@futdevpro/nts-dynamo 1.15.315 → 1.15.320

package/build/_modules/privacy-lifecycle/privacy-lifecycle.mongo-store.js

@@ -0,0 +1,316 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DyNTS_PrivacyLifecycle_MongoStore = void 0;
+const tslib_1 = require("tslib");
+const mongoose_1 = tslib_1.__importStar(require("mongoose"));
+const DyNTS_privacyRequestModelName = 'DyNTSPrivacyRequest';
+const DyNTS_privacyRequestPlanModelName = 'DyNTSPrivacyRequestPlan';
+const DyNTS_privacyRequestOutcomeModelName = 'DyNTSPrivacyRequestOutcome';
+/**
+ * Mongo persistence for the privacy lifecycle — the production `DyNTS_PrivacyLifecycleAdapter_Interface`.
+ *
+ * @description BFR-FUTDEVPRO-010 / BFR-ADVENTOR-025. Before this store the module shipped the contract only,
+ *   so `DyNTS_PrivacyLifecycle_ControlService` (which REQUIRES an adapter) could not be started, and three
+ *   products carried their own copies (company-toolmaker, futdevpro, adventor). This is the futdevpro copy,
+ *   lifted verbatim in behaviour; the collection and model names are unchanged, so existing data stays readable.
+ *
+ *   Atomicity does NOT need a transaction here — every guarantee is a single-document operation:
+ *   - replay idempotency: the UNIQUE `idempotencyHash` index (the loser of a race reads the winner);
+ *   - optimistic concurrency: `replaceRequest` puts `revision` INTO the filter, so a stale writer matches
+ *     nothing and gets `false` (the caller turns that into a 409);
+ *   - plan/outcome writes: an upsert on the UNIQUE `(requestId, contributorId)` pair.
+ *
+ *   ⚠️ A broken revision check here is not "a bug": it is a lost or doubly executed erasure request —
+ *   exactly the operation whose provability is the legal requirement (GDPR Art. 17).
+ *
+ *   ⚠️ Consumers that carried a product-side copy must DELETE it in the same change-set that switches to this
+ *   store: both register the same model names, and `resolveModel` silently returns whichever registered first.
+ */
+class DyNTS_PrivacyLifecycle_MongoStore {
+    injected;
+    readiness;
+    /** Accepts isolated models for integration tests; production resolves the singletons lazily. */
+    constructor(set = {}) {
+        this.injected = set;
+    }
+    /**
+     * Creates the indexes BEFORE the first read or write.
+     *
+     * @description Not a convenience step: idempotency and optimistic concurrency both rest on the UNIQUE
+     *   indexes. Without them a duplicate would not fail — it would silently become a second record.
+     */
+    async ensureReady() {
+        this.readiness ??= Promise.all([
+            this.getRequestModel().createIndexes(),
+            this.getPlanModel().createIndexes(),
+            this.getOutcomeModel().createIndexes(),
+        ])
+            .then(() => undefined)
+            .catch((error) => {
+            this.readiness = undefined;
+            throw error;
+        });
+        await this.readiness;
+    }
+    /**
+     * Creates one request, or returns the EXACT same request on an idempotent replay.
+     *
+     * @description The decision is not a racy "does it exist?" read (two parallel callers would both see
+     *   "no"), but the UNIQUE index: the second writer gets a duplicate-key error and reads the winner.
+     */
+    async createOrGetRequest(request) {
+        try {
+            const created = await this.getRequestModel().create([request]);
+            const value = created[0]?.toObject();
+            if (!value) {
+                throw new Error('DYNTS|PRIVACY_LIFECYCLE|CREATE_EMPTY');
+            }
+            return { request: this.toRequestRecord(value), created: true };
+        }
+        catch (error) {
+            if (!this.isDuplicateKey(error)) {
+                throw error;
+            }
+            const existing = await this.getRequestModel()
+                .findOne({ idempotencyHash: request.idempotencyHash })
+                .lean().exec();
+            if (!existing) {
+                throw error;
+            }
+            return { request: this.toRequestRecord(existing), created: false };
+        }
+    }
+    /** Loads one request by id. Does not throw when missing — interpreting absence is the caller's job. */
+    async findRequestById(requestId) {
+        const found = await this.getRequestModel()
+            .findOne({ requestId: requestId })
+            .lean().exec();
+        return found ? this.toRequestRecord(found) : null;
+    }
+    /**
+     * One bounded, deterministic, newest-first page of the subject's own requests.
+     *
+     * @description Sorted by TWO keys (`createdAt`, then `requestId`): with a single key two requests created in
+     *   the same millisecond would order non-deterministically and paging could skip or repeat a row
+     *   (`createdAt` is ISO-8601 UTC text, so string order is time order). The cursor is opaque and carries no
+     *   personal data — a timestamp and a machine id only.
+     */
+    async listRequests(query) {
+        const filter = {
+            subjectId: query.subjectId,
+            organizationId: query.organizationId,
+        };
+        const cursor = this.decodeCursor(query.cursor);
+        if (cursor) {
+            filter.$or = [
+                { createdAt: { $lt: cursor.createdAt } },
+                { createdAt: cursor.createdAt, requestId: { $lt: cursor.requestId } },
+            ];
+        }
+        // One MORE than the page size: "is there a next page?" is answered without a separate
+        // (and non-consistent) countDocuments call.
+        const found = await this.getRequestModel().find(filter)
+            .sort({ createdAt: -1, requestId: -1 })
+            .limit(query.limit + 1)
+            .lean().exec();
+        const page = found.slice(0, query.limit)
+            .map((row) => this.toRequestRecord(row));
+        const last = page[page.length - 1];
+        return {
+            requests: page,
+            nextCursor: found.length > query.limit && last ? this.encodeCursor(last) : '',
+        };
+    }
+    /**
+     * State transition with OPTIMISTIC CONCURRENCY.
+     *
+     * @description `revision` is part of the filter: if someone else rewrote the record meanwhile, the filter
+     *   matches nothing and `false` is returned. That `false` is not an error — it is the correct answer to a
+     *   race, and the caller turns it into a 409.
+     */
+    async replaceRequest(request, expectedRevision) {
+        const result = await this.getRequestModel().replaceOne({ requestId: request.requestId, revision: expectedRevision }, this.toRequestRecord(request)).exec();
+        return result.matchedCount === 1;
+    }
+    /**
+     * Stores one contributor plan.
+     *
+     * @description Overwrites, does not insert: a resumed run may deliver the same plan again. The upsert on the
+     *   `(requestId, contributorId)` pair keeps it idempotent — never two plans for one contributor.
+     */
+    async saveContributorPlan(requestId, plan) {
+        await this.getPlanModel().updateOne({ requestId: requestId, contributorId: plan.contributorId }, { $set: { ...plan, requestId: requestId } }, { upsert: true }).exec();
+    }
+    /** All contributor plans of one request, in a stable order. */
+    async listContributorPlans(requestId) {
+        const rows = await this.getPlanModel().find({ requestId: requestId })
+            .sort({ contributorId: 1 }).lean().exec();
+        return rows.map((row) => ({
+            contributorId: row.contributorId,
+            action: row.action,
+            retentionBasisCode: row.retentionBasisCode,
+        }));
+    }
+    /**
+     * Stores one contributor outcome.
+     *
+     * @description The overwrite is not only for resumed runs: on a failed verification the lifecycle
+     *   DELIBERATELY replaces an earlier (successful) outcome with a failed one — an insert-only store would make
+     *   the request look falsely successful.
+     */
+    async saveContributorOutcome(requestId, outcome) {
+        await this.getOutcomeModel().updateOne({ requestId: requestId, contributorId: outcome.contributorId }, { $set: { ...outcome, requestId: requestId } }, { upsert: true }).exec();
