@futdevpro/nts-dynamo 1.15.140 → 1.15.142

package/build/_modules/privacy-lifecycle/privacy-lifecycle.control-service.js

@@ -0,0 +1,364 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DyNTS_PrivacyLifecycle_ControlService = void 0;
+const crypto_1 = require("crypto");
+const fsm_dynamo_1 = require("@futdevpro/fsm-dynamo");
+const global_settings_const_1 = require("../../_collections/global-settings.const");
+const privacy_contributor_action_type_enum_1 = require("./_enums/privacy-contributor-action.type-enum");
+const privacy_contributor_outcome_type_enum_1 = require("./_enums/privacy-contributor-outcome.type-enum");
+const privacy_request_state_type_enum_1 = require("./_enums/privacy-request-state.type-enum");
+const privacy_request_type_enum_1 = require("./_enums/privacy-request.type-enum");
+/** Coordinates identity-gated, resumable data-subject requests across product-owned data contributors. */
+class DyNTS_PrivacyLifecycle_ControlService {
+    adapter;
+    contributors;
+    clock;
+    /** Creates an orchestrator with a stable contributor registry. */
+    constructor(set) {
+        this.adapter = set.adapter;
+        this.contributors = [...set.contributors]
+            .sort((first, second) => (first.contributorId.localeCompare(second.contributorId)));
+        this.clock = set.clock ?? (() => new Date());
+        this.validateSettings();
+    }
+    /** Opens or safely replays a subject-scoped request without persisting the raw idempotency key. */
+    async openRequest(set) {
+        if (!this.isBoundedText(set.subjectId, 256)
+            || !this.isBoundedText(set.organizationId, 256)
+            || !Object.values(privacy_request_type_enum_1.DyNTS_PrivacyRequest_Type).includes(set.type)) {
+            throw this.buildError(400, 'REQUEST_INVALID', 'The privacy request is invalid.');
+        }
+        if (!this.isBoundedText(set.idempotencyKey, 256)
+            || !this.isFutureDate(set.deadlineAt)) {
+            throw this.buildError(400, 'IDEMPOTENCY_KEY_INVALID', 'The privacy request key is invalid.');
+        }
+        const createdAt = this.clock().toISOString();
+        const request = {
+            requestId: (0, crypto_1.randomUUID)(),
+            subjectId: set.subjectId,
+            organizationId: set.organizationId,
+            type: set.type,
+            state: privacy_request_state_type_enum_1.DyNTS_PrivacyRequestState_Type.received,
+            idempotencyHash: this.hashIdempotency(set),
+            revision: 0,
+            createdAt: createdAt,
+            deadlineAt: set.deadlineAt,
+            identityVerifiedAt: '',
+            scopedAt: '',
+            plannedAt: '',
+            executionStartedAt: '',
+            verifyingStartedAt: '',
+            completedAt: '',
+        };
+        const result = await this.adapter.createOrGetRequest(request);
+        if (result.request.idempotencyHash !== request.idempotencyHash
+            || result.request.subjectId !== request.subjectId
+            || result.request.organizationId !== request.organizationId
+            || result.request.type !== request.type) {
+            throw this.buildError(409, 'IDEMPOTENCY_CONFLICT', 'The idempotency key belongs to another request.');
+        }
+        return { request: this.toRequestView(result.request), created: result.created };
+    }
+    /** Marks request identity verified after the application has completed its security challenge. */
+    async verifyIdentity(requestId, subjectId) {
+        const request = await this.requireOwnedRequest(requestId, subjectId);
+        if (request.state === privacy_request_state_type_enum_1.DyNTS_PrivacyRequestState_Type.identityVerified) {
+            return this.toRequestView(request);
+        }
+        if (request.state !== privacy_request_state_type_enum_1.DyNTS_PrivacyRequestState_Type.received) {
+            throw this.buildError(409, 'IDENTITY_STATE_CONFLICT', 'The request cannot be identity-verified now.');
+        }
+        const replacement = await this.replaceState(request, privacy_request_state_type_enum_1.DyNTS_PrivacyRequestState_Type.identityVerified, {
+            identityVerifiedAt: this.clock().toISOString(),
+        });
+        return this.toRequestView(replacement);
+    }
+    /** Executes or resumes all contributors and never reports complete while one contributor failed. */
+    async processRequest(requestId, subjectId) {
+        let request = await this.requireOwnedRequest(requestId, subjectId);
+        if (request.state === privacy_request_state_type_enum_1.DyNTS_PrivacyRequestState_Type.completed) {
+            return this.buildResult(request, await this.adapter.listContributorOutcomes(request.requestId));
+        }
+        if (request.state !== privacy_request_state_type_enum_1.DyNTS_PrivacyRequestState_Type.identityVerified
+            && request.state !== privacy_request_state_type_enum_1.DyNTS_PrivacyRequestState_Type.scoped
+            && request.state !== privacy_request_state_type_enum_1.DyNTS_PrivacyRequestState_Type.planned
+            && request.state !== privacy_request_state_type_enum_1.DyNTS_PrivacyRequestState_Type.executing
+            && request.state !== privacy_request_state_type_enum_1.DyNTS_PrivacyRequestState_Type.verifying
+            && request.state !== privacy_request_state_type_enum_1.DyNTS_PrivacyRequestState_Type.partiallyCompleted) {
+            throw this.buildError(409, 'EXECUTION_STATE_CONFLICT', 'The request is not ready for execution.');
+        }
+        if (request.state === privacy_request_state_type_enum_1.DyNTS_PrivacyRequestState_Type.identityVerified) {
+            request = await this.replaceState(request, privacy_request_state_type_enum_1.DyNTS_PrivacyRequestState_Type.scoped, {
+                scopedAt: this.clock().toISOString(),
+            });
+        }
+        const context = this.buildContext(request);
+        let plans = await this.adapter.listContributorPlans(request.requestId);
+        this.validateStoredPlans(plans);
+        if (request.state === privacy_request_state_type_enum_1.DyNTS_PrivacyRequestState_Type.scoped
+            || request.state === privacy_request_state_type_enum_1.DyNTS_PrivacyRequestState_Type.partiallyCompleted) {
+            await this.planMissingContributors(request.requestId, context, plans);
+            plans = await this.adapter.listContributorPlans(request.requestId);
+            this.validateStoredPlans(plans);
+            if (!this.hasAllContributorPlans(plans)) {
+                request = await this.replaceState(request, privacy_request_state_type_enum_1.DyNTS_PrivacyRequestState_Type.partiallyCompleted, {
+                    completedAt: '',
+                });
+                return this.buildResult(request, await this.adapter.listContributorOutcomes(request.requestId));
+            }
+            request = await this.replaceState(request, privacy_request_state_type_enum_1.DyNTS_PrivacyRequestState_Type.planned, {
+                plannedAt: this.clock().toISOString(),
+            });
+        }
+        if (request.state === privacy_request_state_type_enum_1.DyNTS_PrivacyRequestState_Type.planned) {
+            this.validateStoredPlans(plans);
+            request = await this.replaceState(request, privacy_request_state_type_enum_1.DyNTS_PrivacyRequestState_Type.executing, {
+                executionStartedAt: request.executionStartedAt || this.clock().toISOString(),
+                completedAt: '',
+            });
+        }
+        if (request.state === privacy_request_state_type_enum_1.DyNTS_PrivacyRequestState_Type.executing) {
+            await this.executeMissingContributors(request.requestId, context, plans);
+            request = await this.replaceState(request, privacy_request_state_type_enum_1.DyNTS_PrivacyRequestState_Type.verifying, {
+                verifyingStartedAt: this.clock().toISOString(),
+            });
+        }
+        let outcomes = await this.adapter.listContributorOutcomes(request.requestId);
+        if (request.state === privacy_request_state_type_enum_1.DyNTS_PrivacyRequestState_Type.verifying) {
+            await this.verifyContributorOutcomes(context, plans, outcomes);
+            outcomes = await this.adapter.listContributorOutcomes(request.requestId);
+        }
+        const isComplete = this.contributors.every((contributor) => (outcomes.some((outcome) => (outcome.contributorId === contributor.contributorId
+            && outcome.outcome !== privacy_contributor_outcome_type_enum_1.DyNTS_PrivacyContributorOutcome_Type.failed))));
+        const finalState = isComplete
+            ? privacy_request_state_type_enum_1.DyNTS_PrivacyRequestState_Type.completed
+            : privacy_request_state_type_enum_1.DyNTS_PrivacyRequestState_Type.partiallyCompleted;
+        request = await this.replaceState(request, finalState, {
+            completedAt: isComplete ? this.clock().toISOString() : '',
+        });
+        return this.buildResult(request, outcomes);
+    }
+    /** Returns an owned request and its content-free contributor outcomes. */
+    async getRequest(requestId, subjectId) {
+        const request = await this.requireOwnedRequest(requestId, subjectId);
+        return this.buildResult(request, await this.adapter.listContributorOutcomes(request.requestId));
+    }
+    async planMissingContributors(requestId, context, existingPlans) {
+        const plannedContributorIds = new Set(existingPlans.map((plan) => plan.contributorId));
+        for (const contributor of this.contributors) {
+            if (plannedContributorIds.has(contributor.contributorId)) {
+                continue;
+            }
+            try {
+                const plan = await contributor.plan(context);
+                this.validatePlan(contributor, plan);
+                await this.adapter.saveContributorPlan(requestId, plan);
+            }
+            catch (error) {
+                await this.adapter.saveContributorOutcome(requestId, this.buildFailedOutcome(contributor.contributorId, privacy_contributor_action_type_enum_1.DyNTS_PrivacyContributorAction_Type.noData, error instanceof fsm_dynamo_1.DyFM_Error ? 'CONTRIBUTOR_PLAN_INVALID' : 'CONTRIBUTOR_PLAN_FAILED'));
+            }
+        }
+    }
+    async executeMissingContributors(requestId, context, plans) {
+        const existing = await this.adapter.listContributorOutcomes(requestId);
+        const completedContributorIds = new Set();
+        for (const contributor of this.contributors) {
+            const plan = plans.find((item) => item.contributorId === contributor.contributorId);
