alepha 0.22.0 → 0.24.0

package/dist/api/files/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","names":[],"sources":["../../../src/api/files/entities/files.ts","../../../src/api/files/schemas/fileQuerySchema.ts","../../../src/orm/core/schemas/insertSchema.ts","../../../src/orm/core/schemas/updateSchema.ts","../../../src/orm/core/primitives/$entity.ts","../../../src/orm/core/constants/PG_SYMBOLS.ts","../../../src/orm/core/helpers/pgAttr.ts","../../../src/orm/core/schemas/databaseEnvSchema.ts","../../../src/api/files/schemas/fileResourceSchema.ts","../../../src/api/files/schemas/storageStatsSchema.ts","../../../src/api/files/services/FileService.ts","../../../src/api/files/controllers/AdminFileStatsController.ts","../../../src/api/files/providers/FileAccessProvider.ts","../../../src/api/files/controllers/FileController.ts","../../../src/api/files/jobs/FileJobs.ts","../../../src/api/files/schemas/fileCreatorSummarySchema.ts","../../../src/api/files/index.ts"],"mappings":";;;;;;;;;;cAGa,KAAA,uBAAK,eAAA,mBAAA,OAAA;;;;;;;;;;;;;;;;AAAlB;;;EAuDE;;;;;;;;;;;;;;;;;;;;;;;;KAEU,UAAA,GAAa,MAAM,QAAQ,KAAA,CAAM,MAAA;;;cCxDhC,eAAA,oBAAe,OAAA;;;;;;;;;;;;KAUhB,SAAA,GAAY,MAAM,QAAQ,eAAA;;;;;;;;;;;;KCG1B,aAAA,WAAwB,OAAA,IAAW,OAAA,eACjC,CAAA,kBAAmB,CAAA,eAAgB,CAAA;EAAA,CAC5C,YAAA;AAAA,YAGC,CAAA,GAAI,CAAA,eAAgB,CAAA;EAAA,CACjB,UAAA;AAAA;EAAA,CACA,eAAA;AAAA;EACD,WAAA;AAAA,IACF,SAAA,CAAU,CAAA,eAAgB,CAAA,KAC1B,CAAA,eAAgB,CAAA;;;;;;;;;;;;KCTV,aAAA,WAAwB,OAAA,IAAW,OAAA,eACjC,CAAA,kBAAmB,CAAA,eAAgB,CAAA;EAAA,CAC5C,YAAA;AAAA,YAGC,CAAA,GAAI,CAAA,eAAgB,CAAA,UAAW,SAAA,YAC/B,SAAA,CAAU,MAAA,EAAQ,CAAA,EAAG,KAAA,MACrB,CAAA,eAAgB,CAAA;;;UCWL,sBAAA,WACL,OAAA,eACG,MAAA,CAAO,CAAA;;;;;EAMpB,IAAA;;;;EAKA,MAAA,EAAQ,CAAA;;;;EAKR,OAAA,IACI,IAAA;;;;IAKE,MAAA,EAAQ,IAAA;;;;IAIR,MAAA;;;;IAIA,IAAA;;;;IAIA,KAAA,GAAQ,GAAA;EAAA;;;;IAMR,OAAA,EAAS,IAAA;;;;IAIT,MAAA;;;;IAIA,IAAA;;;;IAIA,KAAA,GAAQ,GAAA;EAAA;;;;;;;;;;;AJ9BhB;;;;;;IIiDQ,WAAA,GAAc,IAAA,EAAM,MAAA,CAAO,IAAA,qBAAyB,GAAA;IJjDT;AAAA;;IIqD3C,MAAA;;AH7GR;;IGiHQ,IAAA;IHzGN;;;IG6GM,KAAA,GAAQ,GAAA;EAAA;;;;EAOd,WAAA,GAAc,KAAA;;;;IAIZ,IAAA;;;;IAIA,OAAA,EAAS,KAAA,OAAY,MAAA,CAAO,CAAA;;;;;IAK5B,cAAA,EAAgB,KAAA,OAAY,YAAA;EAAA;;;;;;;;;;;;;AH/HhC;;;;AAAqD;;;;ACGrD;;;;;;;;;;;EE8JE,WAAA,GAAc,KAAA;IFvJP;;;IE2JL,OAAA,EAAS,KAAA,OAAY,MAAA,CAAO,CAAA;IFxJ1B;;;IE4JF,IAAA;IFtKkD;;;IE0KlD,MAAA;IFzKD;;;IE6KC,KAAA,GAAQ,GAAA;EAAA;EFzKN;;;EE+KJ,MAAA,IACE,IAAA,EAAM,uBAAA,SAAgC,UAAA,CAAW,CAAA,aAC9C,uBAAA;AAAA;AAAA,cAKM,eAAA,WAA0B,OAAA,GAAU,OAAA;EAAA,SAC/B,OAAA,EAAS,sBAAA,CAAuB,CAAA;cAEpC,OAAA,EAAS,sBAAA,CAAuB,CAAA;EAI5C,KAAA,CAAM,KAAA;EAAA,IAYF,IAAA,IAAQ,aAAA,CAAc,CAAA;EAAA,IActB,IAAA;EAAA,IAIA,MAAA,IAAU,CAAA;EAAA,IAIV,YAAA,IAAgB,aAAA,CAAc,CAAA;EAAA,IAI9B,YAAA,IAAgB,aAAA,CAAc,CAAA;AAAA;;ADvOpC;;KCmPY,UAAA,WAAqB,OAAA,oBACjB,CAAA,iBAAkB,mBAAA;AAAA,KAYtB,YAAA,WAAuB,OAAA;EACjC,IAAA;EACA,MAAA,EAAQ,eAAA,CAAgB,CAAA;AAAA;AAAA,KAGd,aAAA,WAAwB,OAAA,oBACpB,CAAA,iBAAkB,YAAA,CAAa,CAAA;;;cCjRlC,UAAA;AAAA,cACA,cAAA;AAAA,cACA,aAAA;AAAA,cACA,aAAA;AAAA,cACA,aAAA;AAAA,cACA,UAAA;AAAA,cACA,WAAA;AAAA,cACA,OAAA;AAAA,cACA,MAAA;AAAA,cACA,YAAA;AAAA,cACA,eAAA;;;;cAKA,SAAA;AAAA,KAMD,SAAA;EAAA,CACT,UAAA;EAAA,CACA,cAAA;EAAA,CACA,aAAA;EAAA,CACA,aAAA;EAAA,CACA,aAAA;EAAA,CACA,UAAA;EAAA,CACA,WAAA,GAAc,iBAAA;EAAA,CACd,MAAA,GAAS,YAAA;EAAA,CACT,OAAA,GAAU,aAAA;EAAA,CACV,YAAA,GAAe,kBAAA;EAAA,CACf,eAAA;;;;GAKA,SAAA;AAAA;AAAA,KAGS,YAAA,SAAqB,SAAS;AAAA,KAE9B,iBAAA;EACV,IAAA;AAAA,IACE,iBAAiB;EACjB,IAAA;AAAA;AAAA,UAGa,aAAA;EACf,IAAA;EACA,WAAW;AAAA;AAAA,UAGI,kBAAA;;;;EAIf,UAAA,EAAY,GAAG;;;;;;EAOf,IAAA;AAAA;AAAA,UAGe,YAAA;EACf,GAAA;IACE,IAAA;IACA,MAAA,EAAQ,eAAA;EAAA;EAEV,OAAA;IACE,QAAA,GAAW,kBAAA;IACX,QAAA,GAAW,kBAAA;EAAA;AAAA;;;;;;KC5BH,MAAA,WAAiB,OAAA,gBAAuB,YAAA,IAAgB,CAAA,WAC5D,KAAA,GAAQ,SAAA,CAAU,CAAA;;;;;;;;;;;;;;;;cCvCb,iBAAA,oBAAiB,OAAA;;;APZ9B;;;;;;;;;YO0BY,GAAA,SAAY,OAAA,CAAQ,MAAA,QAAc,iBAAA;AAAA;;;cCzBjC,kBAAA,oBAAkB,OAAA;sDAe9B,cAAA;;;;;;;;;;;;;;;;;;;;;;;;;KAEW,YAAA,GAAe,MAAM,QAAQ,kBAAA;;;cClB5B,iBAAA,oBAAiB,OAAA;;;;;cAMjB,mBAAA,oBAAmB,OAAA;;;;cAKnB,kBAAA,oBAAkB,OAAA;;;;;;;;;;;;;KAOnB,WAAA,GAAc,MAAM,QAAQ,iBAAA;AAAA,KAC5B,aAAA,GAAgB,MAAM,QAAQ,mBAAA;AAAA,KAC9B,YAAA,GAAe,MAAM,QAAQ,kBAAA;;;cCA5B,WAAA;EAAA,mBACQ,MAAA,EAAM,MAAA;EAAA,mBACN,GAAA,0BAAG,MAAA;EAAA,mBACH,gBAAA,EAAgB,gBAAA;EAAA,mBAChB,kBAAA,EAAkB,kBAAA;EAAA,mBAClB,UAAA,EAAU,kBAAA;EAAA,mBACV,aAAA,EAAa,eAAA;EAAA,SAChB,cAAA,uBAAc,UAAA,mBAAA,OAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;YAepB,kBAAA;;;;QAUkD,IAAA;MAAA;IAAA;EAAA;EAAA,UAKlD,YAAA,mBAAY,aAAA;EAAA,UA0BZ,kBAAA,mBAAkB,aAAA;;;;;;;;;;;;;YAwBZ,iBAAA,CAAkB,IAAA,EAAM,QAAA,GAAW,OAAA;;;;;;;;YAWzC,UAAA,CAAW,IAAA,EAAM,WAAA;;;;;AV7D7B;;;EUwES,MAAA,CAAO,UAAA,YAA+C,eAAA;EVxEtC;;;;AAA0B;;;EU6FpC,SAAA,CAAU,CAAA,GAAG,SAAA,GAAiB,OAAA,CAAQ,IAAA,CAAK,UAAA;ETrJ7C;;;;;;ESkNE,gBAAA,IAAoB,OAAA,CAAQ,UAAA;;;;;;;;YAgB/B,iBAAA,CAAkB,GAAA,GAAM,YAAA;;;;;;;;;;;;;;EAsBrB,UAAA,CACX,IAAA,EAAM,QAAA,EACN,OAAA;IACE,cAAA,YAA0B,QAAA;IAC1B,MAAA;IACA,IAAA,GAAO,gBAAA;IACP,IAAA;EAAA,IAED,OAAA,CAAQ,UAAA;;;;;ATtPb;;;;AAAqD;;;;ACGrD;;;;;;YQmTkB,mBAAA,CACd,MAAA,EAAQ,eAAA,EACR,MAAA,UACA,MAAA,QAAc,OAAA,CAAQ,UAAA,IACrB,OAAA,CAAQ,UAAA;ERrTR;;;;;;;;;;EQ6UU,UAAA,CAAW,EAAA,WAAa,UAAA,GAAa,OAAA,CAAQ,QAAA;ER/Ub;;;;;;;;;;;;EQkWhC,UAAA,CACX,EAAA,UACA,IAAA;IACE,IAAA;IACA,IAAA;IACA,cAAA,GAAiB,QAAA;EAAA,IAElB,OAAA,CAAQ,UAAA;ERhWP;;;;;;AACiB;;;EQ8XR,UAAA,CAAW,EAAA,WAAa,OAAA,CAAQ,EAAA;EPvYnC;;;;;EOuaG,WAAA,CAAY,GAAA,aAAgB,OAAA;EPtaM;;;;;;;;EOkdlC,WAAA,CAAY,EAAA,WAAa,UAAA,GAAa,OAAA,CAAQ,UAAA;EP7cvD;;;;;;;;;;;EOgeS,eAAA,IAAmB,OAAA,CAAQ,YAAA;EPreO;;;;;;;EO2gBxC,gBAAA,CAAiB,MAAA,EAAQ,UAAA,GAAa,YAAA;AAAA;;;;;;;cCphBlC,wBAAA;EAAA,mBACQ,GAAA;EAAA,mBACA,KAAA;EAAA,mBACA,WAAA,EAAW,WAAA;;;;;;WAOd,YAAA,0BAAY,iBAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AXjB9B;;;;;;;;cYwBa,kBAAA;;;;;;EAML,cAAA,CACJ,IAAA,EAAM,UAAA,EACN,IAAA,EAAM,gBAAA,eACL,OAAA;;;;;;;;;;;;;;;;;;;EAkCG,YAAA,CAAa,IAAA,EAAM,UAAA,GAAa,OAAA;AAAA;;;;;;;cCzD3B,cAAA;EAAA,mBACQ,GAAA;EAAA,mBACA,KAAA;EAAA,mBACA,WAAA,EAAW,WAAA;EAAA,mBACX,UAAA,EAAU,kBAAA;;;;;WAMb,SAAA,0BAAS,iBAAA;;;;;;;;;;;;;;0DANI,cAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;WAsBb,UAAA,0BAAU,iBAAA;;;;;;;;;;;;;;WAmBV,WAAA,0BAAW,iBAAA;;;;;;;;;;;;AbE7B;WauBkB,UAAA,0BAAU,iBAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;WA0BV,UAAA,0BAAU,iBAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EX5FmB;;;;;;;;;;;EAAA,SW2H7B,UAAA,0BAAU,iBAAA;;;;;;EXlHtB;;;;;;AACiB;;;;ACTvB;;;;EDQM,SW2JY,gBAAA,0BAAgB,iBAAA;;;;;;;;;cCjLrB,QAAA;EAAA,mBACQ,WAAA,EAAW,WAAA;EAAA,SAEd,UAAA,6BAAU,kBAAA;AAAA;;;;;;;;;;;;;;cCMf,wBAAA,oBAAwB,OAAA;;;;;;;KAQzB,kBAAA,GAAqB,MAAM,QAAQ,wBAAA;;;;YCMnC,iBAAA;;;;IAIR,GAAA,GAAM,YAAA;IhB2BR;;;IgBtBE,IAAA;IhBjCc;;;IgBsCd,IAAA,GAAO,gBAAgB;;;;;;IAOvB,OAAA;EAAA;AAAA;;;;;;;;;;;;cAiBS,cAAA,mBAAc,OAAA,kBAAA,MAAA"}
+{"version":3,"file":"index.d.ts","names":[],"sources":["../../../src/api/files/entities/files.ts","../../../src/api/files/schemas/fileQuerySchema.ts","../../../src/orm/core/schemas/insertSchema.ts","../../../src/orm/core/schemas/updateSchema.ts","../../../src/orm/core/primitives/$entity.ts","../../../src/orm/core/constants/PG_SYMBOLS.ts","../../../src/orm/core/helpers/pgAttr.ts","../../../src/orm/core/schemas/databaseEnvSchema.ts","../../../src/api/files/schemas/fileResourceSchema.ts","../../../src/api/files/schemas/storageStatsSchema.ts","../../../src/api/files/services/FileService.ts","../../../src/api/files/controllers/AdminFileStatsController.ts","../../../src/api/files/providers/FileAccessProvider.ts","../../../src/api/files/controllers/FileController.ts","../../../src/api/files/jobs/FileJobs.ts","../../../src/api/files/schemas/fileCreatorSummarySchema.ts","../../../src/api/files/index.ts"],"mappings":";;;;;;;;;;;;;;;;cAGa,4BAAK,8BAAA;;;;;;;;;;;;;;;;;;;KAyDN,aAAa,cAAc,MAAM;;;cCxDhC,+BAAe;;;;;;;;;;;;KAUhB,YAAY,cAAc;;;;;;;;;;;;KCG1B,cAAc,UAAU,WAAW,WAC5C,WAAW,cAAc,WAAW;GAAc;YAE/C,IAAI,WAAW;GACZ;;GACA;IACH,UAAU,QAAQ,WAAW,IAAI,YACjC,WAAW;;;;;;;;;;;;KCLL,cAAc,UAAU,WAAW,WAC5C,WAAW,cAAc,WAAW;GAAc;YAE/C,IAAI,WAAW,WAAW,gBAAgB,UAAU,WACpD,UAAU,QAAQ,GAAG,WACrB,WAAW;;;UCYA,uBACf,UAAU,SACV,aAAa,OAAO;;;;;EAMpB;;;;EAKA,QAAQ;;;;EAKR,WACI;;;;IAKE,QAAQ;;;;IAIR;;;;IAIA;;;;IAIA,QAAQ;;;;;IAMR,SAAS;;;;IAIT;;;;IAIA;;;;IAIA,QAAQ;;;;;;;;;;;;;;;;;;IAmBR,cAAc,MAAM,OAAO,yBAAyB;;;;IAIpD;;;;IAIA;;;;IAIA,QAAQ;;;;;EAOd,cAAc;;;;IAIZ;;;;IAIA,SAAS,YAAY,OAAO;;;;;IAK5B,gBAAgB,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAkC9B,cAAc;;;;IAIZ,SAAS,YAAY,OAAO;;;;IAI5B;;;;IAIA;;;;IAIA,QAAQ;;;;;EAMV,UACE,MAAM,gCAAgC,WAAW,cAC9C;;cAKM,gBAAgB,UAAU,UAAU;WAC/B,SAAS,uBAAuB;EAEhD,YAAY,SAAS,uBAAuB;EAI5C,MAAM;MAYF,QAAQ,cAAc;MActB;MAIA,UAAU;YAIJ,gBAAgB,cAAc;MACpC,gBAAgB,cAAc;YAKxB,gBAAgB,cAAc;MACpC,gBAAgB,cAAc;;;;;KAaxB,WAAW,UAAU,cAC9B,aAAa,kBAAkB;KAYtB,aAAa,UAAU;EACjC;EACA,QAAQ,gBAAgB;;KAGd,cAAc,UAAU,cACjC,aAAa,kBAAkB,aAAa;;;cCrRlC;cACA;cACA;cACA;cACA;cACA;cACA;cACA;cACA;cACA;cACA;;;;cAKA;KAMD;GACT;GACA;GACA;GACA;GACA;GACA;GACA,cAAc;GACd,SAAS;GACT,UAAU;GACV,eAAe;GACf,kBAAkB;;;;GAKlB;;KAGS,qBAAqB;UAEhB;;;;;;;;;EASf;;KAGU;EACV;IACE;EACA;;UAGa;EACf;EACA;;UAGe;;;;EAIf,YAAY;;;;;;EAOZ;;UAGe;EACf;IACE;IACA,QAAQ;;EAEV;IACE,WAAW;IACX,WAAW;;;;;;;;KCxCH,OAAO,UAAU,SAAS,cAAc,gBAAgB,OACjE,KAAK,QAAQ,UAAU;;;;;;;;;;;;;;;;cCvCb,iCAAiB;;;;;YAclB,YAAY,QAAQ,cAAc;;;;cCzBjC,kCAAkB;oDAAlB;;;;;;;;;;;;;;;;;;;;;;;;;KAeD,eAAe,cAAc;;;cChB5B,iCAAiB;;;;;cAMjB,mCAAmB;;;;cAKnB,kCAAkB;;;;;;;;;;;;;KAOnB,cAAc,cAAc;KAC5B,gBAAgB,cAAc;KAC9B,eAAe,cAAc;;;cCA5B;qBACQ,QAAM;qBACN,6BAAG;qBACH,kBAAgB;qBAChB,oBAAkB;qBAClB,YAAU;qBACV,eAAa;WAChB,qCAAc,yBAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;YAepB;;MASJ,2BAAI,iCAAA;MACJ;QAAsD;;;;YAKlD,+BAAY;YA0BZ,qCAAkB;;;;;;;;;;;;;YAwBZ,kBAAkB,MAAM,WAAW;;;;;;;;YAWzC,WAAW,MAAM;;;;;;;;EAWpB,OAAO,sBAA+C;;;;;;;;EAqBhD,UAAU,IAAG,YAAiB,QAAQ,KAAK;;;;;;;EA6D3C,oBAAoB,QAAQ;;;;;;;;YAgB/B,kBAAkB,MAAM;;;;;;;;;;;;;;EAsBrB,WACX,MAAM,UACN;IACE,0BAA0B;IAC1B;IACA,OAAO;IACP;MAED,QAAQ;;;;;;;;;;;;;;;;;;;YAgEK,oBACd,QAAQ,iBACR,gBACA,cAAc,QAAQ,cACrB,QAAQ;;;;;;;;;;;EAwBE,WAAW,aAAa,aAAa,QAAQ;;;;;;;;;;;;;EAmB7C,WACX,YACA;IACE;IACA;IACA,iBAAiB;MAElB,QAAQ;;;;;;;;;;EA+BE,WAAW,aAAa,QAAQ;;;;;;EAgChC,YAAY,gBAAgB;;;;;;;;;EA4C5B,YAAY,aAAa,aAAa,QAAQ;;;;;;;;;;;;EAmB9C,mBAAmB,QAAQ;;;;;;;;EAsCjC,iBAAiB,QAAQ,aAAa;;;;;;;;cCphBlC;qBACQ;qBACA;qBACA,aAAW;;;;;;WAOd,sCAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;cCOjB;;;;;;EAML,eACJ,MAAM,YACN,MAAM,+BACL;;;;;;;;;;;;;;;;;;;EAkCG,aAAa,MAAM,aAAa;;;;;;;;cCzD3B;qBACQ;qBACA;qBACA,aAAW;qBACX,YAAU;;;;;WAMb,mCAAS;;;;;;;;;;;;;;;0DANI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;WAsBb,oCAAU;;;;;;;;;;;;;;WAmBV,qCAAW;;;;;;;;;;;;;WAyBX,oCAAU;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;WA0BV,oCAAU;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;WA+BV,oCAAU;;;;;;;;;;;;;;;;;;;;WAyCV,0CAAgB;;;;;;;;;cCjLrB;qBACQ,aAAW;WAEd,uCAAU;;;;;;;;;;;;;;;cCMf,wCAAwB;;;;;;;KAQzB,qBAAqB,cAAc;;;;YCMnC;;;;IAIR,MAAM;;;;IAKN;;;;IAKA,OAAO;;;;;;IAOP;;;;;;;;;;;;;;cAiBS,iCAAc,yBAAA"}

package/dist/api/files/index.js

@@ -1,4 +1,4 @@
-import { $hook, $inject, $module, Alepha, t } from "alepha";
+import { $hook, $inject, $module, Alepha, z } from "alepha";
 import { $bucket, AlephaBucket, FileNotFoundError } from "alepha/bucket";
 import { $etag, AlephaServerEtag } from "alepha/server/etag";
 import { $secure } from "alepha/security";
@@ -10,44 +10,44 @@ import { $entity, $repository, RepositoryProvider, db, pageQuerySchema } from "a
 import { FileSystemProvider } from "alepha/system";
 import { $scheduler } from "alepha/scheduler";
 //#region ../../src/api/files/schemas/storageStatsSchema.ts
-const bucketStatsSchema = t.object({
-	bucket: t.string(),
-	totalSize: t.number(),
-	fileCount: t.number()
+const bucketStatsSchema = z.object({
+	bucket: z.string(),
+	totalSize: z.number(),
+	fileCount: z.number()
 });
-const mimeTypeStatsSchema = t.object({
-	mimeType: t.string(),
-	fileCount: t.number()
+const mimeTypeStatsSchema = z.object({
+	mimeType: z.string(),
+	fileCount: z.number()
 });
-const storageStatsSchema = t.object({
-	totalSize: t.number(),
-	totalFiles: t.number(),
-	byBucket: t.array(bucketStatsSchema),
-	byMimeType: t.array(mimeTypeStatsSchema)
+const storageStatsSchema = z.object({
+	totalSize: z.number(),
+	totalFiles: z.number(),
+	byBucket: z.array(bucketStatsSchema),
+	byMimeType: z.array(mimeTypeStatsSchema)
 });
 //#endregion
 //#region ../../src/api/files/entities/files.ts
 const files = $entity({
 	name: "files",
-	schema: t.object({
-		id: db.primaryKey(t.uuid()),
+	schema: z.object({
+		id: db.primaryKey(z.uuid()),
 		version: db.version(),
 		createdAt: db.createdAt(),
 		updatedAt: db.updatedAt(),
 		organizationId: db.organization(),
-		blobId: t.text(),
-		creator: t.optional(t.uuid()),
-		creatorRealm: t.optional(t.string()),
-		creatorName: t.optional(t.string()),
-		bucket: t.text(),
-		expirationDate: t.optional(t.datetime()),
+		blobId: z.text(),
+		creator: z.uuid().optional(),
+		creatorRealm: z.string().optional(),
+		creatorName: z.string().optional(),
+		bucket: z.text(),
+		expirationDate: z.datetime().optional(),
 		/**
 		* Display name. Mutable via `FileService.updateFile` — can be renamed
 		* by callers (e.g. an Archive UI letting users rename uploaded blobs).
