@forestadmin/agent 1.95.2 → 1.97.0

package/dist/audit-trail/instrument.js

@@ -0,0 +1,393 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.REDACTED = exports.MAX_SNAPSHOT_RECORDS = void 0;
+exports.buildRecorder = buildRecorder;
+exports.default = installAuditTrailHooks;
+const datasource_toolkit_1 = require("@forestadmin/datasource-toolkit");
+const stableKeyOrderReplacer = (key, value) => {
+    // JSON.stringify has no native BigInt support and throws on one, regardless of nesting depth or
+    // whether it's the root value; the replacer gets a chance to convert it first either way.
+    if (typeof value === 'bigint')
+        return value.toString();
+    if (value && typeof value === 'object' && !Array.isArray(value)) {
+        return Object.keys(value)
+            .sort()
+            .reduce((sorted, name) => {
+            sorted[name] = value[name];
+            return sorted;
+        }, {});
+    }
+    return value;
+};
+// Date/BSON values round-trip through JSON.stringify via their toJSON; the replacer makes
+// plain-object key order irrelevant.
+const deepEquals = (a, b) => JSON.stringify(a, stableKeyOrderReplacer) === JSON.stringify(b, stableKeyOrderReplacer);
+// A value with its own `toJSON` (Date, a BSON wrapper) has a canonical representation that
+// `Object.entries` can't be trusted to reproduce: BSON's `toJSON` is typically on the prototype
+// while the actual data lives in unrelated (and sometimes non-enumerable) own fields, so walking
+// `Object.entries` would silently reconstruct the wrong — or an empty — object instead.
+const hasCanonicalJson = (value) => typeof value.toJSON === 'function';
+// A raw BigInt surviving into a stored `previousValues`/`newValues` would fail later — Sequelize
+// serializing the JSON column, or Koa serializing an HTTP history response — the same way
+// JSON.stringify does above. Recurses through arrays and plain objects (leaving anything with its
+// own `toJSON` untouched, see above) since a BigInt can be nested inside a JSON column's value
+// rather than being the column's value itself — `pickColumns` hands this a whole column value
+// unprocessed by `diff`'s own recursion, and a primitive array is a `diff` leaf kept whole rather
+// than walked.
+const toJsonSafe = (value) => {
+    if (typeof value === 'bigint')
+        return value.toString();
+    if (Array.isArray(value))
+        return value.map(toJsonSafe);
+    if (value && typeof value === 'object' && !hasCanonicalJson(value)) {
+        return Object.fromEntries(Object.entries(value).map(([key, entry]) => [
+            key,
+            toJsonSafe(entry),
+        ]));
+    }
+    return value;
+};
+// Records touched by a bulk operation, bounded so one write can't hold an unbounded result set in
+// memory (or fan out an unbounded number of pending-row inserts). Truncation is logged explicitly
+// rather than silently auditing only part of the operation. Also the cap a smart action's audited
+// selection is checked against (action.ts) — one constant, so the two can't drift apart the way this
+// value and the Ruby agent's once did.
+exports.MAX_SNAPSHOT_RECORDS = 1000;
+// One caller-supplied `Filter` object can be reused across concurrent (or sequential, e.g. a
+// continue-on-error bulk loop) operations sharing the same template, so each key holds a queue of
+// snapshots rather than a single value — otherwise a second `Before` would overwrite the first
+// snapshot and its `After` would silently emit nothing.
+const snapshotsByFilter = new WeakMap();
+function pushSnapshot(key, entry) {
+    const queue = snapshotsByFilter.get(key) ?? [];
+    queue.push(entry);
+    snapshotsByFilter.set(key, queue);
+}
+// Correlates by `patch` content rather than queue position: if a write throws, its `Before`
+// snapshot is never consumed (there is no matching `After` call), so blindly taking the front of
+// the queue would hand a later, unrelated operation someone else's stale snapshot instead of its
+// own. Delete has no equivalent secondary key, so it falls back to FIFO order — a narrower version
+// of the same risk that remains for deletes sharing one `Filter` reference.
+function takeSnapshot(key, patch) {
+    const queue = snapshotsByFilter.get(key);
+    if (!queue || queue.length === 0)
+        return undefined;
+    const index = patch ? queue.findIndex(entry => deepEquals(entry.patch, patch)) : 0;
+    const [entry] = queue.splice(index === -1 ? 0 : index, 1);
+    if (queue.length === 0)
+        snapshotsByFilter.delete(key);
+    return entry;
+}
+// Create has no Filter to key by (there's nothing to select yet), but `context.data` is the exact
+// same array reference in both the Before and After hook for one `.create()` call — verified via
+// `HookBeforeCreateContext`/`HookAfterCreateContext`, which both wrap the literal `data` argument.
+const pendingIdsByData = new WeakMap();
+// Must match IdUtils.packId so recordIds align with the rest of Forest.
+const toPackedRecordId = (record, primaryKeys) => {
+    if (primaryKeys.length === 0) {
+        throw new Error('Cannot audit a collection with no primary key');
+    }
+    return primaryKeys.map(pk => String(record[pk])).join('|');
+};
+const pickColumns = (record, columns) => Object.fromEntries(columns.map(column => [column, toJsonSafe(record[column]) ?? null]));
+const isPlainObject = (value) => Boolean(value) && typeof value === 'object' && !Array.isArray(value) && !(value instanceof Date);
+const isObjectArray = (value) => Array.isArray(value) && value.length > 0 && value.every(isPlainObject);
+// Returns only the leaves that changed. Plain objects and object-arrays recurse; everything else
+// (scalars, primitive arrays, Date, BSON) is compared and kept whole. A leaf that did not exist
+// before/after (as opposed to one explicitly set to `null`) is marked `*Absent`, so the caller
+// simply omits that key/index from that side rather than writing a placeholder value: the stored
+// diff itself never carries a marker, it just doesn't have the key.
+const diff = (before, after) => {
+    if (deepEquals(before, after))
+        return null;
+    if (isPlainObject(before) && isPlainObject(after)) {
+        const previous = {};
+        const next = {};
+        for (const key of new Set([...Object.keys(before), ...Object.keys(after)])) {
+            const subDelta = diff(before[key], after[key]);
+            if (subDelta) {
+                if (!subDelta.previousAbsent)
+                    previous[key] = subDelta.previous;
+                if (!subDelta.nextAbsent)
+                    next[key] = subDelta.next;
+            }
+        }
+        return { previous, next, previousAbsent: false, nextAbsent: false };
+    }
+    if (isObjectArray(before) && isObjectArray(after)) {
+        const previous = {};
+        const next = {};
+        for (let index = 0; index < Math.max(before.length, after.length); index += 1) {
+            const subDelta = diff(before[index], after[index]);
+            if (subDelta) {
+                if (!subDelta.previousAbsent)
+                    previous[index] = subDelta.previous;
+                if (!subDelta.nextAbsent)
+                    next[index] = subDelta.next;
+            }
+        }
+        return { previous, next, previousAbsent: false, nextAbsent: false };
+    }
+    return {
+        previous: before === undefined ? undefined : toJsonSafe(before) ?? null,
+        next: after === undefined ? undefined : toJsonSafe(after) ?? null,
+        previousAbsent: before === undefined,
+        nextAbsent: after === undefined,
+    };
+};
+// Diffs against the record actually persisted by the write (`after`), not the requested patch, so
+// the log reflects normalization/coercion/side effects applied by the datasource or a decorator.
+const changedValues = (before, after, columns) => {
+    const previousValues = {};
+    const newValues = {};
+    for (const column of columns) {
+        const delta = diff(before[column], after[column]);
+        if (delta) {
+            if (!delta.previousAbsent)
+                previousValues[column] = delta.previous;
+            if (!delta.nextAbsent)
+                newValues[column] = delta.next;
+        }
+    }
+    return { previousValues, newValues };
+};
+exports.REDACTED = '[redacted]';
+const redactValues = (values, redactedFields) => {
+    if (!redactedFields.length)
+        return values;
+    const result = { ...values };
+    for (const field of redactedFields)
+        if (field in result)
+            result[field] = exports.REDACTED;
+    return result;
+};
+const consoleSink = record => {
+    // eslint-disable-next-line no-console
+    console.info('[audit-trail]', JSON.stringify(record));
+};
+function buildRecorder(store, sink, critical, logger) {
+    if (store) {
+        return {
+            async insertPendingBatch(records) {
+                if (records.length === 0)
+                    return [];
+                try {
+                    return await store.insertPendingBatch(records);
+                }
+                catch (error) {
+                    // Critical: no unaudited write — refuse the operation before it runs. Non-critical:
+                    // logged and swallowed, exactly like today's single-shot failures; the write proceeds
+                    // with nothing to confirm later.
