@marinoscar/platform-api 0.0.0-stage → 0.1.0-next.11

package/dist/identity/users/users.service.js

@@ -0,0 +1,482 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+var UsersService_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.UsersService = void 0;
+const common_1 = require("@nestjs/common");
+const config_1 = require("@nestjs/config");
+const index_1 = require("../../core/index");
+const identity_constants_1 = require("../identity.constants");
+const identity_options_1 = require("../identity.options");
+const ports_1 = require("../ports");
+const principal_cache_service_1 = require("../auth/principal-cache/principal-cache.service");
+const principal_factory_1 = require("../auth/principal.factory");
+const organizations_errors_1 = require("../organizations/organizations.errors");
+const role_catalog_1 = require("../roles/role-catalog");
+const user_extensions_1 = require("../extensions/user-extensions");
+/**
+ * What the users endpoints load for a user's roles (PP-6.3, #723): the system
+ * roles and every membership with its org role, so `roles` can combine them
+ * through `PrincipalFactory` exactly as `/api/auth/me` does.
+ */
+const USER_ROLES_INCLUDE = {
+    userRoles: {
+        include: { role: true },
+    },
+    memberships: {
+        include: {
+            org: { select: { id: true, isDefault: true } },
+            role: true,
+        },
+    },
+};
+/**
+ * Precedence among org roles when a request names several, highest first.
+ * Any other org role (an app's own) ranks below these, in request order.
+ */
+const ORG_ROLE_PRECEDENCE = [
+    identity_constants_1.ORG_ADMIN_ROLE,
+    identity_constants_1.ROLES.CONTRIBUTOR,
+    identity_constants_1.ROLES.VIEWER,
+];
+/** Where org roles are managed in multi-org mode (PP-6.8, #726). */
+const ORG_ROLES_ELSEWHERE = 'are organization roles. In multi-organization mode this endpoint changes system roles only ' +
+    `(${identity_constants_1.ROLES.ADMIN}); manage organization roles through the organization member endpoints ` +
+    '(/api/orgs/:orgId/members).';
+/**
+ * Exported for the reference app's wiring and tests; not a stable extension point (reach identity through IdentityModule and its documented seams).
+ *
+ * @internal
+ */
+let UsersService = UsersService_1 = class UsersService {
+    prisma;
+    notifications;
+    config;
+    principalCache;
+    profileImages;
+    identityOptions;
+    logger = new common_1.Logger(UsersService_1.name);
+    constructor(prisma, notifications, config, 
+    // PP-1.12 (#683): every write here changes what the user's JWT resolves to.
+    principalCache, profileImages, identityOptions = identity_options_1.DEFAULT_IDENTITY_OPTIONS) {
+        this.prisma = prisma;
+        this.notifications = notifications;
+        this.config = config;
+        this.principalCache = principalCache;
+        this.profileImages = profileImages;
+        this.identityOptions = identityOptions;
+    }
+    /**
+     * List users with pagination and filtering
+     */
+    async listUsers(query, requester) {
+        const { page, pageSize, search, role, isActive, sortBy, sortOrder } = query;
+        const skip = (page - 1) * pageSize;
+        // Build where clause
+        const where = {};
+        if (search) {
+            where.OR = [
+                { email: { contains: search, mode: 'insensitive' } },
+                { displayName: { contains: search, mode: 'insensitive' } },
+                { providerDisplayName: { contains: search, mode: 'insensitive' } },
+            ];
+        }
+        if (role) {
+            // A system role is in `user_roles`; an org role on an active membership
+            // (PP-6.3, #723).
+            // ANDed, so it composes with the search `OR` above.
+            where.AND = [
+                {
+                    OR: [
+                        { userRoles: { some: { role: { name: role } } } },
+                        { memberships: { some: { status: 'active', role: { name: role } } } },
+                    ],
+                },
+            ];
+        }
+        if (isActive !== undefined) {
+            where.isActive = isActive;
+        }
+        // Execute query
+        const [items, total] = await Promise.all([
+            this.prisma.user.findMany({
+                where,
+                skip,
+                take: pageSize,
+                orderBy: { [sortBy]: sortOrder },
+                include: {
+                    ...USER_ROLES_INCLUDE,
+                    // Same query, no N+1: needed to resolve `profileImageUrl` (#367).
+                    userSettings: {
+                        select: { value: true },
+                    },
+                },
+            }),
+            this.prisma.user.count({ where }),
+        ]);
+        // PP-14.25: the app's user-list extensions, each called ONCE for the whole
+        // page (never per row) and isolated: a failing one is skipped and logged.
