@rapidrest/service-core 1.8.0 → 2.1.0

package/dist/lib/security/ACLUtils.js

@@ -11,7 +11,8 @@ var __metadata = (this && this.__metadata) || function (k, v) {
 // Copyright (C) 2020-2026 Jean-Philippe Steinmetz. All rights reserved.
 // SPDX-License-Identifier: MPL-2.0
 ///////////////////////////////////////////////////////////////////////////////
-import { ObjectDecorators, UserUtils, sleep } from "@rapidrest/core";
+import { ApiError, ObjectDecorators, UserUtils, sleep } from "@rapidrest/core";
+import { ApiErrorMessages, ApiErrors } from "../ApiErrors.js";
 import { AccessControlListSQL } from "./AccessControlListSQL.js";
 import { AccessControlListMongo } from "./AccessControlListMongo.js";
 import { ACLAction } from "./AccessControlList.js";
@@ -21,6 +22,7 @@ import { MongoConnection } from "../database/MongoConnection.js";
 import { MongoRepository } from "../database/MongoRepository.js";
 import { RedisCache } from "../database/RedisCache.js";
 import { Transactional, transactionContext } from "../decorators/DatabaseDecorators.js";
+import { isDuplicateKeyError } from "../database/DatabaseErrors.js";
 const { Config, Init, Inject, Logger } = ObjectDecorators;
 /**
  * Common utility functions for working with `AccessControlList` objects and validating user permissions.
@@ -30,6 +32,11 @@ const { Config, Init, Inject, Logger } = ObjectDecorators;
 export class ACLUtils {
     constructor() {
         this.enabled = true;
+        /**
+         * The uids of every code-defined (class, route and endpoint) ACL registered via `saveDefaultACL()` in this
+         * process, together with their `default_<uid>` counterparts. See `isReservedUid()`.
+         */
+        this.reservedUids = new Set();
         this.trustedRoles = ["admin"];
     }
     get repo() {
@@ -85,6 +92,39 @@ export class ACLUtils {
             return "wildcard";
         return "none";
     }
+    /**
+     * Determines whether `uid` names a code-defined ACL: any `default_<uid>` ACL, or a class/route/endpoint ACL (or
+     * its `default_` counterpart) registered through `saveDefaultACL()`. Such an ACL governs a whole model or route,
+     * so a record must never be created at, adopt, or remove it (see `RepoUtils.create()`/`delete()`/`truncate()`).
+     *
+     * @param uid The ACL uid to check.
+     */
+    isReservedUid(uid) {
+        return typeof uid === "string" && (uid.startsWith("default_") || this.reservedUids.has(uid));
+    }
+    /**
+     * Determines whether `acl` is a code-defined ACL: its uid is reserved (see `isReservedUid()`), or it has the
+     * shape of the user-editable half of a default ACL (its parent is `default_<uid>`). The latter also catches one
+     * registered by a route or model that this process doesn't load.
+     *
+     * @param acl The ACL to check.
+     */
+    isProtectedACL(acl) {
+        return !!acl && (this.isReservedUid(acl.uid) || acl.parentUid === `default_${acl.uid}`);
+    }
+    /**
+     * Drops the cached copies of the given ACLs, so the next permission check reads them from the database. Any code
+     * that writes ACL documents without going through `saveACL()`/`removeACL()` must call this (e.g. `RepoUtils`
+     * serving the ACL REST routes).
+     *
+     * @param uids The uids of the ACLs to invalidate.
+     */
+    async invalidateACLs(uids) {
+        if (!this.cache || uids.length === 0) {
+            return;
+        }
+        await this.cache.deleteMany(uids);
+    }
     /**
      * Validates that the user has permission to perform the request operation against the URL path for the
      * provided request. If ACLUtils has not been initialized or the `acl` datasource has not been configured
@@ -172,8 +212,9 @@ export class ACLUtils {
      * @param entityId The unique identifier of the ACL to retrieve.
      * @param parentUids The list of already found parent UIDs. This is used to break circular dependencies.
      * @param options Set `skipCache: true` to bypass the cache and always read the current database state —
-     * mirrors `RepoUtils`'s `RepoFindOptions.skipCache`. The result is still written back into the cache
-     * afterward, same as a normal (non-skipped) lookup.
+     * mirrors `RepoUtils`'s `RepoFindOptions.skipCache` (applies to the whole parent chain). A database read is
+     * written back into the cache afterward. Set `skipParents: true` to not populate the parent chain at all, when
+     * only the ACL itself is needed.
      */
     async findACL(entityId, parentUids = [], options) {
         if (!this.enabled || !this.repo) {
@@ -182,8 +223,12 @@ export class ACLUtils {
         // Retrieve the ACL from the cache if present. A cache hit must still fall through to the parent-chain
         // population below (not return early) — a cached ACL was stored via its own plain, unpopulated `.parent`
         // (see the cache write below), so skipping that step here would silently return an ACL with no parent
-        // chain, which `hasPermission()` needs to find inherited records.
+        // chain, which `hasPermission()` needs to find inherited records. A cached entry that isn't the requested
+        // ACL is ignored (defense in depth: the key space is shared with `RepoUtils`' cache of the ACL model).
         let acl = options?.skipCache ? undefined : await this.cache?.load(entityId);
+        if (acl && acl.uid !== entityId) {
+            acl = undefined;
+        }
         // If the acl wasn't found in the cache (or the cache was skipped) look in the database
         if (!acl) {
             if (this.repo instanceof MongoRepository) {
@@ -194,17 +239,19 @@ export class ACLUtils {
                 acl = await this.repo.findOne({ where: { uid: entityId } });
                 acl = acl ? new AccessControlListSQL(acl) : undefined;
             }
-        }
-        // Store a copy in the cache for faster retrieval next time.
-        if (acl && this.cache) {
-            this.cache.save(entityId, acl).catch((err) => {
-                this.logger?.warn(`ACLUtils: Cache save failed for ACL ${entityId}.`);
-                this.logger?.debug(err);
-            });
+            // Store a copy in the cache for faster retrieval next time. Only after a database read: re-saving on
+            // every cache hit would keep renewing (and re-publishing to Redis) an entry that has since gone stale,
+            // for as long as someone keeps making requests against it.
+            if (acl && this.cache) {
+                this.cache.save(entityId, acl).catch((err) => {
+                    this.logger?.warn(`ACLUtils: Cache save failed for ACL ${entityId}.`);
+                    this.logger?.debug(err);
+                });
+            }
         }
         // Retrieve the parent ACL and assign it if available. Don't populate parents we've
         // already found to prevent a circular dependency.
-        if (acl && acl.parentUid && !parentUids.includes(acl.parentUid)) {
+        if (acl && acl.parentUid && !options?.skipParents && !parentUids.includes(acl.parentUid)) {
             parentUids.push(acl.parentUid);
             acl.parent = await this.findACL(acl.parentUid, parentUids, options);
         }
@@ -226,26 +273,38 @@ export class ACLUtils {
      * actually belongs to the same physical connection this repo does. Reusing it directly used to throw
      * (Mongo) or silently target the wrong connection (SQL).
      *
+     * Pass `unlessProtected: true` to leave a code-defined ACL (see `isProtectedACL()`) in place, resolving to
+     * `undefined` as if there had been nothing to remove. `RepoUtils` uses this when cleaning up after a record, so a
+     * record that shares a class/route ACL's uid can never delete that ACL.
+     *
      * @param uid The unique identifier of the ACL to remove.
+     * @param options Set `unlessProtected: true` to never remove a code-defined ACL.
      */
-    async removeACL(uid) {
+    async removeACL(uid, options) {
         if (!this.enabled) {
             return undefined;
         }
         if (!this.repo) {
             throw new Error("repo is not set.");
         }
+        if (options?.unlessProtected && this.isReservedUid(uid)) {
+            return undefined;
+        }
         const ctx = transactionContext.getStore();
         let removed;
         try {
             if (this.repo instanceof MongoRepository) {
-                const deleted = await this.repo.findOneAndDelete({ uid }, { session: ctx?.session });
+                // The parent condition is part of the atomic delete itself, so a protected ACL is never removed.
+                const filter = options?.unlessProtected
+                    ? { uid, parentUid: { $ne: `default_${uid}` } }
+                    : { uid };
+                const deleted = await this.repo.findOneAndDelete(filter, { session: ctx?.session });
                 removed = deleted ? new AccessControlListMongo(deleted) : undefined;
             }
             else {
                 const repo = ctx?.entityManager ? ctx.entityManager.getRepository(AccessControlListSQL) : this.repo;
                 const existing = await repo.findOne({ where: { uid } });
-                if (existing) {
+                if (existing && !(options?.unlessProtected && this.isProtectedACL(existing))) {
                     await repo.delete({ uid });
                     removed = new AccessControlListSQL(existing);
                 }
@@ -343,9 +402,15 @@ export class ACLUtils {
      * need the entity-side write and this ACL save to stay consistent should register a compensating action
      * via `registerRollbackHook()`.
      *
+     * Pass `createOnly: true` to claim a brand new ACL: it is only ever inserted (at version `0`), never merged
+     * into or overwritten on top of an ACL that already exists at the same uid. If one already exists - including
+     * one a concurrent caller inserted first, caught by the ACL collection's unique key - an `IDENTIFIER_EXISTS`
+     * `ApiError` (400) is thrown instead. Used by `RepoUtils.create()` so that a create can never adopt (and grant
+     * its creator rights on) an ACL that belongs to some other record.
+     *
      * @param acl The ACL to store.
      * @param options Set `preserveVersion: true` to restore `acl` exactly as given (see above) instead of the
-     * normal optimistic-locking update semantics.
+     * normal optimistic-locking update semantics. Set `createOnly: true` to only ever insert a new ACL (see above).
      * @return Returns the ACL that was stored in the database.
      */
     async saveACL(acl, options) {
@@ -358,7 +423,10 @@ export class ACLUtils {
         }
         const ctx = transactionContext.getStore();
         const preserveVersion = !!options?.preserveVersion;
-        if (this.repo instanceof MongoRepository) {
+        if (options?.createOnly) {
+            result = await this.insertNewACL(acl, ctx);
+        }
+        else if (this.repo instanceof MongoRepository) {
             const mACL = new AccessControlListMongo(acl);
             const existing = await this.repo.findOne({ uid: acl.uid }, {
                 session: ctx?.session,
@@ -423,6 +491,61 @@ export class ACLUtils {
         }
         return result;
     }
+    /**
+     * Implements `saveACL()`'s `createOnly` mode: inserts `acl` as a brand new version `0` document, refusing with
+     * `IDENTIFIER_EXISTS` if an ACL already exists at its uid (checked up front, and again via the unique key if a
+     * concurrent insert wins the race in between).
+     */
+    async insertNewACL(acl, ctx) {
+        const exists = () => new ApiError(ApiErrors.IDENTIFIER_EXISTS, 400, ApiErrorMessages.IDENTIFIER_EXISTS);
+        if (this.repo instanceof MongoRepository) {
+            const repo = this.repo;
+            if (await repo.findOne({ uid: acl.uid }, { session: ctx?.session })) {
+                throw exists();
+            }
+            const aclMongo = new AccessControlListMongo({
+                ...acl,
+                _id: undefined,
+                dateModifed: new Date(),
+                version: 0,
+            });
+            try {
+                // `insertOnly` so this can never replace an existing document, whatever `_id` it carries.
+                return await repo.save(aclMongo, { session: ctx?.session, insertOnly: true });
+            }
+            catch (err) {
+                // (uid, version) is unique for ACL documents, so a concurrent claim of the same uid fails here.
+                if (isDuplicateKeyError(err)) {
+                    throw exists();
+                }
+                throw err;
+            }
+        }
+        const repo = ctx?.entityManager
+            ? ctx.entityManager.getRepository(AccessControlListSQL)
+            : this.repo;
+        if (await repo.findOne({ where: { uid: acl.uid } })) {
+            throw exists();
+        }
+        const aclSQL = new AccessControlListSQL({
+            ...acl,
+            dateModifed: new Date(),
+            version: 0,
+        });
+        try {
+            // `insert()` rather than `save()`: TypeORM's `save()` turns into an UPDATE when the row already exists.
+            await repo.insert(aclSQL);
+        }
+        catch (err) {
+            // `uid` is the primary key for ACL rows, so a concurrent claim of the same uid fails here. The failed
+            // statement may have poisoned the active transaction, so check for the winner outside of it.
+            if (await this.repo.findOne({ where: { uid: acl.uid } })) {
+                throw exists();
+            }
+            throw err;
+        }
+        return aclSQL;
+    }
     /**
      * Stores the given default access control list into the ACL database. A default ACL is a special type of ACL
      * that is primarily defined and maintained within the code but allows for user-specific overrides. To accomplish
@@ -432,8 +555,15 @@ export class ACLUtils {
      * overrides. As the `default_<uid>` record is always overwritten with the lastest version of the code, any
      * user-defined changes made to it are lost on service restart.
      *
-     * @param defaultAcl
-     * @returns
+     * Both uids are reserved (see `isReservedUid()`), so no record can be created at, adopt or remove either ACL.
+     *
+     * Contract: when RBAC is enabled and `acl` is given, this either resolves to the user-editable ACL (whose `uid`
+     * is `acl.uid`) or throws; it never resolves to `null` then. A missing user-editable ACL (e.g. one deleted since
+     * the last start) is recreated, with no records, under `default_<uid>`. It resolves to `null` only when RBAC is
+     * disabled or no `acl` is given, and then stores nothing.
+     *
+     * @param acl The code-defined ACL to store.
+     * @returns The user-editable ACL, or `null` when RBAC is disabled or no ACL was given.
      */
     async saveDefaultACL(acl) {
         let result = null;
@@ -445,6 +575,8 @@ export class ACLUtils {
             ...acl,
             uid: `default_${acl.uid}`,
         };
+        this.reservedUids.add(acl.uid);
+        this.reservedUids.add(defaultAcl.uid);
         // Attempt to update the default ACL record. If a version mismatch occurs we will try again.
         const maxAttempts = 3;
         let attempts = 0;
@@ -454,22 +586,25 @@ export class ACLUtils {
                 // and another named `<NAME>`. The `<NAME>` record stores the user-defined
                 // overrides that overlay the `default_<NAME>` document. The `default_<NAME>` is
                 // therefore always updated with whatever is provided as the `defaultAcl` argument.
-                const existing = await this.findACL(defaultAcl.uid);
+                // Read from the database, not the cache: these reads decide whether the ACLs must be (re)created.
+                const existing = await this.findACL(defaultAcl.uid, [], {
+                    skipCache: true,
+                    skipParents: true,
+                });
                 if (existing) {
                     // Copy over the new records from code
                     existing.records = defaultAcl.records;
                     defaultAcl = existing;
-                    // The user-defined override record was already created on a previous run. Look it
-                    // up so callers still receive a valid ACL to register routes against instead of `null`.
-                    result = (await this.findACL(acl.uid)) ?? null;
                 }
-                else {
-                    // Create the user-defined override record
-                    result = await this.saveACL({
-                        uid: acl.uid,
-                        parentUid: defaultAcl.uid,
-                        records: [],
-                    });
+                // The user-defined override record normally exists from a previous run. When it's missing (never
+                // created, or deleted since) it is recreated: without it `checkRequestPerms()` has nothing to find,
+                // and a route registered against `null` would silently lose its permission checks.
+                result = (await this.findACL(acl.uid, [], { skipCache: true })) ?? null;
+                if (!result) {
+                    result = await this.saveACL({ uid: acl.uid, parentUid: defaultAcl.uid, records: [] }, { createOnly: true });
+                }
+                else if (result.parentUid !== defaultAcl.uid) {
+                    this.logger?.warn(`ACLUtils: ACL ${acl.uid} does not inherit from ${defaultAcl.uid} (parentUid=${result.parentUid}).`);
                 }
                 // Always save the ACL into the datasource
                 await this.saveACL(defaultAcl);
@@ -499,11 +634,12 @@ export class ACLUtils {
      * would issue overlapping commands against one session, which drivers reject or misorder.
      *
      * @param uids The unique identifiers of the ACLs to remove.
+     * @param options Set `unlessProtected: true` to never remove a code-defined ACL (see `removeACL()`).
      */
-    async removeACLs(uids) {
+    async removeACLs(uids, options) {
         const removed = [];
         for (const uid of uids) {
-            const acl = await this.removeACL(uid);
+            const acl = await this.removeACL(uid, options);
             if (acl) {
                 removed.push(acl);
             }
@@ -640,7 +776,7 @@ __decorate([
 __decorate([
     Transactional("acl"),
     __metadata("design:type", Function),
-    __metadata("design:paramtypes", [String]),
+    __metadata("design:paramtypes", [String, Object]),
     __metadata("design:returntype", Promise)
 ], ACLUtils.prototype, "removeACL", null);
 __decorate([
@@ -652,7 +788,7 @@ __decorate([
 __decorate([
     Transactional("acl"),
     __metadata("design:type", Function),
-    __metadata("design:paramtypes", [Array]),
+    __metadata("design:paramtypes", [Array, Object]),
     __metadata("design:returntype", Promise)
 ], ACLUtils.prototype, "removeACLs", null);
 __decorate([