+                    if (critical)
+                        throw error;
+                    logger?.('Error', `[ForestAdmin] Audit trail: unable to record pending entries, continuing: ${error}`);
+                    return records.map(() => null);
+                }
+            },
+            async confirm(id, patch) {
+                if (id === null)
+                    return;
+                try {
+                    await store.confirm(id, patch);
+                }
+                catch (error) {
+                    // The write has already happened by now; there is nothing left to refuse.
+                    logger?.('Error', `[ForestAdmin] Audit trail: unable to confirm entry, continuing: ${error}`);
+                }
+            },
+        };
+    }
+    const emit = sink ?? consoleSink;
+    const pendingById = new Map();
+    let nextId = 1;
+    return {
+        async insertPendingBatch(records) {
+            return records.map(record => {
+                const id = nextId;
+                nextId += 1;
+                pendingById.set(id, record);
+                return id;
+            });
+        },
+        async confirm(id, patch) {
+            if (id === null)
+                return;
+            const pending = pendingById.get(id);
+            pendingById.delete(id);
+            if (!pending)
+                return;
+            try {
+                await emit({ ...pending, ...patch });
+            }
+            catch (error) {
+                // The write has already happened by now; there is nothing left to refuse.
+                logger?.('Error', `[ForestAdmin] Audit trail: unable to confirm entry, continuing: ${error}`);
+            }
+        },
+    };
+}
+function instrumentCollection(collection, recorder, redactedFields, logger, critical) {
+    const { schema } = collection;
+    const writableColumns = Object.keys(schema.fields).filter(name => {
+        const field = schema.fields[name];
+        return field.type === 'Column' && !field.isReadOnly;
+    });
+    const primaryKeys = datasource_toolkit_1.SchemaUtils.getPrimaryKeys(schema);
+    // PKs may be read-only, but they are required to build the packed recordId; the diff itself
+    // stays restricted to writableColumns.
+    const readProjection = [...new Set([...primaryKeys, ...writableColumns])];
+    const { name } = collection;
+    const buildRecord = (caller, entry) => ({
+        timestamp: new Date().toISOString(),
+        collection: name,
+        userId: caller.id,
+        userFirstName: caller.firstName,
+        userLastName: caller.lastName,
+        userEmail: caller.email,
+        actionName: null,
+        correlationKey: caller.requestId,
+        ...entry,
+        previousValues: redactValues(entry.previousValues, redactedFields),
+        newValues: redactValues(entry.newValues, redactedFields),
+    });
+    // Requests one more than the cap: fetching exactly `MAX_SNAPSHOT_RECORDS` can never distinguish
+    // "matched exactly the cap" (nothing lost) from "matched more than it" (truncated) — the extra
+    // row is what makes that distinguishable, and is dropped again below before anything is audited.
+    // Constructs a real `PaginatedFilter` (via `.override`-equivalent spread of `context.filter`'s
+    // own fields, which is a plain `Filter` for Update/Delete) rather than merging `page` onto a bare
+    // object: the latter would depend on `context.collection.list` happening to reconstruct a proper
+    // instance from whatever shape it's handed, which isn't part of its contract.
+    const withLimit = (filter) => new datasource_toolkit_1.PaginatedFilter({ ...filter, page: new datasource_toolkit_1.Page(0, exports.MAX_SNAPSHOT_RECORDS + 1) });
+    // Hitting the cap means the operation may have matched more records than were actually audited.
+    // Under `critical: false`, silently dropping the excess would look identical to "everything got
+    // audited" — logged instead. Under `critical: true`, that gap is exactly what the option exists
+    // to refuse: no unaudited write, so the whole operation is refused rather than let through
+    // partially covered.
+    const enforceSnapshotCap = (operation, truncated) => {
+        if (!truncated)
+            return;
+        const message = `[ForestAdmin] Audit trail: "${name}" ${operation} matched more than ` +
+            `${exports.MAX_SNAPSHOT_RECORDS} records — only the first ${exports.MAX_SNAPSHOT_RECORDS} can be audited.`;
+        if (critical) {
+            throw new Error(`${message} Refusing the operation because "critical" is enabled.`);
+        }
+        logger?.('Warn', `${message} The rest were skipped.`);
+    };
+    collection.addInternalHook('Before', 'Create', async (context) => {
+        const pendingRecords = context.data.map(() => buildRecord(context.caller, {
+            operation: 'create',
+            recordId: null,
+            previousValues: {},
+            newValues: {},
+        }));
+        const pendingIds = await recorder.insertPendingBatch(pendingRecords);
+        pendingIdsByData.set(context.data, pendingIds);
+    });
+    collection.addInternalHook('After', 'Create', async (context) => {
+        const pendingIds = pendingIdsByData.get(context.data) ?? [];
+        pendingIdsByData.delete(context.data);
+        await Promise.all(context.records.map((record, index) => recorder.confirm(pendingIds[index] ?? null, {
+            operation: 'create',
+            recordId: toPackedRecordId(record, primaryKeys),
+            previousValues: {},
+            newValues: redactValues(pickColumns(record, writableColumns), redactedFields),
+        })));
+    });
+    collection.addInternalHook('Before', 'Update', async (context) => {
+        const fetched = (await context.collection.list(
+        // `context.filter` is typed as the plain-object `TFilter` shape for customer ergonomics, but
+        // is a real (frozen) `Filter` instance at runtime — the same cast the hook decorator itself
+        // performs to produce it.
+        withLimit(context.filter), readProjection));
+        const truncated = fetched.length > exports.MAX_SNAPSHOT_RECORDS;
+        enforceSnapshotCap('update', truncated);
+        const before = truncated ? fetched.slice(0, exports.MAX_SNAPSHOT_RECORDS) : fetched;
+        const pendingRecords = before.map(record => buildRecord(context.caller, {
+            operation: 'update',
+            recordId: toPackedRecordId(record, primaryKeys),
+            previousValues: pickColumns(record, writableColumns),
+            newValues: {},
+        }));
+        const pendingIds = await recorder.insertPendingBatch(pendingRecords);
+        pushSnapshot(context.filter, { before, patch: context.patch, pendingIds });
+    });
+    collection.addInternalHook('After', 'Update', async (context) => {
+        const snapshot = takeSnapshot(context.filter, context.patch);
+        if (!snapshot || snapshot.before.length === 0)
+            return;
+        const { before, pendingIds } = snapshot;
+        // Re-read each touched record by its own (possibly patch-changed) identity rather than via
+        // `context.filter`: if the update changed a field the filter matched on — including a
+        // writable primary key — re-querying with that same filter would find nothing, silently
+        // dropping the entry instead of filing it under the record's new id.
+        const expectedRecords = before.map(record => ({ ...record, ...context.patch }));
+        const expectedIds = expectedRecords.map(record => primaryKeys.map(pk => record[pk]));
+        const after = (await context.collection.list({ conditionTree: datasource_toolkit_1.ConditionTreeFactory.matchIds(schema, expectedIds) }, readProjection));
+        const afterById = new Map(after.map(record => [toPackedRecordId(record, primaryKeys), record]));
+        await Promise.all(before.map((record, index) => {
+            const updated = afterById.get(toPackedRecordId(expectedRecords[index], primaryKeys));
+            const pendingId = pendingIds[index] ?? null;
+            if (!updated)
+                return undefined;
+            const { previousValues, newValues } = changedValues(record, updated, writableColumns);
+            // Confirmed even when empty: the write still ran and resolved, so leaving the pending row
+            // unconfirmed would misrepresent a completed no-op write as one that never landed.
+            // Packed from the post-update values: if the update changed a writable primary key, the
+            // entry is filed under the record's new id, matching what later history lookups use.
+            return recorder.confirm(pendingId, {
+                operation: 'update',
+                recordId: toPackedRecordId(updated, primaryKeys),
+                previousValues: redactValues(previousValues, redactedFields),
+                newValues: redactValues(newValues, redactedFields),
+            });
+        }));
+    });
+    collection.addInternalHook('Before', 'Delete', async (context) => {
+        const fetched = (await context.collection.list(
+        // `context.filter` is typed as the plain-object `TFilter` shape for customer ergonomics, but
+        // is a real (frozen) `Filter` instance at runtime — the same cast the hook decorator itself
+        // performs to produce it.
