@wildo-ai/saas-backend-lib 1.1.3 → 1.1.4

package/dist/esm/files/storage/storage-sts-credential-resolver.backend.utils.js

@@ -170,6 +170,15 @@ export function createStsStorageCredentialResolver(resolveApplicationId) {
         return parseStsCredentialPayload(payload);
     };
 }
+/**
+ * Hard deadline for one STS credential fetch from apps-manager.
+ *
+ * This sits in front of every FIRST storage operation after a renewal, so the cost of an unbounded
+ * wait is not a slow credential — it is an upload that stalls instead of failing, on a fail-closed
+ * path with no fallback. 15s: the payload is a small JSON credential from a service on our own
+ * network, and the operation behind it is a user waiting for a file to move.
+ */
+const STS_CREDENTIAL_REQUEST_TIMEOUT_MS = 15_000;
 /**
  * Perform the credential fetch and unwrap the response envelope.
  *
@@ -197,9 +206,7 @@ export async function requestStsCredentialPayload(input) {
         const response = await fetch(input.url, {
             method: 'GET',
             headers: input.headers,
-            // Bounded: this sits in front of every first storage operation after a
-            // renewal, so an unbounded wait would stall uploads rather than fail them.
-            signal: AbortSignal.timeout(15_000),
+            signal: AbortSignal.timeout(STS_CREDENTIAL_REQUEST_TIMEOUT_MS),
         });
         if (!response.ok) {
             // `fetch` resolves on non-2xx rather than rejecting, so this has to be an

package/dist/esm/files/storage/storage-sts-credential-resolver.backend.utils.js.map

@@ -1 +1 @@
-{"version":3,"file":"storage-sts-credential-resolver.backend.utils.js","sourceRoot":"","sources":["../../../../../src/files/storage/storage-sts-credential-resolver.backend.utils.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,uBAAuB,EAAE,MAAM,gCAAgC,CAAC;AACzE,OAAO,EAAE,8BAA8B,EAAE,MAAM,kEAAkE,CAAC;AAClH,OAAO,EAAE,mBAAmB,EAAE,MAAM,8EAA8E,CAAC;AAGnH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH;;;;;;;;;;;;;;;GAeG;AACH,SAAS,uBAAuB,CAAC,KAAc;IAC7C,MAAM,KAAK,GAAa,EAAE,CAAC;IAE3B,MAAM,OAAO,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAC;IAC3C,+EAA+E;IAC/E,8EAA8E;IAC9E,gFAAgF;IAChF,0EAA0E;IAC1E,IAAI,OAAO,IAAI,OAAO,KAAK,iBAAiB;QAAE,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAElE,MAAM,aAAa,GAAI,KAA4B,EAAE,IAAI,CAAC;IAC1D,IAAI,OAAO,aAAa,KAAK,QAAQ,IAAI,aAAa;QAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,aAAa,EAAE,CAAC,CAAC;IAE5F,6EAA6E;IAC7E,0EAA0E;IAC1E,8EAA8E;IAC9E,mEAAmE;IACnE,MAAM,YAAY,GAAI,KAA2D,EAAE,KAAK,CAAC;IACzF,IAAI,YAAY,EAAE,CAAC;QACjB,MAAM,IAAI,GAAG,OAAO,YAAY,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;QACnF,MAAM,GAAG,GAAG,OAAO,YAAY,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;QACxF,IAAI,IAAI;YAAE,KAAK,CAAC,IAAI,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;aACjC,IAAI,GAAG;YAAE,KAAK,CAAC,IAAI,CAAC,SAAS,GAAG,EAAE,CAAC,CAAC;IAC3C,CAAC;IAED,MAAM,IAAI,GAAI,KAA4B,EAAE,IAAI,CAAC;IACjD,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,IAAI,KAAK,YAAY,IAAI,IAAI,KAAK,cAAc,CAAC,EAAE,CAAC;QACnF,KAAK,CAAC,IAAI,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC;IAChC,CAAC;IAED,6EAA6E;IAC7E,6EAA6E;IAC7E,2CAA2C;IAE3C,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,MAAM,QAAQ,GAAI,KAA6C,EAAE,WAAW,EAAE,IAAI,CAAC;QACnF,OAAO,QAAQ,CAAC,CAAC,CAAC,gBAAgB,QAAQ,EAAE,CAAC,CAAC,CAAC,0DAA0D,CAAC;IAC5G,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC3B,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,kCAAkC,CAChD,oBAAkC;IAElC,OAAO,KAAK,IAAyC,EAAE;QACrD,4EAA4E;QAC5E,EAAE;QACF,4EAA4E;QAC5E,8EAA8E;QAC9E,+EAA+E;QAC/E,8EAA8E;QAC9E,gCAAgC;QAChC,EAAE;QACF,6EAA6E;QAC7E,6EAA6E;QAC7E,6EAA6E;QAC7E,2EAA2E;QAC3E,8EAA8E;QAC9E,8EAA8E;QAC9E,EAAE;QACF,mEAAmE;QACnE,+EAA+E;QAC/E,6BAA6B;QAC7B,IAAI,OAAO,CAAC,GAAG,CAAC,YAAY,KAAK,uBAAuB,CAAC,qBAAqB,EAAE,CAAC;YAC/E,MAAM,IAAI,KAAK,CACb,mFAAmF;kBACjF,IAAI,uBAAuB,CAAC,qBAAqB,gCAAgC;kBACjF,mFAAmF;kBACnF,8EAA8E;kBAC9E,wBAAwB,CAC3B,CAAC;QACJ,CAAC;QAED,MAAM,cAAc,GAAG,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC;QAC7D,MAAM,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC,mCAAmC,CAAC;QACtE,kEAAkE;QAClE,IAAI,aAAiC,CAAC;QACtC,IAAI,CAAC;YACH,aAAa,GAAG,oBAAoB,EAAE,CAAC;QACzC,CAAC;QAAC,MAAM,CAAC;YACP,yEAAyE;YACzE,oEAAoE;YACpE,yEAAyE;YACzE,aAAa,GAAG,SAAS,CAAC;QAC5B,CAAC;QAED,IAAI,CAAC,cAAc,IAAI,CAAC,aAAa,IAAI,CAAC,aAAa,EAAE,CAAC;YACxD,MAAM,IAAI,KAAK,CACb,iFAAiF;kBAC/E,+BAA+B,OAAO,CAAC,cAAc,CAAC,IAAI;kBAC1D,wCAAwC,OAAO,CAAC,aAAa,CAAC,IAAI;kBAClE,kBAAkB,OAAO,CAAC,aAAa,CAAC,IAAI,CAC/C,CAAC;QACJ,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,2BAA2B,CAAC;YAChD,GAAG,EAAE,GAAG,cAAc,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE;kBACxC,8BAA8B,CAAC,YAAY,CAAC,2CAA2C,EAAE;YAC7F,OAAO,EAAE;gBACP,CAAC,eAAe,CAAC,YAAY,CAAC,EAAE,kBAAkB;gBAClD,CAAC,eAAe,CAAC,eAAe,CAAC,EAAE,aAAa;gBAChD,CAAC,eAAe,CAAC,cAAc,CAAC,EAAE,aAAa;gBAC/C,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,CAAC,eAAe,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC,GAAG,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAChG;SACF,CAAC,CAAC;QAEH,OAAO,yBAAyB,CAAC,OAAO,CAAC,CAAC;IAC5C,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,KAGjD;IACC,IAAI,CAAC;QACH,6DAA6D;QAC7D,EAAE;QACF,2EAA2E;QAC3E,4EAA4E;QAC5E,6EAA6E;QAC7E,+EAA+E;QAC/E,mEAAmE;QACnE,+EAA+E;QAC/E,8BAA8B;QAC9B,EAAE;QACF,8EAA8E;QAC9E,gEAAgE;QAChE,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE;YACtC,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,uEAAuE;YACvE,2EAA2E;YAC3E,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;SACpC,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,0EAA0E;YAC1E,wEAAwE;YACxE,0EAA0E;YAC1E,+DAA+D;YAC/D,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;YACnD,MAAM,IAAI,KAAK,CAAC,UAAU,QAAQ,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,WAAW,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC7F,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,EAA+B,CAAC;QAClE,OAAO,MAAM,EAAE,IAAI,IAAI,MAAM,CAAC;IAChC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,kEAAkE;QAClE,+BAA+B;QAC/B,EAAE;QACF,8EAA8E;QAC9E,6EAA6E;QAC7E,8EAA8E;QAC9E,gFAAgF;QAChF,gFAAgF;QAChF,8EAA8E;QAC9E,MAAM,IAAI,KAAK,CACb,0EAA0E,uBAAuB,CAAC,KAAK,CAAC,EAAE,CAC3G,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,yBAAyB,CAAC,OAAgB;IACxD,MAAM,WAAW,GAAG,OAMZ,CAAC;IAET,IACE,OAAO,WAAW,EAAE,SAAS,KAAK,QAAQ;WACvC,OAAO,WAAW,EAAE,SAAS,KAAK,QAAQ;WAC1C,OAAO,WAAW,EAAE,YAAY,KAAK,QAAQ,EAChD,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,sEAAsE,CAAC,CAAC;IAC1F,CAAC;IAED,MAAM,SAAS,GAAG,OAAO,WAAW,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC1G,IAAI,CAAC,SAAS,IAAI,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CAAC,qFAAqF,CAAC,CAAC;IACzG,CAAC;IAED,OAAO;QACL,SAAS,EAAE,WAAW,CAAC,SAAS;QAChC,SAAS,EAAE,WAAW,CAAC,SAAS;QAChC,YAAY,EAAE,WAAW,CAAC,YAAY;QACtC,SAAS;QACT,8EAA8E;QAC9E,+EAA+E;QAC/E,uEAAuE;QACvE,GAAG,CAAC,OAAO,WAAW,CAAC,aAAa,KAAK,QAAQ,IAAI,WAAW,CAAC,aAAa;YAC5E,CAAC,CAAC,EAAE,aAAa,EAAE,WAAW,CAAC,aAAa,EAAE;YAC9C,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;AACJ,CAAC","sourcesContent":["import { WildoHeaderKeys } from '@wildo-ai/saas-models';\nimport { PlatformApplicationType } from '@wildo-ai/platform-core-shared';\nimport { API_ROUTES_BACKEND_DEFINITIONS } from '~wildo-backend-lib/requests/models/api-routes.backend.defintions';\nimport { describeCaughtError } from '~wildo-backend-lib/errors/utils/error-log-level-classification.backend.utils';\nimport type { ResolvedStorageCredentials, StorageCredentialResolver } from '~wildo-backend-lib/files/storage/storage-credential-provider.backend.utils';\n\n/**\n * Resolver that obtains SHORT-LIVED, prefix-confined object-storage credentials\n * from apps-manager instead of reading a long-lived key out of process env.\n *\n * ## Why this replaces the env read outright\n *\n * `STORAGE_ACCESS_KEY` / `STORAGE_SECRET_KEY` are the object store's ROOT\n * credential, handed to every application, minion and worker through\n * `{appSlug}-secret`. See\n * `.claude/plans/object-storage-root-credential-distribution.md`.\n *\n * There is deliberately **no fallback** to those env vars. A fallback beside this\n * path is precisely how the root credential would quietly remain in use: the\n * fallback would fire on any transient apps-manager hiccup, succeed, and leave no\n * signal that the confinement had been bypassed. Failing closed is the whole\n * point — an application with no storage credential cannot leak one.\n *\n * ## Identity\n *\n * The request carries the caller's own bootstrap identity — the platform secret\n * plus its `APPLICATION_ID` — and apps-manager confines the returned credential to\n * the application that identity authenticates as. There is no parameter by which a\n * caller could ask for ANOTHER application's credential, and none should ever be\n * added.\n *\n * (Corrected 2026-08-12: this previously said the request \"names no application\",\n * which is not what the code does — `X-Application-Id` is sent below. The\n * guarantee is real but it comes from the header being the caller's OWN id and\n * being verified against the presented secret, not from the id being absent. A\n * description that does not match the request is the kind of premise a later\n * reader reasons from without re-checking.)\n *\n * ## This route is on the APPLICATION plane only\n *\n * It resolves a `wildoApplicationId` through the `apps-to-manager` controller,\n * which authenticates against `WildoApplication` records. Platform services carry\n * their own identity on a SEPARATE plane (`platform-services-to-manager`,\n * `Platform_Application_Config` / `_Secrets`, keyed by `platformApplicationId`) and\n * therefore cannot obtain a session here — which is why every platform service\n * currently reports storage UNCONFIGURED. See F-G in\n * `.claude/plans/object-storage-root-credential-distribution.md`.\n */\n/**\n * Render an STS-fetch failure into something a reader can act on.\n *\n * Deliberately assembles from several fields rather than trusting any single\n * one. An HTTP client failure can arrive as a transport error (`code`\n * `ECONNREFUSED`/`ETIMEDOUT`, no response), a non-2xx (`response.status` plus a\n * body explaining why), or a plain programming error — and each of those leaves\n * a DIFFERENT field populated, with the others absent. Reading only `message`\n * is what produced an empty diagnostic here once already.\n *\n * Falls back to the error's constructor name when everything else is empty, so\n * the output is never a bare string: \"something threw, and here is its type\" is\n * a far better starting point than silence.\n *\n * Never includes request headers — they carry the platform secret.\n */\nfunction describeStsFetchFailure(error: unknown): string {\n  const parts: string[] = [];\n\n  const message = describeCaughtError(error);\n  // `\"[object Object]\"` is what `String(x)` yields for a plain object, and it is\n  // NON-EMPTY while carrying exactly as much information as empty. Accepting it\n  // would satisfy a \"message is present\" check and still tell the reader nothing,\n  // so it is treated as absent and the type-name fallback below takes over.\n  if (message && message !== '[object Object]') parts.push(message);\n\n  const transportCode = (error as { code?: unknown })?.code;\n  if (typeof transportCode === 'string' && transportCode) parts.push(`code=${transportCode}`);\n\n  // `fetch` reports transport faults through `cause` (e.g. `ECONNREFUSED` on a\n  // refused connection) while `message` stays a generic \"fetch failed\" — so\n  // without this, the single most common real failure renders as no information\n  // at all. `AbortError` from the timeout arrives as `name` instead.\n  const causeMessage = (error as { cause?: { message?: unknown; code?: unknown } })?.cause;\n  if (causeMessage) {\n    const code = typeof causeMessage.code === 'string' ? causeMessage.code : undefined;\n    const msg = typeof causeMessage.message === 'string' ? causeMessage.message : undefined;\n    if (code) parts.push(`cause=${code}`);\n    else if (msg) parts.push(`cause=${msg}`);\n  }\n\n  const name = (error as { name?: unknown })?.name;\n  if (typeof name === 'string' && (name === 'AbortError' || name === 'TimeoutError')) {\n    parts.push(`aborted=${name}`);\n  }\n\n  // Status/body arrive already formatted from the `!response.ok` branch above,\n  // which reads them off the Response rather than off the error — `fetch` puts\n  // nothing HTTP-shaped on the thrown value.\n\n  if (parts.length === 0) {\n    const typeName = (error as { constructor?: { name?: string } })?.constructor?.name;\n    return typeName ? `unrenderable ${typeName}` : 'unrenderable error with no message, code, status or body';\n  }\n\n  return parts.join(' | ');\n}\n\n/**\n * @param resolveApplicationId - the caller's own application identity, taken from\n *   RESOLVED CONFIGURATION rather than read from `process.env` here.\n *\n *   The two are the same value for an application — the loader seeds\n *   `config.applicationId` from `APPLICATION_ID` — but they are NOT the same for a\n *   platform service, which resolves its identity locally and has no\n *   `APPLICATION_ID` in env at all. Reading env here while the object-key builder\n *   read configuration was a genuine dual-source split: the predicate that decides\n *   whether storage is usable and the value the operation addresses could disagree,\n *   and for every platform service they did. Passing it in makes the identity\n *   single-sourced and defers \"which identity\" to the one place that knows.\n */\nexport function createStsStorageCredentialResolver(\n  resolveApplicationId: () => string,\n): StorageCredentialResolver {\n  return async (): Promise<ResolvedStorageCredentials> => {\n    // ── The ISSUER may never be a CLIENT of itself ───────────────────────────\n    //\n    // apps-manager mints these credentials. If it ever takes this path it calls\n    // its own HTTP endpoint during `initializeConfig()` — before its own listener\n    // exists — which is a guaranteed `ECONNREFUSED` on every boot, not a race that\n    // occasionally loses. That happened on 2026-08-12 and held `/health/ready` at\n    // 503 for the process lifetime.\n    //\n    // It was PREVENTED before that only by accident: platform env files carry no\n    // `APPLICATION_ID`, so the provider's `isConfigured()` happened to be false.\n    // An accident is not a guard — it silently stops guarding the moment someone\n    // supplies the variable, which is exactly what a future platform-plane STS\n    // door will do. This is the explicit form, and it fails with a message naming\n    // the real reason instead of a transport error that reads as a network fault.\n    //\n    // apps-manager does its own storage work with ADMIN rights through\n    // `PlatformInfrastructureManagerService`; it does not need, and must not take,\n    // the app-tier session path.\n    if (process.env.SERVICE_NAME === PlatformApplicationType.PLATFORM_APPS_MANAGER) {\n      throw new Error(\n        'Refusing to fetch object storage session credentials: this runtime IS the issuer '\n        + `(${PlatformApplicationType.PLATFORM_APPS_MANAGER}). apps-manager brokers these `\n        + 'credentials and must never request them from itself — it would call its own HTTP '\n        + 'endpoint before that listener exists. Use the administrative object-storage '\n        + 'configuration instead.',\n      );\n    }\n\n    const appsManagerUrl = process.env.PLATFORM_APPS_MANAGER_URL;\n    const primarySecret = process.env.PLATFORM_APPLICATION_PRIMARY_SECRET;\n    // Never `process.env.APPLICATION_ID` — see the parameter's JSDoc.\n    let applicationId: string | undefined;\n    try {\n      applicationId = resolveApplicationId();\n    } catch {\n      // The configuration getter throws when configuration is not initialized.\n      // Treated as \"no identity yet\" so the message below names the whole\n      // incomplete contract rather than escaping as an unrelated config error.\n      applicationId = undefined;\n    }\n\n    if (!appsManagerUrl || !primarySecret || !applicationId) {\n      throw new Error(\n        'Cannot obtain object storage credentials: the bootstrap contract is incomplete '\n        + `(PLATFORM_APPS_MANAGER_URL: ${Boolean(appsManagerUrl)}, `\n        + `PLATFORM_APPLICATION_PRIMARY_SECRET: ${Boolean(primarySecret)}, `\n        + `applicationId: ${Boolean(applicationId)}).`,\n      );\n    }\n\n    const payload = await requestStsCredentialPayload({\n      url: `${appsManagerUrl.replace(/\\/+$/, '')}`\n        + API_ROUTES_BACKEND_DEFINITIONS.APPS_MANAGER.GET_APPLICATION_STORAGE_SESSION_CREDENTIALS(),\n      headers: {\n        [WildoHeaderKeys.CONTENT_TYPE]: 'application/json',\n        [WildoHeaderKeys.PLATFORM_SECRET]: primarySecret,\n        [WildoHeaderKeys.APPLICATION_ID]: applicationId,\n        ...(process.env.SERVICE_NAME ? { [WildoHeaderKeys.SERVICE_ID]: process.env.SERVICE_NAME } : {}),\n      },\n    });\n\n    return parseStsCredentialPayload(payload);\n  };\n}\n\n/**\n * Perform the credential fetch and unwrap the response envelope.\n *\n * Shared by the APPLICATION-plane and PLATFORM-plane resolvers, deliberately: the\n * transport, the timeout, the non-2xx branch and the diagnostic are properties of\n * \"fetching a credential from apps-manager\", not of which door was used. This repo\n * has twice paid for a duplicated path where a guard added to one copy was a silent\n * gap in the other (`buildContextualFilter`, the Mongo/PostgreSQL repositories), and\n * a fail-closed credential path is the worst place to repeat that.\n */\nexport async function requestStsCredentialPayload(input: {\n  url: string;\n  headers: Record<string, string>;\n}): Promise<unknown> {\n  try {\n    // Global `fetch`, NOT an HTTP client library — deliberately.\n    //\n    // `axios` is a `peerDependency: \"*\"` of this package, not a dependency, so\n    // reaching for it here would have added a runtime dependency to the storage\n    // path that previously had none: it resolves today only because pnpm happens\n    // to place axios in a reachable tree, and `backend-api` does not declare it at\n    // all. A consumer that did not provide axios would fail at storage\n    // initialisation — on a fail-closed path with no fallback, for a reason having\n    // nothing to do with storage.\n    //\n    // `fetch` is a Node built-in on every runtime this framework supports, so the\n    // storage path depends on nothing it is not guaranteed to have.\n    const response = await fetch(input.url, {\n      method: 'GET',\n      headers: input.headers,\n      // Bounded: this sits in front of every first storage operation after a\n      // renewal, so an unbounded wait would stall uploads rather than fail them.\n      signal: AbortSignal.timeout(15_000),\n    });\n\n    if (!response.ok) {\n      // `fetch` resolves on non-2xx rather than rejecting, so this has to be an\n      // explicit branch — the classic footgun when porting from a client that\n      // throws. Read the body BEFORE giving up on it: apps-manager explains the\n      // refusal there, and that explanation is the whole diagnostic.\n      const body = await response.text().catch(() => '');\n      throw new Error(`status=${response.status}${body ? ` | body=${body.slice(0, 300)}` : ''}`);\n    }\n\n    const parsed = await response.json() as { data?: unknown } | null;\n    return parsed?.data ?? parsed;\n  } catch (error) {\n    // Describe the failure from the HTTP error's OWN fields, not from\n    // `describeCaughtError` alone.\n    //\n    // This wrapper previously read `describeCaughtError(error)` and nothing else,\n    // and on 2026-08-10 it produced a message ending in a bare colon — the cause\n    // was empty, so the one thing the wrapper exists to surface was the one thing\n    // it discarded. Storage is a fail-closed path with no fallback by design, which\n    // makes this the ONLY diagnostic a reader gets; an empty one sends them looking\n    // at credentials when the fault may be transport, routing, or a non-2xx body.\n    throw new Error(\n      `Failed to obtain object storage session credentials from apps-manager: ${describeStsFetchFailure(error)}`,\n    );\n  }\n}\n\n/**\n * Validate the credential payload rather than trusting it.\n *\n * A malformed payload that reached the minio client would surface as an opaque\n * signature error on the first upload, a long way from the response that caused it;\n * a credential with no usable expiry would be cached forever by the provider and\n * then start failing mid-request once the server expired it.\n */\nexport function parseStsCredentialPayload(payload: unknown): ResolvedStorageCredentials {\n  const credentials = payload as {\n    accessKey?: unknown;\n    secretKey?: unknown;\n    sessionToken?: unknown;\n    expiresAt?: unknown;\n    applicationId?: unknown;\n  } | null;\n\n  if (\n    typeof credentials?.accessKey !== 'string'\n    || typeof credentials?.secretKey !== 'string'\n    || typeof credentials?.sessionToken !== 'string'\n  ) {\n    throw new Error('apps-manager returned a malformed object storage session credential.');\n  }\n\n  const expiresAt = typeof credentials.expiresAt === 'string' ? new Date(credentials.expiresAt) : undefined;\n  if (!expiresAt || Number.isNaN(expiresAt.getTime())) {\n    throw new Error('apps-manager returned an object storage session credential without a usable expiry.');\n  }\n\n  return {\n    accessKey: credentials.accessKey,\n    secretKey: credentials.secretKey,\n    sessionToken: credentials.sessionToken,\n    expiresAt,\n    // Carried through verbatim — the identity the ISSUER confined this credential\n    // to. Passed on only when the issuer supplied a usable string; a consumer that\n    // needs it must fail closed on absence rather than substitute its own.\n    ...(typeof credentials.applicationId === 'string' && credentials.applicationId\n      ? { applicationId: credentials.applicationId }\n      : {}),\n  };\n}\n"]}
