@de-otio/trellis 0.10.11 → 0.12.0

package/dist/lambda/media-completion-worker.d.ts

@@ -0,0 +1,175 @@
+import type { SQSHandler } from "aws-lambda";
+import type { Track } from "../lib/media/track-verdict.js";
+import type { TextModerationProvider } from "../lib/media/text-moderation.js";
+import type { StoragePort, TranscribePort } from "../lib/media/media-ports.js";
+import type { MediaModerationProvider, ModerationVerdict } from "../lib/media/moderation-provider.js";
+import type { ModerationDecision, ModerationStatus } from "../lib/media/moderation-status.js";
+/** The persisted moderation-job row, looked up by its provider jobId. */
+export interface ModerationJobRow {
+    readonly mediaId: string;
+    readonly track: Track;
+    /** Threshold snapshot captured at submission time (opaque JSON). */
+    readonly thresholdSnapshot: unknown;
+}
+/**
+ * The persistence seam. Every method is idempotent-friendly and total; the
+ * shell never reaches around it to a concrete client.
+ */
+export interface CompletionStore {
+    /**
+     * Attempt to claim a message for processing. Returns `true` if THIS call
+     * inserted the row (first delivery), `false` if the row already existed
+     * (duplicate — caller must ack-drop). Implemented with an INSERT ...
+     * ON CONFLICT DO NOTHING so it is atomic across concurrent deliveries.
+     */
+    claimMessage(dedupeKey: string): Promise<boolean>;
+    /** Look up the job row by its provider jobId. `null` if unknown. */
+    findJobByJobId(jobId: string): Promise<ModerationJobRow | null>;
+    /** Persist this track's resolved decision onto its job row. */
+    persistTrackDecision(jobId: string, decision: ModerationDecision): Promise<void>;
+    /**
+     * Read the sibling track's resolved decision for a media object. Returns the
+     * decision if the other track's job exists AND has resolved; otherwise the
+     * `state` distinguishes a job that exists-but-unresolved from no-such-job.
+     */
+    readOtherTrack(mediaId: string, thisTrack: Track): Promise<OtherTrackState>;
+    /** Read the media object's current persisted moderation status + CAS coords. */
+    findMedia(mediaId: string): Promise<MediaCoords | null>;
+    /** Persist a new moderation status for the media object. */
+    persistMediaStatus(mediaId: string, status: ModerationStatus): Promise<void>;
+}
+/**
+ * The sibling track's state, used to build its {@link TrackOutcome}.
+ *  - `decided`  — the other track has a resolved decision.
+ *  - `pending`  — the other track's job exists but has not resolved yet.
+ *  - `absent`   — there is no job for the other track on this media object.
+ */
+export type OtherTrackState = {
+    readonly state: "decided";
+    readonly decision: ModerationDecision;
+} | {
+    readonly state: "pending";
+} | {
+    readonly state: "absent";
+};
+/**
+ * The media coordinates the shell needs to gate promotion and build keys. The
+ * store returns the RAW identity columns ({@link tenantId}, {@link uploadId},
+ * {@link contentHash}); the shell derives every storage key from them via the
+ * canonical cas-keys builders (so key construction is centralized here and the
+ * store never hand-rolls a key string). {@link contentHash} is the post-
+ * transcode SHA-256 the processing worker persisted (NOT the upload-time
+ * uploadId placeholder).
+ */
+export interface MediaCoords {
+    readonly moderationStatus: ModerationStatus;
+    /** Tenant that owns this object (cas-keys input). */
+    readonly tenantId: string;
+    /** Upload session id — addresses the raw pending + cleaned staging keys. */
+    readonly uploadId: string;
+    /** 64-char lowercase SHA-256 of the CLEANED bytes (addresses the cas/ key). */
+    readonly contentHash: string;
+}
+/**
+ * Pure re-interpreter for a VISUAL verdict against the job's threshold snapshot.
+ *
+ * Injected (not implemented here) so this PUBLIC module carries NO operational
+ * thresholds. It receives the SNAPSHOT taken at submission time — never live
+ * Env — so a config edit between deliveries cannot flip a replayed verdict. Must
+ * be total and fail-closed: any uncertainty maps to `"review"`, never `"approved"`.
+ */
+export type VisualVerdictReinterpreter = (verdict: ModerationVerdict, thresholdSnapshot: unknown) => ModerationDecision;
+/** Everything the per-record processor binds to. */
+export interface CompletionDeps {
+    readonly store: CompletionStore;
+    readonly moderation: MediaModerationProvider;
+    readonly transcribe: TranscribePort;
+    readonly textModeration: TextModerationProvider;
+    readonly storage: StoragePort;
+    /** Re-interpret a visual verdict using the job's threshold snapshot. */
+    readonly reinterpretVisual: VisualVerdictReinterpreter;
+    /** Emit the anti-oracle resolved event. Best-effort; must not throw to ack. */
+    readonly emitResolved: (payload: {
+        readonly mediaId: string;
+        readonly status: "ready" | "not-ready";
+    }) => Promise<void>;
+    /** Structured logger seam (defaults to a no-op in tests). */
+    readonly log?: {
+        info?: (msg: string, data?: unknown) => void;
+        warn?: (msg: string, data?: unknown) => void;
+        error?: (msg: string, data?: unknown) => void;
+    };
+}
+/**
+ * The outcome of processing one SQS record. `retry` is the ONLY value that
+ * causes the message to be returned to the queue (and eventually DLQ'd);
+ * everything else is an ack-drop (idempotent no-op or fail-closed terminal).
