@wildo-ai/saas-backend-lib 1.0.1

package/dist/esm/security/authentications/services/anonymous-session.backend.service.js

@@ -0,0 +1,368 @@
+/**
+ * AnonymousSessionBackendService (W7.3a)
+ *
+ * Manages anonymous session lifecycle: user creation (upsert),
+ * JWT signing/verification, and ownership transposition on registration.
+ */
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+import crypto from 'crypto';
+import { inject, injectable } from 'inversify';
+import jwt from 'jsonwebtoken';
+import { SAAS_SERVICE_TYPES } from '../../../inject/models/service-types.js';
+import { AppConfigurationService } from '../../../config/services/app-configuration.backend.service.js';
+import { AnonymousUserTranspositionStatus, CoreResourceOperation, CoreResourceType, CORE_APP_ROLES, ErrorCustomMessageReference, ErrorType, ResourcePrimaryScope, ResourceTranspositionPolicy, WildoHeaderKeys, } from '@wildo-ai/saas-models';
+import { AUTH_REDIS_KEYS } from '../../../security/authentications/models/auth-constants.backend.js';
+const ANONYMOUS_SESSION_EXPIRY = '24h';
+const ANONYMOUS_SESSION_ALGORITHM = 'HS256';
+let AnonymousSessionBackendService = class AnonymousSessionBackendService {
+    logger;
+    errorBuilder;
+    configService;
+    servicesRegistryHandler;
+    resourcesRegistry;
+    executionContextCreator;
+    rateLimitService;
+    logDebug;
+    constructor(logger, errorBuilder, configService, servicesRegistryHandler, resourcesRegistry, executionContextCreator, rateLimitService) {
+        this.logger = logger;
+        this.errorBuilder = errorBuilder;
+        this.configService = configService;
+        this.servicesRegistryHandler = servicesRegistryHandler;
+        this.resourcesRegistry = resourcesRegistry;
+        this.executionContextCreator = executionContextCreator;
+        this.rateLimitService = rateLimitService;
+        this.logDebug = this.logger.debugByType('AnonymousSessionBackendService');
+    }
+    /**
+     * Upsert an AnonymousUser record. Catches duplicate key errors to handle
+     * concurrent session init from multiple tabs sending the same UUID.
+     */
+    async createAnonymousUser(anonymousUserId, req) {
+        const clientIp = req.ip || req.socket.remoteAddress || 'unknown';
+        await this.rateLimitService.checkRateLimit(`${AUTH_REDIS_KEYS.ANONYMOUS_SESSION_INIT_IP}${clientIp}`, 10, 60);
+        await this.rateLimitService.checkRateLimit(`${AUTH_REDIS_KEYS.ANONYMOUS_SESSION_INIT_HOUR_IP}${clientIp}`, 100, 3600);
+        const ipHash = this.hashIp(clientIp);
+        try {
+            const createOpPath = this.resourcesRegistry.getOperationPathDefault(CoreResourceType.ANONYMOUS_USERS, CoreResourceOperation.CREATE);
+            const internalEc = await this.executionContextCreator.createForInternalOperation({
+                operation: createOpPath,
+                contextResourcesFieldIdentifier: new Map(),
+                initiatorIds: null,
+                initiatorRoles: [{ roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], relatedPrimaryScope: ResourcePrimaryScope.APPLICATION }],
+            });
+            await this.servicesRegistryHandler.create(CoreResourceType.ANONYMOUS_USERS, internalEc, {
+                _id: anonymousUserId,
+                privacy: { consentTimestamp: new Date(), ipRetentionDays: 30 },
+                userAgent: req.headers[WildoHeaderKeys.USER_AGENT]?.substring(0, 256),
+                ipHash,
+            });
+            this.logDebug('AnonymousUser created', { anonymousUserId });
+        }
+        catch (error) {
+            if (error?.code === 11000 || error?.message?.includes('duplicate key') || error?.message?.includes('E11000')) {
+                this.logDebug('AnonymousUser already exists (concurrent init), treating as success', { anonymousUserId });
+                return;
+            }
+            this.logger.error('Failed to create AnonymousUser', { anonymousUserId, error });
+            throw error;
+        }
+    }
+    /**
+     * Sign a session JWT using the platform session HMAC secret.
+     */
+    signSessionToken(anonymousUserId) {
+        const secret = this.configService.secrets.security.session.secret;
+        return jwt.sign({ anonymousUserId }, secret, { algorithm: ANONYMOUS_SESSION_ALGORITHM, expiresIn: ANONYMOUS_SESSION_EXPIRY });
+    }
+    /**
+     * Verify a session JWT. Returns the anonymousUserId or throws.
+     */
+    verifySessionToken(token) {
+        const secret = this.configService.secrets.security.session.secret;
+        try {
+            const decoded = jwt.verify(token, secret, {
+                algorithms: [ANONYMOUS_SESSION_ALGORITHM],
+                clockTolerance: 30,
+            });
+            if (!decoded.anonymousUserId) {
+                throw new Error('Invalid anonymous session token: missing anonymousUserId');
+            }
+            return { anonymousUserId: decoded.anonymousUserId };
+        }
+        catch (error) {
+            if (error instanceof jwt.TokenExpiredError) {
+                throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, { customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_SESSION_EXPIRED, context: { message: 'Anonymous session expired' } });
+            }
+            throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, { customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_SESSION_INVALID, context: { message: 'Invalid anonymous session token' } });
+        }
+    }
+    /**
+     * Transpose ownership of all isAnonymizable resources from an anonymous user
+     * to an authenticated user. Called during registration/login when the user
+     * had prior anonymous activity.
+     *
+     * Checks that the target userType has anonymousSessionsEnabled before proceeding.
+     * If the userType does not support anonymous sessions, returns an empty result.
