@wildo-ai/saas-backend-lib 1.0.1

package/dist/esm/security/authentications/models/jwt.backend.schemas.d.ts

@@ -0,0 +1,42 @@
+import jwt from 'jsonwebtoken';
+import { z } from 'zod';
+/**
+ * Application JWT Private Keys
+ *
+ * Used by Wildo Applications (not platform services) to sign JWTs.
+ * Each application has its own key pair stored in MongoDB:
+ * - Private key: wildo_application_secrets.security.jwt.privateKey[key]
+ * - Public key: wildo_application_config.jwt.publicKey[key]
+ */
+export declare enum JwtPrivateKeys {
+    /** Application signing requests to platform services */
+    APPLICATION_PLATFORM_REQUEST = "APPLICATION_PLATFORM_REQUEST",
+    /** Application signing webhooks */
+    APPLICATION_WEBHOOK = "APPLICATION_WEBHOOK",
+    /** Application signing auth tokens */
+    APPLICATION_AUTH_TOKEN = "APPLICATION_AUTH_TOKEN"
+}
+/**
+ * Platform Service JWT Public Keys
+ *
+ * Used to verify JWTs from platform services.
+ * Public keys are stored in apps-manager env config.
+ * Env var pattern: PLATFORM_<SERVICE_NAME>_PUBLIC_KEY
+ */
+export declare enum JwtPublicKeys {
+    /** Platform service: apps-manager - central platform orchestrator */
+    PLATFORM_APPS_MANAGER = "PLATFORM_APPS_MANAGER",
+    /** Platform service: crontabs-batches-manager - handles scheduled jobs */
+    PLATFORM_CRONTABS_BATCHES_MANAGER = "PLATFORM_CRONTABS_BATCHES_MANAGER",
+    /** Platform service: file-generator - handles file generation */
+    PLATFORM_FILE_GENERATOR = "PLATFORM_FILE_GENERATOR"
+}
+export declare const VerifiableJwtKeysSchema: z.ZodEnum<{
+    [x: string]: string;
+}>;
+export type VerifiableJwtKeys = z.infer<typeof VerifiableJwtKeysSchema>;
+export declare const JwtDefaultSignOptions: jwt.SignOptions;
+export declare const JwtDefaultVerifyOptions: jwt.VerifyOptions;
+export declare const JwtPrivateKeySignOptions: Record<JwtPrivateKeys, jwt.SignOptions>;
+export declare const JwtVerifyOptions: Record<VerifiableJwtKeys, jwt.VerifyOptions>;
+//# sourceMappingURL=jwt.backend.schemas.d.ts.map

package/dist/esm/security/authentications/models/jwt.backend.schemas.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt.backend.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/security/authentications/models/jwt.backend.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,GAAG,MAAM,cAAc,CAAC;AAC/B,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB;;;;;;;GAOG;AACH,oBAAY,cAAc;IACtB,wDAAwD;IACxD,4BAA4B,iCAAiC;IAC7D,mCAAmC;IACnC,mBAAmB,wBAAwB;IAC3C,sCAAsC;IACtC,sBAAsB,2BAA2B;CACpD;AAED;;;;;;GAMG;AACH,oBAAY,aAAa;IACrB,qEAAqE;IACrE,qBAAqB,0BAA0B;IAE/C,0EAA0E;IAC1E,iCAAiC,sCAAsC;IACvE,iEAAiE;IACjE,uBAAuB,4BAA4B;CACtD;AAED,eAAO,MAAM,uBAAuB;;EAAwG,CAAC;AAC7I,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE,eAAO,MAAM,qBAAqB,EAAE,GAAG,CAAC,WAGvC,CAAA;AAED,eAAO,MAAM,uBAAuB,EAAE,GAAG,CAAC,aAGzC,CAAA;AAED,eAAO,MAAM,wBAAwB,EAAE,MAAM,CAAC,cAAc,EAAE,GAAG,CAAC,WAAW,CAmB5E,CAAA;AAED,eAAO,MAAM,gBAAgB,EAAE,MAAM,CAAC,iBAAiB,EAAE,GAAG,CAAC,aAAa,CAkCzE,CAAA"}

