@marinoscar/platform-api 0.0.0-stage → 0.1.0-next.3

package/dist/core/errors/http-exception.filter.js

@@ -0,0 +1,234 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var HttpExceptionFilter_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.HttpExceptionFilter = void 0;
+const common_1 = require("@nestjs/common");
+const nestjs_zod_1 = require("nestjs-zod");
+const verbatim_error_body_exception_1 = require("./verbatim-error-body.exception");
+/**
+ * The application-wide exception filter: turns every thrown value into the one
+ * error envelope (`{ statusCode, code, message, details?, timestamp, path }`,
+ * documented by {@link ErrorDto}) on a Fastify reply, and logs one line per
+ * failure (`warn` below 500, `error` with the stack from 500 up).
+ *
+ * `code` is always derived from the HTTP status; a `code` on the thrown
+ * payload is ignored. `details` is the only place endpoint-specific data
+ * survives. An exception branded with {@link withVerbatimErrorBody} skips the
+ * envelope and is sent exactly as thrown. A 429 whose `details.retryAfterMs`
+ * is a positive number also gets a `Retry-After` header (whole seconds,
+ * rounded up). A `ZodValidationException` without explicit details answers
+ * `details.issues` (`[{ path, message }]`), never the submitted value. A
+ * non-`HttpException` error is a 500 whose `details` carries the stack unless
+ * `NODE_ENV` is `production`.
+ *
+ * Register it once, as an `APP_FILTER` provider of the root module. There is
+ * no module to import and nothing to configure.
+ *
+ * @stability stable
+ * @extensionPoint component
+ * @example
+ * ```ts
+ * import { APP_FILTER } from '@nestjs/core';
+ * import { HttpExceptionFilter } from '@marinoscar/platform-api/core';
+ *
+ * @Module({ providers: [{ provide: APP_FILTER, useClass: HttpExceptionFilter }] })
+ * export class AppModule {}
+ * ```
+ */
+let HttpExceptionFilter = HttpExceptionFilter_1 = class HttpExceptionFilter {
+    logger = new common_1.Logger(HttpExceptionFilter_1.name);
+    /**
+     * Nest's `ExceptionFilter` hook: write the error response for `exception`
+     * on the HTTP reply of `host`. Called by Nest, not by application code.
+     *
+     * @param exception - Whatever was thrown.
+     * @param host - The Nest arguments host of the failed request (HTTP only).
+     */
+    catch(exception, host) {
+        const ctx = host.switchToHttp();
+        const response = ctx.getResponse();
+        const request = ctx.getRequest();
+        let status = common_1.HttpStatus.INTERNAL_SERVER_ERROR;
+        let code = 'INTERNAL_ERROR';
+        let message = 'An unexpected error occurred';
+        let details;
+        if (exception instanceof common_1.HttpException) {
+            status = exception.getStatus();
+            const exceptionResponse = exception.getResponse();
+            // ---------------------------------------------------------------------
+            // Verbatim bodies (#153) — checked FIRST, and returns immediately.
+            // ---------------------------------------------------------------------
+            // A branded exception carries a body dictated by an external spec, not by
+            // us: today that is `POST /auth/device/token`, whose RFC 8628 §3.5 body is
+            // `{ error, error_description }`. Sending it through the envelope below
+            // destroys it — the envelope reads only `message`, `code` and `details`,
+            // so all four RFC outcomes used to arrive as the same generic 400 and a
+            // polling client could not tell them apart. See
+            // `./verbatim-error-body.exception.ts` for why the opt-out
+            // is an explicit brand rather than the filter sniffing for an `error` key.
+            //
+            // Nothing is merged in — not `statusCode`, not `timestamp`, not `path`.
+            // Extra keys would not upset a tolerant parser, but they would put fields
+            // the RFC never defines into a protocol response, and a body that is
+            // "mostly the spec" is exactly the kind of thing a strict client rejects
+            // and a reader stops trusting. The status line still carries the code.
+            //
+            // The object guard matters: a string payload has nothing to send
+            // verbatim, so such an exception falls through to the envelope rather than
+            // putting a bare JSON string on the wire.
+            if ((0, verbatim_error_body_exception_1.hasVerbatimErrorBody)(exception) &&
+                typeof exceptionResponse === 'object' &&
+                exceptionResponse !== null) {
+                this.logOutcome(request, status, this.summarize(exceptionResponse), exception);
+                response.code(status).send(exceptionResponse);
+                return;
+            }
+            if (typeof exceptionResponse === 'string') {
+                message = exceptionResponse;
+            }
+            else if (typeof exceptionResponse === 'object') {
+                const resp = exceptionResponse;
+                message = resp.message || message;
+                details = resp.details;
+            }
+            // A body/query that failed the global `ZodValidationPipe` names the
+            // failing fields under `details.issues` (`{ path, message }` each). Only
+            // the path and Zod's (or the schema's own) message are published — never
+            // the submitted value, which may be personal data or free text.
+            if (exception instanceof nestjs_zod_1.ZodValidationException && details === undefined) {
+                details = zodIssueDetails(exception.getZodError());
+            }
+            // `code` is ALWAYS derived from the status, and a `code` on the thrown
+            // payload is deliberately ignored.
+            //
+            // This line used to be preceded by `code = (resp.code as string) ||
+            // this.getCodeFromStatus(status)`, which this one immediately overwrote —