+{"version":3,"file":"storage-sts-credential-resolver.backend.utils.js","sourceRoot":"","sources":["../../../../src/files/storage/storage-sts-credential-resolver.backend.utils.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,uBAAuB,EAAE,MAAM,gCAAgC,CAAC;AACzE,OAAO,EAAE,8BAA8B,EAAE,MAAM,kEAAkE,CAAC;AAClH,OAAO,EAAE,mBAAmB,EAAE,MAAM,8EAA8E,CAAC;AAGnH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH;;;;;;;;;;;;;;;GAeG;AACH,SAAS,uBAAuB,CAAC,KAAc;IAC7C,MAAM,KAAK,GAAa,EAAE,CAAC;IAE3B,MAAM,OAAO,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAC;IAC3C,+EAA+E;IAC/E,8EAA8E;IAC9E,gFAAgF;IAChF,0EAA0E;IAC1E,IAAI,OAAO,IAAI,OAAO,KAAK,iBAAiB;QAAE,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAElE,MAAM,aAAa,GAAI,KAA4B,EAAE,IAAI,CAAC;IAC1D,IAAI,OAAO,aAAa,KAAK,QAAQ,IAAI,aAAa;QAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,aAAa,EAAE,CAAC,CAAC;IAE5F,6EAA6E;IAC7E,0EAA0E;IAC1E,8EAA8E;IAC9E,mEAAmE;IACnE,MAAM,YAAY,GAAI,KAA2D,EAAE,KAAK,CAAC;IACzF,IAAI,YAAY,EAAE,CAAC;QACjB,MAAM,IAAI,GAAG,OAAO,YAAY,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;QACnF,MAAM,GAAG,GAAG,OAAO,YAAY,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;QACxF,IAAI,IAAI;YAAE,KAAK,CAAC,IAAI,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;aACjC,IAAI,GAAG;YAAE,KAAK,CAAC,IAAI,CAAC,SAAS,GAAG,EAAE,CAAC,CAAC;IAC3C,CAAC;IAED,MAAM,IAAI,GAAI,KAA4B,EAAE,IAAI,CAAC;IACjD,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,IAAI,KAAK,YAAY,IAAI,IAAI,KAAK,cAAc,CAAC,EAAE,CAAC;QACnF,KAAK,CAAC,IAAI,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC;IAChC,CAAC;IAED,6EAA6E;IAC7E,6EAA6E;IAC7E,2CAA2C;IAE3C,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,MAAM,QAAQ,GAAI,KAA6C,EAAE,WAAW,EAAE,IAAI,CAAC;QACnF,OAAO,QAAQ,CAAC,CAAC,CAAC,gBAAgB,QAAQ,EAAE,CAAC,CAAC,CAAC,0DAA0D,CAAC;IAC5G,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC3B,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,kCAAkC,CAChD,oBAAkC;IAElC,OAAO,KAAK,IAAyC,EAAE;QACrD,4EAA4E;QAC5E,EAAE;QACF,4EAA4E;QAC5E,8EAA8E;QAC9E,+EAA+E;QAC/E,8EAA8E;QAC9E,gCAAgC;QAChC,EAAE;QACF,6EAA6E;QAC7E,6EAA6E;QAC7E,6EAA6E;QAC7E,2EAA2E;QAC3E,8EAA8E;QAC9E,8EAA8E;QAC9E,EAAE;QACF,mEAAmE;QACnE,+EAA+E;QAC/E,6BAA6B;QAC7B,IAAI,OAAO,CAAC,GAAG,CAAC,YAAY,KAAK,uBAAuB,CAAC,qBAAqB,EAAE,CAAC;YAC/E,MAAM,IAAI,KAAK,CACb,mFAAmF;kBACjF,IAAI,uBAAuB,CAAC,qBAAqB,gCAAgC;kBACjF,mFAAmF;kBACnF,8EAA8E;kBAC9E,wBAAwB,CAC3B,CAAC;QACJ,CAAC;QAED,MAAM,cAAc,GAAG,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC;QAC7D,MAAM,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC,mCAAmC,CAAC;QACtE,kEAAkE;QAClE,IAAI,aAAiC,CAAC;QACtC,IAAI,CAAC;YACH,aAAa,GAAG,oBAAoB,EAAE,CAAC;QACzC,CAAC;QAAC,MAAM,CAAC;YACP,yEAAyE;YACzE,oEAAoE;YACpE,yEAAyE;YACzE,aAAa,GAAG,SAAS,CAAC;QAC5B,CAAC;QAED,IAAI,CAAC,cAAc,IAAI,CAAC,aAAa,IAAI,CAAC,aAAa,EAAE,CAAC;YACxD,MAAM,IAAI,KAAK,CACb,iFAAiF;kBAC/E,+BAA+B,OAAO,CAAC,cAAc,CAAC,IAAI;kBAC1D,wCAAwC,OAAO,CAAC,aAAa,CAAC,IAAI;kBAClE,kBAAkB,OAAO,CAAC,aAAa,CAAC,IAAI,CAC/C,CAAC;QACJ,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,2BAA2B,CAAC;YAChD,GAAG,EAAE,GAAG,cAAc,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE;kBACxC,8BAA8B,CAAC,YAAY,CAAC,2CAA2C,EAAE;YAC7F,OAAO,EAAE;gBACP,CAAC,eAAe,CAAC,YAAY,CAAC,EAAE,kBAAkB;gBAClD,CAAC,eAAe,CAAC,eAAe,CAAC,EAAE,aAAa;gBAChD,CAAC,eAAe,CAAC,cAAc,CAAC,EAAE,aAAa;gBAC/C,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,CAAC,eAAe,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC,GAAG,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAChG;SACF,CAAC,CAAC;QAEH,OAAO,yBAAyB,CAAC,OAAO,CAAC,CAAC;IAC5C,CAAC,CAAC;AACJ,CAAC;AACD;;;;;;;GAOG;AACH,MAAM,iCAAiC,GAAG,MAAM,CAAC;AAGjD;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,KAGjD;IACC,IAAI,CAAC;QACH,6DAA6D;QAC7D,EAAE;QACF,2EAA2E;QAC3E,4EAA4E;QAC5E,6EAA6E;QAC7E,+EAA+E;QAC/E,mEAAmE;QACnE,+EAA+E;QAC/E,8BAA8B;QAC9B,EAAE;QACF,8EAA8E;QAC9E,gEAAgE;QAChE,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE;YACtC,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,iCAAiC,CAAC;SAC/D,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,0EAA0E;YAC1E,wEAAwE;YACxE,0EAA0E;YAC1E,+DAA+D;YAC/D,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;YACnD,MAAM,IAAI,KAAK,CAAC,UAAU,QAAQ,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,WAAW,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC7F,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,EAA+B,CAAC;QAClE,OAAO,MAAM,EAAE,IAAI,IAAI,MAAM,CAAC;IAChC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,kEAAkE;QAClE,+BAA+B;QAC/B,EAAE;QACF,8EAA8E;QAC9E,6EAA6E;QAC7E,8EAA8E;QAC9E,gFAAgF;QAChF,gFAAgF;QAChF,8EAA8E;QAC9E,MAAM,IAAI,KAAK,CACb,0EAA0E,uBAAuB,CAAC,KAAK,CAAC,EAAE,CAC3G,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,yBAAyB,CAAC,OAAgB;IACxD,MAAM,WAAW,GAAG,OAMZ,CAAC;IAET,IACE,OAAO,WAAW,EAAE,SAAS,KAAK,QAAQ;WACvC,OAAO,WAAW,EAAE,SAAS,KAAK,QAAQ;WAC1C,OAAO,WAAW,EAAE,YAAY,KAAK,QAAQ,EAChD,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,sEAAsE,CAAC,CAAC;IAC1F,CAAC;IAED,MAAM,SAAS,GAAG,OAAO,WAAW,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC1G,IAAI,CAAC,SAAS,IAAI,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CAAC,qFAAqF,CAAC,CAAC;IACzG,CAAC;IAED,OAAO;QACL,SAAS,EAAE,WAAW,CAAC,SAAS;QAChC,SAAS,EAAE,WAAW,CAAC,SAAS;QAChC,YAAY,EAAE,WAAW,CAAC,YAAY;QACtC,SAAS;QACT,8EAA8E;QAC9E,+EAA+E;QAC/E,uEAAuE;QACvE,GAAG,CAAC,OAAO,WAAW,CAAC,aAAa,KAAK,QAAQ,IAAI,WAAW,CAAC,aAAa;YAC5E,CAAC,CAAC,EAAE,aAAa,EAAE,WAAW,CAAC,aAAa,EAAE;YAC9C,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;AACJ,CAAC","sourcesContent":["import { WildoHeaderKeys } from '@wildo-ai/saas-models';\nimport { PlatformApplicationType } from '@wildo-ai/platform-core-shared';\nimport { API_ROUTES_BACKEND_DEFINITIONS } from '~wildo-backend-lib/requests/models/api-routes.backend.defintions';\nimport { describeCaughtError } from '~wildo-backend-lib/errors/utils/error-log-level-classification.backend.utils';\nimport type { ResolvedStorageCredentials, StorageCredentialResolver } from '~wildo-backend-lib/files/storage/storage-credential-provider.backend.utils';\n\n/**\n * Resolver that obtains SHORT-LIVED, prefix-confined object-storage credentials\n * from apps-manager instead of reading a long-lived key out of process env.\n *\n * ## Why this replaces the env read outright\n *\n * `STORAGE_ACCESS_KEY` / `STORAGE_SECRET_KEY` are the object store's ROOT\n * credential, handed to every application, minion and worker through\n * `{appSlug}-secret`. See\n * `.claude/plans/object-storage-root-credential-distribution.md`.\n *\n * There is deliberately **no fallback** to those env vars. A fallback beside this\n * path is precisely how the root credential would quietly remain in use: the\n * fallback would fire on any transient apps-manager hiccup, succeed, and leave no\n * signal that the confinement had been bypassed. Failing closed is the whole\n * point — an application with no storage credential cannot leak one.\n *\n * ## Identity\n *\n * The request carries the caller's own bootstrap identity — the platform secret\n * plus its `APPLICATION_ID` — and apps-manager confines the returned credential to\n * the application that identity authenticates as. There is no parameter by which a\n * caller could ask for ANOTHER application's credential, and none should ever be\n * added.\n *\n * (Corrected 2026-08-12: this previously said the request \"names no application\",\n * which is not what the code does — `X-Application-Id` is sent below. The\n * guarantee is real but it comes from the header being the caller's OWN id and\n * being verified against the presented secret, not from the id being absent. A\n * description that does not match the request is the kind of premise a later\n * reader reasons from without re-checking.)\n *\n * ## This route is on the APPLICATION plane only\n *\n * It resolves a `wildoApplicationId` through the `apps-to-manager` controller,\n * which authenticates against `WildoApplication` records. Platform services carry\n * their own identity on a SEPARATE plane (`platform-services-to-manager`,\n * `Platform_Application_Config` / `_Secrets`, keyed by `platformApplicationId`) and\n * therefore cannot obtain a session here — which is why every platform service\n * currently reports storage UNCONFIGURED. See F-G in\n * `.claude/plans/object-storage-root-credential-distribution.md`.\n */\n/**\n * Render an STS-fetch failure into something a reader can act on.\n *\n * Deliberately assembles from several fields rather than trusting any single\n * one. An HTTP client failure can arrive as a transport error (`code`\n * `ECONNREFUSED`/`ETIMEDOUT`, no response), a non-2xx (`response.status` plus a\n * body explaining why), or a plain programming error — and each of those leaves\n * a DIFFERENT field populated, with the others absent. Reading only `message`\n * is what produced an empty diagnostic here once already.\n *\n * Falls back to the error's constructor name when everything else is empty, so\n * the output is never a bare string: \"something threw, and here is its type\" is\n * a far better starting point than silence.\n *\n * Never includes request headers — they carry the platform secret.\n */\nfunction describeStsFetchFailure(error: unknown): string {\n  const parts: string[] = [];\n\n  const message = describeCaughtError(error);\n  // `\"[object Object]\"` is what `String(x)` yields for a plain object, and it is\n  // NON-EMPTY while carrying exactly as much information as empty. Accepting it\n  // would satisfy a \"message is present\" check and still tell the reader nothing,\n  // so it is treated as absent and the type-name fallback below takes over.\n  if (message && message !== '[object Object]') parts.push(message);\n\n  const transportCode = (error as { code?: unknown })?.code;\n  if (typeof transportCode === 'string' && transportCode) parts.push(`code=${transportCode}`);\n\n  // `fetch` reports transport faults through `cause` (e.g. `ECONNREFUSED` on a\n  // refused connection) while `message` stays a generic \"fetch failed\" — so\n  // without this, the single most common real failure renders as no information\n  // at all. `AbortError` from the timeout arrives as `name` instead.\n  const causeMessage = (error as { cause?: { message?: unknown; code?: unknown } })?.cause;\n  if (causeMessage) {\n    const code = typeof causeMessage.code === 'string' ? causeMessage.code : undefined;\n    const msg = typeof causeMessage.message === 'string' ? causeMessage.message : undefined;\n    if (code) parts.push(`cause=${code}`);\n    else if (msg) parts.push(`cause=${msg}`);\n  }\n\n  const name = (error as { name?: unknown })?.name;\n  if (typeof name === 'string' && (name === 'AbortError' || name === 'TimeoutError')) {\n    parts.push(`aborted=${name}`);\n  }\n\n  // Status/body arrive already formatted from the `!response.ok` branch above,\n  // which reads them off the Response rather than off the error — `fetch` puts\n  // nothing HTTP-shaped on the thrown value.\n\n  if (parts.length === 0) {\n    const typeName = (error as { constructor?: { name?: string } })?.constructor?.name;\n    return typeName ? `unrenderable ${typeName}` : 'unrenderable error with no message, code, status or body';\n  }\n\n  return parts.join(' | ');\n}\n\n/**\n * @param resolveApplicationId - the caller's own application identity, taken from\n *   RESOLVED CONFIGURATION rather than read from `process.env` here.\n *\n *   The two are the same value for an application — the loader seeds\n *   `config.applicationId` from `APPLICATION_ID` — but they are NOT the same for a\n *   platform service, which resolves its identity locally and has no\n *   `APPLICATION_ID` in env at all. Reading env here while the object-key builder\n *   read configuration was a genuine dual-source split: the predicate that decides\n *   whether storage is usable and the value the operation addresses could disagree,\n *   and for every platform service they did. Passing it in makes the identity\n *   single-sourced and defers \"which identity\" to the one place that knows.\n */\nexport function createStsStorageCredentialResolver(\n  resolveApplicationId: () => string,\n): StorageCredentialResolver {\n  return async (): Promise<ResolvedStorageCredentials> => {\n    // ── The ISSUER may never be a CLIENT of itself ───────────────────────────\n    //\n    // apps-manager mints these credentials. If it ever takes this path it calls\n    // its own HTTP endpoint during `initializeConfig()` — before its own listener\n    // exists — which is a guaranteed `ECONNREFUSED` on every boot, not a race that\n    // occasionally loses. That happened on 2026-08-12 and held `/health/ready` at\n    // 503 for the process lifetime.\n    //\n    // It was PREVENTED before that only by accident: platform env files carry no\n    // `APPLICATION_ID`, so the provider's `isConfigured()` happened to be false.\n    // An accident is not a guard — it silently stops guarding the moment someone\n    // supplies the variable, which is exactly what a future platform-plane STS\n    // door will do. This is the explicit form, and it fails with a message naming\n    // the real reason instead of a transport error that reads as a network fault.\n    //\n    // apps-manager does its own storage work with ADMIN rights through\n    // `PlatformInfrastructureManagerService`; it does not need, and must not take,\n    // the app-tier session path.\n    if (process.env.SERVICE_NAME === PlatformApplicationType.PLATFORM_APPS_MANAGER) {\n      throw new Error(\n        'Refusing to fetch object storage session credentials: this runtime IS the issuer '\n        + `(${PlatformApplicationType.PLATFORM_APPS_MANAGER}). apps-manager brokers these `\n        + 'credentials and must never request them from itself — it would call its own HTTP '\n        + 'endpoint before that listener exists. Use the administrative object-storage '\n        + 'configuration instead.',\n      );\n    }\n\n    const appsManagerUrl = process.env.PLATFORM_APPS_MANAGER_URL;\n    const primarySecret = process.env.PLATFORM_APPLICATION_PRIMARY_SECRET;\n    // Never `process.env.APPLICATION_ID` — see the parameter's JSDoc.\n    let applicationId: string | undefined;\n    try {\n      applicationId = resolveApplicationId();\n    } catch {\n      // The configuration getter throws when configuration is not initialized.\n      // Treated as \"no identity yet\" so the message below names the whole\n      // incomplete contract rather than escaping as an unrelated config error.\n      applicationId = undefined;\n    }\n\n    if (!appsManagerUrl || !primarySecret || !applicationId) {\n      throw new Error(\n        'Cannot obtain object storage credentials: the bootstrap contract is incomplete '\n        + `(PLATFORM_APPS_MANAGER_URL: ${Boolean(appsManagerUrl)}, `\n        + `PLATFORM_APPLICATION_PRIMARY_SECRET: ${Boolean(primarySecret)}, `\n        + `applicationId: ${Boolean(applicationId)}).`,\n      );\n    }\n\n    const payload = await requestStsCredentialPayload({\n      url: `${appsManagerUrl.replace(/\\/+$/, '')}`\n        + API_ROUTES_BACKEND_DEFINITIONS.APPS_MANAGER.GET_APPLICATION_STORAGE_SESSION_CREDENTIALS(),\n      headers: {\n        [WildoHeaderKeys.CONTENT_TYPE]: 'application/json',\n        [WildoHeaderKeys.PLATFORM_SECRET]: primarySecret,\n        [WildoHeaderKeys.APPLICATION_ID]: applicationId,\n        ...(process.env.SERVICE_NAME ? { [WildoHeaderKeys.SERVICE_ID]: process.env.SERVICE_NAME } : {}),\n      },\n    });\n\n    return parseStsCredentialPayload(payload);\n  };\n}\n/**\n * Hard deadline for one STS credential fetch from apps-manager.\n *\n * This sits in front of every FIRST storage operation after a renewal, so the cost of an unbounded\n * wait is not a slow credential — it is an upload that stalls instead of failing, on a fail-closed\n * path with no fallback. 15s: the payload is a small JSON credential from a service on our own\n * network, and the operation behind it is a user waiting for a file to move.\n */\nconst STS_CREDENTIAL_REQUEST_TIMEOUT_MS = 15_000;\n\n\n/**\n * Perform the credential fetch and unwrap the response envelope.\n *\n * Shared by the APPLICATION-plane and PLATFORM-plane resolvers, deliberately: the\n * transport, the timeout, the non-2xx branch and the diagnostic are properties of\n * \"fetching a credential from apps-manager\", not of which door was used. This repo\n * has twice paid for a duplicated path where a guard added to one copy was a silent\n * gap in the other (`buildContextualFilter`, the Mongo/PostgreSQL repositories), and\n * a fail-closed credential path is the worst place to repeat that.\n */\nexport async function requestStsCredentialPayload(input: {\n  url: string;\n  headers: Record<string, string>;\n}): Promise<unknown> {\n  try {\n    // Global `fetch`, NOT an HTTP client library — deliberately.\n    //\n    // `axios` is a `peerDependency: \"*\"` of this package, not a dependency, so\n    // reaching for it here would have added a runtime dependency to the storage\n    // path that previously had none: it resolves today only because pnpm happens\n    // to place axios in a reachable tree, and `backend-api` does not declare it at\n    // all. A consumer that did not provide axios would fail at storage\n    // initialisation — on a fail-closed path with no fallback, for a reason having\n    // nothing to do with storage.\n    //\n    // `fetch` is a Node built-in on every runtime this framework supports, so the\n    // storage path depends on nothing it is not guaranteed to have.\n    const response = await fetch(input.url, {\n      method: 'GET',\n      headers: input.headers,\n      signal: AbortSignal.timeout(STS_CREDENTIAL_REQUEST_TIMEOUT_MS),\n    });\n\n    if (!response.ok) {\n      // `fetch` resolves on non-2xx rather than rejecting, so this has to be an\n      // explicit branch — the classic footgun when porting from a client that\n      // throws. Read the body BEFORE giving up on it: apps-manager explains the\n      // refusal there, and that explanation is the whole diagnostic.\n      const body = await response.text().catch(() => '');\n      throw new Error(`status=${response.status}${body ? ` | body=${body.slice(0, 300)}` : ''}`);\n    }\n\n    const parsed = await response.json() as { data?: unknown } | null;\n    return parsed?.data ?? parsed;\n  } catch (error) {\n    // Describe the failure from the HTTP error's OWN fields, not from\n    // `describeCaughtError` alone.\n    //\n    // This wrapper previously read `describeCaughtError(error)` and nothing else,\n    // and on 2026-08-10 it produced a message ending in a bare colon — the cause\n    // was empty, so the one thing the wrapper exists to surface was the one thing\n    // it discarded. Storage is a fail-closed path with no fallback by design, which\n    // makes this the ONLY diagnostic a reader gets; an empty one sends them looking\n    // at credentials when the fault may be transport, routing, or a non-2xx body.\n    throw new Error(\n      `Failed to obtain object storage session credentials from apps-manager: ${describeStsFetchFailure(error)}`,\n    );\n  }\n}\n\n/**\n * Validate the credential payload rather than trusting it.\n *\n * A malformed payload that reached the minio client would surface as an opaque\n * signature error on the first upload, a long way from the response that caused it;\n * a credential with no usable expiry would be cached forever by the provider and\n * then start failing mid-request once the server expired it.\n */\nexport function parseStsCredentialPayload(payload: unknown): ResolvedStorageCredentials {\n  const credentials = payload as {\n    accessKey?: unknown;\n    secretKey?: unknown;\n    sessionToken?: unknown;\n    expiresAt?: unknown;\n    applicationId?: unknown;\n  } | null;\n\n  if (\n    typeof credentials?.accessKey !== 'string'\n    || typeof credentials?.secretKey !== 'string'\n    || typeof credentials?.sessionToken !== 'string'\n  ) {\n    throw new Error('apps-manager returned a malformed object storage session credential.');\n  }\n\n  const expiresAt = typeof credentials.expiresAt === 'string' ? new Date(credentials.expiresAt) : undefined;\n  if (!expiresAt || Number.isNaN(expiresAt.getTime())) {\n    throw new Error('apps-manager returned an object storage session credential without a usable expiry.');\n  }\n\n  return {\n    accessKey: credentials.accessKey,\n    secretKey: credentials.secretKey,\n    sessionToken: credentials.sessionToken,\n    expiresAt,\n    // Carried through verbatim — the identity the ISSUER confined this credential\n    // to. Passed on only when the issuer supplied a usable string; a consumer that\n    // needs it must fail closed on absence rather than substitute its own.\n    ...(typeof credentials.applicationId === 'string' && credentials.applicationId\n      ? { applicationId: credentials.applicationId }\n      : {}),\n  };\n}\n"]}

package/dist/esm/files/storage/wildo-managed-storage-provider.backend.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"wildo-managed-storage-provider.backend.service.d.ts","sourceRoot":"","sources":["../../../../../src/files/storage/wildo-managed-storage-provider.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAGH,OAAO,EAAE,QAAQ,EAAE,MAAM,QAAQ,CAAC;AAGlC,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAG/D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAClG,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAE9G,OAAO,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AAE/G,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qEAAqE,CAAC;AAO5G,OAAO,KAAK,EAA8B,yBAAyB,EAAE,MAAM,4EAA4E,CAAC;AASxJ,OAAO,KAAK,EACV,oBAAoB,EACpB,mBAAmB,EACnB,oBAAoB,EACpB,qBAAqB,EACrB,mBAAmB,EACnB,2BAA2B,EAC3B,uBAAuB,EACxB,MAAM,+BAA+B,CAAC;AAqEvC,qBACa,2BAA4B,YAAW,oBAAoB;IA4DpE,OAAO,CAAC,QAAQ,CAAC,MAAM;IAEvB,OAAO,CAAC,QAAQ,CAAC,YAAY;IAE7B,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IACjC;;;;;;;;;;;;;OAaG;IAEH,OAAO,CAAC,QAAQ,CAAC,0BAA0B,CAAC;IA/E9C,QAAQ,CAAC,UAAU,qCAAqC;IACxD,OAAO,CAAC,MAAM,CAAuB;IACrC;;;;;;OAMG;IACH,OAAO,CAAC,eAAe,CAAqB;IAC5C;;;;;;OAMG;IACH,OAAO,CAAC,kBAAkB,CAA0C;IACpE;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,OAAO,KAAK,iBAAiB,GAE5B;IAED;;;;;;OAMG;IACH,OAAO,KAAK,UAAU,GAErB;gBAIkB,MAAM,EAAE,aAAa,EAErB,YAAY,EAAE,0BAA0B,EAExC,gBAAgB,EAAE,uBAAuB;IAC1D;;;;;;;;;;;;;OAaG;IAEc,0BAA0B,CAAC,EAAE,yBAAyB;IAGzE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAoCG;IACH,YAAY,IAAI,OAAO;IAIvB;;;;;;;;OAQG;IACH,OAAO,CAAC,yBAAyB;IA2BjC;;;;;;;;;;OAUG;IACH,OAAO,CAAC,qBAAqB;IAY7B;;;;OAIG;IACG,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAIjC;;;;;;;;;;;;;;;;OAgBG;YACW,iBAAiB;IA+D/B;;;;;OAKG;YACW,SAAS;IA+DvB;;;;;;;;;;;;;;;;OAgBG;YACW,gBAAgB;IAyB9B;;;;;;;;;;;;;;;;;OAiBG;IACH,OAAO,CAAC,mBAAmB;IAO3B;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4BG;IACH,OAAO,CAAC,yBAAyB;YAwBnB,2BAA2B;IA2EzC,OAAO,CAAC,mBAAmB;IAqJrB,MAAM,CACV,UAAU,EAAE,QAAQ,EACpB,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,EACZ,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACvC,OAAO,CAAC,EAAE,oBAAoB,GAC7B,OAAO,CAAC,mBAAmB,CAAC;IAqFzB,QAAQ,CACZ,IAAI,EAAE,uBAAuB,EAC7B,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,GACtC,OAAO,CAAC,qBAAqB,CAAC;IAgD3B,MAAM,CACV,IAAI,EAAE,uBAAuB,EAC7B,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,GACtC,OAAO,CAAC,IAAI,CAAC;IA2BV,WAAW,CACf,IAAI,EAAE,uBAAuB,EAC7B,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,GACtC,OAAO,CAAC,mBAAmB,CAAC;IAyCzB,WAAW,IAAI,OAAO,CAAC,2BAA2B,CAAC;IA0IzD;;;;;;;OAOG;IACH,OAAO,CAAC,qBAAqB;CAgB9B"}
+{"version":3,"file":"wildo-managed-storage-provider.backend.service.d.ts","sourceRoot":"","sources":["../../../../src/files/storage/wildo-managed-storage-provider.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAGH,OAAO,EAAE,QAAQ,EAAE,MAAM,QAAQ,CAAC;AAGlC,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAG/D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAClG,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAE9G,OAAO,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AAE/G,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qEAAqE,CAAC;AAO5G,OAAO,KAAK,EAA8B,yBAAyB,EAAE,MAAM,4EAA4E,CAAC;AASxJ,OAAO,KAAK,EACV,oBAAoB,EACpB,mBAAmB,EACnB,oBAAoB,EACpB,qBAAqB,EACrB,mBAAmB,EACnB,2BAA2B,EAC3B,uBAAuB,EACxB,MAAM,+BAA+B,CAAC;AAqEvC,qBACa,2BAA4B,YAAW,oBAAoB;IA4DpE,OAAO,CAAC,QAAQ,CAAC,MAAM;IAEvB,OAAO,CAAC,QAAQ,CAAC,YAAY;IAE7B,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IACjC;;;;;;;;;;;;;OAaG;IAEH,OAAO,CAAC,QAAQ,CAAC,0BAA0B,CAAC;IA/E9C,QAAQ,CAAC,UAAU,qCAAqC;IACxD,OAAO,CAAC,MAAM,CAAuB;IACrC;;;;;;OAMG;IACH,OAAO,CAAC,eAAe,CAAqB;IAC5C;;;;;;OAMG;IACH,OAAO,CAAC,kBAAkB,CAA0C;IACpE;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,OAAO,KAAK,iBAAiB,GAE5B;IAED;;;;;;OAMG;IACH,OAAO,KAAK,UAAU,GAErB;gBAIkB,MAAM,EAAE,aAAa,EAErB,YAAY,EAAE,0BAA0B,EAExC,gBAAgB,EAAE,uBAAuB;IAC1D;;;;;;;;;;;;;OAaG;IAEc,0BAA0B,CAAC,EAAE,yBAAyB;IAGzE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAoCG;IACH,YAAY,IAAI,OAAO;IAIvB;;;;;;;;OAQG;IACH,OAAO,CAAC,yBAAyB;IA2BjC;;;;;;;;;;OAUG;IACH,OAAO,CAAC,qBAAqB;IAY7B;;;;OAIG;IACG,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAIjC;;;;;;;;;;;;;;;;OAgBG;YACW,iBAAiB;IA+D/B;;;;;OAKG;YACW,SAAS;IA+DvB;;;;;;;;;;;;;;;;OAgBG;YACW,gBAAgB;IAyB9B;;;;;;;;;;;;;;;;;OAiBG;IACH,OAAO,CAAC,mBAAmB;IAO3B;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4BG;IACH,OAAO,CAAC,yBAAyB;YAwBnB,2BAA2B;IA2EzC,OAAO,CAAC,mBAAmB;IAqJrB,MAAM,CACV,UAAU,EAAE,QAAQ,EACpB,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,EACZ,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACvC,OAAO,CAAC,EAAE,oBAAoB,GAC7B,OAAO,CAAC,mBAAmB,CAAC;IAqFzB,QAAQ,CACZ,IAAI,EAAE,uBAAuB,EAC7B,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,GACtC,OAAO,CAAC,qBAAqB,CAAC;IAgD3B,MAAM,CACV,IAAI,EAAE,uBAAuB,EAC7B,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,GACtC,OAAO,CAAC,IAAI,CAAC;IA2BV,WAAW,CACf,IAAI,EAAE,uBAAuB,EAC7B,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,GACtC,OAAO,CAAC,mBAAmB,CAAC;IAyCzB,WAAW,IAAI,OAAO,CAAC,2BAA2B,CAAC;IA0IzD;;;;;;;OAOG;IACH,OAAO,CAAC,qBAAqB;CAgB9B"}

package/dist/esm/files/storage/wildo-managed-storage-provider.backend.service.js.map

@@ -1 +1 @@