package/dist/esm/security/authentications/models/jwt.backend.schemas.js

@@ -0,0 +1,98 @@
+import { z } from 'zod';
+/**
+ * Application JWT Private Keys
+ *
+ * Used by Wildo Applications (not platform services) to sign JWTs.
+ * Each application has its own key pair stored in MongoDB:
+ * - Private key: wildo_application_secrets.security.jwt.privateKey[key]
+ * - Public key: wildo_application_config.jwt.publicKey[key]
+ */
+export var JwtPrivateKeys;
+(function (JwtPrivateKeys) {
+    /** Application signing requests to platform services */
+    JwtPrivateKeys["APPLICATION_PLATFORM_REQUEST"] = "APPLICATION_PLATFORM_REQUEST";
+    /** Application signing webhooks */
+    JwtPrivateKeys["APPLICATION_WEBHOOK"] = "APPLICATION_WEBHOOK";
+    /** Application signing auth tokens */
+    JwtPrivateKeys["APPLICATION_AUTH_TOKEN"] = "APPLICATION_AUTH_TOKEN";
+})(JwtPrivateKeys || (JwtPrivateKeys = {}));
+/**
+ * Platform Service JWT Public Keys
+ *
+ * Used to verify JWTs from platform services.
+ * Public keys are stored in apps-manager env config.
+ * Env var pattern: PLATFORM_<SERVICE_NAME>_PUBLIC_KEY
+ */
+export var JwtPublicKeys;
+(function (JwtPublicKeys) {
+    /** Platform service: apps-manager - central platform orchestrator */
+    JwtPublicKeys["PLATFORM_APPS_MANAGER"] = "PLATFORM_APPS_MANAGER";
+    /** Platform service: crontabs-batches-manager - handles scheduled jobs */
+    JwtPublicKeys["PLATFORM_CRONTABS_BATCHES_MANAGER"] = "PLATFORM_CRONTABS_BATCHES_MANAGER";
+    /** Platform service: file-generator - handles file generation */
+    JwtPublicKeys["PLATFORM_FILE_GENERATOR"] = "PLATFORM_FILE_GENERATOR";
+})(JwtPublicKeys || (JwtPublicKeys = {}));
+export const VerifiableJwtKeysSchema = z.enum([...Object.values(JwtPrivateKeys), ...Object.values(JwtPublicKeys)]);
+export const JwtDefaultSignOptions = {
+    algorithm: 'ES256',
+    expiresIn: '24h',
+};
+export const JwtDefaultVerifyOptions = {
+    algorithms: ['ES256'],
+    clockTolerance: 30,
+};
+export const JwtPrivateKeySignOptions = {
+    [JwtPrivateKeys.APPLICATION_PLATFORM_REQUEST]: {
+        ...JwtDefaultSignOptions,
+        keyid: JwtPrivateKeys.APPLICATION_PLATFORM_REQUEST,
+        issuer: 'wildo-application',
+        audience: 'PLATFORM_SERVICE',
+    },
+    [JwtPrivateKeys.APPLICATION_WEBHOOK]: {
+        ...JwtDefaultSignOptions,
+        keyid: JwtPrivateKeys.APPLICATION_WEBHOOK,
+        issuer: 'wildo-application',
+        audience: 'WEBHOOK',
+    },
+    [JwtPrivateKeys.APPLICATION_AUTH_TOKEN]: {
+        ...JwtDefaultSignOptions,
+        keyid: JwtPrivateKeys.APPLICATION_AUTH_TOKEN,
+        issuer: 'wildo-application',
+        audience: 'AUTH_TOKEN',
+    },
+};
+export const JwtVerifyOptions = {
+    // Application keys - used to verify tokens from Wildo applications
+    [JwtPrivateKeys.APPLICATION_PLATFORM_REQUEST]: {
+        ...JwtDefaultVerifyOptions,
+        issuer: 'wildo-application',
+        audience: 'PLATFORM_SERVICE',
+    },
+    [JwtPrivateKeys.APPLICATION_WEBHOOK]: {
+        ...JwtDefaultVerifyOptions,
+        issuer: 'wildo-application',
+        audience: 'WEBHOOK',
+    },
+    [JwtPrivateKeys.APPLICATION_AUTH_TOKEN]: {
+        ...JwtDefaultVerifyOptions,
+        issuer: 'wildo-application',
+        audience: 'AUTH_TOKEN',
+    },
+    // Platform service keys - used to verify tokens from platform services
+    [JwtPublicKeys.PLATFORM_APPS_MANAGER]: {
+        ...JwtDefaultVerifyOptions,
+        issuer: 'platform_apps_manager',
+        audience: 'PLATFORM_SERVICE',
+    },
+    [JwtPublicKeys.PLATFORM_CRONTABS_BATCHES_MANAGER]: {
+        ...JwtDefaultVerifyOptions,
+        issuer: 'platform_crontabs_batches_manager',
+        audience: 'SCHEDULED_JOB',
+    },
+    [JwtPublicKeys.PLATFORM_FILE_GENERATOR]: {
+        ...JwtDefaultVerifyOptions,
+        issuer: 'platform_file_generator',
+        audience: 'PLATFORM_SERVICE',
+    },
+};
+//# sourceMappingURL=jwt.backend.schemas.js.map