+            // dead since it was written, so no exception in the app could ever set its
+            // own code (#153). The dead line was removed rather than made to work,
+            // because honouring a payload `code` is a real behaviour change on the
+            // wire and the current behaviour is the one the API actually promises:
+            //
+            //   * `./error.dto.ts` publishes `code` as a CLOSED ENUM of the
+            //     nine status-derived values, and says in so many words that the
+            //     filter overwrites any `code` an exception supplied. That DTO is the
+            //     `default` error response on every operation in the OpenAPI document,
+            //     so it is a published contract, not a comment.
+            //   * `test/core/http-exception.filter.spec.ts` asserts it ("The filter overrides
+            //     custom code with standard code mapping"). The behaviour is tested,
+            //     not accidental.
+            //   * One exception does pass a `code`: `DatabaseSeedException` sends
+            //     `DATABASE_SEED_REQUIRED`. Reviving the dead line would have changed
+            //     that response's `code` from `INTERNAL_ERROR` to a value outside the
+            //     published enum — a silent contract break in the one place nobody
+            //     would think to check. Its identifying data is already in `details`,
+            //     which the envelope carries through.
+            //
+            // Endpoint-specific machine-readable data belongs under `details`; an
+            // externally-specified body belongs behind the verbatim brand above.
+            code = this.getCodeFromStatus(status);
+        }
+        else if (exception instanceof Error) {
+            message = exception.message;
+            // Don't expose stack traces in production
+            if (process.env.NODE_ENV !== 'production') {
+                details = exception.stack;
+            }
+        }
+        const errorResponse = {
+            statusCode: status,
+            code,
+            message,
+            timestamp: new Date().toISOString(),
+            path: request.url,
+        };
+        if (details) {
+            errorResponse.details = details;
+        }
+        this.logOutcome(request, status, message, exception);
+        // A 429 that says when to come back (`details.retryAfterMs` — every
+        // `AiError('AI_RATE_LIMITED')` that knows, including the AI rate limits of
+        // #450) also says so in the standard header, in whole seconds rounded UP
+        // so a client that honours it never retries early.
+        const retryAfterSeconds = status === 429 ? retryAfterSecondsOf(details) : undefined;
+        if (retryAfterSeconds !== undefined) {
+            response.header('Retry-After', String(retryAfterSeconds));
+        }
+        // Fastify response - use code() and send()
+        response.code(status).send(errorResponse);
+    }
+    /**
+     * One log line per handled failure, identical for enveloped and verbatim
+     * responses. Extracted so the verbatim early-return above cannot silently
+     * skip logging — a device-flow `slow_down` storm has to be visible in the
+     * logs like any other 4xx.
+     */
+    logOutcome(request, status, summary, exception) {
+        if (status >= 500) {
+            this.logger.error(`${request.method} ${request.url} - ${status}`, exception instanceof Error ? exception.stack : exception);
+        }
+        else {
+            this.logger.warn(`${request.method} ${request.url} - ${status}: ${summary}`);
+        }
+    }
+    /**
+     * A short log-only description of a verbatim body.
+     *
+     * Reading `error` here is for the LOG LINE ONLY and shapes nothing — an RFC
+     * body's `error` is the single most useful thing to see in operations
+     * (`slow_down` and `access_denied` mean very different things at 3am), and
+     * without it every device-flow failure logs as an indistinguishable 400. The
+     * body itself is never stringified into the log: a verbatim payload is
+     * whatever the spec says it is, and this filter should not assume the rest of
+     * it is safe to print.
+     */
+    summarize(body) {
+        const label = body.error ?? body.message;
+        return typeof label === 'string' ? label : 'verbatim error body';
+    }
+    getCodeFromStatus(status) {
+        const codeMap = {
+            400: 'BAD_REQUEST',
+            401: 'UNAUTHORIZED',
+            403: 'FORBIDDEN',
+            404: 'NOT_FOUND',
+            409: 'CONFLICT',
+            412: 'PRECONDITION_FAILED',
+            413: 'PAYLOAD_TOO_LARGE',
+            422: 'UNPROCESSABLE_ENTITY',
+            429: 'TOO_MANY_REQUESTS',
+            500: 'INTERNAL_ERROR',
+        };
+        return codeMap[status] || 'ERROR';
+    }
+};
+exports.HttpExceptionFilter = HttpExceptionFilter;
+exports.HttpExceptionFilter = HttpExceptionFilter = HttpExceptionFilter_1 = __decorate([
+    (0, common_1.Catch)()
+], HttpExceptionFilter);
+/** `details.retryAfterMs` as a `Retry-After` delta-seconds value (at least 1), or `undefined`. */
+function retryAfterSecondsOf(details) {
+    if (details === null || typeof details !== 'object')
+        return undefined;
+    const ms = details.retryAfterMs;
+    return typeof ms === 'number' && Number.isFinite(ms) && ms > 0 ? Math.max(1, Math.ceil(ms / 1000)) : undefined;
+}
+/** `{ issues: [{ path: 'readings.0.unit', message }] }`, or undefined. */
+function zodIssueDetails(error) {
+    const issues = error?.issues;
+    if (!Array.isArray(issues) || issues.length === 0) {
+        return undefined;
+    }
+    return {
+        issues: issues.map((issue) => ({
+            path: Array.isArray(issue.path) ? issue.path.map(String).join('.') : '',
+            message: typeof issue.message === 'string' ? issue.message : 'Invalid value',
+        })),
+    };
+}
+//# sourceMappingURL=http-exception.filter.js.map