-{"version":3,"file":"wildo-managed-storage-provider.backend.service.js","sourceRoot":"","sources":["../../../../../src/files/storage/wildo-managed-storage-provider.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;;;;;;;;;;;;;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAEzD,OAAO,EAAE,MAAM,EAAiB,MAAM,OAAO,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,2BAA2B,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AACrH,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAC/D,OAAO,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AACtF,OAAO,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AAEpF,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAC9G,OAAO,EAAE,mBAAmB,EAAE,MAAM,8EAA8E,CAAC;AACnH,OAAO,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AAG/G,OAAO,EAAE,aAAa,EAAE,mBAAmB,EAAE,cAAc,EAAE,YAAY,EAAE,cAAc,EAAE,4BAA4B,EAAE,MAAM,sDAAsD,CAAC;AACtL,OAAO,EAAE,8BAA8B,EAAE,MAAM,kEAAkE,CAAC;AAClH,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAG7D,OAAO,EAAE,yBAAyB,EAAE,MAAM,4EAA4E,CAAC;AAEvH,OAAO,EAAE,kCAAkC,EAAE,MAAM,gFAAgF,CAAC;AACpI,OAAO,EAAE,iCAAiC,EAAE,MAAM,2EAA2E,CAAC;AAC9H,OAAO,EACL,wBAAwB,EACxB,4BAA4B,EAC5B,sBAAsB,EACtB,6BAA6B,GAC9B,MAAM,yCAAyC,CAAC;AAWjD,MAAM,sBAAsB,GAAG,WAAW,CAAC;AAE3C;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAM,gCAAgC,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,GAAG,IAAI,CAAC;AAEhE;;;;;;;;;;;;GAYG;AACH,MAAM,eAAe,GAAG,gCAAgC,CAAC;AAEzD;;;;;;;;;;;;;GAaG;AACH,SAAS,uBAAuB,CAAC,KAAc;IAC7C,MAAM,IAAI,GAAI,KAA4B,EAAE,IAAI,CAAC;IACjD,OAAO,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;AACxE,CAAC;AAGM,IAAM,2BAA2B,GAAjC,MAAM,2BAA2B;IA4DnB;IAEA;IAEA;IAgBA;IA/EV,UAAU,GAAG,mBAAmB,CAAC,aAAa,CAAC;IAChD,MAAM,GAAkB,IAAI,CAAC;IACrC;;;;;;OAMG;IACK,eAAe,CAAqB;IAC5C;;;;;;OAMG;IACK,kBAAkB,GAAqC,IAAI,CAAC;IACpE;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,IAAY,iBAAiB;QAC3B,OAAO,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC;IACvD,CAAC;IAED;;;;;;OAMG;IACH,IAAY,UAAU;QACpB,OAAO,IAAI,CAAC,iBAAiB,EAAE,MAAM,IAAI,gBAAgB,CAAC,MAAM,CAAC;IACnE,CAAC;IAED,YAEmB,MAAqB,EAErB,YAAwC,EAExC,gBAAyC,EAgBzC,0BAAsD;QApBtD,WAAM,GAAN,MAAM,CAAe;QAErB,iBAAY,GAAZ,YAAY,CAA4B;QAExC,qBAAgB,GAAhB,gBAAgB,CAAyB;QAgBzC,+BAA0B,GAA1B,0BAA0B,CAA4B;IACtE,CAAC;IAEJ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAoCG;IACH,YAAY;QACV,OAAO,CAAC,CAAC,IAAI,CAAC,iBAAiB,EAAE,QAAQ,IAAI,IAAI,CAAC,yBAAyB,EAAE,CAAC;IAChF,CAAC;IAED;;;;;;;;OAQG;IACK,yBAAyB;QAC/B,6EAA6E;QAC7E,IAAI,IAAI,CAAC,0BAA0B;YAAE,OAAO,IAAI,CAAC;QAEjD,OAAO,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,yBAAyB;eACzC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,mCAAmC;YACpD,yEAAyE;YACzE,0EAA0E;YAC1E,EAAE;YACF,0EAA0E;YAC1E,6EAA6E;YAC7E,6EAA6E;YAC7E,8EAA8E;YAC9E,wEAAwE;YACxE,+EAA+E;YAC/E,8EAA8E;YAC9E,mDAAmD;YACnD,EAAE;YACF,6EAA6E;YAC7E,+EAA+E;YAC/E,gFAAgF;YAChF,4EAA4E;YAC5E,gDAAgD;YAChD,kEAAkE;eAC/D,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC;IACpC,CAAC;IAED;;;;;;;;;;OAUG;IACK,qBAAqB;QAC3B,IAAI,IAAI,CAAC,kBAAkB;YAAE,OAAO,IAAI,CAAC,kBAAkB,CAAC;QAE5D,IAAI,CAAC,kBAAkB,GAAG,IAAI,yBAAyB,CACrD,IAAI,CAAC,0BAA0B;YAC/B,0EAA0E;YAC1E,sEAAsE;eACnE,kCAAkC,CAAC,GAAG,EAAE,CAAC,iCAAiC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,CACtG,CAAC;QACF,OAAO,IAAI,CAAC,kBAAkB,CAAC;IACjC,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,UAAU;QACd,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;IACzB,CAAC;IAED;;;;;;;;;;;;;;;;OAgBG;IACK,KAAK,CAAC,iBAAiB;QAC7B,MAAM,UAAU,GAAG,IAAI,CAAC,iBAAiB,CAAC;QAC1C,MAAM,QAAQ,GAAG,UAAU,EAAE,QAAQ,CAAC;QACtC,MAAM,IAAI,GAAG,UAAU,EAAE,IAAI,IAAI,mBAAmB,CAAC,KAAK,CAAC;QAC3D,MAAM,MAAM,GAAG,UAAU,EAAE,MAAM,IAAI,KAAK,CAAC;QAE3C,yEAAyE;QACzE,4EAA4E;QAC5E,kEAAkE;QAClE,iDAAiD;QACjD,EAAE;QACF,4EAA4E;QAC5E,qEAAqE;QACrE,0EAA0E;QAC1E,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,EAAE,CAAC;YACtC,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,aAAa,EACvB,SAAS,EACT;gBACE,sBAAsB,EAAE,2BAA2B,CAAC,aAAa;gBACjE,OAAO,EAAE;oBACP,OAAO,EACL,wGAAwG;0BACtG,gFAAgF;oBACpF,WAAW,EAAE,CAAC,CAAC,QAAQ;oBACvB,iBAAiB,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,yBAAyB;oBAC1D,gBAAgB,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,mCAAmC;oBACnE,sEAAsE;oBACtE,kEAAkE;oBAClE,kCAAkC;oBAClC,gBAAgB,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc;iBAC/C;aACF,CACF,CAAC;QACJ,CAAC;QAED,6EAA6E;QAC7E,wEAAwE;QACxE,4DAA4D;QAC5D,IAAI,WAAW,CAAC;QAChB,IAAI,CAAC;YACH,WAAW,GAAG,MAAM,IAAI,CAAC,qBAAqB,EAAE,CAAC,cAAc,EAAE,CAAC;QACpE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,qEAAqE;YACrE,0EAA0E;YAC1E,YAAY;YACZ,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,aAAa,EACvB,SAAS,EACT;gBACE,sBAAsB,EAAE,2BAA2B,CAAC,aAAa;gBACjE,OAAO,EAAE;oBACP,SAAS,EAAE,6BAA6B;oBACxC,OAAO,EAAE,wEAAwE;oBACjF,KAAK,EAAE,mBAAmB,CAAC,KAAK,CAAC;iBAClC;aACF,CACF,CAAC;QACJ,CAAC;QAED,OAAO,WAAW,CAAC;IACrB,CAAC;IAED;;;;;OAKG;IACK,KAAK,CAAC,SAAS;QACrB,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACnD,MAAM,UAAU,GAAG,IAAI,CAAC,iBAAiB,CAAC;QAC1C,MAAM,QAAQ,GAAG,UAAU,EAAE,QAAQ,IAAI,EAAE,CAAC;QAC5C,MAAM,IAAI,GAAG,UAAU,EAAE,IAAI,IAAI,mBAAmB,CAAC,KAAK,CAAC;QAC3D,MAAM,MAAM,GAAG,UAAU,EAAE,MAAM,IAAI,KAAK,CAAC;QAE3C,IAAI,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,eAAe,KAAK,WAAW,CAAC,SAAS,EAAE,CAAC;YAClE,OAAO,IAAI,CAAC,MAAM,CAAC;QACrB,CAAC;QAED,MAAM,WAAW,GAAG,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC;YAC1C,CAAC,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC;YACnB,CAAC,CAAC,IAAI,GAAG,CAAC,OAAO,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,MAAM,QAAQ,EAAE,CAAC,CAAC;QAEtD,MAAM,OAAO,GAAkB;YAC7B,QAAQ,EAAE,WAAW,CAAC,QAAQ;YAC9B,IAAI,EAAE,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI;YAC9D,MAAM,EAAE,MAAM,IAAI,WAAW,CAAC,QAAQ,KAAK,QAAQ;YACnD,SAAS,EAAE,WAAW,CAAC,SAAS;YAChC,SAAS,EAAE,WAAW,CAAC,SAAS;YAChC,sEAAsE;YACtE,8CAA8C;YAC9C,GAAG,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,WAAW,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/E,MAAM,EAAE,sBAAsB;YAC9B,wEAAwE;YACxE,wEAAwE;YACxE,oEAAoE;YACpE,QAAQ,EAAE,eAAe;SAC1B,CAAC;QAEF,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC;QAEnC,iEAAiE;QACjE,EAAE;QACF,yEAAyE;QACzE,4EAA4E;QAC5E,8EAA8E;QAC9E,0EAA0E;QAC1E,8EAA8E;QAC9E,wEAAwE;QACxE,8EAA8E;QAC9E,6EAA6E;QAC7E,SAAS;QACT,EAAE;QACF,2EAA2E;QAC3E,yEAAyE;QACzE,8EAA8E;QAC9E,0DAA0D;QAC1D,8EAA8E;QAC9E,2EAA2E;QAC3E,6EAA6E;QAC7E,yCAAyC;QACzC,EAAE;QACF,4EAA4E;QAE5E,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,uEAAuE;QACvE,gEAAgE;QAChE,IAAI,CAAC,eAAe,GAAG,WAAW,CAAC,SAAS,CAAC;QAC7C,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;;;;;;;;;;;;;;OAgBG;IACK,KAAK,CAAC,gBAAgB,CAAC,gBAAuC;QACpE,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACnD,MAAM,aAAa,GAAG,WAAW,CAAC,aAAa,CAAC;QAEhD,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,aAAa,EACvB,gBAAgB,EAChB;gBACE,sBAAsB,EAAE,2BAA2B,CAAC,aAAa;gBACjE,OAAO,EAAE;oBACP,SAAS,EAAE,uCAAuC;oBAClD,OAAO,EACL,sFAAsF;0BACpF,oFAAoF;0BACpF,qBAAqB;iBAC1B;aACF,CACF,CAAC;QACJ,CAAC;QAED,aAAa,CAAC,aAAa,EAAE,IAAI,CAAC,YAAY,EAAE,gBAAgB,EAAE,eAAe,CAAC,CAAC;QACnF,OAAO,aAAa,CAAC;IACvB,CAAC;IAED;;;;;;;;;;;;;;;;;OAiBG;IACK,mBAAmB;QACzB,MAAM,GAAG,GAAG,IAAI,CAAC,iBAAiB,EAAE,YAAY,CAAC;QACjD,IAAI,CAAC,GAAG;YAAE,OAAO,EAAE,CAAC;QACpB,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;QAC3B,OAAO,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,CAAC;IACvE,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4BG;IACK,yBAAyB,CAC/B,SAAiB,EACjB,gBAAuC,EACvC,WAAoC;QAEpC,IAAI,CAAC,6BAA6B,CAAC,SAAS,CAAC,EAAE,CAAC;YAC9C,OAAO;QACT,CAAC;QAED,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,aAAa,EACvB,gBAAgB,EAChB;YACE,sBAAsB,EAAE,2BAA2B,CAAC,4BAA4B;YAChF,OAAO,EAAE;gBACP,wBAAwB;gBACxB,GAAG,WAAW;gBACd,SAAS;gBACT,QAAQ,EAAE,IAAI,CAAC,UAAU;aAC1B;SACF,CACF,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,2BAA2B,CACvC,MAAc,EACd,gBAAuC,EACvC,UAAmB,EACnB,kBAAiC,EACjC,SAAgC;QAEhC,6FAA6F;QAC7F,0FAA0F;QAC1F,gDAAgD;QAChD,IAAI,CAAC,yBAAyB,CAAC,MAAM,EAAE,gBAAgB,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC,CAAC;QAE7F,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,gBAAgB,CAAC,CAAC;QACpE,MAAM,YAAY,GAAG,IAAI,CAAC,mBAAmB,EAAE,CAAC;QAChD,iGAAiG;QACjG,wFAAwF;QACxF,yFAAyF;QACzF,wEAAwE;QACxE,MAAM,UAAU,GACd,YAAY;cACV,4BAA4B,CAAC,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,EAAE,kBAAkB,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;QAE5G,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,OAAO,UAAU,CAAC;QACpB,CAAC;QAED,MAAM,oBAAoB,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC;QAC/C,IAAI,CAAC,oBAAoB,EAAE,CAAC;YAC1B,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,UAAU,EACpB,gBAAgB,EAChB;gBACE,sBAAsB,EAAE,2BAA2B,CAAC,wBAAwB;gBAC5E,OAAO,EAAE;oBACP,wBAAwB;oBACxB,MAAM;oBACN,aAAa;iBACd;aACF,CACF,CAAC;QACJ,CAAC;QAED,2FAA2F;QAC3F,6FAA6F;QAC7F,6EAA6E;QAC7E,IAAI,CAAC,yBAAyB,CAAC,oBAAoB,EAAE,gBAAgB,EAAE,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC,CAAC;QAEhI,0FAA0F;QAC1F,4FAA4F;QAC5F,8FAA8F;QAC9F,4FAA4F;QAC5F,gEAAgE;QAChE,MAAM,cAAc,GAClB,YAAY;cACV,gBAAgB,aAAa,SAAS,CAAC;QAC3C,IAAI,CAAC,oBAAoB,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;YACrD,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,aAAa,EACvB,gBAAgB,EAChB;gBACE,sBAAsB,EAAE,2BAA2B,CAAC,0BAA0B;gBAC9E,OAAO,EAAE;oBACP,wBAAwB;oBACxB,MAAM;oBACN,aAAa;oBACb,UAAU,EAAE,oBAAoB;oBAChC,cAAc;iBACf;aACF,CACF,CAAC;QACJ,CAAC;QAED,OAAO,oBAAoB,CAAC;IAC9B,CAAC;IAEO,mBAAmB,CACzB,KAAc,EACd,SAAwD,EACxD,gBAAmD,EACnD,OAAgC;QAEhC,IAAI,mBAAmB,CAAC,KAAK,CAAC,EAAE,CAAC;YAC/B,MAAM,KAAK,CAAC;QACd,CAAC;QAED,MAAM,YAAY,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAC;QAChD,uEAAuE;QACvE,EAAE;QACF,8EAA8E;QAC9E,0EAA0E;QAC1E,2EAA2E;QAC3E,6EAA6E;QAC7E,6EAA6E;QAC7E,4EAA4E;QAC5E,kEAAkE;QAClE,MAAM,SAAS,GAAG,uBAAuB,CAAC,KAAK,CAAC,CAAC;QACjD,MAAM,iBAAiB,GAAG,YAAY,CAAC,WAAW,EAAE,CAAC;QAErD,IACE,SAAS,KAAK,WAAW;eACtB,SAAS,KAAK,UAAU;eACxB,SAAS,KAAK,cAAc;eAC5B,CAAC,CAAC,SAAS,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,iBAAiB,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,EACvG,CAAC;YACD,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,SAAS,EACnB,gBAAgB,EAChB;gBACE,sBAAsB,EAAE,2BAA2B,CAAC,yBAAyB;gBAC7E,OAAO,EAAE;oBACP,wBAAwB;oBACxB,SAAS;oBACT,GAAG,OAAO;iBACX;aACF,CACF,CAAC;QACJ,CAAC;QAED,IACE,SAAS,KAAK,cAAc;eACzB,SAAS,KAAK,WAAW;eACzB,SAAS,KAAK,uBAAuB;eACrC,SAAS,KAAK,oBAAoB;eAClC,SAAS,KAAK,cAAc;eAC5B,SAAS,KAAK,cAAc;eAC5B,CAAC,CAAC,SAAS,IAAI,CAChB,iBAAiB,CAAC,QAAQ,CAAC,cAAc,CAAC;mBACvC,iBAAiB,CAAC,QAAQ,CAAC,eAAe,CAAC;mBAC3C,iBAAiB,CAAC,QAAQ,CAAC,WAAW,CAAC;mBACvC,iBAAiB,CAAC,QAAQ,CAAC,uBAAuB,CAAC;mBACnD,iBAAiB,CAAC,QAAQ,CAAC,oBAAoB,CAAC,CACpD,CAAC,EACF,CAAC;YACD,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,aAAa,EACvB,gBAAgB,EAChB;gBACE,sBAAsB,EAAE,2BAA2B,CAAC,0BAA0B;gBAC9E,OAAO,EAAE;oBACP,wBAAwB;oBACxB,SAAS;oBACT,GAAG,OAAO;oBACV,aAAa,EAAE,YAAY;iBAC5B;aACF,CACF,CAAC;QACJ,CAAC;QAED,IACE,iBAAiB,CAAC,QAAQ,CAAC,gBAAgB,CAAC;eACzC,iBAAiB,CAAC,QAAQ,CAAC,mBAAmB,CAAC,EAClD,CAAC;YACD,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,aAAa,EACvB,gBAAgB,EAChB;gBACE,sBAAsB,EAAE,2BAA2B,CAAC,aAAa;gBACjE,OAAO,EAAE;oBACP,OAAO,EAAE,4CAA4C;oBACrD,SAAS;oBACT,UAAU,EAAE,IAAI,CAAC,UAAU;oBAC3B,GAAG,OAAO;oBACV,aAAa,EAAE,YAAY;iBAC5B;aACF,CACF,CAAC;QACJ,CAAC;QAED,IACE,iBAAiB,CAAC,QAAQ,CAAC,YAAY,CAAC;eACrC,iBAAiB,CAAC,QAAQ,CAAC,SAAS,CAAC;eACrC,iBAAiB,CAAC,QAAQ,CAAC,cAAc,CAAC;eAC1C,iBAAiB,CAAC,QAAQ,CAAC,SAAS,CAAC,EACxC,CAAC;YACD,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,OAAO,EACjB,gBAAgB,EAChB;gBACE,sBAAsB,EAAE,2BAA2B,CAAC,OAAO;gBAC3D,OAAO,EAAE;oBACP,OAAO,EAAE,mCAAmC;oBAC5C,SAAS;oBACT,GAAG,OAAO;oBACV,aAAa,EAAE,YAAY;iBAC5B;aACF,CACF,CAAC;QACJ,CAAC;QAED,IACE,iBAAiB,CAAC,QAAQ,CAAC,QAAQ,CAAC;eACjC,iBAAiB,CAAC,QAAQ,CAAC,MAAM,CAAC;eAClC,iBAAiB,CAAC,QAAQ,CAAC,UAAU,CAAC,EACzC,CAAC;YACD,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,gBAAgB,EAC1B,gBAAgB,EAChB;gBACE,sBAAsB,EAAE,2BAA2B,CAAC,gBAAgB;gBACpE,OAAO,EAAE;oBACP,OAAO,EAAE,4CAA4C;oBACrD,SAAS;oBACT,GAAG,OAAO;oBACV,aAAa,EAAE,YAAY;iBAC5B;aACF,CACF,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,gBAAgB,EAC1B,gBAAgB,EAChB;YACE,sBAAsB,EAAE,2BAA2B,CAAC,gBAAgB;YACpE,OAAO,EAAE;gBACP,OAAO,EAAE,qCAAqC,SAAS,EAAE;gBACzD,SAAS;gBACT,GAAG,OAAO;gBACV,aAAa,EAAE,YAAY;aAC5B;SACF,CACF,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,MAAM,CACV,UAAoB,EACpB,MAAc,EACd,QAAgB,EAChB,IAAY,EACZ,gBAAuC,EACvC,OAA8B;QAE9B,cAAc,CAAC,MAAM,EAAE,IAAI,CAAC,YAAY,EAAE,gBAAgB,EAAE,QAAQ,CAAC,CAAC;QACtE,mBAAmB,CAAC,QAAQ,EAAE,IAAI,CAAC,YAAY,EAAE,gBAAgB,EAAE,UAAU,CAAC,CAAC;QAC/E,YAAY,CACV,IAAI,EACJ,4BAA4B,CAAC,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,OAAO,EAAE,WAAW,CAAC,EAC/E,IAAI,CAAC,YAAY,EACjB,gBAAgB,EAChB,MAAM,CACP,CAAC;QACF,cAAc,CAAC,UAAU,EAAE,IAAI,CAAC,YAAY,EAAE,gBAAgB,EAAE,YAAY,CAAC,CAAC;QAE9E,wEAAwE;QACxE,2EAA2E;QAC3E,6EAA6E;QAC7E,sEAAsE;QACtE,6EAA6E;QAC7E,4DAA4D;QAC5D,wCAAwC;QACxC,IAAI,IAAI,GAAG,gCAAgC,EAAE,CAAC;YAC5C,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,UAAU,EACpB,gBAAgB,EAChB;gBACE,qEAAqE;gBACrE,+DAA+D;gBAC/D,kCAAkC;gBAClC,sBAAsB,EAAE,2BAA2B,CAAC,gCAAgC;gBACpF,OAAO,EAAE;oBACP,wBAAwB;oBACxB,MAAM;oBACN,IAAI;oBACJ,MAAM,EAAE,4BAA4B;oBACpC,gBAAgB,EAAE,gCAAgC;oBAClD,OAAO,EACL,8FAA8F;0BAC5F,4FAA4F;0BAC5F,GAAG,gCAAgC,SAAS;iBACjD;aACF,CACF,CAAC;QACJ,CAAC;QAED,MAAM,eAAe,GAAG,sBAAsB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAEhE,IAAI,CAAC,eAAe,EAAE,CAAC;YACrB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,UAAU,EACpB,gBAAgB,EAChB;gBACE,sBAAsB,EAAE,2BAA2B,CAAC,mCAAmC;aACxF,CACF,CAAC;QACJ,CAAC;QAED,MAAM,YAAY,GAAG,OAAO,EAAE,oBAAoB,IAAI,IAAI,CAAC;QAC3D,MAAM,GAAG,GAAG,YAAY;YACtB,CAAC,CAAC,MAAM,IAAI,CAAC,2BAA2B,CAAC,eAAe,EAAE,gBAAgB,EAAE,SAAS,EAAE,OAAO,EAAE,kBAAkB,EAAE,OAAO,EAAE,KAAK,CAAC;YACnI,CAAC,CAAC,eAAe,CAAC;QACpB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;QAEtC,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,SAAS,CACpB,IAAI,CAAC,UAAU,EACf,GAAG,EACH,UAAU,EACV,IAAI,EACJ;gBACE,CAAC,eAAe,CAAC,YAAY,CAAC,EAAE,QAAQ;aACzC,CACF,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,mBAAmB,CAAC,KAAK,EAAE,QAAQ,EAAE,gBAAgB,EAAE;gBAC1D,MAAM;gBACN,UAAU,EAAE,GAAG;gBACf,QAAQ,EAAE,IAAI,CAAC,UAAU;aAC1B,CAAC,CAAC;QACL,CAAC;QAED,OAAO;YACL,UAAU,EAAE,GAAG;YACf,QAAQ,EAAE,IAAI,CAAC,UAAU;SAC1B,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,QAAQ,CACZ,IAA6B,EAC7B,gBAAuC;QAEvC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,2BAA2B,CAAC,IAAI,CAAC,MAAM,EAAE,gBAAgB,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;QACnG,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;QACtC,IAAI,MAAgB,CAAC;QACrB,IAAI,QAA6B,CAAC;QAElC,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;YAC3D,MAAM,WAAW,GAAG,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC,YAAY,CAAC,CAAC;YAChE,IAAI,CAAC,WAAW,EAAE,CAAC;gBACjB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,gBAAgB,EAC1B,gBAAgB,EAChB;oBACE,sBAAsB,EAAE,2BAA2B,CAAC,gBAAgB;oBACpE,OAAO,EAAE;wBACP,OAAO,EAAE,oDAAoD,eAAe,CAAC,YAAY,EAAE;wBAC3F,MAAM,EAAE,IAAI,CAAC,MAAM;wBACnB,UAAU,EAAE,GAAG;qBAChB;iBACF,CACF,CAAC;YACJ,CAAC;YAED,MAAM,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;YACtD,QAAQ,GAAG;gBACT,WAAW;gBACX,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,YAAY,EAAE,IAAI,CAAC,YAAY;aAChC,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,mBAAmB,CAAC,KAAK,EAAE,UAAU,EAAE,gBAAgB,EAAE;gBAC5D,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,UAAU,EAAE,GAAG;gBACf,QAAQ,EAAE,IAAI,CAAC,UAAU;aAC1B,CAAC,CAAC;QACL,CAAC;QAED,OAAO;YACL,MAAM;YACN,WAAW,EAAE,QAAQ,CAAC,WAAW;YACjC,IAAI,EAAE,QAAQ,CAAC,IAAI;YACnB,IAAI,EAAE,QAAQ,CAAC,IAAI;YACnB,YAAY,EAAE,QAAQ,CAAC,YAAY;SACpC,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,MAAM,CACV,IAA6B,EAC7B,gBAAuC;QAEvC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,2BAA2B,CAAC,IAAI,CAAC,MAAM,EAAE,gBAAgB,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;QACnG,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;QAEtC,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;QAClD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,0EAA0E;YAC1E,0EAA0E;YAC1E,0DAA0D;YAC1D,MAAM,eAAe,GAAG,uBAAuB,CAAC,KAAK,CAAC,CAAC;YACvD,MAAM,iBAAiB,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;YACnE,IACE,eAAe,KAAK,WAAW;mBAC5B,eAAe,KAAK,UAAU;mBAC9B,CAAC,CAAC,eAAe,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,iBAAiB,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,EAC7G,CAAC;gBACD,OAAO;YACT,CAAC;YACD,IAAI,CAAC,mBAAmB,CAAC,KAAK,EAAE,QAAQ,EAAE,gBAAgB,EAAE;gBAC1D,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,UAAU,EAAE,GAAG;gBACf,QAAQ,EAAE,IAAI,CAAC,UAAU;aAC1B,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,KAAK,CAAC,WAAW,CACf,IAA6B,EAC7B,gBAAuC;QAEvC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,2BAA2B,CAAC,IAAI,CAAC,MAAM,EAAE,gBAAgB,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;QACnG,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;QAEtC,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;YAC3D,MAAM,WAAW,GAAG,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC,YAAY,CAAC,CAAC;YAChE,IAAI,CAAC,WAAW,EAAE,CAAC;gBACjB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,gBAAgB,EAC1B,gBAAgB,EAChB;oBACE,sBAAsB,EAAE,2BAA2B,CAAC,gBAAgB;oBACpE,OAAO,EAAE;wBACP,OAAO,EAAE,oDAAoD,eAAe,CAAC,YAAY,EAAE;wBAC3F,MAAM,EAAE,IAAI,CAAC,MAAM;wBACnB,UAAU,EAAE,GAAG;qBAChB;iBACF,CACF,CAAC;YACJ,CAAC;YAED,OAAO;gBACL,WAAW;gBACX,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,YAAY,EAAE,IAAI,CAAC,YAAY;aAChC,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,mBAAmB,CAAC,KAAK,EAAE,UAAU,EAAE,gBAAgB,EAAE;gBAC5D,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,UAAU,EAAE,GAAG;gBACf,QAAQ,EAAE,IAAI,CAAC,UAAU;aAC1B,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,4EAA4E;IAC5E,eAAe;IACf,4EAA4E;IAE5E,KAAK,CAAC,WAAW;QACf,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAE7B,4EAA4E;QAC5E,+EAA+E;QAC/E,6EAA6E;QAC7E,4EAA4E;QAC5E,4EAA4E;QAC5E,gFAAgF;QAChF,4EAA4E;QAC5E,EAAE;QACF,8EAA8E;QAC9E,6EAA6E;QAC7E,+EAA+E;QAC/E,6DAA6D;QAC7D,EAAE;QACF,4EAA4E;QAC5E,4EAA4E;QAC5E,qBAAqB;QACrB,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YACjB,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;YACzB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,EAAE,KAAK,EAAE,mBAAmB,CAAC,KAAK,CAAC,EAAE,CAAC;YAChG,CAAC;QACH,CAAC;QAED;;;WAGG;QACH,IAAI,QAAQ,GAAG,EAAE,CAAC;QAElB,IAAI,CAAC;YACH,4EAA4E;YAC5E,0EAA0E;YAC1E,yEAAyE;YACzE,uEAAuE;YACvE,oEAAoE;YACpE,0DAA0D;YAC1D,EAAE;YACF,qEAAqE;YACrE,qEAAqE;YACrE,0EAA0E;YAC1E,sEAAsE;YACtE,4EAA4E;YAC5E,8BAA8B;YAC9B,EAAE;YACF,qEAAqE;YACrE,4EAA4E;YAC5E,wBAAwB;YACxB,0EAA0E;YAC1E,+EAA+E;YAC/E,6EAA6E;YAC7E,6CAA6C;YAC7C,MAAM,kBAAkB,GAAG,CAAC,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC,CAAC,aAAa;mBACpE,IAAI,CAAC,gBAAgB,CAAC,aAAa,CAAC;YACzC,QAAQ,GAAG,GAAG,IAAI,CAAC,mBAAmB,EAAE,EAAE;kBACtC,8BAA8B,CAAC,YAAY,CAAC,4BAA4B,CACxE,kBAAkB,EAClB,yBAAyB;gBACzB,wFAAwF;gBACxF,wFAAwF;gBACxF,wFAAwF;gBACxF,gCAAgC;gBAChC,wBAAwB,EACxB,oBAAoB,CAAC,WAAW,EAChC,kBAAkB,CACnB,CAAC;YAEJ,8EAA8E;YAC9E,MAAM,IAAI,CAAC,MAAO,CAAC,UAAU,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;YACzD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,EAAE,CAAC;QAC5D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,GAAG,uBAAuB,CAAC,KAAK,CAAC,CAAC;YAC5C,IAAI,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,UAAU,EAAE,CAAC;gBAChD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,EAAE,CAAC;YAC5D,CAAC;YAED;;;;;;;;;;;;;;;;;;;;;;;;;;eA0BG;YACH,IAAI,IAAI,CAAC,qBAAqB,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,CAAC;gBAC5C,IAAI,CAAC,kBAAkB,EAAE,UAAU,EAAE,CAAC;gBACtC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;gBACnB,IAAI,CAAC,eAAe,GAAG,SAAS,CAAC;gBAEjC,IAAI,CAAC;oBACH,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;oBAC3C,MAAM,WAAW,CAAC,UAAU,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;oBACxD,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,2FAA2F,CAC5F,CAAC;oBACF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,EAAE,CAAC;gBAC5D,CAAC;gBAAC,OAAO,UAAU,EAAE,CAAC;oBACpB,MAAM,SAAS,GAAG,uBAAuB,CAAC,UAAU,CAAC,CAAC;oBACtD,IAAI,SAAS,KAAK,WAAW,IAAI,SAAS,KAAK,UAAU,EAAE,CAAC;wBAC1D,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,2FAA2F,CAC5F,CAAC;wBACF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,EAAE,CAAC;oBAC5D,CAAC;oBACD,OAAO;wBACL,OAAO,EAAE,KAAK;wBACd,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;wBAC/B,KAAK,EAAE,mBAAmB,CAAC,UAAU,CAAC;qBACvC,CAAC;gBACJ,CAAC;YACH,CAAC;YAED,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,EAAE,KAAK,EAAE,mBAAmB,CAAC,KAAK,CAAC,EAAE,CAAC;QAChG,CAAC;IACH,CAAC;IAED;;;;;;;OAOG;IACK,qBAAqB,CAAC,IAAwB,EAAE,KAAc;QACpE,MAAM,0BAA0B,GAAG,IAAI,GAAG,CAAC;YACzC,cAAc;YACd,oBAAoB;YACpB,uBAAuB;YACvB,cAAc;YACd,cAAc;YACd,sBAAsB;YACtB,8BAA8B;SAC/B,CAAC,CAAC;QACH,IAAI,IAAI,IAAI,0BAA0B,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QAE9D,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;QAC7E,OAAO,4FAA4F;aAChG,IAAI,CAAC,OAAO,CAAC,CAAC;IACnB,CAAC;CACF,CAAA;AAxiCY,2BAA2B;IADvC,UAAU,EAAE;IA4DR,WAAA,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAA;IAEjC,WAAA,MAAM,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,CAAA;IAE9C,WAAA,MAAM,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,CAAA;IAgB3C,WAAA,MAAM,CAAC,kBAAkB,CAAC,yBAAyB,CAAC,CAAA;IAAE,WAAA,QAAQ,EAAE,CAAA;+CAjBlC,0BAA0B;QAEtB,uBAAuB;GAhEjD,2BAA2B,CAwiCvC","sourcesContent":["/**\n * Wildo-Managed Storage Provider\n *\n * Default IFileStorageProvider implementation backed by MinIO/S3.\n * All file operations go through z_file() declarations and the unified\n * IFileStorageProvider interface.\n *\n * Two inputs, from two different places, and the split is deliberate:\n * - TOPOLOGY (endpoint, port, ssl, bucket, key prefix) comes from resolved\n *   application configuration (`storage.managed`), which the configuration\n *   loader seeds from the environment.\n * - CREDENTIALS are short-lived, prefix-confined STS sessions fetched from\n *   apps-manager per use. They never appear in configuration or in the\n *   environment.\n */\n\nimport { injectable, inject, optional } from 'inversify';\nimport { Readable } from 'stream';\nimport { Client, ClientOptions } from 'minio';\nimport { ErrorType, ErrorCustomMessageReference, WildoHeaderKeys, isWildoBackendError } from '@wildo-ai/saas-models';\nimport { FileStorageAccepted } from '@wildo-ai/zod-decorators';\nimport { INFRA_DEFAULT_PORTS, STORAGE_DEFAULTS } from '@wildo-ai/platform-config-lib';\nimport { SAAS_SERVICE_TYPES } from '~wildo-backend-lib/inject/models/service-types';\nimport type { LoggerService } from '~wildo-backend-lib/monitoring/logger/services/logger.service';\nimport { ErrorBuilderBackendService } from '~wildo-backend-lib/errors/services/error-builder.backend.service';\nimport { describeCaughtError } from '~wildo-backend-lib/errors/utils/error-log-level-classification.backend.utils';\nimport { AppConfigurationService } from '~wildo-backend-lib/config/services/app-configuration.backend.service';\nimport type { AppConfiguration_Storage_ManagedConnection } from '~wildo-backend-lib/config/models/app-config.backend.schemas';\nimport type { ExecutionContext } from '~wildo-backend-lib/runtime/models/execution-context.backend.schemas';\nimport { validateAppId, validateContentType, validateFileId, validateSize, validateStream, resolveConfiguredMaxFileSize } from '~wildo-backend-lib/files/utils/file-validation.utils';\nimport { API_ROUTES_BACKEND_DEFINITIONS } from '~wildo-backend-lib/requests/models/api-routes.backend.defintions';\nimport { ResourcePrimaryScope } from '@wildo-ai/saas-models';\nimport type { FileScopeIdentifiers, ResourceType } from '@wildo-ai/saas-models';\n\nimport { StorageCredentialProvider } from '~wildo-backend-lib/files/storage/storage-credential-provider.backend.utils';\nimport type { ResolvedStorageCredentials, StorageCredentialResolver } from '~wildo-backend-lib/files/storage/storage-credential-provider.backend.utils';\nimport { createStsStorageCredentialResolver } from '~wildo-backend-lib/files/storage/storage-sts-credential-resolver.backend.utils';\nimport { resolveStorageApplicationIdentity } from '~wildo-backend-lib/files/utils/storage-application-identity.backend.utils';\nimport {\n  UNLINKED_STORAGE_SEGMENT,\n  composeApplicationStorageKey,\n  composeStorageLeafPath,\n  storageKeyHasTraversalSegment,\n} from './application-storage-key.backend.utils';\nimport type {\n  IFileStorageProvider,\n  StorageUploadResult,\n  StorageUploadOptions,\n  StorageDownloadResult,\n  StorageFileMetadata,\n  StorageProviderHealthResult,\n  StoredFileStorageTarget,\n} from './file-storage-provider.types';\n\nconst DEFAULT_STORAGE_REGION = 'us-east-1';\n\n/**\n * S3's maximum object size for a SINGLE `PutObject` request, and therefore the\n * largest object this provider can store under a prefix-confined credential.\n *\n * ## Why a prefix-confined credential cannot use multipart at all\n *\n * The minio client's multipart path opens with `findUploadId()`, which issues\n * **ListMultipartUploads** — a BUCKET-level operation authorised by\n * `s3:ListBucketMultipartUploads`. That action is not in the session policy, so\n * every upload large enough to take the multipart branch is refused\n * `AccessDenied` before a single byte is sent. Measured against live MinIO:\n * `CreateMultipartUpload` is allowed (it maps to `s3:PutObject`), while\n * `findUploadId` and `AbortMultipartUpload` are both refused.\n *\n * Granting the missing action is NOT an option, and not merely on preference —\n * MinIO rejects the policy outright: `s3:ListBucketMultipartUploads` does not\n * accept the `s3:prefix` condition key\n * (`InvalidParameterValue: unsupported condition keys '[s3:prefix]'`). The only\n * way to grant it is an UNCONDITIONED bucket-wide statement, which would expose\n * every other application's in-flight upload keys — the same tenant-structure\n * leak the conditioned `s3:ListBucket` exists to prevent.\n *\n * So the multipart branch is avoided rather than authorised: {@link PART_SIZE_BYTES}\n * is set high enough that no object this provider accepts can reach it, and\n * anything above this ceiling is refused here with a precise error rather than\n * an opaque `AccessDenied` from the store.\n *\n * See `.claude/plans/object-storage-root-credential-distribution.md` (F-D).\n */\nconst MAX_SINGLE_PUT_OBJECT_SIZE_BYTES = 5 * 1024 * 1024 * 1024;\n\n/**\n * Forces every upload onto the single-`PutObject` path — see\n * {@link MAX_SINGLE_PUT_OBJECT_SIZE_BYTES} for why multipart is unreachable.\n *\n * The client branches on `size <= partSize`, so pinning this to the single-PUT\n * ceiling makes the branch unreachable for any object the provider accepts.\n *\n * It costs no additional memory: the single-PUT path buffers `size` bytes, which\n * is bounded by the application's own configured `storage.maxFileSize`, not by\n * this value. What it does mean is that an upload is fully buffered rather than\n * streamed in chunks — acceptable at the 100 MB default ceiling, and the reason\n * `storage.maxFileSize` is the knob that governs storage memory pressure.\n */\nconst PART_SIZE_BYTES = MAX_SINGLE_PUT_OBJECT_SIZE_BYTES;\n\n/**\n * The S3/MinIO error CODE, when the thrown value carries one.\n *\n * Preferred over message matching everywhere in this file. The minio client sets\n * `code` (e.g. `AccessDenied`, `NoSuchKey`, `ExpiredToken`) on its errors, and a\n * code is a stable contract where a message is prose the SDK may reword between\n * releases. F-D is the concrete cost of getting this wrong: a real `AccessDenied`\n * whose message did not contain the expected substring was classified as a\n * generic connectivity failure, so the log blamed credentials and the actual\n * cause — an unauthorised HeadBucket probe — stayed invisible.\n *\n * Returns `undefined` for a plain `Error`, which is the signal for callers to\n * fall back to substring matching rather than mis-classify.