+        const extensions = await (0, user_extensions_1.resolveUserListExtensions)(items.map((user) => user.id), { viewerId: requester?.viewerId ?? null, orgId: requester?.orgId ?? null });
+        // Transform to response format
+        const transformedItems = items.map((user) => ({
+            id: user.id,
+            email: user.email,
+            displayName: user.displayName,
+            providerDisplayName: user.providerDisplayName,
+            profileImageUrl: this.resolveImage(user),
+            providerProfileImageUrl: user.providerProfileImageUrl,
+            isActive: user.isActive,
+            roles: this.roleNames(user),
+            createdAt: user.createdAt,
+            updatedAt: user.updatedAt,
+            ...(extensions.has(user.id) ? { extensions: extensions.get(user.id) } : {}),
+        }));
+        return {
+            items: transformedItems,
+            total,
+            page,
+            pageSize,
+            totalPages: Math.ceil(total / pageSize),
+        };
+    }
+    /**
+     * Get user by ID
+     */
+    async getUserById(id) {
+        const user = await this.prisma.user.findUnique({
+            where: { id },
+            include: {
+                ...USER_ROLES_INCLUDE,
+                identities: {
+                    select: {
+                        provider: true,
+                        providerEmail: true,
+                        createdAt: true,
+                    },
+                },
+                userSettings: {
+                    select: { value: true },
+                },
+            },
+        });
+        if (!user) {
+            throw new common_1.NotFoundException(`User with ID ${id} not found`);
+        }
+        return {
+            id: user.id,
+            email: user.email,
+            displayName: user.displayName,
+            providerDisplayName: user.providerDisplayName,
+            profileImageUrl: this.resolveImage(user),
+            providerProfileImageUrl: user.providerProfileImageUrl,
+            isActive: user.isActive,
+            roles: this.roleNames(user),
+            identities: user.identities,
+            createdAt: user.createdAt,
+            updatedAt: user.updatedAt,
+        };
+    }
+    /**
+     * Update user (admin actions)
+     */
+    async updateUser(id, dto, adminUserId) {
+        // Prevent admin from deactivating themselves
+        if (dto.isActive === false && id === adminUserId) {
+            throw new common_1.ForbiddenException('Cannot deactivate your own account');
+        }
+        const user = await this.prisma.user.findUnique({ where: { id } });
+        if (!user) {
+            throw new common_1.NotFoundException(`User with ID ${id} not found`);
+        }
+        const updated = await this.prisma.user.update({
+            where: { id },
+            data: {
+                displayName: dto.displayName,
+                isActive: dto.isActive,
+            },
+            include: {
+                ...USER_ROLES_INCLUDE,
+                userSettings: {
+                    select: { value: true },
+                },
+            },
+        });
+        // Principal cache (PP-1.12, #683): ALWAYS, after the write committed —
+        // cheap, and it is what makes `isActive: false` reject the user's very
+        // next request (on this replica now, on others within bus latency).
+        this.principalCache.invalidateUser(id);
+        // Log audit event
+        await this.createAuditEvent(adminUserId, 'user:update', 'user', id, {
+            changes: dto,
+        });
+        this.logger.log(`User ${id} updated by admin ${adminUserId}`);
+        return {
+            id: updated.id,
+            email: updated.email,
+            displayName: updated.displayName,
+            providerDisplayName: updated.providerDisplayName,
+            profileImageUrl: this.resolveImage(updated),
+            providerProfileImageUrl: updated.providerProfileImageUrl,
+            isActive: updated.isActive,
+            roles: this.roleNames(updated),
+            createdAt: updated.createdAt,
+            updatedAt: updated.updatedAt,
+        };
+    }
+    /**
+     * Update user roles.
+     *
+     * The body keeps its pre-split shape (`roleNames` from `admin`,
+     * `contributor`, `viewer`); what it changes depends on the tenancy mode
+     * (PP-6.3, #723):
+     *
+     * - **single:** the system roles named become the user's `user_roles`
+     *   (`admin` toggles the system administrator), and the default-org
+     *   membership role becomes `org_admin` when `admin` is named, otherwise the
+     *   highest org role named (`contributor` above `viewer`), otherwise the default
+     *   org role. So `['admin']` is an administrator, `['contributor']` a
+     *   contributor with no system role.
+     * - **multi:** system roles only. An org role name is a 400 pointing to the
+     *   organization member endpoints (#726); memberships are not touched.
+     */
+    async updateUserRoles(id, dto, adminUserId) {
+        // Prevent admin from removing their own admin role
+        if (id === adminUserId && !dto.roleNames.includes(identity_constants_1.ROLES.ADMIN)) {
+            throw new common_1.ForbiddenException('Cannot remove admin role from yourself');
+        }
+        // The roles held BEFORE the change are read here, in the lookup that was
+        // already happening, because they are gone the moment the transaction
+        // below runs — `deleteMany` then `createMany` replaces the set wholesale.
+        // `security.role_changed` reports a DELTA (see role-changed.email.ts: "you
+        // are now a Viewer" cannot tell the reader whether they gained access or
+        // lost it), so the before-state has to be captured on this side of it.
+        const user = await this.prisma.user.findUnique({
+            where: { id },
+            include: USER_ROLES_INCLUDE,
+        });
+        if (!user) {
+            throw new common_1.NotFoundException(`User with ID ${id} not found`);
+        }
+        // System roles plus the current org role, as `/api/auth/me` shows them.
+        const previousRoles = this.roleNames(user);
+        // Validate all roles exist
+        const roles = await this.prisma.role.findMany({
+            where: { name: { in: dto.roleNames } },
+        });
+        if (roles.length !== dto.roleNames.length) {
+            const foundNames = roles.map((r) => r.name);
+            const invalid = dto.roleNames.filter((n) => !foundNames.includes(n));
+            throw new common_1.BadRequestException(`Invalid roles: ${invalid.join(', ')}`);
+        }
+        // Fail closed: every named role must be known to the registry, in the scope
+        // the database says, and not registered `assignable: false`. The database
+        // alone is not the authority on what a caller may hand out.