package/dist/core/errors/http-exception.filter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"http-exception.filter.js","sourceRoot":"","sources":["../../../src/core/errors/http-exception.filter.ts"],"names":[],"mappings":";;;;;;;;;;AAAA,2CAOwB;AACxB,2CAAoD;AACpD,mFAAuE;AAWvE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEI,IAAM,mBAAmB,2BAAzB,MAAM,mBAAmB;IACb,MAAM,GAAG,IAAI,eAAM,CAAC,qBAAmB,CAAC,IAAI,CAAC,CAAC;IAE/D;;;;;;OAMG;IACH,KAAK,CAAC,SAAkB,EAAE,IAAmB;QAC3C,MAAM,GAAG,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;QAChC,MAAM,QAAQ,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;QACnC,MAAM,OAAO,GAAG,GAAG,CAAC,UAAU,EAAE,CAAC;QAEjC,IAAI,MAAM,GAAG,mBAAU,CAAC,qBAAqB,CAAC;QAC9C,IAAI,IAAI,GAAG,gBAAgB,CAAC;QAC5B,IAAI,OAAO,GAAG,8BAA8B,CAAC;QAC7C,IAAI,OAAgB,CAAC;QAErB,IAAI,SAAS,YAAY,sBAAa,EAAE,CAAC;YACvC,MAAM,GAAG,SAAS,CAAC,SAAS,EAAE,CAAC;YAC/B,MAAM,iBAAiB,GAAG,SAAS,CAAC,WAAW,EAAE,CAAC;YAElD,wEAAwE;YACxE,mEAAmE;YACnE,wEAAwE;YACxE,0EAA0E;YAC1E,2EAA2E;YAC3E,wEAAwE;YACxE,yEAAyE;YACzE,wEAAwE;YACxE,gDAAgD;YAChD,2DAA2D;YAC3D,2EAA2E;YAC3E,EAAE;YACF,wEAAwE;YACxE,0EAA0E;YAC1E,qEAAqE;YACrE,yEAAyE;YACzE,uEAAuE;YACvE,EAAE;YACF,iEAAiE;YACjE,2EAA2E;YAC3E,0CAA0C;YAC1C,IACE,IAAA,oDAAoB,EAAC,SAAS,CAAC;gBAC/B,OAAO,iBAAiB,KAAK,QAAQ;gBACrC,iBAAiB,KAAK,IAAI,EAC1B,CAAC;gBACD,IAAI,CAAC,UAAU,CACb,OAAO,EACP,MAAM,EACN,IAAI,CAAC,SAAS,CAAC,iBAA4C,CAAC,EAC5D,SAAS,CACV,CAAC;gBAEF,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;gBAC9C,OAAO;YACT,CAAC;YAED,IAAI,OAAO,iBAAiB,KAAK,QAAQ,EAAE,CAAC;gBAC1C,OAAO,GAAG,iBAAiB,CAAC;YAC9B,CAAC;iBAAM,IAAI,OAAO,iBAAiB,KAAK,QAAQ,EAAE,CAAC;gBACjD,MAAM,IAAI,GAAG,iBAA4C,CAAC;gBAC1D,OAAO,GAAI,IAAI,CAAC,OAAkB,IAAI,OAAO,CAAC;gBAC9C,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;YACzB,CAAC;YAED,oEAAoE;YACpE,yEAAyE;YACzE,yEAAyE;YACzE,gEAAgE;YAChE,IAAI,SAAS,YAAY,mCAAsB,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;gBACzE,OAAO,GAAG,eAAe,CAAC,SAAS,CAAC,WAAW,EAAE,CAAC,CAAC;YACrD,CAAC;YAED,uEAAuE;YACvE,mCAAmC;YACnC,EAAE;YACF,oEAAoE;YACpE,0EAA0E;YAC1E,2EAA2E;YAC3E,uEAAuE;YACvE,uEAAuE;YACvE,uEAAuE;YACvE,EAAE;YACF,gEAAgE;YAChE,qEAAqE;YACrE,0EAA0E;YAC1E,2EAA2E;YAC3E,oDAAoD;YACpD,kFAAkF;YAClF,yEAAyE;YACzE,sBAAsB;YACtB,sEAAsE;YACtE,0EAA0E;YAC1E,0EAA0E;YAC1E,uEAAuE;YACvE,0EAA0E;YAC1E,0CAA0C;YAC1C,EAAE;YACF,sEAAsE;YACtE,qEAAqE;YACrE,IAAI,GAAG,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC;QACxC,CAAC;aAAM,IAAI,SAAS,YAAY,KAAK,EAAE,CAAC;YACtC,OAAO,GAAG,SAAS,CAAC,OAAO,CAAC;YAC5B,0CAA0C;YAC1C,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,EAAE,CAAC;gBAC1C,OAAO,GAAG,SAAS,CAAC,KAAK,CAAC;YAC5B,CAAC;QACH,CAAC;QAED,MAAM,aAAa,GAAkB;YACnC,UAAU,EAAE,MAAM;YAClB,IAAI;YACJ,OAAO;YACP,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,IAAI,EAAE,OAAO,CAAC,GAAG;SAClB,CAAC;QAEF,IAAI,OAAO,EAAE,CAAC;YACZ,aAAa,CAAC,OAAO,GAAG,OAAO,CAAC;QAClC,CAAC;QAED,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;QAErD,oEAAoE;QACpE,2EAA2E;QAC3E,yEAAyE;QACzE,mDAAmD;QACnD,MAAM,iBAAiB,GAAG,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAEpF,IAAI,iBAAiB,KAAK,SAAS,EAAE,CAAC;YACpC,QAAQ,CAAC,MAAM,CAAC,aAAa,EAAE,MAAM,CAAC,iBAAiB,CAAC,CAAC,CAAC;QAC5D,CAAC;QAED,2CAA2C;QAC3C,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IAC5C,CAAC;IAED;;;;;OAKG;IACK,UAAU,CAChB,OAAwC,EACxC,MAAc,EACd,OAAe,EACf,SAAkB;QAElB,IAAI,MAAM,IAAI,GAAG,EAAE,CAAC;YAClB,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,GAAG,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,GAAG,MAAM,MAAM,EAAE,EAC9C,SAAS,YAAY,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CACzD,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,GAAG,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,GAAG,MAAM,MAAM,KAAK,OAAO,EAAE,CAC3D,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;;;;;;;;OAUG;IACK,SAAS,CAAC,IAA6B;QAC7C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,OAAO,CAAC;QACzC,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,qBAAqB,CAAC;IACnE,CAAC;IAEO,iBAAiB,CAAC,MAAc;QACtC,MAAM,OAAO,GAA2B;YACtC,GAAG,EAAE,aAAa;YAClB,GAAG,EAAE,cAAc;YACnB,GAAG,EAAE,WAAW;YAChB,GAAG,EAAE,WAAW;YAChB,GAAG,EAAE,UAAU;YACf,GAAG,EAAE,qBAAqB;YAC1B,GAAG,EAAE,mBAAmB;YACxB,GAAG,EAAE,sBAAsB;YAC3B,GAAG,EAAE,mBAAmB;YACxB,GAAG,EAAE,gBAAgB;SACtB,CAAC;QACF,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,OAAO,CAAC;IACpC,CAAC;CACF,CAAA;AApMY,kDAAmB;8BAAnB,mBAAmB;IAD/B,IAAA,cAAK,GAAE;GACK,mBAAmB,CAoM/B;AAED,kGAAkG;AAClG,SAAS,mBAAmB,CAAC,OAAgB;IAC3C,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAEtE,MAAM,EAAE,GAAI,OAAsC,CAAC,YAAY,CAAC;IAEhE,OAAO,OAAO,EAAE,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACjH,CAAC;AAED,0EAA0E;AAC1E,SAAS,eAAe,CAAC,KAAc;IACrC,MAAM,MAAM,GAAI,KAAqC,EAAE,MAAM,CAAC;IAE9D,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClD,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,OAAO;QACL,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,KAA4C,EAAE,EAAE,CAAC,CAAC;YACpE,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE;YACvE,OAAO,EAAE,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe;SAC7E,CAAC,CAAC;KACJ,CAAC;AACJ,CAAC"}

