@wildo-ai/saas-backend-lib 1.0.1

package/dist/esm/runtime/models/execution-context.backend.schemas.d.ts

@@ -0,0 +1,253 @@
+import { z } from 'zod';
+import { ResourceConfiguration_Operation, ResourceFieldIdentifier, ResourcePrimaryScope, ExecutionContext_ExecutionType, ExecutionContext_InitiatorIds, ExecutionContext_RoleInfo, ExecutionContext_RelationshipContext, type ResolvedFeatures } from '@wildo-ai/saas-models';
+/**
+ * Result of socket authentication - reuses existing ExecutionContext types.
+ * No new authorization types are created.
+ */
+export type SocketAuthResult = {
+    executionType: ExecutionContext_ExecutionType;
+    initiatorIds: ExecutionContext_InitiatorIds | null;
+    initiatorRoles: ExecutionContext_RoleInfo[];
+    /** W7.3b: Raw consumable token value for one-off session WebSocket connections. */
+    consumableTokenValue?: string;
+};
+export declare const ExecutionContext_FactoryParamsSchema: z.ZodObject<{
+    operation: z.ZodAny;
+    executionType: z.ZodEnum<typeof ExecutionContext_ExecutionType>;
+    contextResourcesFieldIdentifier: z.ZodOptional<z.ZodMap<z.ZodString, z.ZodString>>;
+    initiatorIds: z.ZodNullable<z.ZodOptional<z.ZodObject<{
+        organizationId: z.ZodOptional<z.ZodString>;
+        userId: z.ZodOptional<z.ZodString>;
+        applicationId: z.ZodOptional<z.ZodString>;
+        organizationApiKeyId: z.ZodOptional<z.ZodString>;
+        applicationApiKeyId: z.ZodOptional<z.ZodString>;
+        consumableTokenId: z.ZodOptional<z.ZodString>;
+        webhookProviderId: z.ZodOptional<z.ZodString>;
+        anonymousUserId: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip, core.$ZodObjectExtra>>>;
+    initiatorRoles: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        roles: z.ZodArray<z.ZodString>;
+        relatedPrimaryScope: z.ZodEnum<typeof ResourcePrimaryScope>;
+        relatedResourceId: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip, core.$ZodObjectExtra>>>;
+    relationshipContexts: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        resourceType: z.ZodString;
+        relationshipField: z.ZodOptional<z.ZodString>;
+        resourceId: z.ZodString;
+    }, z.core.$strip, core.$ZodObjectExtra>>>;
+}, z.core.$strip, core.$ZodObjectExtra>;
+export declare const ExecutionContextPlatformJwtClaimsSchema: z.ZodObject<{
+    requestUUID: z.ZodString;
+    initiatorIds: z.ZodObject<{
+        organizationId: z.ZodOptional<z.ZodString>;
+        userId: z.ZodOptional<z.ZodString>;
+        applicationId: z.ZodOptional<z.ZodString>;
+        organizationApiKeyId: z.ZodOptional<z.ZodString>;
+        applicationApiKeyId: z.ZodOptional<z.ZodString>;
+        consumableTokenId: z.ZodOptional<z.ZodString>;
+        webhookProviderId: z.ZodOptional<z.ZodString>;
+        anonymousUserId: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip, core.$ZodObjectExtra>;
+    contextResourcesFieldIdentifier: z.ZodOptional<z.ZodMap<z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>>>;
+    initiatorRoles: z.ZodArray<z.ZodObject<{
+        roles: z.ZodArray<z.ZodString>;
+        relatedPrimaryScope: z.ZodEnum<typeof ResourcePrimaryScope>;
+        relatedResourceId: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip, core.$ZodObjectExtra>>;
+    executionType: z.ZodEnum<typeof ExecutionContext_ExecutionType>;
+    operationRef: z.ZodString;
+    resourceIdentifier: z.ZodString;
+    resourcePrimaryScope: z.ZodEnum<typeof ResourcePrimaryScope>;
+    relationshipContexts: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        resourceType: z.ZodString;
+        relationshipField: z.ZodOptional<z.ZodString>;
+        resourceId: z.ZodString;
+    }, z.core.$strip, core.$ZodObjectExtra>>>;
+}, z.core.$strip, core.$ZodObjectExtra>;
+/** ──────────────────────────────────────────────────────────────
+ * Inferred Types (from schemas - no interface duplication)
+ * ────────────────────────────────────────────────────────────── */
+export type ExecutionContext_FactoryParams = z.infer<typeof ExecutionContext_FactoryParamsSchema>;
+export type ExecutionContextPlatformJwtClaims = z.infer<typeof ExecutionContextPlatformJwtClaimsSchema>;
+/**
+ * Immutable request context carried through the entire operation lifecycle.
+ *
+ * Key design invariants:
+ * - `_operation` is `readonly` — once constructed, the operation reference never changes.
+ * - `doOperation()` enforces that `executionContext.operation` always matches the operation
+ *   actually being executed via two correction points that call `withOperation()`.
+ * - Identity fields (`_initiatorIds`, `_initiatorRoles`, `_executionType`) are set at
+ *   construction and never mutated. They represent WHO is performing the operation.
+ * - Scoping fields (`_contextResourcesFieldIdentifier`, `_relationshipContexts`) define
+ *   WHICH resources are in scope. Used by `buildContextualFilter` in the repository layer.
+ * - Sub-call tracking (`_subCallDepth`, `_visitedResources`) is managed by
+ *   `ExecutionContextCreatorBackendService.createForSubCall()` for nested operations.
+ *
+ * Context creation entry points:
+ * - `createExecutionContextFromRequest()` — HTTP requests (controller layer)
+ * - `createForInternalOperation()` — internal/system-initiated operations
+ * - `createForSubCall()` — nested child operations (increments depth, tracks visited)
+ * - `withOperation()` — operation correction within `doOperation()` (preserves all state)
+ */
+export declare class ExecutionContext<TResourceConfigOperation extends ResourceConfiguration_Operation<any, any, any>> {
+    /** The operation being executed. Immutable after construction. See `withOperation()`. */
+    private readonly _operation;
+    private readonly _executionType;
+    private readonly _contextResourcesFieldIdentifier;
+    private readonly _initiatorIds;
+    private readonly _initiatorRoles;
+    private readonly _relationshipContexts;
+    private readonly _activeUserType;
+    private readonly _requestUUID;
+    private readonly _subCallDepth;
+    private readonly _visitedResources;
+    private _isSealed;
+    /**
+     * Precomputed resolved features for this execution context.
+     * Set during context creation or lazily by the feature gate.
+     * Once set, avoids re-resolution per operation.
+     */
+    private _resolvedFeatures;
+    /**
+     * Raw consumable token value from the request, stored for deferred consumption.
+     * Set during context creation when a consumable_token is present.
+     * Consumed by the pipeline AFTER the core operation succeeds (Trap 4).
+     * SECURITY: Never log this value (R2).
+     */
+    private _consumableTokenValue;
+    /**
+     * W7.3b: Set to true after consumeToken() succeeds in the pipeline.
+     * The controller uses this to signal the frontend via response header.
+     */
+    private _consumableTokenConsumed;
+    /**
+     * Epoch seconds of the last primary authentication (password, passkey, SSO).
+     * Extracted from JWT claims during context creation.
+     * Used by step-up auth enforcement in services-registry-handler (W7.1).
+     */
+    private _lastAuthenticatedAt;
+    /**
+     * Raw X-Reauth-Token header value from the request.
+     * Single-use REAUTH consumable token for step-up authentication.