+    }
+    /** All contributor outcomes of one request, in a stable order. */
+    async listContributorOutcomes(requestId) {
+        const rows = await this.getOutcomeModel().find({ requestId: requestId })
+            .sort({ contributorId: 1 }).lean().exec();
+        return rows.map((row) => ({
+            contributorId: row.contributorId,
+            action: row.action,
+            outcome: row.outcome,
+            retentionBasisCode: row.retentionBasisCode,
+            artifactChecksum: row.artifactChecksum,
+            processedRecordCount: row.processedRecordCount,
+            errorCode: row.errorCode,
+            completedAt: row.completedAt,
+        }));
+    }
+    /**
+     * The request-record schema.
+     *
+     * @description Date fields are `String`, not `Date`: the contract uses an EMPTY string for "has not happened
+     *   yet" (`identityVerifiedAt: ''`), which a `Date` field cannot represent. `strict: 'throw'` is deliberate —
+     *   an unknown field must not slip in silently.
+     */
+    static createRequestSchema() {
+        const schema = new mongoose_1.Schema({
+            requestId: { type: String, required: true, immutable: true, maxlength: 128 },
+            subjectId: { type: String, required: true, immutable: true, maxlength: 128 },
+            organizationId: { type: String, required: true, immutable: true, maxlength: 128 },
+            type: { type: String, required: true, immutable: true, maxlength: 64 },
+            state: { type: String, required: true, maxlength: 64 },
+            idempotencyHash: { type: String, required: true, immutable: true, match: /^[a-f0-9]{64}$/u },
+            revision: { type: Number, required: true, min: 0, validate: Number.isSafeInteger },
+            createdAt: { type: String, required: true, immutable: true, maxlength: 64 },
+            deadlineAt: { type: String, required: true, maxlength: 64 },
+            identityVerifiedAt: { type: String, default: '', maxlength: 64 },
+            scopedAt: { type: String, default: '', maxlength: 64 },
+            plannedAt: { type: String, default: '', maxlength: 64 },
+            executionStartedAt: { type: String, default: '', maxlength: 64 },
+            verifyingStartedAt: { type: String, default: '', maxlength: 64 },
+            completedAt: { type: String, default: '', maxlength: 64 },
+            cancelledAt: { type: String, default: '', maxlength: 64 },
+        }, {
+            collection: 'dynts_privacy_requests',
+            strict: 'throw',
+            versionKey: false,
+        });
+        schema.index({ idempotencyHash: 1 }, { unique: true, name: 'uq_dynts_privacy_request_idempotency' });
+        schema.index({ requestId: 1 }, { unique: true, name: 'uq_dynts_privacy_request_id' });
+        schema.index({ subjectId: 1, organizationId: 1, createdAt: -1, requestId: -1 }, { name: 'ix_dynts_privacy_request_subject_page' });
+        return schema;
+    }
+    /** The contributor-plan schema. */
+    static createPlanSchema() {
+        const schema = new mongoose_1.Schema({
+            requestId: { type: String, required: true, immutable: true, maxlength: 128 },
+            contributorId: { type: String, required: true, immutable: true, maxlength: 128 },
+            action: { type: String, required: true, maxlength: 64 },
+            retentionBasisCode: { type: String, default: '', maxlength: 128 },
+        }, {
+            collection: 'dynts_privacy_request_plans',
+            strict: 'throw',
+            versionKey: false,
+        });
+        schema.index({ requestId: 1, contributorId: 1 }, { unique: true, name: 'uq_dynts_privacy_plan_scope' });
+        return schema;
+    }
+    /** The contributor-outcome schema. */
+    static createOutcomeSchema() {
+        const schema = new mongoose_1.Schema({
+            requestId: { type: String, required: true, immutable: true, maxlength: 128 },
+            contributorId: { type: String, required: true, immutable: true, maxlength: 128 },
+            action: { type: String, required: true, maxlength: 64 },
+            outcome: { type: String, required: true, maxlength: 64 },
+            retentionBasisCode: { type: String, default: '', maxlength: 128 },
+            artifactChecksum: { type: String, default: '', maxlength: 128 },
+            processedRecordCount: { type: Number, required: true, min: 0, validate: Number.isSafeInteger },
+            errorCode: { type: String, default: '', maxlength: 128 },
+            completedAt: { type: String, required: true, maxlength: 64 },
+        }, {
+            collection: 'dynts_privacy_request_outcomes',
+            strict: 'throw',
+            versionKey: false,
+        });
+        schema.index({ requestId: 1, contributorId: 1 }, { unique: true, name: 'uq_dynts_privacy_outcome_scope' });
+        return schema;
+    }
+    /**
+     * The contract shape from a stored row — an ALLOW-list.
+     *
+     * @description `.lean()` also returns the persistence's own fields (`_id`). Passing them on, the lifecycle's
+     *   `{ ...request }` spread would write them back — the filtering keeps the domain object clean.
+     */
+    toRequestRecord(row) {
+        return {
+            requestId: row.requestId,
+            subjectId: row.subjectId,
+            organizationId: row.organizationId,
+            type: row.type,
+            state: row.state,
+            idempotencyHash: row.idempotencyHash,
+            revision: row.revision,
+            createdAt: row.createdAt,
+            deadlineAt: row.deadlineAt,
+            identityVerifiedAt: row.identityVerifiedAt ?? '',
+            scopedAt: row.scopedAt ?? '',
+            plannedAt: row.plannedAt ?? '',
+            executionStartedAt: row.executionStartedAt ?? '',
+            verifyingStartedAt: row.verifyingStartedAt ?? '',
+            completedAt: row.completedAt ?? '',
+            cancelledAt: row.cancelledAt ?? '',
+        };
+    }
+    /** Opaque, but NOT encrypted, paging cursor — it holds no personal data. */
+    encodeCursor(record) {
+        return Buffer.from(`${record.createdAt}|${record.requestId}`, 'utf8').toString('base64url');
+    }
+    /**
+     * Decodes the cursor — FAIL-SAFE: a damaged or forged cursor restarts paging on the FIRST page.
+     *
+     * @description Not a security hole: the `subjectId` + `organizationId` filter is independent of the cursor,
+     *   so the subject still sees only their own requests.
+     */
+    decodeCursor(cursor) {
+        if (!cursor) {
+            return undefined;
+        }
+        const parts = Buffer.from(cursor, 'base64url').toString('utf8').split('|');
+        return parts.length === 2 && parts[0] && parts[1]
+            ? { createdAt: parts[0], requestId: parts[1] }
+            : undefined;
+    }
+    getRequestModel() {
+        return this.injected.requestModel ?? this.resolveModel(DyNTS_privacyRequestModelName, DyNTS_PrivacyLifecycle_MongoStore.createRequestSchema());
+    }
+    getPlanModel() {
+        return this.injected.planModel ?? this.resolveModel(DyNTS_privacyRequestPlanModelName, DyNTS_PrivacyLifecycle_MongoStore.createPlanSchema());
+    }
+    getOutcomeModel() {
+        return this.injected.outcomeModel ?? this.resolveModel(DyNTS_privacyRequestOutcomeModelName, DyNTS_PrivacyLifecycle_MongoStore.createOutcomeSchema());
+    }
+    /** Lazy one-time model resolution — a second `mongoose.model(name, schema)` for one name would throw. */
+    resolveModel(name, schema) {
+        return mongoose_1.default.modelNames().includes(name)
+            ? mongoose_1.default.model(name)
+            : mongoose_1.default.model(name, schema);
+    }
+    /** Mongo duplicate-key error — the signal that carries the "idempotent replay" branch. */
+    isDuplicateKey(error) {
+        return typeof error === 'object' && error !== null && 'code' in error
+            && Object.getOwnPropertyDescriptor(error, 'code')?.value === 11000;
+    }
+}
+exports.DyNTS_PrivacyLifecycle_MongoStore = DyNTS_PrivacyLifecycle_MongoStore;
+//# sourceMappingURL=privacy-lifecycle.mongo-store.js.map