package/dist/lib/security/ACLUtils.js.map

@@ -1 +1 @@
-{"version":3,"file":"ACLUtils.js","sourceRoot":"","sources":["../../../src/security/ACLUtils.ts"],"names":[],"mappings":";;;;;;;;;AAAA,+EAA+E;AAC/E,wEAAwE;AACxE,mCAAmC;AACnC,+EAA+E;AAC/E,OAAO,EAAE,gBAAgB,EAAE,SAAS,EAAE,KAAK,EAAgB,MAAM,iBAAiB,CAAC;AACnF,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AACjE,OAAO,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AAGrE,OAAO,EAAE,SAAS,EAA0C,MAAM,wBAAwB,CAAC;AAC3F,OAAO,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AACrE,OAAO,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AACjE,OAAO,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AACjE,OAAO,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AACjE,OAAO,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AAEvD,OAAO,EAAwB,aAAa,EAAE,kBAAkB,EAAE,MAAM,qCAAqC,CAAC;AAC9G,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,gBAAgB,CAAC;AAE1D;;;;GAIG;AACH,MAAM,OAAO,QAAQ;IAArB;QAKW,YAAO,GAAY,IAAI,CAAC;QAWvB,iBAAY,GAAa,CAAC,OAAO,CAAC,CAAC;IAqoB/C,CAAC;IAnoBG,IAAY,IAAI;QACZ,MAAM,IAAI,GAAQ,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACvD,IAAI,IAAI,YAAY,eAAe,EAAE,CAAC;YAClC,OAAO,IAAI,CAAC,aAAa,CAAC,sBAAsB,CAAC,CAAC;QACtD,CAAC;aAAM,IAAI,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC;YAC/B,OAAO,IAAI,CAAC,aAAa,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC;QACzD,CAAC;QACD,OAAO,SAAS,CAAC;IACrB,CAAC;IAGa,AAAN,KAAK,CAAC,IAAI;QACd,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACf,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;gBACb,MAAM,IAAI,KAAK,CAAC,kFAAkF,CAAC,CAAC;YACxG,CAAC;YAED,oEAAoE;YACpE,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;gBACd,MAAM,IAAI,GAAQ,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;gBACvD,IAAI,UAAU,GAAQ,IAAI,YAAY,eAAe,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,oBAAoB,CAAC;gBACtG,IAAI,CAAC,KAAK,GAAG,MAAM,IAAI,CAAC,cAAc,EAAE,WAAW,CAAC,UAAU,EAAE;oBAC5D,IAAI,EAAE,UAAU,CAAC,GAAG,IAAI,UAAU,CAAC,IAAI;oBACvC,IAAI,EAAE,CAAC,UAAU,CAAC;iBACrB,CAAC,CAAC;YACP,CAAC;YAED,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,mCAAmC,CAAC,CAAC;QAC3D,CAAC;aAAM,CAAC;YACJ,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,0BAA0B,CAAC,CAAC;QAClD,CAAC;IACL,CAAC;IAED;;;;;;;OAOG;IACK,gBAAgB,CAAC,IAAyB,EAAE,YAAoB;QACpE,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC;YACb,gGAAgG;YAChG,wDAAwD;YACxD,OAAO,YAAY,KAAK,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC;QAC3D,CAAC;QACD,IAAI,IAAI,CAAC,GAAG,KAAK,YAAY;YAAE,OAAO,OAAO,CAAC;QAC9C,IAAI,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,YAAY,CAAC;YAAE,OAAO,MAAM,CAAC;QACtD,8EAA8E;QAC9E,IAAI,YAAY,KAAK,IAAI,IAAI,YAAY,KAAK,GAAG;YAAE,OAAO,UAAU,CAAC;QACrE,OAAO,MAAM,CAAC;IAClB,CAAC;IAED;;;;;;;;OAQG;IACI,KAAK,CAAC,iBAAiB,CAAC,GAAW,EAAE,IAAyB,EAAE,GAAgB;QACnF,kCAAkC;QAClC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAChB,OAAO,IAAI,CAAC;QAChB,CAAC;QAED,IAAI,CAAC,GAAG,EAAE,CAAC;YACP,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;QAC1E,CAAC;QAED,mFAAmF;QACnF,sFAAsF;QACtF,IAAI,MAAM,GAAY,KAAK,CAAC;QAE5B,IAAI,GAAG,GAAkC,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QACrE,IAAI,GAAG,EAAE,CAAC;YACN,sCAAsC;YACtC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC;gBACd,MAAM,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC;YACnC,CAAC;YAED,sGAAsG;YACtG,qGAAqG;YACrG,IAAI,SAAS,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,YAAY,EAAE,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBACvD,MAAM,GAAG,IAAI,CAAC;YAClB,CAAC;iBAAM,CAAC;gBACJ,0FAA0F;gBAC1F,uFAAuF;gBACvF,MAAM,cAAc,GAA2B;oBAC3C,MAAM,EAAE,SAAS,CAAC,MAAM;oBACxB,GAAG,EAAE,SAAS,CAAC,IAAI;oBACnB,IAAI,EAAE,SAAS,CAAC,KAAK;oBACrB,KAAK,EAAE,SAAS,CAAC,MAAM;oBACvB,IAAI,EAAE,SAAS,CAAC,MAAM;oBACtB,GAAG,EAAE,SAAS,CAAC,MAAM;iBACxB,CAAC;gBACF,MAAM,MAAM,GAAuB,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC;gBAC5E,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;YAC1E,CAAC;QACL,CAAC;QAED,OAAO,MAAM,CAAC;IAClB,CAAC;IAED;;;;;;;OAOG;IACI,KAAK,CAAC,aAAa,CACtB,IAAyB,EACzB,GAA+B,EAC/B,MAAc;QAEd,8GAA8G;QAC9G,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,GAAG,IAAI,GAAG,KAAK,EAAE,EAAE,CAAC;YACpD,OAAO,IAAI,CAAC;QAChB,CAAC;QAED,sGAAsG;QACtG,qGAAqG;QACrG,IAAI,SAAS,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,YAAY,EAAE,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACvF,OAAO,IAAI,CAAC;QAChB,CAAC;QAED,8EAA8E;QAC9E,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;YAC1B,MAAM,KAAK,GAAkC,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YACzE,OAAO,KAAK,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;QACzE,CAAC;QAED,yDAAyD;QACzD,MAAM,MAAM,GAAqB,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAE3D,iEAAiE;QACjE,OAAO,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IACvG,CAAC;IAED;;;;;;;;;;;;;OAaG;IACI,KAAK,CAAC,OAAO,CAChB,QAAgB,EAChB,aAAuB,EAAE,EACzB,OAAiC;QAEjC,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YAC9B,OAAO,SAAS,CAAC;QACrB,CAAC;QAED,sGAAsG;QACtG,yGAAyG;QACzG,sGAAsG;QACtG,kEAAkE;QAClE,IAAI,GAAG,GAAkC,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QAE3G,uFAAuF;QACvF,IAAI,CAAC,GAAG,EAAE,CAAC;YACP,IAAI,IAAI,CAAC,IAAI,YAAY,eAAe,EAAE,CAAC;gBACvC,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC;gBACjD,GAAG,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,sBAAsB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YAC5D,CAAC;iBAAM,CAAC;gBACJ,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,GAAG,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;gBAC5D,GAAG,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,oBAAoB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YAC1D,CAAC;QACL,CAAC;QAED,4DAA4D;QAC5D,IAAI,GAAG,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACpB,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;gBACzC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,uCAAuC,QAAQ,GAAG,CAAC,CAAC;gBACtE,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;YAC5B,CAAC,CAAC,CAAC;QACP,CAAC;QAED,mFAAmF;QACnF,kDAAkD;QAClD,IAAI,GAAG,IAAI,GAAG,CAAC,SAAS,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;YAC9D,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YAC/B,GAAG,CAAC,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC;QACxE,CAAC;QAED,OAAO,GAAG,CAAC;IACf,CAAC;IAED;;;;;;;;;;;;;;;;;OAiBG;IAEU,AAAN,KAAK,CAAC,SAAS,CAAC,GAAW;QAC9B,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAChB,OAAO,SAAS,CAAC;QACrB,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAC;QACxC,CAAC;QAED,MAAM,GAAG,GAAG,kBAAkB,CAAC,QAAQ,EAAE,CAAC;QAC1C,IAAI,OAAsC,CAAC;QAE3C,IAAI,CAAC;YACD,IAAI,IAAI,CAAC,IAAI,YAAY,eAAe,EAAE,CAAC;gBACvC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,EAAE,GAAG,EAAS,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC;gBAC5F,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC,IAAI,sBAAsB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YACxE,CAAC;iBAAM,CAAC;gBACJ,MAAM,IAAI,GAAG,GAAG,EAAE,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,aAAa,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;gBACpG,