+     * Read by step-up enforcement — consumed atomically via ConsumableTokenService.
+     * SECURITY: Never log this value.
+     */
+    private _reAuthTokenValue;
+    /**
+     * W7.3a: Indicates that an AnonymousUser record was created (or upserted) during this request.
+     * When true, the controller inserts the signed session token into the response header.
+     */
+    private _anonymousUserCreated;
+    /**
+     * W7.3a: The signed anonymous session JWT to return in the response header.
+     * Set by the controller after AnonymousSessionBackendService signs the token.
+     */
+    private _anonymousSessionToken;
+    constructor(operation: TResourceConfigOperation, executionType: ExecutionContext_ExecutionType, contextResourcesFieldIdentifier?: Map<ResourceFieldIdentifier, string | string[]>, initiatorIds?: ExecutionContext_InitiatorIds | null, initiatorRoles?: ExecutionContext_RoleInfo[], relationshipContexts?: ExecutionContext_RelationshipContext[], requestUUID?: string, subCallDepth?: number, visitedResources?: Set<string>, 
+    /** Resolved from X-Frontend-Service-Name → frontendServices → user type. Null until Phase 3. */
+    activeUserType?: string | null);
+    seal(): void;
+    get isSealed(): boolean;
+    /**
+     * The operation this context was created for (or corrected to via `withOperation()`).
+     * Inside `doOperation()`, this is guaranteed to match the operation actually being executed.
+     */
+    get operation(): Readonly<TResourceConfigOperation>;
+    get executionType(): Readonly<ExecutionContext_ExecutionType>;
+    /** Precomputed resolved features. Null if not yet resolved. */
+    get resolvedFeatures(): ResolvedFeatures | null;
+    /** Set resolved features (called by resolution service or context creator). */
+    setResolvedFeatures(features: ResolvedFeatures): void;
+    /** Raw consumable token value for deferred consumption. NEVER log this (R2). */
+    get consumableTokenValue(): string | undefined;
+    /** Store raw token value for deferred consumption (called by context creator). */
+    setConsumableTokenValue(value: string): void;
+    /** W7.3b: Whether the consumable token was consumed during this request. */
+    get consumableTokenConsumed(): boolean;
+    /** W7.3b: Mark the consumable token as consumed (called by pipeline after consumeToken). */
+    markConsumableTokenConsumed(): void;
+    /** Epoch seconds of last primary authentication. Undefined for non-user or legacy JWTs. */
+    get lastAuthenticatedAt(): number | undefined;
+    /** Store lastAuthenticatedAt from JWT claims (called by context creator). */
+    setLastAuthenticatedAt(value: number): void;
+    /** Raw X-Reauth-Token header value. NEVER log this. */
+    get reAuthTokenValue(): string | undefined;
+    /** Store re-auth token from request header (called by context creator). */
+    setReAuthTokenValue(value: string): void;
+    get requestUUID(): Readonly<string>;
+    get organizationId(): Readonly<string | undefined>;
+    get userId(): Readonly<string | undefined>;
+    get consumableTokenId(): Readonly<string | undefined>;
+    get applicationId(): Readonly<string | undefined>;
+    get organizationApiKeyId(): Readonly<string | undefined>;
+    get applicationApiKeyId(): Readonly<string | undefined>;
+    get initiatorIds(): ExecutionContext_InitiatorIds | null;
+    /** Resolved from X-Frontend-Service-Name → frontendServices → user type. Null until Phase 3. */
+    get activeUserType(): string | null;
+    get initiatorRoles(): readonly ExecutionContext_RoleInfo[];
+    /**
+     * Returns the relationship contexts for FK-based access paths.
+     * Used for authorization and filtering based on relationship fields.
+     */
+    get relationshipContexts(): readonly ExecutionContext_RelationshipContext[];
+    /**
+     * Get a relationship context by resource type and optionally by relationship field.
+     * @param resourceType The resource type to look for
+     * @param relationshipField Optional FK field name (e.g., 'assignedToUserId')
+     * @returns The matching relationship context or undefined
+     */
+    getRelationshipContext(resourceType: string, relationshipField?: string): ExecutionContext_RelationshipContext | undefined;
+    /**
+     * Check if the context was accessed via a specific FK relationship field.
+     * @param relationshipField The FK field name (e.g., 'assignedToUserId', 'createdByUserId')
+     * @returns true if accessed via this relationship field
+     */
+    hasRelationshipField(relationshipField: string): boolean;
+    getOperationFieldIdentifier(): string | undefined;
+    getContextResourceId(fieldIdentifier: ResourceFieldIdentifier): string | undefined;
+    getContextResourceIds(): ReadonlyMap<ResourceFieldIdentifier, string | string[] | undefined>;
+    /**
+     * Get the current sub-call depth (0 for top-level calls).
+     * Used for cycle detection and depth limiting.
+     */
+    get subCallDepth(): number;
+    /**
+     * Get the current sub-call depth (0 for top-level calls).
+     * Used for cycle detection and depth limiting.
+     */
+    getSubCallDepth(): number;
+    /**
+     * Get the set of visited resources (format: "resourceType:resourceId").
+     * Used for circular dependency detection.
+     */
+    getVisitedResources(): ReadonlySet<string>;
+    /**
+     * Check if a resource has already been visited in this call chain.
+     * @param key The resource key in format "resourceType:resourceId"
+     * @returns true if the resource has been visited
+     */
+    hasVisitedResource(key: string): boolean;
+    /**
+     * Create a new ExecutionContext with a different operation but all other state preserved.
+     * Used by doOperation to enforce the invariant that executionContext.operation always
+     * matches the operation actually being executed — regardless of what the caller passed.
+     *
+     * This is NOT a sub-call: subCallDepth, visitedResources, and requestUUID are preserved as-is.
