glasswork 0.12.2 → 0.13.0

package/dist/uploads/file-upload.js

@@ -0,0 +1,145 @@
+import { customAlphabet } from 'nanoid';
+import { BadRequestException, ForbiddenException } from '../http/errors.js';
+// ============================================================================
+// Constants
+// ============================================================================
+const UPLOAD_RANDOM_ID_LENGTH = 16;
+const MAX_PATH_LENGTH = 1024;
+const NANOID_ALPHABET = '1234567890abcdef';
+// ============================================================================
+// Upload Configuration
+// ============================================================================
+/**
+ * Creates an upload configuration object for presigned URL generation.
+ * Validates IDs and generates a unique random folder to prevent overwrites.
+ *
+ * @param prefix - Upload folder prefix (e.g., 'avatars', 'documents')
+ * @param ids - Array of IDs to include in path (e.g., [userId] or [clientId, orderId])
+ * @param fileName - Sanitized filename (validate with sanitizedFileName schema first)
+ * @returns Configuration object with dir and fileName properties
+ * @throws BadRequestException if prefix is empty or IDs contain invalid characters
+ *
+ * @example
+ * ```typescript
+ * // In route handler:
+ * const config = createUploadConfig('avatars', [user.id], query.name);
+ * const result = await uploadsService.getSignedUploadUrl(config);
+ * // Result path: /uploads/avatars/{userId}/{randomId}/{filename}
+ * ```
+ */
+export function createUploadConfig(prefix, ids, fileName) {
+    if (!prefix || prefix.trim() === '') {
+        throw new BadRequestException('Prefix cannot be empty');
+    }
+    for (const id of ids) {
+        if (!id || typeof id !== 'string') {
+            throw new BadRequestException(`Invalid ID: ${id}`);
+        }
+        if (id.includes('/') || id.includes('\\') || id.includes('..')) {
+            throw new BadRequestException(`Invalid character in ID: ${id}`);
+        }
+    }
+    /*
+     * Handle empty IDs array gracefully to avoid double slashes.
+     * If ids are present, join them with '/', otherwise use empty string.
+     */
+    const idPath = ids.length > 0 ? `${ids.join('/')}/` : '';
+    const randomId = customAlphabet(NANOID_ALPHABET, UPLOAD_RANDOM_ID_LENGTH)();
+    const dir = `uploads/${prefix}/${idPath}${randomId}`;
+    return { dir, fileName };
+}
+// ============================================================================
+// Path Ownership Validation
+// ============================================================================
+/**
+ * Validate IDs don't contain path traversal characters.
+ */
+function validateIdsForPath(ids, errorMessage) {
+    for (const id of ids) {
+        if (!id || typeof id !== 'string') {
+            throw new ForbiddenException(errorMessage);
+        }
+        if (id.includes('/') || id.includes('\\') || id.includes('..')) {
+            throw new ForbiddenException(errorMessage);
+        }
+    }
+}
+/**
+ * Check if path contains control characters (security measure).
+ */
+function hasControlCharacters(path) {
+    for (let i = 0; i < path.length; i++) {
+        const code = path.charCodeAt(i);
+        if ((code >= 0x00 && code <= 0x1f) || code === 0x7f) {
+            return true;
+        }
+    }
+    return false;
+}
+/**
+ * Decode and normalize path, rejecting traversal attempts.
+ */
+function decodeAndNormalizePath(path, errorMessage) {
+    let decodedPath;
+    try {
+        decodedPath = decodeURIComponent(path);
+    }
+    catch {
+        throw new ForbiddenException(errorMessage);
+    }
+    if (decodedPath.includes('..') || decodedPath.includes('./') || decodedPath.includes('.\\')) {
+        throw new ForbiddenException(errorMessage);
+    }
+    if (decodedPath.includes('\\')) {
+        throw new ForbiddenException(errorMessage);
+    }
+    const normalizedPath = decodedPath.replace(/\/+/g, '/');
+    if (normalizedPath !== decodedPath) {
+        throw new ForbiddenException(errorMessage);
+    }
+    return normalizedPath;
+}
+/**
+ * Validate relative path has a valid filename at the end.
+ */
+function validateRelativePath(relativePath, errorMessage) {
+    if (relativePath === '' || relativePath.endsWith('/')) {
+        throw new ForbiddenException(errorMessage);
+    }
+    const lastSlashIndex = relativePath.lastIndexOf('/');
+    const filename = lastSlashIndex >= 0 ? relativePath.slice(lastSlashIndex + 1) : relativePath;
+    if (!filename || filename.trim() === '') {
+        throw new ForbiddenException(errorMessage);
+    }
+}
+/**
+ * Asserts that a file path belongs to the specified prefix and IDs.
+ * Use this to validate delete operations - ensures users can only delete their own files.
+ *
+ * @param path - The file path to validate (e.g., from query.name)
+ * @param prefix - The expected upload prefix (e.g., 'avatars', 'documents')
+ * @param ids - The expected IDs in the path
+ * @param errorMessage - Custom error message (default: 'Invalid file path')
+ * @throws ForbiddenException if path doesn't match expected structure
+ *
+ * @example
+ * ```typescript
+ * // In delete handler:
+ * assertUploadPathOwnership(query.path, 'avatars', [user.id]);
+ * await uploadsService.deleteFile(query.path);
+ * ```
+ */
+export function assertUploadPathOwnership(path, prefix, ids, errorMessage = 'Invalid file path') {
+    validateIdsForPath(ids, errorMessage);
+    if (path.length > MAX_PATH_LENGTH || hasControlCharacters(path)) {
+        throw new ForbiddenException(errorMessage);
+    }
+    const normalizedPath = decodeAndNormalizePath(path, errorMessage);
+    const idPath = ids.length > 0 ? `${ids.join('/')}/` : '';
+    const expectedPrefix = `/uploads/${prefix}/${idPath}`;
+    if (!normalizedPath.startsWith(expectedPrefix)) {
+        throw new ForbiddenException(errorMessage);
+    }
+    validateRelativePath(normalizedPath.slice(expectedPrefix.length), errorMessage);
+}
+//# sourceMappingURL=file-upload.js.map