package/dist/esm/security/authentications/models/jwt.backend.schemas.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt.backend.schemas.js","sourceRoot":"","sources":["../../../../../src/security/authentications/models/jwt.backend.schemas.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB;;;;;;;GAOG;AACH,MAAM,CAAN,IAAY,cAOX;AAPD,WAAY,cAAc;IACtB,wDAAwD;IACxD,+EAA6D,CAAA;IAC7D,mCAAmC;IACnC,6DAA2C,CAAA;IAC3C,sCAAsC;IACtC,mEAAiD,CAAA;AACrD,CAAC,EAPW,cAAc,KAAd,cAAc,QAOzB;AAED;;;;;;GAMG;AACH,MAAM,CAAN,IAAY,aAQX;AARD,WAAY,aAAa;IACrB,qEAAqE;IACrE,gEAA+C,CAAA;IAE/C,0EAA0E;IAC1E,wFAAuE,CAAA;IACvE,iEAAiE;IACjE,oEAAmD,CAAA;AACvD,CAAC,EARW,aAAa,KAAb,aAAa,QAQxB;AAED,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAE,GAAG,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,CAA0B,CAAC,CAAC;AAG7I,MAAM,CAAC,MAAM,qBAAqB,GAAoB;IAClD,SAAS,EAAE,OAAO;IAClB,SAAS,EAAE,KAAK;CACnB,CAAA;AAED,MAAM,CAAC,MAAM,uBAAuB,GAAsB;IACtD,UAAU,EAAE,CAAC,OAAO,CAAC;IACrB,cAAc,EAAE,EAAE;CACrB,CAAA;AAED,MAAM,CAAC,MAAM,wBAAwB,GAA4C;IAC7E,CAAC,cAAc,CAAC,4BAA4B,CAAC,EAAE;QAC3C,GAAG,qBAAqB;QACxB,KAAK,EAAE,cAAc,CAAC,4BAA4B;QAClD,MAAM,EAAE,mBAAmB;QAC3B,QAAQ,EAAE,kBAAkB;KAC/B;IACD,CAAC,cAAc,CAAC,mBAAmB,CAAC,EAAE;QAClC,GAAG,qBAAqB;QACxB,KAAK,EAAE,cAAc,CAAC,mBAAmB;QACzC,MAAM,EAAE,mBAAmB;QAC3B,QAAQ,EAAE,SAAS;KACtB;IACD,CAAC,cAAc,CAAC,sBAAsB,CAAC,EAAE;QACrC,GAAG,qBAAqB;QACxB,KAAK,EAAE,cAAc,CAAC,sBAAsB;QAC5C,MAAM,EAAE,mBAAmB;QAC3B,QAAQ,EAAE,YAAY;KACzB;CACJ,CAAA;AAED,MAAM,CAAC,MAAM,gBAAgB,GAAiD;IAC1E,mEAAmE;IACnE,CAAC,cAAc,CAAC,4BAA4B,CAAC,EAAE;QAC3C,GAAG,uBAAuB;QAC1B,MAAM,EAAE,mBAAmB;QAC3B,QAAQ,EAAE,kBAAkB;KAC/B;IACD,CAAC,cAAc,CAAC,mBAAmB,CAAC,EAAE;QAClC,GAAG,uBAAuB;QAC1B,MAAM,EAAE,mBAAmB;QAC3B,QAAQ,EAAE,SAAS;KACtB;IACD,CAAC,cAAc,CAAC,sBAAsB,CAAC,EAAE;QACrC,GAAG,uBAAuB;QAC1B,MAAM,EAAE,mBAAmB;QAC3B,QAAQ,EAAE,YAAY;KACzB;IACD,uEAAuE;IACvE,CAAC,aAAa,CAAC,qBAAqB,CAAC,EAAE;QACnC,GAAG,uBAAuB;QAC1B,MAAM,EAAE,uBAAuB;QAC/B,QAAQ,EAAE,kBAAkB;KAC/B;IAED,CAAC,aAAa,CAAC,iCAAiC,CAAC,EAAE;QAC/C,GAAG,uBAAuB;QAC1B,MAAM,EAAE,mCAAmC;QAC3C,QAAQ,EAAE,eAAe;KAC5B;IACD,CAAC,aAAa,CAAC,uBAAuB,CAAC,EAAE;QACrC,GAAG,uBAAuB;QAC1B,MAAM,EAAE,yBAAyB;QACjC,QAAQ,EAAE,kBAAkB;KAC/B;CACJ,CAAA"}

package/dist/esm/security/authentications/models/oauth2-connection.backend.schemas.d.ts