+     */
+    async transposeOwnership(anonymousUserId, authenticatedUserId, userType) {
+        const userTypePolicy = this.configService.getUserTypeAuthPolicy(userType);
+        if (!userTypePolicy?.anonymousSessionsEnabled) {
+            this.logDebug('Skipping transposition — anonymousSessionsEnabled is false for user type', { userType, anonymousUserId });
+            return { transposedTypes: [], failedTypes: [], status: AnonymousUserTranspositionStatus.PENDING };
+        }
+        const transposedTypes = [];
+        const failedTypes = [];
+        const anonymizableTypes = this.getAnonymizableResourceTypes();
+        for (const resourceType of anonymizableTypes) {
+            const resourceConfig = this.resourcesRegistry.getResourceConfiguration(resourceType);
+            const policy = resourceConfig?.transpositionPolicy ?? ResourceTranspositionPolicy.ADD;
+            if (policy === ResourceTranspositionPolicy.DISCARD) {
+                this.logDebug('Skipping transposition (DISCARD policy)', { resourceType });
+                continue;
+            }
+            try {
+                const records = await this.listAnonymousRecords(resourceType, anonymousUserId);
+                if (!records || records.length === 0)
+                    continue;
+                if (policy === ResourceTranspositionPolicy.REPLACE) {
+                    await this.deleteExistingUserRecords(resourceType, authenticatedUserId);
+                }
+                if (policy === ResourceTranspositionPolicy.MERGE) {
+                    this.logger.warn('MERGE transposition policy is not yet implemented — falling back to ADD', { resourceType, anonymousUserId, authenticatedUserId });
+                }
+                const ids = records.map((r) => r._id);
+                await this.reassignOwnership(resourceType, ids, authenticatedUserId);
+                transposedTypes.push(resourceType);
+                this.logDebug('Transposed ownership', {
+                    resourceType, policy, count: ids.length, anonymousUserId, authenticatedUserId,
+                });
+            }
+            catch (error) {
+                const errorMsg = error instanceof Error ? error.message : String(error);
+                failedTypes.push({ resourceType, error: errorMsg });
+                this.logger.error('Transposition failed for resource type', {
+                    resourceType, policy, anonymousUserId, authenticatedUserId, error: errorMsg,
+                });
+            }
+        }
+        const status = failedTypes.length === 0
+            ? AnonymousUserTranspositionStatus.COMPLETE
+            : transposedTypes.length > 0
+                ? AnonymousUserTranspositionStatus.PARTIAL
+                : AnonymousUserTranspositionStatus.PENDING;
+        try {
+            const updateOpPath = this.resourcesRegistry.getOperationPathDefault(CoreResourceType.ANONYMOUS_USERS, CoreResourceOperation.UPDATE);
+            const anonymousUserEc = await this.executionContextCreator.createForInternalOperation({
+                operation: updateOpPath,
+                contextResourcesFieldIdentifier: new Map(),
+                initiatorIds: null,
+                initiatorRoles: [{ roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], relatedPrimaryScope: ResourcePrimaryScope.APPLICATION }],
+            });
+            await this.servicesRegistryHandler.update(CoreResourceType.ANONYMOUS_USERS, anonymousUserEc, anonymousUserId, { convertedToUserId: authenticatedUserId, transpositionStatus: status });
+        }
+        catch (error) {
+            this.logger.error('Failed to update AnonymousUser transposition status', { anonymousUserId, error });
+        }
+        return { transposedTypes, failedTypes, status };
+    }
+    async listAnonymousRecords(resourceType, anonymousUserId) {
+        const listOpPath = this.resourcesRegistry.getOperationPathDefault(resourceType, CoreResourceOperation.LIST);
+        const listEc = await this.executionContextCreator.createForInternalOperation({
+            operation: listOpPath,
+            contextResourcesFieldIdentifier: new Map([['anonymousUserId', anonymousUserId]]),
+            initiatorIds: null,
+            initiatorRoles: [{ roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], relatedPrimaryScope: ResourcePrimaryScope.APPLICATION }],
+        });
+        return await this.servicesRegistryHandler.list(resourceType, listEc, { userId: null }, undefined, { paginated: false });
+    }
+    async reassignOwnership(resourceType, ids, authenticatedUserId) {
+        const updateOpPath = this.resourcesRegistry.getOperationPathDefault(resourceType, CoreResourceOperation.UPDATE_MANY);
+        const updateEc = await this.executionContextCreator.createForInternalOperation({
+            operation: updateOpPath,
+            contextResourcesFieldIdentifier: new Map(),
+            initiatorIds: null,
+            initiatorRoles: [{ roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], relatedPrimaryScope: ResourcePrimaryScope.APPLICATION }],
+        });
+        await this.servicesRegistryHandler.updateMany(resourceType, updateEc, ids, { userId: authenticatedUserId, anonymousUserId: null });
+    }
+    async deleteExistingUserRecords(resourceType, userId) {
+        const listOpPath = this.resourcesRegistry.getOperationPathDefault(resourceType, CoreResourceOperation.LIST);
+        const listEc = await this.executionContextCreator.createForInternalOperation({
+            operation: listOpPath,
+            contextResourcesFieldIdentifier: new Map([['userId', userId]]),
+            initiatorIds: null,
+            initiatorRoles: [{ roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], relatedPrimaryScope: ResourcePrimaryScope.APPLICATION }],
+        });
+        const existing = await this.servicesRegistryHandler.list(resourceType, listEc, undefined, undefined, { paginated: false });
+        if (existing && existing.length > 0) {
+            const deleteOpPath = this.resourcesRegistry.getOperationPathDefault(resourceType, CoreResourceOperation.DELETE_MANY);
+            const deleteEc = await this.executionContextCreator.createForInternalOperation({
+                operation: deleteOpPath,
+                contextResourcesFieldIdentifier: new Map(),
+                initiatorIds: null,
+                initiatorRoles: [{ roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], relatedPrimaryScope: ResourcePrimaryScope.APPLICATION }],
+            });
+            const ids = existing.map((r) => r._id);
+            await this.servicesRegistryHandler.deleteMany(resourceType, deleteEc, ids);
+            this.logDebug('Deleted existing user records (REPLACE policy)', { resourceType, userId, count: ids.length });
+        }
+    }
+    /**