\n */\nfunction resolveStorageErrorCode(error: unknown): string | undefined {\n  const code = (error as { code?: unknown })?.code;\n  return typeof code === 'string' && code.length > 0 ? code : undefined;\n}\n\n@injectable()\nexport class WildoManagedStorageProvider implements IFileStorageProvider {\n  readonly providerId = FileStorageAccepted.WILDO_MANAGED;\n  private client: Client | null = null;\n  /**\n   * Access key the cached {@link client} was built with. A storage client binds\n   * its credentials at construction, so once those credentials can EXPIRE the\n   * client must be rebuilt when they change — caching it unconditionally (as this\n   * did while the credential was the never-changing root key) would keep using a\n   * dead session until the process restarted.\n   */\n  private clientAccessKey: string | undefined;\n  /**\n   * Renews credentials before they expire. Today it is fed the long-lived env\n   * credential, so behaviour is unchanged; the point of the seam is that\n   * `getClient()` no longer assumes the credential is immutable, which is what\n   * short-lived prefix-confined STS credentials require.\n   * See `.claude/plans/object-storage-root-credential-distribution.md`.\n   */\n  private credentialProvider: StorageCredentialProvider | null = null;\n  /**\n   * The object store's topology (endpoint, port, ssl, bucket, key prefix), read\n   * from resolved application configuration on every use.\n   *\n   * ## Why configuration and not `process.env`\n   *\n   * Topology is platform-injected material, exactly like `database.mongodb.host`,\n   * and configuration is where platform-injected material belongs: it is the one\n   * seam that can later be served over the wire instead of baked into a `.env`\n   * file. The environment is still the SOURCE — `buildStorageTopologyFromEnvironment`\n   * reads it — but it is read once, at configuration construction, rather than by\n   * each consumer.\n   *\n   * Resolved lazily on every use rather than captured at construction. The bucket\n   * used to be a class field initializer, evaluated during DI wiring — before\n   * application configuration exists — which is precisely why a construction-time\n   * capture cannot be the source here.\n   * See `.claude/plans/application-runtime-topology-delivery.md`.\n   *\n   * Returns `undefined` when no managed store is configured; callers fail with a\n   * precise CONFIGURATION error rather than inventing a default, because a\n   * plausible default would make an unconfigured runtime look configured and fail\n   * later at an object operation.\n   */\n  private get managedConnection(): AppConfiguration_Storage_ManagedConnection | undefined {\n    return this.appConfigService.config.storage?.managed;\n  }\n\n  /**\n   * The bucket. Not optional in practice: reached only from paths that have\n   * already resolved a client, and therefore already proved a managed\n   * connection exists. The fallback exists so an error-formatting path\n   * (`convertStorageError`) can name the bucket without being able to throw a\n   * second error while reporting the first.\n   */\n  private get bucketName(): string {\n    return this.managedConnection?.bucket ?? STORAGE_DEFAULTS.BUCKET;\n  }\n\n  constructor(\n    @inject(SAAS_SERVICE_TYPES.Logger)\n    private readonly logger: LoggerService,\n    @inject(SAAS_SERVICE_TYPES.ErrorBuilderService)\n    private readonly errorBuilder: ErrorBuilderBackendService,\n    @inject(SAAS_SERVICE_TYPES.AppConfigService)\n    private readonly appConfigService: AppConfigurationService,\n    /**\n     * OPTIONAL override for how credentials are obtained — appended LAST so no\n     * existing construction site shifts.\n     *\n     * Unbound (the common case) the provider fetches sessions from apps-manager\n     * over HTTP. A runtime CO-LOCATED with the issuer binds an in-process resolver\n     * instead: same broker, same prefix-confined session policy, same short-lived\n     * credential — no network hop, and therefore no dependency on a listener that\n     * may not exist yet.\n     *\n     * Optional deliberately, and the default is the SAFE case: omitting it yields\n     * the ordinary remote fetch. Only the co-located runtime opts out, and it must\n     * do so explicitly.\n     */\n    @inject(SAAS_SERVICE_TYPES.StorageCredentialResolver) @optional()\n    private readonly credentialResolverOverride?: StorageCredentialResolver,\n  ) {}\n\n  /**\n   * ⚠️ Deliberately does NOT test `STORAGE_ACCESS_KEY` / `STORAGE_SECRET_KEY`.\n   *\n   * Those are the root credential this provider stopped consuming, and Step 2 of\n   * the storage plan removes them from generated env entirely. Leaving them in\n   * this predicate would mean storage silently reports itself UNCONFIGURED the\n   * moment they are removed — the file feature would disable itself with no\n   * error, which is far worse than failing loudly.\n   *\n   * What storage now needs is the endpoint plus the bootstrap contract by which\n   * credentials are fetched.\n   *\n   * The endpoint and the caller's own identity come from CONFIGURATION; the two\n   * apps-manager REACHABILITY values stay in the ENVIRONMENT, deliberately — a URL\n   * and a secret are what a process needs before it can fetch anything at all,\n   * configuration included, so they cannot themselves be delivered as\n   * configuration.\n   *\n   * ## Why identity is NOT `process.env.APPLICATION_ID`\n   *\n   * It used to be, while the object-key builder read\n   * `appConfigService.applicationId` — two sources for one concept. They agree for\n   * an application (the loader seeds config from that env var) and they do NOT\n   * agree for a platform service, which resolves its identity locally and has no\n   * `APPLICATION_ID` in env at all. That split is F-G: every platform service\n   * reported storage UNCONFIGURED on the env conjunct, the router skipped it in\n   * silence, and module-registry publish has been dead since. Reading the same\n   * source the operation addresses removes the disagreement by construction —\n   * and it needs no new environment variable, so nothing changes at env-generation\n   * time. See `.claude/plans/object-storage-root-credential-distribution.md`.\n   *\n   * Reading configuration here can throw `app_configuration_not_initialized`, and\n   * that is left unsoftened on purpose: answering `false` for \"configuration is\n   * not loaded yet\" is indistinguishable from \"this application has no file\n   * feature\", and the router would SKIP the provider in silence. Every caller was\n   * enumerated and runs after configuration init.\n   */\n  isConfigured(): boolean {\n    return !!this.managedConnection?.endpoint && this.hasUsableCredentialSource();\n  }\n\n  /**\n   * Whether SOME credential source can serve this runtime.\n   *\n   * The split matters: the four-var bootstrap contract is a property of the HTTP\n   * resolver, not of storage. Testing it unconditionally made the predicate ask\n   * \"can I reach apps-manager?\" of a runtime that does not need to — which is how\n   * a co-located runtime with a perfectly good in-process source would still\n   * report UNCONFIGURED and be skipped by the router.\n   */\n  private hasUsableCredentialSource(): boolean {\n    // An injected resolver IS the source; it needs nothing from the environment.\n    if (this.credentialResolverOverride) return true;\n\n    return !!process.env.PLATFORM_APPS_MANAGER_URL\n      && !!process.env.PLATFORM_APPLICATION_PRIMARY_SECRET\n      // ⚠️ REVERTED 2026-08-12, and the env read is LOAD-BEARING here — do not\n      // \"clean it up\" to the configuration identity without reading this first.\n      //\n      // Identity was briefly taken from configuration, to close the dual-source\n      // split described on the resolver. That is the right end state and it caused\n      // an OUTAGE, because it made this predicate true for PLATFORM services — and\n      // apps-manager is the STS ISSUER. It then fetched its own storage credentials\n      // from itself, over HTTP, BEFORE its own listener existed: a guaranteed\n      // `ECONNREFUSED`, not a race. `healthCheck()` never retried, so storage stayed\n      // unhealthy for the process lifetime and `/health/ready` answered 503 forever\n      // — the exact state the comment there warns about.\n      //\n      // Absence of `APPLICATION_ID` in a platform env is therefore doing real work\n      // today: it is what keeps a platform service out of a client relationship with\n      // itself. Single-sourcing the identity is safe only once (a) the platform-plane\n      // STS door exists and (b) the issuer is excluded from being its own client.\n      // Until then this stays an env read. See F-G in\n      // `.claude/plans/object-storage-root-credential-distribution.md`.\n      && !!process.env.APPLICATION_ID;\n  }\n\n  /**\n   * The credential source, built lazily so env is read at first use rather than\n   * at construction — preserving the pre-existing behaviour that tests and\n   * dynamic relayers rely on to re-use one instance under different env contexts.\n   *\n   * Credentials come from apps-manager as short-lived, prefix-confined STS\n   * sessions. The env resolver that preceded this was DELETED rather than kept as\n   * a fallback: a fallback would fire on any transient apps-manager hiccup,\n   * succeed with the ROOT credential, and leave no signal that the confinement\n   * had been bypassed.\n   */\n  private getCredentialProvider(): StorageCredentialProvider {\n    if (this.credentialProvider) return this.credentialProvider;\n\n    this.credentialProvider = new StorageCredentialProvider(\n      this.credentialResolverOverride\n      // Identity from CONFIGURATION, single-sourced with the object-key builder\n      // (`resolveStorageApplicationIdentity`) rather than re-read from env.\n      ?? createStsStorageCredentialResolver(() => resolveStorageApplicationIdentity(this.appConfigService)),\n    );\n    return this.credentialProvider;\n  }\n\n  /**\n   * Eagerly initialize the MinIO client and verify bucket access.\n   * Call this at startup to fail fast on misconfiguration.\n   * If not called, the client is created lazily on first operation.\n   */\n  async initialize(): Promise<void> {\n    await this.getClient();\n  }\n\n  /**\n   * Obtain (and renew) the session credential WITHOUT building a client.\n   *\n   * Split out of `getClient()` so the object-key authorization guard can run\n   * before any minio client exists. The guard needs the CONFINED applicationId,\n   * which only arrives with the credential — so the order has to be\n   * credentials → guard → client, not guard → credentials → client.\n   *\n   * The pinned property survives: no client is constructed for a rejected\n   * `storageRef`. What changes is that a rejected ref now costs a credential\n   * LOOKUP — which `StorageCredentialProvider` caches for the session lifetime,\n   * so in practice it is a cache read rather than a round trip.\n   *\n   * Config is validated FIRST so an unconfigured runtime fails with a precise\n   * CONFIGURATION error rather than an opaque credential one, and does not make a\n   * pointless apps-manager round-trip on its way to failing.\n   */\n  private async ensureCredentials(): Promise<ResolvedStorageCredentials> {\n    const connection = this.managedConnection;\n    const endpoint = connection?.endpoint;\n    const port = connection?.port ?? INFRA_DEFAULT_PORTS.MINIO;\n    const useSSL = connection?.useSsl ?? false;\n\n    // Configuration is validated BEFORE credentials are fetched — both so an\n    // unconfigured runtime fails with a precise CONFIGURATION error rather than\n    // an opaque credential error, and so it does not make a pointless\n    // apps-manager round-trip on its way to failing.\n    //\n    // The required set changed with the credential source: the storage keys are\n    // gone (they were the ROOT credential) and what is needed now is the\n    // endpoint plus the bootstrap contract used to fetch session credentials.\n    if (!endpoint || !this.isConfigured()) {\n      throw this.errorBuilder.buildError(\n        ErrorType.CONFIGURATION,\n        undefined,\n        {\n          customMessageReference: ErrorCustomMessageReference.CONFIGURATION,\n          context: {\n            message:\n              'Incomplete managed storage configuration. Required: storage.managed.endpoint (from STORAGE_ENDPOINT), '\n              + 'PLATFORM_APPS_MANAGER_URL, PLATFORM_APPLICATION_PRIMARY_SECRET, APPLICATION_ID',\n            hasEndpoint: !!endpoint,\n            hasAppsManagerUrl: !!process.env.PLATFORM_APPS_MANAGER_URL,\n            hasPrimarySecret: !!process.env.PLATFORM_APPLICATION_PRIMARY_SECRET,\n            // Env, matching `isConfigured()` — the flag must name the SAME source\n            // the predicate gates on, or the diagnostic sends the reader to a\n            // value that was never the cause.\n            hasApplicationId: !!process.env.APPLICATION_ID,\n          },\n        }\n      );\n    }\n\n    // Renew, THEN decide whether the cached client is still usable. Checking the\n    // cache first would return a client bound to an expired session and the\n    // failure would surface as an opaque auth error mid-upload.\n    let credentials;\n    try {\n      credentials = await this.getCredentialProvider().getCredentials();\n    } catch (error) {\n      // Fail closed, but as a typed CONFIGURATION error so callers and the\n      // readiness probe can classify it — not as a bare Error escaping from the\n      // resolver.\n      throw this.errorBuilder.buildError(\n        ErrorType.CONFIGURATION,\n        undefined,\n        {\n          customMessageReference: ErrorCustomMessageReference.CONFIGURATION,\n          context: {\n            operation: 'acquire_storage_credentials',\n            message: 'Could not obtain object storage session credentials from apps-manager.',\n            error: describeCaughtError(error),\n          },\n        }\n      );\n    }\n\n    return credentials;\n  }\n\n  /**\n   * The minio client for the CURRENT credential, rebuilt when that credential\n   * changes. Renew first, THEN decide whether the cached client is still usable:\n   * checking the cache first would return a client bound to an expired session and\n   * the failure would surface as an opaque auth error mid-upload.\n   */\n  private async getClient(): Promise<Client> {\n    const credentials = await this.ensureCredentials();\n    const connection = this.managedConnection;\n    const endpoint = connection?.endpoint ?? '';\n    const port = connection?.port ?? INFRA_DEFAULT_PORTS.MINIO;\n    const useSSL = connection?.useSsl ?? false;\n\n    if (this.client && this.clientAccessKey === credentials.accessKey) {\n      return this.client;\n    }\n\n    const endpointUrl = endpoint.includes('://')\n      ? new URL(endpoint)\n      : new URL(`http${useSSL ? 's' : ''}://${endpoint}`);\n\n    const options: ClientOptions = {\n      endPoint: endpointUrl.hostname,\n      port: endpointUrl.port ? parseInt(endpointUrl.port, 10) : port,\n      useSSL: useSSL || endpointUrl.protocol === 'https:',\n      accessKey: credentials.accessKey,\n      secretKey: credentials.secretKey,\n      // Present only for an STS session credential; a long-lived credential\n      // carries none and the field stays undefined.\n      ...(credentials.sessionToken ? { sessionToken: credentials.sessionToken } : {}),\n      region: DEFAULT_STORAGE_REGION,\n      // Keeps every upload on the single-PutObject path. The multipart branch\n      // opens with a BUCKET-level ListMultipartUploads that a prefix-confined\n      // session cannot be granted — see MAX_SINGLE_PUT_OBJECT_SIZE_BYTES.\n      partSize: PART_SIZE_BYTES,\n    };\n\n    const client = new Client(options);\n\n    // ⚠️ NO `bucketExists()` PROBE HERE — deliberately. This is F-D.\n    //\n    // The probe used to live here (and before that, `makeBucket()`). Under a\n    // prefix-confined session credential it can NEVER succeed: `bucketExists()`\n    // issues HeadBucket, which S3 authorises via `s3:ListBucket`, and the session\n    // policy grants `ListBucket` only under `Condition StringLike s3:prefix`.\n    // HeadBucket carries no prefix, so the condition cannot match and the call is\n    // refused `AccessDenied` — on a credential whose object operations work\n    // perfectly. Keeping it broke EVERY file operation in dev, in the backend and\n    // in every minion, with a message pointing at credentials rather than at the\n    // probe.\n    //\n    // Do NOT \"fix\" this by adding an unconditioned `ListBucket` to the policy.\n    // That is the tempting repair and it re-grants bucket-wide enumeration —\n    // every other application's object keys — to close a check that buys nothing:\n    // bucket existence is already guaranteed platform-side by\n    // `ObjectStorageStsBrokerService.ensureBucketExists()`, which runs with admin\n    // rights on the credential-issuance path immediately before this client is\n    // built. A missing bucket now surfaces at the first real operation, which is\n    // where a genuine storage fault belongs.\n    //\n    // See `.claude/plans/object-storage-root-credential-distribution.md` (F-D).\n\n    this.client = client;\n    // Stamped together with the client so the cache check above can tell a\n    // still-valid client from one bound to a superseded credential.\n    this.clientAccessKey = credentials.accessKey;\n    return client;\n  }\n\n  /**\n   * The application identity object keys are built from — taken from the CREDENTIAL,\n   * i.e. the subject the issuer confined the session policy to.\n   *\n   * Not `resolveStorageApplicationIdentity(appConfigService)`. That was the client's\n   * own answer to the same question, and when the two disagreed the credential was\n   * confined to one subtree while the client addressed another — every operation\n   * failing `Valid and authorized credentials required` with both halves passing\n   * their own tests. `assertPolicySafeApplicationId` requires a 24-hex ObjectId, so\n   * the policy side cannot be bent to match the client; the client must take the\n   * issuer's value.\n   *\n   * FAILS CLOSED when the issuer supplied none. Falling back to the local identity\n   * is precisely the reintroduction of the split — it would work for applications\n   * (where the two happen to agree) and silently mis-address for everything else,\n   * which is the failure mode that took a day to find.\n   */\n  private async getApplicationId(executionContext: ExecutionContext<any>): Promise<string> {\n    const credentials = await this.ensureCredentials();\n    const applicationId = credentials.applicationId;\n\n    if (!applicationId) {\n      throw this.errorBuilder.buildError(\n        ErrorType.CONFIGURATION,\n        executionContext,\n        {\n          customMessageReference: ErrorCustomMessageReference.CONFIGURATION,\n          context: {\n            operation: 'resolve_confined_application_identity',\n            message:\n              'The object storage credential did not name the application it is confined to, so no '\n              + 'object key can be addressed. The issuer must return `applicationId` alongside the '\n              + 'session credential.',\n          },\n        }\n      );\n    }\n\n    validateAppId(applicationId, this.errorBuilder, executionContext, 'applicationId');\n    return applicationId;\n  }\n\n  /**\n   * Resolve the canonical app-level object-key namespace prefix\n   * (Slice 3.6).\n   *\n   * Sourced from `storage.managed.bucketPrefix`, which the configuration loader\n   * seeds from `STORAGE_BUCKET_PREFIX`, originating from\n   * `wildo.saas.config.dataServices.s3.bucketPrefix`. When set, every\n   * application object key produced by `resolveApplicationObjectKey()`\n   * (and every authorized `storageRef` it accepts) is prefixed with\n   * `${bucketPrefix}/`. The bucket itself remains infra-controlled — N apps\n   * can share one bucket with disjoint object trees.\n   *\n   * Cosmetic only: tenant isolation is enforced by the session policy, which\n   * keys on the platform-minted `applicationId` and never on this value.\n   *\n   * Read lazily on every call (rather than cached at construction) so a\n   * configuration change is observed without rebuilding the provider.\n   */\n  private resolveBucketPrefix(): string {\n    const raw = this.managedConnection?.bucketPrefix;\n    if (!raw) return '';\n    const trimmed = raw.trim();\n    return trimmed.length === 0 ? '' : `${trimmed.replace(/\\/+$/, '')}/`;\n  }\n\n  /**\n   * Refuse any key fragment carrying a `.` or `..` segment.\n   *\n   * ## Why the managed provider needs this at all\n   *\n   * The local-directory provider has always had a traversal guard\n   * (`resolveSafePathFromRelative`: `path.resolve` + a `startsWith(base + sep)` check). This\n   * provider had NONE — an S3 key is an opaque string, never resolved by a filesystem, so a `..`\n   * segment cannot escape a bucket and the guard looked unnecessary. It is not, for two reasons:\n   *\n   * 1. **The read guard below is textual.** `startsWith(expectedPrefix)` is satisfied by\n   *    `applications/<app>/files/x/../../../elsewhere/y`, so a stored ref carrying traversal passes\n   *    the one check that exists — and a future consumer that DOES normalize the key (a mirror to a\n   *    filesystem, an archive extraction, a signed-URL rewriter) inherits a ref that was never\n   *    checked.\n   * 2. **A prefix is the tenant boundary here.** `<scope>/<scopeId>` exists so erasure, orphan\n   *    sweeps and per-tenant listing are prefix operations. A key whose literal text contains `..`\n   *    still lands under the prefix it was composed from, but it is unreadable as a path and no\n   *    normalizing tool downstream agrees with the sweep about which tenant owns it.\n   *\n   * The invariant is enforced HERE rather than at the resolver because `StorageUploadOptions` has\n   * more than one producer: `FileStoragePathResolverBackendService` sanitizes (and is the only\n   * app-authored source), but the audit-archive batch composes its own `folderPath` and never\n   * passes through that sanitizer. This method is the single point every key — upload composition\n   * AND every stored `storageRef` on download/delete/metadata — must pass.\n   *\n   * Fail-closed with AUTHORIZATION, matching the local provider's verdict for the same input, so\n   * one authored value cannot mean two different things depending on which provider is bound.\n   */\n  private assertNoTraversalSegments(\n    candidate: string,\n    executionContext: ExecutionContext<any>,\n    diagnostics: Record<string, unknown>,\n  ): void {\n    if (!storageKeyHasTraversalSegment(candidate)) {\n      return;\n    }\n\n    throw this.errorBuilder.buildError(\n      ErrorType.AUTHORIZATION,\n      executionContext,\n      {\n        customMessageReference: ErrorCustomMessageReference.FILE_PATH_TRAVERSAL_DETECTED,\n        context: {\n          // diagnostic (log-only)\n          ...diagnostics,\n          candidate,\n          provider: this.providerId,\n        },\n      }\n    );\n  }\n\n  private async resolveApplicationObjectKey(\n    fileId: string,\n    executionContext: ExecutionContext<any>,\n    storageRef?: string,\n    linkedResourceType?: ResourceType,\n    fileScope?: FileScopeIdentifiers,\n  ): Promise<string> {\n    // Checked BEFORE the application identity is resolved: a traversal segment is a refusal that\n    // needs no credential, and paying an apps-manager STS round trip to reject it would let a\n    // hostile key fragment drive outbound requests.\n    this.assertNoTraversalSegments(fileId, executionContext, { fileId, source: 'composed_key' });\n\n    const applicationId = await this.getApplicationId(executionContext);\n    const bucketPrefix = this.resolveBucketPrefix();\n    // The relative key comes from the SHARED composer, so the local-directory provider addresses the\n    // same blob at the same place. `bucketPrefix` is the one part that stays here: it is an\n    // object-store namespacing knob (N applications sharing one bucket) with no meaning on a\n    // filesystem, so it frames the shared key rather than living inside it.\n    const defaultKey =\n      bucketPrefix\n      + composeApplicationStorageKey({ applicationId, leafPath: fileId, linkedResourceType, scope: fileScope });\n\n    if (!storageRef) {\n      return defaultKey;\n    }\n\n    const normalizedStorageRef = storageRef.trim();\n    if (!normalizedStorageRef) {\n      throw this.errorBuilder.buildError(\n        ErrorType.VALIDATION,\n        executionContext,\n        {\n          customMessageReference: ErrorCustomMessageReference.FILE_STORAGE_REF_INVALID,\n          context: {\n            // diagnostic (log-only)\n            fileId,\n            applicationId,\n          },\n        }\n      );\n    }\n\n    // A stored ref is checked for traversal too, not only the freshly-composed key. The prefix\n    // check below is TEXTUAL, so `applications/<app>/files/x/../../../elsewhere/y` satisfies it;\n    // the row it came from is not a trusted source just because it is persisted.