@@ -0,0 +1,163 @@
+/**
+ * OAuth2 Resolved Connection & State Types
+ *
+ * These are the canonical types shared between the OAuth2 engine and its resolvers.
+ * Social resolver (Step 4) and Enterprise resolver (Step 15) both produce
+ * `OAuth2ResolvedConnection`. The engine methods (`buildAuthorizationUrl`,
+ * `handleCallback`, `provisionOrLinkUser`) consume it.
+ *
+ * `NormalizedUserProfile` has moved to `sso-connection.backend.schemas.ts` (shared
+ * between OIDC and SAML). Re-exported here for backward compatibility.
+ */
+import type { SSOResolvedConnectionBase } from './sso-connection.backend.schemas.js';
+import type { AuthScopeType } from '@wildo-ai/saas-models';
+export type { NormalizedUserProfile } from './sso-connection.backend.schemas.js';
+/**
+ * Canonical resolved OAuth2 connection — the engine's only input.
+ * Social resolver (Step 4) and Enterprise resolver (Step 15) both produce this.
+ * Extends SSOResolvedConnectionBase with OAuth2-specific protocol fields.
+ */
+export interface OAuth2ResolvedConnection extends SSOResolvedConnectionBase {
+    source: 'oidc';
+    authorizationUrl: string;
+    tokenUrl: string;
+    /** Optional — Apple has none (identity from ID token) */
+    userInfoUrl?: string;
+    /** Redirect URI — computed by resolver, stored for exact match on callback */
+    redirectUri: string;
+    /** Issuer URL — for ID token validation (Apple, enterprise OIDC) */
+    issuer?: string;
+    /** JWKS endpoint — for ID token signature verification */
+    jwksUri?: string;
+    clientId: string;
+    /**
+     * Client secret — always a string. For Apple (dynamic JWT secret), the RESOLVER
+     * generates the signed JWT and places the result here. The engine never knows
+     * how the secret was produced.
+     */
+    clientSecret: string;
+    /**
+     * How to send credentials to the token endpoint.
+     * - 'client_secret_post': credentials in POST body (Google, Microsoft, GitHub, Apple)
+     * - 'client_secret_basic': credentials in Authorization: Basic header (some enterprise IdPs)
+     * - 'none': no client auth (public clients, rare)
+     */
+    tokenEndpointAuthMethod: 'client_secret_post' | 'client_secret_basic' | 'none';
+    scopes: string[];
+    pkceMethod: 'S256' | 'plain' | null;
+    /**
+     * How the IdP delivers the authorization response.
+     * - 'query': code & state in URL query params (default, most providers)
+     * - 'fragment': code & state in URL fragment (rare)
+     * - 'form_post': code & state in POST body (Apple REQUIRES this)
+     * The callback handler MUST accept both GET and POST and extract params accordingly.
+     */
+    responseMode: 'query' | 'fragment' | 'form_post';
+    /**
+     * Where user identity comes from after code exchange:
+     * - 'userinfo': fetch from userInfoUrl (Google, Microsoft, GitHub — default)
+     * - 'id_token': decode from ID token JWT (Apple — no userinfo endpoint)
+     * - 'callback_body': embedded in the callback POST body (Apple first-auth name)
+     */
+    identitySource: 'userinfo' | 'id_token' | 'callback_body';
+    /**
+     * Maps provider claim field names to canonical user profile fields.
+     * Works for both social `userProfileMapping` and enterprise `claimsMapping`.
+     */
+    profileMapping: OAuth2ProfileMapping;
+    extraAuthParams?: Record<string, string>;
+    extraTokenParams?: Record<string, string>;
+    tokenRequestHeaders?: Record<string, string>;
+    extensions?: Record<string, unknown>;
+    /** Override: allowedDomains is required (non-optional) for OAuth2 enterprise connections */
+    organization?: OAuth2EnterpriseOrganization;
+}
+/**
+ * Profile mapping — translates provider claim field names to canonical fields.
+ */
+export interface OAuth2ProfileMapping {
+    id: string;
+    email: string;
+    firstName?: string;
+    lastName?: string;
+    name?: string;
+    image?: string;
+    emailVerified?: string;
+    roles?: string;
+    groups?: string;
+    department?: string;
+    employeeId?: string;
+}
+/**
+ * Enterprise-specific context within a resolved connection.
+ * Extends the base organization shape with OAuth2-specific field requirements.
+ */
+export interface OAuth2EnterpriseOrganization {
+    organizationId: string;
+    scopeType?: AuthScopeType;
+    scopeId?: string;
+    connectionId: string;
+    allowedDomains: string[];
+    autoCreateUsers: boolean;
+    autoVerifyEmail: boolean;
+    defaultRole?: string;
+    roleMapping?: Record<string, string>;
+    groupMapping?: Record<string, string[]>;
+}
+/**
+ * Metadata stored in the OAUTH2_STATE consumable token.
+ * Carries connection context through the OAuth2 redirect so the callback handler
+ * can re-resolve the exact same connection configuration.
+ *
+ * Created by buildAuthorizationUrl() → consumed by resolveFromState().
+ *
+ * For social connections with per-scope credential overrides (P3), scopeType + scopeId
+ * are stored so resolveFromState() can re-apply the override on callback — ensuring
+ * the same clientId/clientSecret (and signed-JWT params) are used for the token exchange.
+ */
+export interface OAuth2StateTokenMetadata {
+    connectionType: 'social' | 'enterprise';
+    providerRef: string;
+    /** The clientId used at authorize time. Validated on callback to detect config drift. */
+    clientId: string;
+    responseMode: 'query' | 'fragment' | 'form_post';
+    pkceVerifier?: string;
+    redirectUri: string;
+    initiatedAt: string;
+    /** Config-defined frontend service identity for the surface that initiated the OAuth2 flow.
+     *  Used on callback to redirect back to the correct frontend. */
+    frontendServiceName?: string;
+    /** Scope context — set for enterprise connections AND social connections with
+     *  credential overrides (P3). Used by resolveFromState() to re-resolve the connection
+     *  with the correct org/app scope, including per-scope credential overrides. */
+    scopeType?: AuthScopeType;
+    /** The org or app ID. Combined with scopeType to load SsoConfig for credential overrides. */
+    scopeId?: string;
+    /** Post-auth frontend path to restore after the provider round-trip. */
+    returnUrl?: string;
+    /** Enterprise-only — identifies the specific SsoConnection resource. */
+    connectionId?: string;
+    /** @deprecated Use scopeId. Kept for backward compat with in-flight state tokens during rollout.
+     *  resolveFromState() falls back to this when scopeId is absent. */
+    organizationId?: string;
+}
+/**
+ * Parameters passed to the callback handler from the route.
+ * Extracted from query params (GET) or body (POST) based on responseMode.
+ */
+export interface OAuth2CallbackParams {
+    code: string;
+    state: string;
+    /** Apple form_post: the full POST body including `user` JSON (first auth only) */
+    body?: Record<string, unknown>;
+}
+/**
+ * Result of provisionOrLinkUser — the user and whether it was newly created.
+ */
+export interface OAuth2ProvisionResult {
+    /** The provisioned user ID — userId. */
+    userId: string;
+    /** Whether the user was newly created (JIT provisioning) vs linked to existing. */
+    isNewUser: boolean;
+}
+//# sourceMappingURL=oauth2-connection.backend.schemas.d.ts.map

