@swal/edge-mesh 0.0.0-stage → 0.1.0

package/dist/medico/verificacion-registro.d.ts

@@ -0,0 +1,300 @@
+/**
+ * Foundation verification: from "well-formed credential" to "accredited".
+ *
+ * ─── WHAT THE PREVIOUS PHASE ALREADY SOLVED, AND WHAT IT DID NOT ─────────────
+ *
+ * `./credencial.ts` verifies FORM: ISO country, `idLicencia` is a SHA-256 hex,
+ * `vigenteHasta` present and not lapsed, signature over the canonical bytes. A
+ * credential can pass all of that and still be a forgery — a well-formed object
+ * that no authority ever issued. Nothing before this file asked the substrate
+ * question: *does this licence exist?*
+ *
+ * `./registro.ts` answers part of it, with the right fail-closed primitive
+ * (normalize → SHA-256 → country-scoped membership). What it cannot answer, by
+ * construction, is state: its `InstantaneaRegistroPais` is a `Set<string>` of
+ * hashes, and a set has one relation — *present* or *absent*. A `Set` cannot say
+ * "present, suspended", so a licence the Ministry suspended in March keeps
+ * matching a snapshot taken in January, forever.
+ *
+ * ─── THE THIRD DEFECT, WHICH IS THE ONE THAT ADDS NOVEL VALUE ───────────────
+ *
+ * `InstantaneaRegistroPais` also carries no expiry and no version per entry, so
+ * `{ estado: 'activa' }` would be enough — and that is exactly the
+ * OrionHealth `expired`-never-returned defect wearing a different hat. A state
+ * that is only ever `ACTIVA` because nothing can express anything else is not a
+ * state machine, it is a comment.
+ *
+ * So the registry here is an array of {@link EntradaRegistroLicencia}: country,
+ * licence hash, issuer-signed `vigenteHasta`, and an explicit
+ * {@link EstadoLicenciaRegistro}. All three states are reachable and two of them
+ * refuse. That is the whole point of this file.
+ *
+ * ─── WHY THE LOOKUP IS AN INJECTED FUNCTION ────────────────────────────────
+ *
+ * {@link FuenteAcreditacion.consultar} takes a `{ pais, hashLicencia }` and
+ * returns an entry or `undefined`. No fetch, no filesystem, no `Date.now()`:
+ * the transport is Phase 3's decision (a gossiped, hash-compared snapshot), and
+ * until then a fixture *is* the network. Because the seam is data in / data
+ * out, every state below is reachable from a test with no I/O at all.
+ *
+ * ─── WHY A MISSING COUNTRY REFUSES ────────────────────────────────────────
+ *
+ * OrionHealth returns `LicenseVerificationResult.unknown` when a country's
+ * registry is empty and treats it as "not refused". Here an unlisted country is
+ * `pais_no_soportado` and a supported country with an empty registry is
+ * `licencia_no_encontrada` — both `accesoPermitido: false`, and the type has no
+ * member meaning "we could not check this, carry on". An accreditation whose
+ * failure mode is a bypass is not a verification scheme.
+ *
+ * Pure: no clock read, no randomness, no I/O. `ahora` is always injected, which
+ * is what makes the refusal reasons reproducible — same inputs, same `motivo`,
+ * byte for byte, forever.
+ */
+import { MOTIVO_RECHAZO_CREDENCIAL, type MotivoRechazoCredencial } from "./credencial.js";
+import { MOTIVO_RECHAZO_REGISTRO, type MotivoRechazoRegistro } from "./registro-profesional.js";
+import type { CredencialMedica, MetodoVerificacion } from "./types.js";
+/**
+ * The life cycle of a licence *as the registry sees it*.
+ *
+ * Declared as a closed three-member union so the intermediate and terminal
+ * states are first-class. OrionHealth has the same two non-active states in its
+ * enum and returns neither one, because list membership cannot express them;
+ * here `suspendida` and `revocada` are not decoration — each one is a distinct,
+ * named refusal returned by {@link acreditarContraRegistro}.
+ *
+ * A value outside this union is refused as {@link MOTIVO_RECHAZO_CONSULTA_REGISTRO.ESTADO_REGISTRO_INVALIDO}.
+ * Unknown is never treated as active.
+ */
+export declare const ESTADO_LICENCIA: {
+    readonly ACTIVA: "activa";
+    readonly SUSPENDIDA: "suspendida";
+    readonly REVOCADA: "revocada";
+};
+export type EstadoLicencia = (typeof ESTADO_LICENCIA)[keyof typeof ESTADO_LICENCIA];
+/**
+ * One licence, as held by one country registry snapshot.
+ *
+ * Membership is no longer a bare hash: the entry states *what* the registry says
+ * about the licence and *until when*, so a suspended or lapsed licence cannot be
+ * represented as a good one. `pais` is mandatory so a transport bug that answers
+ * a `CO` query with an `ES` entry is detectable
+ * ({@link MOTIVO_RECHAZO_CONSULTA_REGISTRO.ENTRADA_DE_OTRO_PAIS}).
+ */
+export interface EntradaRegistroLicencia {
+    /** ISO 3166-1 alpha-2, upper case. Must equal the credential's `pais`. */
+    readonly pais: string;
+    /** `sha256(normalize(numeroLicencia))`. Never the number: that is PII (Ley 1581/2012). */
+    readonly hashLicencia: string;
+    /**
+     * Registry-stated validity window, ms epoch. Independent of the credential's
+     * own `vigenteHasta`: both must hold, so a credential claiming a longer
+     * licence than the registry grants is refused rather than believed.
+     */
+    readonly vigenteHasta: number;
+    readonly estado: EstadoLicencia;
+    /** Issuing authority, when the snapshot carries it. Checked when both sides do. */
+    readonly autoridad?: string;
+    /** Specialty slug, when the entry describes a specialty licence. */
+    readonly especialidad?: string;
+}
+/** Sync or async, so a Phase 3 transport may fetch without changing the contract. */
+type Awaitable<T> = T | Promise<T>;
+/** The query a transport receives. Hash only — the licence number never travels. */
+export interface ConsultaRegistroLicencia {
+    readonly pais: string;
+    readonly hashLicencia: string;
+}
+/**
+ * The injected lookup: given a country and a licence hash, produce the registry's
+ * entry, or `undefined` when the registry does not hold it.
+ *
+ * Returning `undefined` is "not in the registry". Throwing is not interpreted as
+ * absence: it becomes {@link MOTIVO_RECHAZO_CONSULTA_REGISTRO.CONSULTA_FALLIDA},
+ * still fail-closed, because a transport error must never be laundered into a
+ * plain miss that some future caller might treat as benign.
+ */
+export type ConsultarEntradaRegistro = (consulta: ConsultaRegistroLicencia) => Awaitable<EntradaRegistroLicencia | undefined>;
+/**
+ * The Phase 3 extension point.
+ *
+ * Everything the verification needs from the outside world arrives through this
+ * interface, so swapping an in-memory fixture for a replicated snapshot is a
+ * constructor change in a later phase and not a change to any rule in this file.