+     */
+    withOperation<TOp extends ResourceConfiguration_Operation<any, any, any>>(operation: TOp): ExecutionContext<TOp>;
+    addContextResourceId(fieldIdentifier: ResourceFieldIdentifier, resourceId: string): void;
+    isApiKeyExecution(): boolean;
+    isUserExecution(): boolean;
+    isInternalExecution(): boolean;
+    isPublicExecution(): boolean;
+    isWebhookExecution(): boolean;
+    isAnonymousExecution(): boolean;
+    get anonymousUserId(): Readonly<string | undefined>;
+    get webhookProviderId(): Readonly<string | undefined>;
+    get anonymousUserCreated(): boolean;
+    setAnonymousUserCreated(value: boolean): void;
+    get anonymousSessionToken(): string | undefined;
+    setAnonymousSessionToken(value: string): void;
+    toExecutionContextPlatformJwtClaims(): ExecutionContextPlatformJwtClaims;
+}
+//# sourceMappingURL=execution-context.backend.schemas.d.ts.map

package/dist/esm/runtime/models/execution-context.backend.schemas.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"execution-context.backend.schemas.d.ts","sourceRoot":"","sources":["../../../../src/runtime/models/execution-context.backend.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,+BAA+B,EAC/B,uBAAuB,EACvB,oBAAoB,EAEpB,8BAA8B,EAC9B,6BAA6B,EAE7B,yBAAyB,EAEzB,oCAAoC,EAGpC,KAAK,gBAAgB,EACtB,MAAM,uBAAuB,CAAC;AAI/B;;;GAGG;AACH,MAAM,MAAM,gBAAgB,GAAG;IAC7B,aAAa,EAAE,8BAA8B,CAAC;IAC9C,YAAY,EAAE,6BAA6B,GAAG,IAAI,CAAC;IACnD,cAAc,EAAE,yBAAyB,EAAE,CAAC;IAC5C,mFAAmF;IACnF,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC/B,CAAC;AAMF,eAAO,MAAM,oCAAoC;;;;;;;;;;;;;;;;;;;;;;;;uCAO/C,CAAC;AAEH,eAAO,MAAM,uCAAuC;;;;;;;;;;;;;;;;;;;;;;;;;;;uCAWlD,CAAC;AAEH;;oEAEoE;AAEpE,MAAM,MAAM,8BAA8B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oCAAoC,CAAC,CAAC;AAClG,MAAM,MAAM,iCAAiC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uCAAuC,CAAC,CAAC;AAExG;;;;;;;;;;;;;;;;;;;GAmBG;AACH,qBAAa,gBAAgB,CAC3B,wBAAwB,SAAS,+BAA+B,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC;IAE/E,yFAAyF;IACzF,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA2B;IACtD,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAiC;IAChE,OAAO,CAAC,QAAQ,CAAC,gCAAgC,CAAkD;IACnG,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAuC;IACrE,OAAO,CAAC,QAAQ,CAAC,eAAe,CAA8B;IAC9D,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAyC;IAC/E,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAgB;IAChD,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAS;IACtC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAS;IACvC,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAc;IAChD,OAAO,CAAC,SAAS,CAAkB;IAEnC;;;;OAIG;IACH,OAAO,CAAC,iBAAiB,CAAiC;IAE1D;;;;;OAKG;IACH,OAAO,CAAC,qBAAqB,CAAiC;IAE9D;;;OAGG;IACH,OAAO,CAAC,wBAAwB,CAAS;IAEzC;;;;OAIG;IACH,OAAO,CAAC,oBAAoB,CAAiC;IAE7D;;;;;OAKG;IACH,OAAO,CAAC,iBAAiB,CAAiC;IAE1D;;;OAGG;IACH,OAAO,CAAC,qBAAqB,CAAkB;IAE/C;;;OAGG;IACH,OAAO,CAAC,sBAAsB,CAAiC;gBAG7D,SAAS,EAAE,wBAAwB,EACnC,aAAa,EAAE,8BAA8B,EAC7C,+BAA+B,GAAE,GAAG,CAAC,uBAAuB,EAAE,MAAM,GAAG,MAAM,EAAE,CAAa,EAC5F,YAAY,GAAE,6BAA6B,GAAG,IAAW,EACzD,cAAc,GAAE,yBAAyB,EAAO,EAChD,oBAAoB,GAAE,oCAAoC,EAAO,EAEjE,WAAW,CAAC,EAAE,MAAM,EACpB,YAAY,GAAE,MAAU,EACxB,gBAAgB,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC;IAC9B,gGAAgG;IAChG,cAAc,GAAE,MAAM,GAAG,IAAW;IA+EtC,IAAI,IAAI,IAAI;IAGZ,IAAI,QAAQ,IAAI,OAAO,CAA0B;IAEjD;;;OAGG;IACH,IAAI,SAAS,IAAI,QAAQ,CAAC,wBAAwB,CAAC,CAA4B;IAE/E,IAAI,aAAa,IAAI,QAAQ,CAAC,8BAA8B,CAAC,CAA8B;IAE3F,+DAA+D;IAC/D,IAAI,gBAAgB,IAAI,gBAAgB,GAAG,IAAI,CAAmC;IAElF,+EAA+E;IAC/E,mBAAmB,CAAC,QAAQ,EAAE,gBAAgB,GAAG,IAAI;IAErD,gFAAgF;IAChF,IAAI,oBAAoB,IAAI,MAAM,GAAG,SAAS,CAAuC;IAErF,kFAAkF;IAClF,uBAAuB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI;IAE5C,4EAA4E;IAC5E,IAAI,uBAAuB,IAAI,OAAO,CAA0C;IAEhF,4FAA4F;IAC5F,2BAA2B,IAAI,IAAI;IAEnC,2FAA2F;IAC3F,IAAI,mBAAmB,IAAI,MAAM,GAAG,SAAS,CAAsC;IAEnF,6EAA6E;IAC7E,sBAAsB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI;IAE3C,uDAAuD;IACvD,IAAI,gBAAgB,IAAI,MAAM,GAAG,SAAS,CAAmC;IAE7E,2EAA2E;IAC3E,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI;IAExC,IAAI,WAAW,IAAI,QAAQ,CAAC,MAAM,CAAC,CAA8B;IAEjE,IAAI,cAAc,IAAI,QAAQ,CAAC,MAAM,GAAG,SAAS,CAAC,CAA8C;IAEhG,IAAI,MAAM,IAAI,QAAQ,CAAC,MAAM,GAAG,SAAS,CAAC,CAAsC;IAEhF,IAAI,iBAAiB,IAAI,QAAQ,CAAC,MAAM,GAAG,SAAS,CAAC,CAAiD;IAEtG,IAAI,aAAa,IAAI,QAAQ,CAAC,MAAM,GAAG,SAAS,CAAC,CAA6C;IAE9F,IAAI,oBAAoB,IAAI,QAAQ,CAAC,MAAM,GAAG,SAAS,CAAC,CAAoD;IAE5G,IAAI,mBAAmB,IAAI,QAAQ,CAAC,MAAM,GAAG,SAAS,CAAC,CAAmD;IAE1G,IAAI,YAAY,IAAI,6BAA6B,GAAG,IAAI,CAA8B;IAEtF,gGAAgG;IAChG,IAAI,cAAc,IAAI,MAAM,GAAG,IAAI,CAAiC;IAEpE,IAAI,cAAc,IAAI,SAAS,yBAAyB,EAAE,CAA+B;IAEzF;;;OAGG;IACH,IAAI,oBAAoB,IAAI,SAAS,oCAAoC,EAAE,CAAqC;IAEhH;;;;;OAKG;IACH,sBAAsB,CACpB,YAAY,EAAE,MAAM,EACpB,iBAAiB,CAAC,EAAE,MAAM,GACzB,oCAAoC,GAAG,SAAS;IAOnD;;;;OAIG;IACH,oBAAoB,CAAC,iBAAiB,EAAE,MAAM,GAAG,OAAO;IAIxD,2BAA2B,IAAI,MAAM,GAAG,SAAS;IAIjD,oBAAoB,CAAC,eAAe,EAAE,uBAAuB,GAAG,MAAM,GAAG,SAAS;IAUlF,qBAAqB,IAAI,WAAW,CAAC,uBAAuB,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC;IAI5F;;;OAGG;IACH,IAAI,YAAY,IAAI,MAAM,CAA+B;IAEzD;;;OAGG;IACH,eAAe,IAAI,MAAM;IAEzB;;;OAGG;IACH,mBAAmB,IAAI,WAAW,CAAC,MAAM,CAAC;IAE1C;;;;OAIG;IACH,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO;IAExC;;;;;;OAMG;IACH,aAAa,CAAC,GAAG,SAAS,+BAA+B,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,EACtE,SAAS,EAAE,GAAG,GACb,gBAAgB,CAAC,GAAG,CAAC;IAuBxB,oBAAoB,CAAC,eAAe,EAAE,uBAAuB,EAAE,UAAU,EAAE,MAAM,GAAG,IAAI;IAWxF,iBAAiB,IAAI,OAAO;IAE5B,eAAe,IAAI,OAAO;IAE1B,mBAAmB,IAAI,OAAO;IAE9B,iBAAiB,IAAI,OAAO;IAE5B,kBAAkB,IAAI,OAAO;IAE7B,oBAAoB,IAAI,OAAO;IAE/B,IAAI,eAAe,IAAI,QAAQ,CAAC,MAAM,GAAG,SAAS,CAAC,CAA+C;IAElG,IAAI,iBAAiB,IAAI,QAAQ,CAAC,MAAM,GAAG,SAAS,CAAC,CAAiD;IAEtG,IAAI,oBAAoB,IAAI,OAAO,CAAuC;IAC1E,uBAAuB,CAAC,KAAK,EAAE,OAAO,GAAG,IAAI;IAE7C,IAAI,qBAAqB,IAAI,MAAM,GAAG,SAAS,CAAwC;IACvF,wBAAwB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI;IAE7C,mCAAmC,IAAI,iCAAiC;CAazE"}

package/dist/esm/runtime/models/execution-context.backend.schemas.js

@@ -0,0 +1,329 @@
+import { z } from 'zod';
+import { ResourcePrimaryScope, ExecutionContext_ExecutionType, ExecutionContext_InitiatorIdsSchema, ExecutionContext_RoleInfoSchema, ExecutionContext_RelationshipContextSchema, } from '@wildo-ai/saas-models';
+import { v4 as uuidv4 } from 'uuid';
+const contextResourcesFieldIdentifierSchema = z.map(z.string(), z.union([z.string(), z.array(z.string())])).optional();
+export const ExecutionContext_FactoryParamsSchema = z.object({
+    operation: z.any(), // Will be validated against ResourceConfiguration_Operation at runtime
+    executionType: z.enum(ExecutionContext_ExecutionType),
+    contextResourcesFieldIdentifier: z.map(z.string(), z.string()).optional(),
+    initiatorIds: ExecutionContext_InitiatorIdsSchema.optional().nullable(),