 		* Initialized to the uploader's filename at upload time. Use
 		* `originalName` if you need the as-uploaded filename after a rename.
 		*/
-		name: t.text(),
+		name: z.text(),
 		/**
 		* Immutable record of the uploader's filename at upload time. Set once
 		* by `FileService.uploadFile` and the `bucket:file:uploaded` hook;
@@ -55,22 +55,22 @@ const files = $entity({
 		* headers (Content-Disposition), audit trails, and any UI that wants
 		* to show "originally uploaded as X" alongside a renamed file.
 		*/
-		originalName: t.optional(t.string()),
-		size: t.number(),
-		mimeType: t.string(),
+		originalName: z.string().optional(),
+		size: z.number(),
+		mimeType: z.string(),
 		/**
 		* Free-form taxonomy. Normalized server-side (trim/lowercase/dedupe is
 		* caller's responsibility for now). Use with `FileQuery.tags` to
 		* filter via array-contains.
 		*/
-		tags: t.optional(t.array(t.text())),
+		tags: z.array(z.text()).optional(),
 		/**
 		* SHA-256 hex digest of the file content (64 lowercase hex chars).
 		* Computed at upload time by `FileService.calculateChecksum`. Stable
 		* — never recomputed after upload. Use for integrity verification,
 		* content-based dedup, or downstream virus-scan correlation.
 		*/
-		checksum: t.optional(t.string())
+		checksum: z.string().optional()
 	}),
 	indexes: [
 		"expirationDate",
@@ -540,14 +540,14 @@ var FileAccessProvider = class {
 };
 //#endregion
 //#region ../../src/api/files/schemas/fileQuerySchema.ts
-const fileQuerySchema = t.extend(pageQuerySchema, {
-	bucket: t.optional(t.string()),
-	tags: t.optional(t.array(t.string())),
-	name: t.optional(t.string()),
-	mimeType: t.optional(t.string()),
-	creator: t.optional(t.uuid()),
-	createdAfter: t.optional(t.datetime()),
-	createdBefore: t.optional(t.datetime())
+const fileQuerySchema = pageQuerySchema.extend({
+	bucket: z.string().optional(),
+	tags: z.array(z.string()).optional(),
+	name: z.string().optional(),
+	mimeType: z.string().optional(),
+	creator: z.uuid().optional(),
+	createdAfter: z.datetime().optional(),
+	createdBefore: z.datetime().optional()
 });
 //#endregion
 //#region ../../src/api/files/schemas/fileCreatorSummarySchema.ts
@@ -562,26 +562,26 @@ const fileQuerySchema = t.extend(pageQuerySchema, {
 * comes back with `user` undefined. Callers must fall back to `creatorName`
 * or the raw `creator` id.
 */
-const fileCreatorSummarySchema = t.object({
-	id: t.uuid(),
-	email: t.optional(t.string({ format: "email" })),
-	username: t.optional(t.shortText({
+const fileCreatorSummarySchema = z.object({
+	id: z.uuid(),
+	email: z.string().meta({ format: "email" }).optional(),
+	username: z.shortText({
 		minLength: 3,
 		maxLength: 30
-	})),
-	firstName: t.optional(t.string()),
-	lastName: t.optional(t.string())
+	}).optional(),
+	firstName: z.string().optional(),
+	lastName: z.string().optional()
 });
 //#endregion
 //#region ../../src/api/files/schemas/fileResourceSchema.ts
-const fileResourceSchema = t.extend(files.schema, { 
+const fileResourceSchema = files.schema.extend({ 
 /**
 * Uploader summary, embedded by the admin listing via a best-effort
 * left join. Optional — see `fileCreatorSummarySchema`. Distinct from
 * the denormalized `creatorName`, which is set only on direct uploads
 * and never carries an email.
 */
-user: t.optional(fileCreatorSummarySchema) }, {
+user: fileCreatorSummarySchema.optional() }).meta({
 	title: "FileResource",
 	description: "A file resource representing a file stored in the system."
 });
@@ -607,7 +607,7 @@ var FileController = class {
 		description: "List files with filtering and pagination",
 		schema: {
 			query: fileQuerySchema,
-			response: t.page(fileResourceSchema)
+			response: z.page(fileResourceSchema)
 		},
 		handler: ({ query }) => this.fileService.findFiles(query)
 	});
@@ -622,7 +622,7 @@ var FileController = class {
 		use: [$secure({ permissions: ["admin:file:delete"] })],
 		description: "Delete a file",
 		schema: {
-			params: t.object({ id: t.uuid() }),
+			params: z.object({ id: z.uuid() }),
 			response: okSchema
 		},
 		handler: ({ params }) => this.fileService.deleteFile(params.id)
@@ -638,11 +638,8 @@ var FileController = class {
 		use: [$secure({ permissions: ["admin:file:delete"] })],
 		description: "Delete many files",
 		schema: {
-			body: t.object({ ids: t.array(t.uuid(), {
-				minItems: 1,
-				maxItems: 1e3
-			}) }),
-			response: t.object({ deleted: t.array(t.string()) })
+			body: z.object({ ids: z.array(z.uuid()).min(1).max(1e3) }),
+			response: z.object({ deleted: z.array(z.string()) })
 		},
 		handler: async ({ body }) => {
 			return { deleted: await this.fileService.deleteFiles(body.ids) };
@@ -659,10 +656,10 @@ var FileController = class {
 		use: [$secure({ permissions: ["file:create"] })],
 		description: "Upload a new file",
 		schema: {
-			body: t.object({ file: t.file() }),
-			query: t.object({
-				expirationDate: t.optional(t.datetime()),
-				bucket: t.optional(t.string())
+			body: z.object({ file: z.file() }),
+			query: z.object({
+				expirationDate: z.datetime().optional(),
+				bucket: z.string().optional()
 			}),
 			response: fileResourceSchema
 		},
@@ -682,11 +679,11 @@ var FileController = class {
 		use: [$secure({ permissions: ["admin:file:update"] })],
 		description: "Update file metadata",
 		schema: {
-			params: t.object({ id: t.uuid() }),
-			body: t.object({
-				name: t.optional(t.string()),
-				tags: t.optional(t.array(t.string())),
-				expirationDate: t.optional(t.datetime())
+			params: z.object({ id: z.uuid() }),
+			body: z.object({
+				name: z.string().optional(),
+				tags: z.array(z.string()).optional(),
+				expirationDate: z.datetime().optional()
 			}),
 			response: fileResourceSchema
 		},
@@ -713,8 +710,8 @@ var FileController = class {
 			immutable: true
 		} })],
 		schema: {
-			params: t.object({ id: t.uuid() }),
-			response: t.file()
+			params: z.object({ id: z.uuid() }),
+			response: z.file()
 		},
 		handler: async ({ params, user }) => {
 			const file = await this.fileService.getFileById(params.id);
@@ -746,8 +743,8 @@ var FileController = class {
 			immutable: true
 		} })],
 		schema: {
-			params: t.object({ id: t.uuid() }),
-			response: t.file()
+			params: z.object({ id: z.uuid() }),
+			response: z.file()
 		},
 		handler: async ({ params }) => {
 			const file = await this.fileService.getFileById(params.id);

package/dist/api/files/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","names":[],"sources":["../../../src/api/files/schemas/storageStatsSchema.ts","../../../src/api/files/entities/files.ts","../../../src/api/files/services/FileService.ts","../../../src/api/files/controllers/AdminFileStatsController.ts","../../../src/api/files/providers/FileAccessProvider.ts","../../../src/api/files/schemas/fileQuerySchema.ts","../../../src/api/files/schemas/fileCreatorSummarySchema.ts","../../../src/api/files/schemas/fileResourceSchema.ts","../../../src/api/files/controllers/FileController.ts","../../../src/api/files/jobs/FileJobs.ts","../../../src/api/files/index.ts"],"sourcesContent":["import type { Static } from \"alepha\";\nimport { t } from \"alepha\";\n\nexport const bucketStatsSchema = t.object({\n  bucket: t.string(),\n  totalSize: t.number(),\n  fileCount: t.number(),\n});\n\nexport const mimeTypeStatsSchema = t.object({\n  mimeType: t.string(),\n  fileCount: t.number(),\n});\n\nexport const storageStatsSchema = t.object({\n  totalSize: t.number(),\n  totalFiles: t.number(),\n  byBucket: t.array(bucketStatsSchema),\n  byMimeType: t.array(mimeTypeStatsSchema),\n});\n\nexport type BucketStats = Static<typeof bucketStatsSchema>;\nexport type MimeTypeStats = Static<typeof mimeTypeStatsSchema>;\nexport type StorageStats = Static<typeof storageStatsSchema>;\n","import { type Static, t } from \"alepha\";\nimport { $entity, db } from \"alepha/orm\";\n\nexport const files = $entity({\n  name: \"files\",\n  schema: t.object({\n    id: db.primaryKey(t.uuid()),\n    version: db.version(),\n    createdAt: db.createdAt(),\n    updatedAt: db.updatedAt(),\n    organizationId: db.organization(),\n    blobId: t.text(),\n    creator: t.optional(t.uuid()),\n    creatorRealm: t.optional(t.string()),\n    creatorName: t.optional(t.string()),\n    bucket: t.text(),\n    expirationDate: t.optional(t.datetime()),\n    /**\n     * Display name. Mutable via `FileService.updateFile` — can be renamed\n     * by callers (e.g. an Archive UI letting users rename uploaded blobs).\n     * Initialized to the uploader's filename at upload time. Use\n     * `originalName` if you need the as-uploaded filename after a rename.\n     */\n    name: t.text(),\n    /**\n     * Immutable record of the uploader's filename at upload time. Set once\n     * by `FileService.uploadFile` and the `bucket:file:uploaded` hook;\n     * `FileService.updateFile` never touches it. Useful for download\n     * headers (Content-Disposition), audit trails, and any UI that wants\n     * to show \"originally uploaded as X\" alongside a renamed file.\n     */\n    originalName: t.optional(t.string()),\n    size: t.number(),\n    mimeType: t.string(),\n    /**\n     * Free-form taxonomy. Normalized server-side (trim/lowercase/dedupe is\n     * caller's responsibility for now). Use with `FileQuery.tags` to\n     * filter via array-contains.\n     */\n    tags: t.optional(t.array(t.text())),\n    /**\n     * SHA-256 hex digest of the file content (64 lowercase hex chars).\n     * Computed at upload time by `FileService.calculateChecksum`. Stable\n     * — never recomputed after upload. Use for integrity verification,\n     * content-based dedup, or downstream virus-scan correlation.\n     */\n    checksum: t.optional(t.string()),\n  }),\n  indexes: [\n    \"expirationDate\",\n    \"bucket\",\n    \"creator\",\n    \"createdAt\",\n    \"mimeType\",\n    {\n      columns: [\"bucket\", \"createdAt\"],\n    },\n  ],\n});\n\nexport type FileEntity = Static<typeof files.schema>;\n","import { createHash } from \"node:crypto\";\nimport { $hook, $inject, Alepha, type FileLike } from \"alepha\";\nimport {\n  $bucket,\n  type BucketPrimitive,\n  FileNotFoundError,\n} from \"alepha/bucket\";\nimport {\n  type DateTime,\n  DateTimeProvider,\n  type DurationLike,\n} from \"alepha/datetime\";\nimport { $logger } from \"alepha/logger\";\nimport { $repository, type Page, RepositoryProvider } from \"alepha/orm\";\nimport type { UserAccountToken } from \"alepha/security\";\nimport type { Ok } from \"alepha/server\";\nimport { NotFoundError } from \"alepha/server\";\nimport { FileSystemProvider } from \"alepha/system\";\nimport { type FileEntity, files } from \"../entities/files.ts\";\nimport type { FileQuery } from \"../schemas/fileQuerySchema.ts\";\nimport type { FileResource } from \"../schemas/fileResourceSchema.ts\";\nimport type { StorageStats } from \"../schemas/storageStatsSchema.ts\";\n\nexport class FileService {\n  protected readonly alepha = $inject(Alepha);\n  protected readonly log = $logger();\n  protected readonly dateTimeProvider = $inject(DateTimeProvider);\n  protected readonly repositoryProvider = $inject(RepositoryProvider);\n  protected readonly fileSystem = $inject(FileSystemProvider);\n  protected readonly defaultBucket = $bucket({ name: \"default\" });\n  public readonly fileRepository = $repository(files);\n\n  /**\n   * Best-effort left join embedding the uploader on every file row, so the\n   * admin UI can render `user.email` instead of the bare `creator` UUID.\n   * Joins `files.creator` → `users.id`. Only applied when the `users` table is\n   * actually registered in the app (see `findFiles`) — the files module stays\n   * usable standalone, without `alepha/api/users`. Targets the default `users`\n   * table, so creators in non-default realms come back unmatched (`user`\n   * undefined), which the UI handles by falling back to `creatorName`.\n   *\n   * The `users` entity is resolved from the repository registry at runtime\n   * rather than imported: the users module already depends on the files module\n   * (avatars), so a compile-time import here would form a circular dependency.\n   */\n  protected resolveCreatorJoin() {\n    const usersEntity = this.repositoryProvider\n      .getRepositories()\n      .find((repo) => repo.entity.name === \"users\")?.entity;\n    if (!usersEntity) {\n      return undefined;\n    }\n    return {\n      user: {\n        join: usersEntity,\n        on: [\"creator\", usersEntity.cols.id] as [\"creator\", { name: string }],\n      },\n    };\n  }\n\n  protected onUploadFile = $hook({\n    on: \"bucket:file:uploaded\",\n    handler: async ({ file, bucket, options, id }) => {\n      if (options.persist === false) {\n        return;\n      }\n\n      const checksum = await this.calculateChecksum(file);\n\n      await this.persistBlobMetadata(bucket, id, () =>\n        this.fileRepository.create({\n          blobId: id,\n          mimeType: file.type,\n          name: file.name,\n          originalName: file.name,\n          size: file.size,\n          creator: options.user?.id,\n          creatorRealm: options.user?.realm,\n          expirationDate: this.getExpirationDate(options.ttl),\n          bucket: bucket.name,\n          checksum,\n        }),\n      );\n    },\n  });\n\n  protected onDeleteBucketFile = $hook({\n    on: \"bucket:file:deleted\",\n    handler: async ({ bucket, id }) => {\n      await this.fileRepository.deleteMany({\n        blobId: { eq: id },\n        bucket: { eq: bucket.name },\n      });\n    },\n  });\n\n  // -------------------------------------------------------------------------------------------------------------------\n\n  /**\n   * Calculates SHA-256 checksum of a file.\n   *\n   * Reads the whole file into memory. Callers that already hold the bytes\n   * should use {@link hashBuffer} instead to avoid re-reading — re-reading a\n   * one-shot stream either yields the wrong hash or drains a stream another\n   * step still needs.\n   *\n   * @param file - The file to calculate checksum for\n   * @returns Hexadecimal string representation of the SHA-256 hash\n   * @protected\n   */\n  protected async calculateChecksum(file: FileLike): Promise<string> {\n    return this.hashBuffer(await file.arrayBuffer());\n  }\n\n  /**\n   * Calculates the SHA-256 checksum of an already-read body.\n   *\n   * @param data - The file bytes\n   * @returns Hexadecimal string representation of the SHA-256 hash\n   * @protected\n   */\n  protected hashBuffer(data: ArrayBuffer): string {\n    return createHash(\"sha256\").update(Buffer.from(data)).digest(\"hex\");\n  }\n\n  /**\n   * Gets a bucket primitive by name.\n   *\n   * @param bucketName - The name of the bucket to retrieve (defaults to \"default\")\n   * @returns The bucket primitive\n   * @throws {NotFoundError} If the bucket is not found\n   */\n  public bucket(bucketName: string = this.defaultBucket.name): BucketPrimitive {\n    const bucket = this.alepha\n      .primitives($bucket)\n      .find((it) => it.name === bucketName);\n\n    if (!bucket) {\n      throw new NotFoundError(`Bucket '${bucketName}' not found.