package/dist/core/errors/verbatim-error-body.exception.d.ts

@@ -0,0 +1,46 @@
+import { HttpException } from '@nestjs/common';
+/**
+ * Mark an exception so `HttpExceptionFilter` sends its payload to the client
+ * exactly as given, instead of rebuilding it as
+ * `{ statusCode, code, message, … }`.
+ *
+ * Returns the same exception instance, so the class identity is untouched:
+ * `withVerbatimErrorBody(new BadRequestException(…))` is still a
+ * `BadRequestException` and still carries status 400. That matters — guards,
+ * interceptors and existing tests that branch on the exception type keep
+ * working, and the opt-out stays a single orthogonal fact about the response
+ * body rather than a parallel exception hierarchy.
+ *
+ * The payload MUST be an object; a string payload has nothing to send verbatim
+ * and the filter falls back to the envelope for it.
+ *
+ * Only for a body an external standard dictates (RFC 8628's
+ * `{ error, error_description }` is the one use in the reference app); see
+ * the header of this file.
+ *
+ * @param exception - The exception to brand; returned as is.
+ * @returns The same exception instance.
+ * @stability stable
+ * @example
+ * ```ts
+ * throw withVerbatimErrorBody(
+ *   new BadRequestException({ error: 'slow_down', error_description: 'Polling too fast' }),
+ * );
+ * ```
+ */
+export declare function withVerbatimErrorBody<T extends HttpException>(exception: T): T;
+/**
+ * Whether an exception opted out of the envelope. Read only by
+ * `HttpExceptionFilter`.
+ *
+ * @param exception - Anything thrown.
+ * @returns `true` only for an `HttpException` branded by
+ *   {@link withVerbatimErrorBody}.
+ * @stability stable
+ * @example
+ * ```ts
+ * hasVerbatimErrorBody(withVerbatimErrorBody(new BadRequestException({ error: 'x' }))); // true
+ * ```
+ */
+export declare function hasVerbatimErrorBody(exception: unknown): boolean;
+//# sourceMappingURL=verbatim-error-body.exception.d.ts.map

package/dist/core/errors/verbatim-error-body.exception.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verbatim-error-body.exception.d.ts","sourceRoot":"","sources":["../../../src/core/errors/verbatim-error-body.exception.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AA2E/C;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,wBAAgB,qBAAqB,CAAC,CAAC,SAAS,aAAa,EAC3D,SAAS,EAAE,CAAC,GACX,CAAC,CAYH;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,oBAAoB,CAAC,SAAS,EAAE,OAAO,GAAG,OAAO,CAOhE"}