+        withLimit(context.filter), readProjection));
+        const truncated = fetched.length > exports.MAX_SNAPSHOT_RECORDS;
+        enforceSnapshotCap('delete', truncated);
+        const before = truncated ? fetched.slice(0, exports.MAX_SNAPSHOT_RECORDS) : fetched;
+        const pendingRecords = before.map(record => buildRecord(context.caller, {
+            operation: 'delete',
+            recordId: toPackedRecordId(record, primaryKeys),
+            previousValues: pickColumns(record, writableColumns),
+            newValues: {},
+        }));
+        const pendingIds = await recorder.insertPendingBatch(pendingRecords);
+        pushSnapshot(context.filter, { before, pendingIds });
+    });
+    collection.addInternalHook('After', 'Delete', async (context) => {
+        const snapshot = takeSnapshot(context.filter);
+        if (!snapshot)
+            return;
+        const { before, pendingIds } = snapshot;
+        await Promise.all(before.map((record, index) => recorder.confirm(pendingIds[index] ?? null, {
+            operation: 'delete',
+            recordId: toPackedRecordId(record, primaryKeys),
+            previousValues: redactValues(pickColumns(record, writableColumns), redactedFields),
+            newValues: {},
+        })));
+    });
+}
+function installAuditTrailHooks(dataSourceCustomizer, _collectionCustomizer, options) {
+    const { sink, store, redact, critical = false, logger } = options ?? {};
+    const recorder = buildRecorder(store, sink, critical, logger);
+    for (const collection of dataSourceCustomizer.collections) {
+        // toPackedRecordId throws for a collection with no primary key — there is nothing to key an
+        // audit entry on, so skip instrumenting it entirely rather than installing hooks that would
+        // throw on the collection's first write.
+        if (datasource_toolkit_1.SchemaUtils.getPrimaryKeys(collection.schema).length === 0) {
+            logger?.('Warn', `[ForestAdmin] Audit trail: skipping "${collection.name}" — it has no primary key.`);
+        }
+        else {
+            instrumentCollection(collection, recorder, redact?.[collection.name] ?? [], logger, critical);
+        }
+    }
+    // Returned so a broken bootstrap fails agent.start() instead of the first write.
+    return store?.init?.();
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5zdHJ1bWVudC5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NyYy9hdWRpdC10cmFpbC9pbnN0cnVtZW50LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7OztBQW9QQSxzQ0EyRUM7QUFrTkQseUNBd0JDO0FBeGhCRCx3RUFLeUM7QUFFekMsTUFBTSxzQkFBc0IsR0FBRyxDQUFDLEdBQVcsRUFBRSxLQUFjLEVBQVcsRUFBRTtJQUN0RSxnR0FBZ0c7SUFDaEcsMEZBQTBGO0lBQzFGLElBQUksT0FBTyxLQUFLLEtBQUssUUFBUTtRQUFFLE9BQU8sS0FBSyxDQUFDLFFBQVEsRUFBRSxDQUFDO0lBRXZELElBQUksS0FBSyxJQUFJLE9BQU8sS0FBSyxLQUFLLFFBQVEsSUFBSSxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsS0FBSyxDQUFDLEVBQUUsQ0FBQztRQUNoRSxPQUFPLE1BQU0sQ0FBQyxJQUFJLENBQUMsS0FBZ0MsQ0FBQzthQUNqRCxJQUFJLEVBQUU7YUFDTixNQUFNLENBQTBCLENBQUMsTUFBTSxFQUFFLElBQUksRUFBRSxFQUFFO1lBQ2hELE1BQU0sQ0FBQyxJQUFJLENBQUMsR0FBSSxLQUFpQyxDQUFDLElBQUksQ0FBQyxDQUFDO1lBRXhELE9BQU8sTUFBTSxDQUFDO1FBQ2hCLENBQUMsRUFBRSxFQUFFLENBQUMsQ0FBQztJQUNYLENBQUM7SUFFRCxPQUFPLEtBQUssQ0FBQztBQUNmLENBQUMsQ0FBQztBQUVGLDBGQUEwRjtBQUMxRixxQ0FBcUM7QUFDckMsTUFBTSxVQUFVLEdBQUcsQ0FBQyxDQUFVLEVBQUUsQ0FBVSxFQUFXLEVBQUUsQ0FDckQsSUFBSSxDQUFDLFNBQVMsQ0FBQyxDQUFDLEVBQUUsc0JBQXNCLENBQUMsS0FBSyxJQUFJLENBQUMsU0FBUyxDQUFDLENBQUMsRUFBRSxzQkFBc0IsQ0FBQyxDQUFDO0FBRTFGLDJGQUEyRjtBQUMzRixnR0FBZ0c7QUFDaEcsaUdBQWlHO0FBQ2pHLHdGQUF3RjtBQUN4RixNQUFNLGdCQUFnQixHQUFHLENBQUMsS0FBYSxFQUFXLEVBQUUsQ0FDbEQsT0FBUSxLQUE4QixDQUFDLE1BQU0sS0FBSyxVQUFVLENBQUM7QUFFL0QsaUdBQWlHO0FBQ2pHLDBGQUEwRjtBQUMxRixrR0FBa0c7QUFDbEcsK0ZBQStGO0FBQy9GLDhGQUE4RjtBQUM5RixrR0FBa0c7QUFDbEcsZUFBZTtBQUNmLE1BQU0sVUFBVSxHQUFHLENBQUMsS0FBYyxFQUFXLEVBQUU7SUFDN0MsSUFBSSxPQUFPLEtBQUssS0FBSyxRQUFRO1FBQUUsT0FBTyxLQUFLLENBQUMsUUFBUSxFQUFFLENBQUM7SUFDdkQsSUFBSSxLQUFLLENBQUMsT0FBTyxDQUFDLEtBQUssQ0FBQztRQUFFLE9BQU8sS0FBSyxDQUFDLEdBQUcsQ0FBQyxVQUFVLENBQUMsQ0FBQztJQUV2RCxJQUFJLEtBQUssSUFBSSxPQUFPLEtBQUssS0FBSyxRQUFRLElBQUksQ0FBQyxnQkFBZ0IsQ0FBQyxLQUFLLENBQUMsRUFBRSxDQUFDO1FBQ25FLE9BQU8sTUFBTSxDQUFDLFdBQVcsQ0FDdkIsTUFBTSxDQUFDLE9BQU8sQ0FBQyxLQUFnQyxDQUFDLENBQUMsR0FBRyxDQUFDLENBQUMsQ0FBQyxHQUFHLEVBQUUsS0FBSyxDQUFDLEVBQUUsRUFBRSxDQUFDO1lBQ3JFLEdBQUc7WUFDSCxVQUFVLENBQUMsS0FBSyxDQUFDO1NBQ2xCLENBQUMsQ0FDSCxDQUFDO0lBQ0osQ0FBQztJQUVELE9BQU8sS0FBSyxDQUFDO0FBQ2YsQ0FBQyxDQUFDO0FBRUYsa0dBQWtHO0FBQ2xHLGtHQUFrRztBQUNsRyxrR0FBa0c7QUFDbEcscUdBQXFHO0FBQ3JHLHVDQUF1QztBQUMxQixRQUFBLG9CQUFvQixHQUFHLElBQUksQ0FBQztBQVF6Qyw2RkFBNkY7QUFDN0Ysa0dBQWtHO0FBQ2xHLCtGQUErRjtBQUMvRix3REFBd0Q7QUFDeEQsTUFBTSxpQkFBaUIsR0FBRyxJQUFJLE9BQU8sRUFBNkIsQ0FBQztBQUVuRSxTQUFTLFlBQVksQ0FBQyxHQUFXLEVBQUUsS0FBc0I7SUFDdkQsTUFBTSxLQUFLLEdBQUcsaUJBQWlCLENBQUMsR0FBRyxDQUFDLEdBQUcsQ0FBQyxJQUFJLEVBQUUsQ0FBQztJQUMvQyxLQUFLLENBQUMsSUFBSSxDQUFDLEtBQUssQ0FBQyxDQUFDO0lBQ2xCLGlCQUFpQixDQUFDLEdBQUcsQ0FBQyxHQUFHLEVBQUUsS0FBSyxDQUFDLENBQUM7QUFDcEMsQ0FBQztBQUVELDRGQUE0RjtBQUM1RixpR0FBaUc7QUFDakcsaUdBQWlHO0FBQ2pHLG1HQUFtRztBQUNuRyw0RUFBNEU7QUFDNUUsU0FBUyxZQUFZLENBQUMsR0FBVyxFQUFFLEtBQWtCO0lBQ25ELE1BQU0sS0FBSyxHQUFHLGlCQUFpQixDQUFDLEdBQUcsQ0FBQyxHQUFHLENBQUMsQ0FBQztJQUN6QyxJQUFJLENBQUMsS0FBSyxJQUFJLEtBQUssQ0FBQyxNQUFNLEtBQUssQ0FBQztRQUFFLE9BQU8sU0FBUyxDQUFDO0lBRW5ELE1BQU0sS0FBSyxHQUFHLEtBQUssQ0FBQyxDQUFDLENBQUMsS0FBSyxDQUFDLFNBQVMsQ0FBQyxLQUFLLENBQUMsRUFBRSxDQUFDLFVBQVUsQ0FBQyxLQUFLLENBQUMsS0FBSyxFQUFFLEtBQUssQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQztJQUNuRixNQUFNLENBQUMsS0FBSyxDQUFDLEdBQUcsS0FBSyxDQUFDLE1BQU0sQ0FBQyxLQUFLLEtBQUssQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUMsS0FBSyxFQUFFLENBQUMsQ0FBQyxDQUFDO0lBRTFELElBQUksS0FBSyxDQUFDLE1BQU0sS0FBSyxDQUFDO1FBQUUsaUJBQWlCLENBQUMsTUFBTSxDQUFDLEdBQUcsQ0FBQyxDQUFDO0lBRXRELE9BQU8sS0FBSyxDQUFDO0FBQ2YsQ0FBQztBQUVELGtHQUFrRztBQUNsRyxpR0FBaUc7QUFDakcsbUdBQW1HO0FBQ25HLE1BQU0sZ0JBQWdCLEdBQUcsSUFBSSxPQUFPLEVBQWdDLENBQUM7QUFFckUsd0VBQXdFO0FBQ3hFLE1BQU0sZ0JBQWdCLEdBQUcsQ0FBQyxNQUFrQixFQUFFLFdBQXFCLEVBQVUsRUFBRTtJQUM3RSxJQUFJLFdBQVcsQ0FBQyxNQUFNLEtBQUssQ0FBQyxFQUFFLENBQUM7UUFDN0IsTUFBTSxJQUFJLEtBQUssQ0FBQywrQ0FBK0MsQ0FBQyxDQUFDO0lBQ25FLENBQUM7SUFFRCxPQUFPLFdBQVcsQ0FBQyxHQUFHLENBQUMsRUFBRSxDQUFDLEVBQUUsQ0FBQyxNQUFNLENBQUMsTUFBTSxDQUFDLEVBQUUsQ0FBQyxDQUFDLENBQUMsQ0FBQyxJQUFJLENBQUMsR0FBRyxDQUFDLENBQUM7QUFDN0QsQ0FBQyxDQUFDO0FBRUYsTUFBTSxXQUFXLEdBQUcsQ0FBQyxNQUFrQixFQUFFLE9BQWlCLEVBQTJCLEVBQUUsQ0FDckYsTUFBTSxDQUFDLFdBQVcsQ0FBQyxPQUFPLENBQUMsR0FBRyxDQUFDLE1BQU0sQ0FBQyxFQUFFLENBQUMsQ0FBQyxNQUFNLEVBQUUsVUFBVSxDQUFDLE1BQU0sQ0FBQyxNQUFNLENBQUMsQ0FBQyxJQUFJLElBQUksQ0FBQyxDQUFDLENBQUMsQ0FBQztBQUUxRixNQUFNLGFBQWEsR0FBRyxDQUFDLEtBQWMsRUFBb0MsRUFBRSxDQUN6RSxPQUFPLENBQUMsS0FBSyxDQUFDLElBQUksT0FBTyxLQUFLLEtBQUssUUFBUSxJQUFJLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxLQUFLLENBQUMsSUFBSSxDQUFDLENBQUMsS0FBSyxZQUFZLElBQUksQ0FBQyxDQUFDO0FBRW5HLE1BQU0sYUFBYSxHQUFHLENBQUMsS0FBYyxFQUFzQyxFQUFFLENBQzNFLEtBQUssQ0FBQyxPQUFPLENBQUMsS0FBSyxDQUFDLElBQUksS0FBSyxDQUFDLE1BQU0sR0FBRyxDQUFDLElBQUksS0FBSyxDQUFDLEtBQUssQ0FBQyxhQUFhLENBQUMsQ0FBQztBQUl6RSxpR0FBaUc7QUFDakcsZ0dBQWdHO0FBQ2hHLCtGQUErRjtBQUMvRixpR0FBaUc7QUFDakcsb0VBQW9FO0FBQ3BFLE1BQU0sSUFBSSxHQUFHLENBQUMsTUFBZSxFQUFFLEtBQWMsRUFBZ0IsRUFBRTtJQUM3RCxJQUFJLFVBQVUsQ0FBQyxNQUFNLEVBQUUsS0FBSyxDQUFDO1FBQUUsT0FBTyxJQUFJLENBQUM7SUFFM0MsSUFBSSxhQUFhLENBQUMsTUFBTSxDQUFDLElBQUksYUFBYSxDQUFDLEtBQUssQ0FBQyxFQUFFLENBQUM7UUFDbEQsTUFBTSxRQUFRLEdBQTRCLEVBQUUsQ0FBQztRQUM3QyxNQUFNLElBQUksR0FBNEIsRUFBRSxDQUFDO1FBRXpDLEtBQUssTUFBTSxHQUFHLElBQUksSUFBSSxHQUFHLENBQUMsQ0FBQyxHQUFHLE1BQU0sQ0FBQyxJQUFJLENBQUMsTUFBTSxDQUFDLEVBQUUsR0FBRyxNQUFNLENBQUMsSUFBSSxDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDO1lBQzNFLE1BQU0sUUFBUSxHQUFHLElBQUksQ0FBQyxNQUFNLENBQUMsR0FBRyxDQUFDLEVBQUUsS0FBSyxDQUFDLEdBQUcsQ0FBQyxDQUFDLENBQUM7WUFFL0MsSUFBSSxRQUFRLEVBQUUsQ0FBQztnQkFDYixJQUFJLENBQUMsUUFBUSxDQUFDLGNBQWM7b0JBQUUsUUFBUSxDQUFDLEdBQUcsQ0FBQyxHQUFHLFFBQVEsQ0FBQyxRQUFRLENBQUM7Z0JBQ2hFLElBQUksQ0FBQyxRQUFRLENBQUMsVUFBVTtvQkFBRSxJQUFJLENBQUMsR0FBRyxDQUFDLEdBQUcsUUFBUSxDQUFDLElBQUksQ0FBQztZQUN0RCxDQUFDO1FBQ0gsQ0FBQztRQUVELE9BQU8sRUFBRSxRQUFRLEVBQUUsSUFBSSxFQUFFLGNBQWMsRUFBRSxLQUFLLEVBQUUsVUFBVSxFQUFFLEtBQUssRUFBRSxDQUFDO0lBQ3RFLENBQUM7SUFFRCxJQUFJLGFBQWEsQ0FBQyxNQUFNLENBQUMsSUFBSSxhQUFhLENBQUMsS0FBSyxDQUFDLEVBQUUsQ0FBQztRQUNsRCxNQUFNLFFBQVEsR0FBNEIsRUFBRSxDQUFDO1FBQzdDLE1BQU0sSUFBSSxHQUE0QixFQUFFLENBQUM7UUFFekMsS0FBSyxJQUFJLEtBQUssR0FBRyxDQUFDLEVBQUUsS0FBSyxHQUFHLElBQUksQ0FBQyxHQUFHLENBQUMsTUFBTSxDQUFDLE1BQU0sRUFBRSxLQUFLLENBQUMsTUFBTSxDQUFDLEVBQUUsS0FBSyxJQUFJLENBQUMsRUFBRSxDQUFDO1lBQzlFLE1BQU0sUUFBUSxHQUFHLElBQUksQ0FBQyxNQUFNLENBQUMsS0FBSyxDQUFDLEVBQUUsS0FBSyxDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUM7WUFFbkQsSUFBSSxRQUFRLEVBQUUsQ0FBQztnQkFDYixJQUFJLENBQUMsUUFBUSxDQUFDLGNBQWM7b0JBQUUsUUFBUSxDQUFDLEtBQUssQ0FBQyxHQUFHLFFBQVEsQ0FBQyxRQUFRLENBQUM7Z0JBQ2xFLElBQUksQ0FBQyxRQUFRLENBQUMsVUFBVTtvQkFBRSxJQUFJLENBQUMsS0FBSyxDQUFDLEdBQUcsUUFBUSxDQUFDLElBQUksQ0FBQztZQUN4RCxDQUFDO1FBQ0gsQ0FBQztRQUVELE9BQU8sRUFBRSxRQUFRLEVBQUUsSUFBSSxFQUFFLGNBQWMsRUFBRSxLQUFLLEVBQUUsVUFBVSxFQUFFLEtBQUssRUFBRSxDQUFDO0lBQ3RFLENBQUM7SUFFRCxPQUFPO1FBQ0wsUUFBUSxFQUFFLE1BQU0sS0FBSyxTQUFTLENBQUMsQ0FBQyxDQUFDLFNBQVMsQ0FBQyxDQUFDLENBQUMsVUFBVSxDQUFDLE1BQU0sQ0FBQyxJQUFJLElBQUk7UUFDdkUsSUFBSSxFQUFFLEtBQUssS0FBSyxTQUFTLENBQUMsQ0FBQyxDQUFDLFNBQVMsQ0FBQyxDQUFDLENBQUMsVUFBVSxDQUFDLEtBQUssQ0FBQyxJQUFJLElBQUk7UUFDakUsY0FBYyxFQUFFLE1BQU0sS0FBSyxTQUFTO1FBQ3BDLFVBQVUsRUFBRSxLQUFLLEtBQUssU0FBUztLQUNoQyxDQUFDO0FBQ0osQ0FBQyxDQUFDO0FBRUYsa0dBQWtHO0FBQ2xHLGlHQUFpRztBQUNqRyxNQUFNLGFBQWEsR0FBRyxDQUNwQixNQUFrQixFQUNsQixLQUFpQixFQUNqQixPQUFpQixFQUNnRSxFQUFFO0lBQ25GLE1BQU0sY0FBYyxHQUE0QixFQUFFLENBQUM7SUFDbkQsTUFBTSxTQUFTLEdBQTRCLEVBQUUsQ0FBQztJQUU5QyxLQUFLLE1BQU0sTUFBTSxJQUFJLE9BQU8sRUFBRSxDQUFDO1FBQzdCLE1BQU0sS0FBSyxHQUFHLElBQUksQ0FBQyxNQUFNLENBQUMsTUFBTSxDQUFDLEVBQUUsS0FBSyxDQUFDLE1BQU0sQ0FBQyxDQUFDLENBQUM7UUFFbEQsSUFBSSxLQUFLLEVBQUUsQ0FBQztZQUNWLElBQUksQ0FBQyxLQUFLLENBQUMsY0FBYztnQkFBRSxjQUFjLENBQUMsTUFBTSxDQUFDLEdBQUcsS0FBSyxDQUFDLFFBQVEsQ0FBQztZQUNuRSxJQUFJLENBQUMsS0FBSyxDQUFDLFVBQVU7Z0JBQUUsU0FBUyxDQUFDLE1BQU0sQ0FBQyxHQUFHLEtBQUssQ0FBQyxJQUFJLENBQUM7UUFDeEQsQ0FBQztJQUNILENBQUM7SUFFRCxPQUFPLEVBQUUsY0FBYyxFQUFFLFNBQVMsRUFBRSxDQUFDO0FBQ3ZDLENBQUMsQ0FBQztBQUVXLFFBQUEsUUFBUSxHQUFHLFlBQVksQ0FBQztBQUVyQyxNQUFNLFlBQVksR0FBRyxDQUNuQixNQUErQixFQUMvQixjQUF3QixFQUNDLEVBQUU7SUFDM0IsSUFBSSxDQUFDLGNBQWMsQ0FBQyxNQUFNO1FBQUUsT0FBTyxNQUFNLENBQUM7SUFFMUMsTUFBTSxNQUFNLEdBQUcsRUFBRSxHQUFHLE1BQU0sRUFBRSxDQUFDO0lBQzdCLEtBQUssTUFBTSxLQUFLLElBQUksY0FBYztRQUFFLElBQUksS0FBSyxJQUFJLE1BQU07WUFBRSxNQUFNLENBQUMsS0FBSyxDQUFDLEdBQUcsZ0JBQVEsQ0FBQztJQUVsRixPQUFPLE1BQU0sQ0FBQztBQUNoQixDQUFDLENBQUM7QUFFRixNQUFNLFdBQVcsR0FBYyxNQUFNLENBQUMsRUFBRTtJQUN0QyxzQ0FBc0M7SUFDdEMsT0FBTyxDQUFDLElBQUksQ0FBQyxlQUFlLEVBQUUsSUFBSSxDQUFDLFNBQVMsQ0FBQyxNQUFNLENBQUMsQ0FBQyxDQUFDO0FBQ3hELENBQUMsQ0FBQztBQWFGLFNBQWdCLGFBQWEsQ0FDM0IsS0FBNkIsRUFDN0IsSUFBMkIsRUFDM0IsUUFBaUIsRUFDakIsTUFBMEI7SUFFMUIsSUFBSSxLQUFLLEVBQUUsQ0FBQztRQUNWLE9BQU87WUFDTCxLQUFLLENBQUMsa0JBQWtCLENBQUMsT0FBTztnQkFDOUIsSUFBSSxPQUFPLENBQUMsTUFBTSxLQUFLLENBQUM7b0JBQUUsT0FBTyxFQUFFLENBQUM7Z0JBRXBDLElBQUksQ0FBQztvQkFDSCxPQUFPLE1BQU0sS0FBSyxDQUFDLGtCQUFrQixDQUFDLE9BQU8sQ0FBQyxDQUFDO2dCQUNqRCxDQUFDO2dCQUFDLE9BQU8sS0FBSyxFQUFFLENBQUM7b0JBQ2Ysb0ZBQW9GO29CQUNwRixzRkFBc0Y7b0JBQ3RGLGlDQUFpQztvQkFDakMsSUFBSSxRQUFRO3dCQUFFLE1BQU0sS0FBSyxDQUFDO29CQUUxQixNQUFNLEVBQUUsQ0FDTixPQUFPLEVBQ1AsNEVBQTRFLEtBQUssRUFBRSxDQUNwRixDQUFDO29CQUVGLE9BQU8sT0FBTyxDQUFDLEdBQUcsQ0FBQyxHQUFHLEVBQUUsQ0FBQyxJQUFJLENBQUMsQ0FBQztnQkFDakMsQ0FBQztZQUNILENBQUM7WUFDRCxLQUFLLENBQUMsT0FBTyxDQUFDLEVBQUUsRUFBRSxLQUFLO2dCQUNyQixJQUFJLEVBQUUsS0FBSyxJQUFJO29CQUFFLE9BQU87Z0JBRXhCLElBQUksQ0FBQztvQkFDSCxNQUFNLEtBQUssQ0FBQyxPQUFPLENBQUMsRUFBRSxFQUFFLEtBQUssQ0FBQyxDQUFDO2dCQUNqQyxDQUFDO2dCQUFDLE9BQU8sS0FBSyxFQUFFLENBQUM7b0JBQ2YsMEVBQTBFO29CQUMxRSxNQUFNLEVBQUUsQ0FDTixPQUFPLEVBQ1AsbUVBQW1FLEtBQUssRUFBRSxDQUMzRSxDQUFDO2dCQUNKLENBQUM7WUFDSCxDQUFDO1NBQ0YsQ0FBQztJQUNKLENBQUM7SUFFRCxNQUFNLElBQUksR0FBRyxJQUFJLElBQUksV0FBVyxDQUFDO0lBQ2pDLE1BQU0sV0FBVyxHQUFHLElBQUksR0FBRyxFQUE4QixDQUFDO0lBQzFELElBQUksTUFBTSxHQUFHLENBQUMsQ0FBQztJQUVmLE9BQU87UUFDTCxLQUFLLENBQUMsa0JBQWtCLENBQUMsT0FBTztZQUM5QixPQUFPLE9BQU8sQ0FBQyxHQUFHLENBQUMsTUFBTSxDQUFDLEVBQUU7Z0JBQzFCLE1BQU0sRUFBRSxHQUFHLE1BQU0sQ0FBQztnQkFDbEIsTUFBTSxJQUFJLENBQUMsQ0FBQztnQkFDWixXQUFXLENBQUMsR0FBRyxDQUFDLEVBQUUsRUFBRSxNQUFNLENBQUMsQ0FBQztnQkFFNUIsT0FBTyxFQUFFLENBQUM7WUFDWixDQUFDLENBQUMsQ0FBQztRQUNMLENBQUM7UUFDRCxLQUFLLENBQUMsT0FBTyxDQUFDLEVBQUUsRUFBRSxLQUFLO1lBQ3JCLElBQUksRUFBRSxLQUFLLElBQUk7Z0JBQUUsT0FBTztZQUV4QixNQUFNLE9BQU8sR0FBRyxXQUFXLENBQUMsR0FBRyxDQUFDLEVBQUUsQ0FBQyxDQUFDO1lBQ3BDLFdBQVcsQ0FBQyxNQUFNLENBQUMsRUFBRSxDQUFDLENBQUM7WUFDdkIsSUFBSSxDQUFDLE9BQU87Z0JBQUUsT0FBTztZQUVyQixJQUFJLENBQUM7Z0JBQ0gsTUFBTSxJQUFJLENBQUMsRUFBRSxHQUFHLE9BQU8sRUFBRSxHQUFHLEtBQUssRUFBRSxDQUFDLENBQUM7WUFDdkMsQ0FBQztZQUFDLE9BQU8sS0FBSyxFQUFFLENBQUM7Z0JBQ2YsMEVBQTBFO2dCQUMxRSxNQUFNLEVBQUUsQ0FDTixPQUFPLEVBQ1AsbUVBQW1FLEtBQUssRUFBRSxDQUMzRSxDQUFDO1lBQ0osQ0FBQztRQUNILENBQUM7S0FDRixDQUFDO0FBQ0osQ0FBQztBQUVELFNBQVMsb0JBQW9CLENBQzNCLFVBQWdDLEVBQ2hDLFFBQWtCLEVBQ2xCLGNBQXdCLEVBQ3hCLE1BQTBCLEVBQzFCLFFBQWlCO0lBRWpCLE1BQU0sRUFBRSxNQUFNLEVBQUUsR0FBRyxVQUFVLENBQUM7SUFDOUIsTUFBTSxlQUFlLEdBQUcsTUFBTSxDQUFDLElBQUksQ0FBQyxNQUFNLENBQUMsTUFBTSxDQUFDLENBQUMsTUFBTSxDQUFDLElBQUksQ0FBQyxFQUFFO1FBQy9ELE1BQU0sS0FBSyxHQUFHLE1BQU0sQ0FBQyxNQUFNLENBQUMsSUFBSSxDQUFDLENBQUM7UUFFbEMsT0FBTyxLQUFLLENBQUMsSUFBSSxLQUFLLFFBQVEsSUFBSSxDQUFDLEtBQUssQ0FBQyxVQUFVLENBQUM7SUFDdEQsQ0FBQyxDQUFDLENBQUM7SUFDSCxNQUFNLFdBQVcsR0FBRyxnQ0FBVyxDQUFDLGNBQWMsQ0FBQyxNQUFNLENBQUMsQ0FBQztJQUN2RCw0RkFBNEY7SUFDNUYsdUNBQXVDO0lBQ3ZDLE1BQU0sY0FBYyxHQUFHLENBQUMsR0FBRyxJQUFJLEdBQUcsQ0FBQyxDQUFDLEdBQUcsV0FBVyxFQUFFLEdBQUcsZUFBZSxDQUFDLENBQUMsQ0FBQyxDQUFDO0lBQzFFLE1BQU0sRUFBRSxJQUFJLEVBQUUsR0FBRyxVQUFVLENBQUM7SUFFNUIsTUFBTSxXQUFXLEdBQUcsQ0FDbEIsTUFBYyxFQUNkLEtBQTBGLEVBQ3RFLEVBQUUsQ0FBQyxDQUFDO1FBQ3hCLFNBQVMsRUFBRSxJQUFJLElBQUksRUFBRSxDQUFDLFdBQVcsRUFBRTtRQUNuQyxVQUFVLEVBQUUsSUFBSTtRQUNoQixNQUFNLEVBQUUsTUFBTSxDQUFDLEVBQUU7UUFDakIsYUFBYSxFQUFFLE1BQU0sQ0FBQyxTQUFTO1FBQy9CLFlBQVksRUFBRSxNQUFNLENBQUMsUUFBUTtRQUM3QixTQUFTLEVBQUUsTUFBTSxDQUFDLEtBQUs7UUFDdkIsVUFBVSxFQUFFLElBQUk7UUFDaEIsY0FBYyxFQUFFLE1BQU0sQ0FBQyxTQUFTO1FBQ2hDLEdBQUcsS0FBSztRQUNSLGNBQWMsRUFBRSxZQUFZLENBQUMsS0FBSyxDQUFDLGNBQWMsRUFBRSxjQUFjLENBQUM7UUFDbEUsU0FBUyxFQUFFLFlBQVksQ0FBQyxLQUFLLENBQUMsU0FBUyxFQUFFLGNBQWMsQ0FBQztLQUN6RCxDQUFDLENBQUM7SUFFSCxnR0FBZ0c7SUFDaEcsK0ZBQStGO0lBQy9GLGlHQUFpRztJQUNqRywrRkFBK0Y7SUFDL0Ysa0dBQWtHO0lBQ2xHLGlHQUFpRztJQUNqRyw4RUFBOEU7SUFDOUUsTUFBTSxTQUFTLEdBQUcsQ0FBQyxNQUFjLEVBQW1CLEVBQUUsQ0FDcEQsSUFBSSxvQ0FBZSxDQUFDLEVBQUUsR0FBRyxNQUFNLEVBQUUsSUFBSSxFQUFFLElBQUkseUJBQUksQ0FBQyxDQUFDLEVBQUUsNEJBQW9CLEdBQUcsQ0FBQyxDQUFDLEVBQUUsQ0FBQyxDQUFDO0lBRWxGLGdHQUFnRztJQUNoRyxnR0FBZ0c7SUFDaEcsZ0dBQWdHO0lBQ2hHLDJGQUEyRjtJQUMzRixxQkFBcUI7SUFDckIsTUFBTSxrQkFBa0IsR0FBRyxDQUFDLFNBQThCLEVBQUUsU0FBa0IsRUFBUSxFQUFFO1FBQ3RGLElBQUksQ0FBQyxTQUFTO1lBQUUsT0FBTztRQUV2QixNQUFNLE9BQU8sR0FDWCwrQkFBK0IsSUFBSSxLQUFLLFNBQVMscUJBQXFCO1lBQ3RFLEdBQUcsNEJBQW9CLDZCQUE2Qiw0QkFBb0Isa0JBQWtCLENBQUM7UUFFN0YsSUFBSSxRQUFRLEVBQUUsQ0FBQztZQUNiLE1BQU0sSUFBSSxLQUFLLENBQUMsR0FBRyxPQUFPLHdEQUF3RCxDQUFDLENBQUM7UUFDdEYsQ0FBQztRQUVELE1BQU0sRUFBRSxDQUFDLE1BQU0sRUFBRSxHQUFHLE9BQU8seUJBQXlCLENBQUMsQ0FBQztJQUN4RCxDQUFDLENBQUM7SUFFRixVQUFVLENBQUMsZUFBZSxDQUFDLFFBQVEsRUFBRSxRQUFRLEVBQUUsS0FBSyxFQUFFLE9BQWdDLEVBQUUsRUFBRTtRQUN4RixNQUFNLGNBQWMsR0FBRyxPQUFPLENBQUMsSUFBSSxDQUFDLEdBQUcsQ0FBQyxHQUFHLEVBQUUsQ0FDM0MsV0FBVyxDQUFDLE9BQU8sQ0FBQyxNQUFNLEVBQUU7WUFDMUIsU0FBUyxFQUFFLFFBQVE7WUFDbkIsUUFBUSxFQUFFLElBQUk7WUFDZCxjQUFjLEVBQUUsRUFBRTtZQUNsQixTQUFTLEVBQUUsRUFBRTtTQUNkLENBQUMsQ0FDSCxDQUFDO1FBQ0YsTUFBTSxVQUFVLEdBQUcsTUFBTSxRQUFRLENBQUMsa0JBQWtCLENBQUMsY0FBYyxDQUFDLENBQUM7UUFFckUsZ0JBQWdCLENBQUMsR0FBRyxDQUFDLE9BQU8sQ0FBQyxJQUFJLEVBQUUsVUFBVSxDQUFDLENBQUM7SUFDakQsQ0FBQyxDQUFDLENBQUM7SUFFSCxVQUFVLENBQUMsZUFBZSxDQUFDLE9BQU8sRUFBRSxRQUFRLEVBQUUsS0FBSyxFQUFFLE9BQStCLEVBQUUsRUFBRTtRQUN0RixNQUFNLFVBQVUsR0FBRyxnQkFBZ0IsQ0FBQyxHQUFHLENBQUMsT0FBTyxDQUFDLElBQUksQ0FBQyxJQUFJLEVBQUUsQ0FBQztRQUM1RCxnQkFBZ0IsQ0FBQyxNQUFNLENBQUMsT0FBTyxDQUFDLElBQUksQ0FBQyxDQUFDO1FBRXRDLE1BQU0sT0FBTyxDQUFDLEdBQUcsQ0FDZixPQUFPLENBQUMsT0FBTyxDQUFDLEdBQUcsQ0FBQyxDQUFDLE1BQU0sRUFBRSxLQUFLLEVBQUUsRUFBRSxDQUNwQyxRQUFRLENBQUMsT0FBTyxDQUFDLFVBQVUsQ0FBQyxLQUFLLENBQUMsSUFBSSxJQUFJLEVBQUU7WUFDMUMsU0