+ */
+export type RecordOutcome = {
+    readonly kind: "duplicate";
+} | {
+    readonly kind: "unroutable";
+} | {
+    readonly kind: "illegal-transition";
+} | {
+    readonly kind: "applied";
+    readonly status: ModerationStatus;
+} | {
+    readonly kind: "retry";
+    readonly reason: string;
+};
+/**
+ * Extract the provider job id from an untrusted completion message body.
+ *
+ * Two shapes are accepted; everything else (and any embedded verdict/status) is
+ * ignored:
+ *   - Rekognition via SNS:  { "Message": "{...\"JobId\":\"...\"}" }  OR a body
+ *     that itself directly carries { "JobId": "..." }.
+ *   - Transcribe via EventBridge: { "detail": { "TranscriptionJobName": "..." } }
+ *     OR a body that directly carries { "TranscriptionJobName": "..." }.
+ *
+ * Returns the job id and which track it belongs to, or `null` when no job id can
+ * be recovered (fail-closed: the caller ack-drops an unroutable message rather
+ * than DLQ-looping a permanently-malformed pointer).
+ *
+ * Pure & total: never throws.
+ */
+export declare function extractJobPointer(body: string): {
+    readonly jobId: string;
+    readonly track: Track;
+} | null;
+/**
+ * Re-fetch THIS track's authoritative decision from the provider, ignoring the
+ * message body entirely. Fail-closed: a non-terminal / failed / unknown result
+ * yields `"errored"`-equivalent `null` so the caller records it as an errored
+ * track outcome (never `"approved"`).
+ *
+ * VISUAL: `getVideoModeration(jobId)` returns a settled verdict; the verdict is
+ * re-interpreted against the JOB's threshold snapshot (not live Env).
+ *
+ * AUDIO: `getTranscription(jobId)` is polled; only a COMPLETED transcription is
+ * fed to `transcriptToModerationDecision` (which is itself fail-closed). Any
+ * other status (IN_PROGRESS / FAILED) yields `null` (errored — fail closed).
+ */
+export declare function refetchTrackDecision(pointer: {
+    readonly jobId: string;
+    readonly track: Track;
+}, job: ModerationJobRow, deps: CompletionDeps): Promise<ModerationDecision | null>;
+/**
+ * Process one completion message. Returns a {@link RecordOutcome}; only
+ * `kind: "retry"` should be surfaced to SQS as a batch-item failure. Throws are
+ * caught by the handler and converted to a retry.
+ */
+export declare function processCompletion(body: string, deps: CompletionDeps): Promise<RecordOutcome>;
+/**
+ * Build the SQS handler from injected deps. The consuming app provides the
+ * concrete adapters; tests provide mocks and call {@link processCompletion}
+ * directly.
+ *
+ * A record that yields `kind: "retry"` (or throws) is reported as a batch-item
+ * failure so SQS retries / DLQs it. Every other outcome is an ack (the message
+ * is consumed): duplicates, unroutable pointers, and illegal transitions are all
+ * fail-closed ack-drops — they must never DLQ-loop.
+ */
+export declare function makeHandler(deps: CompletionDeps): SQSHandler;
+//# sourceMappingURL=media-completion-worker.d.ts.map

package/dist/lambda/media-completion-worker.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"media-completion-worker.d.ts","sourceRoot":"","sources":["../../src/lambda/media-completion-worker.ts"],"names":[],"mappings":"AAqDA,OAAO,KAAK,EAAE,UAAU,EAAa,MAAM,YAAY,CAAC;AAIxD,OAAO,KAAK,EAAgB,KAAK,EAAE,MAAM,+BAA+B,CAAC;AAIzE,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,iCAAiC,CAAC;AAC9E,OAAO,KAAK,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAC/E,OAAO,KAAK,EACV,uBAAuB,EACvB,iBAAiB,EAClB,MAAM,qCAAqC,CAAC;AAC7C,OAAO,KAAK,EACV,kBAAkB,EAClB,gBAAgB,EACjB,MAAM,mCAAmC,CAAC;AAS3C,yEAAyE;AACzE,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB,oEAAoE;IACpE,QAAQ,CAAC,iBAAiB,EAAE,OAAO,CAAC;CACrC;AAED;;;GAGG;AACH,MAAM,WAAW,eAAe;IAC9B;;;;;OAKG;IACH,YAAY,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAElD,oEAAoE;IACpE,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;IAEhE,+DAA+D;IAC/D,oBAAoB,CAClB,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,kBAAkB,GAC3B,OAAO,CAAC,IAAI,CAAC,CAAC;IAEjB;;;;OAIG;IACH,cAAc,CACZ,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,KAAK,GACf,OAAO,CAAC,eAAe,CAAC,CAAC;IAE5B,gFAAgF;IAChF,SAAS,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;IAExD,4DAA4D;IAC5D,kBAAkB,CAChB,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,gBAAgB,GACvB,OAAO,CAAC,IAAI,CAAC,CAAC;CAClB;AAED;;;;;GAKG;AACH,MAAM,MAAM,eAAe,GACvB;IAAE,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,kBAAkB,CAAA;CAAE,GACpE;IAAE,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAA;CAAE,GAC7B;IAAE,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAA;CAAE,CAAC;AAEjC;;;;;;;;GAQG;AACH,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,gBAAgB,EAAE,gBAAgB,CAAC;IAC5C,qDAAqD;IACrD,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