+            const outcome = existing.find((item) => item.contributorId === contributor.contributorId);
+            if (plan && outcome && this.isValidCompletedOutcome(contributor, plan, outcome)) {
+                completedContributorIds.add(contributor.contributorId);
+            }
+        }
+        for (const contributor of this.contributors) {
+            if (completedContributorIds.has(contributor.contributorId)) {
+                continue;
+            }
+            const plan = plans.find((item) => item.contributorId === contributor.contributorId);
+            const outcome = plan
+                ? await this.executeContributor(contributor, context, plan)
+                : this.buildFailedOutcome(contributor.contributorId, privacy_contributor_action_type_enum_1.DyNTS_PrivacyContributorAction_Type.noData, 'CONTRIBUTOR_PLAN_MISSING');
+            await this.adapter.saveContributorOutcome(requestId, outcome);
+        }
+    }
+    async executeContributor(contributor, context, plan) {
+        try {
+            const outcome = await contributor.execute(context, plan);
+            this.validateOutcome(contributor, plan, outcome);
+            return { ...outcome };
+        }
+        catch (error) {
+            return this.buildFailedOutcome(contributor.contributorId, plan.action, error instanceof fsm_dynamo_1.DyFM_Error ? 'CONTRIBUTOR_CONTRACT_FAILED' : 'CONTRIBUTOR_EXECUTION_FAILED');
+        }
+    }
+    async verifyContributorOutcomes(context, plans, outcomes) {
+        for (const contributor of this.contributors) {
+            const outcome = outcomes.find((item) => item.contributorId === contributor.contributorId);
+            const plan = plans.find((item) => item.contributorId === contributor.contributorId);
+            if (!outcome || outcome.outcome === privacy_contributor_outcome_type_enum_1.DyNTS_PrivacyContributorOutcome_Type.failed || !plan) {
+                continue;
+            }
+            try {
+                this.validateOutcome(contributor, plan, outcome);
+                if (!await contributor.verify(context, outcome)) {
+                    await this.adapter.saveContributorOutcome(context.requestId, this.buildFailedOutcome(contributor.contributorId, outcome.action, 'CONTRIBUTOR_VERIFY_FAILED'));
+                }
+            }
+            catch {
+                await this.adapter.saveContributorOutcome(context.requestId, this.buildFailedOutcome(contributor.contributorId, outcome.action, 'CONTRIBUTOR_VERIFY_FAILED'));
+            }
+        }
+    }
+    validatePlan(contributor, plan) {
+        if (plan.contributorId !== contributor.contributorId
+            || !this.isBoundedText(plan.contributorId, 128)
+            || !Object.values(privacy_contributor_action_type_enum_1.DyNTS_PrivacyContributorAction_Type).includes(plan.action)
+            || (plan.action === privacy_contributor_action_type_enum_1.DyNTS_PrivacyContributorAction_Type.retainWithBasis && !plan.retentionBasisCode)
+            || (plan.action !== privacy_contributor_action_type_enum_1.DyNTS_PrivacyContributorAction_Type.retainWithBasis && !!plan.retentionBasisCode)) {
+            throw this.buildError(500, 'CONTRIBUTOR_PLAN_INVALID', 'A privacy contributor returned an invalid plan.');
+        }
+    }
+    validateOutcome(contributor, plan, outcome) {
+        if (outcome.contributorId !== contributor.contributorId
+            || outcome.action !== plan.action
+            || !Object.values(privacy_contributor_outcome_type_enum_1.DyNTS_PrivacyContributorOutcome_Type).includes(outcome.outcome)
+            || !Number.isSafeInteger(outcome.processedRecordCount)
+            || outcome.processedRecordCount < 0
+            || (outcome.outcome === privacy_contributor_outcome_type_enum_1.DyNTS_PrivacyContributorOutcome_Type.retainedWithBasis
+                && outcome.retentionBasisCode !== plan.retentionBasisCode)
+            || (outcome.outcome !== privacy_contributor_outcome_type_enum_1.DyNTS_PrivacyContributorOutcome_Type.retainedWithBasis
+                && !!outcome.retentionBasisCode)
+            || (outcome.outcome === privacy_contributor_outcome_type_enum_1.DyNTS_PrivacyContributorOutcome_Type.failed && !outcome.errorCode)
+            || (outcome.outcome !== privacy_contributor_outcome_type_enum_1.DyNTS_PrivacyContributorOutcome_Type.failed && !!outcome.errorCode)
+            || (outcome.action === privacy_contributor_action_type_enum_1.DyNTS_PrivacyContributorAction_Type.retainWithBasis
+                && outcome.outcome !== privacy_contributor_outcome_type_enum_1.DyNTS_PrivacyContributorOutcome_Type.retainedWithBasis
+                && outcome.outcome !== privacy_contributor_outcome_type_enum_1.DyNTS_PrivacyContributorOutcome_Type.failed)
+            || (outcome.action !== privacy_contributor_action_type_enum_1.DyNTS_PrivacyContributorAction_Type.retainWithBasis
+                && outcome.outcome === privacy_contributor_outcome_type_enum_1.DyNTS_PrivacyContributorOutcome_Type.retainedWithBasis)
+            || (!!outcome.artifactChecksum && !/^[a-f0-9]{64}$/u.test(outcome.artifactChecksum))
+            || !Number.isFinite(new Date(outcome.completedAt).getTime())) {
+            throw this.buildError(500, 'CONTRIBUTOR_OUTCOME_INVALID', 'A privacy contributor returned an invalid outcome.');
+        }
+    }
+    buildFailedOutcome(contributorId, action, errorCode) {
+        return {
+            contributorId: contributorId,
+            action: action,
+            outcome: privacy_contributor_outcome_type_enum_1.DyNTS_PrivacyContributorOutcome_Type.failed,
+            retentionBasisCode: '',
+            artifactChecksum: '',
+            processedRecordCount: 0,
+            errorCode: errorCode,
+            completedAt: this.clock().toISOString(),
+        };
+    }
+    async requireOwnedRequest(requestId, subjectId) {
+        const request = await this.adapter.findRequestById(requestId);
+        if (request?.subjectId !== subjectId) {
+            throw this.buildError(404, 'REQUEST_NOT_FOUND', 'The privacy request was not found.');
+        }
+        return request;
+    }
+    async replaceState(request, state, dates) {
+        const replacement = {
+            ...request,
+            ...dates,
+            state: state,
+            revision: request.revision + 1,
+        };
+        const didReplace = await this.adapter.replaceRequest(replacement, request.revision);
+        if (!didReplace) {
+            throw this.buildError(409, 'REQUEST_REVISION_CONFLICT', 'The privacy request changed concurrently.');
+        }
+        return replacement;
+    }
+    buildContext(request) {
+        return {
+            requestId: request.requestId,
+            subjectId: request.subjectId,
+            organizationId: request.organizationId,
+            type: request.type,
+        };
+    }
+    buildResult(request, outcomes) {
+        if (outcomes.some((outcome) => (!this.contributors.some((contributor) => (contributor.contributorId === outcome.contributorId))))) {
+            throw this.buildError(500, 'CONTRIBUTOR_OUTCOME_UNKNOWN', 'An unknown contributor outcome was stored.');
+        }
+        return {
+            request: this.toRequestView(request),
+            outcomes: [...outcomes].sort((first, second) => (first.contributorId.localeCompare(second.contributorId))),
+        };
+    }
+    toRequestView(request) {
+        return {
+            requestId: request.requestId,
+            subjectId: request.subjectId,
+            organizationId: request.organizationId,
+            type: request.type,
+            state: request.state,
+            revision: request.revision,
+            createdAt: request.createdAt,
+            deadlineAt: request.deadlineAt,
+            identityVerifiedAt: request.identityVerifiedAt,
+            scopedAt: request.scopedAt,
+            plannedAt: request.plannedAt,
+            executionStartedAt: request.executionStartedAt,
+            verifyingStartedAt: request.verifyingStartedAt,
+            completedAt: request.completedAt,
+        };
+    }
+    hashIdempotency(set) {
+        return (0, crypto_1.createHash)('sha256')
+            .update(`${set.subjectId}\u0000${set.organizationId}\u0000${set.type}\u0000${set.idempotencyKey}`)
+            .digest('hex');
+    }
+    isFutureDate(value) {
+        const timestamp = new Date(value).getTime();
+        return Number.isFinite(timestamp) && timestamp > this.clock().getTime();
+    }
+    isBoundedText(value, maxLength) {
+        return typeof value === 'string' && !!value && value.length <= maxLength && !value.includes('\u0000');
+    }
+    hasAllContributorPlans(plans) {
+        return this.contributors.every((contributor) => (plans.some((plan) => (plan.contributorId === contributor.contributorId))));
+    }
+    validateStoredPlans(plans) {
+        for (const plan of plans) {
+            const contributor = this.contributors.find((item) => item.contributorId === plan.contributorId);
+            if (!contributor) {
+                throw this.buildError(500, 'CONTRIBUTOR_PLAN_UNKNOWN', 'An unknown privacy contributor plan was stored.');
+            }
+            this.validatePlan(contributor, plan);
+        }
+    }
+    isValidCompletedOutcome(contributor, plan, outcome) {
+        try {
+            this.validateOutcome(contributor, plan, outcome);
+            return outcome.outcome !== privacy_contributor_outcome_type_enum_1.DyNTS_PrivacyContributorOutcome_Type.failed;
+        }
+        catch {
+            return false;
+        }
+    }
+    validateSettings() {
+        const contributorIds = this.contributors.map((item) => (item.contributorId));
+        if (!this.adapter
+            || !this.contributors.length
+            || contributorIds.some((contributorId) => !contributorId)
+            || new Set(contributorIds).size !== contributorIds.length) {
+            throw this.buildError(500, 'SETTINGS_INVALID', 'The privacy lifecycle settings are invalid.');
+        }
+    }
+    buildError(status, errorCode, message) {
+        return new fsm_dynamo_1.DyFM_Error({
+            status: status,
+            errorCode: `${global_settings_const_1.DyNTS_global_settings.systemShortCodeName}|PRIVACY_LIFECYCLE|${errorCode}`,
+            message: message,
+            userMessage: status < 500
+                ? message
+                : 'The privacy request could not be processed safely. Please try again later.',
+            issuerService: this.constructor.name,
+        });
+    }
+}
+exports.DyNTS_PrivacyLifecycle_ControlService = DyNTS_PrivacyLifecycle_ControlService;
+//# sourceMappingURL=privacy-lifecycle.control-service.js.map