package/build/_modules/privacy-lifecycle/privacy-lifecycle.mongo-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"privacy-lifecycle.mongo-store.js","sourceRoot":"","sources":["../../../src/_modules/privacy-lifecycle/privacy-lifecycle.mongo-store.ts"],"names":[],"mappings":";;;;AAAA,6DAAqE;AAcrE,MAAM,6BAA6B,GAA0B,qBAAqB,CAAC;AACnF,MAAM,iCAAiC,GAA8B,yBAAyB,CAAC;AAC/F,MAAM,oCAAoC,GAAiC,4BAA4B,CAAC;AAexG;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAa,iCAAiC;IAC3B,QAAQ,CAA4C;IAC7D,SAAS,CAAiB;IAElC,gGAAgG;IAChG,YAAY,MAAiD,EAAE;QAC7D,IAAI,CAAC,QAAQ,GAAG,GAAG,CAAC;IACtB,CAAC;IAED;;;;;OAKG;IACI,KAAK,CAAC,WAAW;QACtB,IAAI,CAAC,SAAS,KAAK,OAAO,CAAC,GAAG,CAAC;YAC7B,IAAI,CAAC,eAAe,EAAE,CAAC,aAAa,EAAE;YACtC,IAAI,CAAC,YAAY,EAAE,CAAC,aAAa,EAAE;YACnC,IAAI,CAAC,eAAe,EAAE,CAAC,aAAa,EAAE;SACvC,CAAC;aACC,IAAI,CAAC,GAAS,EAAE,CAAC,SAAS,CAAC;aAC3B,KAAK,CAAC,CAAC,KAAc,EAAS,EAAE;YAC/B,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;YAE3B,MAAM,KAAK,CAAC;QACd,CAAC,CAAC,CAAC;QACL,MAAM,IAAI,CAAC,SAAS,CAAC;IACvB,CAAC;IAED;;;;;OAKG;IACI,KAAK,CAAC,kBAAkB,CAC7B,OAA6C;QAE7C,IAAI,CAAC;YACH,MAAM,OAAO,GACX,MAAM,IAAI,CAAC,eAAe,EAAE,CAAC,MAAM,CAAC,CAAE,OAAO,CAAE,CAAC,CAAC;YACnD,MAAM,KAAK,GAAqD,OAAO,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC;YAEvF,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;YAC1D,CAAC;YAED,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QACjE,CAAC;QAAC,OAAO,KAAc,EAAE,CAAC;YACxB,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,EAAE,CAAC;gBAChC,MAAM,KAAK,CAAC;YACd,CAAC;YAED,MAAM,QAAQ,GAAgD,MAAM,IAAI,CAAC,eAAe,EAAE;iBACvF,OAAO,CAAC,EAAE,eAAe,EAAE,OAAO,CAAC,eAAe,EAAE,CAAC;iBACrD,IAAI,EAAwC,CAAC,IAAI,EAAE,CAAC;YAEvD,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,MAAM,KAAK,CAAC;YACd,CAAC;YAED,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QACrE,CAAC;IACH,CAAC;IAED,uGAAuG;IAChG,KAAK,CAAC,eAAe,CAAC,SAAiB;QAC5C,MAAM,KAAK,GAAgD,MAAM,IAAI,CAAC,eAAe,EAAE;aACpF,OAAO,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;aACjC,IAAI,EAAwC,CAAC,IAAI,EAAE,CAAC;QAEvD,OAAO,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACpD,CAAC;IAED;;;;;;;OAOG;IACI,KAAK,CAAC,YAAY,CACvB,KAA8C;QAE9C,MAAM,MAAM,GAA4B;YACtC,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,cAAc,EAAE,KAAK,CAAC,cAAc;SACrC,CAAC;QACF,MAAM,MAAM,GAAyD,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAErG,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,CAAC,GAAG,GAAG;gBACX,EAAE,SAAS,EAAE,EAAE,GAAG,EAAE,MAAM,CAAC,SAAS,EAAE,EAAE;gBACxC,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,SAAS,EAAE,EAAE,GAAG,EAAE,MAAM,CAAC,SAAS,EAAE,EAAE;aACtE,CAAC;QACJ,CAAC;QAED,sFAAsF;QACtF,4CAA4C;QAC5C,MAAM,KAAK,GAA2C,MAAM,IAAI,CAAC,eAAe,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC;aAC5F,IAAI,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,EAAE,CAAC;aACtC,KAAK,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC;aACtB,IAAI,EAA0C,CAAC,IAAI,EAAE,CAAC;QACzD,MAAM,IAAI,GAA2C,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,KAAK,CAAC;aAC7E,GAAG,CAAC,CAAC,GAAyC,EAAwC,EAAE,CACvF,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC;QAC/B,MAAM,IAAI,GAAqD,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAErF,OAAO;YACL,QAAQ,EAAE,IAAI;YACd,UAAU,EAAE,KAAK,CAAC,MAAM,GAAG,KAAK,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE;SAC9E,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACI,KAAK,CAAC,cAAc,CACzB,OAA6C,EAC7C,gBAAwB;QAExB,MAAM,MAAM,GAAiC,MAAM,IAAI,CAAC,eAAe,EAAE,CAAC,UAAU,CAClF,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,QAAQ,EAAE,gBAAgB,EAAE,EAC5D,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,CAC9B,CAAC,IAAI,EAAE,CAAC;QAET,OAAO,MAAM,CAAC,YAAY,KAAK,CAAC,CAAC;IACnC,CAAC;IAED;;;;;OAKG;IACI,KAAK,CAAC,mBAAmB,CAAC,SAAiB,EAAE,IAA4C;QAC9F,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC,SAAS,CACjC,EAAE,SAAS,EAAE,SAAS,EAAE,aAAa,EAAE,IAAI,CAAC,aAAa,EAAE,EAC3D,EAAE,IAAI,EAAE,EAAE,GAAG,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,EAAE,EAC3C,EAAE,MAAM,EAAE,IAAI,EAAE,CACjB,CAAC,IAAI,EAAE,CAAC;IACX,CAAC;IAED,+DAA+D;IACxD,KAAK,CAAC,oBAAoB,CAAC,SAAiB;QACjD,MAAM,IAAI,GAAkC,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;aACjG,IAAI,CAAC,EAAE,aAAa,EAAE,CAAC,EAAE,CAAC,CAAC,IAAI,EAAiC,CAAC,IAAI,EAAE,CAAC;QAE3E,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAgC,EAA0C,EAAE,CAAC,CAAC;YAC7F,aAAa,EAAE,GAAG,CAAC,aAAa;YAChC,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,kBAAkB,EAAE,GAAG,CAAC,kBAAkB;SAC3C,CAAC,CAAC,CAAC;IACN,CAAC;IAED;;;;;;OAMG;IACI,KAAK,CAAC,sBAAsB,CACjC,SAAiB,EACjB,OAAkD;QAElD,MAAM,IAAI,CAAC,eAAe,EAAE,CAAC,SAAS,CACpC,EAAE,SAAS,EAAE,SAAS,EAAE,aAAa,EAAE,OAAO,CAAC,aAAa,EAAE,EAC9D,EAAE,IAAI,EAAE,EAAE,GAAG,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,EAAE,EAC9C,EAAE,MAAM,EAAE,IAAI,EAAE,CACjB,CAAC,IAAI,EAAE,CAAC;IACX,CAAC;IAED,kEAAkE;IAC3D,KAAK,CAAC,uBAAuB,CAAC,SAAiB;QACpD,MAAM,IAAI,GAAqC,MAAM,IAAI,CAAC,eAAe,EAAE,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;aACvG,IAAI,CAAC,EAAE,aAAa,EAAE,CAAC,EAAE,CAAC,CAAC,IAAI,EAAoC,CAAC,IAAI,EAAE,CAAC;QAE9E,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAmC,EAA6C,EAAE,CAAC,CAAC;YACnG,aAAa,EAAE,GAAG,CAAC,aAAa;YAChC,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,OAAO,EAAE,GAAG,CAAC,OAAO;YACpB,kBAAkB,EAAE,GAAG,CAAC,kBAAkB;YAC1C,gBAAgB,EAAE,GAAG,CAAC,gBAAgB;YACtC,oBAAoB,EAAE,GAAG,CAAC,oBAAoB;YAC9C,SAAS,EAAE,GAAG,CAAC,SAAS;YACxB,WAAW,EAAE,GAAG,CAAC,WAAW;SAC7B,CAAC,CAAC,CAAC;IACN,CAAC;IAED;;;;;;OAMG;IACI,MAAM,CAAC,mBAAmB;QAC/B,MAAM,MAAM,GAAiD,IAAI,iBAAM,CAAuC;YAC5G,SAAS,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE;YAC5E,SAAS,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE;YAC5E,cAAc,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE;YACjF,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE;YACtE,KAAK,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE;YACtD,eAAe,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,iBAAiB,EAAE;YAC5F,QAAQ,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,aAAa,EAAE;YAClF,SAAS,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE;YAC3E,UAAU,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE;YAC3D,kBAAkB,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE;YAChE,QAAQ,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE;YACtD,SAAS,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE;YACvD,kBAAkB,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE;YAChE,kBAAkB,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE;YAChE,WAAW,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE;YACzD,WAAW,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE;SAC1D,EAAE;YACD,UAAU,EAAE,wBAAwB;YACpC,MAAM,EAAE,OAAO;YACf,UAAU,EAAE,KAAK;SAClB,CAAC,CAAC;QAEH,MAAM,CAAC,KAAK,CAAC,EAAE,eAAe,EAAE,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,sCAAsC,EAAE,CAAC,CAAC;QACrG,MAAM,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,6BAA6B,EAAE,CAAC,CAAC;QACtF,MAAM,CAAC,KAAK,CACV,EAAE,SAAS,EAAE,CAAC,EAAE,cAAc,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,EAAE,EACjE,EAAE,IAAI,EAAE,uCAAuC,EAAE,CAClD,CAAC;QAEF,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,mCAAmC;IAC5B,MAAM,CAAC,gBAAgB;QAC5B,MAAM,MAAM,GAAwC,IAAI,iBAAM,CAA8B;YAC1F,SAAS,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE;YAC5E,aAAa,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE;YAChF,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE;YACvD,kBAAkB,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE;SAClE,EAAE;YACD,UAAU,EAAE,6BAA6B;YACzC,MAAM,EAAE,OAAO;YACf,UAAU,EAAE,KAAK;SAClB,CAAC,CAAC;QAEH,MAAM,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,aAAa,EAAE,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,6BAA6B,EAAE,CAAC,CAAC;QAExG,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,sCAAsC;IAC/B,MAAM,CAAC,mBAAmB;QAC/B,MAAM,MAAM,GAA2C,IAAI,iBAAM,CAAiC;YAChG,SAAS,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE;YAC5E,aAAa,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE;YAChF,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE;YACvD,OAAO,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE;YACxD,kBAAkB,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE;YACjE,gBAAgB,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE;YAC/D,oBAAoB,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,aAAa,EAAE;YAC9F,SAAS,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE;YACxD,WAAW,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE;SAC7D,EAAE;YACD,UAAU,EAAE,gCAAgC;YAC5C,MAAM,EAAE,OAAO;YACf,UAAU,EAAE,KAAK;SAClB,CAAC,CAAC;QAEH,MAAM,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,aAAa,EAAE,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,gCAAgC,EAAE,CAAC,CAAC;QAE3G,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;;;OAKG;IACK,eAAe,CAAC,GAAyC;QAC/D,OAAO;YACL,SAAS,EAAE,GAAG,CAAC,SAAS;YACxB,SAAS,EAAE,GAAG,CAAC,SAAS;YACxB,cAAc,EAAE,GAAG,CAAC,cAAc;YAClC,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,KAAK,EAAE,GAAG,CAAC,KAAK;YAChB,eAAe,EAAE,GAAG,CAAC,eAAe;YACpC,QAAQ,EAAE,GAAG,CAAC,QAAQ;YACtB,SAAS,EAAE,GAAG,CAAC,SAAS;YACxB,UAAU,EAAE,GAAG,CAAC,UAAU;YAC1B,kBAAkB,EAAE,GAAG,CAAC,kBAAkB,IAAI,EAAE;YAChD,QAAQ,EAAE,GAAG,CAAC,QAAQ,IAAI,EAAE;YAC5B,SAAS,EAAE,GAAG,CAAC,SAAS,IAAI,EAAE;YAC9B,kBAAkB,EAAE,GAAG,CAAC,kBAAkB,IAAI,EAAE;YAChD,kBAAkB,EAAE,GAAG,CAAC,kBAAkB,IAAI,EAAE;YAChD,WAAW,EAAE,GAAG,CAAC,WAAW,IAAI,EAAE;YAClC,WAAW,EAAE,GAAG,CAAC,WAAW,IAAI,EAAE;SACnC,CAAC;IACJ,CAAC;IAED,4EAA4E;IACpE,YAAY,CAAC,MAA4C;QAC/D,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,SAAS,EAAE,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC9F,CAAC;IAED;;;;;OAKG;IACK,YAAY,CAAC,MAAc;QACjC,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,MAAM,KAAK,GAAa,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAErF,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC;YAC/C,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE;YAC9C,CAAC,CAAC,SAAS,CAAC;IAChB,CAAC;IAEO,eAAe;QACrB,OAAO,IAAI,CAAC,QAAQ,CAAC,YAAY,IAAI,IAAI,CAAC,YAAY,CACpD,6BAA6B,EAAE,iCAAiC,CAAC,mBAAmB,EAAE,CACvF,CAAC;IACJ,CAAC;IAEO,YAAY;QAClB,OAAO,IAAI,CAAC,QAAQ,CAAC,SAAS,IAAI,IAAI,CAAC,YAAY,CACjD,iCAAiC,EAAE,iCAAiC,CAAC,gBAAgB,EAAE,CACxF,CAAC;IACJ,CAAC;IAEO,eAAe;QACrB,OAAO,IAAI,CAAC,QAAQ,CAAC,YAAY,IAAI,IAAI,CAAC,YAAY,CACpD,oCAAoC,EAAE,iCAAiC,CAAC,mBAAmB,EAAE,CAC9F,CAAC;IACJ,CAAC;IAED,yGAAyG;IACjG,YAAY,CAAI,IAAY,EAAE,MAAiB;QACrD,OAAO,kBAAQ,CAAC,UAAU,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC;YACzC,CAAC,CAAC,kBAAQ,CAAC,KAAK,CAAI,IAAI,CAAC;YACzB,CAAC,CAAC,kBAAQ,CAAC,KAAK,CAAI,IAAI,EAAE,MAAM,CAAC,CAAC;IACtC,CAAC;IAED,0FAA0F;IAClF,cAAc,CAAC,KAAc;QACnC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,MAAM,IAAI,KAAK;eAChE,MAAM,CAAC,wBAAwB,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,KAAK,KAAK,KAAK,CAAC;IACvE,CAAC;CACF;AAtWD,8EAsWC"}