,4EAA4E;IAC5E,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,+EAA+E;IAC/E,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAMD;;;;;;;GAOG;AACH,MAAM,MAAM,0BAA0B,GAAG,CACvC,OAAO,EAAE,iBAAiB,EAC1B,iBAAiB,EAAE,OAAO,KACvB,kBAAkB,CAAC;AAExB,oDAAoD;AACpD,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,KAAK,EAAE,eAAe,CAAC;IAChC,QAAQ,CAAC,UAAU,EAAE,uBAAuB,CAAC;IAC7C,QAAQ,CAAC,UAAU,EAAE,cAAc,CAAC;IACpC,QAAQ,CAAC,cAAc,EAAE,sBAAsB,CAAC;IAChD,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC;IAC9B,wEAAwE;IACxE,QAAQ,CAAC,iBAAiB,EAAE,0BAA0B,CAAC;IACvD,+EAA+E;IAC/E,QAAQ,CAAC,YAAY,EAAE,CACrB,OAAO,EAAE;QAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,GAAG,WAAW,CAAA;KAAE,KAC1E,OAAO,CAAC,IAAI,CAAC,CAAC;IACnB,6DAA6D;IAC7D,QAAQ,CAAC,GAAG,CAAC,EAAE;QACb,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,KAAK,IAAI,CAAC;QAC7C,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,KAAK,IAAI,CAAC;QAC7C,KAAK,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,KAAK,IAAI,CAAC;KAC/C,CAAC;CACH;AAED;;;;GAIG;AACH,MAAM,MAAM,aAAa,GACrB;IAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAA;CAAE,GAC9B;IAAE,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAA;CAAE,GAC/B;IAAE,QAAQ,CAAC,IAAI,EAAE,oBAAoB,CAAA;CAAE,GACvC;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,gBAAgB,CAAA;CAAE,GAC/D;IAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAMxD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,MAAM,GACX;IAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAA;CAAE,GAAG,IAAI,CA8C1D;AAWD;;;;;;;;;;;;GAYG;AACH,wBAAsB,oBAAoB,CACxC,OAAO,EAAE;IAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAA;CAAE,EAC1D,GAAG,EAAE,gBAAgB,EACrB,IAAI,EAAE,cAAc,GACnB,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAoBpC;AAoCD;;;;GAIG;AACH,wBAAsB,iBAAiB,CACrC,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,cAAc,GACnB,OAAO,CAAC,aAAa,CAAC,CAsJxB;AASD;;;;;;;;;GASG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,cAAc,GAAG,UAAU,CA4B5D"}

package/dist/lambda/media-completion-worker.js

@@ -0,0 +1,373 @@
+// media-completion-worker.ts — imperative SHELL for the standardized media
+// job-completion SQS queue (B2).
+//
+// One queue drains the completion notifications of BOTH async moderation
+// tracks of a media object:
+//
+//   - VISUAL: the image/video moderation provider finishes a job and publishes
+//     a completion to SNS, which is fanned into this SQS queue. The SNS envelope
+//     carries `{ Message: "<json>" }` whose inner JSON has a `JobId`.
+//   - AUDIO: speech-to-text (Transcribe) finishes and emits an EventBridge event
+//     fanned into this SQS queue, whose `detail` carries `TranscriptionJobName`.
+//
+// THREAT MODEL: the SQS message body is an UNTRUSTED POINTER. A replay, a forged
+// body, or a spoofed verdict must not move a media object toward "approved". So
+// the worker treats the body as nothing more than a job-id pointer and re-fetches
+// the authoritative state from the provider. The body's own verdict/status (if
+// any) is ALWAYS ignored.
+//
+// SAFETY ORDER (fixed, never reordered):
+//   0. parse body -> jobId ONLY
+//   1. DEDUPE FIRST: insert ProcessedModerationMessage(dedupeKey); if it already
+//      exists, ack-drop (idempotent no-op) BEFORE any side effect.
+//   2. RE-FETCH authoritative track state from the provider (visual) or the
+//      transcription seam (audio). Derive THIS track's decision SOLELY from the
+//      re-fetched result. Non-terminal / failed / unknown => errored (fail closed).
+//   3. Look up the MediaModerationJob by jobId => mediaId + track. Persist this
+//      track's decision. Read the OTHER track's decision. Build both TrackOutcomes.
+//   4. decidePromotion({ visual, audio, currentStatus, casObjectPresent }).
+//      casObjectPresent = the cleaned bytes are available to serve: TRUE iff the
+//      cas/ key exists (a prior promote) OR the cleaned STAGING key exists (the
+//      processing worker left them there, pre-promote).
+//   5. APPLY in fixed order:
+//        a. if shouldPromote: copyObject(STAGING -> cas) — promote the CLEANED
+//           STAGING bytes (the exact bytes that were moderated), NEVER the raw
+//           pending upload. Then best-effort deleteObject(pending) (raw-original
+//           cleanup) AND deleteObject(staging) (staging cleanup) — tolerate
+//           already-deleted on both. cas/ thus only ever holds APPROVED cleaned
+//           bytes ("cleaned-staging, promote-on-approval").
+//        b. if shouldPersistStatus: persist transition.status.
+//        c. if shouldEmitResolved: emit moderation.resolved with
+//           moderationResolvedPayload(mediaId, status) — ready|not-ready ONLY.
+//      An illegal transition (transition.ok === false) is ack-dropped, never DLQ.
