@forestadmin/agent 1.95.1 → 1.96.0

package/dist/audit-trail/sql-store.js

@@ -0,0 +1,316 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEFAULT_TABLE = exports.DEFAULT_SCHEMA = void 0;
+exports.defineAuditLogModel = defineAuditLogModel;
+exports.ensureAuditStorage = ensureAuditStorage;
+exports.toRow = toRow;
+exports.fieldsChangedCondition = fieldsChangedCondition;
+exports.searchCondition = searchCondition;
+exports.fromRow = fromRow;
+exports.createSqlAuditStore = createSqlAuditStore;
+const sequelize_1 = require("sequelize");
+const migrations_1 = require("./migrations");
+exports.DEFAULT_SCHEMA = 'forest';
+exports.DEFAULT_TABLE = 'audit_logs';
+const DIALECTS_WITH_SCHEMAS = new Set(['postgres', 'mssql']);
+const MODEL_NAME = 'ForestAuditLog';
+function defineAuditLogModel(sequelize, options) {
+    return sequelize.define(MODEL_NAME, {
+        id: { type: sequelize_1.DataTypes.BIGINT, primaryKey: true, autoIncrement: true },
+        // Millisecond precision: a bare DATE truncates to whole seconds on MySQL, which would
+        // silently drop the fractional part the `/state` boundary and the `id` tiebreaker both rely
+        // on for correct ordering.
+        timestamp: { type: sequelize_1.DataTypes.DATE(3), allowNull: false },
+        operation: { type: sequelize_1.DataTypes.STRING, allowNull: false },
+        collection: { type: sequelize_1.DataTypes.STRING, allowNull: false },
+        // TEXT, not STRING (VARCHAR(255)): a packed composite-id can exceed 255 characters, and the
+        // migration creates the column as such — this must match. Nullable: a pending create's row
+        // has no id yet, since the record doesn't exist until the write resolves.
+        recordId: { type: sequelize_1.DataTypes.TEXT, allowNull: true },
+        userId: { type: sequelize_1.DataTypes.INTEGER, allowNull: true },
+        // Denormalised from the caller at write time — who acted then, not who holds that id today.
+        userFirstName: { type: sequelize_1.DataTypes.TEXT, allowNull: true },
+        userLastName: { type: sequelize_1.DataTypes.TEXT, allowNull: true },
+        userEmail: { type: sequelize_1.DataTypes.TEXT, allowNull: true },
+        // `action` / `action_failed` rows only.
+        actionName: { type: sequelize_1.DataTypes.TEXT, allowNull: true },
+        correlationKey: { type: sequelize_1.DataTypes.STRING, allowNull: true },
+        previousValues: { type: sequelize_1.DataTypes.JSON, allowNull: false, defaultValue: {} },
+        newValues: { type: sequelize_1.DataTypes.JSON, allowNull: false, defaultValue: {} },
+        status: { type: sequelize_1.DataTypes.STRING, allowNull: false, defaultValue: 'done' },
+    }, {
+        schema: options.schema,
+        tableName: options.tableName,
+        timestamps: false,
+        underscored: true,
+        freezeTableName: true,
+    });
+}
+async function ensureAuditStorage(sequelize, options) {
+    const schema = DIALECTS_WITH_SCHEMAS.has(sequelize.getDialect()) ? options.schema : undefined;
+    await (0, migrations_1.runAuditMigrations)(sequelize, { schema, tableName: options.tableName });
+    return defineAuditLogModel(sequelize, { schema, tableName: options.tableName });
+}
+function toRow(record) {
+    return {
+        timestamp: record.timestamp,
+        operation: record.operation,
+        collection: record.collection,
+        recordId: record.recordId,
+        userId: record.userId,
+        userFirstName: record.userFirstName,
+        userLastName: record.userLastName,
+        userEmail: record.userEmail,
+        actionName: record.actionName,
+        correlationKey: record.correlationKey,
+        previousValues: record.previousValues,
+        newValues: record.newValues,
+        status: record.status,
+    };
+}
+// A bare `$.${field}` path treats a dot in `field` as a nested-member separator instead of a
+// literal character (so `profile.name` would look up `profile` → `name` instead of the top-level
+// key `"profile.name"` the audit row actually stores under). Quoting the segment makes it literal.
+function jsonPath(field) {
+    return `$."${field.replace(/"/g, '\\"')}"`;
+}
+function fieldsChangedCondition(sequelize, fields) {
+    const dialect = sequelize.getDialect();
+    if (dialect === 'postgres') {
+        const keys = fields.map(field => sequelize.escape(field)).join(',');
+        return sequelize_1.Sequelize.literal(`(jsonb_exists_any("previous_values"::jsonb, ARRAY[${keys}]) ` +
+            `OR jsonb_exists_any("new_values"::jsonb, ARRAY[${keys}]))`);
+    }
+    if (dialect === 'sqlite') {
+        const tests = fields.flatMap(field => {
+            const path = sequelize.escape(jsonPath(field));
+            return [
+                `json_type(previous_values, ${path}) IS NOT NULL`,
+                `json_type(new_values, ${path}) IS NOT NULL`,
+            ];
+        });
+        return sequelize_1.Sequelize.literal(`(${tests.join(' OR ')})`);
+    }
+    if (dialect === 'mysql' || dialect === 'mariadb') {
+        const paths = fields.map(field => sequelize.escape(jsonPath(field))).join(',');
+        return sequelize_1.Sequelize.literal(`(JSON_CONTAINS_PATH(previous_values, 'one', ${paths}) ` +
+            `OR JSON_CONTAINS_PATH(new_values, 'one', ${paths}))`);
+    }
+    if (dialect === 'mssql') {
+        const tests = fields.flatMap(field => {
+            const path = sequelize.escape(jsonPath(field));
+            return [
+                `JSON_PATH_EXISTS(previous_values, ${path}) = 1`,
+                `JSON_PATH_EXISTS(new_values, ${path}) = 1`,
+            ];
+        });
+        // JSON_PATH_EXISTS requires SQL Server 2022+.
+        return sequelize_1.Sequelize.literal(`(${tests.join(' OR ')})`);
+    }
+    throw new Error(`Audit-trail "fields" filter is not supported on dialect "${dialect}"`);
+}
+// JSON columns are already stored as plain text on dialects with no native JSON type (sqlite,
+// mssql); only postgres/mysql/mariadb need an explicit cast before a text match can run on them.
+function jsonColumnAsText(sequelize, column) {
+    const dialect = sequelize.getDialect();
+    if (dialect === 'postgres')
+        return `${column}::text`;
+    if (dialect === 'mysql' || dialect === 'mariadb')
+        return `CAST(${column} AS CHAR)`;
+    return column;
+}
+// A free-text search against the *serialized* JSON text naturally covers "keys and scalar values
+// at any depth" without walking the structure by hand: both a key and a value appear as a quoted
+// literal substring of that text. This runs as a SQL WHERE clause (not an in-memory scan of
+// fetched rows), so it composes with pagination and COUNT the same way every other filter does. A
+// redacted value can't match a search for the real value — the real value already isn't in this
+// text, `redactValues` replaced it before the row was ever written.
+function searchCondition(sequelize, term) {
+    // `~` rather than the standard `\`: MySQL/MariaDB treat backslash as a string-literal escape
+    // character under the default sql_mode (no NO_BACKSLASH_ESCAPES), so a bare `ESCAPE '\'` is
+    // itself malformed there — the backslash escapes the closing quote instead of terminating the
+    // literal. `~` has no special meaning to any of the four supported dialects' string literals, so
+    // it sidesteps that interaction entirely. Escapes the two LIKE wildcards plus itself, so a term
+    // containing `%`/`_`/`~` is matched literally instead of behaving like a pattern.
+    const escaped = term.replace(/[~%_]/g, char => `~${char}`);
+    const pattern = sequelize.escape(`%${escaped}%`);
+    const columns = [
+        'action_name',
+        'user_first_name',
+        'user_last_name',
+        'user_email',
+        jsonColumnAsText(sequelize, 'previous_values'),
+        jsonColumnAsText(sequelize, 'new_values'),
+    ];
+    return sequelize_1.Sequelize.literal(`(${columns.map(column => `LOWER(${column}) LIKE LOWER(${pattern}) ESCAPE '~'`).join(' OR ')})`);
+}
+function buildHistoryWhereClause({ collection, recordId, userIds, startTimestamp, endTimestamp, fields, search, }, sequelize) {
+    const where = { collection, recordId };
+    if (userIds)
+        where.userId = { [sequelize_1.Op.in]: userIds };
+    const timestampRange = {};
+    if (startTimestamp)
+        timestampRange[sequelize_1.Op.gte] = new Date(startTimestamp);
+    if (endTimestamp)
+        timestampRange[sequelize_1.Op.lte] = new Date(endTimestamp);
+    if (Object.getOwnPropertySymbols(timestampRange).length)
+        where.timestamp = timestampRange;
+    const andConditions = [];
+    if (fields?.length)
+        andConditions.push(fieldsChangedCondition(sequelize, fields));
+    if (search)
+        andConditions.push(searchCondition(sequelize, search));
+    if (andConditions.length)
+        where[sequelize_1.Op.and] = andConditions;
+    return where;
+}
+function fromRow(row) {
+    const plain = row.get({ plain: true });
+    const { timestamp } = plain;
+    return {
+        id: Number(plain.id),
+        timestamp: timestamp instanceof Date ? timestamp.toISOString() : String(timestamp),
+        operation: plain.operation,
+        collection: plain.collection,
+        recordId: plain.recordId ?? null,
+        userId: plain.userId,
+        userFirstName: plain.userFirstName ?? null,
+        userLastName: plain.userLastName ?? null,
+        userEmail: plain.userEmail ?? null,
+        actionName: plain.actionName ?? null,
+        correlationKey: plain.correlationKey,
+        previousValues: plain.previousValues ?? {},
+        newValues: plain.newValues ?? {},
+        status: plain.status,
+    };
+}
+/**
+ * Returns a SQL-backed audit store. Construction is synchronous so the store can be passed to
+ * `createAgent` at module top level; the connection (and pending migrations) only run when
+ * `store.init()` is awaited during `agent.start()`. The store also self-initializes on the first
+ * append or read so tests and manual scripts work without an explicit init.