+ */
+export interface FuenteAcreditacion {
+    /**
+     * Countries this source can speak for. Empty ⇒ nothing is verifiable, and
+     * every credential is refused as `pais_no_soportado`.
+     *
+     * Separate from the registry's own contents on purpose: "we do not carry
+     * Colombia" is a different operational fact from "your licence is not in
+     * Colombia's registry", and conflating them is how an unsupported country
+     * becomes a silent bypass.
+     */
+    readonly paisesSoportados: readonly string[];
+    /** Version of the snapshot backing `pais`, for the audit trail. */
+    versionRegistro(pais: string): string | undefined;
+    /** The lookup itself. Injected; this module performs no I/O. */
+    consultar(consulta: ConsultaRegistroLicencia): Awaitable<EntradaRegistroLicencia | undefined>;
+}
+/**
+ * Refusals specific to consulting a registry.
+ *
+ * Additive to the two existing reason sets rather than a parallel system:
+ * {@link MotivoRechazoAcreditacion} is the union of this, `MOTIVO_RECHAZO_CREDENCIAL`
+ * and `MOTIVO_RECHAZO_REGISTRO`, and a credential that fails form is reported
+ * with the *credential's own* reason, so a caller reading
+ * `motivo === MOTIVO_RECHAZO_CREDENCIAL.SIN_VIGENCIA` keeps working unchanged.
+ */
+export declare const MOTIVO_RECHAZO_CONSULTA_REGISTRO: {
+    /** The credential itself failed `validarCredencial`; see `detalle` for its reason. */
+    readonly CREDENCIAL_MAL_FORMADA: "credencial_mal_formada";
+    /** No source speaks for this country. Fail closed, never "unknown". */
+    readonly PAIS_NO_SOPORTADO: "pais_no_soportado";
+    /** The source supports the country but holds no snapshot for it. */
+    readonly PAIS_SIN_REGISTRO: "pais_sin_registro";
+    /** Country supported, snapshot present, licence absent. */
+    readonly LICENCIA_NO_ENCONTRADA: "licencia_no_encontrada";
+    /** The registry says the licence is suspended. */
+    readonly LICENCIA_SUSPENDIDA: "licencia_suspendida";
+    /** The registry says the licence is revoked. Terminal. */
+    readonly LICENCIA_REVOCADA: "licencia_revocada";
+    /** `vigenteHasta <= ahora` on the registry entry, or on the credential, or the
+     *  credential claims a longer window than the registry grants. */
+    readonly LICENCIA_CADUCADA: "licencia_caducada";
+    /** The entry answered a query for another country. Transport or source bug. */
+    readonly ENTRADA_DE_OTRO_PAIS: "entrada_de_otro_pais";
+    /** `estado` outside {@link ESTADO_LICENCIA}. Unknown is never active. */
+    readonly ESTADO_REGISTRO_INVALIDO: "estado_registro_invalido";
+    /** `vigenteHasta` absent or not a finite number on the entry. */
+    readonly VIGENCIA_REGISTRO_INVALIDA: "vigencia_registro_invalida";
+    /** The specialty the credential claims is not the specialty the registry holds. */
+    readonly ESPECIALIDAD_NO_REGISTRADA: "especialidad_no_registada";
+    /** The issuing authority disagrees with the registry's. */
+    readonly AUTORIDAD_NO_REGISTRADA: "autoridad_no_registada";
+    /** `consultar` threw. Fail closed, and distinguishable from a plain miss. */
+    readonly CONSULTA_FALLIDA: "consulta_fallida";
+    /** A verification class this phase does not implement. See the strategies below. */
+    readonly METODO_NO_IMPLEMENTADO: "metodo_no_implementado";
+};
+export type MotivoRechazoConsultaRegistro = (typeof MOTIVO_RECHAZO_CONSULTA_REGISTRO)[keyof typeof MOTIVO_RECHAZO_CONSULTA_REGISTRO];
+/**
+ * Every reason a foundation verification can fail.
+ *
+ * The union, not a new vocabulary: shape failures surface as
+ * `MOTIVO_RECHAZO_CREDENCIAL.*`, whole-record problems as
+ * `MOTIVO_RECHAZO_REGISTRO.*`, and registry findings as
+ * `MOTIVO_RECHAZO_CONSULTA_REGISTRO.*`.
+ */
+export type MotivoRechazoAcreditacion = MotivoRechazoConsultaRegistro | MotivoRechazoCredencial | MotivoRechazoRegistro;
+/** The audit record of a successful verification. */
+export interface MetodoVerificacionAplicado {
+    readonly clase: "registro_por_pais";
+    readonly pais: string;
+    readonly versionRegistro: string;
+}
+export type ResultadoAcreditacion = {
+    readonly ok: true;
+    readonly credencial: CredencialMedica;
+    /** The registry entry the verification stood on. */
+    readonly entrada: EntradaRegistroLicencia;
+    /**
+     * How it was checked, on the face of the result. An accreditation without
+     * proof of method is a claim, not a verification (`docs/medico/modelo-datos.md` §4.2).
+     */
+    readonly metodoVerificacion: MetodoVerificacionAplicado;
+    /** Injected clock value, so the trail carries no hidden `Date.now()`. */
+    readonly verificadoEn: number;
+} | {
+    readonly ok: false;
+    readonly motivo: MotivoRechazoAcreditacion;
+    readonly detalle: string;
+    /** Always `false`. There is no state here meaning "unverified but proceed". */
+    readonly accesoPermitido: false;
+};
+/**
+ * Build the `metodoVerificacion` that records "I checked this against the
+ * country registry".
+ *
+ * One construction site: the success path below stamps its audit trail with
+ * this, so the shape a verification returns and the shape an `Aval` must carry
+ * cannot drift apart.
+ *
+ * `versionRegistro` is mandatory on the wire (`docs/medico/modelo-datos.md` §4.2):
+ * a stale snapshot that cannot be named cannot be reasoned about, and an
+ * unnameable one is refused by `validarAval` in `./aval.ts`.
+ */
+export declare function metodoRegistroPorPais(pais: string, versionRegistro: string): MetodoVerificacionAplicado;
+/**
+ * Verify a credential against a real registry entry.
+ *
+ * Checks run cheap-to-expensive and in a fixed order, so the same inputs always
+ * produce the same `motivo`: form, then country support, then snapshot presence,
+ * then lookup, then the entry's own state and window, then the claims the
+ * credential makes about that entry. No branch is random, no branch reads a
+ * clock that was not injected, and no branch can widen access.
+ *
+ * @param credencial - a credential already built. Its shape is re-checked here so
+ *   the foundation path cannot be entered with a hand-rolled object.
+ * @param fuente - the injected registry. Phase 3 supplies the real transport.
+ * @param ahora - injected clock (ms epoch), used against both `vigenteHasta` fields.
+ */
+export declare function acreditarContraRegistro(credencial: CredencialMedica, fuente: FuenteAcreditacion, ahora: number): Promise<ResultadoAcreditacion>;
+/**
+ * A verification strategy — the seam Phase 3 fills with peer attestation and
+ * quorum revocation.