package/build/_modules/privacy-lifecycle/privacy-lifecycle.control-service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"privacy-lifecycle.control-service.js","sourceRoot":"","sources":["../../../src/_modules/privacy-lifecycle/privacy-lifecycle.control-service.ts"],"names":[],"mappings":";;;AAAA,mCAGgB;AAEhB,sDAAmD;AAEnD,oFAAiF;AACjF,wGAAoG;AACpG,0GAAsG;AACtG,8FAA0F;AAC1F,kFAA+E;AAgB/E,0GAA0G;AAC1G,MAAa,qCAAqC;IAC/B,OAAO,CAA0C;IACjD,YAAY,CAAuC;IACnD,KAAK,CAAa;IAEnC,kEAAkE;IAClE,YAAY,GAA6C;QACvD,IAAI,CAAC,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC;QAC3B,IAAI,CAAC,YAAY,GAAG,CAAE,GAAG,GAAG,CAAC,YAAY,CAAE;aACxC,IAAI,CAAC,CAAC,KAAyC,EAAE,MAA0C,EAAU,EAAE,CAAC,CACvG,KAAK,CAAC,aAAa,CAAC,aAAa,CAAC,MAAM,CAAC,aAAa,CAAC,CACxD,CAAC,CAAC;QACL,IAAI,CAAC,KAAK,GAAG,GAAG,CAAC,KAAK,IAAI,CAAC,GAAS,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QACnD,IAAI,CAAC,gBAAgB,EAAE,CAAC;IAC1B,CAAC;IAED,mGAAmG;IAC5F,KAAK,CAAC,WAAW,CACtB,GAAuC;QAEvC,IACE,CAAC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC;eACpC,CAAC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,cAAc,EAAE,GAAG,CAAC;eAC5C,CAAC,MAAM,CAAC,MAAM,CAAC,qDAAyB,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,EAC/D,CAAC;YACD,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,iBAAiB,EAAE,iCAAiC,CAAC,CAAC;QACnF,CAAC;QAED,IACE,CAAC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,cAAc,EAAE,GAAG,CAAC;eACzC,CAAC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,EACrC,CAAC;YACD,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,yBAAyB,EAAE,qCAAqC,CAAC,CAAC;QAC/F,CAAC;QAED,MAAM,SAAS,GAAW,IAAI,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,CAAC;QACrD,MAAM,OAAO,GAAyC;YACpD,SAAS,EAAE,IAAA,mBAAU,GAAE;YACvB,SAAS,EAAE,GAAG,CAAC,SAAS;YACxB,cAAc,EAAE,GAAG,CAAC,cAAc;YAClC,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,KAAK,EAAE,gEAA8B,CAAC,QAAQ;YAC9C,eAAe,EAAE,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC;YAC1C,QAAQ,EAAE,CAAC;YACX,SAAS,EAAE,SAAS;YACpB,UAAU,EAAE,GAAG,CAAC,UAAU;YAC1B,kBAAkB,EAAE,EAAE;YACtB,QAAQ,EAAE,EAAE;YACZ,SAAS,EAAE,EAAE;YACb,kBAAkB,EAAE,EAAE;YACtB,kBAAkB,EAAE,EAAE;YACtB,WAAW,EAAE,EAAE;SAChB,CAAC;QAEF,MAAM,MAAM,GACV,MAAM,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC;QAEjD,IACE,MAAM,CAAC,OAAO,CAAC,eAAe,KAAK,OAAO,CAAC,eAAe;eACvD,MAAM,CAAC,OAAO,CAAC,SAAS,KAAK,OAAO,CAAC,SAAS;eAC9C,MAAM,CAAC,OAAO,CAAC,cAAc,KAAK,OAAO,CAAC,cAAc;eACxD,MAAM,CAAC,OAAO,CAAC,IAAI,KAAK,OAAO,CAAC,IAAI,EACvC,CAAC;YACD,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,sBAAsB,EAAE,iDAAiD,CAAC,CAAC;QACxG,CAAC;QAED,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC;IAClF,CAAC;IAED,kGAAkG;IAC3F,KAAK,CAAC,cAAc,CACzB,SAAiB,EACjB,SAAiB;QAEjB,MAAM,OAAO,GAAyC,MAAM,IAAI,CAAC,mBAAmB,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QAE3G,IAAI,OAAO,CAAC,KAAK,KAAK,gEAA8B,CAAC,gBAAgB,EAAE,CAAC;YACtE,OAAO,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;QACrC,CAAC;QAED,IAAI,OAAO,CAAC,KAAK,KAAK,gEAA8B,CAAC,QAAQ,EAAE,CAAC;YAC9D,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,yBAAyB,EAAE,8CAA8C,CAAC,CAAC;QACxG,CAAC;QAED,MAAM,WAAW,GAAyC,MAAM,IAAI,CAAC,YAAY,CAC/E,OAAO,EACP,gEAA8B,CAAC,gBAAgB,EAC/C;YACE,kBAAkB,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE;SAC/C,CACF,CAAC;QAEF,OAAO,IAAI,CAAC,aAAa,CAAC,WAAW,CAAC,CAAC;IACzC,CAAC;IAED,oGAAoG;IAC7F,KAAK,CAAC,cAAc,CACzB,SAAiB,EACjB,SAAiB;QAEjB,IAAI,OAAO,GAAyC,MAAM,IAAI,CAAC,mBAAmB,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QAEzG,IAAI,OAAO,CAAC,KAAK,KAAK,gEAA8B,CAAC,SAAS,EAAE,CAAC;YAC/D,OAAO,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,MAAM,IAAI,CAAC,OAAO,CAAC,uBAAuB,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC;QAClG,CAAC;QAED,IACE,OAAO,CAAC,KAAK,KAAK,gEAA8B,CAAC,gBAAgB;eAC9D,OAAO,CAAC,KAAK,KAAK,gEAA8B,CAAC,MAAM;eACvD,OAAO,CAAC,KAAK,KAAK,gEAA8B,CAAC,OAAO;eACxD,OAAO,CAAC,KAAK,KAAK,gEAA8B,CAAC,SAAS;eAC1D,OAAO,CAAC,KAAK,KAAK,gEAA8B,CAAC,SAAS;eAC1D,OAAO,CAAC,KAAK,KAAK,gEAA8B,CAAC,kBAAkB,EACtE,CAAC;YACD,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,0BAA0B,EAAE,yCAAyC,CAAC,CAAC;QACpG,CAAC;QAED,IAAI,OAAO,CAAC,KAAK,KAAK,gEAA8B,CAAC,gBAAgB,EAAE,CAAC;YACtE,OAAO,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,gEAA8B,CAAC,MAAM,EAAE;gBAChF,QAAQ,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE;aACrC,CAAC,CAAC;QACL,CAAC;QAED,MAAM,OAAO,GAA8C,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;QACtF,IAAI,KAAK,GAA6C,MAAM,IAAI,CAAC,OAAO,CAAC,oBAAoB,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAEjH,IAAI,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC;QAEhC,IACE,OAAO,CAAC,KAAK,KAAK,gEAA8B,CAAC,MAAM;eACpD,OAAO,CAAC,KAAK,KAAK,gEAA8B,CAAC,kBAAkB,EACtE,CAAC;YACD,MAAM,IAAI,CAAC,uBAAuB,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;YACtE,KAAK,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,oBAAoB,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