@nodii/grpc-interceptors 0.0.1 → 0.2.0

package/dist/interceptors/saga-headers.js

@@ -0,0 +1,40 @@
+// withSagaHeaders — spec § 5.1.
+//
+// D25 client-side header auto-injector. When a saga is active on the
+// current ALS context (via `@nodii/saga.currentSaga()`), stamps:
+//
+//   - x-nodii-saga-id            — the active saga id
+//   - x-nodii-saga-tenant-id     — the active saga tenant (if any)
+//
+// onto outbound gRPC metadata. This is the @grpc/grpc-js client
+// interceptor shape — returns an interceptor factory that the consumer
+// passes to `grpc.credentials.createFromInterceptors` or the client
+// constructor's `interceptors` option.
+//
+// When no saga is active or `@nodii/saga` is not initialized: the
+// interceptor is still installed but adds no headers (pure passthrough).
+import { currentSaga, getSagaOrNull } from "@nodii/saga";
+export function withSagaHeaders() {
+    return (options) => {
+        const saga = getSagaOrNull();
+        if (!saga)
+            return;
+        try {
+            const handle = currentSaga();
+            if (!handle)
+                return;
+            const md = options.metadata;
+            if (!md)
+                return;
+            md.set("x-nodii-saga-id", handle.id);
+            if (handle.tenantId) {
+                md.set("x-nodii-saga-tenant-id", handle.tenantId);
+            }
+        }
+        catch {
+            // currentSaga() throws when no saga in ALS — that's fine, just
+            // skip header injection.
+        }
+    };
+}
+//# sourceMappingURL=saga-headers.js.map

package/dist/interceptors/saga-headers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"saga-headers.js","sourceRoot":"","sources":["../../src/interceptors/saga-headers.ts"],"names":[],"mappings":"AAAA,gCAAgC;AAChC,EAAE;AACF,qEAAqE;AACrE,iEAAiE;AACjE,EAAE;AACF,sDAAsD;AACtD,mEAAmE;AACnE,EAAE;AACF,gEAAgE;AAChE,uEAAuE;AACvE,oEAAoE;AACpE,uCAAuC;AACvC,EAAE;AACF,kEAAkE;AAClE,yEAAyE;AAEzE,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAyBzD,MAAM,UAAU,eAAe;IAC7B,OAAO,CAAC,OAA0B,EAAQ,EAAE;QAC1C,MAAM,IAAI,GAAG,aAAa,EAAE,CAAC;QAC7B,IAAI,CAAC,IAAI;YAAE,OAAO;QAClB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,WAAW,EAAE,CAAC;YAC7B,IAAI,CAAC,MAAM;gBAAE,OAAO;YACpB,MAAM,EAAE,GAAG,OAAO,CAAC,QAAQ,CAAC;YAC5B,IAAI,CAAC,EAAE;gBAAE,OAAO;YAChB,EAAE,CAAC,GAAG,CAAC,iBAAiB,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;YACrC,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;gBACpB,EAAE,CAAC,GAAG,CAAC,wBAAwB,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;YACpD,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,+DAA+D;YAC/D,yBAAyB;QAC3B,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}

package/dist/interceptors/signal-binder.d.ts

@@ -0,0 +1,3 @@
+import type { UnaryInterceptor } from "../types";
+export declare function signalBinder(): UnaryInterceptor;
+//# sourceMappingURL=signal-binder.d.ts.map

package/dist/interceptors/signal-binder.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"signal-binder.d.ts","sourceRoot":"","sources":["../../src/interceptors/signal-binder.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EAA2B,gBAAgB,EAAE,MAAM,UAAU,CAAC;AAiB1E,wBAAgB,YAAY,IAAI,gBAAgB,CAgD/C"}

package/dist/interceptors/signal-binder.js

@@ -0,0 +1,83 @@
+// signalBinder — spec § 5.4 line 6.
+//
+// Server-side interceptor that reads inbound `x-nodii-saga-signal-*`
+// headers on the call and (if a signal payload was attached out-of-band)
+// routes it into the saga signal bus so the handler can `awaitSagaSignal`
+// it. This bridges the gRPC transport to the saga signal-bus surface.
+//
+// Headers consumed:
+//   - `x-nodii-saga-signal-event-type` — the event type to publish
+//   - `x-nodii-saga-signal-payload`    — JSON payload (utf-8)
+//   - `x-nodii-saga-signal-from`       — origin saga id
+//   - `x-nodii-saga-signal-scope`      — siblings | global (default siblings)
+//
+// When `x-nodii-saga-signal-event-type` is absent: no-op passthrough.
+// When `@nodii/saga` is not initialized: also no-op (defensive — test
+// harnesses + services that don't run saga can still use this lib's
+// stack).
+import { getSagaOrNull } from "@nodii/saga";
+import { resolveTelemetry } from "../telemetry-shim";
+function readHeader(call, key) {
+    const values = call.metadata?.get(key);
+    if (!values || values.length === 0)
+        return undefined;
+    const first = values[0];
+    if (typeof first === "string")
+        return first;
+    if (first instanceof Uint8Array || Buffer.isBuffer?.(first)) {
+        try {
+            return Buffer.from(first).toString("utf8");
+        }
+        catch {
+            return undefined;
+        }
+    }
+    return undefined;
+}
+export function signalBinder() {
+    return (_methodName, handler) => {
+        return async (call) => {
+            const eventType = readHeader(call, "x-nodii-saga-signal-event-type");
+            if (!eventType)
+                return handler(call);
+            const saga = getSagaOrNull();
+            if (!saga) {
+                // Saga library not initialized — defensive no-op.
+                return handler(call);
+            }
+            const fromSaga = readHeader(call, "x-nodii-saga-signal-from");
+            const payloadRaw = readHeader(call, "x-nodii-saga-signal-payload");
+            const scopeRaw = readHeader(call, "x-nodii-saga-signal-scope");
+            const scope = scopeRaw === "global" ? "global" : "siblings";
+            let payload = null;
+            if (payloadRaw) {
+                try {
+                    payload = JSON.parse(payloadRaw);
+                }
+                catch {
+                    payload = payloadRaw;
+                }
+            }
+            // We can't address a saga we're not the owner of; instead we publish
+            // to the bus tagged with `from` so awaitSagaSignal observers can pick
+            // it up. The saga signal-bus accepts emit() from any context.
+            try {
+                await saga.signalBus.emit({
+                    sagaId: fromSaga ?? "external",
+                    eventType,
+                    payload,
+                    scope,
+                    to: undefined,
+                });
+            }
+            catch (err) {
+                resolveTelemetry().logger.warn("signal_binder.emit_failed", {
+                    event_type: eventType,
+                    error: err instanceof Error ? err.message : String(err),
+                });
+            }
+            return handler(call);
+        };
+    };
+}
+//# sourceMappingURL=signal-binder.js.map