package/build/_modules/usage/index.d.ts

@@ -1,4 +1,6 @@
 export * from './usage.controller';
+export * from './usage-session-owner.interface';
+export * from './usage-session-account-query.interface';
 export * from './usage.data-service';
 export * from './get-usage-routing-module.util';
 export * from '@futdevpro/fsm-dynamo/usage';

package/build/_modules/usage/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/_modules/usage/index.ts"],"names":[],"mappings":"AAUA,cAAc,oBAAoB,CAAC;AACnC,cAAc,sBAAsB,CAAC;AACrC,cAAc,iCAAiC,CAAC;AAChD,cAAc,6BAA6B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/_modules/usage/index.ts"],"names":[],"mappings":"AAUA,cAAc,oBAAoB,CAAC;AACnC,cAAc,iCAAiC,CAAC;AAChD,cAAc,yCAAyC,CAAC;AACxD,cAAc,sBAAsB,CAAC;AACrC,cAAc,iCAAiC,CAAC;AAChD,cAAc,6BAA6B,CAAC"}

package/build/_modules/usage/index.js

@@ -8,6 +8,8 @@ Object.defineProperty(exports, "__esModule", { value: true });
 const tslib_1 = require("tslib");
 // USAGE MODULE
 tslib_1.__exportStar(require("./usage.controller"), exports);
+tslib_1.__exportStar(require("./usage-session-owner.interface"), exports);
+tslib_1.__exportStar(require("./usage-session-account-query.interface"), exports);
 tslib_1.__exportStar(require("./usage.data-service"), exports);
 tslib_1.__exportStar(require("./get-usage-routing-module.util"), exports);
 tslib_1.__exportStar(require("@futdevpro/fsm-dynamo/usage"), exports);

package/build/_modules/usage/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/_modules/usage/index.ts"],"names":[],"mappings":";AAEA,EAAE;AACF,eAAe;AACf,EAAE;AACF,qEAAqE;AACrE,EAAE;;;AAGF,eAAe;AACf,6DAAmC;AACnC,+DAAqC;AACrC,0EAAgD;AAChD,sEAA4C"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/_modules/usage/index.ts"],"names":[],"mappings":";AAEA,EAAE;AACF,eAAe;AACf,EAAE;AACF,qEAAqE;AACrE,EAAE;;;AAGF,eAAe;AACf,6DAAmC;AACnC,0EAAgD;AAChD,kFAAwD;AACxD,+DAAqC;AACrC,0EAAgD;AAChD,sEAA4C"}

package/build/_modules/usage/usage-session-account-query.interface.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Identifies the sessions of one account (BFR-FUTDEVPRO-015).
+ */
+export interface DyNTS_UsageSession_AccountQuery {
+    /** Account id — sessions since nts-dynamo 1.15.320 store it in `issuer` */
+    accountId: string;
+    /**
+     * Usernames the account has used. Sessions written BEFORE 1.15.320 stored the username in `issuer`
+     * (and nothing in `loggedInAs`), so without these the legacy sessions are NOT found.
+     */
+    legacyUsernames?: string[];
+}
+//# sourceMappingURL=usage-session-account-query.interface.d.ts.map

package/build/_modules/usage/usage-session-account-query.interface.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"usage-session-account-query.interface.d.ts","sourceRoot":"","sources":["../../../src/_modules/usage/usage-session-account-query.interface.ts"],"names":[],"mappings":"AACA;;GAEG;AACH,MAAM,WAAW,+BAA+B;IAC9C,2EAA2E;IAC3E,SAAS,EAAE,MAAM,CAAC;IAClB;;;OAGG;IACH,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;CAC5B"}

package/build/_modules/usage/usage-session-account-query.interface.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=usage-session-account-query.interface.js.map

package/build/_modules/usage/usage-session-account-query.interface.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"usage-session-account-query.interface.js","sourceRoot":"","sources":["../../../src/_modules/usage/usage-session-account-query.interface.ts"],"names":[],"mappings":""}

package/build/_modules/usage/usage-session-owner.interface.d.ts

@@ -0,0 +1,15 @@
+/**
+ * The owner of a usage session, as resolved from the incoming request (BFR-FUTDEVPRO-015).
+ *
+ * - `accountId` is what goes into the session's `issuer` (`fdp-issuer-is-account-id`); `'unknown'` when
+ *   the request carries no resolvable account (anonymous visitor, or optional-auth mode).
+ * - `username` goes into `loggedInAs`, and ONLY when an account was resolved — it exists so that legacy
+ *   sessions (written before 1.15.320 with `issuer: <username>`) can still be linked to their account.
+ */
+export interface DyNTS_UsageSessionOwner {
+    /** Account id of the session owner, or `'unknown'` */
+    accountId: string;
+    /** Username of the session owner; `undefined` for anonymous sessions */
+    username?: string;
+}
+//# sourceMappingURL=usage-session-owner.interface.d.ts.map

package/build/_modules/usage/usage-session-owner.interface.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"usage-session-owner.interface.d.ts","sourceRoot":"","sources":["../../../src/_modules/usage/usage-session-owner.interface.ts"],"names":[],"mappings":"AACA;;;;;;;GAOG;AACH,MAAM,WAAW,uBAAuB;IACtC,sDAAsD;IACtD,SAAS,EAAE,MAAM,CAAC;IAClB,wEAAwE;IACxE,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB"}

package/build/_modules/usage/usage-session-owner.interface.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=usage-session-owner.interface.js.map

package/build/_modules/usage/usage-session-owner.interface.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"usage-session-owner.interface.js","sourceRoot":"","sources":["../../../src/_modules/usage/usage-session-owner.interface.ts"],"names":[],"mappings":""}

package/build/_modules/usage/usage.controller.d.ts

@@ -1,7 +1,23 @@
+import { Request } from 'express';
 import { DyNTS_Controller } from '../../_services/route/controller.service';
+import { DyNTS_UsageSessionOwner } from './usage-session-owner.interface';
 export declare class DyNTS_Usage_Controller extends DyNTS_Controller {
     static getInstance(): DyNTS_Usage_Controller;
     private authService;
     setupEndpoints(): void;
+    /**
+     * Resolves the owner of a new usage session (BFR-FUTDEVPRO-015).
+     *
+     * The `issuer` of a session is ALWAYS the account id (`fdp-issuer-is-account-id`) — before this fix it was
+     * the username, so account erasure could not find the sessions (which carry the visitor's IP address).
+     * The username is kept in `loggedInAs` only for logged-in sessions, as a bridge to legacy records.
+     *
+     * Never throws: the endpoint is public, so an absent/invalid token or a missing auth service
+     * (optional-auth mode, BFR-FDPPAL-001) yields an anonymous `'unknown'` owner.
+     *
+     * @param req the incoming request
+     * @returns the resolved owner
+     */
+    getSessionOwnerFromRequest(req: Request): DyNTS_UsageSessionOwner;
 }
 //# sourceMappingURL=usage.controller.d.ts.map

package/build/_modules/usage/usage.controller.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"usage.controller.d.ts","sourceRoot":"","sources":["../../../src/_modules/usage/usage.controller.ts"],"names":[],"mappings":"AAaA,OAAO,EAAE,gBAAgB,EAAE,MAAM,0CAA0C,CAAC;AAG5E,qBAAa,sBAAuB,SAAQ,gBAAgB;IAE1D,MAAM,CAAC,WAAW,IAAI,sBAAsB;IAK5C,OAAO,CAAC,WAAW,CAAoB;IAEvC,cAAc,IAAI,IAAI;CAiHvB"}
+{"version":3,"file":"usage.controller.d.ts","sourceRoot":"","sources":["../../../src/_modules/usage/usage.controller.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,OAAO,EAAY,MAAM,SAAS,CAAC;AAY5C,OAAO,EAAE,gBAAgB,EAAE,MAAM,0CAA0C,CAAC;AAC5E,OAAO,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAG1E,qBAAa,sBAAuB,SAAQ,gBAAgB;IAE1D,MAAM,CAAC,WAAW,IAAI,sBAAsB;IAK5C,OAAO,CAAC,WAAW,CAAoB;IAEvC,cAAc,IAAI,IAAI;IA8GtB;;;;;;;;;;;;OAYG;IACH,0BAA0B,CAAC,GAAG,EAAE,OAAO,GAAG,uBAAuB;CA4BlE"}