package/dist/core/errors/verbatim-error-body.exception.js

@@ -0,0 +1,135 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.withVerbatimErrorBody = withVerbatimErrorBody;
+exports.hasVerbatimErrorBody = hasVerbatimErrorBody;
+const common_1 = require("@nestjs/common");
+/**
+ * Opt-out from the shared error envelope (issue #153).
+ *
+ * ---------------------------------------------------------------------------
+ * WHY THIS EXISTS
+ * ---------------------------------------------------------------------------
+ * `HttpExceptionFilter` rebuilds EVERY error response from a fixed key
+ * allowlist — it reads `message`, `code` and `details` off the thrown payload
+ * and discards everything else. That is the right default and must stay the
+ * default: one envelope, parsed by exactly one code path in the web app and one
+ * in the CLI (`ApiError`, #140), with no endpoint quietly inventing its own
+ * error shape for its own callers to special-case.
+ *
+ * It is wrong for the small set of endpoints whose error body is dictated by an
+ * external specification rather than by us. `POST /auth/device/token` is the
+ * live example and the reason this file exists: RFC 8628 §3.5 (deferring to
+ * RFC 6749 §5.2) specifies `{ error, error_description }` at the TOP LEVEL of
+ * the token response, and the codes it defines — `authorization_pending`,
+ * `slow_down`, `expired_token`, `access_denied` — ARE the protocol. Each one
+ * demands a different action from the polling client: keep waiting, back off,
+ * restart the flow, stop and tell the user they declined. Flattened into the
+ * envelope all four arrived byte-identical, the RFC code destroyed server-side
+ * where no amount of client parsing could recover it, and the endpoint was
+ * simply not RFC 8628 compliant.
+ *
+ * ---------------------------------------------------------------------------
+ * WHY A BRAND, AND NOT "A PAYLOAD THAT HAPPENS TO CARRY `error`"
+ * ---------------------------------------------------------------------------
+ * The smaller fix considered in #153 was for the filter to sniff the payload:
+ * if it has an `error` key, pass it through untouched. Fewer lines, no new
+ * concepts — and implicit in exactly the way that hurts later. It would make an
+ * endpoint's WIRE SHAPE a consequence of the KEY NAMES somebody happened to
+ * pick inside a thrown object, decided silently and at a distance from both the
+ * throw site and the filter.
+ *
+ * `throw new BadRequestException({ error: 'could not reach the mailer' })` is a
+ * completely natural line for someone to write. Under a sniffing filter that
+ * line drops its endpoint out of the envelope, the web app's error rendering
+ * stops finding `message`, and nothing at the throw site hints at why. Nobody
+ * would connect the failure to a decision made in an exception filter over a
+ * key name.
+ *
+ * The brand inverts that. An error leaves the envelope only because someone
+ * said so, in the throw, in one word that is greppable and links back here. An
+ * ordinary exception cannot fall out of the envelope by accident no matter what
+ * keys it carries, and the next person to add an RFC-shaped endpoint finds the
+ * mechanism by following the brand from the filter or from the throw site.
+ * The cost is one file of machinery; the thing it buys is that the default
+ * cannot be broken by inattention.
+ *
+ * ---------------------------------------------------------------------------
+ * WHEN TO USE IT
+ * ---------------------------------------------------------------------------
+ * Only when an external standard dictates the body. NOT to give an endpoint a
+ * nicer error shape, and NOT to smuggle an extra field to a client: that field
+ * belongs under `details`, which the envelope already carries through. Every
+ * new use is a new shape some client has to learn, so it should be rare enough
+ * that each one is argued for.
+ */
+/**
+ * Registered via `Symbol.for` rather than a module-local `Symbol()` on purpose.
+ * The brand is set in one module and read in another, and both this module and
+ * the filter can be instantiated twice in a single process — ts-jest gives each
+ * test file its own module registry, and a `src`/`dist` double-load does the
+ * same in a mis-built container. Two module instances mean two distinct local
+ * symbols, and the brand check would then silently return false: the response
+ * would quietly revert to the flattened envelope and #153 would be back with no
+ * error anywhere. The global symbol registry is keyed by string, so every copy
+ * of this module resolves to the same symbol.
+ */
+const VERBATIM_ERROR_BODY = Symbol.for('EnterpriseAppBase.verbatimErrorBody');
+/**
+ * Mark an exception so `HttpExceptionFilter` sends its payload to the client
+ * exactly as given, instead of rebuilding it as
+ * `{ statusCode, code, message, … }`.
+ *
+ * Returns the same exception instance, so the class identity is untouched:
+ * `withVerbatimErrorBody(new BadRequestException(…))` is still a
+ * `BadRequestException` and still carries status 400. That matters — guards,
+ * interceptors and existing tests that branch on the exception type keep
+ * working, and the opt-out stays a single orthogonal fact about the response
+ * body rather than a parallel exception hierarchy.
+ *
+ * The payload MUST be an object; a string payload has nothing to send verbatim
+ * and the filter falls back to the envelope for it.
+ *
+ * Only for a body an external standard dictates (RFC 8628's
+ * `{ error, error_description }` is the one use in the reference app); see
+ * the header of this file.
+ *
+ * @param exception - The exception to brand; returned as is.
+ * @returns The same exception instance.
+ * @stability stable
+ * @example
+ * ```ts
+ * throw withVerbatimErrorBody(
+ *   new BadRequestException({ error: 'slow_down', error_description: 'Polling too fast' }),
+ * );
+ * ```
+ */
+function withVerbatimErrorBody(exception) {
+    Object.defineProperty(exception, VERBATIM_ERROR_BODY, {
+        value: true,
+        // Non-enumerable so the brand cannot leak into anything that walks the
+        // exception's own properties — a log serializer, a test snapshot, an
+        // error-reporting SDK. It is an instruction to the filter, not data.
+        enumerable: false,
+        writable: false,
+        configurable: false,
+    });
+    return exception;
+}
+/**
+ * Whether an exception opted out of the envelope. Read only by
+ * `HttpExceptionFilter`.
+ *
+ * @param exception - Anything thrown.
+ * @returns `true` only for an `HttpException` branded by
+ *   {@link withVerbatimErrorBody}.
+ * @stability stable
+ * @example
+ * ```ts
+ * hasVerbatimErrorBody(withVerbatimErrorBody(new BadRequestException({ error: 'x' }))); // true
+ * ```
+ */
+function hasVerbatimErrorBody(exception) {
+    return (exception instanceof common_1.HttpException &&
+        exception[VERBATIM_ERROR_BODY] === true);
+}
+//# sourceMappingURL=verbatim-error-body.exception.js.map