+ *
+ * Declared here, implemented by exactly one member today. The point of the
+ * interface is that adding `avalado_por_pares` or `revocacion_por_quorum` is a
+ * new implementation of *this* type, never a new branch inside
+ * {@link acreditarContraRegistro}.
+ */
+export interface EstrategiaAcreditacion {
+    /** The `MetodoVerificacion` class this strategy produces. */
+    readonly clase: MetodoVerificacion["clase"];
+    acreditar(credencial: CredencialMedica, fuente: FuenteAcreditacion, ahora: number): Promise<ResultadoAcreditacion>;
+}
+/** The only implemented strategy: verification of foundation, by country registry. */
+export declare const ESTRATEGIA_REGISTRO_POR_PAIS: EstrategiaAcreditacion;
+/**
+ * Classes declared by `docs/medico/modelo-datos.md` §4.2 that this phase does
+ * not implement. Listed so the gap is explicit rather than inferred from a
+ * missing export.
+ */
+export declare const CLASES_NO_IMPLEMENTADAS: readonly ["colegio_directo", "testimonio_directo", "supervision"];
+/**
+ * Dispatch to a strategy by its verification class.
+ *
+ * Fails closed with {@link MOTIVO_RECHAZO_CONSULTA_REGISTRO.METODO_NO_IMPLEMENTADO}
+ * for a class with no strategy today, so "not built yet" can never be read as
+ * "nothing to check". Peer attestation and quorum revocation arrive here, as
+ * implementations of {@link EstrategiaAcreditacion}, in Phase 3.
+ */
+export declare function acreditarCon(clase: MetodoVerificacion["clase"], credencial: CredencialMedica, fuente: FuenteAcreditacion, ahora: number): Promise<ResultadoAcreditacion>;
+/**
+ * An in-memory registry. Pure data, no I/O — the fixture a test supplies and the
+ * stand-in Phase 3 replaces with a replicated, append-only snapshot.
+ */
+export declare class RegistroLicenciasEnMemoria implements FuenteAcreditacion {
+    private readonly entradasPorPais;
+    private readonly versiones;
+    private readonly soportados;
+    /**
+     * @param entradas - the registry contents. Anything whose `estado` is not in
+     *   {@link ESTADO_LICENCIA} is kept verbatim, so a test can prove such an
+     *   entry is refused rather than normalised away by the fixture.
+     * @param opciones.versionRegistro - snapshot version, per country or shared.
+     * @param opciones.paisesSoportados - countries this source speaks for. Defaults
+     *   to the countries actually present in `entradas`.
+     */
+    constructor(entradas?: readonly EntradaRegistroLicencia[], opciones?: {
+        readonly versionRegistro?: string | Readonly<Record<string, string>>;
+        readonly paisesSoportados?: readonly string[];
+    });
+    get paisesSoportados(): readonly string[];
+    versionRegistro(pais: string): string | undefined;
+    consultar({ pais, hashLicencia, }: ConsultaRegistroLicencia): EntradaRegistroLicencia | undefined;
+}
+/** Reasons this module can produce, re-exported so callers need one import. */
+export { MOTIVO_RECHAZO_CREDENCIAL, MOTIVO_RECHAZO_REGISTRO };
+//# sourceMappingURL=verificacion-registro.d.ts.map

package/dist/medico/verificacion-registro.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verificacion-registro.d.ts","sourceRoot":"","sources":["../../src/medico/verificacion-registro.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmDG;AAEH,OAAO,EACN,yBAAyB,EACzB,KAAK,uBAAuB,EAE5B,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACN,uBAAuB,EACvB,KAAK,qBAAqB,EAC1B,MAAM,2BAA2B,CAAC;AACnC,OAAO,KAAK,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAEvE;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,eAAe;aAC3B,MAAM,EAAE,QAAQ;aAChB,UAAU,EAAE,YAAY;aACxB,QAAQ,EAAE,UAAU;CACX,CAAC;AAEX,MAAM,MAAM,cAAc,GACzB,CAAC,OAAO,eAAe,CAAC,CAAC,MAAM,OAAO,eAAe,CAAC,CAAC;AAExD;;;;;;;;GAQG;AACH,MAAM,WAAW,uBAAuB;IACvC,0EAA0E;IAC1E,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,0FAA0F;IAC1F,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B;;;;OAIG;IACH,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC;IAChC,mFAAmF;IACnF,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,oEAAoE;IACpE,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED,qFAAqF;AACrF,KAAK,SAAS,CAAC,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;AAEnC,oFAAoF;AACpF,MAAM,WAAW,wBAAwB;IACxC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC9B;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,wBAAwB,GAAG,CACtC,QAAQ,EAAE,wBAAwB,KAC9B,SAAS,CAAC,uBAAuB,GAAG,SAAS,CAAC,CAAC;AAEpD;;;;;;GAMG;AACH,MAAM,WAAW,kBAAkB;IAClC;;;;;;;;OAQG;IACH,QAAQ,CAAC,gBAAgB,EAAE,SAAS,MAAM,EAAE,CAAC;IAE7C,mEAAmE;IACnE,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;IAElD,gEAAgE;IAChE,SAAS,CACR,QAAQ,EAAE,wBAAwB,GAChC,SAAS,CAAC,uBAAuB,GAAG,SAAS,CAAC,CAAC;CAClD;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,gCAAgC;IAC5C,sFAAsF;aACtF,sBAAsB,EAAE,wBAAwB;IAChD,uEAAuE;aACvE,iBAAiB,EAAE,mBAAmB;IACtC,oEAAoE;aACpE,iBAAiB,EAAE,mBAAmB;IACtC,2DAA2D;aAC3D,sBAAsB,EAAE,wBAAwB;IAChD,kDAAkD;aAClD,mBAAmB,EAAE,qBAAqB;IAC1C,0DAA0D;aAC1D,iBAAiB,EAAE,mBAAmB;IACtC;sEACkE;aAClE,iBAAiB,EAAE,mBAAmB;IACtC,+EAA+E;aAC/E,oBAAoB,EAAE,sBAAsB;IAC5C,yEAAyE;aACzE,wBAAwB,EAAE,0BAA0B;IACpD,iEAAiE;aACjE,0BAA0B,EAAE,4BAA4B;IACxD,mFAAmF;aACnF,0BAA0B,EAAE,2BAA2B;IACvD,2DAA2D;aAC3D,uBAAuB,EAAE,wBAAwB;IACjD,6EAA6E;aAC7E,gBAAgB,EAAE,kBAAkB;IACpC,oFAAoF;aACpF,sBAAsB,EAAE,