package/build/_modules/usage/usage.controller.js

@@ -22,18 +22,14 @@ class DyNTS_Usage_Controller extends controller_service_1.DyNTS_Controller {
                 endpoint: usage_1.DyFM_usageModule_settings.endPoints.newSession,
                 tasks: [
                     async (req, res, issuer) => {
-                        let username;
-                        try {
-                            // BFR-FDPPAL-001: optional-auth módban nincs auth service — a session issuer ilyenkor 'unknown'
-                            username = this.authService?.getUsernameFromRequest(req) ?? 'unknown';
-                        }
-                        catch {
-                            username = 'unknown';
-                        }
+                        // BFR-FUTDEVPRO-015 / `fdp-issuer-is-account-id`: the session owner is the ACCOUNT ID —
+                        // the session stores the IP address, so account erasure must be able to find it by accountId.
+                        const owner = this.getSessionOwnerFromRequest(req);
                         const usageService = new usage_data_service_1.DyNTS_Usage_DataService({
                             usageSession: new usage_1.DyFM_UsageSession({
                                 sessionStart: new Date(),
-                                issuer: username,
+                                issuer: owner.accountId,
+                                loggedInAs: owner.username,
                             }),
                             issuer,
                         });
@@ -101,6 +97,43 @@ class DyNTS_Usage_Controller extends controller_service_1.DyNTS_Controller {
                 'the protected "getUsageData" endpoint is SKIPPED; session endpoints remain available.');
         }
     }
+    /**
+     * Resolves the owner of a new usage session (BFR-FUTDEVPRO-015).
+     *
+     * The `issuer` of a session is ALWAYS the account id (`fdp-issuer-is-account-id`) — before this fix it was
+     * the username, so account erasure could not find the sessions (which carry the visitor's IP address).
+     * The username is kept in `loggedInAs` only for logged-in sessions, as a bridge to legacy records.
+     *
+     * Never throws: the endpoint is public, so an absent/invalid token or a missing auth service
+     * (optional-auth mode, BFR-FDPPAL-001) yields an anonymous `'unknown'` owner.
+     *
+     * @param req the incoming request
+     * @returns the resolved owner
+     */
+    getSessionOwnerFromRequest(req) {
+        let accountId;
+        try {
+            accountId = this.authService?.getIssuerFromRequest(req);
+        }
+        catch {
+            accountId = undefined;
+        }
+        if (!accountId) {
+            return { accountId: 'unknown' };
+        }
+        let username;
+        try {
+            username = this.authService?.getUsernameFromRequest(req);
+        }
+        catch {
+            username = undefined;
+        }
+        // the default auth service answers 'anonymous' when there is no username — that is not a username
+        if (!username || username === 'anonymous' || username === 'unknown') {
+            username = undefined;
+        }
+        return { accountId: accountId, username: username };
+    }
 }
 exports.DyNTS_Usage_Controller = DyNTS_Usage_Controller;
 //# sourceMappingURL=usage.controller.js.map