+//
+// THRESHOLD SNAPSHOT: when (re)interpreting the re-fetched verdict we use the
+// threshold snapshot stored ON THE JOB ROW (job.thresholdSnapshot), never live
+// Env — so a config edit landing between the original submission and a (re)delivery
+// cannot flip a replayed verdict. The reinterpreter is an injected pure function
+// (no operational numbers live in this PUBLIC tarball).
+//
+// This is the imperative shell: it sequences I/O and delegates EVERY decision to
+// the pure functional-core units (decidePromotion, combineTrackVerdicts,
+// transcriptToModerationDecision, deriveDedupeKey, moderationResolvedPayload).
+import { decidePromotion } from "../lib/media/promote-decision.js";
+import { casKey, pendingKey, isCasKeyError } from "../lib/media/cas-keys.js";
+import { deriveDedupeKey } from "../lib/media/dedupe-key.js";
+import { moderationResolvedPayload } from "../lib/media/moderation-resolved-payload.js";
+import { transcriptToModerationDecision } from "../lib/media/transcript-moderation.js";
+// ---------------------------------------------------------------------------
+// Body parsing — extract ONLY the job id from an untrusted pointer.
+// ---------------------------------------------------------------------------
+/**
+ * Extract the provider job id from an untrusted completion message body.
+ *
+ * Two shapes are accepted; everything else (and any embedded verdict/status) is
+ * ignored:
+ *   - Rekognition via SNS:  { "Message": "{...\"JobId\":\"...\"}" }  OR a body
+ *     that itself directly carries { "JobId": "..." }.
+ *   - Transcribe via EventBridge: { "detail": { "TranscriptionJobName": "..." } }
+ *     OR a body that directly carries { "TranscriptionJobName": "..." }.
+ *
+ * Returns the job id and which track it belongs to, or `null` when no job id can
+ * be recovered (fail-closed: the caller ack-drops an unroutable message rather
+ * than DLQ-looping a permanently-malformed pointer).
+ *
+ * Pure & total: never throws.
+ */
+export function extractJobPointer(body) {
+    let root;
+    try {
+        root = JSON.parse(body);
+    }
+    catch {
+        return null;
+    }
+    if (root === null || typeof root !== "object")
+        return null;
+    const obj = root;
+    // Transcribe (AUDIO): EventBridge `detail.TranscriptionJobName`, or direct.
+    const detail = typeof obj.detail === "object" && obj.detail !== null
+        ? obj.detail
+        : undefined;
+    const transcriptionName = pickString(detail?.TranscriptionJobName) ??
+        pickString(obj.TranscriptionJobName);
+    if (transcriptionName !== null) {
+        return { jobId: transcriptionName, track: "AUDIO" };
+    }
+    // Rekognition (VISUAL): SNS `Message` is a JSON string carrying `JobId`, or
+    // the body carries `JobId` directly.
+    const directJobId = pickString(obj.JobId);
+    if (directJobId !== null) {
+        return { jobId: directJobId, track: "VISUAL" };
+    }
+    const snsMessage = pickString(obj.Message);
+    if (snsMessage !== null) {
+        let inner;
+        try {
+            inner = JSON.parse(snsMessage);
+        }
+        catch {
+            return null;
+        }
+        if (inner !== null && typeof inner === "object") {
+            const innerJobId = pickString(inner.JobId);
+            if (innerJobId !== null) {
+                return { jobId: innerJobId, track: "VISUAL" };
+            }
+        }
+    }
+    return null;
+}
+/** Return a non-empty string value, or null for anything else. */
+function pickString(v) {
+    return typeof v === "string" && v.length > 0 ? v : null;
+}
+// ---------------------------------------------------------------------------
+// Re-fetch authoritative track decision (fail-closed).
+// ---------------------------------------------------------------------------
+/**
+ * Re-fetch THIS track's authoritative decision from the provider, ignoring the
+ * message body entirely. Fail-closed: a non-terminal / failed / unknown result
+ * yields `"errored"`-equivalent `null` so the caller records it as an errored
+ * track outcome (never `"approved"`).
+ *
+ * VISUAL: `getVideoModeration(jobId)` returns a settled verdict; the verdict is
+ * re-interpreted against the JOB's threshold snapshot (not live Env).
+ *
+ * AUDIO: `getTranscription(jobId)` is polled; only a COMPLETED transcription is
+ * fed to `transcriptToModerationDecision` (which is itself fail-closed). Any
+ * other status (IN_PROGRESS / FAILED) yields `null` (errored — fail closed).
+ */
+export async function refetchTrackDecision(pointer, job, deps) {
+    if (pointer.track === "VISUAL") {
+        const verdict = await deps.moderation.getVideoModeration(pointer.jobId);
+        if (verdict == null || typeof verdict !== "object")
+            return null;
+        const decision = deps.reinterpretVisual(verdict, job.thresholdSnapshot);
+        return normalizeDecision(decision);
+    }
+    // AUDIO
+    const res = await deps.transcribe.getTranscription(pointer.jobId);
+    if (res == null || res.status !== "COMPLETED") {
+        // Non-terminal or failed transcription — fail closed (errored).
+        return null;
+    }
+    const transcript = res.transcript ?? "";
+    const decision = await transcriptToModerationDecision(transcript, deps.textModeration);
+    return normalizeDecision(decision);
+}
+/** Accept only the three known decisions; anything else fails closed to null. */
+function normalizeDecision(d) {
+    return d === "approved" || d === "review" || d === "quarantine" ? d : null;
+}
+// ---------------------------------------------------------------------------
+// Build a TrackOutcome from a (possibly null) decision.