YACnE,IAAI,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC;YAEhC,IAAI,CAAC,IAAI,CAAC,sBAAsB,CAAC,KAAK,CAAC,EAAE,CAAC;gBACxC,OAAO,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,gEAA8B,CAAC,kBAAkB,EAAE;oBAC5F,WAAW,EAAE,EAAE;iBAChB,CAAC,CAAC;gBAEH,OAAO,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,MAAM,IAAI,CAAC,OAAO,CAAC,uBAAuB,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC;YAClG,CAAC;YAED,OAAO,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,gEAA8B,CAAC,OAAO,EAAE;gBACjF,SAAS,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE;aACtC,CAAC,CAAC;QACL,CAAC;QAED,IAAI,OAAO,CAAC,KAAK,KAAK,gEAA8B,CAAC,OAAO,EAAE,CAAC;YAC7D,IAAI,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC;YAChC,OAAO,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,gEAA8B,CAAC,SAAS,EAAE;gBACnF,kBAAkB,EAAE,OAAO,CAAC,kBAAkB,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE;gBAC5E,WAAW,EAAE,EAAE;aAChB,CAAC,CAAC;QACL,CAAC;QAED,IAAI,OAAO,CAAC,KAAK,KAAK,gEAA8B,CAAC,SAAS,EAAE,CAAC;YAC/D,MAAM,IAAI,CAAC,0BAA0B,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;YACzE,OAAO,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,gEAA8B,CAAC,SAAS,EAAE;gBACnF,kBAAkB,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE;aAC/C,CAAC,CAAC;QACL,CAAC;QAED,IAAI,QAAQ,GACV,MAAM,IAAI,CAAC,OAAO,CAAC,uBAAuB,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAEhE,IAAI,OAAO,CAAC,KAAK,KAAK,gEAA8B,CAAC,SAAS,EAAE,CAAC;YAC/D,MAAM,IAAI,CAAC,yBAAyB,CAAC,OAAO,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;YAC/D,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,uBAAuB,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAC3E,CAAC;QAED,MAAM,UAAU,GAAY,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,WAA+C,EAAW,EAAE,CAAC,CAChH,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAkD,EAAW,EAAE,CAAC,CAC7E,OAAO,CAAC,aAAa,KAAK,WAAW,CAAC,aAAa;eAChD,OAAO,CAAC,OAAO,KAAK,4EAAoC,CAAC,MAAM,CACnE,CAAC,CACH,CAAC,CAAC;QACH,MAAM,UAAU,GAAmC,UAAU;YAC3D,CAAC,CAAC,gEAA8B,CAAC,SAAS;YAC1C,CAAC,CAAC,gEAA8B,CAAC,kBAAkB,CAAC;QAEtD,OAAO,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,UAAU,EAAE;YACrD,WAAW,EAAE,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE;SAC1D,CAAC,CAAC;QAEH,OAAO,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IAC7C,CAAC;IAED,0EAA0E;IACnE,KAAK,CAAC,UAAU,CACrB,SAAiB,EACjB,SAAiB;QAEjB,MAAM,OAAO,GAAyC,MAAM,IAAI,CAAC,mBAAmB,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QAE3G,OAAO,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,MAAM,IAAI,CAAC,OAAO,CAAC,uBAAuB,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC;IAClG,CAAC;IAEO,KAAK,CAAC,uBAAuB,CACnC,SAAiB,EACjB,OAAkD,EAClD,aAAuD;QAEvD,MAAM,qBAAqB,GAAgB,IAAI,GAAG,CAAC,aAAa,CAAC,GAAG,CAAC,CACnE,IAA4C,EACpC,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC;QAElC,KAAK,MAAM,WAAW,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YAC5C,IAAI,qBAAqB,CAAC,GAAG,CAAC,WAAW,CAAC,aAAa,CAAC,EAAE,CAAC;gBACzD,SAAS;YACX,CAAC;YAED,IAAI,CAAC;gBACH,MAAM,IAAI,GAA2C,MAAM,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;gBAErF,IAAI,CAAC,YAAY,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;gBACrC,MAAM,IAAI,CAAC,OAAO,CAAC,mBAAmB,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;YAC1D,CAAC;YAAC,OAAO,KAAc,EAAE,CAAC;gBACxB,MAAM,IAAI,CAAC,OAAO,CAAC,sBAAsB,CAAC,SAAS,EAAE,IAAI,CAAC,kBAAkB,CAC1E,WAAW,CAAC,aAAa,EACzB,0EAAmC,CAAC,MAAM,EAC1C,KAAK,YAAY,uBAAU,CAAC,CAAC,CAAC,0BAA0B,CAAC,CAAC,CAAC,yBAAyB,CACrF,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,0BAA0B,CACtC,SAAiB,EACjB,OAAkD,EAClD,KAA+C;QAE/C,MAAM,QAAQ,GACZ,MAAM,IAAI,CAAC,OAAO,CAAC,uBAAuB,CAAC,SAAS,CAAC,CAAC;QACxD,MAAM,uBAAuB,GAAgB,IAAI,GAAG,EAAE,CAAC;QAEvD,KAAK,MAAM,WAAW,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YAC5C,MAAM,IAAI,GAAuD,KAAK,CAAC,IAAI,CAAC,CAC1E,IAA4C,EACnC,EAAE,CAAC,IAAI,CAAC,aAAa,KAAK,WAAW,CAAC,aAAa,CAAC,CAAC;YAChE,MAAM,OAAO,GAA0D,QAAQ,CAAC,IAAI,CAAC,CACnF,IAA+C,EACtC,EAAE,CAAC,IAAI,CAAC,aAAa,KAAK,WAAW,CAAC,aAAa,CAAC,CAAC;YAEhE,IAAI,IAAI,IAAI,OAAO,IAAI,IAAI,CAAC,uBAAuB,CAAC,WAAW,EAAE,IAAI,EAAE,OAAO,CAAC,EAAE,CAAC;gBAChF,uBAAuB,CAAC,GAAG,CAAC,WAAW,CAAC,aAAa,CAAC,CAAC;YACzD,CAAC;QACH,CAAC;QAED,KAAK,MAAM,WAAW,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YAC5C,IAAI,uBAAuB,CAAC,GAAG,CAAC,WAAW,CAAC,aAAa,CAAC,EAAE,CAAC;gBAC3D,SAAS;YACX,CAAC;YAED,MAAM,IAAI,GAAuD,KAAK,CAAC,IAAI,CAAC,CAC1E,IAA4C,EACnC,EAAE,CAAC,IAAI,CAAC,aAAa,KAAK,WAAW,CAAC,aAAa,CAAC,CAAC;YAChE,MAAM,OAAO,GAA8C,IAAI;gBAC7D,CAAC,CAAC,MAAM,IAAI,CAAC,kBAAkB,CAAC,WAAW,EAAE,OAAO,EAAE,IAAI,CAAC;gBAC3D,CAAC,CAAC,IAAI,CAAC,kBAAkB,CACvB,WAAW,CAAC,aAAa,EACzB,0EAAmC,CAAC,MAAM,EAC1C,0BAA0B,CAC3B,CAAC;YAEJ,MAAM,IAAI,CAAC,OAAO,CAAC,sBAAsB,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QAChE,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,kBAAkB,CAC9B,WAA+C,EAC/C,OAAkD,EAClD,IAA