) {\n      this.convertStorageError(error, 'upload', executionContext, {\n        fileId,\n        provider: this.providerId,\n      });\n    }\n\n    const metadataRecord: LocalFileMetadataRecord = {\n      contentType: mimeType,\n      size,\n      createdAt: new Date().toISOString(),\n    };\n    await fs.promises.writeFile(filePath + METADATA_SUFFIX, JSON.stringify(metadataRecord), 'utf-8');\n\n    return { storageRef: relativePath, provider: this.providerId };\n  }\n\n  async download(\n    file: StoredFileStorageTarget,\n    executionContext: ExecutionContext<any>,\n  ): Promise<StorageDownloadResult> {\n    const filePath = this.resolvePathFromStorageRef(file, executionContext);\n\n    try {\n      await fs.promises.access(filePath, fs.constants.R_OK);\n    } catch {\n      throw this.errorBuilder.buildError(\n        ErrorType.NOT_FOUND,\n        executionContext,\n        {\n          customMessageReference: ErrorCustomMessageReference.FILE_NOT_FOUND_IN_STORAGE,\n          context: {\n            // diagnostic (log-only)\n            fileId: file.fileId,\n            provider: this.providerId,\n          },\n        }\n      );\n    }\n\n    const metadata = await this.readLocalMetadata(filePath, file.fileId, executionContext);\n    const stat = await fs.promises.stat(filePath);\n    const stream = fs.createReadStream(filePath);\n\n    return {\n      stream,\n      contentType: metadata.contentType,\n      size: stat.size,\n      lastModified: stat.mtime,\n    };\n  }\n\n  async delete(\n    file: StoredFileStorageTarget,\n    executionContext: ExecutionContext<any>,\n  ): Promise<void> {\n    const filePath = this.resolvePathFromStorageRef(file, executionContext);\n\n    try {\n      await fs.promises.unlink(filePath);\n    } catch (error: any) {\n      if (error.code === 'ENOENT') return;\n      this.convertStorageError(error, 'delete', executionContext, {\n        fileId: file.fileId,\n        provider: this.providerId,\n      });\n    }\n\n    try {\n      await fs.promises.unlink(filePath + METADATA_SUFFIX);\n    } catch {\n      // metadata file already gone — fine\n    }\n  }\n\n  async getMetadata(\n    file: StoredFileStorageTarget,\n    executionContext: ExecutionContext<any>,\n  ): Promise<StorageFileMetadata> {\n    const filePath = this.resolvePathFromStorageRef(file, executionContext);\n\n    try {\n      await fs.promises.access(filePath, fs.constants.R_OK);\n    } catch {\n      throw this.errorBuilder.buildError(\n        ErrorType.NOT_FOUND,\n        executionContext,\n        {\n          customMessageReference: ErrorCustomMessageReference.FILE_NOT_FOUND_IN_STORAGE,\n          context: {\n            // diagnostic (log-only)\n            fileId: file.fileId,\n            provider: this.providerId,\n          },\n        }\n      );\n    }\n\n    const metadata = await this.readLocalMetadata(filePath, file.fileId, executionContext);\n    const stat = await fs.promises.stat(filePath);\n\n    return {\n      contentType: metadata.contentType,\n      size: stat.size,\n      lastModified: stat.mtime,\n    };\n  }\n\n  /**\n   * Resolve the absolute filesystem path from a persisted storageRef.\n   * The ref IS the relative path from baseDir — just validate traversal.\n   *\n   * ## Already-stored files are NOT moved by the key-shape change, and nothing has to be migrated\n   *\n   * Every read verb (`download` / `delete` / `getMetadata`) reaches a blob through this method, and\n   * with a ref present it uses that ref VERBATIM. A blob written under the old\n   * `[applicationId]/[folderPath]/<leaf>` layout therefore stays addressable at exactly the path it\n   * was written to: the shape change governs where NEW uploads land, never how an existing row is\n   * resolved. No migration, and no compatibility branch, because there is nothing to be compatible\n   * with — the persisted ref is the address.\n   *\n   * ## The no-ref branch is LIVE, and it must track `upload` rather than freeze\n   *\n   * It looks like a legacy fallback for rows whose `storageRef` never committed. Its real caller is\n   * the audit-log archive batch: `archiveArtifactExists` probes `getMetadata` with\n   * `fileId: '<folderPath>/<fileName>'` and NO ref, deliberately, so that each provider re-derives\n   * the key its own `upload` produced and the batch never re-implements provider path logic. Pin\n   * the old composition here and that probe would address a blob the upload no longer writes, so\n   * `archiveArtifactExists` would answer `false` forever and every past day would be re-archived on\n   * every tick — a silent, unbounded regression with no failing test anywhere.\n   *\n   * So it composes through the SAME composer, with no resource type and no scope, mirroring the\n   * managed provider's `resolveApplicationObjectKey(file.fileId, ctx, undefined)` argument for\n   * argument. The parity is pinned in this provider's test suite (`upload` then `getMetadata` with\n   * no ref); the batch's own suite uses a fake provider and cannot see it.\n   *\n   * ## Residual, recorded rather than fixed: a `.`/`..` segment inside a PRESENT ref\n   *\n   * `composeStorageKey` refuses one on the composition path; this branch does not, and the managed\n   * provider's `assertNoTraversalSegments(normalizedStorageRef, …)` does. Two reasons it is left\n   * asymmetric, and neither is \"nobody thought about it\":\n   *\n   * - the containment check below is a real `path.resolve`, not managed's textual `startsWith`, so\n   *   the class of attack that motivated managed's stored-ref check (a ref that satisfies a textual\n   *   prefix while pointing elsewhere) is already caught here for anything leaving the base;\n   * - a `.