package/dist/interceptors/signal-binder.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"signal-binder.js","sourceRoot":"","sources":["../../src/interceptors/signal-binder.ts"],"names":[],"mappings":"AAAA,oCAAoC;AACpC,EAAE;AACF,qEAAqE;AACrE,yEAAyE;AACzE,0EAA0E;AAC1E,sEAAsE;AACtE,EAAE;AACF,oBAAoB;AACpB,mEAAmE;AACnE,8DAA8D;AAC9D,wDAAwD;AACxD,8EAA8E;AAC9E,EAAE;AACF,sEAAsE;AACtE,sEAAsE;AACtE,oEAAoE;AACpE,UAAU;AAEV,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAGrD,SAAS,UAAU,CAAC,IAAe,EAAE,GAAW;IAC9C,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;IACvC,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IACrD,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;IACxB,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5C,IAAI,KAAK,YAAY,UAAU,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5D,IAAI,CAAC;YACH,OAAO,MAAM,CAAC,IAAI,CAAC,KAAmB,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC3D,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,YAAY;IAC1B,OAAO,CAAC,WAAmB,EAAE,OAAqB,EAAgB,EAAE;QAClE,OAAO,KAAK,EAAE,IAAe,EAAoB,EAAE;YACjD,MAAM,SAAS,GAAG,UAAU,CAAC,IAAI,EAAE,gCAAgC,CAAC,CAAC;YACrE,IAAI,CAAC,SAAS;gBAAE,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC;YAErC,MAAM,IAAI,GAAG,aAAa,EAAE,CAAC;YAC7B,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,kDAAkD;gBAClD,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC;YACvB,CAAC;YAED,MAAM,QAAQ,GAAG,UAAU,CAAC,IAAI,EAAE,0BAA0B,CAAC,CAAC;YAC9D,MAAM,UAAU,GAAG,UAAU,CAAC,IAAI,EAAE,6BAA6B,CAAC,CAAC;YACnE,MAAM,QAAQ,GAAG,UAAU,CAAC,IAAI,EAAE,2BAA2B,CAAC,CAAC;YAC/D,MAAM,KAAK,GACT,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC;YAEhD,IAAI,OAAO,GAAY,IAAI,CAAC;YAC5B,IAAI,UAAU,EAAE,CAAC;gBACf,IAAI,CAAC;oBACH,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;gBACnC,CAAC;gBAAC,MAAM,CAAC;oBACP,OAAO,GAAG,UAAU,CAAC;gBACvB,CAAC;YACH,CAAC;YAED,qEAAqE;YACrE,sEAAsE;YACtE,8DAA8D;YAC9D,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;oBACxB,MAAM,EAAE,QAAQ,IAAI,UAAU;oBAC9B,SAAS;oBACT,OAAO;oBACP,KAAK;oBACL,EAAE,EAAE,SAAS;iBACd,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,gBAAgB,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,2BAA2B,EAAE;oBAC1D,UAAU,EAAE,SAAS;oBACrB,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;iBACxD,CAAC,CAAC;YACL,CAAC;YAED,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC;QACvB,CAAC,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC"}

package/dist/interceptors/tenant-context.d.ts

@@ -0,0 +1,3 @@
+import type { TenantContextConfig, UnaryInterceptor } from "../types";
+export declare function tenantContext(config: TenantContextConfig): UnaryInterceptor;
+//# sourceMappingURL=tenant-context.d.ts.map

package/dist/interceptors/tenant-context.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tenant-context.d.ts","sourceRoot":"","sources":["../../src/interceptors/tenant-context.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EACV,mBAAmB,EAGnB,gBAAgB,EACjB,MAAM,UAAU,CAAC;AAGlB,wBAAgB,aAAa,CAAC,MAAM,EAAE,mBAAmB,GAAG,gBAAgB,CAmC3E"}

package/dist/interceptors/tenant-context.js

@@ -0,0 +1,40 @@
+// tenantContext — spec § 5.8.
+//
+// On call entry: issues `SET LOCAL app.tenant_id = '<tenant_id>'` on the
+// configured Postgres connection. If `call.auth.userActor` is present, also
+// sets `app.user_id`. Skipped for methods in `systemContextMethods`.
+//
+// The connection lifecycle (acquire / release) is the *consumer's*
+// responsibility — this library only writes the GUC. Real wiring with
+// `pg.Pool` / `drizzle` rides as `DbConnection`.
+import { GrpcStatusError } from "../types";
+export function tenantContext(config) {
+    if (!config.db) {
+        throw new GrpcStatusError("INTERNAL", "tenant_context_db_unconfigured");
+    }
+    const systemMethods = config.systemContextMethods ?? new Set();
+    return (methodName, handler) => {
+        return async (call) => {
+            if (systemMethods.has(methodName))
+                return handler(call);
+            const tenantId = call.auth?.requestContext?.tenant_id;
+            if (!tenantId) {
+                // enrichAuthContext should have rejected — defensive.
+                throw new GrpcStatusError("FAILED_PRECONDITION", "tenant_context_required");
+            }
+            // `SET LOCAL app.tenant_id = $1` (Postgres requires literal for
+            // identifier/SET; use parameter-binding via set_config for safety).
+            await config.db.exec("SELECT set_config('app.tenant_id', $1, true)", [
+                tenantId,
+            ]);
+            const userId = call.auth?.userActor?.user_id;
+            if (userId) {
+                await config.db.exec("SELECT set_config('app.user_id', $1, true)", [
+                    userId,
+                ]);
+            }
+            return handler(call);
+        };
+    };
+}
+//# sourceMappingURL=tenant-context.js.map