4C;QAE5C,IAAI,CAAC;YACH,MAAM,OAAO,GAA8C,MAAM,WAAW,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YAEpG,IAAI,CAAC,eAAe,CAAC,WAAW,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;YAEjD,OAAO,EAAE,GAAG,OAAO,EAAE,CAAC;QACxB,CAAC;QAAC,OAAO,KAAc,EAAE,CAAC;YACxB,OAAO,IAAI,CAAC,kBAAkB,CAC5B,WAAW,CAAC,aAAa,EACzB,IAAI,CAAC,MAAM,EACX,KAAK,YAAY,uBAAU,CAAC,CAAC,CAAC,6BAA6B,CAAC,CAAC,CAAC,8BAA8B,CAC7F,CAAC;QACJ,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,yBAAyB,CACrC,OAAkD,EAClD,KAA+C,EAC/C,QAAqD;QAErD,KAAK,MAAM,WAAW,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YAC5C,MAAM,OAAO,GAA0D,QAAQ,CAAC,IAAI,CAAC,CACnF,IAA+C,EACtC,EAAE,CAAC,IAAI,CAAC,aAAa,KAAK,WAAW,CAAC,aAAa,CAAC,CAAC;YAChE,MAAM,IAAI,GAAuD,KAAK,CAAC,IAAI,CAAC,CAC1E,IAA4C,EACnC,EAAE,CAAC,IAAI,CAAC,aAAa,KAAK,WAAW,CAAC,aAAa,CAAC,CAAC;YAEhE,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,OAAO,KAAK,4EAAoC,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;gBACzF,SAAS;YACX,CAAC;YAED,IAAI,CAAC;gBACH,IAAI,CAAC,eAAe,CAAC,WAAW,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;gBAEjD,IAAI,CAAC,MAAM,WAAW,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,CAAC;oBAChD,MAAM,IAAI,CAAC,OAAO,CAAC,sBAAsB,CAAC,OAAO,CAAC,SAAS,EAAE,IAAI,CAAC,kBAAkB,CAClF,WAAW,CAAC,aAAa,EACzB,OAAO,CAAC,MAAM,EACd,2BAA2B,CAC5B,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,IAAI,CAAC,OAAO,CAAC,sBAAsB,CAAC,OAAO,CAAC,SAAS,EAAE,IAAI,CAAC,kBAAkB,CAClF,WAAW,CAAC,aAAa,EACzB,OAAO,CAAC,MAAM,EACd,2BAA2B,CAC5B,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAEO,YAAY,CAClB,WAA+C,EAC/C,IAA4C;QAE5C,IACE,IAAI,CAAC,aAAa,KAAK,WAAW,CAAC,aAAa;eAC7C,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,aAAa,EAAE,GAAG,CAAC;eAC5C,CAAC,MAAM,CAAC,MAAM,CAAC,0EAAmC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC;eACzE,CAAC,IAAI,CAAC,MAAM,KAAK,0EAAmC,CAAC,eAAe,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC;eACjG,CAAC,IAAI,CAAC,MAAM,KAAK,0EAAmC,CAAC,eAAe,IAAI,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,EACrG,CAAC;YACD,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,0BAA0B,EAAE,iDAAiD,CAAC,CAAC;QAC5G,CAAC;IACH,CAAC;IAEO,eAAe,CACrB,WAA+C,EAC/C,IAA4C,EAC5C,OAAkD;QAElD,IACE,OAAO,CAAC,aAAa,KAAK,WAAW,CAAC,aAAa;eAChD,OAAO,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM;eAC9B,CAAC,MAAM,CAAC,MAAM,CAAC,4EAAoC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC;eAC9E,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,oBAAoB,CAAC;eACnD,OAAO,CAAC,oBAAoB,GAAG,CAAC;eAChC,CAAC,OAAO,CAAC,OAAO,KAAK,4EAAoC,CAAC,iBAAiB;mBACzE,OAAO,CAAC,kBAAkB,KAAK,IAAI,CAAC,kBAAkB,CAAC;eACzD,CAAC,OAAO,CAAC,OAAO,KAAK,4EAAoC,CAAC,iBAAiB;mBACzE,CAAC,CAAC,OAAO,CAAC,kBAAkB,CAAC;eAC/B,CAAC,OAAO,CAAC,OAAO,KAAK,4EAAoC,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC;eACvF,CAAC,OAAO,CAAC,OAAO,KAAK,4EAAoC,CAAC,MAAM,IAAI,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC;eACxF,CAAC,OAAO,CAAC,MAAM,KAAK,0EAAmC,CAAC,eAAe;mBACrE,OAAO,CAAC,OAAO,KAAK,4EAAoC,CAAC,iBAAiB;mBAC1E,OAAO,CAAC,OAAO,KAAK,4EAAoC,CAAC,MAAM,CAAC;eAClE,CAAC,OAAO,CAAC,MAAM,KAAK,0EAAmC,CAAC,eAAe;mBACrE,OAAO,CAAC,OAAO,KAAK,4EAAoC,CAAC,iBAAiB,CAAC;eAC7E,CAAC,CAAC,CAAC,OAAO,CAAC,gBAAgB,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;eACjF,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,OAAO,EAAE,CAAC,EAC5D,CAAC;YACD,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,6BAA6B,EAAE,oDAAoD,CAAC,CAAC;QAClH,CAAC;IACH,CAAC;IAEO,kBAAkB,CACxB,aAAqB,EACrB,MAA2C,EAC3C,SAAiB;QAEjB,OAAO;YACL,aAAa,EAAE,aAAa;YAC5B,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,4EAAoC,CAAC,MAAM;YACpD,kBAAkB,EAAE,EAAE;YACtB,gBAAgB,EAAE,EAAE;YACpB,oBAAoB,EAAE,CAAC;YACvB,SAAS,EAAE,SAAS;YACpB,WAAW,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE;SACxC,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,mBAAmB,CAC/B,SAAiB,EACjB,SAAiB;QAEjB,MAAM,OAAO,GAAgD,MAAM,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC;QAE3G,IAAI,OAAO,EAAE,SAAS,KAAK,SAAS,EAAE,CAAC;YACrC,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,mBAAmB,EAAE,oCAAoC,CAAC,CAAC;QACxF,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;IAEO,KAAK,CAAC,YAAY,CACxB,OAA6C,EAC7C,KAAqC,EACrC,KAOC;QAED,MAAM,WAAW,GAAyC;YACxD,GAAG,OAAO;YACV,GAAG,KAAK;YACR,KAAK,EAAE,KAAK;YACZ,QAAQ,EAAE,OAAO,CAAC,QAAQ,GAAG,CAAC;SAC/B,CAAC;QACF,MAAM,UAAU,GAAY,MAAM,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,WAAW,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;QAE7F,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,2BAA2B,EAAE,2CAA2C,CAAC,CAAC;QACvG,CAAC;QAED,OAAO,WAAW,CAAC;IACrB,CAAC;IAEO,YAAY,CAAC,OAA6C;QAChE,OAAO;YACL,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,cAAc,EAAE,OAAO,CAAC,cAAc;YACtC,IAAI,EAAE,OAAO,CAAC,IAAI;SACnB,CAAC;IACJ,CAAC;IAEO,WAAW,CACjB,OAA6C,EAC7C,QAAqD;QAErD,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAkD,EAAW,EAAE,CAAC,CACjF,