`);\n    }\n\n    return bucket;\n  }\n\n  // -------------------------------------------------------------------------------------------------------------------\n\n  /**\n   * Finds files matching the given query criteria with pagination support.\n   * Supports filtering by bucket, tags, name, mimeType, creator, and date range.\n   *\n   * @param q - Query parameters including bucket, tags, name, mimeType, creator, date range, pagination, and sorting\n   * @returns Paginated list of file entities\n   */\n  public async findFiles(q: FileQuery = {}): Promise<Page<FileEntity>> {\n    q.sort ??= \"-createdAt\";\n\n    const where = this.fileRepository.createQueryWhere();\n\n    if (q.bucket) {\n      where.bucket = { eq: q.bucket };\n    }\n\n    if (q.tags) {\n      where.tags = { arrayContains: q.tags };\n    }\n\n    if (q.name) {\n      where.name = { ilike: `%${q.name}%` };\n    }\n\n    if (q.mimeType) {\n      where.mimeType = { eq: q.mimeType };\n    }\n\n    if (q.creator) {\n      where.creator = { eq: q.creator };\n    }\n\n    if (q.createdAfter && q.createdBefore) {\n      where.createdAt = {\n        gte: q.createdAfter,\n        lte: q.createdBefore,\n      };\n    } else if (q.createdAfter) {\n      where.createdAt = { gte: q.createdAfter };\n    } else if (q.createdBefore) {\n      where.createdAt = { lte: q.createdBefore };\n    }\n\n    // The creator join requires the `users` table. Only opt in when a users\n    // repository is registered (i.e. `alepha/api/users` is loaded) so the\n    // files module — and its standalone tests — keep working without it.\n    const withCreator = this.resolveCreatorJoin();\n\n    return await this.fileRepository\n      .paginate(\n        q,\n        { where, ...(withCreator ? { with: withCreator } : {}) },\n        { count: true },\n      )\n      .then((page) => {\n        return {\n          ...page,\n          content: page.content.map((it) => this.entityToResource(it)),\n        };\n      });\n  }\n\n  /**\n   * Finds files that have expired based on their expiration date.\n   * Limited to 1000 files per call to prevent memory issues.\n   *\n   * @returns Array of expired file entities\n   */\n  public async findExpiredFiles(): Promise<FileEntity[]> {\n    return await this.fileRepository.findMany({\n      limit: 1000,\n      where: {\n        expirationDate: { lte: this.dateTimeProvider.nowISOString() },\n      },\n    });\n  }\n\n  /**\n   * Calculates an expiration date based on a TTL (time to live) duration.\n   *\n   * @param ttl - Duration like \"1 day\", \"2 hours\", etc.\n   * @returns DateTime representation of the expiration date, or undefined if no TTL provided\n   * @protected\n   */\n  protected getExpirationDate(ttl?: DurationLike): string | undefined {\n    return ttl\n      ? this.dateTimeProvider\n          .now()\n          .add(this.dateTimeProvider.duration(ttl))\n          .toISOString()\n      : undefined;\n  }\n\n  /**\n   * Uploads a file to a bucket and creates a database record with metadata.\n   * Automatically calculates and stores the file checksum (SHA-256).\n   *\n   * @param file - The file to upload\n   * @param options - Upload options including bucket, expiration, user, and tags\n   * @param options.bucket - Target bucket name (defaults to \"default\")\n   * @param options.expirationDate - When the file should expire\n   * @param options.user - User performing the upload (for audit trail)\n   * @param options.tags - Tags to associate with the file\n   * @returns The created file entity with all metadata\n   * @throws {NotFoundError} If the specified bucket doesn't exist\n   */\n  public async uploadFile(\n    file: FileLike,\n    options: {\n      expirationDate?: string | DateTime;\n      bucket?: string;\n      user?: UserAccountToken;\n      tags?: string[];\n    } = {},\n  ): Promise<FileEntity> {\n    const bucket = this.bucket(options.bucket);\n\n    // Read the source exactly once. The checksum and the stored bytes are\n    // both derived from this single buffer, so a one-shot stream is never\n    // read twice — the previous code checksummed the file and then let\n    // bucket.upload read it again, which drained the stream and stored an\n    // empty blob. Uploads are size-capped (bucket maxSize / multipart\n    // limits), so buffering here is intentional and bounded.\n    const data = await file.arrayBuffer();\n    const checksum = this.hashBuffer(data);\n    file = this.fileSystem.createFile({\n      arrayBuffer: data,\n      name: file.name,\n      type: file.type,\n    });\n\n    const blobId = await bucket.upload(file, { persist: false });\n\n    let expirationDate: string | undefined;\n    if (options.expirationDate) {\n      expirationDate = this.dateTimeProvider\n        .of(options.expirationDate)\n        .toISOString();\n    } else if (bucket.options.ttl) {\n      expirationDate = this.getExpirationDate(bucket.options.ttl);\n    }\n\n    return await this.persistBlobMetadata(bucket, blobId, () =>\n      this.fileRepository.create({\n        blobId: blobId,\n        mimeType: file.type,\n        name: file.name,\n        originalName: file.name,\n        size: file.size,\n        creator: options.user?.id,\n        creatorRealm: options.user?.realm,\n        creatorName: options.user?.name,\n        expirationDate,\n        bucket: bucket.name,\n        tags: options.tags,\n        checksum,\n      }),\n    );\n  }\n\n  /**\n   * Persists the metadata row for an already-uploaded blob, deleting the\n   * blob if the insert fails. Uploads are not atomic: the blob is written to\n   * storage first (the row needs the returned `blobId`), so a failed insert\n   * would otherwise leak the blob — an orphaned blob with no DB row. This\n   * compensates by removing the blob, favouring the recoverable failure\n   * (a missing blob) over the worse one (a row pointing at nothing).\n   *\n   * Best-effort: cleanup runs with `skipHook` so it neither re-emits\n   * `bucket:file:deleted` nor touches the (non-existent) DB row, and a failed\n   * cleanup is logged rather than thrown. The original write error is always\n   * rethrown so callers still see the real failure.\n   *\n   * @param bucket - The bucket the blob was uploaded to\n   * @param blobId - The id returned by `bucket.upload`\n   * @param insert - Thunk performing the metadata insert\n   * @returns The created file entity\n   */\n  protected async persistBlobMetadata(\n    bucket: BucketPrimitive,\n    blobId: string,\n    insert: () => Promise<FileEntity>,\n  ): Promise<FileEntity> {\n    try {\n      return await insert();\n    } catch (error) {\n      await bucket.delete(blobId, true).catch((cleanupError) => {\n        this.log.warn(\n          `Failed to remove orphaned blob ${blobId} from bucket ${bucket.name} after a metadata write failure`,\n          cleanupError,\n        );\n      });\n      throw error;\n    }\n  }\n\n  /**\n   * Streams a file from storage by its database ID, or directly from an\n   * already-loaded `FileEntity` to avoid a duplicate DB roundtrip when the\n   * caller has already fetched the row (e.g. after an access check).\n   *\n   * @param id - The database ID (UUID) of the file, or the entity itself\n   * @returns The file object ready for streaming/downloading\n   * @throws {NotFoundError} If the file doesn't exist in the database\n   * @throws {FileNotFoundError} If the file exists in database but not in storage\n   */\n  public async streamFile(id: string | FileEntity): Promise<FileLike> {\n    const entity = await this.getFileById(id);\n    const bucket = this.bucket(entity.bucket);\n\n    return await bucket.download(entity.blobId);\n  }\n\n  /**\n   * Updates file metadata (name, tags, expiration date).\n   * Does not modify the actual file content in storage.\n   *\n   * @param id - The database ID (UUID) of the file to update\n   * @param data - Partial file data to update\n   * @param data.name - New file name\n   * @param data.tags - New tags array\n   * @param data.expirationDate - New expiration date\n   * @returns The updated file entity\n   * @throws {NotFoundError} If the file doesn't exist in the database\n   */\n  public async updateFile(\n    id: string,\n    data: {\n      name?: string;\n      tags?: string[];\n      expirationDate?: DateTime | string;\n    },\n  ): Promise<FileEntity> {\n    const file = await this.getFileById(id);\n\n    const updateData: Partial<FileEntity> = {};\n\n    if (data.name !== undefined) {\n      updateData.name = data.name;\n    }\n\n    if (data.tags !== undefined) {\n      updateData.tags = data.tags;\n    }\n\n    if (data.expirationDate !== undefined) {\n      updateData.expirationDate = this.dateTimeProvider\n        .of(data.expirationDate)\n        .toISOString();\n    }\n\n    return await this.fileRepository.updateById(file.id, updateData);\n  }\n\n  /**\n   * Deletes a file from both storage and database.\n   * Handles cases where file is already deleted from storage gracefully.\n   * Always ensures database record is removed even if storage deletion fails.\n   *\n   * @param id - The database ID (UUID) of the file to delete\n   * @returns Success response with the deleted file ID\n   * @throws {NotFoundError} If the file doesn't exist in the database\n   */\n  public async deleteFile(id: string): Promise<Ok> {\n    const file = await this.getFileById(id);\n    const bucket = this.bucket(file.bucket);\n\n    // Always delete the database record\n    await this.fileRepository.deleteById(file.id);\n\n    try {\n      await bucket.delete(file.blobId, true);\n    } catch (e) {\n      if (e instanceof FileNotFoundError) {\n        // File is already deleted in the bucket, this is okay\n        this.log.debug(\n          `File ${file.blobId} not found in bucket ${bucket.name}, cleaning up database record`,\n        );\n      } else {\n        // Other errors (permission, network, etc.) - log but continue to clean up database\n        this.log.warn(\n          `Failed to delete file ${file.blobId} from bucket ${bucket.name}`,\n          e,\n        );\n      }\n    }\n\n    return { ok: true, id: String(file.id) };\n  }\n\n  /**\n   * Delete many files in one round-trip per bucket. The database rows are\n   * removed in a single `deleteMany`, and each affected bucket gets a single\n   * `bucket.deleteMany` call (R2/S3 batch where supported).\n   */\n  public async deleteFiles(ids: string[]): Promise<string[]> {\n    if (ids.length === 0) return [];\n\n    const files = await this.fileRepository.findMany({\n      where: { id: { inArray: ids } },\n      columns: [\"id\", \"bucket\", \"blobId\"],\n    });\n    if (files.length === 0) return [];\n\n    const dbDeleted = await this.fileRepository.deleteMany({\n      id: { inArray: files.map((f) => f.id) },\n    });\n\n    const blobsByBucket = new Map<string, string[]>();\n    for (const f of files) {\n      const list = blobsByBucket.get(f.bucket) ?? [];\n      list.push(f.blobId);\n      blobsByBucket.set(f.bucket, list);\n    }\n\n    for (const [bucketName, blobIds] of blobsByBucket) {\n      try {\n        await this.bucket(bucketName).deleteMany(blobIds, true);\n      } catch (e) {\n        // DB rows already gone — log and continue. Orphaned blobs are\n        // recoverable; orphaned DB rows would be worse.\n        this.log.warn(\n          `Failed to bulk-delete ${blobIds.length} files from bucket ${bucketName}`,\n          e,\n        );\n      }\n    }\n\n    return dbDeleted.map(String);\n  }\n\n  /**\n   * Retrieves a file entity by its ID.\n   * If already an entity object, returns it as-is (convenience method).\n   *\n   * @param id - Either a UUID string or an existing FileEntity object\n   * @returns The file entity\n   * @throws {NotFoundError} If the file doesn't exist in the database\n   */\n  public async getFileById(id: string | FileEntity): Promise<FileEntity> {\n    if (typeof id === \"object\") {\n      return id;\n    }\n\n    return await this.fileRepository.getById(id);\n  }\n\n  /**\n   * Gets storage statistics including total size, file count, and breakdowns by bucket and MIME type.\n   *\n   * Aggregated in SQL (`SUM`/`COUNT` + `GROUP BY`) rather than by loading\n   * every row into memory — the table can hold millions of files, and this\n   * endpoint must stay O(groups), not O(rows). Totals are derived from the\n   * per-bucket groups (every row has exactly one bucket), so no extra query\n   * is needed.\n   *\n   * @returns Storage statistics with aggregated data\n   */\n  public async getStorageStats(): Promise<StorageStats> {\n    const [byBucketRows, byMimeTypeRows] = await Promise.all([\n      this.fileRepository.aggregate({\n        select: { bucket: true, size: { sum: true, count: true } },\n        groupBy: [\"bucket\"],\n      }),\n      this.fileRepository.aggregate({\n        select: { mimeType: true, size: { count: true } },\n        groupBy: [\"mimeType\"],\n      }),\n    ]);\n\n    const byBucket = byBucketRows.map((row) => ({\n      bucket: row.bucket,\n      totalSize: row.size.sum,\n      fileCount: row.size.count,\n    }));\n\n    const byMimeType = byMimeTypeRows.map((row) => ({\n      mimeType: row.mimeType,\n      fileCount: row.size.count,\n    }));\n\n    return {\n      totalSize: byBucket.reduce((sum, b) => sum + b.totalSize, 0),\n      totalFiles: byBucket.reduce((sum, b) => sum + b.fileCount, 0),\n      byBucket,\n      byMimeType,\n    };\n  }\n\n  /**\n   * Converts a file entity to a file resource (API response format).\n   * Currently a pass-through, but allows for future transformation logic.\n   *\n   * @param entity - The file entity to convert\n   * @returns The file resource for API responses\n   */\n  public entityToResource(entity: FileEntity): FileResource {\n    return entity;\n  }\n}\n","import { $inject } from \"alepha\";\nimport { $secure } from \"alepha/security\";\nimport { $action } from \"alepha/server\";\nimport { storageStatsSchema } from \"../schemas/storageStatsSchema.ts\";\nimport { FileService } from \"../services/FileService.ts\";\n\n/**\n * REST API controller for storage analytics and statistics.\n * Provides endpoints for viewing storage usage metrics.\n */\nexport class AdminFileStatsController {\n  protected readonly url = \"/files/stats\";\n  protected readonly group = \"admin:files\";\n  protected readonly fileService = $inject(FileService);\n\n  /**\n   * GET /files/stats - Gets storage statistics.\n   * Returns aggregated data including total size, file count,\n   * and breakdowns by bucket and MIME type.\n   */\n  public readonly getFileStats = $action({\n    path: this.url,\n    group: this.group,\n    use: [$secure({ permissions: [\"admin:file:read\"] })],\n    description: \"Get storage statistics\",\n    schema: {\n      response: storageStatsSchema,\n    },\n    handler: () => this.fileService.getStorageStats(),\n  });\n}\n","import type { UserAccountToken } from \"alepha/security\";\nimport { ForbiddenError, NotFoundError } from \"alepha/server\";\nimport type { FileEntity } from \"../entities/files.ts\";\n\n/**\n * Authorization policy for file reads served through `FileController.streamFile`.