+        for (const role of roles)
+            (0, role_catalog_1.assertRoleAssignable)(role.name, role.scope);
+        const systemRoles = roles.filter((role) => role.scope === 'system');
+        const orgRoles = roles.filter((role) => role.scope === 'org');
+        const singleOrg = principal_factory_1.principalFactory.mode() === 'single';
+        if (!singleOrg && orgRoles.length > 0) {
+            throw new common_1.BadRequestException(`${orgRoles.map((role) => role.name).join(', ')} ${ORG_ROLES_ELSEWHERE}`);
+        }
+        // Single mode: the default-org membership role this request implies.
+        let membershipRole = null;
+        let defaultOrgId = null;
+        if (singleOrg) {
+            // An org role the application manages itself (`assignable: false`) that
+            // the user holds on the default organization is not this route's to
+            // replace with the default role when the request names no org role.
+            const heldOrgRole = (user.memberships ?? []).find((membership) => membership.org?.isDefault)?.role.name;
+            const keptOrgRole = heldOrgRole !== undefined && (0, role_catalog_1.isAppManagedRole)(heldOrgRole) ? heldOrgRole : undefined;
+            const membershipRoleName = systemRoles.some((role) => role.name === identity_constants_1.ROLES.ADMIN)
+                ? identity_constants_1.ORG_ADMIN_ROLE
+                : this.highestOrgRole(orgRoles.map((role) => role.name)) ?? keptOrgRole ?? this.identityOptions.defaultOrgRole;
+            membershipRole =
+                orgRoles.find((role) => role.name === membershipRoleName) ??
+                    (await this.prisma.role.findUnique({ where: { name: membershipRoleName } }));
+            if (!membershipRole) {
+                throw new common_1.BadRequestException(`Invalid roles: ${membershipRoleName}`);
+            }
+            // The same lookup as `OrganizationsService.getDefaultOrg` (kept local so
+            // this service's dependencies do not change).
+            const defaultOrg = await this.prisma.organization.findFirst({
+                where: { isDefault: true },
+                select: { id: true },
+            });
+            if (!defaultOrg)
+                throw new organizations_errors_1.DefaultOrganizationMissingException();
+            defaultOrgId = defaultOrg.id;
+        }
+        // System roles the application manages itself (`assignable: false`) are
+        // not this route's to remove: the set below replaces the roles it can
+        // assign, and leaves those rows alone. (They cannot be NAMED here either:
+        // the check above refuses them.)
+        const keptRoles = user.userRoles.map((row) => row.role).filter((role) => (0, role_catalog_1.isAppManagedRole)(role.name));
+        // Replace the system roles (and, in single mode, set the membership role)
+        // in one transaction.
+        await this.prisma.$transaction(async (tx) => {
+            // Remove existing roles. Every row goes, including a pre-split row of an
+            // org role: from here on org roles live on the membership.
+            await tx.userRole.deleteMany({
+                where: keptRoles.length > 0 ? { userId: id, roleId: { notIn: keptRoles.map((role) => role.id) } } : { userId: id },
+            });
+            // Add new roles
+            if (systemRoles.length > 0) {
+                await tx.userRole.createMany({
+                    data: systemRoles.map((role) => ({
+                        userId: id,
+                        roleId: role.id,
+                    })),
+                });
+            }
+            if (membershipRole && defaultOrgId) {
+                await tx.membership.upsert({
+                    where: { orgId_userId: { orgId: defaultOrgId, userId: id } },
+                    update: { roleId: membershipRole.id },
+                    create: {
+                        orgId: defaultOrgId,
+                        userId: id,
+                        roleId: membershipRole.id,
+                        lastActiveAt: new Date(),
+                    },
+                });
+            }
+        });
+        // What the user holds now, in the same terms as `previousRoles`.
+        const currentRoles = [
+            ...new Set([
+                ...systemRoles.map((role) => role.name),
+                ...keptRoles.map((role) => role.name),
+                ...(membershipRole ? [membershipRole.name] : this.currentOrgRole(user)),
+            ]),
+        ];
+        // Principal cache (PP-1.12, #683): AFTER the transaction committed, never
+        // inside it — a removed role stops authorising the next request.
+        this.principalCache.invalidateUser(id);
+        // Log audit event
+        await this.createAuditEvent(adminUserId, 'user:roles_update', 'user', id, {
+            newRoles: dto.roleNames,
+            systemRoles: systemRoles.map((role) => role.name),
+            ...(membershipRole ? { orgRole: membershipRole.name } : {}),
+        });
+        this.logger.log(`User ${id} roles updated to [${dto.roleNames.join(', ')}] by admin ${adminUserId}`);
+        // -------------------------------------------------------------------------
+        // Trigger: `security.role_changed` (#128, epic #109)
+        // -------------------------------------------------------------------------
+        //
+        // AFTER THE TRANSACTION, NOT INSIDE IT. Two independent reasons, and the
+        // first is the property the whole epic exists to prove:
+        //
+        //   1. A send failure MUST NOT roll back the role change. `notify` is
+        //      detached — it schedules the dispatch on a later microtask and
+        //      returns before anything is rendered or sent — so the dispatch does
+        //      not run inside the `$transaction` above (which has already
+        //      committed), does not share a Prisma transaction client with it, and
+        //      cannot fail it. It also never rejects: every failure below it
+        //      becomes a `notification_deliveries` row with an `error`, never an
+        //      exception reaching here.