+    initiatorRoles: z.array(ExecutionContext_RoleInfoSchema).optional(),
+    relationshipContexts: z.array(ExecutionContext_RelationshipContextSchema).optional()
+});
+export const ExecutionContextPlatformJwtClaimsSchema = z.object({
+    requestUUID: z.string(),
+    initiatorIds: ExecutionContext_InitiatorIdsSchema,
+    contextResourcesFieldIdentifier: contextResourcesFieldIdentifierSchema,
+    initiatorRoles: z.array(ExecutionContext_RoleInfoSchema),
+    executionType: z.enum(ExecutionContext_ExecutionType),
+    operationRef: z.string(),
+    resourceIdentifier: z.string(),
+    resourcePrimaryScope: z.enum(ResourcePrimaryScope),
+    /** Relationship contexts for FK-based access paths */
+    relationshipContexts: z.array(ExecutionContext_RelationshipContextSchema).optional(),
+});
+/**
+ * Immutable request context carried through the entire operation lifecycle.
+ *
+ * Key design invariants:
+ * - `_operation` is `readonly` — once constructed, the operation reference never changes.
+ * - `doOperation()` enforces that `executionContext.operation` always matches the operation
+ *   actually being executed via two correction points that call `withOperation()`.
+ * - Identity fields (`_initiatorIds`, `_initiatorRoles`, `_executionType`) are set at
+ *   construction and never mutated. They represent WHO is performing the operation.
+ * - Scoping fields (`_contextResourcesFieldIdentifier`, `_relationshipContexts`) define
+ *   WHICH resources are in scope. Used by `buildContextualFilter` in the repository layer.
+ * - Sub-call tracking (`_subCallDepth`, `_visitedResources`) is managed by
+ *   `ExecutionContextCreatorBackendService.createForSubCall()` for nested operations.
+ *
+ * Context creation entry points:
+ * - `createExecutionContextFromRequest()` — HTTP requests (controller layer)
+ * - `createForInternalOperation()` — internal/system-initiated operations
+ * - `createForSubCall()` — nested child operations (increments depth, tracks visited)
+ * - `withOperation()` — operation correction within `doOperation()` (preserves all state)
+ */
+export class ExecutionContext {
+    /** The operation being executed. Immutable after construction. See `withOperation()`. */
+    _operation;
+    _executionType;
+    _contextResourcesFieldIdentifier;
+    _initiatorIds;
+    _initiatorRoles;
+    _relationshipContexts;
+    _activeUserType;
+    _requestUUID;
+    _subCallDepth;
+    _visitedResources;
+    _isSealed = false;
+    /**
+     * Precomputed resolved features for this execution context.
+     * Set during context creation or lazily by the feature gate.
+     * Once set, avoids re-resolution per operation.
+     */
+    _resolvedFeatures = null;
+    /**
+     * Raw consumable token value from the request, stored for deferred consumption.
+     * Set during context creation when a consumable_token is present.
+     * Consumed by the pipeline AFTER the core operation succeeds (Trap 4).
+     * SECURITY: Never log this value (R2).
+     */
+    _consumableTokenValue = undefined;
+    /**
+     * W7.3b: Set to true after consumeToken() succeeds in the pipeline.
+     * The controller uses this to signal the frontend via response header.
+     */
+    _consumableTokenConsumed = false;
+    /**
+     * Epoch seconds of the last primary authentication (password, passkey, SSO).
+     * Extracted from JWT claims during context creation.
+     * Used by step-up auth enforcement in services-registry-handler (W7.1).
+     */
+    _lastAuthenticatedAt = undefined;
+    /**
+     * Raw X-Reauth-Token header value from the request.
+     * Single-use REAUTH consumable token for step-up authentication.
+     * Read by step-up enforcement — consumed atomically via ConsumableTokenService.
+     * SECURITY: Never log this value.
+     */
+    _reAuthTokenValue = undefined;
+    /**
+     * W7.3a: Indicates that an AnonymousUser record was created (or upserted) during this request.
+     * When true, the controller inserts the signed session token into the response header.
+     */
+    _anonymousUserCreated = false;
+    /**
+     * W7.3a: The signed anonymous session JWT to return in the response header.
+     * Set by the controller after AnonymousSessionBackendService signs the token.
+     */
+    _anonymousSessionToken = undefined;
+    constructor(operation, executionType, contextResourcesFieldIdentifier = new Map(), initiatorIds = null, initiatorRoles = [], relationshipContexts = [], 
+    // Optional parameters for sub-call context creation (added at end for backward compatibility)
+    requestUUID, subCallDepth = 0, visitedResources, 
+    /** Resolved from X-Frontend-Service-Name → frontendServices → user type. Null until Phase 3. */
+    activeUserType = null) {
+        this._operation = operation;
+        this._executionType = executionType;
+        this._contextResourcesFieldIdentifier = new Map(contextResourcesFieldIdentifier);
+        this._initiatorIds = initiatorIds;
+        this._initiatorRoles = [...initiatorRoles];
+        this._relationshipContexts = [...relationshipContexts];
+        this._activeUserType = activeUserType;
+        // Use provided UUID or generate new one
+        this._requestUUID = requestUUID ?? uuidv4();
+        // Sub-call tracking
+        this._subCallDepth = subCallDepth;
+        this._visitedResources = visitedResources ?? new Set();
+        // Validate initiatorIds based on execution type
+        if (executionType === ExecutionContext_ExecutionType.INTERNALLY_INITIATED_REQUEST ||
+            executionType === ExecutionContext_ExecutionType.PUBLIC_EXECUTION) {
+            // For internal/public operations: initiatorIds should be an empty object or only contain applicationId
+            // All identity fields (userId, organizationId, etc.) should be null/undefined
+            if (initiatorIds) {
+                const hasIdentityFields = initiatorIds.userId ||
+                    initiatorIds.organizationId ||
+                    initiatorIds.organizationApiKeyId ||
+                    initiatorIds.applicationApiKeyId ||
+                    initiatorIds.consumableTokenId;
+                if (hasIdentityFields) {
+                    throw new Error(`ExecutionContext_InitiatorIds for ${executionType} execution type should not have identity fields ` +
+                        `(userId, organizationId, etc.). Only applicationId is allowed.`);
+                }
+            }
+        }
+        else if (executionType === ExecutionContext_ExecutionType.WEBHOOK_CALLBACK) {
+            // For webhook callbacks: scope identifiers are allowed, but authentication credentials are rejected.