package/dist/interceptors/tenant-context.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tenant-context.js","sourceRoot":"","sources":["../../src/interceptors/tenant-context.ts"],"names":[],"mappings":"AAAA,8BAA8B;AAC9B,EAAE;AACF,yEAAyE;AACzE,4EAA4E;AAC5E,qEAAqE;AACrE,EAAE;AACF,mEAAmE;AACnE,sEAAsE;AACtE,iDAAiD;AAQjD,OAAO,EAAE,eAAe,EAAE,MAAM,UAAU,CAAC;AAE3C,MAAM,UAAU,aAAa,CAAC,MAA2B;IACvD,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,MAAM,IAAI,eAAe,CAAC,UAAU,EAAE,gCAAgC,CAAC,CAAC;IAC1E,CAAC;IACD,MAAM,aAAa,GAAG,MAAM,CAAC,oBAAoB,IAAI,IAAI,GAAG,EAAU,CAAC;IAEvE,OAAO,CAAC,UAAkB,EAAE,OAAqB,EAAgB,EAAE;QACjE,OAAO,KAAK,EAAE,IAAe,EAAoB,EAAE;YACjD,IAAI,aAAa,CAAC,GAAG,CAAC,UAAU,CAAC;gBAAE,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC;YAExD,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,EAAE,cAAc,EAAE,SAAS,CAAC;YACtD,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,sDAAsD;gBACtD,MAAM,IAAI,eAAe,CACvB,qBAAqB,EACrB,yBAAyB,CAC1B,CAAC;YACJ,CAAC;YAED,gEAAgE;YAChE,oEAAoE;YACpE,MAAM,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,8CAA8C,EAAE;gBACnE,QAAQ;aACT,CAAC,CAAC;YAEH,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,OAAO,CAAC;YAC7C,IAAI,MAAM,EAAE,CAAC;gBACX,MAAM,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,4CAA4C,EAAE;oBACjE,MAAM;iBACP,CAAC,CAAC;YACL,CAAC;YAED,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC;QACvB,CAAC,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC"}

package/dist/interceptors-exports.d.ts

@@ -0,0 +1,9 @@
+export { withLoggingUnary } from "./interceptors/logging";
+export { withAuditUnary } from "./interceptors/audit";
+export { enrichAuthContext } from "./interceptors/enrich-auth";
+export { tenantContext } from "./interceptors/tenant-context";
+export { auditContext } from "./interceptors/audit-context";
+export { deadlineGuard } from "./interceptors/deadline-guard";
+export { cancellationGuard } from "./interceptors/cancellation-guard";
+export { errorMap, STANDARD_ERROR_CATALOG, } from "./interceptors/error-map";
+//# sourceMappingURL=interceptors-exports.d.ts.map

package/dist/interceptors-exports.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"interceptors-exports.d.ts","sourceRoot":"","sources":["../src/interceptors-exports.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAC/D,OAAO,EAAE,aAAa,EAAE,MAAM,+BAA+B,CAAC;AAC9D,OAAO,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AAC5D,OAAO,EAAE,aAAa,EAAE,MAAM,+BAA+B,CAAC;AAC9D,OAAO,EAAE,iBAAiB,EAAE,MAAM,mCAAmC,CAAC;AACtE,OAAO,EACL,QAAQ,EACR,sBAAsB,GACvB,MAAM,0BAA0B,CAAC"}

package/dist/interceptors-exports.js

@@ -0,0 +1,12 @@
+// Internal barrel — owned-interceptor exports used by both `factory.ts`
+// (createStandardServerStack) and `configure.ts` (configureGrpcInterceptors).
+// Keeping this internal sidesteps the circular re-export through `index.ts`.
+export { withLoggingUnary } from "./interceptors/logging";
+export { withAuditUnary } from "./interceptors/audit";
+export { enrichAuthContext } from "./interceptors/enrich-auth";
+export { tenantContext } from "./interceptors/tenant-context";
+export { auditContext } from "./interceptors/audit-context";
+export { deadlineGuard } from "./interceptors/deadline-guard";
+export { cancellationGuard } from "./interceptors/cancellation-guard";
+export { errorMap, STANDARD_ERROR_CATALOG, } from "./interceptors/error-map";
+//# sourceMappingURL=interceptors-exports.js.map

package/dist/interceptors-exports.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"interceptors-exports.js","sourceRoot":"","sources":["../src/interceptors-exports.ts"],"names":[],"mappings":"AAAA,wEAAwE;AACxE,8EAA8E;AAC9E,6EAA6E;AAE7E,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAC/D,OAAO,EAAE,aAAa,EAAE,MAAM,+BAA+B,CAAC;AAC9D,OAAO,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AAC5D,OAAO,EAAE,aAAa,EAAE,MAAM,+BAA+B,CAAC;AAC9D,OAAO,EAAE,iBAAiB,EAAE,MAAM,mCAAmC,CAAC;AACtE,OAAO,EACL,QAAQ,EACR,sBAAsB,GACvB,MAAM,0BAA0B,CAAC"}

package/dist/reexports.d.ts

@@ -0,0 +1,10 @@
+export { withAuthUnary, createServerAuthInterceptor, requireScope, grpcError, type WithAuthUnaryOptions, type ServerAuthOptions, } from "@nodii/grpc-auth/server";
+export { createClientAuthInterceptor, S2STokenManager, } from "@nodii/grpc-auth/client";
+export type { S2SAuthContext, ServerUnaryCallWithAuth, } from "@nodii/grpc-auth/types";
+export { sagaContext, emitSagaSignal, awaitSagaSignal, awaitChildren, awaitAnySibling, getSiblings, currentSaga, initSaga, getSagaOrNull, SagaContextRequired, } from "@nodii/saga";
+export type { SagaContextInterceptorOpts, SagaInterceptorCall, InitSagaConfig, } from "@nodii/saga";
+export { idempotencyGuard, IdempotencyServiceError, wrapForWebhook, wrapConsumerWorker, wrapForSagaStep, computeIdempotencyKey, initIdempotency, getIdempotencyOrNull, } from "@nodii/idempotency";
+export type { IdempotencyGuardConfig, UnaryCallLike as IdempotencyUnaryCallLike, InitIdempotencyConfig, } from "@nodii/idempotency";
+export { signalBinder } from "./interceptors/signal-binder";
+export { withSagaHeaders } from "./interceptors/saga-headers";
+//# sourceMappingURL=reexports.d.ts.map