+        //
+        //   2. It must not delay this request. `notify` returns immediately; the
+        //      admin's PATCH does not wait on a mail server. Awaiting it is still
+        //      correct and cheap — it means "scheduled", not "delivered" — and it
+        //      is awaited here only so a `no-floating-promises` rule has nothing to
+        //      complain about.
+        //
+        // MANDATORY EVENT: `security.role_changed` is `mandatory: true` in the
+        // registry, so the recipient's stored preferences are ignored by
+        // `resolveChannels` and both declared channels (email and the in-app bell)
+        // are always attempted. A privilege change nobody can see is the failure
+        // this event exists to prevent.
+        //
+        // NO SELF-SUPPRESSION. An admin who changes their OWN roles still gets the
+        // notification. Suppressing it would be a rule with no security value —
+        // the alerting case is precisely the one where the actor and the account
+        // owner are believed to be the same person and are not.
+        const payload = {
+            recipientEmail: user.email,
+            previousRoles,
+            currentRoles,
+            changedAt: new Date(),
+            appUrl: this.appUrl(),
+        };
+        // The ACTOR IS NOT IN THE PAYLOAD, deliberately — see the long note in
+        // role-changed.email.ts. `audit_events` above records who made the change,
+        // which is the controlled place for it.
+        await this.notifications.roleChanged(id, payload);
+        return this.getUserById(id);
+    }
+    /**
+     * A user's role names as the API reports them: system roles plus the
+     * current org role (`PrincipalFactory`, PP-6.3).
+     */
+    roleNames(user) {
+        return principal_factory_1.principalFactory.access(user).roles;
+    }
+    /** The current org role of a loaded user, as a 0- or 1-element list. */
+    currentOrgRole(user) {
+        const orgRole = principal_factory_1.principalFactory.access(user).orgRole;
+        return orgRole ? [orgRole] : [];
+    }
+    /** The highest-ranked org role among `names`, or `undefined` when there is none. */
+    highestOrgRole(names) {
+        const ranked = ORG_ROLE_PRECEDENCE.find((name) => names.includes(name));
+        return ranked ?? names[0];
+    }
+    /**
+     * The picture representing a user, per their `profile.imageSource` (#367).
+     * `users.profile_image_url` is deliberately not consulted — nothing writes it.
+     */
+    resolveImage(user) {
+        const storedProfile = user.userSettings?.value?.profile;
+        return this.profileImages.resolveImageUrl(user, storedProfile);
+    }
+    /**
+     * Absolute URL of the application root, for a notification's CTA.
+     *
+     * Built here rather than in the template, which is a pure function of its
+     * input and has no business reading configuration. `undefined` when
+     * `APP_URL` is unset: the layout then omits the button rather than rendering
+     * one that goes nowhere.
+     */
+    appUrl() {
+        const appUrl = this.config.get('appUrl');
+        return appUrl ? appUrl.replace(/\/+$/, '') : undefined;
+    }
+    /**
+     * Create audit event
+     */
+    async createAuditEvent(actorUserId, action, targetType, targetId, meta) {
+        await this.prisma.auditEvent.create({
+            data: {
+                actorUserId,
+                action,
+                targetType,
+                targetId,
+                meta: meta,
+            },
+        });
+    }
+};
+exports.UsersService = UsersService;
+exports.UsersService = UsersService = UsersService_1 = __decorate([
+    (0, common_1.Injectable)(),
+    __param(0, (0, common_1.Inject)(index_1.PLATFORM_PRISMA)),
+    __param(1, (0, common_1.Inject)(ports_1.IDENTITY_NOTIFIER)),
+    __param(4, (0, common_1.Inject)(ports_1.IDENTITY_PROFILE_IMAGES)),
+    __param(5, (0, common_1.Optional)()),
+    __param(5, (0, common_1.Inject)(identity_options_1.IDENTITY_OPTIONS)),
+    __metadata("design:paramtypes", [Object, Object, config_1.ConfigService,
+        principal_cache_service_1.PrincipalCache, Object, Object])
+], UsersService);
+//# sourceMappingURL=users.service.js.map