package/dist/uploads/file-upload.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"file-upload.js","sourceRoot":"","sources":["../../src/uploads/file-upload.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,QAAQ,CAAC;AACxC,OAAO,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAE5E,+EAA+E;AAC/E,YAAY;AACZ,+EAA+E;AAE/E,MAAM,uBAAuB,GAAG,EAAE,CAAC;AACnC,MAAM,eAAe,GAAG,IAAI,CAAC;AAC7B,MAAM,eAAe,GAAG,kBAAkB,CAAC;AAa3C,+EAA+E;AAC/E,uBAAuB;AACvB,+EAA+E;AAE/E;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,kBAAkB,CAChC,MAAc,EACd,GAAsB,EACtB,QAAgB;IAEhB,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACpC,MAAM,IAAI,mBAAmB,CAAC,wBAAwB,CAAC,CAAC;IAC1D,CAAC;IACD,KAAK,MAAM,EAAE,IAAI,GAAG,EAAE,CAAC;QACrB,IAAI,CAAC,EAAE,IAAI,OAAO,EAAE,KAAK,QAAQ,EAAE,CAAC;YAClC,MAAM,IAAI,mBAAmB,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC;QACrD,CAAC;QACD,IAAI,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAC/D,MAAM,IAAI,mBAAmB,CAAC,4BAA4B,EAAE,EAAE,CAAC,CAAC;QAClE,CAAC;IACH,CAAC;IACD;;;OAGG;IACH,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IACzD,MAAM,QAAQ,GAAG,cAAc,CAAC,eAAe,EAAE,uBAAuB,CAAC,EAAE,CAAC;IAC5E,MAAM,GAAG,GAAG,WAAW,MAAM,IAAI,MAAM,GAAG,QAAQ,EAAE,CAAC;IACrD,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC;AAC3B,CAAC;AAED,+EAA+E;AAC/E,4BAA4B;AAC5B,+EAA+E;AAE/E;;GAEG;AACH,SAAS,kBAAkB,CAAC,GAAsB,EAAE,YAAoB;IACtE,KAAK,MAAM,EAAE,IAAI,GAAG,EAAE,CAAC;QACrB,IAAI,CAAC,EAAE,IAAI,OAAO,EAAE,KAAK,QAAQ,EAAE,CAAC;YAClC,MAAM,IAAI,kBAAkB,CAAC,YAAY,CAAC,CAAC;QAC7C,CAAC;QACD,IAAI,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAC/D,MAAM,IAAI,kBAAkB,CAAC,YAAY,CAAC,CAAC;QAC7C,CAAC;IACH,CAAC;AACH,CAAC;AAED;;GAEG;AACH,SAAS,oBAAoB,CAAC,IAAY;IACxC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QAChC,IAAI,CAAC,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,CAAC,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YACpD,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;GAEG;AACH,SAAS,sBAAsB,CAAC,IAAY,EAAE,YAAoB;IAChE,IAAI,WAAmB,CAAC;IACxB,IAAI,CAAC;QACH,WAAW,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;IACzC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,kBAAkB,CAAC,YAAY,CAAC,CAAC;IAC7C,CAAC;IACD,IAAI,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,WAAW,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5F,MAAM,IAAI,kBAAkB,CAAC,YAAY,CAAC,CAAC;IAC7C,CAAC;IACD,IAAI,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,kBAAkB,CAAC,YAAY,CAAC,CAAC;IAC7C,CAAC;IACD,MAAM,cAAc,GAAG,WAAW,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IACxD,IAAI,cAAc,KAAK,WAAW,EAAE,CAAC;QACnC,MAAM,IAAI,kBAAkB,CAAC,YAAY,CAAC,CAAC;IAC7C,CAAC;IACD,OAAO,cAAc,CAAC;AACxB,CAAC;AAED;;GAEG;AACH,SAAS,oBAAoB,CAAC,YAAoB,EAAE,YAAoB;IACtE,IAAI,YAAY,KAAK,EAAE,IAAI,YAAY,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACtD,MAAM,IAAI,kBAAkB,CAAC,YAAY,CAAC,CAAC;IAC7C,CAAC;IACD,MAAM,cAAc,GAAG,YAAY,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IACrD,MAAM,QAAQ,GAAG,cAAc,IAAI,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,KAAK,CAAC,cAAc,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC;IAC7F,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACxC,MAAM,IAAI,kBAAkB,CAAC,YAAY,CAAC,CAAC;IAC7C,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,yBAAyB,CACvC,IAAY,EACZ,MAAc,EACd,GAAsB,EACtB,YAAY,GAAG,mBAAmB;IAElC,kBAAkB,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;IACtC,IAAI,IAAI,CAAC,MAAM,GAAG,eAAe,IAAI,oBAAoB,CAAC,IAAI,CAAC,EAAE,CAAC;QAChE,MAAM,IAAI,kBAAkB,CAAC,YAAY,CAAC,CAAC;IAC7C,CAAC;IACD,MAAM,cAAc,GAAG,sBAAsB,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;IAClE,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IACzD,MAAM,cAAc,GAAG,YAAY,MAAM,IAAI,MAAM,EAAE,CAAC;IACtD,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;QAC/C,MAAM,IAAI,kBAAkB,CAAC,YAAY,CAAC,CAAC;IAC7C,CAAC;IACD,oBAAoB,CAAC,cAAc,CAAC,KAAK,CAAC,cAAc,CAAC,MAAM,CAAC,EAAE,YAAY,CAAC,CAAC;AAClF,CAAC"}