package/dist/esm/security/authentications/models/oauth2-connection.backend.schemas.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth2-connection.backend.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/security/authentications/models/oauth2-connection.backend.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,kCAAkC,CAAC;AAClF,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAE3D,YAAY,EAAE,qBAAqB,EAAE,MAAM,kCAAkC,CAAC;AAM9E;;;;GAIG;AACH,MAAM,WAAW,wBAAyB,SAAQ,yBAAyB;IACzE,MAAM,EAAE,MAAM,CAAC;IAGf,gBAAgB,EAAE,MAAM,CAAC;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,yDAAyD;IACzD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,8EAA8E;IAC9E,WAAW,EAAE,MAAM,CAAC;IACpB,oEAAoE;IACpE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,0DAA0D;IAC1D,OAAO,CAAC,EAAE,MAAM,CAAC;IAGjB,QAAQ,EAAE,MAAM,CAAC;IACjB;;;;OAIG;IACH,YAAY,EAAE,MAAM,CAAC;IACrB;;;;;OAKG;IACH,uBAAuB,EAAE,oBAAoB,GAAG,qBAAqB,GAAG,MAAM,CAAC;IAG/E,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,UAAU,EAAE,MAAM,GAAG,OAAO,GAAG,IAAI,CAAC;IAGpC;;;;;;OAMG;IACH,YAAY,EAAE,OAAO,GAAG,UAAU,GAAG,WAAW,CAAC;IAEjD;;;;;OAKG;IACH,cAAc,EAAE,UAAU,GAAG,UAAU,GAAG,eAAe,CAAC;IAG1D;;;OAGG;IACH,cAAc,EAAE,oBAAoB,CAAC;IAGrC,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACzC,gBAAgB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC1C,mBAAmB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAG7C,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAGrC,4FAA4F;IAC5F,YAAY,CAAC,EAAE,4BAA4B,CAAC;CAC7C;AAED;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;GAGG;AACH,MAAM,WAAW,4BAA4B;IAC3C,cAAc,EAAE,MAAM,CAAC;IACvB,SAAS,CAAC,EAAE,aAAa,CAAC;IAC1B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,eAAe,EAAE,OAAO,CAAC;IACzB,eAAe,EAAE,OAAO,CAAC;IACzB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACrC,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;CACzC;AAOD;;;;;;;;;;GAUG;AACH,MAAM,WAAW,wBAAwB;IACvC,cAAc,EAAE,QAAQ,GAAG,YAAY,CAAC;IACxC,WAAW,EAAE,MAAM,CAAC;IACpB,yFAAyF;IACzF,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,OAAO,GAAG,UAAU,GAAG,WAAW,CAAC;IACjD,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB;qEACiE;IACjE,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B;;oFAEgF;IAChF,SAAS,CAAC,EAAE,aAAa,CAAC;IAC1B,6FAA6F;IAC7F,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,wEAAwE;IACxE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,wEAAwE;IACxE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;wEACoE;IACpE,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED;;;GAGG;AACH,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,kFAAkF;IAClF,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAChC;AAED;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC,wCAAwC;IACxC,MAAM,EAAE,MAAM,CAAC;IACf,mFAAmF;IACnF,SAAS,EAAE,OAAO,CAAC;CACpB"}

package/dist/esm/security/authentications/models/oauth2-connection.backend.schemas.js

@@ -0,0 +1,12 @@
+/**
+ * OAuth2 Resolved Connection & State Types
+ *
+ * These are the canonical types shared between the OAuth2 engine and its resolvers.
+ * Social resolver (Step 4) and Enterprise resolver (Step 15) both produce
+ * `OAuth2ResolvedConnection`. The engine methods (`buildAuthorizationUrl`,
+ * `handleCallback`, `provisionOrLinkUser`) consume it.
+ *
+ * `NormalizedUserProfile` has moved to `sso-connection.backend.schemas.ts` (shared
+ * between OIDC and SAML). Re-exported here for backward compatibility.
+ */
+//# sourceMappingURL=oauth2-connection.backend.schemas.js.map

package/dist/esm/security/authentications/models/oauth2-connection.backend.schemas.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth2-connection.backend.schemas.js","sourceRoot":"","sources":["../../../../../src/security/authentications/models/oauth2-connection.backend.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG"}

package/dist/esm/security/authentications/models/saml-authentication.backend.schemas.d.ts