+     * Cleanup expired, unconverted anonymous sessions and their owned resources.
+     * Called by the anonymous-session-cleanup batch job.
+     */
+    async cleanupExpiredSessions(options) {
+        const FORTY_EIGHT_HOURS_MS = 48 * 60 * 60 * 1000;
+        const NINETY_DAYS_MS = 90 * 24 * 60 * 60 * 1000;
+        const sessionTtlMs = options?.sessionTtlMs ?? FORTY_EIGHT_HOURS_MS;
+        const batchSize = options?.batchSize ?? 100;
+        const maxIterations = options?.maxIterations ?? 100;
+        const convertedRetentionMs = options?.convertedRetentionMs ?? NINETY_DAYS_MS;
+        const cutoff = new Date(Date.now() - sessionTtlMs);
+        if (!this.configService.anonymousSessionsEnabled) {
+            this.logDebug('Anonymous sessions not enabled — skipping cleanup');
+            return { expiredUsersFound: 0, resourcesDeleted: 0, usersArchived: 0, convertedUsersCleaned: 0, errors: 0 };
+        }
+        const anonymizableTypes = this.getAnonymizableResourceTypes();
+        let totalExpiredUsersFound = 0;
+        let resourcesDeleted = 0;
+        let usersArchived = 0;
+        let errors = 0;
+        let iteration = 0;
+        // Phase 1: Clean up expired unconverted sessions (pagination loop)
+        let hasMore = true;
+        while (hasMore && iteration < maxIterations) {
+            iteration++;
+            const listOpPath = this.resourcesRegistry.getOperationPathDefault(CoreResourceType.ANONYMOUS_USERS, CoreResourceOperation.LIST);
+            const listEc = await this.executionContextCreator.createForInternalOperation({
+                operation: listOpPath,
+                contextResourcesFieldIdentifier: new Map(),
+                initiatorIds: null,
+                initiatorRoles: [{ roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], relatedPrimaryScope: ResourcePrimaryScope.APPLICATION }],
+            });
+            const listResult = await this.servicesRegistryHandler.list(CoreResourceType.ANONYMOUS_USERS, listEc, { convertedToUserId: null, createdAt: { $lt: cutoff } }, { page: 1, limit: batchSize });
+            const expiredUsers = Array.isArray(listResult) ? listResult : listResult.data;
+            totalExpiredUsersFound += expiredUsers.length;
+            if (expiredUsers.length === 0) {
+                hasMore = false;
+                break;
+            }
+            for (const anonUser of expiredUsers) {
+                const anonymousUserId = anonUser._id;
+                try {
+                    for (const resourceType of anonymizableTypes) {
+                        const records = await this.listAnonymousRecords(resourceType, anonymousUserId);
+                        if (records && records.length > 0) {
+                            const ids = records.map((r) => r._id);
+                            const deleteOpPath = this.resourcesRegistry.getOperationPathDefault(resourceType, CoreResourceOperation.DELETE_MANY);
+                            const deleteEc = await this.executionContextCreator.createForInternalOperation({
+                                operation: deleteOpPath,
+                                contextResourcesFieldIdentifier: new Map(),
+                                initiatorIds: null,
+                                initiatorRoles: [{ roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], relatedPrimaryScope: ResourcePrimaryScope.APPLICATION }],
+                            });
+                            await this.servicesRegistryHandler.deleteMany(resourceType, deleteEc, ids);
+                            resourcesDeleted += ids.length;
+                        }
+                    }
+                    const deleteAnonOpPath = this.resourcesRegistry.getOperationPathDefault(CoreResourceType.ANONYMOUS_USERS, CoreResourceOperation.DELETE);
+                    const deleteAnonEc = await this.executionContextCreator.createForInternalOperation({
+                        operation: deleteAnonOpPath,
+                        contextResourcesFieldIdentifier: new Map(),
+                        initiatorIds: null,
+                        initiatorRoles: [{ roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], relatedPrimaryScope: ResourcePrimaryScope.APPLICATION }],
+                    });
+                    await this.servicesRegistryHandler.delete(CoreResourceType.ANONYMOUS_USERS, deleteAnonEc, anonymousUserId);
+                    usersArchived++;
+                }
+                catch (error) {
+                    errors++;
+                    this.logger.warn('Failed to clean up expired anonymous session', {
+                        anonymousUserId,
+                        error: error instanceof Error ? error.message : String(error),
+                    });
+                }
+            }
+            hasMore = expiredUsers.length >= batchSize;
+        }
+        // Phase 2: Clean up converted AnonymousUser records past retention period (audit trail)
+        let convertedUsersCleaned = 0;
+        const convertedCutoff = new Date(Date.now() - convertedRetentionMs);
+        try {
+            const convertedListOpPath = this.resourcesRegistry.getOperationPathDefault(CoreResourceType.ANONYMOUS_USERS, CoreResourceOperation.LIST);
+            const convertedListEc = await this.executionContextCreator.createForInternalOperation({
+                operation: convertedListOpPath,
+                contextResourcesFieldIdentifier: new Map(),
+                initiatorIds: null,
+                initiatorRoles: [{ roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], relatedPrimaryScope: ResourcePrimaryScope.APPLICATION }],
+            });
+            const convertedResult = await this.servicesRegistryHandler.list(CoreResourceType.ANONYMOUS_USERS, convertedListEc, { convertedToUserId: { $ne: null }, createdAt: { $lt: convertedCutoff } }, { page: 1, limit: batchSize });
+            const convertedUsers = Array.isArray(convertedResult) ? convertedResult : convertedResult.data;
+            for (const convertedUser of convertedUsers) {
+                try {
+                    const deleteOpPath = this.resourcesRegistry.getOperationPathDefault(CoreResourceType.ANONYMOUS_USERS, CoreResourceOperation.DELETE);
+                    const deleteEc = await this.executionContextCreator.createForInternalOperation({
+                        operation: deleteOpPath,
+                        contextResourcesFieldIdentifier: new Map(),
+                        initiatorIds: null,
+                        initiatorRoles: [{ roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], relatedPrimaryScope: ResourcePrimaryScope.APPLICATION }],
+                    });
+                    await this.servicesRegistryHandler.delete(CoreResourceType.ANONYMOUS_USERS, deleteEc, convertedUser._id);