\n    this.assertNoTraversalSegments(normalizedStorageRef, executionContext, { fileId, applicationId, source: 'stored_storage_ref' });\n\n    // The guard confines to the APPLICATION subtree, deliberately NOT to this call's resource\n    // segment. A read of an already-stored blob supplies no `linkedResourceType`, so keying the\n    // guard on the current call would reject every legitimate read of a linked file. Per-resource\n    // confinement is the session policy's job (it is minted per principal); this guard's job is\n    // that a `storageRef` from a row cannot escape the application.\n    const expectedPrefix =\n      bucketPrefix\n      + `applications/${applicationId}/files/`;\n    if (!normalizedStorageRef.startsWith(expectedPrefix)) {\n      throw this.errorBuilder.buildError(\n        ErrorType.AUTHORIZATION,\n        executionContext,\n        {\n          customMessageReference: ErrorCustomMessageReference.FILE_STORAGE_REF_FORBIDDEN,\n          context: {\n            // diagnostic (log-only)\n            fileId,\n            applicationId,\n            storageRef: normalizedStorageRef,\n            expectedPrefix,\n          },\n        }\n      );\n    }\n\n    return normalizedStorageRef;\n  }\n\n  private convertStorageError(\n    error: unknown,\n    operation: 'upload' | 'download' | 'delete' | 'metadata',\n    executionContext: ExecutionContext<any> | undefined,\n    context: Record<string, unknown>,\n  ): never {\n    if (isWildoBackendError(error)) {\n      throw error;\n    }\n\n    const errorMessage = describeCaughtError(error);\n    // Classify on the S3 error CODE first; the message is a fallback only.\n    //\n    // A message is prose an SDK is free to reword, and matching on substrings has\n    // two real failure modes here: a benign message containing \"not found\" is\n    // misread as a missing object, and — the one F-D made concrete — a genuine\n    // `AccessDenied` whose message is phrased differently escapes classification\n    // entirely and surfaces as a generic connectivity error, pointing the reader\n    // at the wrong subsystem. The minio client exposes `code` on its errors, so\n    // the reliable signal is available and was simply not being used.\n    const errorCode = resolveStorageErrorCode(error);\n    const errorMessageLower = errorMessage.toLowerCase();\n\n    if (\n      errorCode === 'NoSuchKey'\n      || errorCode === 'NotFound'\n      || errorCode === 'NoSuchBucket'\n      || (!errorCode && (errorMessageLower.includes('nosuchkey') || errorMessageLower.includes('not found')))\n    ) {\n      throw this.errorBuilder.buildError(\n        ErrorType.NOT_FOUND,\n        executionContext,\n        {\n          customMessageReference: ErrorCustomMessageReference.FILE_NOT_FOUND_IN_STORAGE,\n          context: {\n            // diagnostic (log-only)\n            operation,\n            ...context,\n          },\n        }\n      );\n    }\n\n    if (\n      errorCode === 'AccessDenied'\n      || errorCode === 'Forbidden'\n      || errorCode === 'SignatureDoesNotMatch'\n      || errorCode === 'InvalidAccessKeyId'\n      || errorCode === 'ExpiredToken'\n      || errorCode === 'InvalidToken'\n      || (!errorCode && (\n        errorMessageLower.includes('accessdenied')\n        || errorMessageLower.includes('access denied')\n        || errorMessageLower.includes('forbidden')\n        || errorMessageLower.includes('signaturedoesnotmatch')\n        || errorMessageLower.includes('invalidaccesskeyid')\n      ))\n    ) {\n      throw this.errorBuilder.buildError(\n        ErrorType.AUTHORIZATION,\n        executionContext,\n        {\n          customMessageReference: ErrorCustomMessageReference.FILE_STORAGE_ACCESS_DENIED,\n          context: {\n            // diagnostic (log-only)\n            operation,\n            ...context,\n            originalError: errorMessage,\n          },\n        }\n      );\n    }\n\n    if (\n      errorMessageLower.includes('bucketnotfound')\n      || errorMessageLower.includes('invalidbucketname')\n    ) {\n      throw this.errorBuilder.buildError(\n        ErrorType.CONFIGURATION,\n        executionContext,\n        {\n          customMessageReference: ErrorCustomMessageReference.CONFIGURATION,\n          context: {\n            message: 'Managed storage bucket configuration error',\n            operation,\n            bucketName: this.bucketName,\n            ...context,\n            originalError: errorMessage,\n          },\n        }\n      );\n    }\n\n    if (\n      errorMessageLower.includes('connection')\n      || errorMessageLower.includes('timeout')\n      || errorMessageLower.includes('econnrefused')\n      || errorMessageLower.includes('network')\n    ) {\n      throw this.errorBuilder.buildError(\n        ErrorType.NETWORK,\n        executionContext,\n        {\n          customMessageReference: ErrorCustomMessageReference.NETWORK,\n          context: {\n            message: 'Managed storage connection failed',\n            operation,\n            ...context,\n            originalError: errorMessage,\n          },\n        }\n      );\n    }\n\n    if (\n      errorMessageLower.includes('stream')\n      || errorMessageLower.includes('pipe')\n      || errorMessageLower.includes('readable')\n    ) {\n      throw this.errorBuilder.buildError(\n        ErrorType.EXTERNAL_SERVICE,\n        executionContext,\n        {\n          customMessageReference: ErrorCustomMessageReference.EXTERNAL_SERVICE,\n          context: {\n            message: 'File stream error during storage operation',\n            operation,\n            ...context,\n            originalError: errorMessage,\n          },\n        }\n      );\n    }\n\n    throw this.errorBuilder.buildError(\n      ErrorType.EXTERNAL_SERVICE,\n      executionContext,\n      {\n        customMessageReference: ErrorCustomMessageReference.EXTERNAL_SERVICE,\n        context: {\n          message: `Managed storage operation failed: ${operation}`,\n          operation,\n          ...context,\n          originalError: errorMessage,\n        },\n      }\n    );\n  }\n\n  async upload(\n    fileStream: Readable,\n    fileId: string,\n    mimeType: string,\n    size: number,\n    executionContext: ExecutionContext<any>,\n    options?: StorageUploadOptions,\n  ): Promise<StorageUploadResult> {\n    validateFileId(fileId, this.errorBuilder, executionContext, 'fileId');\n    validateContentType(mimeType, this.errorBuilder, executionContext, 'mimeType');\n    validateSize(\n      size,\n      resolveConfiguredMaxFileSize(this.appConfigService.config.storage?.maxFileSize),\n      this.errorBuilder,\n      executionContext,\n      'size',\n    );\n    validateStream(fileStream, this.errorBuilder, executionContext, 'fileStream');\n\n    // Above this, the client would take the multipart branch, whose opening\n    // ListMultipartUploads call a prefix-confined session cannot perform — the\n    // store would answer a bare `AccessDenied` that reads as a credential fault.\n    // Refuse here instead, naming the real reason. Reachable only when an\n    // application configures `storage.maxFileSize` above the single-PUT ceiling;\n    // `validateSize` has already applied that configured limit.\n    // See MAX_SINGLE_PUT_OBJECT_SIZE_BYTES.\n    if (size > MAX_SINGLE_PUT_OBJECT_SIZE_BYTES) {\n      throw this.errorBuilder.buildError(\n        ErrorType.VALIDATION,\n        executionContext,\n        {\n          // Same reference `validateContentLength` uses for a size violation —\n          // this IS one, just against a provider ceiling rather than the\n          // application's configured limit.\n          customMessageReference: ErrorCustomMessageReference.CONTENT_LENGTH_VALIDATION_FAILED,\n          context: {\n            // diagnostic (log-only)\n            fileId,\n            size,\n            reason: 'exceeds_single_put_ceiling',\n            maxSinglePutSize: MAX_SINGLE_PUT_OBJECT_SIZE_BYTES,\n            message:\n              'Object exceeds the single-PutObject ceiling for managed storage. Managed storage cannot use '\n              + 'multipart upload under a prefix-confined credential; lower storage.maxFileSize to at most '\n              + `${MAX_SINGLE_PUT_OBJECT_SIZE_BYTES} bytes.`,\n          },\n        }\n      );\n    }\n\n    const effectiveFileId = composeStorageLeafPath(fileId, options);\n\n    if (!effectiveFileId) {\n      throw this.errorBuilder.buildError(\n        ErrorType.VALIDATION,\n        executionContext,\n        {\n          customMessageReference: ErrorCustomMessageReference.FILE_STORAGE_KEY_COMPOSITION_FAILED,\n        }\n      );\n    }\n\n    const includeAppId = options?.includeApplicationId ?? true;\n    const key = includeAppId\n      ? await this.resolveApplicationObjectKey(effectiveFileId, executionContext, undefined, options?.linkedResourceType, options?.scope)\n      : effectiveFileId;\n    const client = await this.getClient();\n\n    try {\n      await client.putObject(\n        this.bucketName,\n        key,\n        fileStream,\n        size,\n        {\n          [WildoHeaderKeys.CONTENT_TYPE]: mimeType,\n        },\n      );\n    } catch (error) {\n      this.convertStorageError(error, 'upload', executionContext, {\n        fileId,\n        storageRef: key,\n        provider: this.providerId,\n      });\n    }\n\n    return {\n      storageRef: key,\n      provider: this.providerId,\n    };\n  }\n\n  async download(\n    file: StoredFileStorageTarget,\n    executionContext: ExecutionContext<any>,\n  ): Promise<StorageDownloadResult> {\n    const key = await this.resolveApplicationObjectKey(file.fileId, executionContext, file.storageRef);\n    const client = await this.getClient();\n    let stream: Readable;\n    let metadata: StorageFileMetadata;\n\n    try {\n      const stat = await client.statObject(this.bucketName, key);\n      const contentType = stat.metaData[WildoHeaderKeys.CONTENT_TYPE];\n      if (!contentType) {\n        throw this.errorBuilder.buildError(\n          ErrorType.EXTERNAL_SERVICE,\n          executionContext,\n          {\n            customMessageReference: ErrorCustomMessageReference.EXTERNAL_SERVICE,\n            context: {\n              message: `Managed storage object metadata missing required ${WildoHeaderKeys.CONTENT_TYPE}`,\n              fileId: file.fileId,\n              storageRef: key,\n            },\n          },\n        );\n      }\n\n      stream = await client.getObject(this.bucketName, key);\n      metadata = {\n        contentType,\n        size: stat.size,\n        etag: stat.etag,\n        lastModified: stat.lastModified,\n      };\n    } catch (error) {\n      this.convertStorageError(error, 'download', executionContext, {\n        fileId: file.fileId,\n        storageRef: key,\n        provider: this.providerId,\n      });\n    }\n\n    return {\n      stream,\n      contentType: metadata.contentType,\n      size: metadata.size,\n      etag: metadata.etag,\n      lastModified: metadata.lastModified,\n    };\n  }\n\n  async delete(\n    file: StoredFileStorageTarget,\n    executionContext: ExecutionContext<any>,\n  ): Promise<void> {\n    const key = await this.resolveApplicationObjectKey(file.fileId, executionContext, file.storageRef);\n    const client = await this.getClient();\n\n    try {\n      await client.removeObject(this.bucketName, key);\n    } catch (error) {\n      // Same code-first classification as `convertStorageError`: a delete of an\n      // already-absent object is a no-op, but only when the store actually said\n      // so. Inferring it from prose can swallow a real failure.\n      const deleteErrorCode = resolveStorageErrorCode(error);\n      const errorMessageLower = describeCaughtError(error).toLowerCase();\n      if (\n        deleteErrorCode === 'NoSuchKey'\n        || deleteErrorCode === 'NotFound'\n        || (!deleteErrorCode && (errorMessageLower.includes('nosuchkey') || errorMessageLower.includes('not found')))\n      ) {\n        return;\n      }\n      this.convertStorageError(error, 'delete', executionContext, {\n        fileId: file.fileId,\n        storageRef: key,\n        provider: this.providerId,\n      });\n    }\n  }\n\n  async getMetadata(\n    file: StoredFileStorageTarget,\n    executionContext: ExecutionContext<any>,\n  ): Promise<StorageFileMetadata> {\n    const key = await this.resolveApplicationObjectKey(file.fileId, executionContext, file.storageRef);\n    const client = await this.getClient();\n\n    try {\n      const stat = await client.statObject(this.bucketName, key);\n      const contentType = stat.metaData[WildoHeaderKeys.CONTENT_TYPE];\n      if (!contentType) {\n        throw this.errorBuilder.buildError(\n          ErrorType.EXTERNAL_SERVICE,\n          executionContext,\n          {\n            customMessageReference: ErrorCustomMessageReference.EXTERNAL_SERVICE,\n            context: {\n              message: `Managed storage object metadata missing required ${WildoHeaderKeys.CONTENT_TYPE}`,\n              fileId: file.fileId,\n              storageRef: key,\n            },\n          },\n        );\n      }\n\n      return {\n        contentType,\n        size: stat.size,\n        etag: stat.etag,\n        lastModified: stat.lastModified,\n      };\n    } catch (error) {\n      this.convertStorageError(error, 'metadata', executionContext, {\n        fileId: file.fileId,\n        storageRef: key,\n        provider: this.providerId,\n      });\n    }\n  }\n\n  // =========================================================================\n  // Health check\n  // =========================================================================\n\n  async healthCheck(): Promise<StorageProviderHealthResult> {\n    const startTime = Date.now();\n\n    // RECOVER, don't just report. This used to `return { healthy: false }` on a\n    // null client and never try again — which turned any transient startup failure\n    // into a PERMANENT one: `initialize()` runs once, so a client that failed to\n    // build at boot was never rebuilt, storage stayed unhealthy for the process\n    // lifetime, and `/health/ready` answered 503 forever while `/health` looked\n    // fine. That is the documented \"port open + /health healthy + /health/ready 503\n    // forever\" state (`platform/CLAUDE.md`), reached without any ongoing fault.\n    //\n    // Observed exactly that way on apps-manager: the credential fetch was refused\n    // at boot, the listener came up 0.4s later, and nothing retried. A readiness\n    // probe is the natural retry point — it is called repeatedly, by design, and a\n    // dependency that has come back should be allowed to say so.\n    //\n    // `getClient()` is idempotent and caches, so a healthy probe costs no extra\n    // work; a still-failing one reports the CURRENT reason instead of the stale\n    // \"not initialized\".\n    if (!this.client) {\n      try {\n        await this.getClient();\n      } catch (error) {\n        return { healthy: false, latency: Date.now() - startTime, error: describeCaughtError(error) };\n      }\n    }\n\n    /**\n     * Declared OUTSIDE the try so the credential-rejection retry below can probe the SAME key.\n     * Recomputing it there would ask a different question than the one that just failed.\n     */\n    let probeKey = '';\n\n    try {\n      // ⚠️ Probes with an OBJECT-level call, not `bucketExists()`. Second site of\n      // F-D, and the more damaging one: this is the readiness dependency behind\n      // `/health/ready`, so a probe the credential cannot satisfy produces the\n      // documented \"port open + /health healthy + /health/ready 503 forever\"\n      // state (see `platform/CLAUDE.md`) — with remote clients looping on\n      // \"Remote API not ready\" and nothing pointing at storage.\n      //\n      // `bucketExists()` issues HeadBucket, authorised by an UNCONDITIONED\n      // `s3:ListBucket`. The session policy grants `ListBucket` only under\n      // `Condition StringLike s3:prefix`, and HeadBucket sends no prefix, so it\n      // can never pass. `statObject` on a key inside this application's own\n      // prefix is authorised by the policy's object statements, which is what the\n      // credential is actually for.\n      //\n      // A `NoSuchKey` reply is the HEALTHY answer: it proves the store was\n      // reached AND the credential was accepted. Only a real refusal or transport\n      // failure is unhealthy.\n      // The probe key must sit inside the prefix the CREDENTIAL covers, not the\n      // one the client would have guessed — otherwise readiness fails `AccessDenied`\n      // on a perfectly good credential and blames storage. Same identity source as\n      // every real operation, for the same reason.\n      const probeApplicationId = (await this.ensureCredentials()).applicationId\n        ?? this.appConfigService.applicationId;\n      probeKey = `${this.resolveBucketPrefix()}`\n        + API_ROUTES_BACKEND_DEFINITIONS.FILE_STORAGE.STORAGE_KEY_APPLICATION_FILE(\n          probeApplicationId,\n          '__storage_healthcheck__',\n          // The probe has no File row and no resource. It must sit under the SAME staging segment\n          // a real unlinked blob uses — once the session policy narrows per resource, a probe key\n          // outside every granted prefix would fail `AccessDenied` on a perfectly good credential\n          // and report storage unhealthy.\n          UNLINKED_STORAGE_SEGMENT,\n          ResourcePrimaryScope.APPLICATION,\n          probeApplicationId,\n        );\n\n      // `this.client!` — the recovery branch above either populated it or returned.\n      await this.client!.statObject(this.bucketName, probeKey);\n      return { healthy: true, latency: Date.now() - startTime };\n    } catch (error) {\n      const code = resolveStorageErrorCode(error);\n      if (code === 'NoSuchKey' || code === 'NotFound') {\n        return { healthy: true, latency: Date.now() - startTime };\n      }\n\n      /**\n       * A credential the STORE REJECTS is re-acquired, not held until it expires.\n       *\n       * The provider refreshes on EXPIRY only — its contract says so explicitly (\"Refresh before\n       * expiry, not after failure\"), and that is right for the ordinary case: callers should never\n       * observe an expired credential. But it leaves one state unrecoverable, and this is the probe\n       * that meets it. A session can become invalid while still unexpired — the object store\n       * restarts and forgets its STS sessions, or the parent credential rotates underneath it. The\n       * cached credential then stays \"fresh\" by the clock and is refused by the store on every call.\n       *\n       * Measured 2026-08-22: THREE platform runtimes (crontabs, apps-manager, the dev companion)\n       * held such a credential for ~27 HOURS. `/health` stayed 200 while `/health/ready` answered\n       * 503 the whole time, and the application backend logged `Remote API not ready` 2,384 times\n       * against one of them. Restarting each process cleared it — which is the definition of a\n       * defect that requires manual intervention, and it is exactly the state\n       * `platform/CLAUDE.md` describes as \"port open + /health healthy + /health/ready 503 forever\".\n       *\n       * `StorageCredentialProvider.invalidate()` existed for precisely this — its own JSDoc says\n       * \"for an explicit re-acquire after a hard failure\" — and NOTHING called it, in production or\n       * in a test. A capability with no door: the third found in this workstream, after\n       * `usePostgreSQL` and `MongoDBService.overrideUri`.\n       *\n       * Retried ONCE, and only for a rejection that names a credential problem. A blanket retry\n       * would mask a genuine outage as latency, and a retry loop on a store that is simply down\n       * would turn a readiness probe into a stall. One attempt distinguishes \"this credential is\n       * stale\" from \"the store is unreachable\", which is the only question this probe has to answer.\n       */\n      if (this.isCredentialRejection(code, error)) {\n        this.credentialProvider?.invalidate();\n        this.client = null;\n        this.clientAccessKey = undefined;\n\n        try {\n          const retryClient = await this.getClient();\n          await retryClient.statObject(this.bucketName, probeKey);\n          this.logger.info(\n            'Object storage credential was refused and has been re-acquired; storage is healthy again.',\n          );\n          return { healthy: true, latency: Date.now() - startTime };\n        } catch (retryError) {\n          const retryCode = resolveStorageErrorCode(retryError);\n          if (retryCode === 'NoSuchKey' || retryCode === 'NotFound') {\n            this.logger.info(\n              'Object storage credential was refused and has been re-acquired; storage is healthy again.',\n            );\n            return { healthy: true, latency: Date.now() - startTime };\n          }\n          return {\n            healthy: false,\n            latency: Date.now() - startTime,\n            error: describeCaughtError(retryError),\n          };\n        }\n      }\n\n      return { healthy: false, latency: Date.now() - startTime, error: describeCaughtError(error) };\n    }\n  }\n\n  /**\n   * Whether a failure says \"this CREDENTIAL is not accepted\" rather than \"the STORE is unavailable\".\n   *\n   * Only the first is worth re-acquiring for. The distinction is made on the error CODE where the\n   * client supplies one, and falls back to the message otherwise — MinIO answers a rejected STS\n   * session with `Valid and authorized credentials required`, which carries no S3 error code, and\n   * that exact string is what the three stuck runtimes reported for 27 hours.\n   */\n  private isCredentialRejection(code: string | undefined, error: unknown): boolean {\n    const CREDENTIAL_REJECTION_CODES = new Set([\n      'AccessDenied',\n      'InvalidAccessKeyId',\n      'SignatureDoesNotMatch',\n      'ExpiredToken',\n      'InvalidToken',\n      'TokenRefreshRequired',\n      'AuthorizationHeaderMalformed',\n    ]);\n    if (code && CREDENTIAL_REJECTION_CODES.has(code)) return true;\n\n    const message = error instanceof Error ? error.message : String(error ?? '');\n    return /valid and authorized credentials required|security token|access denied|invalid access key/i\n      .test(message);\n  }\n}\n"]}