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;gBACxD,IAAI,QAAQ,EAAE,CAAC;oBACX,MAAM,IAAI,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC;oBAC3B,OAAO,GAAG,IAAI,oBAAoB,CAAC,QAAQ,CAAC,CAAC;gBACjD,CAAC;YACL,CAAC;QACL,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAChB,iGAAiG;YACjG,8FAA8F;YAC9F,mGAAmG;YACnG,wBAAwB;YACxB,IAAI,GAAG,EAAE,OAAO,KAAK,cAAc,EAAE,CAAC;gBAClC,MAAM,GAAG,CAAC;YACd,CAAC;QACL,CAAC;QAED,0FAA0F;QAC1F,8FAA8F;QAC9F,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACb,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjC,CAAC;QAED,OAAO,OAAO,CAAC;IACnB,CAAC;IAED;;;;;;OAMG;IACK,OAAO,CAAC,IAAuB,EAAE,IAAuB;QAC5D,IAAI,MAAM,GAAW,CAAC,CAAC;QAEvB,yBAAyB;QACzB,IAAI,IAAI,CAAC,SAAS,KAAK,IAAI,CAAC,SAAS,EAAE,CAAC;YACpC,MAAM,EAAE,CAAC;QACb,CAAC;QAED,6CAA6C;QAC7C,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACjC,IAAI,WAAW,GAA0B,SAAS,CAAC;YAEnD,mCAAmC;YACnC,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;gBACjC,IAAI,OAAO,CAAC,YAAY,KAAK,OAAO,CAAC,YAAY,EAAE,CAAC;oBAChD,WAAW,GAAG,OAAO,CAAC;oBACtB,MAAM;gBACV,CAAC;YACL,CAAC;YAED,IAAI,WAAW,EAAE,CAAC;gBACd,8DAA8D;gBAC9D,MAAM,IAAI,IAAI,CAAC,cAAc,CAAC,WAAW,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAChF,CAAC;iBAAM,CAAC;gBACJ,MAAM,EAAE,CAAC;YACb,CAAC;QACL,CAAC;QAED,6CAA6C;QAC7C,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACjC,IAAI,WAAW,GAA0B,SAAS,CAAC;YAEnD,mCAAmC;YACnC,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;gBACjC,IAAI,OAAO,CAAC,YAAY,KAAK,OAAO,CAAC,YAAY,EAAE,CAAC;oBAChD,WAAW,GAAG,OAAO,CAAC;oBACtB,MAAM;gBACV,CAAC;YACL,CAAC;YAED,IAAI,WAAW,EAAE,CAAC;gBACd,8DAA8D;gBAC9D,MAAM,IAAI,IAAI,CAAC,cAAc,CAAC,WAAW,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAChF,CAAC;iBAAM,CAAC;gBACJ,MAAM,EAAE,CAAC;YACb,CAAC;QACL,CAAC;QAED,OAAO,MAAM,CAAC;IAClB,CAAC;IAED;;OAEG;IACK,cAAc,CAAC,CAAW,EAAE,CAAW;QAC3C,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC;YACxB,OAAO,IAAI,CAAC;QAChB,CAAC;QACD,MAAM,OAAO,GAAa,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACxC,MAAM,OAAO,GAAa,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACxC,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9D,CAAC;IAED;;;;;;;;;;;;;;;;;;OAkBG;IAEU,AAAN,KAAK,CAAC,OAAO,CAChB,GAAsB,EACtB,OAAuC;QAEvC,IAAI,MAAM,GAA6B,IAAI,CAAC;QAC5C,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,GAAG,EAAE,CAAC;YACxB,OAAO,MAAM,CAAC;QAClB,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAC;QACxC,CAAC;QAED,MAAM,GAAG,GAAG,kBAAkB,CAAC,QAAQ,EAAE,CAAC;QAC1C,MAAM,eAAe,GAAY,CAAC,CAAC,OAAO,EAAE,eAAe,CAAC;QAE5D,IAAI,IAAI,CAAC,IAAI,YAAY,eAAe,EAAE,CAAC;YACvC,MAAM,IAAI,GAA2B,IAAI,sBAAsB,CAAC,GAAG,CAAC,CAAC;YACrE,MAAM,QAAQ,GAAkC,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAS,EAAE;gBAC7F,OAAO,EAAE,GAAG,EAAE,OAAO;aACxB,CAAC,CAAC;YACH,IAAI,eAAe,EAAE,CAAC;gBAClB,IAAI,QAAQ,EAAE,CAAC;oBACX,MAAM,IAAI,KAAK,CAAC,sBAAsB,GAAG,CAAC,GAAG,0CAA0C,CAAC,CAAC;gBAC7F,CAAC;YACL,CAAC;iBAAM,CAAC;gBACJ,oEAAoE;gBACpE,IAAI,QAAQ,IAAI,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;oBAChD,OAAO,QAAQ,CAAC;gBACpB,CAAC;gBACD,sDAAsD;gBACtD,IAAI,QAAQ,IAAI,QAAQ,CAAC,OAAO,KAAK,IAAI,CAAC,OAAO,EAAE,CAAC;oBAChD,MAAM,IAAI,KAAK,CACX,oDAAoD,GAAG,CAAC,GAAG,cAAc,QAAQ,CAAC,OAAO,YAAY,IAAI,CAAC,OAAO,EAAE,CACtH,CAAC;gBACN,CAAC;YACL,CAAC;YACD,MAAM,QAAQ,GAA2B,IAAI,sBAAsB,CAAC;gBAChE,GAAG,GAAG;gBACN,WAAW,EAAE,IAAI,IAAI,EAAE;gBACvB,OAAO,EAAE,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;aAC5E,CAAC,CAAC;YACH,mGAAmG;YACnG,0FAA0F;YAC1F,wEAAwE;YACxE,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;QACzF,CAAC;aAAM,CAAC;YACJ,MAAM,IAAI,GAAG,GAAG,EAAE,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,aAAa,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;YACpG,MAAM,IAAI,GAAyB,IAAI,oBAAoB,CAAC,GAAG,CAAC,CAAC;YACjE,MAAM,QAAQ,GAAgC,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YAC9F,IAAI,eAAe,EAAE,CAAC;gBAClB,IAAI,QAAQ,EAAE,CAAC;oBACX,MAAM,IAAI,KAAK,CAAC,sBAAsB,GAAG,CAAC,GAAG,0CAA0C,CAAC,CAAC;gBAC7F,CAAC;YACL,CAAC;iBAAM,CAAC;gBACJ,oEAAoE;gBACpE,IAAI,QAAQ,IAAI,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;oBAChD,OAAO,QAAQ,CAAC;gBACpB,CAAC;gBACD,sDAAsD;gBACtD,IAAI,QAAQ,IAAI,QAAQ,CAAC,OAAO,KAAK,IAAI,CAAC,OAAO,EAAE,CAAC;oBAChD,MAAM,IAAI,KAAK,CACX,oDAAoD,GAAG,CAAC,GAAG,cAAc,QAAQ,CAAC,OAAO,YAAY,IAAI,CAAC,OAAO,EAAE,CACtH,CAAC;gBACN,CAAC;YACL,CAAC;YACD,MAAM,MAAM,GAAyB,IAAI,oBAAoB,CAAC;gBAC1D,GAAG,GAAG;gBACN,WAAW,EAAE,IAAI,IAAI,EAAE;gBACvB,OAAO,EAAE,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;aAC5E,CAAC,CAAC;YACH,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACrC,CAAC;QAED,4DAA4D;QAC5D,IAAI,IAAI,CAAC,KAAK,IAAI,MAAM,EAAE,CAAC;YACvB,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;gBAC9C,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,uCAAuC,MAAM,EAAE,GAAG,GAAG,CAAC,CAAC;gBACzE,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;YAC5B,CAAC,CAAC,CAAC;QACP,CAAC;QAED,OAAO,MAAM,CAAC;IAClB,CAAC;IAED;;;;;;;;;;;OAWG;IACI,KAAK,CAAC,cAAc,CAAC,GAAsB;QAC9C,IAAI,MAAM,GAA6B,IAAI,CAAC;QAC5C,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,GAAG,EAAE,CAAC;YACxB,OAAO,MAAM,CAAC;QAClB,CAAC;QAED,+DAA+D;QAC/D,IAAI,UAAU,GAAsB;YAChC,GAAG,GAAG;YACN,GAAG,EAAE,WAAW,GAAG,CAAC,GAAG,EAAE;SAC5B,CAAC;QAEF,4FAA4F;QAC5F,MAAM,WAAW,GAAW,CAAC,CAAC;QAC9B,IAAI,QAAQ,GAAW,CAAC,CAAC;QACzB,OAAO,QAAQ,EAAE,GAAG,WAAW,EAAE,CAAC;YAC9B,IAAI,CAAC;gBACD,iFAAiF;gBACjF,0EAA0E;gBAC1E,gFAAgF;gBAChF,mFAAmF;gBACnF,MAAM,QAAQ,GAAkC,MAAM,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;gBAEnF,IAAI,QAAQ,EAAE,CAAC;oBACX,sCAAsC;oBACtC,QAAQ,CAAC,OAAO,GAAG,UAAU,CAAC,OAAO,CAAC;oBACtC,UAAU,GAAG,QAAQ,CAAC;oBAEtB,kFAAkF;oBAClF,wFAAwF;oBACxF,MAAM,GAAG,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC;gBACnD,CAAC;qBAAM,CAAC;oBACJ,0CAA0C;oBAC1C,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC;wBACxB,GAAG,EAAE,GAAG,CAAC,GAAG;wBACZ,SAAS,EAAE,UAAU,CAAC,GAAG;wBACzB,OAAO,EAAE,EAAE;qBACd,CAAC,CAAC;gBACP,CAAC;gBAED,0CAA0C;gBAC1C,MAAM,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;gBAC/B,QAAQ,GAAG,WAAW,CAAC;YAC3B,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACX,IAAI,QAAQ,GAAG,WAAW,EAAE,CAAC;oBACzB,sFAAsF;oBACtF,MAAM,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC;gBAClD,CAAC;qBAAM,CAAC;oBACJ,kCAAkC;oBAClC,MAAM,GAAG,CAAC;gBACd,CAAC;YACL,CAAC;QACL,CAAC;QAED,OAAO,MAAM,CAAC;IAClB,CAAC;IAED;;;;;;;;;;;OAWG;IAEU,AAAN,KAAK,CAAC,UAAU,CAAC,IAAc;QAClC,MAAM,OAAO,GAAwB,EAAE,CAAC;QACxC,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACrB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;YACtC,IAAI,GAAG,EAAE,CAAC;gBACN,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACtB,CAAC;QACL,CAAC;QACD,OAAO,OAAO,CAAC;IACnB,CAAC;IAED;;;;;;;;;;OAUG;IAEU,AAAN,KAAK,CAAC,QAAQ,CAAC,IAAyB;QAC3C,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACrB,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC,CAAC;QACvD,CAAC;IACL,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA8BG;IACI,SAAS,CACZ,GAAsB,EACtB,IAAyB,EACzB,OAA+F;QAE/F,IAAI,CAAC,GAAG,EAAE,CAAC;YACP,OAAO,IAAI,CAAC;QAChB,CAAC;QAED,IAAI,QAAQ,GAAG,OAAO,EAAE,QAAQ,IAAI,CAAC,CAAC,CAAC;QACvC,