+// ---------------------------------------------------------------------------
+/** A resolved decision => `decided`; a null (failed/unknown) => `errored`. */
+function outcomeFromDecision(d) {
+    return d === null ? { state: "errored" } : { state: "decided", decision: d };
+}
+/** Map the sibling track's persisted state to a TrackOutcome (fail-closed). */
+function outcomeFromOther(other) {
+    switch (other.state) {
+        case "decided":
+            return { state: "decided", decision: other.decision };
+        case "absent":
+            return { state: "absent" };
+        case "pending":
+        default:
+            // A sibling job that exists but has not resolved is NOT approval — the
+            // combinator treats `absent` and `errored` alike (both degrade away from
+            // approved), and we have no positive evidence yet, so fail closed.
+            return { state: "errored" };
+    }
+}
+// ---------------------------------------------------------------------------
+// Per-record processor (the heart; mock-friendly).
+// ---------------------------------------------------------------------------
+/**
+ * Process one completion message. Returns a {@link RecordOutcome}; only
+ * `kind: "retry"` should be surfaced to SQS as a batch-item failure. Throws are
+ * caught by the handler and converted to a retry.
+ */
+export async function processCompletion(body, deps) {
+    // 0. Extract ONLY the job id from the untrusted pointer.
+    const pointer = extractJobPointer(body);
+    if (pointer === null) {
+        deps.log?.warn?.("completion: no job pointer in body — dropping");
+        return { kind: "unroutable" };
+    }
+    // 1. Look up the job row first — needed for the contentHash that scopes the
+    //    dedupe key and for the threshold snapshot. (No side effect yet.)
+    const job = await deps.store.findJobByJobId(pointer.jobId);
+    if (job === null) {
+        deps.log?.warn?.("completion: unknown jobId — dropping", {
+            jobId: pointer.jobId,
+        });
+        return { kind: "unroutable" };
+    }
+    // The media object's content hash addresses the dedupe key so identical bytes
+    // share fan-in across tenants; we read it from the media coords below. But the
+    // dedupe MUST happen before ANY side effect, and persistTrackDecision is a
+    // side effect — so we resolve the media first (read-only) to obtain the hash.
+    const media = await deps.store.findMedia(job.mediaId);
+    if (media === null) {
+        deps.log?.warn?.("completion: media row missing — dropping", {
+            mediaId: job.mediaId,
+        });
+        return { kind: "unroutable" };
+    }
+    // 2. DEDUPE FIRST — before any side effect. The dedupe key binds the content
+    //    hash, the jobId, and the track so the two tracks of the same bytes never
+    //    collide and a redelivery of the SAME completion is a no-op.
+    const dedupeKey = deriveDedupeKey({
+        contentHash: media.contentHash,
+        jobId: pointer.jobId,
+        track: pointer.track,
+    });
+    const claimed = await deps.store.claimMessage(dedupeKey);
+    if (!claimed) {
+        deps.log?.info?.("completion: duplicate delivery — ack-drop", {
+            jobId: pointer.jobId,
+        });
+        return { kind: "duplicate" };
+    }
+    // 3. RE-FETCH authoritative state for THIS track (body verdict ignored).
+    const thisDecision = await refetchTrackDecision(pointer, job, deps);
+    // Persist this track's decision (the side effect we just earned the right to
+    // perform). An errored re-fetch persists nothing on the row (decision stays
+    // null) but still contributes an `errored` outcome to the combine.
+    if (thisDecision !== null) {
+        await deps.store.persistTrackDecision(pointer.jobId, thisDecision);
+    }
+    // Read the OTHER track's decision and build both outcomes.
+    const other = await deps.store.readOtherTrack(job.mediaId, pointer.track);
+    const thisOutcome = outcomeFromDecision(thisDecision);
+    const otherOutcome = outcomeFromOther(other);
+    const visual = pointer.track === "VISUAL" ? thisOutcome : otherOutcome;
+    const audio = pointer.track === "AUDIO" ? thisOutcome : otherOutcome;
+    // Derive every storage key from the row's identity columns via the canonical
+    // cas-keys builders — key construction is centralized here, never trusted from
+    // the store. A malformed identity (should be impossible past the upload gate)
+    // fails closed to a retry rather than touching an un-addressable key.
+    const casK = casKey(media.tenantId, media.contentHash);
+    const pendingK = pendingKey(media.tenantId, media.uploadId);
+    if (isCasKeyError(casK) || isCasKeyError(pendingK)) {
+        deps.log?.error?.("completion: un-addressable media identity — retry", {
+            mediaId: job.mediaId,
+        });
+        return { kind: "retry", reason: "cas-key-error" };
+    }
+    // The cleaned bytes live at the STAGING key until promoted to cas/.
+    const stagingK = `processing/${media.tenantId}/${media.uploadId}`;
+    // 4. Decide (pure). Promotion is gated on the cleaned bytes being available to
+    //    serve: present in cas/ (after a prior promote) OR at the staging key
+    //    (before promote). Either satisfies casObjectPresent.
+    const casPresent = (await deps.storage.headObject(casK)).exists ||
+        (await deps.storage.headObject(stagingK)).exists;
+    const action = decidePromotion({
+        visual,
+        audio,
+        currentStatus: media.moderationStatus,
+        casObjectPresent: casPresent,
+    });
+    // An illegal transition (e.g. replay on a terminal APPROVED/REJECTED) is an
+    // idempotent ack-drop — NEVER a DLQ.