+            // Webhooks carry resolved scope (organizationId, userId) but never auth tokens.
+            // initiatorIds may be null for unresolved-scope / global events.
+            if (initiatorIds) {
+                const hasAuthCredentialFields = initiatorIds.organizationApiKeyId ||
+                    initiatorIds.applicationApiKeyId ||
+                    initiatorIds.consumableTokenId;
+                if (hasAuthCredentialFields) {
+                    throw new Error(`ExecutionContext_InitiatorIds for WEBHOOK_CALLBACK cannot carry authentication credential fields ` +
+                        `(organizationApiKeyId, applicationApiKeyId, consumableTokenId). ` +
+                        `Only scope identifiers (applicationId, organizationId, userId, webhookProviderId) are allowed.`);
+                }
+            }
+        }
+        else if (executionType === ExecutionContext_ExecutionType.ANONYMOUS_SESSION) {
+            if (!initiatorIds?.anonymousUserId) {
+                throw new Error('ExecutionContext_InitiatorIds for ANONYMOUS_SESSION must include anonymousUserId');
+            }
+            if (!initiatorIds?.applicationId) {
+                throw new Error('ExecutionContext_InitiatorIds for ANONYMOUS_SESSION must include applicationId');
+            }
+            const hasAuthenticatedFields = initiatorIds.userId ||
+                initiatorIds.organizationId ||
+                initiatorIds.organizationApiKeyId ||
+                initiatorIds.applicationApiKeyId ||
+                initiatorIds.consumableTokenId;
+            if (hasAuthenticatedFields) {
+                throw new Error('ExecutionContext_InitiatorIds for ANONYMOUS_SESSION must not carry authenticated identity fields ' +
+                    '(userId, organizationId, organizationApiKeyId, applicationApiKeyId, consumableTokenId).');
+            }
+        }
+        else {
+            // For user/API key operations: initiatorIds is required and must have at least one identity field
+            if (!initiatorIds) {
+                throw new Error(`ExecutionContext_InitiatorIds is required for ${executionType} execution type`);
+            }
+        }
+    }
+    seal() { this._isSealed = true; }
+    get isSealed() { return this._isSealed; }
+    /**
+     * The operation this context was created for (or corrected to via `withOperation()`).
+     * Inside `doOperation()`, this is guaranteed to match the operation actually being executed.
+     */
+    get operation() { return this._operation; }
+    get executionType() { return this._executionType; }
+    /** Precomputed resolved features. Null if not yet resolved. */
+    get resolvedFeatures() { return this._resolvedFeatures; }
+    /** Set resolved features (called by resolution service or context creator). */
+    setResolvedFeatures(features) { this._resolvedFeatures = features; }
+    /** Raw consumable token value for deferred consumption. NEVER log this (R2). */
+    get consumableTokenValue() { return this._consumableTokenValue; }
+    /** Store raw token value for deferred consumption (called by context creator). */
+    setConsumableTokenValue(value) { this._consumableTokenValue = value; }
+    /** W7.3b: Whether the consumable token was consumed during this request. */
+    get consumableTokenConsumed() { return this._consumableTokenConsumed; }
+    /** W7.3b: Mark the consumable token as consumed (called by pipeline after consumeToken). */
+    markConsumableTokenConsumed() { this._consumableTokenConsumed = true; }
+    /** Epoch seconds of last primary authentication. Undefined for non-user or legacy JWTs. */
+    get lastAuthenticatedAt() { return this._lastAuthenticatedAt; }
+    /** Store lastAuthenticatedAt from JWT claims (called by context creator). */
+    setLastAuthenticatedAt(value) { this._lastAuthenticatedAt = value; }
+    /** Raw X-Reauth-Token header value. NEVER log this. */
+    get reAuthTokenValue() { return this._reAuthTokenValue; }
+    /** Store re-auth token from request header (called by context creator). */
+    setReAuthTokenValue(value) { this._reAuthTokenValue = value; }
+    get requestUUID() { return this._requestUUID; }
+    get organizationId() { return this._initiatorIds?.organizationId; }
+    get userId() { return this._initiatorIds?.userId; }
+    get consumableTokenId() { return this._initiatorIds?.consumableTokenId; }
+    get applicationId() { return this._initiatorIds?.applicationId; }
+    get organizationApiKeyId() { return this._initiatorIds?.organizationApiKeyId; }
+    get applicationApiKeyId() { return this._initiatorIds?.applicationApiKeyId; }
+    get initiatorIds() { return this._initiatorIds; }
+    /** Resolved from X-Frontend-Service-Name → frontendServices → user type. Null until Phase 3. */
+    get activeUserType() { return this._activeUserType; }
+    get initiatorRoles() { return this._initiatorRoles; }
+    /**
+     * Returns the relationship contexts for FK-based access paths.
+     * Used for authorization and filtering based on relationship fields.
+     */
+    get relationshipContexts() { return this._relationshipContexts; }
+    /**
+     * Get a relationship context by resource type and optionally by relationship field.
+     * @param resourceType The resource type to look for
+     * @param relationshipField Optional FK field name (e.g., 'assignedToUserId')
+     * @returns The matching relationship context or undefined
+     */
+    getRelationshipContext(resourceType, relationshipField) {
+        return this._relationshipContexts.find(rc => rc.resourceType === resourceType &&
+            (relationshipField === undefined || rc.relationshipField === relationshipField));
+    }
+    /**
+     * Check if the context was accessed via a specific FK relationship field.
+     * @param relationshipField The FK field name (e.g., 'assignedToUserId', 'createdByUserId')
+     * @returns true if accessed via this relationship field
+     */
+    hasRelationshipField(relationshipField) {
+        return this._relationshipContexts.some(rc => rc.relationshipField === relationshipField);
+    }
+    getOperationFieldIdentifier() {
+        return this.getContextResourceId(this._operation.resourceIdentifier);
+    }
+    getContextResourceId(fieldIdentifier) {
+        const resourceId = this._contextResourcesFieldIdentifier.get(fieldIdentifier);
+        if (typeof resourceId === 'string') {
+            return resourceId;
+        }
+        else if (Array.isArray(resourceId)) {
+            return resourceId[0];
+        }
+        return undefined;
+    }
+    getContextResourceIds() {
+        return this._contextResourcesFieldIdentifier;
+    }
+    /**
+     * Get the current sub-call depth (0 for top-level calls).
+     * Used for cycle detection and depth limiting.
+     */
+    get subCallDepth() { return this._subCallDepth; }
+    /**
+     * Get the current sub-call depth (0 for top-level calls).
+     * Used for cycle detection and depth limiting.
+     */
+    getSubCallDepth() { return this._subCallDepth; }
+    /**
+     * Get the set of visited resources (format: "resourceType:resourceId").
+     * Used for circular dependency detection.
+     */
+    getVisitedResources() { return this._visitedResources; }
+    /**
+     * Check if a resource has already been visited in this call chain.
+     * @param key The resource key in format "resourceType:resourceId"
+     * @returns true if the resource has been visited
+     */
+    hasVisitedResource(key) { return this._visitedResources.has(key); }
+    /**
+     * Create a new ExecutionContext with a different operation but all other state preserved.