package/dist/reexports.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"reexports.d.ts","sourceRoot":"","sources":["../src/reexports.ts"],"names":[],"mappings":"AAcA,OAAO,EACL,aAAa,EACb,2BAA2B,EAC3B,YAAY,EACZ,SAAS,EACT,KAAK,oBAAoB,EACzB,KAAK,iBAAiB,GACvB,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EACL,2BAA2B,EAC3B,eAAe,GAChB,MAAM,yBAAyB,CAAC;AAEjC,YAAY,EACV,cAAc,EACd,uBAAuB,GACxB,MAAM,wBAAwB,CAAC;AAIhC,OAAO,EACL,WAAW,EACX,cAAc,EACd,eAAe,EACf,aAAa,EACb,eAAe,EACf,WAAW,EACX,WAAW,EACX,QAAQ,EACR,aAAa,EACb,mBAAmB,GACpB,MAAM,aAAa,CAAC;AAErB,YAAY,EACV,0BAA0B,EAC1B,mBAAmB,EACnB,cAAc,GACf,MAAM,aAAa,CAAC;AAIrB,OAAO,EACL,gBAAgB,EAChB,uBAAuB,EACvB,cAAc,EACd,kBAAkB,EAClB,eAAe,EACf,qBAAqB,EACrB,eAAe,EACf,oBAAoB,GACrB,MAAM,oBAAoB,CAAC;AAE5B,YAAY,EACV,sBAAsB,EACtB,aAAa,IAAI,wBAAwB,EACzC,qBAAqB,GACtB,MAAM,oBAAoB,CAAC;AAS5B,OAAO,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AAC5D,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC"}

package/dist/reexports.js

@@ -0,0 +1,27 @@
+// Re-export façade — spec § 5.1.
+//
+// v0.1.1: real re-exports from @nodii/saga + @nodii/idempotency now that
+// both libraries have landed at v0.1.1 (sibling impl on main per the redo
+// PRs). Per Q4 resolution: re-exports are bytewise identical to importing
+// from the source package — same module instance, same identity.
+//
+// `signalBinder` and `withSagaHeaders` are owned thin wrappers around the
+// saga signal-bus + saga ALS context (saga does not ship them under those
+// names; this library defines the canonical cross-cutting interceptor
+// surface for them per spec § 5.1).
+// ── @nodii/grpc-auth re-exports (real) ───────────────────────────────────────
+export { withAuthUnary, createServerAuthInterceptor, requireScope, grpcError, } from "@nodii/grpc-auth/server";
+export { createClientAuthInterceptor, S2STokenManager, } from "@nodii/grpc-auth/client";
+// ── @nodii/saga re-exports (real) ────────────────────────────────────────────
+export { sagaContext, emitSagaSignal, awaitSagaSignal, awaitChildren, awaitAnySibling, getSiblings, currentSaga, initSaga, getSagaOrNull, SagaContextRequired, } from "@nodii/saga";
+// ── @nodii/idempotency re-exports (real) ─────────────────────────────────────
+export { idempotencyGuard, IdempotencyServiceError, wrapForWebhook, wrapConsumerWorker, wrapForSagaStep, computeIdempotencyKey, initIdempotency, getIdempotencyOrNull, } from "@nodii/idempotency";
+// ── Owned interceptors: signalBinder + withSagaHeaders ──────────────────────
+//
+// These are cross-cutting glue between the gRPC layer and saga. They live
+// here (not in @nodii/saga) so that the canonical interceptor surface in
+// `@nodii/grpc-interceptors` owns the wire shape. Both operate against the
+// saga library's bootstrapped state — no new state introduced.
+export { signalBinder } from "./interceptors/signal-binder";
+export { withSagaHeaders } from "./interceptors/saga-headers";
+//# sourceMappingURL=reexports.js.map

package/dist/reexports.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"reexports.js","sourceRoot":"","sources":["../src/reexports.ts"],"names":[],"mappings":"AAAA,iCAAiC;AACjC,EAAE;AACF,yEAAyE;AACzE,0EAA0E;AAC1E,0EAA0E;AAC1E,iEAAiE;AACjE,EAAE;AACF,0EAA0E;AAC1E,0EAA0E;AAC1E,sEAAsE;AACtE,oCAAoC;AAEpC,gFAAgF;AAEhF,OAAO,EACL,aAAa,EACb,2BAA2B,EAC3B,YAAY,EACZ,SAAS,GAGV,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EACL,2BAA2B,EAC3B,eAAe,GAChB,MAAM,yBAAyB,CAAC;AAOjC,gFAAgF;AAEhF,OAAO,EACL,WAAW,EACX,cAAc,EACd,eAAe,EACf,aAAa,EACb,eAAe,EACf,WAAW,EACX,WAAW,EACX,QAAQ,EACR,aAAa,EACb,mBAAmB,GACpB,MAAM,aAAa,CAAC;AAQrB,gFAAgF;AAEhF,OAAO,EACL,gBAAgB,EAChB,uBAAuB,EACvB,cAAc,EACd,kBAAkB,EAClB,eAAe,EACf,qBAAqB,EACrB,eAAe,EACf,oBAAoB,GACrB,MAAM,oBAAoB,CAAC;AAQ5B,+EAA+E;AAC/E,EAAE;AACF,0EAA0E;AAC1E,yEAAyE;AACzE,2EAA2E;AAC3E,+DAA+D;AAE/D,OAAO,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AAC5D,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC"}