package/dist/uploads/index.d.ts

@@ -0,0 +1,6 @@
+export type { UploadPathConfig } from './file-upload.js';
+export { assertUploadPathOwnership, createUploadConfig } from './file-upload.js';
+export type { SignedDownloadUrlResponse, SignedUrlResponse, StreamFileResult, UploadFileConfig, UploadsServiceConfig, } from './uploads.service.js';
+export { UploadsService } from './uploads.service.js';
+export { fileNameWithExtension, sanitizedFileName } from './validators.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/uploads/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/uploads/index.ts"],"names":[],"mappings":"AAEA,YAAY,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAEzD,OAAO,EAAE,yBAAyB,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACjF,YAAY,EACV,yBAAyB,EACzB,iBAAiB,EACjB,gBAAgB,EAChB,gBAAgB,EAChB,oBAAoB,GACrB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAGtD,OAAO,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC"}

package/dist/uploads/index.js

@@ -0,0 +1,7 @@
+// Service
+// Utilities
+export { assertUploadPathOwnership, createUploadConfig } from './file-upload.js';
+export { UploadsService } from './uploads.service.js';
+// Validators
+export { fileNameWithExtension, sanitizedFileName } from './validators.js';
+//# sourceMappingURL=index.js.map

package/dist/uploads/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/uploads/index.ts"],"names":[],"mappings":"AAAA,UAAU;AAGV,YAAY;AACZ,OAAO,EAAE,yBAAyB,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAQjF,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAEtD,aAAa;AACb,OAAO,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC"}

package/dist/uploads/uploads.service.d.ts

@@ -0,0 +1,98 @@
+import type { Readable } from 'node:stream';
+export interface UploadFileConfig {
+    /** Directory path for the file (e.g., 'uploads/avatars/user123/abc123') */
+    readonly dir: string;
+    /** Sanitized file name (e.g., 'photo.jpg') */
+    readonly fileName: string;
+}
+export interface SignedUrlResponse {
+    /** Presigned URL for uploading the file */
+    readonly uploadUrl: string;
+    /** Relative path where the file will be stored (e.g., '/uploads/avatars/...') */
+    readonly path: string;
+    /** Expiration timestamp of the presigned URL */
+    readonly expiresAt: Date;
+}
+export interface SignedDownloadUrlResponse {
+    /** Presigned URL for downloading the file */
+    readonly downloadUrl: string;
+    /** Expiration timestamp of the presigned URL */
+    readonly expiresAt: Date;
+}
+export interface StreamFileResult {
+    /** Readable stream of the file contents */
+    readonly body: Readable;
+    /** MIME type of the file */
+    readonly contentType: string | undefined;
+    /** Size of the file in bytes */
+    readonly contentLength: number | undefined;
+}
+export interface UploadsServiceConfig {
+    /** AWS region (e.g., 'eu-west-1') */
+    readonly region: string;
+    /** S3 bucket name */
+    readonly bucketName: string;
+    /** Presigned URL expiration in seconds (default: 3600) */
+    readonly urlExpiration?: number;
+}
+/**
+ * Service for S3 file operations including presigned URL generation and streaming.
+ * Framework-agnostic - can be used anywhere TypeScript runs.
+ *
+ * @example
+ * ```typescript
+ * const uploadsService = new UploadsService({
+ *   region: 'eu-west-1',
+ *   bucketName: 'my-files-bucket',
+ *   urlExpiration: 3600,
+ * });
+ *
+ * // Generate presigned upload URL
+ * const { uploadUrl, path } = await uploadsService.getSignedUploadUrl({
+ *   dir: 'uploads/avatars/user123',
+ *   fileName: 'photo.jpg',
+ * });
+ *
+ * // Stream file for private access
+ * const { body, contentType } = await uploadsService.streamFile('/uploads/docs/file.pdf');
+ *
+ * // Generate presigned download URL for private files
+ * const { downloadUrl } = await uploadsService.getSignedDownloadUrl('/uploads/docs/private.pdf');
+ * ```
+ */
+export declare class UploadsService {
+    private readonly client;
+    private readonly bucketName;
+    private readonly urlExpiration;
+    constructor(config: UploadsServiceConfig);
+    /**
+     * Generate a presigned URL for uploading a file to S3.
+     * The URL allows direct upload from the client without going through Lambda.
+     */
+    getSignedUploadUrl(fileConfig: UploadFileConfig): Promise<SignedUrlResponse>;
+    /**
+     * Stream a file from S3 for private file access.
+     * Returns a readable stream that can be piped to the HTTP response.
+     *
+     * **Note**: Lambda has a 6MB response payload limit for synchronous invocations.
+     * For larger files, consider using presigned GET URLs with short expiration.
+     */
+    streamFile(filePath: string): Promise<StreamFileResult>;
+    /**
+     * Generate a presigned URL for downloading a file from S3.
+     * Use this instead of streaming for files that may exceed Lambda's 6MB response limit.
+     *
+     * @param filePath - Relative path to the file (e.g., '/uploads/docs/file.pdf')
+     * @param expiresIn - Optional expiration in seconds (default: service urlExpiration)
+     */
+    getSignedDownloadUrl(filePath: string, expiresIn?: number): Promise<SignedDownloadUrlResponse>;
+    /**
+     * Delete a file from S3 by path.
+     */
+    deleteFile(filePath: string): Promise<void>;
+    /**
+     * Normalize file path to S3 key format (strip leading slashes).
+     */
+    private normalizeKey;
+}
+//# sourceMappingURL=uploads.service.d.ts.map

package/dist/uploads/uploads.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"uploads.service.d.ts","sourceRoot":"","sources":["../../src/uploads/uploads.service.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAe5C,MAAM,WAAW,gBAAgB;IAC/B,2EAA2E;IAC3E,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,8CAA8C;IAC9C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,iBAAiB;IAChC,2CAA2C;IAC3C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,iFAAiF;IACjF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,gDAAgD;IAChD,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC;CAC1B;AAED,MAAM,WAAW,yBAAyB;IACxC,6CAA6C;IAC7C,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,gDAAgD;IAChD,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC;CAC1B;AAED,MAAM,WAAW,gBAAgB;IAC/B,2CAA2C;IAC3C,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IACxB,4BAA4B;IAC5B,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC,gCAAgC;IAChC,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,SAAS,CAAC;CAC5C;AAED,MAAM,WAAW,oBAAoB;IACnC,qCAAqC;IACrC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,qBAAqB;IACrB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,0DAA0D;IAC1D,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;CACjC;AAaD;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAW;IAClC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAS;gBAE3B,MAAM,EAAE,oBAAoB;IAMxC;;;OAGG;IACG,kBAAkB,CAAC,UAAU,EAAE,gBAAgB,GAAG,OAAO,CAAC,iBAAiB,CAAC;IAgBlF;;;;;;OAMG;IACG,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAsB7D;;;;;;OAMG;IACG,oBAAoB,CACxB,QAAQ,EAAE,MAAM,EAChB,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,yBAAyB,CAAC;IAgBrC;;OAEG;IACG,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IASjD;;OAEG;IACH,OAAO,CAAC,YAAY;CAGrB"}