\n *\n * Default: the caller must be the uploader (`file.creator === user.id`). Any\n * other access path — public buckets, shared attachments, avatars — must be\n * opted in by overriding this provider in the consuming app:\n *\n * ```ts\n * class MyAccess extends FileAccessProvider {\n *   async assertReadable(file, user) {\n *     if (file.bucket === \"avatars\") return; // public\n *     if (file.bucket === \"campaign-icons\") return this.checkCampaignVisible(file, user);\n *     return super.assertReadable(file, user);\n *   }\n * }\n * Alepha.create().with({ provide: FileAccessProvider, use: MyAccess });\n * ```\n *\n * Why this exists: prior to introducing this gate, `streamFile` only required\n * the framework-wide `file:read` permission. The default `user` role grants\n * `*`, so every authenticated user could download any file by UUID — turning\n * the 128-bit id into the sole security boundary across tenants.\n */\nexport class FileAccessProvider {\n  /**\n   * Throws `ForbiddenError` when `user` may not read `file`. Override to\n   * implement bucket-aware or relationship-aware policies. The default\n   * implementation is strict: only the uploader passes.\n   */\n  async assertReadable(\n    file: FileEntity,\n    user: UserAccountToken | undefined,\n  ): Promise<void> {\n    if (!user) {\n      throw new ForbiddenError(\"File access requires authentication\");\n    }\n    // Privileged identities (admin without narrow ownership scope) bypass\n    // the per-file check — they need to be able to read any file via the\n    // admin UI/inspector regardless of who uploaded it.\n    if (user.ownership === false) {\n      return;\n    }\n    if (file.creator && file.creator === user.id) {\n      return;\n    }\n    throw new ForbiddenError(\"File access denied\");\n  }\n\n  /**\n   * Throws when `file` may not be served through the anonymous\n   * `/public/files/:id` route. The default is deny-all: nothing is public\n   * unless this method is overridden. Throws `NotFoundError` (not 403) so the\n   * endpoint doesn't leak the existence of private file ids.\n   *\n   * Typical override matches on bucket name:\n   *\n   * ```ts\n   * class MyAccess extends FileAccessProvider {\n   *   async assertPublic(file) {\n   *     if (file.bucket === \"avatars\") return;\n   *     if (file.bucket === \"campaign-icons\") return;\n   *     return super.assertPublic(file);\n   *   }\n   * }\n   * ```\n   */\n  async assertPublic(file: FileEntity): Promise<void> {\n    throw new NotFoundError(`File '${file.id}' not found`);\n  }\n}\n","import type { Static } from \"alepha\";\nimport { t } from \"alepha\";\nimport { pageQuerySchema } from \"alepha/orm\";\n\nexport const fileQuerySchema = t.extend(pageQuerySchema, {\n  bucket: t.optional(t.string()),\n  tags: t.optional(t.array(t.string())),\n  name: t.optional(t.string()),\n  mimeType: t.optional(t.string()),\n  creator: t.optional(t.uuid()),\n  createdAfter: t.optional(t.datetime()),\n  createdBefore: t.optional(t.datetime()),\n});\n\nexport type FileQuery = Static<typeof fileQuerySchema>;\n","import { type Static, t } from \"alepha\";\n\n/**\n * Slim view of a file's uploader, embedded by the admin listing via a\n * best-effort left join (`files.creator` → `users.id`) so the UI can render\n * a human-readable identifier instead of a bare UUID.\n *\n * Optional end-to-end: the join only runs when the `users` entity is\n * registered in the running app (see `FileService.findFiles`), and even then\n * a file whose creator was deleted — or who lives in a non-default realm —\n * comes back with `user` undefined. Callers must fall back to `creatorName`\n * or the raw `creator` id.\n */\nexport const fileCreatorSummarySchema = t.object({\n  id: t.uuid(),\n  email: t.optional(t.string({ format: \"email\" })),\n  username: t.optional(t.shortText({ minLength: 3, maxLength: 30 })),\n  firstName: t.optional(t.string()),\n  lastName: t.optional(t.string()),\n});\n\nexport type FileCreatorSummary = Static<typeof fileCreatorSummarySchema>;\n","import { type Static, t } from \"alepha\";\nimport { files } from \"../entities/files.ts\";\nimport { fileCreatorSummarySchema } from \"./fileCreatorSummarySchema.ts\";\n\nexport const fileResourceSchema = t.extend(\n  files.schema,\n  {\n    /**\n     * Uploader summary, embedded by the admin listing via a best-effort\n     * left join. Optional — see `fileCreatorSummarySchema`. Distinct from\n     * the denormalized `creatorName`, which is set only on direct uploads\n     * and never carries an email.\n     */\n    user: t.optional(fileCreatorSummarySchema),\n  },\n  {\n    title: \"FileResource\",\n    description: \"A file resource representing a file stored in the system.\",\n  },\n);\n\nexport type FileResource = Static<typeof fileResourceSchema>;\n","import { $inject, t } from \"alepha\";\nimport { $secure } from \"alepha/security\";\nimport { $action, okSchema } from \"alepha/server\";\nimport { $etag } from \"alepha/server/etag\";\nimport { FileAccessProvider } from \"../providers/FileAccessProvider.ts\";\nimport { fileQuerySchema } from \"../schemas/fileQuerySchema.ts\";\nimport { fileResourceSchema } from \"../schemas/fileResourceSchema.ts\";\nimport { FileService } from \"../services/FileService.ts\";\n\n/**\n * REST API controller for file management operations.\n * Provides endpoints for uploading, downloading, listing, and deleting files.\n */\nexport class FileController {\n  protected readonly url = \"/files\";\n  protected readonly group = \"files\";\n  protected readonly fileService = $inject(FileService);\n  protected readonly fileAccess = $inject(FileAccessProvider);\n\n  /**\n   * GET /files - Lists files with optional filtering and pagination.\n   * Supports filtering by bucket and tags.\n   */\n  public readonly findFiles = $action({\n    path: this.url,\n    group: `admin:${this.group}`,\n    use: [$secure({ permissions: [\"admin:file:read\"] })],\n    description: \"List files with filtering and pagination\",\n    schema: {\n      query: fileQuerySchema,\n      response: t.page(fileResourceSchema),\n    },\n    handler: ({ query }) => this.fileService.findFiles(query),\n  });\n\n  /**\n   * DELETE /files/:id - Deletes a file from both storage and database.\n   * Removes the file from the bucket and cleans up the database record.\n   */\n  public readonly deleteFile = $action({\n    method: \"DELETE\",\n    path: `${this.url}/:id`,\n    group: `admin:${this.group}`,\n    use: [$secure({ permissions: [\"admin:file:delete\"] })],\n    description: \"Delete a file\",\n    schema: {\n      params: t.object({\n        id: t.uuid(),\n      }),\n      response: okSchema,\n    },\n    handler: ({ params }) => this.fileService.deleteFile(params.id),\n  });\n\n  /**\n   * POST /files/delete - Delete many files in one request, batching the\n   * underlying bucket calls per bucket (R2/S3 batch where supported).\n   */\n  public readonly deleteFiles = $action({\n    method: \"POST\",\n    path: `${this.url}/delete`,\n    group: `admin:${this.group}`,\n    use: [$secure({ permissions: [\"admin:file:delete\"] })],\n    description: \"Delete many files\",\n    schema: {\n      body: t.object({\n        ids: t.array(t.uuid(), { minItems: 1, maxItems: 1000 }),\n      }),\n      response: t.object({\n        deleted: t.array(t.string()),\n      }),\n    },\n    handler: async ({ body }) => {\n      const deleted = await this.fileService.deleteFiles(body.ids);\n      return { deleted };\n    },\n  });\n\n  /**\n   * POST /files - Uploads a new file to storage.\n   * Creates a database record with metadata and calculates checksum.\n   * Optionally specify bucket and expiration date.\n   */\n  public readonly uploadFile = $action({\n    path: this.url,\n    group: this.group,\n    use: [$secure({ permissions: [\"file:create\"] })],\n    description: \"Upload a new file\",\n    schema: {\n      body: t.object({\n        file: t.file(),\n      }),\n      query: t.object({\n        expirationDate: t.optional(t.datetime()),\n        bucket: t.optional(t.string()),\n      }),\n      response: fileResourceSchema,\n    },\n    handler: async ({ body, user, query }) =>\n      this.fileService.uploadFile(body.file, {\n        user,\n        ...query,\n      }),\n  });\n\n  /**\n   * PATCH /files/:id - Updates file metadata.\n   * Allows updating name, tags, and expiration date without modifying file content.\n   */\n  public readonly updateFile = $action({\n    method: \"PATCH\",\n    path: `${this.url}/:id`,\n    group: `admin:${this.group}`,\n    use: [$secure({ permissions: [\"admin:file:update\"] })],\n    description: \"Update file metadata\",\n    schema: {\n      params: t.object({\n        id: t.uuid(),\n      }),\n      body: t.object({\n        name: t.optional(t.string()),\n        tags: t.optional(t.array(t.string())),\n        expirationDate: t.optional(t.datetime()),\n      }),\n      response: fileResourceSchema,\n    },\n    handler: ({ params, body }) => this.fileService.updateFile(params.id, body),\n  });\n\n  /**\n   * GET /files/:id - Streams/downloads a file by its ID.\n   * Returns the file content with appropriate Content-Type header.\n   *\n   * Authorization is delegated to `FileAccessProvider.assertReadable`. The\n   * default policy is creator-only — override the provider via DI to widen\n   * access (e.g. avatars, shared attachments). See `FileAccessProvider`.\n   *\n   * Cache-Control is `private` because the per-user authorization decision\n   * cannot be cached by shared proxies/CDNs. Client-side ETag still works.\n   */\n  public readonly streamFile = $action({\n    path: `${this.url}/:id`,\n    group: this.group,\n    description: \"Download a file\",\n    use: [\n      $secure({ permissions: [\"file:read\"] }),\n      $etag({\n        control: {\n          private: true,\n          maxAge: [1, \"year\"],\n          immutable: true,\n        },\n      }),\n    ],\n    schema: {\n      params: t.object({\n        id: t.uuid(),\n      }),\n      response: t.file(),\n    },\n    handler: async ({ params, user }) => {\n      const file = await this.fileService.getFileById(params.id);\n      await this.fileAccess.assertReadable(file, user);\n      return await this.fileService.streamFile(file);\n    },\n  });\n\n  /**\n   * GET /public/files/:id - Anonymous, edge-cacheable download.\n   *\n   * Authorization is delegated to `FileAccessProvider.assertPublic`. The\n   * default policy is deny-all (throws `NotFoundError`), so consuming apps\n   * must override the provider to opt files in — typically by bucket name\n   * (avatars, campaign icons, etc.).\n   *\n   * Cache-Control is `public, immutable, max-age=1y` so Cloudflare's edge\n   * cache and any intermediary proxy can serve subsequent hits without\n   * touching the Worker. The split URL prefix (vs `/files/:id`) is what\n   * makes this safe: edge cache is URL-keyed, so public and private files\n   * live in separate cache lanes.\n   */\n  public readonly streamPublicFile = $action({\n    path: \"/public/files/:id\",\n    group: this.group,\n    description: \"Download a public file (anonymous, edge-cacheable)\",\n    use: [\n      $etag({\n        control: {\n          public: true,\n          maxAge: [1, \"year\"],\n          immutable: true,\n        },\n      }),\n    ],\n    schema: {\n      params: t.object({\n        id: t.uuid(),\n      }),\n      response: t.file(),\n    },\n    handler: async ({ params }) => {\n      const file = await this.fileService.getFileById(params.id);\n      await this.fileAccess.assertPublic(file);\n      return await this.fileService.streamFile(file);\n    },\n  });\n}\n","import { $inject } from \"alepha\";\nimport { $scheduler } from \"alepha/scheduler\";\nimport { FileService } from \"../services/FileService.ts\";\n\nexport class FileJobs {\n  protected readonly fileService = $inject(FileService);\n\n  public readonly purgeFiles = $scheduler({\n    name: \"api:files:purgeFiles\",\n    description: \"Purge files that are marked for deletion\",\n    cron: \"0 * * * *\", // Hourly at minute 0\n    handler: async () => {\n      const files = await this.fileService.findExpiredFiles();\n\n      await Promise.all(\n        files.map((file) => this.fileService.deleteFile(file.id)),\n      );\n    },\n  });\n}\n","import { $module } from \"alepha\";\nimport { AlephaBucket } from \"alepha/bucket\";\nimport type { DurationLike } from \"alepha/datetime\";\nimport type { UserAccountToken } from \"alepha/security\";\nimport { AlephaServerEtag } from \"alepha/server/etag\";\nimport { AdminFileStatsController } from \"./controllers/AdminFileStatsController.ts\";\nimport { FileController } from \"./controllers/FileController.ts\";\nimport { FileJobs } from \"./jobs/FileJobs.ts\";\nimport { FileAccessProvider } from \"./providers/FileAccessProvider.ts\";\nimport { FileService } from \"./services/FileService.ts\";\n\n// ---------------------------------------------------------------------------------------------------------------------\n\nexport * from \"./controllers/AdminFileStatsController.ts\";\nexport * from \"./controllers/FileController.ts\";\nexport * from \"./entities/files.ts\";\nexport * from \"./jobs/FileJobs.ts\";\nexport * from \"./providers/FileAccessProvider.ts\";\nexport * from \"./schemas/fileCreatorSummarySchema.ts\";\nexport * from \"./schemas/fileQuerySchema.ts\";\nexport * from \"./schemas/fileResourceSchema.ts\";\nexport * from \"./schemas/storageStatsSchema.ts\";\nexport * from \"./services/FileService.ts\";\n\n// ---------------------------------------------------------------------------------------------------------------------\n\ndeclare module \"alepha/bucket\" {\n  interface BucketFileOptions {\n    /**\n     * Time to live for the files in the bucket.\n     */\n    ttl?: DurationLike;\n\n    /**\n     * Tags for the bucket.\n     */\n    tags?: string[];\n\n    /**\n     * User performing the operation.\n     */\n    user?: UserAccountToken;\n\n    /**\n     * Whether to persist the file metadata in the database.\n     *\n     * @default true\n     */\n    persist?: boolean;\n  }\n}\n\n// ---------------------------------------------------------------------------------------------------------------------\n\n/**\n * File management endpoints.