+ */
+function createSqlAuditStore(options) {
+    const { connectionString, schema = exports.DEFAULT_SCHEMA, tableName = exports.DEFAULT_TABLE } = options;
+    let sequelize = null;
+    let bootstrap = null;
+    const init = () => {
+        if (bootstrap)
+            return bootstrap;
+        const connection = new sequelize_1.Sequelize(connectionString, { logging: false });
+        sequelize = connection;
+        bootstrap = (async () => {
+            try {
+                await connection.authenticate();
+                const model = await ensureAuditStorage(connection, { schema, tableName });
+                return { model, connection };
+            }
+            catch (error) {
+                // Reset so a later call can retry once the database is reachable.
+                await connection.close().catch(() => undefined);
+                sequelize = null;
+                bootstrap = null;
+                throw error;
+            }
+        })();
+        return bootstrap;
+    };
+    // Insertion-order tiebreaker on `id` keeps paging deterministic when timestamps collide.
+    const chronologicalOrder = [
+        ['timestamp', 'ASC'],
+        ['id', 'ASC'],
+    ];
+    return {
+        store: {
+            async init() {
+                await init();
+            },
+            async insertPending(record) {
+                const { model } = await init();
+                const row = await model.create(toRow({ ...record, status: 'pending' }));
+                return Number(row.get('id'));
+            },
+            // Per-row generated ids from one statement are trustworthy on every supported dialect:
+            // Postgres/MSSQL return them natively (RETURNING/OUTPUT), Sequelize infers them sequentially
+            // from the single last-insert-id on MySQL/MariaDB (safe because a multi-row INSERT holds the
+            // table's auto-increment lock for the whole statement under the default lock mode — no other
+            // connection's insert can land an id in the middle of this batch), and sqlite returns them
+            // directly too (verified empirically).
+            async insertPendingBatch(records) {
+                const { model } = await init();
+                const rows = await model.bulkCreate(records.map(record => toRow({ ...record, status: 'pending' })));
+                return rows.map(row => Number(row.get('id')));
+            },
+            async confirm(id, patch) {
+                const { model } = await init();
+                await model.update({ ...patch, status: 'done' }, { where: { id } });
+            },
+            async listByRecord(query) {
+                const { model, connection } = await init();
+                const { skip = 0, limit, order = 'asc' } = query;
+                const direction = order === 'desc' ? 'DESC' : 'ASC';
+                const rows = await model.findAll({
+                    where: buildHistoryWhereClause(query, connection),
+                    order: [
+                        ['timestamp', direction],
+                        ['id', direction],
+                    ],
+                    offset: skip,
+                    limit,
+                });
+                return rows.map(fromRow);
+            },
+            async countByRecord(query) {
+                const { model, connection } = await init();
+                return model.count({ where: buildHistoryWhereClause(query, connection) });
+            },
+            async listDistinctUsers(query) {
+                const { model, connection } = await init();
+                // MAX() rather than a bare column: grouping by `user_id` alone is invalid in strict SQL
+                // unless every selected column is either grouped or aggregated.
+                const rows = (await model.findAll({
+                    where: buildHistoryWhereClause(query, connection),
+                    attributes: [
+                        'userId',
+                        [sequelize_1.Sequelize.fn('MAX', sequelize_1.Sequelize.col('user_first_name')), 'userFirstName'],
+                        [sequelize_1.Sequelize.fn('MAX', sequelize_1.Sequelize.col('user_last_name')), 'userLastName'],
+                        [sequelize_1.Sequelize.fn('MAX', sequelize_1.Sequelize.col('user_email')), 'userEmail'],
+                    ],
+                    group: ['userId'],
+                    raw: true,
+                }));
+                return rows.map(row => ({
+                    id: row.userId,
+                    firstName: row.userFirstName ?? null,
+                    lastName: row.userLastName ?? null,
+                    email: row.userEmail ?? null,
+                }));
+            },
+            async listByCorrelation({ collection, recordId, correlationKey }) {
+                const { model } = await init();