package/dist/core/errors/verbatim-error-body.exception.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verbatim-error-body.exception.js","sourceRoot":"","sources":["../../../src/core/errors/verbatim-error-body.exception.ts"],"names":[],"mappings":";;AAwGA,sDAcC;AAeD,oDAOC;AA5ID,2CAA+C;AAE/C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0DG;AAEH;;;;;;;;;;GAUG;AACH,MAAM,mBAAmB,GAAG,MAAM,CAAC,GAAG,CAAC,qCAAqC,CAAC,CAAC;AAE9E;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,SAAgB,qBAAqB,CACnC,SAAY;IAEZ,MAAM,CAAC,cAAc,CAAC,SAAS,EAAE,mBAAmB,EAAE;QACpD,KAAK,EAAE,IAAI;QACX,uEAAuE;QACvE,qEAAqE;QACrE,qEAAqE;QACrE,UAAU,EAAE,KAAK;QACjB,QAAQ,EAAE,KAAK;QACf,YAAY,EAAE,KAAK;KACpB,CAAC,CAAC;IAEH,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,SAAgB,oBAAoB,CAAC,SAAkB;IACrD,OAAO,CACL,SAAS,YAAY,sBAAa;QACjC,SAAgD,CAC/C,mBAAmB,CACpB,KAAK,IAAI,CACX,CAAC;AACJ,CAAC"}

package/dist/core/host/index.d.ts

@@ -0,0 +1,7 @@
+export { definePlatformHost } from './platform-host';
+export type { PlatformAccessPort, PlatformHost } from './platform-host';
+export { AUDIT_SINK, PLATFORM_PRISMA, SYSTEM_SETTINGS_STORE } from './ports';
+export type { AuditEventInput, AuditSink, PortBinding, PrismaClientLike, SystemSettingsSnapshot, SystemSettingsStore, } from './ports';
+export { PlatformHostModule } from './platform-host.module';
+export type { PlatformHostPorts } from './platform-host.module';
+//# sourceMappingURL=index.d.ts.map

package/dist/core/host/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/core/host/index.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AACrD,YAAY,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AACxE,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,qBAAqB,EAAE,MAAM,SAAS,CAAC;AAC7E,YAAY,EACV,eAAe,EACf,SAAS,EACT,WAAW,EACX,gBAAgB,EAChB,sBAAsB,EACtB,mBAAmB,GACpB,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAC5D,YAAY,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC"}

package/dist/core/host/index.js

@@ -0,0 +1,14 @@
+"use strict";
+// The host ports (issue #696, PP-2.7): how a packaged slice reaches app-owned
+// capabilities without importing app code. Recipe: ../README.md, "Host ports".
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PlatformHostModule = exports.SYSTEM_SETTINGS_STORE = exports.PLATFORM_PRISMA = exports.AUDIT_SINK = exports.definePlatformHost = void 0;
+var platform_host_1 = require("./platform-host");
+Object.defineProperty(exports, "definePlatformHost", { enumerable: true, get: function () { return platform_host_1.definePlatformHost; } });
+var ports_1 = require("./ports");
+Object.defineProperty(exports, "AUDIT_SINK", { enumerable: true, get: function () { return ports_1.AUDIT_SINK; } });
+Object.defineProperty(exports, "PLATFORM_PRISMA", { enumerable: true, get: function () { return ports_1.PLATFORM_PRISMA; } });
+Object.defineProperty(exports, "SYSTEM_SETTINGS_STORE", { enumerable: true, get: function () { return ports_1.SYSTEM_SETTINGS_STORE; } });
+var platform_host_module_1 = require("./platform-host.module");
+Object.defineProperty(exports, "PlatformHostModule", { enumerable: true, get: function () { return platform_host_module_1.PlatformHostModule; } });
+//# sourceMappingURL=index.js.map

package/dist/core/host/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/core/host/index.ts"],"names":[],"mappings":";AAAA,8EAA8E;AAC9E,+EAA+E;;;AAE/E,iDAAqD;AAA5C,mHAAA,kBAAkB,OAAA;AAE3B,iCAA6E;AAApE,mGAAA,UAAU,OAAA;AAAE,wGAAA,eAAe,OAAA;AAAE,8GAAA,qBAAqB,OAAA;AAS3D,+DAA4D;AAAnD,0HAAA,kBAAkB,OAAA"}