package/dist/uploads/uploads.service.js

@@ -0,0 +1,134 @@
+import { DeleteObjectCommand, GetObjectCommand, PutObjectCommand, S3Client, S3ServiceException, } from '@aws-sdk/client-s3';
+import { getSignedUrl } from '@aws-sdk/s3-request-presigner';
+import { NotFoundException } from '../http/errors.js';
+// ============================================================================
+// Constants
+// ============================================================================
+const DEFAULT_URL_EXPIRATION = 3600; // 1 hour
+const MILLISECONDS_PER_SECOND = 1000;
+// ============================================================================
+// Service
+// ============================================================================
+/**
+ * Service for S3 file operations including presigned URL generation and streaming.
+ * Framework-agnostic - can be used anywhere TypeScript runs.
+ *
+ * @example
+ * ```typescript
+ * const uploadsService = new UploadsService({
+ *   region: 'eu-west-1',
+ *   bucketName: 'my-files-bucket',
+ *   urlExpiration: 3600,
+ * });
+ *
+ * // Generate presigned upload URL
+ * const { uploadUrl, path } = await uploadsService.getSignedUploadUrl({
+ *   dir: 'uploads/avatars/user123',
+ *   fileName: 'photo.jpg',
+ * });
+ *
+ * // Stream file for private access
+ * const { body, contentType } = await uploadsService.streamFile('/uploads/docs/file.pdf');
+ *
+ * // Generate presigned download URL for private files
+ * const { downloadUrl } = await uploadsService.getSignedDownloadUrl('/uploads/docs/private.pdf');
+ * ```
+ */
+export class UploadsService {
+    client;
+    bucketName;
+    urlExpiration;
+    constructor(config) {
+        this.client = new S3Client({ region: config.region });
+        this.bucketName = config.bucketName;
+        this.urlExpiration = config.urlExpiration ?? DEFAULT_URL_EXPIRATION;
+    }
+    /**
+     * Generate a presigned URL for uploading a file to S3.
+     * The URL allows direct upload from the client without going through Lambda.
+     */
+    async getSignedUploadUrl(fileConfig) {
+        const filePath = `${fileConfig.dir}/${fileConfig.fileName}`;
+        const command = new PutObjectCommand({
+            Bucket: this.bucketName,
+            Key: filePath,
+        });
+        const url = await getSignedUrl(this.client, command, {
+            expiresIn: this.urlExpiration,
+        });
+        return {
+            uploadUrl: url,
+            path: `/${filePath}`,
+            expiresAt: new Date(Date.now() + this.urlExpiration * MILLISECONDS_PER_SECOND),
+        };
+    }
+    /**
+     * Stream a file from S3 for private file access.
+     * Returns a readable stream that can be piped to the HTTP response.
+     *
+     * **Note**: Lambda has a 6MB response payload limit for synchronous invocations.
+     * For larger files, consider using presigned GET URLs with short expiration.
+     */
+    async streamFile(filePath) {
+        try {
+            const key = this.normalizeKey(filePath);
+            const command = new GetObjectCommand({
+                Bucket: this.bucketName,
+                Key: key,
+            });
+            const response = await this.client.send(command);
+            const body = response.Body;
+            return {
+                body,
+                contentType: response.ContentType,
+                contentLength: response.ContentLength,
+            };
+        }
+        catch (error) {
+            if (error instanceof S3ServiceException && error.name === 'NoSuchKey') {
+                throw new NotFoundException('File not found');
+            }
+            throw error;
+        }
+    }
+    /**
+     * Generate a presigned URL for downloading a file from S3.
+     * Use this instead of streaming for files that may exceed Lambda's 6MB response limit.
+     *
+     * @param filePath - Relative path to the file (e.g., '/uploads/docs/file.pdf')
+     * @param expiresIn - Optional expiration in seconds (default: service urlExpiration)
+     */
+    async getSignedDownloadUrl(filePath, expiresIn) {
+        const key = this.normalizeKey(filePath);
+        const expiration = expiresIn ?? this.urlExpiration;
+        const command = new GetObjectCommand({
+            Bucket: this.bucketName,
+            Key: key,
+        });
+        const url = await getSignedUrl(this.client, command, {
+            expiresIn: expiration,
+        });
+        return {
+            downloadUrl: url,
+            expiresAt: new Date(Date.now() + expiration * MILLISECONDS_PER_SECOND),
+        };
+    }
+    /**
+     * Delete a file from S3 by path.
+     */
+    async deleteFile(filePath) {
+        const key = this.normalizeKey(filePath);
+        const command = new DeleteObjectCommand({
+            Bucket: this.bucketName,
+            Key: key,
+        });
+        await this.client.send(command);
+    }
+    /**
+     * Normalize file path to S3 key format (strip leading slashes).
+     */
+    normalizeKey(filePath) {
+        return filePath.replace(/^\/+/, '').replace(/\/+/g, '/');
+    }
+}
+//# sourceMappingURL=uploads.service.js.map