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,WAA+C,EAAW,EAAE,CAAC,CACpF,WAAW,CAAC,aAAa,KAAK,OAAO,CAAC,aAAa,CACpD,CAAC,CACH,CAAC,EAAE,CAAC;YACH,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,6BAA6B,EAAE,4CAA4C,CAAC,CAAC;QAC1G,CAAC;QAED,OAAO;YACL,OAAO,EAAE,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC;YACpC,QAAQ,EAAE,CAAE,GAAG,QAAQ,CAAE,CAAC,IAAI,CAAC,CAC7B,KAAgD,EAChD,MAAiD,EACzC,EAAE,CAAC,CACX,KAAK,CAAC,aAAa,CAAC,aAAa,CAAC,MAAM,CAAC,aAAa,CAAC,CACxD,CAAC;SACH,CAAC;IACJ,CAAC;IAEO,aAAa,CAAC,OAA6C;QACjE,OAAO;YACL,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,cAAc,EAAE,OAAO,CAAC,cAAc;YACtC,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,kBAAkB,EAAE,OAAO,CAAC,kBAAkB;YAC9C,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,kBAAkB,EAAE,OAAO,CAAC,kBAAkB;YAC9C,kBAAkB,EAAE,OAAO,CAAC,kBAAkB;YAC9C,WAAW,EAAE,OAAO,CAAC,WAAW;SACjC,CAAC;IACJ,CAAC;IAEO,eAAe,CAAC,GAAuC;QAC7D,OAAO,IAAA,mBAAU,EAAC,QAAQ,CAAC;aACxB,MAAM,CAAC,GAAG,GAAG,CAAC,SAAS,SAAS,GAAG,CAAC,cAAc,SAAS,GAAG,CAAC,IAAI,SAAS,GAAG,CAAC,cAAc,EAAE,CAAC;aACjG,MAAM,CAAC,KAAK,CAAC,CAAC;IACnB,CAAC;IAEO,YAAY,CAAC,KAAa;QAChC,MAAM,SAAS,GAAW,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC;QAEpD,OAAO,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,SAAS,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC,OAAO,EAAE,CAAC;IAC1E,CAAC;IAEO,aAAa,CAAC,KAAa,EAAE,SAAiB;QACpD,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,IAAI,SAAS,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACxG,CAAC;IAEO,sBAAsB,CAAC,KAA+C;QAC5E,OAAO,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,WAA+C,EAAW,EAAE,CAAC,CAC3F,KAAK,CAAC,IAAI,CAAC,CAAC,IAA4C,EAAW,EAAE,CAAC,CACpE,IAAI,CAAC,aAAa,KAAK,WAAW,CAAC,aAAa,CACjD,CAAC,CACH,CAAC,CAAC;IACL,CAAC;IAEO,mBAAmB,CAAC,KAA+C;QACzE,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,WAAW,GAAmD,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CACzF,IAAwC,EAC/B,EAAE,CAAC,IAAI,CAAC,aAAa,KAAK,IAAI,CAAC,aAAa,CAAC,CAAC;YAEzD,IAAI,CAAC,WAAW,EAAE,CAAC;gBACjB,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,0BAA0B,EAAE,iDAAiD,CAAC,CAAC;YAC5G,CAAC;YAED,IAAI,CAAC,YAAY,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;QACvC,CAAC;IACH,CAAC;IAEO,uBAAuB,CAC7B,WAA+C,EAC/C,IAA4C,EAC5C,OAAkD;QAElD,IAAI,CAAC;YACH,IAAI,CAAC,eAAe,CAAC,WAAW,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;YAEjD,OAAO,OAAO,CAAC,OAAO,KAAK,4EAAoC,CAAC,MAAM,CAAC;QACzE,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAEO,gBAAgB;QACtB,MAAM,cAAc,GAAa,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,IAAwC,EAAU,EAAE,CAAC,CAC3G,IAAI,CAAC,aAAa,CACnB,CAAC,CAAC;QAEH,IACE,CAAC,IAAI,CAAC,OAAO;eACV,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM;eACzB,cAAc,CAAC,IAAI,CAAC,CAAC,aAAqB,EAAW,EAAE,CAAC,CAAC,aAAa,CAAC;eACvE,IAAI,GAAG,CAAC,cAAc,CAAC,CAAC,IAAI,KAAK,cAAc,CAAC,MAAM,EACzD,CAAC;YACD,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,kBAAkB,EAAE,6CAA6C,CAAC,CAAC;QAChG,CAAC;IACH,CAAC;IAEO,UAAU,CAAC,MAAc,EAAE,SAAiB,EAAE,OAAe;QACnE,OAAO,IAAI,uBAAU,CAAC;YACpB,MAAM,EAAE,MAAM;YACd,SAAS,EAAE,GAAG,6CAAqB,CAAC,mBAAmB,sBAAsB,SAAS,EAAE;YACxF,OAAO,EAAE,OAAO;YAChB,WAAW,EAAE,MAAM,GAAG,GAAG;gBACvB,CAAC,CAAC,OAAO;gBACT,CAAC,CAAC,4EAA4E;YAChF,aAAa,EAAE,IAAI,CAAC,WAAW,CAAC,IAAI;SACrC,CAAC,CAAC;IACL,CAAC;CACF;AA7iBD,sFA6iBC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@futdevpro/nts-dynamo",
-  "version": "01.15.140",
+  "version": "01.15.142",
   "description": "Dynamic NodeTS (NodeJS-Typescript), MongoDB Backend System Framework by Future Development Program Ltd.",
   "DyBu_settings": {
     "packageType": "server-package",
@@ -212,6 +212,18 @@
       "types": "./build/_modules/admin-auth/index.d.ts",
       "typings": "./build/_modules/admin-auth/index.d.ts"
     },
+    "./account-security": {
+      "default": "./build/_modules/account-security/index.js",
+      "module": "./build/_modules/account-security/index.js",
+      "types": "./build/_modules/account-security/index.d.ts",
+      "typings": "./build/_modules/account-security/index.d.ts"
+    },
+    "./privacy-lifecycle": {
+      "default": "./build/_modules/privacy-lifecycle/index.js",
+      "module": "./build/_modules/privacy-lifecycle/index.js",
+      "types": "./build/_modules/privacy-lifecycle/index.d.ts",
+      "typings": "./build/_modules/privacy-lifecycle/index.d.ts"
+    },
     "./oauth2": {
       "default": "./build/_modules/oauth2/index.js",
       "module": "./build/_modules/oauth2/index.js",
@@ -338,6 +350,12 @@
       "admin-auth": [
         "build/_modules/admin-auth/index.d.ts"
       ],
+      "account-security": [
+        "build/_modules/account-security/index.d.ts"
+      ],
+      "privacy-lifecycle": [
+        "build/_modules/privacy-lifecycle/index.d.ts"
+      ],
       "oauth2": [
         "build/_modules/oauth2/index.d.ts"
       ],