` ref legitimately addresses the base directory and is pinned as NOT an authorization\n   *   refusal (`ADMITS the base directory itself`), which a whole-segment textual check would break.\n   *\n   * What survives is a ref whose text climbs out of one tenant prefix into another WITHIN the base.\n   * Reaching it needs write access to the `storageRef` column — the composition path can no longer\n   * produce one — so it is a smaller surface than the one closed above, not the same one. Closing it\n   * means deciding what `.` should mean first, which is a separate change.\n   */\n  private resolvePathFromStorageRef(\n    file: StoredFileStorageTarget,\n    executionContext: ExecutionContext<any>,\n  ): string {\n    const ref = file.storageRef;\n    if (!ref) {\n      return this.resolveSafePathFromRelative(this.composeStorageKey(file.fileId, executionContext));\n    }\n    return this.resolveSafePathFromRelative(ref);\n  }\n\n  private async readLocalMetadata(\n    filePath: string,\n    fileId: string,\n    executionContext: ExecutionContext<any>,\n  ): Promise<LocalFileMetadataRecord> {\n    const metaPath = filePath + METADATA_SUFFIX;\n    try {\n      const raw = await fs.promises.readFile(metaPath, 'utf-8');\n      return JSON.parse(raw) as LocalFileMetadataRecord;\n    } catch {\n      return {\n        contentType: 'application/octet-stream',\n        size: 0,\n        createdAt: new Date().toISOString(),\n      };\n    }\n  }\n\n  private convertStorageError(\n    error: unknown,\n    operation: 'upload' | 'download' | 'delete' | 'metadata',\n    executionContext: ExecutionContext<any> | undefined,\n    context: Record<string, unknown>,\n  ): never {\n    if (isWildoBackendError(error)) {\n      throw error;\n    }\n\n    const errorMessage = describeCaughtError(error);\n    const errorCode = (error as any)?.code;\n\n    if (errorCode === 'ENOENT') {\n      throw this.errorBuilder.buildError(\n        ErrorType.NOT_FOUND,\n        executionContext,\n        {\n          customMessageReference: ErrorCustomMessageReference.FILE_NOT_FOUND_IN_STORAGE,\n          context: { operation, ...context }, // diagnostic (log-only)\n        }\n      );\n    }\n\n    if (errorCode === 'EACCES' || errorCode === 'EPERM') {\n      throw this.errorBuilder.buildError(\n        ErrorType.AUTHORIZATION,\n        executionContext,\n        {\n          customMessageReference: ErrorCustomMessageReference.FILE_STORAGE_ACCESS_DENIED,\n          context: { operation, ...context, originalError: errorMessage }, // diagnostic (log-only)\n        }\n      );\n    }\n\n    if (errorCode === 'ENOSPC') {\n      throw this.errorBuilder.buildError(\n        ErrorType.EXTERNAL_SERVICE,\n        executionContext,\n        {\n          customMessageReference: ErrorCustomMessageReference.EXTERNAL_SERVICE,\n          context: { message: 'Local storage disk full', operation, ...context, originalError: errorMessage },\n        }\n      );\n    }\n\n    throw this.errorBuilder.buildError(\n      ErrorType.EXTERNAL_SERVICE,\n      executionContext,\n      {\n        customMessageReference: ErrorCustomMessageReference.EXTERNAL_SERVICE,\n        context: { message: `Local storage operation failed: ${operation}`, operation, ...context, originalError: errorMessage },\n      }\n    );\n  }\n}\n"]}
+{"version":3,"file":"local-directory-storage-provider.backend.service.js","sourceRoot":"","sources":["../../../../src/files/storage/local-directory-storage-provider.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;;;;;;;;;;;;;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAE/C,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAC3C,OAAO,EAAE,SAAS,EAAE,2BAA2B,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AACpG,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAC/D,OAAO,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AAEpF,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAC9G,OAAO,EAAE,mBAAmB,EAAE,MAAM,8EAA8E,CAAC;AACnH,OAAO,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AAE/G,OAAO,EAAE,aAAa,EAAE,mBAAmB,EAAE,cAAc,EAAE,YAAY,EAAE,cAAc,EAAE,4BAA4B,EAAE,MAAM,sDAAsD,CAAC;AACtL,OAAO,EAAE,iCAAiC,EAAE,MAAM,2EAA2E,CAAC;AAC9H,OAAO,EACL,4BAA4B,EAC5B,sBAAsB,EACtB,6BAA6B,GAC9B,MAAM,yCAAyC,CAAC;AAWjD,MAAM,eAAe,GAAG,YAAY,CAAC;AAS9B,IAAM,6BAA6B,GAAnC,MAAM,6BAA6B;IAMrB;IAEA;IAEA;IATV,UAAU,GAAG,mBAAmB,CAAC,eAAe,CAAC;IAClD,OAAO,GAAkB,IAAI,CAAC;IAEtC,YAEmB,MAAqB,EAErB,YAAwC,EAExC,gBAAyC;QAJzC,WAAM,GAAN,MAAM,CAAe;QAErB,iBAAY,GAAZ,YAAY,CAA4B;QAExC,qBAAgB,GAAhB,gBAAgB,CAAyB;IACzD,CAAC;IAEJ;;;;;OAKG;IACH,YAAY;QACV,OAAO,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC;IAClC,CAAC;IAED,yFAAyF;IACzF,IAAY,iBAAiB;QAC3B,OAAO,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,OAAO,EAAE,cAAc,EAAE,OAAO,CAAC;IACvE,CAAC;IAED,KAAK,CAAC,UAAU;QACd,MAAM,MAAM,GAAG,IAAI,CAAC,iBAAiB,CAAC;QACtC,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,aAAa,EACvB,SAAS,EACT;gBACE,sBAAsB,EAAE,2BAA2B,CAAC,aAAa;gBACjE,OAAO,EAAE;oBACP,OAAO,EAAE,sGAAsG;iBAChH;aACF,CACF,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACtC,MAAM,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACvD,IAAI,CAAC,OAAO,GAAG,QAAQ,CAAC;IAC1B,CAAC;IAED,KAAK,CAAC,WAAW;QACf,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAE7B,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAClB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,EAAE,KAAK,EAAE,+BAA+B,EAAE,CAAC;QACrG,CAAC;QAED,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,GAAG,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YAC9E,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,EAAE,CAAC;QAC5D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;gBAC/B,KAAK,EAAE,mBAAmB,CAAC,KAAK,CAAC;aAClC,CAAC;QACJ,CAAC;IACH,CAAC;IAEO,UAAU;QAChB,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAClB,MAAM,GAAG,GAAG,IAAI,CAAC,iBAAiB,CAAC;YACnC,IAAI,CAAC,GAAG,EAAE,CAAC;gBACT,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,aAAa,EACvB,SAAS,EACT;oBACE,sBAAsB,EAAE,2BAA2B,CAAC,aAAa;oBACjE,OAAO,EAAE,EAAE,OAAO,EAAE,gFAAgF,EAAE;iBACvG,CACF,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACnC,CAAC;QACD,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IAED;;;;;;;;;;;OAWG;IACK,iBAAiB,CACvB,MAAc,EACd,gBAAuC,EACvC,OAA8B;QAE9B,MAAM,QAAQ,GAAG,sBAAsB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACzD,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,UAAU,EACpB,gBAAgB,EAChB;gBACE,sBAAsB,EAAE,2BAA2B,CAAC,mCAAmC;aACxF,CACF,CAAC;QACJ,CAAC;QAED,4FAA4F;QAC5F,gGAAgG;QAChG,4FAA4F;QAC5F,+FAA+F;QAC/F,+FAA+F;QAC/F,gGAAgG;QAChG,2FAA2F;QAC3F,2BAA2B;QAC3B,EAAE;QACF,iGAAiG;QACjG,gGAAgG;QAChG,sGAAsG;QACtG,IAAI,6BAA6B,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC5C,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,aAAa,EACvB,SAAS,EACT;gBACE,sBAAsB,EAAE,2BAA2B,CAAC,4BAA4B;gBAChF,OAAO,EAAE;oBACP,YAAY,EAAE,QAAQ,EAAE,wBAAwB;iBACjD;aACF,CACF,CAAC;QACJ,CAAC;QAED,IAAI,OAAO,EAAE,oBAAoB,KAAK,KAAK,EAAE,CAAC;YAC5C,OAAO,QAAQ,CAAC;QAClB,CAAC;QAED,OAAO,4BAA4B,CAAC;YAClC,aAAa,EAAE,IAAI,CAAC,gBAAgB,CAAC,gBAAgB,CAAC;YACtD,QAAQ;YACR,kBAAkB,EAAE,OAAO,EAAE,kBAAkB;YAC/C,KAAK,EAAE,OAAO,EAAE,KAAK;SACtB,CAAC,CAAC;IACL,CAAC;IAED;;;OAGG;IACK,2BAA2B,CAAC,YAAoB;QACtD,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC;QAC/B,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;QAClD,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YAC/D,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,aAAa,EACvB,SAAS,EACT;gBACE,sBAAsB,EAAE,2BAA2B,CAAC,4BAA4B;gBAChF,OAAO,EAAE;oBACP,YAAY,EAAE,wBAAwB;iBACvC;aACF,CACF,CAAC;QACJ,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAEO,gBAAgB,CAAC,gBAAuC;QAC9D,MAAM,aAAa,GAAG,iCAAiC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;QAC/E,aAAa,CAAC,aAAa,EAAE,IAAI,CAAC,YAAY,EAAE,gBAAgB,EAAE,eAAe,CAAC,CAAC;QACnF,OAAO,aAAa,CAAC;IACvB,CAAC;IAED,KAAK,CAAC,MAAM,CACV,UAAoB,EACpB,MAAc,EACd,QAAgB,EAChB,IAAY,EACZ,gBAAuC,EACvC,OAA8B;QAE9B,cAAc,CAAC,MAAM,EAAE,IAAI,CAAC,YAAY,EAAE,gBAAgB,EAAE,QAAQ,CAAC,CAAC;QACtE,mBAAmB,CAAC,QAAQ,EAAE,IAAI,CAAC,YAAY,EAAE,gBAAgB,EAAE,UAAU,CAAC,CAAC;QAC/E,YAAY,CACV,IAAI,EACJ,4BAA4B,CAAC,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,OAAO,EAAE,WAAW,CAAC,EAC/E,IAAI,CAAC,YAAY,EACjB,gBAAgB,EAChB,MAAM,CACP,CAAC;QACF,cAAc,CAAC,UAAU,EAAE,IAAI,CAAC,YAAY,EAAE,gBAAgB,EAAE,YAAY,CAAC,CAAC;QAE9E,MAAM,YAAY,GAAG,IAAI,CAAC,iBAAiB,CAAC,MAAM,EAAE,gBAAgB,EAAE,OAAO,CAAC,CAAC;QAC/E,MAAM,QAAQ,GAAG,IAAI,CAAC,2BAA2B,CAAC,YAAY,CAAC,CAAC;QAEhE,MAAM,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAErE,IAAI,CAAC;YACH,MAAM,WAAW,GAAG,EAAE,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC;YACnD,MAAM,QAAQ,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;QAC1C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,mBAAmB,CAAC,KAAK,EAAE,QAAQ,EAAE,gBAAgB,EAAE;gBAC1D,MAAM;gBACN,QAAQ,EAAE,IAAI,CAAC,UAAU;aAC1B,CAAC,CAAC;QACL,CAAC;QAED,MAAM,cAAc,GAA4B;YAC9C,WAAW,EAAE,QAAQ;YACrB,IAAI;YACJ,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACpC,CAAC;QACF,MAAM,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,QAAQ,GAAG,eAAe,EAAE,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,EAAE,OAAO,CAAC,CAAC;QAEjG,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,QAAQ,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC;IACjE,CAAC;IAED,KAAK,CAAC,QAAQ,CACZ,IAA6B,EAC7B,gBAAuC;QAEvC,MAAM,QAAQ,GAAG,IAAI,CAAC,yBAAyB,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC;QAExE,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QACxD,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,SAAS,EACnB,gBAAgB,EAChB;gBACE,sBAAsB,EAAE,2BAA2B,CAAC,yBAAyB;gBAC7E,OAAO,EAAE;oBACP,wBAAwB;oBACxB,MAAM,EAAE,IAAI,CAAC,MAAM;oBACnB,QAAQ,EAAE,IAAI,CAAC,UAAU;iBAC1B;aACF,CACF,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;QACvF,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC9C,MAAM,MAAM,GAAG,EAAE,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC;QAE7C,OAAO;YACL,MAAM;YACN,WAAW,EAAE,QAAQ,CAAC,WAAW;YACjC,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,YAAY,EAAE,IAAI,CAAC,KAAK;SACzB,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,MAAM,CACV,IAA6B,EAC7B,gBAAuC;QAEvC,MAAM,QAAQ,GAAG,IAAI,CAAC,yBAAyB,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC;QAExE,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACrC,CAAC;QAAC,OAAO,KAAU,EAAE,CAAC;YACpB,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ;gBAAE,OAAO;YACpC,IAAI,CAAC,mBAAmB,CAAC,KAAK,EAAE,QAAQ,EAAE,gBAAgB,EAAE;gBAC1D,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,QAAQ,EAAE,IAAI,CAAC,UAAU;aAC1B,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,GAAG,eAAe,CAAC,CAAC;QACvD,CAAC;QAAC,MAAM,CAAC;YACP,oCAAoC;QACtC,CAAC;IACH,CAAC;IAED,KAAK,CAAC,WAAW,CACf,IAA6B,EAC7B,gBAAuC;QAEvC,MAAM,QAAQ,GAAG,IAAI,CAAC,yBAAyB,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC;QAExE,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QACxD,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,SAAS,EACnB,gBAAgB,EAChB;gBACE,sBAAsB,EAAE,2BAA2B,CAAC,yBAAyB;gBAC7E,OAAO,EAAE;oBACP,wBAAwB;oBACxB,MAAM,EAAE,IAAI,CAAC,MAAM;oBACnB,QAAQ,EAAE,IAAI,CAAC,UAAU;iBAC1B;aACF,CACF,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;QACvF,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAE9C,OAAO;YACL,WAAW,EAAE,QAAQ,CAAC,WAAW;YACjC,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,YAAY,EAAE,IAAI,CAAC,KAAK;SACzB,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4CG;IACK,yBAAyB,CAC/B,IAA6B,EAC7B,gBAAuC;QAEvC,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,CAAC;QAC5B,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,OAAO,IAAI,CAAC,2BAA2B,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC,CAAC;QACjG,CAAC;QACD,OAAO,IAAI,CAAC,2BAA2B,CAAC,GAAG,CAAC,CAAC;IAC/C,CAAC;IAEO,KAAK,CAAC,iBAAiB,CAC7B,QAAgB,EAChB,MAAc,EACd,gBAAuC;QAEvC,MAAM,QAAQ,GAAG,QAAQ,GAAG,eAAe,CAAC;QAC5C,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YAC1D,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAA4B,CAAC;QACpD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO;gBACL,WAAW,EAAE,0BAA0B;gBACvC,IAAI,EAAE,CAAC;gBACP,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;aACpC,CAAC;QACJ,CAAC;IACH,CAAC;IAEO,mBAAmB,CACzB,KAAc,EACd,SAAwD,EACxD,gBAAmD,EACnD,OAAgC;QAEhC,IAAI,mBAAmB,CAAC,KAAK,CAAC,EAAE,CAAC;YAC/B,MAAM,KAAK,CAAC;QACd,CAAC;QAED,MAAM,YAAY,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAC;QAChD,MAAM,SAAS,GAAI,KAAa,EAAE,IAAI,CAAC;QAEvC,IAAI,SAAS,KAAK,QAAQ,EAAE,CAAC;YAC3B,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,SAAS,EACnB,gBAAgB,EAChB;gBACE,sBAAsB,EAAE,2BAA2B,CAAC,yBAAyB;gBAC7E,OAAO,EAAE,EAAE,SAAS,EAAE,GAAG,OAAO,EAAE,EAAE,wBAAwB;aAC7D,CACF,CAAC;QACJ,CAAC;QAED,IAAI,SAAS,KAAK,QAAQ,IAAI,SAAS,KAAK,OAAO,EAAE,CAAC;YACpD,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,aAAa,EACvB,gBAAgB,EAChB;gBACE,sBAAsB,EAAE,2BAA2B,CAAC,0BAA0B;gBAC9E,OAAO,EAAE,EAAE,SAAS,EAAE,GAAG,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,EAAE,wBAAwB;aAC1F,CACF,CAAC;QACJ,CAAC;QAED,IAAI,SAAS,KAAK,QAAQ,EAAE,CAAC;YAC3B,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,gBAAgB,EAC1B,gBAAgB,EAChB;gBACE,sBAAsB,EAAE,2BAA2B,CAAC,gBAAgB;gBACpE,OAAO,EAAE,EAAE,OAAO,EAAE,yBAAyB,EAAE,SAAS,EAAE,GAAG,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE;aACpG,CACF,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,gBAAgB,EAC1B,gBAAgB,EAChB;YACE,sBAAsB,EAAE,2BAA2B,CAAC,gBAAgB;YACpE,OAAO,EAAE,EAAE,OAAO,EAAE,mCAAmC,SAAS,EAAE,EAAE,SAAS,EAAE,GAAG,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE;SACzH,CACF,CAAC;IACJ,CAAC;CACF,CAAA;AA1bY,6BAA6B;IADzC,UAAU,EAAE;IAMR,WAAA,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAA;IAEjC,WAAA,MAAM,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,CAAA;IAE9C,WAAA,MAAM,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,CAAA;+CADb,0BAA0B;QAEtB,uBAAuB;GAVjD,6BAA6B,CA0bzC","sourcesContent":["/**\n * Local Directory Storage Provider\n *\n * IFileStorageProvider implementation backed by the local filesystem.\n * Files are stored under a configurable base directory, at the SAME relative key the\n * Wildo-managed provider would use — `applications/<appId>/files/<storageName>/<scope>/<scopeId>/…`,\n * composed by `application-storage-key.backend.utils`. Path traversal attacks are guarded against\n * by refusing a `.`/`..` segment in the composed key AND by resolving every path and verifying it\n * stays inside the base dir.\n *\n * ## Why the key shape is shared rather than provider-local\n *\n * Until 2026-09-09 this provider composed `[applicationId]/[folderPath]/<leaf>` from the field's\n * declarative binding alone, and included the application id only when the binding asked\n * (`includeApplicationId`, defaulting to `false` here). It therefore emitted NONE of the\n * `<scope>/<scopeId>` segments the managed provider's shape carries, so a deployment routing a\n * `z_file()` field to local storage had no per-tenant prefix to sweep, list or confine against —\n * and nothing failed, because an absent prefix produces no error, only an absent capability.\n *\n * Both providers now call one composer. See `application-storage-key.backend.utils.ts` for the\n * argument and for what deliberately stays provider-local.\n *\n * Configured through `storage.localDirectory.baseDir` in resolved application\n * configuration, which the configuration loader seeds from the\n * `STORAGE_LOCAL_BASE_DIR` environment variable. The provider itself reads\n * configuration, never the environment — see\n * `.claude/plans/application-runtime-topology-delivery.md`.\n */\n\nimport { injectable, inject } from 'inversify';\nimport { Readable } from 'stream';\nimport * as fs from 'fs';\nimport * as path from 'path';\nimport { pipeline } from 'stream/promises';\nimport { ErrorType, ErrorCustomMessageReference, isWildoBackendError } from '@wildo-ai/saas-models';\nimport { FileStorageAccepted } from '@wildo-ai/zod-decorators';\nimport { SAAS_SERVICE_TYPES } from '~wildo-backend-lib/inject/models/service-types';\nimport type { LoggerService } from '~wildo-backend-lib/monitoring/logger/services/logger.service';\nimport { ErrorBuilderBackendService } from '~wildo-backend-lib/errors/services/error-builder.backend.service';\nimport { describeCaughtError } from '~wildo-backend-lib/errors/utils/error-log-level-classification.backend.utils';\nimport { AppConfigurationService } from '~wildo-backend-lib/config/services/app-configuration.backend.service';\nimport type { ExecutionContext } from '~wildo-backend-lib/runtime/models/execution-context.backend.schemas';\nimport { validateAppId, validateContentType, validateFileId, validateSize, validateStream, resolveConfiguredMaxFileSize } from '~wildo-backend-lib/files/utils/file-validation.utils';\nimport { resolveStorageApplicationIdentity } from '~wildo-backend-lib/files/utils/storage-application-identity.backend.utils';\nimport {\n  composeApplicationStorageKey,\n  composeStorageLeafPath,\n  storageKeyHasTraversalSegment,\n} from './application-storage-key.backend.utils';\nimport type {\n  IFileStorageProvider,\n  StorageUploadResult,\n  StorageUploadOptions,\n  StorageDownloadResult,\n  StorageFileMetadata,\n  StorageProviderHealthResult,\n  StoredFileStorageTarget,\n} from './file-storage-provider.types';\n\nconst METADATA_SUFFIX = '.meta.json';\n\ninterface LocalFileMetadataRecord {\n  contentType: string;\n  size: number;\n  createdAt: string;\n}\n\n@injectable()\nexport class LocalDirectoryStorageProvider implements IFileStorageProvider {\n  readonly providerId = FileStorageAccepted.LOCAL_DIRECTORY;\n  private baseDir: string | null = null;\n\n  constructor(\n    @inject(SAAS_SERVICE_TYPES.Logger)\n    private readonly logger: LoggerService,\n    @inject(SAAS_SERVICE_TYPES.ErrorBuilderService)\n    private readonly errorBuilder: ErrorBuilderBackendService,\n    @inject(SAAS_SERVICE_TYPES.AppConfigService)\n    private readonly appConfigService: AppConfigurationService,\n  ) {}\n\n  /**\n   * Reading configuration here can throw `app_configuration_not_initialized`,\n   * and that is left unsoftened on purpose: answering `false` for \"configuration\n   * is not loaded yet\" is indistinguishable from \"this application has no local\n   * storage\", and the router would SKIP the provider in silence.\n   */\n  isConfigured(): boolean {\n    return !!this.configuredBaseDir;\n  }\n\n  /** The authored filesystem root, or `undefined` when local storage is not configured. */\n  private get configuredBaseDir(): string | undefined {\n    return this.appConfigService.config.storage?.localDirectory?.baseDir;\n  }\n\n  async initialize(): Promise<void> {\n    const rawDir = this.configuredBaseDir;\n    if (!rawDir) {\n      throw this.errorBuilder.buildError(\n        ErrorType.CONFIGURATION,\n        undefined,\n        {\n          customMessageReference: ErrorCustomMessageReference.CONFIGURATION,\n          context: {\n            message: 'storage.localDirectory.baseDir (from STORAGE_LOCAL_BASE_DIR) is required for local directory storage',\n          },\n        }\n      );\n    }\n\n    const resolved = path.resolve(rawDir);\n    await fs.promises.mkdir(resolved, { recursive: true });\n    this.baseDir = resolved;\n  }\n\n  async healthCheck(): Promise<StorageProviderHealthResult> {\n    const startTime = Date.now();\n\n    if (!this.baseDir) {\n      return { healthy: false, latency: Date.now() - startTime, error: 'Local storage not initialized' };\n    }\n\n    try {\n      await fs.promises.access(this.baseDir, fs.constants.R_OK | fs.constants.W_OK);\n      return { healthy: true, latency: Date.now() - startTime };\n    } catch (error) {\n      return {\n        healthy: false,\n        latency: Date.now() - startTime,\n        error: describeCaughtError(error),\n      };\n    }\n  }\n\n  private getBaseDir(): string {\n    if (!this.baseDir) {\n      const raw = this.configuredBaseDir;\n      if (!raw) {\n        throw this.errorBuilder.buildError(\n          ErrorType.CONFIGURATION,\n          undefined,\n          {\n            customMessageReference: ErrorCustomMessageReference.CONFIGURATION,\n            context: { message: 'storage.localDirectory.baseDir (from STORAGE_LOCAL_BASE_DIR) is not configured' },\n          }\n        );\n      }\n      this.baseDir = path.resolve(raw);\n    }\n    return this.baseDir;\n  }\n\n  /**\n   * Compose the relative storage key for an upload.\n   *\n   * Layout — identical to the managed provider's, minus that provider's bucket prefix:\n   *   `applications/<applicationId>/files/<storageName>/<scope>/<scopeId>/[folderPath/]<fileName|fileId>`\n   *\n   * `includeApplicationId` defaults to `true` here, as it does on the managed provider. It used to\n   * default to `false` (\"the volume is typically per-app\"), which is exactly what left this provider\n   * with no tenant structure: a per-app VOLUME separates applications from each other and separates\n   * nothing inside one. Set explicitly to `false` the key collapses to the bare leaf path on BOTH\n   * providers — one authored value, one meaning, and the same loss of every prefix operation.\n   */\n  private composeStorageKey(\n    fileId: string,\n    executionContext: ExecutionContext<any>,\n    options?: StorageUploadOptions,\n  ): string {\n    const leafPath = composeStorageLeafPath(fileId, options);\n    if (!leafPath) {\n      throw this.errorBuilder.buildError(\n        ErrorType.VALIDATION,\n        executionContext,\n        {\n          customMessageReference: ErrorCustomMessageReference.FILE_STORAGE_KEY_COMPOSITION_FAILED,\n        }\n      );\n    }\n\n    // Refused on the LEAF, textually, before any prefix is prepended — and this is load-bearing\n    // rather than belt-and-braces. `resolveSafePathFromRelative` below asks \"does the resolved path\n    // escape the base directory\", which was the whole guard while a key was one or two segments\n    // deep. Under the six-segment tenant prefix a `folderPath: '../../outside'` no longer escapes:\n    // it resolves to `applications/<app>/files/_unlinked/outside/…`, still inside the base, so the\n    // containment check ADMITS what it used to refuse. What the `..