IAAI,QAAQ,GAAG,OAAO,EAAE,QAAQ,IAAI,CAAC,CAAC;QACtC,IAAI,WAAW,GAAG,OAAO,EAAE,WAAW,IAAI,UAAU,CAAC;QAErD,gGAAgG;QAChG,uEAAuE;QACvE,MAAM,SAAS,GAAY,WAAW,KAAK,MAAM,IAAI,WAAW,KAAK,UAAU,CAAC;QAChF,MAAM,aAAa,GAAY,WAAW,KAAK,UAAU,CAAC;QAE1D,IAAI,SAAS,GAAqB,IAAI,CAAC;QACvC,IAAI,aAAa,GAAqB,IAAI,CAAC;QAC3C,KAAK,MAAM,MAAM,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC;YAC/B,MAAM,YAAY,GAAG,IAAI,CAAC,gBAAgB,CAAC,IAAI,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC;YACtE,IAAI,YAAY,KAAK,OAAO,EAAE,CAAC;gBAC3B,OAAO,MAAM,CAAC;YAClB,CAAC;iBAAM,IAAI,YAAY,KAAK,MAAM,IAAI,SAAS,EAAE,CAAC;gBAC9C,SAAS,GAAG,MAAM,CAAC;YACvB,CAAC;iBAAM,IAAI,YAAY,KAAK,UAAU,IAAI,aAAa,EAAE,CAAC;gBACtD,aAAa,GAAG,MAAM,CAAC;YAC3B,CAAC;QACL,CAAC;QACD,IAAI,SAAS,EAAE,CAAC;YACZ,OAAO,SAAS,CAAC;QACrB,CAAC;QACD,IAAI,aAAa,EAAE,CAAC;YAChB,OAAO,aAAa,CAAC;QACzB,CAAC;QAED,8EAA8E;QAC9E,IAAI,QAAQ,GAAG,CAAC,IAAI,QAAQ,GAAG,QAAQ,EAAE,CAAC;YACtC,OAAO,GAAG,CAAC,MAAM;gBACb,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE;oBAC7B,QAAQ,EAAE,QAAQ,GAAG,CAAC;oBACtB,QAAQ;oBACR,WAAW;iBACd,CAAC;gBACJ,CAAC,CAAC,IAAI,CAAC;QACf,CAAC;aAAM,CAAC;YACJ,OAAO,IAAI,CAAC;QAChB,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACI,KAAK,CAAC,cAAc,CAAC,GAAsB,EAAE,aAAuB,EAAE;QACzE,IAAI,GAAG,IAAI,GAAG,CAAC,SAAS,EAAE,CAAC;YACvB,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YAC/B,GAAG,CAAC,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;QAC/D,CAAC;IACL,CAAC;CACJ;AAhpBU;IADN,MAAM,CAAC,cAAc,EAAE,IAAI,CAAC;;yCACE;AAKvB;IADP,MAAM,CAAC,iBAAiB,CAAC;8BACR,iBAAiB;yCAAC;AAG5B;IADP,MAAM;;wCACc;AAGb;IADP,MAAM,CAAC,eAAe,EAAE,CAAC,OAAO,CAAC,CAAC;;8CACQ;AAa7B;IADb,IAAI;;;;oCAqBJ;AA8LY;IADZ,aAAa,CAAC,KAAK,CAAC;;;;yCAyCpB;AA4FY;IADZ,aAAa,CAAC,KAAK,CAAC;;;;uCAoFpB;AAoFY;IADZ,aAAa,CAAC,KAAK,CAAC;;;;0CAUpB;AAcY;IADZ,aAAa,CAAC,KAAK,CAAC;;;;wCAKpB"}
+{"version":3,"file":"ACLUtils.js","sourceRoot":"","sources":["../../../src/security/ACLUtils.ts"],"names":[],"mappings":";;;;;;;;;AAAA,+EAA+E;AAC/E,wEAAwE;AACxE,mCAAmC;AACnC,+EAA+E;AAC/E,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAE,SAAS,EAAE,KAAK,EAAgB,MAAM,iBAAiB,CAAC;AAC7F,OAAO,EAAE,gBAAgB,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC9D,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AACjE,OAAO,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AAGrE,OAAO,EAAE,SAAS,EAA0C,MAAM,wBAAwB,CAAC;AAC3F,OAAO,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AACrE,OAAO,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AACjE,OAAO,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AACjE,OAAO,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AACjE,OAAO,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AAEvD,OAAO,EAAwB,aAAa,EAAE,kBAAkB,EAAE,MAAM,qCAAqC,CAAC;AAC9G,OAAO,EAAE,mBAAmB,EAAE,MAAM,+BAA+B,CAAC;AACpE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,gBAAgB,CAAC;AAE1D;;;;GAIG;AACH,MAAM,OAAO,QAAQ;IAArB;QAKW,YAAO,GAAY,IAAI,CAAC;QAU/B;;;WAGG;QACK,iBAAY,GAAgB,IAAI,GAAG,EAAE,CAAC;QAGtC,iBAAY,GAAa,CAAC,OAAO,CAAC,CAAC;IAkxB/C,CAAC;IAhxBG,IAAY,IAAI;QACZ,MAAM,IAAI,GAAQ,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACvD,IAAI,IAAI,YAAY,eAAe,EAAE,CAAC;YAClC,OAAO,IAAI,CAAC,aAAa,CAAC,sBAAsB,CAAC,CAAC;QACtD,CAAC;aAAM,IAAI,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC;YAC/B,OAAO,IAAI,CAAC,aAAa,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC;QACzD,CAAC;QACD,OAAO,SAAS,CAAC;IACrB,CAAC;IAGa,AAAN,KAAK,CAAC,IAAI;QACd,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACf,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;gBACb,MAAM,IAAI,KAAK,CAAC,kFAAkF,CAAC,CAAC;YACxG,CAAC;YAED,oEAAoE;YACpE,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;gBACd,MAAM,IAAI,GAAQ,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;gBACvD,IAAI,UAAU,GAAQ,IAAI,YAAY,eAAe,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,oBAAoB,CAAC;gBACtG,IAAI,CAAC,KAAK,GAAG,MAAM,IAAI,CAAC,cAAc,EAAE,WAAW,CAAC,UAAU,EAAE;oBAC5D,IAAI,EAAE,UAAU,CAAC,GAAG,IAAI,UAAU,CAAC,IAAI;oBACvC,IAAI,EAAE,CAAC,UAAU,CAAC;iBACrB,CAAC,CAAC;YACP,CAAC;YAED,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,mCAAmC,CAAC,CAAC;QAC3D,CAAC;aAAM,CAAC;YACJ,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,0BAA0B,CAAC,CAAC;QAClD,CAAC;IACL,CAAC;IAED;;;;;;;OAOG;IACK,gBAAgB,CAAC,IAAyB,EAAE,YAAoB;QACpE,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC;YACb,gGAAgG;YAChG,wDAAwD;YACxD,OAAO,YAAY,KAAK,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC;QAC3D,CAAC;QACD,IAAI,IAAI,CAAC,GAAG,KAAK,YAAY;YAAE,OAAO,OAAO,CAAC;QAC9C,IAAI,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,YAAY,CAAC;YAAE,OAAO,MAAM,CAAC;QACtD,8EAA8E;QAC9E,IAAI,YAAY,KAAK,IAAI,IAAI,YAAY,KAAK,GAAG;YAAE,OAAO,UAAU,CAAC;QACrE,OAAO,MAAM,CAAC;IAClB,CAAC;IAED;;;;;;OAMG;IACI,aAAa,CAAC,GAAuB;QACxC,OAAO,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IACjG,CAAC;IAED;;;;;;OAMG;IACI,cAAc,CAAC,GAAyC;QAC3D,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,SAAS,KAAK,WAAW,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC;IAC5F,CAAC;IAED;;;;;;OAMG;IACI,KAAK,CAAC,cAAc,CAAC,IAAc;QACtC,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACnC,OAAO;QACX,CAAC;QACD,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;IACtC,CAAC;IAED;;;;;;;;OAQG;IACI,KAAK,CAAC,iBAAiB,CAAC,GAAW,EAAE,IAAyB,EAAE,GAAgB;QACnF,kCAAkC;QAClC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAChB,OAAO,IAAI,CAAC;QAChB,CAAC;QAED,IAAI,CAAC,GAAG,EAAE,CAAC;YACP,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;QAC1E,CAAC;QAED,mFAAmF;QACnF,sFAAsF;QACtF,IAAI,MAAM,GAAY,KAAK,CAAC;QAE5B,IAAI,GAAG,GAAkC,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QACrE,IAAI,GAAG,EAAE,CAAC;YACN,sCAAsC;YACtC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC;gBACd,MAAM,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC;YACnC,CAAC;YAED,sGAAsG;YACtG,qGAAqG;YACrG,IAAI,SAAS,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,YAAY,EAAE,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBACvD,MAAM,GAAG,IAAI,CAAC;YAClB,CAAC;iBAAM,CAAC;gBACJ,0FAA0F;gBAC1F,uFAAuF;gBACvF,MAAM,cAAc,GAA2B;oBAC3C,MAAM,EAAE,SAAS,CAAC,MAAM;oBACxB,GAAG,EAAE,SAAS,CAAC,IAAI;oBACnB,IAAI,EAAE,SAAS,CAAC,KAAK;oBACrB,KAAK,EAAE,SAAS,CAAC,MAAM;oBACvB,IAAI,EAAE,SAAS,CAAC,MAAM;oBACtB,GAAG,EAAE,SAAS,CAAC,MAAM;iBACxB,CAAC;gBACF,MAAM,MAAM,GAAuB,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC;gBAC5E,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;YAC1E,CAAC;QACL,CAAC;QAED,OAAO,MAAM,CAAC;IAClB,CAAC;IAED;;;;;;;OAOG;IACI,KAAK,CAAC,aAAa,CACtB,IAAyB,EACzB,GAA+B,EAC/B,MAAc;QAEd,8GAA8G;QAC9G,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,GAAG,IAAI,GAAG,KAAK,EAAE,EAAE,CAAC;YACpD,OAAO,IAAI,CAAC;QAChB,CAAC;QAED,sGAAsG;QACtG,qGAAqG;QACrG,IAAI,SAAS,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,YAAY,EAAE,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACvF,OAAO,IAAI,CAAC;QAChB,CAAC;QAED,8EAA8E;QAC9E,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;YAC1B,MAAM,KAAK,GAAkC,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YACzE,OAAO,KAAK,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;QACzE,CAAC;QAED,yDAAyD;QACzD,MAAM,MAAM,GAAqB,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAE3D,iEAAiE;QACjE,OAAO,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IACvG,CAAC;IAED;;;;;;;;;;;;;;OAcG;IACI,KAAK,CAAC,OAAO,CAChB,QAAgB,EAChB,aAAuB,EAAE,EACzB,OAAwD;QAExD,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YAC9B,OAAO,SAAS,CAAC;QACrB,CAAC;QAED,sGAAsG;QACtG,yGAAyG;QACzG,sGAAsG;QACtG,0GAA0G;QAC1G,uGAAuG;QACvG,IAAI,GAAG,GAAkC,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC3G,IAAI,GAAG,IAAI,GAAG,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;YAC9B,GAAG,GAAG,SAAS,CAAC;QACpB,CAAC;QAED,uFAAuF;QACvF,IAAI,CAAC,GAAG,EAAE,CAAC;YACP,IAAI,IAAI,CAAC,IAAI,YAAY,eAAe,EAAE,CAAC;gBACvC,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC;gBACjD,GAAG,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,sBAAsB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YAC5D,CAAC;iBAAM,CAAC;gBACJ,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,GAAG,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;gBAC5D,GAAG,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,oBAAoB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YAC1D,CAAC;YAED,qGAAqG;YACrG,uGAAuG;YACvG,2DAA2D;YAC3D,IAAI,GAAG,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;gBACpB,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;oBACzC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,uCAAuC,QAAQ,GAAG,CAAC,CAAC;oBACtE,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;gBAC5B,CAAC,CAAC,CAAC;YACP,CAAC;QACL,CAAC;QAED,mFAAmF;QACnF,kDAAkD;QAClD,IAAI,GAAG,IAAI,GAAG,CAAC,SAAS,IAAI,CAAC,OAAO,EAAE,WAAW,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;YACvF,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YAC/B,GAAG,CAAC,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC;QACxE,CAAC;QAED,OAAO,GAAG,CAAC;IACf,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;OAsBG;IAEU,AAAN,KAAK,CAAC,SAAS,CAClB,GAAW,EACX,OAAuC;QAEvC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAChB,OAAO,SAAS,CAAC;QACrB,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAC;QACxC,CAAC;QACD,IAAI,OAAO,EAAE,eAAe,IAAI,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC;YACtD,OAAO,SAAS,CAAC;QACrB,CAAC;QAED,MAAM,GAAG,GAAG,kBAAkB,CAAC,QAAQ,EAAE,CAAC;QAC1C,IAAI,OAAsC,CAAC;QAE3C,IAAI,CAAC;YACD,IAAI,IAAI,CAAC,IAAI,YAAY,eAAe,EAAE,CAAC;gBACvC,iGAAiG;gBACjG,MAAM,MAAM,GAAQ,OAAO,EAAE,eAAe;oBACxC,CAAC,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,EAAE,GAAG,EAAE,WAAW,GAAG,EAAE,EAAE,EAAE;oBAC/C,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC;gBACd,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,MAAM,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC;gBACpF,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC,IAAI,sBAAsB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YACxE,CAAC;iBAAM,CAAC;gBACJ,MAAM,IAAI,GAAG,GAAG,EAAE,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,aAAa,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;gBACpG,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;gBACxD,IAAI,QAAQ,IAAI,CAAC,CAAC,OAAO,EAAE,eAAe,IAAI,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;oBAC3E,MAAM,IAAI,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC;oBAC3B,OAAO,GAAG,IAAI,oBAAoB,CAAC,QAAQ,CAAC,CAAC;gBACjD,CAAC;YACL,CAAC;QACL,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAChB,iGAAiG;YACjG,8FAA8F;YAC9F,mGAAmG;YACnG,wBAAwB;YACxB,IAAI,GAAG,EAAE,OAAO,KAAK,cAAc,EAAE,CAAC;gBAClC,MAAM,GAAG,CAAC;YACd,CAAC;QACL,CAAC;QAED,0FAA0F;QAC1F,8FAA8F;QAC9F,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACb,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjC,CAAC;QAED,OAAO,OAAO,CAAC;IACnB,CAAC;IAED;;;;;;OAMG;IACK,OAAO,CAAC,IAAuB,EAAE,IAAuB;QAC5D,IAAI,MAAM,GAAW,CAAC,CAAC;QAEvB,yBAAyB;QACzB,IAAI,IAAI,CAAC,SAAS,KAAK,IAAI,CAAC,SAAS,EAAE,CAAC;YACpC,MAAM,EAAE,CAAC;QACb,CAAC;QAED,6CAA6C;QAC7C,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACjC,IAAI,WAAW,GAA0B,SAAS,CAAC;YAEnD,mCAAmC;YACnC,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;gBACjC,IAAI,OAAO,CAAC,YAAY,KAAK,OAAO,CAAC,YAAY,EAAE,CAAC;oBAChD,WAAW,GAAG,OAAO,CAAC;oBACtB,MAAM;gBACV,CAAC;YACL,CAAC;YAED,IAAI,WAAW,EAAE,CAAC;gBACd,8DAA8D;gBAC9D,MAAM,IAAI,IAAI,CAAC,cAAc,CAAC,WAAW,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAChF,CAAC;iBAAM,CAAC;gBACJ,MAAM,EAAE,CAAC;YACb,CAAC;QACL,CAAC;QAED,6CAA6C;QAC7C,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACjC,IAAI,WAAW,GAA0B,SAAS,CAAC;YAEnD,mCAAmC;YACnC,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;gBACjC,IAAI,OAAO,CAAC,YAAY,KAAK,OAAO,CAAC,YAAY,EAAE,CAAC;oBAChD,WAAW,GAAG,OAAO,CAAC;oBACtB,MAAM;gBACV,CAAC;YACL,CAAC;YAED,IAAI,WAAW,EAAE,CAAC;gBACd,8DAA8D;gBAC9D,MAAM,IAAI,IAAI,CAAC,cAAc,CAAC,WAAW,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAChF,CAAC;iBAAM,CAAC;gBACJ,MAAM,EAAE,CAAC;YACb,CAAC;QACL,CAAC;QAED,OAAO,MAAM,CAAC;IAClB,CAAC;IAED;;OAEG;IACK,cAAc,CAAC,CAAW,EAAE,CAAW;QAC3C,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC;YACxB,OAAO,IAAI,CAAC;QAChB,CAAC;QACD,MAAM,OAAO,GAAa,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACxC,MAAM,OAAO,GAAa,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACxC,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9D,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IAEU,AAAN,KAAK,CAAC,OAAO,CAChB,GAAsB,EACtB,OAA6D;QAE7D,IAAI,MAAM,GAA6B,IAAI,CAAC;QAC5C,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,GAAG,EAAE,CAAC;YACxB,OAAO,MAAM,CAAC;QAClB,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAC;QACxC,CAAC;QAED,MAAM,GAAG,GAAG,kBAAkB,CAAC,QAAQ,EAAE,CAAC;QAC1C,MAAM,eAAe,GAAY,CAAC,CAAC,OAAO,EAAE,eAAe,CAAC;QAE5D,IAAI,OAAO,EAAE,UAAU,EAAE,CAAC;YACtB,MAAM,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAC/C,CAAC;aAAM,IAAI,IAAI,CAAC,IAAI,YAAY,eAAe,EAAE,CAAC;YAC9C,MAAM,IAAI,GAA2B,IAAI,sBAAsB,CAAC,GAAG,CAAC,CAAC;YACrE,MAAM,QAAQ,GAAkC,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAS,EAAE;gBAC7F,OAAO,EAAE,GAAG,EAAE,OAAO;aACxB,CAAC,CAAC;YACH,IAAI,eAAe,EAAE,CAAC;gBAClB,IAAI,QAAQ,EAAE,CAAC;oBACX,MAAM,IAAI,KAAK,CAAC,sBAAsB,GAAG,CAAC,GAAG,0CAA0C,CAAC,CAAC;gBAC7F,CAAC;YACL,CAAC;iBAAM,CAAC;gBACJ,oEAAoE;gBACpE,IAAI,QAAQ,IAAI,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;oBAChD,OAAO,QAAQ,CAAC;gBACpB,CAAC;gBACD,sDAAsD;gBACtD,IAAI,QAAQ,IAAI,QAAQ,CAAC,OAAO,KAAK,IAAI,CAAC,OAAO,EAAE,CAAC;oBAChD,MAAM,IAAI,KAAK,CACX,oDAAoD,GAAG,CAAC,GAAG,cAAc,QAAQ,CAAC,OAAO,YAAY,IAAI,CAAC,OAAO,EAAE,CACtH,CAAC;gBACN,CAAC;YACL,CAAC;YACD,MAAM,QAAQ,GAA2B,IAAI,sBAAsB,CAAC;gBAChE,GAAG,GAAG;gBACN,WAAW,EAAE,IAAI,IAAI,EAAE;gBACvB,OAAO,EAAE,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;aAC5E,CAAC,CAAC;YACH,mGAAmG;YACnG,0FAA0F;YAC1F,wEAAwE;YACxE,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;QACzF,CAAC;aAAM,CAAC;YACJ,MAAM,IAAI,GAAG,GAAG,EAAE,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,aAAa,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;YACpG,MAAM,IAAI,GAAyB,IAAI,oBAAoB,CAAC,GAAG,CAAC,CAAC;YACjE,MAAM,QAAQ,GAAgC,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YAC9F,IAAI,eAAe,EAAE,CAAC;gBAClB,IAAI,QAAQ,EAAE,CAAC;oBACX,MAAM,IAAI,KAAK,CAAC,sBAAsB,GAAG,CAAC,GAAG,0CAA0C,CAAC,CAAC;gBAC7F,CAAC;YACL,CAAC;iBAAM,CAAC;gBACJ,oEAAoE;gBACpE,IAAI,QAAQ,IAAI,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;oBAChD,OAAO,QAAQ,CAAC;gBACpB,CAAC;gBACD,sDAAsD;gBACtD,IAAI,QAAQ,IAAI,QAAQ,CAAC,OAAO,KAAK,IAAI,CAAC,OAAO,EAAE,CAAC;oBAChD,MAAM,IAAI,KAAK,CACX,oDAAoD,GAAG,CAAC,GAAG,cAAc,QAAQ,CAAC,OAAO,YAAY,IAAI,CAAC,OAAO,EAAE,CACtH,CAAC;gBACN,CAAC;YACL,CAAC;YACD,MAAM,MAAM,GAAyB,IAAI,oBAAoB,CAAC;gBAC1D,GAAG,GAAG;gBACN,WAAW,EAAE,IAAI,IAAI,EAAE;gBACvB,OAAO,EAAE,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;aAC5E,CAAC,CAAC;YACH,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACrC,CAAC;QAED,4DAA4D;QAC5D,IAAI,IAAI,CAAC,KAAK,IAAI,MAAM,EAAE,CAAC;YACvB,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;gBAC9C,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,uCAAuC,MAAM,EAAE,GAAG,GAAG,CAAC,CAAC;gBACzE,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;YAC5B,CAAC,CAAC,CAAC;QACP,CAAC;QAED,OAAO,MAAM,CAAC;IAClB,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,YAAY,CAAC,GAAsB,EAAE,GAAQ;QACvD,MAAM,MAAM,GAAG,GAAa,EAAE,CAC1B,IAAI,QAAQ,CAAC,SAAS,CAAC,iBAAiB,EAAE,GAAG,EAAE,gBAAgB,CAAC,iBAAiB,CAAC,CAAC;QAEvF,IAAI,IAAI,CAAC,IAAI,YAAY,eAAe,EAAE,CAAC;YACvC,MAAM,IAAI,GAAyB,IAAI,CAAC,IAAI,CAAC;YAC7C,IAAI,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAS,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;gBACzE,MAAM,MAAM,EAAE,CAAC;YACnB,CAAC;YACD,MAAM,QAAQ,GAA2B,IAAI,sBAAsB,CAAC;gBAChE,GAAG,GAAG;gBACN,GAAG,EAAE,SAAS;gBACd,WAAW,EAAE,IAAI,IAAI,EAAE;gBACvB,OAAO,EAAE,CAAC;aACb,CAAC,CAAC;YACH,IAAI,CAAC;gBACD,0FAA0F;gBAC1F,OAAO,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;YAClF,CAAC;YAAC,OAAO,GAAQ,EAAE,CAAC;gBAChB,gGAAgG;gBAChG,IAAI,mBAAmB,CAAC,GAAG,CAAC,EAAE,CAAC;oBAC3B,MAAM,MAAM,EAAE,CAAC;gBACnB,CAAC;gBACD,MAAM,GAAG,CAAC;YACd,CAAC;QACL,CAAC;QAED,MAAM,IAAI,GAAoB,GAAG,EAAE,aAAa;YAC5C,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,aAAa,CAAC,oBAAoB,CAAC;YACvD,CAAC,CAAE,IAAI,CAAC,IAAwB,CAAC;QACrC,IAAI,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,CAAC;YAClD,MAAM,MAAM,EAAE,CAAC;QACnB,CAAC;QACD,MAAM,MAAM,GAAyB,IAAI,oBAAoB,CAAC;YAC1D,GAAG,GAAG;YACN,WAAW,EAAE,IAAI,IAAI,EAAE;YACvB,OAAO,EAAE,CAAC;SACb,CAAC,CAAC;QACH,IAAI,CAAC;YACD,wGAAwG;YACxG,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC9B,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAChB,sGAAsG;YACtG,6FAA6F;YAC7F,IAAI,MAAO,IAAI,CAAC,IAAwB,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,CAAC;gBAC5E,MAAM,MAAM,EAAE,CAAC;YACnB,CAAC;YACD,MAAM,GAAG,CAAC;QACd,CAAC;QACD,OAAO,MAAM,CAAC;IAClB,CAAC;IAED;;;;;;;;;;;;;;;;;;OAkBG;IACI,KAAK,CAAC,cAAc,CAAC,GAAsB;QAC9C,IAAI,MAAM,GAA6B,IAAI,CAAC;QAC5C,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,GAAG,EAAE,CAAC;YACxB,OAAO,MAAM,CAAC;QAClB,CAAC;QAED,+DAA+D;QAC/D,IAAI,UAAU,GAAsB;YAChC,GAAG,GAAG;YACN,GAAG,EAAE,WAAW,GAAG,CAAC,GAAG,EAAE;SAC5B,CAAC;QACF,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QAEtC,4FAA4F;QAC5F,MAAM,WAAW,GAAW,CAAC,CAAC;QAC9B,IAAI,QAAQ,GAAW,CAAC,CAAC;QACzB,OAAO,QAAQ,EAAE,GAAG,WAAW,EAAE,CAAC;YAC9B,IAAI,CAAC;gBACD,iFAAiF;gBACjF,0EAA0E;gBAC1E,gFAAgF;gBAChF,mFAAmF;gBACnF,kGAAkG;gBAClG,MAAM,QAAQ,GAAkC,MAAM,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,EAAE,EAAE,EAAE;oBACnF,SAAS,EAAE,IAAI;oBACf,WAAW,EAAE,IAAI;iBACpB,CAAC,CAAC;gBAEH,IAAI,QAAQ,EAAE,CAAC;oBACX,sCAAsC;oBACtC,QAAQ,CAAC,OAAO,GAAG,UAAU,CAAC,OAAO,CAAC;oBACtC,UAAU,GAAG,QAAQ,CAAC;gBAC1B,CAAC;gBAED,iGAAiG;gBACjG,oGAAoG;gBACpG,mFAAmF;gBACnF,MAAM,GAAG,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC;gBACxE,IAAI,CAAC,MAAM,EAAE,CAAC;oBACV,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CACvB,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,SAAS,EAAE,UAAU,CAAC,GAAG,EAAE,OAAO,EAAE,EAAE,EAAE,EACxD,EAAE,UAAU,EAAE,IAAI,EAAE,CACvB,CAAC;gBACN,CAAC;qBAAM,IAAI,MAAM,CAAC,SAAS,KAAK,UAAU,CAAC,GAAG,EAAE,CAAC;oBAC7C,IAAI,CAAC,MAAM,EAAE,IAAI,CACb,iBAAiB,GAAG,CAAC,GAAG,0BAA0B,UAAU,CAAC,GAAG,eAAe,MAAM,CAAC,SAAS,IAAI,CACtG,CAAC;gBACN,CAAC;gBAED,0CAA0C;gBAC1C,MAAM,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;gBAC/B,QAAQ,GAAG,WAAW,CAAC;YAC3B,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACX,IAAI,QAAQ,GAAG,WAAW,EAAE,CAAC;oBACzB,sFAAsF;oBACtF,MAAM,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC;gBAClD,CAAC;qBAAM,CAAC;oBACJ,kCAAkC;oBAClC,MAAM,GAAG,CAAC;gBACd,CAAC;YACL,CAAC;QACL,CAAC;QAED,OAAO,MAAM,CAAC;IAClB,CAAC;IAED;;;;;;;;;;;;OAYG;IAEU,AAAN,KAAK,CAAC,UAAU,CAAC,IAAc,EAAE,OAAuC;QAC3E,MAAM,OAAO,GAAwB,EAAE,CAAC;QACxC,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACrB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;YAC/C,IAAI,GAAG,EAAE,CAAC;gBACN,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACtB,CAAC;QACL,CAAC;QACD,OAAO,OAAO,CAAC;IACnB,CAAC;IAED;;;;;;;;;;OAUG;IAEU,AAAN,KAAK,CAAC,QAAQ,CAAC,IAAyB;QAC3C,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACrB,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC,CAAC;QACvD,CAAC;IACL,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA8BG;IACI,SAAS,CACZ,GAAsB,EACtB,IAAyB,EACzB,OAA+F;QAE/F,IAAI,CAAC,GAAG,EAAE,CAAC;YACP,OAAO,IAAI,CAAC;QAChB,CAAC;QAED,IAAI,QAAQ,GAAG,OAAO,EAAE,QAAQ,IAAI,CAAC,CAAC,CAAC;QACvC,IAAI,QAAQ,GAAG,OAAO,EAAE,QAAQ,IAAI,CAAC,CAAC;QACtC,IAAI,WAAW,GAAG,OAAO,EAAE,WAAW,IAAI,UAAU,CAAC;QAErD,gGAAgG;QAChG,uEAAuE;QACvE,MAAM,SAAS,GAAY,WAAW,KAAK,MAAM,IAAI,WAAW,KAAK,UAAU,CAAC;QAChF,MAAM,aAAa,GAAY,WAAW,KAAK,UAAU,CAAC;QAE1D,IAAI,SAAS,GAAqB,IAAI,CAAC;QACvC,IAAI,aAAa,GAAqB,IAAI,CAAC;QAC3C,KAAK,MAAM,MAAM,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC;YAC/B,MAAM,YAAY,GAAG,IAAI,CAAC,gBAAgB,CAAC,IAAI,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC;YACtE,IAAI,YAAY,KAAK,OAAO,EAAE,CAAC;gBAC3B,OAAO,MAAM,CAAC;YAClB,CAAC;iBAAM,IAAI,YAAY,KAAK,MAAM,IAAI,SAAS,EAAE,CAAC;gBAC9C,SAAS,GAAG,MAAM,CAAC;YACvB,CAAC;iBAAM,IAAI,YAAY,KAAK,UAAU,IAAI,aAAa,EAAE,CAAC;gBACtD,aAAa,GAAG,MAAM,CAAC;YAC3B,CAAC;QACL,CAAC;QACD,IAAI,SAAS,EAAE,CAAC;YACZ,OAAO,SAAS,CAAC;QACrB,CAAC;QACD,IAAI,aAAa,EAAE,CAAC;YAChB,OAAO,aAAa,CAAC;QACzB,CAAC;QAED,8EAA8E;QAC9E,IAAI,QAAQ,GAAG,CAAC,IAAI,QAAQ,GAAG,QAAQ,EAAE,CAAC;YACtC,OAAO,GAAG,CAAC,MAAM;gBACb,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE;oBAC7B,QAAQ,EAAE,QAAQ,GAAG,CAAC;oBACtB,QAAQ;oBACR,WAAW;iBACd,CAAC;gBACJ,CAAC,CAAC,IAAI,CAAC;QACf,CAAC;aAAM,CAAC;YACJ,OAAO,IAAI,CAAC;QAChB,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACI,KAAK,CAAC,cAAc,CAAC,GAAsB,EAAE,aAAuB,EAAE;QACzE,IAAI,GAAG,IAAI,GAAG,CAAC,SAAS,EAAE,CAAC;YACvB,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YAC/B,GAAG,CAAC,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;QAC/D,CAAC;IACL,CAAC;CACJ;AAnyBU;IADN,MAAM,CAAC,cAAc,EAAE,IAAI,CAAC;;yCACE;AAKvB;IADP,MAAM,CAAC,iBAAiB,CAAC;8BACR,iBAAiB;yCAAC;AAG5B;IADP,MAAM;;wCACc;AASb;IADP,MAAM,CAAC,eAAe,EAAE,CAAC,OAAO,CAAC,CAAC;;8CACQ;AAa7B;IADb,IAAI;;;;oCAqBJ;AA8OY;IADZ,aAAa,CAAC,KAAK,CAAC;;;;yCAmDpB;AAkGY;IADZ,aAAa,CAAC,KAAK,CAAC;;;;uCAsFpB;AA+JY;IADZ,aAAa,CAAC,KAAK,CAAC;;;;0CAUpB;AAcY;IADZ,aAAa,CAAC,KAAK,CAAC;;;;wCAKpB"}