+    if (action.transition.ok === false) {
+        deps.log?.info?.("completion: illegal/absorbing transition — ack-drop", {
+            mediaId: job.mediaId,
+            from: media.moderationStatus,
+        });
+        return { kind: "illegal-transition" };
+    }
+    const nextStatusValue = action.transition.status;
+    // 5. APPLY in fixed order: promote -> persist -> emit.
+    // 5a. PROMOTE: copy the CLEANED STAGING bytes (the exact bytes that were
+    //     moderated) to cas/ so they can serve — NEVER the raw pending upload.
+    //     copyObject is idempotent (content-derived target key). Then best-effort
+    //     remove BOTH the raw original (pending/) and the staging copy. cas/ thus
+    //     only ever holds APPROVED cleaned bytes.
+    if (action.shouldPromote) {
+        await deps.storage.copyObject(stagingK, casK);
+        // Best-effort raw-original cleanup. Tolerate already-deleted (a prior
+        // delivery or lifecycle expiry) — the cas/ copy is what matters.
+        try {
+            await deps.storage.deleteObject(pendingK);
+        }
+        catch (err) {
+            deps.log?.warn?.("completion: pending delete tolerated", {
+                mediaId: job.mediaId,
+                error: String(err),
+            });
+        }
+        // Best-effort staging cleanup. Same tolerance.
+        try {
+            await deps.storage.deleteObject(stagingK);
+        }
+        catch (err) {
+            deps.log?.warn?.("completion: staging delete tolerated", {
+                mediaId: job.mediaId,
+                error: String(err),
+            });
+        }
+    }
+    // 5b. PERSIST the new status.
+    if (action.shouldPersistStatus) {
+        await deps.store.persistMediaStatus(job.mediaId, nextStatusValue);
+    }
+    // 5c. EMIT the anti-oracle resolved event (ready|not-ready ONLY).
+    if (action.shouldEmitResolved) {
+        const payload = moderationResolvedPayload(job.mediaId, nextStatusValue);
+        await deps.emitResolved(payload);
+    }
+    deps.log?.info?.("completion: applied", {
+        mediaId: job.mediaId,
+        status: nextStatusValue,
+    });
+    return { kind: "applied", status: nextStatusValue };
+}
+// ---------------------------------------------------------------------------
+// SQS handler — the thin adapter. Wiring of concrete adapters (Prisma,
+// Rekognition/Transcribe SDK clients, S3, the event emitter, the threshold-
+// snapshot reinterpreter) is done by the consuming app at startup and bound into
+// `buildDeps`; THIS file ships SDK-free except for the lambda type import.
+// ---------------------------------------------------------------------------
+/**
+ * Build the SQS handler from injected deps. The consuming app provides the
+ * concrete adapters; tests provide mocks and call {@link processCompletion}
+ * directly.
+ *
+ * A record that yields `kind: "retry"` (or throws) is reported as a batch-item
+ * failure so SQS retries / DLQs it. Every other outcome is an ack (the message
+ * is consumed): duplicates, unroutable pointers, and illegal transitions are all
+ * fail-closed ack-drops — they must never DLQ-loop.
+ */
+export function makeHandler(deps) {
+    return async (event) => {
+        const failedIds = [];
+        for (const record of event.Records) {
+            try {
+                const outcome = await processCompletion(record.body, deps);
+                if (outcome.kind === "retry") {
+                    deps.log?.error?.("completion: retry", {
+                        messageId: record.messageId,
+                        reason: outcome.reason,
+                    });
+                    failedIds.push(record.messageId);
+                }
+            }
+            catch (err) {
+                // Unexpected (transient I/O) failure — return to the queue for retry.
+                deps.log?.error?.("completion: unexpected failure — retry", {
+                    messageId: record.messageId,
+                    error: String(err),
+                });
+                failedIds.push(record.messageId);
+            }
+        }
+        if (failedIds.length > 0) {
+            return { batchItemFailures: failedIds.map((id) => ({ itemIdentifier: id })) };
+        }
+    };
+}
+//# sourceMappingURL=media-completion-worker.js.map