\n *\n * **Features:**\n * - Upload/download endpoints\n * - File metadata storage\n * - TTL-based expiration\n * - Storage statistics\n *\n * @module alepha.api.files\n */\nexport const AlephaApiFiles = $module({\n  name: \"alepha.api.files\",\n  services: [\n    FileController,\n    AdminFileStatsController,\n    FileJobs,\n    FileService,\n    FileAccessProvider,\n  ],\n  imports: [AlephaBucket, AlephaServerEtag],\n});\n"],"mappings":";;;;;;;;;;;;AAGA,MAAa,oBAAoB,EAAE,OAAO;CACxC,QAAQ,EAAE,OAAO;CACjB,WAAW,EAAE,OAAO;CACpB,WAAW,EAAE,OAAO;AACtB,CAAC;AAED,MAAa,sBAAsB,EAAE,OAAO;CAC1C,UAAU,EAAE,OAAO;CACnB,WAAW,EAAE,OAAO;AACtB,CAAC;AAED,MAAa,qBAAqB,EAAE,OAAO;CACzC,WAAW,EAAE,OAAO;CACpB,YAAY,EAAE,OAAO;CACrB,UAAU,EAAE,MAAM,iBAAiB;CACnC,YAAY,EAAE,MAAM,mBAAmB;AACzC,CAAC;;;AChBD,MAAa,QAAQ,QAAQ;CAC3B,MAAM;CACN,QAAQ,EAAE,OAAO;EACf,IAAI,GAAG,WAAW,EAAE,KAAK,CAAC;EAC1B,SAAS,GAAG,QAAQ;EACpB,WAAW,GAAG,UAAU;EACxB,WAAW,GAAG,UAAU;EACxB,gBAAgB,GAAG,aAAa;EAChC,QAAQ,EAAE,KAAK;EACf,SAAS,EAAE,SAAS,EAAE,KAAK,CAAC;EAC5B,cAAc,EAAE,SAAS,EAAE,OAAO,CAAC;EACnC,aAAa,EAAE,SAAS,EAAE,OAAO,CAAC;EAClC,QAAQ,EAAE,KAAK;EACf,gBAAgB,EAAE,SAAS,EAAE,SAAS,CAAC;;;;;;;EAOvC,MAAM,EAAE,KAAK;;;;;;;;EAQb,cAAc,EAAE,SAAS,EAAE,OAAO,CAAC;EACnC,MAAM,EAAE,OAAO;EACf,UAAU,EAAE,OAAO;;;;;;EAMnB,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;;;;;;;EAOlC,UAAU,EAAE,SAAS,EAAE,OAAO,CAAC;CACjC,CAAC;CACD,SAAS;EACP;EACA;EACA;EACA;EACA;EACA,EACE,SAAS,CAAC,UAAU,WAAW,EACjC;CACF;AACF,CAAC;;;ACnCD,IAAa,cAAb,MAAyB;CACvB,SAA4B,QAAQ,MAAM;CAC1C,MAAyB,QAAQ;CACjC,mBAAsC,QAAQ,gBAAgB;CAC9D,qBAAwC,QAAQ,kBAAkB;CAClE,aAAgC,QAAQ,kBAAkB;CAC1D,gBAAmC,QAAQ,EAAE,MAAM,UAAU,CAAC;CAC9D,iBAAiC,YAAY,KAAK;;;;;;;;;;;;;;CAelD,qBAA+B;EAC7B,MAAM,cAAc,KAAK,mBACtB,gBAAgB,EAChB,MAAM,SAAS,KAAK,OAAO,SAAS,OAAO,GAAG;EACjD,IAAI,CAAC,aACH;EAEF,OAAO,EACL,MAAM;GACJ,MAAM;GACN,IAAI,CAAC,WAAW,YAAY,KAAK,EAAE;EACrC,EACF;CACF;CAEA,eAAyB,MAAM;EAC7B,IAAI;EACJ,SAAS,OAAO,EAAE,MAAM,QAAQ,SAAS,SAAS;GAChD,IAAI,QAAQ,YAAY,OACtB;GAGF,MAAM,WAAW,MAAM,KAAK,kBAAkB,IAAI;GAElD,MAAM,KAAK,oBAAoB,QAAQ,UACrC,KAAK,eAAe,OAAO;IACzB,QAAQ;IACR,UAAU,KAAK;IACf,MAAM,KAAK;IACX,cAAc,KAAK;IACnB,MAAM,KAAK;IACX,SAAS,QAAQ,MAAM;IACvB,cAAc,QAAQ,MAAM;IAC5B,gBAAgB,KAAK,kBAAkB,QAAQ,GAAG;IAClD,QAAQ,OAAO;IACf;GACF,CAAC,CACH;EACF;CACF,CAAC;CAED,qBAA+B,MAAM;EACnC,IAAI;EACJ,SAAS,OAAO,EAAE,QAAQ,SAAS;GACjC,MAAM,KAAK,eAAe,WAAW;IACnC,QAAQ,EAAE,IAAI,GAAG;IACjB,QAAQ,EAAE,IAAI,OAAO,KAAK;GAC5B,CAAC;EACH;CACF,CAAC;;;;;;;;;;;;;CAgBD,MAAgB,kBAAkB,MAAiC;EACjE,OAAO,KAAK,WAAW,MAAM,KAAK,YAAY,CAAC;CACjD;;;;;;;;CASA,WAAqB,MAA2B;EAC9C,OAAO,WAAW,QAAQ,EAAE,OAAO,OAAO,KAAK,IAAI,CAAC,EAAE,OAAO,KAAK;CACpE;;;;;;;;CASA,OAAc,aAAqB,KAAK,cAAc,MAAuB;EAC3E,MAAM,SAAS,KAAK,OACjB,WAAW,OAAO,EAClB,MAAM,OAAO,GAAG,SAAS,UAAU;EAEtC,IAAI,CAAC,QACH,MAAM,IAAI,cAAc,WAAW,WAAW,aAAa;EAG7D,OAAO;CACT;;;;;;;;CAWA,MAAa,UAAU,IAAe,CAAC,GAA8B;EACnE,EAAE,SAAS;EAEX,MAAM,QAAQ,KAAK,eAAe,iBAAiB;EAEnD,IAAI,EAAE,QACJ,MAAM,SAAS,EAAE,IAAI,EAAE,OAAO;EAGhC,IAAI,EAAE,MACJ,MAAM,OAAO,EAAE,eAAe,EAAE,KAAK;EAGvC,IAAI,EAAE,MACJ,MAAM,OAAO,EAAE,OAAO,IAAI,EAAE,KAAK,GAAG;EAGtC,IAAI,EAAE,UACJ,MAAM,WAAW,EAAE,IAAI,EAAE,SAAS;EAGpC,IAAI,EAAE,SACJ,MAAM,UAAU,EAAE,IAAI,EAAE,QAAQ;EAGlC,IAAI,EAAE,gBAAgB,EAAE,eACtB,MAAM,YAAY;GAChB,KAAK,EAAE;GACP,KAAK,EAAE;EACT;OACK,IAAI,EAAE,cACX,MAAM,YAAY,EAAE,KAAK,EAAE,aAAa;OACnC,IAAI,EAAE,eACX,MAAM,YAAY,EAAE,KAAK,EAAE,cAAc;EAM3C,MAAM,cAAc,KAAK,mBAAmB;EAE5C,OAAO,MAAM,KAAK,eACf,SACC,GACA;GAAE;GAAO,GAAI,cAAc,EAAE,MAAM,YAAY,IAAI,CAAC;EAAG,GACvD,EAAE,OAAO,KAAK,CAChB,EACC,MAAM,SAAS;GACd,OAAO;IACL,GAAG;IACH,SAAS,KAAK,QAAQ,KAAK,OAAO,KAAK,iBAAiB,EAAE,CAAC;GAC7D;EACF,CAAC;CACL;;;;;;;CAQA,MAAa,mBAA0C;EACrD,OAAO,MAAM,KAAK,eAAe,SAAS;GACxC,OAAO;GACP,OAAO,EACL,gBAAgB,EAAE,KAAK,KAAK,iBAAiB,aAAa,EAAE,EAC9D;EACF,CAAC;CACH;;;;;;;;CASA,kBAA4B,KAAwC;EAClE,OAAO,MACH,KAAK,iBACF,IAAI,EACJ,IAAI,KAAK,iBAAiB,SAAS,GAAG,CAAC,EACvC,YAAY,IACf,KAAA;CACN;;;;;;;;;;;;;;CAeA,MAAa,WACX,MACA,UAKI,CAAC,GACgB;EACrB,MAAM,SAAS,KAAK,OAAO,QAAQ,MAAM;EAQzC,MAAM,OAAO,MAAM,KAAK,YAAY;EACpC,MAAM,WAAW,KAAK,WAAW,IAAI;EACrC,OAAO,KAAK,WAAW,WAAW;GAChC,aAAa;GACb,MAAM,KAAK;GACX,MAAM,KAAK;EACb,CAAC;EAED,MAAM,SAAS,MAAM,OAAO,OAAO,MAAM,EAAE,SAAS,MAAM,CAAC;EAE3D,IAAI;EACJ,IAAI,QAAQ,gBACV,iBAAiB,KAAK,iBACnB,GAAG,QAAQ,cAAc,EACzB,YAAY;OACV,IAAI,OAAO,QAAQ,KACxB,iBAAiB,KAAK,kBAAkB,OAAO,QAAQ,GAAG;EAG5D,OAAO,MAAM,KAAK,oBAAoB,QAAQ,cAC5C,KAAK,eAAe,OAAO;GACjB;GACR,UAAU,KAAK;GACf,MAAM,KAAK;GACX,cAAc,KAAK;GACnB,MAAM,KAAK;GACX,SAAS,QAAQ,MAAM;GACvB,cAAc,QAAQ,MAAM;GAC5B,aAAa,QAAQ,MAAM;GAC3B;GACA,QAAQ,OAAO;GACf,MAAM,QAAQ;GACd;EACF,CAAC,CACH;CACF;;;;;;;;;;;;;;;;;;;CAoBA,MAAgB,oBACd,QACA,QACA,QACqB;EACrB,IAAI;GACF,OAAO,MAAM,OAAO;EACtB,SAAS,OAAO;GACd,MAAM,OAAO,OAAO,QAAQ,IAAI,EAAE,OAAO,iBAAiB;IACxD,KAAK,IAAI,KACP,kCAAkC,OAAO,eAAe,OAAO,KAAK,kCACpE,YACF;GACF,CAAC;GACD,MAAM;EACR;CACF;;;;;;;;;;;CAYA,MAAa,WAAW,IAA4C;EAClE,MAAM,SAAS,MAAM,KAAK,YAAY,EAAE;EAGxC,OAAO,MAFQ,KAAK,OAAO,OAAO,MAEhB,EAAE,SAAS,OAAO,MAAM;CAC5C;;;;;;;;;;;;;CAcA,MAAa,WACX,IACA,MAKqB;EACrB,MAAM,OAAO,MAAM,KAAK,YAAY,EAAE;EAEtC,MAAM,aAAkC,CAAC;EAEzC,IAAI,KAAK,SAAS,KAAA,GAChB,WAAW,OAAO,KAAK;EAGzB,IAAI,KAAK,SAAS,KAAA,GAChB,WAAW,OAAO,KAAK;EAGzB,IAAI,KAAK,mBAAmB,KAAA,GAC1B,WAAW,iBAAiB,KAAK,iBAC9B,GAAG,KAAK,cAAc,EACtB,YAAY;EAGjB,OAAO,MAAM,KAAK,eAAe,WAAW,KAAK,IAAI,UAAU;CACjE;;;;;;;;;;CAWA,MAAa,WAAW,IAAyB;EAC/C,MAAM,OAAO,MAAM,KAAK,YAAY,EAAE;EACtC,MAAM,SAAS,KAAK,OAAO,KAAK,MAAM;EAGtC,MAAM,KAAK,eAAe,WAAW,KAAK,EAAE;EAE5C,IAAI;GACF,MAAM,OAAO,OAAO,KAAK,QAAQ,IAAI;EACvC,SAAS,GAAG;GACV,IAAI,aAAa,mBAEf,KAAK,IAAI,MACP,QAAQ,KAAK,OAAO,uBAAuB,OAAO,KAAK,8BACzD;QAGA,KAAK,IAAI,KACP,yBAAyB,KAAK,OAAO,eAAe,OAAO,QAC3D,CACF;EAEJ;EAEA,OAAO;GAAE,IAAI;GAAM,IAAI,OAAO,KAAK,EAAE;EAAE;CACzC;;;;;;CAOA,MAAa,YAAY,KAAkC;EACzD,IAAI,IAAI,WAAW,GAAG,OAAO,CAAC;EAE9B,MAAM,QAAQ,MAAM,KAAK,eAAe,SAAS;GAC/C,OAAO,EAAE,IAAI,EAAE,SAAS,IAAI,EAAE;GAC9B,SAAS;IAAC;IAAM;IAAU;GAAQ;EACpC,CAAC;EACD,IAAI,MAAM,WAAW,GAAG,OAAO,CAAC;EAEhC,MAAM,YAAY,MAAM,KAAK,eAAe,WAAW,EACrD,IAAI,EAAE,SAAS,MAAM,KAAK,MAAM,EAAE,EAAE,EAAE,EACxC,CAAC;EAED,MAAM,gCAAgB,IAAI,IAAsB;EAChD,KAAK,MAAM,KAAK,OAAO;GACrB,MAAM,OAAO,cAAc,IAAI,EAAE,MAAM,KAAK,CAAC;GAC7C,KAAK,KAAK,EAAE,MAAM;GAClB,cAAc,IAAI,EAAE,QAAQ,IAAI;EAClC;EAEA,KAAK,MAAM,CAAC,YAAY,YAAY,eAClC,IAAI;GACF,MAAM,KAAK,OAAO,UAAU,EAAE,WAAW,SAAS,IAAI;EACxD,SAAS,GAAG;GAGV,KAAK,IAAI,KACP,yBAAyB,QAAQ,OAAO,qBAAqB,cAC7D,CACF;EACF;EAGF,OAAO,UAAU,IAAI,MAAM;CAC7B;;;;;;;;;CAUA,MAAa,YAAY,IAA8C;EACrE,IAAI,OAAO,OAAO,UAChB,OAAO;EAGT,OAAO,MAAM,KAAK,eAAe,QAAQ,EAAE;CAC7C;;;;;;;;;;;;CAaA,MAAa,kBAAyC;EACpD,MAAM,CAAC,cAAc,kBAAkB,MAAM,QAAQ,IAAI,CACvD,KAAK,eAAe,UAAU;GAC5B,QAAQ;IAAE,QAAQ;IAAM,MAAM;KAAE,KAAK;KAAM,OAAO;IAAK;GAAE;GACzD,SAAS,CAAC,QAAQ;EACpB,CAAC,GACD,KAAK,eAAe,UAAU;GAC5B,QAAQ;IAAE,UAAU;IAAM,MAAM,EAAE,OAAO,KAAK;GAAE;GAChD,SAAS,CAAC,UAAU;EACtB,CAAC,CACH,CAAC;EAED,MAAM,WAAW,aAAa,KAAK,SAAS;GAC1C,QAAQ,IAAI;GACZ,WAAW,IAAI,KAAK;GACpB,WAAW,IAAI,KAAK;EACtB,EAAE;EAEF,MAAM,aAAa,eAAe,KAAK,SAAS;GAC9C,UAAU,IAAI;GACd,WAAW,IAAI,KAAK;EACtB,EAAE;EAEF,OAAO;GACL,WAAW,SAAS,QAAQ,KAAK,MAAM,MAAM,EAAE,WAAW,CAAC;GAC3D,YAAY,SAAS,QAAQ,KAAK,MAAM,MAAM,EAAE,WAAW,CAAC;GAC5D;GACA;EACF;CACF;;;;;;;;CASA,iBAAwB,QAAkC;EACxD,OAAO;CACT;AACF;;;;;;;ACvhBA,IAAa,2BAAb,MAAsC;CACpC,MAAyB;CACzB,QAA2B;CAC3B,cAAiC,QAAQ,WAAW;;;;;;CAOpD,eAA+B,QAAQ;EACrC,MAAM,KAAK;EACX,OAAO,KAAK;EACZ,KAAK,CAAC,QAAQ,EAAE,aAAa,CAAC,iBAAiB,EAAE,CAAC,CAAC;EACnD,aAAa;EACb,QAAQ,EACN,UAAU,mBACZ;EACA,eAAe,KAAK,YAAY,gBAAgB;CAClD,CAAC;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;ACHA,IAAa,qBAAb,MAAgC;;;;;;CAM9B,MAAM,eACJ,MACA,MACe;EACf,IAAI,CAAC,MACH,MAAM,IAAI,eAAe,qCAAqC;EAKhE,IAAI,KAAK,cAAc,OACrB;EAEF,IAAI,KAAK,WAAW,KAAK,YAAY,KAAK,IACxC;EAEF,MAAM,IAAI,eAAe,oBAAoB;CAC/C;;;;;;;;;;;;;;;;;;;CAoBA,MAAM,aAAa,MAAiC;EAClD,MAAM,IAAI,cAAc,SAAS,KAAK,GAAG,YAAY;CACvD;AACF;;;ACrEA,MAAa,kBAAkB,EAAE,OAAO,iBAAiB;CACvD,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC;CAC7B,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC;CAC3B,UAAU,EAAE,SAAS,EAAE,OAAO,CAAC;CAC/B,SAAS,EAAE,SAAS,EAAE,KAAK,CAAC;CAC5B,cAAc,EAAE,SAAS,EAAE,SAAS,CAAC;CACrC,eAAe,EAAE,SAAS,EAAE,SAAS,CAAC;AACxC,CAAC;;;;;;;;;;;;;;ACCD,MAAa,2BAA2B,EAAE,OAAO;CAC/C,IAAI,EAAE,KAAK;CACX,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,QAAQ,CAAC,CAAC;CAC/C,UAAU,EAAE,SAAS,EAAE,UAAU;EAAE,WAAW;EAAG,WAAW;CAAG,CAAC,CAAC;CACjE,WAAW,EAAE,SAAS,EAAE,OAAO,CAAC;CAChC,UAAU,EAAE,SAAS,EAAE,OAAO,CAAC;AACjC,CAAC;;;ACfD,MAAa,qBAAqB,EAAE,OAClC,MAAM,QACN;;;;;;;AAOE,MAAM,EAAE,SAAS,wBAAwB,EAC3C,GACA;CACE,OAAO;CACP,aAAa;AACf,CACF;;;;;;;ACNA,IAAa,iBAAb,MAA4B;CAC1B,MAAyB;CACzB,QAA2B;CAC3B,cAAiC,QAAQ,WAAW;CACpD,aAAgC,QAAQ,kBAAkB;;;;;CAM1D,YAA4B,QAAQ;EAClC,MAAM,KAAK;EACX,OAAO,SAAS,KAAK;EACrB,KAAK,CAAC,QAAQ,EAAE,aAAa,CAAC,iBAAiB,EAAE,CAAC,CAAC;EACnD,aAAa;EACb,QAAQ;GACN,OAAO;GACP,UAAU,EAAE,KAAK,kBAAkB;EACrC;EACA,UAAU,EAAE,YAAY,KAAK,YAAY,UAAU,KAAK;CAC1D,CAAC;;;;;CAMD,aAA6B,QAAQ;EACnC,QAAQ;EACR,MAAM,GAAG,KAAK,IAAI;EAClB,OAAO,SAAS,KAAK;EACrB,KAAK,CAAC,QAAQ,EAAE,aAAa,CAAC,mBAAmB,EAAE,CAAC,CAAC;EACrD,aAAa;EACb,QAAQ;GACN,QAAQ,EAAE,OAAO,EACf,IAAI,EAAE,KAAK,EACb,CAAC;GACD,UAAU;EACZ;EACA,UAAU,EAAE,aAAa,KAAK,YAAY,WAAW,OAAO,EAAE;CAChE,CAAC;;;;;CAMD,cAA8B,QAAQ;EACpC,QAAQ;EACR,MAAM,GAAG,KAAK,IAAI;EAClB,OAAO,SAAS,KAAK;EACrB,KAAK,CAAC,QAAQ,EAAE,aAAa,CAAC,mBAAmB,EAAE,CAAC,CAAC;EACrD,aAAa;EACb,QAAQ;GACN,MAAM,EAAE,OAAO,EACb,KAAK,EAAE,MAAM,EAAE,KAAK,GAAG;IAAE,UAAU;IAAG,UAAU;GAAK,CAAC,EACxD,CAAC;GACD,UAAU,EAAE,OAAO,EACjB,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,EAC7B,CAAC;EACH;EACA,SAAS,OAAO,EAAE,WAAW;GAE3B,OAAO,EAAE,SAAA,MADa,KAAK,YAAY,YAAY,KAAK,GAAG,EAC1C;EACnB;CACF,CAAC;;;;;;CAOD,aAA6B,QAAQ;EACnC,MAAM,KAAK;EACX,OAAO,KAAK;EACZ,KAAK,CAAC,QAAQ,EAAE,aAAa,CAAC,aAAa,EAAE,CAAC,CAAC;EAC/C,aAAa;EACb,QAAQ;GACN,MAAM,EAAE,OAAO,EACb,MAAM,EAAE,KAAK,EACf,CAAC;GACD,OAAO,EAAE,OAAO;IACd,gBAAgB,EAAE,SAAS,EAAE,SAAS,CAAC;IACvC,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC;GAC/B,CAAC;GACD,UAAU;EACZ;EACA,SAAS,OAAO,EAAE,MAAM,MAAM,YAC5B,KAAK,YAAY,WAAW,KAAK,MAAM;GACrC;GACA,GAAG;EACL,CAAC;CACL,CAAC;;;;;CAMD,aAA6B,QAAQ;EACnC,QAAQ;EACR,MAAM,GAAG,KAAK,IAAI;EAClB,OAAO,SAAS,KAAK;EACrB,KAAK,CAAC,QAAQ,EAAE,aAAa,CAAC,mBAAmB,EAAE,CAAC,CAAC;EACrD,aAAa;EACb,QAAQ;GACN,QAAQ,EAAE,OAAO,EACf,IAAI,EAAE,KAAK,EACb,CAAC;GACD,MAAM,EAAE,OAAO;IACb,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC;IAC3B,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;IACpC,gBAAgB,EAAE,SAAS,EAAE,SAAS,CAAC;GACzC,CAAC;GACD,UAAU;EACZ;EACA,UAAU,EAAE,QAAQ,WAAW,KAAK,YAAY,WAAW,OAAO,IAAI,IAAI;CAC5E,CAAC;;;;;;;;;;;;CAaD,aAA6B,QAAQ;EACnC,MAAM,GAAG,KAAK,IAAI;EAClB,OAAO,KAAK;EACZ,aAAa;EACb,KAAK,CACH,QAAQ,EAAE,aAAa,CAAC,WAAW,EAAE,CAAC,GACtC,MAAM,EACJ,SAAS;GACP,SAAS;GACT,QAAQ,CAAC,GAAG,MAAM;GAClB,WAAW;EACb,EACF,CAAC,CACH;EACA,QAAQ;GACN,QAAQ,EAAE,OAAO,EACf,IAAI,EAAE,KAAK,EACb,CAAC;GACD,UAAU,EAAE,KAAK;EACnB;EACA,SAAS,OAAO,EAAE,QAAQ,WAAW;GACnC,MAAM,OAAO,MAAM,KAAK,YAAY,YAAY,OAAO,EAAE;GACzD,MAAM,KAAK,WAAW,eAAe,MAAM,IAAI;GAC/C,OAAO,MAAM,KAAK,YAAY,WAAW,IAAI;EAC/C;CACF,CAAC;;;;;;;;;;;;;;;CAgBD,mBAAmC,QAAQ;EACzC,MAAM;EACN,OAAO,KAAK;EACZ,aAAa;EACb,KAAK,CACH,MAAM,EACJ,SAAS;GACP,QAAQ;GACR,QAAQ,CAAC,GAAG,MAAM;GAClB,WAAW;EACb,EACF,CAAC,CACH;EACA,QAAQ;GACN,QAAQ,EAAE,OAAO,EACf,IAAI,EAAE,KAAK,EACb,CAAC;GACD,UAAU,EAAE,KAAK;EACnB;EACA,SAAS,OAAO,EAAE,aAAa;GAC7B,MAAM,OAAO,MAAM,KAAK,YAAY,YAAY,OAAO,EAAE;GACzD,MAAM,KAAK,WAAW,aAAa,IAAI;GACvC,OAAO,MAAM,KAAK,YAAY,WAAW,IAAI;EAC/C;CACF,CAAC;AACH;;;AC1MA,IAAa,WAAb,MAAsB;CACpB,cAAiC,QAAQ,WAAW;CAEpD,aAA6B,WAAW;EACtC,MAAM;EACN,aAAa;EACb,MAAM;EACN,SAAS,YAAY;GACnB,MAAM,QAAQ,MAAM,KAAK,YAAY,iBAAiB;GAEtD,MAAM,QAAQ,IACZ,MAAM,KAAK,SAAS,KAAK,YAAY,WAAW,KAAK,EAAE,CAAC,CAC1D;EACF;CACF,CAAC;AACH;;;;;;;;;;;;;;AC8CA,MAAa,iBAAiB,QAAQ;CACpC,MAAM;CACN,UAAU;EACR;EACA;EACA;EACA;EACA;CACF;CACA,SAAS,CAAC,cAAc,gBAAgB;AAC1C,CAAC"}
+{"version":3,"file":"index.js","names":[],"sources":["../../../src/api/files/schemas/storageStatsSchema.ts","../../../src/api/files/entities/files.ts","../../../src/api/files/services/FileService.ts","../../../src/api/files/controllers/AdminFileStatsController.ts","../../../src/api/files/providers/FileAccessProvider.ts","../../../src/api/files/schemas/fileQuerySchema.ts","../../../src/api/files/schemas/fileCreatorSummarySchema.ts","../../../src/api/files/schemas/fileResourceSchema.ts","../../../src/api/files/controllers/FileController.ts","../../../src/api/files/jobs/FileJobs.ts","../../../src/api/files/index.ts"],"sourcesContent":["import type { Static } from \"alepha\";\nimport { z } from \"alepha\";\n\nexport const bucketStatsSchema = z.object({\n  bucket: z.string(),\n  totalSize: z.number(),\n  fileCount: z.number(),\n});\n\nexport const mimeTypeStatsSchema = z.object({\n  mimeType: z.string(),\n  fileCount: z.number(),\n});\n\nexport const storageStatsSchema = z.object({\n  totalSize: z.number(),\n  totalFiles: z.number(),\n  byBucket: z.array(bucketStatsSchema),\n  byMimeType: z.array(mimeTypeStatsSchema),\n});\n\nexport type BucketStats = Static<typeof bucketStatsSchema>;\nexport type MimeTypeStats = Static<typeof mimeTypeStatsSchema>;\nexport type StorageStats = Static<typeof storageStatsSchema>;\n","import { type Static, z } from \"alepha\";\nimport { $entity, db } from \"alepha/orm\";\n\nexport const files = $entity({\n  name: \"files\",\n  schema: z.object({\n    id: db.primaryKey(z.uuid()),\n    version: db.version(),\n    createdAt: db.createdAt(),\n    updatedAt: db.updatedAt(),\n    organizationId: db.organization(),\n    blobId: z.text(),\n    creator: z.uuid().optional(),\n    creatorRealm: z.string().optional(),\n    creatorName: z.string().optional(),\n    bucket: z.text(),\n    expirationDate: z.datetime().optional(),\n    /**\n     * Display name. Mutable via `FileService.updateFile` — can be renamed\n     * by callers (e.g. an Archive UI letting users rename uploaded blobs).\n     * Initialized to the uploader's filename at upload time. Use\n     * `originalName` if you need the as-uploaded filename after a rename.\n     */\n    name: z.text(),\n    /**\n     * Immutable record of the uploader's filename at upload time. Set once\n     * by `FileService.uploadFile` and the `bucket:file:uploaded` hook;\n     * `FileService.updateFile` never touches it. Useful for download\n     * headers (Content-Disposition), audit trails, and any UI that wants\n     * to show \"originally uploaded as X\" alongside a renamed file.\n     */\n    originalName: z.string().optional(),\n    size: z.number(),\n    mimeType: z.string(),\n    /**\n     * Free-form taxonomy. Normalized server-side (trim/lowercase/dedupe is\n     * caller's responsibility for now). Use with `FileQuery.tags` to\n     * filter via array-contains.\n     */\n    tags: z.array(z.text()).optional(),\n    /**\n     * SHA-256 hex digest of the file content (64 lowercase hex chars).\n     * Computed at upload time by `FileService.calculateChecksum`. Stable\n     * — never recomputed after upload. Use for integrity verification,\n     * content-based dedup, or downstream virus-scan correlation.\n     */\n    checksum: z.string().optional(),\n  }),\n  indexes: [\n    \"expirationDate\",\n    \"bucket\",\n    \"creator\",\n    \"createdAt\",\n    \"mimeType\",\n    {\n      columns: [\"bucket\", \"createdAt\"],\n    },\n  ],\n});\n\nexport type FileEntity = Static<typeof files.schema>;\n","import { createHash } from \"node:crypto\";\nimport { $hook, $inject, Alepha, type FileLike } from \"alepha\";\nimport {\n  $bucket,\n  type BucketPrimitive,\n  FileNotFoundError,\n} from \"alepha/bucket\";\nimport {\n  type DateTime,\n  DateTimeProvider,\n  type DurationLike,\n} from \"alepha/datetime\";\nimport { $logger } from \"alepha/logger\";\nimport { $repository, type Page, RepositoryProvider } from \"alepha/orm\";\nimport type { UserAccountToken } from \"alepha/security\";\nimport type { Ok } from \"alepha/server\";\nimport { NotFoundError } from \"alepha/server\";\nimport { FileSystemProvider } from \"alepha/system\";\nimport { type FileEntity, files } from \"../entities/files.ts\";\nimport type { FileQuery } from \"../schemas/fileQuerySchema.ts\";\nimport type { FileResource } from \"../schemas/fileResourceSchema.ts\";\nimport type { StorageStats } from \"../schemas/storageStatsSchema.ts\";\n\nexport class FileService {\n  protected readonly alepha = $inject(Alepha);\n  protected readonly log = $logger();\n  protected readonly dateTimeProvider = $inject(DateTimeProvider);\n  protected readonly repositoryProvider = $inject(RepositoryProvider);\n  protected readonly fileSystem = $inject(FileSystemProvider);\n  protected readonly defaultBucket = $bucket({ name: \"default\" });\n  public readonly fileRepository = $repository(files);\n\n  /**\n   * Best-effort left join embedding the uploader on every file row, so the\n   * admin UI can render `user.email` instead of the bare `creator` UUID.