package/dist/telemetry-shim.d.ts

@@ -0,0 +1,12 @@
+import type { TelemetryShim } from "./types";
+/**
+ * Resolve `@nodii/telemetry` lazily. Cached after first successful import.
+ * Returns a stderr-JSON fallback if the peer is unavailable so the
+ * interceptor chain stays usable in tests that don't init telemetry.
+ */
+export declare function resolveTelemetry(): TelemetryShim;
+/** Test-only — drop cached resolver. */
+export declare function _resetTelemetryShimForTests(): void;
+/** Test-only — inject a fake telemetry shim. */
+export declare function _setTelemetryShimForTests(shim: TelemetryShim): void;
+//# sourceMappingURL=telemetry-shim.d.ts.map

package/dist/telemetry-shim.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"telemetry-shim.d.ts","sourceRoot":"","sources":["../src/telemetry-shim.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAmC,aAAa,EAAE,MAAM,SAAS,CAAC;AA+C9E;;;;GAIG;AACH,wBAAgB,gBAAgB,IAAI,aAAa,CA4BhD;AAED,wCAAwC;AACxC,wBAAgB,2BAA2B,IAAI,IAAI,CAElD;AAED,gDAAgD;AAChD,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,aAAa,GAAG,IAAI,CAEnE"}

package/dist/telemetry-shim.js

@@ -0,0 +1,94 @@
+// Lazy telemetry resolver — keeps the interceptor library from
+// crashing-on-import when `@nodii/telemetry` is present but not yet
+// bootstrapped (services boot grpc-auth → saga → idempotency → telemetry
+// in that order; the interceptor stack assembly runs last).
+//
+// The shim re-exposes only the surface this library uses:
+//   - logger.{debug,info,warn,error}
+//   - audit.emit
+//
+// At call time it tries to import `@nodii/telemetry`; on failure (peer
+// not installed, init not run yet) it falls back to a stderr-JSON logger
+// + no-op audit. This guarantees the interceptor chain never throws
+// because telemetry isn't initialized — that's the service's choice.
+const stderrLogger = {
+    debug(msg, fields) {
+        write("debug", msg, fields);
+    },
+    info(msg, fields) {
+        write("info", msg, fields);
+    },
+    warn(msg, fields) {
+        write("warn", msg, fields);
+    },
+    error(msg, fields) {
+        write("error", msg, fields);
+    },
+};
+const noopAudit = {
+    async emit(_args) {
+        /* no-op fallback */
+    },
+};
+function write(level, msg, fields) {
+    try {
+        const line = JSON.stringify({
+            level,
+            msg,
+            ts: new Date().toISOString(),
+            ...fields,
+        });
+        if (level === "warn" || level === "error") {
+            process.stderr.write(`${line}\n`);
+        }
+        else {
+            process.stdout.write(`${line}\n`);
+        }
+    }
+    catch {
+        /* swallow — fallback path must never throw */
+    }
+}
+let cached;
+/**
+ * Resolve `@nodii/telemetry` lazily. Cached after first successful import.
+ * Returns a stderr-JSON fallback if the peer is unavailable so the
+ * interceptor chain stays usable in tests that don't init telemetry.
+ */
+export function resolveTelemetry() {
+    if (cached)
+        return cached;
+    try {
+        // Lazy require so `@nodii/telemetry` is a true peer.
+        // eslint-disable-next-line @typescript-eslint/no-require-imports
+        const mod = require("@nodii/telemetry");
+        if (mod.logger && mod.audit) {
+            const auditWrap = {
+                emit: async (args) => {
+                    await mod.audit?.emit({
+                        action: args.action,
+                        target_kind: args.target_kind,
+                        target_id: args.target_id,
+                        payload: args.payload,
+                    });
+                },
+            };
+            cached = { logger: mod.logger, audit: auditWrap };
+            return cached;
+        }
+    }
+    catch {
+        /* fall through to stderr fallback */
+    }
+    cached = { logger: stderrLogger, audit: noopAudit };
+    return cached;
+}
+/** Test-only — drop cached resolver. */
+export function _resetTelemetryShimForTests() {
+    cached = undefined;
+}
+/** Test-only — inject a fake telemetry shim. */
+export function _setTelemetryShimForTests(shim) {
+    cached = shim;
+}
+//# sourceMappingURL=telemetry-shim.js.map

package/dist/telemetry-shim.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"telemetry-shim.js","sourceRoot":"","sources":["../src/telemetry-shim.ts"],"names":[],"mappings":"AAAA,+DAA+D;AAC/D,oEAAoE;AACpE,yEAAyE;AACzE,4DAA4D;AAC5D,EAAE;AACF,0DAA0D;AAC1D,qCAAqC;AACrC,iBAAiB;AACjB,EAAE;AACF,uEAAuE;AACvE,yEAAyE;AACzE,oEAAoE;AACpE,qEAAqE;AAIrE,MAAM,YAAY,GAAsB;IACtC,KAAK,CAAC,GAAG,EAAE,MAAM;QACf,KAAK,CAAC,OAAO,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;IAC9B,CAAC;IACD,IAAI,CAAC,GAAG,EAAE,MAAM;QACd,KAAK,CAAC,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;IAC7B,CAAC;IACD,IAAI,CAAC,GAAG,EAAE,MAAM;QACd,KAAK,CAAC,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;IAC7B,CAAC;IACD,KAAK,CAAC,GAAG,EAAE,MAAM;QACf,KAAK,CAAC,OAAO,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;IAC9B,CAAC;CACF,CAAC;AAEF,MAAM,SAAS,GAAiB;IAC9B,KAAK,CAAC,IAAI,CAAC,KAAK;QACd,oBAAoB;IACtB,CAAC;CACF,CAAC;AAEF,SAAS,KAAK,CACZ,KAAa,EACb,GAAW,EACX,MAA2C;IAE3C,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC;YAC1B,KAAK;YACL,GAAG;YACH,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YAC5B,GAAG,MAAM;SACV,CAAC,CAAC;QACH,IAAI,KAAK,KAAK,MAAM,IAAI,KAAK,KAAK,OAAO,EAAE,CAAC;YAC1C,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC;QACpC,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC;QACpC,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,8CAA8C;IAChD,CAAC;AACH,CAAC;AAED,IAAI,MAAiC,CAAC;AAEtC;;;;GAIG;AACH,MAAM,UAAU,gBAAgB;IAC9B,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAC1B,IAAI,CAAC;QACH,qDAAqD;QACrD,iEAAiE;QACjE,MAAM,GAAG,GAAG,OAAO,CAAC,kBAAkB,CAGrC,CAAC;QACF,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;YAC5B,MAAM,SAAS,GAAiB;gBAC9B,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;oBACnB,MAAM,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC;wBACpB,MAAM,EAAE,IAAI,CAAC,MAAM;wBACnB,WAAW,EAAE,IAAI,CAAC,WAAW;wBAC7B,SAAS,EAAE,IAAI,CAAC,SAAS;wBACzB,OAAO,EAAE,IAAI,CAAC,OAAO;qBACtB,CAAC,CAAC;gBACL,CAAC;aACF,CAAC;YACF,MAAM,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;YAClD,OAAO,MAAM,CAAC;QAChB,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,qCAAqC;IACvC,CAAC;IACD,MAAM,GAAG,EAAE,MAAM,EAAE,YAAY,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;IACpD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,wCAAwC;AACxC,MAAM,UAAU,2BAA2B;IACzC,MAAM,GAAG,SAAS,CAAC;AACrB,CAAC;AAED,gDAAgD;AAChD,MAAM,UAAU,yBAAyB,CAAC,IAAmB;IAC3D,MAAM,GAAG,IAAI,CAAC;AAChB,CAAC"}