package/build/_modules/usage/usage.controller.js.map

@@ -1 +1 @@
-{"version":3,"file":"usage.controller.js","sourceRoot":"","sources":["../../../src/_modules/usage/usage.controller.ts"],"names":[],"mappings":";;;AAGA,sDAAuF;AACvF,uDAEqC;AAErC,8GAEoE;AAEpE,wEAA0E;AAC1E,iFAA4E;AAC5E,6DAA+D;AAE/D,MAAa,sBAAuB,SAAQ,qCAAgB;IAE1D,MAAM,CAAC,WAAW;QAChB,OAAO,sBAAsB,CAAC,oBAAoB,EAAE,CAAC;IACvD,CAAC;IAED,WAAW;IACH,WAAW,CAAoB;IAEvC,cAAc;QACZ,IAAI,CAAC,WAAW,GAAG,oCAAmB,CAAC,cAAc,EAAE,CAAC;QAExD,IAAI,CAAC,SAAS,GAAG;YACf,IAAI,qDAAqB,CAAC;gBACxB,IAAI,EAAE,YAAY;gBAClB,IAAI,EAAE,8BAAiB,CAAC,GAAG;gBAC3B,QAAQ,EAAE,iCAAyB,CAAC,SAAS,CAAC,UAAU;gBACxD,KAAK,EAAE;oBACL,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,MAAc,EAAiB,EAAE;wBACnE,IAAI,QAAgB,CAAC;wBAErB,IAAI,CAAC;4BACH,gGAAgG;4BAChG,QAAQ,GAAG,IAAI,CAAC,WAAW,EAAE,sBAAsB,CAAC,GAAG,CAAC,IAAI,SAAS,CAAC;wBACxE,CAAC;wBAAC,MAAM,CAAC;4BACP,QAAQ,GAAG,SAAS,CAAC;wBACvB,CAAC;wBACD,MAAM,YAAY,GAAG,IAAI,4CAAuB,CAAC;4BAC/C,YAAY,EAAE,IAAI,yBAAiB,CAAC;gCAClC,YAAY,EAAE,IAAI,IAAI,EAAE;gCACxB,MAAM,EAAE,QAAQ;6BACjB,CAAC;4BACF,MAAM;yBACP,CAAC,CAAC;wBAEH,MAAM,YAAY,CAAC,0BAA0B,CAAC,GAAG,CAAC,CAAC;wBACnD,MAAM,YAAY,CAAC,QAAQ,EAAE,CAAC;wBAE9B,GAAG,CAAC,IAAI,CACN,YAAY,CAAC,IAAI,CAClB,CAAC;oBACJ,CAAC;iBACF;aACF,CAAC;YAEF,IAAI,qDAAqB,CAAC;gBACxB,IAAI,EAAE,aAAa;gBACnB,IAAI,EAAE,8BAAiB,CAAC,IAAI;gBAC5B,QAAQ,EAAE,iCAAyB,CAAC,SAAS,CAAC,WAAW;gBACzD,KAAK,EAAE;oBACL,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,MAAc,EAAiB,EAAE;wBACnE,MAAM,YAAY,GAAG,IAAI,4CAAuB,CAAC;4BAC/C,YAAY,EAAE,EAAE,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC,SAAS,EAAE;4BAC3C,SAAS,EAAE,GAAG,CAAC,IAAI;4BACnB,MAAM;yBACP,CAAC,CAAC;wBAEH,MAAM,YAAY,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;wBAExC,GAAG,CAAC,IAAI,CACN,YAAY,CAAC,IAAI,CAClB,CAAC;oBACJ,CAAC;iBACF;aACF,CAAC;YAEF,IAAI,qDAAqB,CAAC;gBACxB,IAAI,EAAE,cAAc;gBACpB,IAAI,EAAE,8BAAiB,CAAC,GAAG;gBAC3B,QAAQ,EAAE,iCAAyB,CAAC,SAAS,CAAC,YAAY;gBAC1D,KAAK,EAAE;oBACL,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,MAAc,EAAiB,EAAE;wBACnE,MAAM,YAAY,GAAG,IAAI,4CAAuB,CAAC;4BAC/C,YAAY,EAAE,EAAE,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC,SAAS,EAAE;4BAC3C,MAAM;yBACP,CAAC,CAAC;wBAEH,MAAM,YAAY,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;wBAErC,GAAG,CAAC,IAAI,CACN,YAAY,CAAC,IAAI,CAClB,CAAC;oBACJ,CAAC;iBACF;aACF,CAAC;SAEH,CAAC;QAEF,6FAA6F;QAC7F,+FAA+F;QAC/F,2FAA2F;QAC3F,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACrB,IAAI,CAAC,SAAS,CAAC,IAAI,CACjB,IAAI,qDAAqB,CAAC;gBACxB,IAAI,EAAE,cAAc;gBACpB,IAAI,EAAE,8BAAiB,CAAC,GAAG;gBAC3B,QAAQ,EAAE,iCAAyB,CAAC,SAAS,CAAC,YAAY;gBAC1D,YAAY,EAAE,CAAE,IAAI,CAAC,WAAW,CAAC,mCAAmC,CAAE;gBACtE,KAAK,EAAE;oBACL,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,MAAc,EAAiB,EAAE;wBACnE,MAAM,KAAK,GAAsB,GAAG,CAAC,MAAM,CAAC,KAA0B,CAAC;wBAEvE,MAAM,YAAY,GAAG,IAAI,4CAAuB,CAAC;4BAC/C,MAAM,EAAE,MAAM;yBACf,CAAC,CAAC;wBAEH,MAAM,YAAY,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;wBAEnC,GAAG,CAAC,IAAI,CACN,YAAY,CAAC,oBAAoB,CAClC,CAAC;oBACJ,CAAC;iBACF;aACF,CAAC,CACH,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,qBAAQ,CAAC,IAAI,CACX,iEAAiE;gBACjE,uFAAuF,CACxF,CAAC;QACJ,CAAC;IACH,CAAC;CACF;AA1HD,wDA0HC"}
+{"version":3,"file":"usage.controller.js","sourceRoot":"","sources":["../../../src/_modules/usage/usage.controller.ts"],"names":[],"mappings":";;;AAGA,sDAAuF;AACvF,uDAEqC;AAErC,8GAEoE;AAEpE,wEAA0E;AAC1E,iFAA4E;AAE5E,6DAA+D;AAE/D,MAAa,sBAAuB,SAAQ,qCAAgB;IAE1D,MAAM,CAAC,WAAW;QAChB,OAAO,sBAAsB,CAAC,oBAAoB,EAAE,CAAC;IACvD,CAAC;IAED,WAAW;IACH,WAAW,CAAoB;IAEvC,cAAc;QACZ,IAAI,CAAC,WAAW,GAAG,oCAAmB,CAAC,cAAc,EAAE,CAAC;QAExD,IAAI,CAAC,SAAS,GAAG;YACf,IAAI,qDAAqB,CAAC;gBACxB,IAAI,EAAE,YAAY;gBAClB,IAAI,EAAE,8BAAiB,CAAC,GAAG;gBAC3B,QAAQ,EAAE,iCAAyB,CAAC,SAAS,CAAC,UAAU;gBACxD,KAAK,EAAE;oBACL,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,MAAc,EAAiB,EAAE;wBACnE,wFAAwF;wBACxF,8FAA8F;wBAC9F,MAAM,KAAK,GAA4B,IAAI,CAAC,0BAA0B,CAAC,GAAG,CAAC,CAAC;wBAC5E,MAAM,YAAY,GAAG,IAAI,4CAAuB,CAAC;4BAC/C,YAAY,EAAE,IAAI,yBAAiB,CAAC;gCAClC,YAAY,EAAE,IAAI,IAAI,EAAE;gCACxB,MAAM,EAAE,KAAK,CAAC,SAAS;gCACvB,UAAU,EAAE,KAAK,CAAC,QAAQ;6BAC3B,CAAC;4BACF,MAAM;yBACP,CAAC,CAAC;wBAEH,MAAM,YAAY,CAAC,0BAA0B,CAAC,GAAG,CAAC,CAAC;wBACnD,MAAM,YAAY,CAAC,QAAQ,EAAE,CAAC;wBAE9B,GAAG,CAAC,IAAI,CACN,YAAY,CAAC,IAAI,CAClB,CAAC;oBACJ,CAAC;iBACF;aACF,CAAC;YAEF,IAAI,qDAAqB,CAAC;gBACxB,IAAI,EAAE,aAAa;gBACnB,IAAI,EAAE,8BAAiB,CAAC,IAAI;gBAC5B,QAAQ,EAAE,iCAAyB,CAAC,SAAS,CAAC,WAAW;gBACzD,KAAK,EAAE;oBACL,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,MAAc,EAAiB,EAAE;wBACnE,MAAM,YAAY,GAAG,IAAI,4CAAuB,CAAC;4BAC/C,YAAY,EAAE,EAAE,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC,SAAS,EAAE;4BAC3C,SAAS,EAAE,GAAG,CAAC,IAAI;4BACnB,MAAM;yBACP,CAAC,CAAC;wBAEH,MAAM,YAAY,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;wBAExC,GAAG,CAAC,IAAI,CACN,YAAY,CAAC,IAAI,CAClB,CAAC;oBACJ,CAAC;iBACF;aACF,CAAC;YAEF,IAAI,qDAAqB,CAAC;gBACxB,IAAI,EAAE,cAAc;gBACpB,IAAI,EAAE,8BAAiB,CAAC,GAAG;gBAC3B,QAAQ,EAAE,iCAAyB,CAAC,SAAS,CAAC,YAAY;gBAC1D,KAAK,EAAE;oBACL,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,MAAc,EAAiB,EAAE;wBACnE,MAAM,YAAY,GAAG,IAAI,4CAAuB,CAAC;4BAC/C,YAAY,EAAE,EAAE,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC,SAAS,EAAE;4BAC3C,MAAM;yBACP,CAAC,CAAC;wBAEH,MAAM,YAAY,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;wBAErC,GAAG,CAAC,IAAI,CACN,YAAY,CAAC,IAAI,CAClB,CAAC;oBACJ,CAAC;iBACF;aACF,CAAC;SAEH,CAAC;QAEF,6FAA6F;QAC7F,+FAA+F;QAC/F,2FAA2F;QAC3F,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACrB,IAAI,CAAC,SAAS,CAAC,IAAI,CACjB,IAAI,qDAAqB,CAAC;gBACxB,IAAI,EAAE,cAAc;gBACpB,IAAI,EAAE,8BAAiB,CAAC,GAAG;gBAC3B,QAAQ,EAAE,iCAAyB,CAAC,SAAS,CAAC,YAAY;gBAC1D,YAAY,EAAE,CAAE,IAAI,CAAC,WAAW,CAAC,mCAAmC,CAAE;gBACtE,KAAK,EAAE;oBACL,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,MAAc,EAAiB,EAAE;wBACnE,MAAM,KAAK,GAAsB,GAAG,CAAC,MAAM,CAAC,KAA0B,CAAC;wBAEvE,MAAM,YAAY,GAAG,IAAI,4CAAuB,CAAC;4BAC/C,MAAM,EAAE,MAAM;yBACf,CAAC,CAAC;wBAEH,MAAM,YAAY,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;wBAEnC,GAAG,CAAC,IAAI,CACN,YAAY,CAAC,oBAAoB,CAClC,CAAC;oBACJ,CAAC;iBACF;aACF,CAAC,CACH,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,qBAAQ,CAAC,IAAI,CACX,iEAAiE;gBACjE,uFAAuF,CACxF,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;OAYG;IACH,0BAA0B,CAAC,GAAY;QACrC,IAAI,SAA6B,CAAC;QAElC,IAAI,CAAC;YACH,SAAS,GAAG,IAAI,CAAC,WAAW,EAAE,oBAAoB,CAAC,GAAG,CAAC,CAAC;QAC1D,CAAC;QAAC,MAAM,CAAC;YACP,SAAS,GAAG,SAAS,CAAC;QACxB,CAAC;QAED,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;QAClC,CAAC;QAED,IAAI,QAA4B,CAAC;QAEjC,IAAI,CAAC;YACH,QAAQ,GAAG,IAAI,CAAC,WAAW,EAAE,sBAAsB,CAAC,GAAG,CAAC,CAAC;QAC3D,CAAC;QAAC,MAAM,CAAC;YACP,QAAQ,GAAG,SAAS,CAAC;QACvB,CAAC;QAED,kGAAkG;QAClG,IAAI,CAAC,QAAQ,IAAI,QAAQ,KAAK,WAAW,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YACpE,QAAQ,GAAG,SAAS,CAAC;QACvB,CAAC;QAED,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;IACtD,CAAC;CACF;AAhKD,wDAgKC"}