\n   * Joins `files.creator` → `users.id`. Only applied when the `users` table is\n   * actually registered in the app (see `findFiles`) — the files module stays\n   * usable standalone, without `alepha/api/users`. Targets the default `users`\n   * table, so creators in non-default realms come back unmatched (`user`\n   * undefined), which the UI handles by falling back to `creatorName`.\n   *\n   * The `users` entity is resolved from the repository registry at runtime\n   * rather than imported: the users module already depends on the files module\n   * (avatars), so a compile-time import here would form a circular dependency.\n   */\n  protected resolveCreatorJoin() {\n    const usersEntity = this.repositoryProvider\n      .getRepositories()\n      .find((repo) => repo.entity.name === \"users\")?.entity;\n    if (!usersEntity) {\n      return undefined;\n    }\n    return {\n      user: {\n        join: usersEntity,\n        on: [\"creator\", usersEntity.cols.id] as [\"creator\", { name: string }],\n      },\n    };\n  }\n\n  protected onUploadFile = $hook({\n    on: \"bucket:file:uploaded\",\n    handler: async ({ file, bucket, options, id }) => {\n      if (options.persist === false) {\n        return;\n      }\n\n      const checksum = await this.calculateChecksum(file);\n\n      await this.persistBlobMetadata(bucket, id, () =>\n        this.fileRepository.create({\n          blobId: id,\n          mimeType: file.type,\n          name: file.name,\n          originalName: file.name,\n          size: file.size,\n          creator: options.user?.id,\n          creatorRealm: options.user?.realm,\n          expirationDate: this.getExpirationDate(options.ttl),\n          bucket: bucket.name,\n          checksum,\n        }),\n      );\n    },\n  });\n\n  protected onDeleteBucketFile = $hook({\n    on: \"bucket:file:deleted\",\n    handler: async ({ bucket, id }) => {\n      await this.fileRepository.deleteMany({\n        blobId: { eq: id },\n        bucket: { eq: bucket.name },\n      });\n    },\n  });\n\n  // -------------------------------------------------------------------------------------------------------------------\n\n  /**\n   * Calculates SHA-256 checksum of a file.\n   *\n   * Reads the whole file into memory. Callers that already hold the bytes\n   * should use {@link hashBuffer} instead to avoid re-reading — re-reading a\n   * one-shot stream either yields the wrong hash or drains a stream another\n   * step still needs.\n   *\n   * @param file - The file to calculate checksum for\n   * @returns Hexadecimal string representation of the SHA-256 hash\n   * @protected\n   */\n  protected async calculateChecksum(file: FileLike): Promise<string> {\n    return this.hashBuffer(await file.arrayBuffer());\n  }\n\n  /**\n   * Calculates the SHA-256 checksum of an already-read body.\n   *\n   * @param data - The file bytes\n   * @returns Hexadecimal string representation of the SHA-256 hash\n   * @protected\n   */\n  protected hashBuffer(data: ArrayBuffer): string {\n    return createHash(\"sha256\").update(Buffer.from(data)).digest(\"hex\");\n  }\n\n  /**\n   * Gets a bucket primitive by name.\n   *\n   * @param bucketName - The name of the bucket to retrieve (defaults to \"default\")\n   * @returns The bucket primitive\n   * @throws {NotFoundError} If the bucket is not found\n   */\n  public bucket(bucketName: string = this.defaultBucket.name): BucketPrimitive {\n    const bucket = this.alepha\n      .primitives($bucket)\n      .find((it) => it.name === bucketName);\n\n    if (!bucket) {\n      throw new NotFoundError(`Bucket '${bucketName}' not found.`);\n    }\n\n    return bucket;\n  }\n\n  // -------------------------------------------------------------------------------------------------------------------\n\n  /**\n   * Finds files matching the given query criteria with pagination support.\n   * Supports filtering by bucket, tags, name, mimeType, creator, and date range.\n   *\n   * @param q - Query parameters including bucket, tags, name, mimeType, creator, date range, pagination, and sorting\n   * @returns Paginated list of file entities\n   */\n  public async findFiles(q: FileQuery = {}): Promise<Page<FileEntity>> {\n    q.sort ??= \"-createdAt\";\n\n    const where = this.fileRepository.createQueryWhere();\n\n    if (q.bucket) {\n      where.bucket = { eq: q.bucket };\n    }\n\n    if (q.tags) {\n      where.tags = { arrayContains: q.tags };\n    }\n\n    if (q.name) {\n      where.name = { ilike: `%${q.name}%` };\n    }\n\n    if (q.mimeType) {\n      where.mimeType = { eq: q.mimeType };\n    }\n\n    if (q.creator) {\n      where.creator = { eq: q.creator };\n    }\n\n    if (q.createdAfter && q.createdBefore) {\n      where.createdAt = {\n        gte: q.createdAfter,\n        lte: q.createdBefore,\n      };\n    } else if (q.createdAfter) {\n      where.createdAt = { gte: q.createdAfter };\n    } else if (q.createdBefore) {\n      where.createdAt = { lte: q.createdBefore };\n    }\n\n    // The creator join requires the `users` table. Only opt in when a users\n    // repository is registered (i.e. `alepha/api/users` is loaded) so the\n    // files module — and its standalone tests — keep working without it.\n    const withCreator = this.resolveCreatorJoin();\n\n    return await this.fileRepository\n      .paginate(\n        q,\n        { where, ...(withCreator ? { with: withCreator } : {}) },\n        { count: true },\n      )\n      .then((page) => {\n        return {\n          ...page,\n          content: page.content.map((it) => this.entityToResource(it)),\n        };\n      });\n  }\n\n  /**\n   * Finds files that have expired based on their expiration date.\n   * Limited to 1000 files per call to prevent memory issues.\n   *\n   * @returns Array of expired file entities\n   */\n  public async findExpiredFiles(): Promise<FileEntity[]> {\n    return await this.fileRepository.findMany({\n      limit: 1000,\n      where: {\n        expirationDate: { lte: this.dateTimeProvider.nowISOString() },\n      },\n    });\n  }\n\n  /**\n   * Calculates an expiration date based on a TTL (time to live) duration.\n   *\n   * @param ttl - Duration like \"1 day\", \"2 hours\", etc.\n   * @returns DateTime representation of the expiration date, or undefined if no TTL provided\n   * @protected\n   */\n  protected getExpirationDate(ttl?: DurationLike): string | undefined {\n    return ttl\n      ? this.dateTimeProvider\n          .now()\n          .add(this.dateTimeProvider.duration(ttl))\n          .toISOString()\n      : undefined;\n  }\n\n  /**\n   * Uploads a file to a bucket and creates a database record with metadata.\n   * Automatically calculates and stores the file checksum (SHA-256).\n   *\n   * @param file - The file to upload\n   * @param options - Upload options including bucket, expiration, user, and tags\n   * @param options.bucket - Target bucket name (defaults to \"default\")\n   * @param options.expirationDate - When the file should expire\n   * @param options.user - User performing the upload (for audit trail)\n   * @param options.tags - Tags to associate with the file\n   * @returns The created file entity with all metadata\n   * @throws {NotFoundError} If the specified bucket doesn't exist\n   */\n  public async uploadFile(\n    file: FileLike,\n    options: {\n      expirationDate?: string | DateTime;\n      bucket?: string;\n      user?: UserAccountToken;\n      tags?: string[];\n    } = {},\n  ): Promise<FileEntity> {\n    const bucket = this.bucket(options.bucket);\n\n    // Read the source exactly once. The checksum and the stored bytes are\n    // both derived from this single buffer, so a one-shot stream is never\n    // read twice — the previous code checksummed the file and then let\n    // bucket.upload read it again, which drained the stream and stored an\n    // empty blob. Uploads are size-capped (bucket maxSize / multipart\n    // limits), so buffering here is intentional and bounded.\n    const data = await file.arrayBuffer();\n    const checksum = this.hashBuffer(data);\n    file = this.fileSystem.createFile({\n      arrayBuffer: data,\n      name: file.name,\n      type: file.type,\n    });\n\n    const blobId = await bucket.upload(file, { persist: false });\n\n    let expirationDate: string | undefined;\n    if (options.expirationDate) {\n      expirationDate = this.dateTimeProvider\n        .of(options.expirationDate)\n        .toISOString();\n    } else if (bucket.options.ttl) {\n      expirationDate = this.getExpirationDate(bucket.options.ttl);\n    }\n\n    return await this.persistBlobMetadata(bucket, blobId, () =>\n      this.fileRepository.create({\n        blobId: blobId,\n        mimeType: file.type,\n        name: file.name,\n        originalName: file.name,\n        size: file.size,\n        creator: options.user?.id,\n        creatorRealm: options.user?.realm,\n        creatorName: options.user?.name,\n        expirationDate,\n        bucket: bucket.name,\n        tags: options.tags,\n        checksum,\n      }),\n    );\n  }\n\n  /**\n   * Persists the metadata row for an already-uploaded blob, deleting the\n   * blob if the insert fails. Uploads are not atomic: the blob is written to\n   * storage first (the row needs the returned `blobId`), so a failed insert\n   * would otherwise leak the blob — an orphaned blob with no DB row. This\n   * compensates by removing the blob, favouring the recoverable failure\n   * (a missing blob) over the worse one (a row pointing at nothing).\n   *\n   * Best-effort: cleanup runs with `skipHook` so it neither re-emits\n   * `bucket:file:deleted` nor touches the (non-existent) DB row, and a failed\n   * cleanup is logged rather than thrown. The original write error is always\n   * rethrown so callers still see the real failure.\n   *\n   * @param bucket - The bucket the blob was uploaded to\n   * @param blobId - The id returned by `bucket.upload`\n   * @param insert - Thunk performing the metadata insert\n   * @returns The created file entity\n   */\n  protected async persistBlobMetadata(\n    bucket: BucketPrimitive,\n    blobId: string,\n    insert: () => Promise<FileEntity>,\n  ): Promise<FileEntity> {\n    try {\n      return await insert();\n    } catch (error) {\n      await bucket.delete(blobId, true).catch((cleanupError) => {\n        this.log.warn(\n          `Failed to remove orphaned blob ${blobId} from bucket ${bucket.name} after a metadata write failure`,\n          cleanupError,\n        );\n      });\n      throw error;\n    }\n  }\n\n  /**\n   * Streams a file from storage by its database ID, or directly from an\n   * already-loaded `FileEntity` to avoid a duplicate DB roundtrip when the\n   * caller has already fetched the row (e.g. after an access check).\n   *\n   * @param id - The database ID (UUID) of the file, or the entity itself\n   * @returns The file object ready for streaming/downloading\n   * @throws {NotFoundError} If the file doesn't exist in the database\n   * @throws {FileNotFoundError} If the file exists in database but not in storage\n   */\n  public async streamFile(id: string | FileEntity): Promise<FileLike> {\n    const entity = await this.getFileById(id);\n    const bucket = this.bucket(entity.bucket);\n\n    return await bucket.download(entity.blobId);\n  }\n\n  /**\n   * Updates file metadata (name, tags, expiration date).\n   * Does not modify the actual file content in storage.\n   *\n   * @param id - The database ID (UUID) of the file to update\n   * @param data - Partial file data to update\n   * @param data.name - New file name\n   * @param data.tags - New tags array\n   * @param data.expirationDate - New expiration date\n   * @returns The updated file entity\n   * @throws {NotFoundError} If the file doesn't exist in the database\n   */\n  public async updateFile(\n    id: string,\n    data: {\n      name?: string;\n      tags?: string[];\n      expirationDate?: DateTime | string;\n    },\n  ): Promise<FileEntity> {\n    const file = await this.getFileById(id);\n\n    const updateData: Partial<FileEntity> = {};\n\n    if (data.name !== undefined) {\n      updateData.name = data.name;\n    }\n\n    if (data.tags !== undefined) {\n      updateData.tags = data.tags;\n    }\n\n    if (data.expirationDate !== undefined) {\n      updateData.expirationDate = this.dateTimeProvider\n        .of(data.expirationDate)\n        .toISOString();\n    }\n\n    return await this.fileRepository.updateById(file.id, updateData);\n  }\n\n  /**\n   * Deletes a file from both storage and database.\n   * Handles cases where file is already deleted from storage gracefully.\n   * Always ensures database record is removed even if storage deletion fails.\n   *\n   * @param id - The database ID (UUID) of the file to delete\n   * @returns Success response with the deleted file ID\n   * @throws {NotFoundError} If the file doesn't exist in the database\n   */\n  public async deleteFile(id: string): Promise<Ok> {\n    const file = await this.getFileById(id);\n    const bucket = this.bucket(file.bucket);\n\n    // Always delete the database record\n    await this.fileRepository.deleteById(file.id);\n\n    try {\n      await bucket.delete(file.blobId, true);\n    } catch (e) {\n      if (e instanceof FileNotFoundError) {\n        // File is already deleted in the bucket, this is okay\n        this.log.debug(\n          `File ${file.blobId} not found in bucket ${bucket.name}, cleaning up database record`,\n        );\n      } else {\n        // Other errors (permission, network, etc.) - log but continue to clean up database\n        this.log.warn(\n          `Failed to delete file ${file.blobId} from bucket ${bucket.name}`,\n          e,\n        );\n      }\n    }\n\n    return { ok: true, id: String(file.id) };\n  }\n\n  /**\n   * Delete many files in one round-trip per bucket. The database rows are\n   * removed in a single `deleteMany`, and each affected bucket gets a single\n   * `bucket.deleteMany` call (R2/S3 batch where supported).