+                    convertedUsersCleaned++;
+                }
+                catch (error) {
+                    errors++;
+                }
+            }
+        }
+        catch (error) {
+            this.logger.warn('Failed to clean up converted anonymous users', {
+                error: error instanceof Error ? error.message : String(error),
+            });
+        }
+        this.logDebug('Cleanup completed', {
+            expiredUsersFound: totalExpiredUsersFound, resourcesDeleted, usersArchived,
+            convertedUsersCleaned, errors, iterations: iteration,
+            anonymizableTypes: anonymizableTypes.length,
+        });
+        return { expiredUsersFound: totalExpiredUsersFound, resourcesDeleted, usersArchived, convertedUsersCleaned, errors };
+    }
+    getAnonymizableResourceTypes() {
+        const allTypes = this.resourcesRegistry.getResourceTypes();
+        const result = [];
+        for (const resourceType of allTypes) {
+            const config = this.resourcesRegistry.getResourceConfiguration(resourceType);
+            if (config?.isAnonymizable === true) {
+                result.push(resourceType);
+            }
+        }
+        return result;
+    }
+    hashIp(ip) {
+        return crypto.createHash('sha256').update(ip).digest('hex').substring(0, 16);
+    }
+};
+AnonymousSessionBackendService = __decorate([
+    injectable(),
+    __param(0, inject(SAAS_SERVICE_TYPES.Logger)),
+    __param(1, inject(SAAS_SERVICE_TYPES.ErrorBuilderService)),
+    __param(2, inject(SAAS_SERVICE_TYPES.AppConfigService)),
+    __param(3, inject(SAAS_SERVICE_TYPES.ServicesRegistryHandlerService)),
+    __param(4, inject(SAAS_SERVICE_TYPES.ResourceRegistryService)),
+    __param(5, inject(SAAS_SERVICE_TYPES.ExecutionContextCreatorBackendService)),
+    __param(6, inject(SAAS_SERVICE_TYPES.RateLimitBackendService)),
+    __metadata("design:paramtypes", [Function, Function, AppConfigurationService, Function, Function, Function, Function])
+], AnonymousSessionBackendService);
+export { AnonymousSessionBackendService };
+//# sourceMappingURL=anonymous-session.backend.service.js.map

package/dist/esm/security/authentications/services/anonymous-session.backend.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"anonymous-session.backend.service.js","sourceRoot":"","sources":["../../../../../src/security/authentications/services/anonymous-session.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;;;;;;;;;;;;;AAEH,OAAO,MAAM,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAC/C,OAAO,GAAG,MAAM,cAAc,CAAC;AAC/B,OAAO,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AACpF,OAAO,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AAM/G,OAAO,EACL,gCAAgC,EAChC,qBAAqB,EACrB,gBAAgB,EAChB,cAAc,EACd,2BAA2B,EAC3B,SAAS,EACT,oBAAoB,EACpB,2BAA2B,EAC3B,eAAe,GAEhB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EAAE,eAAe,EAAE,MAAM,2EAA2E,CAAC;AAG5G,MAAM,wBAAwB,GAAG,KAAK,CAAC;AACvC,MAAM,2BAA2B,GAAG,OAAgB,CAAC;AAe9C,IAAM,8BAA8B,GAApC,MAAM,8BAA8B;IAKa;IACa;IACH;IACc;IACP;IACc;IACd;IATtD,QAAQ,CAA+D;IAExF,YACsD,MAAqB,EACR,YAAwC,EAC3C,aAAsC,EACxB,uBAA8D,EACrE,iBAAkD,EACpC,uBAA8D,EAC5E,gBAAyC;QAN1D,WAAM,GAAN,MAAM,CAAe;QACR,iBAAY,GAAZ,YAAY,CAA4B;QAC3C,kBAAa,GAAb,aAAa,CAAyB;QACxB,4BAAuB,GAAvB,uBAAuB,CAAuC;QACrE,sBAAiB,GAAjB,iBAAiB,CAAiC;QACpC,4BAAuB,GAAvB,uBAAuB,CAAuC;QAC5E,qBAAgB,GAAhB,gBAAgB,CAAyB;QAE9G,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,gCAAgC,CAAC,CAAC;IAC5E,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,mBAAmB,CAAC,eAAuB,EAAE,GAAY;QAC7D,MAAM,QAAQ,GAAG,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC,MAAM,CAAC,aAAa,IAAI,SAAS,CAAC;QACjE,MAAM,IAAI,CAAC,gBAAgB,CAAC,cAAc,CAAC,GAAG,eAAe,CAAC,yBAAyB,GAAG,QAAQ,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;QAC9G,MAAM,IAAI,CAAC,gBAAgB,CAAC,cAAc,CAAC,GAAG,eAAe,CAAC,8BAA8B,GAAG,QAAQ,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;QAEtH,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAErC,IAAI,CAAC;YACH,MAAM,YAAY,GAAG,IAAI,CAAC,iBAAiB,CAAC,uBAAuB,CAAC,gBAAgB,CAAC,eAAe,EAAE,qBAAqB,CAAC,MAAM,CAAC,CAAC;YACpI,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,0BAA0B,CAAC;gBAC/E,SAAS,EAAE,YAAY;gBACvB,+BAA+B,EAAE,IAAI,GAAG,EAAE;gBAC1C,YAAY,EAAE,IAAI;gBAClB,cAAc,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,mBAAmB,EAAE,oBAAoB,CAAC,WAAW,EAAE,CAAC;aAC3H,CAAC,CAAC;YAEH,MAAM,IAAI,CAAC,uBAAuB,CAAC,MAAM,CAAC,gBAAgB,CAAC,eAAe,EAAE,UAAU,EAAE;gBACtF,GAAG,EAAE,eAAe;gBACpB,OAAO,EAAE,EAAE,gBAAgB,EAAE,IAAI,IAAI,EAAE,EAAE,eAAe,EAAE,EAAE,EAAE;gBAC9D,SAAS,EAAE,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,UAAU,CAAC,EAAE,SAAS,CAAC,CAAC,EAAE,GAAG,CAAC;gBACrE,MAAM;aACP,CAAC,CAAC;YACH,IAAI,CAAC,QAAQ,CAAC,uBAAuB,EAAE,EAAE,eAAe,EAAE,CAAC,CAAC;QAC9D,CAAC;QAAC,OAAO,KAAU,EAAE,CAAC;YACpB,IAAI,KAAK,EAAE,IAAI,KAAK,KAAK,IAAI,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC,eAAe,CAAC,IAAI,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC7G,IAAI,CAAC,QAAQ,CAAC,qEAAqE,EAAE,EAAE,eAAe,EAAE,CAAC,CAAC;gBAC1G,OAAO;YACT,CAAC;YACD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,gCAAgC,EAAE,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC,CAAC;YAChF,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED;;OAEG;IACH,gBAAgB,CAAC,eAAuB;QACtC,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC;QAClE,OAAO,GAAG,CAAC,IAAI,CACb,EAAE,eAAe,EAAE,EACnB,MAAM,EACN,EAAE,SAAS,EAAE,2BAA2B,EAAE,SAAS,EAAE,wBAAwB,EAAE,CAChF,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,kBAAkB,CAAC,KAAa;QAC9B,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC;QAClE,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE;gBACxC,UAAU,EAAE,CAAC,2BAA2B,CAAC;gBACzC,cAAc,EAAE,EAAE;aACnB,CAA+B,CAAC;YAEjC,IAAI,CAAC,OAAO,CAAC,eAAe,EAAE,CAAC;gBAC7B,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;YAC9E,CAAC;YAED,OAAO,EAAE,eAAe,EAAE,OAAO,CAAC,eAAe,EAAE,CAAC;QACtD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,GAAG,CAAC,iBAAiB,EAAE,CAAC;gBAC3C,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,cAAc,EACxB,SAAS,EACT,EAAE,sBAAsB,EAAE,2BAA2B,CAAC,8BAA8B,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,2BAA2B,EAAE,EAAE,CAC1I,CAAC;YACJ,CAAC;YACD,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,cAAc,EACxB,SAAS,EACT,EAAE,sBAAsB,EAAE,2BAA2B,CAAC,8BAA8B,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,iCAAiC,EAAE,EAAE,CAChJ,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,kBAAkB,CACtB,eAAuB,EACvB,mBAA2B,EAC3B,QAAgB;QAEhB,MAAM,cAAc,GAAG,IAAI,CAAC,aAAa,CAAC,qBAAqB,CAAC,QAAQ,CAAC,CAAC;QAC1E,IAAI,CAAC,cAAc,EAAE,wBAAwB,EAAE,CAAC;YAC9C,IAAI,CAAC,QAAQ,CAAC,0EAA0E,EAAE,EAAE,QAAQ,EAAE,eAAe,EAAE,CAAC,CAAC;YACzH,OAAO,EAAE,eAAe,EAAE,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,gCAAgC,CAAC,OAAO,EAAE,CAAC;QACpG,CAAC;QAED,MAAM,eAAe,GAAmB,EAAE,CAAC;QAC3C,MAAM,WAAW,GAAoD,EAAE,CAAC;QAExE,MAAM,iBAAiB,GAAG,IAAI,CAAC,4BAA4B,EAAE,CAAC;QAE9D,KAAK,MAAM,YAAY,IAAI,iBAAiB,EAAE,CAAC;YAC7C,MAAM,cAAc,GAAG,IAAI,CAAC,iBAAiB,CAAC,wBAAwB,CAAC,YAAY,CAAC,CAAC;YACrF,MAAM,MAAM,GAAG,cAAc,EAAE,mBAAmB,IAAI,2BAA2B,CAAC,GAAG,CAAC;YAEtF,IAAI,MAAM,KAAK,2BAA2B,CAAC,OAAO,EAAE,CAAC;gBACnD,IAAI,CAAC,QAAQ,CAAC,yCAAyC,EAAE,EAAE,YAAY,EAAE,CAAC,CAAC;gBAC3E,SAAS;YACX,CAAC;YAED,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,YAAY,EAAE,eAAe,CAAC,CAAC;gBAE/E,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;oBAAE,SAAS;gBAE/C,IAAI,MAAM,KAAK,2BAA2B,CAAC,OAAO,EAAE,CAAC;oBACnD,MAAM,IAAI,CAAC,yBAAyB,CAAC,YAAY,EAAE,mBAAmB,CAAC,CAAC;gBAC1E,CAAC;gBAED,IAAI,MAAM,KAAK,2BAA2B,CAAC,KAAK,EAAE,CAAC;oBACjD,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,yEAAyE,EACzE,EAAE,YAAY,EAAE,eAAe,EAAE,mBAAmB,EAAE,CACvD,CAAC;gBACJ,CAAC;gBAED,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;gBAC3C,MAAM,IAAI,CAAC,iBAAiB,CAAC,YAAY,EAAE,GAAG,EAAE,mBAAmB,CAAC,CAAC;gBAErE,eAAe,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;gBACnC,IAAI,CAAC,QAAQ,CAAC,sBAAsB,EAAE;oBACpC,YAAY,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,eAAe,EAAE,mBAAmB;iBAC9E,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,QAAQ,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBACxE,WAAW,CAAC,IAAI,CAAC,EAAE,YAAY,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;gBACpD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,wCAAwC,EAAE;oBAC1D,YAAY,EAAE,MAAM,EAAE,eAAe,EAAE,mBAAmB,EAAE,KAAK,EAAE,QAAQ;iBAC5E,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,KAAK,CAAC;YACrC,CAAC,CAAC,gCAAgC,CAAC,QAAQ;YAC3C,CAAC,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC;gBAC1B,CAAC,CAAC,gCAAgC,CAAC,OAAO;gBAC1C,CAAC,CAAC,gCAAgC,CAAC,OAAO,CAAC;QAE/C,IAAI,CAAC;YACH,MAAM,YAAY,GAAG,IAAI,CAAC,iBAAiB,CAAC,uBAAuB,CAAC,gBAAgB,CAAC,eAAe,EAAE,qBAAqB,CAAC,MAAM,CAAC,CAAC;YACpI,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,0BAA0B,CAAC;gBACpF,SAAS,EAAE,YAAY;gBACvB,+BAA+B,EAAE,IAAI,GAAG,EAAE;gBAC1C,YAAY,EAAE,IAAI;gBAClB,cAAc,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,mBAAmB,EAAE,oBAAoB,CAAC,WAAW,EAAE,CAAC;aAC3H,CAAC,CAAC;YAEH,MAAM,IAAI,CAAC,uBAAuB,CAAC,MAAM,CACvC,gBAAgB,CAAC,eAAe,EAAE,eAAe,EAAE,eAAe,EAClE,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,MAAM,EAAE,CACxE,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,qDAAqD,EAAE,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC,CAAC;QACvG,CAAC;QAED,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC;IAClD,CAAC;IAEO,KAAK,CAAC,oBAAoB,CAAC,YAA0B,EAAE,eAAuB;QACpF,MAAM,UAAU,GAAG,IAAI,CAAC,iBAAiB,CAAC,uBAAuB,CAAC,YAAY,EAAE,qBAAqB,CAAC,IAAI,CAAC,CAAC;QAC5G,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,0BAA0B,CAAC;YAC3E,SAAS,EAAE,UAAU;YACrB,+BAA+B,EAAE,IAAI,GAAG,CAAC,CAAC,CAAC,iBAAiB,EAAE,eAAe,CAAC,CAAC,CAAC;YAChF,YAAY,EAAE,IAAI;YAClB,cAAc,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,mBAAmB,EAAE,oBAAoB,CAAC,WAAW,EAAE,CAAC;SAC3H,CAAC,CAAC;QACH,OAAO,MAAM,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAM,YAAY,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,CAAU,CAAC;IACxI,CAAC;IAEO,KAAK,CAAC,iBAAiB,CAAC,YAA0B,EAAE,GAAa,EAAE,mBAA2B;QACpG,MAAM,YAAY,GAAG,IAAI,CAAC,iBAAiB,CAAC,uBAAuB,CAAC,YAAY,EAAE,qBAAqB,CAAC,WAAW,CAAC,CAAC;QACrH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,0BAA0B,CAAC;YAC7E,SAAS,EAAE,YAAY;YACvB,+BAA+B,EAAE,IAAI,GAAG,EAAE;YAC1C,YAAY,EAAE,IAAI;YAClB,cAAc,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,mBAAmB,EAAE,oBAAoB,CAAC,WAAW,EAAE,CAAC;SAC3H,CAAC,CAAC;QACH,MAAM,IAAI,CAAC,uBAAuB,CAAC,UAAU,CAAC,YAAY,EAAE,QAAQ,EAAE,GAAG,EAAE,EAAE,MAAM,EAAE,mBAAmB,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC,CAAC;IACrI,CAAC;IAEO,KAAK,CAAC,yBAAyB,CAAC,YAA0B,EAAE,MAAc;QAChF,MAAM,UAAU,GAAG,IAAI,CAAC,iBAAiB,CAAC,uBAAuB,CAAC,YAAY,EAAE,qBAAqB,CAAC,IAAI,CAAC,CAAC;QAC5G,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,0BAA0B,CAAC;YAC3E,SAAS,EAAE,UAAU;YACrB,+BAA+B,EAAE,IAAI,GAAG,CAAC,CAAC,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;YAC9D,YAAY,EAAE,IAAI;YAClB,cAAc,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,mBAAmB,EAAE,oBAAoB,CAAC,WAAW,EAAE,CAAC;SAC3H,CAAC,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAM,YAAY,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,CAAU,CAAC;QACzI,IAAI,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACpC,MAAM,YAAY,GAAG,IAAI,CAAC,iBAAiB,CAAC,uBAAuB,CAAC,YAAY,EAAE,qBAAqB,CAAC,WAAW,CAAC,CAAC;YACrH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,0BAA0B,CAAC;gBAC7E,SAAS,EAAE,YAAY;gBACvB,+BAA+B,EAAE,IAAI,GAAG,EAAE;gBAC1C,YAAY,EAAE,IAAI;gBAClB,cAAc,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,mBAAmB,EAAE,oBAAoB,CAAC,WAAW,EAAE,CAAC;aAC3H,CAAC,CAAC;YACH,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YAC5C,MAAM,IAAI,CAAC,uBAAuB,CAAC,UAAU,CAAC,YAAY,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC;YAC3E,IAAI,CAAC,QAAQ,CAAC,gDAAgD,EAAE,EAAE,YAAY,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;QAC/G,CAAC;IACH,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,sBAAsB,CAAC,OAK5B;QACC,MAAM,oBAAoB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;QACjD,MAAM,cAAc,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;QAChD,MAAM,YAAY,GAAG,OAAO,EAAE,YAAY,IAAI,oBAAoB,CAAC;QACnE,MAAM,SAAS,GAAG,OAAO,EAAE,SAAS,IAAI,GAAG,CAAC;QAC5C,MAAM,aAAa,GAAG,OAAO,EAAE,aAAa,IAAI,GAAG,CAAC;QACpD,MAAM,oBAAoB,GAAG,OAAO,EAAE,oBAAoB,IAAI,cAAc,CAAC;QAC7E,MAAM,MAAM,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,YAAY,CAAC,CAAC;QAEnD,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,wBAAwB,EAAE,CAAC;YACjD,IAAI,CAAC,QAAQ,CAAC,mDAAmD,CAAC,CAAC;YACnE,OAAO,EAAE,iBAAiB,EAAE,CAAC,EAAE,gBAAgB,EAAE,CAAC,EAAE,aAAa,EAAE,CAAC,EAAE,qBAAqB,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;QAC9G,CAAC;QAED,MAAM,iBAAiB,GAAG,IAAI,CAAC,4BAA4B,EAAE,CAAC;QAC9D,IAAI,sBAAsB,GAAG,CAAC,CAAC;QAC/B,IAAI,gBAAgB,GAAG,CAAC,CAAC;QACzB,IAAI,aAAa,GAAG,CAAC,CAAC;QACtB,IAAI,MAAM,GAAG,CAAC,CAAC;QACf,IAAI,SAAS,GAAG,CAAC,CAAC;QAElB,mEAAmE;QACnE,IAAI,OAAO,GAAG,IAAI,CAAC;QACnB,OAAO,OAAO,IAAI,SAAS,GAAG,aAAa,EAAE,CAAC;YAC5C,SAAS,EAAE,CAAC;YAEZ,MAAM,UAAU,GAAG,IAAI,CAAC,iBAAiB,CAAC,uBAAuB,CAAC,gBAAgB,CAAC,eAAe,EAAE,qBAAqB,CAAC,IAAI,CAAC,CAAC;YAChI,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,0BAA0B,CAAC;gBAC3E,SAAS,EAAE,UAAU;gBACrB,+BAA+B,EAAE,IAAI,GAAG,EAAE;gBAC1C,YAAY,EAAE,IAAI;gBAClB,cAAc,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,mBAAmB,EAAE,oBAAoB,CAAC,WAAW,EAAE,CAAC;aAC3H,CAAC,CAAC;YAEH,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,IAAI,CACxD,gBAAgB,CAAC,eAAe,EAChC,MAAM,EACN,EAAE,iBAAiB,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,EACvD,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,CAC9B,CAAC;YACF,MAAM,YAAY,GAAU,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC;YACrF,sBAAsB,IAAI,YAAY,CAAC,MAAM,CAAC;YAE9C,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAAC,OAAO,GAAG,KAAK,CAAC;gBAAC,MAAM;YAAC,CAAC;YAE1D,KAAK,MAAM,QAAQ,IAAI,YAAY,EAAE,CAAC;gBACpC,MAAM,eAAe,GAAG,QAAQ,CAAC,GAAa,CAAC;gBAE/C,IAAI,CAAC;oBACH,KAAK,MAAM,YAAY,IAAI,iBAAiB,EAAE,CAAC;wBAC7C,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,YAAY,EAAE,eAAe,CAAC,CAAC;wBAC/E,IAAI,OAAO,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;4BAClC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;4BAC3C,MAAM,YAAY,GAAG,IAAI,CAAC,iBAAiB,CAAC,uBAAuB,CAAC,YAAY,EAAE,qBAAqB,CAAC,WAAW,CAAC,CAAC;4BACrH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,0BAA0B,CAAC;gCAC7E,SAAS,EAAE,YAAY;gCACvB,+BAA+B,EAAE,IAAI,GAAG,EAAE;gCAC1C,YAAY,EAAE,IAAI;gCAClB,cAAc,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,mBAAmB,EAAE,oBAAoB,CAAC,WAAW,EAAE,CAAC;6BAC3H,CAAC,CAAC;4BACH,MAAM,IAAI,CAAC,uBAAuB,CAAC,UAAU,CAAC,YAAY,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC;4BAC3E,gBAAgB,IAAI,GAAG,CAAC,MAAM,CAAC;wBACjC,CAAC;oBACH,CAAC;oBAED,MAAM,gBAAgB,GAAG,IAAI,CAAC,iBAAiB,CAAC,uBAAuB,CAAC,gBAAgB,CAAC,eAAe,EAAE,qBAAqB,CAAC,MAAM,CAAC,CAAC;oBACxI,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,0BAA0B,CAAC;wBACjF,SAAS,EAAE,gBAAgB;wBAC3B,+BAA+B,EAAE,IAAI,GAAG,EAAE;wBAC1C,YAAY,EAAE,IAAI;wBAClB,cAAc,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,mBAAmB,EAAE,oBAAoB,CAAC,WAAW,EAAE,CAAC;qBAC3H,CAAC,CAAC;oBACH,MAAM,IAAI,CAAC,uBAAuB,CAAC,MAAM,CAAC,gBAAgB,CAAC,eAAe,EAAE,YAAY,EAAE,eAAe,CAAC,CAAC;oBAC3G,aAAa,EAAE,CAAC;gBAClB,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,MAAM,EAAE,CAAC;oBACT,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,8CAA8C,EAAE;wBAC/D,eAAe;wBACf,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;qBAC9D,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YAED,OAAO,GAAG,YAAY,CAAC,MAAM,IAAI,SAAS,CAAC;QAC7C,CAAC;QAED,wFAAwF;QACxF,IAAI,qBAAqB,GAAG,CAAC,CAAC;QAC9B,MAAM,eAAe,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,oBAAoB,CAAC,CAAC;QACpE,IAAI,CAAC;YACH,MAAM,mBAAmB,GAAG,IAAI,CAAC,iBAAiB,CAAC,uBAAuB,CAAC,gBAAgB,CAAC,eAAe,EAAE,qBAAqB,CAAC,IAAI,CAAC,CAAC;YACzI,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,0BAA0B,CAAC;gBACpF,SAAS,EAAE,mBAAmB;gBAC9B,+BAA+B,EAAE,IAAI,GAAG,EAAE;gBAC1C,YAAY,EAAE,IAAI;gBAClB,cAAc,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,mBAAmB,EAAE,oBAAoB,CAAC,WAAW,EAAE,CAAC;aAC3H,CAAC,CAAC;YACH,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAC7D,gBAAgB,CAAC,eAAe,EAChC,eAAe,EACf,EAAE,iBAAiB,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,EAAE,GAAG,EAAE,eAAe,EAAE,EAAE,EACzE,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,CAC9B,CAAC;YACF,MAAM,cAAc,GAAU,KAAK,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC;YAEtG,KAAK,MAAM,aAAa,IAAI,cAAc,EAAE,CAAC;gBAC3C,IAAI,CAAC;oBACH,MAAM,YAAY,GAAG,IAAI,CAAC,iBAAiB,CAAC,uBAAuB,CAAC,gBAAgB,CAAC,eAAe,EAAE,qBAAqB,CAAC,MAAM,CAAC,CAAC;oBACpI,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,0BAA0B,CAAC;wBAC7E,SAAS,EAAE,YAAY;wBACvB,+BAA+B,EAAE,IAAI,GAAG,EAAE;wBAC1C,YAAY,EAAE,IAAI;wBAClB,cAAc,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,mBAAmB,EAAE,oBAAoB,CAAC,WAAW,EAAE,CAAC;qBAC3H,CAAC,CAAC;oBACH,MAAM,IAAI,CAAC,uBAAuB,CAAC,MAAM,CAAC,gBAAgB,CAAC,eAAe,EAAE,QAAQ,EAAE,aAAa,CAAC,GAAG,CAAC,CAAC;oBACzG,qBAAqB,EAAE,CAAC;gBAC1B,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,MAAM,EAAE,CAAC;gBACX,CAAC;YACH,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,8CAA8C,EAAE;gBAC/D,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;aAC9D,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,mBAAmB,EAAE;YACjC,iBAAiB,EAAE,sBAAsB,EAAE,gBAAgB,EAAE,aAAa;YAC1E,qBAAqB,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS;YACpD,iBAAiB,EAAE,iBAAiB,CAAC,MAAM;SAC5C,CAAC,CAAC;QAEH,OAAO,EAAE,iBAAiB,EAAE,sBAAsB,EAAE,gBAAgB,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,EAAE,CAAC;IACvH,CAAC;IAEO,4BAA4B;QAClC,MAAM,QAAQ,GAAG,IAAI,CAAC,iBAAiB,CAAC,gBAAgB,EAAE,CAAC;QAC3D,MAAM,MAAM,GAAmB,EAAE,CAAC;QAClC,KAAK,MAAM,YAAY,IAAI,QAAQ,EAAE,CAAC;YACpC,MAAM,MAAM,GAAG,IAAI,CAAC,iBAAiB,CAAC,wBAAwB,CAAC,YAAY,CAAC,CAAC;YAC7E,IAAI,MAAM,EAAE,cAAc,KAAK,IAAI,EAAE,CAAC;gBACpC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;YAC5B,CAAC;QACH,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,MAAM,CAAC,EAAU;QACvB,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC/E,CAAC;CACF,CAAA;AAxYY,8BAA8B;IAD1C,UAAU,EAAE;IAMR,WAAA,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAA;IACjC,WAAA,MAAM,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,CAAA;IAC9C,WAAA,MAAM,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,CAAA;IAC3C,WAAA,MAAM,CAAC,kBAAkB,CAAC,8BAA8B,CAAC,CAAA;IACzD,WAAA,MAAM,CAAC,kBAAkB,CAAC,uBAAuB,CAAC,CAAA;IAClD,WAAA,MAAM,CAAC,kBAAkB,CAAC,qCAAqC,CAAC,CAAA;IAChE,WAAA,MAAM,CAAC,kBAAkB,CAAC,uBAAuB,CAAC,CAAA;yDAJ0B,uBAAuB;GAP3F,8BAA8B,CAwY1C"}

package/dist/esm/security/authentications/services/auth-credential-verifier.backend.service.d.ts

@@ -0,0 +1,75 @@
+import 'reflect-metadata';
+import { LoggerService } from '../../../monitoring/logger/services/logger.service.js';
+import { ErrorBuilderBackendService } from '../../../errors/services/error-builder.backend.service.js';
+import type { ServicesRegistryHandlerBackendService } from '../../../base-classes/services/services/services-registry-handler.backend.service.js';
+import type { RepositoriesRegistryHandlerBackendService } from '../../../base-classes/services/repositories/repositories-registry-handler.backend.service.js';
+import { UserCredentials } from '@wildo-ai/saas-models';
+import { ExecutionContext } from '../../../runtime/models/execution-context.backend.schemas.js';
+import type { PasswordHashing } from '../../../config/models/app-config.backend.schemas.js';
+import { type PasswordPolicyRules } from '@wildo-ai/saas-models';
+/**
+ * Result of password policy validation.
+ */
+export interface PasswordPolicyValidationResult {
+    valid: boolean;
+    violations: string[];
+}
+/**
+ * AuthCredentialVerifierBackendService
+ *
+ * Responsibilities:
+ * - Resolve credentials for a user from the appropriate repository
+ * - Verify a plaintext password against a stored argon2 hash
+ * - Validate a password against the password policy rules
+ *
+ * This service does NOT:
+ * - Manage sessions (that's AuthSessionStore)
+ * - Issue tokens (that's AuthTokenIssuer)
+ * - Audit log (that's the orchestrator's job — TRAP 13)
+ * - Know about the authentication flow (that's the orchestrator's job)
+ */
+export declare class AuthCredentialVerifierBackendService {
+    private readonly logger;
+    private readonly errorBuilder;
+    private readonly servicesRegistryHandler;
+    private readonly repositoriesRegistryHandler;
+    private readonly logDebug;
+    constructor(logger: LoggerService, errorBuilder: ErrorBuilderBackendService, servicesRegistryHandler: ServicesRegistryHandlerBackendService, repositoriesRegistryHandler: RepositoriesRegistryHandlerBackendService);
+    /**
+     * Resolve credentials for a user.