+                const rows = await model.findAll({
+                    where: { collection, recordId, correlationKey },
+                    order: chronologicalOrder,
+                });
+                return rows.map(fromRow);
+            },
+            async listByCorrelations({ collection, recordId, correlationKeys }) {
+                if (!correlationKeys.length)
+                    return [];
+                const { model } = await init();
+                const rows = await model.findAll({
+                    where: { collection, recordId, correlationKey: { [sequelize_1.Op.in]: correlationKeys } },
+                    order: chronologicalOrder,
+                });
+                return rows.map(fromRow);
+            },
+        },
+        close: async () => {
+            if (sequelize)
+                await sequelize.close();
+            sequelize = null;
+            bootstrap = null;
+        },
+    };
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic3FsLXN0b3JlLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vc3JjL2F1ZGl0LXRyYWlsL3NxbC1zdG9yZS50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7QUFxQkEsa0RBc0NDO0FBRUQsZ0RBU0M7QUFFRCxzQkFrQkM7QUFTRCx3REFpREM7QUFtQkQsMENBc0JDO0FBK0JELDBCQW9CQztBQVFELGtEQW1KQztBQWpZRCx5Q0FBcUQ7QUFFckQsNkNBQWtEO0FBRXJDLFFBQUEsY0FBYyxHQUFHLFFBQVEsQ0FBQztBQUMxQixRQUFBLGFBQWEsR0FBRyxZQUFZLENBQUM7QUFFMUMsTUFBTSxxQkFBcUIsR0FBRyxJQUFJLEdBQUcsQ0FBQyxDQUFDLFVBQVUsRUFBRSxPQUFPLENBQUMsQ0FBQyxDQUFDO0FBRTdELE1BQU0sVUFBVSxHQUFHLGdCQUFnQixDQUFDO0FBRXBDLFNBQWdCLG1CQUFtQixDQUNqQyxTQUFvQixFQUNwQixPQUErQztJQUUvQyxPQUFPLFNBQVMsQ0FBQyxNQUFNLENBQ3JCLFVBQVUsRUFDVjtRQUNFLEVBQUUsRUFBRSxFQUFFLElBQUksRUFBRSxxQkFBUyxDQUFDLE1BQU0sRUFBRSxVQUFVLEVBQUUsSUFBSSxFQUFFLGFBQWEsRUFBRSxJQUFJLEVBQUU7UUFDckUsc0ZBQXNGO1FBQ3RGLDRGQUE0RjtRQUM1RiwyQkFBMkI7UUFDM0IsU0FBUyxFQUFFLEVBQUUsSUFBSSxFQUFFLHFCQUFTLENBQUMsSUFBSSxDQUFDLENBQUMsQ0FBQyxFQUFFLFNBQVMsRUFBRSxLQUFLLEVBQUU7UUFDeEQsU0FBUyxFQUFFLEVBQUUsSUFBSSxFQUFFLHFCQUFTLENBQUMsTUFBTSxFQUFFLFNBQVMsRUFBRSxLQUFLLEVBQUU7UUFDdkQsVUFBVSxFQUFFLEVBQUUsSUFBSSxFQUFFLHFCQUFTLENBQUMsTUFBTSxFQUFFLFNBQVMsRUFBRSxLQUFLLEVBQUU7UUFDeEQsNEZBQTRGO1FBQzVGLDJGQUEyRjtRQUMzRiwwRUFBMEU7UUFDMUUsUUFBUSxFQUFFLEVBQUUsSUFBSSxFQUFFLHFCQUFTLENBQUMsSUFBSSxFQUFFLFNBQVMsRUFBRSxJQUFJLEVBQUU7UUFDbkQsTUFBTSxFQUFFLEVBQUUsSUFBSSxFQUFFLHFCQUFTLENBQUMsT0FBTyxFQUFFLFNBQVMsRUFBRSxJQUFJLEVBQUU7UUFDcEQsNEZBQTRGO1FBQzVGLGFBQWEsRUFBRSxFQUFFLElBQUksRUFBRSxxQkFBUyxDQUFDLElBQUksRUFBRSxTQUFTLEVBQUUsSUFBSSxFQUFFO1FBQ3hELFlBQVksRUFBRSxFQUFFLElBQUksRUFBRSxxQkFBUyxDQUFDLElBQUksRUFBRSxTQUFTLEVBQUUsSUFBSSxFQUFFO1FBQ3ZELFNBQVMsRUFBRSxFQUFFLElBQUksRUFBRSxxQkFBUyxDQUFDLElBQUksRUFBRSxTQUFTLEVBQUUsSUFBSSxFQUFFO1FBQ3BELHdDQUF3QztRQUN4QyxVQUFVLEVBQUUsRUFBRSxJQUFJLEVBQUUscUJBQVMsQ0FBQyxJQUFJLEVBQUUsU0FBUyxFQUFFLElBQUksRUFBRTtRQUNyRCxjQUFjLEVBQUUsRUFBRSxJQUFJLEVBQUUscUJBQVMsQ0FBQyxNQUFNLEVBQUUsU0FBUyxFQUFFLElBQUksRUFBRTtRQUMzRCxjQUFjLEVBQUUsRUFBRSxJQUFJLEVBQUUscUJBQVMsQ0FBQyxJQUFJLEVBQUUsU0FBUyxFQUFFLEtBQUssRUFBRSxZQUFZLEVBQUUsRUFBRSxFQUFFO1FBQzVFLFNBQVMsRUFBRSxFQUFFLElBQUksRUFBRSxxQkFBUyxDQUFDLElBQUksRUFBRSxTQUFTLEVBQUUsS0FBSyxFQUFFLFlBQVksRUFBRSxFQUFFLEVBQUU7UUFDdkUsTUFBTSxFQUFFLEVBQUUsSUFBSSxFQUFFLHFCQUFTLENBQUMsTUFBTSxFQUFFLFNBQVMsRUFBRSxLQUFLLEVBQUUsWUFBWSxFQUFFLE1BQU0sRUFBRTtLQUMzRSxFQUNEO1FBQ0UsTUFBTSxFQUFFLE9BQU8sQ0FBQyxNQUFNO1FBQ3RCLFNBQVMsRUFBRSxPQUFPLENBQUMsU0FBUztRQUM1QixVQUFVLEVBQUUsS0FBSztRQUNqQixXQUFXLEVBQUUsSUFBSTtRQUNqQixlQUFlLEVBQUUsSUFBSTtLQUN0QixDQUNGLENBQUM7QUFDSixDQUFDO0FBRU0sS0FBSyxVQUFVLGtCQUFrQixDQUN0QyxTQUFvQixFQUNwQixPQUErQztJQUUvQyxNQUFNLE1BQU0sR0FBRyxxQkFBcUIsQ0FBQyxHQUFHLENBQUMsU0FBUyxDQUFDLFVBQVUsRUFBRSxDQUFDLENBQUMsQ0FBQyxDQUFDLE9BQU8sQ0FBQyxNQUFNLENBQUMsQ0FBQyxDQUFDLFNBQVMsQ0FBQztJQUU5RixNQUFNLElBQUEsK0JBQWtCLEVBQUMsU0FBUyxFQUFFLEVBQUUsTUFBTSxFQUFFLFNBQVMsRUFBRSxPQUFPLENBQUMsU0FBUyxFQUFFLENBQUMsQ0FBQztJQUU5RSxPQUFPLG1CQUFtQixDQUFDLFNBQVMsRUFBRSxFQUFFLE1BQU0sRUFBRSxTQUFTLEVBQUUsT0FBTyxDQUFDLFNBQVMsRUFBRSxDQUFDLENBQUM7QUFDbEYsQ0FBQztBQUVELFNBQWdCLEtBQUssQ0FDbkIsTUFBb0Q7SUFFcEQsT0FBTztRQUNMLFNBQVMsRUFBRSxNQUFNLENBQUMsU0FBUztRQUMzQixTQUFTLEVBQUUsTUFBTSxDQUFDLFNBQVM7UUFDM0IsVUFBVSxFQUFFLE1BQU0sQ0FBQyxVQUFVO1FBQzdCLFFBQVEsRUFBRSxNQUFNLENBQUMsUUFBUTtRQUN6QixNQUFNLEVBQUUsTUFBTSxDQUFDLE1BQU07UUFDckIsYUFBYSxFQUFFLE1BQU0sQ0FBQyxhQUFhO1FBQ25DLFlBQVksRUFBRSxNQUFNLENBQUMsWUFBWTtRQUNqQyxTQUFTLEVBQUUsTUFBTSxDQUFDLFNBQVM7UUFDM0IsVUFBVSxFQUFFLE1BQU0sQ0FBQyxVQUFVO1FBQzdCLGNBQWMsRUFBRSxNQUFNLENBQUMsY0FBYztRQUNyQyxjQUFjLEVBQUUsTUFBTSxDQUFDLGNBQWM7UUFDckMsU0FBUyxFQUFFLE1BQU0sQ0FBQyxTQUFTO1FBQzNCLE1BQU0sRUFBRSxNQUFNLENBQUMsTUFBTTtLQUN0QixDQUFDO0FBQ0osQ0FBQztBQUVELDZGQUE2RjtBQUM3RixpR0FBaUc7QUFDakcsbUdBQW1HO0FBQ25HLFNBQVMsUUFBUSxDQUFDLEtBQWE7SUFDN0IsT0FBTyxNQUFNLEtBQUssQ0FBQyxPQUFPLENBQUMsSUFBSSxFQUFFLEtBQUssQ0FBQyxHQUFHLENBQUM7QUFDN0MsQ0FBQztBQUVELFNBQWdCLHNCQUFzQixDQUFDLFNBQW9CLEVBQUUsTUFBZ0I7SUFDM0UsTUFBTSxPQUFPLEdBQUcsU0FBUyxDQUFDLFVBQVUsRUFBRSxDQUFDO0lBRXZDLElBQUksT0FBTyxLQUFLLFVBQVUsRUFBRSxDQUFDO1FBQzNCLE1BQU0sSUFBSSxHQUFHLE1BQU0sQ0FBQyxHQUFHLENBQUMsS0FBSyxDQUFDLEVBQUUsQ0FBQyxTQUFTLENBQUMsTUFBTSxDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUMsSUFBSSxDQUFDLEdBQUcsQ0FBQyxDQUFDO1FBRXBFLE9BQU8scUJBQVMsQ0FBQyxPQUFPLENBQ3RCLHFEQUFxRCxJQUFJLEtBQUs7WUFDNUQsa0RBQWtELElBQUksS0FBSyxDQUM5RCxDQUFDO0lBQ0osQ0FBQztJQUVELElBQUksT0FBTyxLQUFLLFFBQVEsRUFBRSxDQUFDO1FBQ3pCLE1BQU0sS0FBSyxHQUFHLE1BQU0sQ0FBQyxPQUFPLENBQUMsS0FBSyxDQUFDLEVBQUU7WUFDbkMsTUFBTSxJQUFJLEdBQUcsU0FBUyxDQUFDLE1BQU0sQ0FBQyxRQUFRLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FBQztZQUUvQyxPQUFPO2dCQUNMLDhCQUE4QixJQUFJLGVBQWU7Z0JBQ2pELHlCQUF5QixJQUFJLGVBQWU7YUFDN0MsQ0FBQztRQUNKLENBQUMsQ0FBQyxDQUFDO1FBRUgsT0FBTyxxQkFBUyxDQUFDLE9BQU8sQ0FBQyxJQUFJLEtBQUssQ0FBQyxJQUFJLENBQUMsTUFBTSxDQUFDLEdBQUcsQ0FBQyxDQUFDO0lBQ3RELENBQUM7SUFFRCxJQUFJLE9BQU8sS0FBSyxPQUFPLElBQUksT0FBTyxLQUFLLFNBQVMsRUFBRSxDQUFDO1FBQ2pELE1BQU0sS0FBSyxHQUFHLE1BQU0sQ0FBQyxHQUFHLENBQUMsS0FBSyxDQUFDLEVBQUUsQ0FBQyxTQUFTLENBQUMsTUFBTSxDQUFDLFFBQVEsQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDLENBQUMsSUFBSSxDQUFDLEdBQUcsQ0FBQyxDQUFDO1FBRS9FLE9BQU8scUJBQVMsQ0FBQyxPQUFPLENBQ3RCLCtDQUErQyxLQUFLLElBQUk7WUFDdEQsNENBQTRDLEtBQUssSUFBSSxDQUN4RCxDQUFDO0lBQ0osQ0FBQztJQUVELElBQUksT0FBTyxLQUFLLE9BQU8sRUFBRSxDQUFDO1FBQ3hCLE1BQU0sS0FBSyxHQUFHLE1BQU0sQ0FBQyxPQUFPLENBQUMsS0FBSyxDQUFDLEVBQUU7WUFDbkMsTUFBTSxJQUFJLEdBQUcsU0FBUyxDQUFDLE1BQU0sQ0FBQyxRQUFRLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FBQztZQUUvQyxPQUFPO2dCQUNMLHFDQUFxQyxJQUFJLE9BQU87Z0JBQ2hELGdDQUFnQyxJQUFJLE9BQU87YUFDNUMsQ0FBQztRQUNKLENBQUMsQ0FBQyxDQUFDO1FBRUgsOENBQThDO1FBQzlDLE9BQU8scUJBQVMsQ0FBQyxPQUFPLENBQUMsSUFBSSxLQUFLLENBQUMsSUFBSSxDQUFDLE1BQU0sQ0FBQyxHQUFHLENBQUMsQ0FBQztJQUN0RCxDQUFDO0lBRUQsTUFBTSxJQUFJLEtBQUssQ0FBQyw0REFBNEQsT0FBTyxHQUFHLENBQUMsQ0FBQztBQUMxRixDQUFDO0FBRUQsOEZBQThGO0FBQzlGLGlHQUFpRztBQUNqRyxTQUFTLGdCQUFnQixDQUFDLFNBQW9CLEVBQUUsTUFBYztJQUM1RCxNQUFNLE9BQU8sR0FBRyxTQUFTLENBQUMsVUFBVSxFQUFFLENBQUM7SUFFdkMsSUFBSSxPQUFPLEtBQUssVUFBVTtRQUFFLE9BQU8sR0FBRyxNQUFNLFFBQVEsQ0FBQztJQUNyRCxJQUFJLE9BQU8sS0FBSyxPQUFPLElBQUksT0FBTyxLQUFLLFNBQVM7UUFBRSxPQUFPLFFBQVEsTUFBTSxXQUFXLENBQUM7SUFFbkYsT0FBTyxNQUFNLENBQUM7QUFDaEIsQ0FBQztBQUVELGlHQUFpRztBQUNqRyxpR0FBaUc7QUFDakcsNEZBQTRGO0FBQzVGLGtHQUFrRztBQUNsRyxnR0FBZ0c7QUFDaEcsb0VBQW9FO0FBQ3BFLFNBQWdCLGVBQWUsQ0FBQyxTQUFvQixFQUFFLElBQVk7SUFDaEUsNkZBQTZGO0lBQzdGLDRGQUE0RjtJQUM1Riw4RkFBOEY7SUFDOUYsaUdBQWlHO0lBQ2pHLGdHQUFnRztJQUNoRyxrRkFBa0Y7SUFDbEYsTUFBTSxPQUFPLEdBQUcsSUFBSSxDQUFDLE9BQU8sQ0FBQyxRQUFRLEVBQUUsSUFBSSxDQUFDLEVBQUUsQ0FBQyxJQUFJLElBQUksRUFBRSxDQUFDLENBQUM7SUFDM0QsTUFBTSxPQUFPLEdBQUcsU0FBUyxDQUFDLE1BQU0sQ0FBQyxJQUFJLE9BQU8sR0FBRyxDQUFDLENBQUM7SUFFakQsTUFBTSxPQUFPLEdBQUc7UUFDZCxhQUFhO1FBQ2IsaUJBQWlCO1FBQ2pCLGdCQUFnQjtRQUNoQixZQUFZO1FBQ1osZ0JBQWdCLENBQUMsU0FBUyxFQUFFLGlCQUFpQixDQUFDO1FBQzlDLGdCQUFnQixDQUFDLFNBQVMsRUFBRSxZQUFZLENBQUM7S0FDMUMsQ0FBQztJQUVGLE9BQU8scUJBQVMsQ0FBQyxPQUFPLENBQ3RCLElBQUksT0FBTyxDQUFDLEdBQUcsQ0FBQyxNQUFNLENBQUMsRUFBRSxDQUFDLFNBQVMsTUFBTSxnQkFBZ0IsT0FBTyxjQUFjLENBQUMsQ0FBQyxJQUFJLENBQUMsTUFBTSxDQUFDLEdBQUcsQ0FDaEcsQ0FBQztBQUNKLENBQUM7QUFFRCxTQUFTLHVCQUF1QixDQUM5QixFQUNFLFVBQVUsRUFDVixRQUFRLEVBQ1IsT0FBTyxFQUNQLGNBQWMsRUFDZCxZQUFZLEVBQ1osTUFBTSxFQUNOLE1BQU0sR0FDWSxFQUNwQixTQUFvQjtJQUVwQixNQUFNLEtBQUssR0FBcUMsRUFBRSxVQUFVLEVBQUUsUUFBUSxFQUFFLENBQUM7SUFFekUsSUFBSSxPQUFPO1FBQUUsS0FBSyxDQUFDLE1BQU0sR0FBRyxFQUFFLENBQUMsY0FBRSxDQUFDLEVBQUUsQ0FBQyxFQUFFLE9BQU8sRUFBRSxDQUFDO0lBRWpELE1BQU0sY0FBYyxHQUF5QixFQUFFLENBQUM7SUFDaEQsSUFBSSxjQUFjO1FBQUUsY0FBYyxDQUFDLGNBQUUsQ0FBQyxHQUFHLENBQUMsR0FBRyxJQUFJLElBQUksQ0FBQyxjQUFjLENBQUMsQ0FBQztJQUN0RSxJQUFJLFlBQVk7UUFBRSxjQUFjLENBQUMsY0FBRSxDQUFDLEdBQUcsQ0FBQyxHQUFHLElBQUksSUFBSSxDQUFDLFlBQVksQ0FBQyxDQUFDO0lBQ2xFLElBQUksTUFBTSxDQUFDLHFCQUFxQixDQUFDLGNBQWMsQ0FBQyxDQUFDLE1BQU07UUFBRSxLQUFLLENBQUMsU0FBUyxHQUFHLGNBQWMsQ0FBQztJQUUxRixNQUFNLGFBQWEsR0FBRyxFQUFFLENBQUM7SUFDekIsSUFBSSxNQUFNLEVBQUUsTUFBTTtRQUFFLGFBQWEsQ0FBQyxJQUFJLENBQUMsc0JBQXNCLENBQUMsU0FBUyxFQUFFLE1BQU0sQ0FBQyxDQUFDLENBQUM7SUFDbEYsSUFBSSxNQUFNO1FBQUUsYUFBYSxDQUFDLElBQUksQ0FBQyxlQUFlLENBQUMsU0FBUyxFQUFFLE1BQU0sQ0FBQyxDQUFDLENBQUM7SUFDbkUsSUFBSSxhQUFhLENBQUMsTUFBTTtRQUFFLEtBQUssQ0FBQyxjQUFFLENBQUMsR0FBRyxDQUFDLEdBQUcsYUFBYSxDQUFDO0lBRXhELE9BQU8sS0FBSyxDQUFDO0FBQ2YsQ0FBQztBQUVELFNBQWdCLE9BQU8sQ0FBQyxHQUFVO0lBQ2hDLE1BQU0sS0FBSyxHQUFHLEdBQUcsQ0FBQyxHQUFHLENBQUMsRUFBRSxLQUFLLEVBQUUsSUFBSSxFQUFFLENBQTRCLENBQUM7SUFDbEUsTUFBTSxFQUFFLFNBQVMsRUFBRSxHQUFHLEtBQUssQ0FBQztJQUU1QixPQUFPO1FBQ0wsRUFBRSxFQUFFLE1BQU0sQ0FBQyxLQUFLLENBQUMsRUFBRSxDQUFDO1FBQ3BCLFNBQVMsRUFBRSxTQUFTLFlBQVksSUFBSSxDQUFDLENBQUMsQ0FBQyxTQUFTLENBQUMsV0FBVyxFQUFFLENBQUMsQ0FBQyxDQUFDLE1BQU0sQ0FBQyxTQUFTLENBQUM7UUFDbEYsU0FBUyxFQUFFLEtBQUssQ0FBQyxTQUFxQztRQUN0RCxVQUFVLEVBQUUsS0FBSyxDQUFDLFVBQW9CO1FBQ3RDLFFBQVEsRUFBRyxLQUFLLENBQUMsUUFBbUIsSUFBSSxJQUFJO1FBQzVDLE1BQU0sRUFBRSxLQUFLLENBQUMsTUFBZ0I7UUFDOUIsYUFBYSxFQUFHLEtBQUssQ0FBQyxhQUF3QixJQUFJLElBQUk7UUFDdEQsWUFBWSxFQUFHLEtBQUssQ0FBQyxZQUF1QixJQUFJLElBQUk7UUFDcEQsU0FBUyxFQUFHLEtBQUssQ0FBQyxTQUFvQixJQUFJLElBQUk7UUFDOUMsVUFBVSxFQUFHLEtBQUssQ0FBQyxVQUFxQixJQUFJLElBQUk7UUFDaEQsY0FBYyxFQUFFLEtBQUssQ0FBQyxjQUF3QjtRQUM5QyxjQUFjLEVBQUcsS0FBSyxDQUFDLGNBQTBDLElBQUksRUFBRTtRQUN2RSxTQUFTLEVBQUcsS0FBSyxDQUFDLFNBQXFDLElBQUksRUFBRTtRQUM3RCxNQUFNLEVBQUUsS0FBSyxDQUFDLE1BQXFCO0tBQ3BDLENBQUM7QUFDSixDQUFDO0FBRUQ7Ozs7O0dBS0c7QUFDSCxTQUFnQixtQkFBbUIsQ0FBQyxPQUE0QjtJQUk5RCxNQUFNLEVBQUUsZ0JBQWdCLEVBQUUsTUFBTSxHQUFHLHNCQUFjLEVBQUUsU0FBUyxHQUFHLHFCQUFhLEVBQUUsR0FBRyxPQUFPLENBQUM7SUFFekYsSUFBSSxTQUFTLEdBQXFCLElBQUksQ0FBQztJQUN2QyxJQUFJLFNBQVMsR0FBeUUsSUFBSSxDQUFDO0lBRTNGLE1BQU0sSUFBSSxHQUFHLEdBQWtFLEVBQUU7UUFDL0UsSUFBSSxTQUFTO1lBQUUsT0FBTyxTQUFTLENBQUM7UUFFaEMsTUFBTSxVQUFVLEdBQUcsSUFBSSxxQkFBUyxDQUFDLGdCQUFnQixFQUFFLEVBQUUsT0FBTyxFQUFFLEtBQUssRUFBRSxDQUFDLENBQUM7UUFDdkUsU0FBUyxHQUFHLFVBQVUsQ0FBQztRQUN2QixTQUFTLEdBQUcsQ0FBQyxLQUFLLElBQUksRUFBRTtZQUN0QixJQUFJLENBQUM7Z0JBQ0gsTUFBTSxVQUFVLENBQUMsWUFBWSxFQUFFLENBQUM7Z0JBQ2hDLE1BQU0sS0FBSyxHQUFHLE1BQU0sa0JBQWtCLENBQUMsVUFBVSxFQUFFLEVBQUUsTUFBTSxFQUFFLFNBQVMsRUFBRSxDQUFDLENBQUM7Z0JBRTFFLE9BQU8sRUFBRSxLQUFLLEVBQUUsVUFBVSxFQUFFLENBQUM7WUFDL0IsQ0FBQztZQUFDLE9BQU8sS0FBSyxFQUFFLENBQUM7Z0JBQ2Ysa0VBQWtFO2dCQUNsRSxNQUFNLFVBQVUsQ0FBQyxLQUFLLEVBQUUsQ0FBQyxLQUFLLENBQUMsR0FBRyxFQUFFLENBQUMsU0FBUyxDQUFDLENBQUM7Z0JBQ2hELFNBQVMsR0FBRyxJQUFJLENBQUM7Z0JBQ2pCLFNBQVMsR0FBRyxJQUFJLENBQUM7Z0JBQ2pCLE1BQU0sS0FBSyxDQUFDO1lBQ2QsQ0FBQztRQUNILENBQUMsQ0FBQyxFQUFFLENBQUM7UUFFTCxPQUFPLFNBQVMsQ0FBQztJQUNuQixDQUFDLENBQUM7SUFFRix5RkFBeUY7SUFDekYsTUFBTSxrQkFBa0IsR0FBRztRQUN6QixDQUFDLFdBQVcsRUFBRSxLQUFLLENBQUM7UUFDcEIsQ0FBQyxJQUFJLEVBQUUsS0FBSyxDQUFDO0tBQ0wsQ0FBQztJQUVYLE9BQU87UUFDTCxLQUFLLEVBQUU7WUFDTCxLQUFLLENBQUMsSUFBSTtnQkFDUixNQUFNLElBQUksRUFBRSxDQUFDO1lBQ2YsQ0FBQztZQUNELEtBQUssQ0FBQyxhQUFhLENBQUMsTUFBTTtnQkFDeEIsTUFBTSxFQUFFLEtBQUssRUFBRSxHQUFHLE1BQU0sSUFBSSxFQUFFLENBQUM7Z0JBQy9CLE1BQU0sR0FBRyxHQUFHLE1BQU0sS0FBSyxDQUFDLE1BQU0sQ0FBQyxLQUFLLENBQUMsRUFBRSxHQUFHLE1BQU0sRUFBRSxNQUFNLEVBQUUsU0FBUyxFQUFFLENBQUMsQ0FBQyxDQUFDO2dCQUV4RSxPQUFPLE1BQU0sQ0FBQyxHQUFHLENBQUMsR0FBRyxDQUFDLElBQUksQ0FBQyxDQUFDLENBQUM7WUFDL0IsQ0FBQztZQUNELHVGQUF1RjtZQUN2Riw2RkFBNkY7WUFDN0YsNkZBQTZGO1lBQzdGLDZGQUE2RjtZQUM3RiwyRkFBMkY7WUFDM0YsdUNBQXVDO1lBQ3ZDLEtBQUssQ0FBQyxrQkFBa0IsQ0FBQyxPQUFPO2dCQUM5QixNQUFNLEVBQUUsS0FBSyxFQUFFLEdBQUcsTUFBTSxJQUFJLEVBQUUsQ0FBQztnQkFDL0IsTUFBTSxJQUFJLEdBQUcsTUFBTSxLQUFLLENBQUMsVUFBVSxDQUNqQyxPQUFPLENBQUMsR0FBRyxDQUFDLE1BQU0sQ0FBQyxFQUFFLENBQUMsS0FBSyxDQUFDLEVBQUUsR0FBRyxNQUFNLEVBQUUsTUFBTSxFQUFFLFNBQVMsRUFBRSxDQUFDLENBQUMsQ0FDL0QsQ0FBQztnQkFFRixPQUFPLElBQUksQ0FBQyxHQUFHLENBQUMsR0FBRyxDQUFDLEVBQUUsQ0FBQyxNQUFNLENBQUMsR0FBRyxDQUFDLEdBQUcsQ0FBQyxJQUFJLENBQUMsQ0FBQyxDQUFDLENBQUM7WUFDaEQsQ0FBQztZQUNELEtBQUssQ0FBQyxPQUFPLENBQUMsRUFBRSxFQUFFLEtBQUs7Z0JBQ3JCLE1BQU0sRUFBRSxLQUFLLEVBQUUsR0FBRyxNQUFNLElBQUksRUFBRSxDQUFDO2dCQUMvQixNQUFNLEtBQUssQ0FBQyxNQUFNLENBQUMsRUFBRSxHQUFHLEtBQUssRUFBRSxNQUFNLEVBQUUsTUFBTSxFQUFFLEVBQUUsRUFBRSxLQUFLLEVBQUUsRUFBRSxFQUFFLEVBQUUsRUFBRSxDQUFDLENBQUM7WUFDdEUsQ0FBQztZQUNELEtBQUssQ0FBQyxZQUFZLENBQUMsS0FBSztnQkFDdEIsTUFBTSxFQUFFLEtBQUssRUFBRSxVQUFVLEVBQUUsR0FBRyxNQUFNLElBQUksRUFBRSxDQUFDO2dCQUMzQyxNQUFNLEVBQUUsSUFBSSxHQUFHLENBQUMsRUFBRSxLQUFLLEVBQUUsS0FBSyxHQUFHLEtBQUssRUFBRSxHQUFHLEtBQUssQ0FBQztnQkFDakQsTUFBTSxTQUFTLEdBQUcsS0FBSyxLQUFLLE1BQU0sQ0FBQyxDQUFDLENBQUMsTUFBTSxDQUFDLENBQUMsQ0FBQyxLQUFLLENBQUM7Z0JBRXBELE1BQU0sSUFBSSxHQUFHLE1BQU0sS0FBSyxDQUFDLE9BQU8sQ0FBQztvQkFDL0IsS0FBSyxFQUFFLHVCQUF1QixDQUFDLEtBQUssRUFBRSxVQUFVLENBQUM7b0JBQ2pELEtBQUssRUFBRTt3QkFDTCxDQUFDLFdBQVcsRUFBRSxTQUFTLENBQUM7d0JBQ3hCLENBQUMsSUFBSSxFQUFFLFNBQVMsQ0FBQztxQkFDbEI7b0JBQ0QsTUFBTSxFQUFFLElBQUk7b0JBQ1osS0FBSztpQkFDTixDQUFDLENBQUM7Z0JBRUgsT0FBTyxJQUFJLENBQUMsR0FBRyxDQUFDLE9BQU8sQ0FBQyxDQUFDO1lBQzNCLENBQUM7WUFDRCxLQUFLLENBQUMsYUFBYSxDQUFDLEtBQUs7Z0JBQ3ZCLE1BQU0sRUFBRSxLQUFLLEVBQUUsVUFBVSxFQUFFLEdBQUcsTUFBTSxJQUFJLEVBQUUsQ0FBQztnQkFFM0MsT0FBTyxLQUFLLENBQUMsS0FBSyxDQUFDLEVBQUUsS0FBSyxFQUFFLHVCQUF1QixDQUFDLEtBQUssRUFBRSxVQUFVLENBQUMsRUFBRSxDQUFDLENBQUM7WUFDNUUsQ0FBQztZQUNELEtBQUssQ0FBQyxpQkFBaUIsQ0FBQyxLQUFLO2dCQUMzQixNQUFNLEVBQUUsS0FBSyxFQUFFLFVBQVUsRUFBRSxHQUFHLE1BQU0sSUFBSSxFQUFFLENBQUM7Z0JBRTNDLHdGQUF3RjtnQkFDeEYsZ0VBQWdFO2dCQUNoRSxNQUFNLElBQUksR0FBRyxDQUFDLE1BQU0sS0FBSyxDQUFDLE9BQU8sQ0FBQztvQkFDaEMsS0FBSyxFQUFFLHVCQUF1QixDQUFDLEtBQTBCLEVBQUUsVUFBVSxDQUFDO29CQUN0RSxVQUFVLEVBQUU7d0JBQ1YsUUFBUTt3QkFDUixDQUFDLHFCQUFTLENBQUMsRUFBRSxDQUFDLEtBQUssRUFBRSxxQkFBUyxDQUFDLEdBQUcsQ0FBQyxpQkFBaUIsQ0FBQyxDQUFDLEVBQUUsZUFBZSxDQUFDO3dCQUN4RSxDQUFDLHFCQUFTLENBQUMsRUFBRSxDQUFDLEtBQUssRUFBRSxxQkFBUyxDQUFDLEdBQUcsQ0FBQyxnQkFBZ0IsQ0FBQyxDQUFDLEVBQUUsY0FBYyxDQUFDO3dCQUN0RSxDQUFDLHFCQUFTLENBQUMsRUFBRSxDQUFDLEtBQUssRUFBRSxxQkFBUyxDQUFDLEdBQUcsQ0FBQyxZQUFZLENBQUMsQ0FBQyxFQUFFLFdBQVcsQ0FBQztxQkFDaEU7b0JBQ0QsS0FBSyxFQUFFLENBQUMsUUFBUSxDQUFDO29CQUNqQixHQUFHLEVBQUUsSUFBSTtpQkFDVixDQUFDLENBS0EsQ0FBQztnQkFFSCxPQUFPLElBQUksQ0FBQyxHQUFHLENBQUMsR0FBRyxDQUFDLEVBQUUsQ0FBQyxDQUFDO29CQUN0QixFQUFFLEVBQUUsR0FBRyxDQUFDLE1BQU07b0JBQ2QsU0FBUyxFQUFFLEdBQUcsQ0FBQyxhQUFhLElBQUksSUFBSTtvQkFDcEMsUUFBUSxFQUFFLEdBQUcsQ0FBQyxZQUFZLElBQUksSUFBSTtvQkFDbEMsS0FBSyxFQUFFLEdBQUcsQ0FBQyxTQUFTLElBQUksSUFBSTtpQkFDN0IsQ0FBQyxDQUFDLENBQUM7WUFDTixDQUFDO1lBQ0QsS0FBSyxDQUFDLGlCQUFpQixDQUFDLEVBQUUsVUFBVSxFQUFFLFFBQVEsRUFBRSxjQUFjLEVBQUU7Z0JBQzlELE1BQU0sRUFBRSxLQUFLLEVBQUUsR0FBRyxNQUFNLElBQUksRUFBRSxDQUFDO2dCQUUvQixNQUFNLElBQUksR0FBRyxNQUFNLEtBQUssQ0FBQyxPQUFPLENBQUM7b0JBQy9CLEtBQUssRUFBRSxFQUFFLFVBQVUsRUFBRSxRQUFRLEVBQUUsY0FBYyxFQUFFO29CQUMvQyxLQUFLLEVBQUUsa0JBQTJCO2lCQUNuQyxDQUFDLENBQUM7Z0JBRUgsT0FBTyxJQUFJLENBQUMsR0FBRyxDQUFDLE9BQU8sQ0FBQyxDQUFDO1lBQzNCLENBQUM7WUFDRCxLQUFLLENBQUMsa0JBQWtCLENBQUMsRUFBRSxVQUFVLEVBQUUsUUFBUSxFQUFFLGVBQWUsRUFBRTtnQkFDaEUsSUFBSSxDQUFDLGVBQWUsQ0FBQyxNQUFNO29CQUFFLE9BQU8sRUFBRSxDQUFDO2dCQUV2QyxNQUFNLEVBQUUsS0FBSyxFQUFFLEdBQUcsTUFBTSxJQUFJLEVBQUUsQ0FBQztnQkFFL0IsTUFBTSxJQUFJLEdBQUcsTUFBTSxLQUFLLENBQUMsT0FBTyxDQUFDO29CQUMvQixLQUFLLEVBQUUsRUFBRSxVQUFVLEVBQUUsUUFBUSxFQUFFLGNBQWMsRUFBRSxFQUFFLENBQUMsY0FBRSxDQUFDLEVBQUUsQ0FBQyxFQUFFLGVBQWUsRUFBRSxFQUFFO29CQUM3RSxLQUFLLEVBQUUsa0JBQTJCO2lCQUNuQyxDQUFDLENBQUM7Z0JBRUgsT0FBTyxJQUFJLENBQUMsR0FBRyxDQUFDLE9BQU8sQ0FBQyxDQUFDO1lBQzNCLENBQUM7U0FDRjtRQUNELEtBQUssRUFBRSxLQUFLLElBQUksRUFBRTtZQUNoQixJQUFJLFNBQVM7Z0JBQUUsTUFBTSxTQUFTLENBQUMsS0FBSyxFQUFFLENBQUM7WUFDdkMsU0FBUyxHQUFHLElBQUksQ0FBQztZQUNqQixTQUFTLEdBQUcsSUFBSSxDQUFDO1FBQ25CLENBQUM7S0FDRixDQUFDO0FBQ0osQ0FBQyJ9

package/dist/audit-trail/types.d.ts

@@ -0,0 +1,129 @@
+import type { Logger } from '@forestadmin/datasource-toolkit';
+export type AuditOperation = 'create' | 'update' | 'delete' | 'action' | 'action_failed';
+export type AuditStatus = 'pending' | 'done';
+export type AuditRecord = {
+    id: number;
+    timestamp: string;
+    operation: AuditOperation;
+    collection: string;
+    /** Null for a pending create — the record's primary key isn't assigned yet. */
+    recordId: string | null;
+    userId: number;
+    /** Denormalised from the caller at write time: who acted then, not who holds that id today. */
+    userFirstName: string | null;
+    userLastName: string | null;
+    userEmail: string | null;
+    /** `action` / `action_failed` rows only. */
+    actionName: string | null;
+    correlationKey: string;
+    previousValues: Record<string, unknown>;
+    newValues: Record<string, unknown>;
+    /**
+     * `pending` from the moment the row is inserted (before the write runs) until it's confirmed
+     * `done` afterward. A row left `pending` means the write may or may not have landed — that
+     * residue is evidence a write was attempted and never confirmed, which is the point.
+     */
+    status: AuditStatus;
+};
+/** The subset known before the write runs, when the pending row is first inserted. */
+export type PendingAuditRecord = Omit<AuditRecord, 'id' | 'status'>;
+/** What `confirm` updates once the write (or action) has resolved. */
+export type AuditRecordConfirmation = Pick<AuditRecord, 'operation' | 'recordId' | 'previousValues' | 'newValues'>;
+export type AuditHistoryQuery = {
+    collection: string;
+    recordId: string;
+    skip?: number;
+    limit?: number;
+    userIds?: number[];
+    /** Inclusive lower bound on `timestamp` as a UTC ISO instant. */
+    startTimestamp?: string;
+    /** Inclusive upper bound on `timestamp` as a UTC ISO instant. */
+    endTimestamp?: string;
+    /** Keep only entries whose change touched at least one of these fields. */
+    fields?: string[];
+    /**
+     * Free-text, case-insensitive substring match against `actionName`, `userFirstName`,
+     * `userLastName`, `userEmail`, and the keys and scalar values of `previousValues`/`newValues` at
+     * any depth. Never matches `operation`, `correlationKey`, `recordId`, `collection`, `status` or
+     * `timestamp` — those are machine identifiers a user would never search, and matching them
+     * produces confusing hits. A redacted value can't match a search for the real value: the real
+     * value was never stored in the first place.
+     *
+     * The match runs against the *serialized JSON text* of `previousValues`/`newValues`, not a
+     * structural walk of the parsed value — cheap, and correct for "keys and scalar values", but two
+     * things fall out of that: a punctuation-only term (`,`, `:`, `{`) matches almost any row whose
+     * diff has more than one key, since those characters are JSON structure rather than content; and
+     * a value containing a double quote or a backslash can't be found by searching for it literally
+     * (`5"` is stored as `5\"`, so searching `5"` never matches the row that holds it). Neither is
+     * severe, and both are inherent to matching the serialized form rather than the parsed value.