package/dist/uploads/uploads.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"uploads.service.js","sourceRoot":"","sources":["../../src/uploads/uploads.service.ts"],"names":[],"mappings":"AACA,OAAO,EACL,mBAAmB,EACnB,gBAAgB,EAChB,gBAAgB,EAChB,QAAQ,EACR,kBAAkB,GACnB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAC7D,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AA+CtD,+EAA+E;AAC/E,YAAY;AACZ,+EAA+E;AAE/E,MAAM,sBAAsB,GAAG,IAAI,CAAC,CAAC,SAAS;AAC9C,MAAM,uBAAuB,GAAG,IAAI,CAAC;AAErC,+EAA+E;AAC/E,UAAU;AACV,+EAA+E;AAE/E;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,OAAO,cAAc;IACR,MAAM,CAAW;IACjB,UAAU,CAAS;IACnB,aAAa,CAAS;IAEvC,YAAY,MAA4B;QACtC,IAAI,CAAC,MAAM,GAAG,IAAI,QAAQ,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;QACtD,IAAI,CAAC,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC;QACpC,IAAI,CAAC,aAAa,GAAG,MAAM,CAAC,aAAa,IAAI,sBAAsB,CAAC;IACtE,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,kBAAkB,CAAC,UAA4B;QACnD,MAAM,QAAQ,GAAG,GAAG,UAAU,CAAC,GAAG,IAAI,UAAU,CAAC,QAAQ,EAAE,CAAC;QAC5D,MAAM,OAAO,GAAG,IAAI,gBAAgB,CAAC;YACnC,MAAM,EAAE,IAAI,CAAC,UAAU;YACvB,GAAG,EAAE,QAAQ;SACd,CAAC,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE;YACnD,SAAS,EAAE,IAAI,CAAC,aAAa;SAC9B,CAAC,CAAC;QACH,OAAO;YACL,SAAS,EAAE,GAAG;YACd,IAAI,EAAE,IAAI,QAAQ,EAAE;YACpB,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,aAAa,GAAG,uBAAuB,CAAC;SAC/E,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,UAAU,CAAC,QAAgB;QAC/B,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;YACxC,MAAM,OAAO,GAAG,IAAI,gBAAgB,CAAC;gBACnC,MAAM,EAAE,IAAI,CAAC,UAAU;gBACvB,GAAG,EAAE,GAAG;aACT,CAAC,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACjD,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAgB,CAAC;YACvC,OAAO;gBACL,IAAI;gBACJ,WAAW,EAAE,QAAQ,CAAC,WAAW;gBACjC,aAAa,EAAE,QAAQ,CAAC,aAAa;aACtC,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,kBAAkB,IAAI,KAAK,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;gBACtE,MAAM,IAAI,iBAAiB,CAAC,gBAAgB,CAAC,CAAC;YAChD,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,oBAAoB,CACxB,QAAgB,EAChB,SAAkB;QAElB,MAAM,GAAG,GAAG,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;QACxC,MAAM,UAAU,GAAG,SAAS,IAAI,IAAI,CAAC,aAAa,CAAC;QACnD,MAAM,OAAO,GAAG,IAAI,gBAAgB,CAAC;YACnC,MAAM,EAAE,IAAI,CAAC,UAAU;YACvB,GAAG,EAAE,GAAG;SACT,CAAC,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE;YACnD,SAAS,EAAE,UAAU;SACtB,CAAC,CAAC;QACH,OAAO;YACL,WAAW,EAAE,GAAG;YAChB,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,UAAU,GAAG,uBAAuB,CAAC;SACvE,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,UAAU,CAAC,QAAgB;QAC/B,MAAM,GAAG,GAAG,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;QACxC,MAAM,OAAO,GAAG,IAAI,mBAAmB,CAAC;YACtC,MAAM,EAAE,IAAI,CAAC,UAAU;YACvB,GAAG,EAAE,GAAG;SACT,CAAC,CAAC;QACH,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAClC,CAAC;IAED;;OAEG;IACK,YAAY,CAAC,QAAgB;QACnC,OAAO,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC3D,CAAC;CACF"}