package/dist/lambda/media-completion-worker.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"media-completion-worker.js","sourceRoot":"","sources":["../../src/lambda/media-completion-worker.ts"],"names":[],"mappings":"AAAA,2EAA2E;AAC3E,iCAAiC;AACjC,EAAE;AACF,yEAAyE;AACzE,4BAA4B;AAC5B,EAAE;AACF,+EAA+E;AAC/E,iFAAiF;AACjF,sEAAsE;AACtE,iFAAiF;AACjF,iFAAiF;AACjF,EAAE;AACF,iFAAiF;AACjF,gFAAgF;AAChF,kFAAkF;AAClF,+EAA+E;AAC/E,0BAA0B;AAC1B,EAAE;AACF,yCAAyC;AACzC,gCAAgC;AAChC,iFAAiF;AACjF,mEAAmE;AACnE,4EAA4E;AAC5E,gFAAgF;AAChF,oFAAoF;AACpF,gFAAgF;AAChF,oFAAoF;AACpF,4EAA4E;AAC5E,iFAAiF;AACjF,gFAAgF;AAChF,wDAAwD;AACxD,6BAA6B;AAC7B,+EAA+E;AAC/E,+EAA+E;AAC/E,iFAAiF;AACjF,4EAA4E;AAC5E,gFAAgF;AAChF,4DAA4D;AAC5D,+DAA+D;AAC/D,iEAAiE;AACjE,+EAA+E;AAC/E,kFAAkF;AAClF,EAAE;AACF,8EAA8E;AAC9E,+EAA+E;AAC/E,oFAAoF;AACpF,iFAAiF;AACjF,wDAAwD;AACxD,EAAE;AACF,iFAAiF;AACjF,yEAAyE;AACzE,+EAA+E;AAI/E,OAAO,EAAE,eAAe,EAAE,MAAM,kCAAkC,CAAC;AACnE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAE7E,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,EAAE,yBAAyB,EAAE,MAAM,6CAA6C,CAAC;AACxF,OAAO,EAAE,8BAA8B,EAAE,MAAM,uCAAuC,CAAC;AAqJvF,8EAA8E;AAC9E,oEAAoE;AACpE,8EAA8E;AAE9E;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,iBAAiB,CAC/B,IAAY;IAEZ,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAE3D,MAAM,GAAG,GAAG,IAA+B,CAAC;IAE5C,4EAA4E;IAC5E,MAAM,MAAM,GACV,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,KAAK,IAAI;QACnD,CAAC,CAAE,GAAG,CAAC,MAAkC;QACzC,CAAC,CAAC,SAAS,CAAC;IAChB,MAAM,iBAAiB,GACrB,UAAU,CAAC,MAAM,EAAE,oBAAoB,CAAC;QACxC,UAAU,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC;IACvC,IAAI,iBAAiB,KAAK,IAAI,EAAE,CAAC;QAC/B,OAAO,EAAE,KAAK,EAAE,iBAAiB,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;IACtD,CAAC;IAED,4EAA4E;IAC5E,qCAAqC;IACrC,MAAM,WAAW,GAAG,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAC1C,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;QACzB,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;IACjD,CAAC;IACD,MAAM,UAAU,GAAG,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAC3C,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;QACxB,IAAI,KAAc,CAAC;QACnB,IAAI,CAAC;YACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QACjC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAChD,MAAM,UAAU,GAAG,UAAU,CAAE,KAAiC,CAAC,KAAK,CAAC,CAAC;YACxE,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;gBACxB,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;YAChD,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,kEAAkE;AAClE,SAAS,UAAU,CAAC,CAAU;IAC5B,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAC1D,CAAC;AAED,8EAA8E;AAC9E,uDAAuD;AACvD,8EAA8E;AAE9E;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,OAA0D,EAC1D,GAAqB,EACrB,IAAoB;IAEpB,IAAI,OAAO,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC/B,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,kBAAkB,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACxE,IAAI,OAAO,IAAI,IAAI,IAAI,OAAO,OAAO,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QAChE,MAAM,QAAQ,GAAG,IAAI,CAAC,iBAAiB,CAAC,OAAO,EAAE,GAAG,CAAC,iBAAiB,CAAC,CAAC;QACxE,OAAO,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IACrC,CAAC;IAED,QAAQ;IACR,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,gBAAgB,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAClE,IAAI,GAAG,IAAI,IAAI,IAAI,GAAG,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;QAC9C,gEAAgE;QAChE,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,UAAU,GAAG,GAAG,CAAC,UAAU,IAAI,EAAE,CAAC;IACxC,MAAM,QAAQ,GAAG,MAAM,8BAA8B,CACnD,UAAU,EACV,IAAI,CAAC,cAAc,CACpB,CAAC;IACF,OAAO,iBAAiB,CAAC,QAAQ,CAAC,CAAC;AACrC,CAAC;AAED,iFAAiF;AACjF,SAAS,iBAAiB,CAAC,CAAU;IACnC,OAAO,CAAC,KAAK,UAAU,IAAI,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAC7E,CAAC;AAED,8EAA8E;AAC9E,wDAAwD;AACxD,8EAA8E;AAE9E,8EAA8E;AAC9E,SAAS,mBAAmB,CAAC,CAA4B;IACvD,OAAO,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;AAC/E,CAAC;AAED,+EAA+E;AAC/E,SAAS,gBAAgB,CAAC,KAAsB;IAC9C,QAAQ,KAAK,CAAC,KAAK,EAAE,CAAC;QACpB,KAAK,SAAS;YACZ,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC;QACxD,KAAK,QAAQ;YACX,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;QAC7B,KAAK,SAAS,CAAC;QACf;YACE,uEAAuE;YACvE,yEAAyE;YACzE,mEAAmE;YACnE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;IAChC,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,mDAAmD;AACnD,8EAA8E;AAE9E;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,IAAY,EACZ,IAAoB;IAEpB,yDAAyD;IACzD,MAAM,OAAO,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;IACxC,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACrB,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,+CAA+C,CAAC,CAAC;QAClE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;IAChC,CAAC;IAED,4EAA4E;IAC5E,sEAAsE;IACtE,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAC3D,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;QACjB,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,sCAAsC,EAAE;YACvD,KAAK,EAAE,OAAO,CAAC,KAAK;SACrB,CAAC,CAAC;QACH,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;IAChC,CAAC;IAED,8EAA8E;IAC9E,+EAA+E;IAC/E,2EAA2E;IAC3E,8EAA8E;IAC9E,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACtD,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACnB,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,0CAA0C,EAAE;YAC3D,OAAO,EAAE,GAAG,CAAC,OAAO;SACrB,CAAC,CAAC;QACH,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