+{"version":3,"file":"wildo-managed-storage-provider.backend.service.js","sourceRoot":"","sources":["../../../../src/files/storage/wildo-managed-storage-provider.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;;;;;;;;;;;;;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAEzD,OAAO,EAAE,MAAM,EAAiB,MAAM,OAAO,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,2BAA2B,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AACrH,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAC/D,OAAO,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AACtF,OAAO,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AAEpF,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAC9G,OAAO,EAAE,mBAAmB,EAAE,MAAM,8EAA8E,CAAC;AACnH,OAAO,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AAG/G,OAAO,EAAE,aAAa,EAAE,mBAAmB,EAAE,cAAc,EAAE,YAAY,EAAE,cAAc,EAAE,4BAA4B,EAAE,MAAM,sDAAsD,CAAC;AACtL,OAAO,EAAE,8BAA8B,EAAE,MAAM,kEAAkE,CAAC;AAClH,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAG7D,OAAO,EAAE,yBAAyB,EAAE,MAAM,4EAA4E,CAAC;AAEvH,OAAO,EAAE,kCAAkC,EAAE,MAAM,gFAAgF,CAAC;AACpI,OAAO,EAAE,iCAAiC,EAAE,MAAM,2EAA2E,CAAC;AAC9H,OAAO,EACL,wBAAwB,EACxB,4BAA4B,EAC5B,sBAAsB,EACtB,6BAA6B,GAC9B,MAAM,yCAAyC,CAAC;AAWjD,MAAM,sBAAsB,GAAG,WAAW,CAAC;AAE3C;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAM,gCAAgC,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,GAAG,IAAI,CAAC;AAEhE;;;;;;;;;;;;GAYG;AACH,MAAM,eAAe,GAAG,gCAAgC,CAAC;AAEzD;;;;;;;;;;;;;GAaG;AACH,SAAS,uBAAuB,CAAC,KAAc;IAC7C,MAAM,IAAI,GAAI,KAA4B,EAAE,IAAI,CAAC;IACjD,OAAO,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;AACxE,CAAC;AAGM,IAAM,2BAA2B,GAAjC,MAAM,2BAA2B;IA4DnB;IAEA;IAEA;IAgBA;IA/EV,UAAU,GAAG,mBAAmB,CAAC,aAAa,CAAC;IAChD,MAAM,GAAkB,IAAI,CAAC;IACrC;;;;;;OAMG;IACK,eAAe,CAAqB;IAC5C;;;;;;OAMG;IACK,kBAAkB,GAAqC,IAAI,CAAC;IACpE;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,IAAY,iBAAiB;QAC3B,OAAO,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC;IACvD,CAAC;IAED;;;;;;OAMG;IACH,IAAY,UAAU;QACpB,OAAO,IAAI,CAAC,iBAAiB,EAAE,MAAM,IAAI,gBAAgB,CAAC,MAAM,CAAC;IACnE,CAAC;IAED,YAEmB,MAAqB,EAErB,YAAwC,EAExC,gBAAyC,EAgBzC,0BAAsD;QApBtD,WAAM,GAAN,MAAM,CAAe;QAErB,iBAAY,GAAZ,YAAY,CAA4B;QAExC,qBAAgB,GAAhB,gBAAgB,CAAyB;QAgBzC,+BAA0B,GAA1B,0BAA0B,CAA4B;IACtE,CAAC;IAEJ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAoCG;IACH,YAAY;QACV,OAAO,CAAC,CAAC,IAAI,CAAC,iBAAiB,EAAE,QAAQ,IAAI,IAAI,CAAC,yBAAyB,EAAE,CAAC;IAChF,CAAC;IAED;;;;;;;;OAQG;IACK,yBAAyB;QAC/B,6EAA6E;QAC7E,IAAI,IAAI,CAAC,0BAA0B;YAAE,OAAO,IAAI,CAAC;QAEjD,OAAO,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,yBAAyB;eACzC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,mCAAmC;YACpD,yEAAyE;YACzE,0EAA0E;YAC1E,EAAE;YACF,0EAA0E;YAC1E,6EAA6E;YAC7E,6EAA6E;YAC7E,8EAA8E;YAC9E,wEAAwE;YACxE,+EAA+E;YAC/E,8EAA8E;YAC9E,mDAAmD;YACnD,EAAE;YACF,6EAA6E;YAC7E,+EAA+E;YAC/E,gFAAgF;YAChF,4EAA4E;YAC5E,gDAAgD;YAChD,kEAAkE;eAC/D,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC;IACpC,CAAC;IAED;;;;;;;;;;OAUG;IACK,qBAAqB;QAC3B,IAAI,IAAI,CAAC,kBAAkB;YAAE,OAAO,IAAI,CAAC,kBAAkB,CAAC;QAE5D,IAAI,CAAC,kBAAkB,GAAG,IAAI,yBAAyB,CACrD,IAAI,CAAC,0BAA0B;YAC/B,0EAA0E;YAC1E,sEAAsE;eACnE,kCAAkC,CAAC,GAAG,EAAE,CAAC,iCAAiC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,CACtG,CAAC;QACF,OAAO,IAAI,CAAC,kBAAkB,CAAC;IACjC,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,UAAU;QACd,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;IACzB,CAAC;IAED;;;;;;;;;;;;;;;;OAgBG;IACK,KAAK,CAAC,iBAAiB;QAC7B,MAAM,UAAU,GAAG,IAAI,CAAC,iBAAiB,CAAC;QAC1C,MAAM,QAAQ,GAAG,UAAU,EAAE,QAAQ,CAAC;QACtC,MAAM,IAAI,GAAG,UAAU,EAAE,IAAI,IAAI,mBAAmB,CAAC,KAAK,CAAC;QAC3D,MAAM,MAAM,GAAG,UAAU,EAAE,MAAM,IAAI,KAAK,CAAC;QAE3C,yEAAyE;QACzE,4EAA4E;QAC5E,kEAAkE;QAClE,iDAAiD;QACjD,EAAE;QACF,4EAA4E;QAC5E,qEAAqE;QACrE,0EAA0E;QAC1E,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,EAAE,CAAC;YACtC,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,aAAa,EACvB,SAAS,EACT;gBACE,sBAAsB,EAAE,2BAA2B,CAAC,aAAa;gBACjE,OAAO,EAAE;oBACP,OAAO,EACL,wGAAwG;0BACtG,gFAAgF;oBACpF,WAAW,EAAE,CAAC,CAAC,QAAQ;oBACvB,iBAAiB,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,yBAAyB;oBAC1D,gBAAgB,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,mCAAmC;oBACnE,sEAAsE;oBACtE,kEAAkE;oBAClE,kCAAkC;oBAClC,gBAAgB,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc;iBAC/C;aACF,CACF,CAAC;QACJ,CAAC;QAED,6EAA6E;QAC7E,wEAAwE;QACxE,4DAA4D;QAC5D,IAAI,WAAW,CAAC;QAChB,IAAI,CAAC;YACH,WAAW,GAAG,MAAM,IAAI,CAAC,qBAAqB,EAAE,CAAC,cAAc,EAAE,CAAC;QACpE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,qEAAqE;YACrE,0EAA0E;YAC1E,YAAY;YACZ,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,aAAa,EACvB,SAAS,EACT;gBACE,sBAAsB,EAAE,2BAA2B,CAAC,aAAa;gBACjE,OAAO,EAAE;oBACP,SAAS,EAAE,6BAA6B;oBACxC,OAAO,EAAE,wEAAwE;oBACjF,KAAK,EAAE,mBAAmB,CAAC,KAAK,CAAC;iBAClC;aACF,CACF,CAAC;QACJ,CAAC;QAED,OAAO,WAAW,CAAC;IACrB,CAAC;IAED;;;;;OAKG;IACK,KAAK,CAAC,SAAS;QACrB,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACnD,MAAM,UAAU,GAAG,IAAI,CAAC,iBAAiB,CAAC;QAC1C,MAAM,QAAQ,GAAG,UAAU,EAAE,QAAQ,IAAI,EAAE,CAAC;QAC5C,MAAM,IAAI,GAAG,UAAU,EAAE,IAAI,IAAI,mBAAmB,CAAC,KAAK,CAAC;QAC3D,MAAM,MAAM,GAAG,UAAU,EAAE,MAAM,IAAI,KAAK,CAAC;QAE3C,IAAI,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,eAAe,KAAK,WAAW,CAAC,SAAS,EAAE,CAAC;YAClE,OAAO,IAAI,CAAC,MAAM,CAAC;QACrB,CAAC;QAED,MAAM,WAAW,GAAG,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC;YAC1C,CAAC,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC;YACnB,CAAC,CAAC,IAAI,GAAG,CAAC,OAAO,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,MAAM,QAAQ,EAAE,CAAC,CAAC;QAEtD,MAAM,OAAO,GAAkB;YAC7B,QAAQ,EAAE,WAAW,CAAC,QAAQ;YAC9B,IAAI,EAAE,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI;YAC9D,MAAM,EAAE,MAAM,IAAI,WAAW,CAAC,QAAQ,KAAK,QAAQ;YACnD,SAAS,EAAE,WAAW,CAAC,SAAS;YAChC,SAAS,EAAE,WAAW,CAAC,SAAS;YAChC,sEAAsE;YACtE,8CAA8C;YAC9C,GAAG,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,WAAW,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/E,MAAM,EAAE,sBAAsB;YAC9B,wEAAwE;YACxE,wEAAwE;YACxE,oEAAoE;YACpE,QAAQ,EAAE,eAAe;SAC1B,CAAC;QAEF,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC;QAEnC,iEAAiE;QACjE,EAAE;QACF,yEAAyE;QACzE,4EAA4E;QAC5E,8EAA8E;QAC9E,0EAA0E;QAC1E,8EAA8E;QAC9E,wEAAwE;QACxE,8EAA8E;QAC9E,6EAA6E;QAC7E,SAAS;QACT,EAAE;QACF,2EAA2E;QAC3E,yEAAyE;QACzE,8EAA8E;QAC9E,0DAA0D;QAC1D,8EAA8E;QAC9E,2EAA2E;QAC3E,6EAA6E;QAC7E,yCAAyC;QACzC,EAAE;QACF,4EAA4E;QAE5E,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,uEAAuE;QACvE,gEAAgE;QAChE,IAAI,CAAC,eAAe,GAAG,WAAW,CAAC,SAAS,CAAC;QAC7C,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;;;;;;;;;;;;;;OAgBG;IACK,KAAK,CAAC,gBAAgB,CAAC,gBAAuC;QACpE,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACnD,MAAM,aAAa,GAAG,WAAW,CAAC,aAAa,CAAC;QAEhD,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,aAAa,EACvB,gBAAgB,EAChB;gBACE,sBAAsB,EAAE,2BAA2B,CAAC,aAAa;gBACjE,OAAO,EAAE;oBACP,SAAS,EAAE,uCAAuC;oBAClD,OAAO,EACL,sFAAsF;0BACpF,oFAAoF;0BACpF,qBAAqB;iBAC1B;aACF,CACF,CAAC;QACJ,CAAC;QAED,aAAa,CAAC,aAAa,EAAE,IAAI,CAAC,YAAY,EAAE,gBAAgB,EAAE,eAAe,CAAC,CAAC;QACnF,OAAO,aAAa,CAAC;IACvB,CAAC;IAED;;;;;;;;;;;;;;;;;OAiBG;IACK,mBAAmB;QACzB,MAAM,GAAG,GAAG,IAAI,CAAC,iBAAiB,EAAE,YAAY,CAAC;QACjD,IAAI,CAAC,GAAG;YAAE,OAAO,EAAE,CAAC;QACpB,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;QAC3B,OAAO,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,CAAC;IACvE,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4BG;IACK,yBAAyB,CAC/B,SAAiB,EACjB,gBAAuC,EACvC,WAAoC;QAEpC,IAAI,CAAC,6BAA6B,CAAC,SAAS,CAAC,EAAE,CAAC;YAC9C,OAAO;QACT,CAAC;QAED,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,aAAa,EACvB,gBAAgB,EAChB;YACE,sBAAsB,EAAE,2BAA2B,CAAC,4BAA4B;YAChF,OAAO,EAAE;gBACP,wBAAwB;gBACxB,GAAG,WAAW;gBACd,SAAS;gBACT,QAAQ,EAAE,IAAI,CAAC,UAAU;aAC1B;SACF,CACF,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,2BAA2B,CACvC,MAAc,EACd,gBAAuC,EACvC,UAAmB,EACnB,kBAAiC,EACjC,SAAgC;QAEhC,6FAA6F;QAC7F,0FAA0F;QAC1F,gDAAgD;QAChD,IAAI,CAAC,yBAAyB,CAAC,MAAM,EAAE,gBAAgB,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC,CAAC;QAE7F,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,gBAAgB,CAAC,CAAC;QACpE,MAAM,YAAY,GAAG,IAAI,CAAC,mBAAmB,EAAE,CAAC;QAChD,iGAAiG;QACjG,wFAAwF;QACxF,yFAAyF;QACzF,wEAAwE;QACxE,MAAM,UAAU,GACd,YAAY;cACV,4BAA4B,CAAC,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,EAAE,kBAAkB,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;QAE5G,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,OAAO,UAAU,CAAC;QACpB,CAAC;QAED,MAAM,oBAAoB,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC;QAC/C,IAAI,CAAC,oBAAoB,EAAE,CAAC;YAC1B,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,UAAU,EACpB,gBAAgB,EAChB;gBACE,sBAAsB,EAAE,2BAA2B,CAAC,wBAAwB;gBAC5E,OAAO,EAAE;oBACP,wBAAwB;oBACxB,MAAM;oBACN,aAAa;iBACd;aACF,CACF,CAAC;QACJ,CAAC;QAED,2FAA2F;QAC3F,6FAA6F;QAC7F,6EAA6E;QAC7E,IAAI,CAAC,yBAAyB,CAAC,oBAAoB,EAAE,gBAAgB,EAAE,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC,CAAC;QAEhI,0FAA0F;QAC1F,4FAA4F;QAC5F,8FAA8F;QAC9F,4FAA4F;QAC5F,gEAAgE;QAChE,MAAM,cAAc,GAClB,YAAY;cACV,gBAAgB,aAAa,SAAS,CAAC;QAC3C,IAAI,CAAC,oBAAoB,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;YACrD,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,aAAa,EACvB,gBAAgB,EAChB;gBACE,sBAAsB,EAAE,2BAA2B,CAAC,0BAA0B;gBAC9E,OAAO,EAAE;oBACP,wBAAwB;oBACxB,MAAM;oBACN,aAAa;oBACb,UAAU,EAAE,oBAAoB;oBAChC,cAAc;iBACf;aACF,CACF,CAAC;QACJ,CAAC;QAED,OAAO,oBAAoB,CAAC;IAC9B,CAAC;IAEO,mBAAmB,CACzB,KAAc,EACd,SAAwD,EACxD,gBAAmD,EACnD,OAAgC;QAEhC,IAAI,mBAAmB,CAAC,KAAK,CAAC,EAAE,CAAC;YAC/B,MAAM,KAAK,CAAC;QACd,CAAC;QAED,MAAM,YAAY,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAC;QAChD,uEAAuE;QACvE,EAAE;QACF,8EAA8E;QAC9E,0EAA0E;QAC1E,2EAA2E;QAC3E,6EAA6E;QAC7E,6EAA6E;QAC7E,4EAA4E;QAC5E,kEAAkE;QAClE,MAAM,SAAS,GAAG,uBAAuB,CAAC,KAAK,CAAC,CAAC;QACjD,MAAM,iBAAiB,GAAG,YAAY,CAAC,WAAW,EAAE,CAAC;QAErD,IACE,SAAS,KAAK,WAAW;eACtB,SAAS,KAAK,UAAU;eACxB,SAAS,KAAK,cAAc;eAC5B,CAAC,CAAC,SAAS,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,iBAAiB,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,EACvG,CAAC;YACD,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,SAAS,EACnB,gBAAgB,EAChB;gBACE,sBAAsB,EAAE,2BAA2B,CAAC,yBAAyB;gBAC7E,OAAO,EAAE;oBACP,wBAAwB;oBACxB,SAAS;oBACT,GAAG,OAAO;iBACX;aACF,CACF,CAAC;QACJ,CAAC;QAED,IACE,SAAS,KAAK,cAAc;eACzB,SAAS,KAAK,WAAW;eACzB,SAAS,KAAK,uBAAuB;eACrC,SAAS,KAAK,oBAAoB;eAClC,SAAS,KAAK,cAAc;eAC5B,SAAS,KAAK,cAAc;eAC5B,CAAC,CAAC,SAAS,IAAI,CAChB,iBAAiB,CAAC,QAAQ,CAAC,cAAc,CAAC;mBACvC,iBAAiB,CAAC,QAAQ,CAAC,eAAe,CAAC;mBAC3C,iBAAiB,CAAC,QAAQ,CAAC,WAAW,CAAC;mBACvC,iBAAiB,CAAC,QAAQ,CAAC,uBAAuB,CAAC;mBACnD,iBAAiB,CAAC,QAAQ,CAAC,oBAAoB,CAAC,CACpD,CAAC,EACF,CAAC;YACD,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,aAAa,EACvB,gBAAgB,EAChB;gBACE,sBAAsB,EAAE,2BAA2B,CAAC,0BAA0B;gBAC9E,OAAO,EAAE;oBACP,wBAAwB;oBACxB,SAAS;oBACT,GAAG,OAAO;oBACV,aAAa,EAAE,YAAY;iBAC5B;aACF,CACF,CAAC;QACJ,CAAC;QAED,IACE,iBAAiB,CAAC,QAAQ,CAAC,gBAAgB,CAAC;eACzC,iBAAiB,CAAC,QAAQ,CAAC,mBAAmB,CAAC,EAClD,CAAC;YACD,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,aAAa,EACvB,gBAAgB,EAChB;gBACE,sBAAsB,EAAE,2BAA2B,CAAC,aAAa;gBACjE,OAAO,EAAE;oBACP,OAAO,EAAE,4CAA4C;oBACrD,SAAS;oBACT,UAAU,EAAE,IAAI,CAAC,UAAU;oBAC3B,GAAG,OAAO;oBACV,aAAa,EAAE,YAAY;iBAC5B;aACF,CACF,CAAC;QACJ,CAAC;QAED,IACE,iBAAiB,CAAC,QAAQ,CAAC,YAAY,CAAC;eACrC,iBAAiB,CAAC,QAAQ,CAAC,SAAS,CAAC;eACrC,iBAAiB,CAAC,QAAQ,CAAC,cAAc,CAAC;eAC1C,iBAAiB,CAAC,QAAQ,CAAC,SAAS,CAAC,EACxC,CAAC;YACD,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,OAAO,EACjB,gBAAgB,EAChB;gBACE,sBAAsB,EAAE,2BAA2B,CAAC,OAAO;gBAC3D,OAAO,EAAE;oBACP,OAAO,EAAE,mCAAmC;oBAC5C,SAAS;oBACT,GAAG,OAAO;oBACV,aAAa,EAAE,YAAY;iBAC5B;aACF,CACF,CAAC;QACJ,CAAC;QAED,IACE,iBAAiB,CAAC,QAAQ,CAAC,QAAQ,CAAC;eACjC,iBAAiB,CAAC,QAAQ,CAAC,MAAM,CAAC;eAClC,iBAAiB,CAAC,QAAQ,CAAC,UAAU,CAAC,EACzC,CAAC;YACD,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,gBAAgB,EAC1B,gBAAgB,EAChB;gBACE,sBAAsB,EAAE,2BAA2B,CAAC,gBAAgB;gBACpE,OAAO,EAAE;oBACP,OAAO,EAAE,4CAA4C;oBACrD,SAAS;oBACT,GAAG,OAAO;oBACV,aAAa,EAAE,YAAY;iBAC5B;aACF,CACF,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,gBAAgB,EAC1B,gBAAgB,EAChB;YACE,sBAAsB,EAAE,2BAA2B,CAAC,gBAAgB;YACpE,OAAO,EAAE;gBACP,OAAO,EAAE,qCAAqC,SAAS,EAAE;gBACzD,SAAS;gBACT,GAAG,OAAO;gBACV,aAAa,EAAE,YAAY;aAC5B;SACF,CACF,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,MAAM,CACV,UAAoB,EACpB,MAAc,EACd,QAAgB,EAChB,IAAY,EACZ,gBAAuC,EACvC,OAA8B;QAE9B,cAAc,CAAC,MAAM,EAAE,IAAI,CAAC,YAAY,EAAE,gBAAgB,EAAE,QAAQ,CAAC,CAAC;QACtE,mBAAmB,CAAC,QAAQ,EAAE,IAAI,CAAC,YAAY,EAAE,gBAAgB,EAAE,UAAU,CAAC,CAAC;QAC/E,YAAY,CACV,IAAI,EACJ,4BAA4B,CAAC,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,OAAO,EAAE,WAAW,CAAC,EAC/E,IAAI,CAAC,YAAY,EACjB,gBAAgB,EAChB,MAAM,CACP,CAAC;QACF,cAAc,CAAC,UAAU,EAAE,IAAI,CAAC,YAAY,EAAE,gBAAgB,EAAE,YAAY,CAAC,CAAC;QAE9E,wEAAwE;QACxE,2EAA2E;QAC3E,6EAA6E;QAC7E,sEAAsE;QACtE,6EAA6E;QAC7E,4DAA4D;QAC5D,wCAAwC;QACxC,IAAI,IAAI,GAAG,gCAAgC,EAAE,CAAC;YAC5C,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,UAAU,EACpB,gBAAgB,EAChB;gBACE,qEAAqE;gBACrE,+DAA+D;gBAC/D,kCAAkC;gBAClC,sBAAsB,EAAE,2BAA2B,CAAC,gCAAgC;gBACpF,OAAO,EAAE;oBACP,wBAAwB;oBACxB,MAAM;oBACN,IAAI;oBACJ,MAAM,EAAE,4BAA4B;oBACpC,gBAAgB,EAAE,gCAAgC;oBAClD,OAAO,EACL,8FAA8F;0BAC5F,4FAA4F;0BAC5F,GAAG,gCAAgC,SAAS;iBACjD;aACF,CACF,CAAC;QACJ,CAAC;QAED,MAAM,eAAe,GAAG,sBAAsB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAEhE,IAAI,CAAC,eAAe,EAAE,CAAC;YACrB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,UAAU,EACpB,gBAAgB,EAChB;gBACE,sBAAsB,EAAE,2BAA2B,CAAC,mCAAmC;aACxF,CACF,CAAC;QACJ,CAAC;QAED,MAAM,YAAY,GAAG,OAAO,EAAE,oBAAoB,IAAI,IAAI,CAAC;QAC3D,MAAM,GAAG,GAAG,YAAY;YACtB,CAAC,CAAC,MAAM,IAAI,CAAC,2BAA2B,CAAC,eAAe,EAAE,gBAAgB,EAAE,SAAS,EAAE,OAAO,EAAE,kBAAkB,EAAE,OAAO,EAAE,KAAK,CAAC;YACnI,CAAC,CAAC,eAAe,CAAC;QACpB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;QAEtC,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,SAAS,CACpB,IAAI,CAAC,UAAU,EACf,GAAG,EACH,UAAU,EACV,IAAI,EACJ;gBACE,CAAC,eAAe,CAAC,YAAY,CAAC,EAAE,QAAQ;aACzC,CACF,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,mBAAmB,CAAC,KAAK,EAAE,QAAQ,EAAE,gBAAgB,EAAE;gBAC1D,MAAM;gBACN,UAAU,EAAE,GAAG;gBACf,QAAQ,EAAE,IAAI,CAAC,UAAU;aAC1B,CAAC,CAAC;QACL,CAAC;QAED,OAAO;YACL,UAAU,EAAE,GAAG;YACf,QAAQ,EAAE,IAAI,CAAC,UAAU;SAC1B,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,QAAQ,CACZ,IAA6B,EAC7B,gBAAuC;QAEvC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,2BAA2B,CAAC,IAAI,CAAC,MAAM,EAAE,gBAAgB,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;QACnG,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;QACtC,IAAI,MAAgB,CAAC;QACrB,IAAI,QAA6B,CAAC;QAElC,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;YAC3D,MAAM,WAAW,GAAG,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC,YAAY,CAAC,CAAC;YAChE,IAAI,CAAC,WAAW,EAAE,CAAC;gBACjB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,gBAAgB,EAC1B,gBAAgB,EAChB;oBACE,sBAAsB,EAAE,2BAA2B,CAAC,gBAAgB;oBACpE,OAAO,EAAE;wBACP,OAAO,EAAE,oDAAoD,eAAe,CAAC,YAAY,EAAE;wBAC3F,MAAM,EAAE,IAAI,CAAC,MAAM;wBACnB,UAAU,EAAE,GAAG;qBAChB;iBACF,CACF,CAAC;YACJ,CAAC;YAED,MAAM,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;YACtD,QAAQ,GAAG;gBACT,WAAW;gBACX,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,YAAY,EAAE,IAAI,CAAC,YAAY;aAChC,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,mBAAmB,CAAC,KAAK,EAAE,UAAU,EAAE,gBAAgB,EAAE;gBAC5D,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,UAAU,EAAE,GAAG;gBACf,QAAQ,EAAE,IAAI,CAAC,UAAU;aAC1B,CAAC,CAAC;QACL,CAAC;QAED,OAAO;YACL,MAAM;YACN,WAAW,EAAE,QAAQ,CAAC,WAAW;YACjC,IAAI,EAAE,QAAQ,CAAC,IAAI;YACnB,IAAI,EAAE,QAAQ,CAAC,IAAI;YACnB,YAAY,EAAE,QAAQ,CAAC,YAAY;SACpC,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,MAAM,CACV,IAA6B,EAC7B,gBAAuC;QAEvC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,2BAA2B,CAAC,IAAI,CAAC,MAAM,EAAE,gBAAgB,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;QACnG,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;QAEtC,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;QAClD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,0EAA0E;YAC1E,0EAA0E;YAC1E,0DAA0D;YAC1D,MAAM,eAAe,GAAG,uBAAuB,CAAC,KAAK,CAAC,CAAC;YACvD,MAAM,iBAAiB,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;YACnE,IACE,eAAe,KAAK,WAAW;mBAC5B,eAAe,KAAK,UAAU;mBAC9B,CAAC,CAAC,eAAe,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,iBAAiB,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,EAC7G,CAAC;gBACD,OAAO;YACT,CAAC;YACD,IAAI,CAAC,mBAAmB,CAAC,KAAK,EAAE,QAAQ,EAAE,gBAAgB,EAAE;gBAC1D,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,UAAU,EAAE,GAAG;gBACf,QAAQ,EAAE,IAAI,CAAC,UAAU;aAC1B,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,KAAK,CAAC,WAAW,CACf,IAA6B,EAC7B,gBAAuC;QAEvC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,2BAA2B,CAAC,IAAI,CAAC,MAAM,EAAE,gBAAgB,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;QACnG,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;QAEtC,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;YAC3D,MAAM,WAAW,GAAG,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC,YAAY,CAAC,CAAC;YAChE,IAAI,CAAC,WAAW,EAAE,CAAC;gBACjB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,gBAAgB,EAC1B,gBAAgB,EAChB;oBACE,sBAAsB,EAAE,2BAA2B,CAAC,gBAAgB;oBACpE,OAAO,EAAE;wBACP,OAAO,EAAE,oDAAoD,eAAe,CAAC,YAAY,EAAE;wBAC3F,MAAM,EAAE,IAAI,CAAC,MAAM;wBACnB,UAAU,EAAE,GAAG;qBAChB;iBACF,CACF,CAAC;YACJ,CAAC;YAED,OAAO;gBACL,WAAW;gBACX,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,YAAY,EAAE,IAAI,CAAC,YAAY;aAChC,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,mBAAmB,CAAC,KAAK,EAAE,UAAU,EAAE,gBAAgB,EAAE;gBAC5D,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,UAAU,EAAE,GAAG;gBACf,QAAQ,EAAE,IAAI,CAAC,UAAU;aAC1B,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,4EAA4E;IAC5E,eAAe;IACf,4EAA4E;IAE5E,KAAK,CAAC,WAAW;QACf,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAE7B,4EAA4E;QAC5E,+EAA+E;QAC/E,6EAA6E;QAC7E,4EAA4E;QAC5E,4EAA4E;QAC5E,gFAAgF;QAChF,4EAA4E;QAC5E,EAAE;QACF,8EAA8E;QAC9E,6EAA6E;QAC7E,+EAA+E;QAC/E,6DAA6D;QAC7D,EAAE;QACF,4EAA4E;QAC5E,4EAA4E;QAC5E,qBAAqB;QACrB,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YACjB,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;YACzB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,EAAE,KAAK,EAAE,mBAAmB,CAAC,KAAK,CAAC,EAAE,CAAC;YAChG,CAAC;QACH,CAAC;QAED;;;WAGG;QACH,IAAI,QAAQ,GAAG,EAAE,CAAC;QAElB,IAAI,CAAC;YACH,4EAA4E;YAC5E,0EAA0E;YAC1E,yEAAyE;YACzE,uEAAuE;YACvE,oEAAoE;YACpE,0DAA0D;YAC1D,EAAE;YACF,qEAAqE;YACrE,qEAAqE;YACrE,0EAA0E;YAC1E,sEAAsE;YACtE,4EAA4E;YAC5E,8BAA8B;YAC9B,EAAE;YACF,qEAAqE;YACrE,4EAA4E;YAC5E,wBAAwB;YACxB,0EAA0E;YAC1E,+EAA+E;YAC/E,6EAA6E;YAC7E,6CAA6C;YAC7C,MAAM,kBAAkB,GAAG,CAAC,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC,CAAC,aAAa;mBACpE,IAAI,CAAC,gBAAgB,CAAC,aAAa,CAAC;YACzC,QAAQ,GAAG,GAAG,IAAI,CAAC,mBAAmB,EAAE,EAAE;kBACtC,8BAA8B,CAAC,YAAY,CAAC,4BAA4B,CACxE,kBAAkB,EAClB,yBAAyB;gBACzB,wFAAwF;gBACxF,wFAAwF;gBACxF,wFAAwF;gBACxF,gCAAgC;gBAChC,wBAAwB,EACxB,oBAAoB,CAAC,WAAW,EAChC,kBAAkB,CACnB,CAAC;YAEJ,8EAA8E;YAC9E,MAAM,IAAI,CAAC,MAAO,CAAC,UAAU,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;YACzD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,EAAE,CAAC;QAC5D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,GAAG,uBAAuB,CAAC,KAAK,CAAC,CAAC;YAC5C,IAAI,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,UAAU,EAAE,CAAC;gBAChD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,EAAE,CAAC;YAC5D,CAAC;YAED;;;;;;;;;;;;;;;;;;;;;;;;;;eA0BG;YACH,IAAI,IAAI,CAAC,qBAAqB,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,CAAC;gBAC5C,IAAI,CAAC,kBAAkB,EAAE,UAAU,EAAE,CAAC;gBACtC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;gBACnB,IAAI,CAAC,eAAe,GAAG,SAAS,CAAC;gBAEjC,IAAI,CAAC;oBACH,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;oBAC3C,MAAM,WAAW,CAAC,UAAU,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;oBACxD,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,2FAA2F,CAC5F,CAAC;oBACF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,EAAE,CAAC;gBAC5D,CAAC;gBAAC,OAAO,UAAU,EAAE,CAAC;oBACpB,MAAM,SAAS,GAAG,uBAAuB,CAAC,UAAU,CAAC,CAAC;oBACtD,IAAI,SAAS,KAAK,WAAW,IAAI,SAAS,KAAK,UAAU,EAAE,CAAC;wBAC1D,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,2FAA2F,CAC5F,CAAC;wBACF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,EAAE,CAAC;oBAC5D,CAAC;oBACD,OAAO;wBACL,OAAO,EAAE,KAAK;wBACd,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;wBAC/B,KAAK,EAAE,mBAAmB,CAAC,UAAU,CAAC;qBACvC,CAAC;gBACJ,CAAC;YACH,CAAC;YAED,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,EAAE,KAAK,EAAE,mBAAmB,CAAC,KAAK,CAAC,EAAE,CAAC;QAChG,CAAC;IACH,CAAC;IAED;;;;;;;OAOG;IACK,qBAAqB,CAAC,IAAwB,EAAE,KAAc;QACpE,MAAM,0BAA0B,GAAG,IAAI,GAAG,CAAC;YACzC,cAAc;YACd,oBAAoB;YACpB,uBAAuB;YACvB,cAAc;YACd,cAAc;YACd,sBAAsB;YACtB,8BAA8B;SAC/B,CAAC,CAAC;QACH,IAAI,IAAI,IAAI,0BAA0B,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QAE9D,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;QAC7E,OAAO,4FAA4F;aAChG,IAAI,CAAC,OAAO,CAAC,CAAC;IACnB,CAAC;CACF,CAAA;AAxiCY,2BAA2B;IADvC,UAAU,EAAE;IA4DR,WAAA,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAA;IAEjC,WAAA,MAAM,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,CAAA;IAE9C,WAAA,MAAM,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,CAAA;IAgB3C,WAAA,MAAM,CAAC,kBAAkB,CAAC,yBAAyB,CAAC,CAAA;IAAE,WAAA,QAAQ,EAAE,CAAA;+CAjBlC,0BAA0B;QAEtB,uBAAuB;GAhEjD,2BAA2B,CAwiCvC","sourcesContent":["/**\n * Wildo-Managed Storage Provider\n *\n * Default IFileStorageProvider implementation backed by MinIO/S3.\n * All file operations go through z_file() declarations and the unified\n * IFileStorageProvider interface.\n *\n * Two inputs, from two different places, and the split is deliberate:\n * - TOPOLOGY (endpoint, port, ssl, bucket, key prefix) comes from resolved\n *   application configuration (`storage.managed`), which the configuration\n *   loader seeds from the environment.\n * - CREDENTIALS are short-lived, prefix-confined STS sessions fetched from\n *   apps-manager per use. They never appear in configuration or in the\n *   environment.\n */\n\nimport { injectable, inject, optional } from 'inversify';\nimport { Readable } from 'stream';\nimport { Client, ClientOptions } from 'minio';\nimport { ErrorType, ErrorCustomMessageReference, WildoHeaderKeys, isWildoBackendError } from '@wildo-ai/saas-models';\nimport { FileStorageAccepted } from '@wildo-ai/zod-decorators';\nimport { INFRA_DEFAULT_PORTS, STORAGE_DEFAULTS } from '@wildo-ai/platform-config-lib';\nimport { SAAS_SERVICE_TYPES } from '~wildo-backend-lib/inject/models/service-types';\nimport type { LoggerService } from '~wildo-backend-lib/monitoring/logger/services/logger.service';\nimport { ErrorBuilderBackendService } from '~wildo-backend-lib/errors/services/error-builder.backend.service';\nimport { describeCaughtError } from '~wildo-backend-lib/errors/utils/error-log-level-classification.backend.utils';\nimport { AppConfigurationService } from '~wildo-backend-lib/config/services/app-configuration.backend.service';\nimport type { AppConfiguration_Storage_ManagedConnection } from '~wildo-backend-lib/config/models/app-config.backend.schemas';\nimport type { ExecutionContext } from '~wildo-backend-lib/runtime/models/execution-context.backend.schemas';\nimport { validateAppId, validateContentType, validateFileId, validateSize, validateStream, resolveConfiguredMaxFileSize } from '~wildo-backend-lib/files/utils/file-validation.utils';\nimport { API_ROUTES_BACKEND_DEFINITIONS } from '~wildo-backend-lib/requests/models/api-routes.backend.defintions';\nimport { ResourcePrimaryScope } from '@wildo-ai/saas-models';\nimport type { FileScopeIdentifiers, ResourceType } from '@wildo-ai/saas-models';\n\nimport { StorageCredentialProvider } from '~wildo-backend-lib/files/storage/storage-credential-provider.backend.utils';\nimport type { ResolvedStorageCredentials, StorageCredentialResolver } from '~wildo-backend-lib/files/storage/storage-credential-provider.backend.utils';\nimport { createStsStorageCredentialResolver } from '~wildo-backend-lib/files/storage/storage-sts-credential-resolver.backend.utils';\nimport { resolveStorageApplicationIdentity } from '~wildo-backend-lib/files/utils/storage-application-identity.backend.utils';\nimport {\n  UNLINKED_STORAGE_SEGMENT,\n  composeApplicationStorageKey,\n  composeStorageLeafPath,\n  storageKeyHasTraversalSegment,\n} from './application-storage-key.backend.utils';\nimport type {\n  IFileStorageProvider,\n  StorageUploadResult,\n  StorageUploadOptions,\n  StorageDownloadResult,\n  StorageFileMetadata,\n  StorageProviderHealthResult,\n  StoredFileStorageTarget,\n} from './file-storage-provider.types';\n\nconst DEFAULT_STORAGE_REGION = 'us-east-1';\n\n/**\n * S3's maximum object size for a SINGLE `PutObject` request, and therefore the\n * largest object this provider can store under a prefix-confined credential.\n *\n * ## Why a prefix-confined credential cannot use multipart at all\n *\n * The minio client's multipart path opens with `findUploadId()`, which issues\n * **ListMultipartUploads** — a BUCKET-level operation authorised by\n * `s3:ListBucketMultipartUploads`. That action is not in the session policy, so\n * every upload large enough to take the multipart branch is refused\n * `AccessDenied` before a single byte is sent. Measured against live MinIO:\n * `CreateMultipartUpload` is allowed (it maps to `s3:PutObject`), while\n * `findUploadId` and `AbortMultipartUpload` are both refused.\n *\n * Granting the missing action is NOT an option, and not merely on preference —\n * MinIO rejects the policy outright: `s3:ListBucketMultipartUploads` does not\n * accept the `s3:prefix` condition key\n * (`InvalidParameterValue: unsupported condition keys '[s3:prefix]'`). The only\n * way to grant it is an UNCONDITIONED bucket-wide statement, which would expose\n * every other application's in-flight upload keys — the same tenant-structure\n * leak the conditioned `s3:ListBucket` exists to prevent.\n *\n * So the multipart branch is avoided rather than authorised: {@link PART_SIZE_BYTES}\n * is set high enough that no object this provider accepts can reach it, and\n * anything above this ceiling is refused here with a precise error rather than\n * an opaque `AccessDenied` from the store.\n *\n * See `.claude/plans/object-storage-root-credential-distribution.md` (F-D).\n */\nconst MAX_SINGLE_PUT_OBJECT_SIZE_BYTES = 5 * 1024 * 1024 * 1024;\n\n/**\n * Forces every upload onto the single-`PutObject` path — see\n * {@link MAX_SINGLE_PUT_OBJECT_SIZE_BYTES} for why multipart is unreachable.\n *\n * The client branches on `size <= partSize`, so pinning this to the single-PUT\n * ceiling makes the branch unreachable for any object the provider accepts.\n *\n * It costs no additional memory: the single-PUT path buffers `size` bytes, which\n * is bounded by the application's own configured `storage.maxFileSize`, not by\n * this value. What it does mean is that an upload is fully buffered rather than\n * streamed in chunks — acceptable at the 100 MB default ceiling, and the reason\n * `storage.maxFileSize` is the knob that governs storage memory pressure.\n */\nconst PART_SIZE_BYTES = MAX_SINGLE_PUT_OBJECT_SIZE_BYTES;\n\n/**\n * The S3/MinIO error CODE, when the thrown value carries one.\n *\n * Preferred over message matching everywhere in this file. The minio client sets\n * `code` (e.g. `AccessDenied`, `NoSuchKey`, `ExpiredToken`) on its errors, and a\n * code is a stable contract where a message is prose the SDK may reword between\n * releases. F-D is the concrete cost of getting this wrong: a real `AccessDenied`\n * whose message did not contain the expected substring was classified as a\n * generic connectivity failure, so the log blamed credentials and the actual\n * cause — an unauthorised HeadBucket probe — stayed invisible.\n *\n * Returns `undefined` for a plain `Error`, which is the signal for callers to\n * fall back to substring matching rather than mis-classify.