@@ -0,0 +1,102 @@
+/**
+ * SAML Authentication — Backend Schemas
+ *
+ * Types specific to the SAML 2.0 protocol engine (AUTH-2).
+ * Parallels `oauth2-connection.backend.schemas.ts` for the OIDC flow.
+ */
+import type { SSOResolvedConnectionBase } from './sso-connection.backend.schemas.js';
+/**
+ * Resolved SAML connection — the SAML engine's input.
+ * Built from `SsoConnection` resource config at request time (per D2).
+ */
+export interface SAMLResolvedConnection extends SSOResolvedConnectionBase {
+    source: 'saml';
+    /** IdP's SAML entity ID (from connection config `saml.entityId`) */
+    idpEntityId: string;
+    /** IdP SSO service URL (HTTP-Redirect or HTTP-POST binding) */
+    ssoUrl: string;
+    /** IdP SLO service URL (optional — not all IdPs support SLO) */
+    sloUrl?: string;
+    /** IdP X.509 certificates for signature verification (supports rotation via array) */
+    x509Certificates: string[];
+    /** SP entity ID — per-scope: `https://{appDomain}/saml/sp/{scopeType}/{scopeId}` */
+    spEntityId: string;
+    /** SP Assertion Consumer Service URL */
+    acsUrl: string;
+    /** NameID format requested from IdP */
+    nameIdFormat: string;
+    /** Maps SAML attribute URIs/names to canonical profile fields */
+    attributeMapping: Record<string, string>;
+    /** Whether IdP-initiated SSO is allowed for this connection */
+    allowIdpInitiated: boolean;
+    /** Allowed clock drift in seconds for timestamp validation */
+    allowedClockDrift: number;
+    /** Whether AuthnRequests should be signed */
+    signRequests: boolean;
+    /** Whether assertions must be signed */
+    wantAssertionsSigned: boolean;
+}
+/**
+ * Metadata stored in the SAML_AUTH_STATE consumable token.
+ * Carries request context through the SAML redirect (via RelayState).
+ * Consumed at the ACS endpoint for InResponseTo validation (per D3).
+ */
+export interface SAMLStateMetadata {
+    /** SAML AuthnRequest ID (for InResponseTo validation) */
+    requestId: string;
+    /** Which SsoConnection initiated this flow */
+    connectionId: string;
+    /** Scope type (organization or application) */
+    scopeType: string;
+    /** Organization/application ID */
+    scopeId: string;
+    /** Where to redirect after successful auth */
+    returnUrl: string;
+    /** Timestamp for age validation */
+    initiatedAt: number;
+}
+/**
+ * Extracted and validated SAML assertion fields.
+ * Produced by `SAMLAssertionValidatorBackendService` after full validation.
+ */
+export interface SAMLAssertionData {
+    /** Unique assertion identifier (used for replay detection) */
+    assertionId: string;
+    /** Subject NameID value (comment-stripped, validated) */
+    nameId: string;
+    /** NameID format URI */
+    nameIdFormat: string;
+    /** Session index for SLO correlation */
+    sessionIndex?: string;
+    /** Extracted SAML attributes (values may be single or multi-valued) */
+    attributes: Record<string, string | string[]>;
+    /** IdP entity ID from the assertion's Issuer element */
+    issuer: string;
+    /** Assertion validity window start */
+    notBefore?: string;
+    /** Assertion validity window end */
+    notOnOrAfter?: string;
+    /** Audience restriction value (should match our SP entity ID) */
+    audienceRestriction?: string;
+    /** InResponseTo value (present for SP-initiated flows) */
+    inResponseTo?: string;
+}
+/**
+ * Structured output of IdP metadata XML parsing.
+ * Returned by `SAMLMetadataBackendService.parseIdPMetadata()`.
+ */
+export interface ParsedIdPMetadata {
+    /** IdP entity ID from the metadata */
+    entityId: string;
+    /** SSO service URL (HTTP-Redirect or HTTP-POST) */
+    ssoUrl: string;
+    /** SLO service URL (optional) */
+    sloUrl?: string;
+    /** IdP signing certificates (PEM-encoded, may contain multiple for rotation) */
+    x509Certificates: string[];
+    /** Preferred NameID format from metadata */
+    nameIdFormat?: string;
+    /** SLO binding types supported by the IdP */
+    sloBindings?: string[];
+}
+//# sourceMappingURL=saml-authentication.backend.schemas.d.ts.map

package/dist/esm/security/authentications/models/saml-authentication.backend.schemas.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"saml-authentication.backend.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/security/authentications/models/saml-authentication.backend.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,kCAAkC,CAAC;AAMlF;;;GAGG;AACH,MAAM,WAAW,sBAAuB,SAAQ,yBAAyB;IACvE,MAAM,EAAE,MAAM,CAAC;IAEf,oEAAoE;IACpE,WAAW,EAAE,MAAM,CAAC;IACpB,+DAA+D;IAC/D,MAAM,EAAE,MAAM,CAAC;IACf,gEAAgE;IAChE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,sFAAsF;IACtF,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAE3B,oFAAoF;IACpF,UAAU,EAAE,MAAM,CAAC;IACnB,wCAAwC;IACxC,MAAM,EAAE,MAAM,CAAC;IACf,uCAAuC;IACvC,YAAY,EAAE,MAAM,CAAC;IACrB,iEAAiE;IACjE,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACzC,+DAA+D;IAC/D,iBAAiB,EAAE,OAAO,CAAC;IAC3B,8DAA8D;IAC9D,iBAAiB,EAAE,MAAM,CAAC;IAC1B,6CAA6C;IAC7C,YAAY,EAAE,OAAO,CAAC;IACtB,wCAAwC;IACxC,oBAAoB,EAAE,OAAO,CAAC;CAC/B;AAMD;;;;GAIG;AACH,MAAM,WAAW,iBAAiB;IAChC,yDAAyD;IACzD,SAAS,EAAE,MAAM,CAAC;IAClB,8CAA8C;IAC9C,YAAY,EAAE,MAAM,CAAC;IACrB,+CAA+C;IAC/C,SAAS,EAAE,MAAM,CAAC;IAClB,kCAAkC;IAClC,OAAO,EAAE,MAAM,CAAC;IAChB,8CAA8C;IAC9C,SAAS,EAAE,MAAM,CAAC;IAClB,mCAAmC;IACnC,WAAW,EAAE,MAAM,CAAC;CACrB;AAMD;;;GAGG;AACH,MAAM,WAAW,iBAAiB;IAChC,8DAA8D;IAC9D,WAAW,EAAE,MAAM,CAAC;IACpB,yDAAyD;IACzD,MAAM,EAAE,MAAM,CAAC;IACf,wBAAwB;IACxB,YAAY,EAAE,MAAM,CAAC;IACrB,wCAAwC;IACxC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,uEAAuE;IACvE,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC,CAAC;IAC9C,wDAAwD;IACxD,MAAM,EAAE,MAAM,CAAC;IACf,sCAAsC;IACtC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,oCAAoC;IACpC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,iEAAiE;IACjE,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,0DAA0D;IAC1D,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAMD;;;GAGG;AACH,MAAM,WAAW,iBAAiB;IAChC,sCAAsC;IACtC,QAAQ,EAAE,MAAM,CAAC;IACjB,mDAAmD;IACnD,MAAM,EAAE,MAAM,CAAC;IACf,iCAAiC;IACjC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,gFAAgF;IAChF,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,4CAA4C;IAC5C,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,6CAA6C;IAC7C,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;CACxB"}

package/dist/esm/security/authentications/models/saml-authentication.backend.schemas.js