+     */
+    search?: string;
+    /** Sort direction on `timestamp` (ties broken by insertion order). Defaults to `'asc'`. */
+    order?: 'asc' | 'desc';
+};
+export type AuditCorrelationQuery = {
+    collection: string;
+    recordId: string;
+    correlationKey: string;
+};
+export type AuditCorrelationsQuery = {
+    collection: string;
+    recordId: string;
+    correlationKeys: string[];
+};
+export type AuditUserSummary = {
+    id: number;
+    firstName: string | null;
+    lastName: string | null;
+    email: string | null;
+};
+export interface AuditStore {
+    /** Inserts one `status: 'pending'` row before the write runs; returns its id. */
+    insertPending(record: PendingAuditRecord): Promise<number>;
+    /** Batched form of `insertPending`, for a bulk operation touching several records at once. */
+    insertPendingBatch(records: PendingAuditRecord[]): Promise<number[]>;
+    /** Updates a pending row to `status: 'done'` with the values known once the write resolved. */
+    confirm(id: number, patch: AuditRecordConfirmation): Promise<void>;
+    listByRecord(query: AuditHistoryQuery): AuditRecord[] | Promise<AuditRecord[]>;
+    /** Total entries matching the query filters, ignoring `skip` / `limit`. */
+    countByRecord(query: AuditHistoryQuery): number | Promise<number>;
+    /** Entries recorded under one `correlationKey` for a record, oldest first. */
+    listByCorrelation(query: AuditCorrelationQuery): AuditRecord[] | Promise<AuditRecord[]>;
+    /** Flat list of entries recorded under any of `correlationKeys` for a record, oldest first. */
+    listByCorrelations(query: AuditCorrelationsQuery): AuditRecord[] | Promise<AuditRecord[]>;
+    /** Distinct authors matching the query filters, independent of pagination. */
+    listDistinctUsers(query: Omit<AuditHistoryQuery, 'skip' | 'limit' | 'order'>): AuditUserSummary[] | Promise<AuditUserSummary[]>;
+    /** One-shot bootstrap awaited by `agent.start()`. Must be idempotent. */
+    init?(): Promise<void>;
+}
+export type AuditSink = (record: PendingAuditRecord) => void | Promise<void>;
+export type AuditTrailInstrumentOptions = {
+    sink?: AuditSink;
+    store?: AuditStore;
+    /**
+     * Fields to mask, keyed by collection name. Redacted fields still produce an audit entry when
+     * they change, but their value is replaced with a sentinel instead of being stored.
+     */
+    redact?: Record<string, string[]>;
+    /**
+     * When true, a failure inserting a write's pending audit row refuses the write itself — no
+     * unaudited write ever happens, though a row left `pending` doesn't guarantee its values are
+     * exact. When false (default), the same failure is logged and the write proceeds unaudited,
+     * matching today's behavior.
+     */
+    critical?: boolean;
+    logger?: Logger;
+};
+export type AuditStorageOptions = {
+    /**
+     * Postgres / SQL connection string for the audit database. May point at an empty database, the
+     * database already used by the agent, or one that already contains the `forest` schema — the
+     * schema and table are created on the fly when missing.
+     */
+    connectionString: string;
+    /** Defaults to `forest`. */
+    schema?: string;
+    /** Defaults to `audit_logs`. */
+    tableName?: string;
+};
+//# sourceMappingURL=types.d.ts.map

package/dist/audit-trail/types.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoidHlwZXMuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvYXVkaXQtdHJhaWwvdHlwZXMudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IiJ9

package/dist/routes/access/audit-trail-correlation.d.ts

@@ -0,0 +1,18 @@
+import type { ForestAdminHttpDriverServices } from '../../services';
+import type { AgentOptionsWithDefaults } from '../../types';
+import type { DataSource } from '@forestadmin/datasource-toolkit';
+import type Router from '@koa/router';
+import type { Context } from 'koa';
+import { RouteType } from '../../types';
+import BaseRoute from '../base-route';
+export default class AuditTrailCorrelationRoute extends BaseRoute {
+    readonly type = RouteType.PrivateRoute;
+    private readonly dataSource;
+    constructor(services: ForestAdminHttpDriverServices, options: AgentOptionsWithDefaults, dataSource: DataSource);
+    setupRoutes(router: Router): void;
+    handleHistory(context: Context): Promise<void>;
+    handleBatch(context: Context): Promise<void>;
+    private assertRecordReadable;
+    private static parseCorrelationKeys;
+}
+//# sourceMappingURL=audit-trail-correlation.d.ts.map

package/dist/routes/access/audit-trail-correlation.js

@@ -0,0 +1,84 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const datasource_toolkit_1 = require("@forestadmin/datasource-toolkit");
+const scope_1 = __importDefault(require("../../audit-trail/scope"));
+const types_1 = require("../../types");
+const base_route_1 = __importDefault(require("../base-route"));
+class AuditTrailCorrelationRoute extends base_route_1.default {
+    constructor(services, options, dataSource) {
+        super(services, options);
+        this.type = types_1.RouteType.PrivateRoute;
+        this.dataSource = dataSource;
+    }
+    setupRoutes(router) {
+        router.get('/_audit-trail/correlation/:correlationKey', this.handleHistory.bind(this));
+        // POST accepts the keys in a JSON body to dodge any URL length limit.
+        router.get('/_audit-trail/correlations', this.handleBatch.bind(this));
+        router.post('/_audit-trail/correlations', this.handleBatch.bind(this));
+    }
+    async handleHistory(context) {
+        const target = await this.assertRecordReadable(context);
+        if (!target)
+            return;
+        const { collection, recordId } = target;
+        const { store } = this.options.auditTrail;
+        const history = await store.listByCorrelation({
+            collection,
+            recordId,
+            correlationKey: context.params.correlationKey,
+        });
+        context.response.body = { data: history };
+    }
+    async handleBatch(context) {
+        const target = await this.assertRecordReadable(context);
+        if (!target)
+            return;
+        const { collection, recordId } = target;
+        const correlationKeys = AuditTrailCorrelationRoute.parseCorrelationKeys(context);
+        const { store } = this.options.auditTrail;
+        const history = correlationKeys.length
+            ? await store.listByCorrelations({ collection, recordId, correlationKeys })
+            : [];
+        context.response.body = { data: history };
+    }
+    // Returns null (after issuing the 404) when a configured record-level scope excludes the id —
+    // same rule as the per-collection route: a scope can't be evaluated retroactively for a
+    // now-deleted record, so a scoped caller cannot look up correlations for an out-of-scope id.
+    async assertRecordReadable(context) {
+        const query = context.request.query;
+        const body = (context.request.body ?? {});
+        const collectionName = (query.collection ?? body.collection)?.toString();
+        const recordId = (query.recordId ?? body.recordId)?.toString();
+        if (!collectionName)
+            throw new datasource_toolkit_1.ValidationError('Missing collection');
+        if (!recordId)
+            throw new datasource_toolkit_1.ValidationError('Missing recordId');
+        const collection = this.dataSource.getCollection(collectionName);
+        await this.services.authorization.assertCanRead(context, collectionName);
+        const { visible } = await (0, scope_1.default)(this.services, collection, recordId, context);
+        if (!visible) {
+            context.throw(types_1.HttpCode.NotFound, 'Record does not exists');
+            return null;
+        }
+        return { collection: collectionName, recordId };
+    }
+    // Body array (POST) takes precedence over the comma-separated query param (GET).