+     * Returns the credential record (with passwordHash) or null if not found.
+     */
+    resolveCredentials(ec: ExecutionContext<any>, userId: string): Promise<UserCredentials | null>;
+    /**
+     * Verify a plaintext password against an argon2 hash.
+     * Returns true if the password matches, false otherwise.
+     *
+     * TRAP 3: This method does NOT enforce password policy.
+     * Password policy is only enforced at creation/change time, never at verification time.
+     * A user who set a password before a policy change can still log in.
+     */
+    verifyPassword(passwordHash: string, plaintext: string): Promise<boolean>;
+    /**
+     * Validate a password against the password policy rules.
+     * Used at password creation/change time, NOT at login verification.
+     *
+     * TRAP 3: Never call this during login verification.
+     *
+     * Delegates to AuthUtils.validatePasswordAgainstPolicy (saas-models) for single source of truth.
+     */
+    validatePasswordPolicy(password: string, rules?: PasswordPolicyRules): PasswordPolicyValidationResult;
+    private static readonly ARGON2_TYPE_MAP;
+    /**
+     * Hash a plaintext password using argon2.
+     * Reads hashing config from the auth configuration.
+     * Only argon2 is implemented.
+     */
+    hashPassword(plaintext: string, hashing?: PasswordHashing): Promise<string>;
+    /**
+     * Update the password hash for a user.
+     * Sets `passwordChangedAt` to current time so refresh tokens issued before
+     * this point can be rejected (C4 fix).
+     */
+    updatePasswordHash(ec: ExecutionContext<any>, userId: string, newPasswordHash: string): Promise<void>;
+}
+//# sourceMappingURL=auth-credential-verifier.backend.service.d.ts.map

package/dist/esm/security/authentications/services/auth-credential-verifier.backend.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-credential-verifier.backend.service.d.ts","sourceRoot":"","sources":["../../../../../src/security/authentications/services/auth-credential-verifier.backend.service.ts"],"names":[],"mappings":"AAAA,OAAO,kBAAkB,CAAC;AAI1B,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAC7F,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAC9G,OAAO,KAAK,EAAE,qCAAqC,EAAE,MAAM,6FAA6F,CAAC;AACzJ,OAAO,KAAK,EAAE,yCAAyC,EAAE,MAAM,qGAAqG,CAAC;AACrK,OAAO,EAGL,eAAe,EAGhB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,gBAAgB,EAAE,MAAM,qEAAqE,CAAC;AACvG,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,6DAA6D,CAAC;AAEnG,OAAO,EAA6B,KAAK,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAE5F;;GAEG;AACH,MAAM,WAAW,8BAA8B;IAC7C,KAAK,EAAE,OAAO,CAAC;IACf,UAAU,EAAE,MAAM,EAAE,CAAC;CACtB;AAED;;;;;;;;;;;;;GAaG;AACH,qBACa,oCAAoC;IAIV,OAAO,CAAC,QAAQ,CAAC,MAAM;IACV,OAAO,CAAC,QAAQ,CAAC,YAAY;IAClB,OAAO,CAAC,QAAQ,CAAC,uBAAuB;IACpC,OAAO,CAAC,QAAQ,CAAC,2BAA2B;IAN7G,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA+D;gBAGlC,MAAM,EAAE,aAAa,EACR,YAAY,EAAE,0BAA0B,EAC7B,uBAAuB,EAAE,qCAAqC,EAC1D,2BAA2B,EAAE,yCAAyC;IAMxJ;;;OAGG;IACU,kBAAkB,CAC7B,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACzB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC;IAKlC;;;;;;;OAOG;IACU,cAAc,CAAC,YAAY,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAWtF;;;;;;;OAOG;IACI,sBAAsB,CAC3B,QAAQ,EAAE,MAAM,EAChB,KAAK,CAAC,EAAE,mBAAmB,GAC1B,8BAA8B;IAKjC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,eAAe,CAIrC;IAEF;;;;OAIG;IACU,YAAY,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC;IAgBxF;;;;OAIG;IACU,kBAAkB,CAC7B,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACzB,MAAM,EAAE,MAAM,EACd,eAAe,EAAE,MAAM,GACtB,OAAO,CAAC,IAAI,CAAC;CAOjB"}

package/dist/esm/security/authentications/services/auth-credential-verifier.backend.service.js

@@ -0,0 +1,139 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+var AuthCredentialVerifierBackendService_1;
+import 'reflect-metadata';
+import { inject, injectable } from 'inversify';
+import * as argon2 from 'argon2';
+import { SAAS_SERVICE_TYPES } from '../../../inject/models/service-types.js';
+import { LoggerService } from '../../../monitoring/logger/services/logger.service.js';
+import { ErrorBuilderBackendService } from '../../../errors/services/error-builder.backend.service.js';
+import { AuthUtils, CoreResourceType, } from '@wildo-ai/saas-models';
+import { Argon2Type } from '../../../config/models/app-config.backend.schemas.js';
+import { PasswordPolicyRulesSchema } from '@wildo-ai/saas-models';
+/**
+ * AuthCredentialVerifierBackendService
+ *
+ * Responsibilities:
+ * - Resolve credentials for a user from the appropriate repository
+ * - Verify a plaintext password against a stored argon2 hash
+ * - Validate a password against the password policy rules
+ *
+ * This service does NOT:
+ * - Manage sessions (that's AuthSessionStore)
+ * - Issue tokens (that's AuthTokenIssuer)
+ * - Audit log (that's the orchestrator's job — TRAP 13)
+ * - Know about the authentication flow (that's the orchestrator's job)
+ */
+let AuthCredentialVerifierBackendService = class AuthCredentialVerifierBackendService {
+    static { AuthCredentialVerifierBackendService_1 = this; }
+    logger;
+    errorBuilder;
+    servicesRegistryHandler;
+    repositoriesRegistryHandler;
+    logDebug;
+    constructor(logger, errorBuilder, servicesRegistryHandler, repositoriesRegistryHandler) {
+        this.logger = logger;
+        this.errorBuilder = errorBuilder;
+        this.servicesRegistryHandler = servicesRegistryHandler;
+        this.repositoriesRegistryHandler = repositoriesRegistryHandler;
+        this.logDebug = this.logger.debugByType('AuthCredentialVerifier');
+        this.logger.setDebugTypeLogging('AuthCredentialVerifier', false);
+    }
+    /**
+     * Resolve credentials for a user.
+     * Returns the credential record (with passwordHash) or null if not found.
+     */
+    async resolveCredentials(ec, userId) {
+        const credentialsRepository = this.repositoriesRegistryHandler.getRepositoryOrThrow(CoreResourceType.USER_CREDENTIALS);
+        return credentialsRepository.read(ec, { userId });
+    }
+    /**
+     * Verify a plaintext password against an argon2 hash.
+     * Returns true if the password matches, false otherwise.
+     *
+     * TRAP 3: This method does NOT enforce password policy.
+     * Password policy is only enforced at creation/change time, never at verification time.
+     * A user who set a password before a policy change can still log in.
+     */
+    async verifyPassword(passwordHash, plaintext) {
+        try {
+            return await argon2.verify(passwordHash, plaintext);
+        }
+        catch (error) {
+            this.logger.error('Password verification failed (argon2 error)', {
+                error: error instanceof Error ? error.message : String(error),
+            });
+            return false;
+        }
+    }
+    /**
+     * Validate a password against the password policy rules.