+     * Used by doOperation to enforce the invariant that executionContext.operation always
+     * matches the operation actually being executed — regardless of what the caller passed.
+     *
+     * This is NOT a sub-call: subCallDepth, visitedResources, and requestUUID are preserved as-is.
+     */
+    withOperation(operation) {
+        const ctx = new ExecutionContext(operation, this._executionType, this._contextResourcesFieldIdentifier, this._initiatorIds, this._initiatorRoles, this._relationshipContexts, this._requestUUID, this._subCallDepth, this._visitedResources, this._activeUserType);
+        if (this._resolvedFeatures)
+            ctx.setResolvedFeatures(this._resolvedFeatures);
+        if (this._consumableTokenValue !== undefined)
+            ctx.setConsumableTokenValue(this._consumableTokenValue);
+        if (this._lastAuthenticatedAt !== undefined)
+            ctx.setLastAuthenticatedAt(this._lastAuthenticatedAt);
+        if (this._reAuthTokenValue !== undefined)
+            ctx.setReAuthTokenValue(this._reAuthTokenValue);
+        if (this._anonymousUserCreated)
+            ctx.setAnonymousUserCreated(true);
+        if (this._anonymousSessionToken !== undefined)
+            ctx.setAnonymousSessionToken(this._anonymousSessionToken);
+        if (this._isSealed)
+            ctx.seal();
+        return ctx;
+    }
+    addContextResourceId(fieldIdentifier, resourceId) {
+        if (this._isSealed)
+            throw new Error('Cannot modify ExecutionContext after it has been sealed');
+        if (this._contextResourcesFieldIdentifier.has(fieldIdentifier))
+            throw new Error(`Context resource field identifier '${fieldIdentifier}' already exists. Cannot replace existing values.`);
+        this._contextResourcesFieldIdentifier.set(fieldIdentifier, resourceId);
+    }
+    isApiKeyExecution() { return [ExecutionContext_ExecutionType.ORG_API_KEY, ExecutionContext_ExecutionType.APP_API_KEY].includes(this._executionType); }
+    isUserExecution() { return this._executionType === ExecutionContext_ExecutionType.USER_REQUEST; }
+    isInternalExecution() { return this._executionType === ExecutionContext_ExecutionType.INTERNALLY_INITIATED_REQUEST; }
+    isPublicExecution() { return this._executionType === ExecutionContext_ExecutionType.PUBLIC_EXECUTION; }
+    isWebhookExecution() { return this._executionType === ExecutionContext_ExecutionType.WEBHOOK_CALLBACK; }
+    isAnonymousExecution() { return this._executionType === ExecutionContext_ExecutionType.ANONYMOUS_SESSION; }
+    get anonymousUserId() { return this._initiatorIds?.anonymousUserId; }
+    get webhookProviderId() { return this._initiatorIds?.webhookProviderId; }
+    get anonymousUserCreated() { return this._anonymousUserCreated; }
+    setAnonymousUserCreated(value) { this._anonymousUserCreated = value; }
+    get anonymousSessionToken() { return this._anonymousSessionToken; }
+    setAnonymousSessionToken(value) { this._anonymousSessionToken = value; }
+    toExecutionContextPlatformJwtClaims() {
+        return {
+            requestUUID: this._requestUUID,
+            initiatorIds: this._initiatorIds || {},
+            initiatorRoles: this._initiatorRoles || [],
+            contextResourcesFieldIdentifier: this._contextResourcesFieldIdentifier,
+            executionType: this._executionType,
+            operationRef: this._operation.operationIdentifier,
+            resourceIdentifier: this._operation.resourceIdentifier,
+            resourcePrimaryScope: this._operation.resourcePrimaryScope,
+            relationshipContexts: this._relationshipContexts.length > 0 ? this._relationshipContexts : undefined
+        };
+    }
+}
+//# sourceMappingURL=execution-context.backend.schemas.js.map

package/dist/esm/runtime/models/execution-context.backend.schemas.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"execution-context.backend.schemas.js","sourceRoot":"","sources":["../../../../src/runtime/models/execution-context.backend.