package/dist/core/host/platform-host.d.ts

@@ -0,0 +1,58 @@
+/**
+ * How a packaged controller authenticates and authorizes its caller, supplied
+ * by the app. Each function returns ONE decorator (usually the app's own
+ * `applyDecorators(...)` composite) that a packaged controller applies to a
+ * handler or a class.
+ *
+ * @stability experimental
+ */
+export interface PlatformAccessPort {
+    /**
+     * Decorators that authenticate the caller AND require every listed
+     * permission. Must never be a no-op.
+     *
+     * @param permissions - the permission strings, all required; never empty.
+     */
+    requirePermissions(permissions: readonly string[]): MethodDecorator & ClassDecorator;
+    /** Decorators that authenticate the caller with no specific permission. */
+    requireAuthenticated(): MethodDecorator & ClassDecorator;
+}
+/**
+ * Everything a packaged slice needs from the app at decorator time. Built once
+ * with {@link definePlatformHost} and passed to every slice's `forRoot({ host })`.
+ *
+ * @stability experimental
+ */
+export interface PlatformHost {
+    /** The app's authentication and authorization decorators. */
+    readonly access: PlatformAccessPort;
+}
+/**
+ * Validates and freezes the app's platform host.
+ *
+ * Checks that `access.requirePermissions` and `access.requireAuthenticated`
+ * are functions and that each returns a decorator (both are called once, with
+ * a probe permission, to find out). The returned host wraps them so a later
+ * call that returns something else, or `requirePermissions([])`, throws too.
+ * Passing an already-defined host returns it unchanged.
+ *
+ * @param host - the app's access decorators.
+ * @returns the frozen, validated host.
+ * @throws Error when either access function is missing or returns a non-function.
+ *
+ * @example
+ * ```ts
+ * // apps/api/src/platform/platform-host.ts
+ * export const platformHost = definePlatformHost({
+ *   access: {
+ *     requirePermissions: (permissions) => Auth({ permissions: [...permissions] as PermissionName[] }),
+ *     requireAuthenticated: () => Auth(),
+ *   },
+ * });
+ * ```
+ *
+ * @extensionPoint option
+ * @stability experimental
+ */
+export declare function definePlatformHost(host: PlatformHost): PlatformHost;
+//# sourceMappingURL=platform-host.d.ts.map

package/dist/core/host/platform-host.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform-host.d.ts","sourceRoot":"","sources":["../../../src/core/host/platform-host.ts"],"names":[],"mappings":"AAkBA;;;;;;;GAOG;AACH,MAAM,WAAW,kBAAkB;IACjC;;;;;OAKG;IACH,kBAAkB,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,GAAG,eAAe,GAAG,cAAc,CAAC;IACrF,2EAA2E;IAC3E,oBAAoB,IAAI,eAAe,GAAG,cAAc,CAAC;CAC1D;AAED;;;;;GAKG;AACH,MAAM,WAAW,YAAY;IAC3B,6DAA6D;IAC7D,QAAQ,CAAC,MAAM,EAAE,kBAAkB,CAAC;CACrC;AA+BD;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,YAAY,GAAG,YAAY,CA+BnE"}

package/dist/core/host/platform-host.js

@@ -0,0 +1,104 @@
+"use strict";
+// =============================================================================
+// The decorator-time host port (issue #696, PP-2.7)
+// =============================================================================
+//
+// A packaged controller must authenticate and authorize its caller exactly as
+// the app's own controllers do, without importing the app's auth code. Nest
+// applies decorators when a class is DEFINED, long before any container
+// exists, so access cannot be an injection token: it is a static port, built
+// once by the app (`apps/api/src/platform/platform-host.ts`) and handed to each
+// slice's `forRoot({ host })`. The slice then creates its controller class
+// inside `forRoot` with the host's decorators (the controller-factory recipe,
+// README.md next to this folder).
+//
+// FAIL CLOSED. `definePlatformHost` refuses a host whose access functions are
+// missing or do not return decorators, and a gate with no permission at all,
+// so a packaged route can never be public by accident.
+// =============================================================================
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.definePlatformHost = definePlatformHost;
+/** Hosts already validated and frozen, so passing one twice is free. */
+const definedHosts = new WeakSet();
+/** A permission string the define-time probe passes; never enforced anywhere. */
+const PROBE_PERMISSION = 'platform:probe';
+function fail(why) {
+    throw new Error(`definePlatformHost: ${why}. A platform host must supply working access decorators; ` +
+        'without them a packaged route would have no access check, and a platform route is never public.');
+}
+function assertDecorator(value, name) {
+    if (typeof value !== 'function')
+        fail(`access.${name}() returned ${value === null ? 'null' : typeof value}, not a decorator`);
+}
+function assertPermissions(permissions) {
+    if (!Array.isArray(permissions) || permissions.length === 0) {
+        fail('access.requirePermissions() was called with no permission; use requireAuthenticated() for "any signed-in caller"');
+    }
+    for (const permission of permissions) {
+        if (typeof permission !== 'string' || permission.trim() === '') {
+            fail(`access.requirePermissions() was called with an invalid permission ${JSON.stringify(permission)}`);
+        }
+    }
+    return permissions;
+}
+/**
+ * Validates and freezes the app's platform host.
+ *
+ * Checks that `access.requirePermissions` and `access.requireAuthenticated`
+ * are functions and that each returns a decorator (both are called once, with
+ * a probe permission, to find out). The returned host wraps them so a later
+ * call that returns something else, or `requirePermissions([])`, throws too.
+ * Passing an already-defined host returns it unchanged.
+ *
+ * @param host - the app's access decorators.
+ * @returns the frozen, validated host.
+ * @throws Error when either access function is missing or returns a non-function.
+ *
+ * @example
+ * ```ts
+ * // apps/api/src/platform/platform-host.ts
+ * export const platformHost = definePlatformHost({
+ *   access: {
+ *     requirePermissions: (permissions) => Auth({ permissions: [...permissions] as PermissionName[] }),
+ *     requireAuthenticated: () => Auth(),
+ *   },
+ * });
+ * ```
+ *
+ * @extensionPoint option
+ * @stability experimental
+ */
+function definePlatformHost(host) {
+    if (host !== null && typeof host === 'object' && definedHosts.has(host))
+        return host;
+    if (host === null || typeof host !== 'object')
+        fail('no host was given');
+    const access = host.access;
+    if (access === null || typeof access !== 'object')
+        fail('`access` is missing');
+    if (typeof access.requirePermissions !== 'function')
+        fail('`access.requirePermissions` is missing or not a function');
+    if (typeof access.requireAuthenticated !== 'function')
+        fail('`access.requireAuthenticated` is missing or not a function');
+    const requirePermissions = access.requirePermissions.bind(access);
+    const requireAuthenticated = access.requireAuthenticated.bind(access);
+    assertDecorator(requirePermissions([PROBE_PERMISSION]), 'requirePermissions');
+    assertDecorator(requireAuthenticated(), 'requireAuthenticated');
+    const defined = Object.freeze({
+        access: Object.freeze({
+            requirePermissions(permissions) {
+                const decorator = requirePermissions([...assertPermissions(permissions)]);
+                assertDecorator(decorator, 'requirePermissions');
+                return decorator;
+            },
+            requireAuthenticated() {
+                const decorator = requireAuthenticated();
+                assertDecorator(decorator, 'requireAuthenticated');
+                return decorator;
+            },
+        }),
+    });
+    definedHosts.add(defined);
+    return defined;
+}
+//# sourceMappingURL=platform-host.js.map