+     * Used at password creation/change time, NOT at login verification.
+     *
+     * TRAP 3: Never call this during login verification.
+     *
+     * Delegates to AuthUtils.validatePasswordAgainstPolicy (saas-models) for single source of truth.
+     */
+    validatePasswordPolicy(password, rules) {
+        const effectiveRules = rules ?? PasswordPolicyRulesSchema.parse({});
+        return AuthUtils.validatePasswordAgainstPolicy(password, effectiveRules);
+    }
+    static ARGON2_TYPE_MAP = {
+        [Argon2Type.ARGON2D]: argon2.argon2d,
+        [Argon2Type.ARGON2I]: argon2.argon2i,
+        [Argon2Type.ARGON2ID]: argon2.argon2id,
+    };
+    /**
+     * Hash a plaintext password using argon2.
+     * Reads hashing config from the auth configuration.
+     * Only argon2 is implemented.
+     */
+    async hashPassword(plaintext, hashing) {
+        const hashOptions = {
+            type: argon2.argon2id,
+        };
+        if (hashing?.argon2) {
+            const a2Conf = hashing.argon2;
+            hashOptions.type = AuthCredentialVerifierBackendService_1.ARGON2_TYPE_MAP[a2Conf.type] ?? argon2.argon2id;
+            if (a2Conf.memoryCost)
+                hashOptions.memoryCost = a2Conf.memoryCost;
+            if (a2Conf.timeCost)
+                hashOptions.timeCost = a2Conf.timeCost;
+            if (a2Conf.parallelism)
+                hashOptions.parallelism = a2Conf.parallelism;
+        }
+        return argon2.hash(plaintext, hashOptions);
+    }
+    /**
+     * Update the password hash for a user.
+     * Sets `passwordChangedAt` to current time so refresh tokens issued before
+     * this point can be rejected (C4 fix).
+     */
+    async updatePasswordHash(ec, userId, newPasswordHash) {
+        await this.servicesRegistryHandler.update(CoreResourceType.USER_CREDENTIALS, ec, { userId: userId }, {
+            passwordHash: newPasswordHash,
+            passwordChangedAt: new Date(),
+        });
+    }
+};
+AuthCredentialVerifierBackendService = AuthCredentialVerifierBackendService_1 = __decorate([
+    injectable(),
+    __param(0, inject(SAAS_SERVICE_TYPES.Logger)),
+    __param(1, inject(SAAS_SERVICE_TYPES.ErrorBuilderService)),
+    __param(2, inject(SAAS_SERVICE_TYPES.ServicesRegistryHandlerService)),
+    __param(3, inject(SAAS_SERVICE_TYPES.RepositoriesRegistryHandlerService)),
+    __metadata("design:paramtypes", [LoggerService,
+        ErrorBuilderBackendService, Function, Function])
+], AuthCredentialVerifierBackendService);
+export { AuthCredentialVerifierBackendService };
+//# sourceMappingURL=auth-credential-verifier.backend.service.js.map

package/dist/esm/security/authentications/services/auth-credential-verifier.backend.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-credential-verifier.backend.service.js","sourceRoot":"","sources":["../../../../../src/security/authentications/services/auth-credential-verifier.backend.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;AAAA,OAAO,kBAAkB,CAAC;AAC1B,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAC/C,OAAO,KAAK,MAAM,MAAM,QAAQ,CAAC;AACjC,OAAO,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AACpF,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAC7F,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAG9G,OAAO,EACL,SAAS,EACT,gBAAgB,GAIjB,MAAM,uBAAuB,CAAC;AAG/B,OAAO,EAAE,UAAU,EAAE,MAAM,6DAA6D,CAAC;AACzF,OAAO,EAAE,yBAAyB,EAA4B,MAAM,uBAAuB,CAAC;AAU5F;;;;;;;;;;;;;GAaG;AAEI,IAAM,oCAAoC,GAA1C,MAAM,oCAAoC;;IAIO;IACa;IACW;IACI;IANjE,QAAQ,CAA+D;IAExF,YACsD,MAAqB,EACR,YAAwC,EAC7B,uBAA8D,EAC1D,2BAAsE;QAHlG,WAAM,GAAN,MAAM,CAAe;QACR,iBAAY,GAAZ,YAAY,CAA4B;QAC7B,4BAAuB,GAAvB,uBAAuB,CAAuC;QAC1D,gCAA2B,GAA3B,2BAA2B,CAA2C;QAEtJ,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,wBAAwB,CAAC,CAAC;QAClE,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,wBAAwB,EAAE,KAAK,CAAC,CAAC;IACnE,CAAC;IAED;;;OAGG;IACI,KAAK,CAAC,kBAAkB,CAC7B,EAAyB,EACzB,MAAc;QAEd,MAAM,qBAAqB,GAAG,IAAI,CAAC,2BAA2B,CAAC,oBAAoB,CAAC,gBAAgB,CAAC,gBAAgB,CAAC,CAAC;QACvH,OAAO,qBAAqB,CAAC,IAAI,CAAkB,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;IACrE,CAAC;IAED;;;;;;;OAOG;IACI,KAAK,CAAC,cAAc,CAAC,YAAoB,EAAE,SAAiB;QACjE,IAAI,CAAC;YACH,OAAO,MAAM,MAAM,CAAC,MAAM,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;QACtD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,6CAA6C,EAAE;gBAC/D,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;aAC9D,CAAC,CAAC;YACH,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED;;;;;;;OAOG;IACI,sBAAsB,CAC3B,QAAgB,EAChB,KAA2B;QAE3B,MAAM,cAAc,GAAG,KAAK,IAAI,yBAAyB,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACpE,OAAO,SAAS,CAAC,6BAA6B,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC;IAC3E,CAAC;IAEO,MAAM,CAAU,eAAe,GAA8B;QACnE,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,OAAO;QACpC,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,OAAO;QACpC,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ;KACvC,CAAC;IAEF;;;;OAIG;IACI,KAAK,CAAC,YAAY,CAAC,SAAiB,EAAE,OAAyB;QACpE,MAAM,WAAW,GAAmB;YAClC,IAAI,EAAE,MAAM,CAAC,QAAQ;SACtB,CAAC;QAEF,IAAI,OAAO,EAAE,MAAM,EAAE,CAAC;YACpB,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;YAC9B,WAAW,CAAC,IAAI,GAAG,sCAAoC,CAAC,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC;YACxG,IAAI,MAAM,CAAC,UAAU;gBAAE,WAAW,CAAC,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC;YAClE,IAAI,MAAM,CAAC,QAAQ;gBAAE,WAAW,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;YAC5D,IAAI,MAAM,CAAC,WAAW;gBAAE,WAAW,CAAC,WAAW,GAAG,MAAM,CAAC,WAAW,CAAC;QACvE,CAAC;QAED,OAAO,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;IAC7C,CAAC;IAED;;;;OAIG;IACI,KAAK,CAAC,kBAAkB,CAC7B,EAAyB,EACzB,MAAc,EACd,eAAuB;QAEvB,MAAM,IAAI,CAAC,uBAAuB,CAAC,MAAM,CAAC,gBAAgB,CAAC,gBAAgB,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE;YACnG,YAAY,EAAE,eAAe;YAC7B,iBAAiB,EAAE,IAAI,IAAI,EAAE;SAC9B,CAAC,CAAC;IACL,CAAC;;AArGU,oCAAoC;IADhD,UAAU,EAAE;IAKR,WAAA,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAA;IACjC,WAAA,MAAM,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,CAAA;IAC9C,WAAA,MAAM,CAAC,kBAAkB,CAAC,8BAA8B,CAAC,CAAA;IACzD,WAAA,MAAM,CAAC,kBAAkB,CAAC,kCAAkC,CAAC,CAAA;qCAHF,aAAa;QACM,0BAA0B;GALhG,oCAAoC,CAuGhD"}