package/dist/identity/users/users.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"users.service.js","sourceRoot":"","sources":["../../../src/identity/users/users.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,2CAQwB;AACxB,2CAA+C;AAC/C,4CAAmD;AAMnD,8DAG+B;AAC/B,0DAAqH;AACrH,oCAMkB;AAClB,6FAAiF;AACjF,iEAA6D;AAC7D,gFAA4F;AAC5F,wDAA+E;AAC/E,mEAA0E;AAE1E;;;;GAIG;AACH,MAAM,kBAAkB,GAAG;IACzB,SAAS,EAAE;QACT,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE;KACxB;IACD,WAAW,EAAE;QACX,OAAO,EAAE;YACP,GAAG,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE;YAC9C,IAAI,EAAE,IAAI;SACX;KACF;CACO,CAAC;AAWX;;;GAGG;AACH,MAAM,mBAAmB,GAAsB;IAC7C,mCAAc;IACd,0BAAK,CAAC,WAAW;IACjB,0BAAK,CAAC,MAAM;CACb,CAAC;AAEF,oEAAoE;AACpE,MAAM,mBAAmB,GACvB,6FAA6F;IAC7F,IAAI,0BAAK,CAAC,KAAK,yEAAyE;IACxF,6BAA6B,CAAC;AAEhC;;;;GAIG;AAEI,IAAM,YAAY,oBAAlB,MAAM,YAAY;IAIqB;IACE;IAC3B;IAEA;IAEiC;IAEjC;IAXF,MAAM,GAAG,IAAI,eAAM,CAAC,cAAY,CAAC,IAAI,CAAC,CAAC;IAExD,YAC4C,MAAsB,EACpB,aAA+B,EAC1D,MAAqB;IACtC,4EAA4E;IAC3D,cAA8B,EAEG,aAAoC,EAErE,kBAAiD,2CAAwB;QARhD,WAAM,GAAN,MAAM,CAAgB;QACpB,kBAAa,GAAb,aAAa,CAAkB;QAC1D,WAAM,GAAN,MAAM,CAAe;QAErB,mBAAc,GAAd,cAAc,CAAgB;QAEG,kBAAa,GAAb,aAAa,CAAuB;QAErE,oBAAe,GAAf,eAAe,CAA0D;IACzF,CAAC;IAEJ;;OAEG;IACH,KAAK,CAAC,SAAS,CAAC,KAAuB,EAAE,SAA6D;QACpG,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,KAAK,CAAC;QAC5E,MAAM,IAAI,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC,GAAG,QAAQ,CAAC;QAEnC,qBAAqB;QACrB,MAAM,KAAK,GAAQ,EAAE,CAAC;QAEtB,IAAI,MAAM,EAAE,CAAC;YACX,KAAK,CAAC,EAAE,GAAG;gBACT,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE;gBACpD,EAAE,WAAW,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE;gBAC1D,EAAE,mBAAmB,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE;aACnE,CAAC;QACJ,CAAC;QAED,IAAI,IAAI,EAAE,CAAC;YACT,wEAAwE;YACxE,kBAAkB;YAClB,oDAAoD;YACpD,KAAK,CAAC,GAAG,GAAG;gBACV;oBACE,EAAE,EAAE;wBACF,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE;wBACjD,EAAE,WAAW,EAAE,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE;qBACtE;iBACF;aACF,CAAC;QACJ,CAAC;QAED,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,KAAK,CAAC,QAAQ,GAAG,QAAQ,CAAC;QAC5B,CAAC;QAED,gBAAgB;QAChB,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YACvC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAmB;gBAC1C,KAAK;gBACL,IAAI;gBACJ,IAAI,EAAE,QAAQ;gBACd,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE;gBAChC,OAAO,EAAE;oBACP,GAAG,kBAAkB;oBACrB,kEAAkE;oBAClE,YAAY,EAAE;wBACZ,MAAM,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE;qBACxB;iBACF;aACF,CAAC;YACF,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,CAAC;SAClC,CAAC,CAAC;QAEH,2EAA2E;QAC3E,0EAA0E;QAC1E,MAAM,UAAU,GAAG,MAAM,IAAA,2CAAyB,EAChD,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAC5B,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,IAAI,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,IAAI,IAAI,EAAE,CAC3E,CAAC;QAEF,+BAA+B;QAC/B,MAAM,gBAAgB,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YAC5C,EAAE,EAAE,IAAI,CAAC,EAAE;YACX,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;YAC7C,eAAe,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC;YACxC,uBAAuB,EAAE,IAAI,CAAC,uBAAuB;YACrD,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;YAC3B,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC5E,CAAC,CAAC,CAAC;QAEJ,OAAO;YACL,KAAK,EAAE,gBAAgB;YACvB,KAAK;YACL,IAAI;YACJ,QAAQ;YACR,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,GAAG,QAAQ,CAAC;SACxC,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,WAAW,CAAC,EAAU;QAC1B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAE5C;YACA,KAAK,EAAE,EAAE,EAAE,EAAE;YACb,OAAO,EAAE;gBACP,GAAG,kBAAkB;gBACrB,UAAU,EAAE;oBACV,MAAM,EAAE;wBACN,QAAQ,EAAE,IAAI;wBACd,aAAa,EAAE,IAAI;wBACnB,SAAS,EAAE,IAAI;qBAChB;iBACF;gBACD,YAAY,EAAE;oBACZ,MAAM,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE;iBACxB;aACF;SACF,CAAC,CAAC;QAEH,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,0BAAiB,CAAC,gBAAgB,EAAE,YAAY,CAAC,CAAC;QAC9D,CAAC;QAED,OAAO;YACL,EAAE,EAAE,IAAI,CAAC,EAAE;YACX,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;YAC7C,eAAe,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC;YACxC,uBAAuB,EAAE,IAAI,CAAC,uBAAuB;YACrD,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;YAC3B,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,SAAS,EAAE,IAAI,CAAC,SAAS;SAC1B,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,UAAU,CACd,EAAU,EACV,GAAkB