wBAAwB;CACvC,CAAC;AAEX,MAAM,MAAM,6BAA6B,GACxC,CAAC,OAAO,gCAAgC,CAAC,CAAC,MAAM,OAAO,gCAAgC,CAAC,CAAC;AAE1F;;;;;;;GAOG;AACH,MAAM,MAAM,yBAAyB,GAClC,6BAA6B,GAC7B,uBAAuB,GACvB,qBAAqB,CAAC;AAEzB,qDAAqD;AACrD,MAAM,WAAW,0BAA0B;IAC1C,QAAQ,CAAC,KAAK,EAAE,mBAAmB,CAAC;IACpC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;CACjC;AAED,MAAM,MAAM,qBAAqB,GAC9B;IACA,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAClB,QAAQ,CAAC,UAAU,EAAE,gBAAgB,CAAC;IACtC,oDAAoD;IACpD,QAAQ,CAAC,OAAO,EAAE,uBAAuB,CAAC;IAC1C;;;OAGG;IACH,QAAQ,CAAC,kBAAkB,EAAE,0BAA0B,CAAC;IACxD,yEAAyE;IACzE,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC7B,GACD;IACA,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IACnB,QAAQ,CAAC,MAAM,EAAE,yBAAyB,CAAC;IAC3C,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,+EAA+E;IAC/E,QAAQ,CAAC,eAAe,EAAE,KAAK,CAAC;CAC/B,CAAC;AASL;;;;;;;;;;;GAWG;AACH,wBAAgB,qBAAqB,CACpC,IAAI,EAAE,MAAM,EACZ,eAAe,EAAE,MAAM,GACrB,0BAA0B,CAM5B;AAKD;;;;;;;;;;;;;GAaG;AACH,wBAAsB,uBAAuB,CAC5C,UAAU,EAAE,gBAAgB,EAC5B,MAAM,EAAE,kBAAkB,EAC1B,KAAK,EAAE,MAAM,GACX,OAAO,CAAC,qBAAqB,CAAC,CA6JhC;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,sBAAsB;IACtC,6DAA6D;IAC7D,QAAQ,CAAC,KAAK,EAAE,kBAAkB,CAAC,OAAO,CAAC,CAAC;IAC5C,SAAS,CACR,UAAU,EAAE,gBAAgB,EAC5B,MAAM,EAAE,kBAAkB,EAC1B,KAAK,EAAE,MAAM,GACX,OAAO,CAAC,qBAAqB,CAAC,CAAC;CAClC;AAED,sFAAsF;AACtF,eAAO,MAAM,4BAA4B,EAAE,sBAG1C,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,uBAAuB,YACnC,iBAAiB,EACjB,oBAAoB,EACpB,aAAa,CACJ,CAAC;AAEX;;;;;;;GAOG;AACH,wBAAsB,YAAY,CACjC,KAAK,EAAE,kBAAkB,CAAC,OAAO,CAAC,EAClC,UAAU,EAAE,gBAAgB,EAC5B,MAAM,EAAE,kBAAkB,EAC1B,KAAK,EAAE,MAAM,GACX,OAAO,CAAC,qBAAqB,CAAC,CAQhC;AAED;;;GAGG;AACH,qBAAa,0BAA2B,YAAW,kBAAkB;IACpE,OAAO,CAAC,QAAQ,CAAC,eAAe,CAG5B;IACJ,OAAO,CAAC,QAAQ,CAAC,SAAS,CAA6B;IACvD,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAsB;IAEjD;;;;;;;OAOG;IACH,YACC,QAAQ,GAAE,SAAS,uBAAuB,EAAO,EACjD,QAAQ,GAAE;QACT,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;QACrE,QAAQ,CAAC,gBAAgB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;KACzC,EAoBN;IAED,IAAI,gBAAgB,IAAI,SAAS,MAAM,EAAE,CAExC;IAED,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAEhD;IAED,SAAS,CAAC,EACT,IAAI,EACJ,YAAY,GACZ,EAAE,wBAAwB,GAAG,uBAAuB,GAAG,SAAS,CAIhE;CACD;AAED,+EAA+E;AAC/E,OAAO,EAAE,yBAAyB,EAAE,uBAAuB,EAAE,CAAC"}

package/dist/medico/verificacion-registro.js

@@ -0,0 +1,319 @@
+/**
+ * Foundation verification: from "well-formed credential" to "accredited".
+ *
+ * ─── WHAT THE PREVIOUS PHASE ALREADY SOLVED, AND WHAT IT DID NOT ─────────────
+ *
+ * `./credencial.ts` verifies FORM: ISO country, `idLicencia` is a SHA-256 hex,
+ * `vigenteHasta` present and not lapsed, signature over the canonical bytes. A
+ * credential can pass all of that and still be a forgery — a well-formed object
+ * that no authority ever issued. Nothing before this file asked the substrate
+ * question: *does this licence exist?*
+ *
+ * `./registro.ts` answers part of it, with the right fail-closed primitive
+ * (normalize → SHA-256 → country-scoped membership). What it cannot answer, by
+ * construction, is state: its `InstantaneaRegistroPais` is a `Set<string>` of
+ * hashes, and a set has one relation — *present* or *absent*. A `Set` cannot say
+ * "present, suspended", so a licence the Ministry suspended in March keeps
+ * matching a snapshot taken in January, forever.
+ *
+ * ─── THE THIRD DEFECT, WHICH IS THE ONE THAT ADDS NOVEL VALUE ───────────────
+ *
+ * `InstantaneaRegistroPais` also carries no expiry and no version per entry, so
+ * `{ estado: 'activa' }` would be enough — and that is exactly the
+ * OrionHealth `expired`-never-returned defect wearing a different hat. A state
+ * that is only ever `ACTIVA` because nothing can express anything else is not a
+ * state machine, it is a comment.
+ *
+ * So the registry here is an array of {@link EntradaRegistroLicencia}: country,
+ * licence hash, issuer-signed `vigenteHasta`, and an explicit
+ * {@link EstadoLicenciaRegistro}. All three states are reachable and two of them
+ * refuse. That is the whole point of this file.
+ *
+ * ─── WHY THE LOOKUP IS AN INJECTED FUNCTION ────────────────────────────────
+ *
+ * {@link FuenteAcreditacion.consultar} takes a `{ pais, hashLicencia }` and
+ * returns an entry or `undefined`. No fetch, no filesystem, no `Date.now()`:
+ * the transport is Phase 3's decision (a gossiped, hash-compared snapshot), and
+ * until then a fixture *is* the network. Because the seam is data in / data
+ * out, every state below is reachable from a test with no I/O at all.
+ *
+ * ─── WHY A MISSING COUNTRY REFUSES ────────────────────────────────────────
+ *
+ * OrionHealth returns `LicenseVerificationResult.unknown` when a country's
+ * registry is empty and treats it as "not refused". Here an unlisted country is
+ * `pais_no_soportado` and a supported country with an empty registry is
+ * `licencia_no_encontrada` — both `accesoPermitido: false`, and the type has no
+ * member meaning "we could not check this, carry on". An accreditation whose
+ * failure mode is a bypass is not a verification scheme.
+ *
+ * Pure: no clock read, no randomness, no I/O. `ahora` is always injected, which
+ * is what makes the refusal reasons reproducible — same inputs, same `motivo`,
+ * byte for byte, forever.