` now buys an attacker is not an\n    // escape from the store but an escape from the TENANT prefix — the exact property this key\n    // shape exists to provide.\n    //\n    // The managed provider refuses the same input for the mirror-image reason (its stored-ref prefix\n    // check is textual), so one authored value cannot mean two things depending on which provider a\n    // deployment binds. `assertNoTraversalSegments` there and this share `storageKeyHasTraversalSegment`.\n    if (storageKeyHasTraversalSegment(leafPath)) {\n      throw this.errorBuilder.buildError(\n        ErrorType.AUTHORIZATION,\n        undefined,\n        {\n          customMessageReference: ErrorCustomMessageReference.FILE_PATH_TRAVERSAL_DETECTED,\n          context: {\n            relativePath: leafPath, // diagnostic (log-only)\n          },\n        }\n      );\n    }\n\n    if (options?.includeApplicationId === false) {\n      return leafPath;\n    }\n\n    return composeApplicationStorageKey({\n      applicationId: this.getApplicationId(executionContext),\n      leafPath,\n      linkedResourceType: options?.linkedResourceType,\n      scope: options?.scope,\n    });\n  }\n\n  /**\n   * Resolve a safe absolute path from a relative storage ref.\n   * Throws if the resolved path escapes the base directory (path traversal guard).\n   */\n  private resolveSafePathFromRelative(relativePath: string): string {\n    const base = this.getBaseDir();\n    const filePath = path.resolve(base, relativePath);\n    if (!filePath.startsWith(base + path.sep) && filePath !== base) {\n      throw this.errorBuilder.buildError(\n        ErrorType.AUTHORIZATION,\n        undefined,\n        {\n          customMessageReference: ErrorCustomMessageReference.FILE_PATH_TRAVERSAL_DETECTED,\n          context: {\n            relativePath, // diagnostic (log-only)\n          },\n        }\n      );\n    }\n    return filePath;\n  }\n\n  private getApplicationId(executionContext: ExecutionContext<any>): string {\n    const applicationId = resolveStorageApplicationIdentity(this.appConfigService);\n    validateAppId(applicationId, this.errorBuilder, executionContext, 'applicationId');\n    return applicationId;\n  }\n\n  async upload(\n    fileStream: Readable,\n    fileId: string,\n    mimeType: string,\n    size: number,\n    executionContext: ExecutionContext<any>,\n    options?: StorageUploadOptions,\n  ): Promise<StorageUploadResult> {\n    validateFileId(fileId, this.errorBuilder, executionContext, 'fileId');\n    validateContentType(mimeType, this.errorBuilder, executionContext, 'mimeType');\n    validateSize(\n      size,\n      resolveConfiguredMaxFileSize(this.appConfigService.config.storage?.maxFileSize),\n      this.errorBuilder,\n      executionContext,\n      'size',\n    );\n    validateStream(fileStream, this.errorBuilder, executionContext, 'fileStream');\n\n    const relativePath = this.composeStorageKey(fileId, executionContext, options);\n    const filePath = this.resolveSafePathFromRelative(relativePath);\n\n    await fs.promises.mkdir(path.dirname(filePath), { recursive: true });\n\n    try {\n      const writeStream = fs.createWriteStream(filePath);\n      await pipeline(fileStream, writeStream);\n    } catch (error) {\n      this.convertStorageError(error, 'upload', executionContext, {\n        fileId,\n        provider: this.providerId,\n      });\n    }\n\n    const metadataRecord: LocalFileMetadataRecord = {\n      contentType: mimeType,\n      size,\n      createdAt: new Date().toISOString(),\n    };\n    await fs.promises.writeFile(filePath + METADATA_SUFFIX, JSON.stringify(metadataRecord), 'utf-8');\n\n    return { storageRef: relativePath, provider: this.providerId };\n  }\n\n  async download(\n    file: StoredFileStorageTarget,\n    executionContext: ExecutionContext<any>,\n  ): Promise<StorageDownloadResult> {\n    const filePath = this.resolvePathFromStorageRef(file, executionContext);\n\n    try {\n      await fs.promises.access(filePath, fs.constants.R_OK);\n    } catch {\n      throw this.errorBuilder.buildError(\n        ErrorType.NOT_FOUND,\n        executionContext,\n        {\n          customMessageReference: ErrorCustomMessageReference.FILE_NOT_FOUND_IN_STORAGE,\n          context: {\n            // diagnostic (log-only)\n            fileId: file.fileId,\n            provider: this.providerId,\n          },\n        }\n      );\n    }\n\n    const metadata = await this.readLocalMetadata(filePath, file.fileId, executionContext);\n    const stat = await fs.promises.stat(filePath);\n    const stream = fs.createReadStream(filePath);\n\n    return {\n      stream,\n      contentType: metadata.contentType,\n      size: stat.size,\n      lastModified: stat.mtime,\n    };\n  }\n\n  async delete(\n    file: StoredFileStorageTarget,\n    executionContext: ExecutionContext<any>,\n  ): Promise<void> {\n    const filePath = this.resolvePathFromStorageRef(file, executionContext);\n\n    try {\n      await fs.promises.unlink(filePath);\n    } catch (error: any) {\n      if (error.code === 'ENOENT') return;\n      this.convertStorageError(error, 'delete', executionContext, {\n        fileId: file.fileId,\n        provider: this.providerId,\n      });\n    }\n\n    try {\n      await fs.promises.unlink(filePath + METADATA_SUFFIX);\n    } catch {\n      // metadata file already gone — fine\n    }\n  }\n\n  async getMetadata(\n    file: StoredFileStorageTarget,\n    executionContext: ExecutionContext<any>,\n  ): Promise<StorageFileMetadata> {\n    const filePath = this.resolvePathFromStorageRef(file, executionContext);\n\n    try {\n      await fs.promises.access(filePath, fs.constants.R_OK);\n    } catch {\n      throw this.errorBuilder.buildError(\n        ErrorType.NOT_FOUND,\n        executionContext,\n        {\n          customMessageReference: ErrorCustomMessageReference.FILE_NOT_FOUND_IN_STORAGE,\n          context: {\n            // diagnostic (log-only)\n            fileId: file.fileId,\n            provider: this.providerId,\n          },\n        }\n      );\n    }\n\n    const metadata = await this.readLocalMetadata(filePath, file.fileId, executionContext);\n    const stat = await fs.promises.stat(filePath);\n\n    return {\n      contentType: metadata.contentType,\n      size: stat.size,\n      lastModified: stat.mtime,\n    };\n  }\n\n  /**\n   * Resolve the absolute filesystem path from a persisted storageRef.\n   * The ref IS the relative path from baseDir — just validate traversal.\n   *\n   * ## Already-stored files are NOT moved by the key-shape change, and nothing has to be migrated\n   *\n   * Every read verb (`download` / `delete` / `getMetadata`) reaches a blob through this method, and\n   * with a ref present it uses that ref VERBATIM. A blob written under the old\n   * `[applicationId]/[folderPath]/<leaf>` layout therefore stays addressable at exactly the path it\n   * was written to: the shape change governs where NEW uploads land, never how an existing row is\n   * resolved. No migration, and no compatibility branch, because there is nothing to be compatible\n   * with — the persisted ref is the address.\n   *\n   * ## The no-ref branch is LIVE, and it must track `upload` rather than freeze\n   *\n   * It looks like a legacy fallback for rows whose `storageRef` never committed. Its real caller is\n   * the audit-log archive batch: `archiveArtifactExists` probes `getMetadata` with\n   * `fileId: '<folderPath>/<fileName>'` and NO ref, deliberately, so that each provider re-derives\n   * the key its own `upload` produced and the batch never re-implements provider path logic. Pin\n   * the old composition here and that probe would address a blob the upload no longer writes, so\n   * `archiveArtifactExists` would answer `false` forever and every past day would be re-archived on\n   * every tick — a silent, unbounded regression with no failing test anywhere.\n   *\n   * So it composes through the SAME composer, with no resource type and no scope, mirroring the\n   * managed provider's `resolveApplicationObjectKey(file.fileId, ctx, undefined)` argument for\n   * argument. The parity is pinned in this provider's test suite (`upload` then `getMetadata` with\n   * no ref); the batch's own suite uses a fake provider and cannot see it.\n   *\n   * ## Residual, recorded rather than fixed: a `.`/`..` segment inside a PRESENT ref\n   *\n   * `composeStorageKey` refuses one on the composition path; this branch does not, and the managed\n   * provider's `assertNoTraversalSegments(normalizedStorageRef, …)` does. Two reasons it is left\n   * asymmetric, and neither is \"nobody thought about it\":\n   *\n   * - the containment check below is a real `path.resolve`, not managed's textual `startsWith`, so\n   *   the class of attack that motivated managed's stored-ref check (a ref that satisfies a textual\n   *   prefix while pointing elsewhere) is already caught here for anything leaving the base;\n   * - a `.` ref legitimately addresses the base directory and is pinned as NOT an authorization\n   *   refusal (`ADMITS the base directory itself`), which a whole-segment textual check would break.\n   *\n   * What survives is a ref whose text climbs out of one tenant prefix into another WITHIN the base.\n   * Reaching it needs write access to the `storageRef` column — the composition path can no longer\n   * produce one — so it is a smaller surface than the one closed above, not the same one. Closing it\n   * means deciding what `.` should mean first, which is a separate change.\n   */\n  private resolvePathFromStorageRef(\n    file: StoredFileStorageTarget,\n    executionContext: ExecutionContext<any>,\n  ): string {\n    const ref = file.storageRef;\n    if (!ref) {\n      return this.resolveSafePathFromRelative(this.composeStorageKey(file.fileId, executionContext));\n    }\n    return this.resolveSafePathFromRelative(ref);\n  }\n\n  private async readLocalMetadata(\n    filePath: string,\n    fileId: string,\n    executionContext: ExecutionContext<any>,\n  ): Promise<LocalFileMetadataRecord> {\n    const metaPath = filePath + METADATA_SUFFIX;\n    try {\n      const raw = await fs.promises.readFile(metaPath, 'utf-8');\n      return JSON.parse(raw) as LocalFileMetadataRecord;\n    } catch {\n      return {\n        contentType: 'application/octet-stream',\n        size: 0,\n        createdAt: new Date().toISOString(),\n      };\n    }\n  }\n\n  private convertStorageError(\n    error: unknown,\n    operation: 'upload' | 'download' | 'delete' | 'metadata',\n    executionContext: ExecutionContext<any> | undefined,\n    context: Record<string, unknown>,\n  ): never {\n    if (isWildoBackendError(error)) {\n      throw error;\n    }\n\n    const errorMessage = describeCaughtError(error);\n    const errorCode = (error as any)?.code;\n\n    if (errorCode === 'ENOENT') {\n      throw this.errorBuilder.buildError(\n        ErrorType.NOT_FOUND,\n        