\n */\nfunction resolveStorageErrorCode(error: unknown): string | undefined {\n  const code = (error as { code?: unknown })?.code;\n  return typeof code === 'string' && code.length > 0 ? code : undefined;\n}\n\n@injectable()\nexport class WildoManagedStorageProvider implements IFileStorageProvider {\n  readonly providerId = FileStorageAccepted.WILDO_MANAGED;\n  private client: Client | null = null;\n  /**\n   * Access key the cached {@link client} was built with. A storage client binds\n   * its credentials at construction, so once those credentials can EXPIRE the\n   * client must be rebuilt when they change — caching it unconditionally (as this\n   * did while the credential was the never-changing root key) would keep using a\n   * dead session until the process restarted.\n   */\n  private clientAccessKey: string | undefined;\n  /**\n   * Renews credentials before they expire. Today it is fed the long-lived env\n   * credential, so behaviour is unchanged; the point of the seam is that\n   * `getClient()` no longer assumes the credential is immutable, which is what\n   * short-lived prefix-confined STS credentials require.\n   * See `.claude/plans/object-storage-root-credential-distribution.md`.\n   */\n  private credentialProvider: StorageCredentialProvider | null = null;\n  /**\n   * The object store's topology (endpoint, port, ssl, bucket, key prefix), read\n   * from resolved application configuration on every use.\n   *\n   * ## Why configuration and not `process.env`\n   *\n   * Topology is platform-injected material, exactly like `database.mongodb.host`,\n   * and configuration is where platform-injected material belongs: it is the one\n   * seam that can later be served over the wire instead of baked into a `.env`\n   * file. The environment is still the SOURCE — `buildStorageTopologyFromEnvironment`\n   * reads it — but it is read once, at configuration construction, rather than by\n   * each consumer.\n   *\n   * Resolved lazily on every use rather than captured at construction. The bucket\n   * used to be a class field initializer, evaluated during DI wiring — before\n   * application configuration exists — which is precisely why a construction-time\n   * capture cannot be the source here.\n   * See `.claude/plans/application-runtime-topology-delivery.md`.\n   *\n   * Returns `undefined` when no managed store is configured; callers fail with a\n   * precise CONFIGURATION error rather than inventing a default, because a\n   * plausible default would make an unconfigured runtime look configured and fail\n   * later at an object operation.\n   */\n  private get managedConnection(): AppConfiguration_Storage_ManagedConnection | undefined {\n    return this.appConfigService.config.storage?.managed;\n  }\n\n  /**\n   * The bucket. Not optional in practice: reached only from paths that have\n   * already resolved a client, and therefore already proved a managed\n   * connection exists. The fallback exists so an error-formatting path\n   * (`convertStorageError`) can name the bucket without being able to throw a\n   * second error while reporting the first.\n   */\n  private get bucketName(): string {\n    return this.managedConnection?.bucket ?? STORAGE_DEFAULTS.BUCKET;\n  }\n\n  constructor(\n    @inject(SAAS_SERVICE_TYPES.Logger)\n    private readonly logger: LoggerService,\n    @inject(SAAS_SERVICE_TYPES.ErrorBuilderService)\n    private readonly errorBuilder: ErrorBuilderBackendService,\n    @inject(SAAS_SERVICE_TYPES.AppConfigService)\n    private readonly appConfigService: AppConfigurationService,\n    /**\n     * OPTIONAL override for how credentials are obtained — appended LAST so no\n     * existing construction site shifts.\n     *\n     * Unbound (the common case) the provider fetches sessions from apps-manager\n     * over HTTP. A runtime CO-LOCATED with the issuer binds an in-process resolver\n     * instead: same broker, same prefix-confined session policy, same short-lived\n     * credential — no network hop, and therefore no dependency on a listener that\n     * may not exist yet.\n     *\n     * Optional deliberately, and the default is the SAFE case: omitting it yields\n     * the ordinary remote fetch. Only the co-located runtime opts out, and it must\n     * do so explicitly.\n     */\n    @inject(SAAS_SERVICE_TYPES.StorageCredentialResolver) @optional()\n    private readonly credentialResolverOverride?: StorageCredentialResolver,\n  ) {}\n\n  /**\n   * ⚠️ Deliberately does NOT test `STORAGE_ACCESS_KEY` / `STORAGE_SECRET_KEY`.\n   *\n   * Those are the root credential this provider stopped consuming, and Step 2 of\n   * the storage plan removes them from generated env entirely. Leaving them in\n   * this predicate would mean storage silently reports itself UNCONFIGURED the\n   * moment they are removed — the file feature would disable itself with no\n   * error, which is far worse than failing loudly.\n   *\n   * What storage now needs is the endpoint plus the bootstrap contract by which\n   * credentials are fetched.\n   *\n   * The endpoint and the caller's own identity come from CONFIGURATION; the two\n   * apps-manager REACHABILITY values stay in the ENVIRONMENT, deliberately — a URL\n   * and a secret are what a process needs before it can fetch anything at all,\n   * configuration included, so they cannot themselves be delivered as\n   * configuration.\n   *\n   * ## Why identity is NOT `process.env.APPLICATION_ID`\n   *\n   * It used to be, while the object-key builder read\n   * `appConfigService.applicationId` — two sources for one concept. They agree for\n   * an application (the loader seeds config from that env var) and they do NOT\n   * agree for a platform service, which resolves its identity locally and has no\n   * `APPLICATION_ID` in env at all. That split is F-G: every platform service\n   * reported storage UNCONFIGURED on the env conjunct, the router skipped it in\n   * silence, and module-registry publish has been dead since. Reading the same\n   * source the operation addresses removes the disagreement by construction —\n   * and it needs no new environment variable, so nothing changes at env-generation\n   * time. See `.claude/plans/object-storage-root-credential-distribution.md`.\n   *\n   * Reading configuration here can throw `app_configuration_not_initialized`, and\n   * that is left unsoftened on purpose: answering `false` for \"configuration is\n   * not loaded yet\" is indistinguishable from \"this application has no file\n   * feature\", and the router would SKIP the provider in silence. Every caller was\n   * enumerated and runs after configuration init.\n   */\n  isConfigured(): boolean {\n    return !!this.managedConnection?.endpoint && this.hasUsableCredentialSource();\n  }\n\n  /**\n   * Whether SOME credential source can serve this runtime.\n   *\n   * The split matters: the four-var bootstrap contract is a property of the HTTP\n   * resolver, not of storage. Testing it unconditionally made the predicate ask\n   * \"can I reach apps-manager?\" of a runtime that does not need to — which is how\n   * a co-located runtime with a perfectly good in-process source would still\n   * report UNCONFIGURED and be skipped by the router.\n   */\n  private hasUsableCredentialSource(): boolean {\n    // An injected resolver IS the source; it needs nothing from the environment.\n    if (this.credentialResolverOverride) return true;\n\n    return !!process.env.PLATFORM_APPS_MANAGER_URL\n      && !!process.env.PLATFORM_APPLICATION_PRIMARY_SECRET\n      // ⚠️ REVERTED 2026-08-12, and the env read is LOAD-BEARING here — do not\n      // \"clean it up\" to the configuration identity without reading this first.\n      //\n      // Identity was briefly taken from configuration, to close the dual-source\n      // split described on the resolver. That is the right end state and it caused\n      // an OUTAGE, because it made this predicate true for PLATFORM services — and\n      // apps-manager is the STS ISSUER. It then fetched its own storage credentials\n      // from itself, over HTTP, BEFORE its own listener existed: a guaranteed\n      // `ECONNREFUSED`, not a race. `healthCheck()` never retried, so storage stayed\n      // unhealthy for the process lifetime and `/health/ready` answered 503 forever\n      // — the exact state the comment there warns about.\n      //\n      // Absence of `APPLICATION_ID` in a platform env is therefore doing real work\n      // today: it is what keeps a platform service out of a client relationship with\n      // itself. Single-sourcing the identity is safe only once (a) the platform-plane\n      // STS door exists and (b) the issuer is excluded from being its own client.\n      // Until then this stays an env read. See F-G in\n      // `.claude/plans/object-storage-root-credential-distribution.md`.\n      && !!process.env.APPLICATION_ID;\n  }\n\n  /**\n   * The credential source, built lazily so env is read at first use rather than\n   * at construction — preserving the pre-existing behaviour that tests and\n   * dynamic relayers rely on to re-use one instance under different env contexts.\n   *\n   * Credentials come from apps-manager as short-lived, prefix-confined STS\n   * sessions. The env resolver that preceded this was DELETED rather than kept as\n   * a fallback: a fallback would fire on any transient apps-manager hiccup,\n   * succeed with the ROOT credential, and leave no signal that the confinement\n   * had been bypassed.\n   */\n  private getCredentialProvider(): StorageCredentialProvider {\n    if (this.credentialProvider) return this.credentialProvider;\n\n    this.credentialProvider = new StorageCredentialProvider(\n      this.credentialResolverOverride\n      // Identity from CONFIGURATION, single-sourced with the object-key builder\n      // (`resolveStorageApplicationIdentity`) rather than re-read from env.\n      ?? createStsStorageCredentialResolver(() => resolveStorageApplicationIdentity(this.appConfigService)),\n    );\n    return this.credentialProvider;\n  }\n\n  /**\n   * Eagerly initialize the MinIO client and verify bucket access.\n   * Call this at startup to fail fast on misconfiguration.\n   * If not called, the client is created lazily on first operation.\n   */\n  async initialize(): Promise<void> {\n    await this.getClient();\n  }\n\n  /**\n   * Obtain (and renew) the session credential WITHOUT building a client.\n   *\n   * Split out of `getClient()` so the object-key authorization guard can run\n   * before any minio client exists. The guard needs the CONFINED applicationId,\n   * which only arrives with the credential — so the order has to be\n   * credentials → guard → client, not guard → credentials → client.\n   *\n   * The pinned property survives: no client is constructed for a rejected\n   * `storageRef`. What changes is that a rejected ref now costs a credential\n   * LOOKUP — which `StorageCredentialProvider` caches for the session lifetime,\n   * so in practice it is a cache read rather than a round trip.\n   *\n   * Config is validated FIRST so an unconfigured runtime fails with a precise\n   * CONFIGURATION error rather than an opaque credential one, and does not make a\n   * pointless apps-manager round-trip on its way to failing.\n   */\n  private async ensureCredentials(): Promise<ResolvedStorageCredentials> {\n    const connection = this.managedConnection;\n    const endpoint = connection?.endpoint;\n    const port = connection?.port ?? INFRA_DEFAULT_PORTS.MINIO;\n    const useSSL = connection?.useSsl ?? false;\n\n    // Configuration is validated BEFORE credentials are fetched — both so an\n    // unconfigured runtime fails with a precise CONFIGURATION error rather than\n    // an opaque credential error, and so it does not make a pointless\n    // apps-manager round-trip on its way to failing.\n    //\n    // The required set changed with the credential source: the storage keys are\n    // gone (they were the ROOT credential) and what is needed now is the\n    // endpoint plus the bootstrap contract used to fetch session credentials.\n    if (!endpoint || !this.isConfigured()) {\n      throw this.errorBuilder.buildError(\n        ErrorType.CONFIGURATION,\n        undefined,\n        {\n          customMessageReference: ErrorCustomMessageReference.CONFIGURATION,\n          context: {\n            message:\n              'Incomplete managed storage configuration. Required: storage.managed.endpoint (from STORAGE_ENDPOINT), '\n              + 'PLATFORM_APPS_MANAGER_URL, PLATFORM_APPLICATION_PRIMARY_SECRET, APPLICATION_ID',\n            hasEndpoint: !!endpoint,\n            hasAppsManagerUrl: !!process.env.PLATFORM_APPS_MANAGER_URL,\n            hasPrimarySecret: !!process.env.PLATFORM_APPLICATION_PRIMARY_SECRET,\n            // Env, matching `isConfigured()` — the flag must name the SAME source\n            // the predicate gates on, or the diagnostic sends the reader to a\n            // value that was never the cause.\n            hasApplicationId: !!process.env.APPLICATION_ID,\n          },\n        }\n      );\n    }\n\n    // Renew, THEN decide whether the cached client is still usable. Checking the\n    // cache first would return a client bound to an expired session and the\n    // failure would surface as an opaque auth error mid-upload.\n    let credentials;\n    try {\n      credentials = await this.getCredentialProvider().getCredentials();\n    } catch (error) {\n      // Fail closed, but as a typed CONFIGURATION error so callers and the\n      // readiness probe can classify it — not as a bare Error escaping from the\n      // resolver.\n      throw this.errorBuilder.buildError(\n        ErrorType.CONFIGURATION,\n        undefined,\n        {\n          customMessageReference: ErrorCustomMessageReference.CONFIGURATION,\n          context: {\n            operation: 'acquire_storage_credentials',\n            message: 'Could not obtain object storage session credentials from apps-manager.',\n            error: describeCaughtError(error),\n          },\n        }\n      );\n    }\n\n    return credentials;\n  }\n\n  /**\n   * The minio client for the CURRENT credential, rebuilt when that credential\n   * changes. Renew first, THEN decide whether the cached client is still usable:\n   * checking the cache first would return a client bound to an expired session and\n   * the failure would surface as an opaque auth error mid-upload.\n   */\n  private async getClient(): Promise<Client> {\n    const credentials = await this.ensureCredentials();\n    const connection = this.managedConnection;\n    const endpoint = connection?.endpoint ?? '';\n    const port = connection?.port ?? INFRA_DEFAULT_PORTS.MINIO;\n    const useSSL = connection?.useSsl ?? false;\n\n    if (this.client && this.clientAccessKey === credentials.accessKey) {\n      return this.client;\n    }\n\n    const endpointUrl = endpoint.includes('://')\n      ? new URL(endpoint)\n      : new URL(`http${useSSL ? 's' : ''}://${endpoint}`);\n\n    const options: ClientOptions = {\n      endPoint: endpointUrl.hostname,\n      port: endpointUrl.port ? parseInt(endpointUrl.port, 10) : port,\n      useSSL: useSSL || endpointUrl.protocol === 'https:',\n      accessKey: credentials.accessKey,\n      secretKey: credentials.secretKey,\n      // Present only for an STS session credential; a long-lived credential\n      // carries none and the field stays undefined.\n      ...(credentials.sessionToken ? { sessionToken: credentials.sessionToken } : {}),\n      region: DEFAULT_STORAGE_REGION,\n      // Keeps every upload on the single-PutObject path. The multipart branch\n      // opens with a BUCKET-level ListMultipartUploads that a prefix-confined\n      // session cannot be granted — see MAX_SINGLE_PUT_OBJECT_SIZE_BYTES.\n      partSize: PART_SIZE_BYTES,\n    };\n\n    const client = new Client(options);\n\n    // ⚠️ NO `bucketExists()` PROBE HERE — deliberately. This is F-D.\n    //\n    // The probe used to live here (and before that, `makeBucket()`). Under a\n    // prefix-confined session credential it can NEVER succeed: `bucketExists()`\n    // issues HeadBucket, which S3 authorises via `s3:ListBucket`, and the session\n    // policy grants `ListBucket` only under `Condition StringLike s3:prefix`.\n    // HeadBucket carries no prefix, so the condition cannot match and the call is\n    // refused `AccessDenied` — on a credential whose object operations work\n    // perfectly. Keeping it broke EVERY file operation in dev, in the backend and\n    // in every minion, with a message pointing at credentials rather than at the\n    // probe.\n    //\n    // Do NOT \"fix\" this by adding an unconditioned `ListBucket` to the policy.\n    // That is the tempting repair and it re-grants bucket-wide enumeration —\n    // every other application's object keys — to close a check that buys nothing:\n    // bucket existence is already guaranteed platform-side by\n    // `ObjectStorageStsBrokerService.ensureBucketExists()`, which runs with admin\n    // rights on the credential-issuance path immediately before this client is\n    // built. A missing bucket now surfaces at the first real operation, which is\n    // where a genuine storage fault belongs.\n    //\n    // See `.claude/plans/object-storage-root-credential-distribution.md` (F-D).\n\n    this.client = client;\n    // Stamped together with the client so the cache check above can tell a\n    // still-valid client from one bound to a superseded credential.\n    this.clientAccessKey = credentials.accessKey;\n    return client;\n  }\n\n  /**\n   * The application identity object keys are built from — taken from the CREDENTIAL,\n   * i.e. the subject the issuer confined the session policy to.\n   *\n   * Not `resolveStorageApplicationIdentity(appConfigService)`. That was the client's\n   * own answer to the same question, and when the two disagreed the credential was\n   * confined to one subtree while the client addressed another — every operation\n   * failing `Valid and authorized credentials required` with both halves passing\n   * their own tests. `assertPolicySafeApplicationId` requires a 24-hex ObjectId, so\n   * the policy side cannot be bent to match the client; the client must take the\n   * issuer's value.\n   *\n   * FAILS CLOSED when the issuer supplied none. Falling back to the local identity\n   * is precisely the reintroduction of the split — it would work for applications\n   * (where the two happen to agree) and silently mis-address for everything else,\n   * which is the failure mode that took a day to find.\n   */\n  private async getApplicationId(executionContext: ExecutionContext<any>): Promise<string> {\n    const credentials = await this.ensureCredentials();\n    const applicationId = credentials.applicationId;\n\n    if (!applicationId) {\n      throw this.errorBuilder.buildError(\n        ErrorType.CONFIGURATION,\n        executionContext,\n        {\n          customMessageReference: ErrorCustomMessageReference.CONFIGURATION,\n          context: {\n            operation: 'resolve_confined_application_identity',\n            message:\n              'The object storage credential did not name the application it is confined to, so no '\n              + 'object key can be addressed. The issuer must return `applicationId` alongside the '\n              + 'session credential.',\n          },\n        }\n      );\n    }\n\n    validateAppId(applicationId, this.errorBuilder, executionContext, 'applicationId');\n    return applicationId;\n  }\n\n  /**\n   * Resolve the canonical app-level object-key namespace prefix\n   * (Slice 3.6).\n   *\n   * Sourced from `storage.managed.bucketPrefix`, which the configuration loader\n   * seeds from `STORAGE_BUCKET_PREFIX`, originating from\n   * `wildo.saas.config.dataServices.s3.bucketPrefix`. When set, every\n   * application object key produced by `resolveApplicationObjectKey()`\n   * (and every authorized `storageRef` it accepts) is prefixed with\n   * `${bucketPrefix}/`. The bucket itself remains infra-controlled — N apps\n   * can share one bucket with disjoint object trees.\n   *\n   * Cosmetic only: tenant isolation is enforced by the session policy, which\n   * keys on the platform-minted `applicationId` and never on this value.\n   *\n   * Read lazily on every call (rather than cached at construction) so a\n   * configuration change is observed without rebuilding the provider.\n   */\n  private resolveBucketPrefix(): string {\n    const raw = this.managedConnection?.bucketPrefix;\n    if (!raw) return '';\n    const trimmed = raw.trim();\n    return trimmed.length === 0 ? '' : `${trimmed.replace(/\\/+$/, '')}/`;\n  }\n\n  /**\n   * Refuse any key fragment carrying a `.` or `..` segment.\n   *\n   * ## Why the managed provider needs this at all\n   *\n   * The local-directory provider has always had a traversal guard\n   * (`resolveSafePathFromRelative`: `path.resolve` + a `startsWith(base + sep)` check). This\n   * provider had NONE — an S3 key is an opaque string, never resolved by a filesystem, so a `..`\n   * segment cannot escape a bucket and the guard looked unnecessary. It is not, for two reasons:\n   *\n   * 1. **The read guard below is textual.** `startsWith(expectedPrefix)` is satisfied by\n   *    `applications/<app>/files/x/../../../elsewhere/y`, so a stored ref carrying traversal passes\n   *    the one check that exists — and a future consumer that DOES normalize the key (a mirror to a\n   *    filesystem, an archive extraction, a signed-URL rewriter) inherits a ref that was never\n   *    checked.\n   * 2. **A prefix is the tenant boundary here.** `<scope>/<scopeId>` exists so erasure, orphan\n   *    sweeps and per-tenant listing are prefix operations. A key whose literal text contains `..`\n   *    still lands under the prefix it was composed from, but it is unreadable as a path and no\n   *    normalizing tool downstream agrees with the sweep about which tenant owns it.\n   *\n   * The invariant is enforced HERE rather than at the resolver because `StorageUploadOptions` has\n   * more than one producer: `FileStoragePathResolverBackendService` sanitizes (and is the only\n   * app-authored source), but the audit-archive batch composes its own `folderPath` and never\n   * passes through that sanitizer. This method is the single point every key — upload composition\n   * AND every stored `storageRef` on download/delete/metadata — must pass.\n   *\n   * Fail-closed with AUTHORIZATION, matching the local provider's verdict for the same input, so\n   * one authored value cannot mean two different things depending on which provider is bound.\n   */\n  private assertNoTraversalSegments(\n    candidate: string,\n    executionContext: ExecutionContext<any>,\n    diagnostics: Record<string, unknown>,\n  ): void {\n    if (!storageKeyHasTraversalSegment(candidate)) {\n      return;\n    }\n\n    throw this.errorBuilder.buildError(\n      ErrorType.AUTHORIZATION,\n      executionContext,\n      {\n        customMessageReference: ErrorCustomMessageReference.FILE_PATH_TRAVERSAL_DETECTED,\n        context: {\n          // diagnostic (log-only)\n          ...diagnostics,\n          candidate,\n          provider: this.providerId,\n        },\n      }\n    );\n  }\n\n  private async resolveApplicationObjectKey(\n    fileId: string,\n    executionContext: ExecutionContext<any>,\n    storageRef?: string,\n    linkedResourceType?: ResourceType,\n    fileScope?: FileScopeIdentifiers,\n  ): Promise<string> {\n    // Checked BEFORE the application identity is resolved: a traversal segment is a refusal that\n    // needs no credential, and paying an apps-manager STS round trip to reject it would let a\n    // hostile key fragment drive outbound requests.\n    this.assertNoTraversalSegments(fileId, executionContext, { fileId, source: 'composed_key' });\n\n    const applicationId = await this.getApplicationId(executionContext);\n    const bucketPrefix = this.resolveBucketPrefix();\n    // The relative key comes from the SHARED composer, so the local-directory provider addresses the\n    // same blob at the same place. `bucketPrefix` is the one part that stays here: it is an\n    // object-store namespacing knob (N applications sharing one bucket) with no meaning on a\n    // filesystem, so it frames the shared key rather than living inside it.\n    const defaultKey =\n      bucketPrefix\n      + composeApplicationStorageKey({ applicationId, leafPath: fileId, linkedResourceType, scope: fileScope });\n\n    if (!storageRef) {\n      return defaultKey;\n    }\n\n    const normalizedStorageRef = storageRef.trim();\n    if (!normalizedStorageRef) {\n      throw this.errorBuilder.buildError(\n        ErrorType.VALIDATION,\n        executionContext,\n        {\n          customMessageReference: ErrorCustomMessageReference.FILE_STORAGE_REF_INVALID,\n          context: {\n            // diagnostic (log-only)\n            fileId,\n            applicationId,\n          },\n        }\n      );\n    }\n\n    // A stored ref is checked for traversal too, not only the freshly-composed key. The prefix\n    // check below is TEXTUAL, so `applications/<app>/files/x/../../../elsewhere/y` satisfies it;\n    // the row it came from is not a trusted source just because it is persisted.\n    this.assertNoTraversalSegments(normalizedStorageRef, executionContext, { fileId, applicationId, source: 'stored_storage_ref' });\n\n    // The guard confines to the APPLICATION subtree, deliberately NOT to this call's resource\n    // segment. A read of an already-stored blob supplies no `linkedResourceType`, so keying the\n    // guard on the current call would reject every legitimate read of a linked file. Per-resource\n    // confinement is the session policy's job (it is minted per principal); this guard's job is\n    // that a `storageRef` from a row cannot escape the application.