package/dist/uploads/validators.d.ts

@@ -0,0 +1,41 @@
+/**
+ * File name validation with extension check AND sanitization.
+ * Validates that the file has an allowed extension, then transforms it to a URL-safe slug.
+ *
+ * @param allowedExtensions - Extensions to allow (e.g., ['.jpg', '.png', '.pdf'])
+ * @param errorMessage - Custom error message for invalid file type
+ * @returns Valibot schema that validates and sanitizes the filename
+ *
+ * @example
+ * ```typescript
+ * // Define allowed extensions per use case
+ * const ALLOWED_IMAGE_EXTENSIONS = ['.jpg', '.jpeg', '.png', '.webp'] as const;
+ * const ALLOWED_DOCUMENT_EXTENSIONS = ['.pdf', '.docx'] as const;
+ *
+ * // Use in schema
+ * const GetUploadUrlQuery = v.object({
+ *   name: sanitizedFileName(ALLOWED_IMAGE_EXTENSIONS),
+ * });
+ *
+ * // Input: "My Photo (1).PNG" → Output: "my-photo-1.png"
+ * // Input: "test.txt" → ValidationError (extension not allowed)
+ * ```
+ */
+export declare const sanitizedFileName: (allowedExtensions: readonly string[], errorMessage?: string) => import("valibot").SchemaWithPipe<readonly [import("valibot").StringSchema<undefined>, import("valibot").CheckAction<string, string>, import("valibot").TransformAction<string, string>]>;
+/**
+ * File name validation with extension check (no transformation).
+ * Use when you want to validate the extension but keep the original filename.
+ *
+ * @param allowedExtensions - Extensions to allow (e.g., ['.jpg', '.png'])
+ * @param errorMessage - Custom error message for invalid file type
+ * @returns Valibot schema that validates the filename extension
+ *
+ * @example
+ * ```typescript
+ * const schema = v.object({
+ *   name: fileNameWithExtension(['.pdf', '.docx']),
+ * });
+ * ```
+ */
+export declare const fileNameWithExtension: (allowedExtensions: readonly string[], errorMessage?: string) => import("valibot").SchemaWithPipe<readonly [import("valibot").StringSchema<undefined>, import("valibot").CheckAction<string, string>]>;
+//# sourceMappingURL=validators.d.ts.map

package/dist/uploads/validators.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validators.d.ts","sourceRoot":"","sources":["../../src/uploads/validators.ts"],"names":[],"mappings":"AAmBA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,eAAO,MAAM,iBAAiB,GAAI,mBAAmB,SAAS,MAAM,EAAE,EAAE,eAAe,MAAM,6LAwC1F,CAAC;AAEJ;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,qBAAqB,GAChC,mBAAmB,SAAS,MAAM,EAAE,EACpC,eAAe,MAAM,0IAoBpB,CAAC"}

package/dist/uploads/validators.js

@@ -0,0 +1,94 @@
+import { check, pipe, string, transform } from 'valibot';
+// ============================================================================
+// File Name Validators
+// ============================================================================
+/**
+ * Slugify a filename base for URL-safe paths.
+ * Converts to lowercase, removes diacritics, replaces non-alphanumeric with hyphens, trims hyphens.
+ */
+function slugify(baseName) {
+    return baseName
+        .normalize('NFD')
+        .replace(/[\u0300-\u036f]/g, '')
+        .toLowerCase()
+        .replace(/[^a-z0-9]+/g, '-')
+        .replace(/^-+|-+$/g, '');
+}
+/**
+ * File name validation with extension check AND sanitization.
+ * Validates that the file has an allowed extension, then transforms it to a URL-safe slug.
+ *
+ * @param allowedExtensions - Extensions to allow (e.g., ['.jpg', '.png', '.pdf'])
+ * @param errorMessage - Custom error message for invalid file type
+ * @returns Valibot schema that validates and sanitizes the filename
+ *
+ * @example
+ * ```typescript
+ * // Define allowed extensions per use case
+ * const ALLOWED_IMAGE_EXTENSIONS = ['.jpg', '.jpeg', '.png', '.webp'] as const;
+ * const ALLOWED_DOCUMENT_EXTENSIONS = ['.pdf', '.docx'] as const;
+ *
+ * // Use in schema
+ * const GetUploadUrlQuery = v.object({
+ *   name: sanitizedFileName(ALLOWED_IMAGE_EXTENSIONS),
+ * });
+ *
+ * // Input: "My Photo (1).PNG" → Output: "my-photo-1.png"
+ * // Input: "test.txt" → ValidationError (extension not allowed)
+ * ```
+ */
+export const sanitizedFileName = (allowedExtensions, errorMessage) => pipe(string(), check((input) => {
+    const lastDotIndex = input.lastIndexOf('.');
+    if (lastDotIndex === -1 || lastDotIndex === input.length - 1) {
+        return false;
+    }
+    // Check for double extensions like .tar.gz
+    const parts = input.toLowerCase().split('.');
+    const ext1 = `.${parts[parts.length - 1]}`;
+    const ext2 = parts.length > 2 ? `.${parts[parts.length - 2]}.${parts[parts.length - 1]}` : null;
+    return !!(allowedExtensions.includes(ext1) || (ext2 && allowedExtensions.includes(ext2)));
+}, errorMessage ?? `Invalid file type. Allowed: ${allowedExtensions.join(', ')}`), transform((input) => {
+    const parts = input.split('.');
+    // Determine which extension to use based on allowed list
+    let extension = parts[parts.length - 1].toLowerCase();
+    let baseName = parts.slice(0, parts.length - 1).join('.');
+    if (parts.length > 2) {
+        const doubleExt = `.${parts[parts.length - 2]}.${parts[parts.length - 1]}`.toLowerCase();
+        if (allowedExtensions.includes(doubleExt)) {
+            extension = parts
+                .slice(parts.length - 2)
+                .join('.')
+                .toLowerCase();
+            baseName = parts.slice(0, parts.length - 2).join('.');
+        }
+    }
+    const slugifiedName = slugify(baseName);
+    return slugifiedName ? `${slugifiedName}.${extension}` : `file.${extension}`;
+}));
+/**
+ * File name validation with extension check (no transformation).
+ * Use when you want to validate the extension but keep the original filename.
+ *
+ * @param allowedExtensions - Extensions to allow (e.g., ['.jpg', '.png'])
+ * @param errorMessage - Custom error message for invalid file type
+ * @returns Valibot schema that validates the filename extension
+ *
+ * @example
+ * ```typescript
+ * const schema = v.object({
+ *   name: fileNameWithExtension(['.pdf', '.docx']),
+ * });
+ * ```
+ */
+export const fileNameWithExtension = (allowedExtensions, errorMessage) => pipe(string(), check((input) => {
+    const lastDotIndex = input.lastIndexOf('.');
+    if (lastDotIndex === -1 || lastDotIndex === input.length - 1) {
+        return false;
+    }
+    const lowerInput = input.toLowerCase();
+    const parts = lowerInput.split('.');
+    const ext1 = `.${parts[parts.length - 1]}`;
+    const ext2 = parts.length > 2 ? `.${parts[parts.length - 2]}.${parts[parts.length - 1]}` : null;
+    return !!(allowedExtensions.includes(ext1) || (ext2 && allowedExtensions.includes(ext2)));
+}, errorMessage ?? `Invalid file type. Allowed: ${allowedExtensions.join(', ')}`));
+//# sourceMappingURL=validators.js.map