package/dist/core/host/platform-host.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform-host.js","sourceRoot":"","sources":["../../../src/core/host/platform-host.ts"],"names":[],"mappings":";AAAA,gFAAgF;AAChF,oDAAoD;AACpD,gFAAgF;AAChF,EAAE;AACF,8EAA8E;AAC9E,4EAA4E;AAC5E,wEAAwE;AACxE,6EAA6E;AAC7E,gFAAgF;AAChF,2EAA2E;AAC3E,8EAA8E;AAC9E,kCAAkC;AAClC,EAAE;AACF,8EAA8E;AAC9E,6EAA6E;AAC7E,uDAAuD;AACvD,gFAAgF;;AAyFhF,gDA+BC;AAvFD,wEAAwE;AACxE,MAAM,YAAY,GAAG,IAAI,OAAO,EAAU,CAAC;AAE3C,iFAAiF;AACjF,MAAM,gBAAgB,GAAG,gBAAgB,CAAC;AAE1C,SAAS,IAAI,CAAC,GAAW;IACvB,MAAM,IAAI,KAAK,CACb,uBAAuB,GAAG,2DAA2D;QACnF,iGAAiG,CACpG,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,KAAc,EAAE,IAAY;IACnD,IAAI,OAAO,KAAK,KAAK,UAAU;QAAE,IAAI,CAAC,UAAU,IAAI,eAAe,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,KAAK,mBAAmB,CAAC,CAAC;AAChI,CAAC;AAED,SAAS,iBAAiB,CAAC,WAAoB;IAC7C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5D,IAAI,CAAC,kHAAkH,CAAC,CAAC;IAC3H,CAAC;IACD,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;QACrC,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;YAC/D,IAAI,CAAC,qEAAqE,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QAC1G,CAAC;IACH,CAAC;IACD,OAAO,WAAgC,CAAC;AAC1C,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,SAAgB,kBAAkB,CAAC,IAAkB;IACnD,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACrF,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,IAAI,CAAC,mBAAmB,CAAC,CAAC;IAEzE,MAAM,MAAM,GAAI,IAA6B,CAAC,MAAiD,CAAC;IAChG,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,IAAI,CAAC,qBAAqB,CAAC,CAAC;IAC/E,IAAI,OAAO,MAAM,CAAC,kBAAkB,KAAK,UAAU;QAAE,IAAI,CAAC,0DAA0D,CAAC,CAAC;IACtH,IAAI,OAAO,MAAM,CAAC,oBAAoB,KAAK,UAAU;QAAE,IAAI,CAAC,4DAA4D,CAAC,CAAC;IAE1H,MAAM,kBAAkB,GAAG,MAAM,CAAC,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAClE,MAAM,oBAAoB,GAAG,MAAM,CAAC,oBAAoB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAEtE,eAAe,CAAC,kBAAkB,CAAC,CAAC,gBAAgB,CAAC,CAAC,EAAE,oBAAoB,CAAC,CAAC;IAC9E,eAAe,CAAC,oBAAoB,EAAE,EAAE,sBAAsB,CAAC,CAAC;IAEhE,MAAM,OAAO,GAAiB,MAAM,CAAC,MAAM,CAAC;QAC1C,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC;YACpB,kBAAkB,CAAC,WAA8B;gBAC/C,MAAM,SAAS,GAAG,kBAAkB,CAAC,CAAC,GAAG,iBAAiB,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;gBAC1E,eAAe,CAAC,SAAS,EAAE,oBAAoB,CAAC,CAAC;gBACjD,OAAO,SAAS,CAAC;YACnB,CAAC;YACD,oBAAoB;gBAClB,MAAM,SAAS,GAAG,oBAAoB,EAAE,CAAC;gBACzC,eAAe,CAAC,SAAS,EAAE,sBAAsB,CAAC,CAAC;gBACnD,OAAO,SAAS,CAAC;YACnB,CAAC;SACF,CAAC;KACH,CAAC,CAAC;IACH,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAC1B,OAAO,OAAO,CAAC;AACjB,CAAC"}