+ */
+import { MOTIVO_RECHAZO_CREDENCIAL, validarCredencial, } from "./credencial.js";
+import { MOTIVO_RECHAZO_REGISTRO, } from "./registro-profesional.js";
+/**
+ * The life cycle of a licence *as the registry sees it*.
+ *
+ * Declared as a closed three-member union so the intermediate and terminal
+ * states are first-class. OrionHealth has the same two non-active states in its
+ * enum and returns neither one, because list membership cannot express them;
+ * here `suspendida` and `revocada` are not decoration — each one is a distinct,
+ * named refusal returned by {@link acreditarContraRegistro}.
+ *
+ * A value outside this union is refused as {@link MOTIVO_RECHAZO_CONSULTA_REGISTRO.ESTADO_REGISTRO_INVALIDO}.
+ * Unknown is never treated as active.
+ */
+export const ESTADO_LICENCIA = {
+    ACTIVA: "activa",
+    SUSPENDIDA: "suspendida",
+    REVOCADA: "revocada",
+};
+/**
+ * Refusals specific to consulting a registry.
+ *
+ * Additive to the two existing reason sets rather than a parallel system:
+ * {@link MotivoRechazoAcreditacion} is the union of this, `MOTIVO_RECHAZO_CREDENCIAL`
+ * and `MOTIVO_RECHAZO_REGISTRO`, and a credential that fails form is reported
+ * with the *credential's own* reason, so a caller reading
+ * `motivo === MOTIVO_RECHAZO_CREDENCIAL.SIN_VIGENCIA` keeps working unchanged.
+ */
+export const MOTIVO_RECHAZO_CONSULTA_REGISTRO = {
+    /** The credential itself failed `validarCredencial`; see `detalle` for its reason. */
+    CREDENCIAL_MAL_FORMADA: "credencial_mal_formada",
+    /** No source speaks for this country. Fail closed, never "unknown". */
+    PAIS_NO_SOPORTADO: "pais_no_soportado",
+    /** The source supports the country but holds no snapshot for it. */
+    PAIS_SIN_REGISTRO: "pais_sin_registro",
+    /** Country supported, snapshot present, licence absent. */
+    LICENCIA_NO_ENCONTRADA: "licencia_no_encontrada",
+    /** The registry says the licence is suspended. */
+    LICENCIA_SUSPENDIDA: "licencia_suspendida",
+    /** The registry says the licence is revoked. Terminal. */
+    LICENCIA_REVOCADA: "licencia_revocada",
+    /** `vigenteHasta <= ahora` on the registry entry, or on the credential, or the
+     *  credential claims a longer window than the registry grants. */
+    LICENCIA_CADUCADA: "licencia_caducada",
+    /** The entry answered a query for another country. Transport or source bug. */
+    ENTRADA_DE_OTRO_PAIS: "entrada_de_otro_pais",
+    /** `estado` outside {@link ESTADO_LICENCIA}. Unknown is never active. */
+    ESTADO_REGISTRO_INVALIDO: "estado_registro_invalido",
+    /** `vigenteHasta` absent or not a finite number on the entry. */
+    VIGENCIA_REGISTRO_INVALIDA: "vigencia_registro_invalida",
+    /** The specialty the credential claims is not the specialty the registry holds. */
+    ESPECIALIDAD_NO_REGISTRADA: "especialidad_no_registada",
+    /** The issuing authority disagrees with the registry's. */
+    AUTORIDAD_NO_REGISTRADA: "autoridad_no_registada",
+    /** `consultar` threw. Fail closed, and distinguishable from a plain miss. */
+    CONSULTA_FALLIDA: "consulta_fallida",
+    /** A verification class this phase does not implement. See the strategies below. */
+    METODO_NO_IMPLEMENTADO: "metodo_no_implementado",
+};
+function fallo(motivo, detalle) {
+    return { ok: false, motivo, detalle, accesoPermitido: false };
+}
+/**
+ * Build the `metodoVerificacion` that records "I checked this against the
+ * country registry".
+ *
+ * One construction site: the success path below stamps its audit trail with
+ * this, so the shape a verification returns and the shape an `Aval` must carry
+ * cannot drift apart.
+ *
+ * `versionRegistro` is mandatory on the wire (`docs/medico/modelo-datos.md` §4.2):
+ * a stale snapshot that cannot be named cannot be reasoned about, and an
+ * unnameable one is refused by `validarAval` in `./aval.ts`.
+ */
+export function metodoRegistroPorPais(pais, versionRegistro) {
+    return {
+        clase: "registro_por_pais",
+        pais: pais.toUpperCase(),
+        versionRegistro,
+    };
+}
+const RE_PAIS_ALFA2 = /^[A-Z]{2}$/;
+const RE_HEX64 = /^[0-9a-f]{64}$/;
+/**
+ * Verify a credential against a real registry entry.
+ *
+ * Checks run cheap-to-expensive and in a fixed order, so the same inputs always
+ * produce the same `motivo`: form, then country support, then snapshot presence,
+ * then lookup, then the entry's own state and window, then the claims the
+ * credential makes about that entry. No branch is random, no branch reads a
+ * clock that was not injected, and no branch can widen access.
+ *
+ * @param credencial - a credential already built. Its shape is re-checked here so
+ *   the foundation path cannot be entered with a hand-rolled object.
+ * @param fuente - the injected registry. Phase 3 supplies the real transport.
+ * @param ahora - injected clock (ms epoch), used against both `vigenteHasta` fields.
+ */
+export async function acreditarContraRegistro(credencial, fuente, ahora) {
+    // ── 1. Form, first: never spend a lookup on a malformed object ──
+    const forma = validarCredencial(credencial, ahora);
+    if (!forma.ok) {
+        // The credential's own reason is preserved so callers of `validarCredencial`
+        // keep working; `motivo` stays inside the one vocabulary.