@@ -0,0 +1,7 @@
+/**
+ * SAML Authentication — Backend Schemas
+ *
+ * Types specific to the SAML 2.0 protocol engine (AUTH-2).
+ * Parallels `oauth2-connection.backend.schemas.ts` for the OIDC flow.
+ */
+//# sourceMappingURL=saml-authentication.backend.schemas.js.map

package/dist/esm/security/authentications/models/saml-authentication.backend.schemas.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"saml-authentication.backend.schemas.js","sourceRoot":"","sources":["../../../../../src/security/authentications/models/saml-authentication.backend.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG"}

package/dist/esm/security/authentications/models/sso-connection.backend.schemas.d.ts

@@ -0,0 +1,88 @@
+/**
+ * SSO Resolved Connection — Protocol-Agnostic Base Types
+ *
+ * Two-level type hierarchy (D19 Auth Stack Coherence):
+ *
+ * 1. `ProvisioningConnectionContext` — minimal context needed by
+ *    `EnterpriseUserProvisioningBackendService` for user creation and
+ *    identity link tracking. Used by OIDC, SAML, and SCIM flows.
+ *
+ * 2. `SSOResolvedConnectionBase` — extends `ProvisioningConnectionContext`
+ *    with SSO-specific fields (`connectionType`, required scope). Used only
+ *    by OIDC and SAML authentication flows (not SCIM).
+ *
+ * `NormalizedUserProfile` is the canonical output of IdP profile extraction,
+ * shared across OIDC, SAML, and SCIM flows.
+ */
+/**
+ * Minimal connection context for user provisioning.
+ * Consumed by `EnterpriseUserProvisioningBackendService.createOrgUser()`.
+ * SCIM returns this directly; OIDC and SAML return `SSOResolvedConnectionBase`
+ * (which extends this) for richer SSO-specific context.
+ */
+export interface ProvisioningConnectionContext {
+    source: 'oidc' | 'saml' | 'scim';
+    providerRef: string;
+    displayName: string;
+    organization?: {
+        organizationId: string;
+        connectionId: string;
+        autoCreateUsers: boolean;
+        autoVerifyEmail: boolean;
+        defaultRole?: string;
+        roleMapping?: Record<string, string>;
+        groupMapping?: Record<string, string[]>;
+        allowedDomains?: string[];
+    };
+}
+/**
+ * Resolved SSO connection with authentication-specific fields.
+ * Narrows `source` to OIDC/SAML (SCIM is not an SSO protocol) and
+ * adds `connectionType` + required scope context in `organization`.
+ */
+export interface SSOResolvedConnectionBase extends ProvisioningConnectionContext {
+    source: 'oidc' | 'saml';
+    connectionType: 'social' | 'enterprise';
+    organization?: ProvisioningConnectionContext['organization'] & {
+        scopeType?: 'organization' | 'application';
+        scopeId?: string;
+    };
+}
+/**
+ * Canonical normalized user profile extracted from IdP claims.
+ *
+ * Used by:
+ * - OAuth2 `handleCallback()` return
+ * - SAML ACS handler assertion extraction
+ * - `EnterpriseUserProvisioningService.createOrgUser()` input
+ * - SCIM controller (translates SCIM User attributes into this type)
+ */
+export interface NormalizedUserProfile {
+    /** IdP's unique user identifier (sub, id, etc.) */
+    providerUserId: string;
+    /** Normalized to lowercase */
+    email: string;
+    /** true if IdP confirms email is verified (default false if unavailable, e.g. GitHub) */
+    emailVerified: boolean;
+    /** Given name (from given_name, givenName, or split from name) */
+    firstName?: string;
+    /** Family name (from family_name, surname, or split from name) */
+    lastName?: string;
+    /** Full display name */
+    displayName?: string;
+    /** Profile picture URL */
+    avatarUrl?: string;
+    /** User's locale/language preference */
+    locale?: string;
+    /** IdP roles/groups (from OIDC roles claim or SAML attribute) */
+    roles?: string[];
+    /** IdP group memberships */
+    groups?: string[];
+    /** Organizational department */
+    department?: string;
+    /** Employee identifier */
+    employeeId?: string;
+    /** Full raw claims from IdP (for debugging/audit) */
+    rawClaims: Record<string, unknown>;
+}
+//# sourceMappingURL=sso-connection.backend.schemas.d.ts.map