package/src/_modules/account-security/_enums/account-challenge-purpose.type-enum.ts

@@ -0,0 +1,5 @@
+/** Supported one-time account challenge purposes. */
+export enum DyNTS_AccountChallengePurpose_Type {
+  emailVerification = 'email-verification',
+  passwordReset = 'password-reset',
+}

package/src/_modules/account-security/_enums/account-refresh-token-state.type-enum.ts

@@ -0,0 +1,6 @@
+/** One-time refresh-token ledger states. */
+export enum DyNTS_AccountRefreshTokenState_Type {
+  active = 'active',
+  used = 'used',
+  revoked = 'revoked',
+}

package/src/_modules/account-security/_enums/account-session-state.type-enum.ts

@@ -0,0 +1,6 @@
+/** Persisted standalone account-session states. */
+export enum DyNTS_AccountSessionState_Type {
+  active = 'active',
+  revoked = 'revoked',
+  expired = 'expired',
+}

package/src/_modules/account-security/_models/account-challenge-adapter.interface.ts

@@ -0,0 +1,17 @@
+import { DyNTS_AccountChallengePurpose_Type } from '../_enums/account-challenge-purpose.type-enum';
+import { DyNTS_AccountChallengeRecord_Interface } from './account-challenge-record.interface';
+
+/** Atomic persistence contract for replacing and consuming one-time account challenges. */
+export interface DyNTS_AccountChallengeAdapter_Interface {
+  replaceActiveChallenge(record: DyNTS_AccountChallengeRecord_Interface): Promise<void>;
+  consumeActiveChallenge(
+    tokenHash: string,
+    purpose: DyNTS_AccountChallengePurpose_Type,
+    consumedAt: string
+  ): Promise<DyNTS_AccountChallengeRecord_Interface | null>;
+  revokeSubjectChallenges(
+    subjectId: string,
+    purpose: DyNTS_AccountChallengePurpose_Type,
+    revokedAt: string
+  ): Promise<void>;
+}

package/src/_modules/account-security/_models/account-challenge-issued.interface.ts

@@ -0,0 +1,6 @@
+/** Raw one-time challenge returned once after its hash is persisted. */
+export interface DyNTS_AccountChallengeIssued_Interface {
+  challengeId: string;
+  token: string;
+  expiresAt: string;
+}

package/src/_modules/account-security/_models/account-challenge-record.interface.ts