+        return fallo(MOTIVO_RECHAZO_CONSULTA_REGISTRO.CREDENCIAL_MAL_FORMADA, `forma inválida (${forma.motivo}): ${forma.detalle}`);
+    }
+    const pais = credencial.pais.toUpperCase();
+    // ── 2. Country support: fail closed, the OrionHealth `unknown` branch ──
+    if (!Array.isArray(fuente.paisesSoportados) ||
+        !fuente.paisesSoportados.some((p) => p.toUpperCase() === pais)) {
+        return fallo(MOTIVO_RECHAZO_CONSULTA_REGISTRO.PAIS_NO_SOPORTADO, `ninguna fuente sostiene '${pais}': no hay registro contra el cual verificar, y no verificar no es perdonar`);
+    }
+    // ── 3. The country is supported: there must still be a snapshot behind it ──
+    const version = fuente.versionRegistro(pais);
+    if (!version) {
+        return fallo(MOTIVO_RECHAZO_CONSULTA_REGISTRO.PAIS_SIN_REGISTRO, `'${pais}' está soportado pero no hay instantánea cargada`);
+    }
+    // ── 4. The lookup. A throwing transport is a failure, not a miss ──
+    let entrada;
+    try {
+        entrada = await fuente.consultar({
+            pais,
+            hashLicencia: credencial.idLicencia,
+        });
+    }
+    catch (error) {
+        return fallo(MOTIVO_RECHAZO_CONSULTA_REGISTRO.CONSULTA_FALLIDA, `la consulta al registro falló: ${error instanceof Error ? error.message : String(error)}`);
+    }
+    if (!entrada) {
+        return fallo(MOTIVO_RECHAZO_CONSULTA_REGISTRO.LICENCIA_NO_ENCONTRADA, `hash de licencia no presente en el registro '${pais}' (versión ${version})`);
+    }
+    // ── 5. The entry must be well formed itself ──
+    if (typeof entrada.pais !== "string" || !RE_PAIS_ALFA2.test(entrada.pais)) {
+        return fallo(MOTIVO_RECHAZO_CONSULTA_REGISTRO.ENTRADA_DE_OTRO_PAIS, `la entrada declara un país inválido: ${String(entrada.pais)}`);
+    }
+    if (entrada.pais.toUpperCase() !== pais) {
+        return fallo(MOTIVO_RECHAZO_CONSULTA_REGISTRO.ENTRADA_DE_OTRO_PAIS, `la entrada responde a una consulta de '${pais}' con una de '${entrada.pais}'`);
+    }
+    if (typeof entrada.hashLicencia !== "string" ||
+        !RE_HEX64.test(entrada.hashLicencia)) {
+        return fallo(MOTIVO_RECHAZO_CONSULTA_REGISTRO.VIGENCIA_REGISTRO_INVALIDA, "la entrada no declara un hash de licencia válido");
+    }
+    if (typeof entrada.vigenteHasta !== "number" ||
+        !Number.isFinite(entrada.vigenteHasta) ||
+        entrada.vigenteHasta <= 0) {
+        return fallo(MOTIVO_RECHAZO_CONSULTA_REGISTRO.VIGENCIA_REGISTRO_INVALIDA, `la entrada no declara una vigencia válida: ${String(entrada.vigenteHasta)}`);
+    }
+    if (!Object.values(ESTADO_LICENCIA).includes(entrada.estado)) {
+        // An unrecognised state is refused, never optimistically read as `activa`.
+        return fallo(MOTIVO_RECHAZO_CONSULTA_REGISTRO.ESTADO_REGISTRO_INVALIDO, `estado de licencia desconocido: ${String(entrada.estado)}`);
+    }
+    // ── 6. State. Both non-active states refuse — no "valid with warnings" ──
+    if (entrada.estado === ESTADO_LICENCIA.REVOCADA) {
+        return fallo(MOTIVO_RECHAZO_CONSULTA_REGISTRO.LICENCIA_REVOCADA, `el registro de '${pais}' declara la licencia revocada: no admite avisos`);
+    }
+    if (entrada.estado === ESTADO_LICENCIA.SUSPENDIDA) {
+        return fallo(MOTIVO_RECHAZO_CONSULTA_REGISTRO.LICENCIA_SUSPENDIDA, `el registro de '${pais}' declara la licencia suspendida: no admite avisos`);
+    }
+    // ── 7. Windows. Two independent ones, and the credential may not exceed the registry ──
+    // `vigenteHasta` is exclusive in both places, matching `validarCredencial`.
+    if (credencial.vigenteHasta <= ahora) {
+        return fallo(MOTIVO_RECHAZO_CONSULTA_REGISTRO.LICENCIA_CADUCADA, `la credencial caducó antes de ${ahora} (vigente hasta ${credencial.vigenteHasta})`);
+    }
+    if (entrada.vigenteHasta <= ahora) {
+        return fallo(MOTIVO_RECHAZO_CONSULTA_REGISTRO.LICENCIA_CADUCADA, `el registro da la licencia por vencida (vigente hasta ${entrada.vigenteHasta}, ahora ${ahora})`);
+    }
+    if (credencial.vigenteHasta > entrada.vigenteHasta) {
+        return fallo(MOTIVO_RECHAZO_CONSULTA_REGISTRO.LICENCIA_CADUCADA, `la credencial reclama vigencia hasta ${credencial.vigenteHasta} pero el registro solo hasta ${entrada.vigenteHasta}`);
+    }
+    // ── 8. The claims the credential makes about that entry ──
+    if (entrada.especialidad !== undefined &&
+        credencial.especialidad !== entrada.especialidad) {
+        return fallo(MOTIVO_RECHAZO_CONSULTA_REGISTRO.ESPECIALIDAD_NO_REGISTRADA, `la entrada registra '${entrada.especialidad}' y la credencial reclama '${String(credencial.especialidad)}'`);
+    }
+    if (entrada.autoridad !== undefined &&
+        credencial.autoridad !== entrada.autoridad) {
+        return fallo(MOTIVO_RECHAZO_CONSULTA_REGISTRO.AUTORIDAD_NO_REGISTRADA, `la entrada registra '${entrada.autoridad}' y la credencial declara '${credencial.autoridad}'`);
+    }
+    return {
+        ok: true,
+        credencial,
+        entrada,
+        metodoVerificacion: metodoRegistroPorPais(pais, version),
+        verificadoEn: ahora,
+    };
+}
+/** The only implemented strategy: verification of foundation, by country registry. */
+export const ESTRATEGIA_REGISTRO_POR_PAIS = {
+    clase: "registro_por_pais",
+    acreditar: acreditarContraRegistro,
+};
+/**
+ * Classes declared by `docs/medico/modelo-datos.md` §4.2 that this phase does
+ * not implement. Listed so the gap is explicit rather than inferred from a
+ * missing export.
+ */
+export const CLASES_NO_IMPLEMENTADAS = [
+    "colegio_directo",
+    "testimonio_directo",
+    "supervision",
+];
+/**
+ * Dispatch to a strategy by its verification class.
+ *
+ * Fails closed with {@link MOTIVO_RECHAZO_CONSULTA_REGISTRO.METODO_NO_IMPLEMENTADO}
+ * for a class with no strategy today, so "not built yet" can never be read as
+ * "nothing to check". Peer attestation and quorum revocation arrive here, as
+ * implementations of {@link EstrategiaAcreditacion}, in Phase 3.
+ */
+export async function acreditarCon(clase, credencial, fuente, ahora) {
+    if (clase === ESTRATEGIA_REGISTRO_POR_PAIS.clase) {
+        return ESTRATEGIA_REGISTRO_POR_PAIS.acreditar(credencial, fuente, ahora);
+    }
+    return fallo(MOTIVO_RECHAZO_CONSULTA_REGISTRO.METODO_NO_IMPLEMENTADO, `la clase de verificación '${clase}' todavía no tiene estrategia en esta fase`);
+}
+/**
+ * An in-memory registry. Pure data, no I/O — the fixture a test supplies and the
+ * stand-in Phase 3 replaces with a replicated, append-only snapshot.
+ */
+export class RegistroLicenciasEnMemoria {
+    entradasPorPais = new Map();
+    versiones = new Map();
+    soportados;
+    /**
+     * @param entradas - the registry contents. Anything whose `estado` is not in
+     *   {@link ESTADO_LICENCIA} is kept verbatim, so a test can prove such an
+     *   entry is refused rather than normalised away by the fixture.