package/dist/esm/security/authentications/models/sso-connection.backend.schemas.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sso-connection.backend.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/security/authentications/models/sso-connection.backend.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAMH;;;;;GAKG;AACH,MAAM,WAAW,6BAA6B;IAC5C,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,CAAC;IACjC,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IAEpB,YAAY,CAAC,EAAE;QACb,cAAc,EAAE,MAAM,CAAC;QACvB,YAAY,EAAE,MAAM,CAAC;QACrB,eAAe,EAAE,OAAO,CAAC;QACzB,eAAe,EAAE,OAAO,CAAC;QACzB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACrC,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;QACxC,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;KAC3B,CAAC;CACH;AAMD;;;;GAIG;AACH,MAAM,WAAW,yBAA0B,SAAQ,6BAA6B;IAC9E,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC;IACxB,cAAc,EAAE,QAAQ,GAAG,YAAY,CAAC;IAExC,YAAY,CAAC,EAAE,6BAA6B,CAAC,cAAc,CAAC,GAAG;QAC7D,SAAS,CAAC,EAAE,cAAc,GAAG,aAAa,CAAC;QAC3C,OAAO,CAAC,EAAE,MAAM,CAAC;KAClB,CAAC;CACH;AAMD;;;;;;;;GAQG;AACH,MAAM,WAAW,qBAAqB;IACpC,mDAAmD;IACnD,cAAc,EAAE,MAAM,CAAC;IACvB,8BAA8B;IAC9B,KAAK,EAAE,MAAM,CAAC;IACd,yFAAyF;IACzF,aAAa,EAAE,OAAO,CAAC;IACvB,kEAAkE;IAClE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,kEAAkE;IAClE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,wBAAwB;IACxB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,0BAA0B;IAC1B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,wCAAwC;IACxC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,iEAAiE;IACjE,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,4BAA4B;IAC5B,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,gCAAgC;IAChC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,0BAA0B;IAC1B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,qDAAqD;IACrD,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC"}

package/dist/esm/security/authentications/models/sso-connection.backend.schemas.js

@@ -0,0 +1,17 @@
+/**
+ * SSO Resolved Connection — Protocol-Agnostic Base Types
+ *
+ * Two-level type hierarchy (D19 Auth Stack Coherence):
+ *
+ * 1. `ProvisioningConnectionContext` — minimal context needed by
+ *    `EnterpriseUserProvisioningBackendService` for user creation and
+ *    identity link tracking. Used by OIDC, SAML, and SCIM flows.
+ *
+ * 2. `SSOResolvedConnectionBase` — extends `ProvisioningConnectionContext`
+ *    with SSO-specific fields (`connectionType`, required scope). Used only
+ *    by OIDC and SAML authentication flows (not SCIM).
+ *
+ * `NormalizedUserProfile` is the canonical output of IdP profile extraction,
+ * shared across OIDC, SAML, and SCIM flows.
+ */
+//# sourceMappingURL=sso-connection.backend.schemas.js.map

package/dist/esm/security/authentications/models/sso-connection.backend.schemas.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sso-connection.backend.schemas.js","sourceRoot":"","sources":["../../../../../src/security/authentications/models/sso-connection.backend.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG"}

package/dist/esm/security/authentications/services/__tests__/mock-auth-execution-context-factory.service.d.ts

@@ -0,0 +1,27 @@
+/**
+ * Vitest-oriented mock auth execution context factory for backend tests.
+ *
+ * **Naming**: `mock-*.service.ts` — canonical mock module, not a test suite.
+ * Plain `.ts` keeps it barrel-compilable, and Vitest also excludes these files
+ * explicitly as a defensive guard.
+ */
+import 'reflect-metadata';
+export declare class MockAuthExecutionContextFactoryService {
+    private preAuthExecutionContext;
+    private authenticatedExecutionContext;
+    private systemExecutionContext;
+    private usersReadOperationPath;
+    private usersCreateOperationPath;
+    createForPreAuthOperation: import("vitest").Mock<[], Promise<unknown>>;
+    createForAuthenticatedAuthOperation: import("vitest").Mock<[], Promise<unknown>>;
+    createForSystemAuthOperation: import("vitest").Mock<[], Promise<unknown>>;
+    getUsersReadOperationPath: import("vitest").Mock<[], unknown>;
+    getUsersCreateOperationPath: import("vitest").Mock<[], unknown>;
+    setPreAuthExecutionContext(executionContext: unknown): void;
+    setAuthenticatedExecutionContext(executionContext: unknown): void;
+    setSystemExecutionContext(executionContext: unknown): void;
+    setUsersReadOperationPath(operationPath: unknown): void;
+    setUsersCreateOperationPath(operationPath: unknown): void;
+    reset(): void;
+}
+//# sourceMappingURL=mock-auth-execution-context-factory.service.d.ts.map

package/dist/esm/security/authentications/services/__tests__/mock-auth-execution-context-factory.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mock-auth-execution-context-factory.service.d.ts","sourceRoot":"","sources":["../../../../../../src/security/authentications/services/__tests__/mock-auth-execution-context-factory.service.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,kBAAkB,CAAC;AAe1B,qBACa,sCAAsC;IACjD,OAAO,CAAC,uBAAuB,CAAuD;IACtF,OAAO,CAAC,6BAA6B,CAA6D;IAClG,OAAO,CAAC,sBAAsB,CAAsD;IACpF,OAAO,CAAC,sBAAsB,CAAuD;IACrF,OAAO,CAAC,wBAAwB,CAAyD;IAEzF,yBAAyB,8CAAmD;IAE5E,mCAAmC,8CAAyD;IAE5F,4BAA4B,8CAAkD;IAE9E,yBAAyB,qCAA4C;IAErE,2BAA2B,qCAA8C;IAEzE,0BAA0B,CAAC,gBAAgB,EAAE,OAAO,GAAG,IAAI;IAI3D,gCAAgC,CAAC,gBAAgB,EAAE,OAAO,GAAG,IAAI;IAIjE,yBAAyB,CAAC,gBAAgB,EAAE,OAAO,GAAG,IAAI;IAI1D,yBAAyB,CAAC,aAAa,EAAE,OAAO,GAAG,IAAI;IAIvD,2BAA2B,CAAC,aAAa,EAAE,OAAO,GAAG,IAAI;IAIzD,KAAK,IAAI,IAAI;CAYd"}