\n    const expectedPrefix =\n      bucketPrefix\n      + `applications/${applicationId}/files/`;\n    if (!normalizedStorageRef.startsWith(expectedPrefix)) {\n      throw this.errorBuilder.buildError(\n        ErrorType.AUTHORIZATION,\n        executionContext,\n        {\n          customMessageReference: ErrorCustomMessageReference.FILE_STORAGE_REF_FORBIDDEN,\n          context: {\n            // diagnostic (log-only)\n            fileId,\n            applicationId,\n            storageRef: normalizedStorageRef,\n            expectedPrefix,\n          },\n        }\n      );\n    }\n\n    return normalizedStorageRef;\n  }\n\n  private convertStorageError(\n    error: unknown,\n    operation: 'upload' | 'download' | 'delete' | 'metadata',\n    executionContext: ExecutionContext<any> | undefined,\n    context: Record<string, unknown>,\n  ): never {\n    if (isWildoBackendError(error)) {\n      throw error;\n    }\n\n    const errorMessage = describeCaughtError(error);\n    // Classify on the S3 error CODE first; the message is a fallback only.\n    //\n    // A message is prose an SDK is free to reword, and matching on substrings has\n    // two real failure modes here: a benign message containing \"not found\" is\n    // misread as a missing object, and — the one F-D made concrete — a genuine\n    // `AccessDenied` whose message is phrased differently escapes classification\n    // entirely and surfaces as a generic connectivity error, pointing the reader\n    // at the wrong subsystem. The minio client exposes `code` on its errors, so\n    // the reliable signal is available and was simply not being used.\n    const errorCode = resolveStorageErrorCode(error);\n    const errorMessageLower = errorMessage.toLowerCase();\n\n    if (\n      errorCode === 'NoSuchKey'\n      || errorCode === 'NotFound'\n      || errorCode === 'NoSuchBucket'\n      || (!errorCode && (errorMessageLower.includes('nosuchkey') || errorMessageLower.includes('not found')))\n    ) {\n      throw this.errorBuilder.buildError(\n        ErrorType.NOT_FOUND,\n        executionContext,\n        {\n          customMessageReference: ErrorCustomMessageReference.FILE_NOT_FOUND_IN_STORAGE,\n          context: {\n            // diagnostic (log-only)\n            operation,\n            ...context,\n          },\n        }\n      );\n    }\n\n    if (\n      errorCode === 'AccessDenied'\n      || errorCode === 'Forbidden'\n      || errorCode === 'SignatureDoesNotMatch'\n      || errorCode === 'InvalidAccessKeyId'\n      || errorCode === 'ExpiredToken'\n      || errorCode === 'InvalidToken'\n      || (!errorCode && (\n        errorMessageLower.includes('accessdenied')\n        || errorMessageLower.includes('access denied')\n        || errorMessageLower.includes('forbidden')\n        || errorMessageLower.includes('signaturedoesnotmatch')\n        || errorMessageLower.includes('invalidaccesskeyid')\n      ))\n    ) {\n      throw this.errorBuilder.buildError(\n        ErrorType.AUTHORIZATION,\n        executionContext,\n        {\n          customMessageReference: ErrorCustomMessageReference.FILE_STORAGE_ACCESS_DENIED,\n          context: {\n            // diagnostic (log-only)\n            operation,\n            ...context,\n            originalError: errorMessage,\n          },\n        }\n      );\n    }\n\n    if (\n      errorMessageLower.includes('bucketnotfound')\n      || errorMessageLower.includes('invalidbucketname')\n    ) {\n      throw this.errorBuilder.buildError(\n        ErrorType.CONFIGURATION,\n        executionContext,\n        {\n          customMessageReference: ErrorCustomMessageReference.CONFIGURATION,\n          context: {\n            message: 'Managed storage bucket configuration error',\n            operation,\n            bucketName: this.bucketName,\n            ...context,\n            originalError: errorMessage,\n          },\n        }\n      );\n    }\n\n    if (\n      errorMessageLower.includes('connection')\n      || errorMessageLower.includes('timeout')\n      || errorMessageLower.includes('econnrefused')\n      || errorMessageLower.includes('network')\n    ) {\n      throw this.errorBuilder.buildError(\n        ErrorType.NETWORK,\n        executionContext,\n        {\n          customMessageReference: ErrorCustomMessageReference.NETWORK,\n          context: {\n            message: 'Managed storage connection failed',\n            operation,\n            ...context,\n            originalError: errorMessage,\n          },\n        }\n      );\n    }\n\n    if (\n      errorMessageLower.includes('stream')\n      || errorMessageLower.includes('pipe')\n      || errorMessageLower.includes('readable')\n    ) {\n      throw this.errorBuilder.buildError(\n        ErrorType.EXTERNAL_SERVICE,\n        executionContext,\n        {\n          customMessageReference: ErrorCustomMessageReference.EXTERNAL_SERVICE,\n          context: {\n            message: 'File stream error during storage operation',\n            operation,\n            ...context,\n            originalError: errorMessage,\n          },\n        }\n      );\n    }\n\n    throw this.errorBuilder.buildError(\n      ErrorType.EXTERNAL_SERVICE,\n      executionContext,\n      {\n        customMessageReference: ErrorCustomMessageReference.EXTERNAL_SERVICE,\n        context: {\n          message: `Managed storage operation failed: ${operation}`,\n          operation,\n          ...context,\n          originalError: errorMessage,\n        },\n      }\n    );\n  }\n\n  async upload(\n    fileStream: Readable,\n    fileId: string,\n    mimeType: string,\n    size: number,\n    executionContext: ExecutionContext<any>,\n    options?: StorageUploadOptions,\n  ): Promise<StorageUploadResult> {\n    validateFileId(fileId, this.errorBuilder, executionContext, 'fileId');\n    validateContentType(mimeType, this.errorBuilder, executionContext, 'mimeType');\n    validateSize(\n      size,\n      resolveConfiguredMaxFileSize(this.appConfigService.config.storage?.maxFileSize),\n      this.errorBuilder,\n      executionContext,\n      'size',\n    );\n    validateStream(fileStream, this.errorBuilder, executionContext, 'fileStream');\n\n    // Above this, the client would take the multipart branch, whose opening\n    // ListMultipartUploads call a prefix-confined session cannot perform — the\n    // store would answer a bare `AccessDenied` that reads as a credential fault.\n    // Refuse here instead, naming the real reason. Reachable only when an\n    // application configures `storage.maxFileSize` above the single-PUT ceiling;\n    // `validateSize` has already applied that configured limit.\n    // See MAX_SINGLE_PUT_OBJECT_SIZE_BYTES.\n    if (size > MAX_SINGLE_PUT_OBJECT_SIZE_BYTES) {\n      throw this.errorBuilder.buildError(\n        ErrorType.VALIDATION,\n        executionContext,\n        {\n          // Same reference `validateContentLength` uses for a size violation —\n          // this IS one, just against a provider ceiling rather than the\n          // application's configured limit.\n          customMessageReference: ErrorCustomMessageReference.CONTENT_LENGTH_VALIDATION_FAILED,\n          context: {\n            // diagnostic (log-only)\n            fileId,\n            size,\n            reason: 'exceeds_single_put_ceiling',\n            maxSinglePutSize: MAX_SINGLE_PUT_OBJECT_SIZE_BYTES,\n            message:\n              'Object exceeds the single-PutObject ceiling for managed storage. Managed storage cannot use '\n              + 'multipart upload under a prefix-confined credential; lower storage.maxFileSize to at most '\n              + `${MAX_SINGLE_PUT_OBJECT_SIZE_BYTES} bytes.`,\n          },\n        }\n      );\n    }\n\n    const effectiveFileId = composeStorageLeafPath(fileId, options);\n\n    if (!effectiveFileId) {\n      throw this.errorBuilder.buildError(\n        ErrorType.VALIDATION,\n        executionContext,\n        {\n          customMessageReference: ErrorCustomMessageReference.FILE_STORAGE_KEY_COMPOSITION_FAILED,\n        }\n      );\n    }\n\n    const includeAppId = options?.includeApplicationId ?? true;\n    const key = includeAppId\n      ? await this.resolveApplicationObjectKey(effectiveFileId, executionContext, undefined, options?.linkedResourceType, options?.scope)\n      : effectiveFileId;\n    const client = await this.getClient();\n\n    try {\n      await client.putObject(\n        this.bucketName,\n        key,\n        fileStream,\n        size,\n        {\n          [WildoHeaderKeys.CONTENT_TYPE]: mimeType,\n        },\n      );\n    } catch (error) {\n      this.convertStorageError(error, 'upload', executionContext, {\n        fileId,\n        storageRef: key,\n        provider: this.providerId,\n      });\n    }\n\n    return {\n      storageRef: key,\n      provider: this.providerId,\n    };\n  }\n\n  async download(\n    file: StoredFileStorageTarget,\n    executionContext: ExecutionContext<any>,\n  ): Promise<StorageDownloadResult> {\n    const key = await this.resolveApplicationObjectKey(file.fileId, executionContext, file.storageRef);\n    const client = await this.getClient();\n    let stream: Readable;\n    let metadata: StorageFileMetadata;\n\n    try {\n      const stat = await client.statObject(this.bucketName, key);\n      const contentType = stat.metaData[WildoHeaderKeys.CONTENT_TYPE];\n      if (!contentType) {\n        throw this.errorBuilder.buildError(\n          ErrorType.EXTERNAL_SERVICE,\n          executionContext,\n          {\n            customMessageReference: ErrorCustomMessageReference.EXTERNAL_SERVICE,\n            context: {\n              message: `Managed storage object metadata missing required ${WildoHeaderKeys.CONTENT_TYPE}`,\n              fileId: file.fileId,\n              storageRef: key,\n            },\n          },\n        );\n      }\n\n      stream = await client.getObject(this.bucketName, key);\n      metadata = {\n        contentType,\n        size: stat.size,\n        etag: stat.etag,\n        lastModified: stat.lastModified,\n      };\n    } catch (error) {\n      this.convertStorageError(error, 'download', executionContext, {\n        fileId: file.fileId,\n        storageRef: key,\n        provider: this.providerId,\n      });\n    }\n\n    return {\n      stream,\n      contentType: metadata.contentType,\n      size: metadata.size,\n      etag: metadata.etag,\n      lastModified: metadata.lastModified,\n    };\n  }\n\n  async delete(\n    file: StoredFileStorageTarget,\n    executionContext: ExecutionContext<any>,\n  ): Promise<void> {\n    const key = await this.resolveApplicationObjectKey(file.fileId, executionContext, file.storageRef);\n    const client = await this.getClient();\n\n    try {\n      await client.removeObject(this.bucketName, key);\n    } catch (error) {\n      // Same code-first classification as `convertStorageError`: a delete of an\n      // already-absent object is a no-op, but only when the store actually said\n      // so. Inferring it from prose can swallow a real failure.\n      const deleteErrorCode = resolveStorageErrorCode(error);\n      const errorMessageLower = describeCaughtError(error).toLowerCase();\n      if (\n        deleteErrorCode === 'NoSuchKey'\n        || deleteErrorCode === 'NotFound'\n        || (!deleteErrorCode && (errorMessageLower.includes('nosuchkey') || errorMessageLower.includes('not found')))\n      ) {\n        return;\n      }\n      this.convertStorageError(error, 'delete', executionContext, {\n        fileId: file.fileId,\n        storageRef: key,\n        provider: this.providerId,\n      });\n    }\n  }\n\n  async getMetadata(\n    file: StoredFileStorageTarget,\n    executionContext: ExecutionContext<any>,\n  ): Promise<StorageFileMetadata> {\n    const key = await this.resolveApplicationObjectKey(file.fileId, executionContext, file.storageRef);\n    const client = await this.getClient();\n\n    try {\n      const stat = await client.statObject(this.bucketName, key);\n      const contentType = stat.metaData[WildoHeaderKeys.CONTENT_TYPE];\n      if (!contentType) {\n        throw this.errorBuilder.buildError(\n          ErrorType.EXTERNAL_SERVICE,\n          executionContext,\n          {\n            customMessageReference: ErrorCustomMessageReference.EXTERNAL_SERVICE,\n            context: {\n              message: `Managed storage object metadata missing required ${WildoHeaderKeys.CONTENT_TYPE}`,\n              fileId: file.fileId,\n              storageRef: key,\n            },\n          },\n        );\n      }\n\n      return {\n        contentType,\n        size: stat.size,\n        etag: stat.etag,\n        lastModified: stat.lastModified,\n      };\n    } catch (error) {\n      this.convertStorageError(error, 'metadata', executionContext, {\n        fileId: file.fileId,\n        storageRef: key,\n        provider: this.providerId,\n      });\n    }\n  }\n\n  // =========================================================================\n  // Health check\n  // =========================================================================\n\n  async healthCheck(): Promise<StorageProviderHealthResult> {\n    const startTime = Date.now();\n\n    // RECOVER, don't just report. This used to `return { healthy: false }` on a\n    // null client and never try again — which turned any transient startup failure\n    // into a PERMANENT one: `initialize()` runs once, so a client that failed to\n    // build at boot was never rebuilt, storage stayed unhealthy for the process\n    // lifetime, and `/health/ready` answered 503 forever while `/health` looked\n    // fine. That is the documented \"port open + /health healthy + /health/ready 503\n    // forever\" state (`platform/CLAUDE.md`), reached without any ongoing fault.\n    //\n    // Observed exactly that way on apps-manager: the credential fetch was refused\n    // at boot, the listener came up 0.4s later, and nothing retried. A readiness\n    // probe is the natural retry point — it is called repeatedly, by design, and a\n    // dependency that has come back should be allowed to say so.\n    //\n    // `getClient()` is idempotent and caches, so a healthy probe costs no extra\n    // work; a still-failing one reports the CURRENT reason instead of the stale\n    // \"not initialized\".\n    if (!this.client) {\n      try {\n        await this.getClient();\n      } catch (error) {\n        return { healthy: false, latency: Date.now() - startTime, error: describeCaughtError(error) };\n      }\n    }\n\n    /**\n     * Declared OUTSIDE the try so the credential-rejection retry below can probe the SAME key.\n     * Recomputing it there would ask a different question than the one that just failed.\n     */\n    let probeKey = '';\n\n    try {\n      // ⚠️ Probes with an OBJECT-level call, not `bucketExists()`. Second site of\n      // F-D, and the more damaging one: this is the readiness dependency behind\n      // `/health/ready`, so a probe the credential cannot satisfy produces the\n      // documented \"port open + /health healthy + /health/ready 503 forever\"\n      // state (see `platform/CLAUDE.md`) — with remote clients looping on\n      // \"Remote API not ready\" and nothing pointing at storage.\n      //\n      // `bucketExists()` issues HeadBucket, authorised by an UNCONDITIONED\n      // `s3:ListBucket`. The session policy grants `ListBucket` only under\n      // `Condition StringLike s3:prefix`, and HeadBucket sends no prefix, so it\n      // can never pass. `statObject` on a key inside this application's own\n      // prefix is authorised by the policy's object statements, which is what the\n      // credential is actually for.\n      //\n      // A `NoSuchKey` reply is the HEALTHY answer: it proves the store was\n      // reached AND the credential was accepted. Only a real refusal or transport\n      // failure is unhealthy.\n      // The probe key must sit inside the prefix the CREDENTIAL covers, not the\n      // one the client would have guessed — otherwise readiness fails `AccessDenied`\n      // on a perfectly good credential and blames storage. Same identity source as\n      // every real operation, for the same reason.\n      const probeApplicationId = (await this.ensureCredentials()).applicationId\n        ?? this.appConfigService.applicationId;\n      probeKey = `${this.resolveBucketPrefix()}`\n        + API_ROUTES_BACKEND_DEFINITIONS.FILE_STORAGE.STORAGE_KEY_APPLICATION_FILE(\n          probeApplicationId,\n          '__storage_healthcheck__',\n          // The probe has no File row and no resource. It must sit under the SAME staging segment\n          // a real unlinked blob uses — once the session policy narrows per resource, a probe key\n          // outside every granted prefix would fail `AccessDenied` on a perfectly good credential\n          // and report storage unhealthy.\n          UNLINKED_STORAGE_SEGMENT,\n          ResourcePrimaryScope.APPLICATION,\n          probeApplicationId,\n        );\n\n      // `this.client!` — the recovery branch above either populated it or returned.\n      await this.client!.statObject(this.bucketName, probeKey);\n      return { healthy: true, latency: Date.now() - startTime };\n    } catch (error) {\n      const code = resolveStorageErrorCode(error);\n      if (code === 'NoSuchKey' || code === 'NotFound') {\n        return { healthy: true, latency: Date.now() - startTime };\n      }\n\n      /**\n       * A credential the STORE REJECTS is re-acquired, not held until it expires.\n       *\n       * The provider refreshes on EXPIRY only — its contract says so explicitly (\"Refresh before\n       * expiry, not after failure\"), and that is right for the ordinary case: callers should never\n       * observe an expired credential. But it leaves one state unrecoverable, and this is the probe\n       * that meets it. A session can become invalid while still unexpired — the object store\n       * restarts and forgets its STS sessions, or the parent credential rotates underneath it. The\n       * cached credential then stays \"fresh\" by the clock and is refused by the store on every call.\n       *\n       * Measured 2026-08-22: THREE platform runtimes (crontabs, apps-manager, the dev companion)\n       * held such a credential for ~27 HOURS. `/health` stayed 200 while `/health/ready` answered\n       * 503 the whole time, and the application backend logged `Remote API not ready` 2,384 times\n       * against one of them. Restarting each process cleared it — which is the definition of a\n       * defect that requires manual intervention, and it is exactly the state\n       * `platform/CLAUDE.md` describes as \"port open + /health healthy + /health/ready 503 forever\".\n       *\n       * `StorageCredentialProvider.invalidate()` existed for precisely this — its own JSDoc says\n       * \"for an explicit re-acquire after a hard failure\" — and NOTHING called it, in production or\n       * in a test. A capability with no door: the third found in this workstream, after\n       * `usePostgreSQL` and `MongoDBService.overrideUri`.\n       *\n       * Retried ONCE, and only for a rejection that names a credential problem. A blanket retry\n       * would mask a genuine outage as latency, and a retry loop on a store that is simply down\n       * would turn a readiness probe into a stall. One attempt distinguishes \"this credential is\n       * stale\" from \"the store is unreachable\", which is the only question this probe has to answer.\n       */\n      if (this.isCredentialRejection(code, error)) {\n        this.credentialProvider?.invalidate();\n        this.client = null;\n        this.clientAccessKey = undefined;\n\n        try {\n          const retryClient = await this.getClient();\n          await retryClient.statObject(this.bucketName, probeKey);\n          this.logger.info(\n            'Object storage credential was refused and has been re-acquired; storage is healthy again.',\n          );\n          return { healthy: true, latency: Date.now() - startTime };\n        } catch (retryError) {\n          const retryCode = resolveStorageErrorCode(retryError);\n          if (retryCode === 'NoSuchKey' || retryCode === 'NotFound') {\n            this.logger.info(\n              'Object storage credential was refused and has been re-acquired; storage is healthy again.',\n            );\n            return { healthy: true, latency: Date.now() - startTime };\n          }\n          return {\n            healthy: false,\n            latency: Date.now() - startTime,\n            error: describeCaughtError(retryError),\n          };\n        }\n      }\n\n      return { healthy: false, latency: Date.now() - startTime, error: describeCaughtError(error) };\n    }\n  }\n\n  /**\n   * Whether a failure says \"this CREDENTIAL is not accepted\" rather than \"the STORE is unavailable\".\n   *\n   * Only the first is worth re-acquiring for. The distinction is made on the error CODE where the\n   * client supplies one, and falls back to the message otherwise — MinIO answers a rejected STS\n   * session with `Valid and authorized credentials required`, which carries no S3 error code, and\n   * that exact string is what the three stuck runtimes reported for 27 hours.\n   */\n  private isCredentialRejection(code: string | undefined, error: unknown): boolean {\n    const CREDENTIAL_REJECTION_CODES = new Set([\n      'AccessDenied',\n      'InvalidAccessKeyId',\n      'SignatureDoesNotMatch',\n      'ExpiredToken',\n      'InvalidToken',\n      'TokenRefreshRequired',\n      'AuthorizationHeaderMalformed',\n    ]);\n    if (code && CREDENTIAL_REJECTION_CODES.has(code)) return true;\n\n    const message = error instanceof Error ? error.message : String(error ?? '');\n    return /valid and authorized credentials required|security token|access denied|invalid access key/i\n      .test(message);\n  }\n}\n"]}

package/dist/esm/files/utils/file-field-schema-path.backend.utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"file-field-schema-path.backend.utils.d.ts","sourceRoot":"","sources":["../../../../../src/files/utils/file-field-schema-path.backend.utils.ts"],"names":[],"mappings":"AAqBA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAeL,KAAK,kBAAkB,EAExB,MAAM,0BAA0B,CAAC;AAElC,MAAM,WAAW,+BAA+B;IAC9C,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,kBAAkB,CAAC;CAClC;AAED,MAAM,WAAW,wBAAwB;IACvC,kBAAkB,EAAE,MAAM,CAAC;IAC3B,gBAAgB,EAAE,MAAM,CAAC;IACzB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,KAAK,EAAE,OAAO,CAAC;CAChB;AAED,qBAAa,oCAAqC,SAAQ,KAAK;aAE3C,SAAS,EAAE,MAAM;aACjB,gBAAgB,EAAE,kBAAkB;aACpC,mBAAmB,EAAE,kBAAkB;gBAFvC,SAAS,EAAE,MAAM,EACjB,gBAAgB,EAAE,kBAAkB,EACpC,mBAAmB,EAAE,kBAAkB;CAO1D;AAED,qBAAa,yCAA0C,SAAQ,KAAK;aACtC,SAAS,EAAE,MAAM;gBAAjB,SAAS,EAAE,MAAM;CAM9C;AAED,qBAAa,+CAAgD,SAAQ,KAAK;aAC5C,SAAS,EAAE,MAAM;gBAAjB,SAAS,EAAE,MAAM;CAM9C;AAkFD,wBAAgB,8BAA8B,CAC5C,MAAM,EAAE,CAAC,CAAC,UAAU,GAAG,SAAS,EAChC,UAAU,GAAE,MAAW,EACvB,aAAa,GAAE,OAAO,CAAC,MAAM,CAAyB,GACrD,+BAA+B,EAAE,CAyHnC;AAED,wBAAgB,gCAAgC,CAC9C,MAAM,EAAE,CAAC,CAAC,UAAU,GAAG,SAAS,EAChC,SAAS,EAAE,MAAM,GAChB,+BAA+B,GAAG,SAAS,CAI7C;AAaD,wBAAgB,kCAAkC,CAChD,IAAI,EAAE,OAAO,EACb,kBAAkB,EAAE,MAAM,GACzB,wBAAwB,EAAE,CAuD5B;AAED,wBAAgB,iCAAiC,CAC/C,SAAS,EAAE,OAAO,EAClB,kBAAkB,EAAE,MAAM,GACzB,OAAO,CAsCT;AAED,wBAAgB,2BAA2B,CACzC,gBAAgB,EAAE,OAAO,EACzB,SAAS,EAAE,OAAO,GACjB,OAAO,CAgCT;AAED,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,EAAE,EAC3C,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,OAAO,GACb,IAAI,CAqCN"}
+{"version":3,"file":"file-field-schema-path.backend.utils.d.ts","sourceRoot":"","sources":["../../../../src/files/utils/file-field-schema-path.backend.utils.ts"],"names":[],"mappings":"AAqBA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAeL,KAAK,kBAAkB,EAExB,MAAM,0BAA0B,CAAC;AAElC,MAAM,WAAW,+BAA+B;IAC9C,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,kBAAkB,CAAC;CAClC;AAED,MAAM,WAAW,wBAAwB;IACvC,kBAAkB,EAAE,MAAM,CAAC;IAC3B,gBAAgB,EAAE,MAAM,CAAC;IACzB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,KAAK,EAAE,OAAO,CAAC;CAChB;AAED,qBAAa,oCAAqC,SAAQ,KAAK;aAE3C,SAAS,EAAE,MAAM;aACjB,gBAAgB,EAAE,kBAAkB;aACpC,mBAAmB,EAAE,kBAAkB;gBAFvC,SAAS,EAAE,MAAM,EACjB,gBAAgB,EAAE,kBAAkB,EACpC,mBAAmB,EAAE,kBAAkB;CAO1D;AAED,qBAAa,yCAA0C,SAAQ,KAAK;aACtC,SAAS,EAAE,MAAM;gBAAjB,SAAS,EAAE,MAAM;CAM9C;AAED,qBAAa,+CAAgD,SAAQ,KAAK;aAC5C,SAAS,EAAE,MAAM;gBAAjB,SAAS,EAAE,MAAM;CAM9C;AAkFD,wBAAgB,8BAA8B,CAC5C,MAAM,EAAE,CAAC,CAAC,UAAU,GAAG,SAAS,EAChC,UAAU,GAAE,MAAW,EACvB,aAAa,GAAE,OAAO,CAAC,MAAM,CAAyB,GACrD,+BAA+B,EAAE,CAyHnC;AAED,wBAAgB,gCAAgC,CAC9C,MAAM,EAAE,CAAC,CAAC,UAAU,GAAG,SAAS,EAChC,SAAS,EAAE,MAAM,GAChB,+BAA+B,GAAG,SAAS,CAI7C;AAaD,wBAAgB,kCAAkC,CAChD,IAAI,EAAE,OAAO,EACb,kBAAkB,EAAE,MAAM,GACzB,wBAAwB,EAAE,CAuD5B;AAED,wBAAgB,iCAAiC,CAC/C,SAAS,EAAE,OAAO,EAClB,kBAAkB,EAAE,MAAM,GACzB,OAAO,CAsCT;AAED,wBAAgB,2BAA2B,CACzC,gBAAgB,EAAE,OAAO,EACzB,SAAS,EAAE,OAAO,GACjB,OAAO,CAgCT;AAED,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,EAAE,EAC3C,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,OAAO,GACb,IAAI,CAqCN"}