,EAClB,WAAmB;QAEnB,6CAA6C;QAC7C,IAAI,GAAG,CAAC,QAAQ,KAAK,KAAK,IAAI,EAAE,KAAK,WAAW,EAAE,CAAC;YACjD,MAAM,IAAI,2BAAkB,CAAC,oCAAoC,CAAC,CAAC;QACrE,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;QAElE,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,0BAAiB,CAAC,gBAAgB,EAAE,YAAY,CAAC,CAAC;QAC9D,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAmB;YAC9D,KAAK,EAAE,EAAE,EAAE,EAAE;YACb,IAAI,EAAE;gBACJ,WAAW,EAAE,GAAG,CAAC,WAAW;gBAC5B,QAAQ,EAAE,GAAG,CAAC,QAAQ;aACvB;YACD,OAAO,EAAE;gBACP,GAAG,kBAAkB;gBACrB,YAAY,EAAE;oBACZ,MAAM,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE;iBACxB;aACF;SACF,CAAC,CAAC;QAEH,uEAAuE;QACvE,uEAAuE;QACvE,oEAAoE;QACpE,IAAI,CAAC,cAAc,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC;QAEvC,kBAAkB;QAClB,MAAM,IAAI,CAAC,gBAAgB,CAAC,WAAW,EAAE,aAAa,EAAE,MAAM,EAAE,EAAE,EAAE;YAClE,OAAO,EAAE,GAAG;SACb,CAAC,CAAC;QAEH,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,qBAAqB,WAAW,EAAE,CAAC,CAAC;QAE9D,OAAO;YACL,EAAE,EAAE,OAAO,CAAC,EAAE;YACd,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,mBAAmB,EAAE,OAAO,CAAC,mBAAmB;YAChD,eAAe,EAAE,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC;YAC3C,uBAAuB,EAAE,OAAO,CAAC,uBAAuB;YACxD,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;YAC9B,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,SAAS,EAAE,OAAO,CAAC,SAAS;SAC7B,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;;;;;OAeG;IACH,KAAK,CAAC,eAAe,CACnB,EAAU,EACV,GAAuB,EACvB,WAAmB;QAEnB,mDAAmD;QACnD,IAAI,EAAE,KAAK,WAAW,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,0BAAK,CAAC,KAAK,CAAC,EAAE,CAAC;YAC/D,MAAM,IAAI,2BAAkB,CAAC,wCAAwC,CAAC,CAAC;QACzE,CAAC;QAED,yEAAyE;QACzE,sEAAsE;QACtE,0EAA0E;QAC1E,2EAA2E;QAC3E,yEAAyE;QACzE,uEAAuE;QACvE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAiB;YAC7D,KAAK,EAAE,EAAE,EAAE,EAAE;YACb,OAAO,EAAE,kBAAkB;SAC5B,CAAC,CAAC;QAEH,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,0BAAiB,CAAC,gBAAgB,EAAE,YAAY,CAAC,CAAC;QAC9D,CAAC;QAED,wEAAwE;QACxE,MAAM,aAAa,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QAE3C,2BAA2B;QAC3B,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC;YAC5C,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,GAAG,CAAC,SAAS,EAAE,EAAE;SACvC,CAAC,CAAC;QAEH,IAAI,KAAK,CAAC,MAAM,KAAK,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC;YAC1C,MAAM,UAAU,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YAC5C,MAAM,OAAO,GAAG,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;YACrE,MAAM,IAAI,4BAAmB,CAAC,kBAAkB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACxE,CAAC;QAED,4EAA4E;QAC5E,0EAA0E;QAC1E,4DAA4D;QAC5D,KAAK,MAAM,IAAI,IAAI,KAAK;YAAE,IAAA,mCAAoB,EAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QAEtE,MAAM,WAAW,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC;QACpE,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC;QAC9D,MAAM,SAAS,GAAG,oCAAgB,CAAC,IAAI,EAAE,KAAK,QAAQ,CAAC;QAEvD,IAAI,CAAC,SAAS,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtC,MAAM,IAAI,4BAAmB,CAC3B,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,mBAAmB,EAAE,CACzE,CAAC;QACJ,CAAC;QAED,qEAAqE;QACrE,IAAI,cAAc,GAAwC,IAAI,CAAC;QAC/D,IAAI,YAAY,GAAkB,IAAI,CAAC;QACvC,IAAI,SAAS,EAAE,CAAC;YACd,wEAAwE;YACxE,oEAAoE;YACpE,oEAAoE;YACpE,MAAM,WAAW,GAAG,CAAC,IAAI,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,SAAS,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC;YACxG,MAAM,WAAW,GAAG,WAAW,KAAK,SAAS,IAAI,IAAA,+BAAgB,EAAC,WAAW,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC;YACzG,MAAM,kBAAkB,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,0BAAK,CAAC,KAAK,CAAC;gBAC9E,CAAC,CAAC,mCAAc;gBAChB,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,WAAW,IAAI,IAAI,CAAC,eAAe,CAAC,cAAc,CAAC;YACjH,cAAc;gBACZ,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,kBAAkB,CAAC;oBACzD,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,kBAAkB,EAAE,EAAE,CAAC,CAAC,CAAC;YAC/E,IAAI,CAAC,cAAc,EAAE,CAAC;gBACpB,MAAM,IAAI,4BAAmB,CAAC,kBAAkB,kBAAkB,EAAE,CAAC,CAAC;YACxE,CAAC;YACD,yEAAyE;YACzE,8CAA8C;YAC9C,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,SAAS,CAAC;gBAC1D,KAAK,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE;gBAC1B,MAAM,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE;aACrB,CAAC,CAAC;YACH,IAAI,CAAC,UAAU;gBAAE,MAAM,IAAI,0DAAmC,EAAE,CAAC;YACjE,YAAY,GAAG,UAAU,CAAC,EAAE,CAAC;QAC/B,CAAC;QAED,wEAAwE;QACxE,sEAAsE;QACtE,0EAA0E;QAC1E,iCAAiC;QACjC,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAA,+BAAgB,EAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QAEtG,0EAA0E;QAC1E,sBAAsB;QACtB,MAAM,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;YAC1C,yEAAyE;YACzE,2DAA2D;YAC3D,MAAM,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC;gBAC3B,KAAK,EAAE,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE;aACnH,CAAC,CAAC;YAEH,gBAAgB;YAChB,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC3B,MAAM,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC;oBAC3B,IAAI,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;wBAC/B,MAAM,EAAE,EAAE;wBACV,MAAM,EAAE,IAAI,CAAC,EAAE;qBAChB,CAAC,CAAC;iBACJ,CAAC,CAAC;YACL,CAAC;YAED,IAAI,cAAc,IAAI,YAAY,EAAE,CAAC;gBACnC,MAAM,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC;oBACzB,KAAK,EAAE,EAAE,YAAY,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE;oBAC5D,MAAM,EAAE,EAAE,MAAM,EAAE,cAAc,CAAC,EAAE,EAAE;oBACrC,MAAM,EAAE;wBACN,KAAK,EAAE,YAAY;wBACnB,MAAM,EAAE,EAAE;wBACV,MAAM,EAAE,cAAc,CAAC,EAAE;wBACzB,YAAY,EAAE,IAAI,IAAI,EAAE;qBACzB;iBACF,CAAC,CAAC;YACL,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,iEAAiE;QACjE,MAAM,YAAY,GAAG;YACnB,GAAG,IAAI,GAAG,CAAC;gBACT,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC;gBACvC,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC;gBACrC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;aACxE,CAAC;SACH,CAAC;QAEF,0EAA0E;QAC1E,iEAAiE;QACjE,IAAI,CAAC,cAAc,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC;QAEvC,kBAAkB;QAClB,MAAM,IAAI,CAAC,gBAAgB,CAAC,WAAW,EAAE,mBAAmB,EAAE,MAAM,EAAE,EAAE,EAAE;YACxE,QAAQ,EAAE,GAAG,CAAC,SAAS;YACvB,WAAW,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC;YACjD,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,cAAc,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC5D,CAAC,CAAC;QAEH,IAAI,CAAC,MAAM,CAAC,GAAG,CACb,QAAQ,EAAE,sBAAsB,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,WAAW,EAAE,CACpF,CAAC;QAEF,4EAA4E;QAC5E,qDAAqD;QACrD,4EAA4E;QAC5E,EAAE;QACF,yEAAyE;QACzE,wDAAwD;QACxD,EAAE;QACF,sEAAsE;QACtE,qEAAqE;QACrE,0EAA0E;QAC1E,kEAAkE;QAClE,2EAA2E;QAC3E,qEAAqE;QACrE,yEAAyE;QACzE,gCAAgC;QAChC,EAAE;QACF,yEAAyE;QACzE,0EAA0E;QAC1E,0EAA0E;QAC1E,4EAA4E;QAC5E,uBAAuB;QACvB,EAAE;QACF,uEAAuE;QACvE,iEAAiE;QACjE,2EAA2E;QAC3E,yEAAyE;QACzE,gCAAgC;QAChC,EAAE;QACF,2EAA2E;QAC3E,wEAAwE;QACxE,yEAAyE;QACzE,wDAAwD;QACxD,MAAM,OAAO,GAAsB;YACjC,cAAc,EAAE,IAAI,CAAC,KAAK;YAC1B,aAAa;YACb,YAAY;YACZ,SAAS,EAAE,IAAI,IAAI,EAAE;YACrB,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE;SACtB,CAAC;QAEF,uEAAuE;QACvE,2EAA2E;QAC3E,wCAAwC;QACxC,MAAM,IAAI,CAAC,aAAa,CAAC,WAAW,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;QAElD,OAAO,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;IAC9B,CAAC;IAED;;;OAGG;IACK,SAAS,CAAC,IAAmD;QACnE,OAAO,oCAAgB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC;IAC7C,CAAC;IAED,wEAAwE;IAChE,cAAc,CAAC,IAAmD;QACxE,MAAM,OAAO,GAAG,oCAAgB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC;QACtD,OAAO,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAClC,CAAC;IAED,oFAAoF;IAC5E,cAAc,CAAC,KAAe;QACpC,MAAM,MAAM,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;QACxE,OAAO,MAAM,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC;IAC5B,CAAC;IAED;;;OAGG;IACK,YAAY,CAAC,IAIpB;QACC,MAAM,aAAa,GACjB,IAAI,CAAC,YAAY,EAAE,KACpB,EAAE,OAAO,CAAC;QACX,OAAO,IAAI,CAAC,aAAa,CAAC,eAAe,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;IACjE,CAAC;IAED;;;;;;;OAOG;IACK,MAAM;QACZ,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAS,QAAQ,CAAC,CAAC;QACjD,OAAO,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACzD,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,gBAAgB,CAC5B,WAAmB,EACnB,MAAc,EACd,UAAkB,EAClB,QAAgB,EAChB,IAA6B;QAE7B,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC;YAClC,IAAI,EAAE;gBACJ,WAAW;gBACX,MAAM;gBACN,UAAU;gBACV,QAAQ;gBACR,IAAI,EAAE,IAAW;aAClB;SACF,CAAC,CAAC;IACL,CAAC;CACF,CAAA;AA9dY,oCAAY;uBAAZ,YAAY;IADxB,IAAA,mBAAU,GAAE;IAKR,WAAA,IAAA,eAAM,EAAC,uBAAe,CAAC,CAAA;IACvB,WAAA,IAAA,eAAM,EAAC,yBAAiB,CAAC,CAAA;IAKzB,WAAA,IAAA,eAAM,EAAC,+BAAuB,CAAC,CAAA;IAC/B,WAAA,IAAA,iBAAQ,GAAE,CAAA;IAAE,WAAA,IAAA,eAAM,EAAC,mCAAgB,CAAC,CAAA;qDALZ,sBAAa;QAEL,wCAAc;GARtC,YAAY,CA8dxB"}

package/dist/index.d.ts

@@ -0,0 +1,11 @@
+/**
+ * The npm name of this package, which holds NestJS dynamic modules of the platform.