FBUyxFQUFFLFFBQVE7WUFDbkIsUUFBUSxFQUFFLGdCQUFnQixDQUFDLE1BQU0sRUFBRSxXQUFXLENBQUM7WUFDL0MsY0FBYyxFQUFFLEVBQUU7WUFDbEIsU0FBUyxFQUFFLFlBQVksQ0FBQyxXQUFXLENBQUMsTUFBTSxFQUFFLGVBQWUsQ0FBQyxFQUFFLGNBQWMsQ0FBQztTQUM5RSxDQUFDLENBQ0gsQ0FDRixDQUFDO0lBQ0osQ0FBQyxDQUFDLENBQUM7SUFFSCxVQUFVLENBQUMsZUFBZSxDQUFDLFFBQVEsRUFBRSxRQUFRLEVBQUUsS0FBSyxFQUFFLE9BQWdDLEVBQUUsRUFBRTtRQUN4RixNQUFNLE9BQU8sR0FBRyxDQUFDLE1BQU0sT0FBTyxDQUFDLFVBQVUsQ0FBQyxJQUFJO1FBQzVDLDZGQUE2RjtRQUM3Riw0RkFBNEY7UUFDNUYsMEJBQTBCO1FBQzFCLFNBQVMsQ0FBQyxPQUFPLENBQUMsTUFBMkIsQ0FBVSxFQUN2RCxjQUF5QixDQUMxQixDQUFpQixDQUFDO1FBRW5CLE1BQU0sU0FBUyxHQUFHLE9BQU8sQ0FBQyxNQUFNLEdBQUcsNEJBQW9CLENBQUM7UUFDeEQsa0JBQWtCLENBQUMsUUFBUSxFQUFFLFNBQVMsQ0FBQyxDQUFDO1FBQ3hDLE1BQU0sTUFBTSxHQUFHLFNBQVMsQ0FBQyxDQUFDLENBQUMsT0FBTyxDQUFDLEtBQUssQ0FBQyxDQUFDLEVBQUUsNEJBQW9CLENBQUMsQ0FBQyxDQUFDLENBQUMsT0FBTyxDQUFDO1FBRTVFLE1BQU0sY0FBYyxHQUFHLE1BQU0sQ0FBQyxHQUFHLENBQUMsTUFBTSxDQUFDLEVBQUUsQ0FDekMsV0FBVyxDQUFDLE9BQU8sQ0FBQyxNQUFNLEVBQUU7WUFDMUIsU0FBUyxFQUFFLFFBQVE7WUFDbkIsUUFBUSxFQUFFLGdCQUFnQixDQUFDLE1BQU0sRUFBRSxXQUFXLENBQUM7WUFDL0MsY0FBYyxFQUFFLFdBQVcsQ0FBQyxNQUFNLEVBQUUsZUFBZSxDQUFDO1lBQ3BELFNBQVMsRUFBRSxFQUFFO1NBQ2QsQ0FBQyxDQUNILENBQUM7UUFDRixNQUFNLFVBQVUsR0FBRyxNQUFNLFFBQVEsQ0FBQyxrQkFBa0IsQ0FBQyxjQUFjLENBQUMsQ0FBQztRQUVyRSxZQUFZLENBQUMsT0FBTyxDQUFDLE1BQU0sRUFBRSxFQUFFLE1BQU0sRUFBRSxLQUFLLEVBQUUsT0FBTyxDQUFDLEtBQUssRUFBRSxVQUFVLEVBQUUsQ0FBQyxDQUFDO0lBQzdFLENBQUMsQ0FBQyxDQUFDO0lBRUgsVUFBVSxDQUFDLGVBQWUsQ0FBQyxPQUFPLEVBQUUsUUFBUSxFQUFFLEtBQUssRUFBRSxPQUFnQyxFQUFFLEVBQUU7UUFDdkYsTUFBTSxRQUFRLEdBQUcsWUFBWSxDQUFDLE9BQU8sQ0FBQyxNQUFNLEVBQUUsT0FBTyxDQUFDLEtBQUssQ0FBQyxDQUFDO1FBRTdELElBQUksQ0FBQyxRQUFRLElBQUksUUFBUSxDQUFDLE1BQU0sQ0FBQyxNQUFNLEtBQUssQ0FBQztZQUFFLE9BQU87UUFFdEQsTUFBTSxFQUFFLE1BQU0sRUFBRSxVQUFVLEVBQUUsR0FBRyxRQUFRLENBQUM7UUFFeEMsMkZBQTJGO1FBQzNGLHNGQUFzRjtRQUN0Rix3RkFBd0Y7UUFDeEYscUVBQXFFO1FBQ3JFLE1BQU0sZUFBZSxHQUFHLE1BQU0sQ0FBQyxHQUFHLENBQUMsTUFBTSxDQUFDLEVBQUUsQ0FBQyxDQUFDLEVBQUUsR0FBRyxNQUFNLEVBQUUsR0FBRyxPQUFPLENBQUMsS0FBSyxFQUFFLENBQUMsQ0FBQyxDQUFDO1FBQ2hGLE1BQU0sV0FBVyxHQUFHLGVBQWUsQ0FBQyxHQUFHLENBQUMsTUFBTSxDQUFDLEVBQUUsQ0FBQyxXQUFXLENBQUMsR0FBRyxDQUFDLEVBQUUsQ0FBQyxFQUFFLENBQUMsTUFBTSxDQUFDLEVBQUUsQ0FBQyxDQUFDLENBQUMsQ0FBQztRQUNyRixNQUFNLEtBQUssR0FBRyxDQUFDLE1BQU0sT0FBTyxDQUFDLFVBQVUsQ0FBQyxJQUFJLENBQzFDLEVBQUUsYUFBYSxFQUFFLHlDQUFvQixDQUFDLFFBQVEsQ0FBQyxNQUFNLEVBQUUsV0FBVyxDQUFDLEVBQVcsRUFDOUUsY0FBeUIsQ0FDMUIsQ0FBaUIsQ0FBQztRQUNuQixNQUFNLFNBQVMsR0FBRyxJQUFJLEdBQUcsQ0FBQyxLQUFLLENBQUMsR0FBRyxDQUFDLE1BQU0sQ0FBQyxFQUFFLENBQUMsQ0FBQyxnQkFBZ0IsQ0FBQyxNQUFNLEVBQUUsV0FBVyxDQUFDLEVBQUUsTUFBTSxDQUFDLENBQUMsQ0FBQyxDQUFDO1FBRWhHLE1BQU0sT0FBTyxDQUFDLEdBQUcsQ0FDZixNQUFNLENBQUMsR0FBRyxDQUFDLENBQUMsTUFBTSxFQUFFLEtBQUssRUFBRSxFQUFFO1lBQzNCLE1BQU0sT0FBTyxHQUFHLFNBQVMsQ0FBQyxHQUFHLENBQUMsZ0JBQWdCLENBQUMsZUFBZSxDQUFDLEtBQUssQ0FBQyxFQUFFLFdBQVcsQ0FBQyxDQUFDLENBQUM7WUFDckYsTUFBTSxTQUFTLEdBQUcsVUFBVSxDQUFDLEtBQUssQ0FBQyxJQUFJLElBQUksQ0FBQztZQUU1QyxJQUFJLENBQUMsT0FBTztnQkFBRSxPQUFPLFNBQVMsQ0FBQztZQUUvQixNQUFNLEVBQUUsY0FBYyxFQUFFLFNBQVMsRUFBRSxHQUFHLGFBQWEsQ0FBQyxNQUFNLEVBQUUsT0FBTyxFQUFFLGVBQWUsQ0FBQyxDQUFDO1lBRXRGLDBGQUEwRjtZQUMxRixtRkFBbUY7WUFDbkYsd0ZBQXdGO1lBQ3hGLHFGQUFxRjtZQUNyRixPQUFPLFFBQVEsQ0FBQyxPQUFPLENBQUMsU0FBUyxFQUFFO2dCQUNqQyxTQUFTLEVBQUUsUUFBUTtnQkFDbkIsUUFBUSxFQUFFLGdCQUFnQixDQUFDLE9BQU8sRUFBRSxXQUFXLENBQUM7Z0JBQ2hELGNBQWMsRUFBRSxZQUFZLENBQUMsY0FBYyxFQUFFLGNBQWMsQ0FBQztnQkFDNUQsU0FBUyxFQUFFLFlBQVksQ0FBQyxTQUFTLEVBQUUsY0FBYyxDQUFDO2FBQ25ELENBQUMsQ0FBQztRQUNMLENBQUMsQ0FBQyxDQUNILENBQUM7SUFDSixDQUFDLENBQUMsQ0FBQztJQUVILFVBQVUsQ0FBQyxlQUFlLENBQUMsUUFBUSxFQUFFLFFBQVEsRUFBRSxLQUFLLEVBQUUsT0FBZ0MsRUFBRSxFQUFFO1FBQ3hGLE1BQU0sT0FBTyxHQUFHLENBQUMsTUFBTSxPQUFPLENBQUMsVUFBVSxDQUFDLElBQUk7UUFDNUMsNkZBQTZGO1FBQzdGLDRGQUE0RjtRQUM1RiwwQkFBMEI7UUFDMUIsU0FBUyxDQUFDLE9BQU8sQ0FBQyxNQUEyQixDQUFVLEVBQ3ZELGNBQXlCLENBQzFCLENBQWlCLENBQUM7UUFFbkIsTUFBTSxTQUFTLEdBQUcsT0FBTyxDQUFDLE1BQU0sR0FBRyw0QkFBb0IsQ0FBQztRQUN4RCxrQkFBa0IsQ0FBQyxRQUFRLEVBQUUsU0FBUyxDQUFDLENBQUM7UUFDeEMsTUFBTSxNQUFNLEdBQUcsU0FBUyxDQUFDLENBQUMsQ0FBQyxPQUFPLENBQUMsS0FBSyxDQUFDLENBQUMsRUFBRSw0QkFBb0IsQ0FBQyxDQUFDLENBQUMsQ0FBQyxPQUFPLENBQUM7UUFFNUUsTUFBTSxjQUFjLEdBQUcsTUFBTSxDQUFDLEdBQUcsQ0FBQyxNQUFNLENBQUMsRUFBRSxDQUN6QyxXQUFXLENBQUMsT0FBTyxDQUFDLE1BQU0sRUFBRTtZQUMxQixTQUFTLEVBQUUsUUFBUTtZQUNuQixRQUFRLEVBQUUsZ0JBQWdCLENBQUMsTUFBTSxFQUFFLFdBQVcsQ0FBQztZQUMvQyxjQUFjLEVBQUUsV0FBVyxDQUFDLE1BQU0sRUFBRSxlQUFlLENBQUM7WUFDcEQsU0FBUyxFQUFFLEVBQUU7U0FDZCxDQUFDLENBQ0gsQ0FBQztRQUNGLE1BQU0sVUFBVSxHQUFHLE1BQU0sUUFBUSxDQUFDLGtCQUFrQixDQUFDLGNBQWMsQ0FBQyxDQUFDO1FBRXJFLFlBQVksQ0FBQyxPQUFPLENBQUMsTUFBTSxFQUFFLEVBQUUsTUFBTSxFQUFFLFVBQVUsRUFBRSxDQUFDLENBQUM7SUFDdkQsQ0FBQyxDQUFDLENBQUM7SUFFSCxVQUFVLENBQUMsZUFBZSxDQUFDLE9BQU8sRUFBRSxRQUFRLEVBQUUsS0FBSyxFQUFFLE9BQWdDLEVBQUUsRUFBRTtRQUN2RixNQUFNLFFBQVEsR0FBRyxZQUFZLENBQUMsT0FBTyxDQUFDLE1BQU0sQ0FBQyxDQUFDO1FBQzlDLElBQUksQ0FBQyxRQUFRO1lBQUUsT0FBTztRQUV0QixNQUFNLEVBQUUsTUFBTSxFQUFFLFVBQVUsRUFBRSxHQUFHLFFBQVEsQ0FBQztRQUV4QyxNQUFNLE9BQU8sQ0FBQyxHQUFHLENBQ2YsTUFBTSxDQUFDLEdBQUcsQ0FBQyxDQUFDLE1BQU0sRUFBRSxLQUFLLEVBQUUsRUFBRSxDQUMzQixRQUFRLENBQUMsT0FBTyxDQUFDLFVBQVUsQ0FBQyxLQUFLLENBQUMsSUFBSSxJQUFJLEVBQUU7WUFDMUMsU0FBUyxFQUFFLFFBQVE7WUFDbkIsUUFBUSxFQUFFLGdCQUFnQixDQUFDLE1BQU0sRUFBRSxXQUFXLENBQUM7WUFDL0MsY0FBYyxFQUFFLFlBQVksQ0FBQyxXQUFXLENBQUMsTUFBTSxFQUFFLGVBQWUsQ0FBQyxFQUFFLGNBQWMsQ0FBQztZQUNsRixTQUFTLEVBQUUsRUFBRTtTQUNkLENBQUMsQ0FDSCxDQUNGLENBQUM7SUFDSixDQUFDLENBQUMsQ0FBQztBQUNMLENBQUM7QUFFRCxTQUF3QixzQkFBc0IsQ0FDNUMsb0JBQTBDLEVBQzFDLHFCQUFrRCxFQUNsRCxPQUFxQztJQUVyQyxNQUFNLEVBQUUsSUFBSSxFQUFFLEtBQUssRUFBRSxNQUFNLEVBQUUsUUFBUSxHQUFHLEtBQUssRUFBRSxNQUFNLEVBQUUsR0FBRyxPQUFPLElBQUksRUFBRSxDQUFDO0lBQ3hFLE1BQU0sUUFBUSxHQUFHLGFBQWEsQ0FBQyxLQUFLLEVBQUUsSUFBSSxFQUFFLFFBQVEsRUFBRSxNQUFNLENBQUMsQ0FBQztJQUU5RCxLQUFLLE1BQU0sVUFBVSxJQUFJLG9CQUFvQixDQUFDLFdBQVcsRUFBRSxDQUFDO1FBQzFELDRGQUE0RjtRQUM1Riw0RkFBNEY7UUFDNUYseUNBQXlDO1FBQ3pDLElBQUksZ0NBQVcsQ0FBQyxjQUFjLENBQUMsVUFBVSxDQUFDLE1BQU0sQ0FBQyxDQUFDLE1BQU0sS0FBSyxDQUFDLEVBQUUsQ0FBQztZQUMvRCxNQUFNLEVBQUUsQ0FDTixNQUFNLEVBQ04sd0NBQXdDLFVBQVUsQ0FBQyxJQUFJLDRCQUE0QixDQUNwRixDQUFDO1FBQ0osQ0FBQzthQUFNLENBQUM7WUFDTixvQkFBb0IsQ0FBQyxVQUFVLEVBQUUsUUFBUSxFQUFFLE1BQU0sRUFBRSxDQUFDLFVBQVUsQ0FBQyxJQUFJLENBQUMsSUFBSSxFQUFFLEVBQUUsTUFBTSxFQUFFLFFBQVEsQ0FBQyxDQUFDO1FBQ2hHLENBQUM7SUFDSCxDQUFDO0lBRUQsaUZBQWlGO0lBQ2pGLE9BQU8sS0FBSyxFQUFFLElBQUksRUFBRSxFQUFFLENBQUM7QUFDekIsQ0FBQyJ9

package/dist/audit-trail/migrations.d.ts

@@ -0,0 +1,34 @@
+import type { QueryInterface, Sequelize, Transaction } from 'sequelize';
+import { Umzug } from 'umzug';
+export type MigrationContext = {
+    queryInterface: QueryInterface;
+    schema?: string;
+    tableName: string;
+    transaction?: Transaction;
+};
+export declare function buildUmzug(sequelize: Sequelize, options: {
+    schema?: string;
+    tableName: string;
+    transaction?: Transaction;
+}): Umzug<MigrationContext>;
+export declare function isSchemaAlreadyExistsError(error: unknown): boolean;
+/**
+ * Idempotent CREATE SCHEMA. Must run (and commit) on its own before Umzug, because Umzug's storage
+ * opens its own connection to create the meta table and would not see a CREATE SCHEMA still
+ * pending in a transaction. Not covered by the advisory lock; the existence check + tolerated
+ * "already exists" error makes it safe under concurrent boots instead.
+ */
+export declare function ensureSchema(sequelize: Sequelize, schema: string | undefined): Promise<void>;
+/**
+ * Creates the schema then applies every pending audit-table migration. On Postgres the migrations
+ * run inside a transaction-scoped advisory lock, and every DDL statement runs on that same
+ * transaction, so concurrent agent boots serialize on the DDL and a failure partway through a
+ * migration rolls back cleanly instead of leaving partial DDL behind. Other dialects have no
+ * equivalent distributed lock; each migration instead checks what already exists before creating
+ * it, which closes most — but not all — of the race window on a truly simultaneous boot.
+ */
+export declare function runAuditMigrations(sequelize: Sequelize, options: {
+    schema?: string;
+    tableName: string;
+}): Promise<void>;
+//# sourceMappingURL=migrations.d.ts.map