package/dist/types/ApiErrors.d.ts

@@ -12,6 +12,11 @@ export declare enum ApiErrors {
     OBJECT_ID_MISMATCH = "api-013",
     SEARCH_INVALID_RANGE = "api-014",
     SEARCH_INVALID_ME_REFERENCE = "api-015",
+    SEARCH_UNKNOWN_OPERATOR = "api-016",
+    SEARCH_INVALID_OPERAND_TYPE = "api-017",
+    SEARCH_INVALID_SORT_FIELD = "api-018",
+    SEARCH_QUERY_TOO_COMPLEX = "api-019",
+    SEARCH_OPERATOR_NOT_SUPPORTED = "api-020",
     BULK_CREATE_FAILURE = "api-021",
     BULK_UPDATE_FAILURE = "api-022",
     AUTH_REQUIRED = "api-100",
@@ -34,6 +39,11 @@ export declare enum ApiErrorMessages {
     OBJECT_ID_MISMATCH = "The object provided does not match the identifier given.",
     SEARCH_INVALID_RANGE = "Invalid range value: '{{value}}'. Expected 2 arguments, got {{length}}",
     SEARCH_INVALID_ME_REFERENCE = "Use of the `me` reference requires authentication.",
+    SEARCH_UNKNOWN_OPERATOR = "Unknown search operator '{{operator}}'. Use eq() to search for a literal value shaped like an operator call.",
+    SEARCH_INVALID_OPERAND_TYPE = "Invalid value '{{value}}' for field '{{field}}'. Expected a {{type}}.",
+    SEARCH_INVALID_SORT_FIELD = "Cannot sort by unknown field '{{field}}'.",
+    SEARCH_QUERY_TOO_COMPLEX = "The search query is too deeply nested or has too many conditions.",
+    SEARCH_OPERATOR_NOT_SUPPORTED = "The '{{operator}}' operator is not supported by the configured datasource.",
     BULK_CREATE_FAILURE = "Failed to create one or more objects.",
     BULK_UPDATE_FAILURE = "Failed to update one or more objects.",
     AUTH_REQUIRED = "Authorization is required to access this resource.",

package/dist/types/BackgroundServiceManager.d.ts

@@ -54,6 +54,12 @@ export declare class BackgroundServiceManager {
      * @param args The list of arguments to pass into the service constructor
      */
     start(serviceName: string, clazz?: any, ...args: any): Promise<void>;
+    /**
+     * Returns `true` if node-schedule accepts the given schedule, without scheduling anything.
+     *
+     * @param spec The cron string, date or recurrence rule to validate.
+     */
+    private static isValidSchedule;
     /**
      * Stops all currently active background services that are owned by the manager.
      */

package/dist/types/EventListenerManager.d.ts

@@ -18,6 +18,10 @@ export declare class EventListenerManager {
     private readonly redis;
     constructor(objectFactory: ObjectFactory, redis: RedisClientType);
     init(): Promise<void>;
+    /**
+     * Unsubscribes from all channels, closes this manager's own (duplicated) redis client and removes all
+     * registered handlers. Safe to call more than once.
+     */
     destroy(): Promise<void>;
     /**
      * Handler function for events that arrive from redis.