\n   */\n  public async deleteFiles(ids: string[]): Promise<string[]> {\n    if (ids.length === 0) return [];\n\n    const files = await this.fileRepository.findMany({\n      where: { id: { inArray: ids } },\n      columns: [\"id\", \"bucket\", \"blobId\"],\n    });\n    if (files.length === 0) return [];\n\n    const dbDeleted = await this.fileRepository.deleteMany({\n      id: { inArray: files.map((f) => f.id) },\n    });\n\n    const blobsByBucket = new Map<string, string[]>();\n    for (const f of files) {\n      const list = blobsByBucket.get(f.bucket) ?? [];\n      list.push(f.blobId);\n      blobsByBucket.set(f.bucket, list);\n    }\n\n    for (const [bucketName, blobIds] of blobsByBucket) {\n      try {\n        await this.bucket(bucketName).deleteMany(blobIds, true);\n      } catch (e) {\n        // DB rows already gone — log and continue. Orphaned blobs are\n        // recoverable; orphaned DB rows would be worse.\n        this.log.warn(\n          `Failed to bulk-delete ${blobIds.length} files from bucket ${bucketName}`,\n          e,\n        );\n      }\n    }\n\n    return dbDeleted.map(String);\n  }\n\n  /**\n   * Retrieves a file entity by its ID.\n   * If already an entity object, returns it as-is (convenience method).\n   *\n   * @param id - Either a UUID string or an existing FileEntity object\n   * @returns The file entity\n   * @throws {NotFoundError} If the file doesn't exist in the database\n   */\n  public async getFileById(id: string | FileEntity): Promise<FileEntity> {\n    if (typeof id === \"object\") {\n      return id;\n    }\n\n    return await this.fileRepository.getById(id);\n  }\n\n  /**\n   * Gets storage statistics including total size, file count, and breakdowns by bucket and MIME type.\n   *\n   * Aggregated in SQL (`SUM`/`COUNT` + `GROUP BY`) rather than by loading\n   * every row into memory — the table can hold millions of files, and this\n   * endpoint must stay O(groups), not O(rows). Totals are derived from the\n   * per-bucket groups (every row has exactly one bucket), so no extra query\n   * is needed.\n   *\n   * @returns Storage statistics with aggregated data\n   */\n  public async getStorageStats(): Promise<StorageStats> {\n    const [byBucketRows, byMimeTypeRows] = await Promise.all([\n      this.fileRepository.aggregate({\n        select: { bucket: true, size: { sum: true, count: true } },\n        groupBy: [\"bucket\"],\n      }),\n      this.fileRepository.aggregate({\n        select: { mimeType: true, size: { count: true } },\n        groupBy: [\"mimeType\"],\n      }),\n    ]);\n\n    const byBucket = byBucketRows.map((row) => ({\n      bucket: row.bucket,\n      totalSize: row.size.sum,\n      fileCount: row.size.count,\n    }));\n\n    const byMimeType = byMimeTypeRows.map((row) => ({\n      mimeType: row.mimeType,\n      fileCount: row.size.count,\n    }));\n\n    return {\n      totalSize: byBucket.reduce((sum, b) => sum + b.totalSize, 0),\n      totalFiles: byBucket.reduce((sum, b) => sum + b.fileCount, 0),\n      byBucket,\n      byMimeType,\n    };\n  }\n\n  /**\n   * Converts a file entity to a file resource (API response format).\n   * Currently a pass-through, but allows for future transformation logic.\n   *\n   * @param entity - The file entity to convert\n   * @returns The file resource for API responses\n   */\n  public entityToResource(entity: FileEntity): FileResource {\n    return entity;\n  }\n}\n","import { $inject } from \"alepha\";\nimport { $secure } from \"alepha/security\";\nimport { $action } from \"alepha/server\";\nimport { storageStatsSchema } from \"../schemas/storageStatsSchema.ts\";\nimport { FileService } from \"../services/FileService.ts\";\n\n/**\n * REST API controller for storage analytics and statistics.\n * Provides endpoints for viewing storage usage metrics.\n */\nexport class AdminFileStatsController {\n  protected readonly url = \"/files/stats\";\n  protected readonly group = \"admin:files\";\n  protected readonly fileService = $inject(FileService);\n\n  /**\n   * GET /files/stats - Gets storage statistics.\n   * Returns aggregated data including total size, file count,\n   * and breakdowns by bucket and MIME type.\n   */\n  public readonly getFileStats = $action({\n    path: this.url,\n    group: this.group,\n    use: [$secure({ permissions: [\"admin:file:read\"] })],\n    description: \"Get storage statistics\",\n    schema: {\n      response: storageStatsSchema,\n    },\n    handler: () => this.fileService.getStorageStats(),\n  });\n}\n","import type { UserAccountToken } from \"alepha/security\";\nimport { ForbiddenError, NotFoundError } from \"alepha/server\";\nimport type { FileEntity } from \"../entities/files.ts\";\n\n/**\n * Authorization policy for file reads served through `FileController.streamFile`.\n *\n * Default: the caller must be the uploader (`file.creator === user.id`). Any\n * other access path — public buckets, shared attachments, avatars — must be\n * opted in by overriding this provider in the consuming app:\n *\n * ```ts\n * class MyAccess extends FileAccessProvider {\n *   async assertReadable(file, user) {\n *     if (file.bucket === \"avatars\") return; // public\n *     if (file.bucket === \"campaign-icons\") return this.checkCampaignVisible(file, user);\n *     return super.assertReadable(file, user);\n *   }\n * }\n * Alepha.create().with({ provide: FileAccessProvider, use: MyAccess });\n * ```\n *\n * Why this exists: prior to introducing this gate, `streamFile` only required\n * the framework-wide `file:read` permission. The default `user` role grants\n * `*`, so every authenticated user could download any file by UUID — turning\n * the 128-bit id into the sole security boundary across tenants.\n */\nexport class FileAccessProvider {\n  /**\n   * Throws `ForbiddenError` when `user` may not read `file`. Override to\n   * implement bucket-aware or relationship-aware policies. The default\n   * implementation is strict: only the uploader passes.\n   */\n  async assertReadable(\n    file: FileEntity,\n    user: UserAccountToken | undefined,\n  ): Promise<void> {\n    if (!user) {\n      throw new ForbiddenError(\"File access requires authentication\");\n    }\n    // Privileged identities (admin without narrow ownership scope) bypass\n    // the per-file check — they need to be able to read any file via the\n    // admin UI/inspector regardless of who uploaded it.\n    if (user.ownership === false) {\n      return;\n    }\n    if (file.creator && file.creator === user.id) {\n      return;\n    }\n    throw new ForbiddenError(\"File access denied\");\n  }\n\n  /**\n   * Throws when `file` may not be served through the anonymous\n   * `/public/files/:id` route. The default is deny-all: nothing is public\n   * unless this method is overridden. Throws `NotFoundError` (not 403) so the\n   * endpoint doesn't leak the existence of private file ids.\n   *\n   * Typical override matches on bucket name:\n   *\n   * ```ts\n   * class MyAccess extends FileAccessProvider {\n   *   async assertPublic(file) {\n   *     if (file.bucket === \"avatars\") return;\n   *     if (file.bucket === \"campaign-icons\") return;\n   *     return super.assertPublic(file);\n   *   }\n   * }\n   * ```\n   */\n  async assertPublic(file: FileEntity): Promise<void> {\n    throw new NotFoundError(`File '${file.id}' not found`);\n  }\n}\n","import type { Static } from \"alepha\";\nimport { z } from \"alepha\";\nimport { pageQuerySchema } from \"alepha/orm\";\n\nexport const fileQuerySchema = pageQuerySchema.extend({\n  bucket: z.string().optional(),\n  tags: z.array(z.string()).optional(),\n  name: z.string().optional(),\n  mimeType: z.string().optional(),\n  creator: z.uuid().optional(),\n  createdAfter: z.datetime().optional(),\n  createdBefore: z.datetime().optional(),\n});\n\nexport type FileQuery = Static<typeof fileQuerySchema>;\n","import { type Static, z } from \"alepha\";\n\n/**\n * Slim view of a file's uploader, embedded by the admin listing via a\n * best-effort left join (`files.creator` → `users.id`) so the UI can render\n * a human-readable identifier instead of a bare UUID.\n *\n * Optional end-to-end: the join only runs when the `users` entity is\n * registered in the running app (see `FileService.findFiles`), and even then\n * a file whose creator was deleted — or who lives in a non-default realm —\n * comes back with `user` undefined. Callers must fall back to `creatorName`\n * or the raw `creator` id.\n */\nexport const fileCreatorSummarySchema = z.object({\n  id: z.uuid(),\n  email: z.string().meta({ format: \"email\" }).optional(),\n  username: z.shortText({ minLength: 3, maxLength: 30 }).optional(),\n  firstName: z.string().optional(),\n  lastName: z.string().optional(),\n});\n\nexport type FileCreatorSummary = Static<typeof fileCreatorSummarySchema>;\n","import type { Static } from \"alepha\";\nimport { files } from \"../entities/files.ts\";\nimport { fileCreatorSummarySchema } from \"./fileCreatorSummarySchema.ts\";\n\nexport const fileResourceSchema = files.schema\n  .extend({\n    /**\n     * Uploader summary, embedded by the admin listing via a best-effort\n     * left join. Optional — see `fileCreatorSummarySchema`. Distinct from\n     * the denormalized `creatorName`, which is set only on direct uploads\n     * and never carries an email.\n     */\n    user: fileCreatorSummarySchema.optional(),\n  })\n  .meta({\n    title: \"FileResource\",\n    description: \"A file resource representing a file stored in the system.\",\n  });\n\nexport type FileResource = Static<typeof fileResourceSchema>;\n","import { $inject, z } from \"alepha\";\nimport { $secure } from \"alepha/security\";\nimport { $action, okSchema } from \"alepha/server\";\nimport { $etag } from \"alepha/server/etag\";\nimport { FileAccessProvider } from \"../providers/FileAccessProvider.ts\";\nimport { fileQuerySchema } from \"../schemas/fileQuerySchema.ts\";\nimport { fileResourceSchema } from \"../schemas/fileResourceSchema.ts\";\nimport { FileService } from \"../services/FileService.ts\";\n\n/**\n * REST API controller for file management operations.\n * Provides endpoints for uploading, downloading, listing, and deleting files.\n */\nexport class FileController {\n  protected readonly url = \"/files\";\n  protected readonly group = \"files\";\n  protected readonly fileService = $inject(FileService);\n  protected readonly fileAccess = $inject(FileAccessProvider);\n\n  /**\n   * GET /files - Lists files with optional filtering and pagination.\n   * Supports filtering by bucket and tags.\n   */\n  public readonly findFiles = $action({\n    path: this.url,\n    group: `admin:${this.group}`,\n    use: [$secure({ permissions: [\"admin:file:read\"] })],\n    description: \"List files with filtering and pagination\",\n    schema: {\n      query: fileQuerySchema,\n      response: z.page(fileResourceSchema),\n    },\n    handler: ({ query }) => this.fileService.findFiles(query),\n  });\n\n  /**\n   * DELETE /files/:id - Deletes a file from both storage and database.\n   * Removes the file from the bucket and cleans up the database record.\n   */\n  public readonly deleteFile = $action({\n    method: \"DELETE\",\n    path: `${this.url}/:id`,\n    group: `admin:${this.group}`,\n    use: [$secure({ permissions: [\"admin:file:delete\"] })],\n    description: \"Delete a file\",\n    schema: {\n      params: z.object({\n        id: z.uuid(),\n      }),\n      response: okSchema,\n    },\n    handler: ({ params }) => this.fileService.deleteFile(params.id),\n  });\n\n  /**\n   * POST /files/delete - Delete many files in one request, batching the\n   * underlying bucket calls per bucket (R2/S3 batch where supported).\n   */\n  public readonly deleteFiles = $action({\n    method: \"POST\",\n    path: `${this.url}/delete`,\n    group: `admin:${this.group}`,\n    use: [$secure({ permissions: [\"admin:file:delete\"] })],\n    description: \"Delete many files\",\n    schema: {\n      body: z.object({\n        ids: z.array(z.uuid()).min(1).max(1000),\n      }),\n      response: z.object({\n        deleted: z.array(z.string()),\n      }),\n    },\n    handler: async ({ body }) => {\n      const deleted = await this.fileService.deleteFiles(body.ids);\n      return { deleted };\n    },\n  });\n\n  /**\n   * POST /files - Uploads a new file to storage.\n   * Creates a database record with metadata and calculates checksum.\n   * Optionally specify bucket and expiration date.\n   */\n  public readonly uploadFile = $action({\n    path: this.url,\n    group: this.group,\n    use: [$secure({ permissions: [\"file:create\"] })],\n    description: \"Upload a new file\",\n    schema: {\n      body: z.object({\n        file: z.file(),\n      }),\n      query: z.object({\n        expirationDate: z.datetime().optional(),\n        bucket: z.string().optional(),\n      }),\n      response: fileResourceSchema,\n    },\n    handler: async ({ body, user, query }) =>\n      this.fileService.uploadFile(body.file, {\n        user,\n        ...query,\n      }),\n  });\n\n  /**\n   * PATCH /files/:id - Updates file metadata.\n   * Allows updating name, tags, and expiration date without modifying file content.\n   */\n  public readonly updateFile = $action({\n    method: \"PATCH\",\n    path: `${this.url}/:id`,\n    group: `admin:${this.group}`,\n    use: [$secure({ permissions: [\"admin:file:update\"] })],\n    description: \"Update file metadata\",\n    schema: {\n      params: z.object({\n        id: z.uuid(),\n      }),\n      body: z.object({\n        name: z.string().optional(),\n        tags: z.array(z.string()).optional(),\n        expirationDate: z.datetime().optional(),\n      }),\n      response: fileResourceSchema,\n    },\n    handler: ({ params, body }) => this.fileService.updateFile(params.id, body),\n  });\n\n  /**\n   * GET /files/:id - Streams/downloads a file by its ID.\n   * Returns the file content with appropriate Content-Type header.\n   *\n   * Authorization is delegated to `FileAccessProvider.assertReadable`. The\n   * default policy is creator-only — override the provider via DI to widen\n   * access (e.g. avatars, shared attachments). See `FileAccessProvider`.\n   *\n   * Cache-Control is `private` because the per-user authorization decision\n   * cannot be cached by shared proxies/CDNs. Client-side ETag still works.\n   */\n  public readonly streamFile = $action({\n    path: `${this.url}/:id`,\n    group: this.group,\n    description: \"Download a file\",\n    use: [\n      $secure({ permissions: [\"file:read\"] }),\n      $etag({\n        control: {\n          private: true,\n          maxAge: [1, \"year\"],\n          immutable: true,\n        },\n      }),\n    ],\n    schema: {\n      params: z.object({\n        id: z.uuid(),\n      }),\n      response: z.file(),\n    },\n    handler: async ({ params, user }) => {\n      const file = await this.fileService.getFileById(params.id);\n      await this.fileAccess.assertReadable(file, user);\n      return await this.fileService.streamFile(file);\n    },\n  });\n\n  /**\n   * GET /public/files/:id - Anonymous, edge-cacheable download.\n   *\n   * Authorization is delegated to `FileAccessProvider.assertPublic`. The\n   * default policy is deny-all (throws `NotFoundError`), so consuming apps\n   * must override the provider to opt files in — typically by bucket name\n   * (avatars, campaign icons, etc.).