+ *
+ * A placeholder export so the build, the pack check and the smoke imports in
+ * CI have something to load end to end. Real slices arrive as subpath
+ * exports (`@marinoscar/platform-api/<slice>`).
+ *
+ * @stability experimental
+ */
+export declare const PLATFORM_PACKAGE: "@marinoscar/platform-api";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,eAAO,MAAM,gBAAgB,EAAG,0BAAmC,CAAC"}

package/dist/index.js

@@ -0,0 +1,14 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PLATFORM_PACKAGE = void 0;
+/**
+ * The npm name of this package, which holds NestJS dynamic modules of the platform.
+ *
+ * A placeholder export so the build, the pack check and the smoke imports in
+ * CI have something to load end to end. Real slices arrive as subpath
+ * exports (`@marinoscar/platform-api/<slice>`).
+ *
+ * @stability experimental
+ */
+exports.PLATFORM_PACKAGE = '@marinoscar/platform-api';
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;AAAA;;;;;;;;GAQG;AACU,QAAA,gBAAgB,GAAG,0BAAmC,CAAC"}

package/dist/jobs/backoff.util.d.ts

@@ -0,0 +1,59 @@
+/**
+ * DI token for the RNG the terminal service passes to `computeBackoffMs`.
+ *
+ * OPTIONAL and unprovided in `JobsModule` — production always gets
+ * `Math.random`, exactly as `JOB_CLOCK` always gets the real clock. It exists
+ * so a unit test can assert the EXACT `scheduled_for` a deferral wrote
+ * instead of a range; see the "the RNG is a parameter" note above for why a
+ * range assertion is nearly worthless on a jittered delay.
+  *
+  * @stability experimental
+ */
+export declare const JOB_RANDOM: unique symbol;
+/**
+ * What `computeBackoffMs` needs to compute one retry delay.
+ *
+ * @stability experimental
+ */
+export interface BackoffInput {
+    /**
+     * WHICH attempt is about to be scheduled, 1-based: `1` produces the first
+     * (shortest) delay.
+     *
+     * ⚠ Callers pass `job.attempts`, which the claim statement already
+     * incremented — so a job on its first run passes `1` and gets the base delay,
+     * not double it. See docs/specs/job-queue.md,
+     * "Attempts are charged at claim". Values below 1 are clamped rather than
+     * trusted, so a caller that reads a stale or un-charged row cannot produce a
+     * fractional (sub-base) delay.
+     */
+    attempt: number;
+    /** The delay for attempt 1, before jitter. */
+    baseMs: number;
+    /** Ceiling for the exponential term, before jitter and before `retryAfterMs`. */
+    maxMs: number;
+    /**
+     * A delay the OTHER side asked for — a provider's `Retry-After`, or a
+     * remote node reporting one. It is a FLOOR, not an override: a provider
+     * saying "come back in 1s" does not entitle us to ignore our own backoff on
+     * the fifth consecutive failure, and a provider saying "come back in an
+     * hour" is obeyed even though our own ceiling is shorter. Taking the max of
+     * the two is the only combination that never violates either constraint.
+     */
+    retryAfterMs?: number | null;
+    /** Injectable RNG in `[0, 1)`. Defaults to `Math.random`. */
+    rand?: () => number;
+}
+/**
+ * Milliseconds to wait before the next attempt.
+ *
+ * `exp   = min(maxMs, baseMs * 2^(attempt - 1))`
+ * `delay = max(retryAfterMs ?? 0, exp / 2 + rand() * exp / 2)`
+ *
+ * Always a non-negative integer (callers turn it into a `Date`, and a
+ * fractional millisecond in a timestamp helps nobody read a job list).
+  *
+  * @stability experimental
+ */
+export declare function computeBackoffMs(input: BackoffInput): number;
+//# sourceMappingURL=backoff.util.d.ts.map

package/dist/jobs/backoff.util.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"backoff.util.d.ts","sourceRoot":"","sources":["../../src/jobs/backoff.util.ts"],"names":[],"mappings":"AA8DA;;;;;;;;;;GAUG;AACH,eAAO,MAAM,UAAU,eAAuB,CAAC;AAE/C;;;;GAIG;AACH,MAAM,WAAW,YAAY;IAC3B;;;;;;;;;;OAUG;IACH,OAAO,EAAE,MAAM,CAAC;IAEhB,8CAA8C;IAC9C,MAAM,EAAE,MAAM,CAAC;IAEf,iFAAiF;IACjF,KAAK,EAAE,MAAM,CAAC;IAEd;;;;;;;OAOG;IACH,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAE7B,6DAA6D;IAC7D,IAAI,CAAC,EAAE,MAAM,MAAM,CAAC;CACrB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,YAAY,GAAG,MAAM,CAc5D"}