package/dist/types/NetUtils.d.ts

@@ -1,10 +1,14 @@
 import type { HttpRequest as XRequest } from "./http/index.js";
+/** The list of trusted proxies accepted by `NetUtils`: an array of entries, or one comma-separated string. */
+export type TrustedProxies = readonly string[] | string;
 /**
  * Provides common utilities and functions for working with networking related problems.
  *
  * @author Jean-Philippe Steinmetz <rapidrests@gmail.com>
  */
 export declare class NetUtils {
+    /** Compiled `trustedProxies` lists, keyed by their normalized, `|`-joined entries. */
+    private static readonly proxyListCache;
     /**
      * Performs DNS lookup of the IP address from a given url.
      *
@@ -13,17 +17,72 @@ export declare class NetUtils {
      * @returns A `string` containing the IP address if found, otherwise `undefined`.
      */
     static lookupIPAddress(url: string, family?: number): Promise<string | undefined>;
+    /**
+     * Parses and canonicalizes a single IP address so that two spellings of the same address always compare
+     * equal. Accepts an optional port (`1.2.3.4:80`, `[::1]:80`), brackets and an IPv6 zone id, all of which are
+     * removed.
+     *
+     * - IPv4 addresses are returned unchanged (e.g. `10.0.0.1`).
+     * - IPv4-mapped IPv6 addresses are unmapped to plain IPv4, in either spelling: `::ffff:127.0.0.1` and uWS's
+     * fully expanded `0000:0000:0000:0000:0000:ffff:7f00:0001` both become `127.0.0.1`.
+     * - Other IPv6 addresses are returned in RFC 5952 form: lowercase, no leading zeros, and the longest run of
+     * two or more zero groups compressed to `::` (e.g. `2001:0DB8:0:0:0:0:0:1` becomes `2001:db8::1`).
+     *
+     * @param value The address to normalize.
+     * @returns The canonical address, or `undefined` if `value` is not a valid IPv4/IPv6 address.
+     */
+    static normalizeIP(value: string | undefined | null): string | undefined;
+    /** Expands an already validated IPv6 address (no zone id) into its eight 16-bit groups. */
+    private static expandIPv6;
+    /** Formats eight 16-bit groups as an RFC 5952 IPv6 address. */
+    private static compressIPv6;
+    /**
+     * Compiles (and caches) a `trustedProxies` list into a `BlockList`. Each entry is a single IPv4/IPv6 address or a
+     * CIDR range (`10.0.0.0/8`, `fd00::/8`). Entries are normalized the same way as `normalizeIP()`. Invalid entries
+     * are ignored.
+     */
+    private static compileTrustedProxies;
+    /**
+     * Returns `true` if `address` matches an entry of `trustedProxies`. Both sides are normalized first (see
+     * `normalizeIP()`), so e.g. `::ffff:10.0.0.1` matches a `10.0.0.1` entry, and CIDR range entries are supported.
+     *
+     * @param address The address to check.
+     * @param trustedProxies The trusted proxy addresses and/or CIDR ranges, as an array or a comma-separated string.
+     */
+    static isTrustedProxy(address: string | undefined, trustedProxies?: TrustedProxies): boolean;
+    /**
+     * Returns the IP address of the client that made the given request, in canonical form (see `normalizeIP()`).
+     * This is the address that should be used for rate limiting, audit logs and any other per-client keying.
+     *
+     * The result is determined as follows:
+     * 1. If the socket's remote address is not a valid IP, it is returned as-is (or `undefined` if empty) and no
+     * header is consulted.
+     * 2. If `trustedProxies` is empty or the remote address is not a trusted proxy, the remote address is returned.
+     * Forwarding headers are ignored, so an untrusted client cannot choose its own address.
+     * 3. Otherwise `X-Forwarded-For` is walked from right to left (every `X-Forwarded-For` value is taken into
+     * account). Addresses of trusted proxies are skipped and the first address that is not a trusted proxy is
+     * returned. If an entry is not a valid IP address, the walk stops and the last trusted hop is returned, since
+     * nothing left of it can be trusted. If every entry is a trusted proxy, the left-most entry is returned.
+     * 4. If there is no `X-Forwarded-For` header, a valid `X-Real-IP` header is returned, else the remote address.
+     *
+     * `X-Original-Forwarded-For` is never consulted.
+     *
+     * @param req The HTTP request to extract the client address from.
+     * @param trustedProxies The addresses and/or CIDR ranges of reverse proxies whose forwarding headers are
+     * trusted, as an array or a comma-separated string.
+     * @returns The client's canonical IP address, or `undefined` if the request has no remote address.
+     */
+    static getClientIP(req: XRequest, trustedProxies?: TrustedProxies): string | undefined;
     /**
      * Extracts the IP address from a given url or HTTP request.
      *
-     * When `trustedProxies` is provided, forwarding headers (`X-Forwarded-For`, etc.) are
-     * only trusted when the direct connection's `remoteAddress` is in that list. Without a
-     * trusted-proxy list the headers are ignored and the socket address is returned directly,
-     * preventing clients from spoofing their IP in audit logs.
+     * For an HTTP request this is identical to `getClientIP()`: forwarding headers are only trusted when the
+     * direct connection's remote address is one of `trustedProxies`, and the result is normalized.
      *
      * @param urlOrRequest The url or HTTP request to extract the IP from.
-     * @param trustedProxies Optional list of proxy IP addresses whose forwarding headers should be trusted.
+     * @param trustedProxies Optional list of proxy IP addresses and/or CIDR ranges whose forwarding headers should
+     * be trusted.
      * @returns A `string` containing the IP address if found, otherwise `undefined`.
      */
-    static getIPAddress(urlOrRequest: string | XRequest, trustedProxies?: string[]): string | undefined;
+    static getIPAddress(urlOrRequest: string | XRequest, trustedProxies?: TrustedProxies): string | undefined;
 }

package/dist/types/RateLimiter.d.ts

@@ -28,9 +28,10 @@ export interface IPRateLimitConfig {
 export interface RateLimitConfig {
     /**
      * The maximum number of attempts allowed within `windowSeconds` before being rejected. Default is `100`.
-     * Note that when driven by the `@RateLimit` decorator this counts attempts against the identifier
-     * `<method> <path>` (see `RouteUtils.checkRateLimiter()`), i.e. combined across *every* caller of that
-     * route, not per-caller - the default is set well above the per-IP default below for that reason.
+     * Note that when driven by the `@RateLimit` decorator without `perUser`, this counts attempts against the
+     * identifier `<method>|<path>` (see `RouteUtils.checkRateLimiter()`), i.e. combined across *every* caller of that
+     * route, not per-caller - the default is set well above the per-IP default below for that reason. With
+     * `perUser` the identifier is scoped to the user's uid, or to the client IP for anonymous callers.
      */
     maxAttempts?: number;
     /** The length of the sliding window, in seconds, that `maxAttempts` applies to. Default is `60`. */

package/dist/types/Server.d.ts

@@ -7,8 +7,12 @@ import { BackgroundServiceManager } from "./BackgroundServiceManager.js";
 import { RouteUtils } from "./routes/RouteUtils.js";
 import { OpenApiSpec } from "./OpenApiSpec.js";
 import { EventListenerManager } from "./EventListenerManager.js";
-import type { IHttpRouter } from "./http/types.js";
+import type { HttpRequest, HttpResponse, IHttpRouter, NextFunction } from "./http/types.js";
 import { SessionManager } from "./http/session/SessionManager.js";
+/** The metrics label used for every request that didn't match a registered application route. */
+export declare const UNMATCHED_ROUTE_LABEL = "<unmatched>";
+/** Default time `Server.stop()` waits for in-flight requests to finish, in milliseconds (`shutdown:drain_timeout`). */
+export declare const DEFAULT_DRAIN_TIMEOUT_MS = 10000;
 /**
  * The configuration options to use when constructing a new Server instance.
  */
@@ -188,7 +192,34 @@ export declare class Server {
      */
     start(): Promise<void>;
     /**
-     * Stops the HTTP listen server.
+     * Serializes one error for a client response. An `ApiError` keeps its own fields (`code`, `status`, `message`,
+     * ...). Anything else, such as a raw database driver error carrying the failed SQL `query` and its `parameters`,
+     * is replaced by the generic internal error so none of its details reach the client. Stack traces are never
+     * included.
+     *
+     * @param err The error to serialize.
+     */
+    protected serializeError(err: any): any;
+    /**
+     * The final error handling middleware. Logs the error and sends it to the client as JSON (see `serializeError()`).
+     */
+    protected handleError(err: any, _req: HttpRequest, res: HttpResponse, next: NextFunction): void;
+    /**
+     * The final middleware of every request: records the request metrics and ends the response if nothing else did.
+     * Metrics are labeled with `req.routePattern` rather than the raw path, so their cardinality is bounded by the
+     * application's routes.
+     */
+    protected recordRequestMetrics(req: HttpRequest, res: HttpResponse): void;
+    /**
+     * Stops the server gracefully:
+     *
+     * 1. Stops all background services.
+     * 2. Stops accepting new connections and waits up to `shutdown:drain_timeout` milliseconds (default 10000) for
+     * in-flight requests to finish, then closes the remaining keep-alive and WebSocket connections.
+     * 3. Destroys the event listener manager, closing its redis subscription.
+     * 4. Closes all database connections.
+     *
+     * The whole sequence is bounded by a 30 second watchdog.
      */
     stop(): Promise<void>;
     /**