@@ -0,0 +1,13 @@
+import { DyNTS_AccountChallengePurpose_Type } from '../_enums/account-challenge-purpose.type-enum';
+
+/** Server-only one-time account challenge record containing a credential hash only. */
+export interface DyNTS_AccountChallengeRecord_Interface {
+  challengeId: string;
+  subjectId: string;
+  purpose: DyNTS_AccountChallengePurpose_Type;
+  tokenHash: string;
+  createdAt: string;
+  expiresAt: string;
+  consumedAt: string;
+  revokedAt: string;
+}

package/src/_modules/account-security/_models/account-challenge-result.interface.ts

@@ -0,0 +1,8 @@
+import { DyNTS_AccountChallengePurpose_Type } from '../_enums/account-challenge-purpose.type-enum';
+
+/** Trusted identity binding returned after an atomic one-time challenge consumption. */
+export interface DyNTS_AccountChallengeResult_Interface {
+  challengeId: string;
+  subjectId: string;
+  purpose: DyNTS_AccountChallengePurpose_Type;
+}

package/src/_modules/account-security/_models/account-challenge-settings.interface.ts

@@ -0,0 +1,9 @@
+import { DyNTS_AccountChallengeAdapter_Interface } from './account-challenge-adapter.interface';
+
+/** Runtime settings for one-time account challenges. */
+export interface DyNTS_AccountChallengeSettings_Interface {
+  adapter: DyNTS_AccountChallengeAdapter_Interface;
+  ttlMs?: number;
+  tokenBytes?: number;
+  clock?: () => Date;
+}

package/src/_modules/account-security/_models/account-password-policy.interface.ts

@@ -0,0 +1,11 @@
+/** Password-hashing and validation policy for the standalone Dynamo account capability. */
+export interface DyNTS_AccountPasswordPolicy_Interface {
+  minLength: number;
+  maxLength: number;
+  scryptCost: number;
+  scryptBlockSize: number;
+  scryptParallelization: number;
+  derivedKeyLength: number;
+  saltLength: number;
+  commonPasswordSha256: string[];
+}

package/src/_modules/account-security/_models/account-password-verification.interface.ts

@@ -0,0 +1,5 @@
+/** Content-free password verification result; never carries the password or derived bytes. */
+export interface DyNTS_AccountPasswordVerification_Interface {
+  isValid: boolean;
+  needsRehash: boolean;
+}

package/src/_modules/account-security/_models/account-refresh-token-record.interface.ts

@@ -0,0 +1,13 @@
+import { DyNTS_AccountRefreshTokenState_Type } from '../_enums/account-refresh-token-state.type-enum';
+
+/** Server-only one-time refresh-token ledger record. */
+export interface DyNTS_AccountRefreshTokenRecord_Interface {
+  tokenHash: string;
+  sessionId: string;
+  familyId: string;
+  subjectId: string;
+  generation: number;
+  state: DyNTS_AccountRefreshTokenState_Type;
+  expiresAt: string;
+  usedAt: string;
+}

package/src/_modules/account-security/_models/account-session-adapter.interface.ts

@@ -0,0 +1,19 @@
+import { DyNTS_AccountRefreshTokenRecord_Interface } from './account-refresh-token-record.interface';
+import { DyNTS_AccountSessionCreate_Interface } from './account-session-create.interface';
+import { DyNTS_AccountSessionRecord_Interface } from './account-session-record.interface';
+import { DyNTS_AccountSessionRotate_Interface } from './account-session-rotate.interface';
+
+/**
+ * Persistence contract. Implementations must make create and rotate atomic and apply compare-and-set semantics.
+ */
+export interface DyNTS_AccountSessionAdapter_Interface {
+  createSession(set: DyNTS_AccountSessionCreate_Interface): Promise<void>;
+  findSessionById(sessionId: string): Promise<DyNTS_AccountSessionRecord_Interface | null>;
+  findSessionByAccessTokenHash(accessTokenHash: string): Promise<DyNTS_AccountSessionRecord_Interface | null>;
+  findRefreshTokenByHash(tokenHash: string): Promise<DyNTS_AccountRefreshTokenRecord_Interface | null>;
+  rotateSession(set: DyNTS_AccountSessionRotate_Interface): Promise<boolean>;
+  revokeSession(sessionId: string, revokedAt: string, reasonCode: string): Promise<void>;
+  revokeFamily(familyId: string, revokedAt: string, reasonCode: string): Promise<void>;
+  revokeSubject(subjectId: string, revokedAt: string, reasonCode: string): Promise<void>;
+  listSubjectSessions(subjectId: string): Promise<DyNTS_AccountSessionRecord_Interface[]>;
+}

package/src/_modules/account-security/_models/account-session-claims.interface.ts

@@ -0,0 +1,7 @@
+/** Authenticated server-side subject projection derived from an opaque access token. */
+export interface DyNTS_AccountSessionClaims_Interface {
+  subjectId: string;
+  sessionId: string;
+  familyId: string;
+  authorizationVersion: number;
+}

package/src/_modules/account-security/_models/account-session-context.interface.ts

@@ -0,0 +1,6 @@
+/** Minimal, pre-redacted session context persisted for user-facing session recognition. */
+export interface DyNTS_AccountSessionContext_Interface {
+  deviceName: string;
+  ipAddressHash: string;
+  userAgentHash: string;
+}

package/src/_modules/account-security/_models/account-session-create.interface.ts

@@ -0,0 +1,8 @@
+import { DyNTS_AccountRefreshTokenRecord_Interface } from './account-refresh-token-record.interface';
+import { DyNTS_AccountSessionRecord_Interface } from './account-session-record.interface';
+
+/** Atomic session creation payload for a concrete Dynamo DataService adapter. */
+export interface DyNTS_AccountSessionCreate_Interface {
+  session: DyNTS_AccountSessionRecord_Interface;
+  refreshToken: DyNTS_AccountRefreshTokenRecord_Interface;
+}

package/src/_modules/account-security/_models/account-session-record.interface.ts

@@ -0,0 +1,21 @@
+import { DyNTS_AccountSessionState_Type } from '../_enums/account-session-state.type-enum';
+import { DyNTS_AccountSessionContext_Interface } from './account-session-context.interface';
+
+/** Server-only session record. It stores token hashes, never bearer credentials. */
+export interface DyNTS_AccountSessionRecord_Interface {
+  sessionId: string;
+  familyId: string;
+  subjectId: string;
+  accessTokenHash: string;
+  accessExpiresAt: string;
+  refreshExpiresAt: string;
+  state: DyNTS_AccountSessionState_Type;
+  generation: number;
+  revision: number;
+  authorizationVersion: number;
+  createdAt: string;
+  lastRotatedAt: string;
+  revokedAt: string;
+  revocationReason: string;
+  context: DyNTS_AccountSessionContext_Interface;
+}

package/src/_modules/account-security/_models/account-session-rotate.interface.ts

@@ -0,0 +1,11 @@
+import { DyNTS_AccountRefreshTokenRecord_Interface } from './account-refresh-token-record.interface';
+import { DyNTS_AccountSessionRecord_Interface } from './account-session-record.interface';
+
+/** Atomic one-time refresh rotation payload for a concrete Dynamo DataService adapter. */
+export interface DyNTS_AccountSessionRotate_Interface {
+  expectedSessionRevision: number;
+  currentRefreshTokenHash: string;
+  usedAt: string;
+  replacementSession: DyNTS_AccountSessionRecord_Interface;
+  replacementRefreshToken: DyNTS_AccountRefreshTokenRecord_Interface;
+}