package/dist/types.d.ts

@@ -0,0 +1,228 @@
+/**
+ * Generic unary call shape the owned interceptors read from / write to.
+ *
+ * Intentionally loose so the same interceptor composes under a real
+ * `@grpc/grpc-js` `ServerUnaryCall` or a synthetic test fixture
+ * (`MockGrpcCall`). The keys we touch are the ones the spec § 5.6 ff
+ * mention (`auth`, `metadata`, `request`, `on`, `cancelled`).
+ */
+export interface UnaryCall {
+    /** Filled by `@nodii/grpc-auth`'s `withAuthUnary` and read downstream. */
+    auth?: AuthOnCall;
+    metadata: {
+        get(key: string): readonly unknown[];
+    };
+    request: unknown;
+    /**
+     * `@grpc/grpc-js` `ServerUnaryCall` exposes `.on("cancelled", ...)`.
+     * Synthetic test calls can omit it; `cancellationGuard` no-ops when
+     * absent.
+     */
+    on?: (event: "cancelled", handler: () => void) => void;
+    /** Optional flag set by the cancellation guard fixture. */
+    cancelled?: boolean;
+    /**
+     * Inbound deadline in milliseconds remaining at the boundary. Real
+     * transports (`@grpc/grpc-js`) set this from `call.getDeadline()` -
+     * `Date.now()`; downstream consumers can set it directly when
+     * constructing a call without going through gRPC (synthetic tests,
+     * custom transports). The `deadlineGuard` interceptor reads this in
+     * preference to the `grpc-timeout` metadata header.
+     */
+    deadlineMs?: number;
+}
+/**
+ * What `@nodii/grpc-auth`'s server interceptor attaches on success. We
+ * declare the shape locally (not via type re-export) so cycles are
+ * impossible and the typing matches what `withAuthUnary` actually
+ * mutates onto the call.
+ */
+export interface AuthOnCall {
+    /** Service-to-service actor stamp. */
+    serviceActor?: {
+        service_id?: string;
+        serviceId?: string;
+        service_name?: string;
+        serviceName?: string;
+        tenant_id?: string;
+        scopes?: readonly string[];
+    };
+    /** Optional user-context envelope (`x-user-context`). */
+    userActor?: {
+        user_id?: string;
+        tenant_id?: string;
+        user_role?: string;
+    };
+    /** Stamped by `enrichAuthContext`. */
+    requestContext?: {
+        tenant_id?: string;
+        intent_id?: string;
+        actor_type?: "user" | "agent" | "system";
+        correlationId?: string;
+    };
+}
+/** Handler shape every interceptor wraps. */
+export type UnaryHandler = (call: UnaryCall) => Promise<unknown>;
+/**
+ * Interceptor factory: `(methodName, handler) -> handler`. Matches the
+ * shape re-exported from `@nodii/grpc-auth` as `composeUnaryInterceptors`
+ * is fed.
+ */
+export type UnaryInterceptor = (methodName: string, handler: UnaryHandler) => UnaryHandler;
+/** Per-call grpc status codes the library names by string for portability. */
+export type GrpcStatusCode = "OK" | "CANCELLED" | "UNKNOWN" | "INVALID_ARGUMENT" | "DEADLINE_EXCEEDED" | "NOT_FOUND" | "ALREADY_EXISTS" | "PERMISSION_DENIED" | "RESOURCE_EXHAUSTED" | "FAILED_PRECONDITION" | "ABORTED" | "OUT_OF_RANGE" | "UNIMPLEMENTED" | "INTERNAL" | "UNAVAILABLE" | "DATA_LOSS" | "UNAUTHENTICATED";
+/** Service-supplied entry in the `errorCatalog`. */
+export interface ErrorMapEntry {
+    code: GrpcStatusCode;
+    detail: string;
+}
+/** A thrown gRPC error carrying status + detail (matches `errorMap` output). */
+export declare class GrpcStatusError extends Error {
+    readonly code: GrpcStatusCode;
+    readonly detail: string;
+    constructor(code: GrpcStatusCode, detail: string, cause?: unknown);
+}
+/** Typed error surfaced by `cancellationGuard` when the call is cancelled. */
+export declare class RpcCancelledError extends GrpcStatusError {
+    constructor(detail?: string);
+}
+/** Marker for deferred saga/idempotency stub re-exports. */
+export declare class NotImplementedError extends Error {
+    constructor(message: string);
+}
+/** Pluggable Postgres connection used by `tenantContext` + `auditContext`. */
+export interface DbConnection {
+    /**
+     * Execute a parameterized SQL statement. The signature mirrors what
+     * `pg` / `drizzle` consumers can adapt to with a thin wrapper. The
+     * library calls `exec` only with `SET LOCAL ...` and
+     * `SELECT set_config(...)` — no row-returning queries.
+     */
+    exec(sql: string, params?: readonly unknown[]): Promise<void>;
+}
+/** Pluggable audit emitter. Defaults to `@nodii/telemetry.audit.emit`. */
+export interface AuditEmitter {
+    emit(args: {
+        action: string;
+        target_kind: string;
+        target_id: string | null;
+        payload?: Record<string, unknown>;
+    }): Promise<void>;
+}
+/** Logger interface — the library uses `@nodii/telemetry.logger` by default. */
+export interface InterceptorLogger {
+    debug(msg: string, fields?: Record<string, unknown>): void;