package/build/_modules/usage/usage.data-service.d.ts

@@ -1,7 +1,8 @@
 import { Request } from 'express';
-import { DyFM_RelativeDate } from '@futdevpro/fsm-dynamo';
+import { DyFM_DBFilter, DyFM_RelativeDate } from '@futdevpro/fsm-dynamo';
 import { DyFM_DailyUsageData, DyFM_UsageData, DyFM_UsageSession } from '@futdevpro/fsm-dynamo/usage';
 import { DyNTS_DataService } from '../../_services/base/data.service';
+import { DyNTS_UsageSession_AccountQuery } from './usage-session-account-query.interface';
 export declare class DyNTS_Usage_DataService extends DyNTS_DataService<DyFM_UsageSession> {
     usageData: DyFM_UsageData[];
     simplifiedDailyUsage: DyFM_DailyUsageData[];
@@ -11,6 +12,45 @@ export declare class DyNTS_Usage_DataService extends DyNTS_DataService<DyFM_Usag
         issuer: string;
     });
     getLocationDataFromRequest(req: Request): void;
+    /**
+     * Builds the filter that matches every session of one account (BFR-FUTDEVPRO-015, `L-24`):
+     * - `issuer === accountId` — sessions since 1.15.320;
+     * - `issuer === <username>` — legacy sessions (before 1.15.320 the username was the issuer);
+     * - `loggedInAs === <username>` — sessions carrying the username as bridge.
+     *
+     * FAIL-CLOSED: throws on a missing / placeholder `accountId`, and silently drops placeholder usernames —
+     * `'unknown'` / `'anonymous'` is shared by all anonymous sessions and must never become a match key.
+     *
+     * @param set the account and its known usernames
+     * @returns a DB filter (`$or`)
+     */
+    static getAccountSessionFilter(set: DyNTS_UsageSession_AccountQuery): DyFM_DBFilter<DyFM_UsageSession>;
+    /**
+     * Lists every session of one account — including soft-deleted ones (data-subject access / export).
+     *
+     * @param set the account and its known usernames
+     * @returns the sessions (they contain the IP address and location)
+     */
+    findSessionsOfAccount(set: DyNTS_UsageSession_AccountQuery): Promise<DyFM_UsageSession[]>;
+    /**
+     * HARD-deletes every session of one account (account erasure, `L-24`) — the sessions hold the IP
+     * address, so a soft delete is not enough.
+     *
+     * @param set the account and its known usernames
+     * @returns the number of deleted sessions
+     */
+    deleteSessionsOfAccount(set: DyNTS_UsageSession_AccountQuery): Promise<number>;
+    /**
+     * One-off migration of legacy sessions (before 1.15.320) to the account id: every session whose `issuer`
+     * is the given username gets `issuer: accountId` and `loggedInAs: username`. Idempotent.
+     * Run it per account, from a source that maps username → accountId (e.g. the user collection).
+     *
+     * @param set the account id and the username it used to be recorded under
+     */
+    relinkLegacySessions(set: {
+        accountId: string;
+        username: string;
+    }): Promise<void>;
     getUsage(range?: DyFM_RelativeDate): Promise<void>;
     updateUsageData(req: Request): Promise<void>;
     closeSession(req: Request): Promise<void>;

package/build/_modules/usage/usage.data-service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"usage.data-service.d.ts","sourceRoot":"","sources":["../../../src/_modules/usage/usage.data-service.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAElC,OAAO,EAAc,iBAAiB,EAAa,MAAM,uBAAuB,CAAC;AACjF,OAAO,EACL,mBAAmB,EACnB,cAAc,EACd,iBAAiB,EAClB,MAAM,6BAA6B,CAAC;AAGrC,OAAO,EAAE,iBAAiB,EAAE,MAAM,mCAAmC,CAAC;AAGtE,qBAAa,uBAAwB,SAAQ,iBAAiB,CAAC,iBAAiB,CAAC;IAC/E,SAAS,EAAE,cAAc,EAAE,CAAM;IACjC,oBAAoB,EAAE,mBAAmB,EAAE,CAAM;gBAG/C,GAAG,EAAE;QACH,YAAY,CAAC,EAAE,iBAAiB,CAAC;QACjC,SAAS,CAAC,EAAE,cAAc,EAAE,CAAC;QAC7B,MAAM,EAAE,MAAM,CAAC;KAChB;IAUH,0BAA0B,CAAC,GAAG,EAAE,OAAO,GAAG,IAAI;IAgBxC,QAAQ,CAAC,KAAK,GAAE,iBAA8C,GAAG,OAAO,CAAC,IAAI,CAAC;IA4D9E,eAAe,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC;IAuC5C,YAAY,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC;CAqChD"}
+{"version":3,"file":"usage.data-service.d.ts","sourceRoot":"","sources":["../../../src/_modules/usage/usage.data-service.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAElC,OAAO,EAAE,aAAa,EAAc,iBAAiB,EAAa,MAAM,uBAAuB,CAAC;AAChG,OAAO,EACL,mBAAmB,EACnB,cAAc,EACd,iBAAiB,EAClB,MAAM,6BAA6B,CAAC;AAGrC,OAAO,EAAE,iBAAiB,EAAE,MAAM,mCAAmC,CAAC;AAEtE,OAAO,EAAE,+BAA+B,EAAE,MAAM,yCAAyC,CAAC;AAQ1F,qBAAa,uBAAwB,SAAQ,iBAAiB,CAAC,iBAAiB,CAAC;IAC/E,SAAS,EAAE,cAAc,EAAE,CAAM;IACjC,oBAAoB,EAAE,mBAAmB,EAAE,CAAM;gBAG/C,GAAG,EAAE;QACH,YAAY,CAAC,EAAE,iBAAiB,CAAC;QACjC,SAAS,CAAC,EAAE,cAAc,EAAE,CAAC;QAC7B,MAAM,EAAE,MAAM,CAAC;KAChB;IAUH,0BAA0B,CAAC,GAAG,EAAE,OAAO,GAAG,IAAI;IAgB9C;;;;;;;;;;;OAWG;IACH,MAAM,CAAC,uBAAuB,CAAC,GAAG,EAAE,+BAA+B,GAAG,aAAa,CAAC,iBAAiB,CAAC;IA6BtG;;;;;OAKG;IACG,qBAAqB,CAAC,GAAG,EAAE,+BAA+B,GAAG,OAAO,CAAC,iBAAiB,EAAE,CAAC;IAe/F;;;;;;OAMG;IACG,uBAAuB,CAAC,GAAG,EAAE,+BAA+B,GAAG,OAAO,CAAC,MAAM,CAAC;IAmBpF;;;;;;OAMG;IACG,oBAAoB,CAAC,GAAG,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAiCjF,QAAQ,CAAC,KAAK,GAAE,iBAA8C,GAAG,OAAO,CAAC,IAAI,CAAC;IA4D9E,eAAe,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC;IAuC5C,YAAY,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC;CAqChD"}