+    static parseCorrelationKeys(context) {
+        const body = (context.request.body ?? {});
+        if (Array.isArray(body.correlationKeys)) {
+            return body.correlationKeys.map(key => String(key).trim()).filter(Boolean);
+        }
+        const raw = context.request.query.correlationKeys?.toString();
+        return raw
+            ? raw
+                .split(',')
+                .map(key => key.trim())
+                .filter(Boolean)
+            : [];
+    }
+}
+exports.default = AuditTrailCorrelationRoute;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYXVkaXQtdHJhaWwtY29ycmVsYXRpb24uanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi9zcmMvcm91dGVzL2FjY2Vzcy9hdWRpdC10cmFpbC1jb3JyZWxhdGlvbi50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7OztBQU1BLHdFQUFrRTtBQUVsRSxvRUFBNEQ7QUFDNUQsdUNBQWtEO0FBQ2xELCtEQUFzQztBQUV0QyxNQUFxQiwwQkFBMkIsU0FBUSxvQkFBUztJQUsvRCxZQUNFLFFBQXVDLEVBQ3ZDLE9BQWlDLEVBQ2pDLFVBQXNCO1FBRXRCLEtBQUssQ0FBQyxRQUFRLEVBQUUsT0FBTyxDQUFDLENBQUM7UUFUbEIsU0FBSSxHQUFHLGlCQUFTLENBQUMsWUFBWSxDQUFDO1FBVXJDLElBQUksQ0FBQyxVQUFVLEdBQUcsVUFBVSxDQUFDO0lBQy9CLENBQUM7SUFFRCxXQUFXLENBQUMsTUFBYztRQUN4QixNQUFNLENBQUMsR0FBRyxDQUFDLDJDQUEyQyxFQUFFLElBQUksQ0FBQyxhQUFhLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxDQUFDLENBQUM7UUFDdkYsc0VBQXNFO1FBQ3RFLE1BQU0sQ0FBQyxHQUFHLENBQUMsNEJBQTRCLEVBQUUsSUFBSSxDQUFDLFdBQVcsQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLENBQUMsQ0FBQztRQUN0RSxNQUFNLENBQUMsSUFBSSxDQUFDLDRCQUE0QixFQUFFLElBQUksQ0FBQyxXQUFXLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxDQUFDLENBQUM7SUFDekUsQ0FBQztJQUVNLEtBQUssQ0FBQyxhQUFhLENBQUMsT0FBZ0I7UUFDekMsTUFBTSxNQUFNLEdBQUcsTUFBTSxJQUFJLENBQUMsb0JBQW9CLENBQUMsT0FBTyxDQUFDLENBQUM7UUFDeEQsSUFBSSxDQUFDLE1BQU07WUFBRSxPQUFPO1FBRXBCLE1BQU0sRUFBRSxVQUFVLEVBQUUsUUFBUSxFQUFFLEdBQUcsTUFBTSxDQUFDO1FBQ3hDLE1BQU0sRUFBRSxLQUFLLEVBQUUsR0FBRyxJQUFJLENBQUMsT0FBTyxDQUFDLFVBQVUsQ0FBQztRQUMxQyxNQUFNLE9BQU8sR0FBRyxNQUFNLEtBQUssQ0FBQyxpQkFBaUIsQ0FBQztZQUM1QyxVQUFVO1lBQ1YsUUFBUTtZQUNSLGNBQWMsRUFBRSxPQUFPLENBQUMsTUFBTSxDQUFDLGNBQWM7U0FDOUMsQ0FBQyxDQUFDO1FBRUgsT0FBTyxDQUFDLFFBQVEsQ0FBQyxJQUFJLEdBQUcsRUFBRSxJQUFJLEVBQUUsT0FBTyxFQUFFLENBQUM7SUFDNUMsQ0FBQztJQUVNLEtBQUssQ0FBQyxXQUFXLENBQUMsT0FBZ0I7UUFDdkMsTUFBTSxNQUFNLEdBQUcsTUFBTSxJQUFJLENBQUMsb0JBQW9CLENBQUMsT0FBTyxDQUFDLENBQUM7UUFDeEQsSUFBSSxDQUFDLE1BQU07WUFBRSxPQUFPO1FBRXBCLE1BQU0sRUFBRSxVQUFVLEVBQUUsUUFBUSxFQUFFLEdBQUcsTUFBTSxDQUFDO1FBQ3hDLE1BQU0sZUFBZSxHQUFHLDBCQUEwQixDQUFDLG9CQUFvQixDQUFDLE9BQU8sQ0FBQyxDQUFDO1FBRWpGLE1BQU0sRUFBRSxLQUFLLEVBQUUsR0FBRyxJQUFJLENBQUMsT0FBTyxDQUFDLFVBQVUsQ0FBQztRQUMxQyxNQUFNLE9BQU8sR0FBRyxlQUFlLENBQUMsTUFBTTtZQUNwQyxDQUFDLENBQUMsTUFBTSxLQUFLLENBQUMsa0JBQWtCLENBQUMsRUFBRSxVQUFVLEVBQUUsUUFBUSxFQUFFLGVBQWUsRUFBRSxDQUFDO1lBQzNFLENBQUMsQ0FBQyxFQUFFLENBQUM7UUFFUCxPQUFPLENBQUMsUUFBUSxDQUFDLElBQUksR0FBRyxFQUFFLElBQUksRUFBRSxPQUFPLEVBQUUsQ0FBQztJQUM1QyxDQUFDO0lBRUQsOEZBQThGO0lBQzlGLHdGQUF3RjtJQUN4Riw2RkFBNkY7SUFDckYsS0FBSyxDQUFDLG9CQUFvQixDQUNoQyxPQUFnQjtRQUVoQixNQUFNLEtBQUssR0FBRyxPQUFPLENBQUMsT0FBTyxDQUFDLEtBQWdDLENBQUM7UUFDL0QsTUFBTSxJQUFJLEdBQUcsQ0FBQyxPQUFPLENBQUMsT0FBTyxDQUFDLElBQUksSUFBSSxFQUFFLENBQTRCLENBQUM7UUFDckUsTUFBTSxjQUFjLEdBQUcsQ0FBQyxLQUFLLENBQUMsVUFBVSxJQUFJLElBQUksQ0FBQyxVQUFVLENBQUMsRUFBRSxRQUFRLEVBQUUsQ0FBQztRQUN6RSxNQUFNLFFBQVEsR0FBRyxDQUFDLEtBQUssQ0FBQyxRQUFRLElBQUksSUFBSSxDQUFDLFFBQVEsQ0FBQyxFQUFFLFFBQVEsRUFBRSxDQUFDO1FBRS9ELElBQUksQ0FBQyxjQUFjO1lBQUUsTUFBTSxJQUFJLG9DQUFlLENBQUMsb0JBQW9CLENBQUMsQ0FBQztRQUNyRSxJQUFJLENBQUMsUUFBUTtZQUFFLE1BQU0sSUFBSSxvQ0FBZSxDQUFDLGtCQUFrQixDQUFDLENBQUM7UUFFN0QsTUFBTSxVQUFVLEdBQUcsSUFBSSxDQUFDLFVBQVUsQ0FBQyxhQUFhLENBQUMsY0FBYyxDQUFDLENBQUM7UUFDakUsTUFBTSxJQUFJLENBQUMsUUFBUSxDQUFDLGFBQWEsQ0FBQyxhQUFhLENBQUMsT0FBTyxFQUFFLGNBQWMsQ0FBQyxDQUFDO1FBRXpFLE1BQU0sRUFBRSxPQUFPLEVBQUUsR0FBRyxNQUFNLElBQUEsZUFBcUIsRUFBQyxJQUFJLENBQUMsUUFBUSxFQUFFLFVBQVUsRUFBRSxRQUFRLEVBQUUsT0FBTyxDQUFDLENBQUM7UUFFOUYsSUFBSSxDQUFDLE9BQU8sRUFBRSxDQUFDO1lBQ2IsT0FBTyxDQUFDLEtBQUssQ0FBQyxnQkFBUSxDQUFDLFFBQVEsRUFBRSx3QkFBd0IsQ0FBQyxDQUFDO1lBRTNELE9BQU8sSUFBSSxDQUFDO1FBQ2QsQ0FBQztRQUVELE9BQU8sRUFBRSxVQUFVLEVBQUUsY0FBYyxFQUFFLFFBQVEsRUFBRSxDQUFDO0lBQ2xELENBQUM7SUFFRCxpRkFBaUY7SUFDekUsTUFBTSxDQUFDLG9CQUFvQixDQUFDLE9BQWdCO1FBQ2xELE1BQU0sSUFBSSxHQUFHLENBQUMsT0FBTyxDQUFDLE9BQU8sQ0FBQyxJQUFJLElBQUksRUFBRSxDQUE0QixDQUFDO1FBRXJFLElBQUksS0FBSyxDQUFDLE9BQU8sQ0FBQyxJQUFJLENBQUMsZUFBZSxDQUFDLEVBQUUsQ0FBQztZQUN4QyxPQUFPLElBQUksQ0FBQyxlQUFlLENBQUMsR0FBRyxDQUFDLEdBQUcsQ0FBQyxFQUFFLENBQUMsTUFBTSxDQUFDLEdBQUcsQ0FBQyxDQUFDLElBQUksRUFBRSxDQUFDLENBQUMsTUFBTSxDQUFDLE9BQU8sQ0FBQyxDQUFDO1FBQzdFLENBQUM7UUFFRCxNQUFNLEdBQUcsR0FBSSxPQUFPLENBQUMsT0FBTyxDQUFDLEtBQWlDLENBQUMsZUFBZSxFQUFFLFFBQVEsRUFBRSxDQUFDO1FBRTNGLE9BQU8sR0FBRztZQUNSLENBQUMsQ0FBQyxHQUFHO2lCQUNBLEtBQUssQ0FBQyxHQUFHLENBQUM7aUJBQ1YsR0FBRyxDQUFDLEdBQUcsQ0FBQyxFQUFFLENBQUMsR0FBRyxDQUFDLElBQUksRUFBRSxDQUFDO2lCQUN0QixNQUFNLENBQUMsT0FBTyxDQUFDO1lBQ3BCLENBQUMsQ0FBQyxFQUFFLENBQUM7SUFDVCxDQUFDO0NBQ0Y7QUFoR0QsNkNBZ0dDIn0=

package/dist/routes/access/audit-trail.d.ts

@@ -0,0 +1,23 @@
+import type Router from '@koa/router';
+import type { Context } from 'koa';
+import CollectionRoute from '../collection-route';
+export default class AuditTrailRoute extends CollectionRoute {
+    setupRoutes(router: Router): void;
+    handleHistory(context: Context): Promise<void>;
+    private withholdOutOfScopeValues;
+    handleStateAt(context: Context): Promise<void>;
+    private fetchCurrentRecord;
+    private static auditedColumns;
+    private static parseAt;
+    private static parseSort;
+    private static parsePagination;
+    private static parsePageSize;
+    private static parsePageNumber;
+    private static parseFilters;
+    private static parseUserIds;
+    private static parseFields;
+    private static parseSearch;
+    private static parseDateBoundary;
+    private static toLocalInstant;
+}
+//# sourceMappingURL=audit-trail.d.ts.map