+    info(msg: string, fields?: Record<string, unknown>): void;
+    warn(msg: string, fields?: Record<string, unknown>): void;
+    error(msg: string, fields?: Record<string, unknown>): void;
+}
+/** Logging interceptor config — spec § 5.5. */
+export interface LoggingConfig {
+    /** Sample ratio for successful (OK) calls. Default 0.01 (1%). */
+    successSample?: number;
+    /**
+     * gRPC codes that are always logged regardless of `successSample`.
+     * Defaults to the spec § 5.5 list:
+     * `["UNAUTHENTICATED", "PERMISSION_DENIED", "FAILED_PRECONDITION",
+     *   "INVALID_ARGUMENT", "INTERNAL", "UNAVAILABLE", "UNKNOWN"]`.
+     */
+    alwaysEmit?: readonly GrpcStatusCode[];
+    /** Optional logger override; defaults to `@nodii/telemetry.logger`. */
+    logger?: InterceptorLogger;
+    /** Optional sample-rate hook for deterministic tests. Default `Math.random`. */
+    random?: () => number;
+}
+/** Audit interceptor config — spec § 5.6. */
+export interface AuditConfig {
+    /** Optional emitter override; defaults to `@nodii/telemetry.audit.emit`. */
+    emitter?: AuditEmitter;
+    /**
+     * Method names (`/svc/Method`) that emit an audit-on-read framing row
+     * per spec § 5.6. Methods NOT in this set are still audited if they
+     * are not in `skipMethods` — the default applies to every gRPC call
+     * including rejections (Pattern C).
+     */
+    auditOnReadMethods?: ReadonlySet<string>;
+    /** Methods skipped entirely (e.g. health checks). */
+    skipMethods?: ReadonlySet<string>;
+}
+/** Deadline guard config — spec § 5.10. */
+export interface DeadlineConfig {
+    /** Budget reserved at the inbound boundary in ms. Default 50ms per § 5.10. */
+    budgetMs?: number;
+    /** Per-method budget overrides. */
+    perMethodBudgetMs?: Record<string, number>;
+}
+/** Cancellation guard config — spec § 5.11. */
+export interface CancellationConfig {
+    /** Grace period in ms before hard-cut. Default 250ms per § 5.11. */
+    gracePeriodMs?: number;
+    /** Service-registered cancel handlers — run on cancel before the grace timer. */
+    onCancel?: readonly (() => Promise<void> | void)[];
+}
+/** Tenant context interceptor config — spec § 5.8. */
+export interface TenantContextConfig {
+    /** Required Postgres connection abstraction. */
+    db: DbConnection;
+    /**
+     * Method names that opt-in to system-context (no tenant scoping) — the
+     * interceptor skips `SET app.tenant_id` for those.
+     */
+    systemContextMethods?: ReadonlySet<string>;
+}
+/** Audit context interceptor config — spec § 5.9. */
+export interface AuditContextConfig {
+    /** Required Postgres connection abstraction (shared with tenantContext). */
+    db: DbConnection;
+    /** Service short-name baked into the `<short>.audit_ctx` GUC. */
+    serviceShortName: string;
+}
+/** Enrich auth context config — spec § 5.7. */
+export interface EnrichAuthConfig {
+    /**
+     * Per-method tenant requirement. Missing entries default to `true`
+     * (tenant required). Health methods opt out with `false`.
+     */
+    tenantRequiredByMethod?: Record<string, boolean>;
+    /** Override for the proto field name carrying tenant id. Default `tenant_id`. */
+    tenantField?: string;
+    /** Override the correlation id minter. Default — local uuid-ish. */
+    mintCorrelationId?: () => string;
+}
+/** Top-level config consumed by `configureGrpcInterceptors` + the factory. */
+export interface StandardServerStackConfig {
+    serviceShortName: string;
+    db?: DbConnection;
+    errorCatalog?: Record<string, ErrorMapEntry>;
+    logging?: LoggingConfig;
+    audit?: AuditConfig;
+    enrich?: EnrichAuthConfig;
+    tenant?: {
+        systemContextMethods?: ReadonlySet<string>;
+    };
+    cancellation?: CancellationConfig;
+    deadline?: DeadlineConfig;
+    /** Methods to skip the full stack on (e.g. `/health.Health/Check`). */
+    skipForMethods?: ReadonlySet<string>;
+    /** Inject an alternate logger across all interceptors. */
+    logger?: InterceptorLogger;
+    /**
+     * gRPC methods that REQUIRE `x-nodii-idempotency-key`. Passed straight
+     * to the @nodii/idempotency `idempotencyGuard` re-export. Empty set =
+     * guard is a no-op for every method.
+     */
+    mutatorMethods?: ReadonlySet<string>;
+    /**
+     * Methods tagged `require_saga_context: true` per spec § 5.7 — passed
+     * to the @nodii/saga `sagaContext` re-export.
+     */
+    requireSagaContextMethods?: ReadonlySet<string>;
+    /** sagaContext enforcement mode: 'warn' (default) | 'reject'. */
+    sagaContextEnforce?: "warn" | "reject";
+}
+/** Subset of `@nodii/telemetry` we depend on at runtime. */
+export interface TelemetryShim {
+    logger: InterceptorLogger;