package/dist/uploads/validators.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"validators.js","sourceRoot":"","sources":["../../src/uploads/validators.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAEzD,+EAA+E;AAC/E,uBAAuB;AACvB,+EAA+E;AAE/E;;;GAGG;AACH,SAAS,OAAO,CAAC,QAAgB;IAC/B,OAAO,QAAQ;SACZ,SAAS,CAAC,KAAK,CAAC;SAChB,OAAO,CAAC,kBAAkB,EAAE,EAAE,CAAC;SAC/B,WAAW,EAAE;SACb,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC;SAC3B,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;AAC7B,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,iBAAoC,EAAE,YAAqB,EAAE,EAAE,CAC/F,IAAI,CACF,MAAM,EAAE,EACR,KAAK,CACH,CAAC,KAAK,EAAE,EAAE;IACR,MAAM,YAAY,GAAG,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAC5C,IAAI,YAAY,KAAK,CAAC,CAAC,IAAI,YAAY,KAAK,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7D,OAAO,KAAK,CAAC;IACf,CAAC;IACD,2CAA2C;IAC3C,MAAM,KAAK,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC7C,MAAM,IAAI,GAAG,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC;IAC3C,MAAM,IAAI,GACR,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAErF,OAAO,CAAC,CAAC,CAAC,iBAAiB,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,iBAAiB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAC5F,CAAC,EACD,YAAY,IAAI,+BAA+B,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC9E,EACD,SAAS,CAAC,CAAC,KAAK,EAAU,EAAE;IAC1B,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAE/B,yDAAyD;IACzD,IAAI,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;IACtD,IAAI,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAE1D,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACrB,MAAM,SAAS,GAAG,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC,WAAW,EAAE,CAAC;QACzF,IAAI,iBAAiB,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;YAC1C,SAAS,GAAG,KAAK;iBACd,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;iBACvB,IAAI,CAAC,GAAG,CAAC;iBACT,WAAW,EAAE,CAAC;YACjB,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACxD,CAAC;IACH,CAAC;IAED,MAAM,aAAa,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IACxC,OAAO,aAAa,CAAC,CAAC,CAAC,GAAG,aAAa,IAAI,SAAS,EAAE,CAAC,CAAC,CAAC,QAAQ,SAAS,EAAE,CAAC;AAC/E,CAAC,CAAC,CACH,CAAC;AAEJ;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CACnC,iBAAoC,EACpC,YAAqB,EACrB,EAAE,CACF,IAAI,CACF,MAAM,EAAE,EACR,KAAK,CACH,CAAC,KAAK,EAAE,EAAE;IACR,MAAM,YAAY,GAAG,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAC5C,IAAI,YAAY,KAAK,CAAC,CAAC,IAAI,YAAY,KAAK,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7D,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,UAAU,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;IACvC,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACpC,MAAM,IAAI,GAAG,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC;IAC3C,MAAM,IAAI,GACR,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAErF,OAAO,CAAC,CAAC,CAAC,iBAAiB,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,iBAAiB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAC5F,CAAC,EACD,YAAY,IAAI,+BAA+B,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC9E,CACF,CAAC"}