executionContext,\n        {\n          customMessageReference: ErrorCustomMessageReference.FILE_NOT_FOUND_IN_STORAGE,\n          context: { operation, ...context }, // diagnostic (log-only)\n        }\n      );\n    }\n\n    if (errorCode === 'EACCES' || errorCode === 'EPERM') {\n      throw this.errorBuilder.buildError(\n        ErrorType.AUTHORIZATION,\n        executionContext,\n        {\n          customMessageReference: ErrorCustomMessageReference.FILE_STORAGE_ACCESS_DENIED,\n          context: { operation, ...context, originalError: errorMessage }, // diagnostic (log-only)\n        }\n      );\n    }\n\n    if (errorCode === 'ENOSPC') {\n      throw this.errorBuilder.buildError(\n        ErrorType.EXTERNAL_SERVICE,\n        executionContext,\n        {\n          customMessageReference: ErrorCustomMessageReference.EXTERNAL_SERVICE,\n          context: { message: 'Local storage disk full', operation, ...context, originalError: errorMessage },\n        }\n      );\n    }\n\n    throw this.errorBuilder.buildError(\n      ErrorType.EXTERNAL_SERVICE,\n      executionContext,\n      {\n        customMessageReference: ErrorCustomMessageReference.EXTERNAL_SERVICE,\n        context: { message: `Local storage operation failed: ${operation}`, operation, ...context, originalError: errorMessage },\n      }\n    );\n  }\n}\n"]}

package/dist/esm/files/storage/storage-credential-provider.backend.utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"storage-credential-provider.backend.utils.d.ts","sourceRoot":"","sources":["../../../../../src/files/storage/storage-credential-provider.backend.utils.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,MAAM,WAAW,0BAA0B;IACzC,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,oEAAoE;IACpE,SAAS,CAAC,EAAE,IAAI,CAAC;IACjB;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,MAAM,yBAAyB,GAAG,MAAM,OAAO,CAAC,0BAA0B,CAAC,CAAC;AAUlF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,qBAAa,yBAAyB;IAKlC,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,mEAAmE;IACnE,OAAO,CAAC,QAAQ,CAAC,GAAG;IANtB,OAAO,CAAC,MAAM,CAA2C;IACzD,OAAO,CAAC,QAAQ,CAAoD;gBAGjD,OAAO,EAAE,yBAAyB;IACnD,mEAAmE;IAClD,GAAG,GAAE,MAAM,MAAyB;IAGvD;;OAEG;IACU,cAAc,IAAI,OAAO,CAAC,0BAA0B,CAAC;IAyBlE;;;;;OAKG;IACI,oBAAoB,CAAC,iBAAiB,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO;IAI3E,sFAAsF;IAC/E,UAAU,IAAI,IAAI;IAIzB,OAAO,CAAC,eAAe;CAYxB"}
+{"version":3,"file":"storage-credential-provider.backend.utils.d.ts","sourceRoot":"","sources":["../../../../src/files/storage/storage-credential-provider.backend.utils.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,MAAM,WAAW,0BAA0B;IACzC,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,oEAAoE;IACpE,SAAS,CAAC,EAAE,IAAI,CAAC;IACjB;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,MAAM,yBAAyB,GAAG,MAAM,OAAO,CAAC,0BAA0B,CAAC,CAAC;AAUlF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,qBAAa,yBAAyB;IAKlC,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,mEAAmE;IACnE,OAAO,CAAC,QAAQ,CAAC,GAAG;IANtB,OAAO,CAAC,MAAM,CAA2C;IACzD,OAAO,CAAC,QAAQ,CAAoD;gBAGjD,OAAO,EAAE,yBAAyB;IACnD,mEAAmE;IAClD,GAAG,GAAE,MAAM,MAAyB;IAGvD;;OAEG;IACU,cAAc,IAAI,OAAO,CAAC,0BAA0B,CAAC;IAyBlE;;;;;OAKG;IACI,oBAAoB,CAAC,iBAAiB,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO;IAI3E,sFAAsF;IAC/E,UAAU,IAAI,IAAI;IAIzB,OAAO,CAAC,eAAe;CAYxB"}

package/dist/esm/files/storage/storage-platform-sts-credential-resolver.backend.utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"storage-platform-sts-credential-resolver.backend.utils.d.ts","sourceRoot":"","sources":["../../../../../src/files/storage/storage-platform-sts-credential-resolver.backend.utils.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAA8B,yBAAyB,EAAE,MAAM,4EAA4E,CAAC;AAExJ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,wBAAgB,iDAAiD,IAAI,yBAAyB,CA2B7F"}
+{"version":3,"file":"storage-platform-sts-credential-resolver.backend.utils.d.ts","sourceRoot":"","sources":["../../../../src/files/storage/storage-platform-sts-credential-resolver.backend.utils.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAA8B,yBAAyB,EAAE,MAAM,4EAA4E,CAAC;AAExJ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,wBAAgB,iDAAiD,IAAI,yBAAyB,CA2B7F"}

package/dist/esm/files/storage/storage-sts-credential-resolver.backend.utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"storage-sts-credential-resolver.backend.utils.d.ts","sourceRoot":"","sources":["../../../../../src/files/storage/storage-sts-credential-resolver.backend.utils.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,0BAA0B,EAAE,yBAAyB,EAAE,MAAM,4EAA4E,CAAC;AAsGxJ;;;;;;;;;;;;GAYG;AACH,wBAAgB,kCAAkC,CAChD,oBAAoB,EAAE,MAAM,MAAM,GACjC,yBAAyB,CAiE3B;AAED;;;;;;;;;GASG;AACH,wBAAsB,2BAA2B,CAAC,KAAK,EAAE;IACvD,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACjC,GAAG,OAAO,CAAC,OAAO,CAAC,CA+CnB;AAED;;;;;;;GAOG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,OAAO,GAAG,0BAA0B,CAkCtF"}
+{"version":3,"file":"storage-sts-credential-resolver.backend.utils.d.ts","sourceRoot":"","sources":["../../../../src/files/storage/storage-sts-credential-resolver.backend.utils.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,0BAA0B,EAAE,yBAAyB,EAAE,MAAM,4EAA4E,CAAC;AAsGxJ;;;;;;;;;;;;GAYG;AACH,wBAAgB,kCAAkC,CAChD,oBAAoB,EAAE,MAAM,MAAM,GACjC,yBAAyB,CAiE3B;AAYD;;;;;;;;;GASG;AACH,wBAAsB,2BAA2B,CAAC,KAAK,EAAE;IACvD,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACjC,GAAG,OAAO,CAAC,OAAO,CAAC,CA6CnB;AAED;;;;;;;GAOG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,OAAO,GAAG,0BAA0B,CAkCtF"}