+    audit: AuditEmitter;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AASA;;;;;;;GAOG;AACH,MAAM,WAAW,SAAS;IACxB,0EAA0E;IAC1E,IAAI,CAAC,EAAE,UAAU,CAAC;IAClB,QAAQ,EAAE;QACR,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,OAAO,EAAE,CAAC;KACtC,CAAC;IACF,OAAO,EAAE,OAAO,CAAC;IACjB;;;;OAIG;IACH,EAAE,CAAC,EAAE,CAAC,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,IAAI,KAAK,IAAI,CAAC;IACvD,2DAA2D;IAC3D,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB;;;;;;;OAOG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;;;GAKG;AACH,MAAM,WAAW,UAAU;IACzB,sCAAsC;IACtC,YAAY,CAAC,EAAE;QACb,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;KAC5B,CAAC;IACF,yDAAyD;IACzD,SAAS,CAAC,EAAE;QACV,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB,CAAC;IACF,sCAAsC;IACtC,cAAc,CAAC,EAAE;QACf,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,QAAQ,CAAC;QACzC,aAAa,CAAC,EAAE,MAAM,CAAC;KACxB,CAAC;CACH;AAED,6CAA6C;AAC7C,MAAM,MAAM,YAAY,GAAG,CAAC,IAAI,EAAE,SAAS,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;AAEjE;;;;GAIG;AACH,MAAM,MAAM,gBAAgB,GAAG,CAC7B,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,YAAY,KAClB,YAAY,CAAC;AAElB,8EAA8E;AAC9E,MAAM,MAAM,cAAc,GACtB,IAAI,GACJ,WAAW,GACX,SAAS,GACT,kBAAkB,GAClB,mBAAmB,GACnB,WAAW,GACX,gBAAgB,GAChB,mBAAmB,GACnB,oBAAoB,GACpB,qBAAqB,GACrB,SAAS,GACT,cAAc,GACd,eAAe,GACf,UAAU,GACV,aAAa,GACb,WAAW,GACX,iBAAiB,CAAC;AAEtB,oDAAoD;AACpD,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,cAAc,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,gFAAgF;AAChF,qBAAa,eAAgB,SAAQ,KAAK;IACxC,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAC9B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;gBACZ,IAAI,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO;CAOlE;AAED,8EAA8E;AAC9E,qBAAa,iBAAkB,SAAQ,eAAe;gBACxC,MAAM,SAAsB;CAIzC;AAED,4DAA4D;AAC5D,qBAAa,mBAAoB,SAAQ,KAAK;gBAChC,OAAO,EAAE,MAAM;CAI5B;AAED,8EAA8E;AAC9E,MAAM,WAAW,YAAY;IAC3B;;;;;OAKG;IACH,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,SAAS,OAAO,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC/D;AAED,0EAA0E;AAC1E,MAAM,WAAW,YAAY;IAC3B,IAAI,CAAC,IAAI,EAAE;QACT,MAAM,EAAE,MAAM,CAAC;QACf,WAAW,EAAE,MAAM,CAAC;QACpB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;QACzB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KACnC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACnB;AAED,gFAAgF;AAChF,MAAM,WAAW,iBAAiB;IAChC,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAC3D,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAC1D,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAC1D,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;CAC5D;AAED,+CAA+C;AAC/C,MAAM,WAAW,aAAa;IAC5B,iEAAiE;IACjE,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;OAKG;IACH,UAAU,CAAC,EAAE,SAAS,cAAc,EAAE,CAAC;IACvC,uEAAuE;IACvE,MAAM,CAAC,EAAE,iBAAiB,CAAC;IAC3B,gFAAgF;IAChF,MAAM,CAAC,EAAE,MAAM,MAAM,CAAC;CACvB;AAED,6CAA6C;AAC7C,MAAM,WAAW,WAAW;IAC1B,4EAA4E;IAC5E,OAAO,CAAC,EAAE,YAAY,CAAC;IACvB;;;;;OAKG;IACH,kBAAkB,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IACzC,qDAAqD;IACrD,WAAW,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;CACnC;AAED,2CAA2C;AAC3C,MAAM,WAAW,cAAc;IAC7B,8EAA8E;IAC9E,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,mCAAmC;IACnC,iBAAiB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC5C;AAED,+CAA+C;AAC/C,MAAM,WAAW,kBAAkB;IACjC,oEAAoE;IACpE,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,iFAAiF;IACjF,QAAQ,CAAC,EAAE,SAAS,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,EAAE,CAAC;CACpD;AAED,sDAAsD;AACtD,MAAM,WAAW,mBAAmB;IAClC,gDAAgD;IAChD,EAAE,EAAE,YAAY,CAAC;IACjB;;;OAGG;IACH,oBAAoB,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;CAC5C;AAED,qDAAqD;AACrD,MAAM,WAAW,kBAAkB;IACjC,4EAA4E;IAC5E,EAAE,EAAE,YAAY,CAAC;IACjB,iEAAiE;IACjE,gBAAgB,EAAE,MAAM,CAAC;CAC1B;AAED,+CAA+C;AAC/C,MAAM,WAAW,gBAAgB;IAC/B;;;OAGG;IACH,sBAAsB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjD,iFAAiF;IACjF,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,oEAAoE;IACpE,iBAAiB,CAAC,EAAE,MAAM,MAAM,CAAC;CAClC;AAED,8EAA8E;AAC9E,MAAM,WAAW,yBAAyB;IACxC,gBAAgB,EAAE,MAAM,CAAC;IACzB,EAAE,CAAC,EAAE,YAAY,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IAC7C,OAAO,CAAC,EAAE,aAAa,CAAC;IACxB,KAAK,CAAC,EAAE,WAAW,CAAC;IACpB,MAAM,CAAC,EAAE,gBAAgB,CAAC;IAC1B,MAAM,CAAC,EAAE;QAAE,oBAAoB,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;KAAE,CAAC;IACxD,YAAY,CAAC,EAAE,kBAAkB,CAAC;IAClC,QAAQ,CAAC,EAAE,cAAc,CAAC;IAC1B,uEAAuE;IACvE,cAAc,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IACrC,0DAA0D;IAC1D,MAAM,CAAC,EAAE,iBAAiB,CAAC;IAC3B;;;;OAIG;IACH,cAAc,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IACrC;;;OAGG;IACH,yBAAyB,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IAChD,iEAAiE;IACjE,kBAAkB,CAAC,EAAE,MAAM,GAAG,QAAQ,CAAC;CACxC;AAED,4DAA4D;AAC5D,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,iBAAiB,CAAC;IAC1B,KAAK,EAAE,YAAY,CAAC;CACrB"}