;IAChC,CAAC;IAED,6EAA6E;IAC7E,8EAA8E;IAC9E,iEAAiE;IACjE,MAAM,SAAS,GAAG,eAAe,CAAC;QAChC,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,KAAK,EAAE,OAAO,CAAC,KAAK;KACrB,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC;IACzD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,2CAA2C,EAAE;YAC5D,KAAK,EAAE,OAAO,CAAC,KAAK;SACrB,CAAC,CAAC;QACH,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;IAC/B,CAAC;IAED,yEAAyE;IACzE,MAAM,YAAY,GAAG,MAAM,oBAAoB,CAAC,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;IAEpE,6EAA6E;IAC7E,4EAA4E;IAC5E,mEAAmE;IACnE,IAAI,YAAY,KAAK,IAAI,EAAE,CAAC;QAC1B,MAAM,IAAI,CAAC,KAAK,CAAC,oBAAoB,CAAC,OAAO,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;IACrE,CAAC;IAED,2DAA2D;IAC3D,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IAC1E,MAAM,WAAW,GAAG,mBAAmB,CAAC,YAAY,CAAC,CAAC;IACtD,MAAM,YAAY,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;IAE7C,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,YAAY,CAAC;IACvE,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,KAAK,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,YAAY,CAAC;IAErE,6EAA6E;IAC7E,+EAA+E;IAC/E,8EAA8E;IAC9E,sEAAsE;IACtE,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;IACvD,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC5D,IAAI,aAAa,CAAC,IAAI,CAAC,IAAI,aAAa,CAAC,QAAQ,CAAC,EAAE,CAAC;QACnD,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,mDAAmD,EAAE;YACrE,OAAO,EAAE,GAAG,CAAC,OAAO;SACrB,CAAC,CAAC;QACH,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;IACpD,CAAC;IACD,oEAAoE;IACpE,MAAM,QAAQ,GAAG,cAAc,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;IAElE,+EAA+E;IAC/E,0EAA0E;IAC1E,0DAA0D;IAC1D,MAAM,UAAU,GACd,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM;QAC5C,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC;IACnD,MAAM,MAAM,GAAG,eAAe,CAAC;QAC7B,MAAM;QACN,KAAK;QACL,aAAa,EAAE,KAAK,CAAC,gBAAgB;QACrC,gBAAgB,EAAE,UAAU;KAC7B,CAAC,CAAC;IAEH,4EAA4E;IAC5E,qCAAqC;IACrC,IAAI,MAAM,CAAC,UAAU,CAAC,EAAE,KAAK,KAAK,EAAE,CAAC;QACnC,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,qDAAqD,EAAE;YACtE,OAAO,EAAE,GAAG,CAAC,OAAO;YACpB,IAAI,EAAE,KAAK,CAAC,gBAAgB;SAC7B,CAAC,CAAC;QACH,OAAO,EAAE,IAAI,EAAE,oBAAoB,EAAE,CAAC;IACxC,CAAC;IAED,MAAM,eAAe,GAAG,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC;IAEjD,uDAAuD;IAEvD,yEAAyE;IACzE,2EAA2E;IAC3E,8EAA8E;IAC9E,8EAA8E;IAC9E,8CAA8C;IAC9C,IAAI,MAAM,CAAC,aAAa,EAAE,CAAC;QACzB,MAAM,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QAC9C,sEAAsE;QACtE,iEAAiE;QACjE,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;QAC5C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,sCAAsC,EAAE;gBACvD,OAAO,EAAE,GAAG,CAAC,OAAO;gBACpB,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC;aACnB,CAAC,CAAC;QACL,CAAC;QACD,+CAA+C;QAC/C,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;QAC5C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,sCAAsC,EAAE;gBACvD,OAAO,EAAE,GAAG,CAAC,OAAO;gBACpB,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC;aACnB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,8BAA8B;IAC9B,IAAI,MAAM,CAAC,mBAAmB,EAAE,CAAC;QAC/B,MAAM,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC,GAAG,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;IACpE,CAAC;IAED,kEAAkE;IAClE,IAAI,MAAM,CAAC,kBAAkB,EAAE,CAAC;QAC9B,MAAM,OAAO,GAAG,yBAAyB,CAAC,GAAG,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;QACxE,MAAM,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;IACnC,CAAC;IAED,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,qBAAqB,EAAE;QACtC,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,MAAM,EAAE,eAAe;KACxB,CAAC,CAAC;IACH,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;AACtD,CAAC;AAED,8EAA8E;AAC9E,uEAAuE;AACvE,4EAA4E;AAC5E,iFAAiF;AACjF,2EAA2E;AAC3E,8EAA8E;AAE9E;;;;;;;;;GASG;AACH,MAAM,UAAU,WAAW,CAAC,IAAoB;IAC9C,OAAO,KAAK,EAAE,KAAK,EAAE,EAAE;QACrB,MAAM,SAAS,GAAa,EAAE,CAAC;QAE/B,KAAK,MAAM,MAAM,IAAI,KAAK,CAAC,OAAsB,EAAE,CAAC;YAClD,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;gBAC3D,IAAI,OAAO,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;oBAC7B,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,mBAAmB,EAAE;wBACrC,SAAS,EAAE,MAAM,CAAC,SAAS;wBAC3B,MAAM,EAAE,OAAO,CAAC,MAAM;qBACvB,CAAC,CAAC;oBACH,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;gBACnC,CAAC;YACH,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,sEAAsE;gBACtE,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,wCAAwC,EAAE;oBAC1D,SAAS,EAAE,MAAM,CAAC,SAAS;oBAC3B,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC;iBACnB,CAAC,CAAC;gBACH,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YACnC,CAAC;QACH,CAAC;QAED,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACzB,OAAO,EAAE,iBAAiB,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,cAAc,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC;QAChF,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}