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAGL,oBAAoB,EAEpB,8BAA8B,EAE9B,mCAAmC,EAEnC,+BAA+B,EAE/B,0CAA0C,GAG3C,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,EAAE,IAAI,MAAM,EAAE,MAAM,MAAM,CAAC;AAiBpC,MAAM,qCAAqC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;AAEvH,MAAM,CAAC,MAAM,oCAAoC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3D,SAAS,EAAE,CAAC,CAAC,GAAG,EAAE,EAAE,uEAAuE;IAC3F,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC,8BAA8B,CAAC;IACrD,+BAA+B,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACzE,YAAY,EAAE,mCAAmC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACvE,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,+BAA+B,CAAC,CAAC,QAAQ,EAAE;IACnE,oBAAoB,EAAE,CAAC,CAAC,KAAK,CAAC,0CAA0C,CAAC,CAAC,QAAQ,EAAE;CACrF,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,uCAAuC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9D,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,YAAY,EAAE,mCAAmC;IACjD,+BAA+B,EAAE,qCAAqC;IACtE,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,+BAA+B,CAAC;IACxD,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC,8BAA8B,CAAC;IACrD,YAAY,EAAG,CAAC,CAAC,MAAM,EAAE;IACzB,kBAAkB,EAAG,CAAC,CAAC,MAAM,EAAE;IAC/B,oBAAoB,EAAG,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC;IACnD,sDAAsD;IACtD,oBAAoB,EAAE,CAAC,CAAC,KAAK,CAAC,0CAA0C,CAAC,CAAC,QAAQ,EAAE;CACrF,CAAC,CAAC;AASH;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,OAAO,gBAAgB;IAG3B,yFAAyF;IACxE,UAAU,CAA2B;IACrC,cAAc,CAAiC;IAC/C,gCAAgC,CAAkD;IAClF,aAAa,CAAuC;IACpD,eAAe,CAA8B;IAC7C,qBAAqB,CAAyC;IAC9D,eAAe,CAAgB;IAC/B,YAAY,CAAS;IACrB,aAAa,CAAS;IACtB,iBAAiB,CAAc;IACxC,SAAS,GAAY,KAAK,CAAC;IAEnC;;;;OAIG;IACK,iBAAiB,GAA4B,IAAI,CAAC;IAE1D;;;;;OAKG;IACK,qBAAqB,GAAuB,SAAS,CAAC;IAE9D;;;OAGG;IACK,wBAAwB,GAAG,KAAK,CAAC;IAEzC;;;;OAIG;IACK,oBAAoB,GAAuB,SAAS,CAAC;IAE7D;;;;;OAKG;IACK,iBAAiB,GAAuB,SAAS,CAAC;IAE1D;;;OAGG;IACK,qBAAqB,GAAY,KAAK,CAAC;IAE/C;;;OAGG;IACK,sBAAsB,GAAuB,SAAS,CAAC;IAE/D,YACE,SAAmC,EACnC,aAA6C,EAC7C,kCAAmF,IAAI,GAAG,EAAE,EAC5F,eAAqD,IAAI,EACzD,iBAA8C,EAAE,EAChD,uBAA+D,EAAE;IACjE,8FAA8F;IAC9F,WAAoB,EACpB,eAAuB,CAAC,EACxB,gBAA8B;IAC9B,gGAAgG;IAChG,iBAAgC,IAAI;QAEpC,IAAI,CAAC,UAAU,GAAG,SAAS,CAAC;QAC5B,IAAI,CAAC,cAAc,GAAG,aAAa,CAAC;QACpC,IAAI,CAAC,gCAAgC,GAAG,IAAI,GAAG,CAAC,+BAA+B,CAAC,CAAC;QACjF,IAAI,CAAC,aAAa,GAAG,YAAY,CAAC;QAClC,IAAI,CAAC,eAAe,GAAG,CAAC,GAAG,cAAc,CAAC,CAAC;QAC3C,IAAI,CAAC,qBAAqB,GAAG,CAAC,GAAG,oBAAoB,CAAC,CAAC;QACvD,IAAI,CAAC,eAAe,GAAG,cAAc,CAAC;QACtC,wCAAwC;QACxC,IAAI,CAAC,YAAY,GAAG,WAAW,IAAI,MAAM,EAAE,CAAC;QAC5C,oBAAoB;QACpB,IAAI,CAAC,aAAa,GAAG,YAAY,CAAC;QAClC,IAAI,CAAC,iBAAiB,GAAG,gBAAgB,IAAI,IAAI,GAAG,EAAU,CAAC;QAE/D,gDAAgD;QAChD,IAAI,aAAa,KAAK,8BAA8B,CAAC,4BAA4B;YAC7E,aAAa,KAAK,8BAA8B,CAAC,gBAAgB,EAAE,CAAC;YACtE,uGAAuG;YACvG,8EAA8E;YAC9E,IAAI,YAAY,EAAE,CAAC;gBACjB,MAAM,iBAAiB,GACrB,YAAY,CAAC,MAAM;oBACnB,YAAY,CAAC,cAAc;oBAC3B,YAAY,CAAC,oBAAoB;oBACjC,YAAY,CAAC,mBAAmB;oBAChC,YAAY,CAAC,iBAAiB,CAAC;gBAEjC,IAAI,iBAAiB,EAAE,CAAC;oBACtB,MAAM,IAAI,KAAK,CACb,qCAAqC,aAAa,kDAAkD;wBACpG,gEAAgE,CACjE,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;aAAM,IAAI,aAAa,KAAK,8BAA8B,CAAC,gBAAgB,EAAE,CAAC;YAC7E,qGAAqG;YACrG,gFAAgF;YAChF,iEAAiE;YACjE,IAAI,YAAY,EAAE,CAAC;gBACjB,MAAM,uBAAuB,GAC3B,YAAY,CAAC,oBAAoB;oBACjC,YAAY,CAAC,mBAAmB;oBAChC,YAAY,CAAC,iBAAiB,CAAC;gBAEjC,IAAI,uBAAuB,EAAE,CAAC;oBAC5B,MAAM,IAAI,KAAK,CACb,mGAAmG;wBACnG,kEAAkE;wBAClE,gGAAgG,CACjG,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;aAAM,IAAI,aAAa,KAAK,8BAA8B,CAAC,iBAAiB,EAAE,CAAC;YAC9E,IAAI,CAAC,YAAY,EAAE,eAAe,EAAE,CAAC;gBACnC,MAAM,IAAI,KAAK,CAAC,kFAAkF,CAAC,CAAC;YACtG,CAAC;YACD,IAAI,CAAC,YAAY,EAAE,aAAa,EAAE,CAAC;gBACjC,MAAM,IAAI,KAAK,CAAC,gFAAgF,CAAC,CAAC;YACpG,CAAC;YACD,MAAM,sBAAsB,GAC1B,YAAY,CAAC,MAAM;gBACnB,YAAY,CAAC,cAAc;gBAC3B,YAAY,CAAC,oBAAoB;gBACjC,YAAY,CAAC,mBAAmB;gBAChC,YAAY,CAAC,iBAAiB,CAAC;YACjC,IAAI,sBAAsB,EAAE,CAAC;gBAC3B,MAAM,IAAI,KAAK,CACb,mGAAmG;oBACnG,yFAAyF,CAC1F,CAAC;YACJ,CAAC;QACH,CAAC;aAAM,CAAC;YACN,kGAAkG;YAClG,IAAI,CAAC,YAAY,EAAE,CAAC;gBAClB,MAAM,IAAI,KAAK,CAAC,iDAAiD,aAAa,iBAAiB,CAAC,CAAC;YACnG,CAAC;QACH,CAAC;IACH,CAAC;IACD,IAAI,KAAW,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC,CAAC;IAGvC,IAAI,QAAQ,KAAc,OAAO,IAAI,CAAC,SAAS,CAAC,CAAA,CAAC;IAEjD;;;OAGG;IACH,IAAI,SAAS,KAAyC,OAAO,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;IAE/E,IAAI,aAAa,KAA8C,OAAO,IAAI,CAAC,cAAc,CAAC,CAAA,CAAC;IAE3F,+DAA+D;IAC/D,IAAI,gBAAgB,KAA8B,OAAO,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC;IAElF,+EAA+E;IAC/E,mBAAmB,CAAC,QAA0B,IAAU,IAAI,CAAC,iBAAiB,GAAG,QAAQ,CAAC,CAAC,CAAC;IAE5F,gFAAgF;IAChF,IAAI,oBAAoB,KAAyB,OAAO,IAAI,CAAC,qBAAqB,CAAC,CAAC,CAAC;IAErF,kFAAkF;IAClF,uBAAuB,CAAC,KAAa,IAAU,IAAI,CAAC,qBAAqB,GAAG,KAAK,CAAC,CAAC,CAAC;IAEpF,4EAA4E;IAC5E,IAAI,uBAAuB,KAAc,OAAO,IAAI,CAAC,wBAAwB,CAAC,CAAC,CAAC;IAEhF,4FAA4F;IAC5F,2BAA2B,KAAW,IAAI,CAAC,wBAAwB,GAAG,IAAI,CAAC,CAAC,CAAC;IAE7E,2FAA2F;IAC3F,IAAI,mBAAmB,KAAyB,OAAO,IAAI,CAAC,oBAAoB,CAAC,CAAC,CAAC;IAEnF,6EAA6E;IAC7E,sBAAsB,CAAC,KAAa,IAAU,IAAI,CAAC,oBAAoB,GAAG,KAAK,CAAC,CAAC,CAAC;IAElF,uDAAuD;IACvD,IAAI,gBAAgB,KAAyB,OAAO,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC;IAE7E,2EAA2E;IAC3E,mBAAmB,CAAC,KAAa,IAAU,IAAI,CAAC,iBAAiB,GAAG,KAAK,CAAC,CAAC,CAAC;IAE5E,IAAI,WAAW,KAAuB,OAAO,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC;IAEjE,IAAI,cAAc,KAAmC,OAAO,IAAI,CAAC,aAAa,EAAE,cAAc,CAAC,CAAA,CAAC;IAEhG,IAAI,MAAM,KAAmC,OAAO,IAAI,CAAC,aAAa,EAAE,MAAM,CAAC,CAAA,CAAC;IAEhF,IAAI,iBAAiB,KAAmC,OAAO,IAAI,CAAC,aAAa,EAAE,iBAAiB,CAAC,CAAA,CAAC;IAEtG,IAAI,aAAa,KAAmC,OAAO,IAAI,CAAC,aAAa,EAAE,aAAa,CAAC,CAAA,CAAC;IAE9F,IAAI,oBAAoB,KAAmC,OAAO,IAAI,CAAC,aAAa,EAAE,oBAAoB,CAAC,CAAA,CAAC;IAE5G,IAAI,mBAAmB,KAAmC,OAAO,IAAI,CAAC,aAAa,EAAE,mBAAmB,CAAC,CAAA,CAAC;IAE1G,IAAI,YAAY,KAA2C,OAAO,IAAI,CAAC,aAAa,CAAC,CAAA,CAAC;IAEtF,gGAAgG;IAChG,IAAI,cAAc,KAAoB,OAAO,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC;IAEpE,IAAI,cAAc,KAA0C,OAAO,IAAI,CAAC,eAAe,CAAC,CAAA,CAAC;IAEzF;;;OAGG;IACH,IAAI,oBAAoB,KAAqD,OAAO,IAAI,CAAC,qBAAqB,CAAC,CAAA,CAAC;IAEhH;;;;;OAKG;IACH,sBAAsB,CACpB,YAAoB,EACpB,iBAA0B;QAE1B,OAAO,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAC1C,EAAE,CAAC,YAAY,KAAK,YAAY;YAChC,CAAC,iBAAiB,KAAK,SAAS,IAAI,EAAE,CAAC,iBAAiB,KAAK,iBAAiB,CAAC,CAChF,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACH,oBAAoB,CAAC,iBAAyB;QAC5C,OAAO,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,iBAAiB,KAAK,iBAAiB,CAAC,CAAC;IAC3F,CAAC;IAED,2BAA2B;QACzB,OAAO,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,UAAU,CAAC,kBAAkB,CAAC,CAAA;IACtE,CAAC;IAED,oBAAoB,CAAC,eAAwC;QAC3D,MAAM,UAAU,GAAG,IAAI,CAAC,gCAAgC,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;QAC9E,IAAI,OAAO,UAAU,KAAK,QAAQ,EAAE,CAAC;YACnC,OAAO,UAAU,CAAC;QACpB,CAAC;aAAM,IAAI,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;YACrC,OAAO,UAAU,CAAC,CAAC,CAAC,CAAC;QACvB,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,qBAAqB;QACnB,OAAO,IAAI,CAAC,gCAAgC,CAAC;IAC/C,CAAC;IAED;;;OAGG;IACH,IAAI,YAAY,KAAa,OAAO,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC;IAEzD;;;OAGG;IACH,eAAe,KAAa,OAAO,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC;IAExD;;;OAGG;IACH,mBAAmB,KAA0B,OAAO,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC;IAE7E;;;;OAIG;IACH,kBAAkB,CAAC,GAAW,IAAa,OAAO,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAEpF;;;;;;OAMG;IACH,aAAa,CACX,SAAc;QAEd,MAAM,GAAG,GAAG,IAAI,gBAAgB,CAC9B,SAAS,EACT,IAAI,CAAC,cAAc,EACnB,IAAI,CAAC,gCAAgC,EACrC,IAAI,CAAC,aAAa,EAClB,IAAI,CAAC,eAAe,EACpB,IAAI,CAAC,qBAAqB,EAC1B,IAAI,CAAC,YAAY,EACjB,IAAI,CAAC,aAAa,EAClB,IAAI,CAAC,iBAAiB,EACtB,IAAI,CAAC,eAAe,CACrB,CAAC;QACF,IAAI,IAAI,CAAC,iBAAiB;YAAE,GAAG,CAAC,mBAAmB,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;QAC5E,IAAI,IAAI,CAAC,qBAAqB,KAAK,SAAS;YAAE,GAAG,CAAC,uBAAuB,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;QACtG,IAAI,IAAI,CAAC,oBAAoB,KAAK,SAAS;YAAE,GAAG,CAAC,sBAAsB,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;QACnG,IAAI,IAAI,CAAC,iBAAiB,KAAK,SAAS;YAAE,GAAG,CAAC,mBAAmB,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;QAC1F,IAAI,IAAI,CAAC,qBAAqB;YAAE,GAAG,CAAC,uBAAuB,CAAC,IAAI,CAAC,CAAC;QAClE,IAAI,IAAI,CAAC,sBAAsB,KAAK,SAAS;YAAE,GAAG,CAAC,wBAAwB,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;QACzG,IAAI,IAAI,CAAC,SAAS;YAAE,GAAG,CAAC,IAAI,EAAE,CAAC;QAC/B,OAAO,GAAG,CAAC;IACb,CAAC;IAED,oBAAoB,CAAC,eAAwC,EAAE,UAAkB;QAE/E,IAAI,IAAI,CAAC,SAAS;YAChB,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;QAE7E,IAAI,IAAI,CAAC,gCAAgC,CAAC,GAAG,CAAC,eAAe,CAAC;YAC5D,MAAM,IAAI,KAAK,CAAC,sCAAsC,eAAe,mDAAmD,CAAC,CAAC;QAE5H,IAAI,CAAC,gCAAgC,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;IACzE,CAAC;IAED,iBAAiB,KAAc,OAAO,CAAC,8BAA8B,CAAC,WAAW,EAAE,8BAA8B,CAAC,WAAW,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAA,CAAC;IAE9J,eAAe,KAAc,OAAO,IAAI,CAAC,cAAc,KAAK,8BAA8B,CAAC,YAAY,CAAC,CAAA,CAAC;IAEzG,mBAAmB,KAAc,OAAO,IAAI,CAAC,cAAc,KAAK,8BAA8B,CAAC,4BAA4B,CAAC,CAAA,CAAC;IAE7H,iBAAiB,KAAc,OAAO,IAAI,CAAC,cAAc,KAAK,8BAA8B,CAAC,gBAAgB,CAAC,CAAA,CAAC;IAE/G,kBAAkB,KAAc,OAAO,IAAI,CAAC,cAAc,KAAK,8BAA8B,CAAC,gBAAgB,CAAC,CAAA,CAAC;IAEhH,oBAAoB,KAAc,OAAO,IAAI,CAAC,cAAc,KAAK,8BAA8B,CAAC,iBAAiB,CAAC,CAAA,CAAC;IAEnH,IAAI,eAAe,KAAmC,OAAO,IAAI,CAAC,aAAa,EAAE,eAAe,CAAC,CAAA,CAAC;IAElG,IAAI,iBAAiB,KAAmC,OAAO,IAAI,CAAC,aAAa,EAAE,iBAAiB,CAAC,CAAA,CAAC;IAEtG,IAAI,oBAAoB,KAAc,OAAO,IAAI,CAAC,qBAAqB,CAAC,CAAC,CAAC;IAC1E,uBAAuB,CAAC,KAAc,IAAU,IAAI,CAAC,qBAAqB,GAAG,KAAK,CAAC,CAAC,CAAC;IAErF,IAAI,qBAAqB,KAAyB,OAAO,IAAI,CAAC,sBAAsB,CAAC,CAAC,CAAC;IACvF,wBAAwB,CAAC,KAAa,IAAU,IAAI,CAAC,sBAAsB,GAAG,KAAK,CAAC,CAAC,CAAC;IAEtF,mCAAmC;QAC/B,OAAO;YACL,WAAW,EAAE,IAAI,CAAC,YAAY;YAC9B,YAAY,EAAE,IAAI,CAAC,aAAa,IAAI,EAAE;YACtC,cAAc,EAAE,IAAI,CAAC,eAAe,IAAI,EAAE;YAC1C,+BAA+B,EAAE,IAAI,CAAC,gCAAgC;YACtE,aAAa,EAAE,IAAI,CAAC,cAAc;YAClC,YAAY,EAAE,IAAI,CAAC,UAAU,CAAC,mBAAmB;YACjD,kBAAkB,EAAE,IAAI,CAAC,UAAU,CAAC,kBAAkB;YACtD,oBAAoB,EAAE,IAAI,CAAC,UAAU,CAAC,oBAAoB;YAC1D,oBAAoB,EAAE,IAAI,CAAC,qBAAqB,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,CAAC,SAAS;SACrG,CAAC;IACJ,CAAC;CACJ"}