\n   *\n   * Cache-Control is `public, immutable, max-age=1y` so Cloudflare's edge\n   * cache and any intermediary proxy can serve subsequent hits without\n   * touching the Worker. The split URL prefix (vs `/files/:id`) is what\n   * makes this safe: edge cache is URL-keyed, so public and private files\n   * live in separate cache lanes.\n   */\n  public readonly streamPublicFile = $action({\n    path: \"/public/files/:id\",\n    group: this.group,\n    description: \"Download a public file (anonymous, edge-cacheable)\",\n    use: [\n      $etag({\n        control: {\n          public: true,\n          maxAge: [1, \"year\"],\n          immutable: true,\n        },\n      }),\n    ],\n    schema: {\n      params: z.object({\n        id: z.uuid(),\n      }),\n      response: z.file(),\n    },\n    handler: async ({ params }) => {\n      const file = await this.fileService.getFileById(params.id);\n      await this.fileAccess.assertPublic(file);\n      return await this.fileService.streamFile(file);\n    },\n  });\n}\n","import { $inject } from \"alepha\";\nimport { $scheduler } from \"alepha/scheduler\";\nimport { FileService } from \"../services/FileService.ts\";\n\nexport class FileJobs {\n  protected readonly fileService = $inject(FileService);\n\n  public readonly purgeFiles = $scheduler({\n    name: \"api:files:purgeFiles\",\n    description: \"Purge files that are marked for deletion\",\n    cron: \"0 * * * *\", // Hourly at minute 0\n    handler: async () => {\n      const files = await this.fileService.findExpiredFiles();\n\n      await Promise.all(\n        files.map((file) => this.fileService.deleteFile(file.id)),\n      );\n    },\n  });\n}\n","import { $module } from \"alepha\";\nimport { AlephaBucket } from \"alepha/bucket\";\nimport type { DurationLike } from \"alepha/datetime\";\nimport type { UserAccountToken } from \"alepha/security\";\nimport { AlephaServerEtag } from \"alepha/server/etag\";\nimport { AdminFileStatsController } from \"./controllers/AdminFileStatsController.ts\";\nimport { FileController } from \"./controllers/FileController.ts\";\nimport { FileJobs } from \"./jobs/FileJobs.ts\";\nimport { FileAccessProvider } from \"./providers/FileAccessProvider.ts\";\nimport { FileService } from \"./services/FileService.ts\";\n\n// ---------------------------------------------------------------------------------------------------------------------\n\nexport * from \"./controllers/AdminFileStatsController.ts\";\nexport * from \"./controllers/FileController.ts\";\nexport * from \"./entities/files.ts\";\nexport * from \"./jobs/FileJobs.ts\";\nexport * from \"./providers/FileAccessProvider.ts\";\nexport * from \"./schemas/fileCreatorSummarySchema.ts\";\nexport * from \"./schemas/fileQuerySchema.ts\";\nexport * from \"./schemas/fileResourceSchema.ts\";\nexport * from \"./schemas/storageStatsSchema.ts\";\nexport * from \"./services/FileService.ts\";\n\n// ---------------------------------------------------------------------------------------------------------------------\n\ndeclare module \"alepha/bucket\" {\n  interface BucketFileOptions {\n    /**\n     * Time to live for the files in the bucket.\n     */\n    ttl?: DurationLike;\n\n    /**\n     * Tags for the bucket.\n     */\n    tags?: string[];\n\n    /**\n     * User performing the operation.\n     */\n    user?: UserAccountToken;\n\n    /**\n     * Whether to persist the file metadata in the database.\n     *\n     * @default true\n     */\n    persist?: boolean;\n  }\n}\n\n// ---------------------------------------------------------------------------------------------------------------------\n\n/**\n * File management endpoints.\n *\n * **Features:**\n * - Upload/download endpoints\n * - File metadata storage\n * - TTL-based expiration\n * - Storage statistics\n *\n * @module alepha.api.files\n */\nexport const AlephaApiFiles = $module({\n  name: \"alepha.api.files\",\n  services: [\n    FileController,\n    AdminFileStatsController,\n    FileJobs,\n    FileService,\n    FileAccessProvider,\n  ],\n  imports: [AlephaBucket, AlephaServerEtag],\n});\n"],"mappings":";;;;;;;;;;;;AAGA,MAAa,oBAAoB,EAAE,OAAO;CACxC,QAAQ,EAAE,OAAO;CACjB,WAAW,EAAE,OAAO;CACpB,WAAW,EAAE,OAAO;AACtB,CAAC;AAED,MAAa,sBAAsB,EAAE,OAAO;CAC1C,UAAU,EAAE,OAAO;CACnB,WAAW,EAAE,OAAO;AACtB,CAAC;AAED,MAAa,qBAAqB,EAAE,OAAO;CACzC,WAAW,EAAE,OAAO;CACpB,YAAY,EAAE,OAAO;CACrB,UAAU,EAAE,MAAM,iBAAiB;CACnC,YAAY,EAAE,MAAM,mBAAmB;AACzC,CAAC;;;AChBD,MAAa,QAAQ,QAAQ;CAC3B,MAAM;CACN,QAAQ,EAAE,OAAO;EACf,IAAI,GAAG,WAAW,EAAE,KAAK,CAAC;EAC1B,SAAS,GAAG,QAAQ;EACpB,WAAW,GAAG,UAAU;EACxB,WAAW,GAAG,UAAU;EACxB,gBAAgB,GAAG,aAAa;EAChC,QAAQ,EAAE,KAAK;EACf,SAAS,EAAE,KAAK,CAAC,CAAC,SAAS;EAC3B,cAAc,EAAE,OAAO,CAAC,CAAC,SAAS;EAClC,aAAa,EAAE,OAAO,CAAC,CAAC,SAAS;EACjC,QAAQ,EAAE,KAAK;EACf,gBAAgB,EAAE,SAAS,CAAC,CAAC,SAAS;;;;;;;EAOtC,MAAM,EAAE,KAAK;;;;;;;;EAQb,cAAc,EAAE,OAAO,CAAC,CAAC,SAAS;EAClC,MAAM,EAAE,OAAO;EACf,UAAU,EAAE,OAAO;;;;;;EAMnB,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,SAAS;;;;;;;EAOjC,UAAU,EAAE,OAAO,CAAC,CAAC,SAAS;CAChC,CAAC;CACD,SAAS;EACP;EACA;EACA;EACA;EACA;EACA,EACE,SAAS,CAAC,UAAU,WAAW,EACjC;CACF;AACF,CAAC;;;ACnCD,IAAa,cAAb,MAAyB;CACvB,SAA4B,QAAQ,MAAM;CAC1C,MAAyB,QAAQ;CACjC,mBAAsC,QAAQ,gBAAgB;CAC9D,qBAAwC,QAAQ,kBAAkB;CAClE,aAAgC,QAAQ,kBAAkB;CAC1D,gBAAmC,QAAQ,EAAE,MAAM,UAAU,CAAC;CAC9D,iBAAiC,YAAY,KAAK;;;;;;;;;;;;;;CAelD,qBAA+B;EAC7B,MAAM,cAAc,KAAK,mBACtB,gBAAgB,CAAC,CACjB,MAAM,SAAS,KAAK,OAAO,SAAS,OAAO,CAAC,EAAE;EACjD,IAAI,CAAC,aACH;EAEF,OAAO,EACL,MAAM;GACJ,MAAM;GACN,IAAI,CAAC,WAAW,YAAY,KAAK,EAAE;EACrC,EACF;CACF;CAEA,eAAyB,MAAM;EAC7B,IAAI;EACJ,SAAS,OAAO,EAAE,MAAM,QAAQ,SAAS,SAAS;GAChD,IAAI,QAAQ,YAAY,OACtB;GAGF,MAAM,WAAW,MAAM,KAAK,kBAAkB,IAAI;GAElD,MAAM,KAAK,oBAAoB,QAAQ,UACrC,KAAK,eAAe,OAAO;IACzB,QAAQ;IACR,UAAU,KAAK;IACf,MAAM,KAAK;IACX,cAAc,KAAK;IACnB,MAAM,KAAK;IACX,SAAS,QAAQ,MAAM;IACvB,cAAc,QAAQ,MAAM;IAC5B,gBAAgB,KAAK,kBAAkB,QAAQ,GAAG;IAClD,QAAQ,OAAO;IACf;GACF,CAAC,CACH;EACF;CACF,CAAC;CAED,qBAA+B,MAAM;EACnC,IAAI;EACJ,SAAS,OAAO,EAAE,QAAQ,SAAS;GACjC,MAAM,KAAK,eAAe,WAAW;IACnC,QAAQ,EAAE,IAAI,GAAG;IACjB,QAAQ,EAAE,IAAI,OAAO,KAAK;GAC5B,CAAC;EACH;CACF,CAAC;;;;;;;;;;;;;CAgBD,MAAgB,kBAAkB,MAAiC;EACjE,OAAO,KAAK,WAAW,MAAM,KAAK,YAAY,CAAC;CACjD;;;;;;;;CASA,WAAqB,MAA2B;EAC9C,OAAO,WAAW,QAAQ,CAAC,CAAC,OAAO,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,OAAO,KAAK;CACpE;;;;;;;;CASA,OAAc,aAAqB,KAAK,cAAc,MAAuB;EAC3E,MAAM,SAAS,KAAK,OACjB,WAAW,OAAO,CAAC,CACnB,MAAM,OAAO,GAAG,SAAS,UAAU;EAEtC,IAAI,CAAC,QACH,MAAM,IAAI,cAAc,WAAW,WAAW,aAAa;EAG7D,OAAO;CACT;;;;;;;;CAWA,MAAa,UAAU,IAAe,CAAC,GAA8B;EACnE,EAAE,SAAS;EAEX,MAAM,QAAQ,KAAK,eAAe,iBAAiB;EAEnD,IAAI,EAAE,QACJ,MAAM,SAAS,EAAE,IAAI,EAAE,OAAO;EAGhC,IAAI,EAAE,MACJ,MAAM,OAAO,EAAE,eAAe,EAAE,KAAK;EAGvC,IAAI,EAAE,MACJ,MAAM,OAAO,EAAE,OAAO,IAAI,EAAE,KAAK,GAAG;EAGtC,IAAI,EAAE,UACJ,MAAM,WAAW,EAAE,IAAI,EAAE,SAAS;EAGpC,IAAI,EAAE,SACJ,MAAM,UAAU,EAAE,IAAI,EAAE,QAAQ;EAGlC,IAAI,EAAE,gBAAgB,EAAE,eACtB,MAAM,YAAY;GAChB,KAAK,EAAE;GACP,KAAK,EAAE;EACT;OACK,IAAI,EAAE,cACX,MAAM,YAAY,EAAE,KAAK,EAAE,aAAa;OACnC,IAAI,EAAE,eACX,MAAM,YAAY,EAAE,KAAK,EAAE,cAAc;EAM3C,MAAM,cAAc,KAAK,mBAAmB;EAE5C,OAAO,MAAM,KAAK,eACf,SACC,GACA;GAAE;GAAO,GAAI,cAAc,EAAE,MAAM,YAAY,IAAI,CAAC;EAAG,GACvD,EAAE,OAAO,KAAK,CAChB,CAAC,CACA,MAAM,SAAS;GACd,OAAO;IACL,GAAG;IACH,SAAS,KAAK,QAAQ,KAAK,OAAO,KAAK,iBAAiB,EAAE,CAAC;GAC7D;EACF,CAAC;CACL;;;;;;;CAQA,MAAa,mBAA0C;EACrD,OAAO,MAAM,KAAK,eAAe,SAAS;GACxC,OAAO;GACP,OAAO,EACL,gBAAgB,EAAE,KAAK,KAAK,iBAAiB,aAAa,EAAE,EAC9D;EACF,CAAC;CACH;;;;;;;;CASA,kBAA4B,KAAwC;EAClE,OAAO,MACH,KAAK,iBACF,IAAI,CAAC,CACL,IAAI,KAAK,iBAAiB,SAAS,GAAG,CAAC,CAAC,CACxC,YAAY,IACf,KAAA;CACN;;;;;;;;;;;;;;CAeA,MAAa,WACX,MACA,UAKI,CAAC,GACgB;EACrB,MAAM,SAAS,KAAK,OAAO,QAAQ,MAAM;EAQzC,MAAM,OAAO,MAAM,KAAK,YAAY;EACpC,MAAM,WAAW,KAAK,WAAW,IAAI;EACrC,OAAO,KAAK,WAAW,WAAW;GAChC,aAAa;GACb,MAAM,KAAK;GACX,MAAM,KAAK;EACb,CAAC;EAED,MAAM,SAAS,MAAM,OAAO,OAAO,MAAM,EAAE,SAAS,MAAM,CAAC;EAE3D,IAAI;EACJ,IAAI,QAAQ,gBACV,iBAAiB,KAAK,iBACnB,GAAG,QAAQ,cAAc,CAAC,CAC1B,YAAY;OACV,IAAI,OAAO,QAAQ,KACxB,iBAAiB,KAAK,kBAAkB,OAAO,QAAQ,GAAG;EAG5D,OAAO,MAAM,KAAK,oBAAoB,QAAQ,cAC5C,KAAK,eAAe,OAAO;GACjB;GACR,UAAU,KAAK;GACf,MAAM,KAAK;GACX,cAAc,KAAK;GACnB,MAAM,KAAK;GACX,SAAS,QAAQ,MAAM;GACvB,cAAc,QAAQ,MAAM;GAC5B,aAAa,QAAQ,MAAM;GAC3B;GACA,QAAQ,OAAO;GACf,MAAM,QAAQ;GACd;EACF,CAAC,CACH;CACF;;;;;;;;;;;;;;;;;;;CAoBA,MAAgB,oBACd,QACA,QACA,QACqB;EACrB,IAAI;GACF,OAAO,MAAM,OAAO;EACtB,SAAS,OAAO;GACd,MAAM,OAAO,OAAO,QAAQ,IAAI,CAAC,CAAC,OAAO,iBAAiB;IACxD,KAAK,IAAI,KACP,kCAAkC,OAAO,eAAe,OAAO,KAAK,kCACpE,YACF;GACF,CAAC;GACD,MAAM;EACR;CACF;;;;;;;;;;;CAYA,MAAa,WAAW,IAA4C;EAClE,MAAM,SAAS,MAAM,KAAK,YAAY,EAAE;EAGxC,OAAO,MAFQ,KAAK,OAAO,OAAO,MAEhB,CAAC,CAAC,SAAS,OAAO,MAAM;CAC5C;;;;;;;;;;;;;CAcA,MAAa,WACX,IACA,MAKqB;EACrB,MAAM,OAAO,MAAM,KAAK,YAAY,EAAE;EAEtC,MAAM,aAAkC,CAAC;EAEzC,IAAI,KAAK,SAAS,KAAA,GAChB,WAAW,OAAO,KAAK;EAGzB,IAAI,KAAK,SAAS,KAAA,GAChB,WAAW,OAAO,KAAK;EAGzB,IAAI,KAAK,mBAAmB,KAAA,GAC1B,WAAW,iBAAiB,KAAK,iBAC9B,GAAG,KAAK,cAAc,CAAC,CACvB,YAAY;EAGjB,OAAO,MAAM,KAAK,eAAe,WAAW,KAAK,IAAI,UAAU;CACjE;;;;;;;;;;CAWA,MAAa,WAAW,IAAyB;EAC/C,MAAM,OAAO,MAAM,KAAK,YAAY,EAAE;EACtC,MAAM,SAAS,KAAK,OAAO,KAAK,MAAM;EAGtC,MAAM,KAAK,eAAe,WAAW,KAAK,EAAE;EAE5C,IAAI;GACF,MAAM,OAAO,OAAO,KAAK,QAAQ,IAAI;EACvC,SAAS,GAAG;GACV,IAAI,aAAa,mBAEf,KAAK,IAAI,MACP,QAAQ,KAAK,OAAO,uBAAuB,OAAO,KAAK,8BACzD;QAGA,KAAK,IAAI,KACP,yBAAyB,KAAK,OAAO,eAAe,OAAO,QAC3D,CACF;EAEJ;EAEA,OAAO;GAAE,IAAI;GAAM,IAAI,OAAO,KAAK,EAAE;EAAE;CACzC;;;;;;CAOA,MAAa,YAAY,KAAkC;EACzD,IAAI,IAAI,WAAW,GAAG,OAAO,CAAC;EAE9B,MAAM,QAAQ,MAAM,KAAK,eAAe,SAAS;GAC/C,OAAO,EAAE,IAAI,EAAE,SAAS,IAAI,EAAE;GAC9B,SAAS;IAAC;IAAM;IAAU;GAAQ;EACpC,CAAC;EACD,IAAI,MAAM,WAAW,GAAG,OAAO,CAAC;EAEhC,MAAM,YAAY,MAAM,KAAK,eAAe,WAAW,EACrD,IAAI,EAAE,SAAS,MAAM,KAAK,MAAM,EAAE,EAAE,EAAE,EACxC,CAAC;EAED,MAAM,gCAAgB,IAAI,IAAsB;EAChD,KAAK,MAAM,KAAK,OAAO;GACrB,MAAM,OAAO,cAAc,IAAI,EAAE,MAAM,KAAK,CAAC;GAC7C,KAAK,KAAK,EAAE,MAAM;GAClB,cAAc,IAAI,EAAE,QAAQ,IAAI;EAClC;EAEA,KAAK,MAAM,CAAC,YAAY,YAAY,eAClC,IAAI;GACF,MAAM,KAAK,OAAO,UAAU,CAAC,CAAC,WAAW,SAAS,IAAI;EACxD,SAAS,GAAG;GAGV,KAAK,IAAI,KACP,yBAAyB,QAAQ,OAAO,qBAAqB,cAC7D,CACF;EACF;EAGF,OAAO,UAAU,IAAI,MAAM;CAC7B;;;;;;;;;CAUA,MAAa,YAAY,IAA8C;EACrE,IAAI,OAAO,OAAO,UAChB,OAAO;EAGT,OAAO,MAAM,KAAK,eAAe,QAAQ,EAAE;CAC7C;;;;;;;;;;;;CAaA,MAAa,kBAAyC;EACpD,MAAM,CAAC,cAAc,kBAAkB,MAAM,QAAQ,IAAI,CACvD,KAAK,eAAe,UAAU;GAC5B,QAAQ;IAAE,QAAQ;IAAM,MAAM;KAAE,KAAK;KAAM,OAAO;IAAK;GAAE;GACzD,SAAS,CAAC,QAAQ;EACpB,CAAC,GACD,KAAK,eAAe,UAAU;GAC5B,QAAQ;IAAE,UAAU;IAAM,MAAM,EAAE,OAAO,KAAK;GAAE;GAChD,SAAS,CAAC,UAAU;EACtB,CAAC,CACH,CAAC;EAED,MAAM,WAAW,aAAa,KAAK,SAAS;GAC1C,QAAQ,IAAI;GACZ,WAAW,IAAI,KAAK;GACpB,WAAW,IAAI,KAAK;EACtB,EAAE;EAEF,MAAM,aAAa,eAAe,KAAK,SAAS;GAC9C,UAAU,IAAI;GACd,WAAW,IAAI,KAAK;EACtB,EAAE;EAEF,OAAO;GACL,WAAW,SAAS,QAAQ,KAAK,MAAM,MAAM,EAAE,WAAW,CAAC;GAC3D,YAAY,SAAS,QAAQ,KAAK,MAAM,MAAM,EAAE,WAAW,CAAC;GAC5D;GACA;EACF;CACF;;;;;;;;CASA,iBAAwB,QAAkC;EACxD,OAAO;CACT;AACF;;;;;;;ACvhBA,IAAa,2BAAb,MAAsC;CACpC,MAAyB;CACzB,QAA2B;CAC3B,cAAiC,QAAQ,WAAW;;;;;;CAOpD,eAA+B,QAAQ;EACrC,MAAM,KAAK;EACX,OAAO,KAAK;EACZ,KAAK,CAAC,QAAQ,EAAE,aAAa,CAAC,iBAAiB,EAAE,CAAC,CAAC;EACnD,aAAa;EACb,QAAQ,EACN,UAAU,mBACZ;EACA,eAAe,KAAK,YAAY,gBAAgB;CAClD,CAAC;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;ACHA,IAAa,qBAAb,MAAgC;;;;;;CAM9B,MAAM,eACJ,MACA,MACe;EACf,IAAI,CAAC,MACH,MAAM,IAAI,eAAe,qCAAqC;EAKhE,IAAI,KAAK,cAAc,OACrB;EAEF,IAAI,KAAK,WAAW,KAAK,YAAY,KAAK,IACxC;EAEF,MAAM,IAAI,eAAe,oBAAoB;CAC/C;;;;;;;;;;;;;;;;;;;CAoBA,MAAM,aAAa,MAAiC;EAClD,MAAM,IAAI,cAAc,SAAS,KAAK,GAAG,YAAY;CACvD;AACF;;;ACrEA,MAAa,kBAAkB,gBAAgB,OAAO;CACpD,QAAQ,EAAE,OAAO,CAAC,CAAC,SAAS;CAC5B,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,SAAS;CACnC,MAAM,EAAE,OAAO,CAAC,CAAC,SAAS;CAC1B,UAAU,EAAE,OAAO,CAAC,CAAC,SAAS;CAC9B,SAAS,EAAE,KAAK,CAAC,CAAC,SAAS;CAC3B,cAAc,EAAE,SAAS,CAAC,CAAC,SAAS;CACpC,eAAe,EAAE,SAAS,CAAC,CAAC,SAAS;AACvC,CAAC;;;;;;;;;;;;;;ACCD,MAAa,2BAA2B,EAAE,OAAO;CAC/C,IAAI,EAAE,KAAK;CACX,OAAO,EAAE,OAAO,CAAC,CAAC,KAAK,EAAE,QAAQ,QAAQ,CAAC,CAAC,CAAC,SAAS;CACrD,UAAU,EAAE,UAAU;EAAE,WAAW;EAAG,WAAW;CAAG,CAAC,CAAC,CAAC,SAAS;CAChE,WAAW,EAAE,OAAO,CAAC,CAAC,SAAS;CAC/B,UAAU,EAAE,OAAO,CAAC,CAAC,SAAS;AAChC,CAAC;;;ACfD,MAAa,qBAAqB,MAAM,OACrC,OAAO;;;;;;;AAON,MAAM,yBAAyB,SAAS,EAC1C,CAAC,CAAC,CACD,KAAK;CACJ,OAAO;CACP,aAAa;AACf,CAAC;;;;;;;ACJH,IAAa,iBAAb,MAA4B;CAC1B,MAAyB;CACzB,QAA2B;CAC3B,cAAiC,QAAQ,WAAW;CACpD,aAAgC,QAAQ,kBAAkB;;;;;CAM1D,YAA4B,QAAQ;EAClC,MAAM,KAAK;EACX,OAAO,SAAS,KAAK;EACrB,KAAK,CAAC,QAAQ,EAAE,aAAa,CAAC,iBAAiB,EAAE,CAAC,CAAC;EACnD,aAAa;EACb,QAAQ;GACN,OAAO;GACP,UAAU,EAAE,KAAK,kBAAkB;EACrC;EACA,UAAU,EAAE,YAAY,KAAK,YAAY,UAAU,KAAK;CAC1D,CAAC;;;;;CAMD,aAA6B,QAAQ;EACnC,QAAQ;EACR,MAAM,GAAG,KAAK,IAAI;EAClB,OAAO,SAAS,KAAK;EACrB,KAAK,CAAC,QAAQ,EAAE,aAAa,CAAC,mBAAmB,EAAE,CAAC,CAAC;EACrD,aAAa;EACb,QAAQ;GACN,QAAQ,EAAE,OAAO,EACf,IAAI,EAAE,KAAK,EACb,CAAC;GACD,UAAU;EACZ;EACA,UAAU,EAAE,aAAa,KAAK,YAAY,WAAW,OAAO,EAAE;CAChE,CAAC;;;;;CAMD,cAA8B,QAAQ;EACpC,QAAQ;EACR,MAAM,GAAG,KAAK,IAAI;EAClB,OAAO,SAAS,KAAK;EACrB,KAAK,CAAC,QAAQ,EAAE,aAAa,CAAC,mBAAmB,EAAE,CAAC,CAAC;EACrD,aAAa;EACb,QAAQ;GACN,MAAM,EAAE,OAAO,EACb,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAI,EACxC,CAAC;GACD,UAAU,EAAE,OAAO,EACjB,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,EAC7B,CAAC;EACH;EACA,SAAS,OAAO,EAAE,WAAW;GAE3B,OAAO,EAAE,SAAA,MADa,KAAK,YAAY,YAAY,KAAK,GAAG,EAC1C;EACnB;CACF,CAAC;;;;;;CAOD,aAA6B,QAAQ;EACnC,MAAM,KAAK;EACX,OAAO,KAAK;EACZ,KAAK,CAAC,QAAQ,EAAE,aAAa,CAAC,aAAa,EAAE,CAAC,CAAC;EAC/C,aAAa;EACb,QAAQ;GACN,MAAM,EAAE,OAAO,EACb,MAAM,EAAE,KAAK,EACf,CAAC;GACD,OAAO,EAAE,OAAO;IACd,gBAAgB,EAAE,SAAS,CAAC,CAAC,SAAS;IACtC,QAAQ,EAAE,OAAO,CAAC,CAAC,SAAS;GAC9B,CAAC;GACD,UAAU;EACZ;EACA,SAAS,OAAO,EAAE,MAAM,MAAM,YAC5B,KAAK,YAAY,WAAW,KAAK,MAAM;GACrC;GACA,GAAG;EACL,CAAC;CACL,CAAC;;;;;CAMD,aAA6B,QAAQ;EACnC,QAAQ;EACR,MAAM,GAAG,KAAK,IAAI;EAClB,OAAO,SAAS,KAAK;EACrB,KAAK,CAAC,QAAQ,EAAE,aAAa,CAAC,mBAAmB,EAAE,CAAC,CAAC;EACrD,aAAa;EACb,QAAQ;GACN,QAAQ,EAAE,OAAO,EACf,IAAI,EAAE,KAAK,EACb,CAAC;GACD,MAAM,EAAE,OAAO;IACb,MAAM,EAAE,OAAO,CAAC,CAAC,SAAS;IAC1B,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,SAAS;IACnC,gBAAgB,EAAE,SAAS,CAAC,CAAC,SAAS;GACxC,CAAC;GACD,UAAU;EACZ;EACA,UAAU,EAAE,QAAQ,WAAW,KAAK,YAAY,WAAW,OAAO,IAAI,IAAI;CAC5E,CAAC;;;;;;;;;;;;CAaD,aAA6B,QAAQ;EACnC,MAAM,GAAG,KAAK,IAAI;EAClB,OAAO,KAAK;EACZ,aAAa;EACb,KAAK,CACH,QAAQ,EAAE,aAAa,CAAC,WAAW,EAAE,CAAC,GACtC,MAAM,EACJ,SAAS;GACP,SAAS;GACT,QAAQ,CAAC,GAAG,MAAM;GAClB,WAAW;EACb,EACF,CAAC,CACH;EACA,QAAQ;GACN,QAAQ,EAAE,OAAO,EACf,IAAI,EAAE,KAAK,EACb,CAAC;GACD,UAAU,EAAE,KAAK;EACnB;EACA,SAAS,OAAO,EAAE,QAAQ,WAAW;GACnC,MAAM,OAAO,MAAM,KAAK,YAAY,YAAY,OAAO,EAAE;GACzD,MAAM,KAAK,WAAW,eAAe,MAAM,IAAI;GAC/C,OAAO,MAAM,KAAK,YAAY,WAAW,IAAI;EAC/C;CACF,CAAC;;;;;;;;;;;;;;;CAgBD,mBAAmC,QAAQ;EACzC,MAAM;EACN,OAAO,KAAK;EACZ,aAAa;EACb,KAAK,CACH,MAAM,EACJ,SAAS;GACP,QAAQ;GACR,QAAQ,CAAC,GAAG,MAAM;GAClB,WAAW;EACb,EACF,CAAC,CACH;EACA,QAAQ;GACN,QAAQ,EAAE,OAAO,EACf,IAAI,EAAE,KAAK,EACb,CAAC;GACD,UAAU,EAAE,KAAK;EACnB;EACA,SAAS,OAAO,EAAE,aAAa;GAC7B,MAAM,OAAO,MAAM,KAAK,YAAY,YAAY,OAAO,EAAE;GACzD,MAAM,KAAK,WAAW,aAAa,IAAI;GACvC,OAAO,MAAM,KAAK,YAAY,WAAW,IAAI;EAC/C;CACF,CAAC;AACH;;;AC1MA,IAAa,WAAb,MAAsB;CACpB,cAAiC,QAAQ,WAAW;CAEpD,aAA6B,WAAW;EACtC,MAAM;EACN,aAAa;EACb,MAAM;EACN,SAAS,YAAY;GACnB,MAAM,QAAQ,MAAM,KAAK,YAAY,iBAAiB;GAEtD,MAAM,QAAQ,IACZ,MAAM,KAAK,SAAS,KAAK,YAAY,WAAW,KAAK,EAAE,CAAC,CAC1D;EACF;CACF,CAAC;AACH;;;;;;;;;;;;;;AC8CA,MAAa,iBAAiB,QAAQ;CACpC,MAAM;CACN,UAAU;EACR;EACA;EACA;EACA;EACA;CACF;CACA,SAAS,CAAC,cAAc,gBAAgB;AAC1C,CAAC"}