+     * @param opciones.versionRegistro - snapshot version, per country or shared.
+     * @param opciones.paisesSoportados - countries this source speaks for. Defaults
+     *   to the countries actually present in `entradas`.
+     */
+    constructor(entradas = [], opciones = {}) {
+        for (const entrada of entradas) {
+            const clave = entrada?.pais?.toUpperCase?.() ?? "";
+            if (clave === "")
+                continue;
+            const lista = this.entradasPorPais.get(clave);
+            if (lista)
+                lista.push(entrada);
+            else
+                this.entradasPorPais.set(clave, [entrada]);
+        }
+        const version = opciones.versionRegistro;
+        for (const pais of this.entradasPorPais.keys()) {
+            const propia = typeof version === "string" ? version : version?.[pais];
+            // An empty registry still has a version, so "supported but no snapshot" is
+            // distinguishable from "empty snapshot" — both refuse, for different reasons.
+            this.versiones.set(pais, propia ?? `${pais}-v0`);
+        }
+        const declarados = opciones.paisesSoportados?.map((p) => p.toUpperCase());
+        this.soportados = new Set(declarados ?? [...this.entradasPorPais.keys()]);
+    }
+    get paisesSoportados() {
+        return [...this.soportados];
+    }
+    versionRegistro(pais) {
+        return this.versiones.get(pais.toUpperCase());
+    }
+    consultar({ pais, hashLicencia, }) {
+        const lista = this.entradasPorPais.get(pais.toUpperCase());
+        if (!lista)
+            return undefined;
+        return lista.find((e) => e.hashLicencia === hashLicencia);
+    }
+}
+/** Reasons this module can produce, re-exported so callers need one import. */
+export { MOTIVO_RECHAZO_CREDENCIAL, MOTIVO_RECHAZO_REGISTRO };
+//# sourceMappingURL=verificacion-registro.js.map

package/dist/medico/verificacion-registro.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verificacion-registro.js","sourceRoot":"","sources":["../../src/medico/verificacion-registro.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmDG;AAEH,OAAO,EACN,yBAAyB,EAEzB,iBAAiB,GACjB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACN,uBAAuB,GAEvB,MAAM,2BAA2B,CAAC;AAGnC;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG;IAC9B,MAAM,EAAE,QAAQ;IAChB,UAAU,EAAE,YAAY;IACxB,QAAQ,EAAE,UAAU;CACX,CAAC;AAkFX;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAG;IAC/C,sFAAsF;IACtF,sBAAsB,EAAE,wBAAwB;IAChD,uEAAuE;IACvE,iBAAiB,EAAE,mBAAmB;IACtC,oEAAoE;IACpE,iBAAiB,EAAE,mBAAmB;IACtC,2DAA2D;IAC3D,sBAAsB,EAAE,wBAAwB;IAChD,kDAAkD;IAClD,mBAAmB,EAAE,qBAAqB;IAC1C,0DAA0D;IAC1D,iBAAiB,EAAE,mBAAmB;IACtC;sEACkE;IAClE,iBAAiB,EAAE,mBAAmB;IACtC,+EAA+E;IAC/E,oBAAoB,EAAE,sBAAsB;IAC5C,yEAAyE;IACzE,wBAAwB,EAAE,0BAA0B;IACpD,iEAAiE;IACjE,0BAA0B,EAAE,4BAA4B;IACxD,mFAAmF;IACnF,0BAA0B,EAAE,2BAA2B;IACvD,2DAA2D;IAC3D,uBAAuB,EAAE,wBAAwB;IACjD,6EAA6E;IAC7E,gBAAgB,EAAE,kBAAkB;IACpC,oFAAoF;IACpF,sBAAsB,EAAE,wBAAwB;CACvC,CAAC;AA+CX,SAAS,KAAK,CACb,MAAiC,EACjC,OAAe;IAEf,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC;AAC/D,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,qBAAqB,CACpC,IAAY,EACZ,eAAuB;IAEvB,OAAO;QACN,KAAK,EAAE,mBAAmB;QAC1B,IAAI,EAAE,IAAI,CAAC,WAAW,EAAE;QACxB,eAAe;KACf,CAAC;AACH,CAAC;AAED,MAAM,aAAa,GAAG,YAAY,CAAC;AACnC,MAAM,QAAQ,GAAG,gBAAgB,CAAC;AAElC;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC5C,UAA4B,EAC5B,MAA0B,EAC1B,KAAa;IAEb,mEAAmE;IACnE,MAAM,KAAK,GAAG,iBAAiB,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IACnD,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;QACf,6EAA6E;QAC7E,0DAA0D;QAC1D,OAAO,KAAK,CACX,gCAAgC,CAAC,sBAAsB,EACvD,mBAAmB,KAAK,CAAC,MAAM,MAAM,KAAK,CAAC,OAAO,EAAE,CACpD,CAAC;IACH,CAAC;IAED,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;IAE3C,0EAA0E;IAC1E,IACC,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC;QACvC,CAAC,MAAM,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,KAAK,IAAI,CAAC,EAC7D,CAAC;QACF,OAAO,KAAK,CACX,gCAAgC,CAAC,iBAAiB,EAClD,4BAA4B,IAAI,4EAA4E,CAC5G,CAAC;IACH,CAAC;IAED,8EAA8E;IAC9E,MAAM,OAAO,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;IAC7C,IAAI,CAAC,OAAO,EAAE,CAAC;QACd,OAAO,KAAK,CACX,gCAAgC,CAAC,iBAAiB,EAClD,IAAI,IAAI,kDAAkD,CAC1D,CAAC;IACH,CAAC;IAED,qEAAqE;IACrE,IAAI,OAA4C,CAAC;IACjD,IAAI,CAAC;QACJ,OAAO,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC;YAChC,IAAI;YACJ,YAAY,EAAE,UAAU,CAAC,UAAU;SACnC,CAAC,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,OAAO,KAAK,CACX,gCAAgC,CAAC,gBAAgB,EACjD,kCAAkC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAC1F,CAAC;IACH,CAAC;IAED,IAAI,CAAC,OAAO,EAAE,CAAC;QACd,OAAO,KAAK,CACX,gCAAgC,CAAC,sBAAsB,EACvD,gDAAgD,IAAI,cAAc,OAAO,GAAG,CAC5E,CAAC;IACH,CAAC;IAED,gDAAgD;IAChD,IAAI,OAAO,OAAO,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3E,OAAO,KAAK,CACX,gCAAgC,CAAC,oBAAoB,EACrD,wCAAwC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAC9D,CAAC;IACH,CAAC;IACD,IAAI,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,IAAI,EAAE,CAAC;QACzC,OAAO,KAAK,CACX,gCAAgC,CAAC,oBAAoB,EACrD,0CAA0C,IAAI,iBAAiB,OAAO,CAAC,IAAI,GAAG,CAC9E,CAAC;IACH,CAAC;IACD,IACC,OAAO,OAAO,CAAC,YAAY,KAAK,QAAQ;QACxC,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,EACnC,CAAC;QACF,OAAO,KAAK,CACX,gCAAgC,CAAC,0BAA0B,EAC3D,kDAAkD,CAClD,CAAC;IACH,CAAC;IACD,IACC,OAAO,OAAO,CAAC,YAAY,KAAK,QAAQ;QACxC,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,YAAY,CAAC;QACtC,OAAO,CAAC,YAAY,IAAI,CAAC,EACxB,CAAC;QACF,OAAO,KAAK,CACX,gCAAgC,CAAC,0BAA0B,EAC3D,8CAA8C,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAC5E,CAAC;IACH,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC9D,2EAA2E;QAC3E,OAAO,KAAK,CACX,gCAAgC,CAAC,wBAAwB,EACzD,mCAAmC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAC3D,CAAC;IACH,CAAC;IAED,2EAA2E;IAC3E,IAAI,OAAO,CAAC,MAAM,KAAK,eAAe,CAAC,QAAQ,EAAE,CAAC;QACjD,OAAO,KAAK,CACX,gCAAgC,CAAC,iBAAiB,EAClD,mBAAmB,IAAI,kDAAkD,CACzE,CAAC;IACH,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,eAAe,CAAC,UAAU,EAAE,CAAC;QACnD,OAAO,KAAK,CACX,gCAAgC,CAAC,mBAAmB,EACpD,mBAAmB,IAAI,oDAAoD,CAC3E,CAAC;IACH,CAAC;IAED,yFAAyF;IACzF,4EAA4E;IAC5E,IAAI,UAAU,CAAC,YAAY,IAAI,KAAK,EAAE,CAAC;QACtC,OAAO,KAAK,CACX,gCAAgC,CAAC,iBAAiB,EAClD,iCAAiC,KAAK,mBAAmB,UAAU,CAAC,YAAY,GAAG,CACnF,CAAC;IACH,CAAC;IACD,IAAI,OAAO,CAAC,YAAY,IAAI,KAAK,EAAE,CAAC;QACnC,OAAO,KAAK,CACX,gCAAgC,CAAC,iBAAiB,EAClD,yDAAyD,OAAO,CAAC,YAAY,WAAW,KAAK,GAAG,CAChG,CAAC;IACH,CAAC;IACD,IAAI,UAAU,CAAC,YAAY,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC;QACpD,OAAO,KAAK,CACX,gCAAgC,CAAC,iBAAiB,EAClD,wCAAwC,UAAU,CAAC,YAAY,gCAAgC,OAAO,CAAC,YAAY,EAAE,CACrH,CAAC;IACH,CAAC;IAED,4DAA4D;IAC5D,IACC,OAAO,CAAC,YAAY,KAAK,SAAS;QAClC,UAAU,CAAC,YAAY,KAAK,OAAO,CAAC,YAAY,EAC/C,CAAC;QACF,OAAO,KAAK,CACX,gCAAgC,CAAC,0BAA0B,EAC3D,wBAAwB,OAAO,CAAC,YAAY,8BAA8B,MAAM,CAAC,UAAU,CAAC,YAAY,CAAC,GAAG,CAC5G,CAAC;IACH,CAAC;IACD,IACC,OAAO,CAAC,SAAS,KAAK,SAAS;QAC/B,UAAU,CAAC,SAAS,KAAK,OAAO,CAAC,SAAS,EACzC,CAAC;QACF,OAAO,KAAK,CACX,gCAAgC,CAAC,uBAAuB,EACxD,wBAAwB,OAAO,CAAC,SAAS,8BAA8B,UAAU,CAAC,SAAS,GAAG,CAC9F,CAAC;IACH,CAAC;IAED,OAAO;QACN,EAAE,EAAE,IAAI;QACR,UAAU;QACV,OAAO;QACP,kBAAkB,EAAE,qBAAqB,CAAC,IAAI,EAAE,OAAO,CAAC;QACxD,YAAY,EAAE,KAAK;KACnB,CAAC;AACH,CAAC;AAqBD,sFAAsF;AACtF,MAAM,CAAC,MAAM,4BAA4B,GAA2B;IACnE,KAAK,EAAE,mBAAmB;IAC1B,SAAS,EAAE,uBAAuB;CAClC,CAAC;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG;IACtC,iBAAiB;IACjB,oBAAoB;IACpB,aAAa;CACJ,CAAC;AAEX;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CACjC,KAAkC,EAClC,UAA4B,EAC5B,MAA0B,EAC1B,KAAa;IAEb,IAAI,KAAK,KAAK,4BAA4B,CAAC,KAAK,EAAE,CAAC;QAClD,OAAO,4BAA4B,CAAC,SAAS,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;IAC1E,CAAC;IACD,OAAO,KAAK,CACX,gCAAgC,CAAC,sBAAsB,EACvD,6BAA6B,KAAK,4CAA4C,CAC9E,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,OAAO,0BAA0B;IACrB,eAAe,GAAG,IAAI,GAAG,EAGvC,CAAC;IACa,SAAS,GAAG,IAAI,GAAG,EAAkB,CAAC;IACtC,UAAU,CAAsB;IAEjD;;;;;;;OAOG;IACH,YACC,QAAQ,GAAuC,EAAE,EACjD,QAAQ,GAGJ,EAAE;QAEN,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;YAChC,MAAM,KAAK,GAAG,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,IAAI,EAAE,CAAC;YACnD,IAAI,KAAK,KAAK,EAAE;gBAAE,SAAS;YAC3B,MAAM,KAAK,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YAC9C,IAAI,KAAK;gBAAE,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;;gBAC1B,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;QACjD,CAAC;QAED,MAAM,OAAO,GAAG,QAAQ,CAAC,eAAe,CAAC;QACzC,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,eAAe,CAAC,IAAI,EAAE,EAAE,CAAC;YAChD,MAAM,MAAM,GAAG,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,CAAC;YACvE,2EAA2E;YAC3E,8EAA8E;YAC9E,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,IAAI,GAAG,IAAI,KAAK,CAAC,CAAC;QAClD,CAAC;QAED,MAAM,UAAU,GAAG,QAAQ,CAAC,gBAAgB,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;QAC1E,IAAI,CAAC,UAAU,GAAG,IAAI,GAAG,CAAC,UAAU,IAAI,CAAC,GAAG,IAAI,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAC3E,CAAC;IAED,IAAI,gBAAgB;QACnB,OAAO,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC;IAC7B,CAAC;IAED,eAAe,CAAC,IAAY;QAC3B,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;IAC/C,CAAC;IAED,SAAS,CAAC,EACT,IAAI,EACJ,YAAY,GACc;QAC1B,MAAM,KAAK,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;QAC3D,IAAI,CAAC,KAAK;YAAE,OAAO,SAAS,CAAC;QAC7B,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,KAAK,YAAY,CAAC,CAAC;IAC3D,CAAC;CACD;AAED,+EAA+E;AAC/E,OAAO,EAAE,yBAAyB,EAAE,uBAAuB,EAAE,CAAC"}